Analyzing...
|
File Name:   stealer.exe
SHA1:   bea1bfaa0192020c9f12a720072b5cacac9fbd11
MD5:   604bf451df3e73c36ce073a0550d6673
First Seen Date:  2015-09-19 09:47:04.658000 ( )
Number of Clients Seen:   6
Last Analysis Date:  2016-04-08 14:42:23.860928 ( )
Human Expert Analysis Date:  2016-04-08 19:35:03.941603 ( )Human Expert Analysis Result:   Malware
Analysis Summary
Analysis Type | Date | Verdict | |
---|---|---|---|
Signature Based Detection | 2016-04-08 14:42:23.860928 | Malware | |
Static Analysis Overall Verdict | 2016-04-08 14:42:23.860928 | No Threat Found | help |
Dynamic Analysis Overall Verdict | 2016-04-08 14:42:23.860928 | Highly Suspicious | |
Human Expert Analysis Overall Verdict | 2016-04-08 19:35:03.941603 | Malware |
Static Analysis
Static Analysis Overall Verdict | Result |
---|---|
No Threat Found | help |
Detector | Result | |
---|---|---|
Optional Header LoaderFlags field is valued illegal | Clean | |
Non-ascii or empty section names detected | Suspicious | |
Illegal size of optional Header | Clean | |
Packer detection on signature database | Unknown | help |
Based on the sections entropy check! file is possibly packed | Clean | |
Timestamp value suspicious | Suspicious | |
Header Checksum is zero! | Suspicious | |
Enrty point is outside the 1st(.code) section! Binary is possibly packed | Clean | |
Optional Header NumberOfRvaAndSizes field is valued illegal | Clean | |
Anti-vm present | Suspicious | |
The Size Of Raw data is valued illegal! Binary might crash your disassembler/debugger | Clean | |
TLS callback functions array detected | Suspicious |
Dynamic Analysis
Dynamic Analysis Overall Verdict | Result |
---|---|
Highly Suspicious |
Suspicious Behaviors | |
---|---|
Creates a child process | |
Writes to address space of another process | |
Reads memory of another process | |
Creates manual DNS entries | |
Executes another application | |
Opens a file in a system directory | |
Has no visible windows |
Behavioral Information
C:\sample
C:\Users\win7\AppData\Local\Temp\is-AFQM3.tmp\_isetup\_RegDLL.tmp
C:\Users\win7\AppData\Local\Temp\is-AFQM3.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-AFQM3.tmp\_isetup\_shfoldr.dll
C:\Windows\Fonts\staticcache.dat
http://go.microsoft.com/fwlink/?linkid=182804
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\trl.txt
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\tvl.txt
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Fonts\segoeui.ttf
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Fonts\segoeuil.ttf
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Fonts\seguisb.ttf
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\APTAT.Application.exe.config
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\APTAT.Application.exe
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\APTAT.Bootstrapper.exe
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\cmdapt64.exe
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\cmdapt86.exe
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\APTAT.Core.dll
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\FluentValidation.dll
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Microsoft.ReportViewer.Common.dll
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Microsoft.ReportViewer.DataVisualization.dll
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Microsoft.ReportViewer.ProcessingObjectModel.dll
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Microsoft.ReportViewer.WinForms.dll
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Newtonsoft.Json.dll
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\System.Windows.Interactivity.dll
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Controls.dll
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Controls.FixedDocumentViewers.dll
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Controls.GridView.dll
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Controls.Input.dll
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Controls.Navigation.dll
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Data.dll
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Documents.dll
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Documents.Fixed.dll
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Themes.Windows8.dll
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Zip.dll
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Valkyrie.WebApiProvider.dll
\??\C:\Windows\SysWOW64\ieframe.dll
C:\
C:\Users\win7\AppData\Local\Microsoft\Windows\Caches\cversions.1.db
C:\Users\win7\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000008.db
C:\Users\desktop.ini
C:\Users
C:\Users\win7
C:\Users\win7\AppData
C:\Users\win7\AppData\Local
C:\Users\win7\AppData\Local\Temp
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000
C:\Users\win7\Searches\desktop.ini
C:\Users\win7\Videos\desktop.ini
C:\Users\win7\Contacts\desktop.ini
C:\Users\win7\Favorites\desktop.ini
C:\Users\win7\Downloads\desktop.ini
C:\Users\win7\Links\desktop.ini
C:\Users\win7\Saved Games\desktop.ini
\??\C:\Windows\System32\shdocvw.dll
1.217.399.0_TO_1.217.565.0_MPASDLTA.VDM._P
1.217.399.0_TO_1.217.565.0_MPAVDLTA.VDM._P
C:\Windows\system32\LogFiles\PunkBuster\pbsvc.log
C:\//conf//locale.conf
C:\lang\\ServerControl_.properties
wdmaud.drv
\??\C:\Windows\system32\EhStorShell.dll
\??\C:\Windows\system32\ntshrui.dll
\\.\PIPE\srvsvc
C:\Windows
C:\DesktopOK.ini
__tmp_rar_sfx_access_check_757656
babel.exe
Crypted.exe
C:\Windows\system32\Crypted.exe
C:\Windows\syswow64\kernel32.dll
C:\Windows\syswow64\KERNELBASE.dll
C:\Windows\SysWOW64\ntdll.dll
C:\Users\win7\AppData\Local\Temp\wrapped.sandboxed\cis_temp_a16e2.exe
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat
\\.\Nsi
C:\Windows\system32\rsaenh.dll
C:\Users\win7\AppData\Local\Temp\wrapped.sandboxed\cis_temp_a5a54.exe
C:\\libxml2.dll
C:\Users\win7\AppData\Local\Temp\{4bfc0d50-0417-46a0-ab1e-475fb1a90916}\.ba1\wixextba.dll
C:\Users\win7\AppData\Local\Temp\{4bfc0d50-0417-46a0-ab1e-475fb1a90916}\.ba1\thm.xml
C:\Users\win7\AppData\Local\Temp\{4bfc0d50-0417-46a0-ab1e-475fb1a90916}\.ba1\thm.wxl
C:\Users\win7\AppData\Local\Temp\{4bfc0d50-0417-46a0-ab1e-475fb1a90916}\.ba1\Logo.png
C:\Users\win7\AppData\Local\Temp\{4bfc0d50-0417-46a0-ab1e-475fb1a90916}\.ba1\LogoSide2.png
C:\Users\win7\AppData\Local\Temp\{4bfc0d50-0417-46a0-ab1e-475fb1a90916}\.ba1\BootstrapperApplicationData.xml
C:\Users\win7\AppData\Local\Temp\MorphVOX_Pro_20160404201433.log
C:\Windows\WindowsUpdate.log
C:\Users\win7\AppData\Local\Temp\{4bfc0d50-0417-46a0-ab1e-475fb1a90916}\.be\setup.exe
C:\Users\win7\AppData\Local\Temp\VSD9634.tmp\install.log
C:\Users\win7\AppData\Local\Temp\lui8EE1.tmp\setup.exe
NUL
C:\sample.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch
C:\Users\win7\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\win7\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index1c2.dat
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\140B4CDED8ED877CDC65B54BA965BD39
C:\Users\win7\AppData\Local\Temp\gentee00.tmp
C:\Users\win7\AppData\Local\Temp\gentee00\gentee.dll
C:\Users\win7\AppData\Local\Temp\gentee00\guig.dll
C:\Users\Public
C:\Users\win7\AppData\Roaming
C:\Users\win7\AppData\Roaming\Microsoft\desktop.ini
C:\Users\win7\AppData\Roaming\Microsoft
C:\Users\win7\AppData\Roaming\Microsoft\Windows
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Start Menu
C:\ProgramData
C:\ProgramData\Microsoft\desktop.ini
C:\ProgramData\Microsoft
C:\ProgramData\Microsoft\Windows
C:\ProgramData\Microsoft\Windows\Start Menu
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
C:\ProgramData\Microsoft\Windows\Start Menu\Programs
C:\Windows\Fonts\desktop.ini
C:\Users\win7\AppData\Local\Temp\gentee00\setup_temp.gea
C:\Users\win7\AppData\Local\Temp\gentee00\Default.bmp
C:\Windows\SysWOW64\ieframe.dll
C:\FN.xml
C:\Download\Free Video Converter.exe
C:\ProgramData\IObit\ASCDownloader\Downloader.log
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\thumbnail-100x100[1].png
C:\Download\Free Video Converter.png.dat
C:\Download\Free Video Converter.png
C:\Download\Free Video Converter.jpg
\\.\{CFE68B1E-656A-488B-8077-738CA67BA3A5}
\\.\pipe\GoogleCrashServices\S-1-5-21-3979321414-2393373014-2172761192-1000
C:\ProgramData\d8986107-dff3-4565-a17b-637d7c3968d3\temp
\\.\pipe\OperaCrashReporter2480
C:\installer_prefs.json
C:\Users\win7\AppData\Local\Temp\Opera Installer\opera_installer_20160404230406.log
\\.\C:
\\.\D:
C:\Users\win7\AppData\Local\Temp\Opera Installer\installer.lck
http://www.opera.com/download/get/?partner=www&opsys=Windows
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_A7467B47637944C1E4B4025C763E391F
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0270780F846F08BEFE0DD8112D932FEF
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E4F76C0C82655FD6506668127FA0ACD1_F6AB1C86FB0C74897AC7F2CB403CFB96
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E4F76C0C82655FD6506668127FA0ACD1_CDD1BCAFC964EE6D17D60D9802FE2583
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D0EAFE99DD0474CD3DF1720DC4B3759
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C911EABD82D65947049C32F9037AA0E0
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E4F76C0C82655FD6506668127FA0ACD1_F6AB1C86FB0C74897AC7F2CB403CFB96
C:\Users\win7\AppData\Local\Temp\Opera Installer\opera_installer_20160404230405.exe
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\Opera_36.0.2130.59_Setup[1].exe
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_3F584A3392BB586FC541F0F81FC9D443
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2659C1A560AB92C9C29D4B2B25815AE8
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_EDB66B901A72087123FA294684FE200A
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_82ECB2AA2A64A56FD6DF03971CF2DA6B
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\782AC1F7D5B160B0F71F6F92B0912799
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6E47DC54834F661FE77B461D2DF73D9D
CONIN$
1.217.500.0_TO_1.217.576.0_MPASDLTA.VDM._P
1.217.500.0_TO_1.217.576.0_MPAVDLTA.VDM._P
C:\Users\win7\AppData\Local\Temp\\PDApp.log
1.217.523.0_TO_1.217.576.0_MPASDLTA.VDM._P
1.217.523.0_TO_1.217.576.0_MPAVDLTA.VDM._P
C:\ProgramData\78a595fd-df95-40de-93ec-d80a00f25811\temp
C:\Users\win7\AppData\Local\Temp\GLK3967.tmp
C:\Users\win7\AppData\Local\Temp\~GLH0000.TMP
C:\Users\win7\AppData\Local\Temp\GLF3DC~1.EXE
\\?\C:\Windows\system32\Macromed\Flash\ss.sgn
\\?\C:\Windows\system32\Macromed\Flash\ss.cfg
\\?\C:\Windows\system32\Macromed\Flash\mms.cfg
\\?\C:\Windows\system32\mms.cfg
\\?\C:\Windows\system32\Macromed\Flash\oem.cfg
\\?\C:\Windows\system32\oem.cfg
\\?\C:\Users\win7\AppData\Roaming\Adobe\Flash Player\AssetCache
\\?\C:\Users\win7\AppData\Roaming\Adobe\Flash Player
\\?\C:\Users\win7\AppData\Roaming\Adobe\Flash Player\AssetCache\HZ5CA82N
\\?\C:\Users\win7\AppData\Roaming\Macromedia\Flash Player\#SharedObjects
\\?\C:\Users\win7\AppData\Roaming\Macromedia\Flash Player
\\?\C:\Users\win7\AppData\Roaming\Macromedia
\\?\C:\Users\win7\AppData\Roaming
\\?\C:\Users\win7\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\ANNE248V
\\?\C:\Users\win7\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\ANNE248V\localhost\sample\Ram.sol
\\?\C:\Users\win7\AppData\Roaming\Macromedia\Flash Player\localhost\sample\Ram.sol
\\?\C:\Users\win7\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\ANNE248V\macromedia.com\support\flashplayer\sys\#local\settings.sol
\\?\C:\Users\win7\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#local\settings.sol
\\?\C:\Users\win7\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#local
\\?\C:\Users\win7\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys
\\?\C:\Users\win7\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer
\\?\C:\Users\win7\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support
\\?\C:\Users\win7\AppData\Roaming\Macromedia\Flash Player\macromedia.com
\\?\C:\Users\win7\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#local\settings.sxx
\\?\C:\Users\win7\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\ANNE248V\macromedia.com\support\flashplayer\sys\settings.sol
\\?\C:\Users\win7\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol
\\?\C:\Users\win7\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx
\\?\C:\Users\win7\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\ANNE248V\localhost\sample
\\?\C:\Users\win7\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\ANNE248V\localhost
\\?\C:\Users\win7\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\ANNE248V\localhost\sample\Ram.sxx
C:\Users\win7\AppData\Local\Temp\nsn3B7E.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\nsn3B7E.tmp\UAC.dll
C:\Users\win7\AppData\Local\Temp\nsn3B7E.tmp\options.ini
C:\Users\win7\AppData\Local\Temp\nsn3B7E.tmp\shortcuts.ini
C:\Users\win7\AppData\Local\Temp\nsn3B7E.tmp\components.ini
C:\Users\win7\AppData\Local\Temp\nsn3B7E.tmp\summary.ini
C:\Users\win7\AppData\Local\Temp\nsn3B7E.tmp\ioSpecial.ini
C:\Users\win7\AppData\Local\Temp\nsn3B7E.tmp\modern-wizard.bmp
C:\Users\win7\AppData\Local\Temp\nsn3B7E.tmp\modern-header.bmp
C:\Users\win7\AppData\Local\Temp\nsn3B7E.tmp\InstallOptions.dll
C:\Windows\system32\wbem\XSL-Mappings.xml
C:\Windows\system32\wbem\textvaluelist.xsl
C:\Users\win7\AppData\Local\Temp\nssB12F.tmp\modern-header.bmp
C:\Users\win7\AppData\Local\Temp\nssB12F.tmp\modern-wizard.bmp
C:\Users\win7\AppData\Local\Temp\nssB12F.tmp\ButtonEvent.dll
C:\Users\win7\AppData\Local\Temp\nssB12F.tmp\nsDialogs.dll
C:\Users\win7\AppData\Local\Temp\nssB12F.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\nssB12F.tmp\nsExec.dll
C:\Users\win7\AppData\Local\Temp\nsw913F.tmp\UserInfo.dll
C:\Users\win7\AppData\Local\Temp\CACE_Banner.htm
C:\Users\win7\AppData\Local\Temp\CACE_Logo.gif
C:\Users\win7\AppData\Local\Temp\NetSol.jpg
C:\Users\win7\AppData\Local\Temp\nsw913F.tmp\ioSpecial.ini
C:\Users\win7\AppData\Local\Temp\nsw913F.tmp\modern-wizard.bmp
C:\Users\win7\AppData\Local\Temp\nsw913F.tmp\modern-header.bmp
C:\Users\win7\AppData\Local\Temp\nsw913F.tmp\nsWeb.dll
C:\Users\win7\AppData\Local\Temp\aiw751453.bmp
C:\Users\win7\AppData\Local\Temp\aaiw751454.bmp
C:\Users\win7\AppData\Local\Temp\aaiw751455.bmp
C:\Users\win7\AppData\Local\Temp\aaiw751456.bmp
C:\Windows\Cat Karat Packet Builder Uninstaller.exe
C:\Users\win7\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Cat Karat Packet Builder\Cat Karat Packet Builder Uninstaller.lnk
C:\Users\win7\Desktop\Karat.lnk
C:\Users\win7\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Cat Karat Packet Builder\Karat.lnk
C:\Users\win7\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Cat Karat Packet Builder\scr.txt.lnk
C:\Users\win7\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Cat Karat Packet Builder\License Agreement.doc.lnk
C:\Users\win7\AppData\Local\Temp\aaiw751457.bmp
1.217.515.0_TO_1.217.599.0_MPASDLTA.VDM._P
1.217.515.0_TO_1.217.599.0_MPAVDLTA.VDM._P
C:\Users\win7\AppData\Local\Temp\wbxtra_04052016_005917.wbt
C:\Users\win7\AppData\Local\Temp\\Fonts\Roboto_Light.ttf
C:\Users\win7\AppData\Local\Temp\\Fonts\Roboto_Regular.ttf
C:\Users\win7\AppData\Local\Temp\\Fonts\Roboto_Thin.ttf
C:\ProgramData\IObit\ASCDownloader\ASCInstaller_Downloader.log
C:\Users\win7\AppData\Local\Temp\_MSI5166._IS
C:\Setup.INI
C:\0x0000.ini
MPASDLTA.VDM
MPAVDLTA.VDM
C:\Users\win7\AppData\Local\Temp\fraps\setup.exe
C:\Users\win7\AppData\Local\Temp\nsh1B64.tmp
C:\Users\win7\AppData\Local\Temp\beepa.bmp
C:\Users\win7\AppData\Local\Temp\nsx1B75.tmp\AdvSplash.dll
C:\Users\win7\AppData\Local\Temp\beepa.wav.WAV
C:\Users\win7\AppData\Local\Temp\nsx1B75.tmp\StartMenu.dll
CONOUT$
C:\Windows\system32\wbem\wbemdisp.TLB
C:\Windows\SysWOW64\stdole2.tlb
\\.\PhysicalDrive0
C:\Users\win7\Downloads
C:\Users\win7\Desktop
C:\Users\Public\Desktop
C:\Users\win7\Links
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Libraries
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms
C:\Users\Public\Videos\desktop.ini
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms
\??\C:\Windows\system32\NetworkExplorer.dll
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms
\\.\PIPE\samr
C:\Users\win7\Links\Desktop.lnk
C:\Users\win7\Links\Downloads.lnk
C:\Users\win7\Links\RecentPlaces.lnk
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini
\\.\VBoxGuest
\\.\VBoxMiniRdrDN
\\.\PIPE\wkssvc
\\.\PIPE\DAV RPC SERVICE
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Network Shortcuts\desktop.ini
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Network Shortcuts
C:\\.install4j\pref_jre.cfg
C:\\.install4j\inst_jre.cfg
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_E9915110418DBDEA47BB3BFCDB24CFF1
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F
C:\Users\win7\AppData\Local\Temp\nsvA7A0.tmp
C:\Users\win7\AppData\Local\Temp\nsbA7C1.tmp\LangDLL.dll
C:\Users\win7\AppData\Local\Temp\nsbA7C1.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\nsbA7C1.tmp\FindProcDLL.dll
C:\Users\win7\AppData\Local\Temp\nsbA7C1.tmp\modern-header.bmp
C:\Users\win7\AppData\Local\Temp\nsbA7C1.tmp\modern-wizard.bmp
C:\Users\win7\AppData\Local\Temp\nsbA7C1.tmp\nsDialogs.dll
C:\Users\win7\AppData\Local\Temp\nsbA7C1.tmp\w7tbp.dll
C:\WeChatPortable\WeChatPortable.exe
C:\WeChatPortable\App\AndroidServer\1.0.0.460\AdbCmdServer.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\AdbWinApi.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\AdbWinUsbApi.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\AndroidDaemon.exe
C:\WeChatPortable\App\AndroidServer\1.0.0.460\AndroidDevice.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\AndroidServer.exe
C:\WeChatPortable\App\AndroidServer\1.0.0.460\AndroidServerUp.exe
C:\WeChatPortable\App\AndroidServer\1.0.0.460\AsyncTask.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\Common.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\ConnectManager.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\ConnectUI.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\Daemon.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\DaemonProxy.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\DebugModeBrand.brand
C:\WeChatPortable\App\AndroidServer\1.0.0.460\DebugModeConfigV2.xml
C:\WeChatPortable\App\AndroidServer\1.0.0.460\DeviceDesc.xml
C:\WeChatPortable\App\AndroidServer\1.0.0.460\DriverTools.exe
C:\WeChatPortable\App\AndroidServer\1.0.0.460\DriverToolsX64.exe
C:\WeChatPortable\App\AndroidServer\1.0.0.460\GF.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\Log4cplus.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\NetHub.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\QQPMIpc.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\RubikEngine.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\SdkClient.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\TADInstaller.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\UnReDevice.xml
C:\WeChatPortable\App\AndroidServer\1.0.0.460\am5tools
C:\WeChatPortable\App\AndroidServer\1.0.0.460\arkFS.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\arkGraphic.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\arkIOStub.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\arkImage.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\atl100.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\bugreport.exe
C:\WeChatPortable\App\AndroidServer\1.0.0.460\jwlxtzqn.xml
C:\WeChatPortable\App\AndroidServer\1.0.0.460\jwlxtzqnui.xml
C:\WeChatPortable\App\AndroidServer\1.0.0.460\libexpatw.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\libimagequant.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\libjpegturbo.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\libpng.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\libtcmalloc.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\lua.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\maMainFrame.rdb
C:\WeChatPortable\App\AndroidServer\1.0.0.460\maMainFrame.tpc
C:\WeChatPortable\App\AndroidServer\1.0.0.460\main.properties
C:\WeChatPortable\App\AndroidServer\1.0.0.460\mdb.exe
C:\WeChatPortable\App\AndroidServer\1.0.0.460\msvcp100.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\msvcr100.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\sqlite.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\tadb.exe
C:\WeChatPortable\App\AndroidServer\1.0.0.460\tinyxml.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\xGraphic32.dll
C:\WeChatPortable\App\AndroidServer\1.0.0.460\zlib.dll
C:\WeChatPortable\App\AppInfo\appicon.ico
C:\WeChatPortable\App\AppInfo\appicon_128.png
C:\WeChatPortable\App\AppInfo\appicon_16.png
C:\WeChatPortable\App\AppInfo\appicon_32.png
C:\WeChatPortable\App\AppInfo\appinfo.ini
C:\WeChatPortable\App\AppInfo\Launcher\WeChatPortable.ini
C:\WeChatPortable\App\QQPhoneManager\Components\QQDownload.zip
C:\WeChatPortable\App\QQPhoneManager\Components\QQDownload\DownloadProxyPS.dll
C:\WeChatPortable\App\QQPhoneManager\Components\QQDownload\Tencentdl.exe
C:\WeChatPortable\App\QQPhoneManager\Components\QQDownload\dlcore.dll
C:\WeChatPortable\App\QQPhoneManager\Components\QQDownload\extract.dll
C:\WeChatPortable\App\QQPhoneManager\Components\QQDownload\tnproxy.dll
C:\WeChatPortable\App\WeChat\AndroidAssistHelper.dll
C:\WeChatPortable\App\WeChat\PrScrn.dll
C:\WeChatPortable\App\WeChat\VoipEngine.dll
C:\WeChatPortable\App\WeChat\WeChat.exe
