Plataforma:

Windows

 Riesgo general:
 Potencial de destrucción:
 Potencial de distribución:
 Infección divulgada:
 Impacto en el sistema :
 Revelación de la información:
Bajo
Medio
High
Crítico

  • Tipo de malware
    Trojan Spy

  • Destructivo?
    No

  • Cifrado
     

  • In the Wild:

  Resumen y descripción

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Elimina archivos para impedir la ejecución correcta de programas y aplicaciones.

  Detalles técnicos

Tamaño del archivo 8,704 bytes
Tipo de archivo EXE
Residente en memoria
Fecha de recepción de las muestras iniciales 26 Mar 2020

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Agrega los procesos siguientes:

  • notepad.exe {username}

Técnica de inicio automático

Este malware infiltra el/los archivo(s) siguiente(s) en la carpeta de inicio del usuario de Windows para permitir su ejecución automática cada vez que se inicia el sistema:

  • %User Startup%\{username}

(Nota: %User Startup% es la carpeta Inicio del usuario activo, que en el caso de Windows 98 y ME suele estar en C:\Windows\Profiles\{nombre de usuario}\Menú Inicio\Programas\Inicio, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}\Menú Inicio\Programas\Inicio, en el caso de Windows 2003(32-bit), XP y 2000(32-bit) en C:\Documents and Settings\{nombre de usuario}\Menú Inicio\Programas\Inicio y en en el caso de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup).

)

Otras modificaciones del sistema

Elimina los archivos siguientes:

