TrojanSpy.MSIL.URSNIF.THCBFBO

Para reiniciar en modo seguro:

• Para usuarios de Windows 98 y ME

1. Reinicie el equipo.
2. Pulse la tecla CTRL hasta que aparezca el menú de inicio.
3. Seleccione la opción Modo seguro y pulse Intro.

• Para usuarios de Windows NT (modo VGA)

1. Haga clic en Inicio>Configuración>Panel de control.
2. Haga doble clic en el icono Sistema.
3. Haga clic en la pestaña Inicio o Apagado.
4. Establezca 10 segundos en el campo Mostrar lista y haga clic en Aceptar para guardar el cambio.
5. Apague el equipo y reinícielo.
6. Seleccione el modo VGA en el menú de inicio.

• Para usuarios de Windows 2000

1. Reinicie el equipo.
2. Pulse la tecla F8 cuando vea la barra Iniciando Windows en la parte inferior de la pantalla.
3. Seleccione la opción Modo seguro en el menú de opciones avanzadas de Windows y pulse Intro.

• Para usuarios de Windows XP

1. Reinicie el equipo.
2. Pulse la tecla F8 cuando haya finalizado la autoprueba de encendido (POST). Si no aparecen las opciones avanzadas de Windows, intente reiniciar y pulse F8 varias veces después de que aparezca de la pantalla de la autoprueba de encendido (POST).
3. Seleccione la opción Modo seguro en el menú de opciones avanzadas de Windows y pulse Intro.

• Para usuarios de Windows Server 2003

1. Reinicie el equipo.
2. Pulse la tecla F8 cuando se haya iniciado Windows. Si no aparecen las opciones avanzadas de Windows, intente reiniciar y, a continuación, pulse F8 varias veces tras el inicio.
3. En el menú de opciones avanzadas de Windows, utilice las teclas de flecha para seleccionar la opción Modo seguro y pulse Intro.

Para terminar el proceso de malware/grayware/spyware:

1. Explore el equipo con su producto de Trend Micro y anote el nombre del malware/grayware/spyware detectado.
2. Abra el Administrador de tareas de Windows.
   • Para usuarios de Windows 98 y ME, pulse
   CTRL+ALT+SUPR
   . • Para usuarios de Windows NT, 2000, XP y Server 2003, pulse
   CTRL+MAYÚS+ESC y, a continuación, haga clic en la pestaña Procesos.
3. En la lista de programas en ejecución, busque el archivo de malware/grayware/spyware detectado anteriormente.
4. Seleccione los archivos detectados y, a continuación, pulse el botón Finalizar tarea o Terminar proceso, según cuál sea la versión de Windows que use.
5. Proceda del mismo modo con el resto de archivos de malware/grayware/spyware detectados en la lista de programas en ejecución.
6. Para confirmar que el proceso de malware/grayware/spyware ha terminado, cierre el Administrador de tareas y vuelva a abrirlo.
7. Cierre el Administrador de tareas.

Para eliminar los archivos del componente de malware/grayware/spyware:

1. Haga clic con el botón derecho en Inicio y haga clic en Buscar....
2. En el cuadro de entrada Nombre, escriba:
   
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\{username}
   • %All Users Profile%\Microsoft\Search\Data\Applications\{username}
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\{username}
   • %Start Menu%\Programs\Administrative Tools\{username}
   • %AppDataLocal%Low\Mozilla\{username}
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Java\{username}
   • %AppDataLocal%\pip\cache\http\a\1\9\5\{username}
   • %System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\updates\0\{username}.KEKW
   • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo175.gif.KEKW
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pings\{username}
   • %System Root%\Python27\include\pgenheaders.h.KEKW
   • %User Temp%\dd_vcredistMSI0FD5.txt.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\50\{username}
   • %System Root%\Python27\Lib\hotshot\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47\{username}
   • %System Root%\powerpoint2k\PPT2KExx.PPT.KEKW
   • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieUserList\container.dat.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_07.txt.KEKW
   • %System Root%\Python27\include\Python-ast.h.KEKW
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\virtual\{username}.KEKW
   • %System Root%\Python27\Lib\idlelib\Icons\minusnode.gif.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\treeadapters\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp.KEKW
   • %System Root%\Users\{username}\AppData\Roaming\Microsoft\Windows\Libraries\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\{username}
   • %Desktop%\word2k\DOC2KE01.doc.KEKW
   • %AppDataLocal%\pip\cache\http\7\e\9\8\0\{username}
   • %System Root%\Users\Default\AppData\Roaming\{username}
   • %System Root%\Python27\include\ast.h.KEKW
   • %System Root%\Python27\Lib\idlelib\extend.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Device Stage\Task\{{GUID}}\{username}.KEKW
   • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\Un_A\{username}.KEKW
   • %System Root%\word2k\DOC2KE02.doc.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Store\{username}.KEKW
   • %System Root%\Python27\NEWS.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Assistance\Client\{username}
   • %System Root%\Python27\Lib\test\zipdir.zip.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\johab-utf8.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1D\{username}
   • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo200.gif.KEKW
   • %AppDataLocal%\Microsoft\Internet Explorer\VersionManager\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1D\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\util\{username}
   • %System Root%\Users\All Users\Microsoft\Assistance\Client\{username}.KEKW
   • %User Temp%\Low\{username}
   • F:\data\photos\{username}
   • %System Root%\Users\Public\Pictures\Sample Pictures\{username}
   • %System Root%\Users\All Users\McAfee\MCLOGS\Common\{username}.KEKW
   • %Start Menu%\{username}
   • %Application Data%\Microsoft\UProof\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\{username}.KEKW
   • %AppDataLocal%\pip\cache\http\a\6\9\b\d\{username}
   • %System Root%\excel2k\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Pretty_Peacock.jpg.KEKW
   • %System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\dependency_links.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\{username}
   • %System Root%\Python27\Lib\idlelib\Icons\idle_32.gif.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_35.txt.KEKW
   • %AppDataLocal%\pip\cache\http\7\e\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\{username}
   • %All Users Profile%\Microsoft\Assistance\Client\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\F0\{username}
   • %AppDataLocal%\Microsoft\Feeds Cache\container.dat.KEKW
   • %System Root%\Users\All Users\Mozilla\updates\{username}.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\treewalkers\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\22\{username}
   • %System Root%\Users\{username}\Music\{username}
   • %System Root%\Users\Public\Music\Sample Music\Kalimba.mp3.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Definition Updates\Updates\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A\{username}
   • %System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\top_level.txt.KEKW
   • %System Root%\Python27\tcl\reg1.2\{username}
   • %System Root%\Python27\include\pymem.h.KEKW
   • %System Root%\Users\All Users\Microsoft\IdentityCRL\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\{username}.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\shift_jisx0213.txt.KEKW
   • %AppDataLocal%\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_internal\commands\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp.KEKW
   • %System Root%\word2k\DOC2KE05.doc.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\{username}.KEKW
   • %System Root%\PerfLogs\Admin\{username}
   • %System Root%\Python27\tcl\tcl8\8.5\{username}
   • %AppDataLocal%\pip\cache\http\d\3\7\e\0\{username}
   • %System Root%\Python27\Lib\test\cjkencodings\cp949-utf8.txt.KEKW
   • %System Root%\Python27\tcl\tcl8.5\tzdata\Etc\{username}
   • %System Root%\Python27\Lib\test\cjkencodings\gb2312-utf8.txt.KEKW
   • %System Root%\Python27\tcl\tix8.4.3\bitmaps\minusarm.gif.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\muffin\{username}
   • %System Root%\Python27\Lib\test\capath\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\CacheManager\{username}.KEKW
   • %System Root%\Python27\Tools\pynche\webcolors.txt.KEKW
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\SoftBlue.jpg.KEKW
   • %AppDataLocal%\pip\cache\http\d\3\{username}
   • %AppDataLocal%\pip\cache\http\2\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\39\{username}
   • %All Users Profile%\Microsoft\Windows\Sqm\Upload\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\18\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_22.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\{username}
   • %System Root%\Users\All Users\Microsoft\RAC\PublishedData\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp.KEKW
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\datareporting\archived\2019-05\{username}
   • %System Root%\Users\Default\Videos\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\{username}.KEKW
   • %Application Data%\Microsoft\SystemCertificates\My\CRLs\{username}
   • %System Root%\Python27\tcl\tcl8\8.4\platform\{username}
   • %System Root%\Python27\include\descrobject.h.KEKW
   • %System Root%\Python27\include\dictobject.h.KEKW
   • %System Root%\Python27\Lib\test\imghdrdata\python.bmp.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\OriginTrials\{username}
   • %System Root%\Users\Default\AppData\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\requests\{username}
   • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.1\{username}
   • %System Root%\Users\Public\Documents\excel2k\XLS2KExx.xls.KEKW
   • %System Root%\Python27\tcl\tk8.5\images\logo100.gif.KEKW
   • %System Root%\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\7\{username}
   • %AppDataLocal%Low\{username}
   • %System Root%\Python27\tcl\tcl8.5\tzdata\Australia\{username}
   • %System Root%\Users\All Users\Microsoft\MF\{username}
   • %System Root%\Python27\Lib\test\cjkencodings\gb18030-utf8.txt.KEKW
   • %Application Data%\Macromedia\Flash Player\macromedia.com\support\flashplayer\{username}
   • %System Root%\Python27\tcl\tcl8.5\http1.0\{username}
   • %Desktop%\powerpoint2k\PPT2KE02.ppt.KEKW
   • %System Root%\Users\All Users\Microsoft\IlsCache\{username}
   • %System Root%\Python27\include\modsupport.h.KEKW
   • %Desktop%\excel2k\XLS2KE01.xls.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_11.txt.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_46.txt.KEKW
   • %System Root%\Users\All Users\Microsoft Help\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\Tiles\pin9728060290\{username}
   • %All Users Profile%\Oracle\Java\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\52\{username}
   • %Favorites%\MSN Websites\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\{username}.KEKW
   • %AppDataLocal%Low\Microsoft\Windows\AppCache\LY14JQYG\container.dat.KEKW
   • %User Profile%\Documents\Email and Password List.txt.KEKW
   • %User Temp%\WPDNSE\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\Backup\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_05.txt.KEKW
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\2918063365piupsah.files\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\{username}
   • %System Root%\Python27\tcl\tix8.4.3\bitmaps\folder.gif.KEKW
   • %AppDataLocal%\pip\cache\http\a\1\{username}
   • %AppDataLocal%\Google\Chrome\User Data\SwReporter\{username}
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-child.bin.KEKW
   • %All Users Profile%\McAfee\WinCore\{username}
   • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.1\_metadata\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg.KEKW
   • %AppDataLocal%\Deployment\{username}
   • %AppDataLocal%\Apps\2.0\Data\RNQG94OQ.QJC\E1WGPJBQ.PMC\goog...app_9ae46cec200785df_0001.0003_7581c0cd83ac8659\{username}
   • %System Root%\Python27\tcl\tix8.4.3\demos\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\{username}
   • %System Root%\Python27\Lib\test\cjkencodings\euc_kr-utf8.txt.KEKW
   • %System Root%\Python27\Lib\idlelib\NEWS.txt.KEKW
   • %Application Data%\Macromedia\Flash Player\{username}
   • %Application Data%\Microsoft\Credentials\{username}
   • %All Users Profile%\VMware\RawdskCompatibility\native\C\{username}
   • %System Root%\Python27\Lib\site-packages\pip\{username}
   • %AppDataLocal%\Google\Chrome\User Data\FileTypePolicies\34\_metadata\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\{username}
   • %AppDataLocal%\Google\Chrome\User Data\BrowserMetrics\{username}
   • %Application Data%\Macromedia\Flash Player\macromedia.com\{username}
   • %Application Data%\Mozilla\SystemExtensionsDev\{username}
   • %User Profile%\Documents\word2k\{username}
   • %System Root%\Python27\Lib\test\audiodata\pluck-pcm8.wav.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp.KEKW
   • %AppDataLocal%\pip\cache\http\0\2\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\mpcache-B1C01FED9F08520A4647901EFB883A6A3B247F8D.bin.KEKW
   • %AppDataLocal%\Apps\2.0\Data\RNQG94OQ.QJC\E1WGPJBQ.PMC\{username}
   • %AppDataLocal%\Microsoft\Windows\History\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\DeviceMetadataStore\en-US\{username}
   • %System Root%\Python27\Lib\test\floating_points.txt.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\37\{username}
   • %System Root%\Python27\Lib\lib2to3\fixes\{username}
   • %System Root%\Users\All Users\Microsoft\RAC\StateData\RacWmiDataBookmarks.dat.KEKW
   • %User Profile%\Documents\word2k\DOC2KE02.doc.KEKW
   • %AppDataLocal%\pip\cache\http\7\{username}
   • %System Root%\Users\Public\Pictures\Sample Pictures\Desert.jpg.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70\{username}
   • %All Users Profile%\Microsoft\Windows\WER\ReportQueue\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\{username}.KEKW
   • %System Root%\Users\{username}\Pictures\{username}
   • %System Root%\Python27\tcl\tix8.4.3\demos\bitmaps\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\host\{username}
   • %AppDataLocal%\pip\cache\http\b\a\9\3\5\{username}
   • %System Root%\Python27\Lib\test\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\8\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\{username}.KEKW
   • %Application Data%\Microsoft\Internet Explorer\{username}
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\VMware\{username}
   • %AppDataLocal%\Microsoft\Feeds Cache\M7X9O6Z1\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Caches\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\IECompatData\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\19\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_internal\models\{username}
   • %System Root%\Python27\tcl\tix8.4.3\bitmaps\minus.gif.KEKW
   • %AppDataLocal%\pip\cache\http\f\e\d\0\e\{username}
   • %System Root%\Python27\Lib\test\math_testcases.txt.KEKW
   • %System Root%\Users\Public\Libraries\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\42\{username}
   • %Application Data%\Microsoft\Office\Recent\index.dat.KEKW
   • %System Root%\Python27\include\traceback.h.KEKW
   • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\History\CacheManager\MpSfc.bin.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Support\{username}.KEKW
   • %AppDataLocal%\pip\cache\http\5\4\{username}
   • %All Users Profile%\Microsoft\Device Stage\Task\{{GUID}}\{username}
   • %All Users Profile%\VMware\RawdskCompatibility\{username}
   • %System Root%\Python27\Lib\distutils\command\{username}
   • %System Root%\Users\All Users\Microsoft\Device Stage\Task\{username}.KEKW
   • %AppDataLocal%\Microsoft\Windows\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp.KEKW
   • %Application Data%\Microsoft\Windows\Templates\{username}
   • %AppDataLocal%\Python-Eggs\Python-Eggs\Cache\pillow-4.1.0-py2.7-win32.egg-tmp\{username}
   • %System Root%\Users\Public\Documents\powerpoint2k\{username}
   • %AppDataLocal%\Microsoft\Feeds Cache\NNO7APUS\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\tabiconcache.dat.KEKW
   • %System Root%\Users\Public\Pictures\Sample Pictures\Koala.jpg.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95\{username}
   • %System Root%\Python27\Lib\test\leakers\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\33\{username}
   • %User Temp%\dd_NDP452-KB2901907-x86-x64-AllOS-ENU_decompression_log.txt.KEKW
   • %System Root%\Users\All Users\Oracle\Java\javapath_target_313094\{username}.KEKW
   • %AppDataLocal%\pip\cache\http\7\e\9\8\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\{username}.KEKW
   • %System Root%\Python27\Lib\multiprocessing\{username}
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\SentItems\{username}.KEKW
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Psychedelic.jpg.KEKW
   • %AppDataLocal%\pip\cache\http\4\{username}
   • %User Profile%\Contacts\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Device Stage\Task\{{GUID}}\en-US\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Entries\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Inbox\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\msgpack\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\34\{username}
   • %AppDataLocal%\Microsoft\Office\Groove\User\{username}
   • %All Users Profile%\Microsoft\Network\Downloader\qmgr0.dat.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\pnacl\0.57.44.2492\_platform_specific\x86_64\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\70\{username}.KEKW
   • %System Root%\Python27\Lib\idlelib\idle_test\README.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\AIT\{username}
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Sqm\Upload\{username}
   • %All Users Profile%\VMware\VMware Tools\Unity Filters\vmwarefilters.txt.KEKW
   • %System Root%\Users\All Users\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\eHome\{username}
   • %System Root%\Python27\Lib\test\cjkencodings\cp949.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\{username}.KEKW
   • %System Root%\Python27\include\iterobject.h.KEKW
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\cache2\entries\{username}
   • %AppDataLocal%\Google\Chrome\User Data\InterventionPolicyDatabase\2018.9.6.0\{username}
   • %All Users Profile%\Microsoft\OFFICE\DATA\opa12.dat.KEKW
   • %System Root%\Users\Default\Links\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp.KEKW
   • %All Users Profile%\McAfee\MCLOGS\PartnerCustom\SSScheduler\{username}
   • %System Root%\Python27\tcl\tix8.4.3\bitmaps\{username}
   • %System Root%\Python27\include\import.h.KEKW
   • %AppDataLocal%\pip\cache\http\0\2\5\{username}
   • %System Root%\Users\Default\AppData\Local\Temp\{username}
   • %All Users Profile%\VMware\VMware Tools\manifest.txt.KEKW
   • %All Users Profile%\Mozilla\updates\308046B0AF4A39CB\updates\{username}
   • %AppDataLocal%\Microsoft\Windows\Burn\{username}
   • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KExx.PPT.KEKW
   • %AppDataLocal%\Microsoft\Internet Explorer\UrlBlockManager\urlblocklist.bin.KEKW
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts\{username}
   • %AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\{username}
   • %System Root%\Users\Public\Documents\excel2k\XLS2KE01.xls.KEKW
   • %AppDataLocal%\Microsoft\Internet Explorer\imagestore\1s32qbz\{username}
   • %User Profile%\Documents\word2k\DOC2KE01.doc.KEKW
   • %System Root%\Users\All Users\VMware\VMware Tools\Unity Filters\{username}
   • %System Root%\Users\All Users\VMware\{username}.KEKW
   • %System Root%\Users\Public\Music\{username}
   • %System Root%\Users\All Users\Microsoft\OFFICE\DATA\{username}
   • %System Root%\Python27\Lib\test\cjkencodings\euc_jp-utf8.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\DRM\Cache\{username}
   • %All Users Profile%\Microsoft\NetFramework\BreadcrumbStore\{username}
   • %User Profile%\Documents\excel2k\XLS2KE02.xls.KEKW
   • %System Root%\Python27\Lib\site-packages\pythonnet-2.1.0.dist-info\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\{username}.KEKW
   • %User Profile%\Documents\powerpoint2k\PPT2KE05.ppt.KEKW
   • %System Root%\Users\All Users\Microsoft\DRM\Server\{username}.KEKW
   • %System Root%\Users\{username}\AppData\Roaming\Microsoft\Windows\{username}
   • %System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\LICENSE.txt.KEKW
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\datareporting\archived\2019-04\{username}
   • %System Root%\Users\All Users\Microsoft\Media Player\{username}
   • %System Root%\Users\All Users\Microsoft\OFFICE\{username}.KEKW
   • %Application Data%\Microsoft\Windows\DNTException\Low\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\{username}
   • %System Root%\Python27\tcl\tcl8.5\tzdata\Arctic\{username}
   • %System Root%\Python27\include\fileobject.h.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Scans\History\Results\Resource\{username}
   • %AppDataLocal%\Microsoft\Feeds\Feeds for United States~\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp.KEKW
   • %AppDataLocal%\pip\cache\http\5\4\3\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp.KEKW
   • %System Root%\Python27\tcl\tcl8.5\tzdata\Canada\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\3UYAQU1F\{username}
   • %AppDataLocal%\Microsoft\Windows\Ringtones\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Connectivity.gif.KEKW
   • %User Temp%\Microsoft .NET Framework 4.5.2 Setup_20161212_135033207.html.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\56\{username}
   • %User Profile%\Documents\powerpoint2k\PPT2KE04.ppt.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\hz.txt.KEKW
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\cache2\doomed\{username}
   • %System Root%\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\{username}
   • %System Root%\Users\All Users\Microsoft\Device Stage\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\WER\{username}
   • %System Root%\Python27\include\eval.h.KEKW
   • %All Users Profile%\Microsoft\Device Stage\Task\{username}
   • %System Root%\Python27\include\intobject.h.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp.KEKW
   • %System Root%\word2k\DOC2KE03.doc.KEKW
   • %System Root%\$Recycle.Bin\S-1-5-21-2407829820-1079796033-203259571-500\{username}
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Maintenance\{username}
   • %AppDataLocal%\Google\Chrome\User Data\ShaderCache\GPUCache\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3\{username}
   • %All Users Profile%\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\{username}
   • %System Root%\excel2k\XLS2KE02.xls.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\VMware Tools\{username}.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\shift_jis-utf8.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Assistance\{username}.KEKW
   • %Application Data%\Microsoft\Vault\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_19.txt.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Scans\History\Results\Quick\{username}
   • %System Root%\Python27\tcl\tcl8.5\tzdata\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Store\{username}
   • %System Root%\Users\All Users\Microsoft\RAC\{username}.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\gbk-utf8.txt.KEKW
   • %All Users Profile%\Microsoft\Windows\Sqm\Sessions\{username}
   • %System Root%\Users\{username}\AppData\{username}
   • %System Root%\Python27\tcl\tcl8.5\tzdata\Africa\{username}
   • %All Users Profile%\McAfee\MCLOGS\PartnerCustom\Un_A\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\61\{username}
   • %System Root%\Python27\Lib\site-packages\setuptools\command\{username}
   • %System Root%\Python27\tcl\tix8.4.3\bitmaps\srcfile.gif.KEKW
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-current.bin.KEKW
   • %All Users Profile%\McAfee\MCLOGS\PartnerCustom\McCHSvc\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp.KEKW
   • %All Users Profile%\Microsoft\Windows\DRM\{username}
   • %System Root%\Python27\Tools\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Config\{username}.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\shift_jisx0213-utf8.txt.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_08.txt.KEKW
   • %All Users Profile%\Microsoft\MSDN\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\{AD285A8B-713F-11E9-85F8-005056BC44A9}.dat.KEKW
   • %System Root%\Python27\Lib\test\decimaltestdata\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\LocalCopy\{username}
   • %System Root%\Users\All Users\Microsoft\MSDN\8.0\{username}.KEKW
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp.KEKW
   • %System Root%\Python27\Lib\test\test_doctest.txt.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\pep517\{username}
   • %System Root%\Python27\include\osdefs.h.KEKW
   • %System Root%\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.KEKW
   • %All Users Profile%\Microsoft\Windows NT\MSFax\ActivityLog\{username}
   • %AppDataLocal%\pip\cache\http\0\{username}
   • %AppDataLocal%\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\{username}
   • %AppDataLocal%\Microsoft\Windows\WebCache\WebCacheV01.dat.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\contrib\_securetransport\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\4\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5\{username}
   • %All Users Profile%\Oracle\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\GUFNQG0Q\{username}
   • %User Temp%\acrocef_low\{username}
   • %System Root%\Python27\Doc\{username}
   • %User Profile%\Documents\powerpoint2k\PPT2KE01.ppt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSScan\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\{username}
   • %System Root%\Python27\tcl\tcl8.5\tzdata\America\Argentina\{username}
   • %System Root%\Users\All Users\Microsoft\OFFICE\DATA\{username}.KEKW
   • %AppDataLocal%\Microsoft\Internet Explorer\Tracking Protection\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\LocalCopy\{username}.KEKW
   • %System Root%\Python27\LICENSE.txt.KEKW
   • %System Root%\Users\All Users\Adobe\Setup\{username}
   • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\{username}.KEKW
   • %System Root%\Python27\tcl\tix8.4.3\bitmaps\act_fold.gif.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Scans\{username}
   • %System Root%\Python27\Lib\test\cjkencodings\big5hkscs.txt.KEKW
   • %System Root%\Users\{username}\AppData\Local\{username}
   • %System Root%\Python27\tcl\tk8.5\images\logoMed.gif.KEKW
   • %All Users Profile%\Microsoft\RAC\Outbound\{username}
   • %System Root%\Python27\Lib\xml\etree\{username}
   • %Application Data%\Microsoft\Document Building Blocks\1033\{username}
   • %All Users Profile%\Microsoft\Windows\Sqm\{username}
   • %System Root%\Python27\tcl\tix8.4.3\{username}
   • %AppDataLocal%\Google\Chrome\User Data\InterventionPolicyDatabase\2018.9.6.0\_metadata\{username}
   • %System Root%\Python27\tcl\tix8.4.3\pref\TixGray.cs.KEKW
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp.KEKW
   • %System Root%\Recovery\{GUID}\{username}
   • %Start Menu%\Programs\Accessories\Accessibility\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\History\{username}
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\{username}
   • %AppDataLocal%\pip\cache\http\3\8\9\3\{username}
   • %Application Data%\Microsoft\Windows\IEDownloadHistory\container.dat.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.1\LICENSE.txt.KEKW
   • %All Users Profile%\Microsoft\Search\Data\Temp\{username}
   • %System Root%\Python27\include\pyerrors.h.KEKW
   • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\PDYB5D8B\{username}
   • %AppDataLocal%Low\Microsoft\Windows\AppCache\container.dat.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\{username}
   • %System Root%\Users\Public\Pictures\Sample Pictures\Tulips.jpg.KEKW
   • %System Root%\Users\All Users\Microsoft\NetFramework\BreadcrumbStore\{username}
   • %All Users Profile%\Microsoft\Windows\Power Efficiency Diagnostics\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\Updates\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\1\{username}
   • %System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\updates\{username}.KEKW
   • %All Users Profile%\Oracle\Java\installcache_x64\{username}
   • %System Root%\Users\All Users\Microsoft\Network\Connections\{username}.KEKW
   • %System Root%\Email and Password List.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\{username}.KEKW
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\pkcs11.txt.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_27.txt.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\0\{username}
   • %Application Data%\Microsoft\Office\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Power Efficiency Diagnostics\{username}.KEKW
   • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieUserList\{username}
   • %System Root%\Python27\include\pyarena.h.KEKW
   • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieBrowserModeList\{username}
   • %Desktop%\powerpoint2k\PPT2KE04.ppt.KEKW
   • %System Root%\Users\Public\Documents\word2k\DOC2KE02.doc.KEKW
   • %Application Data%\Microsoft\Windows\Printer Shortcuts\{username}
   • %System Root%\Python27\Lib\test\cjkencodings\euc_jp.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp.KEKW
   • %System Root%\Python27\Lib\lib2to3\tests\{username}
   • %System Root%\Users\All Users\Microsoft\DeviceSync\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F0\{username}
   • %System Root%\Users\All Users\McAfee\MCLOGS\{username}.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_04.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\DeviceMetadataStore\{username}
   • %System Root%\Python27\include\setobject.h.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_internal\operations\{username}
   • %Desktop%\word2k\DOC2KE05.doc.KEKW
   • %System Root%\Python27\tcl\tix8.4.3\bitmaps\info.gif.KEKW
   • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\8YC9813O\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\{username}
   • %System Root%\Python27\tcl\tix8.4.3\pref\WmDefault.cs.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\contrib\{username}
   • %All Users Profile%\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\DATA\{username}
   • %All Users Profile%\VMware\VMware Tools\Unity Filters\vistasidebar.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Sqm\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\{username}
   • %System Root%\Users\All Users\Adobe\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\{username}
   • %Start Menu%\Programs\{username}
   • %Desktop%\{username}
   • %User Profile%\Documents\excel2k\XLS2KExx.xls.KEKW
   • %AppDataLocal%\pip\cache\http\b\a\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\F0\{username}
   • %System Root%\Python27\tcl\tk8.5\msgs\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43\{username}.KEKW
   • %System Root%\Python27\include\marshal.h.KEKW
   • %System Root%\Python27\Lib\test\audiodata\{username}
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Microsoft Office\{username}
   • %System Root%\Python27\Lib\idlelib\README.txt.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\12\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Definition Updates\Backup\{username}
   • %AppDataLocal%\pip\cache\http\f\e\d\{username}
   • %System Root%\Python27\include\Python.h.KEKW
   • %System Root%\Users\All Users\Microsoft\Network\{username}.KEKW
   • %All Users Profile%\Microsoft\IdentityCRL\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\{username}
   • %All Users Profile%\Oracle\Java\javapath_target_313094\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_41.txt.KEKW
   • %System Root%\Python27\tcl\tk8.5\images\logoLarge.gif.KEKW
   • %System Root%\Python27\tcl\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Quarantine\{username}.KEKW
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_15.txt.KEKW
   • %AppDataLocal%Low\Sun\Java\{username}
   • %System Root%\Python27\Lib\curses\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\MSIMGSIZ.DAT.KEKW
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\{username}
   • %System Root%\Python27\include\graminit.h.KEKW
   • %AppDataLocal%\Microsoft\TaskSchedulerConfig\{username}
   • F:\data\dolist.txt.KEKW
   • %AppDataLocal%\Microsoft\PlayReady\{username}
   • %Start Menu%\Programs\Maintenance\{username}
   • %User Temp%\{username}
   • %AppDataLocal%\Microsoft\Windows Media\{username}
   • %AppDataLocal%\Microsoft\Windows\Burn\Burn\{username}
   • %System Root%\Python27\tcl\tk8.5\images\logo64.gif.KEKW
   • %All Users Profile%\Microsoft\RAC\Temp\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Entries\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\{username}.KEKW
   • %Desktop%\powerpoint2k\PPT2KE03.ppt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\{username}
   • %All Users Profile%\Microsoft\Windows\AIT\{username}
   • %System Root%\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Queue\{username}.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\treebuilders\{username}
   • %User Profile%\Documents\Email and Password List.js.KEKW
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\urlCache.bin.KEKW
   • %System Root%\Python27\include\pythonrun.h.KEKW
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Tablet PC\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\{username}
   • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\550F8967-2EE2-4F33-8E16-1BFFBE114803\{username}
   • %AppDataLocal%\Microsoft Help\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_09.txt.KEKW