C:\WeChatPortable\App\WeChat\WeChatResource.dll
C:\WeChatPortable\App\WeChat\WechatUpdate.exe
C:\WeChatPortable\App\WeChat\avcodec-56.dll
C:\WeChatPortable\App\WeChat\avformat-56.dll
C:\WeChatPortable\App\WeChat\avutil-54.dll
C:\WeChatPortable\App\WeChat\bugreport.exe
C:\WeChatPortable\App\WeChat\directui license.txt
C:\WeChatPortable\App\WeChat\duilib license.txt
C:\WeChatPortable\App\WeChat\improve.xml
C:\WeChatPortable\App\WeChat\swresample-1.dll
C:\WeChatPortable\App\WeChat\swscale-3.dll
C:\WeChatPortable\App\WeChat\tinyxml.dll
C:\ProgramData\8f23bb0e-d21d-43d3-bd7b-a0fba15a3b5e\temp
C:\Windows\system32\l_intl.nls
C:\Windows\assembly\pubpol1.dat
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\win7\AppData\Local\Temp\nslFB7E.tmp\System.dll
C:\ProgramData\48ed1695-d484-472b-bd42-582714ef1368\temp
C:\Windows\System32\drivers\etc\services
C:\Users\win7\AppData\Local\Temp\00109f4f.a
C:\Users\win7\AppData\Local\Temp\0010a5e6.a
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\index[1]
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\wrapper[1]
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\normal_bg[1]
C:\Users\win7\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT
C:\WINDOWS\FONTS\VERDANAB.TTF
C:\WINDOWS\FONTS\VERDANA.TTF
C:\WINDOWS\FONTS\TAHOMA.TTF
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\appImg[1]
C:\WINDOWS\FONTS\SEGUISYM.TTF
C:\Users\win7\AppData\Local\Temp\1091578\dlreport
C:\Users\win7\AppData\LocalLow\Yahoo! Companion\Data\default
C:\Users\win7\AppData\Local\Temp\nstEE00.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\nstEE00.tmp\ioSpecial.ini
C:\Users\win7\AppData\Local\Temp\nstEE00.tmp\modern-wizard.bmp
C:\Users\win7\AppData\Local\Temp\nstEE00.tmp\modern-header.bmp
C:\Users\win7\AppData\Local\Temp\nstEE00.tmp\InstallOptions.dll
C:\Users\win7\AppData\Local\Temp\is-VDQD0.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-VDQD0.tmp\_isetup\_shfoldr.dll
C:\Windows\system32
\\.\SICE
\\.\SIWVID
\\.\NTICE
C:\app\gfriend.exe
<NULL>
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D47DBD2F9E3365FBBE008D71FB06716F_BBB35F3D100606CE5776FB7E4248C8F3
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5
C:\Users\win7\AppData\Local\Temp\SETUP_19714\Setup.txt
C:\Users\win7\AppData\Local\Temp\SETUP_19714\Engine.exe
C:\Users\win7\AppData\Local\Temp\SETUP_19714\Autochartist_AlpariNZ.qsp
C:\Users\win7\AppData\Local\Temp\SETUP_19714\AutochartistPlugin_AutoUpdaterAlpari.original
C:\Users\win7\AppData\Local\Temp\SETUP_19714\Modern_Setup.bmp
C:\Users\win7\AppData\Local\Temp\SETUP_19714\Modern_Icon.bmp
C:\Users\win7\AppData\Local\Temp\SETUP_19714\disclaimer.rtf
C:\Users\win7\AppData\Local\Temp\SETUP_19714\ac-set-up.bmp
C:\Users\win7\AppData\Local\Temp\SETUP_19714\small.bmp
C:\Users\win7\AppData\Local\Temp\SETUP_19714\logo.bmp
C:\Users\win7\AppData\Local\Temp\SETUP_19714\English.lng
C:\Users\win7\AppData\Local\Temp\SETUP_19714\French.lng
C:\Users\win7\AppData\Local\Temp\SETUP_19714\German.lng
C:\Users\win7\AppData\Local\Temp\SETUP_19714\Greek.lng
C:\Users\win7\AppData\Local\Temp\SETUP_19714\Hungarian.lng
C:\Users\win7\AppData\Local\Temp\SETUP_19714\Indonesian.lng
C:\Users\win7\AppData\Local\Temp\SETUP_19714\Russian.lng
C:\Users\win7\AppData\Local\Temp\SETUP_19714\Spanish.lng
C:\Users\win7\AppData\Local\Temp\SETUP_19714\Turkish.lng
C:\Users\win7\AppData\Local\Temp\SETUP_19714\InstallationFolderDetector.exe
C:\Users\win7\AppData\Local\Temp\SETUP_19714\Autochartist.tpl
C:\Users\win7\AppData\Local\Temp\SETUP_19714\Default.tpl
C:\Users\win7\AppData\Local\Temp\SETUP_19714\00000#Autochartist Chart Patterns.ex4
C:\Users\win7\AppData\Local\Temp\SETUP_19714\00001#Autochartist Fibonacci Patterns.ex4
C:\Users\win7\AppData\Local\Temp\SETUP_19714\00002#Autochartist Key Levels.ex4
C:\Users\win7\AppData\Local\Temp\SETUP_19714\00003#Autochartist Market Reports.ex4
C:\Users\win7\AppData\Local\Temp\SETUP_19714\00004#Autochartist Volatility.ex4
C:\Users\win7\AppData\Local\Temp\SETUP_19714\00005#Autochartist Web Application.ex4
C:\Users\win7\AppData\Local\Temp\SETUP_19714\00006#AutochartistLibrary.ex4
C:\Users\win7\AppData\Local\Temp\SETUP_19714\00007#stdcall_ChartPatterns.dll
C:\Users\win7\AppData\Local\Temp\SETUP_19714\00007#stdcall_ChartPatterns.dll.00002
C:\Users\win7\AppData\Local\Temp\nss3CD5.tmp
C:\Users\win7\AppData\Local\Temp\nsy3CF6.tmp\npeNSISUtil.dll
C:\Users\win7\AppData\Local\Temp\nsy3CF6.tmp\System.dll
C:\Windows\Downloaded Program Files\npenkIEInstall5.dll
C:\Windows\Downloaded Program Files\npenkIEInstall5.inf
C:\Windows\Downloaded Program Files\npenkIEInstall5x64.dll
C:\Windows\Downloaded Program Files\npenkIEInstall5x64.inf
C:\ProgramData\c00fd789-4044-4a32-8a4f-7d731dbdc0d1\temp
C:\Users\win7\AppData\Roaming\Juniper Networks
C:\Users\win7\AppData\Roaming\Juniper Networks\Logging
C:\Users\win7\AppData\Roaming\Juniper Networks\Logging\debuglog.log
C:\Users\win7\AppData\Roaming\Juniper Networks\Setup Client\JuniperSetupClient.ini
C:\JuniperSetupAutoupgrade.param
C:\toolbar.png
C:\toolbar.bmp
Users.txt
HotFolders.txt
msrle32.dll
msvidc32.dll
msyuv.dll
iyuv_32.dll
tsbyuv.dll
iccvid.dll
C:\Users\win7\AppData\Local\Temp\\{EC92633C-8F08-470A-BCDF-3FE5FD778C8D}\AutodeskDownloadManager.msi
C:\Users\win7\AppData\Local\Temp\AutodeskDownloadManager00000.log
C:\ProgramData\Applications\Cache\{EC92633C-8F08-470A-BCDF-3FE5FD778C8D}v4.0.14.0.msi
C:\English.txt
C:\Users\win7\AppData\Local\GDIPFONTCACHEV1.DAT
C:\WINDOWS\FONTS\ARIAL.TTF
C:\WINDOWS\FONTS\ARIALBD.TTF
C:\WINDOWS\FONTS\ARIALI.TTF
C:\WINDOWS\FONTS\ARIALBI.TTF
C:\WINDOWS\FONTS\MSJH.TTF
C:\WINDOWS\FONTS\MSYH.TTF
C:\WINDOWS\FONTS\MALGUN.TTF
C:\WINDOWS\FONTS\MICROSS.TTF
C:\WINDOWS\FONTS\SEGOEUI.TTF
C:\ProgramData\COMODO\CSB\Syslog.log
C:\Users\win7\AppData\Local\Temp\comodo_temp_setup\csb_installer.exe
C:\Users\win7\AppData\Local\Temp\is-PUU28.tmp\_isetup\_RegDLL.tmp
C:\Users\win7\AppData\Local\Temp\is-PUU28.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-PUU28.tmp\_isetup\_shfoldr.dll
C:\ProgramData\COMODO\CSB\integrity.log
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D237426009EE0F53ADECD7FCEBA7288C_97325C0F99E0D4A128C98C1EE254C1B7
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D237426009EE0F53ADECD7FCEBA7288C_97325C0F99E0D4A128C98C1EE254C1B7
C:\Users\win7\AppData\Local\Temp\be0d60d3-fb0d-11e5-9e88-08002763e612\target.zip_be0d60d4-fb0d-11e5-9e88-08002763e612
C:\Users\win7\AppData\Local\Temp\VSDDADB.tmp\install.log
PowerPointInteractiveGuideSetupEN.msi
C:\Users\win7\AppData\Local\Temp\GLJ17F8.tmp
C:\Users\win7\AppData\Local\Temp\GLG2393.tmp
C:\Windows\system32\GLBSINST.%$D
C:\Users\win7\AppData\Local\Temp\~GLH0001.TMP
C:\Users\win7\AppData\Local\Temp\BlasterEULA.txt
C:\Windows\system32\ChSuite.ocx
C:\Windows\system32\~GLH0004.TMP
C:\Windows\ChSuite.ocx
ChSuite.ocx
C:\Windows\system32\temp.000
C:\Windows\system32\~GLH0006.TMP
C:\Windows\system32\hcwblast.ocx
C:\Windows\system32\~GLH0007.TMP
C:\Windows\system32\~GLH0008.TMP
C:\Windows\~GLH0009.TMP
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hauppauge WinTV\BlastCfg.lnk
C:\Windows\System32\ChSuite.ocx
\\.\BCMDMCCP
C:\sfmsi.dat
C:\Users\win7\AppData\Local\Temp\nsq2CBE.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\~nsu.tmp\Au_.exe
C:\Users\win7\AppData\Local\Temp\nsw2EB1.tmp
C:\Users\win7\AppData\Local\Temp\nsb2ED1.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\WIN7-PC-20160405-1354.log
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\BN4ZCNYC.txt
C:\Users\win7\AppData\Local\Microsoft\Office\16.0\sample_Rules.xml
C:\Users\win7\AppData\Local\Temp\OfficeC2R0F488821-BA95-4F00-8981-81A4773CF2EE\v32.cab
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759AD
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759AD
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7396C420A8E1BC1DA97F1AF0D10BAD21
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7396C420A8E1BC1DA97F1AF0D10BAD21
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F90F18257CBB4D84216AC1E1F3BB2C76
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F90F18257CBB4D84216AC1E1F3BB2C76
C:\Users\win7\AppData\Local\Temp\OFFICE~1\v32.cab
C:\Users\win7\AppData\Local\Temp\OfficeC2R0F488821-BA95-4F00-8981-81A4773CF2EEOfficeC2R65F089D7-5B90-4813-9AAF-D42E50464B92\v32.hash
C:\Users\win7\AppData\Local\Temp\OfficeC2R0F488821-BA95-4F00-8981-81A4773CF2EEOfficeC2R65F089D7-5B90-4813-9AAF-D42E50464B92\VersionDescriptor.xml
C:\Users\win7\AppData\Local\Temp\OfficeC2R0F488821-BA95-4F00-8981-81A4773CF2EE\VersionDescriptor.xml
C:\Users\win7\AppData\Local\Temp\IXP000.TMP\wllogin.msi
C:\Users\win7\AppData\Local\Temp\nsj5E22.tmp
C:\Users\win7\AppData\Local\Temp\FPrint.bmp
C:\Users\win7\AppData\Local\Temp\nsz5E33.tmp\AdvSplash.dll
C:\Users\win7\AppData\Local\Temp\FPrint.wav.WAV
C:\Users\win7\AppData\Local\Temp\nsz5E33.tmp\LangDLL.dll
C:\Users\win7\AppData\Local\Temp\nsz5E33.tmp\modern-wizard.bmp
C:\Users\win7\AppData\Local\Temp\is-1C63A.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-1C63A.tmp\_isetup\_shfoldr.dll
C:\Users\win7\AppData\Local\Temp\is-1C63A.tmp\isxdl.dll
C:\Users\win7\AppData\Local\Temp\is-1C63A.tmp\tsmanager.ico
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\YXCY2N06.txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\publicita[1].htm
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\firemonkey[1].htm
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\f[1].txt
C:\Users\win7\AppData\Local\Microsoft\Internet Explorer\DOMStore\KHBIN2T7\marijsoftdevteam.altervista[1].xml
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\O98Z4CN1.txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\f[1].txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\firemonkey[1].htm
C:\Windows\system32\MSHTML.tlb
C:\WINDOWS\FONTS\TIMES.TTF
C:\WINDOWS\FONTS\MARLETT.TTF
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\script[1].js
C:\Windows\media\Windows Navigation Start.wav
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\t2_marijsoftdevteam[1].htm
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\toolbar-font[1].css
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\toolbar-icons[1].css
C:\Windows\system32\ieframe.dll
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\error[1]
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\site[1].css
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\error[1]
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\warning[1]
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\r=1459856096129[1].js
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\lato-regular-webfont[1].eot
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\r=1459856096230[1].js
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\toolbar-font[1].css
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\style[1].css
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\toolbar-icons[1].css
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\.css[1].htm
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\toolbar[1].js
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\828298824EA5549947C17DDABF6871F5_D1BCEE7E304F0D5FB8AA811D9B2D0835
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\828298824EA5549947C17DDABF6871F5_7711FB3A44D1E4EB005F46022D09BCC0
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D7B4E43171BB9E412497B0377F4343E7
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\828298824EA5549947C17DDABF6871F5_D1BCEE7E304F0D5FB8AA811D9B2D0835
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_AB842635E733833DC05096E9A4494FC9
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_FB7D9C6A87003755BD03BA2D675D6CF6
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8A574ED5927B3CEC9626151D220C7448
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_8BB80E6E041620A271AF240901929614
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_1821DFFB454F80FE8537F91C7B2CC258
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_72FBC00613C42227D7780704871FC4AB
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_D0F068A5F5A59137E6AD66733A1CF2CA
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_8BB80E6E041620A271AF240901929614
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_72FBC00613C42227D7780704871FC4AB
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_AB842635E733833DC05096E9A4494FC9
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\f[1].txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\zrt_lookup[1].htm
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\3512845138-ieretrofit[1].js
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\3375562265-css_bundle_v2[1].css
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\8QB428KS.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\UUH783CY.txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\ads[1].htm
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\ads[2].htm
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\win7@google[1].txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\2179604375-comment_from_post_iframe[1].js
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_FB77EF9D078595E536BD66F635E882AE
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_4F2ABCCA92B8223B2E731E1588B0628C
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\icon18_email[1].gif
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\icon18_edit_allbkg[1].gif
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_6DF1A56DDF24C758101CAC4E59DBE10B
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_CCA751700403049CDE8A366B2192A68E
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\[UNSET][1].png
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_FB77EF9D078595E536BD66F635E882AE
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_6DF1A56DDF24C758101CAC4E59DBE10B
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\f[2].txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\8423986820179553253[1].png
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\378784852393342141[1].png
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\91W45OAO.txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\icon[1].png
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\it[1].png
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\plusone[1].js
C:\Windows\system32\spool\drivers\color\sRGB Color Space Profile.icm
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\unnamed[1].jpg
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\s[1].htm
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\s[1].htm
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\googlelogo_color_112x36dp[1].png
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\cb=gapi[1].js
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\icon18_wrench_allbkg[1].png
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\f[2].txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\arrow_dropdown[1].gif
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\subscribe-netvibes[1].png
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\icon_feed12[1].png
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\cb=gapi[1].js
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\f[2].txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\subscribe-yahoo[1].png
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_99550CA4998A44BD4ED12FB54505518D
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_2F0E564780F0A1C12C35F0638A3E7C11
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_99550CA4998A44BD4ED12FB54505518D
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\x_button_blue2[1].png
C:\WINDOWS\FONTS\WINGDING.TTF
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\white80[1].png
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\images[1].jpg
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\blog-post-reactions[1].htm
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\blank[1].htm
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\share_buttons_20_3[1].png
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\1442378207-rx[1].js
C:\WINDOWS\FONTS\TREBUC.TTF
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\navbar[1].htm
C:\Windows\SysWOW64\Dxtmsft.dll
C:\Windows\SysWOW64\Dxtrans.dll
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\navcancl[1]
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\checks_sprite[1].png
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\2Q5KAEQS.txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\ErrorPageTemplate[1]
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\errorPageStrings[1]
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\navcancl[1]
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\ErrorPageTemplate[1]
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\icons_peach[1].png
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\arrows-light[1].png
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\platform_gapi.iframes.style.common[1].js
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\errorPageStrings[1]
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\cb=gapi[1].js
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\cb=gapi[2].js
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\fastbutton[1].htm
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_CA98B3D4179D81FFFA54CFF959AACD67
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_3D45C76D54B7BF3F6C0B22D377433CEF
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\0O3HLJVD.txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\si[1].htm
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_CA98B3D4179D81FFFA54CFF959AACD67
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\postmessageRelay[1].htm
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\cb=gapi[2].js
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\cb=gapi[3].js
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\rpc_shindig_random[1].js
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\si[1].htm
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\618489298-postmessagerelay[1].js
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\cb=gapi[1].js
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\swflash[1].cab
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8828F39C7C0CE9A14B25C7EB321181BA_DC03E45EC7611F50ADAEBABE405A8C4C
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A3D5BF1283C2E63D8C8A8C72F0051F5A
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0972B7C417F696E06E186AEB26286F01_3EAEAB67121169D5C037E4B1278DEA7C
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0972B7C417F696E06E186AEB26286F01_BF6629C8D58F6027ED4272B170DA1F7D
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3D0AC26322348780E90E022EA217C58C
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0972B7C417F696E06E186AEB26286F01_3EAEAB67121169D5C037E4B1278DEA7C
C:\Users\win7\AppData\Local\Temp\CabAEA9\swflash64.inf
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\Y9BM8VUB.HTM
C:\Users\win7\AppData\Local\Microsoft\Internet Explorer\DOMStore\683K235F\www.marijsoftdevteam.blogspot.co[1].xml
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\translateelement[1].css
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\main[1].js
C:\Users\win7\AppData\Local\Temp\000b5b59.a
C:\Users\win7\AppData\Local\Temp\000b6358.a
C:\Users\win7\AppData\Local\Temp\746906\dlreport
C:\Windows\System32
C:\Windows\System32\r
data.dat
\\.\inpoutx64
C:\ProgramData\219d5106-5a99-41fd-b942-db6b503b0178\temp
\\.\pipe\OperaCrashReporter3064
C:\Users\win7\AppData\Local\Temp\Opera Installer\opera_installer_20160405162503.log
C:\Users\win7\AppData\Local\Temp\Opera Installer\opera_installer_20160405162502.exe
C:\Users\win7\AppData\Local\Temp\nswD621.tmp
C:\Users\win7\AppData\Local\Temp\nsbD641.tmp\InstOpt.dll
C:\Users\win7\AppData\Local\Temp\nsbD641.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\nsbD641.tmp\OCSetupHlp.dll
C:\Users\win7\AppData\Local\Temp\nsbD641.tmp\modern-header.bmp
C:\Users\win7\AppData\Local\Temp\nsfEBCE.tmp
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerISO\Uninstall PowerISO.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerISO\PowerISO Help.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerISO\PowerISO.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerISO\PowerISO Virtual Drive Manager.lnk
C:\Users\Public\Desktop\PowerISO.lnk
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\version[1].txt
http://windjview.sourceforge.net/
\\.\pipe\OperaCrashReporter1852
C:\Users\win7\AppData\Local\Temp\Opera Installer\opera_installer_20160405165534.log
C:\Users\win7\AppData\Local\Temp\Opera Installer\opera_installer_20160405165533.exe
C:\Users\win7\AppData\Local\Temp\is-036IG.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-036IG.tmp\_isetup\_shfoldr.dll
torrentex_ic0.1.4c.exe
C:\Users\win7\AppData\Local\Temp\torrentex_ic0.1.4c.exe
C:\Users\win7\AppData\Local\Temp\is-VDDFP.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-VDDFP.tmp\_isetup\_shfoldr.dll
C:\Users\win7\AppData\Local\Temp\ext4A76.tmp
C:\Users\win7\AppData\Local\Temp\wel4A75.tmp
C:\Users\win7\AppData\Local\Temp\ext4A78.tmp
C:\Users\win7\AppData\Roaming\Rockers Team\RT 7 Lite x64\install\rt_7_lite_win7_Vista_x64_sp1.msi
C:\Users\win7\AppData\Local\Temp\MSID92.tmp
C:\Users\win7\AppData\Local\Temp\AI_EXTUI_BIN_2292\Up
