Analyzing...
|
File Name:   1509302109.exe
SHA1:   e56b1eb605031b1363146eba07889065905f6905
MD5:   7d29aebaa6ecc4f300914d675dc656a2
First Seen Date:  2015-09-30 17:40:46.572000 ( )
Number of Clients Seen:   7
Last Analysis Date:  2015-09-30 17:40:46.572000 ( )
Human Expert Analysis Result:   No human expert analysis verdict given to this sample yet.
Analysis Summary
Analysis Type | Date | Verdict | |
---|---|---|---|
Signature Based Detection | 2015-09-30 17:40:46.572000 | Malware | |
Static Analysis Overall Verdict | 2015-09-30 17:40:46.572000 | Highly Suspicious | |
Dynamic Analysis Overall Verdict | 2015-09-30 17:40:46.572000 | No Match | help |
Static Analysis
Static Analysis Overall Verdict | Result |
---|---|
Highly Suspicious |
Detector | Result | |
---|---|---|
Optional Header LoaderFlags field is valued illegal | Clean | |
Non-ascii or empty section names detected | Suspicious | |
Illegal size of optional Header | Clean | |
Optional Header NumberOfRvaAndSizes field is valued illegal | Clean | |
Based on the sections entropy check! file is possibly packed | Clean | |
Timestamp value suspicious | Suspicious | |
Header Checksum is zero! | Suspicious | |
Enrty point is outside the 1st(.code) section! Binary is possibly packed | Clean | |
Packer detection on signature database | Unknown | help |
Anti-vm present | Clean | |
The Size Of Raw data is valued illegal! Binary might crash your disassembler/debugger | Clean | |
TLS callback functions array detected | Suspicious |
Packer detection on signature database
ASProtect v1.2x (New Strain)
ASProtect 1.33 - 2.1 Registered -> Alexey Solodovnikov
ASProtect v1.23 RC1
Dynamic Analysis
Dynamic Analysis Overall Verdict | Result |
---|---|
No Threat Found | help |
Suspicious Behaviors | |
---|---|
Opens a file in a system directory |
Behavioral Information
C:\Users\win7\AppData\Local\Temp\RBX-1D26ABDC.tmp
C:\Windows\system32\DUser.dll
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195c
C:\Users\win7\AppData\Local\Temp\is-0AH6L.tmp\sample.tmp
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe
C:\Users\win7\AppData\Local\Temp\nsd9943.tmp\domanager.exe
C:\Windows\system32\mscoree.dll
C:\Windows\SysWOW64\WScript.exe
C:\Users\win7\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
C:\Windows\system32\MSHTML.DLL
C:\Users\win7\AppData\Local\Temp\caa414.tmp
C:\Windows\SysWOW64\explorer.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cscomp.dll
C:\Windows\SysWOW64\jscript9.dll
C:\Users\win7\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
C:\Windows\system32\cryptnet.dll
C:\Users\win7\AppData\Local\Temp\wwaE1E2.tmp
C:\Windows\syswow64\MSCTF.dll
C:\Users\win7\AppData\Local\Temp\SandboxieInstall-64-bit-42371359.exe
C:\Windows\System32\msxml6.dll
C:\Users\win7\AppData\Local\Temp\rna86B2.tmp
C:\Windows\system32\riched20.dll
C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_50916076bcb9a742\MSVCR90.dll
C:\Users\win7\AppData\Local\Temp\nsr3BC7.tmp\setupcl.exe
C:\WINDOWS\SYSTEM32\MSVBVM60.DLL
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\SysWOW64\Wbem\WMIC.exe
C:\Windows\system32\RichEd20.dll
C:\Windows\SysWOW64\tasklist.exe
C:\Users\win7\AppData\Local\Temp\~nsu.tmp\Au_.exe
C:\Windows\system32\d3d11.dll
C:\Windows\SysWOW64\CSrv.exe
C:\Users\win7\AppData\Local\Temp\is-FIM1G.tmp\sample.tmp
C:\Users\win7\AppData\Local\Temp\beecdhceii.exe
C:\Windows\SysWOW64\wscript.exe
C:\Users\win7\A
C:\Users\win7\AppData\Local\Temp\~dl5790.exe
C:\Windows\SysWOW64\msiexec.exe
C:\Windows\system32\ODBC32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.dll
C:\Windows\syswow64\CRYPT32.dll
C:\Users\win7\AppData\Local\Temp\7zSF225.tmp\SymCCISExe.exe
C:\Windows\syswow64\SETUPAPI.dll
C:\Users\win7\AppData\Local\Temp\beecbdbgjc.exe
C:\Users\win7\AppData\Local\Temp\nstD3DD.tmp\7za.exe
C:\Windows\syswow64\USER32.dll
C:\Windows\system32\propsys.dll
C:\Windows\syswow64\shlwapi.DLL
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\.ba1\WixStdBA.dll
C:\Users\win7\AppData\Local\Temp\nss29BA.tmp\g\gtapi_signed.DLL
C:\Windows\system32\ieframe.dll
-33363537-
C:\Windows\SysWOW64\DDRAW.dll
C:\Windows\system32\MSVBVM60.DLL
C:\Users\win7\AppData\Local\Temp\SETUP_41436\Engine.exe
C:\Windows\SYSTEM32\MSCOREE.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\D3D10Warp.dll
C:\Users\win7\AppData\Local\Temp\IXP000.TMP\WcPlugin.exe
C:\Users\win7\AppData\Local\Tem
C:\sample
C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\MSVCR80.dll
C:\Windows\SysWOW64\cryptnet.dll
C
C:\Windows\SysWOW64\PROPSYS.dll
C:\Users\win7\AppData\Local\Temp\nss29BA.tmp\g\pfWWW.DLL
C:\Windows\SysWOW64\schtasks.exe
C:\User
C:\Windows\system32\dxgi.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
C:\Windows\system32\WINMM.dll
C:\Windows\system32\EhStorShell.dll
C:\Windows\system32\RICHED20.dll
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\APTAT.Bootstrapper.exe
C:\Users\win7\AppData\Roaming\subfolder\jdhdf.exe
C:\Windows\SysWOW64\schannel.dll
C:\Users\win7\AppData\Local\Temp\7zSF225.tmp\SCC.dll
C:\Windows\system32\MSFTEDIT.DLL
C:\Windows\system32\RichEd20.DLL
C:\Windows\system32\MSHTML.dll
C:\Users\win7\AppData\Local\Temp\is-I98HR.tmp\sample.tmp
C:\Users\win7\AppData\Local\Temp\nsc4C2.tmp\webapp-uninstaller.exe
C:\Windows\SysWOW64\Wbem\wmic.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\msi.dll
C:\
C:\Windows\SysWOW64\mshtml.dll
C:\Windows\SysWOW64\ieframe.dll
C:\Windows\system32\PROPSYS.dll
C:\Users\win7\AppData\Local\Temp\is-7PPJQ.tmp\sample.tmp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\system32\werui.dll
C:\Windows\SysWOW64\cmd.exe
C:\Windows\syswow64\kernel32.dll
C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
C:\Windows\System32\msxml3.dll
C:\Windows\system32\sxs.dll
C:\Windows\system32\ntshrui.dll
C:\Users\win7\AppData\Local\Temp\7zSF225.tmp\SymCCIS.dll
C:\Windows\system32\RICHED20.DLL
C:\Users\win7\AppData\Local\Temp\nso3BBE.tmp\setupcl.exe
C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18834_none_72d38c5186679d48\gdiplus.dll
C:\Windows\system32\CRTDLL.DLL
c:\dupdmhgeno
C:\Windows\system32\DirectX\WebSetup\dsetup.dll
C:\Users\win7\AppData\Local\Temp\is-5VJ0O.tmp\itdownload.dll
C:\DLL_Loader.exe
CSS_Compat
Plane5
Version
MinimumSystemTimerResolution
DisableCachingOfSSLPages
DriverVersion
EnablePunycode
Plane3
TabProcGrowth
Plane16
~MHz
Compatible
Print_Background
CreateUriCacheSize
DriverDate
EnableNegotiate
<NULL>
MachineId
SIG
Platform
WarnOnPostRedirect
EnableUTF8
Plane1
kxesc
DisableBasicOverClearChannel
SavedLegacySettings
Plane10
ILDependencies
DisplayName
InfSection
sample
RtfConverterFlags
IECompatVersionLow
MVID
DisableSecuritySettingsCheck
SystemSetupInProgress
Plane8
MatchingDeviceId
QueuePesterInterval
Plane6
DisableBranchCache
ProductName
ConnectRetries
Move System Caret
WpadDhcp
System.Web.Services
AlwaysDrainOnRedirect
DisableQueue
AutoConfigURL
Plane11
ProviderName
DaysToKeep
Disable Diagnostics Mode
Plane15
SocketSendBufferLength
DriverDesc
No3DBorder
EnablePrivateObjectHeap
DefaultConnectionSettings
AdminTabProcs
SpecialFoldersCacheSize
MiscFlags
UseFirstAvailable
Plane2
DnsCacheEnabled
Modules
Level
NIDependencies
CertCacheNoValidate
WpadDecisionTime
EnableLUA
CacheMode
WpadDecision
UrlEncoding
C:\Windows\SYSTEM32\MSCOREE.DLL
ScavengeCacheFileLimit
PresentationCore
WpadSearchAllDomains
Enable AutoImageResize
Anchor Color
DigitalProductId
ConnectTimeOut
DontUseDNSLoadBalancing
Expand Alt Text
Disable
ShareCredsWithWinHttp
Plane9
DisableNTLMPreAuth
Latest
Plane14
DnsCacheEntries
LastModTime
Plane12
Plane4
ConfigString
Use_DlgBox_Colors
Show image placeholders
SessionMerging
WarnOnZoneCrossing
C:\Windows\system32\IMM32.DLL
Play_Background_Sounds
EvalationData
path
GCStressStartAtJit
MissingDependencies
InfSectionExt
Status
IESansSerifFontName
MachineGUID
MD_TrackColDesMisses
ProxyHttp1.1
System.Data.SqlXml
SendExtraCRLF
InstallRoot
mscorlib
FrameMerging
ConfigureArchive
System
DnsCacheTimeout
WarnOnPost
EnableSpdyDebugAsserts
Cleanup HTCs
WarnOnBadCertRecving
Counter Names
WpadDecisionReason
UninstallString
Size
CoInternetCombineIUriCacheSize
JScriptProfileCacheEventDelay
SendTimeOut
Always Use My Colors
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\ea543310204d0addfaf9792d820e958d\PresentationFramework.ni.dll
ClientAuthBuiltInUI
WpadExpirationDays
DisableMSIPeek
AutoBackupLogFiles
MediaSubType
SmoothScroll
DataFilePath
ScavengeCacheFileLifeTime
ConfigMask
WarnOnHTTPSToHTTPRedirect
Plane7
IEFontSizePrivate
Accessibility
UserContextLockCount
ProxyServer
PreConnectLimit
AutoDetect
FrameTabWindow
ReceiveTimeOut
VersioningLog
RuntimeVersion
MaxSubDomains
Name
MaxConnectionsPer1_0Server
Always Use My Font Size
SocketReceiveBufferLength
C:\Windows\syswow64\api-ms-win-downlevel-user32-l1-1-0.dll
DontSendAdditionalData
IE
System.Xml
WpadOverride
FromCacheTimeout
PrivacyAdvanced
IEFixedFontName
DuoProtocols
InfPath
DisableKeepAlive
Language
MaxQueueCount
NIUsageMask
NoProtectedModeBanner
RootDomainLimit
Display Inline Images
CVListXMLVersionLow
System.Deployment
AutoRecover
DigitalProductId4
MaxConnectionsPerProxy
DefaultOverrideBehavior
DisableScriptDebuggerIE
LatestIndex
950
VML
EnableHttp1_1
Microsoft.VisualC
ProxyOverride
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\38bf604432e1a30c954b2ee40d6a2d1c\mscorlib.ni.dll
ClientCacheSize
WarnAlwaysOnPost
Plane13
TcpAutotuning
CacheLocation
DbgManagedDebugger
DefaultConsent
EnableLog
System.Configuration
SecureProtocols
ObjectLimit
CombineFalseStartData
UseMPHeap
LogFile
XDomainRequest
DOMStorage
ScavengeCacheLowerBound
System.Runtime.Serialization.Formatters.Soap
InstallDate
Install
SuiteLanguage
Display Inline Videos
LeashLegacyCookies
Use Anchor Hover Color
CommonFilesDir
DisableReadRange
WindowsBase
MaxConnectionsPerServer
BaiduSdTray
CLR20r3
MaxArchiveCount
UseHR
IEPropFontName
IEUIFontName
SyncMode5
Anchor Underline
WpadDns
ProgramFilesDir
ZoomDisabled
DisableFalseStartBlocklist
CLRLoadLogDir
CorporateWerUseAuthentication
BadProxyExpiresTime
PresentationUI
Disabled
DisplayVersion
DownloadCacheQuotaInKB
SqmHttpStreamRandomUploadPoolSize
AutoProxyDetectType
ServerInfoTimeout
DisableArchive
Microsoft.PowerShell.ConsoleHost
DontShowUI
ProcessID
MaxHttpRedirects
PreResolveLimit
Microsoft.PowerShell.Security
Use Web Based FTP
ForceDriverFlagsOff
KeepAliveTimeout
Flags
TotalLimit
C:\Windows\syswow64\iertutil.dll
IESerifFontName
ProxyEnable
ForceLog
Class
BuildLab
FtpDefaultExpiryTimeSecs
FEATURE_CLIENTAUTHCERTFILTER
C:\Windows\syswow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
LoggingLevel
Default_CodePage
Anchor Color Visited
SecurityIdIUriCacheSize
IEFontSize
DXTFilterBehavior
LoggingDisabled
CorporateWerServer
CurrentVersion
BundleUpgradeCode
Allow Programmatic Cut_Copy_Paste
DebugLogPath
OWNDC
CLSID
ReachFramework
LogFailures
OnlyUseLatestCLR
Microsoft.PowerShell.Commands.Utility
Microsoft.WSMan.Runtime
GlobalFlags
NoRecentDocsHistory
IdentifierLimit
ContextLimit
XMLHTTP
C:\sample
RegisteredOwner
TRACE_UTIL
0
WpadDetectedUrl
UseLegacyIdentityFormat
install host
LogResourceBinds
MTxOciCPTimeout
PnpInstanceID
NoClientChecks
IsTextPlainHonored
ApplicationBase
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
Fonts
Logging
QQPCTray
DisableConfigCache
Anchor Color Hover
PINF
LicenseDate
CorporateWerPortNumber
Microsoft.JScript
EnforceP3PValidity
Disable Visited Hyperlinks
PowerShellVersion
360Safetray
HttpDefaultExpiryTimeSecs
DebugLogLevel
SendEFSFiles
SwapMouseButtons
C:\Windows\syswow64\api-ms-win-downlevel-ole32-l1-1-0.dll
Always Use My Font Face
PipelineMaxStackSizeMB
KSafeTray
System.Security
RenderingLoopMaxTime
version
Content Type
BypassDataThrottling
FORCE_ASSEMREF_DUPCHECK
System.DirectoryServices
Default_IEFontSizePrivate
Play_Animations
ScanAtStartup
360sd
CodePointToFontMap
System.Core
NavigationDelay
System.Printing
LegacyPolicyTimeStamp
System.Transactions
IdnEnabled
FileMappingSize
Microsoft.WSMan.Management
System.Data
SP
Disable Script Debugger
FXMemEnabled
CVListXMLVersionHigh
System.Web
C:\Windows\Microsoft.NET\Framework\v3.0\WPF\wpfgfx_v0300.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\ef204c8310562595a0518e356fb15387\PresentationCore.ni.dll
Log File Max Size
Microsoft.PowerShell.Commands.Management
MS Shell Dlg 2
BaiduAnTray
System.Configuration.Install
C:\Windows\syswow64\USER32.dll
DevOverrideEnable
ts
DataStreamEnabledState
InstanceType
C:\Windows\syswow64\SspiCli.dll
System.ServiceProcess
IJWEntrypointCompatMode
PageNotifyNext
SystemBiosVersion
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\63e9d5c341d64a753cde97f5a3d65c71\System.Core.ni.dll
StackVersion
GCStressStart
System.Windows.Forms
ProtectedModeOffForAllZones
C:\Windows\syswow64\urlmon.dll
ForceQueue
DomainLimit
Win31FileSystem
IECompatVersionHigh
UpgradeID
CategoryOptions
ForceBFCacheCandidacyPass
StyleUpdatedMax
System.EnterpriseServices
ap
.HLP
eulaaccepted
cufValue
RegisteredOrganization
Start Menu
InstallationType
ConsoleHostAssemblyName
PSMODULEPATH
ForceUserModeCabCollection
Q300829
TRACE_CM
TRACE_TRACE
InstalledDisplayDrivers
ComputerName
DelayShortcut
LanguageUpdatedUse
C:\Windows\syswow64\normaliz.DLL
RestrictRun
MaxSize
index1
System.Drawing
System.Management.Automation
URL Protocol
WindowsEdition
C:\Windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
EulaAccepted
UUID
test
version0
C:\Windows\syswow64\MSCTF.dll
IsMultiInstance
HWID
C:\Windows\syswow64\profapi.dll
PresentationFramework
NoNetConnectDisconnect
C:\Windows\system32\version.DLL
Enable Browser Extensions
UseWINSAFER
C:\Windows\syswow64\USP10.dll
ILUsageMask
C:\Windows\system32\dwmapi.dll
C:\Windows\SysWOW64\ntdll.dll
s_Enable
C:\CFVS_HookDll.dll
C:\Windows\syswow64\msvcrt.dll
TRACE_UI
Microsoft.PowerShell.Commands.Diagnostics
TasksFolder
ColorEnabledDisplay
C:\Windows\syswow64\CRYPTBASE.dll
DisplayLogo
SoftwareOnly
TRACE_PROXY
TRACE_GATEWAY
oeminstall
CorporateWerUseSSL
ShortcutBehavior
t
Logging Directory
LastVersionChecking
Local AppData
C:\Windows\syswow64\api-ms-win-downlevel-version-l1-1-0.dll
WaitToKillServiceTimeout
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\syswow64\KERNELBASE.dll
OracleXaLib
UIAutomationProvider
OracleSqlLib
PresentationCFFRasterizer
NoClose
MSFTInternal
CurrentType
Timeout
TypeChangedShow
NoDrives
Default Impersonation Level
RunDate
InstallerResult
TRACE_PERFMON
C:\Windows\syswow64\WININET.dll
Columns
OracleOciLib
BundlePatchCode
First Counter
DbgJITDebugLaunchSetting
C:\Windows\system32\apphelp.dll
NotifyOnTaskMiss
C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\MSVCR80.dll
System.Management
NoGuiFromShim
TRACE_TM
SpeedGuard
LogDir
NoRun
UserLanguage
ProductType
sYearMonth
PackageCode
C:\Windows\syswow64\RPCRT4.dll
Piriform Ltd
C:\Windows\syswow64\WS2_32.dll
AppStart
CSDVersion
OracleTraceFilePath
AdvpackLogFile
Installed
CacheOk
C:\Windows\system32\DNSAPI.dll
UIAutomationTypes
CPath
C:\Windows\syswow64\OLEAUT32.dll
C:\Windows\syswow64\ADVAPI32.dll
C:\Windows\syswow64\shlwapi.DLL
NumberOfCsPools
UserContextListCount
BuyNowURL
EnableDebugLog
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\syswow64\NSI.dll
ViewHiddenTasks
PendingFileRenameOperations
ItemsToScan
ThemeUpdatedValid
msi
USERNAME
netsvcs
MachineGuid
C:\Windows\syswow64\LPK.dll
DebugOutEnabled
EditionID
C:\Windows\syswow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
UndoDir
C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\1c3513960037508558358652f2d202a1\WindowsBase.ni.dll
TraceFilePath
BundleDetectCode
StateModifiedLocal
TRACE_LOG
TRACE_XA
IgnoreUserSettings
UseExceptionList
TRACE_VSSBACKUP
C:\Windows\syswow64\ole32.DLL
UninstallArguments
C:\Windows\syswow64\USERENV.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\908ba9e296e92b4e14bdc2437edac603\System.ni.dll
C:\Windows\syswow64\KERNEL32.dll
C:\Windows\system32\uxtheme.dll
beecdhceii.exe
System.Design
StyleModifiedPrev
TRACE_CONTACT
lang
TRACE_LU
InstallerError
C:\Windows\syswow64\GDI32.dll
LogSecuritySuccesses
InstalledLanguages
Default
ActiveModifiedTheme
TRACE_MISC
EventMessageFile
MemoryBufferSize
TRACE_MTXOCI
Group
TRACE_TIP
LegacyWPADSupport
C:\Windows\SysWOW64\sechost.dll
EnabledScopes
BundleAddonCode
DepOfLookAsideBuf
BannerURL
InstallerResultUIString
InstallStat
APPCRASH
IsTest
C:\Windows\syswow64\shell32.dll
SSet
TRACE_ETWTRACE
UMID
ShowRebootMessage
TrustPolicy
usagestats
LoadDebugRuntime
OEMID
DisableMMX
Enabled
Library
CurrentBuildNumber
COM+Enabled
SessionID
s_SmartScan
installedcampaigns
ShowEUA
MinCompletedLine
TRACE_KTMRM
TRACE_CLUSTER
TRACE_RESOURCE
IR
brand
TRACE_SVC
SonyAgent
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\.ba1\en\thm.wxl
C:\Python27\Lib\test\cjkencodings\shift_jisx0213.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\YMR1SCT1.txt
C:\Users\win7\AppData\Local\Temp\chrome_installer.log
C:\Python27\tcl\tcl8.5\tzdata\Australia\Lindeman
c:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui
C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Entries\{063FD797-5F24-091F-2B4E-0269D13D0B70}
C:\WINDOWS\FONTS\FRANK.TTF
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\O21E4UII.txt
C:\Users\win7\AppData\Local\Temp\E592A50D-87A9-437F-9F9B-31AA642D3A9Bmp\\tE592A50D-87A9-437.tmp
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_logical_operators.help.txt
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell
C:\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Entries\{5814391C-0379-0644-BCB5-61696E94879C}
c:\apilog.txt
C:\WINDOWS\FONTS\UPCEBI.TTF
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Data.dll
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F90F18257CBB4D84216AC1E1F3BB2C76
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\SB3PQI11.txt
C:\WINDOWS\FONTS\CANDARAI.TTF
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D
C:\Python27\Lib\test\math_testcases.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\BDROMVNZ.txt
C:\Python27\tcl\tcl8.5\tzdata\America\Dawson_Creek
C:\Python27\tcl\tcl8.5\tzdata\Asia\Kuwait
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\YD05796Z.txt
c:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui
C:\Windows\Installer\SourceHash{E2B51919-207A-43EB-AE78-733F9C6797C3}
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\IOWT5XY4.txt
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Ref.help.txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat
C:\Python27\tcl\tcl8.5\tzdata\America\Buenos_Aires
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\EQ3RJPSK.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\win7@scorecardresearch[2].txt
C:\ProgramData\Microsoft\WLSetup\Logs\2015-09-15_20-28_938-di4afso8.log
C:\Windows\SysWOW64\ntdll.dll
C:\theme\region-----en\masterconfig.ini
C:\Users\win7\AppData\Local\Temp\tmp2475.tmp
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\V4F4NQ8I.txt
C:\Users\win7\AppData\Local\Temp\81442385095.txt
C:\Users\win7\AppData\Local\SharedSettings.ccs
C:\Python27\tcl\tcl8.5\tzdata\Etc\Universal
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_trap.help.txt
C:\Users\win7\AppData\Local\Temp\nsj20C1.tmp\inetc.dll
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8828F39C7C0CE9A14B25C7EB321181BA_DC03E45EC7611F50ADAEBABE405A8C4C
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\dm_left_image[1].png
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Kiritimati
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_regular_expressions.help.txt
C:\sample
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\tvl.txt
C:\Python27\tcl\tcl8.5\tzdata\Antarctica\Palmer
C:\Python27\tcl\tcl8.5\tzdata\America\Manaus
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\nsl1B3A.tmp
C:\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Entries\{790D7354-EF74-7B90-6BD5-12E3B1F9A7EF}
C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Entries\{790D7354-EF74-7B90-6BD5-12E3B1F9A7EF}
C:\Windows\syswow64\profapi.dll
C:\Python27\tcl\tix8.4.3\pref\Makefile
C:\Python27\tcl\tcl8.5\tzdata\America\Martinique
C:\Python27\tcl\tcl8.5\tzdata\Indian\Mauritius
C:\rei\AV\Microsoft.VC90.CRT\Microsoft.VC90.CRT.manifest
C:\Python27\tcl\tcl8.5\tzdata\Asia\Oral
C:\Python27\tcl\tcl8.5\tzdata\Africa\Bangui
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_execution_policies.help.txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\f[1].js
C:\Windows\DXError.log
C:\Python27\Lib\email\test\data\msg_25.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\4PRGF2ZY.txt
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Provider.aspx
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\cmdapt64.exe
C:\Python27\Lib\test\test_doctest4.txt
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619
C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm
C:\Python27\tcl\tk8.5\demos\timer
C:\Python27\Lib\test\cjkencodings\big5-utf8.txt
C:\Users\win7\AppData\Local\SharedSettings.sqlite
C:\Users\win7\AppData\Local\Temp\nso3BBE.tmp\nsExec.dll
C:\Users\win7\AppData\Local\Temp\7zSF225.tmp\SCC.config
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\T6X47WH9.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\KCWRVXVA.txt
C:\Users\win7\AppData\Local\Temp\tmp603B.tmp
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT-2
C:\Python27\tcl\tcl8.5\tzdata\America\Atikokan
C:\Python27\Lib\idlelib\HISTORY.txt
C:\Python27\tcl\tcl8.5\tzdata\Asia\Aqtau
C:\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\E1\E1332F9BF2E2ECFA57F3D54F626BF8D7C529BA04
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\1QPBV6ZE.txt
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5B565E5A03C1711296156E2E5BE2718C_C297F03C959E5AB6ED910FFB1EF385B4
C:\Python27\tcl\tcl8.5\tzdata\Australia\ACT
c:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\O98Z4CN1.txt
C:\Python27\tcl\tcl8.5\tzdata\America\Toronto
C:\clearkeycdmadapter.dll.asm_patch
C:\Python27\Lib\test\cjkencodings\iso2022_kr.txt
C:\Python27\Lib\idlelib\idle_test\README.txt
c:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml
C:\Python27\tcl\tcl8.5\tzdata\Australia\Eucla
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\translations\3098.lang
C:\Users\win7\Favorites\desktop.ini
C:\Users\win7\AppData\Local\Temp\SandboxieInstall-64-bit-42371359.exe
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\ToolTips.dll
C:\Users\win7\AppData\Local\Temp\WERCB6C.tmp.WERInternalMetadata.xml
C:\Python27\Tools\pynche\webcolors.txt
/dev/urandom
C:\Python27\tcl\tcl8.5\tzdata\Asia\Dubai
c:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm
C:\Python27\tcl\tcl8.5\tzdata\America\North_Dakota\New_Salem
C:\Python27\tcl\tcl8.5\tzdata\Asia\Macau
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\background[1]
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\N3GH2QOL.txt
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Fiji
C:\Python27\Lib\site-packages\pip-7.0.1.dist-info\WHEEL
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_type_operators.help.txt
C:\Users\win7\AppData\Local\Temp\nss29BA.tmp\ButtonEvent.dll
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\.ba1\zhtw\thm.wxl
C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\D3\D34ED774F9FDCBA938A7807BD8FB1B398C51BC81
C:\Python27\tcl\tcl8.5\tzdata\America\Winnipeg
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_890607A31D4342BEBCF2B7827B9DBD65
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT+5
C:\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\47267F943F060E36604D56C8895A6EECE063D9A1
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Redirection.help.txt
C:\WINDOWS\FONTS\ARIBLK.TTF
C:\Python27\tcl\tcl8.5\tzdata\America\Havana
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6CU58ZXQ24V9BBYJ797G.temp
C:\Users\win7\AppData\Local\Temp\beecdhceii.exe
c:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Security.aspx
C:\Python27\Lib\email\test\data\msg_04.txt
c:\Program Files\Common Files\System\msadc\adcjavas.inc
C:\Users\win7\AppData\Local\Temp\tmp4C8E.tmp
C:\ProgramData\CuteFTP\sm.dat
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\DEQWR84V.txt
C:\Users\win7\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.htm
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_remote_FAQ.help.txt
C:\Windows\security\logs\scecomp.log
C:\WINDOWS\FONTS\ANGSAB.TTF
vc.exe
C:\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Entries\{063FD797-5F24-091F-2B4E-0269D13D0B70}
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\6V3C84B9.txt
C:\Python27\Lib\email\test\data\msg_02.txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\cancel1[1].gif
C:\Users\win7\AppData\Local\Temp\tmp2423.tmp
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\win7@dll-files[2].txt
c:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\M9LC6CR7.txt
C:\Python27\tcl\tcl8.5\tzdata\America\Blanc-Sablon
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT-14
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_profiles.help.txt
C:\Python27\tcl\tcl8.5\tzdata\Asia\Kolkata
C:\Python27\tcl\tcl8.5\tzdata\America\Indiana\Indianapolis
C:\ProgramData\GlobalSCAPE\CuteFTP Lite\sm.dat
C:\rei\AV\avupdate_msg.avr
C:\Windows\system32\directx\websetup\dsetup32.dll
__tmp_rar_sfx_access_check_7129968
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\translations\1061.lang
C:\Python27\tcl\tcl8.5\tzdata\SystemV\PST8PDT
C:\Python27\tcl\tcl8.5\tzdata\America\St_Lucia
C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\0119C23D88292A0E4FEC04D5CF8629005A44E37C
C:\Python27\tcl\tcl8.5\tzdata\Canada\Pacific
C:\Python27\tcl\tcl8.5\tzdata\US\Eastern
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml
C:\Users\win7\AppData\LocalLow\rbxcsettings.rbx
c:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui
C:\Python27\tcl\tcl8.5\tzdata\Africa\Djibouti
C:\Python27\tcl\tcl8.5\tzdata\Antarctica\DumontDUrville
C:\Users\win7\AppData\Local\Temp\tmp2412.tmp
C:\Python27\tcl\tcl8.5\tzdata\Etc\UTC
C:\Python27\tcl\tcl8.5\tzdata\America\Regina
\\.\PIPE\winreg
C:\USERS\WIN7\APPDATA\LOCAL\TEMP\7ZSF225.TMP\SCC.DLL
C:\Users\win7\AppData\Local\Temp\{aba88724-37eb-4f03-b83b-45199c5a7cf5}\.ba1\NetfxLicense.rtf
C:\localization\az.pak.patch
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\H6RXVCWB.txt
C:\Python27\tcl\tcl8.5\tzdata\US\Alaska
C:\Python27\tcl\tcl8.5\tzdata\Europe\Warsaw
C:\Users\win7\AppData\Local\Temp\Image.png
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
C:\localization\hi.pak.patch
C:\Python27\tcl\tcl8.5\tzdata\Asia\Ashgabat
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\C7K1L312.txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\accept[1].gif
C:\Python27\tcl\tcl8.5\tzdata\Asia\Damascus
C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Entries\{A59C741C-0B17-3F5B-C21F-EE1993E1E19E}
C:\Python27\tcl\tcl8.5\tzdata\Asia\Dhaka
C:\msvcp100.dll.asm_patch
C:\Python27\tcl\tcl8.5\tzdata\America\Cambridge_Bay
C:\Python27\tcl\tcl8.5\tzdata\America\Coral_Harbour
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\0TPTDR50.txt
C:\Users\Default
C:\Python27\tcl\tcl8.5\tzdata\America\Bogota
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\DefaultWsdlHelpGenerator.aspx
C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\rdpbus.cat
C:\Users\win7\AppData\Local\Temp\nss29BA.tmp\g\gcombo\ComboText.bmp
C:\Users\win7\AppData\Local\Temp\nsx74CC.tmp\System.dll
C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\AF\AF210C8748D77C2FF93966299D4CD49A8C722EF6
C:\files_list
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_27027F5B92BE5F4D2A02B25576D6D7CF
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\FileSystem.format.ps1xml
C:\Python27\tcl\tcl8.5\tzdata\Asia\Ust-Nera
C:\Python27\Lib\test\cjkencodings\gb2312.txt
C:\Users\win7\AppData\Local\GHISLER\wcx_ftp.ini
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_98E4B7607AA4134EC093F1CD1619DB87
c:\Program Files\Internet Explorer\Timeline.cpu.xml
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Reserved_Words.help.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\H28OV8I1.txt
C:\putty.hlp
C:\opera_autoupdate.version
C:\Users\win7\AppData\Roaming\FileZilla\filezilla.xml
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\0YU7W84K.txt
C:\Python27\tcl\tcl8.5\tzdata\Asia\Katmandu
C:\Python27\tcl\tcl8.5\tzdata\Asia\Thimphu
C:\WINDOWS\FONTS\SIMFANG.TTF
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\HCL5J0LW.txt
C:\Python27\tcl\tcl8.5\tzdata\Africa\Mbabane
C:\Python27\tcl\tcl8.5\tzdata\America\New_York
C:\Python27\tcl\tcl8.5\tzdata\Australia\Hobart
KJ.exe
C:\Users\win7\AppData\Local\Temp\beecbdbgjc.exe
C:\Python27\tcl\tcl8.5\tzdata\NZ-CHAT
C:\Windows\system32\GDIPFONTCACHEV1.DAT
C:\WINDOWS\FONTS\SHRUTIB.TTF
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\6Q4AVUPA.txt
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Wallis
C:\Python27\tcl\tcl8.5\tzdata\Europe\Helsinki
C:\localization\sv.pak.patch
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\DynamicOfferScreen[1].htm
C:\WINDOWS\FONTS\VERDANA.TTF
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\UD7SAZF7.txt
C:\Users\win7\AppData\Local\Temp\autB17C.tmp
C:\localization\pt-PT.pak.patch
c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini
C:\Python27\tcl\tcl8.5\tzdata\America\St_Johns
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6AA3321A15A787985201D7A6820782F0_4E35DE6F4FCFB7BE2C045F6B5ED89FC8
C:\Python27\tcl\tcl8.5\tzdata\Universal
C:\Users\win7\AppData\Local\Temp\_ir_sf_temp_0\irsetup.dat
C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\cdrom.cat
c:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\tipresx.dll.mui
C:\Python27\tcl\tix8.4.3\Makefile
C:\\rainoide.gif
C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\mshdc.cat
C:\Windows\SysWOW64\Wbem\textvaluelist.xsl
C:\WINDOWS\FONTS\ARIAL.TTF
C:\Python27\tcl\tk8.5\demos\tclIndex
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\RV4OUS9D.txt
c:\Program Files\Oracle\VirtualBox Guest Additions\VBoxMouse.inf
C:\localization\fy.pak.patch
C:\Python27\tcl\tcl8.5\tzdata\America\Pangnirtung
C:\theme\default-----en\masterconfig.ini
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\nsisXML.dll
C:\Users\win7\AppData\Local\Temp\nso3BBE.tmp\7za.exe
C:\Users\win7\AppData\Local\Temp\49F7.exe
C:\Users\win7\AppData\Local\Temp\\~DFA0E89673EBD853D1.TMP
__tmp_rar_sfx_access_check_428796
C:\Users\win7\AppData\Local\Temp\nsc8A4A.tmp\System.dll
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\XGZ52ECN.txt
C:\Users\win7\AppData\Local\Temp\nsc4C2.tmp\webapp-uninstaller.exe
C:\Windows\system32\directx\websetup\SETA386.tmp
C:\Python27\tcl\tcl8.5\tzdata\America\Shiprock
C:\Users\win7\AppData\Local\Temp\Image1.bmp
C:\Python27\tcl\tcl8.5\tzdata\Asia\Kashgar
c:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui
C:\Python27\tcl\tcl8.5\tzdata\America\Bahia_Banderas
C:\Python27\tcl\tcl8.5\tzdata\US\Samoa
C:\Python27\tcl\tcl8.5\tzdata\America\Argentina\Salta
C:\Users\win7\AppData\Local\Microsoft\Windows\Caches\cversions.1.db
C:\Users\win7\AppData\Local\Temp\nso3A98.tmp\System.dll
C:\Python27\tcl\tcl8.5\tzdata\EET
C:\Python27\tcl\tcl8.5\tzdata\NZ
C:\Python27\tcl\tcl8.5\tzdata\America\Fort_Wayne
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\IA6PYJIF.txt
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\MsiZhTw
C:\Python27\tcl\tcl8.5\tzdata\Australia\NSW
C:\Users\win7\AppData\Local\Temp\is-D5T9K.tmp\_isetup\_setup64.tmp
C:\Python27\tcl\tcl8.5\tzdata\Asia\Tehran
C:\Users\win7\AppData\Local\Temp\81442827323.txt
C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\input.cat
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\DefaultWsdlHelpGenerator.aspx
C:\Python27\tcl\tcl8.5\tzdata\Africa\Ceuta
C:\Users\win7\AppData\Local\FlashFXP\4\Sites.dat
C:\WINDOWS\FONTS\GEORGIAB.TTF
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT-4
C:\Users\win7\AppData\Local\Temp\aut6E96.tmp
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\S759SH6J.txt
C:\WINDOWS\FONTS\SEGOEUI.TTF
C:\data\region--en\masterconfig.ini
C:\Windows\System32\Drivers\etc\hosts
C:\ProgramData\SharedSettings.ccs
C:\Python27\tcl\tcl8.5\tzdata\Antarctica\South_Pole
C:\Python27\tcl\tix8.4.3\pref\tixmkpref
https://ninite.com/error/?source=fetchapps&code=1065&message=&error=0x80004005&version=0%2C1%2C0%2C496&os=6%2E1%2ESP1&key=&date=2015%2D09%2D15
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Fakaofo
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\ToolTips.dll
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
C:\Users\win7\AppData\Local\bitcoin\bitcoinmineropencl.cl
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Easter
C:\Python27\tcl\tcl8.5\tzdata\Africa\Accra
C:\Python27\tcl\tcl8.5\tzdata\Antarctica\Syowa
C:\Python27\tcl\tcl8.5\tzdata\America\Whitehorse
C:\rei\AV\HBEDV.KEY
C:\Python27\tcl\tcl8.5\tzdata\America\Edmonton
C:\Users\win7\AppData\Local\FluxSoftware\Flux\runtime\flux.psd
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Tahiti
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\NXM6034S.txt
c:\Program Files\Internet Explorer\en-US\networkinspection.dll.mui
c:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\machine.config
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\1K4U6GPN.txt
C:\Python27\tcl\tcl8.5\tzdata\Atlantic\Madeira
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\SFB8EP8Z.txt
C:\Users\win7\AppData\Local\Temp\is-I98HR.tmp\sample.tmp
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\OFLHI1RR.txt
C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm
C:\Windows\System32\drivers\etc\services
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\010914i[1].htm
C:\Users\win7\AppData\Local\Temp\tmp2486.tmp
C:\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\954D59EAEADC36CB19A224A5DDDFA1EDCFDC49CE
c:\Program Files\Oracle\VirtualBox Guest Additions\VBoxMouse.cat
C:\Users\win7\AppData\Roaming\subfolder\jdhdf.exe
c:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\2UV2UFOL.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\KNSAUFKK.txt
C:\Python27\tcl\tcl8.5\tzdata\Europe\Andorra
C:\WINDOWS\FONTS\CAMBRIAZ.TTF
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reimage Repair\Run in safe mode.lnk
C:\Users\win7\AppData\Local\Temp\AITMP601\setup.cab
C:\Users\win7\AppData\Local\Temp\tmp5F5D.tmp
C:\Python27\tcl\tcl8.5\tzdata\America\Indiana\Knox
C:\Users\win7\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.htm
C:\Users\win7\AppData\Local\bitcoin\gpl-2.0.txt
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\security.aspx
C:\Python27\tcl\tcl8.5\tzdata\America\Guayaquil
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\default.aspx
c:\Program Files\Common Files\Microsoft Shared\ink\Content.xml
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_transactions.help.txt
C:\Users\win7\AppData\Local\Temp\09152028-00000938-144e43q4vi\tmp293C.tmp
C:\Python27\Lib\email\test\data\msg_46.txt
C:\Program Files\Reimage\Reimage Repair\REI_SupportInfoTool.exe
c:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml
C:\Users\win7\AppData\Local\Temp\WER6053.tmp.WERInternalMetadata.xml
C:\Python27\tcl\tcl8.5\tzdata\Africa\Porto-Novo
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\next[1].gif
C:\wow_helper.exe.asm_patch
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\bg.bmp
C:\Users\win7\AppData\Local\Temp\nsh9F68.tmp
C:\Users\win7\AppData\Local\Temp\nss29BA.tmp\g\gcombo\combo-offer.png
C:\Python27\Lib\email\test\data\msg_30.txt
C:\WINDOWS\FONTS\KOKILAI.TTF
c:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui
C:\Users\win7\AppData\Local\Temp\nsc8A4A.tmp\LangDLL.dll
C:\WINDOWS\FONTS\CORDIAI.TTF
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_D37EE34BE4DBD55061320F8E501020FB
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Variables.help.txt
C:\Python27\tcl\tcl8.5\tzdata\America\Argentina\Tucuman
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\ManageAppSettings.aspx
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\TBHM0S79.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\XSA07G0J.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\IBS1CMH9.txt
C:\Users\win7\AppData\Local\Temp\tmp23C3.tmp
C:\Python27\tcl\tcl8.5\tzdata\SystemV\YST9YDT
C:\Python27\tcl\tcl8.5\tzdata\Africa\Windhoek
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\DebugAndTrace.aspx
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Break.help.txt
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_functions_advanced.help.txt
C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nete1g3e.cat
c:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\887FDFEF9DC62EF73EB288690D5944B1_69D8D47AB1AD575C0CF624C7D137AD1B
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Rarotonga
C:\widevinecdmadapter.dll.asm_patch
C:\Python27\tcl\tcl8.5\tzdata\America\Yellowknife
c:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7396C420A8E1BC1DA97F1AF0D10BAD21
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Auckland
C:\Python27\tcl\tcl8.5\tzdata\America\Port-au-Prince
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\tr-tr[1].htm
C:\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Entries\{A59C741C-0B17-3F5B-C21F-EE1993E1E19E}
C:\Users\win7\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.htm
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_4D025354576A836AEDB98A250F5497E3
C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\umbus.cat
C:\Python27\tcl\tcl8.5\tzdata\Europe\Lisbon
C:\Python27\tcl\tcl8.5\tzdata\America\Guadeloupe
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\paused_icon[1]
c:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\EmbedWeb.dll
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\MFSMUTFY.txt
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5B565E5A03C1711296156E2E5BE2718C_C297F03C959E5AB6ED910FFB1EF385B4
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\F401WZN1.txt
C:\Users\win7\AppData\Roaming\Microsoft\Internet Explorer
C:\Users\win7\AppData\Local\Temp\nss29BA.tmp\g\gcombo\ComboOffer.html
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_BD2DB04D89BA06543548BA6261B01318
C:\Users\win7\AppData\Local\Temp\tmp23A2.tmp
C:\Users\win7\AppData\Local\Temp\Icon.ico
C:\Python27\tcl\tcl8.5\tzdata\Africa\Douala
C:\ProgramData\CoffeeCup Software\SharedSettings.ccs
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_arrays.help.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\LB0UT742.txt
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\KPTool.dll
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\378B079587A9184B2E2AB859CB263F40_2B618FC6CF84AEF3C14E129161BF18D9
C:\theme.cab
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_PSSnapins.help.txt
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_try_catch_finally.help.txt
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_types.ps1xml.help.txt
C:\Python27\Lib\site-packages\pip-7.0.1.dist-info\entry_points.txt
Readme.txt
C:\Users\win7\AppData\Local\Temp\tmp4326.tmp
C:\Python27\tcl\tk8.5\demos\hello
C:\Users\win7\AppData\Local\Microsoft\Windows Mail\Stationery\Hand Prints.htm
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\check.png
C:\Python27\tcl\tcl8.5\tzdata\Europe\Gibraltar
C:\Python27\tcl\tcl8.5\tzdata\Etc\Greenwich
C:\Python27\Lib\email\test\data\msg_27.txt
c:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui
c:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\tipresx.dll.mui
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\addUser.aspx
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp.aspx
C:\Windows\SysWOW64\userenv.dll
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\I5782HI2.txt
C:\WINDOWS\FONTS\MSGOTHIC.TTC
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT+2
C:\Users\win7\AppData\Local\Temp\tmp5F6E.tmp
C:\Users\win7\AppData\Local\SharedSettings_1_0_5.ccs
C:\Python27\tcl\tcl8.5\tzdata\America\Chihuahua
C:\ProgramData\FileZilla\recentservers.xml
C:\WINDOWS\FONTS\ANGSAUZ.TTF
C:\WINDOWS\FONTS\MEIRYO.TTC
C:\Python27\tcl\tcl8.5\tzdata\Asia\Tokyo
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Newtonsoft.Json.dll
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\L2OMZRFK.txt
C:\Users\win7\AppData\Local\Temp\fuf54C3.exe
C:\Users\win7\AppData\Local\Temp\Tar3E34.tmp
C:\Users\win7\AppData\Local\Temp\uw2c.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\2V3UVBK0.txt
C:\Python27\Lib\test\cjkencodings\iso2022_jp.txt
C:\Python27\tcl\tcl8.5\tzdata\America\Belize
C:\Python27\tcl\tcl8.5\tzdata\Australia\Brisbane
C:\Python27\tcl\tcl8.5\tzdata\America\Rainy_River
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Documents.dll
C:\Python27\tcl\tcl8.5\tzdata\Europe\Sarajevo
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\MG4C5NVS.txt
C:\WINDOWS\FONTS\WINGDING.TTF
C:\Users\win7\AppData\Local\Temp\AITMP601\aiwizard.bmp
C:\Python27\tcl\tcl8.5\tzdata\America\Lima
C:\Python27\tcl\tcl8.5\tzdata\Greenwich
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\nsDialogs.dll
C:\Python27\tcl\tcl8.5\tzdata\America\Rankin_Inlet
C:\WINDOWS\FONTS\KOKILAB.TTF
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\J3KN6NZI.txt
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAEBE581FCB73249406FC21094EA252E_FD361CE5A85478C5EE18C8A08F5CE82E
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_475F510BF9169BFE0F32718985630A57
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Provider.aspx
C:\Users\win7\AppData\Local\Temp\nst1E41.tmp\xml.dll
C:\Users\win7\AppData\Local\Temp\RES4BBF.tmp
C:\Python27\tcl\tcl8.5\tzdata\America\Mazatlan
C:\WINDOWS\FONTS\UPCJI.TTF
C:\Python27\tcl\tcl8.5\tzdata\Europe\Monaco
C:\Python27\tcl\tcl8.5\tzdata\Asia\Dushanbe
C:\Users\win7\AppData\Local\Temp\nsx8A2A.tmp
C:\Program Files\Windows NT\TableTextService\TableTextServiceAmharic.txt
Install.cmd
C:\Python27\Lib\email\test\data\msg_29.txt
C:\Users\All Users
C:\Python27\tcl\tcl8.5\tzdata\Antarctica\Macquarie
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\manageAllRoles.aspx
C:\Python27\tcl\tcl8.5\tzdata\US\Hawaii
C:\Users\win7\AppData\Local\FlashFXP\4\History.dat
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml
C:\Users\win7\AppData\Local\Temp\Tar9D7D.tmp
c:\Program Files\Internet Explorer\en-US\eula.rtf
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\D7NP3JX9.txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\mobi[1].js
C:\Python27\tcl\tcl8.5\tzdata\Asia\Chongqing
C:\Users\win7\AppData\Local\FluxSoftware\Flux\runtime\flux.tre
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\8G338BYR.txt
C:\localization\fi.pak.patch
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\GERCUCX1.txt
C:\Users\win7\AppData\Local\Temp\is-V8JDK.tmp\_isetup\_setup64.tmp
C:\Windows\syswow64\NSI.dll
C:\WINDOWS\FONTS\KARTIKA.TTF
C:\WINDOWS\FONTS\PHAGSPA.TTF
C:\Python27\tcl\tcl8.5\tzdata\America\Anguilla
C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\APTAT.Application.exe.config
c:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\2529C6BI.txt
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\KPTool.dll
C:\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\D3\D34ED774F9FDCBA938A7807BD8FB1B398C51BC81
c:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
C:\Users\win7\AppData\Local\Temp\tmp2391.tmp
C:\Python27\tcl\tcl8.5\tzdata\Asia\Urumqi
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\win7@google[1].txt
C:\Users\win7\AppData\Local\Temp\RBX-1F8E419F.log
C:\WINDOWS\FONTS\TRADBDO.TTF
C:\Python27\Lib\idlelib\extend.txt
C:\snapshot_blob.bin.patch
C:\Windows\SysWOW64\ieframe.dll
C:\Users\win7\AppData\Local\Temp\nsd9943.tmp\domanager.exe.config
c:\Program Files\Internet Explorer\en-US\F12Resources.dll.mui
C:\Python27\Lib\email\test\data\msg_18.txt
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_debuggers.help.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\DF4GP3IX.txt
C:\Users\win7\AppData\Local\Temp\tmp2514.tmp
c:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui
C:\WINDOWS\FONTS\SEGUISB.TTF
C:\Python27\tcl\tcl8.5\tzdata\Asia\Jakarta
C:\Users\win7\AppData\Local\Temp\fgsvzkd
C:\Python27\tcl\tcl8.5\tzdata\SystemV\EST5
C:\data\default--en\masterconfig.ini
C:\Users\win7\AppData\Local\Temp\nstECF5.tmp\nsExec.dll
C:\Program Files\Reimage\Reimage Repair\Reimage_SafeMode.ico
C:\Python27\tcl\tcl8.5\tzdata\America\Argentina\Catamarca
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Application.aspx
c:\Program Files\Common Files\System\ado\msado27.tlb
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml
C:\Users\win7\AppData\Local\Temp\nsx74CC.tmp\Banner.dll
C:\Users\All Users\Microsoft\Windows\Power Efficiency Diagnostics\energy-report.html
C:\Python27\tcl\tcl8.5\tzdata\Asia\Kamchatka
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\.ba1\Avira.OE.Setup.InstallationCore.dll
C:\Users\win7\AppData\Local\Temp\AITMP601\aiheader.bmp
C:\Windows\lsass.exe
C:\Python27\Lib\site-packages\setuptools-16.0.dist-info\RECORD
C:\Python27\tcl\tcl8.5\tzdata\Indian\Comoro
C:\Python27\tcl\tcl8.5\tzdata\Australia\Yancowinna
c:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\ETTNNUN2.txt
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\Banner.dll
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml
C:\Users\win7\AppData\Local\Temp\caa414.tmp
C:\Python27\tcl\tcl8.5\tzdata\America\Matamoros
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\XRWDRXD1.txt
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_hash_tables.help.txt
C:\Python27\tcl\tcl8.5\tzdata\Mexico\BajaSur
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Enderbury
C:\Python27\tcl\tcl8.5\tzdata\America\Kralendijk
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\273HX8ZF.txt
C:\Windows\system32\sample\<install zipextimporter>
c:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui
c:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\.ba1\thm.wxl
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\WIGVNGRL.txt
C:\Users\win7\AppData\Local\Temp\default.txt
C:\Python27\Lib\email\test\data\msg_37.txt
C:\Python27\tcl\tcl8.5\tzdata\Africa\Kinshasa
tools\SDI\langs
C:\ProgramData\FlashFXP\4\Sites.dat
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_While.help.txt
Setup.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Certificate.format.ps1xml
C:\Users\win7\AppData\Local\Temp\qcb16A7.tmp
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\8MI0PG69.txt
C:\Python27\tcl\tcl8.5\tzdata\America\Creston
C:\Python27\Lib\email\test\data\msg_23.txt
C:\Users\win7\AppData\Roaming\Microsoft
c:\Program Files\Internet Explorer\en-US\F12Tools.dll.mui
C:\WINDOWS\FONTS\UPCEI.TTF
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\wizard.aspx
Qt5WebSockets.dll
C:\WINDOWS\FONTS\UPCJB.TTF
C:\Users\win7\AppData\Local\bitcoin\license.txt
c:\countdown.py
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\.ba1\ptbr\thm.wxl
C:\Users\win7\Saved Games\desktop.ini
C:\Python27\Lib\test\cjkencodings\gbk-utf8.txt
C:\Python27\tcl\tcl8.5\tzdata\Asia\Makassar
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\99GJRSIY.txt
C:\Users\win7\AppData\Local\Temp\nsx74CC.tmp\LogEx.dll
C:\Python27\tcl\tcl8.5\tzdata\America\Bahia
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C3E814D1CB223AFCD58214D14C3B7EAB
C:\Users\win7\AppData\Local\Temp\is-QV65I.tmp\sample.tmp
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\O2XAMW3O.txt