   • %System Root%\Python27\include\pymactoolbox.h.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_02.txt.KEKW
   • %AppDataLocal%\Microsoft\Windows\WER\ReportArchive\NonCritical_iexplore.exe_12df8271b62395a348f102b12959f9768e2baf9_0be7f64f\{username}
   • %System Root%\Python27\Lib\test\support\{username}
   • %System Root%\word2k\DOC2KE01.doc.KEKW
   • %System Root%\Users\All Users\Microsoft\IdentityCRL\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\SiteSecurityServiceState.txt.KEKW
   • %System Root%\Python27\Lib\test\tokenize_tests.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70\{username}.KEKW
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Tiki.gif.KEKW
   • %System Root%\Python27\include\stringobject.h.KEKW
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg.KEKW
   • %System Root%\Users\All Users\Microsoft Help\{username}.KEKW
   • %System Root%\Python27\Lib\idlelib\idle_test\{username}
   • %System Root%\Users\All Users\VMware\VMware Tools\{username}.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\packages\{username}
   • %AppDataLocal%\pip\cache\http\2\3\b\{username}
   • %AppDataLocal%\pip\cache\http\4\e\e\3\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\weave\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Ringtones\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp.KEKW
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\{username}
   • %System Root%\Python27\include\grammar.h.KEKW
   • %AppDataLocal%\pip\cache\http\2\3\{username}
   • %System Root%\excel2k\XLS2KE04.xls.KEKW
   • %All Users Profile%\Microsoft\Assistance\Client\1.0\en-US\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\{username}.dat.KEKW
   • %System Root%\Python27\Lib\test\formatfloat_testcases.txt.KEKW
   • %System Root%\Python27\tcl\tcl8\{username}
   • %AppDataLocal%\Microsoft\Windows Media\12.0\{username}
   • %System Root%\Python27\tcl\tk8.5\ttk\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\{username}.KEKW
   • %System Root%\Python27\tcl\tix8.4.3\pref\Blue.cs.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\3\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\{username}
   • %System Root%\Python27\DLLs\{username}
   • %System Root%\Python27\Lib\idlelib\CREDITS.txt.KEKW
   • %All Users Profile%\McAfee\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_39.txt.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\41\{username}
   • %Application Data%\Microsoft\SystemCertificates\My\CTLs\{username}
   • %System Root%\Users\All Users\VMware\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp.KEKW
   • %System Root%\Python27\tcl\tcl8.5\encoding\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\46\{username}
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\{username}.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_internal\cli\{username}
   • %Application Data%\Sun\Java\{username}
   • %Application Data%\Microsoft\Windows\IEDownloadHistory\{username}
   • %AppDataLocal%\Python-Eggs\{username}
   • %AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\RJ6VBH4W.DN2\manifests\{username}
   • %Application Data%\Microsoft\Windows\IETldCache\{username}
   • %System Root%\Users\All Users\Adobe\ARM\{username}
   • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieSiteList\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\{0E1465B0-BA9C-409F-BC32-D934317129CD}\{username}.KEKW
   • %System Root%\Python27\include\complexobject.h.KEKW
   • %System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\updates\{username}
   • %Start Menu%\Programs\Accessories\{username}
   • %System Root%\Python27\Lib\idlelib\TODO.txt.KEKW
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Sqm\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\59\{username}
   • %Application Data%\Microsoft\Windows\IECompatUACache\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\tmp\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_30.txt.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\70\{username}
   • %AppDataLocal%\Mozilla\Firefox\{username}
   • %Application Data%\Identities\{3D0FBFE3-9E5C-4F14-8D00-F0C8FEFA78BA}\{username}
   • %System Root%\Users\All Users\McAfee\{username}.KEKW
   • %All Users Profile%\Microsoft\Windows\Caches\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\{username}
   • %System Root%\Users\All Users\Microsoft\Device Stage\Task\{{GUID}}\{username}
   • %AppDataLocal%\pip\cache\http\a\1\9\{username}
   • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\Un_A\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\{username}
   • %AppDataLocal%\pip\cache\http\b\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_40.txt.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0\{username}
   • %System Root%\Users\All Users\Microsoft\WwanSvc\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\{username}.KEKW
   • %System Root%\powerpoint2k\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Sqm\Manifest\{username}.KEKW
   • %AppDataLocal%\GDIPFONTCACHEV1.DAT.KEKW
   • %All Users Profile%\VMware\RawdskCompatibility\native\C\ProgramData\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\57\{username}
   • %AppDataLocal%\pip\cache\http\3\8\9\3\0\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\{username}.KEKW
   • %System Root%\Python27\tcl\tcl8.5\tzdata\America\Indiana\{username}
   • %System Root%\Users\All Users\Microsoft\Network\Connections\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\pluginreg.dat.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\{username}.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_28.txt.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\gbk.txt.KEKW
   • %All Users Profile%\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_505c7fc25c7e5866de583f14c22e2b4c2a6018c_0a2493a7\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\History\Results\{username}
   • %System Root%\Users\All Users\Adobe\Setup\{username}.KEKW
   • %AppDataLocal%\Microsoft\Windows\WebCacheLock.dat.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\23\{username}
   • %System Root%\Users\All Users\Microsoft\MF\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Assistance\Client\1.0\{username}.KEKW
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Wrinkled_Paper.gif.KEKW
   • %User Profile%\Documents\powerpoint2k\PPT2KExx.PPT.KEKW
   • %User Profile%\Documents\word2k\DOC2KE04.doc.KEKW
   • %System Root%\excel2k\XLS2KE05.xls.KEKW
   • %System Root%\Python27\Lib\idlelib\Icons\folder.gif.KEKW
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\{username}.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportQueue\{username}
   • %System Root%\Python27\include\object.h.KEKW
   • %Start Menu%\Programs\Accessories\System Tools\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\38\{username}
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Quarantine\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\distlib\{username}
   • %System Root%\word2k\{username}
   • %Start Menu%\Programs\ImDisk\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\27\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\14\{username}
   • %System Root%\Users\All Users\McAfee\MCLOGS\Common\SmallInstaller\{username}
   • %System Root%\Users\{username}\{username}
   • %All Users Profile%\Microsoft\RAC\PublishedData\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\user.bmp.KEKW
   • %System Root%\Python27\include\intrcheck.h.KEKW
   • %All Users Profile%\VMware\VMware Tools\Unity Filters\visualstudio2005.txt.KEKW
   • %Desktop%\AAljoOV.jpg.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1D\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\{username}
   • %AppDataLocal%\Google\Software Reporter Tool\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Support\{username}
   • %AppDataLocal%\Google\Chrome\User Data\Crashpad\settings.dat.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\{username}.KEKW
   • %System Root%\Users\Public\Documents\Email and Password List.js.KEKW
   • %Application Data%\Microsoft\{username}
   • %System Root%\Users\Default\NTUSER.DAT.KEKW
   • %System Root%\Users\All Users\Microsoft\Search\Data\Temp\usgthrsvc\{username}.KEKW
   • %System Root%\Python27\include\weakrefobject.h.KEKW
   • %All Users Profile%\McAfee\MCLOGS\{username}
   • %System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\{username}
   • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\{username}
   • %System Root%\Python27\include\bitset.h.KEKW
   • %System Root%\Users\All Users\Microsoft\RAC\StateData\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Assistance\Client\1.0\{username}
   • %System Root%\Python27\Lib\unittest\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\{username}
   • %System Root%\Python27\Lib\test\imghdrdata\python.png.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\ShaderCache\{username}
   • %AppDataLocal%\Google\Chrome\User Data\pnacl\0.57.44.2492\{username}
   • %Application Data%\Microsoft\Windows\IECompatCache\container.dat.KEKW
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp.KEKW
   • F:\data\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\History\Store\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\minidumps\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp.KEKW
   • %All Users Profile%\Microsoft\Windows NT\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\{username}.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_18.txt.KEKW
   • %System Root%\word2k\DOC2KExx.doc.KEKW
   • %System Root%\Python27\tcl\tcl8.5\tzdata\Antarctica\{username}
   • %System Root%\Users\All Users\Microsoft\Search\{username}.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\Safe Browsing\{username}
   • %System Root%\Python27\tcl\tcl8.5\tzdata\America\Kentucky\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\{username}.KEKW
   • %System Root%\Python27\include\genobject.h.KEKW
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp.KEKW
   • %All Users Profile%\Microsoft\Windows\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\EmieBrowserModeList\container.dat.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\{0E1465B0-BA9C-409F-BC32-D934317129CD}\{username}
   • %System Root%\Python27\include\dtoa.h.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\43\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\{username}
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\45\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\ActivityLog\{username}.KEKW
   • %Application Data%\Microsoft\Internet Explorer\UserData\Low\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3\{username}
   • %System Root%\Python27\Lib\site-packages\setuptools\_vendor\packaging\{username}
   • %System Root%\Users\All Users\Microsoft\MSDN\8.0\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_20.txt.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\CertificateRevocation\5140\_metadata\{username}
   • %User Temp%\Guest.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\{username}.KEKW
   • %User Profile%\Documents\word2k\DOC2KExx.doc.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Inbox\{username}.KEKW
   • %System Root%\Users\Public\Documents\word2k\{username}
   • %User Temp%\Deployment\{username}
   • %AppDataLocal%\pip\cache\http\d\{username}
   • %System Root%\Users\All Users\Microsoft\Search\{username}
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\safebrowsing\google4\{username}
   • %System Root%\Users\All Users\Microsoft\MSDN\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\F0\{username}.KEKW
   • %AppDataLocal%Low\Microsoft\Internet Explorer\{username}
   • %All Users Profile%\Microsoft\DeviceSync\{username}
   • %Application Data%\Macromedia\{username}
   • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\Config\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\40\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Garden.jpg.KEKW
   • %System Root%\Users\All Users\Oracle\{username}.KEKW
   • %All Users Profile%\Microsoft\IlsCache\{username}
   • %System Root%\Python27\Lib\xml\parsers\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp.KEKW
   • %AppDataLocal%\pip\cache\http\0\2\5\2\b\{username}
   • %System Root%\word2k\DOC2KE04.doc.KEKW
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\weave\toFetch\{username}
   • %All Users Profile%\Microsoft\Device Stage\{username}
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Games\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\TabRoaming\{username}
   • %Desktop%\excel2k\XLS2KE02.xls.KEKW
   • %System Root%\Python27\Lib\lib2to3\Grammar.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\{username}.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\iso2022_jp-utf8.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp.KEKW
   • %All Users Profile%\Adobe\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\17\{username}
   • F:\data\photos\stunning.jpg.KEKW
   • %System Root%\Python27\include\memoryobject.h.KEKW
   • %AppDataLocal%\Microsoft\Office\Groove\System\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\lockfile\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\EmieBrowserModeList\{username}
   • %All Users Profile%\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\{username}
   • %System Root%\Python27\Lib\test\tracedmodules\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\GameExplorer\{username}
   • %System Root%\Python27\tcl\tk8.5\images\tai-ku.gif.KEKW
   • %User Profile%\Pictures\{username}
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\OfflineCache\{username}
   • %AppDataLocal%\pip\cache\http\a\1\9\5\3\{username}
   • %System Root%\Users\Default\Desktop\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\{username}
   • %System Root%\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\filters\{username}
   • %All Users Profile%\VMware\RawdskCompatibility\native\regdata.dat.KEKW
   • %System Root%\Users\All Users\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\{username}
   • %All Users Profile%\Microsoft\Windows\Templates\{username}
   • %System Root%\Python27\Lib\ensurepip\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\imagestore\joppu72\{username}
   • %User Temp%\dd_wcf_CA_smci_20161212_135110_351.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\NetFramework\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\{username}.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\CertificateRevocation\{username}
   • %System Root%\Python27\Lib\lib2to3\PatternGrammar.txt.KEKW
   • %System Root%\Python27\Lib\test\cmath_testcases.txt.KEKW
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\cache2\{username}
   • %System Root%\Users\All Users\McAfee\WinCore\{username}.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\FileTypePolicies\34\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Service\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportQueue\{username}.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_25.txt.KEKW
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\{username}
   • %System Root%\Python27\tcl\tix8.4.3\pref\Gray.cs.KEKW
   • %AppDataLocal%\Microsoft\Office\{username}
   • %AppDataLocal%\Microsoft\Windows\History\Low\{username}
   • %System Root%\Python27\include\symtable.h.KEKW
   • %System Root%\Python27\tcl\tix8.4.3\pref\{username}
   • %AppDataLocal%\Google\Chrome\User Data\PepperFlash\{username}
   • %System Root%\Python27\tcl\tk8.5\{username}
   • %Desktop%\powerpoint2k\PPT2KE01.ppt.KEKW
   • %All Users Profile%\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47\{username}
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Administrative Tools\{username}
   • %AppDataLocal%\Microsoft\Windows\GameExplorer\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\AlternateServices.txt.KEKW
   • %System Root%\Users\All Users\Oracle\Java\{username}
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\{username}
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\{username}
   • %System Root%\Python27\Lib\unittest\test\{username}
   • %System Root%\Python27\Lib\test\ieee754.txt.KEKW
   • %System Root%\Python27\Tools\webchecker\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\cachecontrol\caches\{username}
   • %AppDataLocal%\Python-Eggs\Python-Eggs\Cache\pillow-4.1.0-py2.7-win32.egg-tmp\PIL\{username}
   • %System Root%\Python27\include\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_10.txt.KEKW
   • %System Root%\Users\All Users\Adobe\ARM\{username}.KEKW
   • %System Root%\Python27\include\tupleobject.h.KEKW
   • %Application Data%\Microsoft\SystemCertificates\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\{username}
   • %AppDataLocal%\Apps\2.0\{username}
   • %System Root%\Users\All Users\Adobe\ARM\Reader_19.010.20099\{username}
   • %AppDataLocal%\Microsoft\Windows Sidebar\Gadgets\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Notebook.jpg.KEKW
   • %All Users Profile%\Microsoft\Media Player\{username}
   • %All Users Profile%\Microsoft\MSDN\8.0\{username}
   • %AppDataLocal%\pip\cache\http\f\e\{username}
   • %User Profile%\Documents\fp_18.0.0.203_archive\{username}
   • %System Root%\Python27\include\bufferobject.h.KEKW
   • %System Root%\Users\Public\Documents\word2k\DOC2KE03.doc.KEKW
   • %System Root%\Python27\Tools\pynche\namedcolors.txt.KEKW
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\crashes\events\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01\{username}
   • %Application Data%\Microsoft\Windows\IETldCache\container.dat.KEKW
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\{username}
   • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\{username}
   • %AppDataLocal%\Microsoft\Media Player\Sync Playlists\en-US\00007196\{username}
   • %User Profile%\Documents\powerpoint2k\{username}
   • %System Root%\Python27\Lib\test\cjkencodings\euc_jisx0213.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSScan\{username}
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\{username}
   • %System Root%\Users\All Users\Microsoft\Device Stage\Task\{{GUID}}\en-US\{username}.KEKW
   • %All Users Profile%\Microsoft\Network\Connections\{username}
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\{username}
   • %System Root%\Python27\Lib\xml\dom\{username}
   • %System Root%\Python27\tcl\tcl8.5\tzdata\SystemV\{username}
   • %AppDataLocal%\Google\Chrome\User Data\SSLErrorAssistant\7\{username}
   • %All Users Profile%\Oracle\Java\.oracle_jre_usage\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Backup\new\{username}
   • %Desktop%\powerpoint2k\{username}
   • %System Root%\Users\All Users\Mozilla\updates\{username}
   • %System Root%\Python27\Lib\test\cjkencodings\big5-utf8.txt.KEKW
   • %AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\RJ6VBH4W.DN2\{username}
   • %AppDataLocal%\Microsoft\Media Player\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_72da1383309c93bd2441accd728cf953e4fa97a_0a24a840\{username}.KEKW
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\bookmarkbackups\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\{username}.KEKW
   • %System Root%\Users\All Users\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_42.txt.KEKW
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-child-current.bin.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\CertificateRevocation\5140\{username}
   • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{4555A5E7-C06D-11E6-8AB1-005056BC3E18}.dat.KEKW
   • %All Users Profile%\Microsoft\Windows\WER\{username}
   • %All Users Profile%\McAfee\MCLOGS\SmallInstaller\{username}
   • %Application Data%\Microsoft\Windows\Libraries\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\3561288849sdhlie.files\{username}
   • %AppDataLocal%\Google\Chrome\User Data\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\{username}
   • %System Root%\Python27\tcl\tix8.4.3\bitmaps\no_entry.gif.KEKW
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\virtual\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\security\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\{username}
   • %System Root%\Python27\include\parsetok.h.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\{username}
   • %User Temp%\Adobe_ADMLogs\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp.KEKW
   • %System Root%\Users\Public\Favorites\{username}
   • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\GatherLogs\{username}
   • %User Profile%\Documents\fp_18.0.0.203_archive.zip.KEKW
   • %Application Data%\Microsoft\Protect\{username}
   • %AppDataLocal%\Google\Chrome\User Data\FileTypePolicies\{username}
   • %System Root%\Users\{username}\Videos\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\container.dat.KEKW
   • %System Root%\Python27\include\listobject.h.KEKW
   • %System Root%\Users\All Users\Microsoft\Vault\{username}.KEKW
   • %All Users Profile%\Microsoft\NetFramework\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Roses.jpg.KEKW
   • %System Root%\Python27\tcl\tix8.4.3\pref\WmDefault.txt.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_12.txt.KEKW
   • %User Temp%\WebInstaller\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Backup\{username}
   • %System Root%\Python27\tcl\dde1.3\{username}
   • %System Root%\Python27\Tools\pynche\README.txt.KEKW
   • %System Root%\Python27\Lib\xml\{username}
   • %AppDataLocal%\Microsoft\Feeds Cache\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_03.txt.KEKW
   • %All Users Profile%\Microsoft\Windows\Start Menu\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp.KEKW
   • %System Root%\Python27\Lib\json\tests\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\HandPrints.jpg.KEKW
   • %Application Data%\Microsoft\Proof\{username}
   • %System Root%\Python27\Tools\versioncheck\README.txt.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\_metadata\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Tablet PC\{username}.KEKW
   • %All Users Profile%\Microsoft\Windows NT\MSFax\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\9IWSW3EX\{username}
   • %System Root%\Python27\include\objimpl.h.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\big5hkscs-utf8.txt.KEKW
   • %System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\{username}.KEKW
   • %Desktop%\word2k\DOC2KExx.doc.KEKW
   • %Application Data%\Macromedia\Flash Player\macromedia.com\support\{username}
   • %All Users Profile%\Mozilla\updates\{username}
   • %System Root%\Python27\Lib\site-packages\setuptools\{username}
   • %System Root%\Python27\include\pyexpat.h.KEKW
   • %System Root%\Python27\Tools\Scripts\{username}
   • %System Root%\Users\Public\Videos\{username}
   • %User Profile%\Documents\word2k\DOC2KE05.doc.KEKW
   • %System Root%\Python27\Lib\idlelib\help.html.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Sqm\Sessions\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp.KEKW
   • %All Users Profile%\VMware\VMware Tools\Unity Filters\adobephotoshopcs3.txt.KEKW
   • %System Root%\Python27\include\cobject.h.KEKW
   • %System Root%\Python27\tcl\tcl8.5\tzdata\Indian\{username}
   • %System Root%\Users\{username}\AppData\Local\Microsoft\{username}
   • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE02.ppt.KEKW
   • %User Temp%\dd_SetupUtility.txt.KEKW
   • %System Root%\Python27\tcl\tcl8.5\tzdata\US\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\11\{username}
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\15\{username}
   • %System Root%\Users\Public\Documents\word2k\DOC2KE01.doc.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\51\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg.KEKW
   • %System Root%\Python27\Lib\test\xmltestdata\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\SecurityPreloadState.txt.KEKW
   • %User Temp%\dd_vcredistMSI0FC1.txt.KEKW
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\urlCache-current.bin.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\packages\ssl_match_hostname\{username}
   • %Application Data%\Microsoft\Internet Explorer\UserData\{username}
   • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Power Efficiency Diagnostics\{username}
   • %Application Data%\Mozilla\Firefox\Crash Reports\{username}
   • %System Root%\Users\All Users\Oracle\Java\{username}.KEKW
   • %System Root%\Python27\tcl\tix8.4.3\bitmaps\openfold.gif.KEKW
   • %System Root%\Python27\include\ceval.h.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95\{username}.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\_trie\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\guest.bmp.KEKW
   • %AppDataLocal%\pip\cache\http\5\4\3\d\7\{username}
   • %System Root%\Users\Default\AppData\Local\Microsoft\Windows\GameExplorer\{username}
   • %System Root%\Users\All Users\Microsoft\WwanSvc\Profiles\{username}
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Python 2.7\{username}
   • %System Root%\Users\Public\Documents\excel2k\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\sessionstore-backups\{username}
   • %System Root%\Python27\include\pymacconfig.h.KEKW
   • %Application Data%\Microsoft\Windows\IECompatCache\Low\{username}
   • %System Root%\Python27\Lib\sqlite3\{username}
   • %AppDataLocal%\pip\cache\http\{username}
   • %System Root%\Python27\Lib\lib-tk\test\test_ttk\{username}
   • %System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\entry_points.txt.KEKW
   • %System Root%\Python27\Scripts\{username}
   • %System Root%\Python27\tcl\tcl8.5\{username}
   • %Application Data%\Microsoft\Windows\Recent\{username}
   • %AppDataLocal%\Microsoft\Feeds Cache\JPOHUSHF\{username}
   • %System Root%\Python27\Lib\test\exception_hierarchy.txt.KEKW
   • %System Root%\$Recycle.Bin\S-1-5-21-2407829820-1079796033-203259571-1000\{username}
   • %All Users Profile%\Microsoft\Windows\Sqm\Manifest\{username}
   • %User Temp%\{username}.bmp.KEKW
   • %AppDataLocal%\Microsoft\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp.KEKW
   • %Application Data%\Microsoft\Internet Explorer\Quick Launch\User Pinned\{username}
   • F:\data\tmp.doc.KEKW
   • %System Root%\Python27\Lib\lib2to3\tests\data\fixers\myfixes\{username}
   • %Favorites%\{username}
   • %System Root%\Users\All Users\Microsoft\RAC\PublishedData\{username}.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\certifi\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\{username}
   • %System Root%\Users\Public\Documents\excel2k\XLS2KE05.xls.KEKW
   • %All Users Profile%\Mozilla\updates\308046B0AF4A39CB\updates\0\{username}
   • %Application Data%\Macromedia\Flash Player\#SharedObjects\K48846QH\{username}
   • F:\data\photos\long_exposure.jpg.KEKW
   • %User Profile%\Links\{username}
   • %System Root%\Python27\libs\{username}
   • %System Root%\Users\Public\Documents\Email and Password List.txt.KEKW
   • %AppDataLocal%\Microsoft\Media Player\Sync Playlists\en-US\{username}
   • %All Users Profile%\VMware\VMware Tools\Unity Filters\googledesktop.txt.KEKW
   • %System Root%\Python27\Lib\importlib\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\43\{username}.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\6\{username}
   • %System Root%\Python27\include\structmember.h.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\DeviceMetadataStore\en-US\{username}.KEKW
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\packages\backports\{username}
   • %AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\{username}
   • %System Root%\Python27\include\metagrammar.h.KEKW
   • %System Root%\Users\All Users\Microsoft\DRM\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\{username}.KEKW
   • %AppDataLocal%\Apps\2.0\Data\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\21\{username}
   • %System Root%\Python27\Lib\idlelib\{username}
   • %System Root%\Users\All Users\Oracle\Java\javapath_target_313094\{username}
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\Backup\{username}.KEKW
   • %AppDataLocal%\Microsoft\Internet Explorer\EmieSiteList\{username}
   • %AppDataLocal%\pip\cache\http\b\a\9\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_34.txt.KEKW
   • %System Root%\Python27\include\floatobject.h.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\idna\{username}
   • %All Users Profile%\VMware\VMware Tools\Unity Filters\microsoftoffice2003.txt.KEKW
   • %Application Data%\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\{username}
   • %Desktop%\word2k\DOC2KE02.doc.KEKW
   • %Application Data%\Microsoft\Windows\Network Shortcuts\{username}
   • %Application Data%\Microsoft\Templates\{username}
   • %System Root%\Python27\tcl\tix8.4.3\bitmaps\plusarm.gif.KEKW
   • %All Users Profile%\Microsoft\Assistance\{username}
   • %System Root%\Python27\Lib\msilib\{username}
   • %System Root%\Python27\Lib\idlelib\help.txt.KEKW
   • %User Temp%\dd_vcredistUI0FC1.txt.KEKW
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\{username}
   • %System Root%\Python27\tcl\tk8.5\demos\{username}
   • %System Root%\Python27\tcl\tix8.4.3\pref\TK.cs.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\{username}.KEKW
   • %AppDataLocal%\Microsoft\Vault\{username}
   • %Application Data%\{username}
   • %AppDataLocal%\Microsoft\Windows\AppCache\6A582BR6\{username}
   • %System Root%\Users\All Users\Microsoft\Device Stage\Task\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\20\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\{username}.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\LastBld.dat.KEKW
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\{username}
   • %All Users Profile%\VMware\RawdskCompatibility\virtual\{username}
   • %AppDataLocal%\Google\Software Reporter Tool\settings.dat.KEKW
   • %System Root%\Python27\Lib\email\test\{username}
   • %System Root%\Python27\include\datetime.h.KEKW
   • %All Users Profile%\Microsoft\eHome\logs\{username}
   • %System Root%\Users\All Users\Oracle\Java\.oracle_jre_usage\{username}.KEKW
   • %System Root%\Python27\Lib\test\imghdrdata\python.gif.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F0\{username}.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\LocalCopy\{username}
   • %System Root%\Python27\Lib\test\cjkencodings\shift_jis.txt.KEKW
   • %System Root%\Users\Public\Recorded TV\{username}
   • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\{username}
   • %System Root%\Python27\Lib\site-packages\pkg_resources\_vendor\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\43\{username}
   • %Application Data%\Microsoft\Windows\DNTException\{username}
   • %Favorites%\Links for United States\{username}
   • %System Root%\powerpoint2k\PPT2KE03.ppt.KEKW
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Temp\usgthrsvc\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp.KEKW
   • %System Root%\Users\Public\Documents\word2k\DOC2KE05.doc.KEKW
   • %Application Data%\Microsoft\SystemCertificates\My\Keys\{username}
   • %System Root%\Users\Default\AppData\Local\Microsoft\Windows\History\{username}
   • %System Root%\Users\All Users\Microsoft\RAC\StateData\{username}
   • %Desktop%\word2k\DOC2KE04.doc.KEKW