C:\Users\win7\AppData\Local\Temp\AI_EXTUI_BIN_2292\lite.ico
C:\Users\win7\AppData\Local\Temp\AI_EXTUI_BIN_2292\repairic
C:\Users\win7\AppData\Local\Temp\AI_EXTUI_BIN_2292\installer.bmp
C:\Users\win7\AppData\Local\Temp\AI_EXTUI_BIN_2292\New
C:\Users\win7\AppData\Local\Temp\AI_EXTUI_BIN_2292\completi
C:\Users\win7\AppData\Local\Temp\AI_EXTUI_BIN_2292\removico
C:\Users\win7\AppData\Local\Temp\AI_EXTUI_BIN_2292\exclamic
C:\Users\win7\AppData\Local\Temp\AI_EXTUI_BIN_2292\style1_banner.jpg
C:\Users\win7\AppData\Local\Temp\AI_EXTUI_BIN_2292\custicon
C:\Users\win7\AppData\Local\Temp\AI_EXTUI_BIN_2292\info
C:\Users\win7\AppData\Local\Temp\AI_EXTUI_BIN_2292\insticon
C:\Users\win7\AppData\Local\Temp\AI_EXTUI_BIN_2292\aicustact.dll
C:\Users\win7\AppData\Local\Temp\AI_EXTUI_BIN_2292\lzmaextractor.dll
C:\Users\win7\AppData\Local\Temp\AI_EXTUI_BIN_2292\cmdlinkarrow
C:\Users\win7\AppData\Local\Temp\\~DFE8696B66E2642FCB.TMP
C:\Users\win7\AppData\Local\Temp\MSI1004.tmp
C:\Users\win7\AppData\Local\Temp\MSI169C.tmp
C:\Users\win7\AppData\Local\Temp\TeamViewer
C:\Users\win7\AppData\Local\Temp\TeamViewer\Version9\TeamViewer_.exe
C:\Users\win7\AppData\Local\Temp\nsuFF3B.tmp
C:\Users\win7\AppData\Local\Temp\nskFF4C.tmp\TvGetVersion.dll
C:\Users\win7\AppData\Local\Temp\nskFF4C.tmp\UserInfo.dll
C:\Users\win7\AppData\Local\Temp\nskFF4C.tmp\ioSpecial.ini
C:\Users\win7\AppData\Local\Temp\nskFF4C.tmp\modern-wizard.bmp
C:\Users\win7\AppData\Local\Temp\nskFF4C.tmp\Lizenz_TeamViewer_EN_unicode.txt
C:\Users\win7\AppData\Local\Temp\nskFF4C.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\nskFF4C.tmp\host_unicode.ini
C:\Users\win7\AppData\Local\Temp\nskFF4C.tmp\start_unicode.ini
C:\Users\win7\AppData\Local\Temp\nskFF4C.tmp\advanced_unicode.ini
C:\Users\win7\AppData\Local\Temp\nskFF4C.tmp\environment_unicode.ini
C:\Users\win7\AppData\Local\Temp\nskFF4C.tmp\vpn_unicode.ini
C:\Users\win7\AppData\Local\Temp\nskFF4C.tmp\license_unicode.ini
C:\Users\win7\AppData\Local\Temp\nskFF4C.tmp\security_unicode.ini
C:\Users\win7\AppData\Local\Temp\nskFF4C.tmp\InstallOptions.dll
C:\Users\win7\AppData\Local\Temp\nskFF4C.tmp\linker.dll
C:\Users\win7\AppData\Local\Temp\DMR\dmr_72.exe
C:\Windows\SysWOW64\iepeers.dll
C:\Windows\system32\regsvr32.exe
C:\Users\win7\AppData\Local\Temp\nsc9635.tmp
C:\Users\win7\AppData\Local\Temp\nsh9655.tmp\UserInfo.dll
C:\Users\win7\AppData\Local\Temp\nsh9655.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\nsh9655.tmp\LangDLL.dll
C:\Users\win7\AppData\Local\Temp\nsh9655.tmp\modern-wizard.bmp
C:\Users\win7\AppData\Local\Temp\nsh9655.tmp\nsDialogs.dll
C:\Users\win7\AppData\Local\Temp\nsh9655.tmp\StartMenu.dll
C:\Users\win7\AppData\Local\Temp\toolbar_log.txt
C:\Users\win7\AppData\Local\Temp\nsdF39C.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\nsdF39C.tmp\UAC.dll
C:\Users\win7\AppData\Local\Temp\nsdF39C.tmp\bgintro.bmp
C:\Users\win7\AppData\Local\Temp\nsdF39C.tmp\appname.bmp
C:\Users\win7\AppData\Local\Temp\nsdF39C.tmp\clock.bmp
C:\Users\win7\AppData\Local\Temp\nsdF39C.tmp\particles.bmp
C:\Users\win7\AppData\Local\Temp\nsdF39C.tmp\pencil.bmp
C:\Users\win7\AppData\Local\Temp\nsdF39C.tmp\nsDialogs.dll
C:\guard.log
C:\ProgramData\NortonInstaller\Logs\2016-04-05-18h54m47s\NortonInstall-2016-04-05-18h54m47s.log
C:\ProgramData\NortonInstaller\Logs\2016-04-05-18h54m47s\Install.1.mft
C:\SAMPLE
C:\WINDOWS\FONTS\TAHOMABD.TTF
c:\AMBrc\AMB driver update.pdf
c:\AMBrc\Ambusb.inf
c:\AMBrc\ambusb.sys
C:\Users\win7\AppData\Local\Temp\is-APLMG.tmp\_isetup\_RegDLL.tmp
C:\Users\win7\AppData\Local\Temp\is-APLMG.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-APLMG.tmp\_isetup\_shfoldr.dll
C:\Users\win7\AppData\Local\Temp\is-APLMG.tmp\ISDone.dll
C:\Users\win7\AppData\Local\Temp\is-APLMG.tmp\b2p.dll
C:\Users\win7\AppData\Local\Temp\is-APLMG.tmp\botva2.dll
C:\settings.ini
C:\Users\win7\AppData\Local\Temp\\~DF3D4C1FAA22B2BAE3.TMP
C:\Windows\Logs\CBS\CBS.log
C:\SpWizUi.dll
C:\32928ce3633b0f262bf320
C:\Users\win7\AppData\Local\Temp\nsmB9D5.tmp\LangDLL.dll
C:\Users\win7\AppData\Local\Temp\nsmB9D5.tmp\modern-header.bmp
C:\Users\win7\AppData\Local\Temp\nsmB9D5.tmp\modern-wizard.bmp
C:\Users\win7\AppData\Local\Temp\nsmB9D5.tmp\nsDialogs.dll
C:\Users\win7\AppData\Local\Temp\nsmB9D5.tmp\System.dll
C:\Windows\Dell\UpdatePackage\log\Synaptics.log
C:\Users\win7\AppData\Local\Temp\is-2B6B0.tmp\sample.tmp
\Localization.ini
C:\Users\win7\AppData\Local\Temp\nsf3592.tmp
C:\Users\win7\AppData\Local\Temp\nsk35B2.tmp\UserInfo.dll
C:\Users\win7\AppData\Local\Temp\nsk35B2.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\nsk35B2.tmp\modern-wizard.bmp
C:\Users\win7\AppData\Local\Temp\nsk35B2.tmp\nsDialogs.dll
C:\Windows\system32\lua5.1a.dll
C:\Windows\system32\zenwinx.dll
C:\Windows\system32\udefrag.dll
C:\Windows\system32\hibernate4win.exe
C:\Windows\system32\udefrag-dbg.exe
C:\Program Files\UltraDefrag\HISTORY.TXT
C:\Program Files\UltraDefrag\README.TXT
C:\Program Files\UltraDefrag\lua5.1a.exe
C:\Program Files\UltraDefrag\lua5.1a_gui.exe
C:\Program Files\UltraDefrag\scripts\udreportcnv.lua
C:\Program Files\UltraDefrag\scripts\udsorting.js
C:\Program Files\UltraDefrag\scripts\upgrade-options.lua
C:\Program Files\UltraDefrag\scripts\udreport.css
C:\Program Files\UltraDefrag\man\boot-off.man
C:\Program Files\UltraDefrag\man\boot-on.man
C:\Program Files\UltraDefrag\man\call.man
C:\Program Files\UltraDefrag\man\echo.man
C:\Program Files\UltraDefrag\man\exit.man
C:\Program Files\UltraDefrag\man\help.man
C:\Program Files\UltraDefrag\man\hexview.man
C:\Program Files\UltraDefrag\man\history.man
C:\Program Files\UltraDefrag\man\man.man
C:\Program Files\UltraDefrag\man\pause.man
C:\Program Files\UltraDefrag\man\readme.txt
C:\Program Files\UltraDefrag\man\reboot.man
C:\Program Files\UltraDefrag\man\set.man
C:\Program Files\UltraDefrag\man\shutdown.man
C:\Program Files\UltraDefrag\man\type.man
C:\Program Files\UltraDefrag\man\udefrag.man
C:\Program Files\UltraDefrag\man\variables.man
C:\Windows\system32\boot-config.cmd
C:\Windows\system32\boot-off.cmd
C:\Windows\system32\boot-on.cmd
C:\Windows\system32\bootexctrl.exe
C:\Windows\system32\defrag_native.exe
C:\Windows\system32\ud-boot-time.cmd
C:\Windows\system32\ud-boot-time.ini
C:\Windows\system32\udefrag.exe
C:\Program Files\UltraDefrag\locale\ach\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\ar\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\be\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\bg\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\bn\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\bs\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\ca\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\cs\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\da\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\de\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\el\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\en_GB\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\en_US\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\es\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\es_AR\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\es_MX\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\et\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\eu\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\eu_ES\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\fa\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\fi\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\fr\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\gl\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\he\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\hi\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\hr\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\hu\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\hy\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\id\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\ilo\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\is\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\it\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\ja\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\jv\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\ka\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\ko\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\la\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\lt\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\lv\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\mk\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\ms\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\my\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\nl\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\no\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\pam\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\pl\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\pt\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\pt_BR\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\ro\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\ru\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\si_LK\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\sk\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\sl\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\sq\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\sr\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\sv\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\szl\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\ta\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\th\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\tl\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\tr\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\uk\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\uz@Latn\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\vi\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\war\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\yi\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\zh_CN\UltraDefrag.mo
C:\Program Files\UltraDefrag\locale\zh_TW\UltraDefrag.mo
C:\Program Files\UltraDefrag\po\ach.po
C:\Program Files\UltraDefrag\po\ar.po
C:\Program Files\UltraDefrag\po\be.po
C:\Program Files\UltraDefrag\po\bg.po
C:\Program Files\UltraDefrag\po\bn.po
C:\Program Files\UltraDefrag\po\bs.po
C:\Program Files\UltraDefrag\po\ca.po
C:\Program Files\UltraDefrag\po\cs.po
C:\Program Files\UltraDefrag\po\da.po
C:\Program Files\UltraDefrag\po\de.po
C:\Program Files\UltraDefrag\po\el.po
C:\Program Files\UltraDefrag\po\en_GB.po
C:\Program Files\UltraDefrag\po\en_US.po
C:\Program Files\UltraDefrag\po\es.po
C:\Program Files\UltraDefrag\po\es_AR.po
C:\Program Files\UltraDefrag\po\es_MX.po
C:\Program Files\UltraDefrag\po\et.po
C:\Program Files\UltraDefrag\po\eu.po
C:\Program Files\UltraDefrag\po\eu_ES.po
C:\Program Files\UltraDefrag\po\fa.po
C:\Program Files\UltraDefrag\po\fi.po
C:\Program Files\UltraDefrag\po\fr.po
C:\Program Files\UltraDefrag\po\gl.po
C:\Program Files\UltraDefrag\po\he.po
C:\Program Files\UltraDefrag\po\hi.po
C:\Program Files\UltraDefrag\po\hr.po
C:\Program Files\UltraDefrag\po\hu.po
C:\Program Files\UltraDefrag\po\hy.po
C:\Program Files\UltraDefrag\po\id.po
C:\Program Files\UltraDefrag\po\ilo.po
C:\Program Files\UltraDefrag\po\is.po
C:\Program Files\UltraDefrag\po\it.po
C:\Program Files\UltraDefrag\po\ja.po
C:\Program Files\UltraDefrag\po\jv.po
C:\Program Files\UltraDefrag\po\ka.po
C:\Program Files\UltraDefrag\po\ko.po
C:\Program Files\UltraDefrag\po\la.po
C:\Program Files\UltraDefrag\po\lt.po
C:\Program Files\UltraDefrag\po\lv.po
C:\Program Files\UltraDefrag\po\mk.po
C:\Program Files\UltraDefrag\po\ms.po
C:\Program Files\UltraDefrag\po\my.po
C:\Program Files\UltraDefrag\po\nl.po
C:\Program Files\UltraDefrag\po\no.po
C:\Program Files\UltraDefrag\po\pam.po
C:\Program Files\UltraDefrag\po\pl.po
C:\Program Files\UltraDefrag\po\pt.po
C:\Program Files\UltraDefrag\po\pt_BR.po
C:\Program Files\UltraDefrag\po\ro.po
C:\Program Files\UltraDefrag\po\ru.po
C:\Program Files\UltraDefrag\po\si_LK.po
C:\Program Files\UltraDefrag\po\sk.po
C:\Program Files\UltraDefrag\po\sl.po
C:\Program Files\UltraDefrag\po\sq.po
C:\Program Files\UltraDefrag\po\sr.po
C:\Program Files\UltraDefrag\po\sv.po
C:\Program Files\UltraDefrag\po\szl.po
C:\Program Files\UltraDefrag\po\ta.po
C:\Program Files\UltraDefrag\po\th.po
C:\Program Files\UltraDefrag\po\tl.po
C:\Program Files\UltraDefrag\po\tr.po
C:\Program Files\UltraDefrag\po\uk.po
C:\Program Files\UltraDefrag\po\uz@Latn.po
C:\Program Files\UltraDefrag\po\vi.po
C:\Program Files\UltraDefrag\po\war.po
C:\Program Files\UltraDefrag\po\yi.po
C:\Program Files\UltraDefrag\po\zh_CN.po
C:\Program Files\UltraDefrag\po\zh_TW.po
C:\Program Files\UltraDefrag\po\UltraDefrag.pot
C:\Program Files\UltraDefrag\ultradefrag.exe
C:\Users\win7\AppData\Local\Temp\is-004JP.tmp\_isetup\_RegDLL.tmp
C:\Users\win7\AppData\Local\Temp\is-004JP.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-004JP.tmp\_isetup\_shfoldr.dll
C:\Users\win7\AppData\Local\Temp\is-UBQ5P.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-UBQ5P.tmp\_isetup\_shfoldr.dll
C:\Users\win7\AppData\Local\Temp\is-UBQ5P.tmp\RdZone.dll
C:\Users\win7\AppData\Local\Temp\is-UBQ5P.tmp\SDDriverMgr.dll
C:\Users\win7\AppData\Roaming\IObit\Smart Defrag 4\Config.ini
C:\Users\win7\AppData\Local\Temp\is-UBQ5P.tmp\Inno_English.lng
\\.\PHYSICALDRIVE0
\\.\Scsi0:
\\.\Scsi1:
\\.\Scsi2:
\\.\Scsi3:
\\.\Scsi4:
\\.\Scsi5:
\\.\Scsi6:
\\.\Scsi7:
\\.\Scsi8:
\\.\Scsi9:
\\.\Scsi10:
\\.\Scsi11:
\\.\Scsi12:
\\.\Scsi13:
\\.\Scsi14:
\\.\Scsi15:
C:\Users\win7\AppData\Local\Temp\pft4C67~tmp\setup.ini
C:\Users\win7\AppData\Local\Temp\{7C5A5A01-BA31-4712-8E81-703787A937A1}\setup.ini
C:\Users\win7\AppData\Local\Temp\pft4C67~tmp\setup.exe
C:\Users\win7\AppData\Local\Temp\pft4C67~tmp\data1.hdr
C:\Users\win7\AppData\Local\Temp\pft4C67~tmp\layout.bin
C:\Users\win7\AppData\Local\Temp\pft4C67~tmp\data1.cab
C:\Users\win7\AppData\Local\Temp\pft4C67~tmp\setup.isn
C:\Users\win7\AppData\Local\Temp\pft4C67~tmp\_setup.dll
C:\Users\win7\AppData\Local\Temp\pft4C67~tmp\ISSetup.dll
C:\Users\win7\AppData\Local\Temp\pft4C67~tmp\setup.inx
C:\Users\win7\AppData\Local\Temp\5cef.rra
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\setu5e47.rra
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\IsBk5e47.rra
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\NvIn5e56.rra
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\_ISU5e56.rra
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\core5e66.rra
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\dotn5e66.rra
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\Font5e76.rra
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\ISBE5e76.rra
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\Stri5e85.rra
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\isrt5e85.rra
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\defa5e85.rra
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\_IsR5e95.rra
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\{13C5D420-CAE2-11D4-B34D-00105A1C23DD}\setup.inx
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\{13C5D420-CAE2-11D4-B34D-00105A1C23DD}\ISRT.dll
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\{13C5D420-CAE2-11D4-B34D-00105A1C23DD}\_isres.dll
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\{13C5D420-CAE2-11D4-B34D-00105A1C23DD}\_isuser.dll
C:\Users\win7\AppData\Local\Temp\ispr6135.rra
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\{13C5D420-CAE2-11D4-B34D-00105A1C23DD}\skin6135.rra
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\{13C5D420-CAE2-11D4-B34D-00105A1C23DD}\StringTable-0009-English.ips
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\corecomp.ini
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\{13C5D420-CAE2-11D4-B34D-00105A1C23DD}\NVINSTNT.DLL
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\{13C5D420-CAE2-11D4-B34D-00105A1C23DD}\ISBKGD.BMP
C:\ProgramData\HP\Installer\Temp\sample000.log
C:\WINDOWS\FONTS\TIMESBD.TTF
power_2006_gest_ad\Copie de Tmp.mdb
power_2006_gest_ad\cr\Crystal Reports\00019144.dat
power_2006_gest_ad\cr\Crystal Reports\00028747.dat
power_2006_gest_ad\cr\Crystal Reports\arcvt32r.dll
power_2006_gest_ad\cr\Crystal Reports\arfit.exe
power_2006_gest_ad\cr\Crystal Reports\c2rstub.exe
power_2006_gest_ad\cr\Crystal Reports\c2supprt.dll
power_2006_gest_ad\cr\Crystal Reports\cd2c70fr.dll
power_2006_gest_ad\cr\Crystal Reports\cif32r.dll
power_2006_gest_ad\cr\Crystal Reports\cq2c70fr.dll
power_2006_gest_ad\cr\Crystal Reports\cqw32.exe
power_2006_gest_ad\cr\Crystal Reports\craxddt.dll
power_2006_gest_ad\cr\Crystal Reports\craxdrt.dep
power_2006_gest_ad\cr\Crystal Reports\craxdrt.dll
power_2006_gest_ad\cr\Crystal Reports\craxdui.dll
power_2006_gest_ad\cr\Crystal Reports\crcvt32r.dll
power_2006_gest_ad\cr\Crystal Reports\crd32.exe
power_2006_gest_ad\cr\Crystal Reports\crdelphi.pas
power_2006_gest_ad\cr\Crystal Reports\crdit.cnt
power_2006_gest_ad\cr\Crystal Reports\crmap.cnt
power_2006_gest_ad\cr\Crystal Reports\crodbc32.inf
power_2006_gest_ad\cr\Crystal Reports\crpe32.pas
power_2006_gest_ad\cr\Crystal Reports\crrdc.cnt
power_2006_gest_ad\cr\Crystal Reports\crsource.tlb
power_2006_gest_ad\cr\Crystal Reports\crsql.cnt
power_2006_gest_ad\cr\Crystal Reports\crw.act
power_2006_gest_ad\cr\Crystal Reports\crw.cnt
power_2006_gest_ad\cr\Crystal Reports\crw.crr
power_2006_gest_ad\cr\Crystal Reports\crw.GID
power_2006_gest_ad\cr\Crystal Reports\crw.net
power_2006_gest_ad\cr\Crystal Reports\crw32.exe
power_2006_gest_ad\cr\Crystal Reports\crwizard.awx
power_2006_gest_ad\cr\Crystal Reports\crwrap.bas
power_2006_gest_ad\cr\Crystal Reports\Cs2c70fr.dll
power_2006_gest_ad\cr\Crystal Reports\cw2c70fr.dll
power_2006_gest_ad\cr\Crystal Reports\developr.cnt
power_2006_gest_ad\cr\Crystal Reports\dexpert.exe
power_2006_gest_ad\cr\Crystal Reports\dictnry.cnt
power_2006_gest_ad\cr\Crystal Reports\dsx32.exe
power_2006_gest_ad\cr\Crystal Reports\extract.exe
power_2006_gest_ad\cr\Crystal Reports\field.ddf
power_2006_gest_ad\cr\Crystal Reports\file.ddf
power_2006_gest_ad\cr\Crystal Reports\global32.bas
power_2006_gest_ad\cr\Crystal Reports\grdkrn32.dll
power_2006_gest_ad\cr\Crystal Reports\impwdf.dll
power_2006_gest_ad\cr\Crystal Reports\index.ddf
power_2006_gest_ad\cr\Crystal Reports\labels.txt
power_2006_gest_ad\cr\Crystal Reports\library.crr
power_2006_gest_ad\cr\Crystal Reports\orders.ttx
power_2006_gest_ad\cr\Crystal Reports\peplus.cpp
power_2006_gest_ad\cr\Crystal Reports\peplus.h
power_2006_gest_ad\cr\Crystal Reports\R3dxpfr.dll
power_2006_gest_ad\cr\Crystal Reports\r3GLCfr.dll
power_2006_gest_ad\cr\Crystal Reports\readme.cnt
power_2006_gest_ad\cr\Crystal Reports\rptglanc.cnt
power_2006_gest_ad\cr\Crystal Reports\rptglanc.exe
power_2006_gest_ad\cr\Crystal Reports\runtime.cnt
power_2006_gest_ad\cr\Crystal Reports\setup.log
power_2006_gest_ad\cr\Crystal Reports\sstree32.dll
power_2006_gest_ad\cr\Crystal Reports\sysdb32.exe
power_2006_gest_ad\cr\Crystal Reports\unistp32.dll
power_2006_gest_ad\cr\Crystal Reports\w32mkset.dll
power_2006_gest_ad\cr\Crystal Reports\w32mkset.exe
power_2006_gest_ad\cr\Crystal Reports\wdbuei32.dll
power_2006_gest_ad\cr\Crystal Reports\wdbuui32.dll
power_2006_gest_ad\Etats\BalanceAge.rpt
power_2006_gest_ad\Etats\BalanceComptes.rpt
power_2006_gest_ad\Etats\BonSortie.rpt
power_2006_gest_ad\Etats\CompteAttente.rpt
power_2006_gest_ad\Etats\CompteDposs.rpt
power_2006_gest_ad\Etats\CompteImpaysDPNR.rpt
power_2006_gest_ad\Etats\CompteInstance.rpt
power_2006_gest_ad\Etats\CompteRecap.rpt
power_2006_gest_ad\Etats\CompteRecap0.rpt
power_2006_gest_ad\Etats\Copie de MVT.RPT
power_2006_gest_ad\Etats\CrAchatsVentes.rpt
power_2006_gest_ad\Etats\CrAchatsVentesac.rpt
power_2006_gest_ad\Etats\crArticles.rpt
power_2006_gest_ad\Etats\crComptesTiers.rpt
power_2006_gest_ad\Etats\crComptesTiersMois.rpt
power_2006_gest_ad\Etats\CrConsommation.rpt
power_2006_gest_ad\Etats\CrConsommationAchats.rpt
power_2006_gest_ad\Etats\CrFicheStock.rpt
power_2006_gest_ad\Etats\crHistoriques.rpt
power_2006_gest_ad\Etats\crListeVentes.rpt
power_2006_gest_ad\Etats\crMvts.rpt
power_2006_gest_ad\Etats\crMvts_2005.rpt
power_2006_gest_ad\Etats\crProduction.rpt
power_2006_gest_ad\Etats\crReglementsJour.rpt
power_2006_gest_ad\Etats\crReglementsTiers.rpt
power_2006_gest_ad\Etats\crReleveComptesTiersMois.rpt
power_2006_gest_ad\Etats\CrSoldeCommandes.rpt
power_2006_gest_ad\Etats\CrValeurInventaire.rpt
power_2006_gest_ad\Etats\CrvaleurStock.rpt
power_2006_gest_ad\Etats\CrvaleurStockDate.rpt
power_2006_gest_ad\Etats\DetailMvtTiers.rpt
power_2006_gest_ad\Etats\Etat350.rpt
power_2006_gest_ad\Etats\Etat350Chx7.rpt
power_2006_gest_ad\Etats\Etat350Ens7.rpt
power_2006_gest_ad\Etats\Etat_cajourne.rpt
power_2006_gest_ad\Etats\Etat_Echanges.rpt
power_2006_gest_ad\Etats\etat_Inventairestk.rpt
power_2006_gest_ad\Etats\Etat_journalVte.rpt
power_2006_gest_ad\Etats\Etat_Nseries.rpt
power_2006_gest_ad\Etats\Etat_NseriesBL.rpt
power_2006_gest_ad\Etats\Etat_NseriesBR.rpt
power_2006_gest_ad\Etats\Etat_PmsJourne.rpt
power_2006_gest_ad\Etats\Etat_PrixPPH.rpt
power_2006_gest_ad\Etats\Etat_ReleveFactures.rpt
power_2006_gest_ad\Etats\Etat_RelevePms.rpt
power_2006_gest_ad\Etats\Etat_RelevePmsVille.rpt
power_2006_gest_ad\Etats\Etat_RelevePmsVilleDetail.rpt