C:\Users\Default\desktop.ini
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A3D5BF1283C2E63D8C8A8C72F0051F5A
c:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_27027F5B92BE5F4D2A02B25576D6D7CF
c:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml
C:\Windows\system32\l_intl.nls
C:\Windows\System32\version.dll
C:\Python27\tcl\tcl8.5\tzdata\America\Aruba
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\FDOPPIJY.txt
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini
C:\Users\win7\AppData\Local\Temp\Cab3E33.tmp
C:\Python27\tcl\tcl8.5\tzdata\America\Santarem
C:\Python27\tcl\tcl8.5\tzdata\Europe\Athens
C:\Windows\SysWOW64\wshom.ocx
C:\putty.chm
C:\Users\win7\AppData\Local\Microsoft\Internet Explorer\brndlog.txt
C:\Python27\tcl\tk8.5\demos\README
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\button_over[1].png
C:\Users\win7\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3979321414-2393373014-2172761192-1000\58b8aea4ae7184a912187a66498d9b0c_c4b6765a-c53d-4b48-b576-0e1db4e9f3bc
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B912B2C6928A18B8CD7D50CF08BEA95B_10F92F379FD782720F9335B450E2C644
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_remote_jobs.help.txt
C:\Users\win7\AppData\Local\Temp\49E7.tmp
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\resume[1]
C:\Users\win7\AppData\Local\FluxSoftware\Flux\flux.exe
C:\Users\win7\AppData\Local\Temp\tmp2370.tmp
C:\Python27\tcl\tcl8.5\tzdata\America\Virgin
c:\Program Files\Internet Explorer\en-US\iedvtool.dll.mui
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\0C5BAPV6.txt
C:\Users\win7\AppData\Local\Temp\CR_23DD3.tmp\CHROME_PATCH.PACKED.7Z
C:\Users\win7\AppData\Local\Temp\tmp602B.tmp
C:\Python27\tcl\tcl8.5\tzdata\America\Yakutat
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\CreateAppSetting.aspx
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D1F03728133589A90656A87E482B21F
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\6EOHKMIT.txt
c:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Fonts\segoeuil.ttf
C:\Windows\system32\LogFiles\PunkBuster\pbsvc.log
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\3SL6PEUZ.txt
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Chuuk
C:\Python27\Tools\webchecker\README.txt
C:\Python27\tcl\tcl8.5\tzdata\SystemV\PST8
C:\Python27\tcl\tcl8.5\tzdata\GMT0
ycha.py
C:\Python27\tcl\tcl8.5\tzdata\Asia\Aqtobe
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_remote_troubleshooting.help.txt
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_BD2DB04D89BA06543548BA6261B01318
C:\Python27\tcl\tcl8.5\tzdata\America\North_Dakota\Beulah
C:\Users\win7\AppData\Local\Temp\nso3A98.tmp\NSISdl.dll
C:\Python27\Lib\email\test\data\msg_34.txt
C:\Python27\tcl\tcl8.5\tzdata\Brazil\East
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\APTAT.Core.dll
C:\ProgramData\CoffeeCup Software\SharedSettings_1_0_5.sqlite
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Arithmetic_Operators.help.txt
C:\Users\win7\AppData\Local\Temp\tmp2435.tmp
C:\ProgramData\FileZilla\filezilla.xml
C:\Users\win7\AppData\Local\Temp\nstD3DD.tmp\nsExec.dll
C:\WINDOWS\FONTS\ANGSAU.TTF
C:\Python27\Lib\email\test\data\msg_42.txt
C:\WINDOWS\FONTS\DAUNPENH.TTF
C:\Python27\tcl\tcl8.5\tzdata\Singapore
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\QVE6004M.txt
C:\Users\win7\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\win7\AppData\Local\bitcoin\msvcp80.dll
C:\Windows\inf\netsstpa.inf
C:\Users\win7\AppData\Local\Temp\is-J09EF.tmp\_isetup\_setup64.tmp
C:\Python27\tcl\tcl8.5\tzdata\Africa\Nairobi
C:\Users\win7\AppData\Local\Temp\tmp25D2.tmp
C:\Users\win7\AppData\Local\Temp\SETUP_41436\Modern_Icon.bmp
c:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\close.png
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\win7@www.bing[2].txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\2L0LKOYU.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\win7@bing[1].txt
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\140B4CDED8ED877CDC65B54BA965BD39
C:\Python27\tcl\tix8.4.3\demos\tclIndex
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1
C:\Users\win7\AppData\Local\bitcoin\libsasl.dll
C:\Users\win7\AppData\Local\Temp\nst1E41.tmp\modern-header.bmp
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Roblox\ROBLOX Studio 2.0 Beta.lnk
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\Button.dll
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\downloading_icon[1]
C:\WINDOWS\FONTS\ANGSAI.TTF
C:\Users\win7\AppData\Local\Temp\tmp3C6E.tmp
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_D37EE34BE4DBD55061320F8E501020FB
C:\Python27\tcl\tcl8.5\tzdata\America\Eirunepe
C:\Python27\tcl\tcl8.5\tzdata\EST5EDT
C:\Python27\tcl\tcl8.5\tzdata\Asia\Tbilisi
C:\Python27\tcl\tcl8.5\tzdata\Asia\Baku
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\security0.aspx
C:\Python27\Lib\test\tokenize_tests.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\BN4ZCNYC.txt
C:\Python27\tcl\tcl8.5\tzdata\Antarctica\McMurdo
C:\Python27\tcl\tcl8.5\tzdata\America\Menominee
C:\Users\win7\AppData\Local\bitcoin\pooler.exe
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\I5F903WU.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\H1QRV2ZL.txt
C:\Windows\System32\schtasks.exe
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\error_icon[1]
C:\Python27\tcl\tcl8.5\tzdata\Asia\Harbin
C:\Users\win7\Downloads\desktop.ini
<install zipextimporter>
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\HK5VK64M.txt
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\RSSFeeds.html
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\bsm_chrome.exe
C:\Users\win7\AppData\Local\Temp\tmp2894.tmp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Python27\tcl\tcl8.5\tzdata\US\East-Indiana
C:\WINDOWS\FONTS\MSUIGHUR.TTF
C:\Python27\tcl\tcl8.5\tzdata\America\Fortaleza
C:\Users\win7\AppData\Local\Temp\nst1E41.tmp\System.dll
C:\Python27\Lib\email\test\data\msg_35.txt
C:\Python27\tcl\tcl8.5\tzdata\Asia\Pontianak
C:\Windows\syswow64\WS2_32.dll
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\OSNLNBHU.txt
C:\localization\fr.pak.patch
C:\Windows\System32\drivers\gmreadme.txt
C:\Users\win7\AppData\Local\bitcoin\cudart32_32_16.dll
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT+10
C:\Python27\tcl\tcl8.5\tzdata\America\Cancun
C:\Users\win7\AppData\Roaming
C:\Python27\tcl\tcl8.5\tzdata\US\Pacific-New
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\828298824EA5549947C17DDABF6871F5_95A32724DDCFA58B11E92C028AD410A3
C:\Windows\syswow64\shlwapi.DLL
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_4D025354576A836AEDB98A250F5497E3
C:\Python27\tcl\tcl8.5\tzdata\Asia\Hebron
C:\WINDOWS\FONTS\SHRUTI.TTF
C:\Python27\tcl\tcl8.5\tzdata\Europe\Jersey
C:\Python27\tcl\tcl8.5\tzdata\Australia\Lord_Howe
C:\Python27\tcl\tcl8.5\tzdata\Australia\Tasmania
C:\Python27\tcl\tcl8.5\tzdata\GMT-0
C:\Users\win7\AppData\Local\Temp\tmp23B2.tmp
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\MsiIt
C:\Users\win7\AppData\Local\Temp\ReimageRepair.exe
C:\Users\win7\AppData\Local\Temp\Cab9D7C.tmp
C:\Users\win7\AppData\Local\Temp\tmp4C8D.tmp
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Providers\ManageConsolidatedProviders.aspx
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Fonts\segoeui.ttf
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\check.png
C:\Windows\syswow64\normaliz.DLL
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\81ETU8VM.txt
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\IWR0EC3Z.txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\error_icon[1]
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\bg.bmp
C:\WINDOWS\FONTS\SERIFE.FON
C:\Users\win7\AppData\Local\Temp\nsj20C1.tmp\WmiInspector.dll
C:\Python27\tcl\tcl8.5\tzdata\Europe\Paris
C:\Python27\tcl\tcl8.5\tzdata\Europe\Simferopol
C:\Users\win7\AppData\Local\Temp\tmp3C6D.tmp
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml
C:\Python27\tcl\tcl8.5\tzdata\Africa\Luanda
C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll
C:\WINDOWS\FONTS\APARAJI.TTF
C:\Windows\inf\compositebus.inf
C:\Users\win7\AppData\Local\Temp\AITMP601\setup.ini
C:\Users\win7\AppData\Local\Temp\is-V8JDK.tmp\_isetup\_RegDLL.tmp
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Command_Syntax.help.txt
C:\Users\win7\AppData\Local\bitcoin\bitcoinminercuda_20.cubin
CONOUT$
C:\Python27\Lib\email\test\data\msg_16.txt
C:\Users\win7\AppData\Local\Temp\IXP000.TMP\dsetup32.dll
C:\WINDOWS\FONTS\TIMESBD.TTF
c:\$Recycle.Bin\S-1-5-21-3979321414-2393373014-2172761192-1000\desktop.ini
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\win7@ssl.bing[2].txt
C:\WINDOWS\FONTS\MVBOLI.TTF
C:\WINDOWS\FONTS\CANDARAB.TTF
C:\Python27\tcl\tcl8.5\tzdata\Atlantic\St_Helena
C:\Python27\tcl\tcl8.5\tzdata\Europe\Kiev
c:\Program Files\Common Files\System\ado\msador28.tlb
C:\data\masterconfig.ini
C:\ProgramData\CoffeeCup Software\SharedSettings_1_0_5.ccs
c:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets
http://java.com/download
C:\ProgramData\SharedSettings.sqlite
c:\Program Files\Common Files\System\ado\adojavas.inc
C:\Users\win7\AppData\Local\Temp\SETUP_41436\WebBars.bmp
C:\Windows\System32\msxml3.dll
C:\Users\win7\AppData\Local\Temp\SETUP_41436\Russian.lng
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml
C:\Python27\Lib\test\cjkencodings\johab.txt
C:\Python27\tcl\tcl8.5\tzdata\Africa\Cairo
C:\Python27\tcl\tcl8.5\tzdata\GB
C:\Python27\Tools\pynche\html40colors.txt
c:\Program Files\Common Files\System\Ole DB\oledbvbs.inc
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
C:\localization\da.pak.patch
C:\Python27\tcl\tcl8.5\tzdata\America\Resolute
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\home1.aspx
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\data.xml
c:\Program Files\Common Files\System\Ole DB\sqloledb.rll
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\EmbedWeb.dll
c:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui
C:\WINDOWS\FONTS\UPCEL.TTF
c:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml
C:\WINDOWS\FONTS\LAOUIB.TTF
c:\Program Files\Common Files\System\ado\msado26.tlb
C:\Python27\tcl\tcl8.5\tzdata\Africa\Addis_Ababa
C:\Python27\tcl\tcl8.5\tzdata\HST
C:\Windows\DirectX.log
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT-9
C:\Users\win7\AppData\Local\FlashFXP\3\Quick.dat
C:\Users\win7\AppData\Local\Temp\nso3A98.tmp\nsq3ECF.tmp
C:\WINDOWS\FONTS\CORBELB.TTF
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\QRQ4ILAH.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\PNOL738O.txt
C:\WINDOWS\FONTS\UPCKL.TTF
C:\localization\te.pak.patch
C:\Python27\tcl\tcl8.5\tzdata\Europe\Prague
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\win7@bluekai[2].txt
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\.be\Avira.OE.Setup.Bundle.exe
C:\WINDOWS\FONTS\FRAMDIT.TTF
C:\Python27\tcl\tcl8.5\tzdata\Africa\Ouagadougou
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_98E4B7607AA4134EC093F1CD1619DB87
C:\Users\win7\AppData\Local\Temp\nsz2082.tmp
C:\Windows\SysWOW64\nsi.dll
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\624QKZBD.txt
C:\Users\win7\AppData\Local\CoffeeCup Software\SharedSettings.ccs
C:\Python27\tcl\tcl8.5\tzdata\Kwajalein
C:\Python27\tcl\tcl8.5\tzdata\US\Central
C:\Users\win7\AppData\Local\Temp\WERA3DA.tmp.WERInternalMetadata.xml
C:\WINDOWS\FONTS\MSYI.TTF
c:\Program Files\Common Files\System\Ole DB\oledbjvs.inc
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\VLT117EP.txt
C:\Python27\tcl\tcl8.5\tzdata\Africa\Bamako
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_escape_characters.help.txt
C:\WINDOWS\FONTS\ARIALI.TTF
C:\Users\win7\AppData\Local\Temp\nstD3DD.tmp\7za.exe
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Tarawa
C:\Users\win7\AppData\Local\Temp\nst1E41.tmp\nsExec.dll
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\F0446JSX.txt
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\140B4CDED8ED877CDC65B54BA965BD39
C:\Python27\tcl\tcl8.5\tzdata\Asia\Seoul
C:\WINDOWS\FONTS\ANDLSO.TTF
C:\Users\win7\AppData\Local\bitcoin\ssleay32.dll
C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\17542707A3D9FA13C569450FD978272EF7070A77
C:\Python27\tcl\tcl8.5\tzdata\Africa\Abidjan
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_functions_advanced_parameters.help.txt
C:\Python27\Lib\email\test\data\msg_40.txt
C:\Windows\inf\volume.inf
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\NCTOZBI5.txt
data.bin
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml
C:\Windows\system32\directx\websetup\SETA396.tmp
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\2GS7K03H.txt
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Kwajalein
C:\Users\win7\AppData\Local\Temp\tmp4E26.tmp
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\C4D46XLC.txt
C:\WINDOWS\FONTS\SIMHEI.TTF
C:\WINDOWS\FONTS\TAHOMA.TTF
C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm
C:\Python27\tcl\tcl8.5\tzdata\Canada\East-Saskatchewan
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\amipb[1].js
c:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml
C:\Python27\tcl\tcl8.5\tzdata\Asia\Bishkek
C:\Users\win7\AppData\Local\Temp\bars_soft.split.bin
C:\Users\win7\AppData\Local\Temp\nss29BA.tmp\g\gcapi_dll.dll
C:\Python27\tcl\tcl8.5\tzdata\GB-Eire
C:\Users\win7\AppData\Local\Temp\nsj20C1.tmp\UserInfo.dll
C:\Python27\tcl\tcl8.5\tzdata\SystemV\CST6
C:\Users\win7\AppData\Local\Temp\nsa73EB.tmp\Banner.dll
C:\Python27\tcl\tcl8.5\tzdata\Europe\Kaliningrad
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Core_Commands.help.txt
C:\Python27\Tools\Scripts\README.txt
C:\Program Files\Reimage\Reimage Repair\REI_Engine.lza
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7396C420A8E1BC1DA97F1AF0D10BAD21
C:\ProgramData\FlashFXP\3\History.dat
C:\Python27\tcl\tcl8.5\tzdata\Asia\Bangkok
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\DefineErrorPage.aspx
C:\localization\sw.pak.patch
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Johnston
C:\Users\win7\AppData\Local\Temp\dfs91B6.tmp
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\editUser.aspx
C:\Python27\Lib\test\leakers\README.txt
C:\Users\win7\AppData\Local\Temp\{aba88724-37eb-4f03-b83b-45199c5a7cf5}\.ba1\mbapreq.png
C:\Program Files\AppPatch\NetSyst76.dll
C:\Python27\LICENSE.txt
C:\WINDOWS\FONTS\LATHA.TTF
C:\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Entries\{830143B2-F526-C024-EA03-13DCD07868F4}
C:\Python27\tcl\tcl8.5\tzdata\Europe\Istanbul
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\9PFQBAFQ.txt
C:\Users\win7\AppData\Local\Temp\tmp234E.tmp
C:\Python27\tcl\tcl8.5\tzdata\Europe\Riga
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe
C:\Users\win7\AppData\Local\Temp\tmp2424.tmp
C:\WINDOWS\FONTS\SIMPFXO.TTF
C:\Python27\Lib\test\ieee754.txt
C:\Python27\tcl\tcl8.5\tzdata\America\Indiana\Tell_City
c:\Program Files\Common Files\System\ado\msado60.tlb
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\BB9QPQVA.txt
C:\Python27\tcl\tcl8.5\tzdata\America\Barbados
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB788E090BC1F3AA2FBC9E8FB2859601
C:\Python27\tcl\tcl8.5\tzdata\Africa\Kigali
C:\Python27\Lib\test\cjkencodings\big5.txt
C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\1A141DBFA4083406630DD9A81AD35C416F604800
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Users\win7\AppData\Local\CoffeeCup Software\SharedSettings_1_0_5.sqlite
C:\Python27\tcl\tcl8.5\tzdata\Chile\Continental
C:\Python27\tcl\tcl8.5\tzdata\America\Argentina\ComodRivadavia
C:\Users\win7\AppData\Local\Temp\tmp2434.tmp
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\settings.html
C:\Python27\Lib\email\test\data\msg_32.txt
C:\Python27\Lib\email\test\data\msg_38.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\CTUIWTT6.txt
C:\Users\win7\AppData\Local\Temp\SETUP_41436\
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\Banner.dll
__tmp_rar_sfx_access_check_509593
C:\WINDOWS\FONTS\ISKPOTAB.TTF
c:\Program Files\Oracle\VirtualBox Guest Additions\VBoxGuest.inf
logs\2015_09_20__15_56_09__WIN7-PC_state.snp
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\2IW56DSD.txt
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Guadalcanal
c:\Program Files\Oracle\VirtualBox Guest Additions\VBoxGuest.cat
C:\Python27\tcl\tcl8.5\tzdata\America\Recife
C:\Users\win7\AppData\Local\bitcoin\msvcr80.dll
C:\Users\win7\AppData\Local\Temp\craurol
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\OCCD4T1I.txt
c:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui
C:\WINDOWS\FONTS\UTSAAHBI.TTF
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\resume[1]
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\extreme[1].htm
C:\Users\win7\AppData\Local\Temp\nss29BA.tmp\UserInfo.dll
C:\Python27\tcl\tcl8.5\tzdata\Brazil\DeNoronha
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\translations\1046.lang
\??\C:\Windows\system32\NetworkExplorer.dll
C:\Python27\tcl\tcl8.5\tzdata\Asia\Macao
C:\Python27\tcl\tcl8.5\tzdata\America\Argentina\Rio_Gallegos
C:\Python27\tcl\tcl8.5\tzdata\SystemV\YST9
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT-8
c:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm
c:\Program Files\Oracle\VirtualBox Guest Additions\VBoxMouse.sys
C:\Python27\tcl\tcl8.5\tzdata\Europe\Tirane
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml
c:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml
C:\Users\win7\AppData\Local\Temp\nss29BA.tmp\g\gcombo\ChromeLogo.bmp
C:\Python27\tcl\tcl8.5\tzdata\America\Anchorage
C:\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Entries\{E01AD230-00F2-4114-DB75-9C788D7FF24E}
C:\Python27\tcl\tcl8.5\tclIndex
C:\Users\win7\AppData\Local\Temp\nso3A98.tmp\Banner.dll
C:\Python27\tcl\tcl8.5\tzdata\America\Argentina\Buenos_Aires
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Windows_PowerShell_ISE.help.txt
C:\theme\default--en\masterconfig.ini
c:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\finish[1].gif
C:\Python27\Lib\email\test\data\msg_43.txt
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml
C:\Python27\tcl\tcl8.5\tzdata\Asia\Tel_Aviv
C:\Python27\Lib\test\sgml_input.html
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759AD
C:\Users\win7\AppData\Local\FileZilla\sitemanager.xml
C:\Windows\Fonts\staticcache.dat
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml
C:\Users\win7\AppData\Local\Temp\nsj20C1.tmp\flush-inetc.dll
c:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\QLAWXJYQ.txt
\\?\C:\Users\Default\AppData\Local\Vcreditx86\platforms\qwindows.dll
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAEBE581FCB73249406FC21094EA252E_BC0CE803EF41A748738619ED7838EEFC
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\ETGQBXWO.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\10ASNT0V.txt
C:\Users\win7\AppData\Roaming\GlobalSCAPE\CuteFTP\sm.dat
C:\Python27\tcl\tcl8.5\tzdata\Asia\Beirut
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\0VXTW8FR.txt
C:\WINDOWS\TERMS.EXE
C:\Users\win7\AppData\Local\Microsoft\Windows Mail\Stationery\Shades of Blue.htm
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\714CLA5I.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3RXTZ7GJRTYSEPBHB49E.temp
C:\Users\win7\AppData\Local\FileZilla\recentservers.xml
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT
C:\WINDOWS\FONTS\GEORGIAI.TTF
C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\settings.html
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\5K4MMSXP.txt
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml
C:\Python27\tcl\tcl8.5\tzdata\Africa\Casablanca
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\1B74QM04.txt
C:\Python27\Lib\site-packages\setuptools-16.0.dist-info\top_level.txt
C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\disk.cat
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_pipelines.help.txt
C:\Python27\Lib\email\test\data\msg_08.txt
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\MsiTr
C:\Python27\tcl\tcl8.5\tzdata\Indian\Christmas
C:\Python27\Lib\site-packages\setuptools-16.0.dist-info\WHEEL
c:\Program Files\Common Files\System\ado\msadox28.tlb
C:\Python27\tcl\tcl8.5\tzdata\America\Indiana\Vincennes
C:\Users\win7\AppData\Local\Temp\AITMP601\file.cab
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Controls.GridView.dll
C:\Python27\tcl\tcl8.5\tzdata\America\Cayenne
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\FCQ3UFDK.txt
C:\Users\win7\AppData\Roaming\ExpanDrive\drives.js
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\createPermission.aspx
C:\Users\win7\AppData
c:\monkey.py
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\dm_left_image[1].png
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Microsoft.ReportViewer.WinForms.dll
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\5H339KJG.txt
C:\Python27\tcl\tcl8.5\tzdata\Brazil\Acre
C:\Users\win7\AppData\Local\Temp\nsa73EB.tmp\WmiInspector.dll
c:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui
C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm
C:\Users\win7\AppData\Local\Temp\WERC83A.tmp.WERInternalMetadata.xml
C:\WINDOWS\FONTS\ARIALBD.TTF
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\6RJHR8F6.txt
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\translations\1025.lang
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Honolulu
C:\Windows\system32\version.DLL
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\7za.dll
C:\Users\win7\AppData\Local\GlobalSCAPE\CuteFTP\sm.dat
C:\WINDOWS\FONTS\MOOLBOR.TTF
C:\Windows\system32\wbem\XSL-Mappings.xml
C:\Python27\tcl\tcl8.5\tzdata\America\Miquelon
C:\localization\cs.pak.patch
c:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets
C:\Python27\tcl\tcl8.5\tzdata\Portugal
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_pssessions.help.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\V90UXX9G.txt
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\378B079587A9184B2E2AB859CB263F40_2B618FC6CF84AEF3C14E129161BF18D9
C:\Python27\tcl\tcl8.5\tzdata\US\Indiana-Starke
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT-7
C:\ProgramData\FlashFXP\3\Quick.dat
C:\Users\win7\AppData\Roaming\FlashFXP\4\Quick.dat
C:\Windows\system32\en-US\erofflps.txt
C:\Python27\tcl\tcl8.5\tzdata\Atlantic\Jan_Mayen
C:\WINDOWS\FONTS\VANI.TTF
c:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\MsiRu
C:\Windows\system32\directx\websetup\dsetup.dll
C:\Users\win7\AppData\Local\Temp\nsc8A4A.tmp\InstallType.ini
C:\Python27\tcl\tcl8.5\tzdata\Asia\Bahrain
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9A19ADAD9D098E039450ABBEDD5616EB_80816F00CAFD308FC47918F3B0796D11
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\System.Windows.Interactivity.dll
C:\Users\win7\AppData\Local\Temp\nss29BA.tmp\modern-wizard.bmp
C:\Python27\tcl\tix8.4.3\pref\WmDefault.txt
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Niue
C:\Windows\Logs\DXError.log
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\FYP0LUA8.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\TK81TXN7.txt
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9A19ADAD9D098E039450ABBEDD5616EB_80816F00CAFD308FC47918F3B0796D11
C:\WINDOWS\FONTS\MEIRYOB.TTC
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_do.help.txt
C:\WINDOWS\FONTS\TIMES.TTF
C:\Python27\tcl\tcl8.5\tzdata\Asia\Hovd
C:\Python27\tcl\tcl8.5\tzdata\Poland
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\POVIU1LJ.txt
C:\mojo_test_support.dll
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\vboxxharddisk_vba99b5653-18fe4867[1].htm
C:\localization\lv.pak.patch
C:\Python27\tcl\tcl8.5\tzdata\Asia\Almaty
C:\Program Files\Reimage\Reimage Repair\version.rei
C:\Python27\Lib\email\test\data\msg_10.txt
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml
C:\Python27\tcl\tcl8.5\tzdata\Australia\West
C:\Users\win7\AppData\Local\Temp\WER61E6.tmp.mdmp
C:\Python27\tcl\tcl8.5\tzdata\Australia\Broken_Hill
C:\Python27\tcl\tcl8.5\tzdata\America\Vancouver
C:\Python27\tcl\tcl8.5\tzdata\America\Rosario
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\translations\1043.lang
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_scripts.help.txt
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT-3
C:\Python27\tcl\tcl8.5\tzdata\Africa\Tunis
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Windows_PowerShell_2.0.help.txt
C:\Users\win7\AppData\Local\Temp\nst7984.tmp
C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\netrasa.cat
C:\rei\AV\savapi3_restart.exe
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6AA3321A15A787985201D7A6820782F0_4E35DE6F4FCFB7BE2C045F6B5ED89FC8
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\7GDDKCDH.txt
C:\WINDOWS\FONTS\SEGOEUIZ.TTF
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml
C:\Python27\tcl\tcl8.5\tzdata\Asia\Calcutta
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\Button.dll
C:\Users\win7\AppData\Local\Temp\RBX-1D26ABDC.tmp
C:\Users\win7\AppData\Local\Temp\WER42C1.tmp.mdmp
C:\Users\win7\wcx_ftp.ini
C:\Users\Public\desktop.ini
C:\localization\zu.pak.patch
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml
c:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Parsing.help.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\ZVFGM2P6.txt
C:\Python27\tcl\tcl8.5\tzdata\America\Thunder_Bay
C:\Python27\tcl\tcl8.5\tzdata\Europe\Zagreb
C:\Users\win7\AppData\Local\Temp\\cmdinstall.exe_15-09-19_08.23.45.log
C:\ProgramData\SharedSettings_1_0_5.ccs
C:\WINDOWS\FONTS\VERDANAB.TTF
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\XBEAQONA.txt
C:\Python27\tcl\tcl8.5\tzdata\Asia\Aden
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\W38XA0E9.txt
C:\Python27\tcl\tcl8.5\tzdata\Australia\Victoria
C:\WINDOWS\FONTS\BROWAUZ.TTF
C:\localization\en-US.pak.patch
C:\WINDOWS\FONTS\TIMESI.TTF
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\7ZB3P1W0.txt
C:\WINDOWS\FONTS\TREBUCBD.TTF
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0972B7C417F696E06E186AEB26286F01_5FE673895F793154E229BED7BA1C1A2B
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\2VTJOSVY.txt
C:\Windows\SoftwareDistribution\Download\14d19c27b28cc3990260d7191f6e0ff6c7483623
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\AppConfigHome.aspx
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_methods.help.txt
C:\Users\win7\AppData\Local\Temp\dfsCDFD.tmp
C:\Python27\tcl\tcl8.5\tzdata\Asia\Muscat
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3D0AC26322348780E90E022EA217C58C
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\R8CLYK1Z.txt
C:\Users\win7\AppData\Local\Temp\nsy3A77.tmp
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_script_internationalization.help.txt
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\weather.html
C:\Python27\Lib\email\test\data\msg_21.txt
tools\SDI\themes
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Wake
C:\Users\win7\AppData\Local\Temp\SETUP_41436\Engine.exe
C:\message_center_win8.dll.asm_patch
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_1E5D470765E0BE1964814B1F5A3581DC
C:\WINDOWS\FONTS\MSYHBD.TTF
C:\Python27\Lib\email\test\data\msg_13.txt
C:\localization\ro.pak.patch
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7396C420A8E1BC1DA97F1AF0D10BAD21
C:\Users\win7\AppData\Local\Temp\{aba88724-37eb-4f03-b83b-45199c5a7cf5}\.ba1\mbapreq.dll
C:\Python27\tcl\tcl8.5\tzdata\Arctic\Longyearbyen
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\0PFOP4AF.txt
C:\localization\ja.pak.patch
C:\Python27\tcl\tcl8.5\tzdata\America\Port_of_Spain
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\YRTD83RG.txt
C:\Program Files\Reimage\Reimage Repair\Reimageicon.ico
c:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\1FZXP1DG.txt
C:\Users\win7\AppData\Local\Temp\nss29BA.tmp\System.dll
C:\Python27\tcl\tcl8.5\tzdata\America\Indiana\Marengo
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\skip[1].gif
C:\Python27\tcl\tcl8.5\tzdata\Asia\Istanbul
C:\Python27\tcl\tcl8.5\tzdata\America\Asuncion
c:\Program Files\Common Files\System\ado\msado25.tlb
C:\tmp.exe
C:\ProgramData\Comodo\Cis\regbackup\product.dat
C:\Windows\system32\ex.exe
C:\Python27\tcl\tcl8.5\tzdata\Australia\Darwin
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_modules.help.txt
c:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\installer_langdata.bin
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\main[1].css
C:\Python27\tcl\tcl8.5\tzdata\MST7MDT
C:\Python27\tcl\tcl8.5\tzdata\Africa\Mogadishu
C:\Python27\tcl\tcl8.5\tzdata\Africa\Johannesburg
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\win7@c1.microsoft[2].txt
C:\Python27\Lib\test\cjkencodings\euc_jisx0213-utf8.txt
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\translations\1040.lang
C:\Users\win7\AppData\Local\Temp\nsc8A4A.tmp\ioSpecial.ini
C:\Windows\inf\keyboard.inf
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\X0F62QL0.txt
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\.ba1\it\thm.wxl
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619
C:\Users\win7\AppData\Local\Temp\\~DFF9C1F6F75CF55C24.TMP
C:\Users\win7\AppData\Local\Temp\\~DF07F777DA30D9BC97.TMP
C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\settings.html
C:\Users\win7\AppData\Local\Temp\nss29BA.tmp
c:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui
C:\ProgramData\GlobalSCAPE\CuteFTP Pro\sm.dat
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\win7@bs.serving-sys[1].txt
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Controls.Navigation.dll
C:\Python27\tcl\tk8.5\images\README
C:\Users\Default\AppData\Local\Vcreditx86\vc.exe
c:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui
C:\Python27\tcl\tcl8.5\tzdata\Asia\Saigon
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\KUOP0KFP.txt
C:\Python27\tcl\tcl8.5\tzdata\America\Los_Angeles
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\C3CQSGPO.txt
C:\Python27\tcl\tcl8.5\tzdata\America\Montserrat
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\1E8F2POD.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\Q6FW2WMK.txt
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1DAF2884EC4DFA96BA4A58D4DBC9C406
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B912B2C6928A18B8CD7D50CF08BEA95B_10F92F379FD782720F9335B450E2C644
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Microsoft.ReportViewer.DataVisualization.dll
C:\Users\Default User
C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\picturePuzzle.html
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\K8EHS4I6.txt
C:\Users\win7\AppData\Local\Temp\09152028-00000938-144e43q4vi\tmp2822.tmp
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Apia
c:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\GWXFZMZY.txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\finish[1].gif
C:\sample.EXE
C:\Python27\tcl\tcl8.5\tzdata\America\Glace_Bay
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\translations\1028.lang
C:\Python27\tcl\tcl8.5\tzdata\America\Argentina\La_Rioja
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\sndsock.dll
C:\Python27\tcl\tcl8.5\tzdata\America\Montreal
c:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tipresx.dll.mui
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\GFR5MKMI.txt
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\.ba1\thm.xml
C:\WINDOWS\FONTS\MODERN.FON
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\NSISdl.dll
C:\Python27\Lib\email\test\data\msg_45.txt
sdi.cfg
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\EUP3OJVQ.txt
cudart32_60.dll
C:\Python27\Lib\email\test\data\msg_24.txt
C:\Python27\tcl\tcl8.5\tzdata\Canada\Eastern
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\28YAT5EW.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\5NXZCUKH.txt
c:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\.ba1\logo.png
C:\Python27\tcl\tcl8.5\tzdata\PST8PDT
C:\data\default-en\masterconfig.ini
C:\Python27\tcl\tcl8.5\tzdata\America\Indianapolis
C:\Users\win7\AppData\Roaming\Microsoft\Protect\S-1-5-21-3979321414-2393373014-2172761192-1000\9298ce2a-0ad7-4414-870d-86acd6d1cda3
C:\Windows\inf\hdaudbus.inf
C:\Python27\tcl\tcl8.5\tzdata\Australia\Perth
C:\Python27\tcl\tcl8.5\tzdata\America\Nipigon
C:\Python27\tcl\tcl8.5\tzdata\America\Nome
C:\Python27\tcl\tcl8.5\tzdata\Europe\Vilnius
c:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml
C:\Python27\tcl\tcl8.5\tzdata\Europe\London
C:\Users\win7\AppData\Local\Temp\nsdD3CC.tmp
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\SmtpSettings.aspx
c:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml
C:\Python27\tcl\tcl8.5\tzdata\Africa\Conakry
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E4F76C0C82655FD6506668127FA0ACD1_A6D48D4EDEA7C273F5F17961856573CE
C:\WINDOWS\FONTS\SCRIPT.FON
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\4VIBJTL9.txt
C:\Python27\tcl\tcl8.5\tzdata\Europe\Bucharest
C:\Users\win7\AppData\Local\bitcoin\bitcoinminercuda_10.cubin
c:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm
C:\Windows\System32\catroot2\dberr.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\LDMGX5WR.txt
C:\Windows\Logs\DirectX.log
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\error_icon[1]
C:\Python27\tcl\tcl8.5\tzdata\Europe\Tiraspol
C:\data\theme-en\masterconfig.ini
C:\Python27\tcl\tcl8.5\tzdata\America\Dominica
C:\Windows\inf\netavpna.inf
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Signing.help.txt
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_jobs.help.txt
C:\Users\win7\AppData\Local\Temp\tmp2631.tmp
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\CH8RFXGD.txt
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT-6
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_providers.help.txt
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_If.help.txt
C:\WINDOWS\FONTS\COURBD.TTF
C:\Python27\tcl\tcl8.5\tzdata\Europe\Belgrade
C:\Users\win7\AppData\Local\Temp\nsc8A4A.tmp\KmdUtil.exe
C:\opera.dll.asm_patch
C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\msmouse.cat
C:\Users\win7\AppData\Local\Temp\oqmofjt
C:\Windows\Speech\Engines\SR\en-US\l1033.phn
C:\Python27\tcl\tcl8.5\tzdata\America\Argentina\Ushuaia
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_WMI_Cmdlets.help.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\8K0HOAP4.txt
c:\Program Files\Common Files\System\msadc\en-US\msadcfr.dll.mui
c:\Program Files\Common Files\System\ado\msadomd28.tlb
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7396C420A8E1BC1DA97F1AF0D10BAD21
C:\Users\win7\AppData\Local\Temp\downloader log.txt
c:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui
C:\WINDOWS\FONTS\ISKPOTA.TTF
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\data.txt
C:\Users\win7\AppData\Local\Temp\49A7.tmp
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\IOYJYIJH.txt
C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\954D59EAEADC36CB19A224A5DDDFA1EDCFDC49CE
c:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml
C:\Users\win7\AppData\Local\Temp\tmp234F.tmp
C:\Python27\Lib\email\test\data\msg_05.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\win7@youtube[2].txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\W6KPGYXJ.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\E917R8SO.txt
c:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat
C:\Users\win7\AppData\Local\Temp\tmp25C1.tmp
C:\Python27\tcl\tcl8.5\tzdata\America\Santa_Isabel
C:\Windows\syswow64\ole32.DLL
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini
C:\Users\win7\AppData\Local\Temp\trfmvinh.0.cs
C:\KMSAutoLite.ini
C:\Python27\Lib\test\cjkencodings\shift_jisx0213-utf8.txt
C:\Windows\syswow64\ADVAPI32.dll
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_scopes.help.txt
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT-11
C:\Python27\tcl\tcl8.5\tzdata\America\Sao_Paulo
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F
C:\Python27\tcl\tcl8.5\tzdata\America\El_Salvador
C:\Python27\tcl\tcl8.5\tzdata\Europe\Isle_of_Man
C:\Users\win7\AppData\Local\Temp\nsd29AA.tmp
C:\WINDOWS\FONTS\FRAMD.TTF
C:\Users\win7\AppData\Local\Temp\nsa18D7.tmp
C:\Python27\tcl\tcl8.5\tzdata\Europe\Busingen
C:\WINDOWS\FONTS\BROWAUB.TTF
C:\opera_crashreporter.exe.asm_patch
C:\ProgramData\FlashFXP\3\Sites.dat
C:\Users\win7\AppData\Local\Temp\nsx74CC.tmp\nsExec.dll
C:\Program Files\Windows NT\TableTextService\TableTextServiceYi.txt
C:\Python27\tcl\tcl8.5\tzdata\Libya
C:\Python27\tcl\tcl8.5\tzdata\SystemV\AST4
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\6OIB528H.txt
C:\WINDOWS\FONTS\SIMSUNB.TTF
C:\Windows\hh.exe
c:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui
C:\Python27\tcl\tcl8.5\tzdata\UCT
C:\sample.log
C:\Python27\tcl\tcl8.5\tzdata\Asia\Jayapura
C:\Windows\inf\msports.inf
c:\Users\win7\AppData\Local\Temp\trfmvinh.dll
c:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui
C:\Python27\tcl\tk8.5\demos\rolodex
c:\Program Files\Internet Explorer\en-US\jsdbgui.dll.mui
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT-10
C:\Python27\tcl\tcl8.5\tzdata\Europe\Oslo
C:\rei\AV\savapi3_start.exe
c:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui
C:\Users\win7\AppData\Local\Microsoft\Windows
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\translations\1045.lang
C:\WINDOWS\FONTS\UPCKI.TTF
C:\Program Files\Reimage\Reimage Repair\REI_AVIRA.exe
C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\msports.cat
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\YY3K4XVC.txt
C:\Users\win7\AppData\Local\bitcoin\msvcr90.dll
c:\Program Files\Oracle\VirtualBox Guest Additions\VBoxVideo.cat
C:\Users\win7\AppData\Local\Temp\nspE41A.tmp\System.dll
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D
C:\Python27\tcl\tcl8.5\tzdata\America\Dawson
C:\Users\win7\AppData\Local\Temp\HWID
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82414F9D7AB8999991FFEB2BC378A4EB_376643DBA507E2F631E33255C6BD3D64
C:\Python27\tcl\tcl8.5\tzdata\Africa\Blantyre
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\ACL35KU9.txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\vboxxharddisk_vba99b5653-18fe4867[2].htm
C:\Users\win7\AppData\Roaming\CoffeeCup Software\SharedSettings_1_0_5.ccs
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Application.aspx
C:\ProgramData\Microsoft\Windows
C:\WINDOWS\FONTS\SEGOEUIL.TTF
C:\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\17542707A3D9FA13C569450FD978272EF7070A77
vcreditx86.exe
C:\Python27\tcl\tcl8.5\tzdata\America\Araguaina
C:\Users\win7\Desktop\Continue installation .lnk
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_operators.help.txt
c:\Users\win7\AppData\Local\Temp\CSC4BBE.tmp
C:\Users\win7\AppData\Local\FluxSoftware\Flux\runtime\Calibri-36-700-0.ytf
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\inetc.dll
C:\Python27\Lib\lib2to3\Grammar.txt
C:\Python27\tcl\tcl8.5\tzdata\America\Atka
c:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui
C:\Users\win7\AppData\Local\Temp\tmp2621.tmp
C:\Users\win7\AppData\Local\bitcoin\curllib.dll
C:\Users\win7\AppData\Local\bitcoin\openldap.dll
C:\WINDOWS\FONTS\SMALLE.FON
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\1XXCZN0S.txt
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\error.aspx
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Documents.Fixed.dll
C:\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Entries\{4BF2B463-7479-3DAE-72F0-FB54116DE50F}
c:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\2BILA876.txt
C:\ProgramData\ClassicShellSetup64_4_2_4.msi
c:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui
C:\Users\win7\AppData\Roaming\FlashFXP\3\History.dat
C:\WINDOWS\FONTS\SEGOEPR.TTF
C:\Users\win7\AppData\Local\FlashFXP\4\Quick.dat
C:\WINDOWS\FONTS\CALIBRIB.TTF
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Palau
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
C:\Python27\tcl\tcl8.5\tzdata\America\Argentina\Cordoba
C:\ProgramData\Package Cache\{315dd168-0794-4cf1-8355-f195cde642fc}\state.rsm
C:\WINDOWS\FONTS\CORDIAUZ.TTF
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\V3BXSV5S.txt
C:\Python27\Lib\test\test_doctest.txt
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\MsiEN
C:\Python27\tcl\tcl8.5\tzdata\Asia\Kabul
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\WADDJ4K1.txt
c:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui
C:\Python27\README.txt
C:\Users\win7\AppData\Local\FlashFXP\3\Sites.dat
C:\Python27\tcl\tcl8.5\tzdata\Africa\Lubumbashi
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Pohnpei
C:\Users\win7\AppData\Local\bitcoin\OpenCL.dll
C:\Users\win7\AppData\Local\Temp\AITMP601\English.lng
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT+3
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\1LXGGZDF.txt
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_1E5D470765E0BE1964814B1F5A3581DC
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\SaveFromNet-Helper-Setup[1].exe
C:\Python27\tcl\tcl8.5\tzdata\Zulu
C:\Python27\tcl\tcl8.5\tzdata\Asia\Kuching
C:\Python27\tcl\tcl8.5\tzdata\Australia\Currie
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\PT4WCT08.txt
C:\Python27\tcl\tcl8.5\tzdata\Australia\Canberra
c:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui
C:\Python27\tcl\tcl8.5\tzdata\Europe\Chisinau
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\XIF3SFUV.txt
C:\Python27\Lib\lib2to3\PatternGrammar.txt
C:\Users\win7\AppData\Local\Temp\trfmvinh.cmdline
C:\Python27\tcl\tcl8.5\tzdata\Etc\Zulu
C:\Users\win7\AppData\Local\Temp\ztmp
C:\WINDOWS\FONTS\VERDANAI.TTF
c:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui
C:\Python27\tcl\tcl8.5\tzdata\America\Louisville
C:\Python27\tcl\tcl8.5\tzdata\America\Santo_Domingo
C:\Python27\tcl\tcl8.5\tzdata\Europe\Copenhagen
C:\Users\win7\Desktop\ROBLOX Studio 2.0.lnk
C:\Program Files\Reimage\Reimage Repair\ReimageSafeMode.exe
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Efate
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\main[1].css
c:\Program Files\Internet Explorer\SIGNUP\install.ins
C:\localization\pa.pak.patch
C:\Windows\inf\disk.inf
C:\WINDOWS\FONTS\LVNM.TTF
C:\Users\win7\AppData\Local\Temp\SETUP_41436\00001#webbars.exe
c:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui
C:\Users\win7\AppData\Roaming\CoffeeCup Software\SharedSettings.ccs
C:\Python27\Tools\pynche\README.txt
C:\Python27\Lib\test\formatfloat_testcases.txt
C:\Python27\Lib\test\cjkencodings\euc_jisx0213.txt
C:\Python27\tcl\tcl8.5\tzdata\Africa\Brazzaville
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\finish[1].gif
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\OUYSP0CJ.txt
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\GetEvent.types.ps1xml
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml
C:\WINDOWS\FONTS\SYMBOL.TTF
C:\Python27\tcl\tcl8.5\tzdata\America\St_Kitts
C:\Windows\inf\usbport.inf
c:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui
C:\localization\hr.pak.patch
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\VZWYZ1AJ.txt
C:\Python27\tcl\tcl8.5\tzdata\Eire
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\JD9VRF2T.txt
C:\Python27\tcl\tcl8.5\tzdata\Atlantic\Azores
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Yap
C:\WINDOWS\FONTS\CORDIA.TTF
C:\Users\win7\Searches\desktop.ini
C:\Users\win7\AppData\Local\bitcoin\rpcminer-4way.exe
C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\887FDFEF9DC62EF73EB288690D5944B1_69D8D47AB1AD575C0CF624C7D137AD1B
c:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm
C:\Users\win7\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.htm
C:\Python27\tcl\tcl8.5\tzdata\Africa\Dakar
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\Id.Avira.OE.Setup.Msi
C:\Python27\tcl\tcl8.5\tzdata\Asia\Baghdad
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\T75M8QLR.txt
C:\Python27\tcl\tcl8.5\tzdata\America\Indiana\Petersburg
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reimage Repair\Reimage Repair.lnk
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\L7WHNAM9.htm
C:\Python27\tcl\tcl8.5\tzdata\Asia\Gaza
C:\Users\win7\AppData\Local\Temp\nsa73EB.tmp\LogEx.dll
c:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf
C:\Python27\tcl\tcl8.5\tzdata\America\Campo_Grande
C:\Python27\tcl\tcl8.5\tzdata\ROK
c:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_requires.help.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\4VZPHFI8.txt
C:\WINDOWS\FONTS\CONSTANB.TTF
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Funafuti
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\03NIXB8K.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\DWM6Q5RR.txt
C:\Users\win7\AppData\Local\Temp\{aba88724-37eb-4f03-b83b-45199c5a7cf5}\.ba1\Microsoft.Bootstrapper.dll
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Samoa
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\AIKUJW7D.txt
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT+0
C:\Python27\tcl\tcl8.5\tzdata\Africa\Sao_Tome
C:\Python27\Tools\pynche\X\xlicense.txt
C:\Windows\system32\MSHTML.tlb
C:\Python27\tcl\tcl8.5\tzdata\Mexico\BajaNorte
C:\Python27\Lib\email\test\data\msg_01.txt
vccorlib110.dll
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_data_sections.help.txt
C:\WINDOWS\FONTS\LUCON.TTF
C:\Python27\tcl\tcl8.5\tzdata\America\Costa_Rica
C:\Users\win7\AppData\Local\FluxSoftware
C:\WINDOWS\FONTS\PALAB.TTF
C:\Python27\tcl\tcl8.5\tzdata\Australia\South
C:\Python27\tcl\tcl8.5\tzdata\Indian\Cocos
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\PBD55XI0.txt
C:\Python27\Lib\email\test\data\msg_07.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\2TT3K5SQ.txt
C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\J6ONWTAK.txt
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B9BC83D408105DBA1B3E3814C9C8FB9F
C:\WINDOWS\FONTS\SEGUISYM.TTF
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\A4HQ5LQT.txt
C:\WINDOWS\FONTS\BROWAI.TTF
C:\Users\win7\AppData\Roaming\CoffeeCup Software\SharedSettings_1_0_5.sqlite
C:\Python27\tcl\tcl8.5\tzdata\Africa\Ndjamena
c:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui
C:\WINDOWS\FONTS\ESTRE.TTF
C:\Python27\tcl\tcl8.5\tzdata\America\Tijuana
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\MsiDE
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\data.txt
c:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_eventlogs.help.txt
C:\Windows\System32\imm32.dll
C:\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\17542707A3D9FA13C569450FD978272EF7070A77
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\home0.aspx
C:\Python27\tcl\tcl8.5\tzdata\Africa\Lagos
c:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf
C:\Windows\system32\wbem\wbemdisp.TLB
C:\Users\win7\Music\desktop.ini
C:\Python27\tcl\tcl8.5\tzdata\Africa\Asmera
C:\Users\win7\AppData\Local\Temp\lugjkou
C:\Users\win7\AppData\Local\Microsoft\Windows Mail\Stationery\Orange Circles.htm
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\6M3PU2AI.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\5VUUJVMJ.txt
C:\Windows\System32\dnsapi.dll
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml
Server.exe
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\NSISdl.dll
C:\Python27\Lib\email\test\data\msg_26.txt
C:\Python27\tcl\tcl8.5\tzdata\America\Adak
C:\WINDOWS\FONTS\SYLFAEN.TTF
C:\Python27\tcl\tcl8.5\tzdata\Europe\Guernsey
c:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm
C:\Python27\tcl\tcl8.5\tzdata\Africa\Kampala
C:\Python27\tcl\tcl8.5\tzdata\America\Indiana\Vevay
C:\Program Files\Reimage\Reimage Repair\REI_AxControl.inf
C:\Python27\tcl\tcl8.5\tzdata\America\North_Dakota\Center
C:\Python27\tcl\tcl8.5\tzdata\Europe\San_Marino
C:\Python27\tcl\tcl8.5\tzdata\Indian\Chagos
C:\Users\win7\AppData\Roaming\FlashFXP\4\Sites.dat
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_parameters.help.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\WEIYBMFK.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\87Q8Q04Q.txt
C:\Users\win7\AppData\Local\Temp\aut40D8.tmp
C:\Windows\System32\msxml3.dll\1
C:\Users\win7\AppData\Local\Temp\jivibgo
C:\Users\win7\AppData\Local\Temp\SETUP_41436\Modern_Setup.bmp
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\0CWWQI59.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\OC59BMU2.txt
C:\WINDOWS\FONTS\ARIALBI.TTF
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\DAXRIGLW.txt
C:\Python27\Lib\site-packages\README.txt
C:\Python27\tcl\tcl8.5\tzdata\Canada\Mountain
C:\Users\win7\AppData\Local\Temp\nsc8A4A.tmp\SbieMsg.dll
C:\Windows\SysWOW64\msctf.dll
C:\Python27\Lib\idlelib\CREDITS.txt
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_CommonParameters.help.txt
C:\Python27\tcl\tcl8.5\tzdata\Asia\Ulaanbaatar
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D84E548583BE1EE7DB5A935821009D26_5B98B6CD6E69202676965CF5B0E2A7A7
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\6FX9W22Z.txt
C:\Python27\tcl\tcl8.5\tzdata\America\Argentina\San_Juan
C:\Python27\Tools\versioncheck\README.txt
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\.ba1\tr\thm.wxl
C:\Users\win7\Contacts\desktop.ini
C:\Python27\tcl\tcl8.5\tzdata\Europe\Zaporozhye
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\MsiZhCn
C:\WINDOWS\FONTS\TREBUCIT.TTF
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\QF0B2H9C.txt
C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\dm_bar_up[1]
C:\WINDOWS\FONTS\SSERIFE.FON
c:\sample
C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\netsstpa.cat
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\setUpAuthentication.aspx
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT-12
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\3PBHOHC1.txt
C:\Windows\System32\uxtheme.dll
c:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui
C:\Windows\SysWOW64\shell32.dll
C:\localization\zh-CN.pak.patch
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT-13
C:\Users\win7\AppData\Local\Temp\c72ace89-5c96-47bf-92a3-9cf5351db700\bin\bin.html
C:\Users\win7\AppData\Roaming\Microsoft\Windows
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\dm_bar_left[1]
C:\Users\win7\AppData\Local\Temp\nsdECE4.tmp
C:\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\A2\A2C4E53F8E58DC61E337D4CFBBDFBF5BA2825852
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\S4T2D47F.txt
C:\Windows\syswow64\MSCTF.dll
C:\Windows\SysWOW64\Dxtrans.dll
C:\Windows\system32\uxtheme.dll
c:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf
C:\WINDOWS\FONTS\BROWA.TTF
C:\WINDOWS\FONTS\LEELAWAD.TTF
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_remote_requirements.help.txt
C:\WINDOWS\FONTS\CALIBRI.TTF
C:\Users\win7\AppData\Local\bitcoin\msvcp90.dlli
C:\ProgramData\FlashFXP\4\History.dat
C:\Users\win7\AppData\Local\bitcoin\bitcoinminercuda_11.cubin
C:\WINDOWS\FONTS\BROWAB.TTF
C:\Python27\tcl\tcl8.5\tzdata\Asia\Ashkhabad
C:\Windows\inf\oem2.inf
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_functions_cmdletbindingattribute.help.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\OYLR6T3N.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\win7@serving-sys[1].txt
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml
C:\Users\win7\AppData\Local\Temp\nsa73EB.tmp\UserInfo.dll
C:\Users\win7\Desktop\ROBLOX Studio 2.0 Beta.lnk
C:\Windows\syswow64\msvcrt.dll
C:\WINDOWS\FONTS\TUNGAB.TTF
C:\WINDOWS\FONTS\MSJH.TTF
C:\Python27\tcl\tcl8.5\tzdata\Asia\Novosibirsk
C:\Windows\syswow64\iertutil.dll
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\OEXOHZ60.txt
C:\Python27\tcl\tcl8.5\tzdata\Australia\Melbourne
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1
C:\Python27\Lib\site-packages\pip-7.0.1.dist-info\METADATA
C:\theme\theme-en\masterconfig.ini
C:\Python27\tcl\tcl8.5\tzdata\Asia\Ujung_Pandang
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\cancel1[1].gif
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\data.xml
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\EditAppSetting.aspx
C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\volume.cat
C:\Program Files\Reimage\Reimage Repair\engine.dat
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\translations\2052.lang
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\54NAA5HQ.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\CGJO7QOX.txt
C:\rei\cpuidsdk.dll
C:\Users\win7\AppData\Roaming\AnyProtectEx\installer\tempfile.t
C:\Python27\Lib\email\test\data\msg_20.txt
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\ReimageRepair[1].exe
C:\Python27\tcl\tcl8.5\tzdata\America\Porto_Velho
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Roblox\Play Roblox.lnk
C:\Python27\tcl\tcl8.5\tzdata\Europe\Luxembourg
C:\Python27\tcl\tcl8.5\tzdata\Chile\EasterIsland
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\F2X7D9BZ.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\43OYUV6H.txt
C:\Python27\tcl\tcl8.5\tzdata\SystemV\AST4ADT
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\HV0XJKR7.txt
C:\WINDOWS\FONTS\MSJHBD.TTF
C:\Python27\tcl\tcl8.5\tzdata\Brazil\West
C:\Users\win7\AppData\Local\Temp\~dl5790.tmp.bk
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\flyout.html
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp.aspx
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\M79UU8X8.txt
C:\Python27\tcl\tcl8.5\tzdata\America\Noronha
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\index[1].htm
c:\Program Files\Common Files\System\ado\msado21.tlb
C:\WINDOWS\FONTS\MANGAL.TTF
C:\Windows\Microsoft Help\Secure
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\APTAT.Bootstrapper.exe
C:\Users\win7\AppData\Local\bitcoin\libeay32.dll
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\YZD1GVYH.txt
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\home2.aspx
C:\Python27\tcl\tcl8.5\tzdata\Africa\Asmara
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\220X10C1.txt
C:\Python27\tcl\tcl8.5\tzdata\America\Mexico_City
C:\Python27\tcl\tcl8.5\tzdata\America\Tortola
C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\machine.cat
C:\Python27\tcl\tcl8.5\tzdata\Atlantic\Stanley
C:\libGLESv2.dll.asm_patch
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\translations\1050.lang
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_script_blocks.help.txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\paused_icon[1]
C:\Users\win7\AppData\Local\Temp\fuf54C3.js
C:\Python27\tcl\tcl8.5\tzdata\Europe\Belfast
C:\Python27\tcl\tcl8.5\tzdata\Turkey
libeay32.dll
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\4U0YRSM5.txt
C:\Users\win7\AppData\Local\Temp\nst1E41.tmp\DcryptDll.dll
C:\Python27\Lib\test\cjkencodings\hz-utf8.txt
C:\Python27\tcl\tcl8.5\tzdata\Australia\Queensland
c:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml
C:\Users\win7\AppData\Local\Temp\tmp2AC8.tmp
C:\Python27\tcl\tcl8.5\tzdata\America\Marigot
C:\Python27\tcl\tcl8.5\tzdata\ROC
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\MNFH9BJF.txt
C:\Python27\Lib\test\exception_hierarchy.txt
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\908ba9e296e92b4e14bdc2437edac603\System.ni.dll
C:\Windows\inf\battery.inf
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Internals.aspx
C:\Python27\tcl\tcl8.5\tzdata\Europe\Vaduz
C:\Python27\tcl\tcl8.5\tzdata\Europe\Sofia
C:\Users\win7\AppData\Local\Temp\nso3A98.tmp\KPTool.dll
C:\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\1A141DBFA4083406630DD9A81AD35C416F604800
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\.ba1\ru\thm.wxl
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\I3J4YHI2.txt
C:\Python27\Lib\site-packages\setuptools-16.0.dist-info\entry_points.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\JDRDX8I8.txt
C:\WINDOWS\FONTS\APARAJBI.TTF
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\T5OJGZ4J.txt
C:\Python27\tcl\tk8.5\demos\rmt
C:\Windows\inf\nettun.inf
C:\Windows\SysWOW64\win_hcleaner.ini
C:\Python27\tcl\tcl8.5\tzdata\Asia\Magadan
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\icone_cadeado[1].gif
C:\Users\win7\AppData\Local\Temp\WER24B8.tmp.WERInternalMetadata.xml
C:\Python27\tcl\tcl8.5\tzdata\America\Grand_Turk
C:\Python27\tcl\tcl8.5\tzdata\Europe\Vienna
C:\Users\win7\AppData\Local\Temp\nss29BA.tmp\g\pfWWW.DLL
C:\Users\win7\AppData\Local\Temp\repair setup log.txt
C:\Program Files\Reimage\Reimage Repair\Reimage_website.ico
C:\Users\win7\AppData\Roaming\SharedSettings.sqlite
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\MsiJa
C:\Python27\tcl\tcl8.5\tzdata\America\Cordoba
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB
C:\Python27\tcl\tcl8.5\tzdata\Indian\Maldives
c:\Program Files\Oracle\VirtualBox Guest Additions\install_drivers.log
C:\Users\win7\AppData\Local\Temp\tmp2504.tmp
C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
C:\Windows\inf\input.inf
Combat-Arms_00.jpg
C:\WINDOWS\FONTS\GABRIOLA.TTF
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\A1ALVITY.txt
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
C:\Python27\tcl\tcl8.5\tzdata\Africa\El_Aaiun
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\L8ZJIOWL.txt
C:\Users\win7\AppData\Local\Temp\is-V8JDK.tmp\externalwrapper.exe
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Flux\Uninstall.lnk
C:\WINDOWS\FONTS\SHONAR.TTF
C:\Users\win7\AppData\Local\Temp\{aba88724-37eb-4f03-b83b-45199c5a7cf5}\.ba1\UserExperienceManifest.xml
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Majuro
C:\WINDOWS\FONTS\TAILEB.TTF
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Return.help.txt
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\.ba1\BootstrapperApplicationData.xml
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\translations\1055.lang
logs\2015_09_20__15_55_55__WIN7-PC_log.txt
C:\Python27\tcl\tcl8.5\tzdata\Africa\Monrovia
C:\Windows\SysWOW64\lpk.dll
C:\Python27\tcl\tcl8.5\tzdata\America\Argentina\San_Luis
C:\Python27\tcl\tcl8.5\tzdata\SystemV\MST7MDT
C:\Python27\tcl\tcl8.5\tzdata\Indian\Kerguelen
FilePath
C:\Users\win7\AppData\Local\Temp\SETUP_41436\Setup.txt
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT-5
C:\Python27\tcl\tcl8.5\tzdata\Africa\Banjul
C:\Python27\tcl\tcl8.5\tzdata\SystemV\MST7
C:\Python27\Lib\email\test\data\msg_14.txt
C:\WINDOWS\FONTS\CALIBRII.TTF
C:\Python27\tcl\tcl8.5\tzdata\Asia\Rangoon
C:\Python27\tcl\tcl8.5\tzdata\Atlantic\Reykjavik
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Roblox\ROBLOX Studio Beta.lnk
C:\Python27\tcl\tcl8.5\tzdata\Antarctica\Davis
C:\WINDOWS\FONTS\MSMINCHO.TTC
C:\Python27\Lib\email\test\data\msg_36.txt
C:\WINDOWS\FONTS\UPCLI.TTF
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\cancel[1].gif
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Runtime.dll
C:\localization\uk.pak.patch
C:\Python27\tcl\tcl8.5\tzdata\Canada\Yukon
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C1F94CD5CA263ECFB1A4BAB1B832C909
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Galapagos
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\T02RKW3A.txt
C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\FF\FF658A36899E43FEC3966D608B4AA4472DE7A378
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\SOTIT0A7.txt
C:\Python27\tcl\tcl8.5\tzdata\Asia\Yerevan
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT+1
C:\USERS\WIN7\APPDATA\LOCAL\TEMP\7ZSF225.TMP\SYMCCIS.DLL
\\.\PIPE\wkssvc
c:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Continue.help.txt
C:\Users\win7\AppData\Local\Temp\tmp4E16.tmp
C:\Python27\tcl\tix8.4.3\demos\widget
C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Entries\{830143B2-F526-C024-EA03-13DCD07868F4}
C:\Python27\tcl\tcl8.5\tzdata\Jamaica
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_job_details.help.txt
C:\Python27\tcl\tcl8.5\tzdata\US\Arizona
C:\Users\win7\AppData\Roaming\GlobalSCAPE\CuteFTP Lite\sm.dat
C:\Python27\Lib\idlelib\NEWS.txt
C:\Python27\tcl\tcl8.5\tzdata\America\Juneau
C:\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\0119C23D88292A0E4FEC04D5CF8629005A44E37C
C:\Python27\tcl\tcl8.5\tzdata\Asia\Phnom_Penh
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_pssession_details.help.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\WSCNELGL.txt
C:\WINDOWS\FONTS\BROWAU.TTF
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Internals.aspx
C:\Users\win7\AppData\Local\bitcoin\rpcminer-opencl.exe
C:\Python27\tcl\tcl8.5\tzdata\Asia\Qyzylorda
C:\Users\win7\AppData\Local\Temp\nsc8A4A.tmp\Warning.ini
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\U8VZU304.txt
C:\Python27\tcl\tcl8.5\tzdata\America\Puerto_Rico
C:\WINDOWS\FONTS\GULIM.TTC
C:\WINDOWS\FONTS\UPCFBI.TTF
C:\WINDOWS\FONTS\VIJAYAB.TTF
C:\Users\win7\AppData\Local\Temp\tmp235F.tmp
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\ISVLIF2J.txt
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8BD11C4A2318EC8E5A82462092971DEA
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT+9
C:\Python27\tcl\tcl8.5\tzdata\America\Jamaica
C:\Users\win7\AppData\Local\Temp\nss29BA.tmp\modern-header.bmp
C:\Python27\tcl\tcl8.5\tzdata\America\Swift_Current
C:\Users\win7\AppData\Local\bitcoin\rpcminer-cuda.exe
C:\Python27\tcl\tcl8.5\tzdata\Europe\Samara
C:\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Entries\{9CD7968E-5F23-B83B-A3A2-126CF8F3168A}
C:\Users\win7\AppData\Local\Temp\trfmvinh.err
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_functions_advanced_methods.help.txt
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_preference_variables.help.txt
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\close.png
C:\Windows\inf\acpi.inf
C:\WINDOWS\FONTS\KALINGA.TTF
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Automatic_Variables.help.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\N5WDG8I7.txt
C:\Windows\\waccess2832.tmp
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\8DKAN069.txt
C:\WINDOWS\FONTS\SHONARB.TTF
C:\Python27\tcl\tcl8.5\tzdata\Asia\Khandyga
C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\17542707A3D9FA13C569450FD978272EF7070A77
C:\Python27\tcl\tcl8.5\tzdata\Europe\Skopje
C:\Python27\tcl\tcl8.5\tzdata\Asia\Yakutsk
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F90F18257CBB4D84216AC1E1F3BB2C76
C:\Windows\Speech\Engines\SR\en-GB\l2057.phn
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_remote.help.txt
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0CCA7F4B3366C6FAA13012C139D5D8C6_D929E6188CFB2655AFCC3684E0AD5177
c:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui
c:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Midway
C:\Users\win7\AppData\Local\Temp\IXP000.TMP\dsetup.dll
C:\Python27\tcl\tcl8.5\tzdata\Asia\Ulan_Bator
C:\WINDOWS\FONTS\TREBUC.TTF
C:\WINDOWS\FONTS\SEGOEPRB.TTF
C:\WINDOWS\FONTS\EBRIMA.TTF
c:\Program Files\Internet Explorer\ie9props.propdesc
C:\localization\kk.pak.patch
c:\Program Files\Internet Explorer\en-US\jsprofilerui.dll.mui
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\translations\1066.lang
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\S06999DG.txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\verificar_ip[1].htm
C:\Python27\tcl\tcl8.5\tzdata\Hongkong
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\dm[1]
C:\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Entries\{4951AB05-CB9A-E18D-0C55-EB74CFE11108}
C:\Python27\tcl\tcl8.5\tzdata\GMT+0
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Quoting_Rules.help.txt
C:\Python27\tcl\tcl8.5\tzdata\Antarctica\Rothera
C:\theme\masterconfig.ini
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\amipb[1].js
C:\Python27\tcl\tcl8.5\tzdata\Asia\Kuala_Lumpur
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_aliases.help.txt
C:\Users\win7\Pictures\desktop.ini
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\themes\imodern.set
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Norfolk
c:\Program Files\Common Files\System\msadc\handler.reg
C:\Users\win7\AppData\Local\Temp\SETUP_41436\bars_soft.qsp
C:\Python27\tcl\tcl8.5\tzdata\Europe\Bratislava
C:\Python27\Tools\pynche\X\rgb.txt
c:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui
C:\Users\win7\AppData\Local\Temp\\~DFF780591B71B56E21.TMP
C:\Python27\tcl\tcl8.5\tzdata\Japan
http://go.microsoft.com/fwlink/?linkid=182804
C:\Python27\tcl\tcl8.5\tzdata\Asia\Qatar
C:\Python27\tcl\tcl8.5\tzdata\MET
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\1HCAXCQ2.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\ZVOZIFOG.txt
C:\Users\Default\AppData\Local\Vcreditx86
C:\localization\lt.pak.patch
C:\Windows\syswow64\SspiCli.dll
C:\Users\win7\AppData\Local\Temp\tmp2371.tmp
C:\Windows\system32\wbem\texttable.xsl
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\X0QL2I90.txt
C:\WINDOWS\FONTS\COURI.TTF
C:\Python27\Lib\email\test\data\msg_39.txt
C:\Users\win7\AppData\Roaming\GHISLER\wcx_ftp.ini
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\dm_bar_down[1]
C:\Users\win7\AppData\Local\Temp\ztmp\t26979.bat
C:\Windows\SysWOW64\ws2_32.dll
C:\Python27\tcl\tcl8.5\tzdata\Africa\Freetown
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9
C:\Python27\tcl\tcl8.5\tzdata\CST6CDT
c:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\nsDialogs.dll
C:\sample.lang.txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\carregando[1].gif
C:\Users\win7\AppData\Roaming\1F866980-42E9-295E-F965-A482A2715E84\{12bb73b5-eaa8-9f96-b663-805edb785006}.xpi
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\pause[1]
C:\Python27\Lib\test\cjkencodings\iso2022_jp-utf8.txt
C:\Python27\tcl\tcl8.5\tzdata\America\Cuiaba
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Line_Editing.help.txt
C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
C:\Python27\Lib\test\test_doctest3.txt
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1DAF2884EC4DFA96BA4A58D4DBC9C406
C:\ProgramData\FlashFXP\4\Quick.dat
C:\Python27\tcl\tcl8.5\tzdata\Europe\Stockholm
C:\Python27\Lib\email\test\data\msg_33.txt
c:\Program Files\Common Files\System\ado\msado20.tlb
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759AD
C:\Python27\tcl\tcl8.5\tzdata\America\Panama
C:\Windows\System32\WindowsPowerShell
C:\Python27\Lib\email\test\data\msg_11.txt
C:\Windows\syswow64\api-ms-win-downlevel-user32-l1-1-0.dll
C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\volsnap.cat
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\92KBHETR.txt
C:\Python27\Lib\email\test\data\msg_17.txt
C:\Python27\tcl\tcl8.5\tzdata\Europe\Amsterdam
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml
c:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm
C:\Python27\tcl\tcl8.5\tzdata\Africa\Niamey
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Port_Moresby
C:\Users\win7\AppData\Local\Temp\CabF8B4.tmp
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT+4
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\O60SNXMK.txt
C:\Users\win7\AppData\Local\Temp\~dl5790.tmp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch
C:\opera_200_percent.pak.patch
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Pitcairn
C:\Users\win7\AppData\Local\FluxSoftware\Flux
C:\localization\en-GB.pak.patch
C:\WINDOWS\FONTS\CONSOLAI.TTF
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0CCA7F4B3366C6FAA13012C139D5D8C6_3E5A36213ABCB9178323FF3C3E7EC975
C:\localization\be.pak.patch
C:\ProgramData\Microsoft
C:\WINDOWS\FONTS\UPCFI.TTF
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Marquesas
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\Y6BI8W2S.txt
C:\webapp.ini
C:\Users\win7\AppData\Local\Temp\nso3A98.tmp\data.xml
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml
C:\Python27\tcl\tcl8.5\tzdata\US\Pacific
c:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui
c:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui
C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm
C:\Users\win7\AppData\Local
C:\Users\win7\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
C:\Users\win7\AppData\Local\Temp\nsr3BC7.tmp\7za.exe
C:\Python27\tcl\tcl8.5\tzdata\America\Ensenada
C:\Users\win7\AppData\Local\Temp\OTuttipw8f.tmp
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\HFGLCKJH.txt
C:\Python27\tcl\tcl8.5\tzdata\America\Rio_Branco
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_For.help.txt
C:\Program Files\Reimage\Reimage Repair
C:\Python27\Lib\idlelib\help.txt
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\MsiPtBr
C:\WINDOWS\FONTS\PALABI.TTF
install52219.exe
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\findUsers.aspx
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\cancel[1].gif
C:\Users\win7\AppData\Local\Temp\SETUP_41436\webbars_license.rtf
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\HNMMQR3E.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\DYHFEHYG.txt
c:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\UBDS398H.txt
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\.ba1\progress.gif
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT+8
C:\Python27\tcl\tcl8.5\tzdata\Asia\Colombo
C:\Users\win7\AppData\Local\GlobalSCAPE\CuteFTP Pro\sm.dat
C:\Users\win7\AppData\Local\Temp\nsd9943.tmp\domanager.exe
C:\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Entries\{1C4E74AC-149D-39AE-B74A-B53F4CC32D79}
C:\Python27\Lib\test\cjkencodings\gb18030-utf8.txt
C:\WINDOWS\FONTS\MANGALB.TTF
c:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf
C:\theme\region--en\masterconfig.ini
C:\Python27\Lib\test\cjkencodings\iso2022_kr-utf8.txt
C:\Users\desktop.ini
C:\Python27\tcl\tcl8.5\tzdata\America\Managua
C:\Python27\tcl\tcl8.5\tzdata\Antarctica\Casey
C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll
C:\Python27\tcl\tcl8.5\tzdata\Asia\Riyadh
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D84E548583BE1EE7DB5A935821009D26_5B98B6CD6E69202676965CF5B0E2A7A7
C:\WINDOWS\FONTS\MAJALLAB.TTF
C:\Python27\tcl\tcl8.5\tzdata\America\Grenada
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\IU1B7840.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\ZIAS7P2G.txt
C:\WINDOWS\FONTS\CAMBRIA.TTC
C:\Python27\tcl\tcl8.5\tzdata\Australia\North
C:\WINDOWS\FONTS\CAMBRIAI.TTF
C:\Python27\tcl\tcl8.5\tzdata\Asia\Dili
C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\E1\E1332F9BF2E2ECFA57F3D54F626BF8D7C529BA04
C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\footer_img[1].png
C:\Python27\tcl\tcl8.5\tzdata\Egypt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\libacess_js[1].htm
C:\localization\nn.pak.patch
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\0UXC38WY.txt
c:\Program Files\Common Files\System\msadc\handsafe.reg
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Comparison_Operators.help.txt
C:\ProgramData\SharedSettings_1_0_5.sqlite
c:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\S9O4VT2S.txt
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\MsiFr
C:\Python27\tcl\tcl8.5\tzdata\Asia\Yekaterinburg
C:\Python27\tcl\tcl8.5\tzdata\Asia\Novokuznetsk
C:\Users\win7\AppData\Local\Temp\\~DFDBE5BCBA0E995FB2.TMP
C:\Python27\tcl\tcl8.5\tzdata\America\Sitka
c:\Program Files\desktop.ini
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\RHUTRK5V.txt
C:\Python27\tcl\tcl8.5\tzdata\US\Mountain
C:\putty.cnt
C:\Windows\SoftwareDistribution\SelfUpdate\wuident.txt
C:\WINDOWS\FONTS\MINGLIU.TTC
C:\ProgramData\Microsoft\Windows\Power Efficiency Diagnostics\energy-report.html
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\GW29UB38.txt
C:\Python27\tcl\tcl8.5\tzdata\Europe\Volgograd
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\BHFHLEL8.txt
c:\Users\win7\AppData\Local\Temp\trfmvinh.cmdline
C:\Windows\System32\apphelp.dll
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT-1
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C9E3282A673263848AB7F0C007FD3AF1_C5413D7851C1D8C1625ABF026CE6F45F
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT+7
C:\localization\me.pak.patch
C:\Windows\inf\oem3.inf
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\sndsock.dll
C:\Users\win7\AppData\Local\CuteFTP\sm.dat
C:\WINDOWS\FONTS\TAILE.TTF
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0972B7C417F696E06E186AEB26286F01_9D3D67F23DE0B5AF5A01813A18AAA802
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\MVT7LNNS.txt
C:\Users\win7\AppData\Local\Temp\TarF8B5.tmp
C:\Python27\tcl\tcl8.5\tzdata\Africa\Lusaka
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\cancel[1].gif
c:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\F7R1U3BU.txt
C:\Python27\tcl\tcl8.5\tzdata\Africa\Malabo
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\34E7YEXQ.txt
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT+6
C:\Python27\tcl\tcl8.5\tzdata\Australia\Adelaide
C:\WINDOWS\FONTS\CONSTANZ.TTF
C:\Windows\inf\blbdrive.inf
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\skip[1].gif
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Security.aspx
C:\Windows\system32\apphelp.dll
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\0QDK8JVW.txt
C:\WINDOWS\FONTS\PALA.TTF
c:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm
C:\Python27\tcl\tcl8.5\tzdata\America\Paramaribo
C:\Python27\tcl\tcl8.5\tzdata\America\Boa_Vista
C:\Users\win7\AppData\Local\Temp\SETUP_41436\00000#kill.bat
C:\Windows\Temp\KMSAuto\bin\KMSactivator.vbs
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\top-line[1].gif
C:\Windows\system32\mlang.dll
C:\sample:ZONE.identifier
c:\Program Files\Internet Explorer\en-US\DiagnosticsTap.dll.mui
C:\WINDOWS\FONTS\LVNMBD.TTF
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT-0
C:\Users\win7\AppData\Roaming\FileZilla\sitemanager.xml
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\58CV715U.txt
C:\WINDOWS\FONTS\UPCFL.TTF
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\.ba1\nl\thm.wxl
C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\slideShow.html
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C9E3282A673263848AB7F0C007FD3AF1_C5413D7851C1D8C1625ABF026CE6F45F
C:\WINDOWS\FONTS\KAIU.TTF
\??\C:\Windows\SysWOW64\ieframe.dll
C:\Users\win7\AppData\Local\Temp\21244e6e-e96b-444c-b1dc-f6d19955aa60\bin\bin.html
C:\Users\win7\AppData\Local\Microsoft\Windows Mail\Stationery\Green Bubbles.htm
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\translations\1034.lang
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\19IHUE4A.txt
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_format.ps1xml.help.txt
C:\Python27\tcl\tcl8.5\tzdata\Africa\Algiers
C:\Users\win7\AppData\Local\Temp\is-5VJ0O.tmp\SupOptHelper.dll
c:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat
C:\Python27\tcl\tcl8.5\tzdata\GMT
C:\Python27\tcl\tk8.5\demos\tcolor
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\SAN4BKQ8.txt
C:\Users\win7\AppData\Local\Temp\Manual.pdf
C:\Windows\SysWOW64\advapi32.dll
C:\localization\he.pak.patch
C:\Python27\tcl\tcl8.5\tzdata\Canada\Atlantic
c:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml
C:\Python27\tcl\tcl8.5\tzdata\Asia\Taipei
C:\Users\win7\AppData\Local\Temp\WERB53.tmp.WERInternalMetadata.xml
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT+12
C:\sample:typelib
C:\Setup.dat
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\9O3BWOFX.txt
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\nsisXML.dll
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB788E090BC1F3AA2FBC9E8FB2859601
C:\Users\win7\AppData\Local\ExpanDrive\drives.js
C:\Windows\SysWOW64\iertutil.dll
C:\Python27\tcl\tcl8.5\tzdata\Atlantic\Faeroe
c:\Program Files\Internet Explorer\en-US\F12.dll.mui
c:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat
C:\Python27\tcl\tcl8.5\tzdata\Australia\Sydney
C:\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\AF\AF210C8748D77C2FF93966299D4CD49A8C722EF6
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\0XULS0NT.txt
C:\localization\zh-TW.pak.patch
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Switch.help.txt
C:\Python27\tcl\tcl8.5\tzdata\SystemV\HST10
C:\Users\win7\AppData\Local\Temp\{aba88724-37eb-4f03-b83b-45199c5a7cf5}\.ba1\mbapreq.thm
C:\Users\win7\AppData\Local\Temp\tmp2AC7.tmp
C:\Python27\Lib\test\cjkencodings\euc_kr.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\16CFQHP9.txt
C:\Python27\tcl\tcl8.5\tzdata\America\Indiana\Winamac
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
C:\Python27\tcl\tcl8.5\tzdata\Africa\Gaborone
C:\Program Files\Reimage\Reimage Repair\Reimage_uninstall.ico
C:\Windows\inf\hal.inf
C:\Windows\System32\explorer.exe
C:\localization\sr.pak.patch
C:\localization\bn.pak.patch
C:\opera_100_percent.pak.patch
C:\Python27\tcl\tcl8.5\tzdata\Europe\Budapest
C:\Python27\tcl\tcl8.5\tzdata\America\Guatemala
C:\Python27\tcl\tcl8.5\tzdata\America\Boise
C:\Python27\tcl\tcl8.5\tzdata\Asia\Irkutsk
C:\WINDOWS\FONTS\CAMBRIAB.TTF
C:\Python27\tcl\tcl8.5\tzdata\America\Godthab
C:\Python27\tcl\tcl8.5\tzdata\Asia\Ho_Chi_Minh
C:\ProgramData\Microsoft\Windows\Start Menu
C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\keyboard.cat
C:\WINDOWS\FONTS\GEORGIA.TTF
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_remote_output.help.txt
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\828298824EA5549947C17DDABF6871F5_334ED69A36BF882B447815998BE46E97
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759AD
C:\Python27\tcl\tcl8.5\tzdata\Europe\Zurich
C:\Users\win7\AppData\Local\Temp\49A6.tmp
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
C:\data\default-----en\masterconfig.ini
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\MWY1NDP5.txt
c:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Session_Configurations.help.txt
C:\Python27\tcl\tcl8.5\tzdata\America\Caracas
C:\WINDOWS\FONTS\ANGSAUI.TTF
C:\Users\win7\AppData\Roaming\CuteFTP\sm.dat
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\translations\1065.lang
C:\Python27\Lib\email\test\data\msg_12a.txt
C:\Python27\tcl\tcl8.5\tzdata\Europe\Mariehamn
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\L34NK59V.txt
sample\ycha.py
C:\WINDOWS\FONTS\GAUTAMIB.TTF
C:\Users\win7/.sqliterc
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\70RE6SN6.txt
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Comment_Based_Help.help.txt
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\.ba1\pl\thm.wxl
C:\Python27\tcl\tcl8.5\tzdata\Europe\Ljubljana
C:\WINDOWS\FONTS\TUNGA.TTF
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\vboxxharddisk_vba99b5653-18fe4867[2].htm
FilePath123
C:\Windows\System32\dwmapi.dll
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Providers\ManageProviders.aspx
C:\Python27\Lib\test\cjkencodings\shift_jis-utf8.txt
C:\Windows\SysWOW64\oleaut32.dll
c:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui
C:\Python27\tcl\tcl8.5\tzdata\Asia\Dacca
C:\Windows\System32\en-US\erofflps.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\P393WWIA.txt
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\2D3HLXYA.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\HDD5460F.txt
C:\
C:\Users\win7\AppData\Local\Temp\trfmvinh.dll
C:\ProgramData\FileZilla\sitemanager.xml
C:\WINDOWS\FONTS\EBRIMABD.TTF
C:\Python27\Lib\test\cjkencodings\gb18030.txt
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Controls.Input.dll
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\7JIEZE4I.txt
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Pago_Pago
C:\WINDOWS\FONTS\SEGOEUII.TTF
C:\localization\tr.pak.patch
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\ef204c8310562595a0518e356fb15387\PresentationCore.ni.dll
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\DV7UX8EH.txt
C:\ProgramData\ClassicShellSetup64_4_0_2.msi
C:\Program Files\Reimage\Reimage Repair\savapi3.dll
C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\hal.cat
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Ponape
C:\Users\win7\AppData\Roaming\FileZilla\recentservers.xml
C:\Python27\tcl\tcl8.5\tzdata\America\Curacao
C:\Python27\tcl\tcl8.5\tzdata\America\Knox_IN
C:\Python27\tcl\tcl8.5\tzdata\Iceland
C:\WINDOWS\FONTS\UPCLBI.TTF
C:\Python27\tcl\tcl8.5\tzdata\Europe\Minsk
C:\Python27\tcl\tcl8.5\tzdata\America\Danmarkshavn
C:\Python27\tcl\tcl8.5\tzdata\Europe\Madrid
C:\Python27\tcl\tcl8.5\tzdata\Europe\Brussels
C:\Python27\tcl\tcl8.5\tzdata\Africa\Khartoum
C:\Python27\tcl\tcl8.5\tzdata\Africa\Nouakchott
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\paused_icon[1]
C:\Python27\Lib\email\test\data\msg_06.txt
c:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui
C:\WINDOWS\FONTS\GEORGIAZ.TTF
C:\msvcr100.dll.asm_patch
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0CCA7F4B3366C6FAA13012C139D5D8C6_D929E6188CFB2655AFCC3684E0AD5177
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\browse.png
C:\ProgramData\ExpanDrive\drives.js
c:\Windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
C:\data\region-----en\masterconfig.ini
C:\WINDOWS\FONTS\UPCLL.TTF
C:\application.ini
C:\Users\win7\AppData\Local\Temp\aut40B6.tmp
C:\Python27\tcl\tcl8.5\tzdata\Asia\Kathmandu
c:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\inetc.dll
C:\Windows\syswow64\USER32.dll
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\38bf604432e1a30c954b2ee40d6a2d1c\mscorlib.ni.dll
C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\hdaudbus.cat
c:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml
C:\Users\win7\Desktop\desktop.ini
C:\Python27\tcl\tcl8.5\tzdata\Africa\Timbuktu
C:\Python27\tcl\tcl8.5\tzdata\SystemV\EST5EDT
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_environment_variables.help.txt
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\System.dll
C:\Program Files\Reimage\Reimage Repair\Microsoft.VC90.CRT\msvcr90.dll
C:\Python27\tcl\tcl8.5\tzdata\Indian\Mahe
C:\WINDOWS\FONTS\KHMERUIB.TTF
C:\opera_125_percent.pak.patch
C:\Users\win7\AppData\Local\Temp\nsr3BC7.tmp\nsExec.dll
C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\clock.html
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Noumea
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Quick\{DB738614-2FD0-4474-AA77-5448B932F65A}
C:\Python27\Tools\pynche\namedcolors.txt
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\WWPRZ6FN.txt
c:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml
C:\Users\win7\Desktop\ROBLOX Studio Beta.lnk
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\translations\1026.lang
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\63e9d5c341d64a753cde97f5a3d65c71\System.Core.ni.dll
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\828298824EA5549947C17DDABF6871F5_4A500E9AA7C5573906560F21D53A5861
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Fonts\seguisb.ttf
C:\Windows\32BitFtp.ini
C:\Users\win7\AppData\Local\Temp\aut6EF5.tmp
C:\WINDOWS\FONTS\VRINDAB.TTF
C:\Users\win7\AppData\Local\Temp\rainoide.gif
C:\Users\win7
C:\Python27\tcl\tcl8.5\tzdata\Europe\Malta
C:\Users\win7\AppData\Local\Temp\trfmvinh.tmp
C:\Python27\tcl\tcl8.5\tzdata\Africa\Maseru
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\vboxxharddisk_vba99b5653-18fe4867[1].htm
C:\Windows\system32\rsaenh.dll
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\dc[1].js
C:\Python27\tcl\tcl8.5\tzdata\America\Chicago
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\US1AFEOK.txt
tools\SDI\settings.cfg
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\178S9VCZ.txt
C:\WINDOWS\FONTS\UTSAAHB.TTF
C:\launcher.exe
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\75ULH6M1.txt
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\manageUsers.aspx
C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Entries\{5814391C-0379-0644-BCB5-61696E94879C}
c:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui
C:\Users\win7\AppData\Local\Temp\{aba88724-37eb-4f03-b83b-45199c5a7cf5}\.ba1\BootstrapperApplicationData.xml
C:\WINDOWS\FONTS\UPCDL.TTF
C:\Python27\tcl\tk8.5\demos\ixset
C:\Python27\Lib\test\cjkencodings\gbk.txt
c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui
C:\Python27\tcl\tcl8.5\tzdata\Asia\Brunei
c:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat
C:\Windows\Microsoft Help\Secure\desktop.ini
C:\Python27\tcl\tcl8.5\tzdata\America\Moncton
C:\Windows\SysWOW64\kernel32.dll
C:\Users\win7\AppData\Roaming\SharedSettings.ccs
C:\Python27\tcl\tcl8.5\tzdata\America\Tegucigalpa
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\cancel[1]
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\KRVSKFEO.txt
C:\WINDOWS\FONTS\KHMERUI.TTF
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\V6MJ6QKO.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\DZC3HAVT.txt
C:\Python27\tcl\tcl8.5\tzdata\Asia\Thimbu
C:\Users\win7\AppData\Local\Temp\{aba88724-37eb-4f03-b83b-45199c5a7cf5}\.ba1\BootstrapperCore.config
c:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml
C:\localization\fr-CA.pak.patch
C:\Windows\syswow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
c:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\dm_bar_right[1]
C:\Python27\tcl\tcl8.5\tzdata\Europe\Dublin
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\D86PJFZN.txt
C:\Python27\tcl\tcl8.5\tzdata\America\Thule
C:\Python27\tcl\tcl8.5\tzdata\US\Michigan
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9
C:\Users\win7\AppData\Local\Temp\nss29BA.tmp\nsDialogs.dll
C:\Python27\tcl\tcl8.5\tzdata\Asia\Anadyr
C:\Users\win7\AppData\Local\Temp\{aba88724-37eb-4f03-b83b-45199c5a7cf5}\.ba1\Microsoft.Bootstrapper.Presentation.dll
C:\WINDOWS\FONTS\UTSAAH.TTF
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\language[1]
c:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll
C:\Users\win7\AppData\Local\Temp\nst1E41.tmp\stack.dll
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\56JODNFN.txt
C:\WINDOWS\FONTS\CONSTAN.TTF
C:\Python27\tcl\tcl8.5\tzdata\Navajo
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Foreach.help.txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\decline[1].gif
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\EVSRHQHQ.txt
C:\Python27\tcl\tcl8.5\tzdata\America\Mendoza
C:\Python27\tcl\tcl8.5\tzdata\CET
C:\Windows\Temp\KMSAuto\bin.dat
C:\Python27\tcl\tcl8.5\tzdata\America\Phoenix
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\browse.png
C:\Users\win7\AppData\Local\Temp\rna86B2.tmp
C:\WINDOWS\FONTS\VRINDA.TTF
\\.\Nsi
C:\Users\win7\AppData\Local\FluxSoftware\Flux\uninstall.exe
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\L16A1VTC.txt
C:\Users\win7\AppData\Local\Temp\trfmvinh.out
C:\Python27\tcl\tcl8.5\tzdata\Europe\Rome
C:\Users\win7\AppData\Roaming\FlashFXP\4\History.dat
C:\osmesa.dll.asm_patch
C:\Python27\tcl\tcl8.5\tzdata\America\Montevideo
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\R83G6DOG.txt
C:\WINDOWS\FONTS\SEGOEUIB.TTF
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Assignment_Operators.help.txt
C:\Python27\Lib\site-packages\setuptools-16.0.dist-info\METADATA
C:\Python27\tcl\tcl8.5\tzdata\America\Guyana
C:\Python27\Lib\test\cjkencodings\cp949.txt
C:\Python27\tcl\tcl8.5\tzdata\Asia\Manila
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\iplookup[1].json
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\XOQK6T25.txt
C:\Windows\syswow64\GDI32.dll
C:\Users\win7\AppData\Local\Temp\ext2BD7.tmp
C:\Users\win7\AppData\Local\GDIPFONTCACHEV1.DAT
C:\WINDOWS\FONTS\TIMESBI.TTF
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\translations\1029.lang
c:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\accept[1].gif
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\nswF36F.tmp
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\button.png
C:\Python27\tcl\tcl8.5\tzdata\Asia\Amman
C:\Python27\tcl\tcl8.5\tzdata\PRC
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\J7A7VBA3.txt
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\cmdstat.dll
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\ZY6K7JAX.txt
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_properties.help.txt
C:\WINDOWS\FONTS\L_10646.TTF
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\translations\1038.lang
C:\Python27\Lib\test\test_doctest2.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\ZMIQA62O.txt
C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Entries\{E01AD230-00F2-4114-DB75-9C788D7FF24E}
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82414F9D7AB8999991FFEB2BC378A4EB_376643DBA507E2F631E33255C6BD3D64
c:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\nssF575.tmp
C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\acpi.cat
C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
C:\Windows\SysWOW64\user32.dll
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Nauru
C:\Python27\tcl\tcl8.5\tzdata\Atlantic\South_Georgia
C:\Windows\inf\umbus.inf
c:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\VBOXXHARDDISK_VBa99b5653-18fe4867[1].htm
%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
C:\Users\win7\AppData\Local\Temp\nst1E41.tmp\inetc.dll
C:\Windows\System32\cmd.exe
C:\WINDOWS\FONTS\CANDARAZ.TTF
C:\Python27\tcl\tcl8.5\tzdata\Australia\LHI
C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Entries\{1C4E74AC-149D-39AE-B74A-B53F4CC32D79}
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\FONTS\NTAILU.TTF
C:\Python27\Lib\test\cjkencodings\euc_jp.txt
C:\Python27\Lib\test\cjkencodings\gb2312-utf8.txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\line[1]
C:\Python27\tcl\tcl8.5\tzdata\America\Antigua
C:\Python27\tcl\tcl8.5\tzdata\Europe\Berlin
C:\WINDOWS\FONTS\ARABTYPE.TTF
C:\Python27\tcl\tcl8.5\tzdata\Atlantic\Canary
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\828298824EA5549947C17DDABF6871F5_4A500E9AA7C5573906560F21D53A5861
C:\localization\fil.pak.patch
C:\localization\uz.pak.patch
c:\Users\win7\AppData\Local\Temp\trfmvinh.0.cs
C:\localization\vi.pak.patch
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_join.help.txt
C:\opera_250_percent.pak.patch
c:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui
C:\Python27\tcl\tcl8.5\tzdata\Indian\Mayotte
C:\Python27\tcl\tcl8.5\tzdata\America\Belem
c:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf
C:\Python27\tcl\tcl8.5\tzdata\America\Monterrey
C:\localization\es-419.pak.patch
C:\Users\win7\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch
c:\Program Files\Common Files\System\ado\msado28.tlb
C:\WINDOWS\FONTS\KOKILA.TTF
C:\WINDOWS\FONTS\COMIC.TTF
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\SH63WJQG.txt
C:\WINDOWS\FONTS\CORDIAZ.TTF
C:\ST_LOG.INI
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\trl.txt
C:\Program Files
C:\Python27\tcl\tcl8.5\tzdata\Asia\Tashkent
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\button.png
C:\Users\win7\AppData\Local\Temp\nss29BA.tmp\g\pfWWW.dll
C:\Python27\tcl\tcl8.5\tzdata\Europe\Moscow
c:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf
C:\Users\win7\AppData\Local\Temp\sample
C:\Python27\tcl\tcl8.5\tzdata\Africa\Bissau
C:\Users\win7\AppData\Local\Temp\c72ace89-5c96-47bf-92a3-9cf5351db700\bin.dmc
C:\Users\win7\AppData\Local\Temp\AITMP601\
C:\Users\win7\AppData\Local\Temp\nso3A98.tmp\inetc.dll
C:\Python27\Tools\pynche\websafe.txt
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\A7B2E6TB.txt
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAEBE581FCB73249406FC21094EA252E_BC0CE803EF41A748738619ED7838EEFC
C:\Python27\tcl\tcl8.5\tzdata\America\La_Paz
C:\WINDOWS\FONTS\ROD.TTF
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
C:\Program Files\Reimage\Reimage Repair\ReimageRepair.exe
C:\Python27\tcl\tcl8.5\tzdata\Canada\Saskatchewan
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\CW8NJ7ND.txt
C:\Python27\tcl\tcl8.5\tzdata\Asia\Hong_Kong
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\C1B1REZZ.txt
C:\Windows\SysWOW64\msvcrt.dll
C:\Python27\tcl\tcl8.5\tzdata\Asia\Chungking
C:\WINDOWS\FONTS\AHRONBD.TTF
c:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_0_ff109b8e6ff4d05d9a6d51ed29594fae5ed875d_cab_077bf59b\client_manifest.txt
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Path_Syntax.help.txt
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DABB55AEBD8EE118C20603B589704E10
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml
C:\Python27\tcl\tcl8.5\tzdata\Europe\Tallinn
C:\Python27\tcl\tcl8.5\tzdata\America\Metlakatla
c:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui
C:\Python27\tcl\tcl8.5\tzdata\America\Lower_Princes
<NULL>
C:\Python27\tcl\tk8.5\demos\square
C:\Python27\tcl\tcl8.5\tzdata\America\Iqaluit
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Saipan
C:\WINDOWS\FONTS\CORBELZ.TTF
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\M068IP1S.txt
C:\Users\win7\AppData\Local\Temp\WERF945.tmp.WERInternalMetadata.xml
C:\Python27\Lib\idlelib\TODO.txt
C:\Python27\tcl\tcl8.5\tzdata\Europe\Nicosia
C:\Windows\SysWOW64\FirewallAPI.dll
C:\Windows\inf\mshdc.inf
C:\Python27\tcl\tcl8.5\tzdata\UTC
C:\Python27\tcl\tcl8.5\tzdata\Europe\Uzhgorod
C:\Users\win7\AppData\Local\Temp\is-V8JDK.tmp\_isetup\_shfoldr.dll
C:\Users\win7\AppData\Local\Temp\nsc8A4A.tmp\modern-wizard.bmp
C:\WINDOWS\FONTS\BROWAUI.TTF
C:\Python27\tcl\tcl8.5\tzdata\America\St_Vincent
C:\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\FF\FF658A36899E43FEC3966D608B4AA4472DE7A378
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B912B2C6928A18B8CD7D50CF08BEA95B_A0A4E63D002FE2D2FEB4730A59BEAF43
C:\Python27\tcl\tcl8.5\tzdata\Canada\Central
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Zip.dll
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\MS36MMC9.txt
C:\WINDOWS\FONTS\CORBEL.TTF
C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\hdaudio.cat
C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\settings.html
C:\Users\win7\AppData\Roaming\FlashFXP\3\Sites.dat
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\D8SHPSXY.txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\trans[1]
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_command_precedence.help.txt
C:\Users\win7\AppData\Local\Temp\48E9.tmp
C:\Windows\inf\volsnap.inf
C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem2.cat
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\50IFX3T6.txt
C:\Python27\Lib\test\cjkencodings\cp949-utf8.txt
C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\ExecutePrequisites
C:\Users\win7\AppData\Local\Microsoft\Windows Mail\Stationery\Soft Blue.htm
CONIN$
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B912B2C6928A18B8CD7D50CF08BEA95B_A0A4E63D002FE2D2FEB4730A59BEAF43