   • %System Root%\Users\{username}\AppData\Roaming\{username}
   • %System Root%\Python27\Lib\email\test\data\{username}
   • %System Root%\Python27\include\cellobject.h.KEKW
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\{username}
   • %User Profile%\Videos\{username}
   • %User Temp%\Microsoft .NET Framework 4.5.2 Setup_20161212_135033207-MSI_netfx_Full_GDR_x64.msi.txt.KEKW
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\{username}
   • %AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\_platform_specific\{username}
   • %System Root%\Python27\Tools\pynche\html40colors.txt.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\9\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\82DF2NUK\{username}
   • %System Root%\Python27\Lib\test\sgml_input.html.KEKW
   • %AppDataLocal%\Microsoft\Feeds\{username}
   • %System Root%\Users\All Users\Microsoft\Windows NT\{username}.KEKW
   • %System Root%\Python27\include\pycapsule.h.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_24.txt.KEKW
   • %System Root%\Python27\include\pystrtod.h.KEKW
   • %AppDataLocal%\Microsoft\Internet Explorer\EmieUserList\container.dat.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Entries\{username}
   • %Application Data%\Microsoft\Windows\PrivacIE\container.dat.KEKW
   • %All Users Profile%\Microsoft\Windows NT\MSFax\Queue\{username}
   • %System Root%\Users\All Users\Microsoft\OFFICE\{username}
   • %System Root%\Python27\Lib\test\test_doctest2.txt.KEKW
   • %System Root%\Python27\include\abstract.h.KEKW
   • %System Root%\Python27\Lib\site-packages\Pillow-6.0.0.dist-info\top_level.txt.KEKW
   • %AppDataLocal%Low\Microsoft\Windows\AppCache\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\47\{username}
   • %System Root%\Users\All Users\McAfee\MCLOGS\Common\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Definition Updates\{username}
   • %System Root%\Python27\Lib\test\test_difflib_expect.html.KEKW
   • %User Profile%\Documents\excel2k\XLS2KE01.xls.KEKW
   • %User Profile%\Downloads\{username}
   • %System Root%\Python27\Lib\test\testtar.tar.KEKW
   • %Application Data%\Microsoft\Windows\IECompatUACache\container.dat.KEKW
   • %System Root%\$Recycle.Bin\{username}
   • %User Profile%\Searches\{username}
   • %System Root%\Python27\README.txt.KEKW
   • %All Users Profile%\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\DomainSuggestions\{username}
   • %User Profile%\Documents\fp_18.0.0.203_archive\18_0_r0_203\{username}
   • %System Root%\Python27\tcl\tix8.4.3\demos\bitmaps\tix.gif.KEKW
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\SentItems\{username}
   • %System Root%\Python27\Lib\test\cjkencodings\big5.txt.KEKW
   • %System Root%\Python27\Lib\lib-tk\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\chardet\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp.KEKW
   • %Desktop%\Transmag.doc.KEKW
   • %All Users Profile%\VMware\VMware Tools\Unity Filters\{username}
   • %Favorites%\Microsoft Websites\{username}
   • %System Root%\Python27\Lib\site-packages\pkg_resources\_vendor\packaging\{username}
   • %System Root%\Python27\include\longintrepr.h.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\58\{username}
   • %All Users Profile%\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_43.txt.KEKW
   • %AppDataLocal%\pip\{username}
   • %AppDataLocal%\Google\Chrome\User Data\Crashpad\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\DRM\{username}
   • %System Root%\Python27\Lib\ctypes\test\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\Crashpad\reports\{username}
   • %System Root%\Users\Public\Pictures\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\26\{username}
   • %Favorites%\Windows Live\{username}
   • %System Root%\Python27\tcl\tix8.4.3\bitmaps\warning.gif.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0\{username}.KEKW
   • %System Root%\Python27\include\pyconfig.h.KEKW
   • %System Root%\Users\All Users\McAfee\{username}
   • %Application Data%\Microsoft\Windows\PrivacIE\{username}
   • %System Root%\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.KEKW
   • %All Users Profile%\Oracle\Java\javapath\{username}
   • %System Root%\Users\All Users\Microsoft\MSDN\{username}.KEKW
   • %System Root%\Users\All Users\McAfee\WinCore\{username}
   • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Indexed Rules\25\9.1\{username}
   • %System Root%\Python27\Lib\pydoc_data\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A\{username}.KEKW
   • %System Root%\Python27\tcl\tcl8.5\msgs\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5\{username}
   • %All Users Profile%\Microsoft\Windows\DRM\Cache\{username}
   • %System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\{username}
   • %All Users Profile%\Microsoft\Network\Downloader\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\progress\{username}
   • %User Temp%\chrome_BITS_3756_19263\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\pytoml\{username}
   • %System Root%\Users\All Users\Microsoft\RAC\Outbound\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\RAC\Temp\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_16.txt.KEKW
   • %System Root%\Users\Default\AppData\Local\Microsoft\Windows\{username}
   • %Application Data%\Mozilla\{username}
   • %Application Data%\Microsoft\Windows\IECompatUACache\Low\container.dat.KEKW
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\datareporting\archived\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\DRM\{username}.KEKW
   • %System Root%\Python27\Lib\wsgiref\{username}
   • %System Root%\Users\All Users\Microsoft\Network\Downloader\{username}
   • %User Profile%\Documents\excel2k\{username}
   • %User Profile%\Documents\fp_18.0.0.203_archive\18_0_r0_203_debug\{username}
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\{username}.KEKW
   • %System Root%\Python27\Lib\ensurepip\_bundled\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp.KEKW
   • %All Users Profile%\Oracle\Java\javapath_target_313094\{username}.KEKW
   • %User Profile%\Documents\powerpoint2k\PPT2KE03.ppt.KEKW
   • %AppDataLocal%\pip\cache\http\2\3\b\7\9\{username}
   • %All Users Profile%\Microsoft\OFFICE\{username}
   • %System Root%\Python27\Lib\lib2to3\tests\data\{username}
   • %System Root%\Python27\Lib\idlelib\Icons\openfolder.gif.KEKW
   • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE01.ppt.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\54\{username}
   • %All Users Profile%\Microsoft\Windows NT\MSFax\VirtualInbox\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\62\{username}
   • %System Root%\Users\All Users\Oracle\Java\.oracle_jre_usage\{username}
   • %System Root%\Python27\include\compile.h.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0\{username}
   • %Application Data%\Microsoft\Windows\{username}
   • %System Root%\powerpoint2k\PPT2KE05.ppt.KEKW
   • %System Root%\Users\Default\AppData\Local\{username}
   • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\SSScheduler\{username}.KEKW
   • %AppDataLocal%\{username}
   • %System Root%\Users\All Users\Microsoft\DeviceSync\{username}
   • F:\{username}
   • %System Root%\Python27\Lib\idlelib\Icons\tk.gif.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\RecoveryImproved\{username}
   • %System Root%\Python27\Tools\Scripts\README.txt.KEKW
   • %AppDataLocal%\Microsoft\Internet Explorer\EmieSiteList\container.dat.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\5\{username}
   • %All Users Profile%\Microsoft\Network\{username}
   • %System Root%\Python27\Lib\test\cjkencodings\iso2022_kr.txt.KEKW
   • %Application Data%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\{username}
   • %System Root%\Python27\tcl\tk8.5\demos\images\earth.gif.KEKW
   • %System Root%\Python27\tcl\tcl8.5\tzdata\Mexico\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5\{username}.KEKW
   • %All Users Profile%\Microsoft\Windows\DRM\blackbox.bin.KEKW
   • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo100.gif.KEKW
   • %User Profile%\Documents\word2k\DOC2KE03.doc.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\{username}.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_33.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp.KEKW
   • %System Root%\Python27\include\pymath.h.KEKW
   • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE05.ppt.KEKW
   • %System Root%\Python27\include\methodobject.h.KEKW
   • %System Root%\Python27\Lib\site-packages\pkg_resources\{username}
   • %Application Data%\Mozilla\Firefox\Pending Pings\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\TRRBlacklist.txt.KEKW
   • %System Root%\Users\All Users\Oracle\Java\installcache_x64\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\SSLErrorAssistant\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_01.txt.KEKW
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Stars.jpg.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\{username}
   • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieBrowserModeList\container.dat.KEKW
   • %System Root%\Users\All Users\Microsoft\Search\Data\Temp\{username}.KEKW
   • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\SSScheduler\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\cachecontrol\{username}
   • %System Root%\Python27\Lib\bsddb\{username}
   • %All Users Profile%\Adobe\Setup\{username}
   • %User Temp%\jawshtml.html.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp.KEKW
   • %System Root%\Users\All Users\Oracle\Java\javapath\{username}
   • %AppDataLocal%\Python-Eggs\Python-Eggs\Cache\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\webencodings\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\weave\failed\{username}
   • %System Root%\Users\All Users\Microsoft\RAC\{username}
   • %System Root%\Users\All Users\VMware\VMware Tools\Unity Filters\{username}.KEKW
   • %AppDataLocal%\pip\cache\http\f\e\d\0\{username}
   • %System Root%\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg.KEKW
   • %AppDataLocal%\Microsoft\Windows\History\Low\History.IE5\container.dat.KEKW
   • %System Root%\Users\All Users\Mozilla\{username}
   • %All Users Profile%\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.KEKW
   • %Desktop%\powerpoint2k\PPT2KExx.PPT.KEKW
   • %System Root%\Python27\Lib\site-packages\setuptools\extern\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\UrlBlockManager\{username}
   • %AppDataLocal%\Mozilla\Firefox\Profiles\{username}
   • %System Root%\Python27\tcl\tcl8\8.4\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Support\{username}
   • %User Profile%\Music\{username}
   • %All Users Profile%\Microsoft\Assistance\Client\1.0\{username}
   • %Application Data%\Identities\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Stucco.gif.KEKW
   • %System Root%\{username}
   • %System Root%\Python27\include\structseq.h.KEKW
   • %System Root%\Python27\include\ucnhash.h.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\60\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_internal\req\{username}
   • %System Root%\Python27\Lib\{username}
   • %System Root%\Python27\Lib\json\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\History\CacheManager\{username}
   • %System Root%\Python27\include\bytes_methods.h.KEKW
   • %System Root%\Users\Default\Favorites\{username}
   • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp.KEKW
   • %System Root%\Python27\Lib\lib-tk\test\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\{username}
   • %System Root%\Python27\Lib\ctypes\macholib\{username}
   • %System Root%\Python27\include\errcode.h.KEKW
   • %All Users Profile%\Microsoft\Search\{username}
   • %System Root%\Python27\Lib\site-packages\{username}
   • %User Temp%\mozilla-temp-files\{username}
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp.KEKW
   • %System Root%\Python27\include\bytearrayobject.h.KEKW
   • %AppDataLocal%\Microsoft\Windows Sidebar\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Active\{username}
   • %System Root%\Users\All Users\McAfee\MCLOGS\SmallInstaller\{username}.KEKW
   • %AppDataLocal%\Microsoft\Internet Explorer\imagestore\{username}
   • %System Root%\Python27\tcl\tcl8.5\tzdata\Europe\{username}
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\VMware\VMware Tools\{username}
   • %Desktop%\word2k\DOC2KE03.doc.KEKW
   • %System Root%\Python27\tcl\tix8.4.3\pref\TkWin.cs.KEKW
   • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo75.gif.KEKW
   • %System Root%\Python27\Tools\webchecker\README.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\{username}
   • %System Root%\Python27\tcl\tcl8.5\tzdata\Chile\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\{username}
   • %AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Pine_Lumber.jpg.KEKW
   • %Application Data%\Microsoft\SystemCertificates\My\Certificates\{username}
   • %AppDataLocal%\Microsoft\Windows\History\Low\History.IE5\{username}
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\safebrowsing\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp.KEKW
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Small_News.jpg.KEKW
   • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE04.ppt.KEKW
   • %Favorites%\Links\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\{username}.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\63\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Temp\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Resource\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\{username}
   • %System Root%\Python27\include\opcode.h.KEKW
   • %All Users Profile%\Microsoft\Windows\GameExplorer\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\70\{username}
   • %AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\RJ6VBH4W.DN2\clic...exe_9ae46cec200785df_0001.0003_none_d631acba18f736d8\{username}
   • %System Root%\Python27\Lib\test\cjkencodings\hz-utf8.txt.KEKW
   • %System Root%\Python27\Lib\email\test\data\PyBanner048.gif.KEKW
   • %System Root%\Python27\Lib\idlelib\Icons\plusnode.gif.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\16\{username}
   • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\McCHSvc\{username}
   • %System Root%\Python27\Tools\i18n\{username}
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache.bin.KEKW
   • %All Users Profile%\Microsoft\Windows NT\MSFax\Inbox\{username}
   • %System Root%\Users\All Users\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\{username}.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\30\{username}
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\{username}
   • %System Root%\Python27\include\sliceobject.h.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_06.txt.KEKW
   • %System Root%\Users\All Users\McAfee\MCLOGS\{username}
   • %AppDataLocal%\Microsoft\Feeds Cache\CRAV926P\{username}
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\{username}.KEKW
   • %System Root%\Python27\include\warnings.h.KEKW
   • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\{username}
   • %System Root%\Users\All Users\Oracle\{username}
   • %System Root%\Python27\Tools\pynche\websafe.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\Updates\{username}.KEKW
   • %All Users Profile%\Microsoft\Windows\DeviceMetadataStore\{username}
   • %System Root%\Python27\include\rangeobject.h.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\WidevineCdm\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_505c7fc25c7e5866de583f14c22e2b4c2a6018c_0a2493a7\{username}.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\{username}
   • %AppDataLocal%\pip\cache\http\d\3\7\{username}
   • %All Users Profile%\Microsoft\{username}
   • %System Root%\Python27\Lib\test\imghdrdata\python.jpg.KEKW
   • %All Users Profile%\Microsoft\Windows\WER\ReportArchive\{username}
   • %System Root%\excel2k\XLS2KE01.xls.KEKW
   • %AppDataLocal%\Microsoft\Credentials\{username}
   • %All Users Profile%\Microsoft\Device Stage\Task\{{GUID}}\en-US\{username}
   • %All Users Profile%\Microsoft\Windows\Power Efficiency Diagnostics\energy-report.html.KEKW
   • %User Temp%\hsperfdata_{username}\{username}
   • %AppDataLocal%\pip\cache\http\3\{username}
   • %System Root%\Recovery\{username}
   • %AppDataLocal%\pip\cache\http\a\6\9\b\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\48\{username}
   • %All Users Profile%\Microsoft\Network\Downloader\qmgr1.dat.KEKW
   • %System Root%\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\VMware Tools\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1D\{username}
   • %System Root%\Python27\Lib\lib-tk\test\test_tkinter\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Quick\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01\{username}
   • %System Root%\Python27\tcl\tk8.5\demos\images\tcllogo.gif.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1D\{username}.KEKW
   • %All Users Profile%\Microsoft\User Account Pictures\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\{username}
   • %System Root%\Users\Public\Music\Sample Music\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp.KEKW
   • %System Root%\Python27\include\frameobject.h.KEKW
   • %AppDataLocal%\pip\cache\http\a\6\{username}
   • %System Root%\Python27\include\token.h.KEKW
   • %System Root%\Python27\include\sysmodule.h.KEKW
   • %All Users Profile%\Microsoft\OFFICE\Groove\{username}
   • %System Root%\Users\All Users\Adobe\{username}.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\pnacl\{username}
   • %System Root%\Python27\include\node.h.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3\{username}.KEKW
   • %AppDataLocal%\Google\Software Reporter Tool\reports\{username}
   • %All Users Profile%\Microsoft\MF\{username}
   • %System Root%\Users\All Users\Microsoft\eHome\logs\{username}
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Startup\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Service\{username}
   • %System Root%\Python27\Lib\lib2to3\tests\data\fixers\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\WER\{username}.KEKW
   • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\McCHSvc\{username}.KEKW
   • %Application Data%\Microsoft\Windows\Recent\AutomaticDestinations\{username}
   • %Application Data%\Microsoft\Internet Explorer\Quick Launch\{username}
   • %System Root%\Python27\Lib\email\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0\{username}
   • %System Root%\Python27\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47\{username}.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\29\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\distlib\_backport\{username}
   • %All Users Profile%\VMware\RawdskCompatibility\native\{username}
   • %System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\updates\0\{username}
   • %System Root%\Users\All Users\Microsoft\Assistance\{username}
   • %System Root%\Python27\Lib\tkinter\{username}
   • %System Root%\Python27\include\boolobject.h.KEKW
   • %System Root%\Users\Default\AppData\Roaming\Media Center Programs\{username}
   • %AppDataLocal%\Google\Chrome\User Data\SSLErrorAssistant\7\_metadata\{username}
   • %System Root%\Python27\include\pyfpe.h.KEKW
   • %AppDataLocal%\pip\cache\http\f\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp.KEKW
   • %Desktop%\excel2k\XLS2KExx.xls.KEKW
   • %AppDataLocal%\Microsoft\Windows\AppCache\6A582BR6\container.dat.KEKW
   • %System Root%\Python27\Lib\tkinter\test\{username}
   • %Application Data%\Microsoft\Document Building Blocks\{username}
   • %AppDataLocal%\Microsoft\Windows\WER\{username}
   • %All Users Profile%\Microsoft\Search\Data\Temp\usgthrsvc\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\datareporting\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Tanspecks.jpg.KEKW
   • %AppDataLocal%\pip\cache\http\a\{username}
   • %System Root%\Python27\include\pystate.h.KEKW
   • %Application Data%\Sun\{username}
   • %AppDataLocal%\Google\Chrome\User Data\InterventionPolicyDatabase\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\GameExplorer\{username}.KEKW
   • %System Root%\Python27\Tools\versioncheck\{username}
   • %System Root%\Users\All Users\Microsoft\DRM\Server\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\10\{username}
   • %System Root%\Python27\tcl\tix8.4.3\bitmaps\plus.gif.KEKW
   • %System Root%\Users\Public\Downloads\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Tablet PC\{username}
   • %System Root%\Python27\include\moduleobject.h.KEKW
   • %Desktop%\excel2k\XLS2KE05.xls.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_internal\utils\{username}
   • %System Root%\Users\All Users\McAfee\MCLOGS\Common\SmallInstaller\{username}.KEKW
   • %System Root%\Users\Default\Saved Games\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp.KEKW
   • %AppDataLocal%Low\Microsoft\Windows\{username}
   • %AppDataLocal%\pip\cache\http\a\6\9\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_505c7fc25c7e5866de583f14c22e2b4c2a6018c_0a2493a7\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\{username}.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_internal\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\43\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01\{username}.KEKW
   • %Application Data%\Microsoft\AddIns\{username}
   • %Desktop%\excel2k\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Sand_Paper.jpg.KEKW
   • %AppDataLocal%\pip\cache\http\4\e\e\3\1\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\{username}
   • %System Root%\Python27\Lib\site-packages\PIL\{username}
   • %System Root%\Python27\include\cStringIO.h.KEKW
   • %Application Data%\Microsoft\Windows\IECompatCache\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\{username}.KEKW
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp.KEKW
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp.KEKW
   • %All Users Profile%\Microsoft\Windows\DeviceMetadataStore\en-US\{username}
   • %All Users Profile%\VMware\{username}
   • %System Root%\Users\Default\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\{username}
   • %AppDataLocal%\pip\cache\http\d\3\7\e\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\log\{username}
   • %All Users Profile%\Microsoft\RAC\{username}
   • %System Root%\Users\All Users\VMware\VMware Tools\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\chardet\cli\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\55\{username}
   • %User Profile%\Documents\excel2k\XLS2KE04.xls.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\euc_kr.txt.KEKW
   • %All Users Profile%\Microsoft\Windows NT\MSFax\SentItems\{username}
   • %System Root%\Email and Password List.js.KEKW
   • %System Root%\Users\All Users\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\{username}.KEKW
   • %All Users Profile%\Microsoft\eHome\{username}
   • %System Root%\PerfLogs\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\crashes\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp.KEKW
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp.KEKW
   • %All Users Profile%\Microsoft\RAC\StateData\{username}
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Queue\{username}
   • %System Root%\Users\Public\Documents\excel2k\XLS2KE03.xls.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\{username}.KEKW
   • %System Root%\Python27\Lib\idlelib\Icons\idle_16.gif.KEKW
   • %Application Data%\Microsoft\Windows\IECompatUACache\Low\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Templates\{username}.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_14.txt.KEKW
   • %System Root%\Python27\include\timefuncs.h.KEKW
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\{username}.KEKW
   • %AppDataLocal%\Apps\2.0\Data\RNQG94OQ.QJC\{username}
   • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Indexed Rules\25\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\{username}.KEKW
   • %AppDataLocal%Low\Microsoft\Internet Explorer\Services\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Sqm\Upload\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Network\Downloader\{username}.KEKW
   • %System Root%\Python27\tcl\tk8.5\images\{username}
   • %System Root%\Python27\Lib\lib2to3\{username}
   • %System Root%\Python27\Lib\site-packages\pkg_resources\extern\{username}
   • %System Root%\Users\All Users\{username}
   • %AppDataLocal%\Microsoft\Windows\WER\ReportQueue\{username}
   • %All Users Profile%\Microsoft\Search\Data\{username}
   • %AppDataLocal%\pip\cache\http\4\e\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\{username}
   • %System Root%\Python27\Lib\ctypes\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\colorama\{username}
   • %All Users Profile%\McAfee\MCLOGS\Common\{username}
   • %System Root%\Python27\Lib\multiprocessing\dummy\{username}
   • %Application Data%\Microsoft\Windows\IETldCache\Low\{username}
   • %System Root%\Python27\include\longobject.h.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\iso2022_jp.txt.KEKW
   • %System Root%\Python27\Lib\tkinter\test\test_ttk\{username}
   • %System Root%\Users\All Users\Oracle\Java\installcache_x64\{username}.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\euc_jisx0213-utf8.txt.KEKW
   • %AppDataLocal%\pip\cache\http\2\3\b\7\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_36.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\OFFICE\Groove\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\History\Service\{username}
   • %System Root%\Users\All Users\Microsoft\NetFramework\BreadcrumbStore\{username}.KEKW
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\{username}
   • %System Root%\Python27\include\classobject.h.KEKW
   • %System Root%\Users\Public\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp.KEKW
   • %System Root%\excel2k\XLS2KE03.xls.KEKW
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\{username}
   • %AppDataLocal%\pip\cache\http\4\e\e\{username}
   • %System Root%\Users\Default\Documents\{username}
   • %Application Data%\Microsoft\Word\{username}
   • %All Users Profile%\McAfee\MCLOGS\PartnerCustom\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\31\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_37.txt.KEKW
   • %System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\entry_points.txt.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\SwReporter\40.200.201.3\_metadata\{username}
   • %Application Data%\Microsoft\Windows\IECompatCache\Low\container.dat.KEKW
   • %Application Data%\Microsoft\Windows\SendTo\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\2LHHLFH6\{username}
   • %System Root%\Python27\tcl\tcl8.5\tzdata\Asia\{username}
   • %System Root%\Users\All Users\Microsoft\IlsCache\{username}.KEKW
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\{username}
   • %System Root%\Python27\Lib\logging\{username}
   • %AppDataLocal%\Apps\{username}
   • %All Users Profile%\{username}
   • %AppDataLocal%\Google\Chrome\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Config\{username}
   • %System Root%\excel2k\XLS2KExx.xls.KEKW
   • %System Root%\Users\Public\Desktop\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\_platform_specific\all\{username}
   • %System Root%\Users\All Users\Adobe\ARM\Reader_19.010.20099\{username}.KEKW
   • %AppDataLocal%\Microsoft\Windows\1024\{username}
   • %Application Data%\Microsoft\Office\Recent\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_12a.txt.KEKW
   • %System Root%\Users\Public\Documents\word2k\DOC2KExx.doc.KEKW
   • %AppDataLocal%\Google\{username}
   • %AppDataLocal%\pip\cache\http\3\8\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5\{username}
   • %System Root%\Python27\tcl\tcl8.5\opt0.4\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\{username}.KEKW
   • %System Root%\Python27\Tools\pynche\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\2\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Templates\{username}
   • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo150.gif.KEKW
   • %System Root%\Users\Default\AppData\Local\Microsoft\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\25\{username}
   • %System Root%\Users\All Users\Microsoft\RAC\Outbound\{username}
   • %System Root%\Python27\tcl\tcl8.5\tzdata\Atlantic\{username}
   • %All Users Profile%\VMware\VMware Tools\Unity Filters\adobeflashcs3.txt.KEKW
   • %AppDataLocal%\Microsoft\Media Player\Sync Playlists\{username}
   • %All Users Profile%\McAfee\MCLOGS\PartnerCustom\550F8967-2EE2-4F33-8E16-1BFFBE114803\{username}
   • %All Users Profile%\VMware\VMware Tools\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\Tiles\{username}
   • F:\wlines.zip.KEKW
   • %AppDataLocal%\Microsoft\Feeds\Microsoft Feeds~\{username}
   • %System Root%\Users\All Users\McAfee\MCLOGS\SmallInstaller\{username}
   • %System Root%\Python27\include\unicodeobject.h.KEKW
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\{username}.KEKW
   • %AppDataLocal%\Microsoft\Feeds Cache\NWKETFVL\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\CacheManager\{username}
   • %System Root%\Users\Public\Documents\word2k\DOC2KE04.doc.KEKW
   • %System Root%\Users\All Users\Microsoft\DRM\{username}.KEKW
   • %User Profile%\Documents\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F0\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\extensions\{username}
   • %System Root%\Python27\Lib\test\subprocessdata\{username}
   • %System Root%\Python27\Lib\test\audiodata\pluck-pcm32.wav.KEKW
   • %System Root%\Python27\include\codecs.h.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_31.txt.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\SwReporter\40.200.201.3\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\brndlog.txt.KEKW
   • %Application Data%\Mozilla\Firefox\{username}
   • %System Root%\powerpoint2k\PPT2KE04.ppt.KEKW
   • %AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\RJ6VBH4W.DN2\goog...app_9ae46cec200785df_0001.0003_7581c0cd83ac8659\{username}
   • %System Root%\Users\All Users\Microsoft\OFFICE\Groove\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp.KEKW
   • %System Root%\Python27\tcl\tix8.4.3\pref\Bisque.cs.KEKW
   • %Desktop%\powerpoint2k\PPT2KE05.ppt.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\{username}
   • %System Root%\powerpoint2k\PPT2KE02.ppt.KEKW
   • %System Root%\Python27\Lib\idlelib\Icons\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43\{username}
   • %AppDataLocal%\Microsoft\Windows\1033\StructuredQuerySchema.bin.KEKW
   • %Application Data%\Microsoft\Excel\{username}
   • %Application Data%\Microsoft\Spelling\{username}
   • %User Profile%\Documents\powerpoint2k\PPT2KE02.ppt.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\iso2022_kr-utf8.txt.KEKW
   • %All Users Profile%\Mozilla\{username}
   • %Application Data%\Sun\Java\Deployment\{username}
   • %AppDataLocal%\Microsoft\Feeds Cache\COOE7IBP\{username}
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\{username}
   • %AppDataLocal%\Microsoft\Windows\1033\{username}
   • %All Users Profile%\Microsoft\Windows NT\MSScan\{username}
   • %System Root%\Users\Public\Recorded TV\Sample Media\{username}