power_2006_gest_ad\Etats\Etat_RelevePmsVilleFrs.rpt
power_2006_gest_ad\Etats\Etat_Rupture.rpt
power_2006_gest_ad\Etats\Etat_Situations.rpt
power_2006_gest_ad\Etats\Etat_SituationsRecap.rpt
power_2006_gest_ad\Etats\Etat_SituationTiers.rpt
power_2006_gest_ad\Etats\Etat_SituationTiersF.rpt
power_2006_gest_ad\Etats\Etat_Tva_AV.rpt
power_2006_gest_ad\Etats\Etat_Tva_AVTTX.rpt
power_2006_gest_ad\Etats\Etat_Tva_ERDET.rpt
power_2006_gest_ad\Etats\Etat_Tva_RE.rpt
power_2006_gest_ad\Etats\Inventaire.rpt
power_2006_gest_ad\Etats\InventaireVte.rpt
power_2006_gest_ad\Etats\Liste prix par client.rpt
power_2006_gest_ad\Etats\LISTEARTICLES.rpt
power_2006_gest_ad\Etats\ListePrixArticles.rpt
power_2006_gest_ad\Etats\LISTES.crf
power_2006_gest_ad\Etats\LISTES.rpt
power_2006_gest_ad\Etats\LISTES02.crf
power_2006_gest_ad\Etats\LISTES02.rpt
power_2006_gest_ad\Etats\LISTES03.crf
power_2006_gest_ad\Etats\LISTES03.rpt
power_2006_gest_ad\Etats\Liste_articles.rpt
power_2006_gest_ad\Etats\Liste_catalogue.rpt
power_2006_gest_ad\Etats\Liste_prix_par_article.rpt
power_2006_gest_ad\Etats\Liste_prix_par_client.rpt
power_2006_gest_ad\Etats\MB_CAISSE.rpt
power_2006_gest_ad\Etats\MB_CAISSE2.rpt
power_2006_gest_ad\Etats\MVT.RPT
power_2006_gest_ad\Etats\mvtFac.rpt
power_2006_gest_ad\Etats\mvtFacBL.rpt
power_2006_gest_ad\Etats\mvtImp.rpt
power_2006_gest_ad\Etats\mvtmaxi.rpt
power_2006_gest_ad\Etats\mvtPre.rpt
power_2006_gest_ad\Etats\mvtSansPU.rpt
power_2006_gest_ad\Etats\MVTSANSQTE.rpt
power_2006_gest_ad\Etats\mvt_ancien.rpt
power_2006_gest_ad\Etats\PAM_DPA.RPT
power_2006_gest_ad\Etats\SituationChauffeurs.rpt
power_2006_gest_ad\Etats\SITUATIONDUJOUR.rpt
power_2006_gest_ad\Etats\Situation_agence.rpt
power_2006_gest_ad\Etats\Situation_journalier.rpt
power_2006_gest_ad\Etats\Situation_produit.rpt
power_2006_gest_ad\Etats\Situation_produitS.rpt
power_2006_gest_ad\Etats\xxMVTSANSQTE.RPT
power_2006_gest_ad\Etats\~crw564d.tmp
power_2006_gest_ad\PAUTOTmp.mdb
power_2006_gest_ad\PHOT\F1212.jpg
power_2006_gest_ad\PHOT\Thumbs.db
power_2006_gest_ad\PowerGad2014AUTO.exe
power_2006_gest_ad\Sts.mdb
power_2006_gest_ad\Tmp.mdb
power_2006_gest_ad\VI14\GESTION.mdb
power_2006_gest_ad\cr\Crystal Reports
power_2006_gest_ad\cr
power_2006_gest_ad\Etats
power_2006_gest_ad\EXELL
power_2006_gest_ad\PHOT
power_2006_gest_ad\VI14
power_2006_gest_ad
C:\Users\win7\AppData\Local\Temp\btwinlog.txt
C:\Users\win7\AppData\Local\Temp\GUM550F.tmp\goopdate.dll
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C86BD7751D53F10F65AAAD66BBDF33C7
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EE44ECA143B76F2B9F2A5AA75B5D1EC6_847118BE2683F0C241D1D702F3A3F5F9
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EE44ECA143B76F2B9F2A5AA75B5D1EC6_48BC6893316669491F73A0AFA6B78DC9
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\616AD1AB067CFD351D6C0EF6F3E12F40
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\782D7E2BFB036A849A99FFA65C652D39
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CA4458E7366E94A3C3A9C1FE548B6D21_03701DFFBB0DB68C6FEF44A923FC306A
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CA4458E7366E94A3C3A9C1FE548B6D21_11890B83A662A94DAA54032730C974C0
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7BD5521448F9309F5CEB0C75890FFABC
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\76A6104AD5D7661815E18299392B9F65
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAEBE581FCB73249406FC21094EA252E_BC0CE803EF41A748738619ED7838EEFC
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAEBE581FCB73249406FC21094EA252E_FD361CE5A85478C5EE18C8A08F5CE82E
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C3E814D1CB223AFCD58214D14C3B7EAB
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D84E548583BE1EE7DB5A935821009D26_5B98B6CD6E69202676965CF5B0E2A7A7
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D84E548583BE1EE7DB5A935821009D26_1070D8A1DE1737B040B2F83EA6FA69E1
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8BD11C4A2318EC8E5A82462092971DEA
C:\ProgramData\Dropbox\Update\Log\DropboxUpdate.log-2016-04-05-20-25-34-643-1424
C:\Users\win7\AppData\Local\Temp\is-2MFB3.tmp\_isetup\_RegDLL.tmp
C:\Users\win7\AppData\Local\Temp\is-2MFB3.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-2MFB3.tmp\_isetup\_shfoldr.dll
C:\Users\win7\AppData\Local\Temp\is-2MFB3.tmp\_isetup\_isdecmp.dll
C:\Users\win7\AppData\Local\Temp\is-2MFB3.tmp\psvince.dll
Nul
\\.\PhysicalDrive1
\\.\PhysicalDrive2
\\.\PhysicalDrive3
\\.\PhysicalDrive4
C:\Users\win7\AppData\Local\Temp\w64.exe
C:\Users\win7\AppData\Local\Temp\vivaldi_installer.log
C:\Users\win7\AppData\Local\Temp\{39439C73-7F64-4AEF-93C1-CCA89078D9E9}\iobitappsToolbar.msi
C:\Users\win7\AppData\Local\Temp\{39439C73-7F64-4AEF-93C1-CCA89078D9E9}\1033.MST
C:\Windows\SysWOW64\MSIEXEC.EXE.config
C:\Windows\SysWOW64\MSIEXEC.EXE
viewed.dat
launcher.vpp_pc
data\settings.xml
data\
C:\Users\win7\AppData\Local\Temp\GUM9B45.tmp\goopdate.dll
C:\ProgramData\Dropbox\Update\Log\DropboxUpdate.log-2016-04-05-21-24-14-654-2400
setup.exe
C:\_Setup.dll
C:\Users\win7\AppData\Local\Temp\sample.log
\\.\Siwvid
C:\sample\2
C:\Windows\system32\uc.tlb
C:\sample\3
\\.\SiwvidSTART
C:\Users\win7\AppData\Roaming\Skype\shared.lck
C:\Users\win7\AppData\Roaming\Skype\shared.xml
C:\Users\win7\AppData\Roaming\Skype\shared.tmp
C:\Users\win7\AppData\Roaming\Skype\shared_dynco\dc.lock
C:\Users\win7\AppData\Roaming\Skype\shared_dynco\dc.db
C:\Users\win7\AppData\Roaming\Skype\shared_dynco\dc.db-journal
C:\Users\win7\AppData\Roaming\Skype
C:\Users\win7\AppData\Roaming\Skype\shared_httpfe\queue.lock
C:\Users\win7\AppData\Roaming\Skype\shared_httpfe\queue.db
C:\Users\win7\AppData\Roaming\Skype\shared_httpfe\queue.db-journal
\\.\MountPointManager
C:\Users\win7\AppData\Local\Temp\is-SG73T.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-SG73T.tmp\_isetup\_shfoldr.dll
\\.\pipe\OperaCrashReporter584
C:\Users\win7\AppData\Local\Temp\Opera Installer\opera_installer_20160406013027.log
C:\Users\win7\AppData\Local\Temp\Opera Installer\opera_installer_20160406013025.exe
C:\ProgramData\AMMYY\hr
C:\ProgramData\AMMYY\hr3
C:\ProgramData\AMMYY\settings3.bin
C:\Users\win7\AppData\Local\Temp\nsn4262.tmp
C:\Users\win7\AppData\Local\Temp\nsc4272.tmp\CheckRunVirtual.dll
C:\Users\win7\AppData\Local\Temp\nsc4272.tmp\FindProcDLL.dll
C:\Users\win7\AppData\Local\Temp\nsc4272.tmp\Banner.dll
C:\Users\win7\AppData\Local\Temp\nsc4272.tmp\NSISdl.dll
C:\Users\win7\AppData\Roaming\azbconfig.ini
C:\Users\win7\AppData\Local\Temp\AutoRunSPLog.tmp
C:\DEFAULT_READ_STRING
C:\Users\win7\AppData\Local\Temp\HiSuiteDownLoader.log
C:\Users\win7\AppData\Local\Temp\nsmC01D.tmp
C:\sample:Zone.Identifier
C:\Users\win7\AppData\Local\Temp\LxProxy.log
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\perl514.dll
nul
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\x-sjis-cp932.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\x-sjis-jisx0221.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\iso-8859-2.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\big5.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\windows-1255.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\koi8-r.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\x-euc-jp-jisx0221.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\iso-8859-3.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\e2e81dd6b3e5a36f0bdae076393cc11d\icudt46.dll
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\iso-8859-8.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\iso-8859-6.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\windows-1250.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\iso-8859-11.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\ibm866.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\x-sjis-unicode.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\e2e81dd6b3e5a36f0bdae076393cc11d\icuuc46.dll
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\windows-1252.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\SAX\ParserDetails.ini
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\x-euc-jp-unicode.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\iso-8859-9.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\iso-8859-4.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\iso-8859-13.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\x-sjis-jdk117.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\iso-8859-1.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\iso-8859-15.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\e2e81dd6b3e5a36f0bdae076393cc11d\icuin46.dll
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\iso-8859-7.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\windows-1251.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\euc-kr.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\iso-8859-5.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\iso-8859-10.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\iso-8859-16.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings\iso-8859-14.enc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\31638f63e39b38d3e250a9a57cb9d1c5\Cwd.dll
C:\bin\pwd
C:\usr\bin\pwd
C:\QOpenSys\bin\pwd
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\f233f63b6654362865c7577442edb9e3\Win32.dll
C:\MSWin32-x86-multi-thread\auto
C:\5.14.1
C:\5.14.1\MSWin32-x86-multi-thread
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\32785c19dc6898fbbbf06f3b776edd08\Fcntl.dll
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\e56c61f7248672819579325af3387035\POSIX.dll
C:\<C:\sample>auto\POSIX\load_imports.al
C:\etc\selinux
C:\Slim\Utils\OS\Custom.pmc
C:\Slim\Utils\OS\Custom.pm
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\Slim\Utils\OS\Custom.pmc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\Slim\Utils\OS\Custom.pm
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\5ffd05b2cbd58528e56519784ca9c869\Hostname.dll
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\df1ba73f49c38cbbc7a11c779c3506d2\OLE.dll
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\eaeabd54205de2f10c00aea80bbf0d83\Registry.dll
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\3a7ccbf8181ee5a145227a6dfce3594c\WinError.dll
C:\SetDualVar.pmc
C:\SetDualVar.pm
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\SetDualVar.pmc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\SetDualVar.pm
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\60ff464e01c2cd5526dbdad5a125081d\Dumper.dll
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\4461f48e31bde5c56b31b973b773de09\List.dll
C:\CPAN\arch\5.14\MSWin32-x86-multi-thread\version\vxs.pmc
C:\CPAN\arch\5.14\MSWin32-x86-multi-thread\version\vxs.pm
C:\CPAN\arch\5.14\MSWin32-x86-multi-thread\auto\version\vxs.pmc
C:\CPAN\arch\5.14\MSWin32-x86-multi-thread\auto\version\vxs.pm
C:\CPAN\arch\5.14.1\MSWin32-x86-multi-thread\version\vxs.pmc
C:\CPAN\arch\5.14.1\MSWin32-x86-multi-thread\version\vxs.pm
C:\CPAN\arch\5.14.1\MSWin32-x86-multi-thread\auto\version\vxs.pmc
C:\CPAN\arch\5.14.1\MSWin32-x86-multi-thread\auto\version\vxs.pm
C:\CPAN\arch\MSWin32-x86-multi-thread\version\vxs.pmc
C:\CPAN\arch\MSWin32-x86-multi-thread\version\vxs.pm
C:\CPAN\arch\5.14\version\vxs.pmc
C:\CPAN\arch\5.14\version\vxs.pm
C:\lib\version\vxs.pmc
C:\lib\version\vxs.pm
C:\CPAN\version\vxs.pmc
C:\CPAN\version\vxs.pm
C:\version\vxs.pmc
C:\version\vxs.pm
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\version\vxs.pmc
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\version\vxs.pm
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\c199d3c1960e7aeeecb599487952bed2\HiRes.dll
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\961b0d62fa52b1dd29c795a822fbf1cf\DBI.dll
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\c5cce8d16a1bd48692b421dcf46d3396\Util.dll
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\7f177c338672436e01c4f0bdbcf94491\EV.dll
C:\Windows\system32\auto\EV\EV.dll
C:\CPAN\arch\5.14\MSWin32-x86-multi-thread\auto\EV
C:\CPAN\arch\5.14\MSWin32-x86-multi-thread\auto\auto\EV
C:\CPAN\arch\5.14.1\MSWin32-x86-multi-thread\auto\EV
C:\CPAN\arch\5.14.1\MSWin32-x86-multi-thread\auto\auto\EV
C:\CPAN\arch\MSWin32-x86-multi-thread\auto\EV
C:\CPAN\arch\5.14\auto\EV
C:\lib\auto\EV
C:\CPAN\auto\EV
C:\auto\EV
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\auto\EV
C:\Windows\system32\auto\EV\EV.bs
C:\CPAN\arch\5.14\MSWin32-x86-multi-thread\XML\Parser\Encodings
C:\CPAN\arch\5.14\MSWin32-x86-multi-thread\auto\XML\Parser\Encodings
C:\CPAN\arch\5.14.1\MSWin32-x86-multi-thread\XML\Parser\Encodings
C:\CPAN\arch\5.14.1\MSWin32-x86-multi-thread\auto\XML\Parser\Encodings
C:\CPAN\arch\MSWin32-x86-multi-thread\XML\Parser\Encodings
C:\CPAN\arch\5.14\XML\Parser\Encodings
C:\lib\XML\Parser\Encodings
C:\CPAN\XML\Parser\Encodings
C:\XML\Parser\Encodings
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\XML\Parser\Encodings
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\44727051c604ef6b79894b64d4c63832\Expat.dll
C:\CPAN\arch\5.14\MSWin32-x86-multi-thread\auto\XML\Parser\Expat
C:\CPAN\arch\5.14\MSWin32-x86-multi-thread\auto\auto\XML\Parser\Expat
C:\CPAN\arch\5.14.1\MSWin32-x86-multi-thread\auto\XML\Parser\Expat
C:\CPAN\arch\5.14.1\MSWin32-x86-multi-thread\auto\auto\XML\Parser\Expat
C:\CPAN\arch\MSWin32-x86-multi-thread\auto\XML\Parser\Expat
C:\CPAN\arch\5.14\auto\XML\Parser\Expat
C:\lib\auto\XML\Parser\Expat
C:\CPAN\auto\XML\Parser\Expat
C:\auto\XML\Parser\Expat
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\auto\XML\Parser\Expat
C:\Windows\system32\auto\XML\Parser\Expat\Expat.bs
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\2b1fc61b36a6711ea149b18bf3b41500\Parser.dll
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\dacfd0ab9b5fd029ed8d29e4482b0775\XS.dll
C:\Windows\system32\auto\JSON\XS\XS.dll
C:\CPAN\arch\5.14\MSWin32-x86-multi-thread\auto\JSON\XS
C:\CPAN\arch\5.14\MSWin32-x86-multi-thread\auto\auto\JSON\XS
C:\CPAN\arch\5.14.1\MSWin32-x86-multi-thread\auto\JSON\XS
C:\CPAN\arch\5.14.1\MSWin32-x86-multi-thread\auto\auto\JSON\XS
C:\CPAN\arch\MSWin32-x86-multi-thread\auto\JSON\XS
C:\CPAN\arch\5.14\auto\JSON\XS
C:\lib\auto\JSON\XS
C:\CPAN\auto\JSON\XS
C:\auto\JSON\XS
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\auto\JSON\XS
C:\Windows\system32\auto\JSON\XS\XS.bs
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\c344fd5536724b2af2e6453833b60203\SHA1.dll
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\eb138ef0e4282611dbf485a302784646\LibYAML.dll
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\de446fdd1ae335c7d2b9e62bb8cdf765\B.dll
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\bd5179a413bc0c4b82eedc22c6cab101\re.dll
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\b979ace6da01e63d651cce9ee2474fdc\Name.dll
C:\<C:\sample>auto\DBI\DESTROY.al
C:\auto\DBI\DESTROY.al
C:\Users\win7\AppData\Local\Temp\pdk-win7-1868\auto\DBI\DESTROY.al
1.217.680.0_TO_1.217.714.0_MPASDLTA.VDM._P
1.217.680.0_TO_1.217.714.0_MPAVDLTA.VDM._P
C:\Users\win7\AppData\Local\Temp\is-O2M7M.tmp\_isetup\_RegDLL.tmp
C:\Users\win7\AppData\Local\Temp\is-O2M7M.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-O2M7M.tmp\_isetup\_shfoldr.dll
C:\Users\win7\AppData\Local\Temp\000b8ac5.a
C:\Users\win7\AppData\Local\Temp\000b9286.a
C:\Users\win7\AppData\Local\Temp\758921\dlreport
http://www.eveofjustice.com/files/WL2.2.2-link.zip
\??\C:\Windows\system32\explorerframe.dll
C:\Windows\System32\
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
C:\Users\win7\AppData\Local\Temp\is-R48DI.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-R48DI.tmp\_isetup\_shfoldr.dll
C:\.lib\gameband.properties
C:\.lib\locale
C:\.lib\translations_en.properties
C:\.lib\.anon.data
/usr/local/ssl/openssl.cnf
C:\/gameband_log.log
C:\\minecraft\.mc.exe
C:\pic\splash3.bmp
C:\Users\win7\AppData\Local\Temp\\~DF807D64001FE39DCC.TMP
C:\Users\win7\AppData\Local\Temp\nsx987C.tmp\UserInfo.dll
C:\Users\win7\AppData\Local\Temp\nsx987C.tmp\System.dll
x
C:\Users\win7\AppData\Local\Temp\Opera Installer\opera_installer_20160406095615.log
C:\Users\win7\AppData\Local\Temp\Opera Installer\opera_installer_20160406095614.exe
C:\Users\win7\AppData\Local\Temp\nspD120.tmp\ioSpecial.ini
C:\Users\win7\AppData\Local\Temp\nspD120.tmp\modern-wizard.bmp
C:\Users\win7\AppData\Local\Temp\nspD120.tmp\InstallOptions.dll
C:\winrar.lng
C:\Users\win7\AppData\Roaming\WinRAR\version.dat
MsiDetector.xml
C:\ProgramData\Comodo\CCAV\ccavusage.sdb
C:\ProgramData\Comodo\CCAV\ccavusage.sdb-journal
C:\ProgramData\Comodo\CCAV\ccavusage.sdb-wal
C:\ProgramData\Comodo\CCAV\ccavusage.sdb-shm
C:\Users\win7\AppData\Local\Temp\ccavusage.sdb
C:\Users\win7\AppData\Local\Temp\ccavusage.sdb-journal
C:\Users\win7\AppData\Local\Temp\ccavusage.sdb-wal
C:\Users\win7\AppData\Local\Temp\ccavusage.sdb-shm
C:\5e9bb6160f29570403445143eb9f90\secondaryinstaller.exe.config
C:\5e9bb6160f29570403445143eb9f90\secondaryinstaller.exe
C:\Users\win7\AppData\Local\Temp\IXP000.TMP\BingDesktop.msi
C:\Windows\System32\msiexec.exe
C:\Windows\SysWOW64\activeds.tlb
C:\Users\win7\AppData\Local\Temp\chrome_installer.log
C:\Users\win7\AppData\Local\Google
C:\Users\win7\AppData\Local\Google\Chrome
C:\Users\win7\AppData\Local\Google\Chrome\Temp
C:\Users\win7\AppData\Local\Google\Chrome\Temp\source2416_26991
C:\Users\win7\AppData\Local\Temp\nsp9D78.tmp\modern-wizard.bmp
C:\Users\win7\AppData\Local\Temp\HFIEB1.tmp.html
c:\b96331e079800925b3a7\ParameterInfo.xml
C:\Users\win7\AppData\Local\Temp\Microsoft .NET Framework 3.5-KB2861697_20160406_092257331.html
c:\b96331e079800925b3a7\NDP35SP1-KB2861697.msp
1033\eula.rtf
c:\b96331e079800925b3a7\header.bmp
c:\b96331e079800925b3a7\watermark.bmp
C:\tconnectservice.exe
/etc/init.d/tconnect
C:\ProgramData\Takeaway.com\T-Connect\database.db
C:\ProgramData\Takeaway.com\T-Connect\database.db-journal
C:\Users\win7\AppData\Local\Temp\etilqs_gPTjsQCZJXVrRVv
C:\ProgramData\Takeaway.com\T-Connect\systemlog.db
C:\ProgramData\Takeaway.com\T-Connect\systemlog.db-journal
C:\Users\win7\AppData\Local\Temp\etilqs_SEdVPd1UpGS8Qrf
C:\Users\win7\AppData\Local\Temp\etilqs_GU5dXbDn5jqEhrY
C:\database.db
C:\Users\win7\AppData\Local\Temp\etilqs_qw4HWtFoGnvBgIr
C:\libeay32.dll
C:\ssleay32.dll
C:\zlib1.dll
C:\ProgramData\Takeaway.com\T-Connect\resource\keyboard_en_1
C:\ProgramData\Takeaway.com\T-Connect\resource\keyboard_en_2
C:\ProgramData\Takeaway.com\T-Connect\resource\keyboard_en_3
C:\ProgramData\Takeaway.com\T-Connect\resource\keyboard_en_4
C:\ProgramData\Takeaway.com\T-Connect\en.lang
C:\Users\win7\AppData\Local\Temp\nss331B.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\nss331B.tmp\UAC.dll
C:\Users\win7\AppData\Local\Temp\nss331B.tmp\bgintro.bmp
C:\Users\win7\AppData\Local\Temp\nss331B.tmp\appname.bmp
C:\Users\win7\AppData\Local\Temp\nss331B.tmp\clock.bmp
C:\Users\win7\AppData\Local\Temp\nss331B.tmp\particles.bmp
C:\Users\win7\AppData\Local\Temp\nss331B.tmp\pencil.bmp
C:\Users\win7\AppData\Local\Temp\nss331B.tmp\nsDialogs.dll
C:\Users\win7\AppData\Local\Temp\nss331B.tmp\InetBgDL.dll
C:\Users\win7\AppData\Local\Temp\nss331B.tmp\download.exe
w "C:\Users\win7\AppData\Local\Temp\nss331B.tmp\download.exe"
C:\Users\win7\AppData\Local\Temp\nss331B.tmp\CertCheck.dll
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
C:\Users\win7\AppData\Local\Temp\Cab4E57.tmp
C:\Users\win7\AppData\Local\Temp\Tar4E58.tmp
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_AB5EAAA21DF673505B87D680AC76B6E1
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_108A7991F73F2B507007C35661993162
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_AF71C1BB2E04981CC28D0E1D27405C45
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E506CEBBC8B162CFB2D72DB4891DCAE
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F4EA555947766F67C3BB52DEDFD509C5
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_108A7991F73F2B507007C35661993162
C:\Users\win7\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3979321414-2393373014-2172761192-1000\ea7d98b67203979fe2cf085282291e43_c4b6765a-c53d-4b48-b576-0e1db4e9f3bc
C:\Drivers\AR-NB2_M160M200_PCL_PS_0911a_EnglishUS_XPVistax64\setup.ini
C:\Users\win7\AppData\Local\Temp\{7C029741-4E9A-470A-92DA-703787A937A1}\setup.ini
C:\Drivers\AR-NB2_M160M200_PCL_PS_0911a_EnglishUS_XPVistax64\ISSetup.dll
C:\Drivers\AR-NB2_M160M200_PCL_PS_0911a_EnglishUS_XPVistax64\data1.hdr
C:\Drivers\AR-NB2_M160M200_PCL_PS_0911a_EnglishUS_XPVistax64\setup.isn
C:\Users\win7\AppData\Local\Temp\{7C029741-4E9A-470A-92DA-703787A937A1}\setup.isn
C:\Users\win7\AppData\Local\Temp\skinf609.rra
C:\Drivers\AR-NB2_M160M200_PCL_PS_0911a_EnglishUS_XPVistax64\setupdir\0009\setup.gif
C:\Drivers\AR-NB2_M160M200_PCL_PS_0911a_EnglishUS_XPVistax64\setup.gif
C:\Drivers\AR-NB2_M160M200_PCL_PS_0911a_EnglishUS_XPVistax64\layout.bin
C:\Drivers\AR-NB2_M160M200_PCL_PS_0911a_EnglishUS_XPVistax64\data1.cab
C:\Drivers\AR-NB2_M160M200_PCL_PS_0911a_EnglishUS_XPVistax64\setup.exe
C:\Drivers\AR-NB2_M160M200_PCL_PS_0911a_EnglishUS_XPVistax64\_setup.dll
C:\Drivers\AR-NB2_M160M200_PCL_PS_0911a_EnglishUS_XPVistax64\setup.inx
C:\Users\win7\AppData\Local\Temp\f741.rra
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\{673E2CB8-8306-4F99-9DF9-6492C2F57072}\setuf7ce.rra
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\{673E2CB8-8306-4F99-9DF9-6492C2F57072}\licef81c.rra
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\coref81c.rra