  • %System Root%\Python27\Lib\email\test\data\msg_39.txt
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp
  • %System Root%\Python27\Lib\test\cjkencodings\johab.txt
  • %User Profile%\Documents\excel2k\XLS2KE03.xls
  • %System Root%\Python27\include\datetime.h
  • %System Root%\Python27\include\abstract.h
  • %System Root%\Python27\include\patchlevel.h
  • %System Root%\Python27\Lib\test\cjkencodings\cp949.txt
  • %System Root%\Python27\Lib\test\cjkencodings\shift_jis-utf8.txt
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\HandPrints.jpg
  • %System Root%\Python27\Lib\email\test\data\msg_18.txt
  • %System Root%\Python27\Lib\test\leakers\README.txt
  • %System Root%\Python27\Lib\email\test\data\msg_38.txt
  • %System Root%\Python27\include\sysmodule.h
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Notebook.jpg
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp
  • %System Root%\Python27\include\dtoa.h
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp
  • %System Root%\Python27\Lib\test\cjkencodings\gb18030-utf8.txt
  • %System Root%\Python27\tcl\tix8.4.3\pref\Blue.cs
  • F:\data\photos\stunning.jpg
  • %System Root%\Python27\include\graminit.h
  • %System Root%\Python27\include\cellobject.h
  • %System Root%\Python27\tcl\tix8.4.3\pref\WmDefault.cs
  • %System Root%\Python27\Lib\email\test\data\msg_05.txt
  • F:\data\photos\long_exposure.jpg
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\adobeflashcs3.txt
  • %System Root%\Users\Public\Pictures\Sample Pictures\Tulips.jpg
  • %System Root%\Python27\Lib\test\test_doctest4.txt
  • %User Temp%\jawshtml.html
  • %System Root%\Python27\Lib\test\cjkencodings\iso2022_jp-utf8.txt
  • %Desktop%\word2k\DOC2KE01.doc
  • %AppDataLocal%\Microsoft\Internet Explorer\MSIMGSIZ.DAT
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp
  • %System Root%\Python27\include\descrobject.h
  • %System Root%\Python27\Lib\idlelib\Icons\tk.gif
  • %System Root%\Python27\tcl\tk8.5\images\logoMed.gif
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Peacock.jpg
  • %User Temp%\dd_vcredistMSI0FD5.txt
  • %Desktop%\Transmag.doc
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\pkcs11.txt
  • %System Root%\Python27\Lib\test\imghdrdata\python.bmp
  • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\container.dat
  • %Desktop%\excel2k\XLS2KE04.xls
  • %System Root%\Python27\tcl\tk8.5\demos\images\earth.gif
  • %User Temp%\dd_NDP452-KB2901907-x86-x64-AllOS-ENU_decompression_log.txt
  • %System Root%\Python27\include\ast.h
  • %System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\top_level.txt
  • %System Root%\Python27\Lib\test\sgml_input.html
  • %System Root%\Users\Public\Pictures\Sample Pictures\Desert.jpg
  • %System Root%\Python27\include\genobject.h
  • %System Root%\Python27\include\fileobject.h
  • %System Root%\Python27\Lib\test\zipdir.zip
  • %User Profile%\Documents\word2k\DOC2KE03.doc
  • %System Root%\Python27\include\compile.h
  • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KExx.PPT
  • %System Root%\Python27\Tools\pynche\webcolors.txt
  • %All Users Profile%\Microsoft\Windows\Power Efficiency Diagnostics\energy-report.html
  • %User Profile%\Documents\powerpoint2k\PPT2KE01.ppt
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp
  • %System Root%\Python27\Lib\email\test\data\msg_04.txt
  • %Desktop%\excel2k\XLS2KE05.xls
  • %System Root%\Python27\Lib\site-packages\Pillow-6.0.0.dist-info\top_level.txt
  • %System Root%\Python27\Lib\email\test\data\msg_12.txt
  • %System Root%\excel2k\XLS2KE01.xls
  • %System Root%\Python27\include\marshal.h
  • %System Root%\Python27\Lib\test\test_doctest2.txt
  • %System Root%\Python27\Lib\email\test\data\msg_42.txt
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\TRRBlacklist.txt
  • %System Root%\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg
  • %Desktop%\word2k\DOC2KE05.doc
  • %Application Data%\Microsoft\Windows\IECompatUACache\Low\container.dat
  • %System Root%\Python27\include\pymath.h
  • %System Root%\Python27\Lib\test\imghdrdata\python.gif
  • %System Root%\Python27\Lib\email\test\data\msg_37.txt
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\file.gif
  • %System Root%\Python27\include\object.h
  • %System Root%\Python27\include\pyctype.h
  • %System Root%\Python27\tcl\tix8.4.3\pref\SGIGray.cs
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\srcfile.gif
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\LastBld.dat
  • %System Root%\Python27\Lib\test\exception_hierarchy.txt
  • %System Root%\Users\All Users\Microsoft\RAC\StateData\RacWmiDataBookmarks.dat
  • %All Users Profile%\Microsoft\Network\Downloader\qmgr0.dat
  • %AppDataLocal%\Microsoft\Internet Explorer\tabiconcache.dat
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp
  • %System Root%\Users\Public\Documents\excel2k\XLS2KE03.xls
  • %System Root%\Python27\include\pystrcmp.h
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp
  • %System Root%\powerpoint2k\PPT2KExx.PPT
  • %System Root%\Python27\include\symtable.h
  • %System Root%\Python27\Lib\email\test\data\msg_14.txt
  • %AppDataLocal%\Microsoft\Windows\AppCache\6A582BR6\container.dat
  • %System Root%\Python27\include\ucnhash.h
  • %System Root%\Python27\include\weakrefobject.h
  • %System Root%\excel2k\XLS2KE05.xls
  • %User Profile%\Documents\powerpoint2k\PPT2KE03.ppt
  • %System Root%\Python27\Lib\email\test\data\msg_10.txt
  • %All Users Profile%\Microsoft\Windows Defender\Scans\History\CacheManager\MpSfc.bin
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Monet.jpg
  • %System Root%\Python27\Tools\versioncheck\README.txt
  • %System Root%\Users\Public\Documents\Email and Password List.txt
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg
  • %System Root%\Python27\include\import.h