   • %All Users Profile%\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_72da1383309c93bd2441accd728cf953e4fa97a_0a24a840\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\2PEMJMIY\{username}
   • %System Root%\Python27\Lib\idlelib\Icons\idle_48.gif.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\{username}
   • %AppDataLocal%Low\Microsoft\Windows\AppCache\LY14JQYG\{username}
   • %System Root%\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\{username}
   • %System Root%\Users\All Users\Adobe\ARM\S\{username}.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_23.txt.KEKW
   • %AppDataLocal%\Microsoft\Office\ONetConfig\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\packaging\{username}
   • %System Root%\Users\All Users\Microsoft\RAC\Temp\{username}.KEKW
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\DATA\{username}
   • %AppDataLocal%\Microsoft\Feeds Cache\NKNYYDHU\{username}
   • %User Temp%\dd_vcredistUI0FD5.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\AIT\{username}.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\{username}
   • %System Root%\Users\All Users\Microsoft\NetFramework\{username}
   • %Application Data%\Microsoft\MMC\{username}
   • %User Profile%\Saved Games\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_32.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Media Player\{username}.KEKW
   • %AppDataLocal%Low\Microsoft\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\{username}.KEKW
   • %System Root%\Python27\Lib\email\mime\{username}
   • %System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\{username}.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\{username}
   • %Desktop%\Email and Password List.txt.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\gb2312.txt.KEKW
   • %System Root%\Python27\include\funcobject.h.KEKW
   • %AppDataLocal%\Microsoft\Internet Explorer\frameiconcache.dat.KEKW
   • %System Root%\Python27\Lib\sqlite3\test\{username}
   • %System Root%\Users\All Users\Oracle\Java\javapath\{username}.KEKW
   • %AppDataLocal%\Microsoft\Internet Explorer\{username}
   • %System Root%\Python27\Tools\pynche\X\rgb.txt.KEKW
   • %AppDataLocal%\Microsoft\Windows\WER\ReportArchive\{username}
   • %System Root%\Users\All Users\Adobe\ARM\S\{username}
   • %Application Data%\Mozilla\Firefox\Crash Reports\events\{username}
   • %All Users Profile%\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3\{username}
   • %All Users Profile%\Microsoft\Windows\Ringtones\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\tmp\si\{username}
   • %System Root%\Python27\Lib\bsddb\test\{username}
   • %AppDataLocal%\Mozilla\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\35\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Cave_Drawings.gif.KEKW
   • %AppDataLocal%\pip\cache\http\5\{username}
   • %All Users Profile%\McAfee\MCLOGS\Common\SmallInstaller\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Ringtones\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Resource\{username}
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0\{username}
   • %System Root%\Python27\Lib\test\imghdrdata\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Bears.jpg.KEKW
   • %System Root%\Python27\Lib\test\audiodata\pluck-pcm24.wav.KEKW
   • %System Root%\Python27\Lib\idlelib\Icons\python.gif.KEKW
   • %System Root%\Python27\tcl\tix8.4.3\bitmaps\file.gif.KEKW
   • %System Root%\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.KEKW
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\gmp\WINNT_x86_64-msvc\{username}
   • %System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\top_level.txt.KEKW
   • %Application Data%\Media Center Programs\{username}
   • %Application Data%\Microsoft\Protect\S-1-5-21-2407829820-1079796033-203259571-500\{username}
   • %AppDataLocal%\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\{username}
   • %Desktop%\word2k\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0\{username}.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\pnacl\0.57.44.2492\_metadata\{username}
   • %System Root%\$Recycle.Bin\S-1-5-21-2407829820-1079796033-203259571-500\$IC8HJH8.zip.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\49\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\DeviceMetadataStore\{username}.KEKW
   • %System Root%\Users\Default\Pictures\{username}
   • %Application Data%\Macromedia\Flash Player\#SharedObjects\{username}
   • %System Root%\Python27\include\pyport.h.KEKW
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\prefs.js.KEKW
   • %System Root%\Users\All Users\Microsoft\eHome\{username}.KEKW
   • %System Root%\Python27\tcl\tk8.5\demos\images\earthris.gif.KEKW
   • %AppDataLocal%\pip\cache\http\b\a\9\3\{username}
   • %System Root%\Python27\Lib\lib2to3\pgen2\{username}
   • %System Root%\powerpoint2k\PPT2KE01.ppt.KEKW
   • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE03.ppt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Python 2.7\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\{username}
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\ActivityLog\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\{username}
   • %User Profile%\Documents\excel2k\XLS2KE03.xls.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\{username}.KEKW
   • %AppDataLocal%\pip\cache\http\0\2\5\2\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Java\{username}.KEKW
   • %System Root%\Python27\include\asdl.h.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\{username}.KEKW
   • %Desktop%\excel2k\XLS2KE04.xls.KEKW
   • %System Root%\Users\Public\Documents\{username}
   • %AppDataLocal%\Microsoft\Windows\WebCache\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Java\{username}
   • %System Root%\Users\All Users\Mozilla\{username}.KEKW
   • %All Users Profile%\Microsoft\Vault\{username}
   • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieSiteList\container.dat.KEKW
   • %User Profile%\Documents\excel2k\XLS2KE05.xls.KEKW
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\{username}.KEKW
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Blue_Gradient.jpg.KEKW
   • %System Root%\Python27\Lib\distutils\{username}
   • %User Temp%\dd_wcf_CA_smci_20161212_135109_353.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Python 2.7\{username}.KEKW
   • %Desktop%\note.txt.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\13\{username}
   • %AppDataLocal%\Google\Chrome\User Data\pnacl\0.57.44.2492\_platform_specific\{username}
   • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\{username}
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\{username}
   • %All Users Profile%\Microsoft\OFFICE\DATA\{username}
   • %Desktop%\Email and Password List.js.KEKW
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\gmp\{username}
   • %All Users Profile%\Microsoft\Windows NT\MSFax\Common Coverpages\{username}
   • %All Users Profile%\Microsoft Help\{username}
   • %AppDataLocal%\pip\cache\http\7\e\9\{username}
   • %System Root%\Python27\include\pygetopt.h.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\44\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Quick\{username}.KEKW
   • %System Root%\Python27\Lib\site-packages\Pillow-6.0.0.dist-info\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_17.txt.KEKW
   • %System Root%\Python27\Lib\test\leakers\README.txt.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_38.txt.KEKW
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\White_Chocolate.jpg.KEKW
   • %Application Data%\Microsoft\Excel\XLSTART\{username}
   • %AppDataLocal%\pip\cache\{username}
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\{username}.KEKW
   • %Application Data%\Microsoft\SystemCertificates\My\{username}
   • %System Root%\Python27\include\pythread.h.KEKW
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\DRM\Cache\{username}.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_21.txt.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\36\{username}
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp.KEKW
   • %AppDataLocal%\Microsoft\Office\Groove\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Peacock.jpg.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Indexed Rules\{username}
   • %System Root%\Users\{username}\AppData\Roaming\Microsoft\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_72da1383309c93bd2441accd728cf953e4fa97a_0a24a840\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Quarantine\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\32\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\{username}.KEKW
   • %System Root%\Users\Public\Documents\excel2k\XLS2KE04.xls.KEKW
   • %System Root%\Python27\tcl\tcl8.5\tzdata\Pacific\{username}
   • %System Root%\Users\Default\Music\{username}
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\DATA\{username}.KEKW
   • %AppDataLocal%\Microsoft\Windows\Explorer\{username}
   • %System Root%\Python27\Lib\test\test_doctest4.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Caches\{username}.KEKW
   • %System Root%\Python27\tcl\tix8.4.3\pref\SGIGray.cs.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\{username}
   • %System Root%\Python27\include\code.h.KEKW
   • %System Root%\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\{username}.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95\{username}
   • %System Root%\Python27\tcl\tix8.4.3\bitmaps\textfile.gif.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\PepperFlash\32.0.0.171\_metadata\{username}
   • %System Root%\Python27\include\enumobject.h.KEKW
   • %System Root%\Users\Default\Downloads\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Sqm\Sessions\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Sqm\Manifest\{username}
   • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\550F8967-2EE2-4F33-8E16-1BFFBE114803\{username}.KEKW
   • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\{username}
   • %System Root%\Python27\Lib\idlelib\HISTORY.txt.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\johab.txt.KEKW
   • %System Root%\Python27\include\py_curses.h.KEKW
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\thumbnails\{username}
   • %System Root%\Python27\Lib\compiler\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\1D\{username}
   • %System Root%\Python27\tcl\tk8.5\demos\images\{username}
   • %System Root%\Python27\include\pgen.h.KEKW
   • %System Root%\Python27\Lib\test\crashers\{username}
   • %AppDataLocal%\Python-Eggs\Python-Eggs\{username}
   • %System Root%\Python27\include\pydebug.h.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\PepperFlash\32.0.0.171\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_internal\vcs\{username}
   • %Application Data%\Microsoft\Windows\PrivacIE\Low\{username}
   • %User Temp%\CR_E83EE.tmp\{username}
   • %System Root%\Python27\include\patchlevel.h.KEKW
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\{username}
   • %System Root%\Users\Public\Music\Sample Music\Sleep Away.mp3.KEKW
   • %System Root%\Python27\Lib\encodings\{username}
   • %System Root%\Python27\Lib\site-packages\setuptools\_vendor\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_26.txt.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\53\{username}
   • %User Profile%\{username}
   • %System Root%\Users\All Users\Microsoft\eHome\logs\{username}.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\28\{username}
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\{username}
   • %AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\_platform_specific\all\sths\{username}
   • %System Root%\Python27\Tools\pynche\X\{username}
   • %System Root%\Users\All Users\Microsoft\WwanSvc\{username}
   • %System Root%\Users\All Users\Microsoft\Network\{username}
   • %AppDataLocal%Low\Sun\{username}
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\{username}
   • %System Root%\Python27\Tools\pynche\X\xlicense.txt.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Definition Updates\{0E1465B0-BA9C-409F-BC32-D934317129CD}\{username}
   • %System Root%\Python27\tcl\tix8.4.3\demos\samples\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp.KEKW
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp.KEKW
   • %System Root%\Python27\include\pystrcmp.h.KEKW
   • %System Root%\Python27\tcl\tcl8.5\tzdata\Brazil\{username}
   • %System Root%\Users\Public\Videos\Sample Videos\{username}
   • %AppDataLocal%\Google\Chrome\User Data\MEIPreload\{username}
   • %AppDataLocal%\Microsoft\Windows\AppCache\container.dat.KEKW
   • %System Root%\Python27\Lib\site-packages\README.txt.KEKW
   • %System Root%\Python27\include\bytesobject.h.KEKW
   • %AppDataLocal%\Microsoft\Windows\AppCache\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\24\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\{username}
   • %System Root%\Python27\tcl\tcl8.5\tzdata\America\{username}
   • %System Root%\Users\{username}\AppData\Local\Microsoft\Media Player\{username}
   • %All Users Profile%\Mozilla\updates\308046B0AF4A39CB\{username}
   • %System Root%\Python27\tcl\tcl8.5\tzdata\America\North_Dakota\{username}
   • %AppDataLocal%\Apps\2.0\Data\RNQG94OQ.QJC\E1WGPJBQ.PMC\goog...app_9ae46cec200785df_0001.0003_7581c0cd83ac8659\Data\{username}
   • %System Root%\Users\All Users\Microsoft\RAC\StateData\RacMetaData.dat.KEKW
   • %System Root%\Users\Public\Pictures\Sample Pictures\Penguins.jpg.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\{username}
   • %Application Data%\Microsoft\Word\STARTUP\{username}
   • %System Root%\Python27\Lib\test\test_doctest3.txt.KEKW
   • %System Root%\Python27\Lib\site-packages\pythonnet-2.1.0.dist-info\top_level.txt.KEKW
   • %System Root%\Users\{username}
   • %System Root%\Users\Public\Documents\excel2k\XLS2KE02.xls.KEKW
   • %System Root%\Users\All Users\Microsoft\Device Stage\{username}.KEKW
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp.KEKW
   • %AppDataLocal%\Microsoft\Feeds Cache\8TQ1M9OZ\{username}
   • %Application Data%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\{username}
   • %Desktop%\excel2k\XLS2KE03.xls.KEKW
   • %Application Data%\Microsoft\Windows\DNTException\container.dat.KEKW
   • %System Root%\Python27\include\pyctype.h.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\gb18030.txt.KEKW
   • %System Root%\Python27\Lib\xml\sax\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Monet.jpg.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_44.txt.KEKW
   • %Application Data%\Mozilla\Extensions\{username}
   • %AppDataLocal%\pip\cache\http\5\4\3\d\{username}
   • %System Root%\Users\All Users\Microsoft\Vault\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_29.txt.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_45.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\RAC\StateData\RacWmiEventData.dat.KEKW
   • %System Root%\Python27\Lib\distutils\tests\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\EmieUserList\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\pkg_resources\{username}
   • %System Root%\Python27\Lib\test\audiodata\pluck-pcm16.wav.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\{username}.KEKW
   • %AppDataLocal%\pip\cache\http\3\8\9\{username}
   • %User Profile%\AppData\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_13.txt.KEKW
3. En la lista desplegable Buscar en, seleccione Mi PC y pulse Intro.
4. Una vez haya encontrado el archivo, selecciónelo y, a continuación, pulse MAYÚS+SUPR para eliminarlo definitivamente.
5. Repita los pasos 2 a 4 con el resto de archivos:
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\{username}
   • %All Users Profile%\Microsoft\Search\Data\Applications\{username}
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\{username}
   • %Start Menu%\Programs\Administrative Tools\{username}
   • %AppDataLocal%Low\Mozilla\{username}
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Java\{username}
   • %AppDataLocal%\pip\cache\http\a\1\9\5\{username}
   • %System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\updates\0\{username}.KEKW
   • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo175.gif.KEKW
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pings\{username}
   • %System Root%\Python27\include\pgenheaders.h.KEKW
   • %User Temp%\dd_vcredistMSI0FD5.txt.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\50\{username}
   • %System Root%\Python27\Lib\hotshot\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47\{username}
   • %System Root%\powerpoint2k\PPT2KExx.PPT.KEKW
   • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieUserList\container.dat.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_07.txt.KEKW
   • %System Root%\Python27\include\Python-ast.h.KEKW
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\virtual\{username}.KEKW
   • %System Root%\Python27\Lib\idlelib\Icons\minusnode.gif.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\treeadapters\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp.KEKW
   • %System Root%\Users\{username}\AppData\Roaming\Microsoft\Windows\Libraries\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\{username}
   • %Desktop%\word2k\DOC2KE01.doc.KEKW
   • %AppDataLocal%\pip\cache\http\7\e\9\8\0\{username}
   • %System Root%\Users\Default\AppData\Roaming\{username}
   • %System Root%\Python27\include\ast.h.KEKW
   • %System Root%\Python27\Lib\idlelib\extend.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Device Stage\Task\{{GUID}}\{username}.KEKW
   • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\Un_A\{username}.KEKW
   • %System Root%\word2k\DOC2KE02.doc.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Store\{username}.KEKW
   • %System Root%\Python27\NEWS.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Assistance\Client\{username}
   • %System Root%\Python27\Lib\test\zipdir.zip.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\johab-utf8.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1D\{username}
   • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo200.gif.KEKW
   • %AppDataLocal%\Microsoft\Internet Explorer\VersionManager\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1D\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\util\{username}
   • %System Root%\Users\All Users\Microsoft\Assistance\Client\{username}.KEKW
   • %User Temp%\Low\{username}
   • F:\data\photos\{username}
   • %System Root%\Users\Public\Pictures\Sample Pictures\{username}
   • %System Root%\Users\All Users\McAfee\MCLOGS\Common\{username}.KEKW
   • %Start Menu%\{username}
   • %Application Data%\Microsoft\UProof\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\{username}.KEKW
   • %AppDataLocal%\pip\cache\http\a\6\9\b\d\{username}
   • %System Root%\excel2k\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Pretty_Peacock.jpg.KEKW
   • %System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\dependency_links.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\{username}
   • %System Root%\Python27\Lib\idlelib\Icons\idle_32.gif.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_35.txt.KEKW
   • %AppDataLocal%\pip\cache\http\7\e\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\{username}
   • %All Users Profile%\Microsoft\Assistance\Client\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\F0\{username}
   • %AppDataLocal%\Microsoft\Feeds Cache\container.dat.KEKW
   • %System Root%\Users\All Users\Mozilla\updates\{username}.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\treewalkers\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\22\{username}
   • %System Root%\Users\{username}\Music\{username}
   • %System Root%\Users\Public\Music\Sample Music\Kalimba.mp3.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Definition Updates\Updates\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A\{username}
   • %System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\top_level.txt.KEKW
   • %System Root%\Python27\tcl\reg1.2\{username}
   • %System Root%\Python27\include\pymem.h.KEKW
   • %System Root%\Users\All Users\Microsoft\IdentityCRL\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\{username}.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\shift_jisx0213.txt.KEKW
   • %AppDataLocal%\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_internal\commands\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp.KEKW
   • %System Root%\word2k\DOC2KE05.doc.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\{username}.KEKW
   • %System Root%\PerfLogs\Admin\{username}
   • %System Root%\Python27\tcl\tcl8\8.5\{username}
   • %AppDataLocal%\pip\cache\http\d\3\7\e\0\{username}
   • %System Root%\Python27\Lib\test\cjkencodings\cp949-utf8.txt.KEKW
   • %System Root%\Python27\tcl\tcl8.5\tzdata\Etc\{username}
   • %System Root%\Python27\Lib\test\cjkencodings\gb2312-utf8.txt.KEKW
   • %System Root%\Python27\tcl\tix8.4.3\bitmaps\minusarm.gif.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\muffin\{username}
   • %System Root%\Python27\Lib\test\capath\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\CacheManager\{username}.KEKW
   • %System Root%\Python27\Tools\pynche\webcolors.txt.KEKW
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\SoftBlue.jpg.KEKW
   • %AppDataLocal%\pip\cache\http\d\3\{username}
   • %AppDataLocal%\pip\cache\http\2\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\39\{username}
   • %All Users Profile%\Microsoft\Windows\Sqm\Upload\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\18\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_22.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\{username}
   • %System Root%\Users\All Users\Microsoft\RAC\PublishedData\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp.KEKW
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\datareporting\archived\2019-05\{username}
   • %System Root%\Users\Default\Videos\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\{username}.KEKW
   • %Application Data%\Microsoft\SystemCertificates\My\CRLs\{username}
   • %System Root%\Python27\tcl\tcl8\8.4\platform\{username}
   • %System Root%\Python27\include\descrobject.h.KEKW
   • %System Root%\Python27\include\dictobject.h.KEKW
   • %System Root%\Python27\Lib\test\imghdrdata\python.bmp.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\OriginTrials\{username}
   • %System Root%\Users\Default\AppData\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\requests\{username}
   • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.1\{username}
   • %System Root%\Users\Public\Documents\excel2k\XLS2KExx.xls.KEKW
   • %System Root%\Python27\tcl\tk8.5\images\logo100.gif.KEKW
   • %System Root%\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\7\{username}
   • %AppDataLocal%Low\{username}
   • %System Root%\Python27\tcl\tcl8.5\tzdata\Australia\{username}
   • %System Root%\Users\All Users\Microsoft\MF\{username}
   • %System Root%\Python27\Lib\test\cjkencodings\gb18030-utf8.txt.KEKW
   • %Application Data%\Macromedia\Flash Player\macromedia.com\support\flashplayer\{username}
   • %System Root%\Python27\tcl\tcl8.5\http1.0\{username}
   • %Desktop%\powerpoint2k\PPT2KE02.ppt.KEKW
   • %System Root%\Users\All Users\Microsoft\IlsCache\{username}
   • %System Root%\Python27\include\modsupport.h.KEKW
   • %Desktop%\excel2k\XLS2KE01.xls.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_11.txt.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_46.txt.KEKW
   • %System Root%\Users\All Users\Microsoft Help\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\Tiles\pin9728060290\{username}
   • %All Users Profile%\Oracle\Java\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\52\{username}
   • %Favorites%\MSN Websites\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\{username}.KEKW
   • %AppDataLocal%Low\Microsoft\Windows\AppCache\LY14JQYG\container.dat.KEKW
   • %User Profile%\Documents\Email and Password List.txt.KEKW
   • %User Temp%\WPDNSE\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\Backup\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_05.txt.KEKW
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\2918063365piupsah.files\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\{username}
   • %System Root%\Python27\tcl\tix8.4.3\bitmaps\folder.gif.KEKW
   • %AppDataLocal%\pip\cache\http\a\1\{username}
   • %AppDataLocal%\Google\Chrome\User Data\SwReporter\{username}
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-child.bin.KEKW
   • %All Users Profile%\McAfee\WinCore\{username}
   • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.1\_metadata\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg.KEKW
   • %AppDataLocal%\Deployment\{username}
   • %AppDataLocal%\Apps\2.0\Data\RNQG94OQ.QJC\E1WGPJBQ.PMC\goog...app_9ae46cec200785df_0001.0003_7581c0cd83ac8659\{username}
   • %System Root%\Python27\tcl\tix8.4.3\demos\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\{username}
   • %System Root%\Python27\Lib\test\cjkencodings\euc_kr-utf8.txt.KEKW
   • %System Root%\Python27\Lib\idlelib\NEWS.txt.KEKW
   • %Application Data%\Macromedia\Flash Player\{username}
   • %Application Data%\Microsoft\Credentials\{username}
   • %All Users Profile%\VMware\RawdskCompatibility\native\C\{username}
   • %System Root%\Python27\Lib\site-packages\pip\{username}
   • %AppDataLocal%\Google\Chrome\User Data\FileTypePolicies\34\_metadata\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\{username}
   • %AppDataLocal%\Google\Chrome\User Data\BrowserMetrics\{username}
   • %Application Data%\Macromedia\Flash Player\macromedia.com\{username}
   • %Application Data%\Mozilla\SystemExtensionsDev\{username}
   • %User Profile%\Documents\word2k\{username}
   • %System Root%\Python27\Lib\test\audiodata\pluck-pcm8.wav.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp.KEKW
   • %AppDataLocal%\pip\cache\http\0\2\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\mpcache-B1C01FED9F08520A4647901EFB883A6A3B247F8D.bin.KEKW
   • %AppDataLocal%\Apps\2.0\Data\RNQG94OQ.QJC\E1WGPJBQ.PMC\{username}
   • %AppDataLocal%\Microsoft\Windows\History\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\DeviceMetadataStore\en-US\{username}
   • %System Root%\Python27\Lib\test\floating_points.txt.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\37\{username}
   • %System Root%\Python27\Lib\lib2to3\fixes\{username}
   • %System Root%\Users\All Users\Microsoft\RAC\StateData\RacWmiDataBookmarks.dat.KEKW
   • %User Profile%\Documents\word2k\DOC2KE02.doc.KEKW
   • %AppDataLocal%\pip\cache\http\7\{username}
   • %System Root%\Users\Public\Pictures\Sample Pictures\Desert.jpg.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70\{username}
   • %All Users Profile%\Microsoft\Windows\WER\ReportQueue\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\{username}.KEKW
   • %System Root%\Users\{username}\Pictures\{username}
   • %System Root%\Python27\tcl\tix8.4.3\demos\bitmaps\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\host\{username}
   • %AppDataLocal%\pip\cache\http\b\a\9\3\5\{username}
   • %System Root%\Python27\Lib\test\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\8\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\{username}.KEKW
   • %Application Data%\Microsoft\Internet Explorer\{username}
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\VMware\{username}
   • %AppDataLocal%\Microsoft\Feeds Cache\M7X9O6Z1\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Caches\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\IECompatData\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\19\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_internal\models\{username}
   • %System Root%\Python27\tcl\tix8.4.3\bitmaps\minus.gif.KEKW
   • %AppDataLocal%\pip\cache\http\f\e\d\0\e\{username}
   • %System Root%\Python27\Lib\test\math_testcases.txt.KEKW
   • %System Root%\Users\Public\Libraries\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\42\{username}
   • %Application Data%\Microsoft\Office\Recent\index.dat.KEKW
   • %System Root%\Python27\include\traceback.h.KEKW
   • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\History\CacheManager\MpSfc.bin.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Support\{username}.KEKW
   • %AppDataLocal%\pip\cache\http\5\4\{username}
   • %All Users Profile%\Microsoft\Device Stage\Task\{{GUID}}\{username}
   • %All Users Profile%\VMware\RawdskCompatibility\{username}
   • %System Root%\Python27\Lib\distutils\command\{username}
   • %System Root%\Users\All Users\Microsoft\Device Stage\Task\{username}.KEKW
   • %AppDataLocal%\Microsoft\Windows\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp.KEKW
   • %Application Data%\Microsoft\Windows\Templates\{username}
   • %AppDataLocal%\Python-Eggs\Python-Eggs\Cache\pillow-4.1.0-py2.7-win32.egg-tmp\{username}
   • %System Root%\Users\Public\Documents\powerpoint2k\{username}
   • %AppDataLocal%\Microsoft\Feeds Cache\NNO7APUS\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\tabiconcache.dat.KEKW
   • %System Root%\Users\Public\Pictures\Sample Pictures\Koala.jpg.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95\{username}
   • %System Root%\Python27\Lib\test\leakers\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\33\{username}
   • %User Temp%\dd_NDP452-KB2901907-x86-x64-AllOS-ENU_decompression_log.txt.KEKW
   • %System Root%\Users\All Users\Oracle\Java\javapath_target_313094\{username}.KEKW
   • %AppDataLocal%\pip\cache\http\7\e\9\8\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\{username}.KEKW
   • %System Root%\Python27\Lib\multiprocessing\{username}
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\SentItems\{username}.KEKW
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Psychedelic.jpg.KEKW
   • %AppDataLocal%\pip\cache\http\4\{username}
   • %User Profile%\Contacts\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Device Stage\Task\{{GUID}}\en-US\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Entries\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Inbox\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\msgpack\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\34\{username}
   • %AppDataLocal%\Microsoft\Office\Groove\User\{username}
   • %All Users Profile%\Microsoft\Network\Downloader\qmgr0.dat.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\pnacl\0.57.44.2492\_platform_specific\x86_64\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\70\{username}.KEKW
   • %System Root%\Python27\Lib\idlelib\idle_test\README.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\AIT\{username}
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Sqm\Upload\{username}
   • %All Users Profile%\VMware\VMware Tools\Unity Filters\vmwarefilters.txt.KEKW
   • %System Root%\Users\All Users\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\eHome\{username}
   • %System Root%\Python27\Lib\test\cjkencodings\cp949.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\{username}.KEKW
   • %System Root%\Python27\include\iterobject.h.KEKW
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\cache2\entries\{username}
   • %AppDataLocal%\Google\Chrome\User Data\InterventionPolicyDatabase\2018.9.6.0\{username}