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\dotnf82c.rra
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\{673E2CB8-8306-4F99-9DF9-6492C2F57072}\Fontf83b.rra
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\ISBEf83b.rra
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\{673E2CB8-8306-4F99-9DF9-6492C2F57072}\Strif83b.rra
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\{673E2CB8-8306-4F99-9DF9-6492C2F57072}\isrtf85a.rra
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\{673E2CB8-8306-4F99-9DF9-6492C2F57072}\defaf86a.rra
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\{673E2CB8-8306-4F99-9DF9-6492C2F57072}\_IsRf86a.rra
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\{673E2CB8-8306-4F99-9DF9-6492C2F57072}\difxf87a.rra
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\{673E2CB8-8306-4F99-9DF9-6492C2F57072}\setup.inx
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\{673E2CB8-8306-4F99-9DF9-6492C2F57072}\ISRT.dll
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\{673E2CB8-8306-4F99-9DF9-6492C2F57072}\_isres.dll
C:\Users\win7\AppData\Local\Temp\isprf9f1.rra
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\{673E2CB8-8306-4F99-9DF9-6492C2F57072}\skinfa00.rra
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\{673E2CB8-8306-4F99-9DF9-6492C2F57072}\StringTable-0009-English.ips
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\corecomp.ini
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\{673E2CB8-8306-4F99-9DF9-6492C2F57072}\default.pal
C:\Drivers\AR-NB2_M160M200_PCL_PS_0911a_EnglishUS_XPVistax64\_isusr32.dll
C:\Drivers\AR-NB2_M160M200_PCL_PS_0911a_EnglishUS_XPVistax64\data2.cab
C:\Drivers\AR-NB2_M160M200_PCL_PS_0911a_EnglishUS_XPVistax64\_isusrrs.dll
C:\Drivers\AR-NB2_M160M200_PCL_PS_0911a_EnglishUS_XPVistax64\seaeis.sii
C:\Drivers\AR-NB2_M160M200_PCL_PS_0911a_EnglishUS_XPVistax64\uprn64.dll
C:\Drivers\AR-NB2_M160M200_PCL_PS_0911a_EnglishUS_XPVistax64\DrvInst.exe
C:\Drivers\AR-NB2_M160M200_PCL_PS_0911a_EnglishUS_XPVistax64\_isusrxp.dll
C:\Drivers\AR-NB2_M160M200_PCL_PS_0911a_EnglishUS_XPVistax64\iswlh64.dll
C:\Drivers\AR-NB2_M160M200_PCL_PS_0911a_EnglishUS_XPVistax64\setup.sii
C:\Drivers\AR-NB2_M160M200_PCL_PS_0911a_EnglishUS_XPVistax64\EnglishA\sealang.sii
C:\Drivers\AR-NB2_M160M200_PCL_PS_0911a_EnglishUS_XPVistax64\EnglishA\seaeins.sii
C:\Windows\seae88.rra
C:\Drivers\AR-NB2_M160M200_PCL_PS_0911a_EnglishUS_XPVistax64\EnglishA\seahins.sii
C:\Windows\seah98.rra
C:\Drivers\AR-NB2_M160M200_PCL_PS_0911a_EnglishUS_XPVistax64\EnglishA\seains.sii
C:\Drivers\AR-NB2_M160M200_PCL_PS_0911a_EnglishUS_XPVistax64\EnglishA\
C:\Drivers\AR-NB2_M160M200_PCL_PS_0911a_EnglishUS_XPVistax64\DiscFltr.dll
C:\Drivers\AR-NB2_M160M200_PCL_PS_0911a_EnglishUS_XPVistax64\DiscFltr.dat
C:\Users\win7\AppData\Local\Temp\autEA7E.tmp
C:\\LangManager.ini
C:\7za\7z.exe
C:\7za\7za.exe
C:\Users\win7\AppData\Local\Temp\autEB2B.tmp
C:\\load.gif
C:\Users\win7\AppData\Local\Temp\\~DFBF19F6C63982335F.TMP
C:\Users\win7\AppData\Local\Temp\nscB29B.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\nsb2134.tmp
C:\Users\win7\AppData\Local\Temp\nsr2145.tmp\trialpay.bmp
C:\Users\win7\AppData\Local\Temp\nsr2145.tmp\paypal.bmp
C:\Users\win7\AppData\Local\Temp\nsr2145.tmp\bitcoin.bmp
C:\Users\win7\AppData\Local\Temp\nsr2145.tmp\modern-header.bmp
C:\Users\win7\AppData\Local\Temp\nsr2145.tmp\processwork.dll
1.217.560.0_TO_1.217.756.0_MPASDLTA.VDM._P
1.217.560.0_TO_1.217.756.0_MPAVDLTA.VDM._P
C:\Users\win7\AppData\Local\Temp\nsn1652.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\is-QRQ3F.tmp\sample.tmp
C:\Users\win7\AppData\Local\Temp\is-MKMAE.tmp\_isetup\_RegDLL.tmp
C:\Users\win7\AppData\Local\Temp\is-MKMAE.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-MKMAE.tmp\_isetup\_shfoldr.dll
C:\Users\win7\AppData\Local\Temp\is-MKMAE.tmp\splashtm.bmp
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_DF4CA81DC775CDA9B3214BDB5B55900E
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\40C68D5626484A90937F0752C8B950AB
mciseq.dll
C:\Program Files\desktop.ini
C:\Program Files
C:\Doom95.exe
C:\Users\win7\AppData\Local\Temp\\~DFC60A7B0919EA7B57.TMP
C:\Windows\SysWOW64\scrrun.dll
C:\sample.exe
C:\Windows\SysWOW64\wshom.ocx
C:\Users\win7\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini
C:\Users\win7\AppData\Local\Temp\nsr6DBE.tmp\System.dll
C:\Users\win7\AppData\Roaming\Logishrd
C:\Users\win7\AppData\Local\Temp\TMPE2E9.exe
C:\Users\win7\AppData\Roaming\Microsoft\Internet Explorer
C:\Users\win7\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch
C:\Users\win7\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned
C:\Users\win7\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar
C:\Users\win7\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\UCOh.lnk
C:\Users\win7\AppData\Local\Temp\nstB46.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\nstB46.tmp\CityHash.dll
C:\Windows\system32\
C:\C:\sample
C:\Users\win7\AppData\Local\Temp\ptnD205.tmp
C:\Users\win7\AppData\Roaming\Psiphon3\psiphon.config
C:\Users\win7\AppData\Roaming\Psiphon3\psiphon.boltdb
C:\Users\win7\AppData\Roaming\Psiphon3\server_list.dat
c:\sample
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\main[1]
C:\Windows\System32\msxml3.dll\1
C:\Windows\System32\msxml3.dll
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\logo-bw[1]
C:\WINDOWS\FONTS\SEGOEUIB.TTF
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\icomoon[1]
C:\Users\win7\AppData\Local\Temp\dat936A.tmp
C:\WINDOWS\FONTS\MSYHBD.TTF
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\banner[1]
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\flags32[1]
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\flag_unknown_64[1]
C:\Users\win7\AppData\Local\Temp\psiphon-tunnel-core.exe
C:\Users\win7\AppData\Local\Temp\0009fe98.a
C:\Users\win7\AppData\Local\Temp\000a05bc.a
C:\Users\win7\AppData\Local\Temp\657515\dlreport
__tmp_rar_sfx_access_check_683390
steam_api.dll
C:\Windows\system32\en-US\erofflps.txt
C:\Users\win7\AppData\Local\Temp\WER86C0.tmp.WERInternalMetadata.xml
C:\Users\win7\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_sample_5a984f1bc10616efb11a273fb9ae1e865d0f114_05c286ee\Report.wer
C:\ProgramData\6cd7b088-ad43-47a9-9f65-96d8797bb92b\temp
C:\Users\win7\AppData\Local\Temp\nsf100.tmp\System.dll
C:\Windows\wmsetup.log
C:\Users\win7\AppData\Local\Temp\tmp01062.WMC\control.xml
C:\Users\win7\AppData\Local\Temp\HFIDB22.tmp.html
C:\Users\win7\AppData\Local\Temp\Setup_20160406_184707832.html
c:\e3f36a8ae28746d76c9e278a\UiInfo.xml
c:\e3f36a8ae28746d76c9e278a\ParameterInfo.xml
c:\e3f36a8ae28746d76c9e278a\SplashScreen.bmp
c:\e3f36a8ae28746d76c9e278a\1033\LocalizedData.xml
c:\e3f36a8ae28746d76c9e278a\1025\LocalizedData.xml
c:\e3f36a8ae28746d76c9e278a\1028\LocalizedData.xml
c:\e3f36a8ae28746d76c9e278a\1029\LocalizedData.xml
c:\e3f36a8ae28746d76c9e278a\1030\LocalizedData.xml
c:\e3f36a8ae28746d76c9e278a\1031\LocalizedData.xml
c:\e3f36a8ae28746d76c9e278a\1032\LocalizedData.xml
c:\e3f36a8ae28746d76c9e278a\1035\LocalizedData.xml
c:\e3f36a8ae28746d76c9e278a\1036\LocalizedData.xml
c:\e3f36a8ae28746d76c9e278a\1037\LocalizedData.xml
c:\e3f36a8ae28746d76c9e278a\1038\LocalizedData.xml
c:\e3f36a8ae28746d76c9e278a\1040\LocalizedData.xml
c:\e3f36a8ae28746d76c9e278a\1041\LocalizedData.xml
c:\e3f36a8ae28746d76c9e278a\1042\LocalizedData.xml
c:\e3f36a8ae28746d76c9e278a\1043\LocalizedData.xml
c:\e3f36a8ae28746d76c9e278a\1044\LocalizedData.xml
c:\e3f36a8ae28746d76c9e278a\1045\LocalizedData.xml
c:\e3f36a8ae28746d76c9e278a\1046\LocalizedData.xml
c:\e3f36a8ae28746d76c9e278a\1049\LocalizedData.xml
c:\e3f36a8ae28746d76c9e278a\1053\LocalizedData.xml
c:\e3f36a8ae28746d76c9e278a\1055\LocalizedData.xml
c:\e3f36a8ae28746d76c9e278a\2052\LocalizedData.xml
c:\e3f36a8ae28746d76c9e278a\2070\LocalizedData.xml
c:\e3f36a8ae28746d76c9e278a\3076\LocalizedData.xml
c:\e3f36a8ae28746d76c9e278a\3082\LocalizedData.xml
C:\Users\win7\AppData\Local\Temp\KB2446708_20160406_184708535.html
c:\e3f36a8ae28746d76c9e278a\SetupUi.xsd
c:\e3f36a8ae28746d76c9e278a\Strings.xml
C:\Users\win7\AppData\Local\Temp\HFIDF2D.tmp.html
c:\e3f36a8ae28746d76c9e278a\graphics\print.ico
c:\e3f36a8ae28746d76c9e278a\graphics\save.ico
c:\e3f36a8ae28746d76c9e278a\graphics\setup.ico
c:\e3f36a8ae28746d76c9e278a\header.bmp
c:\e3f36a8ae28746d76c9e278a\watermark.bmp
c:\e3f36a8ae28746d76c9e278a\1033\EULA.rtf
c:\e3f36a8ae28746d76c9e278a\graphics\SysReqMet.ico
c:\e3f36a8ae28746d76c9e278a\graphics\SysReqNotMet.ico
C:\Users\win7\AppData\Local\Temp\nsc68A9.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\nsc68A9.tmp\nsExec.dll
C:\Users\win7\AppData\Local\Temp\Autodesk-WebInstall3StubGUI-execution.log
C:\Users\win7\AppData\Local\Temp\install_log.log
C:\Users\win7\AppData\Local\Temp\VSDD4DE.tmp\dotnetfx\dotnetchk.exe.config
C:\EsgInstallerResumeAction
C:\Users\win7\AppData\Local\Temp\esg_setup.log
C:\Users\win7\AppData\Local\Temp\nso8B06.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\nso8B06.tmp\modern-wizard.bmp
C:\Users\win7\AppData\Local\Temp\nso8B06.tmp\nsDialogs.dll
C:\Users\win7\AppData\Local\Temp\nso8B06.tmp\INetC.dll
C:\Users\win7\AppData\Local\Temp\nso8B06.tmp\install_flash_player_plugin.exe
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\install_flash_player[1].exe
C:\Users\win7\AppData\Local\Temp\nso8B06.tmp\nsExec.dll
xxz.dat
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\mediaget-tmp-4899.tmp
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\360_offer.jpg
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\cancel_page.jpg
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\cancel_page_en.jpg
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\cancel_page_tr.jpg
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\adkiller-cancel-en.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\adkiller-cancel.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\adkiller-install-en.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\adkiller-install.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\adkiller-logo.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\cancel-cancel-grey-en.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\cancel-cancel-grey.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\cancel-cancel-tr.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\cancel-cancel.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\cancel-try-en.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\cancel-try-tr.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\cancel-try.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\checkbox-off.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\checkbox-on.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\checkbox-white-off.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\checkbox-white-on.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\close.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\custom-back.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\indir-tr.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\mediaget-logo.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\next-big-tr.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\next-en.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\next-hovered-en.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\next-hovered-tr.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\next-hovered.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\next-tr.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\next.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\yandex-logo-ru.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\img\yandex-logo-tr.png
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\stub.html
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\js\jquery-ui.min.1.8.0.js
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\js\jquery.min.1.6.4.js
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\cancel-en.template
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\cancel-tr.template
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\cancel.template
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\index.template
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\install-min.template
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\install.template
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\page.template
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\postinstall.template
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\preinstall.template
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\preinstall_1.template
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\preinstall_2.template
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp\index.html
C:\Users\win7\AppData\Local\Temp\mediaget-installer-tmp
C:\apilog.txt
C:\Users\win7\AppData\Local\Temp\IXP000.TMP\dev32.exe
C:\Users\win7\AppData\Local\Temp\IXP000.TMP\dev64.exe
C:\Users\win7\AppData\Local\Temp\IXP000.TMP\Install.exe
C:\Users\win7\AppData\Local\Temp\IXP000.TMP\Install.ini
C:\Users\win7\AppData\Local\Temp\IXP000.TMP\win732.exe
C:\Users\win7\AppData\Local\Temp\IXP000.TMP\win764.exe
C:\WBDJA44I.DLL
C:\Users\win7\AppData\Local\Temp\nse340B.tmp
C:\Users\win7\AppData\Local\Temp\nsz34D7.tmp\System.dll
C:\WINDOWS\FONTS\VERDANAI.TTF
C:\WINDOWS\FONTS\VERDANAZ.TTF
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config
C:\translations.xml
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.pdb
C:\Windows\symbols\dll\System.Windows.Forms.pdb
C:\Windows\dll\System.Windows.Forms.pdb
C:\Windows\System.Windows.Forms.pdb
C:\Users\win7\AppData\Local\Temp\$inst\2.tmp
C:\Users\win7\AppData\Local\Temp\$inst\7.tmp
C:\Users\win7\AppData\Local\Temp\$inst\9.tmp
C:\Users\win7\AppData\Local\Temp\$inst\temp_0.tmp
C:\install.cfg
C:\Intel\Logs\IntelGFX.log
__tmp_rar_sfx_access_check_669578
Russian.lg
SystemInstall.bat
vp8decoder.dll
vp8encoder.dll
webmmux.dll
webmvorbisdecoder.dll
webmvorbisencoder.dll
WUDLicense.exe
xpsrchv.exe
drv_set.reg
C:\Users\win7\AppData\Local\Google\Chrome\Temp\source2764_11995
\\?\ide#diskvbox_harddisk___________________________1.0_____#5&33d1638a&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
C:\Users\win7\AppData\Local\Temp\IXP000.TMP\install.bat
C:\Users\win7\AppData\Local\Temp\GUMD3F.tmp\goopdate.dll
C:\ProgramData\Dropbox\Update\Log\DropboxUpdate.log-2016-04-06-20-32-58-649-1984
C:\Intel\Logs\IntelAMT.log
C:\Users\win7\AppData\Local\Temp\is-FFR0B.tmp\_isetup\_RegDLL.tmp
C:\Users\win7\AppData\Local\Temp\is-FFR0B.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-FFR0B.tmp\_isetup\_shfoldr.dll
C:\Users\win7\AppData\Local\Temp\is-FFR0B.tmp\ISDone.dll
C:\Users\win7\AppData\Local\Temp\is-FFR0B.tmp\b2p.dll
C:\Users\win7\AppData\Local\Temp\is-FFR0B.tmp\botva2.dll
C:\Users\win7\AppData\Local\Temp\is-GBSIV.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-GBSIV.tmp\_isetup\_shfoldr.dll
C:\Users\win7\AppData\Local\Temp\is-2PJMN.tmp\_isetup\_RegDLL.tmp
C:\Users\win7\AppData\Local\Temp\is-2PJMN.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-2PJMN.tmp\_isetup\_shfoldr.dll
C:\Users\win7\AppData\Local\Temp\nsvEAAE.tmp
C:\Users\win7\AppData\Local\Temp\nslEB5B.tmp\System.dll
http://java.com/download
__tmp_rar_sfx_access_check_749890
tapinstall.exe
C:\Users\win7\AppData\Local\Temp\RarSFX0\tapinstall.exe
C:\Users\win7\AppData\Local\Temp\RarSFX0
C:\Users\win7\AppData\Local\Temp\nsvF51C.tmp
C:\Users\win7\AppData\Local\Temp\nslF5C9.tmp\System.dll
1.217.747.0_TO_1.217.786.0_MPASDLTA.VDM._P
1.217.747.0_TO_1.217.786.0_MPAVDLTA.VDM._P
C:\Users\win7\AppData\Local\Temp\nsx190E.tmp
C:\Users\win7\AppData\Local\Temp\nsn19BB.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\nst892.tmp\LogEx.dll
C:\Users\win7\AppData\Local\Temp\NXPProximityInstaller\install_log.txt
C:\Users\win7\AppData\Local\Temp\nst892.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\nst892.tmp\LangDLL.dll
C:\Users\win7\AppData\Local\Temp\NXPProximityInstaller\binutils\x64\devcon.exe
C:\Users\win7\AppData\Local\Temp\NXPProximityInstaller\binutils\x86\devcon.exe
C:\Users\win7\AppData\Local\Temp\NXPProximityInstaller\binutils\x64\AppDrv.exe
C:\Users\win7\AppData\Local\Temp\NXPProximityInstaller\binutils\x86\AppDrv.exe
C:\Users\win7\AppData\Local\Temp\NXPProximityInstaller\binutils\VersionChecker.exe
C:\Users\win7\AppData\Local\Temp\NXPProximityInstaller\regkey\galapagosRegKey.reg
C:\Users\win7\AppData\Local\Temp\NXPProximityInstaller\binutils\x86\CertMgr.exe
C:\Users\win7\AppData\Local\Temp\NXPProximityInstaller\binutils\x64\CertMgr.exe
C:\Users\win7\AppData\Local\Temp\NXPProximityInstaller\driver\x86\nxpnfpprovider.cat
C:\Users\win7\AppData\Local\Temp\NXPProximityInstaller\driver\x86\NxpNfpProvider.dll
C:\Users\win7\AppData\Local\Temp\NXPProximityInstaller\driver\x86\NxpNfpProvider_Win7.inf
C:\Users\win7\AppData\Local\Temp\NXPProximityInstaller\driver\x86\NxpNfpProvider_Win8.inf
C:\Users\win7\AppData\Local\Temp\NXPProximityInstaller\driver\x86\libpn547_fw.dll
C:\Users\win7\AppData\Local\Temp\NXPProximityInstaller\driver\x86\NxpNfcRM.dll
C:\Users\win7\AppData\Local\Temp\NXPProximityInstaller\driver\x86\WudfUpdate_01011.dll
C:\Users\win7\AppData\Local\Temp\NXPProximityInstaller\driver\x64\nxpnfpprovider.cat
C:\Users\win7\AppData\Local\Temp\NXPProximityInstaller\driver\x64\NxpNfpProvider.dll
C:\Users\win7\AppData\Local\Temp\NXPProximityInstaller\driver\x64\NxpNfpProvider_Win7.inf
C:\Users\win7\AppData\Local\Temp\NXPProximityInstaller\driver\x64\NxpNfpProvider_Win8.inf
C:\Users\win7\AppData\Local\Temp\NXPProximityInstaller\driver\x64\libpn547_fw.dll
C:\Users\win7\AppData\Local\Temp\NXPProximityInstaller\driver\x64\NxpNfcRM.dll
C:\Users\win7\AppData\Local\Temp\NXPProximityInstaller\driver\x64\WudfUpdate_01011.dll
C:\Users\win7\AppData\Local\Temp\NXPProximityInstaller\driver\x86\NxpNfpProvider.cer
C:\Users\win7\AppData\Local\Temp\NXPProximityInstaller\driver\x64\NxpNfpProvider.cer
C:\Users\win7\AppData\Local\Temp\nst892.tmp\execDos.dll
C:\Users\win7\AppData\Local\Temp\is-EO950.tmp\_isetup\_RegDLL.tmp
C:\Users\win7\AppData\Local\Temp\is-EO950.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-EO950.tmp\_isetup\_shfoldr.dll
C:\config\product.ini
C:\Config\NLS\LangConv.ini
C:\Users\win7\AppData\Local\Temp\install.log
C:\Config\NLS\en.nls
C:\Config\NLS\Common.nls
C:\Config\NLS\OEM.nls
C:\Users\win7\AppData\Local\Temp\WIN7-PC-20160407-0336.log
C:\Users\win7\AppData\Local\Temp\OfficeC2RB660EE87-6CBD-487B-877F-1328CCEA4D05\v32.cab
C:\Users\win7\AppData\Local\Temp\OfficeC2RB660EE87-6CBD-487B-877F-1328CCEA4D05OfficeC2R13DFB8A2-F0A7-4176-B433-5124360962DF\v32.hash
C:\Users\win7\AppData\Local\Temp\OfficeC2RB660EE87-6CBD-487B-877F-1328CCEA4D05OfficeC2R13DFB8A2-F0A7-4176-B433-5124360962DF\VersionDescriptor.xml
C:\Users\win7\AppData\Local\Temp\OfficeC2RB660EE87-6CBD-487B-877F-1328CCEA4D05\VersionDescriptor.xml
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\mbahost.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\BootstrapperCore.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\mbapreq.wxl
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\1028\mbapreq.wxl
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\1030\mbapreq.wxl
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\1031\mbapreq.wxl
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\1032\mbapreq.wxl
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\1035\mbapreq.wxl
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\1036\mbapreq.wxl
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\1038\mbapreq.wxl
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\1041\mbapreq.wxl
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\1042\mbapreq.wxl
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\1043\mbapreq.wxl
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\1044\mbapreq.wxl
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\1045\mbapreq.wxl
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\1046\mbapreq.wxl
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\1051\mbapreq.wxl
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\1060\mbapreq.wxl
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\3082\mbapreq.wxl
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\BootstrapperCore.config
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\Microsoft.Deployment.Compression.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\Microsoft.Deployment.Compression.Cab.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\wix.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\winterop.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\Bootstrapper.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\Intel.Tools.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\IIF4Common.dll
\\.\pipe\BurnPipe.{390383CD-9143-4AF7-93C1-CCA8B896C1E9}
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\ar-SA\Bootstrapper.resources.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\da-DK\Bootstrapper.resources.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\de-DE\Bootstrapper.resources.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\el-GR\Bootstrapper.resources.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\mbapreq.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\mbapreq.thm
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\1049\mbapreq.wxl