C:\Python27\Lib\test\test_difflib_expect.html
C:\Python27\tcl\tcl8.5\tzdata\Antarctica\Vostok
C:\Windows\system32\dwmapi.dll
C:\localization\de.pak.patch
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\W3B79UNW.txt
C:\Python27\tcl\tcl8.5\tzdata\Africa\Maputo
C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Entries\{4BF2B463-7479-3DAE-72F0-FB54116DE50F}
C:\Python27\tcl\tcl8.5\tzdata\Africa\Juba
C:\Users\win7\AppData\Local\Temp\48D8.exe
C:\Python27\tcl\tcl8.5\tzdata\Indian\Antananarivo
C:\localization\sk.pak.patch
C:\WINDOWS\FONTS\UPCIBI.TTF
C:\Python27\Lib\test\cjkencodings\shift_jis.txt
C:\Python27\tcl\tcl8.5\tzdata\America\Maceio
C:\Users\win7\AppData\Local\Temp\7zSF225.tmp\SCC.dll
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\V3Q6NYIQ.txt
C:\Python27\tcl\tcl8.5\tzdata\America\Merida
c:\Program Files\Common Files\System\ado\adovbs.inc
C:\Users\win7\AppData\Roaming\FlashFXP\3\Quick.dat
C:\Users\win7\AppData\Local\Temp\\cmdinstall.exe_15-09-23_21.35.55.log
C:\Users\win7\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\s9[1].gif
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\CAR5K97G.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\IEVRWV8V.txt
c:\Program Files\Oracle\VirtualBox Guest Additions\Oracle VM VirtualBox Guest Additions.url
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\MQBKAJUR.txt
C:\Users\win7\AppData\Local\Temp\tmp1853.exe
\\.\PhysicalDrive0
C:\Python27\tcl\tcl8.5\tzdata\America\Denver
C:\Windows\SysWOW64\shlwapi.dll
C:\localization\bg.pak.patch
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml
C:\Python27\tcl\tcl8.5\tzdata\America\Argentina\Jujuy
C:\Users\All Users\Microsoft\Windows\WER\ReportQueue\NonCritical_0_ff109b8e6ff4d05d9a6d51ed29594fae5ed875d_cab_077bf59b\client_manifest.txt
C:\Windows\SysWOW64\normaliz.dll
c:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui
C:\Windows\INF\setupapi.app.log
C:\WINDOWS\FONTS\LEELAWDB.TTF
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\LRD1T7P0.txt
C:\WINDOWS\FONTS\GAUTAMI.TTF
C:\Users\win7\AppData\Local\bitcoin\rpcminer-cpu.exe
C:\Python27\tcl\tcl8.5\tzdata\America\Detroit
C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\V2WZFL6XIXNE54BFC34Y.temp
C:\WINDOWS\FONTS\UPCIB.TTF
C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm
C:\Python27\tcl\tcl8.5\tzdata\Asia\Vladivostok
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\currency.html
C:\Python27\tcl\tcl8.5\tzdata\Asia\Choibalsan
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\APTAT.Application.exe
C:\Users\win7\AppData\Local\Temp\aut40F9.tmp
C:\Users\win7\AppData\Roaming\GlobalSCAPE\CuteFTP Pro\sm.dat
C:\Python27\tcl\tcl8.5\tzdata\America\Kentucky\Louisville
C:\Python27\tcl\tcl8.5\tzdata\America\Kentucky\Monticello
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_prompts.help.txt
C:\Users\Public\Downloads\dm-39B9.tmp
c:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui
C:\Python27\tcl\tcl8.5\tzdata\Africa\Lome
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Help.format.ps1xml
Qt5Core.dll
C:\Python27\tcl\tcl8.5\tzdata\MST
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\settings.html
C:\localization\ta.pak.patch
C:\Users\win7\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\PVUV5EHS.txt
C:\WINDOWS\FONTS\CANDARA.TTF
C:\Windows\System32\mscoree.dll
C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\MSVCR80.dll
C:\Python27\tcl\tcl8.5\tzdata\Israel
C:\ProgramData\CoffeeCup Software\SharedSettings.sqlite
C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm
C:\WINDOWS\FONTS\VANIB.TTF
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\QCOF19VF.txt
C:\Windows\syswow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
C:\Python27\tcl\tcl8.5\tzdata\Atlantic\Bermuda
C:\Python27\tcl\tcl8.5\tzdata\America\Porto_Acre
C:\WINDOWS\FONTS\EUPHEMIA.TTF
[RANDOM_STRING].7z
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\828298824EA5549947C17DDABF6871F5_334ED69A36BF882B447815998BE46E97
C:\Python27\Lib\site-packages\setuptools-16.0.dist-info\dependency_links.txt
C:\Python27\tcl\tcl8.5\tzdata\Asia\Krasnoyarsk
C:\Users
C:\Users\win7\AppData\Local\Temp\nsx74CC.tmp\inetc.dll
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759AD
C:\Program Files\Reimage
C:\WINDOWS\FONTS\UPCDBI.TTF
C:\Users\win7\AppData\Local\IconCache.db
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\translations\1032.lang
C:\Users\win7\AppData\Local\Temp\nsy3BAD.tmp
C:\opera.exe.asm_patch
C:\Windows\inf\nete1g3e.inf
C:\WINDOWS\FONTS\NYALA.TTF
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\APTAT.Valkyrie.Client.dll
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\ETOQE1TG.txt
C:\Python27\tcl\tcl8.5\tzdata\Atlantic\Faroe
C:\WINDOWS\FONTS\PHAGSPAB.TTF
C:\WINDOWS\FONTS\UPCFB.TTF
c:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_History.help.txt
\
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Gambier
C:\Users\win7\AppData\Local\FlashFXP\3\History.dat
C:\WINDOWS\FONTS\NTAILUB.TTF
C:\Windows\system32\DNSAPI.dll
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Language_Keywords.help.txt
c:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT+11
C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\calendar.html
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\LinkConfig[1].xml
C:\installer.exe.asm_patch
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\iSafe_setup[1].exe
C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\cpu.cat
C:\WINDOWS\FONTS\VIJAYA.TTF
C:\WINDOWS\FONTS\IMPACT.TTF
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml
C:\Python27\tcl\tcl8.5\tzdata\Cuba
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe.config
C:\Python27\tcl\tcl8.5\tzdata\Asia\Sakhalin
C:\WINDOWS\FONTS\KOKILABI.TTF
C:\Python27\tcl\tcl8.5\tzdata\America\Argentina\Mendoza
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\WindowsBootstrapperSettings[1].htm
C:\Python27\tcl\tcl8.5\tzdata\America\Santiago
C:\Python27\tcl\tcl8.5\tzdata\EST
C:\WINDOWS\FONTS\SIMKAI.TTF
C:\localization\af.pak.patch
C:\Python27\tcl\tcl8.5\tzdata\Asia\Jerusalem
C:\localization\pt-BR.pak.patch
C:\Python27\tcl\tcl8.5\tzdata\Africa\Bujumbura
C:\Windows\SysWOW64\scrrun.dll
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\0NUGPF93.txt
C:\Users\win7\AppData\Roaming\SharedSettings_1_0_5.ccs
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\resume[1]
C:\Python27\tcl\tcl8.5\tzdata\America\Hermosillo
C:\localization\nl.pak.patch
C:\Users\win7\AppData\Local\GlobalSCAPE\CuteFTP Lite\sm.dat
C:\Users\win7\AppData\Local\Temp\aut40E8.tmp
C:\Users\win7\AppData\Local\Temp\nsx74CC.tmp\UserInfo.dll
C:\WINDOWS\FONTS\MRIAM.TTF
C:\Users\win7\AppData\Local\Temp\downloader_version.xml
c:\Program Files\Common Files\System\msadc\adcvbs.inc
C:\WINDOWS\SYSWOW64\CSRV.EXE
C:\Python27\tcl\tcl8.5\tzdata\Africa\Harare
ssleay32.dll
c:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml
C:\Users\win7\AppData\Local\Temp\{aba88724-37eb-4f03-b83b-45199c5a7cf5}\.ba1\license.rtf
C:\Windows\SYSTEM32\MSCOREE.DLL
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\mobi2[1].js
C:\Users\win7\AppData\Local\Microsoft
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Themes.Windows8.dll
C:\Windows\SysWOW64\urlmon.dll
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\FluentValidation.dll
C:\Python27\Lib\test\floating_points.txt
C:\Windows\syswow64\shell32.dll
C:\WINDOWS\FONTS\COURE.FON
C:\Python27\tcl\tcl8.5\tzdata\America\Halifax
C:\WINDOWS\FONTS\MSYH.TTF
C:\WINDOWS\FONTS\SEGOESCB.TTF
C:\Python27\tcl\tcl8.5\tzdata\Mexico\General
C:\Python27\tcl\tcl8.5\tzdata\Asia\Shanghai
C:\Users\win7\AppData\Local\CoffeeCup Software\SharedSettings.sqlite
C:\Python27\tcl\tcl8.5\tzdata\Asia\Omsk
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Microsoft.ReportViewer.Common.dll
C:\Users\win7\AppData\Roaming\uTorrent\ipfilter.dat
C:\Program Files\desktop.ini
C:\dbghelp.dll.asm_patch
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\cmdhtml.dll
c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml
C:\Python27\tcl\tcl8.5\tzdata\SystemV\CST6CDT
C:\resources\default_partner_content.json.patch
C:\WINDOWS\FONTS\RAAVIB.TTF
C:\Users\Public
C:\Python27\tcl\tcl8.5\tzdata\America\Jujuy
C:\theme\default-en\masterconfig.ini
C:\win8_importing.dll.asm_patch
C:\localization\it.pak.patch
C:\Windows\syswow64\USERENV.dll
C:\Users\win7\AppData\Local\Temp\nsj20C1.tmp\System.dll
C:\Python27\tcl\tcl8.5\tzdata\Antarctica\Mawson
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Chatham
platforms\qwindows.dll
C:\Users\win7\AppData\Local\SharedSettings_1_0_5.sqlite
C:\Python27\tcl\tcl8.5\tzdata\America\Ojinaga
C:\WINDOWS\FONTS\APARAJ.TTF
C:\WINDOWS\FONTS\ANGSAZ.TTF
C:\rei\AV\avupdate.conf
C:\Users\win7\AppData\Local\Temp\nsa73EB.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\is-5VJ0O.tmp\itdownload.dll
C:\Windows\inf\cpu.inf
C:\Users\win7\AppData\Roaming\CoffeeCup Software\SharedSettings.sqlite
C:\Python27\tcl\tcl8.5\tzdata\America\Catamarca
c:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml
C:\Python27\tcl\tcl8.5\tzdata\Africa\Libreville
C:\Program Files\Reimage\Reimage Repair\Microsoft.VC90.CRT\Microsoft.VC90.CRT.manifest
C:\Users\win7\AppData\Local\Google\Chrome\Temp\source2140_24157
C:\Users\win7\AppData\Local\Temp\48EA.tmp
C:\localization\mk.pak.patch
\\.\pipe\GoogleCrashServices\S-1-5-21-3979321414-2393373014-2172761192-1000
C:\Users\win7\AppData\Local\Temp\OTuttipw8f.tmp\htmlayout.dll
C:\WINDOWS\FONTS\CORDIAU.TTF
C:\Python27\Lib\test\cjkencodings\johab-utf8.txt
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E4F76C0C82655FD6506668127FA0ACD1_A6D48D4EDEA7C273F5F17961856573CE
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Registry.format.ps1xml
C:\natives_blob.bin.patch
C:\Python27\tcl\tcl8.5\tzdata\US\Aleutian
C:\Python27\Lib\test\cjkencodings\hz.txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\footer_img[1].png
C:\localization\id.pak.patch
C:\Users\win7\AppData\Local\Temp\is-J09EF.tmp\_isetup\_shfoldr.dll
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Providers\chooseProviderManagement.aspx
C:\Users\win7\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.htm
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6
\??\C:\Windows\system32\EhStorShell.dll
C:\d3dcompiler_47.dll.asm_patch
C:\Users\win7\AppData\Local\Temp\7zSF225.tmp\SymCCISExe.exe
C:\localization\ms.pak.patch
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\DDO0REPA.txt
c:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Tongatapu
C:\Python27\tcl\tcl8.5\tzdata\America\Nassau
C:\Users\win7\AppData\Local\Temp\nsz216E.tmp
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\4MNS85V8.txt
C:\Windows\SysWOW64\sechost.dll
C:\Users\win7\AppData\Local\Temp\{aba88724-37eb-4f03-b83b-45199c5a7cf5}\.ba1\BootstrapperCore.dll
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\.ba1\es\thm.wxl
C:\Users\win7\AppData\Local\Temp\is-D5T9K.tmp\_isetup\_shfoldr.dll
C:\Users\win7\AppData\Local\bitcoin\readme.txt
c:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml
C:\ProgramData\GHISLER\wcx_ftp.ini
C:\Windows\syswow64\USP10.dll
C:\WINDOWS\FONTS\MAJALLA.TTF
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3151BAC9462B3E2DEE2326609B77DE7E
C:\Python27\tcl\tcl8.5\tzdata\Etc\GMT0
C:\Python27\tcl\tcl8.5\tzdata\Europe\Vatican
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Controls.FixedDocumentViewers.dll
c:\Program Files\Common Files\System\en-US\wab32res.dll.mui
C:\Program Files\Reimage\Reimage Repair\REI_Axcontrol.lza
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D7B4E43171BB9E412497B0377F4343E7
Qt5Network.dll
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\translations\1049.lang
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\MU4FPLZN.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\RP01ZUAV.txt
C:\WINDOWS\FONTS\SIMSUN.TTC
C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\47267F943F060E36604D56C8895A6EECE063D9A1
C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\LJV2VX45.txt
C:\WINDOWS\FONTS\UPCJBI.TTF
C:\Python27\tcl\tcl8.5\tzdata\America\Goose_Bay
C:\Users\win7\AppData\Local\Temp\CR_23DD3.tmp\SETUP_PATCH.PACKED.7Z
C:\Python27\Lib\email\test\data\msg_03.txt
C:\WINDOWS\FONTS\KARTIKAB.TTF
C:\WINDOWS\FONTS\UPCLB.TTF
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\8PLYGTV4.txt
C:\Users\win7\AppData\Local\CoffeeCup Software\SharedSettings_1_0_5.ccs
C:\Users\win7\AppData\Roaming\SharedSettings_1_0_5.sqlite
C:\Users\win7\AppData\Local\Temp\nsy1E11.tmp
C:\Users\win7\AppData\Local\FileZilla\filezilla.xml
C:\Users\win7\AppData\Local\\Google\Chrome\User Data\Local State
C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.cat
C:\Windows\SysWOW64\WScript.exe
C:\WINDOWS\FONTS\ROMAN.FON
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\cmdapt86.exe
\??\C:\Windows\System32\shdocvw.dll
C:\Python27\tcl\tcl8.5\tzdata\America\St_Barthelemy
C:\Users\win7\AppData\Local\Temp\sample.log
C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\cpu.html
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_split.help.txt
C:\temp\t.txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\resume[1]
C:\Users\win7\AppData\Local\Temp\nso3BBE.tmp\[RANDOM_STRING].7z
C:\Windows\system32\wbem\\texttable.xsl
C:\Python27\tcl\tcl8.5\tzdata\America\St_Thomas
C:\rei\AV\savapi3_stop.exe
drivers
C:\WINDOWS\FONTS\BROWAZ.TTF
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_890607A31D4342BEBCF2B7827B9DBD65
C:\Windows\SysWOW64\rpcrt4.dll
C:\WINDOWS\FONTS\DAVIDBD.TTF
C:\Users\win7\AppData\Local\Temp\nst1E41.tmp\installer-164x314.bmp
C:\Users\Default\AppData\Local
C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\compositebus.cat
C:\Users\win7\AppData\Local\Temp\nsr3BC7.tmp\[RANDOM_STRING].7z
C:\WINDOWS\FONTS\MALGUNBD.TTF
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\.ba1\WixStdBA.dll
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml
C:\Users\win7\Documents\desktop.ini
C:\WINDOWS\FONTS\RAAVI.TTF
C:\Users\win7\AppData\Local\Temp\Avira_Launcher_20150927011828.log
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C0AF5F80AA0D55CA55AD4471DD73D761
c:\Program Files\Oracle\VirtualBox Guest Additions\VBoxVideo.inf
C:\WINDOWS\FONTS\UPCDI.TTF
C:\Users\win7\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6
C:\Windows\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk\desktop.ini
C:\Users\win7\Desktop\Play Roblox.lnk
C:\Python27\tcl\tcl8.5\tzdata\Asia\Pyongyang
C:\Users\win7\Videos\desktop.ini
C:\Windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
C:\Windows\syswow64\OLEAUT32.dll
C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\A2\A2C4E53F8E58DC61E337D4CFBBDFBF5BA2825852
C:\Windows\syswow64\CRYPTBASE.dll
C:\Python27\Lib\test\cjkencodings\euc_jp-utf8.txt
C:\Windows\wcx_ftp.ini
\\.\pipe\BurnPipe.{DF98ECAE-0F19-4F81-8F8B-59BDB4652DB1}
C:\Python27\tcl\tcl8.5\tzdata\Canada\Newfoundland
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Throw.help.txt
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\MsiNl
C:\Program Files\Reimage\Reimage Repair\reimage.dat
C:\Users\Public\Desktop\PC Scan & Repair by Reimage.lnk
C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nettun.cat
C:\Python27\Lib\email\test\data\msg_19.txt
C:\WINDOWS\FONTS\KALINGAB.TTF
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\WNPKXY63.txt
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\translations\1036.lang
c:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml
C:\WINDOWS\FONTS\GISHA.TTF
C:\Users\win7\AppData\Local\Temp\nsx74CC.tmp\WmiInspector.dll
c:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml
C:\WINDOWS\FONTS\LAOUI.TTF
C:\Windows\inf\machine.inf
C:\Python27\tcl\tcl8.5\tzdata\Africa\Tripoli
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\accept[1].gif
C:\WINDOWS\FONTS\UPCEB.TTF
c:\Program Files\Oracle\VirtualBox Guest Additions\VBoxGuest.sys
C:\Windows\system32\IMM32.DLL
C:\opera.pak.patch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe.config
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\FWEK4WT8.txt
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\.ba1\ja\thm.wxl
C:\Python27\tcl\tcl8.5\tzdata\Atlantic\Cape_Verde
C:\Python27\tcl\tcl8.5\tzdata\America\Scoresbysund
C:\Python27\tcl\tcl8.5\tzdata\Asia\Samarkand
C:\WINDOWS\FONTS\CORDIAUB.TTF
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\MsiPl
C:\WINDOWS\FONTS\COMICBD.TTF
C:\WINDOWS\FONTS\ANGSA.TTF
C:\Users\win7\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db
C:\icudtl.dat.patch
C:\sample.config
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Controls.dll
C:\WINDOWS\FONTS\LATHAB.TTF
C:\Windows\syswow64\WININET.dll
C:\localization\th.pak.patch
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\finish[1].gif
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\BundlePayload
C:\WINDOWS\FONTS\TRADO.TTF
C:\WINDOWS\FONTS\CONSOLAB.TTF
c:\pagefile.sys
C:\Users\win7\AppData\Local\Temp\aut1F0F.tmp
C:\WINDOWS\FONTS\CALIBRIZ.TTF
C:\WINDOWS\FONTS\TREBUCBI.TTF
C:\Users\win7\AppData\Roaming\Microsoft\desktop.ini
C:\WINDOWS\FONTS\HIMALAYA.TTF
C:\Python27\tcl\tcl8.5\tzdata\Europe\Podgorica
C:\Python27\tcl\tcl8.5\tzdata\Indian\Reunion
C:\Windows\SysWOW64\wininet.dll
C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Entries\{9CD7968E-5F23-B83B-A3A2-126CF8F3168A}
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\TU9L9XJ4.txt
C:\Python27\Lib\email\test\data\msg_31.txt
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0972B7C417F696E06E186AEB26286F01_9D3D67F23DE0B5AF5A01813A18AAA802
C:\Users\win7\AppData\Local\Temp\nss29BA.tmp\g\gtapi_signed.dll
C:\localization\el.pak.patch
C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\.ba1\zhcn\thm.wxl
c:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
C:\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Quick\{DB738614-2FD0-4474-AA77-5448B932F65A}
C:\Windows
C:\Windows\inf\msmouse.inf
C:\Python27\Lib\idlelib\README.txt
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
C:\Windows\SysWOW64\profapi.dll
C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Entries\{4951AB05-CB9A-E18D-0C55-EB74CFE11108}
C:\WINDOWS\FONTS\CORBELI.TTF
C:\Python27\tcl\tcl8.5\tzdata\Etc\UCT
C:\WINDOWS\FONTS\MICROSS.TTF
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_475F510BF9169BFE0F32718985630A57
\\.\PIPE\srvsvc
C:\Python27\tcl\tcl8.5\tzdata\Africa\Dar_es_Salaam
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D47DBD2F9E3365FBBE008D71FB06716F_835A2FD7EE5F1F37B7872C78D42A88BF
C:\Windows\syswow64\RPCRT4.dll
C:\WINDOWS\FONTS\UPCDB.TTF
C:\ProgramData\Package Cache\.unverified\ExecutePrequisites
C:\Windows\syswow64\urlmon.dll
C:\data.cab
C:\Python27\tcl\tcl8.5\tzdata\Asia\Nicosia
C:\Windows\syswow64\api-ms-win-downlevel-version-l1-1-0.dll
C:\rei\AV\Microsoft.VC90.CRT\msvcr90.dll
C:\Python27\Lib\email\test\data\msg_12.txt
msvcp110.dll
C:\WINDOWS\FONTS\CONSOLA.TTF
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\accept[1].gif
C:\Python27\Lib\test\cjkencodings\euc_kr-utf8.txt
C:\Python27\tcl\tcl8.5\tzdata\W-SU
C:\Windows\System32\WindowsPowerShell\v1.0
C:\Python27\tcl\tcl8.5\tzdata\Asia\Singapore
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\5YZ5NDZI.txt
C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\usbport.cat
C:\Python27\tcl\tcl8.5\tzdata\Asia\Vientiane
C:\WINDOWS\FONTS\SEGOESC.TTF
C:\WINDOWS\FONTS\APARAJB.TTF
C:\WINDOWS\FONTS\NRKIS.TTF
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\4KPFDFTN.txt
C:\Windows\SysWOW64\gdi32.dll
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\ACYXBMEK.txt
C:\WINDOWS\FONTS\WEBDINGS.TTF
C:\ProgramData\Microsoft\desktop.ini
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3130B1871A126520A8C47861EFE3ED4D
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\.ba1\de\thm.wxl
C:\WINDOWS\FONTS\UPCJL.TTF
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_objects.help.txt
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D47DBD2F9E3365FBBE008D71FB06716F_835A2FD7EE5F1F37B7872C78D42A88BF
C:\Users\win7\AppData\Local\Temp\nsn464.tmp\System.dll
C:\Python27\Lib\email\test\data\msg_15.txt
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\manageSingleRole.aspx
C:\Windows\syswow64\LPK.dll
C:\Windows\SysWOW64\CRYPTBASE.dll
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\LD25D6GG.txt
C:\WINDOWS\SYSTEM32\HYZJUC.EXE
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\translations\1058.lang
C:\Users\win7\AppData\Local\Google\Chrome\Temp
C:\Users\win7\AppData\Local\Temp\{aba88724-37eb-4f03-b83b-45199c5a7cf5}\.ba1\mbapreq.wxl
c:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Special_Characters.help.txt
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\MU6HEFEQ.txt
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_locations.help.txt
C:\Python27\tcl\tcl8.5\tzdata\WET
C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml
C:\opera_autoupdate.exe
C:\WINDOWS\FONTS\GISHABD.TTF
C:\Users\win7\AppData\Local\Temp\wdk\Windows Driver Kit for Windows 8.1_20150924173132.log
C:\Users\win7\AppData\Local\Temp\nss29BA.tmp\g\gcombo
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\managePermissions.aspx
C:\Program Files\Reimage\Reimage Repair\Reimage.exe
C:\Windows\assembly\pubpol1.dat
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\vboxxharddisk_vba99b5653-18fe4867[1].htm
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\IEBHE9OC.txt
C:\Users\win7\AppData\Local\Temp\nstD3DD.tmp\[RANDOM_STRING].7z
C:\rei\AV\avupdate.exe
C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\battery.cat
C:\Users\win7\AppData\Local\Temp\nst1E41.tmp\LogEx.dll
C:\Windows\SysWOW64\Dxtmsft.dll
C:\WINDOWS\FONTS\VERDANAZ.TTF
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\skip[1].gif
C:\ProgramData\Package Cache\15568BEAD79920B30F068404FD4CBB9D841B18F2\Avira.OE.Setup.Prerequisites.exe
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F
C:\libEGL.dll.asm_patch
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_functions.help.txt
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\LinkConfig[1].htm
C:\Python27\tcl\tcl8.5\tzdata\America\Cayman
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0Q58CC5A\next[1].gif
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Kosrae
C:\Python27\tcl\tk8.5\demos\browse
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Flux\Flux.lnk
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\065V986J.txt
C:\rei\SupportInfoTool.ini
C:\Users\win7\AppData\Local\Temp\aut40C7.tmp
C:\Windows\inf\cdrom.inf
C:\Windows\SysWOW64\stdole2.tlb
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\K4MG17JT.txt
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Roblox\ROBLOX Studio 2.0.lnk
C:\WINDOWS\FONTS\CORDIAUI.TTF
C:\Python27\tcl\tcl8.5\tzdata\America\Inuvik
C:\localization\ru.pak.patch
C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_wildcards.help.txt
C:\Users\win7\AppData\Local\Google\Chrome
C:\WINDOWS\FONTS\CORDIAB.TTF
C:\localization\pl.pak.patch
\??\C:\Windows\system32\ntshrui.dll
C:\Python27\Lib\email\test\data\msg_09.txt
C:\WINDOWS\FONTS\SIMPBDO.TTF
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
C:\WINDOWS\FONTS\UPCIL.TTF
C:\Users\win7\AppData\Local\Temp\wwaE1E2.tmp
C:\Python27\tcl\tcl8.5\tzdata\Asia\Karachi
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vc.lnk
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\W3LPKI31.txt
C:\Users\win7\AppData\Local\FluxSoftware\Flux\runtime\Calibri-14-400-0.ytf
C:\Python27\tcl\tcl8.5\tzdata\Iran
C:\Users\win7\AppData\Local\Microsoft\Windows\History\desktop.ini
C:\WINDOWS\FONTS\UPCKBI.TTF
C:\Users\win7\AppData\Local\Temp\nst1E41.tmp\ProtectorUpdater.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\index1c2.dat
c:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui
C:\Program Files\Reimage\Reimage Repair\ReimageReminder.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\types.ps1xml
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\Microsoft.ReportViewer.ProcessingObjectModel.dll
C:\Windows\inf\rdpbus.inf
msvcr110.dll
C:\Windows\syswow64\KERNELBASE.dll
C:\Users\win7\AppData\Local\Temp\IXP000.TMP\dxwsetup.inf
C:\WINDOWS\FONTS\COURBI.TTF
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\MsiEs
C:\Windows\inf\netrasa.inf
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\translations\1053.lang
C:\WINDOWS\FONTS\COUR.TTF
C:\WINDOWS\FONTS\DAVID.TTF
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config
C:\WINDOWS\FONTS\ANGSAUB.TTF
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\LD4LURWZ.txt
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\ea543310204d0addfaf9792d820e958d\PresentationFramework.ni.dll
C:\Users\win7\AppData\Local\Temp\sqlite3.exe
C:\Users\win7\AppData\Local\Temp\autB14C.tmp
C:\Windows\Microsoft.NET\Framework\v3.0\WPF\wpfgfx_v0300.dll
C:\Users\win7\AppData\Local\Temp\WERE474.tmp.mdmp
C:\Users\win7\Links\desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs
C:\Windows\syswow64\api-ms-win-downlevel-ole32-l1-1-0.dll
C:\ProgramData
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\WSMan.format.ps1xml
C:\Python27\Lib\email\test\data\msg_41.txt
C:\Users\Default\AppData
C:\Users\win7\AppData\Local\Temp\21244e6e-e96b-444c-b1dc-f6d19955aa60\bin.dmc
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D84E548583BE1EE7DB5A935821009D26_1070D8A1DE1737B040B2F83EA6FA69E1
C:\opera_150_percent.pak.patch
C:\Users\win7\AppData\Local\Temp\pft2D5F~tmp\pftw1.pkg
C:\Program Files\Reimage\Reimage Repair\LZMA.EXE
C:\Users\win7\AppData\Local\Temp\IsProcessActive.txt
C:\WINDOWS\FONTS\MONBAITI.TTF
C:\WINDOWS\FONTS\DOKCHAMP.TTF
C:\localization\ko.pak.patch
tools\SDI\themes\metallic\unchecked.webp
C:\WINDOWS\FONTS\CONSTANI.TTF
C:\localization\ca.pak.patch
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\next[1].gif
C:\Python27\Lib\email\test\data\msg_22.txt
C:\localization\gd.pak.patch
C:\WINDOWS\FONTS\PALAI.TTF
tools\SDI\themes\metallic\checked.webp
C:\Users\win7\AppData\Local\Temp\{aba88724-37eb-4f03-b83b-45199c5a7cf5}\.ba1\mbahost.dll
C:\Users\win7\AppData\Local\Temp\is-5VJ0O.tmp\_isetup\_shfoldr.dll
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Truk
C:\Users\win7\AppData\Local\Temp\Setup_20150924173132_Failed.txt
C:\clearkeycdm.dll.asm_patch
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
C:\Users\win7\AppData\Local\Temp\nsm9F88.tmp\nsWeb.dll
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89Q863BS\button[1].png
C:\WINDOWS\FONTS\SIMPO.TTF
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\OECrossDetectionKey
C:\CFVS_HookDll.dll
C:\Windows\WindowsUpdate.log
C:\localization\hu.pak.patch
C:\Windows\inf\hdaudio.inf
C:\Users\win7\AppData\Roaming\uTorrent\utorrent.lng
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\decline[1].gif
C:\WINDOWS\FONTS\MINGLIUB.TTC
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RGC5OOPI\bodyImg[1].png
C:\Python27\Lib\email\test\data\msg_28.txt
C:\Users\Public\Desktop\desktop.ini
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Start Menu
C:\Python27\tcl\tcl8.5\tzdata\Pacific\Guam
__tmp_rar_sfx_access_check_1460875
C:\WINDOWS\FONTS\CONSOLAZ.TTF
C:\Windows\SysWOW64\usp10.dll
C:\Python27\Lib\email\test\data\msg_44.txt
C:\Users\win7\AppData\Local\Temp\is-5VJ0O.tmp\idp.dll
C:\Users\win7\AppData\Local\Temp\nss29BA.tmp\g
C:\Users\win7\AppData\Local\Temp\sample:Zone.Identifier
C:\Users\win7\AppData\Local\Google
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\dm_left_image[1].png
C:\Windows\syswow64\KERNEL32.dll
C:\Users\win7\AppData\Local\Temp\{aba88724-37eb-4f03-b83b-45199c5a7cf5}\.ba1\sqmapi.dll
C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\netavpna.cat
C:\WINDOWS\FONTS\MRIAMC.TTF
C:\localization\nb.pak.patch
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\downloader_version[1].xml
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0XGLEA4UD6NX92OILKCT.temp
C:\WINDOWS\FONTS\PLANTC.TTF
C:\Windows\System32
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\translations\1031.lang
C:\ProgramData\GlobalSCAPE\CuteFTP\sm.dat
C:\WINDOWS\FONTS\MALGUN.TTF
C:\Windows\SysWOW64\ole32.dll
\\.\PIPE\samr
C:\Windows\Microsoft Help
C:\WINDOWS\FONTS\BATANG.TTC
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Cookies\81052BHH.txt
C:\WINDOWS\FONTS\UTSAAHI.TTF
C:\WINDOWS\FONTS\UPCKB.TTF
C:\localization\es.pak.patch
C:\Users\win7\AppData\Local\Temp\is-5VJ0O.tmp\_isetup\_setup64.tmp
C:\Users\win7\AppData\Local\Temp\SymCCISDll.txt
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\.ba1\fr\thm.wxl
C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\1c3513960037508558358652f2d202a1\WindowsBase.ni.dll
C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H0G27RVV\decline[1].gif
C:\WINDOWS\FONTS\TAHOMABD.TTF
C:\WINDOWS\FONTS\UPCII.TTF
C:\Windows\SysWOW64\sspicli.dll
C:\Windows\System32\WScript.exe
C:\Users\win7\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\blbdrive.cat
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\translations\1048.lang
C:\Users\win7\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DB87D2AB058205E5452E4516D5631B
C:\Windows\SysWOW64\KERNELBASE.dll
C:\WINDOWS\FONTS\SMALLF.FON
C:\Users\win7\AppData\Local\Temp\091520~1\tmp2822.tmp
C:\WINDOWS\FONTS\MARLETT.TTF
Software\Microsoft\WBEM\CIMOM
NI\159a66b8\424bd4d8
SOFTWARE\OracleVirtualBox
CLSID\{D44CEDFE-7157-4cb5-A339-2CD1249A2153}
Folder
Software\Microsoft\Windows\CurrentVersion\Uninstall\Highlightly_1.9.0.3
Microsoft\Internet Explorer\Security
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Internet Explorer\JScript9
Software\Microsoft\.NETFramework
Software\InstalledBrowserExtensions\27058
Software\AVAST Software
SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Cache
FEATURE_DOCUMENT_COMPATIBLE_MODE
Microsoft\Internet Explorer\Low Rights
Software\Microsoft\.NETFramework\Policy\Standards
policy.2.0.System.EnterpriseServices__b03f5f7f11d50a3a
Software\Microsoft\Windows\CurrentVersion\UninstallASPackage
Software\WaNetEnhance
Software\WIntEnhance
Software\Microsoft\Windows\Windows Error Reporting\Debug
FEATURE_LAZIER_IMAGE_DECODING
{1409cd30-b4f5-4078-86aa-9b8c995c7d0c}
Software\Microsoft\Windows NT\CurrentVersion
SOFTWARE\Wow6432Node\Microsoft
SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
Software\Policies\Microsoft\Internet Explorer\Main
Software\SpeedCheck
Software\Microsoft\DXGI
Software\Microsoft\Windows\CurrentVersion\Uninstall\InfoAtoms_1.6.0.1
FEATURE_READ_ZONE_STRINGS_FROM_REGISTRY
Software\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
NI\340dcf4c\3a6a696d
SOFTWARE\Flashbeat
Software\WajaNEnhance
policy.2.0.System.Deployment__b03f5f7f11d50a3a
ActiveX Compatibility\{ADC6CB82-424C-11D2-952A-00C04FA34F05}
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
SOFTWARE\SearchModulePlus
{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
SOFTWARE\Wow6432Node\Flowsurf
FEATURE_COMPAT_USE_CONNECTION_BASED_NEGOTIATE_AUTH_KB2151543
SOFTWARE\PicColor Utility
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C42C5197-0EE9-4940-893B-F4EF047DFF0F}
109F1CAED645BB78B3EA2B94C0697C740733031C
SOFTWARE\BoBrowser
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BoBrowser
Software\WajNetEnhancer
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{69DC4768-446B-4F82-A6B0-63966A243064}
Microsoft\Windows\CurrentVersion\Internet Settings\Url History
FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562
Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224
SYSTEM\CurrentControlSet\Services\Tcpip\Linkage
FEATURE_USE_SECURITY_THUNKS
Software\WNEnhancer
Software\WajaIntEnhance
SOFTWARE\AVAST Software\Avast
Software\Rtp
SOFTWARE\1stBrowser
VersionIndependentProgID
Software\ROBLOX Corporation\Roblox
FEATURE_USE_CNAME_FOR_SPN_KB911149
Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
Software\WWebEnhance
{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
FEATURE_DISABLE_INTERNAL_SECURITY_MANAGER
Software\WaInterEnhancer
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
FEATURE_XSSFILTER
Software\Policies\Microsoft\Internet Explorer\International\Scripts
{000C10F1-0000-0000-C000-000000000046}
SOFTWARE\Goobzo
policy.1.0.Microsoft.PowerShell.Commands.Utility__31bf3856ad364e35
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Policies\Microsoft\Windows\Installer
Software\Microsoft\Avalon.Graphics
FEATURE_ENABLE_CLIPCHILDREN_OPTIMIZATION
SOFTWARE\Policies\Microsoft\Windows\Installer
SOFTWARE\Classes\CLSID\{ccb24e92-62c4-4c53-95d2-65f9eed476bc}
SOFTWARE\5da059a482fd494db3f252126fbc3d5b
SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback
policy.2.0.System.Security__b03f5f7f11d50a3a
SOFTWARE\Opera Software
Software\WajWebEnhancer
Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar
Software\Microsoft\Fusion
Software\Avast
SOFTWARE\ESET
Software\Microsoft\Windows\CurrentVersion\Uninstall\TermTrident_1.10.0.22
{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
SOFTWARE\Classes\PROTOCOLS\Filter\text/html
Software\WajIEnhance
SOFTWARE\Microsoft\Windows\Cu\rrentVersion\Uninstall\BoBrowser
SYSTEM\CurrentControlSet\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0009
Software\Microsoft\SystemCertificates\Disallowed\PhysicalStores
SOFTWARE\WordSurfer_1.10.0.19
SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
Software\Policies\Microsoft\Internet Explorer\PrefetchPrerender
{cfe68b1e-656a-488b-8077-738ca67ba3a5}
EUDC\1252
Software\WajNetworkEnhancer
Software\Vosteran Browser
SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance
Software\WNetEnhance
4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5
Software\WajaNetworkEnhancer
NI\181938c6\7950e2c5\16
Software\Microsoft\Windows\CurrentVersion\Uninstall\RapidReader_1.10.0.21
Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl
Recovery
SOFTWARE\AVAST Software
SOFTWARE\Classes\avast
Software\AppDataLow\Software\BlockAndSurf
FEATURE_HTTP_USERNAME_PASSWORD_DISABLE
Software\WajNEnhance
FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\mbam.exe
SOFTWARE\PhraseProfessor_1.10.0.24
FEATURE_PROTOCOL_LOCKDOWN
Software\tstamptoken
Software\Microsoft\Internet Explorer\Main
SYSTEM\CurrentControlSet\Control\Nls\CodePage
Software\Policies\Microsoft\Internet Explorer\IEDevTools\Options
IL\7b5311d7\1b0ed4d\39
Software\Microsoft\Internet Explorer\Main\FeatureControl
NI\3e571dbb\41bddfc6
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp
Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3979321414-2393373014-2172761192-1000
SOFTWARE\csdimedia
Settings
Software\Policies
Software\Microsoft\Windows\CurrentVersionUninstall\TermTrident_1.10.0.22
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{43C3D832-AC96-463A-2003-1B8D1BFA252T}
SOFTWARE\Doctor Web
Software\WIntEnhancer
CLSID\{BC1DDB0D-4663-40bd-812C-12EC1D2EE97C}
IL\475dce40\1c022996\5b
System\Setup
Software\InstalledBrowserExtensions\Plus HD
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IQIYI Video
FEATURE_FIX_CHUNKED_PROXY_SCRIPT_DOWNLOAD_KB843289
S-1-5-21-3979321414-2393373014-2172761192-1000
FEATURE_SPELLCHECKING
FEATURE_HIGH_RESOLUTION_AWARE
International
Software\Ghisler\Total Commander
Software\Microsoft\Windows\CurrentVersionUninstall\TermTrident_1.10.0.24
FEATURE_MAXCONNECTIONSPER1_0SERVER
Software\CheckPoint
FEATURE_SCH_SEND_AUX_RECORD_KB_2618444
FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001
FEATURE_DISPLAY_NODE_ADVISE_KB833311
Software\Fast-Search
cloddier.duding.1
FEATURE_PERMIT_CACHE_FOR_AUTHENTICATED_FTP_KB910274
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\I - Cinema
Software\WaWebEnhance
SOFTWARE\Microsoft\Windows\CurrentVersion\Parental Controls\users\S-1-5-21-3979321414-2393373014-2172761192-1000
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
{603BCC1F-4B59-4E08-B724-D2C6297EF351}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NSBU
Software\FastSearch
{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
FEATURE_IGNORE_MAPPINGS_FOR_CREDPOLICY
DOMStorage
Software\Microsoft\Windows\CurrentVersion\Uninstall\BetterBrain_1.10.0.9
Software\WajIEnhancer
Software\WajaInternetEnhance
CTLs
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8EBAEC61-5A07-49F6-9CDF-2E6746F5465A}
SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{CFE68B1E-656A-488B-8077-738CA67BA3A5}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7ADF667E-E14D-4D2C-827C-B0108F0D93BC}
Software\Microsoft\Windows\CurrentVersion\Uninstall\WordSurfer_1.10.0.20
SOFTWARE\Microsoft\Internet Explorer\LinksBar\ItemCache\0
FEATURE_TOPMOST_GWND
FEATURE_SKIP_POST_RETRY_ON_INTERNETWRITEFILE_KB895954
CLSID\{2E3EBFCA-0815-4961-A617-3C06976B77FC}
NI\61e7e666\c991064\a
Software\AppDataLow\Software\SpeeditUp
Microsoft\Windows\CurrentVersion\Internet Settings
Software\Wow6432Node\DtsEncodeTools
Software\Microsoft\Windows NT\CurrentVersion\PeerDist\Service
FEATURE_ARIA_SUPPORT
MenuExt
Software\WajNEnhancer
System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces
SYSTEM\CurrentControlSet\Services\EventLog
Windows PowerShell
SOFTWARE\Avg
Directory
Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing
Software\Microsoft\Windows\CurrentVersion\UninstallEppink
policy.2.0.Accessibility__b03f5f7f11d50a3a
SOFTWARE\VMware
SOFTWARE\G Data
Segoe UI
SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\InclusionList
SOFTWARE\McAfee
#2008
Software\Microsoft\SystemCertificates\TrustedPublisher\Safer
S-1-5-21-3979321414-2393373014-2172761192-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
FEATURE_LAZY_IMAGE_DECODING
Software\Microsoft\Windows\Windows Error Reporting
NI\76c6ce9a\53ba442c
Zoom
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
SOFTWARE\Classes\CLSID\{90128821-e848-437c-999b-1b4eb986947a}
FEATURE_LEGACY_DISPPARAMS
86E817C81A5CA672FE000F36F878C19518D6F844
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Opera 22.0.1471.50
policy.3.0.WindowsBase__31bf3856ad364e35
SOFTWARE\Microsoft\Windows Script
Software\Microsoft\Cryptography\OID
CurVer
Software\WajInterEnhance
PROTOCOLS\Name-Space Handler\http\
Software\AppDataLow\Software\CinemaP-1.3c
FEATURE_DISABLE_NAVIGATION_SOUNDS
Software\WajaIntEnhancer
PROTOCOLS\Name-Space Handler\
Post Platform
SOFTWARE\Microsoft\Windows Search\ProcessedSearchRoots\0002
SOFTWARE\Beamrise
FEATURE_MIME_HANDLING
Software\Microsoft\Direct3D
<NULL>
Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Certificates
CLSID
1.3.6.1.4.1.311.16.1.1
oftware\WNetworkEnhance
SOFTWARE\Microsoft\Reliability Analysis\RAC
cloddier.duding
{0470fb84-3e8e-43f9-a5dc-150168dae9c8}
{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Opera 25.0.1614.50
Software\Microsoft\Windows\CurrentVersionUninstall\TermCoach_1.10.0.24
Software\WajInterEnhancer
Software\Microsoft\Windows\Windows Error Reporting\Throttling\CLR20r3
Software\WNetworkEnhancer
FEATURE_MAXCONNECTIONSPERSERVER
Software\Microsoft\Windows\CurrentVersion
SOFTWARE\Norton
Software\WajIntEnhance
FEATURE_ZONE_ELEVATION
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A3C7D36-A78F-4832-9417-E519E9F4DAC1}
policy.3.0.PresentationCore__31bf3856ad364e35
Software\McAfee Software
Software\WaIntEnhance
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{27C41D5E-53C8-4033-BAD0-1F1BC926AB5C}
SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{44B436FA-FB33-4B24-8AD1-D8C9A50474E9}
Software\WajWebEnhance
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}
3A850044D8A195CD401A680C012CB0A3B5F8DC08
policy.3.0.ReachFramework__31bf3856ad364e35
FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK
Software\WaIEnhancer
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xps
SOFTWARE\Microsoft\Windows NT\CurrentVersion
Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections
Software\Microsoft\Windows\CurrentVersion\UninstallYSPackage
PrefetchPrerender
SOFTWARE\DoReMe
Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
SOFTWARE\{44C29802-3946-42EC-BA6B-EB0953B5CE31}
v2.0.50727
Software\Microsoft\Windows\CurrentVersion\Uninstall\SearchSnacks_1.10.0.6
GDSetup\Components\{39FB83FC-9596-43A5-938F-A5F55C41F930}\R_Scanner_GData_Engine
Content
SOFTWARE\SmartPurpleConf
SOFTWARE\Wow6432Node\FastSearch
Default
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PPStream
SYSTEM\CurrentControlSet\Services\avast! Antivirus
Software\WajaIEnhancer
2B84BFBB34EE2EF949FE1CBE30AA026416EB2216
CEA586B2CE593EC7D939898337C57814708AB2BE
SOFTWARE\{C1856559-BA5C-41B7-961C-677E89A2C490}
IL\75638fee\27002c8f\5a
SOFTWARE\Microsoft\Windows\CurrentVersion\Action Center
Main
SOFTWARE\OpenVPN
CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
FEATURE_OLEALIAS_GWND
GDSetup\Components\{7ABCB3E6-8A8F-4F2B-B357-304170A132D7}\R_Scanner_GData
Software\Microsoft\Windows\CurrentVersion\UninstallConnection Manager
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VOPackage
GDSetup\Components\{30E36983-4329-4538-B296-27D9ECDCB571}\R_Scanner_GData
Safety\Tracking Protection Exceptions
Software\Microsoft\Windows\CurrentVersion\Uninstall\WordShark_1.10.0.19
Software\Microsoft\Windows\CurrentVersion\Uninstall\WordShark_1.10.0.20
ActiveX Compatibility\{16D51579-A30B-4C8B-A276-0FF4DC41E755}
Software\AppDataLow\Software\CheckMeUp
FEATURE_ENABLE_PROXY_CACHE_REFRESH_KB2983228
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Standards
Software\Nosibay\Bubble Dock Tag
SOFTWARE\Classes\PROTOCOLS\Handler\about
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Software\Avg
NI\30bc7c4f\3f50fe4f\18
IL\6e35940e\c92739a\59
Software\InstalledBrowserExtensions\19979
SOFTWARE\CrossBrowser
CLSID\{3050F406-98B5-11CF-BB82-00AA00BDCE0B}
Software\Microsoft\Ftp
SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}
System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}
Consent
Software\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}
FEATURE_DATABINDING_SUPPORT
CRLs
FEATURE_USE_UTF8_FOR_BASIC_AUTH_KB967545
Fontcore
Software\Policies\Microsoft\Internet Explorer\ActiveX Compatibility\{16D51579-A30B-4C8B-A276-0FF4DC41E755}
SOFTWARE\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.100
SessionInfo\1
{DE351A42-8E59-11D0-8C47-00C04FC295EE}
FEATURE_WEBOC_DOCUMENT_ZOOM
{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
Software\Microsoft\Windows\CurrentVersionUninstall\PhraseProfessor_1.10.0.22
Software\Microsoft\EnterpriseCertificates\Disallowed\PhysicalStores
Software\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots
EncodingType 0
Viewport
Styles
PowerShell
FEATURE_RETURN_FAILED_CONNECT_CONTENT_KB942615
SOFTWARE\shopperz12082015
Software\Microsoft\Windows\CurrentVersion\Uninstall\Quiknowledge_1.9.0.3
7D7F4414CCEF168ADF6BF40753B5BECD78375931
AllFilesystemObjects
FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS
SOFTWARE\Microsoft\Windows\CurrentVersion\Telephony\HandoffPriorities\MediaModes
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Opera 27.0.1689.54
Script
policy.1.0.System.Management.Automation.resources_en-US_31bf3856ad364e35
Software\Microsoft\Windows\CurrentVersion\Uninstall\WordSurfer_1.10.0.19
FEATURE_SOFTWARE_FILTER_RENDERING
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace
SOFTWARE\{8B261394-6C7D-4CFC-A767-E02F34A60D8B}
SYSTEM\CurrentControlSet\services\wbsvc
FEATURE_ENABLE_COMPAT_LOGGING
SOFTWARE\{57C1F957-89AE-41F3-9E2B-18EB4A7F9731}
SOFTWARE\Microsoft\Windows Script\Features
IEDevTools\Options
SOFTWARE\Ikarus
System\CurrentControlSet\Control\Keyboard Layouts\04090409
SOFTWARE\WebBar
NI\5a8de2c3\2b1a4e4
MIME\Database\Content Type\text/xml
PROTOCOLS\Name-Space Handler\*\
Software\Microsoft\Windows\CurrentVersion\Uninstall\WeatherTool
SOFTWARE\Classes\CLSID\{42ab629f-6fd1-44e2-9a7f-4cbfea37e4bf}
Software\Apple Computer
Software\Policies\Microsoft\Internet Explorer
Software\AppDataLow\Software\SpeedChecker
Software\SpeedChecker
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
SOFTWARE\Microsoft\IMEJP\10.0\Window
000000000005
FEATURE_ALLOW_WINDOW_PUTNAME_CROSS_DOMAIN
SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3979321414-2393373014-2172761192-1000\Installer\Assemblies\C:|sample
policy.1.0.Microsoft.WSMan.Management.resources_en-US_31bf3856ad364e35
Software
NI\7ac727df\7b5311d7\22
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VuuPC
FEATURE_PRESERVE_SPACES_IN_FILENAMES_KB952730
Software\Ghisler\Windows Commander
2A83E9020591A55FC6DDAD3FB102794C52B24E70
RETRY_HEADERONLYPOST_ONCONNECTIONRESET
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Avast
Software\Microsoft\Windows\CurrentVersion\Uninstall\Note-up
CLSID\{D52F7CE0-A4BA-4220-A907-444CB6158A09}
SOFTWARE\Iminent
Software\Policies\Microsoft\SystemCertificates\TrustedPeople
Software\Microsoft\Windows\CurrentVersion\UninstallIE5BAKEX
SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\ExclusionList
Software\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
FEATURE_URLMON_IQDA_SIZE
Software\AppDataLow\Software\CheckMeApp
FEATURE_BYPASS_CACHE_FOR_CREDPOLICY_KB936611
Software\FlashFXP
Software\Policies\Microsoft\Internet Explorer\Zoom
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe
Software\Microsoft\PowerShell
ts
SOFTWARE\CinemaP-1.3c
Software\CheckMeUp
SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{CFE68B1E-656A-488B-8077-738CA67BA3A5}\Connection
Software\ESET
SOFTWARE\Symantec
FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{055FBA0A-DDF0-42DB-B914-4880C3D2DE12}
Software\Microsoft\Windows\CurrentVersion\Uninstall\LinkWiz_1.10.0.14
SOFTWARE\Comodo
SOFTWARE\Panda Software
Software\Microsoft\Windows\CurrentVersion\Uninstall\QuickSurf_1.10.0.20
FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615
PropertyBag
SOFTWARE\LolyKey
Software\Policies\Microsoft\Windows\Windows Error Reporting
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\Handler
Software\Policies\Microsoft\PeerDist\Service
Software\WaNEnhance
Software\AppDataLow\Software\SpeedCheck
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{28891990-8598-4A38-93D6-7C7C978A686E}
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
#2000
NI\20fe3c1a\56aa3966
SOFTWARE\Microsoft\Internet Explorer\InternetRegistry
SOFTWARE\Classes\CLSID\{193b40dd-1d63-4025-8c4d-b8bb042442da}
FEATURE_SHIM_MSHELP_COMBINE
SOFTWARE\Smartbar
Security\Floppy Access
Software\WaInterEnhance
#2009
Software\Policies\Microsoft\SystemCertificates\AuthRoot
Software\Microsoft\Windows\CurrentVersion\Uninstall\WordProser_1.10.0.9
Software\Microsoft\Windows\CurrentVersion\Uninstall\WordAnchor_1.10.0.19
Clsid
Application Compatibility
FEATURE_BUFFERBREAKING_818408
Upgrades
C060ED44CBD881BD0EF86C0BA287DDCF8167478C
SOFTWARE\{9E6892AE-EDB8-490A-9FDD-5A9770E7909E}
SOFTWARE\LolliScan
Software\Microsoft\Windows\CurrentVersion\Uninstall\QuickSurf_1.10.0.19
SOFTWARE\Microsoft\Windows\CurrentVersion\Action Center\Providers
Software\InstalledBrowserExtensions\30935
SOFTWARE\Classes\CLSID\{32cf5a7d-f785-42ee-b97f-4c53ea70e6ed}
SOFTWAREMicrosoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop
physis.dextrous
BrowserStorage\AppCache
SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70
SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\32
EncodingType 1
SOFTWARE\Avast
Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7
Software\Microsoft\Windows\CurrentVersion\Policies\System
Internet Explorer
{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}
policy.2.0.System.Configuration.Install__b03f5f7f11d50a3a