   • %All Users Profile%\Microsoft\OFFICE\DATA\opa12.dat.KEKW
   • %System Root%\Users\Default\Links\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp.KEKW
   • %All Users Profile%\McAfee\MCLOGS\PartnerCustom\SSScheduler\{username}
   • %System Root%\Python27\tcl\tix8.4.3\bitmaps\{username}
   • %System Root%\Python27\include\import.h.KEKW
   • %AppDataLocal%\pip\cache\http\0\2\5\{username}
   • %System Root%\Users\Default\AppData\Local\Temp\{username}
   • %All Users Profile%\VMware\VMware Tools\manifest.txt.KEKW
   • %All Users Profile%\Mozilla\updates\308046B0AF4A39CB\updates\{username}
   • %AppDataLocal%\Microsoft\Windows\Burn\{username}
   • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KExx.PPT.KEKW
   • %AppDataLocal%\Microsoft\Internet Explorer\UrlBlockManager\urlblocklist.bin.KEKW
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts\{username}
   • %AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\{username}
   • %System Root%\Users\Public\Documents\excel2k\XLS2KE01.xls.KEKW
   • %AppDataLocal%\Microsoft\Internet Explorer\imagestore\1s32qbz\{username}
   • %User Profile%\Documents\word2k\DOC2KE01.doc.KEKW
   • %System Root%\Users\All Users\VMware\VMware Tools\Unity Filters\{username}
   • %System Root%\Users\All Users\VMware\{username}.KEKW
   • %System Root%\Users\Public\Music\{username}
   • %System Root%\Users\All Users\Microsoft\OFFICE\DATA\{username}
   • %System Root%\Python27\Lib\test\cjkencodings\euc_jp-utf8.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\DRM\Cache\{username}
   • %All Users Profile%\Microsoft\NetFramework\BreadcrumbStore\{username}
   • %User Profile%\Documents\excel2k\XLS2KE02.xls.KEKW
   • %System Root%\Python27\Lib\site-packages\pythonnet-2.1.0.dist-info\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\{username}.KEKW
   • %User Profile%\Documents\powerpoint2k\PPT2KE05.ppt.KEKW
   • %System Root%\Users\All Users\Microsoft\DRM\Server\{username}.KEKW
   • %System Root%\Users\{username}\AppData\Roaming\Microsoft\Windows\{username}
   • %System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\LICENSE.txt.KEKW
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\datareporting\archived\2019-04\{username}
   • %System Root%\Users\All Users\Microsoft\Media Player\{username}
   • %System Root%\Users\All Users\Microsoft\OFFICE\{username}.KEKW
   • %Application Data%\Microsoft\Windows\DNTException\Low\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\{username}
   • %System Root%\Python27\tcl\tcl8.5\tzdata\Arctic\{username}
   • %System Root%\Python27\include\fileobject.h.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Scans\History\Results\Resource\{username}
   • %AppDataLocal%\Microsoft\Feeds\Feeds for United States~\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp.KEKW
   • %AppDataLocal%\pip\cache\http\5\4\3\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp.KEKW
   • %System Root%\Python27\tcl\tcl8.5\tzdata\Canada\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\3UYAQU1F\{username}
   • %AppDataLocal%\Microsoft\Windows\Ringtones\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Connectivity.gif.KEKW
   • %User Temp%\Microsoft .NET Framework 4.5.2 Setup_20161212_135033207.html.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\56\{username}
   • %User Profile%\Documents\powerpoint2k\PPT2KE04.ppt.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\hz.txt.KEKW
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\cache2\doomed\{username}
   • %System Root%\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\{username}
   • %System Root%\Users\All Users\Microsoft\Device Stage\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\WER\{username}
   • %System Root%\Python27\include\eval.h.KEKW
   • %All Users Profile%\Microsoft\Device Stage\Task\{username}
   • %System Root%\Python27\include\intobject.h.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp.KEKW
   • %System Root%\word2k\DOC2KE03.doc.KEKW
   • %System Root%\$Recycle.Bin\S-1-5-21-2407829820-1079796033-203259571-500\{username}
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Maintenance\{username}
   • %AppDataLocal%\Google\Chrome\User Data\ShaderCache\GPUCache\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3\{username}
   • %All Users Profile%\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\{username}
   • %System Root%\excel2k\XLS2KE02.xls.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\VMware Tools\{username}.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\shift_jis-utf8.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Assistance\{username}.KEKW
   • %Application Data%\Microsoft\Vault\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_19.txt.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Scans\History\Results\Quick\{username}
   • %System Root%\Python27\tcl\tcl8.5\tzdata\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Store\{username}
   • %System Root%\Users\All Users\Microsoft\RAC\{username}.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\gbk-utf8.txt.KEKW
   • %All Users Profile%\Microsoft\Windows\Sqm\Sessions\{username}
   • %System Root%\Users\{username}\AppData\{username}
   • %System Root%\Python27\tcl\tcl8.5\tzdata\Africa\{username}
   • %All Users Profile%\McAfee\MCLOGS\PartnerCustom\Un_A\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\61\{username}
   • %System Root%\Python27\Lib\site-packages\setuptools\command\{username}
   • %System Root%\Python27\tcl\tix8.4.3\bitmaps\srcfile.gif.KEKW
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-current.bin.KEKW
   • %All Users Profile%\McAfee\MCLOGS\PartnerCustom\McCHSvc\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp.KEKW
   • %All Users Profile%\Microsoft\Windows\DRM\{username}
   • %System Root%\Python27\Tools\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Config\{username}.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\shift_jisx0213-utf8.txt.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_08.txt.KEKW
   • %All Users Profile%\Microsoft\MSDN\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\{AD285A8B-713F-11E9-85F8-005056BC44A9}.dat.KEKW
   • %System Root%\Python27\Lib\test\decimaltestdata\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\LocalCopy\{username}
   • %System Root%\Users\All Users\Microsoft\MSDN\8.0\{username}.KEKW
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp.KEKW
   • %System Root%\Python27\Lib\test\test_doctest.txt.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\pep517\{username}
   • %System Root%\Python27\include\osdefs.h.KEKW
   • %System Root%\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.KEKW
   • %All Users Profile%\Microsoft\Windows NT\MSFax\ActivityLog\{username}
   • %AppDataLocal%\pip\cache\http\0\{username}
   • %AppDataLocal%\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\{username}
   • %AppDataLocal%\Microsoft\Windows\WebCache\WebCacheV01.dat.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\contrib\_securetransport\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\4\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5\{username}
   • %All Users Profile%\Oracle\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\GUFNQG0Q\{username}
   • %User Temp%\acrocef_low\{username}
   • %System Root%\Python27\Doc\{username}
   • %User Profile%\Documents\powerpoint2k\PPT2KE01.ppt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSScan\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\{username}
   • %System Root%\Python27\tcl\tcl8.5\tzdata\America\Argentina\{username}
   • %System Root%\Users\All Users\Microsoft\OFFICE\DATA\{username}.KEKW
   • %AppDataLocal%\Microsoft\Internet Explorer\Tracking Protection\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\LocalCopy\{username}.KEKW
   • %System Root%\Python27\LICENSE.txt.KEKW
   • %System Root%\Users\All Users\Adobe\Setup\{username}
   • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\{username}.KEKW
   • %System Root%\Python27\tcl\tix8.4.3\bitmaps\act_fold.gif.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Scans\{username}
   • %System Root%\Python27\Lib\test\cjkencodings\big5hkscs.txt.KEKW
   • %System Root%\Users\{username}\AppData\Local\{username}
   • %System Root%\Python27\tcl\tk8.5\images\logoMed.gif.KEKW
   • %All Users Profile%\Microsoft\RAC\Outbound\{username}
   • %System Root%\Python27\Lib\xml\etree\{username}
   • %Application Data%\Microsoft\Document Building Blocks\1033\{username}
   • %All Users Profile%\Microsoft\Windows\Sqm\{username}
   • %System Root%\Python27\tcl\tix8.4.3\{username}
   • %AppDataLocal%\Google\Chrome\User Data\InterventionPolicyDatabase\2018.9.6.0\_metadata\{username}
   • %System Root%\Python27\tcl\tix8.4.3\pref\TixGray.cs.KEKW
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp.KEKW
   • %System Root%\Recovery\{GUID}\{username}
   • %Start Menu%\Programs\Accessories\Accessibility\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\History\{username}
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\{username}
   • %AppDataLocal%\pip\cache\http\3\8\9\3\{username}
   • %Application Data%\Microsoft\Windows\IEDownloadHistory\container.dat.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.1\LICENSE.txt.KEKW
   • %All Users Profile%\Microsoft\Search\Data\Temp\{username}
   • %System Root%\Python27\include\pyerrors.h.KEKW
   • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\PDYB5D8B\{username}
   • %AppDataLocal%Low\Microsoft\Windows\AppCache\container.dat.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\{username}
   • %System Root%\Users\Public\Pictures\Sample Pictures\Tulips.jpg.KEKW
   • %System Root%\Users\All Users\Microsoft\NetFramework\BreadcrumbStore\{username}
   • %All Users Profile%\Microsoft\Windows\Power Efficiency Diagnostics\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\Updates\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\1\{username}
   • %System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\updates\{username}.KEKW
   • %All Users Profile%\Oracle\Java\installcache_x64\{username}
   • %System Root%\Users\All Users\Microsoft\Network\Connections\{username}.KEKW
   • %System Root%\Email and Password List.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\{username}.KEKW
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\pkcs11.txt.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_27.txt.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\0\{username}
   • %Application Data%\Microsoft\Office\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Power Efficiency Diagnostics\{username}.KEKW
   • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieUserList\{username}
   • %System Root%\Python27\include\pyarena.h.KEKW
   • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieBrowserModeList\{username}
   • %Desktop%\powerpoint2k\PPT2KE04.ppt.KEKW
   • %System Root%\Users\Public\Documents\word2k\DOC2KE02.doc.KEKW
   • %Application Data%\Microsoft\Windows\Printer Shortcuts\{username}
   • %System Root%\Python27\Lib\test\cjkencodings\euc_jp.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp.KEKW
   • %System Root%\Python27\Lib\lib2to3\tests\{username}
   • %System Root%\Users\All Users\Microsoft\DeviceSync\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F0\{username}
   • %System Root%\Users\All Users\McAfee\MCLOGS\{username}.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_04.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\DeviceMetadataStore\{username}
   • %System Root%\Python27\include\setobject.h.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_internal\operations\{username}
   • %Desktop%\word2k\DOC2KE05.doc.KEKW
   • %System Root%\Python27\tcl\tix8.4.3\bitmaps\info.gif.KEKW
   • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\8YC9813O\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\{username}
   • %System Root%\Python27\tcl\tix8.4.3\pref\WmDefault.cs.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\contrib\{username}
   • %All Users Profile%\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\DATA\{username}
   • %All Users Profile%\VMware\VMware Tools\Unity Filters\vistasidebar.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Sqm\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\{username}
   • %System Root%\Users\All Users\Adobe\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\{username}
   • %Start Menu%\Programs\{username}
   • %Desktop%\{username}
   • %User Profile%\Documents\excel2k\XLS2KExx.xls.KEKW
   • %AppDataLocal%\pip\cache\http\b\a\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\F0\{username}
   • %System Root%\Python27\tcl\tk8.5\msgs\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43\{username}.KEKW
   • %System Root%\Python27\include\marshal.h.KEKW
   • %System Root%\Python27\Lib\test\audiodata\{username}
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Microsoft Office\{username}
   • %System Root%\Python27\Lib\idlelib\README.txt.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\12\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Definition Updates\Backup\{username}
   • %AppDataLocal%\pip\cache\http\f\e\d\{username}
   • %System Root%\Python27\include\Python.h.KEKW
   • %System Root%\Users\All Users\Microsoft\Network\{username}.KEKW
   • %All Users Profile%\Microsoft\IdentityCRL\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\{username}
   • %All Users Profile%\Oracle\Java\javapath_target_313094\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_41.txt.KEKW
   • %System Root%\Python27\tcl\tk8.5\images\logoLarge.gif.KEKW
   • %System Root%\Python27\tcl\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Quarantine\{username}.KEKW
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_15.txt.KEKW
   • %AppDataLocal%Low\Sun\Java\{username}
   • %System Root%\Python27\Lib\curses\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\MSIMGSIZ.DAT.KEKW
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\{username}
   • %System Root%\Python27\include\graminit.h.KEKW
   • %AppDataLocal%\Microsoft\TaskSchedulerConfig\{username}
   • F:\data\dolist.txt.KEKW
   • %AppDataLocal%\Microsoft\PlayReady\{username}
   • %Start Menu%\Programs\Maintenance\{username}
   • %User Temp%\{username}
   • %AppDataLocal%\Microsoft\Windows Media\{username}
   • %AppDataLocal%\Microsoft\Windows\Burn\Burn\{username}
   • %System Root%\Python27\tcl\tk8.5\images\logo64.gif.KEKW
   • %All Users Profile%\Microsoft\RAC\Temp\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Entries\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\{username}.KEKW
   • %Desktop%\powerpoint2k\PPT2KE03.ppt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\{username}
   • %All Users Profile%\Microsoft\Windows\AIT\{username}
   • %System Root%\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Queue\{username}.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\treebuilders\{username}
   • %User Profile%\Documents\Email and Password List.js.KEKW
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\urlCache.bin.KEKW
   • %System Root%\Python27\include\pythonrun.h.KEKW
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Tablet PC\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\{username}
   • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\550F8967-2EE2-4F33-8E16-1BFFBE114803\{username}
   • %AppDataLocal%\Microsoft Help\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_09.txt.KEKW
   • %System Root%\Python27\include\pymactoolbox.h.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_02.txt.KEKW
   • %AppDataLocal%\Microsoft\Windows\WER\ReportArchive\NonCritical_iexplore.exe_12df8271b62395a348f102b12959f9768e2baf9_0be7f64f\{username}
   • %System Root%\Python27\Lib\test\support\{username}
   • %System Root%\word2k\DOC2KE01.doc.KEKW
   • %System Root%\Users\All Users\Microsoft\IdentityCRL\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\SiteSecurityServiceState.txt.KEKW
   • %System Root%\Python27\Lib\test\tokenize_tests.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70\{username}.KEKW
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Tiki.gif.KEKW
   • %System Root%\Python27\include\stringobject.h.KEKW
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg.KEKW
   • %System Root%\Users\All Users\Microsoft Help\{username}.KEKW
   • %System Root%\Python27\Lib\idlelib\idle_test\{username}
   • %System Root%\Users\All Users\VMware\VMware Tools\{username}.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\packages\{username}
   • %AppDataLocal%\pip\cache\http\2\3\b\{username}
   • %AppDataLocal%\pip\cache\http\4\e\e\3\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\weave\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Ringtones\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp.KEKW
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\{username}
   • %System Root%\Python27\include\grammar.h.KEKW
   • %AppDataLocal%\pip\cache\http\2\3\{username}
   • %System Root%\excel2k\XLS2KE04.xls.KEKW
   • %All Users Profile%\Microsoft\Assistance\Client\1.0\en-US\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\{username}.dat.KEKW
   • %System Root%\Python27\Lib\test\formatfloat_testcases.txt.KEKW
   • %System Root%\Python27\tcl\tcl8\{username}
   • %AppDataLocal%\Microsoft\Windows Media\12.0\{username}
   • %System Root%\Python27\tcl\tk8.5\ttk\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\{username}.KEKW
   • %System Root%\Python27\tcl\tix8.4.3\pref\Blue.cs.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\3\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\{username}
   • %System Root%\Python27\DLLs\{username}
   • %System Root%\Python27\Lib\idlelib\CREDITS.txt.KEKW
   • %All Users Profile%\McAfee\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_39.txt.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\41\{username}
   • %Application Data%\Microsoft\SystemCertificates\My\CTLs\{username}
   • %System Root%\Users\All Users\VMware\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp.KEKW
   • %System Root%\Python27\tcl\tcl8.5\encoding\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\46\{username}
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\{username}.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_internal\cli\{username}
   • %Application Data%\Sun\Java\{username}
   • %Application Data%\Microsoft\Windows\IEDownloadHistory\{username}
   • %AppDataLocal%\Python-Eggs\{username}
   • %AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\RJ6VBH4W.DN2\manifests\{username}
   • %Application Data%\Microsoft\Windows\IETldCache\{username}
   • %System Root%\Users\All Users\Adobe\ARM\{username}
   • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieSiteList\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\{0E1465B0-BA9C-409F-BC32-D934317129CD}\{username}.KEKW
   • %System Root%\Python27\include\complexobject.h.KEKW
   • %System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\updates\{username}
   • %Start Menu%\Programs\Accessories\{username}
   • %System Root%\Python27\Lib\idlelib\TODO.txt.KEKW
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Sqm\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\59\{username}
   • %Application Data%\Microsoft\Windows\IECompatUACache\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\tmp\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_30.txt.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\70\{username}
   • %AppDataLocal%\Mozilla\Firefox\{username}
   • %Application Data%\Identities\{3D0FBFE3-9E5C-4F14-8D00-F0C8FEFA78BA}\{username}
   • %System Root%\Users\All Users\McAfee\{username}.KEKW
   • %All Users Profile%\Microsoft\Windows\Caches\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\{username}
   • %System Root%\Users\All Users\Microsoft\Device Stage\Task\{{GUID}}\{username}
   • %AppDataLocal%\pip\cache\http\a\1\9\{username}
   • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\Un_A\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\{username}
   • %AppDataLocal%\pip\cache\http\b\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_40.txt.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0\{username}
   • %System Root%\Users\All Users\Microsoft\WwanSvc\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\{username}.KEKW
   • %System Root%\powerpoint2k\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Sqm\Manifest\{username}.KEKW
   • %AppDataLocal%\GDIPFONTCACHEV1.DAT.KEKW
   • %All Users Profile%\VMware\RawdskCompatibility\native\C\ProgramData\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\57\{username}
   • %AppDataLocal%\pip\cache\http\3\8\9\3\0\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\{username}.KEKW
   • %System Root%\Python27\tcl\tcl8.5\tzdata\America\Indiana\{username}
   • %System Root%\Users\All Users\Microsoft\Network\Connections\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\pluginreg.dat.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\{username}.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_28.txt.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\gbk.txt.KEKW
   • %All Users Profile%\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_505c7fc25c7e5866de583f14c22e2b4c2a6018c_0a2493a7\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\History\Results\{username}
   • %System Root%\Users\All Users\Adobe\Setup\{username}.KEKW
   • %AppDataLocal%\Microsoft\Windows\WebCacheLock.dat.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\23\{username}
   • %System Root%\Users\All Users\Microsoft\MF\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Assistance\Client\1.0\{username}.KEKW
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Wrinkled_Paper.gif.KEKW
   • %User Profile%\Documents\powerpoint2k\PPT2KExx.PPT.KEKW
   • %User Profile%\Documents\word2k\DOC2KE04.doc.KEKW
   • %System Root%\excel2k\XLS2KE05.xls.KEKW
   • %System Root%\Python27\Lib\idlelib\Icons\folder.gif.KEKW
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\{username}.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportQueue\{username}
   • %System Root%\Python27\include\object.h.KEKW
   • %Start Menu%\Programs\Accessories\System Tools\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\38\{username}
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Quarantine\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\distlib\{username}
   • %System Root%\word2k\{username}
   • %Start Menu%\Programs\ImDisk\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\27\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\14\{username}
   • %System Root%\Users\All Users\McAfee\MCLOGS\Common\SmallInstaller\{username}
   • %System Root%\Users\{username}\{username}
   • %All Users Profile%\Microsoft\RAC\PublishedData\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\user.bmp.KEKW
   • %System Root%\Python27\include\intrcheck.h.KEKW
   • %All Users Profile%\VMware\VMware Tools\Unity Filters\visualstudio2005.txt.KEKW
   • %Desktop%\AAljoOV.jpg.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1D\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\{username}
   • %AppDataLocal%\Google\Software Reporter Tool\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Support\{username}
   • %AppDataLocal%\Google\Chrome\User Data\Crashpad\settings.dat.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\{username}.KEKW
   • %System Root%\Users\Public\Documents\Email and Password List.js.KEKW
   • %Application Data%\Microsoft\{username}
   • %System Root%\Users\Default\NTUSER.DAT.KEKW
   • %System Root%\Users\All Users\Microsoft\Search\Data\Temp\usgthrsvc\{username}.KEKW
   • %System Root%\Python27\include\weakrefobject.h.KEKW
   • %All Users Profile%\McAfee\MCLOGS\{username}
   • %System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\{username}
   • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\{username}
   • %System Root%\Python27\include\bitset.h.KEKW
   • %System Root%\Users\All Users\Microsoft\RAC\StateData\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Assistance\Client\1.0\{username}
   • %System Root%\Python27\Lib\unittest\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\{username}
   • %System Root%\Python27\Lib\test\imghdrdata\python.png.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\ShaderCache\{username}
   • %AppDataLocal%\Google\Chrome\User Data\pnacl\0.57.44.2492\{username}
   • %Application Data%\Microsoft\Windows\IECompatCache\container.dat.KEKW
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp.KEKW
   • F:\data\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\History\Store\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\minidumps\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp.KEKW
   • %All Users Profile%\Microsoft\Windows NT\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\{username}.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_18.txt.KEKW
   • %System Root%\word2k\DOC2KExx.doc.KEKW
   • %System Root%\Python27\tcl\tcl8.5\tzdata\Antarctica\{username}
   • %System Root%\Users\All Users\Microsoft\Search\{username}.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\Safe Browsing\{username}
   • %System Root%\Python27\tcl\tcl8.5\tzdata\America\Kentucky\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\{username}.KEKW
   • %System Root%\Python27\include\genobject.h.KEKW
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp.KEKW
   • %All Users Profile%\Microsoft\Windows\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\EmieBrowserModeList\container.dat.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\{0E1465B0-BA9C-409F-BC32-D934317129CD}\{username}
   • %System Root%\Python27\include\dtoa.h.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\43\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\{username}
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\45\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\ActivityLog\{username}.KEKW
   • %Application Data%\Microsoft\Internet Explorer\UserData\Low\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3\{username}
   • %System Root%\Python27\Lib\site-packages\setuptools\_vendor\packaging\{username}
   • %System Root%\Users\All Users\Microsoft\MSDN\8.0\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_20.txt.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\CertificateRevocation\5140\_metadata\{username}
   • %User Temp%\Guest.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\{username}.KEKW
   • %User Profile%\Documents\word2k\DOC2KExx.doc.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Inbox\{username}.KEKW
   • %System Root%\Users\Public\Documents\word2k\{username}
   • %User Temp%\Deployment\{username}
   • %AppDataLocal%\pip\cache\http\d\{username}
   • %System Root%\Users\All Users\Microsoft\Search\{username}
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\safebrowsing\google4\{username}
   • %System Root%\Users\All Users\Microsoft\MSDN\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\F0\{username}.KEKW
   • %AppDataLocal%Low\Microsoft\Internet Explorer\{username}
   • %All Users Profile%\Microsoft\DeviceSync\{username}
   • %Application Data%\Macromedia\{username}
   • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\Config\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\40\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Garden.jpg.KEKW
   • %System Root%\Users\All Users\Oracle\{username}.KEKW
   • %All Users Profile%\Microsoft\IlsCache\{username}
   • %System Root%\Python27\Lib\xml\parsers\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp.KEKW
   • %AppDataLocal%\pip\cache\http\0\2\5\2\b\{username}
   • %System Root%\word2k\DOC2KE04.doc.KEKW
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\weave\toFetch\{username}
   • %All Users Profile%\Microsoft\Device Stage\{username}
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Games\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\TabRoaming\{username}
   • %Desktop%\excel2k\XLS2KE02.xls.KEKW
   • %System Root%\Python27\Lib\lib2to3\Grammar.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\{username}.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\iso2022_jp-utf8.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp.KEKW
   • %All Users Profile%\Adobe\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\17\{username}
   • F:\data\photos\stunning.jpg.KEKW
   • %System Root%\Python27\include\memoryobject.h.KEKW
   • %AppDataLocal%\Microsoft\Office\Groove\System\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\lockfile\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\EmieBrowserModeList\{username}
   • %All Users Profile%\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\{username}
   • %System Root%\Python27\Lib\test\tracedmodules\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\GameExplorer\{username}
   • %System Root%\Python27\tcl\tk8.5\images\tai-ku.gif.KEKW
   • %User Profile%\Pictures\{username}
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\OfflineCache\{username}
   • %AppDataLocal%\pip\cache\http\a\1\9\5\3\{username}
   • %System Root%\Users\Default\Desktop\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\{username}
   • %System Root%\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\filters\{username}
   • %All Users Profile%\VMware\RawdskCompatibility\native\regdata.dat.KEKW
   • %System Root%\Users\All Users\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\{username}
   • %All Users Profile%\Microsoft\Windows\Templates\{username}
   • %System Root%\Python27\Lib\ensurepip\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\imagestore\joppu72\{username}
   • %User Temp%\dd_wcf_CA_smci_20161212_135110_351.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\NetFramework\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\{username}.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\CertificateRevocation\{username}
   • %System Root%\Python27\Lib\lib2to3\PatternGrammar.txt.KEKW
   • %System Root%\Python27\Lib\test\cmath_testcases.txt.KEKW
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\cache2\{username}
   • %System Root%\Users\All Users\McAfee\WinCore\{username}.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\FileTypePolicies\34\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Service\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportQueue\{username}.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_25.txt.KEKW
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\{username}
   • %System Root%\Python27\tcl\tix8.4.3\pref\Gray.cs.KEKW
   • %AppDataLocal%\Microsoft\Office\{username}
   • %AppDataLocal%\Microsoft\Windows\History\Low\{username}
   • %System Root%\Python27\include\symtable.h.KEKW
   • %System Root%\Python27\tcl\tix8.4.3\pref\{username}
   • %AppDataLocal%\Google\Chrome\User Data\PepperFlash\{username}
   • %System Root%\Python27\tcl\tk8.5\{username}
   • %Desktop%\powerpoint2k\PPT2KE01.ppt.KEKW
   • %All Users Profile%\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47\{username}
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Administrative Tools\{username}