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\2052\mbapreq.wxl
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\2070\mbapreq.wxl
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\cs-CZ\Bootstrapper.resources.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\es-ES\Bootstrapper.resources.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\fi-FI\Bootstrapper.resources.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\fr-FR\Bootstrapper.resources.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\he-IL\Bootstrapper.resources.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\hr-HR\Bootstrapper.resources.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\hu-HU\Bootstrapper.resources.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\it-IT\Bootstrapper.resources.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\ja-JP\Bootstrapper.resources.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\ko-KR\Bootstrapper.resources.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\nb-NO\Bootstrapper.resources.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\pt-PT\Bootstrapper.resources.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\ro-RO\Bootstrapper.resources.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\ru-RU\Bootstrapper.resources.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\sk-SK\Bootstrapper.resources.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\sl-SI\Bootstrapper.resources.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\sv-SE\Bootstrapper.resources.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\tr-TR\Bootstrapper.resources.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\zh-CN\Bootstrapper.resources.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\zh-TW\Bootstrapper.resources.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\mbapreq.png
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\1029\mbapreq.wxl
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\1040\mbapreq.wxl
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\1053\mbapreq.wxl
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\1055\mbapreq.wxl
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\th-TH\Bootstrapper.resources.dll
C:\Users\win7\AppData\Local\Temp\{755abcd0-2942-482b-a27d-22921a5849f0}\.ba1\BootstrapperApplicationData.xml
C:\Users\win7\AppData\Local\Temp\Intel_Integrated_Sensor_Solution_20160407041017.log
C:\Users\win7\AppData\Local\Temp\27G1G705\sample\presetup.rgn
C:\Users\win7\AppData\Local\Temp\27G1G705\sample\presetup.bmp
C:\Users\win7\AppData\Local\Temp\27G1G705\sample\presetup\License.txt
C:\Users\win7\AppData\Local\Temp\27G1G705\sample\plugins\0\StdUI.dll
C:\Users\win7\AppData\Local\Temp\27G1G705\sample\plugins\0\lng\Enu.lng
C:\Users\win7\AppData\Local\Temp\27G1G705\sample\plugins\0\lng\Epo.lng
C:\Users\win7\AppData\Local\Temp\27G1G705\sample\plugins\0\lng\Deu.lng
C:\Users\win7\AppData\Local\Temp\27G1G705\sample\plugins\0\lng\Fra.lng
C:\Users\win7\AppData\Local\Temp\27G1G705\sample\plugins\0\lng\Rus.lng
C:\Users\win7\AppData\Local\Temp\27G1G705\sample\db.pdb
C:\Users\win7\AppData\Local\Temp\27G1G705\sample\main.pdb
C:\Users\win7\AppData\Local\Temp\27G1G705\sample\lng\Enu.lng
C:\Users\win7\AppData\Local\Temp\27G1G705\sample\lng\Epo.lng
C:\Users\win7\AppData\Local\Temp\27G1G705\sample\lng\Deu.lng
C:\Users\win7\AppData\Local\Temp\27G1G705\sample\lng\Fra.lng
C:\Users\win7\AppData\Local\Temp\27G1G705\sample\lng\Rus.lng
C:\Users\win7\AppData\Local\Temp\27G1G705\sample\Uninstall.exe
C:\USERS\WIN7\APPDATA\LOCAL\TEMP\27G1G705\SAMPLE\PLUGINS\0\LNG\ENU.LNG
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bazooka Scanner\Bazooka.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bazooka Scanner\Manual.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bazooka Scanner\Faq.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bazooka Scanner\Uninstall.lnk
C:\setup.ini
0x0000.ini
C:\Users\win7\AppData\Roaming\SOLIDWORKS\Installation Logs\BgDwld\sldBgDwldLog_00001.txt
C:\ProgramData\6f66c052-8827-4487-9031-09becb0cf541\temp
C:\Users\win7\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\Install.log
/dev/urandom
C:\Users\win7\AppData\Local\Temp\nsoA7B9.tmp\ISF_NSIS_UTIL.dll
C:\Users\win7\AppData\Local\Temp\setup.exe
C:\Viewer.00
C:\Program Files\Internet Explorer
C:\Windows\SysWOW64\rundll32.exe
C:\Users\win7\AppData\Local\Temp\nseCDDF.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\TempFolder.aaa\Macromedia.lok
C:\Users\win7\AppData\Local\Temp\TempFolder.aaa\proj.dll
C:\Users\win7\AppData\Local\Temp\TempFolder.aaa\dirapi.dll
C:\Users\win7\AppData\Local\Temp\TempFolder.aaa\iml32.dll
C:\Users\win7\AppData\Local\Temp\TempFolder.aaa\msvcrt.dll
C:\Users\win7\AppData\Local\Temp\TempFolder.aaa\dirapi.mch
C:\LINGO.INI
C:\Users\win7\AppData\Local\Temp\TempFolder.aaa\xtras\temp0000
C:\Users\win7\AppData\Local\Temp\TempFolder.aaa\xtras\INetURL.x32
C:\Users\win7\AppData\Local\Temp\TempFolder.aaa\xtras\NetFile.x32
C:\Users\win7\AppData\Local\Temp\TempFolder.aaa\xtras\NetLingo.x32
C:\Users\win7\AppData\Local\Temp\TempFolder.aaa\xtras\SWADCmpr.x32
C:\Users\win7\AppData\Local\Temp\TempFolder.aaa\xtras\DirectSound.x32
C:\Users\win7\AppData\Local\Temp\TempFolder.aaa\xtras\Sound Control.x32
C:\Users\win7\AppData\Local\Temp\TempFolder.aaa\xtras\AVI Agent.x32
C:\Users\win7\AppData\Local\Temp\TempFolder.aaa\xtras\Mix Services.x32
C:\Users\win7\AppData\Local\Temp\TempFolder.aaa\xtras\Text Asset.x32
C:\Users\win7\AppData\Local\Temp\TempFolder.aaa\xtras\TextXtra.x32
C:\Users\win7\AppData\Local\Temp\TempFolder.aaa\xtras\Font Xtra.x32
C:\Users\win7\AppData\Local\Temp\TempFolder.aaa\xtras\PrintOMatic Lite MX.x32
C:\Users\win7\AppData\Local\Temp\TempFolder.aaa\xtras\QT6Asset.x32
C:\Users\win7\AppData\Local\Temp\TempFolder.aaa\xtras\epsonXtra.x32
C:\Users\win7\AppData\Local\Temp\TempFolder.aaa\xtras\budapi.x32
C:\Users\win7\AppData\Local\Temp\TempFolder.aaa\xtras\PNG Import Export.x32
C:\Users\win7\AppData\Local\Temp\TempFolder.aaa\xtras\Flash Asset.x32
C:\Users\win7\AppData\Local\Temp\TempFolder.aaa\xtras\JPEG Agent.x32
C:\Users\win7\AppData\Local\Temp\TempFolder.aaa\xtras\FileIo.x32
Splash.png.lnk
C:\Windows\Splash.png.lnk\desktop.ini
C:\desktop.ini
C:\Users\win7\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db
C:\Users\win7\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db
C:\Users\win7\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db
C:\Users\win7\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1024.db
C:\Users\win7\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db
C:\Users\win7\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
\\localhost\C$
C:\Splash.png
C:\sample.log
\\.\PhysicalDrive5
\\.\PhysicalDrive6
\\.\PhysicalDrive7
\\.\PhysicalDrive8
\\.\PhysicalDrive9
\\.\PhysicalDrive10
\\.\PhysicalDrive11
\\.\PhysicalDrive12
\\.\PhysicalDrive13
\\.\PhysicalDrive14
\\.\PhysicalDrive15
\\.\pipe\cygwin-7d2b541f81e048bd-1352-sigwait
C:\Users\win7\AppData\Local\Temp\nsm535B.tmp
C:\Users\win7\AppData\Local\Temp\nsy582E.tmp\nsExec.dll
C:\Users\win7\AppData\Roaming\Juniper Networks\Setup Client\JuniperSetupClientOCX64.exe
C:\Windows\Downloaded Program Files\install.log
C:\Windows\Downloaded Program Files\JuniperSetupClient64.inf
C:\Users\win7\AppData\Local\Temp\nsiF01D.tmp\System.dll
C:\Windows\Downloaded Program Files\JuniperSetupClient64.ocx
C:\Windows\Downloaded Program Files\JuniperExt64.exe
C:\Windows\Downloaded Program Files\JuniperSetupClientCtrlUninstaller64.exe
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B8944BA8AD0EFDF0E01A43EF62BECD0_26300638DA5DAC8F64C5E0B68BBFDC2C
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B8944BA8AD0EFDF0E01A43EF62BECD0_6FD44B103AF754F5F9D6957CD04B28FE
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6
C:\Windows\Downloaded Program Files\JuniperSetupClient64.REBOOT
C:\Users\win7\AppData\Roaming\Juniper Networks\Setup Client\JuniperSetupAutoupgrade.param
C:\Windows\Downloaded Program Files\JuniperSetupClient.ocx
\\GetSys Error\pipe\sql\query
C:\FileZilla Server Interface.xml
C:\Themes
C:\WinRAR.exe
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk
C:\WinRAR.chm
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk
C:\Rar.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk
C:\Users\win7\AppData\Local\Temp\KSS\SWMaintDateCheck.exe.config
C:\Users\win7\AppData\Local\Temp\KSS\SWMaintDateCheck.exe
C:\Users\win7\AppData\Local\Temp\KSS\log4net.dll
C:\Users\win7\AppData\Local\Temp\KSS\Microsoft.Web.Services3.dll
C:\Users\win7\AppData\Local\Temp\KSS\SolarWinds.Licensing.Framework.dll
C:\Users\win7\AppData\Local\Temp\KSS\SolarWinds.Logging.dll
C:\Users\win7\AppData\Local\Temp\KSS\log4net.xml
C:\Users\win7\AppData\Local\Temp\7zS4034.tmp\wifi-config.exe
C:\Users\win7\AppData\Local\Temp\7zS4034.tmp
logo.bmp
C:\Users\win7\AppData\Local\Temp\\~DFCF17092AD11F6CB7.TMP
\\.\pipe\OperaCrashReporter2632
C:\Users\win7\AppData\Local\Temp\Opera Installer\opera_installer_20160407132926.log
C:\Users\win7\AppData\Local\Temp\Opera Installer\opera_installer_20160407132925.exe
C:\sppgpath.dat
C:\Users\win7\AppData\Local\Temp\is-RPGEI.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-RPGEI.tmp\_isetup\_shfoldr.dll
C:\Users\win7\AppData\Local\Temp\is-RPGEI.tmp\OCSetupHlp.dll
C\aped
\\.\pipe\OperaCrashReporter1076
C:\Users\win7\AppData\Local\Temp\Opera Installer\opera_installer_20160407143530.log
C:\Users\win7\AppData\Local\Temp\Opera Installer\opera_installer_20160407143529.exe
C:\Windows\system32\LocalInfo.dat
C:\Users\win7\AppData\Local\Temp\is-R4JTE.tmp\CNCBGuardReg.exe
C:\ProgramData\NortonInstaller\Logs\2016-04-07-14h52m58s\NortonInstall-2016-04-07-14h52m58s.log
C:\Users\win7\AppData\Local\Temp\CR_7EA0A.tmp\CHROME_PATCH.PACKED.7Z
C:\Users\win7\AppData\Local\Temp\CR_7EA0A.tmp\SETUP_PATCH.PACKED.7Z
C:\Users\win7\AppData\Local\Temp\pft7A9B.tmp\pftw1.pkg
C:\Users\win7\AppData\Local\Temp\pft7A9B.tmp\MSetup.exe
C:\Users\win7\AppData\Local\Temp\pft7A9B.tmp\ConsoleInatall.exe
C:\Users\win7\AppData\Local\Temp\pft7A9B.tmp\Download_8110.ocx
C:\Users\win7\AppData\Local\Temp\pft7A9B.tmp\LocalInstall.exe
C:\Users\win7\AppData\Local\Temp\pft7A9B.tmp\LocalInstall.ini
C:\Users\win7\AppData\Local\Temp\pft7A9B.tmp\multiview.ini
C:\Users\win7\AppData\Local\Temp\pft7A9B.tmp\RegOCX.INI
C:\Users\win7\AppData\Local\Temp\pft7A9B.tmp\Install_OCX.exe
C:\Users\win7\AppData\Local\Temp\pft7A9B.tmp\OCXDownloadChecker_8300.ocx
C:\Users\win7\AppData\Local\Temp\pft7A9B.tmp\MSetup_1024768.exe
C:\Users\win7\AppData\Local\Temp\is-A6DC6.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-A6DC6.tmp\_isetup\_shfoldr.dll
C:\Users\win7\AppData\Local\Temp\is-A6DC6.tmp\botva2.dll
C:\Users\win7\AppData\Local\Temp\is-A6DC6.tmp\innocallback.dll
C:\Users\win7\AppData\Local\Temp\is-A6DC6.tmp\bg_en.png
C:\Users\win7\AppData\Local\Temp\is-A6DC6.tmp\close.png
C:\Users\win7\AppData\Local\Temp\is-A6DC6.tmp\button_en.png
C:\Users\win7\AppData\Local\Temp\is-A6DC6.tmp\reboot_btn_en.png
C:\Users\win7\AppData\Local\Temp\is-A6DC6.tmp\progress_bg.png
C:\Users\win7\AppData\Local\Temp\is-A6DC6.tmp\progress_fg.png
C:\Users\win7\AppData\Local\Temp\is-A6DC6.tmp\hand.cur
C:\Users\win7\AppData\Local\Temp\is-A6DC6.tmp\Close.png
C:\Program Files\OPPO\USB Driver\Google\Android\fastboot.exe
C:\Program Files\OPPO\USB Driver\Google\Driver\amd64\WUDFUpdate_01009.dll
C:\Program Files\OPPO\USB Driver\Google\Driver\i386\WUDFUpdate_01009.dll
C:\Program Files\OPPO\USB Driver\msvcp80.dll
C:\Program Files\OPPO\USB Driver\CertTool.exe
C:\Program Files\OPPO\USB Driver\Google\Driver\amd64\WdfCoInstaller01009.dll
C:\Program Files\OPPO\USB Driver\Google\Driver\i386\WdfCoInstaller01009.dll
C:\Program Files\OPPO\USB Driver\mfc80.dll
C:\Program Files\OPPO\USB Driver\mfcm80u.dll
C:\Program Files\OPPO\USB Driver\Microsoft\Driver\umdf.exe
C:\Program Files\OPPO\USB Driver\Microsoft\Driver\wmfdist11.exe
C:\Program Files\OPPO\USB Driver\msvcm80.dll
C:\Program Files\OPPO\USB Driver\DIFxAPI.dll
C:\Program Files\OPPO\USB Driver\Google\Android\AdbWinUsbApi.dll
C:\Program Files\OPPO\USB Driver\mfc80u.dll
C:\Program Files\OPPO\USB Driver\mfcm80.dll
C:\Program Files\OPPO\USB Driver\msvcr80.dll
C:\Program Files\OPPO\USB Driver\DconTool.exe
C:\Program Files\OPPO\USB Driver\Google\Android\adb.exe
C:\Program Files\OPPO\USB Driver\Google\Android\AdbWinApi.dll
C:\Program Files\OPPO\USB Driver\Google\Driver\amd64\winusbcoinstaller2.dll
C:\Program Files\OPPO\USB Driver\Google\Driver\i386\winusbcoinstaller2.dll
C:\Program Files\OPPO\USB Driver\InstallDriver.exe
C:\Program Files\OPPO\USB Driver\libLog64.dll
C:\Program Files\OPPO\USB Driver\unins000.dat
C:\Program Files\OPPO\USB Driver\is-H5OLB.tmp
C:\Users\win7\AppData\Local\Temp\is-CDSAD.tmp\sample.tmp
C:\Program Files\OPPO\USB Driver\Google\Android\is-41SDC.tmp
C:\Program Files\OPPO\USB Driver\Google\Android\is-BTFOR.tmp
C:\Program Files\OPPO\USB Driver\Google\Android\is-ADRID.tmp
C:\Program Files\OPPO\USB Driver\Google\Android\is-67LJE.tmp
C:\Program Files\OPPO\USB Driver\Google\Driver\is-LPQUQ.tmp
C:\Program Files\OPPO\USB Driver\Google\Driver\is-7ODN2.tmp
C:\Program Files\OPPO\USB Driver\Google\Driver\is-1BBCG.tmp
C:\Program Files\OPPO\USB Driver\Google\Driver\amd64\is-0G74V.tmp
C:\Program Files\OPPO\USB Driver\Google\Driver\amd64\is-0SV1H.tmp
C:\Program Files\OPPO\USB Driver\Google\Driver\amd64\is-DCVRK.tmp
C:\Program Files\OPPO\USB Driver\Google\Driver\i386\is-91QM8.tmp
C:\Program Files\OPPO\USB Driver\Google\Driver\i386\is-O1QKN.tmp
C:\Program Files\OPPO\USB Driver\Google\Driver\i386\is-1Q3B8.tmp
C:\Program Files\OPPO\USB Driver\Microsoft\Driver\is-NJ3J8.tmp
C:\Program Files\OPPO\USB Driver\Microsoft\Driver\is-TDKFD.tmp
C:\Program Files\OPPO\USB Driver\Microsoft\Driver\is-V1V1D.tmp
C:\Program Files\OPPO\USB Driver\Microsoft\Driver\is-D3ALO.tmp
C:\Program Files\OPPO\USB Driver\Microsoft\Driver\is-5MUUM.tmp
C:\Program Files\OPPO\USB Driver\is-E4ERM.tmp
C:\Program Files\OPPO\USB Driver\is-POQTQ.tmp
C:\Program Files\OPPO\USB Driver\is-TCDUO.tmp
C:\Program Files\OPPO\USB Driver\is-FH6IN.tmp
C:\Program Files\OPPO\USB Driver\is-7E92R.tmp
C:\Program Files\OPPO\USB Driver\Microsoft\Driver\is-8E2GL.tmp
C:\Program Files\OPPO\USB Driver\is-QQA81.tmp
C:\Users\win7\AppData\Local\Temp\00087076.log
C:\Users\win7\AppData\Local\Temp\INH553~1\css\ie6_main.css
C:\Users\win7\AppData\Local\Temp\INH553~1\css\main.css
C:\Users\win7\AppData\Local\Temp\INH553~1\css\sdk-ui\browse.css
C:\Users\win7\AppData\Local\Temp\INH553~1\css\sdk-ui\button.css
C:\Users\win7\AppData\Local\Temp\INH553~1\css\sdk-ui\checkbox.css
C:\Users\win7\AppData\Local\Temp\INH553~1\css\sdk-ui\images\button-bg.png
C:\Users\win7\AppData\Local\Temp\INH553~1\css\sdk-ui\images\progress-bg-corner.png
C:\Users\win7\AppData\Local\Temp\INH553~1\css\sdk-ui\images\progress-bg.png
C:\Users\win7\AppData\Local\Temp\INH553~1\css\sdk-ui\images\progress-bg2.png
C:\Users\win7\AppData\Local\Temp\INH553~1\css\sdk-ui\progress-bar.css
C:\Users\win7\AppData\Local\Temp\INH553~1\csshover3.htc
C:\Users\win7\AppData\Local\Temp\INH553~1\form.bmp.Mask
C:\Users\win7\AppData\Local\Temp\INH553~1\images\BG.jpg
C:\Users\win7\AppData\Local\Temp\INH553~1\images\Close.png
C:\Users\win7\AppData\Local\Temp\INH553~1\images\Color_Button.png
C:\Users\win7\AppData\Local\Temp\INH553~1\images\Color_Button_Hover.png
C:\Users\win7\AppData\Local\Temp\INH553~1\images\Grey_Button.png
C:\Users\win7\AppData\Local\Temp\INH553~1\images\Grey_Button_Hover.png
C:\Users\win7\AppData\Local\Temp\INH553~1\images\Loader.gif
C:\Users\win7\AppData\Local\Temp\INH553~1\images\Pause_Button.png
C:\Users\win7\AppData\Local\Temp\INH553~1\images\Progress.png
C:\Users\win7\AppData\Local\Temp\INH553~1\images\ProgressBar.png
C:\Users\win7\AppData\Local\Temp\INH553~1\images\Quick_Specs.png
C:\Users\win7\AppData\Local\Temp\INH553~1\images\Resume_Button.png
C:\Users\win7\AppData\Local\Temp\INH553~1\images\sponsored.png
C:\Users\win7\AppData\Local\Temp\INH553~1\locale\DE.locale
C:\Users\win7\AppData\Local\Temp\INH553~1\locale\EN.locale
C:\Users\win7\AppData\Local\Temp\INH553~1\locale\ES.locale
C:\Users\win7\AppData\Local\Temp\INH553~1\locale\FR.locale
C:\Users\win7\AppData\Local\Temp\INH553~1\locale\JA.locale
C:\Users\win7\AppData\Local\Temp\INH553~1\locale\PT.locale
\\.\pipe\0S1P1R2Y1C1P1Q0D1F2W1G1I1F1T1Q1V1G1P2W
\\.\pipe\0S1P1R2Y1C1P1Q0D1F2W1G1I1F1T1Q1V1G1P2W_TEST
C:\Users\win7\AppData\Local\Temp\000870D3.log
C:\Users\win7\AppData\Local\Temp\in1C2ACCFB\2F207485.tmp
C:\Users\win7\AppData\Local\Temp\000870E3.log
C:\Users\win7\AppData\Local\Temp\inH55309318997\bootstrap_54001.html
C:\Users\win7\AppData\Local\Temp\inH55309318997
C:\Users\win7\AppData\Local\Temp\inH55309318997\css\sdk-ui\progress-bar.css
C:\Users\win7\AppData\Local\Temp\inH55309318997\css\main.css
C:\Users\win7\AppData\Local\Temp\inH55309318997\images\default_tb.png
C:\Users\win7\AppData\Local\Temp\inH55309318997\images\default_wi.png
C:\Users\win7\AppData\Local\Temp\inH55309318997\images\BG.jpg
C:\Users\win7\AppData\Local\Temp\inH55309318997\images\Quick_Specs.png
C:\Users\win7\AppData\Local\Temp\inH55309318997\images\sponsored.png
C:\Users\win7\AppData\Local\Temp\inH55309318997\images\Close.png
C:\Users\win7\AppData\Local\Temp\inH55309318997\images\Loader.gif
C:\Users\win7\AppData\Local\Temp\inH55309318997\images\ProgressBar.png
C:\Users\win7\AppData\Local\Temp\inH55309318997\images\Progress.png
C:\Users\win7\AppData\Local\Temp\inH55309318997\images\Pause_Button.png
C:\Users\win7\AppData\Local\Temp\inH55309318997\images\Resume_Button.png
C:\Users\win7\AppData\Local\Temp\inH55309318997\images\Grey_Button.png
C:\Users\win7\AppData\Local\Temp\inH55309318997\images\Color_Button.png
C:\Users\win7\AppData\Local\Temp\inH55309318997\locale\EN.locale
C:\Users\win7\AppData\Local\Temp\inH55309318997\images\Close_Hover.png
C:\Users\win7\AppData\Local\Temp\inH55309318997\images\Grey_Button_Hover.png
C:\Users\win7\AppData\Local\Temp\inH55309318997\images\Color_Button_Hover.png
C:\Users\win7\AppData\Local\Temp\in1C2ACCFB\2A7BA53F_stp.EXE
C:\Users\win7\AppData\Local\Temp\IN1C2A~1\2A7BA5~1.EXE
C:\Users\win7\AppData\Local\Temp\in1C2ACCFB\2A7BA53F_stp.EXE.part
C:\Users\win7\AppData\Local\Temp\IN1C2A~1\2A7BA5~1.PAR
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\iconp[1].png
\lng\english.dll
\\.\Acceler
\\.\pipe\OperaCrashReporter2180
C:\Users\win7\AppData\Local\Temp\Opera Installer\opera_installer_20160407162818.log
C:\Users\win7\AppData\Local\Temp\Opera Installer\opera_installer_20160407162817.exe
C:\Users\Public\Desktop\CarboniteSetup.log
C:\Users\win7\AppData\Local\Temp\CrbDC76.tmp
.\
css\kermit\images\ui-bg_flat_0_aaaaaa_40x100.png
css\kermit\images\ui-bg_flat_100_000000_40x100.png
css\kermit\images\ui-bg_flat_75_ffffff_40x100.png
css\kermit\images\ui-bg_flat_95_fef1ec_40x100.png
css\kermit\images\ui-bg_glass_50_708f11_1x400.png
css\kermit\images\ui-bg_glass_50_829a39_1x400.png
css\kermit\images\ui-bg_glass_55_fff9d7_1x400.png
css\kermit\images\ui-bg_highlight-hard_100_b8bea7_1x100.png
css\kermit\images\ui-bg_inset-hard_65_b8bcae_1x100.png
css\kermit\images\ui-icons_222222_256x240.png
css\kermit\images\ui-icons_2e83ff_256x240.png
css\kermit\images\ui-icons_333333_256x240.png
css\kermit\images\ui-icons_cd0a0a_256x240.png
css\kermit\images\ui-icons_ffffff_256x240.png
css\kermit\jquery-ui-1.8.13.custom.css
css\PIE.htc
css\smoothness\images\ui-bg_flat_0_aaaaaa_40x100.png
css\smoothness\images\ui-bg_flat_75_ffffff_40x100.png
css\smoothness\images\ui-bg_glass_55_fbf9ee_1x400.png
css\smoothness\images\ui-bg_glass_65_ffffff_1x400.png
css\smoothness\images\ui-bg_glass_75_dadada_1x400.png
css\smoothness\images\ui-bg_glass_75_e6e6e6_1x400.png
css\smoothness\images\ui-bg_glass_95_fef1ec_1x400.png
css\smoothness\images\ui-bg_highlight-soft_75_cccccc_1x100.png
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\unknownprotocol[1]
css\smoothness\images\ui-icons_222222_256x240.png
css\smoothness\images\ui-icons_2e83ff_256x240.png
css\smoothness\images\ui-icons_454545_256x240.png
css\smoothness\images\ui-icons_888888_256x240.png
css\smoothness\images\ui-icons_cd0a0a_256x240.png
css\smoothness\jquery-ui-1.8.12.custom.css
fonts\carbonite-webfont.eot
fonts\carbonite_bold-webfont.eot
fonts\carbonite_light-webfont.eot
html\dynamic\MarketingPanel.html
html\dynamic\mobileaccess-sm.png
html\dynamic\NoMirrorImage.html
i\access.png
i\arrow-less.png
i\arrow-more.png
i\backup-manual-new-german.png
i\backup-manual-new.png
i\bullet-green.png
i\button-backs.png
i\buttonFade30.png
i\cancelX.png
i\carboniteTargetDrivePlug.png
i\carb_logo_large.png
i\checkmark.gif
i\clouds.png
i\cross.png
i\deleted-files.png
i\dots-donut-folder-win.png
i\dots-grn.png
i\dots-none-file-win.png
i\dots-ylw-file.png
i\dots.png
i\download_icon.png
i\ehd_icon.png
i\ethernet.png
i\firewall.png
i\icon-alert.png
i\icon-autobackup.png
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\errorPageStrings[1]
i\icon-check-lg.png
i\icon-check-sm.png
i\icon-computer-type.png
i\icon-continuous.png
i\icon-encryption.png
i\icon-NO-ehd.png
i\icon-NO-exe.png
i\icon-NO-largefile.png
i\icon-NO-video.png
i\icon-nobackup.png
i\icon-pushpin.png
i\icon-redx-lg.png
i\icon-redx-sm.png
i\icon-schedule.png
i\icon-YES-documents.png
i\icon-YES-email.png
i\icon-YES-music.png
i\icon-YES-photos.png
i\icon-YES-video.png
i\info16x16.png
i\installerTopGradient.png
i\leftnavBg.png
i\lid.png
i\logo.png
i\mobileaccess-sm-new.png