Software\Tencent\QQPCMgr
Software\Speedchecker Limited\PC Speed Up
Software\WNetEnhancer
SOFTWARE\OlciniumBrowser
SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\InstalledThemes
Software\BlockAndSurf
Software\Microsoft\Net Framework Setup\NDP\v3.0\Setup\Windows Presentation Foundation
FEATURE_EXCLUDE_INVALID_CLIENT_CERT_KB929477
{babe9b11-0f98-11e5-b301-806e6f6e6963}\
SOFTWARE\Microsoft\PowerShell
Software\InstalledBrowserExtensions\HQ-Video
Software\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1
Software\Microsoft\Direct3D\Drivers
{5E6C858F-0E22-4760-9AFE-EA3317B67173}
Software\Microsoft\Direct3D\DX6TextureEnumInclusionList
18F7C1FCC3090203FD5BAA2F861A754976C8DD25
MS Shell Dlg 2
SOFTWARE\Classes\CLSID\{88d8ecb7-204f-4efd-8134-f6341f76c672}
Software\Embarcadero\Locales
FEATURE_INCLUDE_PORT_IN_SPN_KB908209
LocalServer32
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
SOFTWARE\Microsoft\Windows NT\CurrentVersion\msasn1
CryptSIPDllIsMyFileType2
v2.0
SOFTWARE\Classes\CLSID{4AA46D49-459F-4358-B4D1-169048547C23}
SOFTWARE\AppDataLow\Software
Software\Microsoft\Windows\CurrentVersion\Uninstall\TermCoach_1.10.0.22
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare 3_is1
SOFTWARE\Classes\PROTOCOLS\Filter\image/gif
CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}
S-1-5-21-3979321414-2393373014-2172761192-1000\Software\Microsoft\Installer\Products\22BEFC8F7E2A1793E9ADB411DEFE1C58
SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates
{3d3783a2-703a-11de-8c7a-806e6f6e6963}
Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.torrent
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sample
policy.2.0.System.Drawing__b03f5f7f11d50a3a
Software\McAfeeInstallIntegrator
Software\Microsoft\Windows\CurrentVersion\Uninstall\WordAnchor_1.10.0.18
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad
InprocServer32
AppEvents\Schemes\Apps\Avast
SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\CRLs
Software\WWebEnhancer
Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Safer
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77E7AE5C-181C-4CAF-ADBF-946F11C1CE26}
Software\Microsoft\Windows\CurrentVersion\UninstallWIC
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\AU
FEATURE_LOCALMACHINE_LOCKDOWN
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A36B158D-8E9D-4BD3-8BDA-4B5EDC9C2E8C}
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\VOPackage
SOFTWARE\Wow6432Node\key-findSOFTWARE\Wow6432Node\key-findhp
Software\WajaWebEnhancer
Control Panel
FEATURE_FEEDS
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC
Advanced
Software\Microsoft\Internet Account Manager\Accounts
Text Scaling
Software\Classes\CLSID\{BECFD49B-FA50-441D-8C4E-B84EEA87FAC9}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Tools Security for Netbooks_is1
97817950D81C9670CC34D809CF794431367EF474
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp\Tracing
Software\WajInternetEnhance
FEATURE_FORCE_DISABLE_UNTRUSTEDPROTOCOL
Software\WajaInternetEnhancer
FEATURE_DIGEST_NO_EXTRAS_IN_URI
SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore
Software\Microsoft\Windows
Software\Microsoft\PowerShell\1\PowerShellEngine
SOFTWARE\YTDownloader
CLSID\{3ea54411-9f2a-4a18-a93a-84312350f7c1}
DocObject
Software\WajIntEnhancer
SYSTEM\CurrentControlSet\Control\Class\{4d36e96a-e325-11ce-bfc1-08002be10318}\0000
FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120
Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
SOFTWARE\Microsoft\CTF\KnownClasses
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1
FEATURE_DISABLE_DEFERRED_IMAGE_DOWNLOAD
SOFTWARE\Policies\Microsoft\SystemCertificates
Software\IneedSpeed
SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}
{03B5835F-F03C-411B-9CE2-AA23E1171E36}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
FEATURE_WEBSOCKET
Software\WaWebEnhancer
Software\Microsoft\Windows\CurrentVersion\Uninstall\SearchQuest_1.10.0.24
SOFTWARE\Microsoft\SystemCertificates
Software\WNEnhance
IL\3a6a696d\59152bf2\4a
Software\WInterEnhance
SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{CFBFAE00-17A6-11D0-99CB-00C04FD64497}
NI\76f08412\6ac8051a
SOFTWARE\Panda
Software\WaInternetEnhancer
Software\AppDataLow\Software\Safer-Surf
Software\Microsoft\Internet Explorer
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe
FEATURE_XDOMAINREQUEST
Software\AppDataLow\Software\GenericAddon
NI\6eae2d34\3b249b34\1
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf
CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}
NI\340dcf4c\3a6a696d\3
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoneAlarm
FEATURE_PROCESS_XML_AS_HTML
FEATURE_ENABLE_PERFWIDGET_EXTRA_INFO
FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW
Software\Microsoft\Windows\CurrentVersion\Uninstall\TermCoach_1.10.0.21
CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}
Software\WaNetworkEnhancer
policy.2.0.System.Windows.Forms__b77a5c561934e089
Software\Microsoft\Cryptography
SOFTWARE\{43026FDD-1104-41C8-B570-5E9A3D7D8152}
FEATURE_PASTE_IMAGE_DATAURI
SOFTWARE\WordShark
{69DC4768-446B-4F82-A6B0-63966A243064}
SOFTWARE\shopperz
Software\Microsoft\Windows\Shell\RegisteredApplications\UrlAssociations\Directory\OpenWithProgids
Version
Software\Policies\Microsoft\Internet Explorer\ActiveX Compatibility\{ADC6CB82-424C-11D2-952A-00C04FA34F05}
Software\Microsoft\Windows\CurrentVersion\Uninstall\TermTutor_1.10.0.1
Software\FileZilla
FEATURE_DISALLOW_NULL_IN_RESPONSE_HEADERS
policy.1.0.Microsoft.PowerShell.ConsoleHost.resources_en-US_31bf3856ad364e35
SOFTWARE\Wow6432Node\Microsoft\WindowsCurrentVersion\Uninstall\I - Cinema
LocalIntranet
FEATURE_MIME_USE_BUILTIN_ACCEPT_HEADERS
Software\Microsoft\Windows\CurrentVersion\UninstallIE40
SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN
FEATURE_CROSS_DOMAIN_REDIRECT_MITIGATION
Larger Hit Test
Software\Wow6432Node\TabNav
System
SOFTWARE\Classes\CLSID\{096b81ea-be98-4454-950f-8447f4abe833}
Software\WaNetEnhancer
Software\Microsoft\Installer\Assemblies\C:|Windows|SysWOW64|WindowsPowerShell|v1.0|powershell.exe
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{17D894FE-B31B-433C-B78D-01DAC8D31DC0}
Software\Microsoft\Windows\CurrentVersionUninstall\RapidReader_1.10.0.22
FEATURE_ENABLE_PASSPORT_SESSION_STORE_KB948608
Software\Google\Update\ClientState\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}
SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\Interfaces\{3D3783A2-703A-11DE-8C7A-806E6F6E6963}
1F62F885-1398C2AF
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
Scripts
FEATURE_PAINT_INSIDE_WMPAINT
.torrent
FEATURE_96DPI_PIXEL
SYSTEMCurrentControlSetServicesVuuPCConnectivity
Internet
Software\Microsoft\Windows\CurrentVersion\Uninstall\CleverSearch_1.10.0.19
SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime
FEATURE_USE_WEBOC_OMNAVIGATOR_IMPLEMENTATION
FEATURE_REDUCE_RENDER_AHEAD_CACHE
Software\WajaIEnhance
SOFTWARE\Classes\CLSID\{8244CE7C-A878-4BE9-8B6B-19206DA348C2}
KnownFolders
{1A610570-38CE-11D4-A2A3-00104BD35090}
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F252F215-5CA5-4643-BCD2-62E4BE7F940E}
Software\RGMservice
B533345D06F64516403C00DA03187D3BFEF59156
Software\Microsoft\Installer\Assemblies\C:|sample
FEATURE_CLEANUP_AT_FLS
Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
NI\13b06edc\3d40437
kemps.negaton.1
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9282A887-261F-4E57-85A0-086C89A4C665}
policy.2.0.System.Configuration__b03f5f7f11d50a3a
Software\AppDataLow\Software\IneedSpeed
Software\TurboFTP
Software\Policies\Microsoft\Internet Explorer\DOMStorage
{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6
index1c2
IL\528efda8\3dbff305\53
Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
Software\Microsoft\Windows\CurrentVersion\Explorer\TravelLog
NI\6faf58\19ab8d57
FEATURE_MOBILE_CUSTOMIZATIONS
IL\43f5e26f\3b5d08db\6e
Software\Microsoft\Windows\CurrentVersion\Uninstall\Wordinator_1.10.0.19
Software\Microsoft\Windows\CurrentVersion\Uninstall{E2B51919-207A-43EB-AE78-733F9C6797C3}
SOFTWARE\Wow6432Node\mystartsearchSOFTWAREWow6432Node\mystartsearchhp
policy.2.0.System.Data__b77a5c561934e089
IL\7950e2c5\4b5f28af\5f
SOFTWARE\WordSurfer
ProgID
SOFTWARE\Classes\CLSID\{F1F0CBDA-5D80-47BA-9A7E-BD9E8C1883A2}
Software\Avira
Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
FEATURE_ALLOW_HIGHFREQ_TIMERS
FEATURE_MSHTML_AUTOLOAD_IEFRAME
NameSpace_Catalog5
CLSID\{16D51579-A30B-4C8B-A276-0FF4DC41E755}
TreatAs
FEATURE_SHOW_CERT_WARNINGS_ON_POST_FROM_ISTREAM_KB2894776
FEATURE_GPU_RENDERING
Software\Flowsurf
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mbot_id_014010032_is1
Software\WajaNetEnhance
Software\WaNetworkEnhance
MS Sans Serif
Software\Opera Software
policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
61793FCBFA4F9008309BBA5FF12D2CB29CD4151A
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NUIns
Software\Microsoft\SystemCertificates\TrustedPeople\PhysicalStores
Software\Microsoft\Windows\CurrentVersion\Uninstall\IntelliTerm_1.10.0.13
SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
Software\Microsoft\RestartManager
Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData
IL\6dc7d4c0\c47ad54\56
SOFTWARE\Classes\CLSID\{a4ad8fd9-b395-43e3-88b5-240710b48e27}
SOFTWARE\Microsoft\Windows Mail\Trident\Main
SOFTWARE\Classes\Installer\Assemblies\C:|sample
Tahoma
Software\PowerPack
SOFTWARE\X-AVCSD
Software\Policies\Microsoft\Internet Explorer\Settings
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
Software\Microsoft\Windows\CurrentVersion\Uninstall\PhraseProfessor_1.10.0.21
System\CurrentControlSet\Control\Keyboard Layouts\041F0409
FA6660A94AB45F6A88C0D7874D89A863D74DEE97
SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3979321414-2393373014-2172761192-1000\Installer\Assemblies\Global
00000005
SOFTWARE\Microsoft\Windows\CurrentVersion\UrlMon Settings
Software\Microsoft\Windows\CurrentVersion\Uninstall\ClickCaption_1.10.0.9
SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}
Security
SOFTWARE\Microsoft\Windows\CurrentVersion\Screensavers\Bubbles\Screen 1
Ldap
Software\Classes\CLSID\{BAABBF07-7232-4EE2-96E5-C45AE99F6D72}
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID
policy.8.0.Microsoft.JScript__b03f5f7f11d50a3a
CertDllOpenStoreProv
Cookies
D4DE20D05E66FC53FE1A50882C78DB2852CAE474
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7E5CDECB-726B-4581-BA8C-5B11148C3FA5}
Software\Microsoft\Windows\CurrentVersion\Uninstall\CleverSearch_1.10.0.17
SYSTEM\CurrentControlSet\Services\avast! Antivirus
IL\5b43ba09\32355fde\4e
Software\WInternetEnhance
CLSID\{08ACFB57-8187-47f0-AF93-56360D03634A}
FEATURE_CUSTOM_IMAGE_MIME_TYPES_KB910561
IL\19ab8d57\c91dbb2\5e
Software\Microsoft\Windows\CurrentVersionUninstall\PhraseProfessor_1.10.0.24
Software\Microsoft\Internet Explorer\PageSetup
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\avast5
SOFTWARE\Classes\CLSID\{cf4032f0-2dc7-4311-8516-8f8b0da1a903}
FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING
Software\Microsoft\Windows\CurrentVersion\Uninstall\{373B1718-8CC5-4567-8EE2-9033AD08A680}
FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454
Software\Policies\Microsoft\Internet Explorer\Recovery
svchost
Software\Microsoft\Windows\CurrentVersion\Uninstall\WordAnchor_1.10.0.20
Software\Microsoft\CTF\DirectSwitchHotkeys
FEATURE_BINARY_CALLER_SERVICE_PROVIDER
NI\159a66b8\424bd4d8\17
Keyboard Layout\Toggle
SOFTWARE\Clara
51C3247D60F356C7CA3BAF4C3F429DAC93EE7B74
Software\Microsoft\Windows\CurrentVersion\Uninstall\QuickSurf_1.10.0.18
BrowseInPlace
FEATURE_MIME_SNIFFING
SOFTWARE\Microsoft\BidInterface\Loader
Software\WajaNEnhancer
Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3979321414-2393373014-2172761192-1000\Installer\Products\91915B2EA702BE34EA8737F3C976793C
SOFTWARE\Microsoft\CTF\TIP\
Software\AppDataLow\Software\WikiTime
Software\Microsoft\Windows\CurrentVersion\Uninstall\Wordinator_1.10.0.20
Software\WajNetEnhance
FEATURE_SUBDOWNLOAD_LOCKDOWN
SOFTWARE\shopper-z
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{22E9CF2B-4063-4dab-A251-93FA46F7DECC}_is1
SYSTEM\CurrentControlSet\Control\Class\{745a17a0-74d3-11d0-b6fe-00a0c90f57da}\0000
Software\Microsoft\Windows\CurrentVersion\Uninstall\PhraseFinder_1.10.0.13
Software\Microsoft\Windows\CurrentVersion\UninstallIEData
SOFTWARE\Internet Browser
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
Software\Microsoft\Windows\CurrentVersion\Uninstall\WordSurfer_1.10.0.17
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\McAfee SiteAdvisor
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Max Driver Updater_is1
SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}
SOFTWARE\Sicent
FEATURE_ENABLE_WEB_CONTROL_VISUALS
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
Software\BPFTP\Bullet Proof FTP\Main
MIME\Database\Content Type\text/html
Software\SpeeditUp
policy.3.0.UIAutomationTypes__31bf3856ad364e35
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{706CF16D_480D_4CB8_B81F_30688E745B62}
NI\3d67735\6e35940e\11
CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}
AdvancedOptions\DISAMBIGUATION
SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{81A25967-DB85-4B48-A8A7-D25AC191DEE4}
Software\Microsoft\Internet Explorer\AdvancedOptions\DISAMBIGUATION
policy.2.0.System.ServiceProcess__b03f5f7f11d50a3a
SOFTWARE\Classes\CLSID\{B1FDB64C-07AC-4B60-AEF7-EE65437BE4C6}
IL\2dd6ac50\553abeb3\58
Software\Policies\Microsoft\SystemCertificates\ChainEngine\Config
SOFTWARE\Wow6432Node\ESET
Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
SOFTWARE\Appiance
Software\Microsoft\CTF\LayoutIcon\0409\0000041f
Software\Microsoft\Windows\CurrentVersion\UninstallMobileOptionPack
Software\WajInternetEnhancer
Software\Microsoft\Internet Explorer\Safety\Tracking Protection Exceptions
policy.2.0.System.Management__b03f5f7f11d50a3a
FEATURE_IEDDE_REGISTER_URLECHO
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40
52-54-00-12-35-02
Microsoft\Internet Explorer\Feeds
Software\Borland\Delphi\Locales
Software\Microsoft\MSDTC\Tracing
International\Scripts
SOFTWARE\Microsoft\CTF\Compatibility\sample
Software\Policies\Microsoft\Windows\Explorer
SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers
Software\Microsoft\Windows\CurrentVersion\Uninstall\CleverSearch_1.10.0.20
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\Driver
Software\WInterEnhancer
Software\WajaNetworkEnhance
Software\Classes\CLSID\{BAABBF07-7232-4EE2-96E5-C45AE99F6D72}
IL\7f3aad1e\165f8aa0\55
FEATURE_IEDDE_REGISTER_PROTOCOL
SYSTEM\CurrentControlSet\Control\Class\{4d36e96f-e325-11ce-bfc1-08002be10318}\0000
{7bb6f64f-46f0-414a-93b5-662a065eeea7}
Software\Pservice
Software\Microsoft\Windows\CurrentVersion\Uninstall{f65db027-aff3-4070-886a-0d87064aabb1}
Interface\{00000134-0000-0000-C000-000000000046}
policy.2.0.System.Data.SqlXml__b77a5c561934e089
HTML Help
SOFTWARE\Microsoft\wfs
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Bitdefender
{babe9b14-0f98-11e5-b301-806e6f6e6963}\
SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates
FEATURE_RESPECT_OBJECTSAFETY_POLICY_KB905547
Software\Microsoft\Windows\CurrentVersion\Uninstall\LessTabs_1.8.2.0
SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy
SOFTWARE\Microsoft\Updates\UpdateExeVolatile
qqlive
IL\141dfd70\41a2a33b\d
Software\Microsoft\Windows\CurrentVersionUninstall\WordWizard_1.10.0.22
PROTOCOLS\Name-Space Handler\C\
Software\Microsoft\Windows\CurrentVersion\Uninstall\WordFly_1.10.0.15
Software\Policies\Microsoft\Cryptography
SOFTWARE\Hintsoft
Pre Platform
Software\Avast Software
NI\19aba884\259d21de
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Accepted Documents
Software\WajaWebEnhance
1.2.840.113549.1.9.16.2.2
SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0005
FEATURE_RESTRICT_FILEDOWNLOAD
FEATURE_DISABLE_NOTIFY_UNVERIFIED_SPN_KB2385266
SOFTWARE\Policies\Power
SYSTEM\CurrentControlSet\Control\FileSystem
Software\Microsoft\windows\CurrentVersion\Internet Settings\Wpad
Software\Microsoft\Windows\CurrentVersion\Uninstall\WordShark_1.10.0.17
SYSTEM\Software\COMODO\Firewall Pro\Configurations
image/png\Bits
t
system\CurrentControlSet\control\NetworkProvider\HwOrder
SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust
Software\Classes\Installer\Products\91915B2EA702BE34EA8737F3C976793C
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7926EFB6-7CB4-4A9D-AB01-095F67F9D519}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Wooden Seal
SOFTWARE\Microsoft\Windows Search
FEATURE_OBJECT_CACHING
policy.3.0.PresentationFramework__31bf3856ad364e35
SOFTWARE\Microsoft\PCHealth\ErrorReporting
Software\WaIntEnhancer
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{35C03C04-3F1F-42C2-A989-A757EE691F65}
FEATURE_DOWNLOAD_INITIATOR_HTTP_HEADER
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{10E5F3FF-AD93-40C5-A0F5-13B9185DBB12}
Software\Policies\Microsoft\SystemCertificates\Disallowed
NI\13b06edc\3d40437\5f
Software\Microsoft\Internet Explorer\TabbedBrowsing
Software\Reimage\Reimage Protector
{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}
Software\Policies\Microsoft\SystemCertificates\CA
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{050d4fc8-5d48-4b8f-8972-47c82c46020f}
SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
CLSID\{403E842C-83DE-4d95-B19C-C4C71F9C6078}
FEATURE_CSS_SHOW_HIDE_EVENTS
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallWIX_{560985FB-4B76-4121-9189-7A2CDC7886D6}
D559A586669B08F46A30A133F8A9ED3D038E2EA8
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.otf
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5C9AA73C-07A2-4280-AAD9-474E3A609719}
History
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{018A0E82-1E79-4EA4-BA31-A72CEC193F0F}
Software\Safer-Surf
SOFTWARE\McAfee.com
SOFTWARE\Microsoft\WAB\WAB4
Software\Policies\Microsoft\Internet Explorer\BrowserStorage\AppCache
FEATURE_BROWSER_EMULATION
SOFTWARE\RobloxReg
SOFTWARE\Avira
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\TraceTestMain
NI\181938c6\7950e2c5
Software\Microsoft\Windows Live\Common
SOFTWARE\Microsoft\Fax\FaxOptions
Programmable
NI\19aba884\259d21de\5a
{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
Software\Policies\Microsoft\Internet Explorer\Control Panel
SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com
FEATURE_DISABLE_FORMAT_REUSE
A43489159A520F0D93D032CCAF37E7FE20A8B419
Software\WInternetEnhancer
Software\Microsoft\Windows\CurrentVersion\Uninstall\SwiftSearch_1.10.0.14
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum
CDD4EEAE6000AC7F40C3802C171E30148030C072
Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
HPLaserJetService
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ocx
SOFTWARE\Microsoft\IME
NI\5bec2d27\74219a81
NI\46b91004\77ccecdd\7
BrowserEmulation
FEATURE_MEMPROTECT_MODE
SOFTWARE\Policies\Microsoft\SystemCertificates\CA
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\DnldMgr
Software\Microsoft\Windows\CurrentVersion\UninstallOracle VM VirtualBox Guest Additions
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent
A377D1B1C0538833035211F4083D00FECC414DAB
FEATURE_FORCE_NATURAL_TEXT_METRICS
91C6D6EE3E8AC86384E548C299295C756C817B81
PROTOCOLS\Name-Space Handler\file\
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\Directory
SOFTWARE\Classes\CLSID\{55FC8D93-9E8B-41D6-84A4-09830910158D}
MobileOptionPack
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\16
B86E791620F759F17B8D25E38CA8BE32E7D5EAC2
Software\Microsoft\Windows Live\Installer\RebootPending
System\CurrentControlSet\Control\Session Manager\Environment
IL\3d590c3f\59f3b67b\5d
NI\6faf58\19ab8d57\15
HardwareEvents
FEATURE_ALLOW_EXPANDURI_BYPASS
8F43288AD272F3103B6FB1428485EA3014C0BCFE
{AE6BE008-07FB-400D-8BEB-337A64F7051F}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{55FD1D5A-7AEF-4DA3-8FAF-A71B2A52FFC7}_is1
FEATURE_NEW_TREE_VERIFICATION
SOFTWARE\{0D40F91C-41DE-4E06-8B14-ABCCF7A51495}
{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0006
Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32
Software\Wajam
FEATURE_NINPUT_LEGACYMODE
Software\Microsoft\SystemCertificates\Root\PhysicalStores
Software\BoBrowser
SOFTWARE\Microsoft\Windows\CurrentVersion\MCT\US
IL\68fb5015\1b89bb32\52
SOFTWARE\Microsoft\PeerNet
FEATURE_USE_LEGACY_JSCRIPT
IL\2d485ce4\49f52278\4b
Software\Microsoft\Windows\CurrentVersionUninstall\RapidReader_1.10.0.24
NI\72d7914b\283706d8
IE4Data
BE36A4562FB2EE05DBB3D32323ADF445084ED656
CertDllVerifyRevocation
TypeLib
MS Shell Dlg
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\K7UltimateSecurity
{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
kemps.negaton
SOFTWARE\Wow6432Node\istartsurfSOFTWARE\Wow6432Node\istartsurfhp
policy.8.0.Microsoft.VisualC__b03f5f7f11d50a3a
Software\Microsoft\Installer\Assemblies\Global
Interface\{2A1C9EB2-DF62-4154-B800-63278FCB8037}
Software\Microsoft\StrongName
SOFTWARE\Classes\CLSID\{05bf0e05-a298-4d0a-b6eb-f55b30a2e662}
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2
IL\6b2ef2ae\1964a88c\4d
AppPatch
FEATURE_PRIVATE_FONT_SETTING
FEATURE_USE_UNISCRIBE
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
000000000010
367D4B3B4FCBBC0B767B2EC0CDB2A36EAB71A4EB
Software\WajaInterEnhance
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe
NI\a94d4ab\5a294d6
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B88A00A2-7294-4D67-B5B5-90C8B9B2962E}
Software\Microsoft\Windows\CurrentVersion\Uninstall\SuperClick_1.10.0.16
FEATURE_BROWSER_COMPATDATA
SOFTWARE\SearchModule
Software\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows Sidebar\IEOverride\Styles
NI\55f42e41\7cb74961
Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar
{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
SYSTEM\CurrentControlSet\Services\crypt32
Software\WajaNetEnhancer
SOFTWARE\Classes\Local Settings
SYSTEM\CurrentControlSet\Services\Winsock\Setup Migration\Providers
Software\InstalledBrowserExtensions\Cinema Plus
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FE2C8DFE-8886-4181-B3BA-36978ABD5E36}
Software\Microsoft\Windows\CurrentVersion\Setup
Arial
SOFTWARE\Microsoft\Windows Search\ProcessedSearchRoots\0000
FEATURE_FILEPROTOCOL_NOFINDFIRST_KB947853
Interface\{55272A00-42CB-11CE-8135-00AA004BB851}
SchedulingAgent
SOFTWARE\Classes\CLSID{B853E835-9F24-4F4B-B55C-E554D15CCCD2}
Software\Microsoft\Windows\CurrentVersion\Uninstall\InfoAtoms__1.6.0.1
Software\IvoSoft\ClassicShell
1.3.6.1.4.1.311.64.1.1!7
CLSID\{E569BDE7-A8DC-47F3-893F-FD2B31B3EEFD}
policy.2.0.System__b77a5c561934e089
CLSID\{F9E6F9C4-2592-45e5-A641-D0D7FF0EB43C}
SOFTWARE\Super Optimizer
IL\3c9c8d7b\33794b65\44
IL\73843e06\61f4f6f6\3e
Software\BPFTP\Bullet Proof FTP\Options
Software\Microsoft\Cryptography\Offload
Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mcafee.com SecurityCenter
Software\Microsoft\Internet Explorer\Security
Software\Microsoft\EnterpriseCertificates\CA\PhysicalStores
Application
Software\Microsoft\Windows NT\CurrentVersion\Diagnostics
SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{3D3783A2-703A-11DE-8C7A-806E6F6E6963}
FEATURE_BLOCK_LMZ_SCRIPT
IL\3b249b34\27fafbb2\48
1.2.840.113549.1.9.16.2.12
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations
AddressBook
SOFTWARE\InstalledBrowserExtensions\30935
Software\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
IL\7f5cd084\5675326b\a
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.py
Software\Microsoft\Cryptography\DESHashSessionKeyBackward
SOFTWARE\Microsoft\Windows\CurrentVersion\Ext
policy.3.5.System.Core__b77a5c561934e089
63FEAE960BAA91E343CE2BD8B71798C76BDB77D0
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8D9CC4EC_8170_461F_ADDE_5A25126B1065}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3407FD83-0A2F-475E-BE94-34F1FA342C84}
Software\Microsoft\Windows\CurrentVersion\Uninstall\ASPackage
ContextDllCreateObjectContext
dihydric.wary.1
FEATURE_BLOCK_PAINT_FOR_PAGE_ENTER
IL\2ffb0c52\49d8870\57
policy.1.0.Microsoft.PowerShell.ConsoleHost__31bf3856ad364e35
SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs
Security\Adv AddrBar Spoof Detection
Software\AutoIt v3\AutoIt
NI\226b2009\5b43ba09\2
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm
FEATURE_ALIGNED_TIMERS
40AA38731BD189F9CDB5B9DC35E2136F38777AF4
Software\TutoTag
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform
SOFTWARE\Classes\CLSID\{41ca0640-a64c-4262-8540-36c33ee58961}
Software\LolliScan
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpaceSoundPro
Software\eFix\eFix Express
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe
1.3.6.1.4.1.311.2.1.20
Software\TabNav
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
ShockwaveFlash.ShockwaveFlash
{082fbf9e-b435-4f7d-9bb5-5aa9c42d0a2a}
IL\77ccecdd\79679de4\4f
FEATURE_XMLHTTP
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallWIX_{653C1B5A-3287-47B1-8613-0745D4E771C4}
TimeValidDllGetObject
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\Perf
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe
policy.2.0.System.Web.Services__b03f5f7f11d50a3a
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{58E05C78-4785-443D-8A1B-CBFF49C2A84E}
Software\Microsoft\NET Framework Setup\NDP\v2.0.50727
Software\Microsoft\Rpc
Software\Policies\Microsoft\Windows\System
4F65566336DB6598581D584A596C87934D5F2AB4
{0000897b-83df-4b96-be07-0fb58b01c4a4}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Streams
Version Vector
SOFTWARE\Classes\CLSID\{08ae5e13-70cc-4fbb-ad00-ef4b90a44451}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{05637CBD-DC52-4B56-83BB-B621BEC17C5E}
{06C9E010-38CE-11D4-A2A3-00104BD35090}
Software\WajNetworkEnhance
Software\FlashFXP\4
000000000006
NI\130e9a23\5569937f\52
FEATURE_BLOCK_LMZ_IMG
Default Behaviors
#2001
IL\3f50fe4f\265c633d\60
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired
SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full
{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects\Themes
FEATURE_IGNORE_LEADING_FILE_SEPARATOR_IN_URI_KB933105
000000000001
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\24
Software\Microsoft\Windows\CurrentVersion\Policies\Network
IL\74219a81\7cb419c4\8
policy.2.0.System.DirectoryServices__b03f5f7f11d50a3a
SOFTWARE\Microsoft\Windows\CurrentVersion\RADAR
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4A56DAB1-2680-4B8A-AD84-77EECFB94D7B}
Software\Apple Inc.\Apple Software Support
Software\WNetworkEnhance
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6ECB944F-D027-4E8A-9906-70E77C005AD5}
FEATURE_ZONES_DEFAULT_DRIVE_INTRANET_KB941000
SOFTWARE\WordShark_1.10.0.20
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CabinetState
SOFTWARE\COMODO\CIS\DbgTrace\cmdinstall
SOFTWARE\SearchModulePlus\Success
SOFTWARE\SecurityUtility
NI\5fcea75a\3c9c8d7b\28
Software\Microsoft\Windows\CurrentVersion\Explorer\KindMap
Software\WajaInterEnhancer
NI\55d78379\2ffb0c52\10
FEATURE_MOBILE_VIEWPORT_WIDTH_RESTRICTIONS
Software\Microsoft\Windows Script Host\Settings
Software\Classes\CLSID\{B853E835-9F24-4F4B-B55C-E554D15CCCD2}
8E5BD50D6AE686D65252F843A9D4B96D197730AB
SYSTEM\CurrentControlSet\Control\SystemInformation
Software\rising
Software\Google\Update\Clients\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}
Software\WaInternetEnhance
IL\7df4ed04\78e5e798\7
Software\Microsoft\Windows\CurrentVersionUninstall\WordWizard_1.10.0.24
SOFTWARE\Microsoft\Internet Explorer\International
Software\One System Care
FEATURE_SAFE_BINDTOOBJECT
SOFTWARE\Microsoft\Internet Explorer\Help_Menu_URLs
Software\Microsoft\SystemCertificates\CA\PhysicalStores
SOFTWARE\Microsoft\IMEJP\10.0
Software\Microsoft\Windows\CurrentVersion\Uninstall\Infonaut_1.10.0.14
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
SOFTWARE\JavaSoft\Java Runtime Environment
image/x-png\Bits
SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0007
software\InstalledBrowserExtensions\30935
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A621B45A-D138-4A95-BE10-7CABA05EF94E}
Software\Microsoft\Windows\CurrentVersion\Uninstall\YouXunBox
FEE449EE0E3965A5246F000E87FDE2A065FD89D4
IL\c991064\5086dba8\51
CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32
SOFTWARE\Policies\Microsoft\SystemCertificates\trust
{DE351A43-8E59-11D0-8C47-00C04FC295EE}
Software\WIEnhancer
SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs
SOFTWARE\Microsoft\Internet Explorer\Toolbar
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\30
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}
SOFTWARE\Microsoft\Feeds
Software\Microsoft\.NETFramework\Policy\
Software\Google\Update\ClientStateMedium\{8A69D345-D564-463c-AFF1-A69D9E530F96}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{625BD732-ACDF-4552-BF22-98EBB413B6F3}
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0
SOFTWARE\Microsoft\CTF\
FEATURE_WEBOC_GLOBAL_WINLIST
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0F7F74EE-0EB4-4133-A9C4-C242C6EFD087}
{babe9b10-0f98-11e5-b301-806e6f6e6963}\
Software\Microsoft\Windows\CurrentVersion\Uninstall\Reimage Repair
SOFTWARE\Microsoft\Fax\Setup
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D1DA2BA7-2592-4036-9BB2-DCCABDE8DC1A}
SOFTWARE\Microsoft\Internet Explorer\UrlBlockManager
Software\FlashFXP\3
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG8Uninstall
SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
SOFTWARE\Microsoft\PCHealth\ErrorReporting\InclusionList
SOFTWARE\Microsoft\Internet Explorer\MINIE
UrlDllGetObjectUrl
Software\Borland\Locales
SYSTEM\CurrentControlSet\Control\Class\{36fc9e60-c465-11cf-8056-444553540000}\0001
Software\Microsoft\Windows\CurrentVersion\Uninstall\OE-Mail Recovery_is1
SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3979321414-2393373014-2172761192-1000\Installer\Assemblies\C:|Windows|SysWOW64|WindowsPowerShell|v1.0|powershell.exe
FEATURE_SCRIPTURL_MITIGATION
Software\TaoTaoSou\TTK
SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.google.com.tr
Software\Microsoft\Windows\CurrentVersion\Explorer\Sharing
CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{89FD3239-CA76-436B-B702-D5472433F33C}
System\CurrentControlSet\Control\Video\{B285A319-4BD4-4785-A840-9BDC49C97EFA}\0000
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\lsl.exe
FEATURE_ALLOW_INTRANET_CSS_MIME_MISMATCH
{3697C5FA-60DD-4B56-92D4-74A569205C16}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows
Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar
Control Panel\International
S-1-5-21-3979321414-2393373014-2172761192-1000\Software\Microsoft\Installer\UpgradeCodes\C71F3D9B2D7958249946FB6DDAFF3EF8
IL\424bd4d8\324708cb\5c
1916A2AF346D399F50313C393200F14140456616
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B9807C3D-B3DD-41B7-8321-53DDB3A3A888}
SOFTWARE\Microsoft\CTF\Compatibility\msiexec.exe
Software\Microsoft\Ole
Software\Microsoft\COM3
System\CurrentControlSet\Services\LanmanWorkstation\Parameters
pirogues.idol.1
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\K7AntiVirus Premium
Tcpip
FEATURE_ENFORCE_BSTR
Software\GenericAddon
#2221
NI\61e7e666\c991064
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SYSTEM\CurrentControlSet\Services\NetBT\Linkage
NI\7ac727df\7b5311d7
SYSTEM\CurrentControlSet\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0008
305F8BD17AA2CBC483A4C41B19A39A0C75DA39D6
Software\Microsoft\Windows\CurrentVersion\Uninstall{050d4fc8-5d48-4b8f-8972-47c82c46020f}
System\CurrentControlSet\Services\DnsCache\Parameters
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\14
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Software\Policies\Microsoft\System\DNSClient
Software\Microsoft\Fusion\PublisherPolicy\Default
SOFTWARE\Microsoft\SystemCertificates\CA\CRLs
CryptDllConvertPublicKeyInfo
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
1.2.840.113549.1.9.16.2.4
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallWIX_{D0DCD54F-C829-41A5-AF32-71E632BB0E2C}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E62381A7-B1C1-4121-8262-84D38C77786C}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DD83A4D4-745F-4B69-94BA-FF1E1CCC03D1}
IL\259d21de\372b3ce5\1
Software\Microsoft\Windows\CurrentVersion\Uninstall\TermBlazer_1.10.0.16
SOFTWARE\Classes\Installer\Assemblies\Global
Sources
SOFTWARE\Microsoft\Internet Explorer\MAIN
Software\Microsoft\Windows\CurrentVersion\Explorer
Palatino Linotype
CryptDllEncodeObjectEx
SOFTWARE\Microsoft
NI\5d88ef29\7f5cd084\53
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bat
742C3192E607E424EB4549542BE1BBC53E6174E2
IL\3ced59c5\48d69eb2\54
5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25
NI\2b1373f4\4f4f14cc
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\F-Secure Internet Shield
CryptSIPDllGetSignedDataMsg
CryptDllDecodeObjectEx
SOFTWARE\CloudGuard
Software\Microsoft\Windows\CurrentVersionUninstall\TermCoach_1.10.0.22
Software\Microsoft\Windows\CurrentVersion\Uninstall\QuickRef_1.10.0.13
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\F-Secure Product 303
Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar
Software\Microsoft\windows\CurrentVersion\Internet Settings
SOFTWARE\Microsoft\Windows\Shell\Bags\2\Shell
SOFTWARE\Classes\ProcMon.Logfile.1
policy.1.0.Microsoft.PowerShell.Commands.Management__31bf3856ad364e35
policy.2.0.System.Xml__b77a5c561934e089
Software\CheckMeApp
SOFTWARE\Microsoft\IMEJP\10.0\Dictionaries
ProxyStubClsid32
PROTOCOLS\Name-Space Handler\about\
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{76756402-BF1E-4A0F-AFCC-0EE6CF58F58C}
SYSTEM\CurrentControlSet\Services\FontCache\Parameters
Software\Microsoft\Windows\CurrentVersion\Uninstall
IL\30c2c2bf\69ed4d2\43
Software\Microsoft\Windows\CurrentVersion\Uninstall\Linksicle_1.8.2.0
S-1-5-21-3979321414-2393373014-2172761192-1000\Software\Microsoft\Installer\Products
#2007
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{babe9b14-0f98-11e5-b301-806e6f6e6963}
Software\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config
SOFTWARE\Classes\CLSID\{c0caa5fe-7c9c-4dca-a265-63cf55379d1a}
policy.3.0.PresentationCFFRasterizer__31bf3856ad364e35
Software\Microsoft\SQMClient
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CD Burning\StagingInfo
SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\InstalledThemes\MCT
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CD Burning\Drives
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C0D93E4E-0866-43C8-A104-BF41A803EA84}
SOFTWARE\Symantec\Norton Security Scan
NI\226b2009\5b43ba09
SYSTEM\CurrentControlSet\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0021
farness.suets
Software\Microsoft\Windows\CurrentVersion\Uninstall\Wordinator_1.10.0.17
{0c5174cf-acb8-4af4-bd2f-620c0d0f5026}
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf
SOFTWARE\Microsoft\wfs\IncomingView
Software\Microsoft\Tracing\WPF
Software\Microsoft\Internet Explorer\MediaTypeClass
Software\Microsoft\Internet Explorer\International\Scripts
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallWIX_{45E557D6-2271-4F13-8101-C620B4285AB0}
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths
SOFTWARE\Microsoft\Windows\Shell\BagMRU
Software\Microsoft\Internet Explorer\ActiveX Compatibility\{16D51579-A30B-4C8B-A276-0FF4DC41E755}
image/x-icon\Bits
SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider
quaggas.pallial.1
Key Management Service
Software\Microsoft\SystemCertificates\My
D018B62DC518907247DF50925BB09ACF4A5CB3AD
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe
IL\39f21844\3feac0d8\6d
CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\3554AA4B-9B0B-451a-A269-2B5F53982209_is1
SOFTWARE\Classes\PROTOCOLS\Filter\text/xml
SOFTWARE\Microsoft\SystemCertificates\CA\Certificates
SYSTEM\CurrentControlSet\Services\CmdAgent\Mode
NI\5bec2d27\74219a81\59
Software\Microsoft\Internet Explorer\Control Panel
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Reimage Express
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
Software\Microsoft\Windows\CurrentVersion\Uninstall\WordWizard_1.10.0.24
Software\CodeGear\Locales
000000000007
SOFTWARE\COMODO\CIS\VolatileData
imposts.manors
NI\34cea914\43f5e26f\6e
SOFTWARE\Microsoft\Windows\CurrentVersion\Screensavers\ssText3d
SOFTWARE\Microsoft\OLEAUT
SYSTEM\CurrentControlSet\Services\Winsock\Parameters
Catalog_Entries
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Tools Internet Security
SOFTWARE\Microsoft\IAM
CLSID\{842A1268-6E6A-465C-868F-8BC445B9828F}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2EEE18E7-5C87-4506-A7E4-A42A6191B03E}
CLSID\{317D06E8-5F24-433D-BDF7-79CE68D8ABC2}
SoftwareMicrosoft\Windows\CurrentVersion\Uninstall\BoBrowser
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoneAlarm Antivirus
CryptSIPDllVerifyIndirectData
SOFTWARE\Microsoft\NET Framework Setup\NDP\v3.5
Software\WinRAR
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\N360
SOFTWARE\Classes\CLSID\{516444ca-a80b-4143-96cb-605675251c4f}
SOFTWARE\Microsoft\IAM\Accounts\VeriSign
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects\ListBoxSmoothScrolling
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml
SOFTWARE\Microsoft\Windows\CurrentVersion\Action Center\Checks\{852FB1F8-5CC6-4567-9C0E-7C330F8807C2}.check.100
SOFTWARE\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0.map
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92098E58-00AD-4F78-AD6E-807BDB323478}
F8A54E03AADC5692B850496A4C4630FFEAA29D83
Software\Reimage
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\26
SOFTWARE\Microsoft\Windows\CurrentVersion\Screensavers\Ribbons\Screen 1
Software\FileZilla Client
exordial.malthas
NI\56d30baa\7df4ed04
Software\AntiToolbar
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2
SOFTWARE\Microsoft\IMEJP\10.0\MSIME
S-1-5-21-3979321414-2393373014-2172761192-1000\Software\Microsoft\Installer\Products\6E8D947A316B3EB3F8F540C548BE2AB9
Software\WaNEnhancer
Software\Microsoft\Windows\CurrentVersion\UninstallFontcore
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BA1EA42A-B02E-4210-882C-717416D96E65}
IL\24bf93f6\708deaf7\46
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CIDSave
SYSTEM\CurrentControlSet\Services\BITS
NI\56d30baa\7df4ed04\60
Installer\Products\62DBF9290209B993A9A757D1160F9B24
SOFTWARE\Microsoft\CTF
FEATURE_MOBILE_DISPOSABLE_RESOURCE_CACHE_THRESHOLD_BYTES
Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3979321414-2393373014-2172761192-1000\Installer\Products
Software\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent
Software\Microsoft\Internet Explorer\Security\Adv AddrBar Spoof Detection
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StuckRects2
{07EB03D6-B001-41DF-9192-BF9B841EE71F}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Viper
245C97DF7514E7CF2DF8BE72AE957B9E04741E85
1.2.840.113549.1.9.16.2.11
Software\Microsoft\NET Framework Setup\NDP\v4\Client
Software\Microsoft\Cryptography\Wintrust\Config
Software\Microsoft\Windows NT\CurrentVersion\Winlogon
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{830D8CBD-C668-49e2-A969-C2C2106332E0}
Opera.HTML\shell\open\command
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoneAlarm Free Antivirus + Firewall
80962AE4D6C5B442894E95A13E4A699E07D694CF
SOFTWARE\Microsoft\IMEJP\Colors
6431723036FD26DEA502792FA595922493030F97
FEATURE_ENABLE_LARGER_HIT_TEST
CLSID\{50D5107A-D278-4871-8989-F4CEAAF59CFC}
disabled.mecca.1
System\CurrentControlSet\Services\Tcpip6\Parameters\Winsock
CLSID\{2933BF90-7B36-11D2-B20E-00C04F983E60}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\winprof
Software\Classes\Installer\Products\6E8D947A316B3EB3F8F540C548BE2AB9
SYSTEM\CurrentControlSet\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0019
IL\41c04c7e\4bf62c79\50
{d4248bed-b105-49da-8908-870a97b538b4}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1
SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup
#16
FEATURE_ADDITIONAL_IE8_MEMORY_CLEANUP
SOFTWARE\Microsoft\Windows\CurrentVersion
policy.3.0.UIAutomationProvider__31bf3856ad364e35
SOFTWARE\Microsoft\NET Framework Setup\NDP\V4\Client
SOFTWARE\Microsoft\SystemCertificates\Root\CRLs
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults
SYSTEM\CurrentControlSet\Services\Wsewqq qmciyqmk
Software\Google\Update\Clients\{8BA986DA-5100-405E-AA35-86F34A02ACBF}
Software\Far\SavedDialogHistory\FTPHost
Software\Policies\IvoSoft\ClassicShell
Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
NI\34cea914\43f5e26f
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FD8E178D-8B4E-42DA-B434-EFF270329B1C}
SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\Interfaces\{CFE68B1E-656A-488B-8077-738CA67BA3A5}
9845A431D51959CAF225322B4A4FE9F223CE6D15
Software\Microsoft\Windows\CurrentVersion\UninstallSchedulingAgent
Software\7-Zip
{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
Microsoft.XMLDOM
Software\Microsoft\NET Framework Setup\NDP\v3.5
SOFTWARE\Flowsurf
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F9FFD19E-B9BA-4C0C-B088-A385F9E9A15B}
SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser
NI\7f0603e4\73843e06\27
Software\Mozilla
SOFTWARE\Microsoft\wfs\SentItemsView
Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions
Software\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C6F5B6CF-609C-428E-876F-CA83176C021B}
Software\Microsoft\SystemCertificates\Root\ProtectedRoots
000000000004
SOFTWARE\Microsoft\Windows\Shell\BagMRU\0
SOFTWARE\Microsoft\Windows\CurrentVersion\Settings\Super Optimizer
Software\Microsoft\Windows\CurrentVersion\UninstallAddressBook
Software\Microsoft\Windows NT\CurrentVersion\ProfileList
SOFTWARE\Microsoft\Windows\CurrentVersion\Action Center\Checks
SYSTEM\CurrentControlSet\Control\Class\{4d36e978-e325-11ce-bfc1-08002be10318}\0000
SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0004
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A575685D-B473-43C8-8644-196A2642A832}
Software\Microsoft\Windows Live\WLInstaller
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dll
SYSTEM\CurrentControlSet\Control\Class\{50127dc3-0f36-415e-a6cc-4cb3be910b65}\0003
CryptDllDecodeObject
Help
NI\5fcea75a\3c9c8d7b
SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\0000
CLSID\{E5CB7A31-7512-11D2-89CE-0080C792E5D8}\Server
Software\Microsoft\Windows\CurrentVersion\UninstallIE4Data
Software\Microsoft\Windows\CurrentVersion\Uninstall{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}
SOFTWARE\Microsoft\Internet Explorer\Main\Default Feeds\{E49E57AF-5044-42E7-A8FE-E4FFEC5C1392}
Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3979321414-2393373014-2172761192-1000\Installer\UpgradeCodes\C71F3D9B2D7958249946FB6DDAFF3EF8
SYSTEM\CurrentControlSet\Control\Class\{4d36e96f-e325-11ce-bfc1-08002be10318}\0001
SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerNet\CollabHost
SOFTWARE\Microsoft\Internet Explorer\Suggested Sites
System\CurrentControlSet\Control\ProductOptions
Software\Policies\Microsoft\Windows\App Management
Software\Microsoft\Internet Explorer\Settings
1.2.840.113549.1.9.16.2.1
disabled.mecca
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\eFix Pro
Interface\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}
NI\5a8de2c3\2b1a4e4\57
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
Software\Sota\FFFTP
SOFTWARE\Microsoft\DataAccess
SOFTWARE\Classes\.PML
SOFTWARE\Microsoft\Internet Explorer\Desktop
policy.2.0.System.Transactions__b77a5c561934e089
SYSTEM\CurrentControlSet\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0010
SYSTEM\CurrentControlSet\Control\Session Manager
IEData
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0
NI\2dc8ae8e\1183d74c
Software\Policies\Microsoft\Windows\CredUI
SOFTWARE\Microsoft\RAS AutoDial\Default
SOFTWARE\JavaSoft\Java Development Kit
System\CurrentControlSet\Services\LDAP
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2D617065-1C52-4240-B5BC-C0AE12157777}
SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}
SOFTWARE\Microsoft\Updates
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sys
SOFTWARE\Classes\PROTOCOLS\Filter\application/octet-stream
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5DF3D1BB-894E-4DCD-8275-159AC9829B43}
SOFTWARE\Microsoft\Internet Explorer\Main\Default Feeds\{E3434E05-96B9-4A1D-99B8-DEE9E5FF1518}
Software\Wine
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Panda Cloud Antivirus
Software\Reimage\Reimage Express
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F0E8CB62-6A1C-4e55-BCD9-1A0F7527B64A}
FEATURE_USE_IETLDLIST_FOR_DOMAIN_DETERMINATION
SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs
Software\Microsoft\Windows\CurrentVersion\UninstallDirectDrawEx
Interface\{D0074FFD-570F-4A9B-8D69-199FDBA5723B}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EFA800BF-C5C8-46D1-B49D-13920D05417C}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiToolbar
policy.3.0.PresentationUI__31bf3856ad364e35
{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Ribbon
SOFTWARE\Microsoft\Windows\CurrentVersion\MCT\US\Theme
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jtx
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\CPL
prima.rifflers
SOFTWARE\Microsoft\Windows\CurrentVersion\Action Center\Checks\{01979c6a-42fa-414c-b8aa-eee2c8202018}.check.100
471C949A8143DB5AD5CDF1C972864A2504FA23C9
Software\Microsoft\Windows\CurrentVersion\Policies
SOFTWARE\Microsoft\SchedulingAgent
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{51C8741C-4A91-42A6-B6A2-CB891F7398A1}
Software\Microsoft\Internet Explorer\Version Vector
NI\30bc7c4f\3f50fe4f
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallWIX_{C774410D-3EF9-4DE7-AC01-332613163ECF}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Opera 31.0.1889.99
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NOD32 Antivirus 4.0.4674.0.467
#2130
ExcludedApplications
SYSTEM\CurrentControlSet\Control\Class\{4d36e96a-e325-11ce-bfc1-08002be10318}\0003
Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A93C9E60-29B6-49da-BA21-F70AC6AADE20}
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage2
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DB368901-C41E-4D86-9809-E0EE635A6939}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3979321414-2393373014-2172761192-1000\Installer\Products\DD7B982E237633344AA7571A542DE33E
FEATURE_USE_WINDOWEDSELECTCONTROL
policy.1.0.Microsoft.PowerShell.Security__31bf3856ad364e35
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects\ListviewAlphaSelect
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.zip
image/tiff\Bits
{C689AABA-8E78-11D0-8C47-00C04FC295EE}
CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
{092903c1-2b9b-4c84-aecf-663ed0f728b2}
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4
NI\5d88ef29\7f5cd084
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\CltUI
Protocol_Catalog9
Software\Microsoft\SystemCertificates\trust\PhysicalStores
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{34EF3470-B8D8-44b6-B09B-7F5EB9AECCC8}
#2002
SOFTWARE\Wow6432Node\Fast-Search
NI\46b91004\77ccecdd
WIC
CLSID\{00020424-0000-0000-C000-000000000046}
SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}
Software\Microsoft\SystemCertificates\My\PhysicalStores