   • %AppDataLocal%\Microsoft\Windows\GameExplorer\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\AlternateServices.txt.KEKW
   • %System Root%\Users\All Users\Oracle\Java\{username}
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\{username}
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\{username}
   • %System Root%\Python27\Lib\unittest\test\{username}
   • %System Root%\Python27\Lib\test\ieee754.txt.KEKW
   • %System Root%\Python27\Tools\webchecker\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\cachecontrol\caches\{username}
   • %AppDataLocal%\Python-Eggs\Python-Eggs\Cache\pillow-4.1.0-py2.7-win32.egg-tmp\PIL\{username}
   • %System Root%\Python27\include\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_10.txt.KEKW
   • %System Root%\Users\All Users\Adobe\ARM\{username}.KEKW
   • %System Root%\Python27\include\tupleobject.h.KEKW
   • %Application Data%\Microsoft\SystemCertificates\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\{username}
   • %AppDataLocal%\Apps\2.0\{username}
   • %System Root%\Users\All Users\Adobe\ARM\Reader_19.010.20099\{username}
   • %AppDataLocal%\Microsoft\Windows Sidebar\Gadgets\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Notebook.jpg.KEKW
   • %All Users Profile%\Microsoft\Media Player\{username}
   • %All Users Profile%\Microsoft\MSDN\8.0\{username}
   • %AppDataLocal%\pip\cache\http\f\e\{username}
   • %User Profile%\Documents\fp_18.0.0.203_archive\{username}
   • %System Root%\Python27\include\bufferobject.h.KEKW
   • %System Root%\Users\Public\Documents\word2k\DOC2KE03.doc.KEKW
   • %System Root%\Python27\Tools\pynche\namedcolors.txt.KEKW
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\crashes\events\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01\{username}
   • %Application Data%\Microsoft\Windows\IETldCache\container.dat.KEKW
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\{username}
   • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\{username}
   • %AppDataLocal%\Microsoft\Media Player\Sync Playlists\en-US\00007196\{username}
   • %User Profile%\Documents\powerpoint2k\{username}
   • %System Root%\Python27\Lib\test\cjkencodings\euc_jisx0213.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSScan\{username}
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\{username}
   • %System Root%\Users\All Users\Microsoft\Device Stage\Task\{{GUID}}\en-US\{username}.KEKW
   • %All Users Profile%\Microsoft\Network\Connections\{username}
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\{username}
   • %System Root%\Python27\Lib\xml\dom\{username}
   • %System Root%\Python27\tcl\tcl8.5\tzdata\SystemV\{username}
   • %AppDataLocal%\Google\Chrome\User Data\SSLErrorAssistant\7\{username}
   • %All Users Profile%\Oracle\Java\.oracle_jre_usage\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Backup\new\{username}
   • %Desktop%\powerpoint2k\{username}
   • %System Root%\Users\All Users\Mozilla\updates\{username}
   • %System Root%\Python27\Lib\test\cjkencodings\big5-utf8.txt.KEKW
   • %AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\RJ6VBH4W.DN2\{username}
   • %AppDataLocal%\Microsoft\Media Player\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_72da1383309c93bd2441accd728cf953e4fa97a_0a24a840\{username}.KEKW
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\bookmarkbackups\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\{username}.KEKW
   • %System Root%\Users\All Users\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_42.txt.KEKW
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-child-current.bin.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\CertificateRevocation\5140\{username}
   • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{4555A5E7-C06D-11E6-8AB1-005056BC3E18}.dat.KEKW
   • %All Users Profile%\Microsoft\Windows\WER\{username}
   • %All Users Profile%\McAfee\MCLOGS\SmallInstaller\{username}
   • %Application Data%\Microsoft\Windows\Libraries\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\3561288849sdhlie.files\{username}
   • %AppDataLocal%\Google\Chrome\User Data\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\{username}
   • %System Root%\Python27\tcl\tix8.4.3\bitmaps\no_entry.gif.KEKW
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\virtual\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\security\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\{username}
   • %System Root%\Python27\include\parsetok.h.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\{username}
   • %User Temp%\Adobe_ADMLogs\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp.KEKW
   • %System Root%\Users\Public\Favorites\{username}
   • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\GatherLogs\{username}
   • %User Profile%\Documents\fp_18.0.0.203_archive.zip.KEKW
   • %Application Data%\Microsoft\Protect\{username}
   • %AppDataLocal%\Google\Chrome\User Data\FileTypePolicies\{username}
   • %System Root%\Users\{username}\Videos\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\container.dat.KEKW
   • %System Root%\Python27\include\listobject.h.KEKW
   • %System Root%\Users\All Users\Microsoft\Vault\{username}.KEKW
   • %All Users Profile%\Microsoft\NetFramework\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Roses.jpg.KEKW
   • %System Root%\Python27\tcl\tix8.4.3\pref\WmDefault.txt.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_12.txt.KEKW
   • %User Temp%\WebInstaller\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Backup\{username}
   • %System Root%\Python27\tcl\dde1.3\{username}
   • %System Root%\Python27\Tools\pynche\README.txt.KEKW
   • %System Root%\Python27\Lib\xml\{username}
   • %AppDataLocal%\Microsoft\Feeds Cache\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_03.txt.KEKW
   • %All Users Profile%\Microsoft\Windows\Start Menu\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp.KEKW
   • %System Root%\Python27\Lib\json\tests\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\HandPrints.jpg.KEKW
   • %Application Data%\Microsoft\Proof\{username}
   • %System Root%\Python27\Tools\versioncheck\README.txt.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\_metadata\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Tablet PC\{username}.KEKW
   • %All Users Profile%\Microsoft\Windows NT\MSFax\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\9IWSW3EX\{username}
   • %System Root%\Python27\include\objimpl.h.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\big5hkscs-utf8.txt.KEKW
   • %System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\{username}.KEKW
   • %Desktop%\word2k\DOC2KExx.doc.KEKW
   • %Application Data%\Macromedia\Flash Player\macromedia.com\support\{username}
   • %All Users Profile%\Mozilla\updates\{username}
   • %System Root%\Python27\Lib\site-packages\setuptools\{username}
   • %System Root%\Python27\include\pyexpat.h.KEKW
   • %System Root%\Python27\Tools\Scripts\{username}
   • %System Root%\Users\Public\Videos\{username}
   • %User Profile%\Documents\word2k\DOC2KE05.doc.KEKW
   • %System Root%\Python27\Lib\idlelib\help.html.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Sqm\Sessions\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp.KEKW
   • %All Users Profile%\VMware\VMware Tools\Unity Filters\adobephotoshopcs3.txt.KEKW
   • %System Root%\Python27\include\cobject.h.KEKW
   • %System Root%\Python27\tcl\tcl8.5\tzdata\Indian\{username}
   • %System Root%\Users\{username}\AppData\Local\Microsoft\{username}
   • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE02.ppt.KEKW
   • %User Temp%\dd_SetupUtility.txt.KEKW
   • %System Root%\Python27\tcl\tcl8.5\tzdata\US\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\11\{username}
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\15\{username}
   • %System Root%\Users\Public\Documents\word2k\DOC2KE01.doc.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\51\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg.KEKW
   • %System Root%\Python27\Lib\test\xmltestdata\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\SecurityPreloadState.txt.KEKW
   • %User Temp%\dd_vcredistMSI0FC1.txt.KEKW
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\urlCache-current.bin.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\packages\ssl_match_hostname\{username}
   • %Application Data%\Microsoft\Internet Explorer\UserData\{username}
   • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Power Efficiency Diagnostics\{username}
   • %Application Data%\Mozilla\Firefox\Crash Reports\{username}
   • %System Root%\Users\All Users\Oracle\Java\{username}.KEKW
   • %System Root%\Python27\tcl\tix8.4.3\bitmaps\openfold.gif.KEKW
   • %System Root%\Python27\include\ceval.h.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95\{username}.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\_trie\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\guest.bmp.KEKW
   • %AppDataLocal%\pip\cache\http\5\4\3\d\7\{username}
   • %System Root%\Users\Default\AppData\Local\Microsoft\Windows\GameExplorer\{username}
   • %System Root%\Users\All Users\Microsoft\WwanSvc\Profiles\{username}
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Python 2.7\{username}
   • %System Root%\Users\Public\Documents\excel2k\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\sessionstore-backups\{username}
   • %System Root%\Python27\include\pymacconfig.h.KEKW
   • %Application Data%\Microsoft\Windows\IECompatCache\Low\{username}
   • %System Root%\Python27\Lib\sqlite3\{username}
   • %AppDataLocal%\pip\cache\http\{username}
   • %System Root%\Python27\Lib\lib-tk\test\test_ttk\{username}
   • %System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\entry_points.txt.KEKW
   • %System Root%\Python27\Scripts\{username}
   • %System Root%\Python27\tcl\tcl8.5\{username}
   • %Application Data%\Microsoft\Windows\Recent\{username}
   • %AppDataLocal%\Microsoft\Feeds Cache\JPOHUSHF\{username}
   • %System Root%\Python27\Lib\test\exception_hierarchy.txt.KEKW
   • %System Root%\$Recycle.Bin\S-1-5-21-2407829820-1079796033-203259571-1000\{username}
   • %All Users Profile%\Microsoft\Windows\Sqm\Manifest\{username}
   • %User Temp%\{username}.bmp.KEKW
   • %AppDataLocal%\Microsoft\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp.KEKW
   • %Application Data%\Microsoft\Internet Explorer\Quick Launch\User Pinned\{username}
   • F:\data\tmp.doc.KEKW
   • %System Root%\Python27\Lib\lib2to3\tests\data\fixers\myfixes\{username}
   • %Favorites%\{username}
   • %System Root%\Users\All Users\Microsoft\RAC\PublishedData\{username}.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\certifi\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\{username}
   • %System Root%\Users\Public\Documents\excel2k\XLS2KE05.xls.KEKW
   • %All Users Profile%\Mozilla\updates\308046B0AF4A39CB\updates\0\{username}
   • %Application Data%\Macromedia\Flash Player\#SharedObjects\K48846QH\{username}
   • F:\data\photos\long_exposure.jpg.KEKW
   • %User Profile%\Links\{username}
   • %System Root%\Python27\libs\{username}
   • %System Root%\Users\Public\Documents\Email and Password List.txt.KEKW
   • %AppDataLocal%\Microsoft\Media Player\Sync Playlists\en-US\{username}
   • %All Users Profile%\VMware\VMware Tools\Unity Filters\googledesktop.txt.KEKW
   • %System Root%\Python27\Lib\importlib\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\43\{username}.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\6\{username}
   • %System Root%\Python27\include\structmember.h.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\DeviceMetadataStore\en-US\{username}.KEKW
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\packages\backports\{username}
   • %AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\{username}
   • %System Root%\Python27\include\metagrammar.h.KEKW
   • %System Root%\Users\All Users\Microsoft\DRM\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\{username}.KEKW
   • %AppDataLocal%\Apps\2.0\Data\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\21\{username}
   • %System Root%\Python27\Lib\idlelib\{username}
   • %System Root%\Users\All Users\Oracle\Java\javapath_target_313094\{username}
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\Backup\{username}.KEKW
   • %AppDataLocal%\Microsoft\Internet Explorer\EmieSiteList\{username}
   • %AppDataLocal%\pip\cache\http\b\a\9\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_34.txt.KEKW
   • %System Root%\Python27\include\floatobject.h.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\idna\{username}
   • %All Users Profile%\VMware\VMware Tools\Unity Filters\microsoftoffice2003.txt.KEKW
   • %Application Data%\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\{username}
   • %Desktop%\word2k\DOC2KE02.doc.KEKW
   • %Application Data%\Microsoft\Windows\Network Shortcuts\{username}
   • %Application Data%\Microsoft\Templates\{username}
   • %System Root%\Python27\tcl\tix8.4.3\bitmaps\plusarm.gif.KEKW
   • %All Users Profile%\Microsoft\Assistance\{username}
   • %System Root%\Python27\Lib\msilib\{username}
   • %System Root%\Python27\Lib\idlelib\help.txt.KEKW
   • %User Temp%\dd_vcredistUI0FC1.txt.KEKW
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\{username}
   • %System Root%\Python27\tcl\tk8.5\demos\{username}
   • %System Root%\Python27\tcl\tix8.4.3\pref\TK.cs.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\{username}.KEKW
   • %AppDataLocal%\Microsoft\Vault\{username}
   • %Application Data%\{username}
   • %AppDataLocal%\Microsoft\Windows\AppCache\6A582BR6\{username}
   • %System Root%\Users\All Users\Microsoft\Device Stage\Task\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\20\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\{username}.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\LastBld.dat.KEKW
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\{username}
   • %All Users Profile%\VMware\RawdskCompatibility\virtual\{username}
   • %AppDataLocal%\Google\Software Reporter Tool\settings.dat.KEKW
   • %System Root%\Python27\Lib\email\test\{username}
   • %System Root%\Python27\include\datetime.h.KEKW
   • %All Users Profile%\Microsoft\eHome\logs\{username}
   • %System Root%\Users\All Users\Oracle\Java\.oracle_jre_usage\{username}.KEKW
   • %System Root%\Python27\Lib\test\imghdrdata\python.gif.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F0\{username}.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\LocalCopy\{username}
   • %System Root%\Python27\Lib\test\cjkencodings\shift_jis.txt.KEKW
   • %System Root%\Users\Public\Recorded TV\{username}
   • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\{username}
   • %System Root%\Python27\Lib\site-packages\pkg_resources\_vendor\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\43\{username}
   • %Application Data%\Microsoft\Windows\DNTException\{username}
   • %Favorites%\Links for United States\{username}
   • %System Root%\powerpoint2k\PPT2KE03.ppt.KEKW
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Temp\usgthrsvc\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp.KEKW
   • %System Root%\Users\Public\Documents\word2k\DOC2KE05.doc.KEKW
   • %Application Data%\Microsoft\SystemCertificates\My\Keys\{username}
   • %System Root%\Users\Default\AppData\Local\Microsoft\Windows\History\{username}
   • %System Root%\Users\All Users\Microsoft\RAC\StateData\{username}
   • %Desktop%\word2k\DOC2KE04.doc.KEKW
   • %System Root%\Users\{username}\AppData\Roaming\{username}
   • %System Root%\Python27\Lib\email\test\data\{username}
   • %System Root%\Python27\include\cellobject.h.KEKW
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\{username}
   • %User Profile%\Videos\{username}
   • %User Temp%\Microsoft .NET Framework 4.5.2 Setup_20161212_135033207-MSI_netfx_Full_GDR_x64.msi.txt.KEKW
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\{username}
   • %AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\_platform_specific\{username}
   • %System Root%\Python27\Tools\pynche\html40colors.txt.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\9\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\82DF2NUK\{username}
   • %System Root%\Python27\Lib\test\sgml_input.html.KEKW
   • %AppDataLocal%\Microsoft\Feeds\{username}
   • %System Root%\Users\All Users\Microsoft\Windows NT\{username}.KEKW
   • %System Root%\Python27\include\pycapsule.h.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_24.txt.KEKW
   • %System Root%\Python27\include\pystrtod.h.KEKW
   • %AppDataLocal%\Microsoft\Internet Explorer\EmieUserList\container.dat.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Entries\{username}
   • %Application Data%\Microsoft\Windows\PrivacIE\container.dat.KEKW
   • %All Users Profile%\Microsoft\Windows NT\MSFax\Queue\{username}
   • %System Root%\Users\All Users\Microsoft\OFFICE\{username}
   • %System Root%\Python27\Lib\test\test_doctest2.txt.KEKW
   • %System Root%\Python27\include\abstract.h.KEKW
   • %System Root%\Python27\Lib\site-packages\Pillow-6.0.0.dist-info\top_level.txt.KEKW
   • %AppDataLocal%Low\Microsoft\Windows\AppCache\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\47\{username}
   • %System Root%\Users\All Users\McAfee\MCLOGS\Common\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Definition Updates\{username}
   • %System Root%\Python27\Lib\test\test_difflib_expect.html.KEKW
   • %User Profile%\Documents\excel2k\XLS2KE01.xls.KEKW
   • %User Profile%\Downloads\{username}
   • %System Root%\Python27\Lib\test\testtar.tar.KEKW
   • %Application Data%\Microsoft\Windows\IECompatUACache\container.dat.KEKW
   • %System Root%\$Recycle.Bin\{username}
   • %User Profile%\Searches\{username}
   • %System Root%\Python27\README.txt.KEKW
   • %All Users Profile%\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\DomainSuggestions\{username}
   • %User Profile%\Documents\fp_18.0.0.203_archive\18_0_r0_203\{username}
   • %System Root%\Python27\tcl\tix8.4.3\demos\bitmaps\tix.gif.KEKW
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\SentItems\{username}
   • %System Root%\Python27\Lib\test\cjkencodings\big5.txt.KEKW
   • %System Root%\Python27\Lib\lib-tk\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\chardet\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp.KEKW
   • %Desktop%\Transmag.doc.KEKW
   • %All Users Profile%\VMware\VMware Tools\Unity Filters\{username}
   • %Favorites%\Microsoft Websites\{username}
   • %System Root%\Python27\Lib\site-packages\pkg_resources\_vendor\packaging\{username}
   • %System Root%\Python27\include\longintrepr.h.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\58\{username}
   • %All Users Profile%\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_43.txt.KEKW
   • %AppDataLocal%\pip\{username}
   • %AppDataLocal%\Google\Chrome\User Data\Crashpad\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\DRM\{username}
   • %System Root%\Python27\Lib\ctypes\test\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\Crashpad\reports\{username}
   • %System Root%\Users\Public\Pictures\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\26\{username}
   • %Favorites%\Windows Live\{username}
   • %System Root%\Python27\tcl\tix8.4.3\bitmaps\warning.gif.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0\{username}.KEKW
   • %System Root%\Python27\include\pyconfig.h.KEKW
   • %System Root%\Users\All Users\McAfee\{username}
   • %Application Data%\Microsoft\Windows\PrivacIE\{username}
   • %System Root%\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.KEKW
   • %All Users Profile%\Oracle\Java\javapath\{username}
   • %System Root%\Users\All Users\Microsoft\MSDN\{username}.KEKW
   • %System Root%\Users\All Users\McAfee\WinCore\{username}
   • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Indexed Rules\25\9.1\{username}
   • %System Root%\Python27\Lib\pydoc_data\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A\{username}.KEKW
   • %System Root%\Python27\tcl\tcl8.5\msgs\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5\{username}
   • %All Users Profile%\Microsoft\Windows\DRM\Cache\{username}
   • %System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\{username}
   • %All Users Profile%\Microsoft\Network\Downloader\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\progress\{username}
   • %User Temp%\chrome_BITS_3756_19263\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\pytoml\{username}
   • %System Root%\Users\All Users\Microsoft\RAC\Outbound\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\RAC\Temp\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_16.txt.KEKW
   • %System Root%\Users\Default\AppData\Local\Microsoft\Windows\{username}
   • %Application Data%\Mozilla\{username}
   • %Application Data%\Microsoft\Windows\IECompatUACache\Low\container.dat.KEKW
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\datareporting\archived\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\DRM\{username}.KEKW
   • %System Root%\Python27\Lib\wsgiref\{username}
   • %System Root%\Users\All Users\Microsoft\Network\Downloader\{username}
   • %User Profile%\Documents\excel2k\{username}
   • %User Profile%\Documents\fp_18.0.0.203_archive\18_0_r0_203_debug\{username}
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\{username}.KEKW
   • %System Root%\Python27\Lib\ensurepip\_bundled\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp.KEKW
   • %All Users Profile%\Oracle\Java\javapath_target_313094\{username}.KEKW
   • %User Profile%\Documents\powerpoint2k\PPT2KE03.ppt.KEKW
   • %AppDataLocal%\pip\cache\http\2\3\b\7\9\{username}
   • %All Users Profile%\Microsoft\OFFICE\{username}
   • %System Root%\Python27\Lib\lib2to3\tests\data\{username}
   • %System Root%\Python27\Lib\idlelib\Icons\openfolder.gif.KEKW
   • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE01.ppt.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\54\{username}
   • %All Users Profile%\Microsoft\Windows NT\MSFax\VirtualInbox\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\62\{username}
   • %System Root%\Users\All Users\Oracle\Java\.oracle_jre_usage\{username}
   • %System Root%\Python27\include\compile.h.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0\{username}
   • %Application Data%\Microsoft\Windows\{username}
   • %System Root%\powerpoint2k\PPT2KE05.ppt.KEKW
   • %System Root%\Users\Default\AppData\Local\{username}
   • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\SSScheduler\{username}.KEKW
   • %AppDataLocal%\{username}
   • %System Root%\Users\All Users\Microsoft\DeviceSync\{username}
   • F:\{username}
   • %System Root%\Python27\Lib\idlelib\Icons\tk.gif.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\RecoveryImproved\{username}
   • %System Root%\Python27\Tools\Scripts\README.txt.KEKW
   • %AppDataLocal%\Microsoft\Internet Explorer\EmieSiteList\container.dat.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\5\{username}
   • %All Users Profile%\Microsoft\Network\{username}
   • %System Root%\Python27\Lib\test\cjkencodings\iso2022_kr.txt.KEKW
   • %Application Data%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\{username}
   • %System Root%\Python27\tcl\tk8.5\demos\images\earth.gif.KEKW
   • %System Root%\Python27\tcl\tcl8.5\tzdata\Mexico\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5\{username}.KEKW
   • %All Users Profile%\Microsoft\Windows\DRM\blackbox.bin.KEKW
   • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo100.gif.KEKW
   • %User Profile%\Documents\word2k\DOC2KE03.doc.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\{username}.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_33.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp.KEKW
   • %System Root%\Python27\include\pymath.h.KEKW
   • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE05.ppt.KEKW
   • %System Root%\Python27\include\methodobject.h.KEKW
   • %System Root%\Python27\Lib\site-packages\pkg_resources\{username}
   • %Application Data%\Mozilla\Firefox\Pending Pings\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\TRRBlacklist.txt.KEKW
   • %System Root%\Users\All Users\Oracle\Java\installcache_x64\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\SSLErrorAssistant\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_01.txt.KEKW
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Stars.jpg.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\{username}
   • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieBrowserModeList\container.dat.KEKW
   • %System Root%\Users\All Users\Microsoft\Search\Data\Temp\{username}.KEKW
   • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\SSScheduler\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\cachecontrol\{username}
   • %System Root%\Python27\Lib\bsddb\{username}
   • %All Users Profile%\Adobe\Setup\{username}
   • %User Temp%\jawshtml.html.KEKW
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp.KEKW
   • %System Root%\Users\All Users\Oracle\Java\javapath\{username}
   • %AppDataLocal%\Python-Eggs\Python-Eggs\Cache\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\webencodings\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\weave\failed\{username}
   • %System Root%\Users\All Users\Microsoft\RAC\{username}
   • %System Root%\Users\All Users\VMware\VMware Tools\Unity Filters\{username}.KEKW
   • %AppDataLocal%\pip\cache\http\f\e\d\0\{username}
   • %System Root%\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg.KEKW
   • %AppDataLocal%\Microsoft\Windows\History\Low\History.IE5\container.dat.KEKW
   • %System Root%\Users\All Users\Mozilla\{username}
   • %All Users Profile%\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.KEKW
   • %Desktop%\powerpoint2k\PPT2KExx.PPT.KEKW
   • %System Root%\Python27\Lib\site-packages\setuptools\extern\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\UrlBlockManager\{username}
   • %AppDataLocal%\Mozilla\Firefox\Profiles\{username}
   • %System Root%\Python27\tcl\tcl8\8.4\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Support\{username}
   • %User Profile%\Music\{username}
   • %All Users Profile%\Microsoft\Assistance\Client\1.0\{username}
   • %Application Data%\Identities\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Stucco.gif.KEKW
   • %System Root%\{username}
   • %System Root%\Python27\include\structseq.h.KEKW
   • %System Root%\Python27\include\ucnhash.h.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\60\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_internal\req\{username}
   • %System Root%\Python27\Lib\{username}
   • %System Root%\Python27\Lib\json\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\History\CacheManager\{username}
   • %System Root%\Python27\include\bytes_methods.h.KEKW
   • %System Root%\Users\Default\Favorites\{username}
   • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp.KEKW
   • %System Root%\Python27\Lib\lib-tk\test\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\{username}
   • %System Root%\Python27\Lib\ctypes\macholib\{username}
   • %System Root%\Python27\include\errcode.h.KEKW
   • %All Users Profile%\Microsoft\Search\{username}
   • %System Root%\Python27\Lib\site-packages\{username}
   • %User Temp%\mozilla-temp-files\{username}
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp.KEKW
   • %System Root%\Python27\include\bytearrayobject.h.KEKW
   • %AppDataLocal%\Microsoft\Windows Sidebar\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Active\{username}
   • %System Root%\Users\All Users\McAfee\MCLOGS\SmallInstaller\{username}.KEKW
   • %AppDataLocal%\Microsoft\Internet Explorer\imagestore\{username}
   • %System Root%\Python27\tcl\tcl8.5\tzdata\Europe\{username}
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\VMware\VMware Tools\{username}
   • %Desktop%\word2k\DOC2KE03.doc.KEKW
   • %System Root%\Python27\tcl\tix8.4.3\pref\TkWin.cs.KEKW
   • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo75.gif.KEKW
   • %System Root%\Python27\Tools\webchecker\README.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\{username}
   • %System Root%\Python27\tcl\tcl8.5\tzdata\Chile\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\{username}
   • %AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Pine_Lumber.jpg.KEKW
   • %Application Data%\Microsoft\SystemCertificates\My\Certificates\{username}
   • %AppDataLocal%\Microsoft\Windows\History\Low\History.IE5\{username}
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\safebrowsing\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp.KEKW
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Small_News.jpg.KEKW
   • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE04.ppt.KEKW
   • %Favorites%\Links\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\{username}.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\63\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Temp\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Resource\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\{username}
   • %System Root%\Python27\include\opcode.h.KEKW
   • %All Users Profile%\Microsoft\Windows\GameExplorer\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\70\{username}
   • %AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\RJ6VBH4W.DN2\clic...exe_9ae46cec200785df_0001.0003_none_d631acba18f736d8\{username}
   • %System Root%\Python27\Lib\test\cjkencodings\hz-utf8.txt.KEKW
   • %System Root%\Python27\Lib\email\test\data\PyBanner048.gif.KEKW
   • %System Root%\Python27\Lib\idlelib\Icons\plusnode.gif.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\16\{username}
   • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\McCHSvc\{username}
   • %System Root%\Python27\Tools\i18n\{username}
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache.bin.KEKW
   • %All Users Profile%\Microsoft\Windows NT\MSFax\Inbox\{username}
   • %System Root%\Users\All Users\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\{username}.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\30\{username}
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\{username}
   • %System Root%\Python27\include\sliceobject.h.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_06.txt.KEKW
   • %System Root%\Users\All Users\McAfee\MCLOGS\{username}
   • %AppDataLocal%\Microsoft\Feeds Cache\CRAV926P\{username}
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\{username}.KEKW
   • %System Root%\Python27\include\warnings.h.KEKW
   • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\{username}
   • %System Root%\Users\All Users\Oracle\{username}
   • %System Root%\Python27\Tools\pynche\websafe.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\Updates\{username}.KEKW
   • %All Users Profile%\Microsoft\Windows\DeviceMetadataStore\{username}
   • %System Root%\Python27\include\rangeobject.h.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\WidevineCdm\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_505c7fc25c7e5866de583f14c22e2b4c2a6018c_0a2493a7\{username}.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\{username}
   • %AppDataLocal%\pip\cache\http\d\3\7\{username}
   • %All Users Profile%\Microsoft\{username}
   • %System Root%\Python27\Lib\test\imghdrdata\python.jpg.KEKW