i\mobileaccess-sm.png
i\online-settings-icons.png
i\pbar-ani-green.gif
i\pbar-ani.gif
i\pbar-full.png
i\pendingfiles.png
i\plug.png
i\programs.png
i\question16x16.png
i\red_x.png
i\restore-browse.png
i\restore-cancel.png
i\restore-cancelled.png
i\restore-complete-error.png
i\restore-complete-success.png
i\restore-files-lg.png
i\restore-full-lg.png
i\restore-full.png
i\restore-migrate.png
C:\Windows\SysWOW64\mshtml.tlb
i\restore-power.png
i\restore-priority-add.png
i\restore-priority-added.png
i\restore-priority.png
i\restore-review-files.png
i\restore-review-time.png
i\restore-review-useraccounts.png
i\restore-search.png
i\restore-severe.png
i\restore-sleep.png
i\restore-step-background.png
i\restore-success.png
i\restore-warning.png
i\right-click-explorer-german.png
i\right-click-explorer.png
i\setup-automatic.png
i\setup-custom.png
i\sleep.png
i\spinner_16.gif
i\sprite-client.png
i\sprite-restore.png
i\ss-icon.png
i\support_getting-started.png
i\support_how-to-guides.png
i\support_troubleshooting.png
i\support_video-tutorials.png
i\type-computer.png
i\type-laptop.png
i\type-server.png
i\users.gif
i\versions.png
i\vRule_ccdc9c.png
i\warning24x24.png
i\windows-icon.png
images\addfile.png
images\alert.png
images\alert_titlebar.jpg
images\Backgrounds\background_header.jpg
images\Backgrounds\table_header.png
images\backup-sets.png
images\BackupDrive\BackupPending.ico
images\BackupDrive\BackupRoot.ico
images\BackupDrive\bar_logo.jpg
images\BackupDrive\bar_tile.jpg
images\BackupDrive\context-menu.ico
images\BackupDrive\overlay-green.ico
images\BackupDrive\overlay-partial.ico
images\BackupDrive\overlay-yellow.ico
images\BackupDrive\prop-gray.bmp
images\BackupDrive\prop-green.bmp
images\BackupDrive\prop-multi.bmp
images\BackupDrive\prop-partial.bmp
images\BackupDrive\prop-yellow.bmp
images\BackupDrive\region_backup.jpg
images\BackupDrive\region_help.jpg
images\BackupDrive\region_status.jpg
images\BackupDrive\RestoreComplete.ico
images\BackupDrive\RestoreError.ico
images\BackupDrive\RestorePending.ico
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\httpErrorPagesScripts[1]
images\BackupDrive\RestoreRoot.ico
images\BackupDrive\Root.ico
images\BackupDrive\watermark.png
images\bg_innercontent_sidepanel.png
images\breadcrumb-selected.gif
images\breadcrumb.gif
images\buttons\gray-button.png
images\buttons\large-gray-button.png
images\buttons\primary-button.png
images\buttons\remove.gif
images\buttons\secondary-button.png
images\buttons\upgrade.gif
images\buttons\video.gif
images\checkmark.gif
images\context-menu.png
images\dots.png
images\ehd-sample.jpg
images\FileSelector\basic-hover.png
images\FileSelector\basic-tab.png
images\FileSelector\excluded-hover.png
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\info_48[1]
images\FileSelector\excluded-tab.png
images\FileSelector\folder-hover.png
images\FileSelector\folder-tab.png
images\FileSelector\tab-selected.png
images\FileSelector\tab-unselected.png
images\folder.png
images\forbidden.png
images\green_donut.png
images\gr_arrow_bull.png
images\Headers\carb_logo_large.png
images\Headers\carb_logo_small.png
images\Headers\closebox_default.png
images\Headers\closebox_hover.png
images\Headers\closebox_onclick.png
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\bullet[1]
images\Headers\header_bg_large.png
images\Headers\header_bg_med.png
images\Headers\header_bg_small.png
images\help.png
images\icon_chat.jpg
images\InfoCenter\application.ico
images\InfoCenter\BackingUp.png
images\InfoCenter\Complete.png
images\InfoCenter\Error.png
images\InfoCenter\PausedOrDisabled.png
images\InfoCenter\Restoring.png
images\InfoCenter\Search.png
images\InfoCenter\spinner_16.gif
images\InfoCenter\ssl_lock.ico
images\InfoCenter\Waiting.png
images\InfoCenter\Warning.png
images\information.png
images\install-video-bg.png
images\Machines\blue-box-b-border.png
images\Machines\blue-box-l-border.png
images\Machines\blue-box-lbcorner.png
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\background_gradient[1]
images\Machines\blue-box-ltcorner.png
images\Machines\blue-box-r-border.png
images\Machines\blue-box-rbcorner.png
images\Machines\blue-box-rtcorner.png
images\Machines\blue-box-t-border.png
images\Machines\blue-box.png
images\Machines\desktop.jpg
images\Machines\desktop_small.png
images\Machines\green-box-b-border.png
images\Machines\green-box-l-border.png
images\Machines\green-box-lbcorner.png
images\Machines\green-box-ltcorner.png
images\Machines\green-box-r-border.png
images\Machines\green-box-rbcorner.png
images\Machines\green-box-rtcorner.png
images\Machines\green-box-t-border.png
images\Machines\green-box.png
images\Machines\laptop.jpg
images\Machines\laptop_small.png
images\Machines\mac.png
images\Machines\mac_small.png
images\Machines\server.jpg
images\Machines\server_small.png
images\Machines\white-box-b-border.png
images\Machines\white-box-l-border.png
images\Machines\white-box-lbcorner.png
images\Machines\white-box-ltcorner.png
images\Machines\white-box-r-border.png
images\Machines\white-box-rbcorner.png
images\Machines\white-box-rtcorner.png
images\Machines\white-box-t-border.png
images\Machines\white-box.png
images\no_dot.png
images\pb_inner_left.png
images\pb_inner_mid.png
images\pb_inner_right.png
images\pb_outer_left.png
images\pb_outer_mid.png
images\pb_outer_right.png
images\red_x.png
images\Restore\checkmark.png
images\Restore\chunkback.JPG
images\Restore\date.gif
images\Restore\drive.gif
images\Restore\OtherFiles.gif
images\Restore\restore-mgr-4steps-bg.png
images\Restore\restore-mgr-help-bg.png
images\Restore\restore-tabs-body-bg.png
images\Restore\RestoreCompleteSuccess.png
images\Restore\RestoredPriorityFiles.png
images\Restore\RestoreReport.png
images\Restore\step-center.gif
images\Restore\step-mid.gif
images\Restore\triangle_down.gif
images\Restore\triangle_rt.gif
images\Restore\triangle_up.gif
images\Restore\users.gif
images\Restore\users_small.gif
images\Restore\user_large.png
images\Restore\user_medium.png
images\Restore\user_small.png
images\Restore\version.png
images\Restore\wait.gif
images\Restore\wait16.gif
images\Restore\Warning.png
images\right-click-explorer.png
images\Setup\application.ico
images\Sidebar\sidebar_about.jpg
images\Sidebar\sidebar_about_down.jpg
images\Sidebar\sidebar_about_over.jpg
images\Sidebar\sidebar_backup.jpg
images\Sidebar\sidebar_backup_down.jpg
images\Sidebar\sidebar_backup_over.jpg
images\Sidebar\sidebar_buynow.jpg
images\Sidebar\sidebar_options.jpg
images\Sidebar\sidebar_options_down.jpg
images\Sidebar\sidebar_options_over.jpg
images\Sidebar\sidebar_restore.jpg
images\Sidebar\sidebar_restore_down.jpg
images\Sidebar\sidebar_restore_over.jpg
images\Sidebar\sidebar_support.jpg
images\Sidebar\sidebar_support_down.jpg
images\Sidebar\sidebar_support_over.jpg
images\Sidebar\sidebar_tile.png
images\Sidebar\sidebar_tile_top.png
images\solid_gr_dot.png
images\switch\slider_arrow_left.png
images\switch\slider_arrow_right.png
images\switch\slide_base_left.png
images\switch\slide_base_right.png
images\tabs\tab_active.gif
images\tabs\tab_inactive.jpg
images\titlebar_slice.jpg
images\tooltiparrow.gif
images\trashCan.png
images\tray-yellow.gif
images\Tree\cb_checked.jpg
images\Tree\cb_clear.jpg
images\Tree\cb_mixed.jpg
images\Tree\collapsed.jpg
images\Tree\expanded.jpg
images\Tree\fl_collapsed.jpg
images\Tree\fl_expanded.jpg
images\Tree\folder.jpg
images\Tree\MacFolder.png
images\Tree\MacFolderORG.png
images\Tree\selfolder.jpg
images\Tree\sel_collapsed.jpg
images\Tree\sel_expanded.jpg
images\Tree\tris_checked.jpg
images\Tree\tris_checkedmixed.jpg
images\Tree\tris_unchecked.jpg
images\Tree\tris_uncheckedmixed.jpg
images\yellow_dot.png
js\account.js
js\alert.js
js\backup.js
js\badge.js
js\buyFeature.js
js\chatFeature.js
js\config.js
js\displayinfo.js
js\email.js
js\functions.js
js\help.js
js\index.js
js\jquery-1.6.1.min.js
js\jquery-ui-1.8.13.custom.min.js
js\jquery.calendrical.js
js\jquery.json-2.2.min.js
js\jquery.placeholder.min.js
js\jquery.tooltip.min.js
js\jquery.ui.tooltip.js
js\localbackup.js
js\navigation.js
js\OnOffSwitch.Class.js
js\options.js
js\restore.js
js\restorepriority.js
js\restorestatus.js
js\restoreusers.js
js\schedule.js
js\setupmirrorimage.js
js\swfobject.js
js\uitests.js
js\wait.js
scripts\alert-account-disabled.js
scripts\alert-backup-failed.js
scripts\alert-backup-folders-discovered.js
scripts\alert-backup-overdue.js
scripts\alert-backup-overquota.js
scripts\alert-general.js
scripts\alert-mirror-image.js
scripts\alert-missing-files.js
scripts\alert-missing-networkdrive.js
scripts\alert-missing-volumes.js
scripts\alert-no-files-selected.js
scripts\alert-offline.js
scripts\alert-ops-message.js
scripts\alert-paused.js
scripts\alert-recover-mode-reminder.js
scripts\alert-recover-mode.js
scripts\alert-restore-file-deleted.js
scripts\alert-service-disabled.js
scripts\alert-sub-expired.js
scripts\alert-upgrade-available.js
scripts\BackupSearcher.class.js
scripts\BaseSearcher.Class.js
scripts\Box.Class.js
scripts\ButtonFocusColor.js
scripts\Buttons.js
scripts\Calendar.js
scripts\CarboniteDrive.js
scripts\CarboniteSetup.js
scripts\ColumnInfo.Class.js
scripts\CommonFunctions.js
scripts\ComputerDescription.js
scripts\ConfirmEraseVolume.js
scripts\Dictionary.Class.js
scripts\DomHelper.js
scripts\DragAndDrop.js
scripts\DragInfo.Class.js
scripts\DragRow.Class.js
scripts\flash\AC_OETags.js
scripts\flowplayer\flowplayer-3.1.4.min.js
scripts\flowplayer\flowplayer.controls-3.1.5.swf
scripts\flowplayer\flowplayer.unlimited-3.1.5.swf
scripts\Flyout.Class.js
scripts\InfoCenter-Email.js
scripts\InfoCenter-Log.js
scripts\InfoCenter-Shutdown.js
scripts\InfoCenter-tooltips.js
scripts\Installation.js
scripts\LeafCollection.Class.js
scripts\lightbox.js
scripts\LocalBackup.Classes.js
scripts\localbackup.js
scripts\Logging.js
scripts\MachineRecord.Class.js
scripts\MessageBox.js
scripts\MissingFileList.js_
scripts\NotReady.js
scripts\NumberFormat.js
scripts\objectJSON.js
scripts\OnOffSwitch.js
scripts\popup-backup-within-quota.js
scripts\PrivateKey.js
scripts\ProgressMeter.Class.js
scripts\prototype.js
scripts\registration-backedup.js
scripts\Registration-Pages.js
scripts\registration-recovery.js
scripts\Restore.js
scripts\RestoreCore.js
scripts\RestoreFiles.js
scripts\RestoreSearchSupport.js
scripts\RestoreStatus.js
scripts\RestoreWizard-ChooseUsers.js
scripts\RestoreWizard-PriorityFiles.js
scripts\RestoreWizard-PriorityQuestion.js
scripts\RestoreWizard-Review.js
scripts\RestoreWizard-Welcome.js
scripts\RowDataAccess.Class.js
scripts\Schedule.Class.js
scripts\scriptaculous\builder.js
scripts\scriptaculous\controls.js
scripts\scriptaculous\dragdrop.js
scripts\scriptaculous\effects.js
scripts\scriptaculous\prototype.js
scripts\scriptaculous\scriptaculous.js
scripts\scriptaculous\slider.js
scripts\scriptaculous\unittest.js
scripts\SearchOptions.Class.js
scripts\ServiceInterconnect.Class.js
scripts\ServiceInterconnect.js
scripts\Slider.Class.js
scripts\Sorting.js
scripts\String.Class.js
scripts\support-offline.js
scripts\Support.js
scripts\Table.Class.js
scripts\tests\CommonFunctions-Tests.js
scripts\tests\localbackup-Tests.js
scripts\tests\ProgressMeter.Class-Tests.js
scripts\tests\Testing.htm
scripts\tests\Testing.js
scripts\tests\Tests.js
scripts\Tooltips.js
scripts\trapError.js
scripts\TreeControl.js
scripts\TreeNode.Class.js
scripts\TreeNodeStyle.Class.js
scripts\vars.js
scripts\VersionGetter.Class.js_
scripts\__About__.js
scripts\__Accordian.Class__.js
scripts\__CarboniteInfo__.js
scripts\__FileSelector__.js
scripts\__InfoCenter-Alerts__.js
scripts\__InfoCenter-Nav__.js
scripts\__InfoCenter-Options__.js
scripts\__InfoCenter-Status__.js
scripts\__Options__.js
scripts\__Schedule__.js
scripts\__Status__.js
scripts\__Wait__.js
ScriptTests.txt
ShowAll.txt
tray-icons\ellipsis.ico
tray-icons\green-low.ico
tray-icons\green.ico
tray-icons\paused.ico
tray-icons\red.ico
tray-icons\restoring.ico
CarboniteNSE.strings
CarboniteService.strings
CarboniteSetup.strings
CarboniteUI.strings
css\adtile.css
css\backup.css
css\buttons.css
css\calendrical.css
css\eula.css
css\fileselector.css
css\help.css
css\IE10lteSpecified.css
css\InfoCenter.css
css\install.css
css\Installation.css
css\lightbox.css
css\OnOffSwitch.css
css\restore.css
css\restoreManager.css
css\RoundedBox.css
css\Setup.css
css\style.css
css\TreeStyles.css
html\account.html
html\add-remove-files-popup.htmi
html\alert-account-disabled-by-plan-change.htm
html\alert-account-disabled.htm
html\alert-backup-failed.htm
html\alert-backup-folders-discovered.htm
html\alert-backup-overdue.htm
html\alert-backup-overquota.htm
html\alert-mirror-image-db-repair-failed.htm
html\alert-missing-files.htm
html\alert-missing-networkdrive.htm
html\alert-missing-volumes.htm
html\alert-multiple-rollbacks.htm
html\alert-no-files-selected.htm
html\alert-no-mirror-image-snapshot.htm
html\alert-ops-message.htm
html\alert-paused.htm
html\alert-recover-mode-exit-reminder.htm
html\alert-recover-mode.htm
html\alert-restore-file-deleted.htm
html\alert-restore-resumed.htm
html\alert-rollback-success.htm
html\alert-service-disabled.htm
html\alert-sub-expired.htm
html\alert-unfreeze-popup.htm
html\alert-unfreeze.htm
html\alert-upgrade-available.htm
html\AlertHeader.htmi
html\autobackup.htmi
html\backup-settings-popup.htmi
html\backup.html
html\Carbonite-EULA.htm
html\Carbonite-Setup.htm
html\CarboniteDrive-BackupPending.htm
html\CarboniteDrive-BackupRoot.htm
html\CarboniteDrive-Root.htm
html\CreateMachineDescription.htmi
html\DateFilter.htmi
html\designPatterns.html
html\encryptauto.htmi
html\FileSelector-Exclusions.htmi_
html\frozen-descr-and-tooltip.htmi
html\help.html
html\index.html
html\InfoCenter-CompatibleSW.htm
html\InfoCenter-Log.htm
html\install-phase-25.htmi
html\install-phase-35.htmi
html\install-phase-encryption.htmi
html\install-phase-manualbackup.htmi
html\install-phase-review.htmi
html\install-phase-scanned.htmi
html\install-phase-scanning.htmi
html\install-phase-schedule.htmi
html\install-phase-scope-auto.htmi
html\install-phase-scope-custom.htmi
html\install-phase-scope.htmi
html\install-phase-what.htmi
html\Installation.htm
html\localbackup.html
html\MachineListTemplate.htmi
html\MessageBox.htm
html\MessageBox2.htm
html\mm-no-files-selected.htm
html\mm-sub-expired.htm
html\NameFilter.htmi
html\NotReady.htm
html\OnOffSwitch.htmi
html\PopupHeader.htmi
html\recommendations.htmi
html\registration-backedup.htm
html\restore.html
html\restoreComplete.html
html\RestoreFilesBottom.htmi
html\RestoreFilesTop.htmi
html\RestoreMessages.htmi
html\RestoreReportStatic.htm
html\restoresearch.html
html\RWiz-AllFiles.html
html\Rwiz-Footer.htmi
html\RWiz-PriorityQuestion.html
html\RWiz-PrioritySelect.html
html\RWiz-RestoreStatus.html
html\RWiz-Review.html
html\RWiz-SelectUserAccounts.html
html\RWiz-Welcome.html
html\schedulewidgets.htmi
html\settings.html
html\setUpMirrorImage.html
html\snapshotHistory.html
html\uitests.html
html\unfreeze-and-tooltip.htmi
html\vars.htm
skin.settings
C:\Users\win7\AppData\Local\Temp\CrbDC76\CarboniteSetup.strings
C:\Users\win7\AppData\Local\Temp\CrbDC76\skin.settings
C:\Users\Public\Desktop\Carbonite Setup.log
C:\Users\win7\AppData\Local\Temp\CrbDC76
C:\Users\win7\AppData\Local\Temp\CrbDC76\html
C:\Users\win7\AppData\Local\Temp\CrbDC76\html\Carbonite-Setup.htm
C:\Users\win7\AppData\Local\Temp\CrbDC76\css\kermit\jquery-ui-1.8.13.custom.css
C:\Users\win7\AppData\Local\Temp\CrbDC76\css\style.css
C:\Users\win7\AppData\Local\Temp\CrbDC76\css\install.css
C:\Users\win7\AppData\Local\Temp\CrbDC76\js\jquery-1.6.1.min.js
C:\Users\win7\AppData\Local\Temp\CrbDC76\scripts\ProgressMeter.Class.js
C:\Users\win7\AppData\Local\Temp\CrbDC76\scripts\CarboniteSetup.js
C:\Users\win7\AppData\Local\Temp\CrbDC76\scripts\CommonFunctions.js
C:\Users\win7\AppData\Local\Temp\CrbDC76\scripts\DomHelper.js
C:\Users\win7\AppData\Local\Temp\CrbDC76\scripts\ServiceInterconnect.Class.js
C:\Users\win7\AppData\Local\Temp\CrbDC76\js\navigation.js
C:\Users\win7\AppData\Local\Temp\CrbDC76\js\jquery-ui-1.8.13.custom.min.js
C:\Users\win7\AppData\Local\Temp\CrbDC76\js\displayinfo.js
C:\Users\win7\AppData\Local\Temp\CrbDC76\js\chatFeature.js
C:\Users\win7\AppData\Local\Temp\CrbDC76\i\carb_logo_large.png
C:\Users\win7\AppData\Local\Temp\CrbDC76\i\clouds.png
C:\Users\win7\AppData\Local\Temp\CrbDC76\i\access.png
C:\Users\win7\AppData\Local\Microsoft
C:\Users\win7\AppData\Local\Microsoft\Windows
C:\Users\win7\AppData\Local\Microsoft\Windows\History\desktop.ini
C:\Users\win7\AppData\Local\Temp\nsy8F47.tmp\inetc.dll
C:\Users\win7\AppData\Local\Temp\etime.dat
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\get_current_timestamp[1].htm
C:\Users\win7\AppData\Local\Temp\nsy8F47.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\nsy8F47.tmp\AccessControl.dll
C:\Users\win7\AppData\Local\Temp\nsy8F47.tmp\UserInfo.dll
C:\Users\win7\AppData\Local\Temp\nsy8F47.tmp\IpConfig.dll
C:\Users\win7\AppData\Local\Temp\dloc.off
C:\Users\win7\AppData\Local\Temp\nsy8F47.tmp\SimpleSC.dll
C:\Users\win7\AppData\Local\Temp\eset\bts\bootstrapper.log
C:\\linuxlive\launcher.log
C:\ProgramData\3c022f79-33eb-49e6-81b8-ddaa369645b1\temp
C:\Users\win7\AppData\Local\Temp\nsz5B52.tmp
C:\Users\win7\AppData\Local\Temp\nse5BC0.tmp\NSISdl.dll
C:\Users\win7\AppData\Local\Temp\install.txt
C:\Users\Public\Desktop\AAGroup Products.lnk
C:\Windows\system32\wdmaud.drv
C:\Users\win7\AppData\Local\Temp\is-JC4JF.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-JC4JF.tmp\_isetup\_shfoldr.dll
C:\Users\win7\AppData\Local\Temp\is-JC4JF.tmp\yandex_str_yb.txt
C:\Users\win7\AppData\Local\Temp\is-JC4JF.tmp\yandex-browser.bmp
C:\Users\win7\AppData\Local\Temp\is-JC4JF.tmp\yandex_str.txt
C:\Users\win7\AppData\Local\Temp\is-JC4JF.tmp\yandex-logo.bmp
C:\Users\win7\AppData\Local\Temp\is-JC4JF.tmp\other_str.txt
\\?\C:\Users\win7\AppData\Roaming\Adobe\Flash Player\AssetCache\3DK6HEXR
\\?\C:\Users\win7\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\4R9HMLCQ
\\?\C:\Users\win7\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\4R9HMLCQ\macromedia.com\support\flashplayer\sys\settings.sol
\\?\C:\menu\LogoOpen.swf
\\?\C:\menu\fontPack.swf
\\?\C:\menu\model.dat
\\?\C:\menu\defaultSetting.dat
C:\Users\win7\AppData\Local\Temp\nsvDDAE.tmp
C:\Users\win7\AppData\Local\Temp\nslDDBF.tmp\CPUFeatures.dll
C:\Users\win7\AppData\Local\Temp\nslDDBF.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\nslDDBF.tmp\nsProcess.dll
1.217.784.0_TO_1.217.861.0_MPASDLTA.VDM._P
1.217.784.0_TO_1.217.861.0_MPAVDLTA.VDM._P
C:\Users\win7\AppData\Local\Temp\nsmF435.tmp
C:\Users\win7\AppData\Local\Temp\nscF446.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\nscF446.tmp\UserInfo.dll
C:\Users\win7\AppData\Local\Temp\nscF446.tmp\splash.bmp
C:\Users\win7\AppData\Local\Temp\nscF446.tmp\AdvSplash.dll
C:\Users\win7\AppData\Local\Temp\nscF446.tmp\splash.wav.WAV
C:\Users\win7\AppData\Local\Temp\nscF446.tmp\KillProcDLL.dll
C:\Users\win7\AppData\Local\Temp\nscF446.tmp\ioSpecial.ini
C:\Users\win7\AppData\Local\Temp\nscF446.tmp\modern-wizard.bmp
C:\Users\win7\AppData\Local\Temp\nscF446.tmp\modern-header.bmp
C:\Users\win7\AppData\Local\Temp\nscF446.tmp\InstallOptions.dll
C:\ProgramData\Total PC Health\Total PC Health\dc_db.db
C:\ProgramData\Total PC Health\UUS3\Master.xml
C:\ProgramData\Total PC Health\UUS3\Patch.xml
C:\ProgramData\Total PC Health\UUS3\Update.xml
C:\ProgramData\Total PC Health\UUS3\tpch\Master.xml
C:\ProgramData\Total PC Health\UUS3\tpch\Patch.xml
C:\ProgramData\Total PC Health\UUS3\tpch\Update.xml
C:\ProgramData\Total PC Health\UUS3\tpch\Database.xml
C:\Users\win7\AppData\Local\Temp\nsu889D.tmp
C:\Users\win7\AppData\Local\Temp\nsk894A.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\ptn58B3.tmp
C:\lib\bluej.defs
C:\Users\win7\AppData\Local\Temp\000b0a2c.a
C:\Users\win7\AppData\Local\Temp\000b13f0.a
C:\Users\win7\AppData\Local\Temp\726390\dlreport
C:\Users\win7\AppData\Local\Temp\726390\Win7LoaderExtreme-3.503-link.zip
C:\Users\win7\AppData\Local\Temp\726390
C:\Users\win7\AppData\Local\tuto_monetize_120160407\tuto_monetize_120160407\1.10\cnf.cyl
C:\Users\win7\AppData\Local\Temp\gch4F21.tmp
C:\Users\win7\AppData\Local\Temp\\~DF78FFCE1771B2F5CF.TMP
C:\Users\win7\AppData\Local\Temp\is-4M5AR.tmp\sample.tmp
\\.\pipe\OperaCrashReporter2388
C:\Users\win7\AppData\Local\Temp\Opera Installer\opera_installer_20160407211831.log
C:\Users\win7\AppData\Local\Temp\Opera Installer\opera_installer_20160407211829.exe
C:\Users\win7\AppData\Local\Temp\dotNetFx.log
C:\Users\win7\AppData\Local\Temp\IXP000.TMP\netfx.msi
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\active[1].htm
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\reg[1].htm
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\theme[1].css
C:\WINDOWS\FONTS\SIMSUN.TTC
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\util[1].png
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\core[1].js
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\config[1].js
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\login[1].png
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\b1[1].jpg
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\domaincids[1].js
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\web_referer[1].js
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\refer[1].js
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\98R98IOZ.txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\jquery[1].js