Software\Policies\Microsoft\SystemCertificates
NI\76f08412\6f13f493
NI\70d7f9a2\33860a5d
SOFTWARE\Microsoft\Internet Connection Wizard
SOFTWARE\Wow6432Node
SOFTWARE\Microsoft\Internet Explorer\Security
Software\ExpanDrive
FEATURE_RESTRICT_ABOUT_PROTOCOL_IE7
SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}
delver.keyword
SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
AppId_Catalog
SOFTWARE\Microsoft\Internet Explorer\User Preferences
ShellEx\IconHandler
Software\Classes\Installer\Products\62DBF9290209B993A9A757D1160F9B24
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{99747F0D-D4F8-4877-9CA0-4AE96D963633}
SOFTWARE\Classes\Installer\Assemblies\C:|Windows|SysWOW64|WindowsPowerShell|v1.0|powershell.exe
Software\Microsoft\Windows\Shell\Associations\UrlAssociations\Directory
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder
Software\Microsoft\Internet Explorer\Application Compatibility
SOFTWARE\Microsoft\Speech\Preferences
SYSTEM\CurrentControlSet\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0012
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\Shutdwn
FEATURE_VSYNC_WATCHDOG
SOFTWARE\Microsoft\Speech\Preferences\AppCompatDisableDictation
DebugApplications
000000000003
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{559BABFF-3056-48EB-B644-6D6805D04E9A}
policy.1.0.Microsoft.PowerShell.Security.resources_en-US_31bf3856ad364e35
SOFTWARE\Classes\Local Settings\MuiCache\6\52C64B7E
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoneAlarm Security Suite
System\CurrentControlSet\Control\Lsa\SspiCache
1.3.6.1.4.1.311.12.2.2
Software\Microsoft\Windows\CurrentVersion\Uninstall{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}
SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0003
Software\Classes\Installer\Products
SOFTWARE\Microsoft\Windows\CurrentVersion\MCT
SOFTWARE\Microsoft\SideShow
SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\6
msn.com
Software\Microsoft\OLE\AppCompat
System\CurrentControlSet\Control\SecurityProviders
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE15D1B6-19B6-4D4D-8F43-CF5D2C3356FF}
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\CACHE
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\Cmpress
System\CurrentControlSet\Control\LsaExtensionConfig\SspiCli
SOFTWARE\Microsoft\Windows\CurrentVersion\Screensavers\Bubbles
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
{9bca00b9-32b3-473b-8e21-64d7b6a8d8a6}
SOFTWARE\Microsoft\Fax
.js
SOFTWARE\Microsoft\Cryptography
fumettes.piddling.1
Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3979321414-2393373014-2172761192-1000\Installer\Products\62DBF9290209B993A9A757D1160F9B24
SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats
IL\5569937f\21247651\9
SOFTWARE\Microsoft\Wisp\Pen\SysEventParameters
policy.3.0.System.Printing__31bf3856ad364e35
SOFTWARE\Microsoft\PCHealth\ErrorReporting\ExclusionList
policy.1.0.Microsoft.PowerShell.Commands.Diagnostics__31bf3856ad364e35
SYSTEM\CurrentControlSet\Control\Class\{72631e54-78a4-11d0-bcf7-00aa00b7b32a}\0001
SOFTWARE\Microsoft\Internet Explorer\IETld\LowMic
{d5ef4fde-932a-4bd0-83ec-be3af5191977}
SOFTWARE\Microsoft\MSF\Registration\Listen
SYSTEM\CurrentControlSet\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f}\0001
SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch
SYSTEM\CurrentControlSet\services\Avg\SystemValues
SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7B0180DE-6A86-4600-BD2A-25D5A20EE7F8}
#2222
SOFTWARE\AppDataLow\Software\Microsoft\Internet Explorer
Software\Magicbit\Helper
AppID\sample
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3
SOFTWARE\Microsoft\Windows\CurrentVersion\Screensavers\Mystify\Screen 2
S-1-5-21-3979321414-2393373014-2172761192-1000\Software\Microsoft\Installer\Products\21EE4A31AE32173319EEFE3BD6FDFFE3
SOFTWARE\Microsoft\Windows Sidebar
pirogues.idol
Software\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
physis.dextrous.1
1.3.6.1.4.1.311.2.1.27
Software\Microsoft\Windows\Windows Error Reporting\Debug\DataRequest
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Modules\CommonPlaces
Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice
fumettes.piddling
System\CurrentControlSet\Control
Software\Google\Update\ClientStateMedium\{8BA986DA-5100-405E-AA35-86F34A02ACBF}
SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\sample
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History
Software\LeechFTP
FEATURE_BEHAVIORS
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}
{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}
NI\7ae8e9fa\630c27ba
1F62F885
SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates
SOFTWARE\COMODO\CIS\Cam
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VETWIN32Vp5
DEFAULT
D23209AD23D314232174E40D7F9D62139786633A
SOFTWARE\Microsoft\Windows\CurrentVersion\Action Center\Checks\{DAB69A6A-4D2A-4D44-94BF-E0091898C881}.check.100
SOFTWARE\Microsoft\Internet Explorer\Main\Default Feeds\{DFBB69F0-85E2-4E66-A532-078A3BCC89AA}
SOFTWARE\Microsoft\IME\IMESC
Software\Symantec\InstalledApps
1.3.6.1.4.1.311.47.1.1!7
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NIS
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{411C5D92-2AE4-436F-A027-1E441EDC05CE}
SOFTWARE\Microsoft\IMEJP\10.0\RomaDef\MS-IME
SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop
SYSTEM\CurrentControlSet\Control\Windows
SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople
Software\Microsoft\Windows\CurrentVersion\Uninstall{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}
43D9BCB568E039D073A74A71D8511F7476089CC3
Software\Microsoft\Windows\CurrentVersion\CEIPRole\RolesInWER
SOFTWARE\Classes\ProcMon.Logfile.1\shell\open
SOFTWARE\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.104
SOFTWARE\Microsoft\FTP
SOFTWARE\Internal\Debuger
Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3979321414-2393373014-2172761192-1000\Installer\Products\4225BB89D5CB8204D90235C6C162A39A
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\21
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\11
Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare 7_is1
Software\Microsoft\.NETFramework\Policy\Upgrades
SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0009
IL\2b351479\5cfc7041\42
policy.1.0.Microsoft.WSMan.Runtime__31bf3856ad364e35
00000028
CLSID\{3050F26B-98B5-11CF-BB82-00AA00BDCE0B}
3B1EFD3A66EA28B16697394703A72CA340A05BD5
SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\DefaultVisualStyleOff
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C6E8173D-40EE-4998-B659-CA19F1F278BA}
SOFTWARE\Policies\Power\PowerSettings
Verdana
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones
SOFTWARE\Microsoft\Windows NT\CurrentVersion\PDH
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects\CursorShadow
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A66242A1-9101-425D-9BE5-D19A50E1D0D8}
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\domanager.exe
Software\Classes\CLSID\{BECFD49B-FA50-441D-8C4E-B84EEA87FAC9}
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\28
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\5
SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\CTLs
Tcpip6
SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}
SOFTWARE\Microsoft\IMEJP\10.0\StyleList
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5C5D4795-65F3-4686-B597-7BD3456E91AD}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NAV
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml
SOFTWARE\Goyoo
System\CurrentControlSet\Services\WinSock2\Parameters
SOFTWARE\Microsoft\IMEJP\10.0\Window\PltTiny
IL\43fd4348\4eab5f0e\4c
Software\BPFTP
PowerShellEngine
SYSTEM\CurrentControlSet\Control\Class\{4d36e96a-e325-11ce-bfc1-08002be10318}\0002
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BB85F18B-43C6-48B5-ABA9-6A5DDA65AA1B}
SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs
SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates
SYSTEM\CurrentControlSet\services\KMSEmulator
SOFTWARE\Microsoft\Windows\Windows Error Reporting\Consent
SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs
SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser
Software\Apple Inc.\Apple Application Support
SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs
NI\72522657\2b351479
Software\Microsoft\Windows\Shell\Associations\MIMEAssociations\text/xml\UserChoice
Software\GlobalSCAPE\CuteFTP 9\QCToolbar
Software\Microsoft\Windows NT\CurrentVersion\KnownManagedDebuggingDlls
SOFTWARE\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup
System\CurrentControlSet\Services\Winsock2\Parameters
#2005
MIME\Database\Content Type\application/octet-stream
IE5BAKEX
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Streams\Desktop
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77FFBA7E-0973-4F39-BBDB-AC2F537578D2}
SOFTWARE\Microsoft\Windows\CurrentVersion\Screensavers\Mystify\Screen 1
policy.1.0.System.Management.Automation__31bf3856ad364e35
Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
SYSTEM\CurrentControlSet\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0018
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A7FB84F1-FA4F-4B50-9AEC-4F83AB1DFEBE}
SOFTWARE\AppDataLow
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FB37AE19-DFA1-40B2-93B5-88B9DA4B6385}
Interface\{332C4425-26CB-11D0-B483-00C04FD90119}\ProxyStubClsid32
Main\WindowsSearch
IE40
policy.1.0.Microsoft.WSMan.Management__31bf3856ad364e35
SYSTEM\CurrentControlSet\Control\Windows\
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices
SOFTWARE\Microsoft\Windows NT\CurrentVersion\TaskManager
Software\Microsoft\Windows\CurrentVersion\Uninstall{929FBD26-9020-399B-9A7A-751D61F0B942}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVir PersonalEdition Classic
Software\Microsoft\Windows Live\WLInstaller\Reboot
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{848AC794-8B81-440A-81AE-6474337DB527}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DB90FF25-9932-48F2-B643-1802F1864FAF}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TELUS security services
Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3979321414-2393373014-2172761192-1000\Installer\Products\6E8D947A316B3EB3F8F540C548BE2AB9
NI\3cca06a0\6dc7d4c0\b
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{70553946-F6FD-41F4-A3BB-EB3F6CACCB07}
CryptSIPDllPutSignedDataMsg
SOFTWARE\IBM\Java Development Kit
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8537ABE9-DCE4-4149-A0B4-9926E449AD01}
.png
NI\2c243c3\580ff182
SYSTEM\CurrentControlSet\Control\Class\{533c5b84-ec70-11d2-9505-00c04f79deaf}\0000
Software\Microsoft\OLE
SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs
SOFTWARE\Classes
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Taskband
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects\DragFullWindows
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spyware Doctor
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Tools AntiVirus
SOFTWARE\Microsoft\Windows\CurrentVersion\HomeGroup
System\CurrentControlSet\Control\Session Manager
SYSTEM\Setup\SetupapiLogStatus
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{22E9CF2B-4063-4dab-A251-93FA46F7DECC}_is1}
Microsoft Sans Serif
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1AD8819A-70E8-4380-92DA-F5B2421DAE35}
Software\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
SOFTWARE\Microsoft\CTF\Assemblies\0x00000409
Software\Microsoft\Cryptography\TVO
Software\Policies\Microsoft\Windows NT\Rpc
Software\Microsoft\Advanced INF Setup
Software\BulletProof Software\BulletProof FTP Client\Main
NI\6d7a7b03\20482f61
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\FirstFolder
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallWIX_{1A59064A-12A9-469F-99F6-04BF118DBCFF}
Software\Microsoft\EnterpriseCertificates\Root\PhysicalStores
SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SYSTEM\CurrentControlSet\Services\SbieDrv
NI\7f0603e4\73843e06
000000000009
SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{8856F961-340A-11D0-A96B-00C04FD705A2}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E55FB276-73C9-4776-AB53-BC028C0509ED}
SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Wordpad
SOFTWARE\Piriform\CCleaner
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{f65db027-aff3-4070-886a-0d87064aabb1}
CryptDllEncodeObject
policy.2.0.System.Web__b03f5f7f11d50a3a
1.3.6.1.4.1.311.2.1.11
SOFTWARE\Microsoft\NET Framework Setup\NDP\v4
SYSTEM\CurrentControlSet\Services\Windows Test 5.0
SOFTWARE\Policies
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\27
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
Software\Microsoft\Windows NT\CurrentVersion\VFW
SOFTWARE\Microsoft\SystemCertificates\trust\CTLs
Software\BulletProof Software\BulletProof FTP Client\Options
CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3538DD8F-A0CF-4CB9-8B38-0963CAA509EA}
Software\OB
SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0
SOFTWARE\ODBC\ODBC.INI\ODBC
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff
Software\Microsoft\Internet Explorer\Recovery
Software\Downloader
CryptSIPDllIsMyFileType
SYSTEM\CurrentControlSet\Services\SbieSvc
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{658FDBCA-B7A1-43E4-A849-9F0812473331}
IL\2b1a4e4\3822b536\f
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{315dd168-0794-4cf1-8355-f195cde642fc}.RebootRequired
SOFTWARE\Microsoft\Internet Explorer\IETld
NI\130e9a23\5569937f
Software\Policies\microsoft\Internet Explorer\Persistence
SOFTWARE\Microsoft\Internet Explorer\SearchUrl
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\15
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\F-Secure Anti-Virus
{2e1f1e06-f82f-4033-a0dc-ce5024543837}
Software\Policies\Microsoft\Windows NT\DnsClient
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA
imposts.manors.1
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects\FontSmoothing
Software\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
SOFTWARE\Microsoft\Windows\CurrentVersion\HomeGroup\Printers
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
Drive\shellex\FolderExtensions
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects\DWMEnabled
Software\Microsoft\Windows NT\CurrentVersion\MiniDumpAuxiliaryDlls
SOFTWARE\Microsoft\Internet Explorer\DOMStorage\doubleclick.net
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallWIX_{2D270A67-B7CD-4281-B2FE-60DF18D19B8E}
NI\55f42e41\3612750a
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BED0B8A2-2986-49F8-90D6-FA008D37A3D2}
SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine
SOFTWARE\Microsoft\F12
SOFTWARE\COMODO\CIS\Installer
SOFTWARE\Microsoft\Internet Explorer\VersionManager
5DE83EE82AC5090AEA9D6AC4E7A6E213F946E179
Installer\Products\22BEFC8F7E2A1793E9ADB411DEFE1C58
Software\Microsoft\Windows\CurrentVersion\Uninstall\Hamster Free Zip Archiver_is1
Software\Microsoft\Windows NT\CurrentVersion\Secedit
Installer\Products\91915B2EA702BE34EA8737F3C976793C
SOFTWARE\Sysinternals\Process Monitor
SOFTWARE\Microsoft\PowerShell\1\ShellIds
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ps1xml
FEATURE_RELEASE_CALLBACK_ON_STOP_BINDING
SOFTWARE\Microsoft\CTF\Assemblies
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TmPcc
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1DA193D3-BEC6-4FEF-89E3-D8F739216BFB}_is1
Software\Symantec\Symantec AntiVirus
SOFTWARE\Microsoft\NET Framework Setup\NDP\v1.1.4322
DirectDrawEx
SOFTWARE\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain
CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}
Software\Microsoft\.NETFramework\Policy\AppPatch
SYSTEM\CurrentControlSet\Control\Class\{4d36e965-e325-11ce-bfc1-08002be10318}\0000
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallWIX_{D0702EE9-9DE4-419A-9C6C-4730B1C985BA}
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0
SOFTWARE\Microsoft\Advanced INF Setup\mshtml.Install\RegBackup\0
delver.keyword.1
Software\Microsoft\Internet Explorer\DOMStorage
SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001
CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\InprocServer32
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects\DWMAeroPeekEnabled
Control Panel\Mouse
Keys
CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}
SOFTWARE\Microsoft\Assistance\Client\1.0
prima.rifflers.1
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle
SOFTWARE\Microsoft\Internet Explorer\LowRegistry\DOMStorage
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CCEA2053-D975-4E38-AC09-4D5E6DAC6B6F}
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts
Software\\OB
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\39
farness.suets.1
SOFTWARE\Microsoft\Windows Mail\Trident
{094643c0-3723-445f-bb86-8d957b3e201f}
Software\FileZilla\Site Manager
SOFTWARE\AppDataLow\Software\Microsoft
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ {AF8267C6_8886_4cfd_AAC7_48BCB879743F}
SYSTEM\Software\COMODO\Firewall Pro\VolatileData
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E404EFD4-6110-413C-AD1A-D6D0F261960E}
FEATURE_IEXPLORE_USE_FEEDVIEWER_ON_FEED_MIMETYPE_DETECTION_KB2920147
Software\Microsoft\Windows\CurrentVersion\App Paths\Reimage.exe
Software\Microsoft\Internet Explorer\Security\Floppy Access
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Activation
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallWIX_{4B9BB601-13E9-4042-A3BC-E7955BF4A98F}
{ffb3d409-3448-4e1f-a5da-09806c2fe14a}
SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs
Software\Microsoft\Internet Explorer\International
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{75DEED91-7B14-49DC-A5F3-B60E633AC4A5}
dihydric.wary
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.edrwx
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C670480D-10CE-4E2E-929E-EE453EDE6BE2}
Software\Microsoft\Internet Explorer\PrefetchPrerender
System\CurrentControlSet\Services\Tcpip\Parameters\Winsock
SOFTWARE\COMODO\CIS\Testing purposes
Software\Microsoft\EnterpriseCertificates\TrustedPeople\PhysicalStores
SOFTWARE\Microsoft\Advanced INF Setup\IE UserData NT\RegBackup\0.map
policy.2.0.mscorlib.resources_tr_b77a5c561934e089
SOFTWARE\Microsoft\Windows\Shell\BagMRU\0\0
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C1C185CA-C531-49F5-A6FA-B838405A049D}
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.odt
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AS3 Personal Firewall
Software\Google\Update\ClientState\{8BA986DA-5100-405E-AA35-86F34A02ACBF}
{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}
FEATURE_LOAD_SHDOCLC_RESOURCES
SOFTWARE\Microsoft\Windows\CurrentVersion\Action Center\Checks\{A5268B8E-7DB5-465b-BAB7-BDCDA39A394A}.check.100
SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{129769F0-485B-47AD-AE95-5D094D346BFC}
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\34
SOFTWARE\Microsoft\Remote Assistance
SOFTWARE\Microsoft\Speech
vatted.chazzen.1
CryptDllFindOIDInfo
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{530241F4-D15B-4E0B-B3F3-47F83BC285AA}
SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.microsoft.com
{b24a17c8-49a2-4859-9f44-b04625ff1207}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NS
Software\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}
SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\DefaultVisualStyleOn
Software\Symantec\Symantec Endpoint Protection
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4FEA2BE8-CA8C-4D14-A022-BDDD3EA898E7}
Software\IvoSoft\ClassicShell\Settings
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\K7AntiVirus Plus
Software\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs
Software\Microsoft\Windows\CurrentVersion\App Paths\CEAPPMGR.EXE
{31ea7cd7-8886-4206-8c05-84c8652641ee}
vatted.chazzen
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{147BCE03-C0F1-4C9F-8157-6A89B6D2D973}
SOFTWARE\Microsoft\SystemCertificates\Root\Certificates
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt
FEATURE_RESTRICT_RES_TO_LMZ
Interface\{B06B0CE5-689B-4AFD-B326-0A08A1A647AF}
Microsoft YaHei
SOFTWARE\Microsoft\wfs\InboxView
SOFTWARE\Microsoft\Internet Explorer\DOMStorage\microsoft.com
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\WUWeb
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Symantec AntiVirus Central Quarantine
credssp.dll
SYSTEM\CurrentControlSet\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0000
SOFTWARE\Classes\.386\
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Quick Heal Total Security
SOFTWARE\Microsoft\Active Setup\Installed Components\{7D715857-A67C-4C2F-A929-038448584D63}
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\mrl.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BitDefender
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{27D0BA93-9779-481A-BC4A-2F966A2B0DC6}
NI\5c5eae51\16c6e4c3
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}
FEATURE_MIME_TREAT_IMAGE_AS_AUTHORITATIVE
SOFTWARE\Classes\Local Settings\Software\Microsoft
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HaoYing
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1FCC574F-AFA2-4432-9EF1-79CA7BA73431}_is1
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\AUClnt
trymedia.com
Software\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
SOFTWARE\Microsoft\SystemCertificates\My
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360se6
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{babe9b11-0f98-11e5-b301-806e6f6e6963}
SYSTEM\CurrentControlSet\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0003
SOFTWARE\Microsoft\Command Processor
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\22
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\10
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\INVISUS Spyware Scanner_is1
SOFTWARE\Microsoft\Wbem\CIMOM
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xsl
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\eTrust Suite Personal
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A6F7E997-2236-4145-A028-438F2484241A}
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eprtx
SOFTWARE\Microsoft\Windows Sidebar\IEOverride\Settings
SOFTWARE\Microsoft\MSDTC\MTxOCI
SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}
sample
SOFTWARE\Microsoft\MSF
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG7Uninstall
SYSTEM\CurrentControlSet\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0006
SOFTWARE\Microsoft\IAM\Accounts
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.search-ms
1.3.6.1.4.1.311.2.1.30
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5A05A6CC-EA05-420E-8F6E-8ADF414BEDB3}
1.3.6.1.4.1.311.2.1.26
SOFTWARE\Microsoft\SystemCertificates\CA
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.docx
CryptDllImportPublicKeyInfoEx
SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2895E88E-A352-4E7A-AA86-AB032C69EAB8}
SchemeDllRetrieveEncodedObjectW
Environment
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache
1.3.6.1.4.1.311.2.1.12
SOFTWARE\Microsoft\Windows\CurrentVersion\Screensavers\Ribbons
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7
Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
{f65db027-aff3-4070-886a-0d87064aabb1}
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\17
1.3.6.1.4.1.311.2.1.25
SOFTWARE\Microsoft\Fax\UserInfo
SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs
Software\BulletProof Software\BulletProof FTP Client 2010\Options
SOFTWARE\Microsoft\Internet Explorer\Settings
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{10D4BC5F-F73E-4CD1-A7C2-DF215307A811}
SOFTWARE\Microsoft\Windows\CurrentVersion\MCT\US\RSSFeed
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{44C05FED-4BA8-4C65-A39D-FA83451E6ACB}
Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3979321414-2393373014-2172761192-1000\Installer\Products\22BEFC8F7E2A1793E9ADB411DEFE1C58
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EBC48410-C292-412D-A72A-4F2855988D55}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BF7D87C5-CFC3-40C5-A367-24586EEBB8CA}
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\##vboxsrv#Pictures
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{34D6AD5A-C03D-45FF-AA8A-8B306E01B96D}
SOFTWARE\Microsoft\Fax\fxsclnt\Archive
SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png
SOFTWARE\Microsoft\Windows Search\ProcessedSearchRoots
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\avast
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Quick Heal Internet Security
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CCF98260-1FE9-4CEC-ACE7-88EE3158F23C}
1.3.6.1.4.1.311.16.4
SOFTWARE\Microsoft\Windows NT\CurrentVersion\MsiCorruptedFileRecovery\RepairedProducts
Software\Microsoft\Windows\CurrentVersion\Uninstall\Reimage Express
SOFTWARE\Microsoft\Windows\CurrentVersion\Action Center\Checks\{852FB1F8-5CC6-4567-9C0E-7C330F8807C2}.check.101
SYSTEM\CurrentControlSet\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0004
SOFTWARE\Microsoft\wfs\DraftsView
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\33
SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\GroupMembership
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers\Images
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3
Software\Classes\Installer\UpgradeCodes\C71F3D9B2D7958249946FB6DDAFF3EF8
SOFTWARE\Microsoft\IMEJP\10.0\StyleList\VJE
SOFTWARE\Classes\Local Settings\MuiCache\6
SYSTEM\CurrentControlSet\Services\yto
1F62F885-14E8367A
SOFTWARE\Microsoft\Advanced INF Setup\IE UserData NT\RegBackup
Installer\Products
SOFTWARE\Microsoft\Windows\CurrentVersion\MCT\US\Link
Software\Microsoft\Windows\CurrentVersionUninstall\SearchQuest_1.10.0.24
SOFTWARE\Microsoft\Windows\CurrentVersion\Applets
SOFTWARE\Microsoft\EventSystem
Software\Super Optimizer
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallWIX_{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\F-Secure Product 444
Software\Classes\Installer\Products\4225BB89D5CB8204D90235C6C162A39A
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ClamWin Free Antivirus_is1
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoneAlarm Anti-virus
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C21C71CB-3E5C-401C-91D2-DEDACDB26BAF}
SOFTWARE\Microsoft\Assistance\Client\1.0\Settings
SYSTEM\CurrentControlSet\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0014
SYSTEM\CurrentControlSet\Services\.net clr networking\Performance
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\WUApp
SOFTWARE\Microsoft\SystemCertificates\TrustedPeople
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\escan Internet Security for windows_is1
SOFTWARE\Microsoft\Windows Search\ProcessedSearchRoots\0001
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoneAlarm ForceField
SOFTWARE\Microsoft\Internet Explorer
SOFTWARE\Microsoft\PeerNet\Event_Config
1.3.6.1.4.1.311.12.2.3
SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0000
SOFTWARE\Microsoft\Internet Explorer\DOMStorage\msn.com
SOFTWARE\Microsoft\IMEJP\10.0\StyleList\WX
SOFTWARE\Microsoft\IMEJP\10.0\StyleList\NATURAL
v4.0.30319
Software\Microsoft\Internet Explorer\IEDevTools\Options
26
Software\Python\PythonCore\py2exe\PythonPath
SOFTWARE\Microsoft\Advanced INF Setup\IE UserData NT
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\25
1.2.840.113549.1.9.16.2.3
Software\Microsoft\NET Framework Setup\NDP\v4\Full
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\CIDSizeMRU
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EF52336D-7A5C-4FD5-80DF-C44F19C60DC4}
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\PT
exordial.malthas.1
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ksaduba
SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Settings
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RIS
SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs
SOFTWARE\Microsoft\Advanced INF Setup\mshtml.Install
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Webroot Software
IL\85e83df\71a5f57e\49
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Avira AntiVir Desktop
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6FB650FD-E94A-47A3-A36C-81DD824194FC}
image/x-jg\Bits
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Streams\0
Oracle VM VirtualBox Guest Additions
SOFTWARE\Microsoft\Active Setup
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{795A3A1E-E06A-4214-A2EF-3DDF3BA05C2B}
SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage
SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318}\0000
SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation\LowMic
SOFTWARE\Microsoft\Windows Sidebar\IEOverride\Main
#2004
SOFTWARE\Microsoft\CTF\DirectSwitchHotkeys
Software\FileZilla\Recent Servers
{2B0F765D-C0E9-4171-908E-08A611B84FF6}
NI\5e8c75c\6905a655
SOFTWARE\Microsoft\Internet Explorer\Zoom
{929FBD26-9020-399B-9A7A-751D61F0B942}
SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery
SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects\TransparentGlass
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{22524CA1-515C-4153-9807-52AE65F73B5F}
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ini
SOFTWARE\Microsoft\Advanced INF Setup
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{98032D6F-3EE6-4646-B68C-40BF012AC89B}
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects\DropShadow
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
live.com
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kingsoft Internet Security 9 Plus
SOFTWARE\Microsoft\Internet Explorer\DOMStorage\gemius.pl
SYSTEM\CurrentControlSet\Control\Class\{4d36e966-e325-11ce-bfc1-08002be10318}\0000
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360 Internet Security
CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2}\InprocServer32
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1
SOFTWARE\Microsoft\Windows\CurrentVersion\HomeGroup\UIStatusCache
SOFTWARE\Microsoft\Internet Explorer\LowRegistry
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Passport
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\Service
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters
SYSTEM\CurrentControlSet\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0015
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\McAfee Security Scan
SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher
SOFTWARE\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.101
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DFF63B1C-07DC-4C4D-A1FA-76460710AC5F}_is1
#2003
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360TotalSecurity
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ABBD4BA9-6703-40D2-AB1E-5BB1F7DB49A4}
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CIDSave\Modules
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{590B11BB-7FF9-4D4F-A9E8-E8165BF88381}
SOFTWARE\Microsoft\Internet Explorer\LinksBar\ItemCache
SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant
SOFTWARE\Microsoft\Internet Explorer\EUPP\DSP
SOFTWARE\Microsoft\Fax\fxsclnt\Confirm
SOFTWARE\Microsoft\Windows Mail\Trident\Settings
SOFTWARE\Microsoft\Internet Explorer\PhishingFilter
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects\SelectionFade
SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallWIX_{75193929-9A52-4CA4-98DE-8C7296940920}
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.py
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\Misc
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2CF886EE-C102-4CE7-B50F-FFEDAC13581D}
FEATURE_ISOLATE_NAMED_WINDOWS
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-12-35-02
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Emsisoft Anti-Malware_is1
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare 5_is1
S-1-5-21-3979321414-2393373014-2172761192-1000\Software\Microsoft\Installer\Products\91915B2EA702BE34EA8737F3C976793C
International\Scripts\4
Software\Classes\Installer\Products\DD7B982E237633344AA7571A542DE33E
SYSTEM\CurrentControlSet\Services\DirectX jrq
SOFTWARE\Microsoft\Windows Script\Settings
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dwfx
Software\Classes\Installer\Products\21EE4A31AE32173319EEFE3BD6FDFFE3
SOFTWARE\Microsoft\CTF\TIP
SOFTWARE\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0
SOFTWARE\Classes\PROTOCOLS\Filter\image/pjpeg
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\9
Software\Microsoft\NET Framework Setup\NDP\v3.0
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BitCoin 0.3a
SOFTWARE\Microsoft\Windows\Shell\Bags\1
Software\Classes\Installer\Products\22BEFC8F7E2A1793E9ADB411DEFE1C58
SOFTWARE\Microsoft\Internet Explorer\PageSetup
quaggas.pallial
Software\Policies\Microsoft\SystemCertificates\trust
SOFTWARE\IBM\Java2 Runtime Environment
SOFTWARE\Microsoft\IME\IMESC\5.0
MIME\Database\Content Type
S-1-5-21-3979321414-2393373014-2172761192-1000\Software\Microsoft\Installer\Products\62DBF9290209B993A9A757D1160F9B24
S-1-5-21-3979321414-2393373014-2172761192-1000\Software\Microsoft\Installer\Products\DD7B982E237633344AA7571A542DE33E
SOFTWARE\Microsoft\Windows\CurrentVersion\Screensavers\Ribbons\Screen 2
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\19
SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.msn.com
FEATURE_CONVERT_A3A0INGB2312
SOFTWARE\Microsoft\Windows\CurrentVersion\Action Center\Checks\{945a8954-c147-4acd-923f-40c45405a658}.check.42
NI\76c6ce9a\6ad9a2c1
SOFTWARE\Microsoft\Internet Explorer\Download
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A819907C-5912-4471-91D7-D94885A2C40B}
Software\Microsoft\Windows Live
Software\Microsoft\Internet Explorer\Zoom
SOFTWARE\Microsoft\CTF\MSUTB
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CA0B79A3-9E0B-4641-8120-A5A2379EEE02}
SOFTWARE\Microsoft\SystemCertificates\Disallowed
SOFTWARE\Microsoft\Wisp\Pen\SysEventParameters\FlickCommands
SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Options
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CD Burning
SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp
image/x-emf\Bits
SOFTWARE\Microsoft\Internet Explorer\New Windows
NI\3a35478b\5c177847
SOFTWARE\Microsoft\Windows\CurrentVersion\Action Center\Checks\{11CD958A-C507-4EF3-B3F2-5FD9DFBD2C78}.check.101
SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs
SOFTWARE\Microsoft\Advanced INF Setup\mshtml.Install\RegBackup\0.map
NI\166393f0\409fb3f0
SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs
v2.0.50727.00000
SYSTEM\CurrentControlSet\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0005
SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ls.hit.gemius.pl
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\CDM
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\Inv
SOFTWARE\Microsoft\Internet Explorer\GPU
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\35
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\IMEJP
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{71E7B3F5-CFAF-4C1E-B494-528E28707937}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB02124D-C43A-467E-9385-6AF9C9FB11FD}
SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total
Installer\Products\21EE4A31AE32173319EEFE3BD6FDFFE3
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare 6_is1
Installer\Products\6E8D947A316B3EB3F8F540C548BE2AB9
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2AB9289D-6432-4CC0-8869-A195C3F0CFCC}
7F88CD7223F3C813818C994614A89C99FA3B5247
SOFTWARE\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.103
http\shell\open\command
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IObit Malware Fighter_is1
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\WuRedir
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Security Client
SOFTWARE\Microsoft\Windows\CurrentVersion\Screensavers
SOFTWARE\Microsoft\Internet Explorer\Document Windows
S-1-5-21-3979321414-2393373014-2172761192-1000\Software\Microsoft\Installer\Products\4225BB89D5CB8204D90235C6C162A39A
SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components
FEATURE_DATAURI
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies
policy.2.0.mscorlib.resources_tr-TR_b77a5c561934e089
image/vnd.ms-dds\Bits
Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3979321414-2393373014-2172761192-1000\Installer\Products\21EE4A31AE32173319EEFE3BD6FDFFE3
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OfficeScanNT
SYSTEM\CurrentControlSet\Control\Class\{72631e54-78a4-11d0-bcf7-00aa00b7b32a}\0000
SOFTWARE\Microsoft\Windows Mail\News
000000000002
image/pjpeg\Bits
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EF181DC1-0ECB-4546-9772-C3C3F58E5747}
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects\ListviewShadow
SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com.tr
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\Trace
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallWIX_{77E7AE5C-181C-4CAF-ADBF-946F11C1CE26}
NI\72522657\2b351479\1e
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8BA78FA6-E817-454C-9D32-8DE04404119E}
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lnk
SOFTWARE\Microsoft\Internet Explorer\Main
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Font Management\Auto Activation Languages
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6006059E-013D-4B77-BC5C-4DD5E4A6570D}
.DEFAULT
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\NewShortcutHandlers
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BBD3F66B-1180-4785-B679-3F91572CD3B4}_is1
IL\3d40437\3f3fc448\6
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU
SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}
0FF82528
Software\Microsoft\Wbem\Scripting
SOFTWARE\Microsoft\Windows\Shell\Bags
SOFTWARE\Microsoft\Internet Explorer\SearchScopes
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{695B13B2-7919-4EC5-8601-092F0D2DE069}
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
CertDllVerifyCertificateChainPolicy
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects\TaskbarAnimations
SOFTWARE\Microsoft\Active Setup\Installed Components
SOFTWARE\Microsoft\SystemCertificates\Root\ProtectedRoots
1.3.6.1.4.1.311.2.1.10
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SearchPlatform\Preferences
Software\Far2\SavedDialogHistory\FTPHost
{bdc4542a-0b14-4b91-8ddb-013d8bdcd352}
Software\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9609871C-BE91-48A7-ADC0-628DF4706397}
policy.2.0.System.Design__b03f5f7f11d50a3a
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A9D2F17B-CB52-484B-A54A-7B7238939D96}
Interface\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}
SOFTWARE\ESET\ESET Security\CurrentVersion\Info
SOFTWARE\Microsoft\Windows\CurrentVersion\Sidebar\Settings
1.3.6.1.4.1.311.2.1.4
SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
SYSTEM\CurrentControlSet\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0002
SOFTWARE\Microsoft\IMEJP\10.0\StyleList\MS-IME2000
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\xmrl.exe
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\23
SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}
Software\Microsoft\Windows\CurrentVersion\WindowsUpdateSysprepInProgress
Software\Microsoft\EnterpriseCertificates\trust\PhysicalStores
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6903F76C-3C19-4E23-9672-ED1698928602}
Software\VanDyke\SecureFX
SOFTWARE\Microsoft\IMEJP\10.0\MSIME\AutoCharWidth
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\7
serverdatasrv.com
SOFTWARE\Microsoft\Internet Explorer\LinksBar\ItemCache\1
Software\Microsoft\Msxml30
SOFTWARE\AppDataLow\Software\Microsoft\RepService
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6864ABC3-A982-436B-BEF1-5652D6303361}
SOFTWARE\Microsoft\Windows Search\ProcessedSearchRoots\0003
SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates
SOFTWARE\Microsoft\Windows\CurrentVersion\MCT\US\Wallpaper
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoneAlarm Extreme Security
SOFTWARE\Microsoft\Windows\CurrentVersion\Screensavers\Bubbles\Screen 2
Software\Microsoft\WAB\WAB4\Wab File Name
SOFTWARE\Policies\Microsoft\Windows
SOFTWARE\Microsoft\Internet Explorer\DOMStorage
Software\Google\Update\ClientStateMedium\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{76F8CB2B-6516-4E1E-B6F1-AED4ABDB4B0A}_is1
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C99CEE0-3B88-40C0-A2FB-6F8F923EEBA9}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\cciss_av
Volatile Environment
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects\ComboBoxAnimation
SOFTWARE\Microsoft\Internet Explorer\IntelliForms
SOFTWARE\Microsoft\WAB\WAB4\Wab File Name
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{08B857DF-E6F9-4283-853A-4F329CC09A4F}
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Font Management
SOFTWARE\SpaceSoundPro
Software\Piriform\CCleaner
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{21829177-4DED-4209-AD08-490B3AC9C01A}
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC
SOFTWARE\Microsoft\wfs\OutboxView
SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7E36A3A4-9652-4200-AF89-C839CE4F1F2A}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Agnitum Outpost Security Suite Free_is1
1.3.6.1.4.1.311.44.3.4!7
Connection Manager
{352481E8-33BE-4251-BA85-6007CAEDCF9D}
SOFTWARE\Microsoft\Windows
Software\Microsoft\Windows\CurrentVersion\PropertySystem\PropertyHandlers\.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallWIX_{9D8B0949-7C47-476F-9F06-F900D3B078EA}
SOFTWARE\Microsoft\Wisp
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Modules\NavPane
SOFTWARE\Microsoft\Windows\CurrentVersion\NetCache
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\4
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SearchPlatform
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVGAntiSpyware75
SOFTWARE\Microsoft\Internet Explorer\Desktop\General
SYSTEM\CurrentControlSet\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0016
1.2.840.113549.1.9.16.1.1
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E01AB74B-991A-49C2-99F8-3D3682DC9D8E}
SOFTWARE\Microsoft\Windows\CurrentVersion\Action Center\Providers\EventLog
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C1D1FC57-3EB9-4B21-BCA3-F1C927508200}
Software\PhraseProfessor_1.10.0.24
SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70\FuzzyScheme
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{19FDE7C3-9837-4365-883C-01D51A9F262C}
SOFTWARE\Microsoft\Windows\CurrentVersion\Screensavers\ssText3d\Screen 2
SOFTWARE\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.106
NI\6eae2d34\3b249b34
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ABBD4BA8-6703-40D2-AB1E-5BB1F7DB49A4}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallWIX_{6F6873E3-5C92-4049-B511-231A138DD090}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\safecenter
SYSTEM\CurrentControlSet\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0013
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
Software\Microsoft\Windows\CurrentVersion\Uninstall\{B805FF17-92FE-4757-8142-F0A2850DFE03}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{66F1F013-008F-4875-B283-5A814B820347}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{78DC83C7-7E9D-4518-8DFE-C8BBF69173D9}
SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\38
SYSTEM\CurrentControlSet\Services\KillAllcdo web Service
SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001
System\CurrentControlSet\Control\SecurityProviders\SaslProfiles
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp
Software\Pantaray\QSetup\SpanDisk
SOFTWARE\Microsoft\Windows\CurrentVersion\Sidebar
ZoneMap\Ranges\
SOFTWARE\Microsoft\Windows Sidebar\IEOverride
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\EEHndlr
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mcafee SecurityCenter
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\OfflSnc
SOFTWARE\Microsoft\.NETFramework
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RAV
Output
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusScan NT
SOFTWARE\Classes\Local Settings\MuiCache
SOFTWARE\Microsoft\Assistance\Client
SOFTWARE\Microsoft\Windows\CurrentVersion\Device Metadata
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ad-Aware
SOFTWARE\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\K7TotalSecurity
image/x-wmf\Bits
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\12
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\20
SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates
SYSTEM\CurrentControlSet\Control\Class\{36fc9e60-c465-11cf-8056-444553540000}\0000
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{757BEF67-AF8C-4A2E-B5C4-FDF3C3595509}
SOFTWARE\Microsoft\Fax\fxsclnt
NI\38915167\3c0719ca
SOFTWARE\Microsoft\OLE
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU
NI\5e8c75c\1883695a
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}
SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Security Essentials
SYSTEM\CurrentControlSet\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0001
SOFTWARE\Microsoft\IMEJP\10.0\StyleList\NATURAL\Color
SOFTWARE\Policies\Microsoft\Windows\CurrentVersion
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{85C70286-A56F-4834-BD24-B34EB76A93A2}
SOFTWARE\Microsoft\Internet Explorer\Setup
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\TraceTestThreads
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Panda Universal Agent Endpoint
1.3.6.1.4.1.311.2.1.28
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\29
SOFTWARE\Microsoft\SystemCertificates\CA\CTLs
SOFTWARE\CCleaner
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVir PersonalEdition Premium
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects\AnimateMinMax
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects\MenuAnimation
CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InProcServer32
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\avast!
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoneAlarm Pro
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\McAfee Personal Firewall Plus
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers
System\CurrentControlSet\Control\SQMServiceList
SOFTWARE\Microsoft\Windows\CurrentVersion\Themes
SYSTEM\CurrentControlSet\Services\Cool2014
SOFTWARE\Microsoft\Internet Explorer\LowRegistry\ErrorReporting
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{65B7ECC2-DA56-4557-B1FA-475488FE7112}
Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
Software\Microsoft\Internet Explorer\BrowserStorage\AppCache
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg
SOFTWARE\Microsoft\Internet Explorer\SQM
SOFTWARE\Sysinternals
Software\Microsoft\Windows\CurrentVersion\POSIX
SOFTWARE\Microsoft\Advanced INF Setup\mshtml.Install\RegBackup
Verdana Bold
SOFTWARE\Microsoft\SideShow\Gadgets
#2006
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.txt
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{40E12A55-C504-4223-AFAC-7672DBF1ACDE}