  • %System Root%\Python27\Lib\email\test\data\msg_41.txt
  • %System Root%\Python27\Lib\idlelib\help.html
  • %AppDataLocal%\Microsoft\Windows\WebCache\WebCacheV01.dat
  • %System Root%\Python27\Lib\test\cjkencodings\big5-utf8.txt
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache.bin
  • %System Root%\Python27\Lib\email\test\data\msg_17.txt
  • %AppDataLocal%\Microsoft\Windows\WebCacheLock.dat
  • %System Root%\Python27\include\floatobject.h
  • %System Root%\Python27\Lib\email\test\data\msg_08.txt
  • %User Temp%\Microsoft .NET Framework 4.5.2 Setup_20161212_135033207-MSI_netfx_Full_GDR_x64.msi.txt
  • %System Root%\Python27\Lib\idlelib\Icons\openfolder.gif
  • %System Root%\word2k\DOC2KE03.doc
  • %System Root%\Python27\Lib\test\imghdrdata\python.jpg
  • %Application Data%\Microsoft\Windows\IEDownloadHistory\container.dat
  • %System Root%\Python27\Lib\test\ieee754.txt
  • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo200.gif
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\SiteSecurityServiceState.txt
  • %System Root%\Python27\Lib\idlelib\TODO.txt
  • %System Root%\Python27\include\pystate.h
  • %System Root%\Python27\Lib\email\test\data\msg_31.txt
  • %System Root%\Python27\include\pyerrors.h
  • %System Root%\Python27\include\boolobject.h
  • %System Root%\Python27\Lib\email\test\data\msg_03.txt
  • %System Root%\Python27\include\sliceobject.h
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\AlternateServices.txt
  • %User Profile%\Documents\word2k\DOC2KE01.doc
  • %System Root%\Python27\include\timefuncs.h
  • %System Root%\Python27\include\pythread.h
  • %System Root%\Python27\include\pgenheaders.h
  • %All Users Profile%\Microsoft\Network\Downloader\qmgr1.dat
  • %System Root%\Users\Public\Documents\word2k\DOC2KE02.doc
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp
  • %System Root%\Python27\Lib\test\tokenize_tests.txt
  • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE01.ppt
  • %System Root%\Python27\include\node.h
  • %System Root%\Python27\tcl\tix8.4.3\pref\Gray.cs
  • %System Root%\Python27\include\pyexpat.h
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\prefs.js
  • %User Profile%\Documents\powerpoint2k\PPT2KE04.ppt
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\visualstudio2005.txt
  • %System Root%\Python27\Lib\idlelib\Icons\idle_48.gif
  • %System Root%\Python27\include\unicodeobject.h
  • %AppDataLocal%\Microsoft\Windows\AppCache\container.dat
  • %System Root%\Python27\Lib\email\test\data\msg_32.txt
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\textfile.gif
  • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE03.ppt
  • %Desktop%\powerpoint2k\PPT2KE03.ppt
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Connectivity.gif
  • %System Root%\Python27\Lib\email\test\data\msg_01.txt
  • %Application Data%\Microsoft\Windows\IETldCache\container.dat
  • %System Root%\Python27\Lib\email\test\data\msg_30.txt
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg
  • %User Temp%\dd_SetupUtility.txt
  • %AppDataLocal%Low\Microsoft\Windows\AppCache\LY14JQYG\container.dat
  • %System Root%\Python27\tcl\tk8.5\images\logo100.gif
  • %System Root%\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
  • %System Root%\Python27\include\Python.h
  • %System Root%\Python27\include\parsetok.h
  • %System Root%\Python27\include\pymacconfig.h
  • %System Root%\Users\Public\Documents\word2k\DOC2KE01.doc
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\plusarm.gif
  • %System Root%\Python27\Lib\test\audiodata\pluck-pcm32.wav
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Pine_Lumber.jpg
  • %User Profile%\Documents\excel2k\XLS2KE02.xls
  • %System Root%\Users\Public\Pictures\Sample Pictures\Koala.jpg
  • %System Root%\Python27\include\bufferobject.h
  • %System Root%\Python27\Lib\email\test\data\msg_13.txt
  • %System Root%\Python27\include\bytesobject.h
  • %User Temp%\dd_wcf_CA_smci_20161212_135110_351.txt
  • %System Root%\Python27\include\classobject.h
  • %System Root%\Users\Public\Documents\word2k\DOC2KExx.doc
  • %System Root%\Python27\Lib\test\cjkencodings\gb2312.txt
  • %System Root%\Python27\include\osdefs.h
  • %System Root%\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
  • %System Root%\Python27\Tools\pynche\websafe.txt
  • %System Root%\Python27\include\pyport.h
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp
  • %Desktop%\excel2k\XLS2KE01.xls
  • %System Root%\word2k\DOC2KE04.doc
  • %Application Data%\Microsoft\Windows\IECompatUACache\container.dat
  • %System Root%\powerpoint2k\PPT2KE04.ppt
  • %System Root%\Python27\include\bytearrayobject.h
  • %System Root%\Python27\include\Python-ast.h
  • %System Root%\Python27\include\ceval.h
  • %System Root%\Python27\include\longobject.h
  • %User Temp%\Microsoft .NET Framework 4.5.2 Setup_20161212_135033207.html
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp
  • %System Root%\Python27\tcl\tk8.5\images\logo64.gif
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\SecurityPreloadState.txt
  • %System Root%\Python27\include\pystrtod.h
  • %AppDataLocal%\Microsoft\Windows\1033\StructuredQuerySchema.bin
  • %System Root%\Python27\Tools\pynche\X\rgb.txt
  • %System Root%\Python27\include\eval.h
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp
  • %System Root%\$Recycle.Bin\S-1-5-21-2407829820-1079796033-203259571-500\$IC8HJH8.zip
  • %System Root%\powerpoint2k\PPT2KE03.ppt
  • %System Root%\Python27\Lib\test\cjkencodings\hz-utf8.txt
  • %System Root%\Python27\Lib\test\test_doctest3.txt
  • %AppDataLocal%\GDIPFONTCACHEV1.DAT
  • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieSiteList\container.dat
  • %System Root%\Python27\include\pgen.h
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp
  • %System Root%\Python27\Lib\email\test\data\msg_36.txt