   • %All Users Profile%\Microsoft\Windows\WER\ReportArchive\{username}
   • %System Root%\excel2k\XLS2KE01.xls.KEKW
   • %AppDataLocal%\Microsoft\Credentials\{username}
   • %All Users Profile%\Microsoft\Device Stage\Task\{{GUID}}\en-US\{username}
   • %All Users Profile%\Microsoft\Windows\Power Efficiency Diagnostics\energy-report.html.KEKW
   • %User Temp%\hsperfdata_{username}\{username}
   • %AppDataLocal%\pip\cache\http\3\{username}
   • %System Root%\Recovery\{username}
   • %AppDataLocal%\pip\cache\http\a\6\9\b\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\48\{username}
   • %All Users Profile%\Microsoft\Network\Downloader\qmgr1.dat.KEKW
   • %System Root%\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\VMware Tools\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1D\{username}
   • %System Root%\Python27\Lib\lib-tk\test\test_tkinter\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Quick\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01\{username}
   • %System Root%\Python27\tcl\tk8.5\demos\images\tcllogo.gif.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1D\{username}.KEKW
   • %All Users Profile%\Microsoft\User Account Pictures\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\{username}
   • %System Root%\Users\Public\Music\Sample Music\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp.KEKW
   • %System Root%\Python27\include\frameobject.h.KEKW
   • %AppDataLocal%\pip\cache\http\a\6\{username}
   • %System Root%\Python27\include\token.h.KEKW
   • %System Root%\Python27\include\sysmodule.h.KEKW
   • %All Users Profile%\Microsoft\OFFICE\Groove\{username}
   • %System Root%\Users\All Users\Adobe\{username}.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\pnacl\{username}
   • %System Root%\Python27\include\node.h.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3\{username}.KEKW
   • %AppDataLocal%\Google\Software Reporter Tool\reports\{username}
   • %All Users Profile%\Microsoft\MF\{username}
   • %System Root%\Users\All Users\Microsoft\eHome\logs\{username}
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Startup\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Service\{username}
   • %System Root%\Python27\Lib\lib2to3\tests\data\fixers\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\WER\{username}.KEKW
   • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\McCHSvc\{username}.KEKW
   • %Application Data%\Microsoft\Windows\Recent\AutomaticDestinations\{username}
   • %Application Data%\Microsoft\Internet Explorer\Quick Launch\{username}
   • %System Root%\Python27\Lib\email\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0\{username}
   • %System Root%\Python27\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47\{username}.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\29\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\distlib\_backport\{username}
   • %All Users Profile%\VMware\RawdskCompatibility\native\{username}
   • %System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\updates\0\{username}
   • %System Root%\Users\All Users\Microsoft\Assistance\{username}
   • %System Root%\Python27\Lib\tkinter\{username}
   • %System Root%\Python27\include\boolobject.h.KEKW
   • %System Root%\Users\Default\AppData\Roaming\Media Center Programs\{username}
   • %AppDataLocal%\Google\Chrome\User Data\SSLErrorAssistant\7\_metadata\{username}
   • %System Root%\Python27\include\pyfpe.h.KEKW
   • %AppDataLocal%\pip\cache\http\f\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp.KEKW
   • %Desktop%\excel2k\XLS2KExx.xls.KEKW
   • %AppDataLocal%\Microsoft\Windows\AppCache\6A582BR6\container.dat.KEKW
   • %System Root%\Python27\Lib\tkinter\test\{username}
   • %Application Data%\Microsoft\Document Building Blocks\{username}
   • %AppDataLocal%\Microsoft\Windows\WER\{username}
   • %All Users Profile%\Microsoft\Search\Data\Temp\usgthrsvc\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\datareporting\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Tanspecks.jpg.KEKW
   • %AppDataLocal%\pip\cache\http\a\{username}
   • %System Root%\Python27\include\pystate.h.KEKW
   • %Application Data%\Sun\{username}
   • %AppDataLocal%\Google\Chrome\User Data\InterventionPolicyDatabase\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\GameExplorer\{username}.KEKW
   • %System Root%\Python27\Tools\versioncheck\{username}
   • %System Root%\Users\All Users\Microsoft\DRM\Server\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\10\{username}
   • %System Root%\Python27\tcl\tix8.4.3\bitmaps\plus.gif.KEKW
   • %System Root%\Users\Public\Downloads\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Tablet PC\{username}
   • %System Root%\Python27\include\moduleobject.h.KEKW
   • %Desktop%\excel2k\XLS2KE05.xls.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_internal\utils\{username}
   • %System Root%\Users\All Users\McAfee\MCLOGS\Common\SmallInstaller\{username}.KEKW
   • %System Root%\Users\Default\Saved Games\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp.KEKW
   • %AppDataLocal%Low\Microsoft\Windows\{username}
   • %AppDataLocal%\pip\cache\http\a\6\9\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_505c7fc25c7e5866de583f14c22e2b4c2a6018c_0a2493a7\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\{username}.KEKW
   • %System Root%\Python27\Lib\site-packages\pip\_internal\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\43\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01\{username}.KEKW
   • %Application Data%\Microsoft\AddIns\{username}
   • %Desktop%\excel2k\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Sand_Paper.jpg.KEKW
   • %AppDataLocal%\pip\cache\http\4\e\e\3\1\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\{username}
   • %System Root%\Python27\Lib\site-packages\PIL\{username}
   • %System Root%\Python27\include\cStringIO.h.KEKW
   • %Application Data%\Microsoft\Windows\IECompatCache\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\{username}.KEKW
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp.KEKW
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp.KEKW
   • %All Users Profile%\Microsoft\Windows\DeviceMetadataStore\en-US\{username}
   • %All Users Profile%\VMware\{username}
   • %System Root%\Users\Default\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\{username}
   • %AppDataLocal%\pip\cache\http\d\3\7\e\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\log\{username}
   • %All Users Profile%\Microsoft\RAC\{username}
   • %System Root%\Users\All Users\VMware\VMware Tools\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\chardet\cli\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\55\{username}
   • %User Profile%\Documents\excel2k\XLS2KE04.xls.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\euc_kr.txt.KEKW
   • %All Users Profile%\Microsoft\Windows NT\MSFax\SentItems\{username}
   • %System Root%\Email and Password List.js.KEKW
   • %System Root%\Users\All Users\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\{username}.KEKW
   • %All Users Profile%\Microsoft\eHome\{username}
   • %System Root%\PerfLogs\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\crashes\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp.KEKW
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp.KEKW
   • %All Users Profile%\Microsoft\RAC\StateData\{username}
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Queue\{username}
   • %System Root%\Users\Public\Documents\excel2k\XLS2KE03.xls.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\{username}.KEKW
   • %System Root%\Python27\Lib\idlelib\Icons\idle_16.gif.KEKW
   • %Application Data%\Microsoft\Windows\IECompatUACache\Low\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Templates\{username}.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_14.txt.KEKW
   • %System Root%\Python27\include\timefuncs.h.KEKW
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\{username}.KEKW
   • %AppDataLocal%\Apps\2.0\Data\RNQG94OQ.QJC\{username}
   • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Indexed Rules\25\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\{username}.KEKW
   • %AppDataLocal%Low\Microsoft\Internet Explorer\Services\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Sqm\Upload\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Network\Downloader\{username}.KEKW
   • %System Root%\Python27\tcl\tk8.5\images\{username}
   • %System Root%\Python27\Lib\lib2to3\{username}
   • %System Root%\Python27\Lib\site-packages\pkg_resources\extern\{username}
   • %System Root%\Users\All Users\{username}
   • %AppDataLocal%\Microsoft\Windows\WER\ReportQueue\{username}
   • %All Users Profile%\Microsoft\Search\Data\{username}
   • %AppDataLocal%\pip\cache\http\4\e\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\{username}
   • %System Root%\Python27\Lib\ctypes\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\colorama\{username}
   • %All Users Profile%\McAfee\MCLOGS\Common\{username}
   • %System Root%\Python27\Lib\multiprocessing\dummy\{username}
   • %Application Data%\Microsoft\Windows\IETldCache\Low\{username}
   • %System Root%\Python27\include\longobject.h.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\iso2022_jp.txt.KEKW
   • %System Root%\Python27\Lib\tkinter\test\test_ttk\{username}
   • %System Root%\Users\All Users\Oracle\Java\installcache_x64\{username}.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\euc_jisx0213-utf8.txt.KEKW
   • %AppDataLocal%\pip\cache\http\2\3\b\7\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_36.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\OFFICE\Groove\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\History\Service\{username}
   • %System Root%\Users\All Users\Microsoft\NetFramework\BreadcrumbStore\{username}.KEKW
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\{username}
   • %System Root%\Python27\include\classobject.h.KEKW
   • %System Root%\Users\Public\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp.KEKW
   • %System Root%\excel2k\XLS2KE03.xls.KEKW
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\{username}
   • %AppDataLocal%\pip\cache\http\4\e\e\{username}
   • %System Root%\Users\Default\Documents\{username}
   • %Application Data%\Microsoft\Word\{username}
   • %All Users Profile%\McAfee\MCLOGS\PartnerCustom\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\31\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_37.txt.KEKW
   • %System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\entry_points.txt.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\SwReporter\40.200.201.3\_metadata\{username}
   • %Application Data%\Microsoft\Windows\IECompatCache\Low\container.dat.KEKW
   • %Application Data%\Microsoft\Windows\SendTo\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\2LHHLFH6\{username}
   • %System Root%\Python27\tcl\tcl8.5\tzdata\Asia\{username}
   • %System Root%\Users\All Users\Microsoft\IlsCache\{username}.KEKW
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\{username}
   • %System Root%\Python27\Lib\logging\{username}
   • %AppDataLocal%\Apps\{username}
   • %All Users Profile%\{username}
   • %AppDataLocal%\Google\Chrome\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp.KEKW
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Config\{username}
   • %System Root%\excel2k\XLS2KExx.xls.KEKW
   • %System Root%\Users\Public\Desktop\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\_platform_specific\all\{username}
   • %System Root%\Users\All Users\Adobe\ARM\Reader_19.010.20099\{username}.KEKW
   • %AppDataLocal%\Microsoft\Windows\1024\{username}
   • %Application Data%\Microsoft\Office\Recent\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_12a.txt.KEKW
   • %System Root%\Users\Public\Documents\word2k\DOC2KExx.doc.KEKW
   • %AppDataLocal%\Google\{username}
   • %AppDataLocal%\pip\cache\http\3\8\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5\{username}
   • %System Root%\Python27\tcl\tcl8.5\opt0.4\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\{username}.KEKW
   • %System Root%\Python27\Tools\pynche\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\2\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Templates\{username}
   • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo150.gif.KEKW
   • %System Root%\Users\Default\AppData\Local\Microsoft\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\25\{username}
   • %System Root%\Users\All Users\Microsoft\RAC\Outbound\{username}
   • %System Root%\Python27\tcl\tcl8.5\tzdata\Atlantic\{username}
   • %All Users Profile%\VMware\VMware Tools\Unity Filters\adobeflashcs3.txt.KEKW
   • %AppDataLocal%\Microsoft\Media Player\Sync Playlists\{username}
   • %All Users Profile%\McAfee\MCLOGS\PartnerCustom\550F8967-2EE2-4F33-8E16-1BFFBE114803\{username}
   • %All Users Profile%\VMware\VMware Tools\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\Tiles\{username}
   • F:\wlines.zip.KEKW
   • %AppDataLocal%\Microsoft\Feeds\Microsoft Feeds~\{username}
   • %System Root%\Users\All Users\McAfee\MCLOGS\SmallInstaller\{username}
   • %System Root%\Python27\include\unicodeobject.h.KEKW
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\{username}.KEKW
   • %AppDataLocal%\Microsoft\Feeds Cache\NWKETFVL\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\CacheManager\{username}
   • %System Root%\Users\Public\Documents\word2k\DOC2KE04.doc.KEKW
   • %System Root%\Users\All Users\Microsoft\DRM\{username}.KEKW
   • %User Profile%\Documents\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F0\{username}
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\extensions\{username}
   • %System Root%\Python27\Lib\test\subprocessdata\{username}
   • %System Root%\Python27\Lib\test\audiodata\pluck-pcm32.wav.KEKW
   • %System Root%\Python27\include\codecs.h.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_31.txt.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\SwReporter\40.200.201.3\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\brndlog.txt.KEKW
   • %Application Data%\Mozilla\Firefox\{username}
   • %System Root%\powerpoint2k\PPT2KE04.ppt.KEKW
   • %AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\RJ6VBH4W.DN2\goog...app_9ae46cec200785df_0001.0003_7581c0cd83ac8659\{username}
   • %System Root%\Users\All Users\Microsoft\OFFICE\Groove\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp.KEKW
   • %System Root%\Python27\tcl\tix8.4.3\pref\Bisque.cs.KEKW
   • %Desktop%\powerpoint2k\PPT2KE05.ppt.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\{username}
   • %System Root%\powerpoint2k\PPT2KE02.ppt.KEKW
   • %System Root%\Python27\Lib\idlelib\Icons\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43\{username}
   • %AppDataLocal%\Microsoft\Windows\1033\StructuredQuerySchema.bin.KEKW
   • %Application Data%\Microsoft\Excel\{username}
   • %Application Data%\Microsoft\Spelling\{username}
   • %User Profile%\Documents\powerpoint2k\PPT2KE02.ppt.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\iso2022_kr-utf8.txt.KEKW
   • %All Users Profile%\Mozilla\{username}
   • %Application Data%\Sun\Java\Deployment\{username}
   • %AppDataLocal%\Microsoft\Feeds Cache\COOE7IBP\{username}
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\{username}
   • %AppDataLocal%\Microsoft\Windows\1033\{username}
   • %All Users Profile%\Microsoft\Windows NT\MSScan\{username}
   • %System Root%\Users\Public\Recorded TV\Sample Media\{username}
   • %All Users Profile%\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_72da1383309c93bd2441accd728cf953e4fa97a_0a24a840\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\2PEMJMIY\{username}
   • %System Root%\Python27\Lib\idlelib\Icons\idle_48.gif.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\{username}
   • %AppDataLocal%Low\Microsoft\Windows\AppCache\LY14JQYG\{username}
   • %System Root%\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\{username}
   • %System Root%\Users\All Users\Adobe\ARM\S\{username}.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_23.txt.KEKW
   • %AppDataLocal%\Microsoft\Office\ONetConfig\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\packaging\{username}
   • %System Root%\Users\All Users\Microsoft\RAC\Temp\{username}.KEKW
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\DATA\{username}
   • %AppDataLocal%\Microsoft\Feeds Cache\NKNYYDHU\{username}
   • %User Temp%\dd_vcredistUI0FD5.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\AIT\{username}.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\{username}
   • %System Root%\Users\All Users\Microsoft\NetFramework\{username}
   • %Application Data%\Microsoft\MMC\{username}
   • %User Profile%\Saved Games\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_32.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Media Player\{username}.KEKW
   • %AppDataLocal%Low\Microsoft\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\{username}.KEKW
   • %System Root%\Python27\Lib\email\mime\{username}
   • %System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\{username}.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\{username}
   • %Desktop%\Email and Password List.txt.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\gb2312.txt.KEKW
   • %System Root%\Python27\include\funcobject.h.KEKW
   • %AppDataLocal%\Microsoft\Internet Explorer\frameiconcache.dat.KEKW
   • %System Root%\Python27\Lib\sqlite3\test\{username}
   • %System Root%\Users\All Users\Oracle\Java\javapath\{username}.KEKW
   • %AppDataLocal%\Microsoft\Internet Explorer\{username}
   • %System Root%\Python27\Tools\pynche\X\rgb.txt.KEKW
   • %AppDataLocal%\Microsoft\Windows\WER\ReportArchive\{username}
   • %System Root%\Users\All Users\Adobe\ARM\S\{username}
   • %Application Data%\Mozilla\Firefox\Crash Reports\events\{username}
   • %All Users Profile%\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3\{username}
   • %All Users Profile%\Microsoft\Windows\Ringtones\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\tmp\si\{username}
   • %System Root%\Python27\Lib\bsddb\test\{username}
   • %AppDataLocal%\Mozilla\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\35\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Cave_Drawings.gif.KEKW
   • %AppDataLocal%\pip\cache\http\5\{username}
   • %All Users Profile%\McAfee\MCLOGS\Common\SmallInstaller\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Ringtones\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Resource\{username}
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0\{username}
   • %System Root%\Python27\Lib\test\imghdrdata\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Bears.jpg.KEKW
   • %System Root%\Python27\Lib\test\audiodata\pluck-pcm24.wav.KEKW
   • %System Root%\Python27\Lib\idlelib\Icons\python.gif.KEKW
   • %System Root%\Python27\tcl\tix8.4.3\bitmaps\file.gif.KEKW
   • %System Root%\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.KEKW
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\gmp\WINNT_x86_64-msvc\{username}
   • %System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\top_level.txt.KEKW
   • %Application Data%\Media Center Programs\{username}
   • %Application Data%\Microsoft\Protect\S-1-5-21-2407829820-1079796033-203259571-500\{username}
   • %AppDataLocal%\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\{username}
   • %Desktop%\word2k\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0\{username}.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\pnacl\0.57.44.2492\_metadata\{username}
   • %System Root%\$Recycle.Bin\S-1-5-21-2407829820-1079796033-203259571-500\$IC8HJH8.zip.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\49\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\DeviceMetadataStore\{username}.KEKW
   • %System Root%\Users\Default\Pictures\{username}
   • %Application Data%\Macromedia\Flash Player\#SharedObjects\{username}
   • %System Root%\Python27\include\pyport.h.KEKW
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\prefs.js.KEKW
   • %System Root%\Users\All Users\Microsoft\eHome\{username}.KEKW
   • %System Root%\Python27\tcl\tk8.5\demos\images\earthris.gif.KEKW
   • %AppDataLocal%\pip\cache\http\b\a\9\3\{username}
   • %System Root%\Python27\Lib\lib2to3\pgen2\{username}
   • %System Root%\powerpoint2k\PPT2KE01.ppt.KEKW
   • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE03.ppt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Python 2.7\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\{username}
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\{username}.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\ActivityLog\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\{username}
   • %User Profile%\Documents\excel2k\XLS2KE03.xls.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\{username}.KEKW
   • %AppDataLocal%\pip\cache\http\0\2\5\2\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Java\{username}.KEKW
   • %System Root%\Python27\include\asdl.h.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows NT\{username}
   • %System Root%\Users\All Users\Microsoft\Search\Data\{username}.KEKW
   • %Desktop%\excel2k\XLS2KE04.xls.KEKW
   • %System Root%\Users\Public\Documents\{username}
   • %AppDataLocal%\Microsoft\Windows\WebCache\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Java\{username}
   • %System Root%\Users\All Users\Mozilla\{username}.KEKW
   • %All Users Profile%\Microsoft\Vault\{username}
   • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieSiteList\container.dat.KEKW
   • %User Profile%\Documents\excel2k\XLS2KE05.xls.KEKW
   • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\{username}.KEKW
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Blue_Gradient.jpg.KEKW
   • %System Root%\Python27\Lib\distutils\{username}
   • %User Temp%\dd_wcf_CA_smci_20161212_135109_353.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Python 2.7\{username}.KEKW
   • %Desktop%\note.txt.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\13\{username}
   • %AppDataLocal%\Google\Chrome\User Data\pnacl\0.57.44.2492\_platform_specific\{username}
   • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\{username}
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\{username}
   • %All Users Profile%\Microsoft\OFFICE\DATA\{username}
   • %Desktop%\Email and Password List.js.KEKW
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\gmp\{username}
   • %All Users Profile%\Microsoft\Windows NT\MSFax\Common Coverpages\{username}
   • %All Users Profile%\Microsoft Help\{username}
   • %AppDataLocal%\pip\cache\http\7\e\9\{username}
   • %System Root%\Python27\include\pygetopt.h.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\44\{username}
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Quick\{username}.KEKW
   • %System Root%\Python27\Lib\site-packages\Pillow-6.0.0.dist-info\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_17.txt.KEKW
   • %System Root%\Python27\Lib\test\leakers\README.txt.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_38.txt.KEKW
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\White_Chocolate.jpg.KEKW
   • %Application Data%\Microsoft\Excel\XLSTART\{username}
   • %AppDataLocal%\pip\cache\{username}
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\{username}.KEKW
   • %Application Data%\Microsoft\SystemCertificates\My\{username}
   • %System Root%\Python27\include\pythread.h.KEKW
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\DRM\Cache\{username}.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_21.txt.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\36\{username}
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\{username}
   • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp.KEKW
   • %AppDataLocal%\Microsoft\Office\Groove\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Peacock.jpg.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Indexed Rules\{username}
   • %System Root%\Users\{username}\AppData\Roaming\Microsoft\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_72da1383309c93bd2441accd728cf953e4fa97a_0a24a840\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Quarantine\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\32\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\{username}.KEKW
   • %System Root%\Users\Public\Documents\excel2k\XLS2KE04.xls.KEKW
   • %System Root%\Python27\tcl\tcl8.5\tzdata\Pacific\{username}
   • %System Root%\Users\Default\Music\{username}
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\DATA\{username}.KEKW
   • %AppDataLocal%\Microsoft\Windows\Explorer\{username}
   • %System Root%\Python27\Lib\test\test_doctest4.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows\Caches\{username}.KEKW
   • %System Root%\Python27\tcl\tix8.4.3\pref\SGIGray.cs.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\{username}
   • %System Root%\Python27\include\code.h.KEKW
   • %System Root%\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\{username}.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95\{username}
   • %System Root%\Python27\tcl\tix8.4.3\bitmaps\textfile.gif.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\PepperFlash\32.0.0.171\_metadata\{username}
   • %System Root%\Python27\include\enumobject.h.KEKW
   • %System Root%\Users\Default\Downloads\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Sqm\Sessions\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Sqm\Manifest\{username}
   • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\550F8967-2EE2-4F33-8E16-1BFFBE114803\{username}.KEKW
   • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\{username}
   • %System Root%\Python27\Lib\idlelib\HISTORY.txt.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\johab.txt.KEKW
   • %System Root%\Python27\include\py_curses.h.KEKW
   • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\thumbnails\{username}
   • %System Root%\Python27\Lib\compiler\{username}
   • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\1D\{username}
   • %System Root%\Python27\tcl\tk8.5\demos\images\{username}
   • %System Root%\Python27\include\pgen.h.KEKW
   • %System Root%\Python27\Lib\test\crashers\{username}
   • %AppDataLocal%\Python-Eggs\Python-Eggs\{username}
   • %System Root%\Python27\include\pydebug.h.KEKW
   • %AppDataLocal%\Google\Chrome\User Data\PepperFlash\32.0.0.171\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_internal\vcs\{username}
   • %Application Data%\Microsoft\Windows\PrivacIE\Low\{username}
   • %User Temp%\CR_E83EE.tmp\{username}
   • %System Root%\Python27\include\patchlevel.h.KEKW
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\{username}
   • %System Root%\Users\Public\Music\Sample Music\Sleep Away.mp3.KEKW
   • %System Root%\Python27\Lib\encodings\{username}
   • %System Root%\Python27\Lib\site-packages\setuptools\_vendor\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_26.txt.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\53\{username}
   • %User Profile%\{username}
   • %System Root%\Users\All Users\Microsoft\eHome\logs\{username}.KEKW
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\28\{username}
   • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\{username}
   • %AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\_platform_specific\all\sths\{username}
   • %System Root%\Python27\Tools\pynche\X\{username}
   • %System Root%\Users\All Users\Microsoft\WwanSvc\{username}
   • %System Root%\Users\All Users\Microsoft\Network\{username}
   • %AppDataLocal%Low\Sun\{username}
   • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\{username}
   • %System Root%\Python27\Tools\pynche\X\xlicense.txt.KEKW
   • %All Users Profile%\Microsoft\Windows Defender\Definition Updates\{0E1465B0-BA9C-409F-BC32-D934317129CD}\{username}
   • %System Root%\Python27\tcl\tix8.4.3\demos\samples\{username}
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp.KEKW
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp.KEKW
   • %System Root%\Python27\include\pystrcmp.h.KEKW
   • %System Root%\Python27\tcl\tcl8.5\tzdata\Brazil\{username}
   • %System Root%\Users\Public\Videos\Sample Videos\{username}
   • %AppDataLocal%\Google\Chrome\User Data\MEIPreload\{username}
   • %AppDataLocal%\Microsoft\Windows\AppCache\container.dat.KEKW
   • %System Root%\Python27\Lib\site-packages\README.txt.KEKW
   • %System Root%\Python27\include\bytesobject.h.KEKW
   • %AppDataLocal%\Microsoft\Windows\AppCache\{username}
   • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\24\{username}
   • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\{username}
   • %System Root%\Python27\tcl\tcl8.5\tzdata\America\{username}
   • %System Root%\Users\{username}\AppData\Local\Microsoft\Media Player\{username}
   • %All Users Profile%\Mozilla\updates\308046B0AF4A39CB\{username}
   • %System Root%\Python27\tcl\tcl8.5\tzdata\America\North_Dakota\{username}
   • %AppDataLocal%\Apps\2.0\Data\RNQG94OQ.QJC\E1WGPJBQ.PMC\goog...app_9ae46cec200785df_0001.0003_7581c0cd83ac8659\Data\{username}
   • %System Root%\Users\All Users\Microsoft\RAC\StateData\RacMetaData.dat.KEKW
   • %System Root%\Users\Public\Pictures\Sample Pictures\Penguins.jpg.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\{username}
   • %Application Data%\Microsoft\Word\STARTUP\{username}
   • %System Root%\Python27\Lib\test\test_doctest3.txt.KEKW
   • %System Root%\Python27\Lib\site-packages\pythonnet-2.1.0.dist-info\top_level.txt.KEKW
   • %System Root%\Users\{username}
   • %System Root%\Users\Public\Documents\excel2k\XLS2KE02.xls.KEKW
   • %System Root%\Users\All Users\Microsoft\Device Stage\{username}.KEKW
   • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp.KEKW
   • %AppDataLocal%\Microsoft\Feeds Cache\8TQ1M9OZ\{username}
   • %Application Data%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\{username}
   • %Desktop%\excel2k\XLS2KE03.xls.KEKW
   • %Application Data%\Microsoft\Windows\DNTException\container.dat.KEKW
   • %System Root%\Python27\include\pyctype.h.KEKW
   • %System Root%\Python27\Lib\test\cjkencodings\gb18030.txt.KEKW
   • %System Root%\Python27\Lib\xml\sax\{username}
   • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Monet.jpg.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_44.txt.KEKW
   • %Application Data%\Mozilla\Extensions\{username}
   • %AppDataLocal%\pip\cache\http\5\4\3\d\{username}
   • %System Root%\Users\All Users\Microsoft\Vault\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_29.txt.KEKW
   • %System Root%\Python27\Lib\email\test\data\msg_45.txt.KEKW
   • %System Root%\Users\All Users\Microsoft\RAC\StateData\RacWmiEventData.dat.KEKW
   • %System Root%\Python27\Lib\distutils\tests\{username}
   • %AppDataLocal%\Microsoft\Internet Explorer\EmieUserList\{username}
   • %System Root%\Python27\Lib\site-packages\pip\_vendor\pkg_resources\{username}
   • %System Root%\Python27\Lib\test\audiodata\pluck-pcm16.wav.KEKW
   • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\{username}.KEKW
   • %AppDataLocal%\pip\cache\http\3\8\9\{username}
   • %User Profile%\AppData\{username}
   • %System Root%\Python27\Lib\email\test\data\msg_13.txt.KEKW