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\cs[1].gif
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\check[1].png
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\action[1].js
C:\Users\win7\AppData\Local\Temp\is-0AC83.tmp\sample.tmp
C:\Users\win7\AppData\Local\Temp\is-S7GN3.tmp\_isetup\_RegDLL.tmp
C:\Users\win7\AppData\Local\Temp\is-S7GN3.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-S7GN3.tmp\_isetup\_shfoldr.dll
C:\Users\win7\AppData\Local\Temp\is-S7GN3.tmp\_isetup\_iscrypt.dll
C:\Users\win7\AppData\Local\Temp\nst1417.tmp\dtsetup.ini
C:\Users\win7\AppData\Local\Temp\nst1417.tmp\DTProX64Hlp.exe
C:\Users\win7\AppData\Local\Temp\nst1417.tmp\ioSpecial.ini
C:\Users\win7\AppData\Local\Temp\nst1417.tmp\modern-wizard.bmp
C:\Users\win7\AppData\Local\Temp\nst1417.tmp\modern-header.bmp
C:\Users\win7\AppData\Local\Temp\nst1417.tmp\InstallOptions.dll
C:\Users\win7\AppData\Local\Temp\nst1417.tmp\setuphlp.dll
C:\Users\win7\AppData\Local\Temp\SPTDinst.exe
C:\Users\win7\AppData\Local\Temp\nst1417.tmp\System.dll
C:\ProgramData\ClassicShellSetup64_4_1_0.msi
1.217.680.0_TO_1.217.869.0_MPASDLTA.VDM._P
1.217.680.0_TO_1.217.869.0_MPAVDLTA.VDM._P
C:\Windows\DPINST.LOG
C:\Users\win7\AppData\Local\Temp\is-QQL3U.tmp\sample.tmp
C:\Users\win7\AppData\Local\Temp\Setup Log 2016-04-07 #001.txt
C:\Users\win7\AppData\Local\Temp\is-5U1MP.tmp\_isetup\_RegDLL.tmp
C:\Users\win7\AppData\Local\Temp\is-5U1MP.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-5U1MP.tmp\_isetup\_shfoldr.dll
C:\Users\win7\AppData\Local\Temp\is-5U1MP.tmp\_isetup\_iscrypt.dll
C:\Users\win7\AppData\Local\Temp\is-5U1MP.tmp\ffSpkCfg.dll
C:\Users\win7\AppData\Local\Temp\is-5U1MP.tmp\WinCPUID.dll
C:\Users\win7\AppData\Local\Temp\is-5U1MP.tmp\psvince.dll
C:\Users\win7\AppData\Local\Temp\{419280CA-C520-425D-AC0A-E5BC4EFBF810}\fpb.tmp
C:\Users\win7\AppData\Local\Temp\{751F51AF-F47E-49A8-B05E-0D0463F62F92}\fpb.tmp
C:\Windows\SysWOW64\Macromed\Flash\mms.cfg
C:\Windows\SysWOW64\mms.cfg
.\images\background.jpg
C:\Windows\Temp\EZInst.log
C:\properties.ini
C:\ProgramData\1a0254e4-d458-47fa-82a0-6940ee729f6c\temp
C:\Users\win7\AppData\Local\Temp\7zS2D17\DPInst.xml
C:\Users\win7\AppData\Local\Temp\7zS2D17\hpxpg400.cat
C:\Users\win7\AppData\Local\Temp\7zS2D17\hpxpg400.inf
C:\Users\win7\AppData\Local\Temp\7zS2D17\dpinst32.exe
C:\Users\win7\AppData\Local\Temp\7zS2D17\dpinst64.exe
C:\Users\win7\AppData\Local\Temp\7zS2D17\DPInstLaunch.exe
C:\Users\win7\AppData\Local\Temp\7zS2D17\hpG400co.dll
C:\Users\win7\AppData\Local\Temp\7zS2D17\x64\hpG400co.dll
C:\Users\win7\AppData\Local\Temp\7zS2D17\hpgtg400.dll
C:\Users\win7\AppData\Local\Temp\7zS2D17\x64\hpgtg400.dll
C:\Users\win7\AppData\Local\Temp\7zS2D17\hpscg400.dll
C:\Users\win7\AppData\Local\Temp\7zS2D17\x64\hpscg400.dll
C:\Users\win7\AppData\Local\Temp\7zS2D17\hpstG400.dll
C:\Users\win7\AppData\Local\Temp\7zS2D17\hpxpG400.dll
C:\Users\win7\AppData\Local\Temp\7zS2D17\x64\hpxpG400.dll
C:\Users\win7\AppData\Local\Temp\7zS2D17\hpusbscn.sys
C:\Users\win7\AppData\Local\Temp\is-OB16F.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-OB16F.tmp\_isetup\_shfoldr.dll
1.217.686.0_TO_1.217.882.0_MPASDLTA.VDM._P
1.217.686.0_TO_1.217.882.0_MPAVDLTA.VDM._P
C:\Users\win7\AppData\Local\Temp\nsyEF9B.tmp\registry.dll
C:\Users\win7\AppData\Local\Temp\nsyEF9B.tmp\modern-header.bmp
C:\Users\win7\AppData\Local\Temp\nsyEF9B.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\nsyEF9B.tmp\UserInfo.dll
C:\Users\win7\AppData\Local\Temp\nsyEF9B.tmp\UAC.dll
C:\Users\win7\AppData\Local\Temp\nsyEF9B.tmp\TorchInstaller.dll
C:\Users\win7\AppData\Local\Temp\nsyEF9B.tmp\Uninstall.exe
C:\Users\win7\AppData\Local\Torch\log.log
C:\Users\win7\AppData\Local\Temp\nsyEF9B.tmp\Banner0.jpg
C:\Users\win7\AppData\Local\Temp\nsyEF9B.tmp\Banner1.jpg
C:\Users\win7\AppData\Local\Temp\nsyEF9B.tmp\Banner2.jpg
C:\Users\win7\AppData\Local\Temp\nsyEF9B.tmp\Banner3.jpg
C:\Users\win7\AppData\Local\Temp\nsyEF9B.tmp\Banner4.jpg
C:\Users\win7\AppData\Local\Temp\nsyEF9B.tmp\Banner5.jpg
C:\Users\win7\AppData\Local\Temp\nsyEF9B.tmp\nsDialogs.dll
C:\Users\win7\AppData\Local\Temp\RarSFX0\OpaTool.bat
OpaTool.bat
Certificates\ACER-NEW.xrm-ms
Certificates\ACER.xrm-ms
Certificates\ALIENWARE.xrm-ms
Certificates\ASUS-NEW.xrm-ms
Certificates\ASUS.xrm-ms
Certificates\BENQ.xrm-ms
Certificates\DELL.xrm-ms
Certificates\DSGLTD.xrm-ms
Certificates\FOUNDER.xrm-ms
Certificates\FUJITSU-FSC-NEW.xrm-ms
Certificates\FUJITSU-FSC.xrm-ms
Certificates\FUJITSU.xrm-ms
Certificates\GATEWAY-EMACHINE.xrm-ms
Certificates\GIGABYTE.xrm-ms
Certificates\HAIER.xrm-ms
Certificates\HASEE.xrm-ms
Certificates\HEDY.xrm-ms
Certificates\HP-COMPAQ.xrm-ms
Certificates\IBM-LENOVO.xrm-ms
Certificates\LG.xrm-ms
Certificates\MEDION.xrm-ms
Certificates\MSI.xrm-ms
Certificates\NEC.xrm-ms
Certificates\PACBEL.xrm-ms
Certificates\SAMSUNG.xrm-ms
Certificates\SHARP.xrm-ms
Certificates\SONY-NEW.xrm-ms
Certificates\SONY.xrm-ms
Certificates\TCL.xrm-ms
Certificates\TOSHIBA-TOSCPL.xrm-ms
Certificates\TOSHIBA-TOSINV.xrm-ms
Certificates\TOSHIBA-TOSQCI.xrm-ms
Certificates\TOSHIBA.xrm-ms
Certificates\TSINGHUA-TONGFANG.xrm-ms
Certificates
C:\Users\win7\AppData\Roaming\AntDM\exclude_addrs.txt
exclude_addrs_def.txt
C:\Users\win7\AppData\Roaming\AntDM\exclude_addrs_cnds.txt
C:\Users\win7\AppData\Local\Temp\is-T9AG3.tmp\sample.tmp
C:\Users\win7\AppData\Local\Temp\Setup Log 2016-04-08 #001.txt
C:\Users\win7\AppData\Local\Temp\is-PU2NA.tmp\_isetup\_RegDLL.tmp
C:\Users\win7\AppData\Local\Temp\is-PU2NA.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-PU2NA.tmp\_isetup\_shfoldr.dll
C:\Users\win7\AppData\Local\Temp\HFI72A.tmp.html
C:\Users\win7\AppData\Local\Temp\HFI72C.tmp.txt
C:\Users\win7\AppData\Local\Temp\nswB5D9.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\is-HJABC.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-HJABC.tmp\_isetup\_shfoldr.dll
C:\Users\win7\AppData\Local\Temp\is-ABT1U.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-ABT1U.tmp\_isetup\_shfoldr.dll
C:\Windows\system32\sppcomapi.dll
C:\Windows\System32\slui.exe
https://www.mql5.com/?utm_campaign=WebInstaller&utm_medium=special&utm_source=installer
\\.\pipe\OperaCrashReporter748
C:\Users\win7\AppData\Local\Temp\Opera Installer\opera_installer_20160408101521.log
C:\Users\win7\AppData\Local\Temp\Opera Installer\opera_installer_20160408101520.exe
C:\48bbb65d7533d851a4\secondaryinstaller.exe.config
C:\48bbb65d7533d851a4\secondaryinstaller.exe
C:\Users\win7\AppData\Local\Temp\7zSDF8D.tmp\setup-stub.exe
C:\Users\win7\AppData\Local\Temp\nsxE162.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\nsxE162.tmp\UAC.dll
C:\Users\win7\AppData\Local\Temp\nsxE162.tmp\bgintro.bmp
C:\Users\win7\AppData\Local\Temp\nsxE162.tmp\appname.bmp
C:\Users\win7\AppData\Local\Temp\nsxE162.tmp\clock.bmp
C:\Users\win7\AppData\Local\Temp\nsxE162.tmp\particles.bmp
C:\Users\win7\AppData\Local\Temp\nsxE162.tmp\pencil.bmp
C:\Users\win7\AppData\Local\Temp\nsxE162.tmp\nsDialogs.dll
1.217.882.0_TO_1.217.915.0_MPASDLTA.VDM._P
1.217.882.0_TO_1.217.915.0_MPAVDLTA.VDM._P
C:\Users\win7\AppData\Local\Temp\nsr8B04.tmp
C:\Users\win7\AppData\Local\Temp\nsg8B14.tmp\registry.dll
C:\Users\win7\AppData\Local\Temp\nsg8B14.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\nsoB0CD.tmp
C:\Users\win7\AppData\Local\Temp\nsdB0DD.tmp\UserInfo.dll
C:\Users\win7\AppData\Local\Temp\ComodoDragon\RBSkin.skf
C:\Users\win7\AppData\Local\Temp\nsdB0DD.tmp\NSIS_SkinCrafter_Plugin.dll
C:\Users\win7\AppData\Local\Temp\nsdB0DD.tmp\SkinNsis.skf
C:\Users\win7\AppData\Local\Temp\nsdB0DD.tmp\SkinCrafter.dll
C:\Windows\system32\gdiplus.dll
C:\Windows\system32\msvcr71.dll
C:\Windows\system32\mfc71.dll
C:\Users\win7\AppData\Local\Temp\nsdB0DD.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\nsdB0DD.tmp\SecureDNSPlugin.dll
C:\Users\win7\AppData\Local\Temp\ComodoDragon\DragonPlugin.dll
C:\Users\win7\AppData\Local\Temp\ComodoLogsFolder\sample.log
C:\Users\win7\AppData\Local\Temp\nsdB0DD.tmp\modern-header.bmp
C:\Users\win7\AppData\Local\Temp\ComodoDragon\bottom.bmp
C:\Users\win7\AppData\Local\Temp\ComodoDragon\content.bmp
C:\Users\win7\AppData\Local\Temp\ComodoDragon\license.bmp
C:\Users\win7\AppData\Local\Temp\ComodoDragon\browse.ini
C:\Users\win7\AppData\Local\Temp\ComodoDragon\dir.bmp
C:\Users\win7\AppData\Local\Temp\nsdB0DD.tmp\InstallOptions.dll
C:\Windows\system32\Macromed\Flash\mms.cfg
\??\C:\Users\win7\AppData\Local\Temp\acro_rd_dir
\??\C:\Users\win7\AppData\LocalLow\Microsoft\IMJP12
\??\C:\Users\win7\AppData\LocalLow\Microsoft\IME12
\??\C:\Users\win7\AppData\LocalLow\Microsoft\IMJP8_1
\??\C:\Users\win7\AppData\LocalLow\Microsoft\IMJP9_0
\??\C:\Users\win7\AppData\LocalLow\Microsoft\IMJP?_?
\??\C:\Users\win7\AppData\LocalLow\Microsoft
\??\C:\Users\win7\AppData\LocalLow\Microsoft\IME??
\??\C:\Users\win7\AppData\LocalLow\Microsoft\IMJP??
\??\C:\Users\win7\AppData\Roaming\Microsoft\Speech
\??\C:\Users\win7\AppData\Roaming\Adobe\Flash Player\AssetCache
\??\C:\Users\win7\AppData\Roaming\Adobe\Flash Player\AFCache
\??\C:\Users\win7\AppData\Roaming\Adobe\Flash Player\Icon Cache
\??\C:\Users\win7\AppData\Roaming\Adobe\Flash Player\APSPrivateData2
\??\C:\Users\win7\AppData\Roaming\Adobe\Flash Player\NativeCache
\??\C:\Users\win7\AppData\Roaming\Macromedia\Flash Player
\??\C:\Users\win7\AppData\Local\Macromedia\Flash Player
\??\C:\Users\win7\AppData\Roaming\Justsystem
\??\C:\Users\win7\AppData\Roaming
C:\Users\win7\AppData\Local\Temp\SafeReg.ini.log
C:\Users\win7\AppData\Local\Temp\is-MGELV.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-MGELV.tmp\_isetup\_shfoldr.dll
C:\Users\win7\AppData\Local\Temp\is-MGELV.tmp\_isetup\_isdecmp.dll
C:\Users\win7\AppData\Local\Temp\is-MGELV.tmp\isskin.dll
C:\Windows\bcdedit.exe
C:\Windows\Synaptics.log
C:\Users\win7\AppData\Local\Temp\nsd9BA8.tmp\System.dll
C:\Windows\System32\desktop.ini
\\localhost\C$\Windows\System32
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Debut Video Capture Software.lnk
C:\Users\Public\Desktop\Debut Video Capture Software.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Video Related Programs\Video File Format Converter.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Video Related Programs\Video Capture Software.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Video Related Programs\Video Streaming Server.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Video Related Programs\Video Tape to DVD Converter.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Video Related Programs\Slideshow Creator Software.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Video Related Programs\VideoPad Video Editor.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Classic FTP Software.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Video Capture Software.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Doxillion Document Converter.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Express Dictate Recorder.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Accounting Software.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Invoicing Software.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Express Rip CD Ripper.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Express Talk Softphone.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Golden Records LP Converter.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\MixPad MultiTrack Mixer.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Graphics File Converter.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Prism Video File Format Converter.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\RecordPad Sound Recorder.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\SoundTap Streaming Recorder.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Switch Sound File Converter.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\WavePad Sound Editor.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\VideoPad Video Editor.lnk
C:\Users\win7\Favorites\NCH Software Download Site.lnk
C:\Users\win7\AppData\Local\Temp\is-PO0NI.tmp\sample.tmp
C:\Users\win7\AppData\Local\Temp\is-J5PDV.tmp\_isetup\_RegDLL.tmp
C:\Users\win7\AppData\Local\Temp\is-J5PDV.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-J5PDV.tmp\_isetup\_shfoldr.dll
C:\Users\win7\AppData\Local\Temp\~TMAD5B.tmp
C:\Users\win7\AppData\Local\Temp\~TMAFFC.tmp
C:\Users\win7\AppData\Local\Temp\mdmD5E6.tmp
\\?\hid#vid_80ee&pid_0021#6&e993e07&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030}
\\?\C:\Users\win7\AppData\Roaming\Adobe\Flash Player\AssetCache\WVW9FBZN
\\?\C:\Users\win7\.telemetry.cfg
\\?\C:\Users\win7\telemetry.cfg
C:\Users\win7\AppData\Local\Temp\FAPD79D.tmp
\\?\C:\Users\win7\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\G6FJ6N5A
\\?\C:\Users\win7\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\G6FJ6N5A\macromedia.com\support\flashplayer\sys\settings.sol
C:\Users\win7\AppData\Local\Temp\MDSD7CD.tmp
C:\Users\win7\AppData\Local\Temp\is-ABJK3.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\is-ABJK3.tmp\_isetup\_shfoldr.dll
C:\Users\win7\AppData\Local\Temp\nsq6451.tmp
C:\Windows\System32\Drivers\etc\hosts
C:\Users\win7\AppData\Roaming\1F866980-42E9-295E-F965-A482A2715E84\{12bb73b5-eaa8-9f96-b663-805edb785006}.xpi
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?linkid=182804
"C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\APTAT.Bootstrapper.exe"
MpSigStub.exe /program "C:\sample"
"C:\Users\win7\AppData\Local\Temp\lui8EE1.tmp\setup.exe"
"C:\Users\win7\AppData\Local\Temp\Opera Installer\sample" --version
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.opera.com/download/get/?partner=www&opsys=Windows
C:\Windows\system32\cmd.exe /c pause
MotoCast.exe
"C:\Windows\system32\cmd.exe" /C wmic computersystem get model /format:list
setup.exe
"C:\sample"
"C:\soffice.exe" --quickstart
C:\Users\win7\AppData\Local\Temp\SETUP_19714\Engine.exe /TH_ID=_2160 /OriginExe="C:\sample"
/s "C:\Windows\Downloaded Program Files\npenkIEInstall5x64.dll"
regsvr32.exe /s "C:\Windows\Downloaded Program Files\npenkIEInstall5x64.dll"
"C:\Users\win7\AppData\Local\Temp\GLJ17F8.tmp" C:\Windows\System32\ChSuite.ocx
"C:\Program Files\Common Files\logishrd\DriverStore\LDPInst.exe" /L /U
App/vidalia.exe --datadir .\Data\Vidalia\
"C:\Program Files\Internet Explorer\iexplore.exe" http://windjview.sourceforge.net/
"MOM"
"Setup.exe"
"C:\Windows\system32\regsvr32.exe" corpol.dll /s
"C:\Windows\system32\regsvr32.exe" crswpp.dll /s
"C:\Windows\system32\regsvr32.exe" cryptdlg.dll /s
"C:\Windows\system32\regsvr32.exe" cryptext.dll /s
"C:\Windows\system32\regsvr32.exe" csseqchk.dll /s
"C:\Windows\system32\regsvr32.exe" danim.dll /s
"C:\Windows\system32\regsvr32.exe" datime.dll /s
"C:\Windows\system32\regsvr32.exe" daxctle.ocx /s
"C:\Windows\system32\regsvr32.exe" dispex.dll /s
"C:\Windows\system32\regsvr32.exe" dssenh.dll /s
"C:\Windows\system32\regsvr32.exe" dxmasf.dll /s
"C:\Windows\system32\regsvr32.exe" dxtmsft.dll /s
"C:\Windows\system32\regsvr32.exe" dxtrans.dll /s
"C:\Windows\system32\regsvr32.exe" Es.dll /s
"C:\Windows\system32\regsvr32.exe" fpwpp.dll /s
"C:\Windows\system32\regsvr32.exe" ftpwpp.dll /s
"C:\Windows\system32\regsvr32.exe" gpkcsp.dll /s
"C:\Windows\system32\regsvr32.exe" hhctrl.ocx /s
"C:\Windows\system32\regsvr32.exe" hlink.dll /s
"C:\Windows\system32\regsvr32.exe" icmfilter.dll /s
"C:\Windows\system32\regsvr32.exe" iedkcs32.dll /s
"C:\Windows\system32\regsvr32.exe" iepeers.dll /s
"C:\Windows\system32\regsvr32.exe" xenroll.dll /s
"C:\Windows\system32\regsvr32.exe" ils.dll /s
C:\hndclient.exe
"C:\Program Files\UltraDefrag\lua5.1a_gui.exe" "C:\Program Files\UltraDefrag\scripts\upgrade-options.lua" "C:\Program Files\UltraDefrag"
"C:\Program Files\UltraDefrag\ultradefrag.exe" --setup
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5728603A-3FCB-4E6C-9E10-CC28D551EDDC}
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A54BEB11-7580-47D3-A88E-FDA33F6D1B38}
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0F488853-BB39-4F34-99DA-97A6C7C7F3EF}
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A409DC24-7574-4AB0-BF83-45CDB0DB1C48}
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5ADC58D4-9F48-4405-855C-92689F2C0D4B}
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AB138E76-8C41-4221-83F6-DFB12CD36481}
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4534286E-A18A-4048-8418-1C704F6AD0A8}
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{43D76218-2C5B-4FC4-B838-0706FA167285}
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{65F089CA-545C-4827-92F6-C22CA8B24A93}
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9DD74F05-BB6D-4F10-B807-70B6CA1D16E4}
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DC3C51F1-7A22-4523-BEA6-9F6A04CC56C1}
C:\Users\win7\AppData\Local\Temp\{D7840700-AB5E-44A0-8E3F-E9C3DC215D62}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D116A2E3-1FB9-43C3-92FE-A7199DE99823}
timeout 3
cmd.exe /C timeout 3 > Nul & Del "C:\sample"
MSIEXEC.EXE /i "C:\Users\win7\AppData\Local\Temp\{39439C73-7F64-4AEF-93C1-CCA89078D9E9}\iobitappsToolbar.msi" TRANSFORMS="C:\Users\win7\AppData\Local\Temp\{39439C73-7F64-4AEF-93C1-CCA89078D9E9}\1033.MST" SETUPEXEDIR="C:" SETUPEXENAME="sample"
C:\install\InstallGui.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.eveofjustice.com/files/WL2.2.2-link.zip
attrib +H C:\minecraft\.mc.exe
C:\\minecraft\.mc.exe --workDir .
C:\\minecraft\.mc.exe --workDir . --workDir .
C:\\minecraft\.mc.exe --workDir . --workDir . --workDir .
C:\\minecraft\.mc.exe --workDir . --workDir . --workDir . --workDir .
"C:\Users\win7\AppData\Local\Temp\nss331B.tmp\download.exe" /INI=C:\Users\win7\AppData\Local\Temp\nss331B.tmp\config.ini
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A54BEB11-8438-47D3-825C-CEB1979D1B38}
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0F488853-8519-4F34-B308-A4B4E7F9F3EF}
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A409DC24-4B54-4AB0-9551-76DF90E51C48}
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AB138E76-B051-4221-A924-ECA31CEF6481}
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3EE1097E-99C7-4E6E-A3D0-2C16E319E86C}
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CEE6A59E-E409-40E7-9F19-C25652F4729D}
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{43D76218-DCF3-4FC4-92EA-341462E67285}
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{65F089CA-6A7C-4827-B824-F13E88804A93}
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9DD74F05-854D-4F10-92D5-43A4EA2F16E4}
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DC3C51F1-4402-4523-9474-AC7824FE56C1}
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D116A2E3-2389-43C3-B82C-940BADD59823}
C:\Users\win7\AppData\Local\Temp\{DBEA6ADC-3E7D-4157-A2D5-4A7366E9A8C8}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E0B52307-E7B2-4174-ACA1-5A448DB3CC39}
C:\..\
C:\Users\win7\AppData\Local\Temp\psiphon-tunnel-core.exe --config "C:\Users\win7\AppData\Roaming\Psiphon3\psiphon.config" --serverList "C:\Users\win7\AppData\Roaming\Psiphon3\server_list.dat"
"C:\Users\win7\AppData\Local\Temp\VSDD4DE.tmp\dotnetfx\dotnetchk.exe"
"C:\Users\win7\AppData\Local\Temp\nso8B06.tmp\install_flash_player_plugin.exe"
cmd /k taskkill /IM "sample" /f
C:\\CFVS_Injector.exe
cmd /c Install.exe
cmd /c install.bat
"C:\Program Files\Internet Explorer\iexplore.exe" http://java.com/download
"C:\Users\win7\AppData\Local\Temp\NXPProximityInstaller\binutils\x64\CertMgr.exe" -add "C:\Users\win7\AppData\Local\Temp\NXPProximityInstaller\driver\x64\NxpNfpProvider.cer" -c -s -r localMachine TrustedPublisher
"C:\IntegrityCheck.exe"
"C:\Users\win7\AppData\Local\Temp\setup.exe"
C:\Windows\splwow64.exe 12288
"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\Downloaded Program Files\JuniperSetupClient64.ocx"
"C:\Users\win7\AppData\Roaming\Juniper Networks\Setup Client\JuniperSetupClientOCX64.exe"
"C:\Users\win7\AppData\Local\Temp\is-R4JTE.tmp\CNCBGuardReg.exe" /VERYSILENT /norestart
"C:\Users\win7\AppData\Local\Temp\pft7A9B.tmp\LocalInstall.exe"
"C:\sample" /_ShowProgress
"c:\sample"war3.exe"
C:\Users\win7\AppData\Roaming\MusaLLaT.exe
C:\Users\win7\AppData\Local\Temp\IXP000.TMP\Install.exe
C:\\BattleFleetGothic\Binaries\Win64\BattleFleetGothic-Win64-Shipping.exe
"C:\Users\win7\AppData\Local\Temp\SPTDinst.exe" add /q
Please enter LauncherInstallExecutable in ini
C:\EasyInst64.exe EZU
.\DPInstLaunch.exe HPG4000
MODE CON COLS=75 LINES=17
"C:\Users\win7\AppData\Local\Temp\RarSFX0\OpaTool.bat"
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.mql5.com/?utm_campaign=WebInstaller&utm_medium=special&utm_source=installer
"C:\sample" --channel=2084.0023F414.2025234015 --type=renderer
tear
"C:\Users\win7\AppData\Roaming\Genieo\Application\Partner\uninstall\genuninstallui.exe"
taskkill /F /IM "firefox.exe"
Precise Detectors Analysis Results
No Detector Result Received
Advance Heuristics
No Advanced Heuristic Analysis Result Received
Human Expert Analysis Results
Analysis Start Date:   2016-04-08 14:44:32.194011 ( )
Analysis End Date:  2016-04-08 19:35:03.941603 ( )
File Upload Date:  2016-04-08 14:42:23.923079 ( )
Update Date:  2016-04-08 19:35:03.941606 ( )
Human Expert Analyst Feedback:  
Verdict:   Malware
Additional File Information
Property | Value |
---|
Name | Virtual Address | Virtual Size | Raw Size | Entropy | MD5 |
---|