  • %System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\LICENSE.txt
  • %System Root%\Users\Public\Documents\word2k\DOC2KE04.doc
  • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo150.gif
  • %System Root%\Python27\Lib\idlelib\Icons\plusnode.gif
  • %System Root%\Python27\Lib\email\test\data\msg_19.txt
  • %User Profile%\Documents\word2k\DOC2KE05.doc
  • %Application Data%\Microsoft\Windows\IECompatCache\Low\container.dat
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Stucco.gif
  • %System Root%\Python27\include\stringobject.h
  • %System Root%\Python27\README.txt
  • %System Root%\Python27\Lib\email\test\data\msg_09.txt
  • %System Root%\Python27\include\tupleobject.h
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\urlCache.bin
  • %Desktop%\powerpoint2k\PPT2KExx.PPT
  • %User Profile%\Documents\excel2k\XLS2KExx.xls
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp
  • %System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\entry_points.txt
  • %System Root%\Python27\Lib\test\cjkencodings\gbk-utf8.txt
  • %Application Data%\Microsoft\Windows\IECompatCache\container.dat
  • %System Root%\word2k\DOC2KE02.doc
  • %System Root%\Python27\Lib\email\test\data\msg_12a.txt
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Psychedelic.jpg
  • %System Root%\Python27\Lib\idlelib\README.txt
  • %System Root%\Python27\Lib\test\imghdrdata\python.png
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\vistasidebar.txt
  • %System Root%\Python27\Lib\test\testtar.tar
  • %System Root%\Users\Public\Music\Sample Music\Kalimba.mp3
  • %System Root%\Python27\Lib\idlelib\help.txt
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\warning.gif
  • %System Root%\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
  • %System Root%\Python27\include\pycapsule.h
  • %System Root%\Python27\Lib\test\cjkencodings\euc_jp.txt
  • %System Root%\Python27\include\bitset.h
  • %System Root%\Python27\include\errcode.h
  • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieUserList\container.dat
  • %System Root%\Python27\Lib\email\test\data\msg_46.txt
  • %AppDataLocal%\Microsoft\Internet Explorer\frameiconcache.dat
  • %System Root%\Python27\include\structmember.h
  • %Desktop%\word2k\DOC2KExx.doc
  • %User Temp%\Guest.bmp
  • %System Root%\Python27\Lib\email\test\data\msg_06.txt
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\SoftBlue.jpg
  • %System Root%\Python27\Lib\idlelib\Icons\minusnode.gif
  • %System Root%\Python27\include\code.h
  • %System Root%\Users\Public\Documents\excel2k\XLS2KE01.xls
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp
  • %User Temp%\dd_wcf_CA_smci_20161212_135109_353.txt
  • %AppDataLocal%\Microsoft\Internet Explorer\EmieBrowserModeList\container.dat
  • %User Profile%\Documents\word2k\DOC2KE04.doc
  • %System Root%\Python27\tcl\tix8.4.3\pref\TK.cs
  • %System Root%\Python27\Tools\pynche\namedcolors.txt
  • %System Root%\Users\Public\Documents\excel2k\XLS2KE05.xls
  • %System Root%\Python27\Lib\test\floating_points.txt
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\minus.gif
  • %System Root%\Python27\Lib\idlelib\Icons\folder.gif
  • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\{AD285A8B-713F-11E9-85F8-005056BC44A9}.dat
  • %User Profile%\Documents\excel2k\XLS2KE05.xls
  • %System Root%\Python27\Lib\email\test\data\msg_21.txt
  • %System Root%\Python27\include\moduleobject.h
  • %System Root%\Python27\Lib\test\audiodata\pluck-pcm16.wav
  • %System Root%\Users\Public\Documents\excel2k\XLS2KE04.xls
  • %System Root%\Python27\Lib\test\cjkencodings\iso2022_kr-utf8.txt
  • %Desktop%\excel2k\XLS2KE03.xls
  • %System Root%\Python27\include\metagrammar.h
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp
  • %System Root%\excel2k\XLS2KE02.xls
  • %System Root%\Python27\Lib\email\test\data\msg_29.txt
  • %User Profile%\Documents\fp_18.0.0.203_archive.zip
  • %Desktop%\Email and Password List.js
  • %System Root%\Python27\Lib\email\test\data\msg_35.txt
  • %System Root%\Python27\Lib\test\cjkencodings\euc_kr-utf8.txt
  • %System Root%\Python27\include\objimpl.h
  • %All Users Profile%\VMware\VMware Tools\manifest.txt
  • %System Root%\Python27\include\py_curses.h
  • %Desktop%\excel2k\XLS2KE02.xls
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp
  • %System Root%\word2k\DOC2KExx.doc
  • %All Users Profile%\Microsoft\User Account Pictures\{username}.dat
  • %System Root%\word2k\DOC2KE05.doc
  • %System Root%\Python27\Tools\webchecker\README.txt
  • %System Root%\Python27\Lib\email\test\data\msg_20.txt
  • %All Users Profile%\Microsoft\Windows Defender\Scans\mpcache-B1C01FED9F08520A4647901EFB883A6A3B247F8D.bin
  • %System Root%\Python27\Lib\email\test\data\msg_24.txt
  • %System Root%\Python27\Tools\pynche\X\xlicense.txt
  • %System Root%\Python27\Lib\test\cjkencodings\gbk.txt
  • %System Root%\Python27\include\token.h
  • %System Root%\Python27\include\pyconfig.h
  • %System Root%\Python27\include\intrcheck.h
  • %System Root%\Python27\Lib\test\cjkencodings\hz.txt
  • %System Root%\Python27\Lib\idlelib\extend.txt
  • %System Root%\Python27\Lib\test\cjkencodings\iso2022_jp.txt
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\White_Chocolate.jpg
  • %Desktop%\Email and Password List.txt
  • %System Root%\Python27\Lib\test\cjkencodings\euc_kr.txt
  • %System Root%\Python27\Lib\email\test\data\msg_22.txt
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp
  • %System Root%\Python27\Lib\lib2to3\Grammar.txt
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp
  • %System Root%\excel2k\XLS2KE04.xls
  • %System Root%\Python27\include\modsupport.h
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Stars.jpg
  • %User Temp%\dd_vcredistUI0FD5.txt
  • %System Root%\Python27\Tools\Scripts\README.txt