SOFTWARE\Microsoft\Notepad
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ris
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects\DWMSaveThumbnailEnabled
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG9Uninstall
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains
SOFTWARE\Microsoft\Speech\Preferences\AppCompatDisableMSAA
SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates
SOFTWARE\Microsoft\SystemCertificates\trust\CRLs
SYSTEM\CurrentControlSet\Services\CmdAgent\CisConfigs
SOFTWARE\Microsoft\IMEJP\10.0\StyleList\ATOK
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinFix Pro
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cab
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{315dd168-0794-4cf1-8355-f195cde642fc}
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fon
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B4094407-2F69-44bb-9DD7-9470FBD9F521}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{45E557D6-2271-4F13-8101-C620B4285AB0}
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\37
SYSTEM\CurrentControlSet\Services\
SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}
SYSTEM\CurrentControlSet\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0017
000000000008
SOFTWARE\Microsoft\Assistance
SOFTWARE\Microsoft\WAB\Me
SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\PolicyApplicationState
Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
image/gif\Bits
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CDF97135-7FD2-4289-96B8-DD4505267ACD}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare with Antivirus 2013_is1
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OnlineArmor_is1
SOFTWARE\Microsoft\Internet Explorer\Services
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoneAlarm Internet Security Suite
SOFTWARE\Microsoft\CTF\Compatibility\WcPlugin.exe
SOFTWARE\Microsoft\Windows NT
SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0008
International\Scripts\3
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}
SOFTWARE\Microsoft\IMEJP\10.0\RomaDef
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip
SOFTWARE\COMODO\CIS\Options
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1E5E7177-5156-4541-B8D5-B0C7E9064329}
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ex$
Suggested Sites
SOFTWARE\Norton\SecurityStatusSDK\
Domains\
SOFTWARE\Microsoft\Windows\CurrentVersion\ime
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EA8C73AA-3D75-44C9-87A2-8E945FC5FEE6}
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.btsearch
SOFTWARE\Microsoft\Windows\CurrentVersion\Screensavers\ssText3d\Screen 1
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.css
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\ARP
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\36
QuickTime.QuickTime\CLSID
SOFTWARE\Microsoft\Advanced INF Setup\IE UserData NT\RegBackup\0
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\UltraFXP
SYSTEM\CurrentControlSet\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0007
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ABBA2EA4-740E-4052-902B-9CA70B081E3F}
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\Setup
SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects
SOFTWARE\Microsoft\IAM\Accounts\Active Directory GC
Software\Policies\Microsoft\SQMClient
Software\Policies\Microsoft\SystemCertificates\Root
SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History
SYSTEM\CurrentControlSet\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0011
JSFile\ScriptEngine
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{943B6738-4801-4982-90EC-0442EF7AEB16}
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects\ControlAnimations
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DA15069B-7DD3-445B-8488-E46A38CCF939}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2EEBAC31-3EEF-4118-91CB-1A286A507DB2}
image/bmp\Bits
NI\72d7914b\24e65f15
SOFTWARE\Microsoft\Windows Mail
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{85F6FC98-FA56-4D01-AAC2-BF2993BF77E5}
shell\open\command
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Passport\LowDAMap
SOFTWARE\Classes\ProcMon.Logfile.1\shell\open\command
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\eFix Express
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif
SOFTWARE\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup
SOFTWARE\Microsoft\Windows NT\CurrentVersion\MsiCorruptedFileRecovery
SOFTWARE\Microsoft\IAM\Accounts\Active Directory GC\Windows Mail Account ID
Software\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WRUNINST
SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pml
SOFTWARE\Microsoft\Wisp\Pen\SysEventParameters\CustomFlickCommands
Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\Report
SOFTWARE\Microsoft\Windows\Windows Error Reporting
SOFTWARE
SOFTWARE\Policies\Microsoft
SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts
SOFTWARE\Classes\ProcMon.Logfile.1\DefaultIcon
SOFTWARE\Microsoft\MSF\Registration
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains
SOFTWARE\Microsoft\Windows\CurrentVersion\Telephony
SOFTWARE\Microsoft\Wisp\Touch
SOFTWARE\Microsoft\Wisp\MultiTouch
SOFTWARE\Microsoft\Windows NT\CurrentVersion\EFS
Software\Microsoft\Windows\Shell\Associations\URLAssociations\http\UserChoice
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallWIX_{66F1F013-008F-4875-B283-5A814B820347}
SOFTWARE\Microsoft\Protected Storage System Provider
SOFTWARE\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Quick Heal AntiVirus Pro
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Tools Firewall Plus
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Modules
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{718D791F-F4E8-4aa7-98A6-15FDED17BDD0}
1.3.6.1.4.1.311.12.2.1
SOFTWARE\Microsoft\IAM\Accounts\VeriSign\Windows Mail Account ID
SOFTWARE\Microsoft\Windows\CurrentVersion\Telephony\HandoffPriorities
SOFTWARE\Microsoft\CTF\Assemblies\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}
SYSTEM\CurrentControlSet\Services\BFE
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EZ Firewall
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2
SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000
NI\70d7f9a2\64315150
SOFTWARE\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EE091E7B-BEAC-4704-9529-6E8FC92F0901}
image/svg+xml\Bits
{D9DC8A3B-B784-432E-A781-5A1130A75963}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C8B34404-2E52-4C1F-A2B7-D26E46E5974D}
{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers
SOFTWARE\Microsoft\Windows Mail\Mail
SOFTWARE\Microsoft\Internet Explorer\International\Scripts
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\8
#2223
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\
SOFTWARE\Microsoft\CTF\HiddenDummyLayouts
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3F5B6210-0903-4DC6-8034-8F488AA3A782}
SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerNet
SOFTWARE\Microsoft\Windows\Shell
Software\BitTorrent\uTorrent
SOFTWARE\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0.map
SOFTWARE\Microsoft\Internet Explorer\Main\Default Feeds
SYSTEM\CurrentControlSet\Services\Windows Test 111.0
SOFTWARE\Microsoft\Windows\CurrentVersion\Screensavers\Mystify
ProtocolDefaults\
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CBC11EBE-CF8A-43B3-83DD-8D3A1FEB4E1A}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallWIX_{02FECEE0-16B2-43DB-BC3B-C844477FC142}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EEBA9416-3207-47E0-9022-116440599DBC}
SOFTWARE\Microsoft\Wisp\Pen
SOFTWARE\Microsoft\WAB
SOFTWARE\Microsoft\IMEJP\10.0\StyleList\VJE\Color
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket
SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\Parser
SOFTWARE\Microsoft\IMEJP\10.0\Window\PltSmall
{E2B51919-207A-43EB-AE78-733F9C6797C3}
SYSTEM\CurrentControlSet\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f}\0000
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BFD080F6-3BF0-40E1-9507-9CA969C35870}
SOFTWARE\Microsoft\Protected Storage System Provider\S-1-5-21-3979321414-2393373014-2172761192-1000
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Malwarebytes' Anti-Malware_is1
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9ACB414D-9347-40B6-A453-5EFB2DB59DFA}
SOFTWARE\Microsoft\IMEJP\10.0\StyleList\MS-IME2000\Color
SOFTWARE\Microsoft\SystemCertificates\trust\Certificates
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5CE74A57-75E8-43A9-9BAA-CB97A1A23043}
SOFTWARE\Microsoft\Windows\TabletPC
SOFTWARE\Microsoft\Advanced INF Setup\IE40.UserAgent
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8B287B75-DF8D-40C8-9620-8E4492C38EF1}
SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\SysTray
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IObit Security 360_is1
CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
SOFTWARE\Microsoft\Windows\CurrentVersion\Action Center\Checks\{01979c6a-42fa-414c-b8aa-eee2c8202018}.check.101
SOFTWARE\Microsoft\RAS AutoDial
SOFTWARE\Microsoft\SystemCertificates\Root\CTLs
1.3.6.1.4.1.311.2.1.15
{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}
Interface\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}
SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0002
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects\TooltipAnimation
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8A36FA9C-E350-41F0-B339-F040297F4C6C}
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\3
image/vnd.ms-photo\Bits
SOFTWARE\Microsoft\IMEJP\10.0\StyleList\WX\Color
SOFTWARE\Microsoft\IMEJP\10.0\StyleList\ATOK\Color
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio
SOFTWARE\Classes\Local Settings\Software
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8F023021-A7EB-45D3-9269-D65264C81729}
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers\KnownFolders
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D6AB1F5B-FED6-49A9-9747-327BD28FB3C7}
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.contact
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\Agent
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IObit Advanced SystemCare 4_is1
SOFTWARE\Microsoft\IMEJP\10.0\Manage
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
NI\38915167\3b4756a2
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1549B388-042B-4573-B0CE-A8FF0D7F8F2A}
CryptDllImportPublicKeyInfoEx2
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.scf
Interface\{332C4425-26CB-11D0-B483-00C04FD90119}
Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AF8267C6_8886_4cfd_AAC7_48BCB879743F}
{050d4fc8-5d48-4b8f-8972-47c82c46020f}
SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs
SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spam Monitor_is1
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rtf
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\Folder
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1463BA91-7FE5-4B8C-A890-FB4E5FACCB47}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Quick Heal AntiVirus
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{882362E0-C71A-411B-B16F-46D1B66E1890}_is1
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{71E4D679-20AB-41E9-A350-D5BF92088FFE}
SOFTWARE\Microsoft\Windows\Shell\Bags\2
SOFTWARE\Microsoft\CTF\Compatibility\dxwsetup.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CFB8BDCE-8814-4B9A-8EA9-31DB74FEF0AE}
SYSTEM\CurrentControlSet\Control\Class\{4d36e96a-e325-11ce-bfc1-08002be10318}\0001
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RadialpointClientGateway_is1
SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\18
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallWIX_{6580C5A3-2336-4EC5-85F1-3448C5F6208A}
SYSTEM\CurrentControlSet\Services\Vwxyab Defghijk Mno
SOFTWARE\Classes\ProcMon.Logfile.1\shell
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{33831881-EBD7-411D-BF44-CAFA80AF1600}
SOFTWARE\Microsoft\Internet Explorer\LinksBar
Software\Microsoft\Windows Live\WLInstaller\Reboot\RebootPending
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinSS
SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallWIX_{943B6738-4801-4982-90EC-0442EF7AEB16}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MSC
NI\500757a9\6d8fb968
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\31
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9D2B0322-44AE-460E-9283-4D2D7A9205AE}
SOFTWARE\Microsoft\Internet Explorer\International\Scripts\13
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{38D80A4C-D893-4985-BA3F-0B1D9E848CED}
SOFTWARE\Microsoft\Windows\DWM
SOFTWARE\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.102
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BC30E5E7-047D-4232-A7E8-F2CB7CC7B2E0}_is1
SYSTEM\CurrentControlSet\services\ekrn
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}
SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\DtaStor
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\COMAPI
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU
SOFTWARE\Microsoft\Internet Explorer\TypedURLs
SOFTWARE\Microsoft\CTF\SortOrder
SYSTEM\CurrentControlSet\Control\Class\{4d36e96a-e325-11ce-bfc1-08002be10318}\0004
SOFTWARE\Microsoft\Windows\Windows Error Reporting\Hangs
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B4B5AD48-8D34-41D3-BD8A-8A10BD9BDED3}_is1
CryptDllVerifyEncodedSignature
SOFTWARE\Microsoft\Internet Explorer\Recovery
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlersDefaultSelection
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{85CB7BCF-958D-4B9E-8373-AE4D2C9FB324}
SYSTEM\CurrentControlSet\Control\Class\{4d36e96c-e325-11ce-bfc1-08002be10318}\0000
SOFTWARE\Microsoft\Windows\CurrentVersion\Device Metadata\ActiveDownloads
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume
SOFTWARE\Microsoft\SystemCertificates\Root
NI\4fbb0180\50c8699a
SOFTWARE\Microsoft\SystemCertificates\trust
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D66C9F03-5F7C-4A4F-A4D0-7D04FCD426AE}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{87AEFD84-BC0D-11D4-B885-00508B022A51}
SOFTWARE\Wow6432Node\Microsoft\Active Setup
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf
SOFTWARE\Microsoft\Internet Explorer\EUPP
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\F-Secure Uninstall
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects\ThumbnailsOrIcon
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites
SYSTEM\CurrentControlSet\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0020
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Modules\GlobalSettings
SOFTWARE\Microsoft\CTF\SortOrder\Language
SOFTWARE\Microsoft\Windows\TabletPC\TabSetup
SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000001\Profiles\@My profile
Software\Trymedia Systems\Download Manager\34000080000000004b45524e454c3332
image/jpeg\Bits
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.easmx
Global\CLR_CASOFF_MUTEX
Residented
nuijkbegdEl
<NULL>
Global\{32E97724-211B-41C8-8091-EC4FB927B738}
Global\.net clr networking
Local\MSCTF.Asm.MutexDefault1
DefaultTabtip-MainUI
SuperOptimizer
_!SHMSFTHISTORY!_
Global\netfxeventlog.1.0
C:\Windows\system32\shell32.dll
secur32.dll
C:\Windows\syswow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
NTDLL
C:\Users\win7\AppData\Local\Temp\is-7PPJQ.tmp\sample.EN
C:\Windows\SysWOW64\SHLWAPI.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\\wminet_utils.dll
C:\Windows\SysWOW64\urlmon.dll
msimg32.dll
iertutil.dll
C:\Windows\SysWOW64\cryptnet.dll
ws2_32.dll
C:\Windows\system32\dwmapi.dll
urlmon.dll
C:\Windows\System32\msxml3r.dll
winhttp.dll
C:\Windows\system32\comsvcs.dll
imagehlp.dll
C:\Users\win7\AppData\Local\Temp\nst1E41.tmp\inetc.dll
ntdll.dll
C:\Users\win7\AppData\Local\Temp\nss29BA.tmp\ButtonEvent.dll
C:\Windows\system32\uxtheme.dll
netutils.dll
COMCTL32.DLL
Ntdll.dll
imm32.dll
C:\Windows\system32\advapi32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\culture.dll
C:\Windows\SysWOW64\SHELL32.DLL
api-ms-win-core-fibers-l1-1-1
SensApi.dll
Secur32.dll
profapi.dll
COMDLG32.dll
C:\Windows\system32\sxs.dll
C:\Windows\syswow64\ole32.DLL
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\4b335bfaa07fc54f2d72213d33f53e97\System.Data.ni.dll
MSWSOCK.dll
KERNEL32.dll
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\nsisXML.dll
C:\Windows\system32\CRTDLL.DLL
C:\Windows\system32\EhStorShell.dll
C:\sampleLOC.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\7fcb194ae385dc872688067fb024bd55\Microsoft.PowerShell.Commands.Utility.ni.dll
wtsapi32.dll
gdi32.dll
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\KPTool.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\inetc.dll
Uxtheme.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\f45bc0251cceb599622f55cc1c7f4aba\System.Transactions.ni.dll
C:\Users\win7\AppData\Local\Temp\nsj20C1.tmp\WmiInspector.dll
srvcli.dll
C:\Windows\system32\Msi.dll
MSHTML.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\ef204c8310562595a0518e356fb15387\PresentationCore.ni.dll
C:\Users\win7\AppData\Local\Temp\nsa73EB.tmp\Banner.dll
USP10.dll
PSAPI.DLL
COMDLG32.DLL
C:\Windows\SysWOW64\bcryptprimitives.dll
C:\Users\win7\AppData\Local\Temp\nsx74CC.tmp\inetc.dll
C:\Users\win7\AppData\Local\Temp\nss29BA.tmp\System.dll
ADVAPI32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
Rstrtmgr.dll
shcore.dll
WINMM.dll
C:\Windows\syswow64\profapi.dll
C:\Windows\system32\secur32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
cmdhtml.dll
DUI70.dll
wininet.dll
advapi32
advapi32.dll
UXTHEME.DLL
WINSTA.dll
rtutils.dll
C:\Users\win7\AppData\Local\Temp\rna86B2.ENU
CRYPT32.dll
SHFolder.dll
Cabinet.dll
user32.dll
MSVCRT.dll
C:\Windows\syswow64\ADVAPI32.dll
C:\sampleENU.dll
API-MS-WIN-Service-winsvc-L1-1-0.dll
KERNEL32.DLL
gdiplus.dll
D3D10Warp.dll
api-ms-win-downlevel-ole32-l1-1-0.dll
C:\Users\win7\AppData\Local\Temp\nst1E41.tmp\stack.dll
uxtheme
psapi.dll
C:\Windows\system32\ntkrnlpa.exe
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\ToolTips.dll
version.dll
C:\Windows\SysWOW64\OLE32.DLL
winspool.drv
C:\Users\win7\AppData\Local\Temp\nso3A98.tmp\Banner.dll
C:\Windows\system32\msasn1.dll
MSHTML.DLL
C:\Users\win7\AppData\Local\Temp\nso3A98.tmp\inetc.dll
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\System.dll
C:\Windows\system32\riched20.dll
C:\Users\win7\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
C:\Users\win7\AppData\Local\Temp\nsm9F88.tmp\nsWeb.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
C:\Users\win7\AppData\Local\Temp\nst1E41.tmp\xml.dll
C:\Windows\system32\sfc.dll
Mpr.dll
mpr.dll
C:\Users\win7\AppData\Local\Temp\is-D5T9K.tmp\_isetup\_shfoldr.dll
C:\Windows\syswow64\iertutil.dll
C:\Users\win7\AppData\Local\Temp\nsc8A4A.tmp\LangDLL.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\38bf604432e1a30c954b2ee40d6a2d1c\mscorlib.ni.dll
shlwapi.dll
C:\Users\win7\AppData\Local\Temp\nsa73EB.tmp\LogEx.dll
C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\MSVCR80.dll
VERSION.dll
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\sndsock.dll
C:\Windows\syswow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
Fwpuclnt.dll
C:\Windows\syswow64\urlmon.dll
C:\sa.dll
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\Banner.dll
C:\Windows\syswow64\CRYPTBASE.dll
C:\Windows\syswow64\USER32.dll
API-MS-Win-Core-LocalRegistry-L1-1-0.dll
WSOCK32.dll
shfolder.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\908ba9e296e92b4e14bdc2437edac603\System.ni.dll
WS2_32.dll
USER32.dll
comctl32
shell32.dll
SHFOLDER
CRTDLL.DLL
ImgUtil.dll
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\KPTool.dll
C:\Windows\system32\directx\websetup\dsetup.dll
MPR.DLL
d3dxof.dll
riched32.dll
mscoree.dll
UxTheme.dll
C:\Users\win7\AppData\Local\Temp\nso3BBE.tmp\nsExec.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management.A#\24f3f84b0793777ae7337796ef5551a5\System.Management.Automation.ni.dll
IMM32.dll
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
OLEAUT32
C:\sample
cryptnet.dll
C:\Users\win7\AppData\Local\Temp\nsa73EB.tmp\UserInfo.dll
C:\Users\win7\AppData\Local\Temp\nstECF5.tmp\nsExec.dll
RASMAN.DLL
C:\Windows\system32\ole32.dll
C:\Windows\syswow64\MSCTF.dll
C:\Users\win7\AppData\Local\Temp\7zSF225.tmp\SymCCIS.dll
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll
C:\Windows\syswow64\WS2_32.dll
WINTRUST.dll
C:\Windows\system32\D3D10Warp.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\uxtheme.dll
C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
C:\Users\win7\AppData\Local\Temp\qcb16A7.tmp
api-ms-win-security-systemfunctions-l1-1-0
C:\Users\win7\AppData\Local\Temp\wwaE1E2.EN
C:\Users\win7\AppData\Local\Temp\is-V8JDK.tmp\_isetup\_shfoldr.dll
UXTHEME
JSCRIPT.DLL
dxgi.dll
DUser.dll
msvcrt.dll
C:\Users\win7\AppData\Local\Temp\nsj20C1.tmp\System.dll
API-MS-Win-Security-LSALookup-L1-1-0.dll
api-ms-win-downlevel-advapi32-l2-1-0.dll
d3d11.dll
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\shell32.dll
C:\Users\win7\AppData\Local\Temp\nsr3BC7.tmp\nsExec.dll
GDI32.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.dll
C:\Users\win7\AppData\Local\Temp\dfsCDFD.tmp
C:\Users\win7\AppData\Local\Temp\SETUP_41436\Engine.ENU
OLE32.DLL
Skin.dll
oledlg.dll
C:\Windows\Microsoft.NET\Framework\v3.0\WPF\wpfgfx_v0300.dll
C:\Windows\syswow64\shell32.dll
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\rasapi32.dll
COMCTL32.dll
C:\Windows\system32\imageres.dll
C:\Program Files\Microsoft Silverlight\sllauncher.exe
api-ms-win-appmodel-runtime-l1-1-1
C:\Users\win7\AppData\Local\Temp\nst1E41.tmp\nsExec.dll
C:\Windows\syswow64\CRYPT32.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\1c3513960037508558358652f2d202a1\WindowsBase.ni.dll
C:\Users\win7\AppData\Local\Temp\shell32.dll
C:\Users\win7\AppData\Local\Temp\nst1E41.tmp\LogEx.dll
C:\Windows\system32\Oleacc.dll
Advapi32
NETAPI32.dll
C:\Users\win7\AppData\Local\Temp\is-5VJ0O.tmp\_isetup\_shfoldr.dll
User32.dll
C:\Users\win7\AppData\Local\Temp\230915124841988.exe
ext-ms-win-kernel32-package-current-l1-1-0
C:\Windows\system32\cryptsp.dll
C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\MSVCR80.dll
netapi32.dll
uiautomationcore.dll
Userenv.dll
C:\Users\win7\AppData\Local\Temp\nsx74CC.tmp\UserInfo.dll
C:\Users\win7\AppData\Local\Temp\nsj20C1.tmp\inetc.dll
C:\Windows\system32\userenv.dll
WINHTTP.dll
C:\Users\win7\AppData\Local\Temp\nsx74CC.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\SETUP_41436\
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\inetc.dll
C:\Windows\syswow64\GDI32.dll
C:\Users\win7\AppData\Local\Temp\is-J09EF.tmp\_isetup\_shfoldr.dll
kernel32.dll
C:\Users\win7\AppData\Local\Temp\nsj20C1.tmp\flush-inetc.dll
OLEACC.dll
mscorwks.dll
C:\Windows\syswow64\api-ms-win-downlevel-user32-l1-1-0.dll
C:\Users\win7\AppData\Local\Temp\rna86B2.tmp
WindowsCodecs.dll
backtrace.dll
C:\Windows\syswow64\WININET.dll
user32
C:\Users\win7\AppData\Local\Temp\nst1E41.tmp\System.dll
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\winhttp.dll
winmm.dll
iphlpapi.dll
SHELL32.dll
dwrite.dll
FastMM_FullDebugMode.dll
powrprof.dll
C:\Windows\system32\asycfilt.dll
C:\Windows\system32\Winsta.dll
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\cmdstat.dll
Iphlpapi.dll
Kernel32
d2d1.dll
riched20.dll
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\NSISdl.dll
ntdll
OLEAUT32.dll
C:\Windows\system32\networkexplorer.dll
C:\Windows\syswow64\shlwapi.DLL
C:\Program Files\Reimage\Reimage Repair\REI_Engine.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\63e9d5c341d64a753cde97f5a3d65c71\System.Core.ni.dll
C:\Windows\system32\user32.dll
C:\Windows\system32\msi.dll
Normaliz.dll
DWrite.dll
C:\Users\win7\AppData\Local\Temp\DXGIDebug.dll
wpcap.dll
MSIMG32.dll
CFGMGR32.dll
C:\Windows\system32\wups.dll
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\DXGIDebug.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5a401fd2a7689ff13fb54182953f9c40\System.Drawing.ni.dll
C:\Windows\system32\shlwapi.dll
comctl32.dll
C:\Windows\system32\DirectX\WebSetup\DSETUP32.DLL
SHELL32.DLL
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\2b0a3b04b44b8d8e3cd4d489220d8c35\Microsoft.PowerShell.Security.ni.dll
RichEd20
security.dll
WINSPOOL.DRV
RPCRT4.dll
SHLWAPI.dll
ddraw.dll
C:\Users\win7\AppData\Local\Temp\is-5VJ0O.tmp\idp.dll
GDI32.dll
USERENV.dll
dbghelp.dll
C:\Users\win7\AppData\Local\Temp\rna86B2.EN
C:\Windows\system32\wbem\xml\wmi2xml.dll
kernel32
SPINF.dll
C:\Windows\SysWOW64\tasklist.exe
C:\Windows\syswow64\KERNELBASE.dll
C:\Windows\SYSTEM32\MSCOREE.DLL
C:\Windows\syswow64\SspiCli.dll
SPFILEQ.dll
C:\Windows\system32\Msimtf.dll
SETUPAPI.dll
C:\Windows\system32\apphelp.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\007fc007edc388d9806dff94ee04f129\System.Configuration.ni.dll
crypt32.dll
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\iphlpapi.dll
mscorsec.dll
C:\Users\win7\AppData\Local\Temp\nsx74CC.tmp\WmiInspector.dll
C:\Users\win7\AppData\Local\Temp\nso3A98.tmp\System.dll
Wtsapi32.dll
C:\Users\win7\AppData\Local\bitcoin\ssleay32.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\2804664decc8bc37bdc172b35a5bdd46\System.Web.Services.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorwks.dll
C:\Windows\system32\AdvApi32.dll
C:\Windows\system32\kernel32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll
C:\Windows\syswow64\RPCRT4.dll
C:\Windows\system32\DirectX\WebSetup\dsetup.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\30280e5e7d89ffe702df50de4d339fc7\System.Configuration.Install.ni.dll
C:\Users\win7\AppData\Local\Temp\nsc8A4A.tmp\System.dll
userenv.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\99cdfef98595ed91f14936cf52a49c54\System.Management.ni.dll
C:\Windows\system32\wer.dll
RICHED20.DLL
api-ms-win-core-winrt-l1-1-0.dll
shell32
C:\Users\win7\AppData\Local\Temp\is-7PPJQ.tmp\sample.ENU
ole32.dll
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\NSISdl.dll
cabinet.dll
C:\Windows\system32\cryptbase.dll
C:\Windows\syswow64\OLEAUT32.dll
pstorec.dll
C:\Users\win7\AppData\Local\Temp\is-0AH6L.tmp\sample.ENU
C:\Windows\SysWOW64\schtasks.exe
C:\WINDOWS\SYSTEM32\VB6ES.DLL
d3d10_1.dll
C:\Windows\system32\version.DLL
msls31.dll
C:\Windows\syswow64\NSI.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
C:\Windows\syswow64\USERENV.dll
C:\Users\win7\AppData\Local\Temp\caa414.ENU
C:\Windows\system32\ws2_32.dll
ntmarta.dll
dhcpcsvc.DLL
C:\Windows\syswow64\msvcrt.dll
C:\Windows\System32\shdocvw.dll
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\.ba1\Avira.OE.Setup.InstallationCore.dll
MSFTEDIT.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\tr\mscorrc.dll
C:\Windows\syswow64\api-ms-win-downlevel-ole32-l1-1-0.dll
DEVRTL.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll
COMCTL32
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\cbe531dae622018576dbf7b1fca5ce47\System.DirectoryServices.ni.dll
msi.dll
C:\Windows\System32\msxml6r.dll
C:\Windows\SysWOW64\jscript9.dll
imageres.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\34420c5bbb60572350b8af1a12d94451\Microsoft.WSMan.Management.ni.dll
C:\Windows\syswow64\USP10.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\716ee14dc9aafde2b5f7f387d842661d\System.ServiceProcess.ni.dll
WS2_32.DLL
API-MS-Win-Security-SDDL-L1-1-0.dll
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\Button.dll
KERNEL32
Riched32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\tr-TR\mscorrc.dll
C:\Windows\system32\odbcint.dll
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\ToolTips.dll
IEFRAME.dll
C:\Windows\system32\ntshrui.dll
C:\Windows\SysWOW64\WScript.exe
IdnDL.dll
C:\Windows\syswow64\LPK.dll
C:\Windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
C:\zlib.pyd
SXS.DLL
MSVCRT.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll
ieframe.dll
C:\Users\win7\AppData\Local\Temp\SETUP_41436\Engine.EN
advpack.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\1a6d99549254a6a0dbac7b728f3e010b\Microsoft.PowerShell.Commands.Diagnostics.ni.dll
SSPICLI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\VERSION.dll
C:\Users\win7\AppData\Local\Temp\bga3D11.tmp
OLEAUT32.DLL
MPR.dll
C:\Windows\SysWOW64\sechost.dll
C:\Windows\system32\IMM32.DLL
C:\Windows\system32\xmllite.dll
C:\Users\win7\AppData\Local\Temp\nsa73EB.tmp\System.dll
OLEACC.DLL
C:\Users\win7\AppData\Local\Temp\nss29BA.tmp\g\pfWWW
mshtml.dll
mtxoci.dll
CRYPTSP.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bcrypt.dll
uxtheme.dll
ncrypt.dll
lua5.1.dll
slc.dll
sxs.dll
USER32.DLL
WSOCK32.DLL
newdev.dll
DWMAPI.DLL
IPHLPAPI.DLL
POWRPROF.dll
setupapi.dll
dwmapi.dll
C:\Windows\system32\QuickTime.qts
comdlg32.dll
C:\Windows\system32\directx\websetup\dsetup32.dll
C:\Windows\system32\crypt32.dll
DnsApi.dll
C:\Windows\syswow64\api-ms-win-downlevel-version-l1-1-0.dll
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\nsDialogs.dll
C:\Users\win7\AppData\Local\Temp\nso3A98.tmp\KPTool.dll
PROPSYS.dll
c:\windows\system32\imageres.dll
C:\icons.dll
oleaut32.dll
bcrypt.dll
NSI.dll
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\Button.dll
MSISIP.DLL
C:\Users\win7\AppData\Local\Temp\nsx74CC.tmp\Banner.dll
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\sndsock.dll
C:\Users\win7\AppData\Local\Temp\nsx74CC.tmp\nsExec.dll
C:\Users\win7\AppData\Local\Temp\caa414.EN
C:\Windows\SysWOW64\wshext.dll
C:\Windows\system32\WINMM.dll
MLANG.dll
C:\Users\win7\AppData\Local\Temp\nss29BA.tmp\g\gtapi_signed
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\Banner.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\alink.dll
C:\Users\win7\AppData\Local\Google\Chrome\Application\chrome.exe
kernel64
wsock32.dll
C:\Users\win7\AppData\Local\Temp\wwaE1E2.ENU
C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18834_none_72d38c5186679d48\gdiplus.dll
C:\Users\win7\AppData\Local\Temp\is-FIM1G.tmp\sample.ENU
UIAutomationCore.dll
werui.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\1033\cscompui.dll
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\System.dll
Kernel32.dll
C:\Users\win7\AppData\Local\Temp\nss29BA.tmp\UserInfo.dll
oci.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d49908aa93a23c84847b1f8b1b667860\System.Xml.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6949c4470a81970ec3de0a575d93babc\System.Windows.Forms.ni.dll
C:\Windows\SysWOW64\ntdll.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll
API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\61bdc0f0c598b66a5af21dc10f824141\Microsoft.PowerShell.Commands.Management.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll
C:\Users\win7\AppData\Local\Temp\caa414.tmp
api-ms-win-core-localization-l1-2-1
dsetup.dll
OLEACCRC.DLL
MSVCR80.dll
jScript.dLL
C:\Windows\system32\RICHED20.DLL
C:\Windows\SysWOW64\TSAPPCMP.DLL
MSVCR90.dll
C:\Users\win7\AppData\Local\Temp\is-5VJ0O.tmp\itdownload.ENU
CRYPTBASE.dll
C:\Users\win7\AppData\Local\Temp\is-5VJ0O.tmp\itdownload.EN
uSeR32
API-MS-WIN-Service-Management-L1-1-0.dll
API-MS-WIN-Service-Management-L2-1-0.dll
C:\Users\win7\AppData\Local\Temp\is-5VJ0O.tmp\itdownload.dll
User32
C:\DXGIDebug.dll
gdi32
ntshrui.dll
Advapi32.dll
rasapi32.dll
Avira.OE.Setup.InstallationCore.dll
C:\Users\win7\AppData\Local\Temp\{315dd168-0794-4cf1-8355-f195cde642fc}\.ba1\WixStdBA.dll
C:\Windows\System32\setupapi.dll
C:\Users\win7\AppData\Local\Temp\nss29BA.tmp\nsDialogs.dll
C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
C:\Windows\syswow64\KERNEL32.dll
api-ms-win-downlevel-shlwapi-l2-1-0.dll
C:\Windows\system32\DXGIDebug.dll
ShFolder.DLL
rpcrt4.dll
C:\Windows\syswow64\normaliz.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
IMAGEHLP.DLL
C:\Users\win7\AppData\Local\Temp\is-0AH6L.tmp\sample.EN
api-ms-win-core-sysinfo-l1-2-1
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\ea543310204d0addfaf9792d820e958d\PresentationFramework.ni.dll
cscapi.dll
olepro32.dll
C:\Users\win7\AppData\Local\Temp\7zSF225.tmp\SCC.dll
Comctl32.dll
VBoxDisp.dll
api-ms-win-core-synch-l1-2-0
C:\Users\win7\AppData\Local\Temp\is-FIM1G.tmp\sample.EN
C:\Users\win7\AppData\Local\Temp\dfs91B6.tmp
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\nsDialogs.dll
AdvApi32.dll
C:\Windows\system32\DUser.dll
MsiMsg.dll
C:\Windows\system32\wu.upgrade.ps.dll
C:\Windows\system32\wsock32.dll
C:\Users\win7\AppData\Local\Temp\nsx74CC.tmp\LogEx.dll
SideBar.dll
C:\Users\win7\AppData\Local\Temp\nsn464.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\EmbedWeb.dll
WININET.dll
RichEd20.dll
DNSAPI.dll
C:\Windows\syswow64\dbghelp.dll
C:\Users\win7\AppData\Local\Temp\nso3A98.tmp\NSISdl.dll
C:\Windows\SysWOW64\KERNEL32.DLL
C:\Windows\SysWOW64\ieframe.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
C:\CFVS_HookDll.dll
C:\PotPlayer.dll
C:\Windows\system32\IconCodecService.dll
KerNEl32.DlL
MSDART.dll
SspiCli.dll
C:\Windows\SysWOW64\NETAPI32.DLL
C:\PYTHON26.DLL
C:\Users\win7\AppData\Local\Temp\nss29BA.tmp\g\gcapi_dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll
MSIMG32.DLL
WINTRUST.DLL
Shell32.dll
C:\Users\win7\AppData\Local\Temp\nstD3DD.tmp\nsExec.dll
propsys.dll
C:\Users\win7\AppData\Local\Temp\nsj20C1.tmp\UserInfo.dll
MSLS31.dll
RICHED32.DLL
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\comctl32.dll
C:\Users\win7\AppData\Local\Temp\RBX-1D~1.TMP
C:\Windows\system32\QuickTime\QuickTime.qts
C:\Users\win7\AppData\Local\Temp\OTuttipw8f.tmp\htmlayout.dll
C:\Users\win7\AppData\Local\Temp\wwaE1E2.tmp
C:\Users\win7\AppData\Local\Temp\nsmF380.tmp\nsisXML.dll
C:\Users\win7\AppData\Local\Temp\nsa73EB.tmp\WmiInspector.dll
feclient.dll
C:\Users\win7\AppData\Local\Temp\nspE41A.tmp\System.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\4fddb3cf84aed83214f65fbe791348e5\Microsoft.PowerShell.ConsoleHost.ni.dll
C:\Users\win7\AppData\Local\Temp\nsp18E7.tmp\EmbedWeb.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\system32\cryptnet.dll
C:\Windows\system32\DNSAPI.dll
shdocvw.dll
lz32
rstrtmgr.dll
C:\Users\win7\AppData\Local\Temp\nst1E41.tmp\DcryptDll.dll
ADVAPI32.DLL
C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe
C:\Windows\SysWOW64\DDRAW.dll
C:\Windows\SysWOW64\ADVAPI32.DLL
C:\Windows\system32\ws2_32
FreeMibTable
CryptSetHashParam
GetThemeBackgroundContentRect
CommDlgExtendedError
SHGetFolderPathA
PrinterMessageBoxW
CreateXmlReader
GetMartaExtensionInterface
ShutdownBlockReasonCreate
ImmGetContext
SetLoadedByMscoree
BeginBufferedAnimation
NotifyIpInterfaceChange
DrawThemeText
GetThemeBool
EnumPortsW
WindowFromPhysicalPoint
DeletePrinterDataExW
idpStartDownload
HIMAGELIST_QueryInterface
GetThemeFont
SHGetDesktopFolder
WinHttpCreateProxyResolver
AddPrintProvidorW
CloseThemeData
GetThemeEnumValue
DeviceCapabilitiesW
RegQueryValueExW
DnsFree
FlushPrinter
GdipDeleteRegion
VarFix
SHGetValueW
GdipGetImageBounds
DrawSizeBox
TaskDialogIndirect
VariantToStringWithDefault
WaitForPrinterChange
AddMonitorW
DocumentPropertySheets
DeleteMethod
GetPrinterDriverW
AdvancedDocumentPropertiesA
SpInfGetLineTextWithKey
GetDefaultPrinterW
AddJobW
PutInstanceWmi
WinHttpConnect
mciSendStringW
ConfigurePortW
ResetSecurity
SetDCBrushColor
GetThemeColor
LoadLibrary
D3DKMTLock
AdjustTokenPrivilegesW
GetTraceEnableFlags
ImpersonateSelf
GetThemeSysSize
GetFormW
BufferedPaintRenderAnimation
LookupAccountSidA
PlayGdiScriptOnPrinterIC
GetLastActivePopup
SetGadgetFocus
GdipGetFontUnit
ConnectServerWmi
D3DKMTQueryAllocationResidency
SLGetWindowsInformationDWORD
StartDocPrinterW
GdipFillEllipseI
InitThread
DevicePropertySheets
PSPropertyBag_ReadDWORD
UnregisterMessagePumpHook
EnumPrintersW
DeletePrintProvidorW
GlobalAddAtomW
CompareSecurityIds
GetHashInterface
EnumPrintProcessorDatatypesW
get
CharLowerBuffW
CheckETWTLS
_getwch
SetPrinterDataExW
setsockopt
WSAQuerySocketSecurity
CreateDCA
D3DKMTCreateContext
CPImportKey
D3DKMTCreateAllocation
DestroyIcon
AddPrinterDriverExW
PSPropertyBag_ReadGUID
GetCipherInterface
AppendMenuW
EtwUnregisterTraceGuids
CreateXmlReaderInputWithEncodingName
__clean_type_info_names_internal
OpenPrinter2W
DeletePrintProcessorW
__sys_nerr
VarDecFromDate
SetRTL
?IsContentProtected@Element@DirectUI@@UAE_NXZ
OpenAdapter10_2
IUnknown_QueryService
DrawThemeParentBackgroundEx
WinHttpOpenRequest
CredFree
GetThreadPreferredUILanguagesW
RmShutdown
OleDestroyMenuDescriptor
StartDocDlgW
Delete
GetClipboardFormatNameW
GetAdaptersAddresses
DevRtlGetThreadLogToken
__dllonexit
AddPortW
OpenProcessW
time
FindFirstChangeNotificationA
SetPrinterDataW
EnumPrinterDriversW
LoadIconW
QualifierSet_Get
GetOverlappedResult
ShowHTMLDialog
CryptDestroyKey
EnableThemeDialogTexture
ThemeInitApiHook
GetUserNameExW
CryptCreateHash
InitializeFlatSB
SxsOleAut32RedirectTypeLibrary
GetUserNameExA
SetMenuItemBitmaps
GetBufferedPaintDC
DeletePrinterDataW
GetFileVersionInfoSize
ConvertStringSecurityDescriptorToSecurityDescriptorW
CreateProcessWithLogonW
OnChange
CryptDestroyHash
gethostbyname
atoi
CryptGetHashParam
AdvancedDocumentPropertiesW
GetTokenInformation
D3DKMTSignalSynchronizationObject
GetUserName
GdipCreateBitmapFromScan0
D3DKMTDestroySynchronizationObject
WSNoteSuccessfulHostentLookup
ClosePrinter
SpoolerPrinterEvent
GetClipboardFormatNameA
InternetSetFilePointer
VarUdateFromDate
D3DKMTWaitForVerticalBlankEvent
CreateIconIndirect
SetupIterateCabinetW
GetIfEntry2
CreateDUIWrapper
GetWindowTheme
ImageList_GetImageCount
RegisterClassNameW
GdipDeleteStringFormat
ConvertLangIdToCultureName
shutdown
GdipResetPath
SetThreadToken
IsValidDevmodeW
SetTokenInformation
IsDlgButtonChecked
PSPropertyBag_ReadBSTR
?ProcessFilenameInfo@ExtensionApi@Setup@OE@Avira@@YGXPA_WPAPA_W@Z
CoGetApartmentType
GetIpNetEntry2
GetTokenForVTableEntry
GetNamedSecurityInfoA
Free
DrawThemeBackground
OleCreatePropertyFrameIndirect
GetPrivateProfileIntA
select
CoGetClassObject
SetPrinterW
ImmNotifyIME
DwmIsCompositionEnabled
SHFileOperationA
DllGetClassObject
ImageList_DragMove
InitCommonControlsEx
QuerySystemGestureStatus
IsThemePartDefined
VariantClear
GetThemeTextExtent
ImageList_Add
wcscmp
CryptImportKey
D3DKMTSetContextSchedulingPriority
SetGadgetStyle
GetNextDlgGroupItem
GetMethod
D3DKMTDestroyDevice
BringWindowToTop
LockFileEx
strstr
DocumentPropertiesW
D3DKMTSetVidPnSourceOwner
idpAddMessage
StretchBlt
CreateBitmap
_Unload
EnumPrinterKeyW
GetPrinterDriverPackagePathW
wcsncat
BindMoniker
_isatty
CPGetProvParam
GetThemeTextMetrics
idpSetInternalOption
LZClose
D3DKMTQueryAdapterInfo
IsNetworkAlive
GetThemeSysColorBrush
DrawScrollBar
ImageList_SetOverlayImage
__p__fmode
WSHIoctl
waveOutGetVolume
GetBestInterfaceEx
OleCreatePictureIndirect
SHGetMalloc
EnumFormsW
DeleteMonitorW
GetThemeSysFont
?SetFontSize@Element@DirectUI@@QAEJH@Z
SetRectEmpty
DisableContainerHwnd
CPSetKeyParam
CreateLinkInfoW
?OnWindowStyleChanged@HWNDHost@DirectUI@@UAEXIPBUtagSTYLESTRUCT@@@Z
isdigit
GetPrinterDriverDirectoryW
OleSetContainedObject
DnsQueryExW
CreatePrinterIC
HeapCreate
GetThemeMargins
GetThemeIntList
ControlService
CPCreateHash
SciterAPI
NtSetSystemInformation
ImageList_SetIconSize
ftell
CombineRgn
OutputDebugStringA
BCryptFinishHash
_CIsqrt
GetIfEntry
VerLanguageNameW
WSARecvFrom
IsClipboardFormatAvailable
EnumJobsW
FindFirstChangeNotificationW
BeginBufferedPaint
CCSetScrollInfo
DrawShadowText
strchr
D3DKMTCreateDevice
DeletePrinterDriverW
?GetByClassIndex@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
InstallPrinterDriverFromPackageW
_getche
D3DKMTSetGammaRamp
waveOutSetVolume
D3DKMTRender
islower
frexp
AddPrinterW
SetConsoleCtrlHandlerW
SplDriverUnloadComplete
GetFullPathNameA
VarCat
BeginMethodEnumeration
LZOpenFileW
IsValidDevmodeA
CreateDCW
GetCurrentApartmentType
BufferedPaintStopAllAnimations
ImageDirectoryEntryToData
_ns_clear
SetDefaultPrinterW
DeletePrinterKeyW
luaL_openlib
CreateInstanceEnumWmi
ExecNotificationQueryWmi
GdiplusStartup
AddPrinterDriverExA
ImageList_Draw
BufferedPaintInit
ImageList_AddMasked
AttachScrollBars
Beep
CryptGenRandom
DrawThemeParentBackground
GetPrinterW
__GetMainArgs
FindMimeFromData
FlsFree
WaitForThreadpoolTimerCallbacks
FindWindowExW
ScriptPlace
StringFromCLSID
ResetPrinterW
PathStripToRootW
fclose
__initenv
RmEndSession
ExecToStack
WNetGetResourceInformationW
IStream_Size
GetFileInformationByHandleEx
OleLoadPictureEx
socket
BCryptHashData
GetThemePartSize
PlaySoundA
DirectXSetupGetEULAW
GetJobW
GetDateFormatEx
DispatchMessage
EndPath
TlsGetValue
ImageList_Create
ConvertInterfaceGuidToLuid
GetStdHandleW
FindAtomW
IsThemeBackgroundPartiallyTransparent
D3DKMTGetThunkVersion
DeletePortW
RegisterDragDrop
getJit
WSHNotify
isxdigit
GdipGetFamilyName
DefWindowProc
MsiSIPIsMyTypeOfFile
SetDIBColorTable
DeviceIoControl
AddPrintProcessorW
DllCanUnloadNow
_write
IsAppThemed
DetachWndProc
NotifyUnicastIpAddressChange
NetShareEnum
PSStringFromPropertyKey
WinHttpOpen
WinStationRegisterConsoleNotification
clock
LookupAccountSidW
FlatSB_GetScrollPos
ShellExecuteW
SHGetValueA
WinHttpGetProxyForUrl
ReleaseSRWLockExclusive
CompatValue
InitializeCriticalSectionEx
GetMenuState
DeleteTimerQueueTimer
GetProcessExecutableHeap
FlatSB_SetScrollRange
RegCreateKeyA
IsAppThemedW
CCGetScrollInfo
SafeArrayAccessData
RegOpenKeyExW
GetFileVersionInfoW
GetCurrentDirectory
memcpy
MessageBox
SHFileOperationW
DeletePrinterDriverPackageW
ImageList_Replace
EndBufferedPaint
BCryptDestroyHash
ImageList_DrawIndirect
WerUIPromptForSecondLevel
CoTaskMemAlloc
vfprintf
ForwardGadgetMessage
D3DKMTCloseAdapter
UploadPrinterDriverPackageW
ScreenToClient
WSASetSocketPeerTargetName
CPExportKey
ScrollBar_Menu
EventActivityIdControl
GetThemeRect
?PostCreate@CCBase@DirectUI@@MAEXPAUHWND__@@@Z
Alloc
BCryptCreateHash
GdipGetPropertyItem
WNetGetResourceInformationA
DeletePrinterDriverExW
BCryptOpenAlgorithmProvider
ChooseColorA
IIDFromString
DeletePrinterConnectionW
CPGenKey
PathCreateFromUrlW
Process32NextW
_gmtime64
WinHttpGetIEProxyConfigForCurrentUser
AddPortExW
?OnDestroy@HWNDHost@DirectUI@@UAEXXZ
CoSuspendClassObjects
_tempnam
OpenThemeData
SetFileTime
show
ImageList_GetIconSize
CoCreateInstance
IdnToAscii
mixerGetControlDetailsW
DeletePrinterIC
RtlUnhandledExceptionFilter
CloneEnumWbemClassObject
ObjectStublessClient10
DhcpRequestParams
CorePrinterDriverInstalledW
DnsApiFree
getsockopt
ShellExecuteA
IStream_Read
FlushViewOfFile
WerUICreate
SHBrowseForFolderW
_strcmpi
SHCreateMemStream
SetProcessAffinityMask
connect
GetThemeTransitionDuration
?OnMessage@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
GetThemeInt
gai_strerror
GetFullPathNameW
Wow64RevertWow64FsRedirection
GetClientRect
SHGetFolderPathW
GdipGetLineSpacing
GetCorePrinterDriversW
SetVolumeMountPointA
CreateGadget
GetThemePropertyOrigin
ImmSetCompositionFontW
GetDUserModule
GetCurrentProcessId
GetSystemPowerStatus
ImageList_BeginDrag
FindNextPrinterChangeNotification
ImmDestroyContext
Module32NextW
GetDriveTypeW
OpenMutex
GdipFree
CryptHashData
InvalidateGadget
GetKeyboardType
??0ClassInfoBase@DirectUI@@QAE@XZ
RegisterEventSourceW
CryptGenKey
GdipGetImagePixelFormat
ExitProcess
EnumPrinterDataExW
EnumMonitorsW
FindExecutableA
SetGadgetFocusEx
TlsAlloc
RectVisible
BufferedPaintUnInit
PSCreateMemoryPropertyStore
RtlUnwind
SxsOleAut32MapIIDToProxyStubCLSID
EnumFontFamiliesA
strrchr
NtAllocateVirtualMemory
EnumPrintProcessorsW
?Initialize@CCBase@DirectUI@@QAEJIPAVElement@2@PAK@Z
CreateCompatibleBitmap
I_RpcExtInitializeExtensionPoint
ScrollDC
CompareStringA
Heap32ListNext
EnumDisplaySettingsA
HandleScrollCmd
IEE
FlatSB_GetScrollProp
WritePropertyValue
?EndDefer@Element@DirectUI@@QAEXK@Z
CryptAcquireContextA
SetFormW
VerLanguageName
OleLockRunning
FDICreate
GdipGetImageHeight
SaferiSearchMatchingHashRules
_tzset
SetupDiGetDeviceInterfaceDetailW
BlessIWbemServicesObject
HitTestThemeBackground
LineTo
CoTaskMemFree
FindClose
GetThemePosition
GdipDrawImageI
timeGetTime
Chord
SslImportKey
D3DKMTSetQueuedLimit
EndDoc
_onexit
SetGadgetMessageFilter
ImmCreateContext
BCryptGenRandom
Clone
?OnPropertyChanging@Element@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
EnumProcessModulesW
FlatSB_SetScrollPos
WinHttpReceiveResponse
SystemFunction035
WinHttpReadData
GetGadgetFocus
ActivateActCtx
GetTextExtentPoint32A
_unlink
WNetOpenEnumA
VerQueryValueW
wcsrchr
ScrollBar_MouseMove
_set_s
D3DKMTWaitForSynchronizationObject
CreateActCtx
D3DKMTUnlock
WSHStringToAddress
D3DKMTGetContextSchedulingPriority
GetGUIThreadInfo
SetThreadpoolWait
WinHttpCrackUrl
WSHGetSocketInformation
SslOpenProvider
GetFileInformationByHandle
WinHttpSendRequest
CPDuplicateKey
CryptRetrieveObjectByUrlW
CryptExportKey
GetRecordInfoFromGuids
IUnknown_SetSite
SHRegGetValueW
_set_o
RegisterClass
CharNextA
MsiSourceListAddSourceExW
GetMethodQualifierSet
GetCaretPos
EndBufferedAnimation
FormatMessageA
GdipGetImageWidth
SHBrowseForFolderA
DirectXSetupA
WSAGetLastError
_setmode
SetThemeAppProperties
SetGadgetParent
GlobalDeleteAtom
DeleteHandle
SetPortW
FlsAlloc
GetFileVersionInfoSizeW
DUserFlushMessages
InternetOpenA
AddPrinterConnectionW
WerReportCloseHandle
CoGetMarshalSizeMax
EndEnumeration
load
GdipImageForceValidation
UuidCreateSequential
GdipAlloc
RegCreateKeyExW
SHStrDupW
FlatSB_GetScrollRange
SxsOleAut32MapConfiguredClsidToReferenceClsid
_init
QualifierSet_Delete
CompareStringW
SetJobW
GetSidSubAuthority
FlatSB_EnableScrollBar
FindResourceA
SafeArrayPutElement
?GetClassInfoPtr@CCBase@DirectUI@@SGPAUIClassInfo@2@XZ
CreatePopupMenu
?OnGroupChanged@Element@DirectUI@@UAEXH_N@Z
CPHashData
DeleteUrlCacheContainerA
AddPrinterConnection2W
GetMetaDataInternalInterface
CoUninitializeEE
ImageList_Remove
WinHttpSetOption
ImmGetOpenStatus
SetTargetForVTableEntry
PSPropertyBag_ReadStrAlloc
GdipGetFontSize
strerror
UiaClientsAreListening
GetThemeString
RegEnumValueW
CloseServiceHandle
recv
CoRegisterInitializeSpy
DnsGetProxyInformation
GetTextExtentPoint32W
DnsApiAlloc
WerReportAddFile
D3DKMTOpenResource
MsiGetPatchInfoExW
DefMDIChildProcW
WinHttpQueryHeaders
GetEnhMetaFilePaletteEntries
SpFileQueueOpen
GetModuleHandle
GetFileVersionInfoA
FormatMessageW
GetHostConfigurationFile
GdipFillRectangleI
bind
CreateClassEnumWmi
_decode_pointer
idpDownloadFilesCompUi
GetDiskFreeSpaceExA
SetAddrInfoExW
WNetUseConnectionW
SetWindowTextA
EndMethodEnumeration
RegDeleteValueW
SslDecryptPacket
ExecQueryWmi
WTSEnumerateSessionsExW
GdipCreateFontFamilyFromName
UnregisterClassA
PostQueuedCompletionStatus
GetTraceLoggerHandle
OleIconToCursor
FindWindowW
EnumWindows
IsThemeActive
CPSetHashParam
DrawTextExWW
DeleteFormW
CPAcquireContext
mixerGetLineControlsA
lua_setfield
fputs
GetSaveFileNameA
WSHGetBroadcastSockaddr
?SetHeight@Element@DirectUI@@QAEJH@Z
D3DKMTGetDisplayModeList
RemoveWindowSubclass
system
LoadLibraryW
CoInitializeEE
CreateEllipticRgn
DhcpQueryLeaseInfo
iswctype
DhcpIsEnabled
GetCLRFunction
RmRegisterResources
GetLongPathNameW
_initterm
SafeArrayCreateEx
FindExecutable
InternetOpenW
WinStationFreeGAPMemory
SpawnInstance
CryptSIPVerifyIndirectData
SpInfGetNextInf
UnregisterHotKey
OffsetRgn
D3DKMTCreateSynchronizationObject
FindStdColor
WSAIsBlocking
LoadIconA
SafeArraySetRecordInfo
CryptVerifySignatureA
release
CreateBrushIndirect
LocalAllocW
CharUpperBuffA
ImmGetCompositionWindow
SetParent
OnClick
SHAutoComplete
FlatSB_SetScrollProp