  • %System Root%\Python27\Lib\test\cjkencodings\big5.txt
  • %System Root%\Python27\Lib\idlelib\Icons\python.gif
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\vmwarefilters.txt
  • %System Root%\Python27\include\pyarena.h
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\folder.gif
  • %Application Data%\Microsoft\Windows\DNTException\container.dat
  • %Desktop%\word2k\DOC2KE02.doc
  • %System Root%\Python27\Lib\test\cjkencodings\big5hkscs-utf8.txt
  • %System Root%\Python27\LICENSE.txt
  • %System Root%\Python27\include\longintrepr.h
  • %System Root%\Python27\include\rangeobject.h
  • %System Root%\Python27\tcl\tix8.4.3\pref\Bisque.cs
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Roses.jpg
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\urlCache-current.bin
  • %System Root%\Python27\Lib\test\test_doctest.txt
  • %System Root%\Email and Password List.txt
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg
  • %System Root%\Python27\include\memoryobject.h
  • %System Root%\Users\Public\Documents\Email and Password List.js
  • %System Root%\Python27\Lib\email\test\data\msg_16.txt
  • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.1\LICENSE.txt
  • %AppDataLocal%\Microsoft\Windows\History\Low\History.IE5\container.dat
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp
  • %System Root%\Python27\include\pyfpe.h
  • %System Root%\Python27\tcl\tix8.4.3\demos\bitmaps\tix.gif
  • %System Root%\Python27\Lib\test\cjkencodings\euc_jisx0213.txt
  • %System Root%\Python27\include\intobject.h
  • %System Root%\Python27\include\pygetopt.h
  • %System Root%\Python27\Lib\test\cjkencodings\gb2312-utf8.txt
  • %System Root%\Python27\include\structseq.h
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\openfold.gif
  • %System Root%\Python27\Lib\idlelib\CREDITS.txt
  • %System Root%\Python27\Lib\test\audiodata\pluck-pcm8.wav
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\microsoftoffice2003.txt
  • %System Root%\Python27\tcl\tk8.5\images\logoLarge.gif
  • %System Root%\Users\All Users\Microsoft\RAC\StateData\RacMetaData.dat
  • %System Root%\Python27\include\traceback.h
  • %System Root%\Python27\Lib\email\test\data\msg_23.txt
  • %System Root%\Python27\Lib\email\test\data\msg_44.txt
  • %All Users Profile%\Microsoft\Windows NT\MSScan\WelcomeScan.jpg
  • %User Profile%\Documents\powerpoint2k\PPT2KExx.PPT
  • %System Root%\Python27\Lib\email\test\data\msg_25.txt
  • %System Root%\Python27\Lib\test\cjkencodings\gb18030.txt
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Tiki.gif
  • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo175.gif
  • %System Root%\Python27\Lib\test\cjkencodings\johab-utf8.txt
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Blue_Gradient.jpg
  • %System Root%\Python27\Lib\test\cjkencodings\euc_jp-utf8.txt
  • %System Root%\Python27\include\grammar.h
  • %Desktop%\powerpoint2k\PPT2KE04.ppt
  • %User Profile%\Documents\excel2k\XLS2KE01.xls
  • %System Root%\powerpoint2k\PPT2KE01.ppt
  • %AppDataLocal%\Microsoft\Internet Explorer\UrlBlockManager\urlblocklist.bin
  • %User Profile%\Documents\Email and Password List.js
  • %System Root%\Python27\Lib\email\test\data\msg_15.txt
  • %User Profile%\Documents\Email and Password List.txt
  • %System Root%\Python27\Lib\idlelib\idle_test\README.txt
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\minusarm.gif
  • %System Root%\Python27\include\pymactoolbox.h
  • %System Root%\Python27\include\pymem.h
  • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{4555A5E7-C06D-11E6-8AB1-005056BC3E18}.dat
  • %User Temp%\dd_vcredistMSI0FC1.txt
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Pretty_Peacock.jpg
  • %System Root%\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp
  • %System Root%\Python27\Lib\email\test\data\msg_34.txt
  • %System Root%\Python27\include\opcode.h
  • %AppDataLocal%\Microsoft\Internet Explorer\EmieUserList\container.dat
  • %System Root%\Python27\include\pydebug.h
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\no_entry.gif
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Sand_Paper.jpg
  • %Desktop%\powerpoint2k\PPT2KE01.ppt
  • %System Root%\Python27\include\dictobject.h
  • %System Root%\Python27\Lib\site-packages\README.txt
  • F:\wlines.zip
  • %System Root%\Python27\include\frameobject.h
  • %System Root%\Python27\tcl\tk8.5\demos\images\earthris.gif
  • %All Users Profile%\Microsoft\User Account Pictures\user.bmp
  • %User Profile%\Documents\powerpoint2k\PPT2KE05.ppt
  • %All Users Profile%\Microsoft\Windows\DRM\blackbox.bin
  • %System Root%\Python27\NEWS.txt
  • %System Root%\Python27\tcl\tk8.5\images\tai-ku.gif
  • %System Root%\Python27\Tools\pynche\README.txt
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp
  • %System Root%\word2k\DOC2KE01.doc
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\act_fold.gif
  • %System Root%\Python27\include\warnings.h
  • %System Root%\Python27\Lib\lib2to3\PatternGrammar.txt
  • %System Root%\Python27\Lib\test\cjkencodings\shift_jisx0213.txt
  • %System Root%\Python27\Tools\pynche\html40colors.txt
  • %System Root%\Python27\Lib\idlelib\Icons\idle_16.gif
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp
  • %System Root%\excel2k\XLS2KE03.xls
  • %System Root%\Python27\Lib\email\test\data\PyBanner048.gif
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-current.bin
  • %Application Data%\Microsoft\Windows\PrivacIE\container.dat
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\pluginreg.dat
  • %System Root%\Python27\include\pythonrun.h
  • %System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\dependency_links.txt
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp
  • %System Root%\Python27\Lib\test\formatfloat_testcases.txt
  • %System Root%\Users\Public\Music\Sample Music\Sleep Away.mp3
  • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE02.ppt
  • %All Users Profile%\Microsoft\OFFICE\DATA\opa12.dat
  • %System Root%\Python27\Lib\test\cjkencodings\shift_jis.txt
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\info.gif
  • %System Root%\Python27\Lib\test\cjkencodings\euc_jisx0213-utf8.txt
  • %System Root%\Python27\tcl\tix8.4.3\pref\WmDefault.txt
  • %AppDataLocal%\Microsoft\Internet Explorer\EmieSiteList\container.dat
  • %All Users Profile%\Microsoft\User Account Pictures\guest.bmp
  • %System Root%\Users\Default\NTUSER.DAT
  • %User Profile%\Documents\word2k\DOC2KE02.doc
  • %System Root%\Python27\Lib\email\test\data\msg_27.txt
  • %System Root%\Users\All Users\Microsoft\RAC\StateData\RacWmiEventData.dat
  • %System Root%\Python27\Lib\email\test\data\msg_43.txt
  • %System Root%\Python27\Lib\email\test\data\msg_33.txt
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\googledesktop.txt
  • %System Root%\Python27\include\complexobject.h
  • %System Root%\Users\Public\Documents\word2k\DOC2KE03.doc
  • %System Root%\powerpoint2k\PPT2KE02.ppt
  • %Desktop%\excel2k\XLS2KExx.xls
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp
  • %System Root%\Python27\include\codecs.h
  • %System Root%\Python27\Lib\test\cjkencodings\cp949-utf8.txt
  • %Desktop%\word2k\DOC2KE03.doc
  • %System Root%\Python27\tcl\tix8.4.3\pref\TixGray.cs
  • %User Profile%\Documents\excel2k\XLS2KE04.xls
  • %System Root%\Python27\include\listobject.h
  • %System Root%\Python27\Lib\test\audiodata\pluck-pcm24.wav
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\adobephotoshopcs3.txt
  • %System Root%\Python27\Lib\test\cmath_testcases.txt
  • %Desktop%\note.txt
  • %AppDataLocal%\Google\Chrome\User Data\Crashpad\settings.dat
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Tanspecks.jpg
  • F:\data\dolist.txt
  • %User Temp%\{username}.bmp
  • %System Root%\powerpoint2k\PPT2KE05.ppt
  • %Desktop%\powerpoint2k\PPT2KE02.ppt
  • %System Root%\excel2k\XLS2KExx.xls
  • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE04.ppt
  • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE05.ppt
  • %User Temp%\dd_vcredistUI0FC1.txt
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Wrinkled_Paper.gif
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp
  • %User Profile%\Documents\powerpoint2k\PPT2KE02.ppt
  • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo75.gif
  • %System Root%\Python27\include\methodobject.h
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\plus.gif
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-child.bin
  • %System Root%\Python27\Lib\email\test\data\msg_26.txt
  • %All Users Profile%\VMware\RawdskCompatibility\native\regdata.dat
  • F:\data\tmp.doc
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-child-current.bin
  • %AppDataLocal%\Microsoft\Internet Explorer\brndlog.txt
  • %AppDataLocal%\Microsoft\Feeds Cache\container.dat
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp
  • %System Root%\Python27\Lib\email\test\data\msg_07.txt
  • %Desktop%\word2k\DOC2KE04.doc
  • %System Root%\Users\Public\Documents\excel2k\XLS2KE02.xls
  • %User Profile%\Documents\word2k\DOC2KExx.doc
  • %AppDataLocal%\Google\Software Reporter Tool\settings.dat
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp
  • %System Root%\Python27\include\iterobject.h
  • %System Root%\Email and Password List.js
  • %System Root%\Python27\tcl\tk8.5\demos\images\tcllogo.gif
  • %System Root%\Python27\Lib\email\test\data\msg_02.txt
  • %System Root%\Python27\Lib\email\test\data\msg_28.txt
  • %System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\top_level.txt
  • %System Root%\Python27\Lib\email\test\data\msg_40.txt
  • %Desktop%\AAljoOV.jpg
  • %Application Data%\Microsoft\Office\Recent\index.dat
  • %System Root%\Python27\Lib\idlelib\NEWS.txt
  • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieBrowserModeList\container.dat
  • %System Root%\Python27\Lib\test\cjkencodings\shift_jisx0213-utf8.txt
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Cave_Drawings.gif
  • %AppDataLocal%Low\Microsoft\Windows\AppCache\container.dat
  • %System Root%\Users\Public\Documents\word2k\DOC2KE05.doc
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Bears.jpg
  • %System Root%\Python27\include\cobject.h
  • %System Root%\Python27\include\asdl.h
  • %System Root%\Python27\include\setobject.h
  • %System Root%\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg
  • %System Root%\Python27\Lib\test\test_difflib_expect.html
  • %System Root%\Python27\Lib\test\cjkencodings\iso2022_kr.txt
  • %System Root%\Python27\include\bytes_methods.h
  • %System Root%\Users\Public\Documents\excel2k\XLS2KExx.xls
  • %System Root%\Python27\Lib\test\math_testcases.txt
  • %System Root%\Python27\include\cStringIO.h
  • %System Root%\Python27\Lib\site-packages\pythonnet-2.1.0.dist-info\top_level.txt
  • %System Root%\Python27\Lib\idlelib\Icons\idle_32.gif
  • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo100.gif
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Garden.jpg
  • %System Root%\Python27\Lib\test\cjkencodings\big5hkscs.txt
  • %System Root%\Python27\include\funcobject.h
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Small_News.jpg
  • %System Root%\Python27\Lib\email\test\data\msg_45.txt
  • %System Root%\Python27\Lib\email\test\data\msg_11.txt
  • %System Root%\Python27\tcl\tix8.4.3\pref\TkWin.cs
  • %System Root%\Python27\Lib\idlelib\HISTORY.txt
  • %Desktop%\powerpoint2k\PPT2KE05.ppt
  • %System Root%\Users\Public\Pictures\Sample Pictures\Penguins.jpg
  • %System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\entry_points.txt
  • %System Root%\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
  • %System Root%\Python27\include\enumobject.h

(Nota: %System Root% es la carpeta raíz, normalmente C:\. También es la ubicación del sistema operativo).

. %User Profile% es la carpeta de perfil del usuario activo, que en el caso de Windows 98 y ME suele estar en C:\Windows\Profiles\{nombre de usuario}, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}, en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) en C:\Documents and Settings\{nombre de usuario} y en el caso de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}).

. %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).

. %Desktop% es la carpeta Escritorio del usuario activo, que en el caso de Windows 98 y ME suele estar en C:\Windows\Profiles\{nombre de usuario}\Escritorio, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}\Escritorio, en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) en C:\Documents and Settings\{nombre de usuario}\Escritorio y en el caso de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\Desktop).

. %Application Data% es la carpeta Application Data del usuario activo, que en el caso de Windows 98 y ME suele estar ubicada en C:\Windows\Profiles\{nombre de usuario}\Application Data, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}\Application Data, en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) en C:\Documents and Settings\{nombre de usuario}\Local Settings\Application Data y en el caso de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Roaming.).

)

Rutina de infiltración

Infiltra los archivos siguientes:

  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\{username}
  • %All Users Profile%\Microsoft\Search\Data\Applications\{username}
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\{username}
  • %Start Menu%\Programs\Administrative Tools\{username}
  • %AppDataLocal%Low\Mozilla\{username}
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Java\{username}
  • %AppDataLocal%\pip\cache\http\a\1\9\5\{username}
  • %System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\updates\0\{username}.KEKW
  • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo175.gif.KEKW
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pings\{username}
  • %System Root%\Python27\include\pgenheaders.h.KEKW
  • %User Temp%\dd_vcredistMSI0FD5.txt.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\50\{username}
  • %System Root%\Python27\Lib\hotshot\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47\{username}
  • %System Root%\powerpoint2k\PPT2KExx.PPT.KEKW
  • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieUserList\container.dat.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_07.txt.KEKW
  • %System Root%\Python27\include\Python-ast.h.KEKW
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\virtual\{username}.KEKW
  • %System Root%\Python27\Lib\idlelib\Icons\minusnode.gif.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\treeadapters\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp.KEKW
  • %System Root%\Users\{username}\AppData\Roaming\Microsoft\Windows\Libraries\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\{username}
  • %Desktop%\word2k\DOC2KE01.doc.KEKW
  • %AppDataLocal%\pip\cache\http\7\e\9\8\0\{username}
  • %System Root%\Users\Default\AppData\Roaming\{username}
  • %System Root%\Python27\include\ast.h.KEKW
  • %System Root%\Python27\Lib\idlelib\extend.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Device Stage\Task\{{GUID}}\{username}.KEKW
  • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\Un_A\{username}.KEKW
  • %System Root%\word2k\DOC2KE02.doc.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Store\{username}.KEKW
  • %System Root%\Python27\NEWS.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Assistance\Client\{username}
  • %System Root%\Python27\Lib\test\zipdir.zip.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\johab-utf8.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1D\{username}
  • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo200.gif.KEKW
  • %AppDataLocal%\Microsoft\Internet Explorer\VersionManager\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1D\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\util\{username}
  • %System Root%\Users\All Users\Microsoft\Assistance\Client\{username}.KEKW
  • %User Temp%\Low\{username}
  • F:\data\photos\{username}
  • %System Root%\Users\Public\Pictures\Sample Pictures\{username}
  • %System Root%\Users\All Users\McAfee\MCLOGS\Common\{username}.KEKW
  • %Start Menu%\{username}
  • %Application Data%\Microsoft\UProof\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\{username}.KEKW
  • %AppDataLocal%\pip\cache\http\a\6\9\b\d\{username}
  • %System Root%\excel2k\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Pretty_Peacock.jpg.KEKW
  • %System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\dependency_links.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\{username}
  • %System Root%\Python27\Lib\idlelib\Icons\idle_32.gif.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_35.txt.KEKW
  • %AppDataLocal%\pip\cache\http\7\e\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\{username}
  • %All Users Profile%\Microsoft\Assistance\Client\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\F0\{username}
  • %AppDataLocal%\Microsoft\Feeds Cache\container.dat.KEKW
  • %System Root%\Users\All Users\Mozilla\updates\{username}.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\treewalkers\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\22\{username}
  • %System Root%\Users\{username}\Music\{username}
  • %System Root%\Users\Public\Music\Sample Music\Kalimba.mp3.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Definition Updates\Updates\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A\{username}
  • %System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\top_level.txt.KEKW
  • %System Root%\Python27\tcl\reg1.2\{username}
  • %System Root%\Python27\include\pymem.h.KEKW
  • %System Root%\Users\All Users\Microsoft\IdentityCRL\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\{username}.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\shift_jisx0213.txt.KEKW
  • %AppDataLocal%\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_internal\commands\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp.KEKW