GetDiskFreeSpaceExW
getText
GdipSetPathFillMode
lua_tolstring
D3DKMTSetAllocationPriority
WaitForSingleObject
GetDemultiplexedStub
SetWindowOrgEx
EnumPrinterDataW
CoInternetIsFeatureEnabledForIUri
GetModuleInformationW
CscNetApiGetInterface
NlsGetCacheUpdateCount
OutputDebugStringW
CLSIDFromOle1Class
memmove
DirectDrawCreate
GetQualifierSet
ConvertSidToStringSidW
GetNetResourceFromLocalPathW
RealChildWindowFromPoint
SetCursorPos
GetFileInformationByHandleExW
TracePrintfExA
wcslen
WSHOpenSocket2
GetPrintProcessorDirectoryW
CCEnableScrollBar
GetThemeFilename
D3DKMTCheckSharedResourceAccess
NSPStartup
SetWindowTextW
GetStartupFlags
SetConsoleTextAttribute
AddAtom
GetThreadLocale
UnregisterClassW
WerUIUpdateUIForState
GetIpForwardTable2
fputc
GdipDeleteFont
GetCurrentProcessorNumber
IUnknown_Set
InitOnceExecuteOnce
ScheduleJob
lua_pushcclosure
itd_initui
RegQueryValueExA
AppendMenuA
StrFormatByteSize64
SHGetFolderPath
GetThreadContext
StrCmpNIA
DeleteFile
GetCORSystemDirectory
GetThemeAppProperties
strxfrm
_set_i
VerQueryValueA
GdipSetLineWrapMode
LresultFromObject
SetupDiLoadClassIcon
ImageList_DragLeave
MsiSetExternalUIRecord
_CIsin
DefSubclassProc
SHCreateAssociationRegistration
_encode_pointer
FlatSB_GetScrollInfo
CharNextW
GetIfTable
NetGetJoinInformation
GetDesktopWindow
IdnToNameprepUnicode
ShowWebInPopUp
_set_c
GetEnhMetaFileDescriptionW
CryptAcquireContextW
RestoreDC
mixerClose
IsValidSid
_set_d
DwmExtendFrameIntoClientArea
GetNamedSecurityInfoW
WinHttpQueryDataAvailable
ImmSetConversionStatus
idpAddFile
ConvertInterfaceNameToLuidW
GetCursor
CreateDirectory
GetThemeDocumentationProperty
GetAcceptExSockaddrs
GetPrinterDataExW
_wremove
InheritsFrom
WSHOpenSocket
AddFormW
VarCyMulI4
isupper
abs
GetSaveFileNameW
D3DKMTSetDisplayPrivateDriverFormat
BeginEnumeration
mixerGetLineInfoW
VarWeekdayName
CryptMsgClose
CoInternetCombineUrlEx
SafeArrayAllocDescriptorEx
CreatePatternBrush
D3DKMTPresent
InternetGetCookieExW
SetCurrentDirectoryW
StrStrIA
CreateAssemblyEnum
WerUIStart
FindNextStreamW
GetWindowThreadProcessId
GetGadgetRect
strlen
strpbrk
ImageList_Write
GetThemeBackgroundRegion
CharLowerA
ReleaseStgMedium
D3DKMTOpenAdapterFromDeviceName
PSCreateAdapterFromPropertyStore
SetSkin
CryptGetKeyParam
InitializeSecurityDescriptor
HttpQueryInfoW
SetServiceStatus
FillRgn
GetPropertyOrigin
DecodePointer
CreateAssemblyEnumW
CPDestroyHash
CreateScalableFontResourceA
SetWindowSubclass
D3DKMTQueryResourceInfo
MsiSIPVerifyIndirectData
GetBufferedPaintTargetDC
StartServiceA
_TrackMouseEvent
SxsOleAut32MapIIDOrCLSIDToTypeLibrary
GetPrivateProfileSectionA
GdipGetImageRawFormat
?HandleUiaPropertyChangingListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@@Z
AddEventHandler
wcschr
_setjmp3
DhcpFreeLeaseInfo
sprintf
GetProfileIntA
WinHttpSetStatusCallback
RtlQueryElevationFlags
GdipGetLogFontW
GetCurrentDirW
IsWindowRedirectedForPrint
strftime
SpFileQueueClose
QueryActCtxW
BCryptGetProperty
PolyPolygon
InternetConnectW
CharLowerW
FindCloseChangeNotification
InvalidateRect
GetThemeBackgroundExtent
D3D11CreateDevice
GetModuleHandleExW
GetFileVersionInfo
InetPtonW
MulDiv
WinHttpGetDefaultProxyConfiguration
GetThemeSysColor
destroy
SetupInstallFromInfSectionA
RegGetValueW
MapAndLoad
CreateURLMonikerEx
RmGetList
GetCurrentThemeName
OpenPrinterW
__WSAFDIsSet
GetThemeSysString
SetGadgetRect
CoInternetCreateSecurityManager
RtlFillMemory
NamespaceCallout
GetTextExtentExPointA
SetVolumeLabelW
GdipSetEmpty
IsCompositionActive
lstrlen
SpInfGetOriginalInfName
SHCreateDirectoryExW
WSPStartup
SetWindowLongW
PropVariantToString
PnpIsFilePnpDriver
VarRound
SpInfFileFullPathFromLineContext
CORPolicyEE
WinHttpSetTimeouts
GlobalFindAtomW
LocalReAlloc
WSHSetSocketInformation
GetThemeSysBool
ScriptGetProperties
GdipDeleteGraphics
InterlockedCompareExchange
SetCurrentDirectoryA
StrStrIW
WSAttemptAutodialAddr
SpFileQueueSetFlags
GdipCreateHBITMAPFromBitmap
InitGadgets
NtGetCurrentProcessorNumber
LockFile
GetClassInfoExW
ExpandEnvironmentStringsW
GdipCloneBrush
OpenPrinterA
DefMDIChildProcA
ConvertStringSidToSidW
DragFinish
InterlockedExchangeAdd
FreeEnvironmentStringsA
GetFileVersionInfoSizeA
SetNamedSecurityInfoA
FlatSB_SetScrollInfo
PutSignedDataMsg
GetOEMCP
_dup2
DUserFlushDeferredMessages
GetScrollInfo
SetActiveWindow
SpInfLineFromContext
_CorExeMain
RemovePropW
tmpnam
D3DKMTGetDeviceState
asin
EnumPrintersA
_CIfmod
LocalSize
itd_getstring
RemoveClipboardFormatListener
SetThreadUILanguage
OleSaveToStream
CryptReleaseContext
?OnHosted@HWNDHost@DirectUI@@MAEXPAVElement@2@@Z
NextMethod
CM_Get_DevNode_Status
__set_app_type
idpFilesDownloaded
CreateRoundRectRgn
CoUninitialize
SoftpubLoadMessage
FCIAddFile
GdipDrawString
SxsLookupClrGuid
SHGetKnownFolderIDList
IsThemeDialogTextureEnabled
luaL_loadbuffer
PutMethod
GetThemeSysInt
GetProcessHeap
WSHAddressToString
GetPrinterDataW
WSHGetWildcardSockaddr
GetPrivateProfileSectionW
GetThemeBitmap
SetWindowLongA
RegDeleteValueA
?OnPropertyChanged@CCBase@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
GetBkMode
StringFromGUID2
DuplicateTokenExW
exp
CreateAssemblyCache
OleCreateFontIndirect
??0CritSecLock@DirectUI@@QAE@PAU_RTL_CRITICAL_SECTION@@@Z
GetTextExtentExPointW
I_CryptNetGetConnectivity
GetAccountType
VerifyClientKey
GetConsoleScreenBufferInfoW
GetScrollRange
Module32First
asctime
Create
GlobalFindAtomA
malloc
Put
GetGadgetTicket
FreeEnvironmentStringsW
GetLastError
NetApiBufferFree
GetUpdateRgn
?GetModule@ClassInfoBase@DirectUI@@UBEPAUHINSTANCE__@@XZ
DdeInitializeA
GdipSetClipRectI
_fdopen
FreeCredentialsHandle
WSAStartup
HeapFree
DUserSendEvent
D3DKMTGetMultisampleMethodList
GetWindowTextLength
GdipSetTextRenderingHint
DetachScrollBars
getpeername
listen
SizeBoxHwnd
D3DKMTEscape
mixerGetLineInfoA
SafeArraySetIID
WSHJoinLeaf
VarBoolFromStr
GetGestureInfo
GdipCreateHalftonePalette
InternetConnectA
EmptyClipboard
InvertRect
?OnUnHosted@HWNDHost@DirectUI@@MAEXPAVElement@2@@Z
ShellExecuteEx
ferror
__sys_errlist
CloseGestureInfoHandle
closesocket
GetVersionExA
Show
LoadImageA
CreateSolidBrush
GetWindowThreadProcessIdW
VarR4FromDec
?SetWidth@Element@DirectUI@@QAEJH@Z
GetKeyboardLayoutNameW
GetTextExtentPointW
IsValidCodePage
GdiplusShutdown
MapViewOfFile
IsMenu
CreateEventExW
GetKeyboardLayout
GetWindowTextLengthA
EnumDisplayDevicesW
RegEnumValue
tmpfile
QualifierSet_GetNames
TranslateMessage
D3DKMTDestroyContext
lua_type
D3DKMTSetDisplayMode
cos
GdipTranslateRegionI
StrFormatByteSizeW
fwprintf
RegSaveKeyA
lua_isnumber
SetConsoleCtrlHandler
SetViewportExtEx
_wcsicmp
SetWindowTheme
OpenThemeDataW
CreateControl
luaL_openlibs
CloseWbemTextSource
CoInitialize
setlocale
SetProcessDPIAware
strncat
GdipGetGenericFontFamilySansSerif
InternetOpenUrlA
_beginthreadex
VerifyVersionInfoA
OleUIBusyW
CopyBindInfo
FindFirstVolumeA
EnumSystemLocalesW
StartServiceCtrlDispatcher
RegRestoreKeyW
RemovePropA
ExpandEnvironmentStringsA
CertDllVerifyRevocation
_strnicmp
RegisterBindStatusCallback
OleRun
FlatSB_ShowScrollBar
LoadUserProfileW
GdipCreateFont
SetEnvironmentVariable
DestroyLinkInfo
SpInfGetVersionNode
FindFirstStreamW
QueryPerformanceFrequency
DdeClientTransaction
?CreateAccNameLabel@HWNDHost@DirectUI@@IAEPAUHWND__@@PAU3@@Z
ScaleViewportExtEx
ImageList_ReplaceIcon
SHCreateThread
_set_error_mode
CPGetHashParam
GdipSetPathGradientSurroundColorsWithCount
SslIncrementProviderReferenceCount
itd_setstring
_adjust_fdiv
RmRestart
CheckDlgButton
D2D1MakeRotateMatrix
GdipDrawImageRectRect
cosh
GetSidIdentifierAuthority
_atoi64
_unlock
SHGetFileInfoW
D3DKMTCheckVidPnExclusiveOwnership
UiaReturnRawElementProvider
SetFileAttributesA
_fileno
GetDriveTypeA
UpdateLayeredWindow
FtpGetFileSize
GetPropertyQualifierSet
GetCurrentActCtx
IsNTAdmin
SetTextAlign
SetNamedSecurityInfoW
CreatePen
RegLoadKeyW
GetWindowTextLengthW
DeleteService
ungetc
InitProcessPriv
AddVectoredContinueHandler
GetSecurityInfo
EnumSystemLocalesA
Int64Op
GetSystemDefaultLangID
WTSFreeMemory
EndDeferWindowPos
DragAcceptFiles
VarImp
ImageList_EndDrag
GetFileTime
GetCPInfo
BeginPath
HttpSendRequestW
GdipCreateBitmapFromHBITMAP
LoadLibraryShim
MsiSIPPutSignedDataMsg
AttachWndProcW
Dhcpv6FreeLeaseInfo
DnsQuery_A
getc
CPDeriveKey
itd_addfile
Next
mciGetErrorStringA
UrlCanonicalizeW
CoReleaseServerProcess
IStream_Reset
strcmp
EnumDisplayDevicesA
GetTitleBarInfo
SaveDC
GetOpenFileNameW
gethostname
GetCurrentThreadCompartmentId
CreateSemaphoreExW
TryAcquireSRWLockExclusive
GdiIsMetaPrintDC
GetAsymmetricEncryptionInterface
VarBstrFromDate
RegisterClassExW
CopyEnhMetaFileW
PostThreadMessageA
printf
ioctlsocket
CreateDXGIFactory
GdipCreateFromHDC
SetUserData
RasConnectionNotificationW
ConvertSidToStringSidA
_snwprintf
memset
WakeConditionVariable
GetIDNFlagsForUri
SHReleaseThreadRef
SpawnDerivedClass
ZwUnmapViewOfSection
lua_pushlstring
_tzname
OleSetMenuDescriptor
VarBstrFromCy
ceil
tan
AddClipboardFormatListener
SleepConditionVariableSRW
CryptFindOIDInfo
LpkEditControl
VirtualUnlock
GetConsoleMode
SHGetFileInfoA
lua_next
LookupPrivilegeValue
idpAddFtpDir
idpDownloadFiles
CreateStdAccessibleObject
SealMessage
GdipLoadImageFromStream
CreateActCtxW
CPReleaseContext
IsAccelerator
GdipImageGetFrameCount
WinHttpOpenW
SetProcessDEPPolicy
IsWow64Process
ImageList_GetImageInfo
QualifierSet_Next
GetModuleFileNameEx
SendInput
CreateUri
PtVisible
RegisterServiceCtrlHandlerA
SxsOleAut32MapIIDToTLBPath
WaitForMultipleObjectsEx
ImageList_Destroy
WSASend
??1CritSecLock@DirectUI@@QAE@XZ
QueryServiceStatus
SafeArrayUnaccessData
GetClassInfoExA
HttpSendRequestA
GetRequestedRuntimeInfoW
SetThreadUILanguageW
ImageList_SetBkColor
LogicalToPhysicalPoint
GetOpenFileNameA
GetSystemTimePreciseAsFileTime
RegisterClassExA
ConvertDefaultLocale
GetProcessMemoryInfo
isspace
CopyEnhMetaFileA
LoadUserProfileA
_vsnwprintf
PathIsUNCW
RegSetValueEx
ShowScrollBar
PostThreadMessageW
GdipGetDC
SetROP2
InternetOpenUrlW
ImageList_DragShowNolock
GetAclInformation
VarInt
IsWindowVisibleW
CreateActCtxA
DWriteCreateFactory
GdipCreateRegionPath
_crt_debugger_hook
SetFileAttributesW
RegLoadKeyA
TrackEvent
NdrClientCall2
SetThreadPreferredUILanguagesW
?GetPICount@ClassInfoBase@DirectUI@@UBEIXZ
_stricmp
VerifyVersionInfoW
HttpQueryInfoA
CheckMenuRadioItem
CharLowerBuffA
CertDuplicateCertificateContext
IsWindowVisible
RtlDecompressBuffer
ExitWindowsEx
SystemFunction036
SslEncryptPacket
DllGetVersion
QueryMemoryResourceNotification
CM_Get_Device_Interface_List_ExW
IsRectEmpty
CertFreeCertificateChain
WSHGetSockaddrType
WNetCloseEnum
WSASocketA
SetGestureConfig
RegisterWindowMessageA
OleGetClipboard
vsprintf
GetThemeMetric
SafeArrayCreate
BCryptCloseAlgorithmProvider
CoMarshalInterface
sinh
WSASendTo
GdipCreateImageAttributes
HttpOpenRequestA
GetBestInterface
D3DKMTOpenAdapterFromGdiDisplayName
FindNextVolumeA
CPDecrypt
GetNames
ND_RI2
_strdup
InternetSetOptionA
GetWindowRgn
RegisterTypeLibForUser
ProgIDFromCLSID
RegisterTypeLib
ND_RI4
DisableProcessWindowsGhosting
OpenDesktopW
OpenEventW
CopyImage
_errno
CreateHalftonePalette
SetProcessPreferredUILanguages
CryptGetObjectUrl
GetParent
IsCharAlphaW
SetMenu
WTSRegisterSessionNotification
QualifierSet_BeginEnumeration
ExcludeClipRect
DownlevelVerifyScripts
SafeArrayGetIID
RpcBindingFromStringBindingW
sqrt
ImmSetCompositionWindow
CPEncrypt
_ultoa
CreateDIBitmap
CertGetNameStringA
InsertMenuA
ExtractIconW
CreateWindowExA
_heapmin
setvbuf
DdeFreeStringHandle
ImmReleaseContext
DrawThemeEdge
SetupDiGetClassDevsW
SoftpubAuthenticode
lua_insert
_wfopen
CPGenRandom
Request
GdipDrawPath
CryptVerifyTimeStampSignature
ScriptItemize
UninitializeFlatSB
DownlevelGetStringScripts
VarPow
Arc
ImageList_GetDragImage
FlashWindowEx
GetPrivateProfileSectionNamesA
OpenSCManagerW
MsiEnumProductsExW
GetRngInterface
SaferiChangeRegistryScope
GetMethodOrigin
_amsg_exit
SetMenuInfo
SetGadgetRootInfo
IsCharUpperW
CPHashSessionKey
_mktime64
StrStrA
MoveToEx
CryptMsgGetParam
OpenProcess
FDIIsCabinet
GetModuleHandleA
Polygon
RpcAsyncInitializeHandle
RegisterWindowMessageW
GdipDeleteFontFamily
FlsGetValue
SetEntriesInAclA
CreateWindowExW
VarDecFromR8
SleepConditionVariableCS
OpenDesktopA
GetTempPathA
SetFileSecurityW
StartDocW
ChangeServiceConfigA
RpcBindingFromStringBindingA
GetUserObjectInformationW
SetupDiEnumDeviceInfo
VarDecFromR4
__p__environ
__mb_cur_max
CoGetPSClsid
CreateWindowEx
_iob
_cwait
ApphelpCheckShellObject
MonitorFromWindow
FreeAddrInfoExW
DeleteCriticalSection
SetEntriesInAclW
GdipCreateSolidFill
EventWrite
RegDeleteKeyA
RegEnumValueA
Call
SetBkColor
ScriptShape
mbtowc
WSAWaitForMultipleEvents
RegSaveKeyW
_CIlog
SetThreadPriority
CreateURLMonikerEx2
CoGetObjectContext
WinStationFreeMemory
GetAltMonthNames
wcstombs
VarAdd
GetDIBColorTable
GetUserObjectInformationA
GetPrivateProfileSectionNamesW
SaferComputeTokenFromLevel
DuplicateHandle
SetCaretPos
SetSearchPathMode
GetCurrentDirectoryA
RpcBindingSetOption
ExtFloodFill
SetupDiGetDevicePropertyW
GdipSetPathGradientCenterColor
wvsprintfA
ZwReadVirtualMemory
LocaleNameToLCID
GetConsoleScreenBufferInfo
Write
IEDllLoader
CreateAssemblyNameObject
GetRegionData
VarFormatNumber
CryptGetUserKey
isalnum
idpGetFileSize
GetRequestedRuntimeInfo
waveOutClose
BCryptDestroyKey
SetThreadPreferredUILanguages
WTSEnumerateSessionsW
_putch
IsDialogMessageA
ImageList_DragEnter
StartDocA
D3DKMTDestroyAllocation
GetModuleHandleW
ExecToLog
RegDeleteKeyW
IsThemePartDefinedW
CoInitializeEx
_check
ImageList_SetDragCursorImage
FCIFlushFolder
OffsetRect
SHUnicodeToAnsi
LdrFindEntryForAddress
IsDBCSLeadByteEx
CoCreateGuid
ConvertStringSidToSidA
DrawThemeIcon
CreateDXGIFactory1
SafeArrayDestroy
CertFindCertificateInStore
ND_RU1
floor
GetListBoxInfo
feof
DnsNameCompare_W
OpenEventA
SetClassLongA
PatBlt
WSACleanup
StartServiceW
lua_createtable
Process32FirstW
GetProcessWindowStation
SetClipboardData
_dup
ExtractIconA
CheckRadioButton
GetGadgetRgn
accept
SaferIdentifyLevel
GdipCreatePen1
SHGetPathFromIDListW
GetKeyboardLayoutList
InitializeCriticalSection
fabs
??1CCBase@DirectUI@@UAE@XZ
itd_cancel
_endthreadex
GdipCreateBitmapFromStream
ungetwc
DdeConnect
SpInfGetVersionDatum
getsockname
WICCreateImagingFactory_Proxy
SetPixel
modf
SHDoDragDrop
?Initialize@ExtensionApi@Setup@OE@Avira@@YGXV?$function@$$A6GXPB_W0@Z@std@@P6AJPAPA_WPB_WZZ@Z
?Initialize@ClassInfoBase@DirectUI@@QAEJPAUHINSTANCE__@@PBG_NPBQBUPropertyInfo@2@I@Z
RegCreateKeyExA
UnpackDDElParam
PathParseIconLocationW
idpFtpDirsCount
GetViewportExtEx
ExitThread
d3dxof.dll
HTTPSCertificateTrust
MoveFileA
ShellAboutW
RegisterTouchHitTestingWindow
SetPropA
CreateThreadpoolWait
GetMetaFileBitsEx
SafeArrayGetLBound
fgetc
ImageList_LoadImageW
UnrealizeObject
WerReportSetUIOption
?ClassExist@ClassInfoBase@DirectUI@@SG_NPAPAUIClassInfo@2@PBQBUPropertyInfo@2@IPAU32@PAUHINSTANCE__@@PBG_N@Z
DirectXSetupSetCallback
ImmSetCompositionStringW
InitializeCriticalSectionAndSpinCount
CreateIcon
StartPage
MonitorFromPoint
GetSystemDirectoryW
GetQueuedCompletionStatus
_getpid
ChangeServiceConfig2A
LoadImageW
ExtCreateRegion
FilterCreateInstance
ReleaseSRWLockShared
GetSystemMenu
GoogleChromeCompatibilityCheck
Initiate
ImmSetCompositionStringA
GetFileType
_resetstkoflw
_lseeki64
SHPathPrepareForWriteW
SetTextColor
CreateSymbolicLinkW
OpenServiceA
GetCurrentDirectoryW
FreeSid
CreateProcessA
WinHttpSetTimeoutsW
OpenWbemTextSource
GdipIsMatrixIdentity
SHSetInstanceExplorer
ImageList_DrawEx
SetPropW
_CorDllMain
_CIcosh
CreateThreadpoolWork
mixerSetControlDetails
VerQueryValue
towlower
InternetCreateUrlW
FreeContextBuffer
IsDialogMessageW
GetThreadPreferredUILanguages
EnumerateSecurityPackagesA
OffsetViewportOrgEx
PropVariantToBSTR
GetIpForwardTable
SetHandleCount
CopyAcceleratorTableW
CPSignHash
GetStringTypeExA
SetWindowPlacement
GdipSetPageUnit
WerReportCreate
LoadAcceleratorsW
AngleArc
_timezone
WTHelperGetProvSignerFromChain
IsDBCSLeadByte
CertOpenStore
ResumeThread
CreateProcessW
GetTempPathW
BlessIWbemServices
AlphaBlend
DUserPostEvent
strtol
AttachThreadInput
RmStartSession
strtok
SpInfFindNextMatchLine
strncmp
?MessageCallback@HWNDHost@DirectUI@@UAEIPAUtagGMSG@@@Z
InternetCreateUrlA
GetPublisher
GetSystemDirectoryA
EndMenu
CertGetNameStringW
_execv
InternetUnlockRequestFile
RevokeBindStatusCallback
CopyAcceleratorTableA
CreateIoCompletionPort
GetVolumeInformationW
MsimtfIsWindowFiltered
QualifierSet_Put
lstrcmpA
HttpOpenRequestW
GetCursorPos
fgetpos
MapWindowPoints
EnumResourceNamesA
GdipGetSmoothingMode
AddAccessAllowedAce
LoadAcceleratorsA
FindResourceExW
FileTimeToDosDateTime
GetPhysicalCursorPos
OpenFile
idpAddFtpDirComp
GetSystemMetrics
SetUserObjectSecurity
CopyFileExW
WinStationOpenServerW
AcquireSRWLockExclusive
UuidToStringA
wcscoll
lstrcpyA
EnumResourceNamesW
_filelengthi64
strcat
GetTimeZoneInformation
PathAppendW
SetBrushOrgEx
CoInternetIsFeatureEnabledForUrl
CoAddRefServerProcess
OleTranslateAccelerator
RaiseException
GetUserData
lua_sethook
idpFileDownloaded
?HandleUiaPropertyListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
RegCloseKey
SetConsoleInputExeNameW
CoWaitForMultipleHandles
GetIconInfo
GetCurrentThreadId
UnloadUserProfile
_isnan
isprint
GetMenu
VarAbs
ActivateKeyboardLayout
InsertMenuW
GetPropertyHandle
MoveFileW
InternetSetOptionW
MsiDeterminePatchSequenceW
lua_error
GetEnhMetaFileA
WSACancelBlockingCall
GetMenuBarInfo
GetProcessIoCounters
SetCursor
CompareTo
CreateToolhelp32Snapshot
GetVolumeInformationA
GetMapMode
SafeArrayGetElement
GetDoubleClickTime
Toolhelp32ReadProcessMemory
SHPathPrepareForWriteA
lstrcpy
GdipGetImagePaletteSize
GetClipBox
FeClientInitialize
freeaddrinfo
EnumFontsA
ImageList_GetBkColor
SetPixelV
GdipSetLinePresetBlend
GetMetaFileA
SetRectRgn
IsCharLowerA
GetDiskFreeSpaceW
mixerGetControlDetailsA
DirectDrawEnumerateW
fsetpos
GetSystemWindowsDirectoryA
SafeArrayCopyData
GdipGetEmHeight
SetProcessShutdownParameters
SoftpubInitialize
__doserrno
atexit
QualifierSet_EndEnumeration
PutClassWmi
OpenProcessTokenW
SetAbortProc
VerSetConditionMask
VariantCopy
GetObjectW
LZCopy
GetWindowRect
lua_close
LockResource
LookupAccountNameLocalA
ZwQueryInformationThread
InterlockedPopEntrySList
WriteConsoleW
download_quiet
DrawEdge
CoInternetCanonicalizeIUri
_CIexp
?CreateHWND@CCBase@DirectUI@@UAEPAUHWND__@@PAU3@@Z
RegisterClipboardFormatA
GlobalGetAtomNameA
SetThreadpoolTimer
ToolbarCompatibilityCheck
GlobalReAlloc
NtQueryInformationThread
UpdateWindow
GetFileAttributesExA
ND_WU1
GetStdHandle
SetWindowsHookExA
ResetWriteWatch
PathRemoveBackslashW
VarNeg
SetStdHandle
GetClassNameA
lua_concat
CPGetKeyParam
calloc
fopen
EventRegister
RtlInitUnicodeString
WriteFileGather
SystemParametersInfoA
?Register@ClassInfoBase@DirectUI@@QAEJXZ
clearerr
?GetName@ClassInfoBase@DirectUI@@UBEPBGXZ
itd_addfilesize
WNetEnumResourceA
GetObjectA
SetWindowsHookExW
_acmdln
SetWinMetaFileBits
MapDialogRect
CompareAssemblyIdentity
GetTextCharsetInfo
AllocConsole
DirectDrawEnumerateA
__iob_func
LoadLibraryA
SetWaitableTimer
itd_addmirror
VarSub
WNetGetConnectionW
IsBadReadPtr
GetFileAttributesExW
DebugBreak
EnumFontsW
SHGetKnownFolderPath
Get
StrongNameTokenFromPublicKey
CheckTokenMembershipW
SetTimer
GetMenuItemInfoW
OleFlushClipboard
ReadProcessMemory
SHDeleteKeyW
WinStationCloseServer
BeginDeferWindowPos
AddRefActCtx
WSAAsyncSelect
WSAttemptAutodialName
_open
RevertToSelf
SetSecurity
WINNLSEnableIME
GetWindowLongW
qsort
PostQuitMessage
GetProfileType
_CItan
GetSysColorW
CoCreateFreeThreadedMarshaler
_finite
LockWindowUpdate
OpenMutexW
LookupAccountNameLocalW
FindResourceW
LoadImage
GetUserObjectSecurity
ChangeDisplaySettingsA
DrawMenuBar
AcceptEx
VarDecAdd
lua_pushvalue
GetIpAddrTable
CoReleaseMarshalData
WNetAddConnection2W
MsgWaitForMultipleObjectsEx
PolyBezier
GlobalGetAtomNameW
lua_settop
GetWindowText
PtInRegion
SwitchToThread
FindWindowA
idpFilesCount
__lconv_init
GrayStringW
wsprintfW
signal
ImageList_GetIcon
ShowWindow
GetLogicalDriveStringsA
SetPriorityClass
isalpha
GetUserDefaultLocaleName
DialogBoxIndirectParamA
NotifyServiceStatusChangeW
SetFileInformationByHandleW
DeleteDC
CoSetProxyBlanket
LoadCursorA
ReleaseActCtx
raise
AdjustWindowRectEx
AccessibleObjectFromWindow
CreateUrlCacheEntryA
SystemParametersInfoW
CPVerifySignature
WSARevertImpersonation
WinStationGetAllProcesses
MessageBoxW
IsCharLowerW
ReadDirectoryChangesW
idpConnectControl
OleInitialize
strtoul
GdiRealizationInfo
?IsGlobal@ClassInfoBase@DirectUI@@UBE_NXZ
RemoveVectoredExceptionHandler
MessageBoxA
___CPPdebugHook
SetFilePointerEx
GetFullPathName
?GetFactoryLock@Element@DirectUI@@SGPAU_RTL_CRITICAL_SECTION@@XZ
wsprintfA
FlashWindow
ntohl
GdipIsInfiniteRegion
DialogBoxParamW
WerReportAddDump
CryptSignHashA
DocumentPropertiesA
TextToWbemObject
GetWindowLongA
SetupOpenFileQueue
_controlfp
WerSetFlags
WTHelperProvDataFromStateData
GrayStringA
OpenMutexA
CertDuplicateStore
RegisterClipboardFormatW
GetDiskFreeSpaceA
SpInfGetLineCount
CoCreateInstanceEx
OpenServiceW
RemoveMenu
UnhookWindowsHookEx
GetTimeFormatEx
fgets
VarDiv
WinExec
OpenWindowStationW
D3DKMTCreateDCFromMemory
AddMandatoryAce
DrawFrameControl
NotifyServiceStatusChangeA
DialogBoxIndirectParamW
CertEnumCertificatesInStore
Process32First
SetThreadDesktop
AddVectoredExceptionHandler
__p__commode
GdipGetDpiY
LoadIconWithScaleDown
create
VerLanguageNameA
GetLogicalDriveStringsW
UpdateDriverForPlugAndPlayDevicesW
exit
__pioinfo
GetViewportOrgEx
CreateRectRgn
EnableTheming
BCryptImportKeyPair
DeleteEnhMetaFile
GlobalLock
fwrite
CoAllowSetForegroundWindow
RegCreateKeyW
GetTextExtentExPointWPri
TrackPopupMenuEx
SetPolyFillMode
CreateCompatibleDC
UiaRaiseAutomationEvent
VarDecCmp
StringFromIID
toupper
GetTimeFormatA
VarMonthName
DrawTextA
GdipDrawImageRectRectI
ExpandEnvironmentStringsForUserA
DosDateTimeToFileTime
GdipCloneImage
FindFirstUrlCacheContainerA
SwitchToThisWindow
RegQueryValueEx
ObjectFromLresult
DwmDefWindowProc
FreeResource
idpReportError
PathStripToRootA
VirtualFree
GetStockObject
LockServiceDatabase
PostMessageW
RtlMoveMemory
getservbyname
TerminateThread
WinStationGetAllSessionsW
lua_tothread
SetCommTimeouts
CreatePalette
PeekNamedPipe
RpcBindingSetAuthInfoExW
GetSystemPaletteEntries
CharPrevA
CPDuplicateHash
CoUnmarshalInterface
fgetws
SetFileValidData
SysFreeString
DrawIcon
AccessCheck
SoftpubLoadSignature
mciSendCommandA
itd_getresultlen
CreateWellKnownSidW
WSAAddressToStringA
lua_tointeger
_spawnve
MultiByteToWideChar
ReportEventW
WideCharToMultiByte
QueueUserAPC
StrRChrA
WaitMessage
send
GetTokenInformationW
GetShortPathNameA
wcsxfrm
GetObjectText
CPGetUserKey
CreateWaitableTimerW
_close
InternetCombineUrlA
IsValidLocale
LoadCursorW
WSAEventSelect
SetDIBits
RasEnumConnections
UnregisterTraceGuids
ShutdownBlockReasonDestroy
CheckRemoteDebuggerPresent
DdeNameService
WSAGetOverlappedResult
FtpOpenFileW
Unembed
CPDestroyKey
ExpandEnvironmentStringsForUserW
Thread32First
GetObject
PostMessageA
wctomb
Netbios
CoRegisterMessageFilter
ConvertStringSecurityDescriptorToSecurityDescriptor
difftime
CharPrevW
ImageList_Read
GetClassNameW
htons
GlobalAddAtomA
GdiFlush
GetModuleBaseName
_wcsnicmp
DispCallFunc
UrlMkGetSessionOption
ExpandEnvironmentStrings
RegQueryInfoKeyW
FreeLibrary
SetFilePointer
GetExitCodeProcessW
CreateStatusWindowW
getwc
getnameinfo
TravelLogCreateInstance
FlushFileBuffers
free
htonl
GetTimeFormatW
ImmGetCompositionStringA
GetLayout
DeleteMetaFile
tanh
CreateFileW
GdipBitmapLockBits
GetLargePageMinimum
SetMenuDefaultItem
GetCapture
putc
FindFirstFileW
GetMenuCheckMarkDimensions
GetCursorInfo
strcoll
IEGetProcessModule
SetupCloseFileQueue
wcscpy
MsiSIPGetSignedDataMsg
OpenSCManagerA
CorExitProcess
OleCreateMenuDescriptor
DdeDisconnect
SetThreadContext
WriteConsoleA
VariantInit
SoftpubCheckCert
ImmSetOpenStatus
GetMenuItemInfoA
timeSetEvent
AcquireSRWLockShared
PolyDraw
GetSystemWindowsDirectoryW
IsValidLocaleName
luaL_newstate
GdipCreatePathGradientFromPath
CheckTokenMembership
FreeConsole
CreateFileA
_CIcos
IsIconic
OpenThread
RegQueryInfoKeyA
ImmGetCompositionStringW
CreateAsyncBindCtxEx
CoResumeClassObjects
SpInfGetField
BCryptVerifySignature
CryptAcquireCertificatePrivateKey
IsTNT
lua_isstring
VariantChangeType
Wow64EnableWow64FsRedirection
rand
_wcslwr
lua_gettable
RegisterEventSource
localeconv
SHGetThreadRef
OleSetClipboard
SetCommState
CertGetCertificateChain
RtlConvertSidToUnicodeString
GetThreadPriority
_HUGE
FindFirstFileA
GetAtomNameW
CreateURLMoniker
GetDCOrgEx
RegEnumKeyEx
LoadBitmapW
RegisterHotKey
SetProcessWindowStation
GdipGetImageGraphicsContext
lstrcpynA
CertOpenSystemStoreA
GdipGetMatrixElements
CallNextHookEx
LookupPrivilegeValueW
FtpCommandA
_get_osfhandle
SetWindowRgn
_mbstrlen
DPtoLP
___lc_codepage_func
inet_addr
SysAllocStringLen
CertDuplicateCertificateChain
ImageList_Copy
GetNetworkParams
VarDecFromI4
StrFormatByteSize64A
RegFlushKey
GetComboBoxInfo
CommitUrlCacheEntryBinaryBlob
GetSidSubAuthorityCount
FindCloseUrlCache
GetLogicalDrives
SysStringLen
itd_clearfiles
EqualRect
CoRevokeInitializeSpy
CPSetProvParam
GenerateConsoleCtrlEvent
CLSIDFromProgID
FDIDestroy
Embed
GetSystemDefaultUILanguage
VarMod
FtpCommandW
GetHandleVerifier
RegisterClassW
RasConnectionNotification
DnsQueryConfigAllocEx
RemoveVectoredContinueHandler
EnumResourceTypesA
ReleaseMutex
FrameRgn
StrToIntA
VarI4FromStr
GdipGetFontStyle
CreateSemaphoreW
TranslateAcceleratorW
UrlGetPartW
SendMessageA
BCryptGetFipsAlgorithmMode
WbemObjectToText
GetBkColor
TrackMouseEvent
GdipSaveGraphics
DeleteFileA
SHSetThreadRef
FlushProcessWriteBuffers
IsBadCodePtr
GetWindowsDirectoryA
GetScrollBarInfo
GetFileSecurityW
NtQuerySystemInformation
GetUserNameA
SHGetDataFromIDListW
_GetText
SetBkMode
CreateSemaphoreA
SizeofResource
InterlockedExchange
CreateDIBPatternBrushPt
GetDateFormatW
WerReportSubmit
CreateDIBSection
UnhandledExceptionFilter
D3D10CreateDevice1
VarXor
SHGetSpecialFolderLocation
lua_getfield
GetCurrentPositionEx
IsWindow
wcstol
SetPaletteEntries
GetEnhMetaFileHeader
CreateCursor
IsProcessDPIAware
Dhcpv6QueryLeaseInfo
DrawTextW
RegCreateKeyEx
LoadBitmapA
CreateWaitableTimerA
SendMessageW
EqualSid
_read
CallWindowProcA
GetWriteWatch
WVTAsn1SpcPeImageDataDecode
GetShortPathNameW
GetKeyboardState
ReleaseCapture
MessageBeep
GetMessageExtraInfo
MsiGetComponentPathA
UuidCreate
_ftime64
?GetHWND@HWNDHost@DirectUI@@UAEPAUHWND__@@XZ
InitializeConditionVariable
GetTextColor
GetUpdateRect
GetKeyState
QueryServiceStatusEx
idpAddFileSize
Module32FirstW
_GotoPath
CloseDesktop
CLSIDFromString
TranslateAcceleratorA
GetNextDlgTabItem
SetLayeredWindowAttributes
UnionRect
GdipGetPageUnit
InternetCrackUrlA
HeapQueryInformation
LocalFileTimeToFileTime
GetWindowInfo
_vsnprintf
CreateIconFromResourceEx
GdipCreateRegion
CreateICA
SetCoalescableTimer
CancelIo
GetSystemDefaultLCID
GetCurrentThread
NRTN_OfferEngine_CheckCriteria_Web
DoDragDrop
GetStartupInfoA
LCIDToLocaleName
CallWindowProcW
GetClipboardData
LCMapStringEx
RegisterClassA
SHChangeNotify
mixerGetLineControlsW
DrawStateA
EventEnabled
CoInternetParseUrl
OleIsCurrentClipboard
lstrcpynW
EncodePointer
NsiAllocateAndGetTable
GetClassLongA
GdipGetPathGradientPointCount
RpcStringBindingComposeA
mixerGetDevCapsW
PathAddBackslashW
SetForegroundWindow
wcsncpy
InetNtopW
NdrOleInitializeExtension
HideCaret
GetProcessAffinityMask
GdipGetFontHeight
GetTargetForVTableEntry
_execve
RegisterTraceGuidsW
CoGetMalloc
lstrcatW
InitSecurityInterfaceA
GetProcessTimesW
Modern
CoInternetCombineIUri
CreateUrlCacheContainerA
DllGetClassObjectInternal
SetSecurityInfo
VarNot
GetDateFormatA
GetACP
mixerOpen
PolyBezierTo
VarNumFromParseNum
CreateICW
SpInfLoadInfFile
SetupDiGetDeviceRegistryPropertyW
InterlockedDecrement
AddAtomW
GetMessagePos
ntohs
GetCPInfoExW
WinHttpCloseHandleW
Sleep
SetScrollPos
getprotobyname
SetWindowText
SendDlgItemMessageW
PathRemoveFileSpecW
LangDialog
GetStartupInfoW
CreateWellKnownSid
AddFontResourceA
lstrcatA
lua_pushstring
TryEnterCriticalSection
SslLookupCipherSuiteInfo
CreateBindCtx
FillRect
RegDeleteTreeW
SHAnsiToUnicode
SceSetupMoveSecurityFile
DdeUninitialize
GetConsoleTitleW
strncpy
D2D1InvertMatrix
SetMapMode
acos
SHGetPathFromIDListA
UrlUnescapeW
CopyIcon
RegDeleteKeyExW
DestroyICeeFileGen
GetKerningPairsA
DrawThemeTextEx
CreateTimerQueueTimer
GdipLoadImageFromFile
CryptDecodeObject
GetMenuStringA
_wmkdir
GetConsoleWindow
GetWindowExtEx
OemToCharA
GetUserNameW
sin
UnMapAndLoad
QueryPerformanceCounter
GdipBitmapUnlockBits
TlsFree
GetStringTypeW
WSAImpersonateSocketPeer
GetUrlCacheEntryBinaryBlob
timeGetDevCaps
FindFirstVolumeMountPointA
Escape
RemoveFontResource
IsFileSupportedName
?HandleUiaDestroyListener@Element@DirectUI@@UAEXXZ
RegUnLoadKeyW
GetEnvironmentStrings
RegDeleteTreeA
SpInfFreeInfFile
_msize
CertGetEnhancedKeyUsage
CreateFileMapping
GetConsoleOutputCPW
LookupPrivilegeValueA
AddFontResource
GdipCreateRegionHrgn
LoadCursorFromFileA
SHCreateItemFromParsingName
GetAdaptersInfo
FindFirstFileExA
NetUserEnum
_func5
_CItanh
Init
CompatFlagsFromClsid
GetNearestColor
_exit
URLDownloadToFileW
TraceEvent
GdipAddPathRectangleI
RpcStringBindingComposeW
OpenFileMappingA
RegisterGPNotificationInternal
wcsftime
SetDlgItemInt
GetClassLongW
DestroyMenu
DllCanUnloadNowInternal
VarIdiv
DdeGetLastError
CreateICeeFileGen
IsWindowUnicode
GetCurrencyFormatW
CloseHandle
idpSetProxyLogin
_ungetch
CloseWindowStation
atan
NtFreeVirtualMemory
TlsSetValue
GetDCEx
GetExtendedTcpTable
GetWindowsDirectoryW
GetHandleInformation
ImmUnlockIMC
GetComputerNameA
DeleteVolumeMountPointA
AdjustTokenPrivileges
fflush
UrlUnescapeA
CertControlStore
_getcwd
OpenFileMappingW
_except_handler3
SetMenuItemInfoA
TrackPopupMenu
StrRChrIA
IsNormalizedString
AddFontMemResourceEx
SpInfLockInf
_func3
GdipGetWorldTransform
RtlIsThreadWithinLoaderCallout
SetFileApisToOEM
FCIDestroy
_func4
SendDlgItemMessageA
CreateMemoryResourceNotification
CoInternetParseIUri
_func1
RegisterClassEx
UnRegisterTypeLib
DeleteUrlCacheEntryW
_func2
URLDownloadToFileA
SetEnvironmentVariableW
SetErrorMode
InitCommonControls
lua_pushnil
idpSetLogin
PathFileExistsW
FindFirstFileExW
ImageList_LoadImageA
_CIlog10
SpInfSectionNameFromLineContext
lua_getstack
GetInterfaceInfo
GetNativeSystemInfo
AllocateAndInitializeSid
CreateFontIndirectW
CertVerifyCertificateChainPolicy
CreateDialogParamW
GetUserProfileDirectoryW
CreateProcessAsUserW
SetupDiEnumDeviceInterfaces
VirtualProtectEx
InternetSetCookieExW
_CIpow
OleCreate
DirectXSetupCallback
tolower
GetThemeAppPropertiesW
GradientFill
?SetNotifyHandler@CCBase@DirectUI@@QAEXP6GHIIJPAJPAX@Z1@Z
ImmSetCandidateWindow
CoInternetQueryInfo
VarBstrCat
TabbedTextOutW
ReleaseDC
GdipCreateFontFromLogfontW
EnumProcesses
GdipGetImagePalette
PathSkipRootW
RegisterGPNotification
CreateFileMappingW
SetThreadStackGuarantee
GetCharABCWidthsW
iDirectXSetupGetEULAA
PathFindFileNameA
VarCmp
RemoveDirectoryW
IntersectClipRect
GetFocus
CreateDC
realloc
CoTaskMemRealloc
GdipClosePathFigure
FindVolumeClose
EnumDisplayMonitors
DefWindowProcA
GetPrivateProfileStringA
InitializeSRWLock
SafeArrayGetUBound
VirtualLock
iDirectXSetupGetEULAW
_snd_o
SafeArrayGetRecordInfo
DefWindowProcW
lstrcmpW
??0CCBase@DirectUI@@QAE@KPBG@Z
VarDateFromUdate
GetFinalPathNameByHandleW
GdipSetPenMode
PageSetupDlgA
ArcTo
Pie
GetWindowTextA
CreateDialogParamA
SetConsoleMode
SetLastError
GdipAddPathEllipseI
StrokeAndFillPath
SetupOpenInfFileA
GetDlgItemTextA
VirtualAllocEx
GetPrivateProfileStringW
lstrcpyW
ChildWindowFromPoint
ResetEvent
RegGetValueA
PlaySoundW
CreateProcessAsUserA
GetAltTabInfoW
DdeCreateStringHandleA
idpTrace
WinHttpCloseHandle
_daylight
ShowCaret
ExtCreatePen
GlobalUnlock
getenv
LoadMenuW
GetComputerNameW
_XcptFilter
PulseEvent
_wcsdup
InternetSetStatusCallbackW
EndPage
PathFindFileNameW
GdipCombineRegionRegion
WNetGetUniversalNameA
idpSetProxyMode
SHEmptyRecycleBinW
GetTextFaceA
DragQueryFileW
HeapCompact
DeleteMenu
CreateFileMappingA
DestroyWindow
OpenClipboard
lua_settable
_wopen
idpSetComponents
atol
RegEnumKeyA
I_RpcInitFwImports
GetDeviceCaps
RevokeDragDrop
SHDeleteEmptyKeyW
itd_loadstrings
__getmainargs
lua_pushnumber
GetBrushOrgEx
WriteFile
itd_postpage
RedrawWindow
SetSystemFileCacheSize
CoLockObjectExternal
ValidateRect
TabbedTextOutA
GetMenuStringW
LoadKeyboardLayoutW
KillTimer
CreateFontIndirectA
_kbhit
GdipDisposeImageAttributes
DdeGetData
InitializeSecurityContextA
CoInitializeSecurity
GlobalFlags
fseek
_umask
DnsRecordListFree
OleDuplicateData
GdipGetFamily
DuplicateTokenEx
GetBoundsRect
GetCharABCWidthsA
_access
_localtime64
_lseek
SHAppBarMessage
QueryFullProcessImageNameW
Wow64DisableWow64FsRedirection
CreateHardLinkW
RegSetValueExW
DirectXSetupShowEULA
CreateHatchBrush
_snprintf
MapViewOfFileEx
SetConsoleTextAttributeW
RegDeleteKeyExA
NtQueryInformationProcess
GetCatalogObject2
RasEnumConnectionsW
GdipAddPathPolygonI
GdipCloneRegion
UiaHostProviderFromHwnd
GdipDeleteMatrix
NormalizeString
memchr
GetGlyphOutlineW
RtlExitUserThread
OpenProcessToken
DragQueryFileA
_commit
GetCurrentProcessW
CopyMetaFileA
RegOpenCurrentUser
LoadKeyboardLayoutA
fprintf
_lopen
GetWindow
GetBitmapBits
RpcBindingFree
GetThreadDesktop
SetUnhandledExceptionFilter
RegEnumKeyW
idpStopDownload
Process32Next
wnsprintfW
GetClassInfo
WintrustCertificateTrust
_open_osfhandle
swscanf
TerminateProcess
SelectPalette
CoInternetIsFeatureEnabled
InternetCrackUrlW
ImmGetConversionStatus
EnumServicesStatusA
SpFileQueueCopy
MD5Update
UrlEscapeA
EnumSystemLocalesEx
RtlRunDecodeUnicodeString
GetDlgItemInt
SetClassLongW
DdeQueryStringA
getservbyport
GetTempPath
GetFileAttributesW
idpDownloadFilesComp
Decrypt
SetCapture
SetEnhMetaFileBits
GetConsoleTitle
ExtTextOutA
FreeLibraryWhenCallbackReturns
GetDC
CoInternetGetSecurityUrl
MaskBlt
ImpersonateLoggedOnUser
SHGetInstanceExplorer
GetSystemTimeAsFileTime
GdipResetClip
Ellipse
SpInfGetLineFieldCount
InterlockedPushEntrySList
DdeFreeDataHandle
GetNumberFormatW
VirtualProtect
GetFileTitleW
CertFreeCertificateContext
D2D1MakeSkewMatrix
RegSetValueA
GetAddrInfoW
ImageList_SetImageCount
strcpy
CreateDirectoryW
GetSystemInfo
DirectXLoadString
GetEnhMetaFileBits
TraceMessage
GetClassInfoW
VarEqv
SHGetSpecialFolderPathW
GetSystemDefaultLocaleName
CryptEnumProvidersA
UrlIsW
lua_getinfo
ToAsciiEx
SetCurrentDirectory
DrawIconEx
RtlComputeCrc32
ResolveDelayLoadedAPI
GetAncestor
SHGetSpecialFolderPathA
GdipDeletePen
GetWindowOrgEx
SetScrollInfo
GetCommandLineA
itd_getoption
GetTextFaceW
RegQueryInfoKey
GetModuleFileNameExW
SpInfGetInfLineNumber
GetUserDefaultLocaleNameW
SetupCloseInfFile
TextOutA
GetFileAttributesA
CoFreeUnusedLibraries
itd_setoption
GlobalMemoryStatusEx
FDICopy
VarCyFromStr
GetClassInfoA
ShellExecuteExA
GdipDrawLineI
StrCmpIW
GetFileTitleA
HeapAlloc
CopyRect
GetNumberFormatA
_fpreset
GdipCreateRegionRectI
GlobalHandle
CreateDirectoryA
DevRtlSetThreadLogToken
TransparentBlt
GetThemePartSizeW
SetClipboardViewer
SetConsoleTitle
UnlockFile
TextOutW
SleepEx
SetupDefaultQueueCallbackA
GetProfileStringA
wcsncmp
OleCreatePropertyFrame
DeferWindowPos
UnregisterWaitEx
DeleteFileW
GetNearestPaletteIndex
_stat64i32
RectInRegion
timeKillEvent
GetTextFaceAliasW
InflateRect
HeapValidate
GetQueueStatus
EnableScrollBar
IsWindowEnabled
ClientToScreen
VarFormatPercent
WSASocketW
BootstrapperApplicationCreate
GetComputerName
ldexp
GdipDeletePath
ExtTextOutW
lua_pushfstring
GetWindowTextW
GetBufferedPaintBits
WSARecv
_hypot
D3DKMTDestroyDCFromMemory
GetLengthSid
GetDlgItem
SubtractRect
CallNtPowerInformation
towupper
FormatMessage
GdipReleaseDC
GdipDrawImageRectI
VkKeyScanW
FindNextUrlCacheContainerA
RegisterWaitForSingleObject
FindNextChangeNotification
DrawFocusRect
GdipDeleteBrush
__setusermatherr
__CppXcptFilter
GetTextAlign
SHGetPropertyStoreForWindow
NRTN_OfferEngine_SetSymCCISPing
EnableMenuItem
GetServiceKeyNameA
RoundRect
SelectObject
AreFileApisANSI
CreateEnvironmentBlock
MiniDumpWriteDump
WriteProcessMemory
mouse_event
RegReplaceKeyW
WinStationIsSessionRemoteable
CryptGetProvParam
CertVerifyTimeValidity
InitSecurityInterfaceW
GetStartupInfo
GetAccCursorInfo
WSASocket
SetDIBitsToDevice
SHOpenFolderAndSelectItems
VirtualQuery
GetCommandLineW
LoadTypeLibEx
getprotobynumber
GetVolumeInformation
GetErrorInfo
RegConnectRegistryW
InternetQueryDataAvailable
IsValidURL
PathFindExtensionA
DeregisterEventSource
GdipSetStringFormatAlign
ReportEvent
MapVirtualKeyW
CreateAssemblyNameObjectW
WTSGetActiveConsoleSessionId
GetAce
GetCommState
GetPaletteEntries
CryptQueryObject
lua_gettop
GetThreadTimes
CryptUnprotectData
NRTN_OfferEngine_SetLogging
CM_Get_Device_Interface_List_Size_ExW
MkParseDisplayName
GdipAddPathArcI
GetProcessImageFileNameA
GetTickCount64
AllowSetForegroundWindow
VariantChangeTypeEx
CreateFile
CreateMutexW
InternetReadFile
SpFileQueueCommit
NetWkstaGetInfo
SCC_CheckCriteria_Web
WNetCancelConnection2W
inet_ntoa
CoInternetCombineUrl
CharUpperW
FlsSetValue
SetDllDirectoryW
wcsstr
RpcStringFreeW
InternetWriteFile
RegisterMessagePumpHook
FindNextFileA
GetExitCodeThread
CreateThread
OleLoadFromStream
MapVirtualKeyA
RaiseFailFastException
ImageEnumerateCertificates
GetModuleInformation
EnumClipboardFormats
CoGetObject
FindFirstUrlCacheEntryA
_cexit
IERefreshElevationPolicy
D3DKMTCheckMonitorPowerState
SetupDiDestroyDeviceInfoList
_wfsopen
GetComputerNameExW
GdipGetPropertyItemSize
GlobalFree
PathFindExtensionW
WinVerifyTrust
keybd_event
StartServiceCtrlDispatcherW
WinSqmIsOptedIn
CreateRectRgnIndirect
WritePrivateProfileStringW
RealizePalette
RegConnectRegistryA
CreatePenIndirect
_getch
joyGetPosEx
GetWinMetaFileBits
GetSysColorBrush
IsZoomed
CertCloseStore
PathIsUNCA
VarR4FromStr
sendto
NotifyWinEvent
IsTextUnicode
LocalFree
GetFontAssocStatus
IsChild
GetSystemDefaultLCIDW
InternetErrorDlg
LogonUserA
VarFormatCurrency
ReleaseBindInfo
GetSysColor
itd_downloadfile
DispatchMessageW
VarDateFromStr
HTTPSFinalProv
srand
memcmp
GetLocalTime
GetWindowPlacement
EventSetInformation
HeapWalk
CreateThreadpoolTimer
GetServiceDisplayNameA
PostMessage
SetKeyboardState
RegOpenKeyW
RegOpenKeyExA
InternetQueryOptionA
EnumResourceLanguagesW
GetProcessTimes
PathMatchSpecA
waveOutOpen
GetVolumePathNameW
FindVolumeMountPointClose
GdipGetImageType
SpInfUnlockInf
GetCurrentProcess
HttpDuplicateDependencyHandle
SetWindowContextHelpId
VirtualFreeEx
CharUpperA
CloseClipboard
_wrename
ShellExecuteExW
?set_terminate@@YAP6AXXZP6AXXZ@Z
GetVolumePathNameA
EnumResourceLanguagesA
GetFileSizeEx
StartServiceCtrlDispatcherA
InternetQueryOptionW
RegOpenKeyA
SetSecurityDescriptorDacl
WinHttpGetProxyForUrlW
putwc
AssocQueryStringW
RegNotifyChangeKeyValue
RegEnumKeyExW
GetCurrentPackageId
ReleaseSemaphore
OpenInputDesktop
WritePrivateProfileStringA
CheckMenuItem
FindNextFileW
UrlCombineA
GdipSetImageAttributesColorMatrix
VirtualAlloc
SetEvent
DispatchMessageA
GetUserDefaultLCID
Module32Next
GdipDisposeImage
GdipCreateStringFormat
WaitForSingleObjectEx
GetConsoleModeW
SpInfFindFirstLine
WerReportSetParameter
itd_filecount
PlayEnhMetaFile
EnumWindowsW
VirtualQueryEx
PeekMessageW
GetLastInputInfo
?AddRef@ClassInfoBase@DirectUI@@UAEXXZ
InitializeAcl
gethostbyaddr
_copysign
CryptStringToBinaryW
RegEnumKeyExA
CreateAcceleratorTableA
SetViewportOrgEx
MsiGetProductInfoExW
SetUrlCacheEntryInfoA
SetCriticalSectionSpinCount
RegisterWindowMessage
SelectClipRgn
PathIsUNCServerW
ImmAssociateContext
itd_getresultstring
CertGetCertificateContextProperty
idpSetProxyName
PrivIsDllSynchronizationHeld
GetTextMetricsW
WritePrivateProfileSectionW
CloseThreadpoolWait
ScrollWindowEx
SaferCloseLevel
SpInfGetTargetPath
LeaveCriticalSection
GetTraceEnableLevel
GetSystemWow64DirectoryW
SendMessageTimeoutA
InterlockedIncrement
GetFileAttributesEx
GetPropW
Thread32Next
DeactivateActCtx
OpenSemaphoreW
recvfrom
Heap32Next
ChangeWindowMessageFilterEx
?DirectionProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
StrCmpNW
GetStockObjectW
GetUserObjectInformation
SysReAllocStringLen
GetConsoleCP
WaitForMultipleObjects
CharToOemW
CommitUrlCacheEntryA
ToUnicodeEx
VarMul
GdipDrawEllipse
QueryServiceConfigW
GetObjectType
GetVersionExW
GdipSetClipRegion
GetDriveType
IsDebuggerPresent
SetDlgItemTextA
AbortDoc
CryptSIPPutSignedDataMsg
CreateCaret
CharToOemA
WinStationNameFromLogonIdW
CloseThreadpoolWork
LoadTypeLib
AcquireCredentialsHandleA
lua_remove
VarParseNumFromStr
GetPropA
OffsetWindowOrgEx
LogonUserW
__control87_2
BeginPaint
SHCreateThreadRef
lua_toboolean
GdipCreatePath
GetWindowDC
LoadLibraryExW
GetPixel
ImmLockIMC
CreateAcceleratorTableW
idpAddFileComp
InternetCanonicalizeUrlW
Shell_NotifyIconW
GetModuleFileNameW
_LoadFile
GetSystemWow64DirectoryA
PathMatchSpecW
NsiFreeTable
GetVersionEx
CloseThreadpoolTimer
GetMonitorInfoA
GetTextMetricsA
GetActiveWindow
iDirectXSetup
LPtoDP
MoveFileExW
GetProcAddress
MD5Final
ImageGetCertificateData
fread
DestroyAcceleratorTable
WindowFromPoint
WSAEnumNetworkEvents
LoadStringA
GetRecordInfoFromTypeInfo
RpcAsyncCompleteCall
RemoveDirectoryA
_CIatan2
ShouldShowIntranetWarningSecband
OleLoadPicture
SafeArrayPtrOfIndex
_getwche
WinHelpW
WSADeleteSocketPeerTargetName
LoadMenuA
_environ
CoRevokeClassObject
HeapSize
GlobalAlloc
WSAStringToAddressW
CreateMenu
_locking
ExtractIconExA
DestroyEnvironmentBlock
itd_downloadfiles
GetModuleBaseNameA
FindNextVolumeMountPointA
RpcStringFreeA
FileTimeToLocalFileTime
StgOpenStorageOnILockBytes
WSASetLastError
SystemTimeToFileTime
AnimateWindow
ExtractIconExW
GetWindowLong
GetScrollPos
WSAIoctl
IntersectRect
GetModuleFileNameA
LoadStringW
CommandLineToArgvW
SendMessageTimeoutW
CreateEvent
CopySid
CreateStreamOnHGlobal
GetMonitorInfoW
GetModuleBaseNameW
GetUrlCacheEntryInfoExW
FontIsLinked
GdipImageGetFrameDimensionsList
MonitorFromRect
EndPaint
WSAStringToAddressA
GetSystemTimes
HttpAddRequestHeadersW
MoveFileExA
Heap32First
GetMenuItemID
CompareFileTime
SetDlgItemTextW
NdrAsyncClientCall
FrameRect
localtime
QueryServiceConfigA
VkKeyScanExW
WVTAsn1SpcIndirectDataContentDecode
WinHelpA
NtQuerySystemInformationW
IsUserAnAdmin
ReadFileScatter
GdipSetInterpolationMode
ScrollWindow
GetClipRgn
FCICreate
SafeArrayGetElemsize
ImmAssociateContextEx
SysAllocString
CompareStringEx
WSAAccept
GetLayeredWindowAttributes
StgOpenStorage
CredEnumerateA
SslLookupCipherLengths
InternetCloseHandle
SetFocus
EnumFontFamiliesExA
HeapSetInformation
GetLocaleInfoA
GetVersion
GdipCreateMatrix
GetHGlobalFromStream
SetFileInformationByHandle
ReadFile
GetKeyNameTextW
GetRgnBox
GetMenuItemCount
SendMessage
getaddrinfo
InsertMenuItemW
EnumProcessModules
ExtSelectClipRgn
_ctime64
OnBack
_wtoi
GetEnvironmentVariableW
SetEnvironmentVariableA
CharUpperBuffW
gmtime
ShowCursor
_except_handler4_common
ResizePalette
lua_pcall
DllBidEntryPoint
NRTN_OfferEngine_Create
QueryDosDeviceA
WerRegisterMemoryBlock
PeekMessage
GetSystemTime
RegQueryValueA
GetEnvironmentStringsW
RealGetWindowClassW
GetSecurityDescriptorDacl
GdipSetPathGradientCenterPointI
GetConsoleOutputCP
CM_Open_Class_Key_ExW
GetAddrInfoExW
WinStationEnumerateProcesses
idpGetFilesSize
CreatePolygonRgn
UnsealMessage
idpSetDetailedMode
_time64
StretchDIBits
InternetGetLastResponseInfoA
SetWindowLong
RegOpenKeyEx
GetMonitorInfo
lua_pushboolean
FindAtom
joyGetDevCapsW
_initterm_e
FindActCtxSectionStringW
_fmode
MapVirtualKeyExA
lstrcmpiA
EventUnregister
SetMenuItemInfoW
DefDlgProcW
D2D1CreateFactory
ImmIsIME
VarDecFromCy
DrawTextExW
SpFileQueueDelete
InitiateSystemShutdownExW
StrongNameFreeBuffer
GetAsyncKeyState
CreateEventW
LookupAccountNameA
lstrlenA
DdePostAdvise
QueryDosDeviceW
LoadResource
lstrcmpiW
ProcessIdToSessionId
CreateWebControl
GetUserNameEx
ChangeWindowMessageFilter
DefDlgProcA
Rectangle
ResolveIpNetEntry2
GetEnvironmentVariableA
CreateILockBytesOnHGlobal
GetMenuDefaultItem
GetLocaleInfoW
InternetGetLastResponseInfoW
AddAce
itd_getfilesize
CountClipboardFormats
SpInfSetDirIdHandler
LookupAccountSidLocalW
DefFrameProcW
GetDIBits
DestroyCaret
PtInRect
GetMessageW
CoInternetGetSession
DdeCreateDataHandle
GetSubMenu
GdipGetClip
GetPriorityClass
lua_tonumber
SetStretchBltMode
CreateALink
EnumFontFamiliesExW
GdipImageGetFrameDimensionsCount
TranslateMDISysAccel
EndDialog
GetFileSize
EnterCriticalSection
SearchPathW
SetThreadLocale
FCIFlushCabinet
CreateTimer
SetRect
GlobalMemoryStatus
_purecall
IsAsyncMoniker
DeleteObject
MapVirtualKeyExW
HttpCloseDependencyHandle
DragQueryPoint
Shell_NotifyIconA
GetKeyNameTextA
UnmapViewOfFile
CoInternetCreateZoneManager
SetScrollRange
DrawTextExA
GetMessageA
InsertMenuItemA
LoadLibraryExA
LookupAccountNameW
IsEqualGUID
TraceRegisterExA
QueryContextAttributesA
EqualRgn
GetStringTypeA
GetCatalogObject
_encoded_null
I_RpcInitImports
VarFormat
wcscat
GetCurrentProcessIdW
SearchPathA
_CIsinh
StrCpyW
CreateTypeLib2
CryptSIPGetSignedDataMsg
GetMessageTime
OleUninitialize
SetupDiGetClassDescriptionW
CreateServiceA
GetDlgCtrlID
GetTopWindow
BitBlt
CoGetContextToken
ObtainUserAgentString
MsgWaitForMultipleObjects
QueryTraceW
PrintDlgA
Polyline
abort
PhysicalToLogicalPoint
RtlMoveMemoryW
GetSignedDataMsg
LocalAlloc
GetProductInfo
CreateProcess
GdipSetStringFormatLineAlign
InvalidateRgn
SetLayout
_putwch
UnlockServiceDatabase
GetLogicalProcessorInformation
FreeAddrInfoW
GetNameInfoW
longjmp
_get_terminate
_fstat64
OleTranslateColor
idpClearFiles
CopyFileA
VarBstrFromBool
WSAConnect
wvnsprintfW
_spawnv
PStoreCreateInstance
GetCurrentObject
EnumThreadWindows
SetDefaultDllDirectories
SetupDiGetDeviceInstanceIdW
InitNetworkAddressControl
RemoveFontResourceA
lstrlenW
GlobalSize
CreateDialogIndirectParamW
OpenThreadToken
I_RpcVerifierCorruptionExpected
SetConsoleTitleW
GetTickCount
ScaleWindowExtEx
rewind
SoftpubCleanup
PeekMessageA
CreateFontIndirect
_lock
WakeAllConditionVariable
GetCaretBlinkTime
GetRealProcAddress
SetWindowPos
ScriptGetCMap
IsProcessorFeaturePresent
VarAnd
InternetGetConnectedState
GetCalendarInfoW
CreateEventA
IdentifyMIMEType
CreateFontA
GetForegroundWindow
GdipCreateLineBrushFromRectI
UrlCacheUpdateEntryExtraData
LCMapStringA
GetCachePath
DcomChannelSetHResult
MD5Init
ReuseDDElParam
CreateMutex
VarFormatDateTime
DefFrameProcA
CloseFigure
HeapReAlloc
wvnsprintfA
GetUserDefaultUILanguage
SuspendThread
LookupIconIdFromDirectoryEx
VariantCopyInd
EnumCalendarInfoA
GetEnvironmentVariable
CopyFileW
CharLower
VarBstrCmp
RtlRunEncodeUnicodeString
CreateFontW
VarR8FromStr
iswspace
Heap32ListFirst
FlushInstructionCache
RegSetValueExA
ShowOwnedPopups
MoveWindow
GdiAddGlsRecord
RpcEpResolveBinding
CLSIDFromProgIDEx
CreateMutexA
RtlGetVersion
IsCharAlphaNumericW
DwmSetWindowAttribute
SetEndOfFile
ModifyMenuA
SetSystemPowerState
GetTempFileNameW
GetLocaleInfoEx
GdiAddGlsBounds
EtwRegisterTraceGuidsW
_fstat64i32
GdipFillPath
_putenv
PropVariantClear
BlockInput
SetWindowExtEx
GdipSetSmoothingMode
GetExitCodeProcess
LCMapStringW
GetThreadUILanguage
StrokePath
StgCreateDocfileOnILockBytes
CallWindowProc
IdnToUnicode
GetVolumeNameForVolumeMountPointA
ModifyMenuW
idpAddMirror
DestroyCursor
SubmitThreadpoolWork
ChangeClipboardChain
GetModuleFileName
EnumChildWindows
CreateDialogIndirectParamA
MapGenericMask
GetProcessImageFileNameW
FileTimeToSystemTime
VarOr
HeapDestroy
CreatePipe
ChooseFontA
EnumCalendarInfoW
DownlevelGetLocaleScripts
IsBadWritePtr
GetTempFileNameA
EnableWindow
_malloc_crt
RegQueryValueW
Precise Detectors Analysis Results
No Detector Result Received
Advance Heuristics
No Advanced Heuristic Analysis Result Received
Additional File Information
Property | Value |
---|
Name | Virtual Address | Virtual Size | Raw Size | Entropy | MD5 |
---|