  • %System Root%\word2k\DOC2KE05.doc.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\{username}.KEKW
  • %System Root%\PerfLogs\Admin\{username}
  • %System Root%\Python27\tcl\tcl8\8.5\{username}
  • %AppDataLocal%\pip\cache\http\d\3\7\e\0\{username}
  • %System Root%\Python27\Lib\test\cjkencodings\cp949-utf8.txt.KEKW
  • %System Root%\Python27\tcl\tcl8.5\tzdata\Etc\{username}
  • %System Root%\Python27\Lib\test\cjkencodings\gb2312-utf8.txt.KEKW
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\minusarm.gif.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\muffin\{username}
  • %System Root%\Python27\Lib\test\capath\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\CacheManager\{username}.KEKW
  • %System Root%\Python27\Tools\pynche\webcolors.txt.KEKW
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\SoftBlue.jpg.KEKW
  • %AppDataLocal%\pip\cache\http\d\3\{username}
  • %AppDataLocal%\pip\cache\http\2\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\39\{username}
  • %All Users Profile%\Microsoft\Windows\Sqm\Upload\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\18\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_22.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\{username}
  • %System Root%\Users\All Users\Microsoft\RAC\PublishedData\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp.KEKW
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\datareporting\archived\2019-05\{username}
  • %System Root%\Users\Default\Videos\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\{username}.KEKW
  • %Application Data%\Microsoft\SystemCertificates\My\CRLs\{username}
  • %System Root%\Python27\tcl\tcl8\8.4\platform\{username}
  • %System Root%\Python27\include\descrobject.h.KEKW
  • %System Root%\Python27\include\dictobject.h.KEKW
  • %System Root%\Python27\Lib\test\imghdrdata\python.bmp.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\OriginTrials\{username}
  • %System Root%\Users\Default\AppData\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\requests\{username}
  • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.1\{username}
  • %System Root%\Users\Public\Documents\excel2k\XLS2KExx.xls.KEKW
  • %System Root%\Python27\tcl\tk8.5\images\logo100.gif.KEKW
  • %System Root%\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\7\{username}
  • %AppDataLocal%Low\{username}
  • %System Root%\Python27\tcl\tcl8.5\tzdata\Australia\{username}
  • %System Root%\Users\All Users\Microsoft\MF\{username}
  • %System Root%\Python27\Lib\test\cjkencodings\gb18030-utf8.txt.KEKW
  • %Application Data%\Macromedia\Flash Player\macromedia.com\support\flashplayer\{username}
  • %System Root%\Python27\tcl\tcl8.5\http1.0\{username}
  • %Desktop%\powerpoint2k\PPT2KE02.ppt.KEKW
  • %System Root%\Users\All Users\Microsoft\IlsCache\{username}
  • %System Root%\Python27\include\modsupport.h.KEKW
  • %Desktop%\excel2k\XLS2KE01.xls.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_11.txt.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_46.txt.KEKW
  • %System Root%\Users\All Users\Microsoft Help\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\Tiles\pin9728060290\{username}
  • %All Users Profile%\Oracle\Java\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\52\{username}
  • %Favorites%\MSN Websites\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\{username}.KEKW
  • %AppDataLocal%Low\Microsoft\Windows\AppCache\LY14JQYG\container.dat.KEKW
  • %User Profile%\Documents\Email and Password List.txt.KEKW
  • %User Temp%\WPDNSE\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\Backup\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_05.txt.KEKW
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\2918063365piupsah.files\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\{username}
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\folder.gif.KEKW
  • %AppDataLocal%\pip\cache\http\a\1\{username}
  • %AppDataLocal%\Google\Chrome\User Data\SwReporter\{username}
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-child.bin.KEKW
  • %All Users Profile%\McAfee\WinCore\{username}
  • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.1\_metadata\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg.KEKW
  • %AppDataLocal%\Deployment\{username}
  • %AppDataLocal%\Apps\2.0\Data\RNQG94OQ.QJC\E1WGPJBQ.PMC\goog...app_9ae46cec200785df_0001.0003_7581c0cd83ac8659\{username}
  • %System Root%\Python27\tcl\tix8.4.3\demos\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\{username}
  • %System Root%\Python27\Lib\test\cjkencodings\euc_kr-utf8.txt.KEKW
  • %System Root%\Python27\Lib\idlelib\NEWS.txt.KEKW
  • %Application Data%\Macromedia\Flash Player\{username}
  • %Application Data%\Microsoft\Credentials\{username}
  • %All Users Profile%\VMware\RawdskCompatibility\native\C\{username}
  • %System Root%\Python27\Lib\site-packages\pip\{username}
  • %AppDataLocal%\Google\Chrome\User Data\FileTypePolicies\34\_metadata\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\{username}
  • %AppDataLocal%\Google\Chrome\User Data\BrowserMetrics\{username}
  • %Application Data%\Macromedia\Flash Player\macromedia.com\{username}
  • %Application Data%\Mozilla\SystemExtensionsDev\{username}
  • %User Profile%\Documents\word2k\{username}
  • %System Root%\Python27\Lib\test\audiodata\pluck-pcm8.wav.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp.KEKW
  • %AppDataLocal%\pip\cache\http\0\2\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\mpcache-B1C01FED9F08520A4647901EFB883A6A3B247F8D.bin.KEKW
  • %AppDataLocal%\Apps\2.0\Data\RNQG94OQ.QJC\E1WGPJBQ.PMC\{username}
  • %AppDataLocal%\Microsoft\Windows\History\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\DeviceMetadataStore\en-US\{username}
  • %System Root%\Python27\Lib\test\floating_points.txt.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\37\{username}
  • %System Root%\Python27\Lib\lib2to3\fixes\{username}
  • %System Root%\Users\All Users\Microsoft\RAC\StateData\RacWmiDataBookmarks.dat.KEKW
  • %User Profile%\Documents\word2k\DOC2KE02.doc.KEKW
  • %AppDataLocal%\pip\cache\http\7\{username}
  • %System Root%\Users\Public\Pictures\Sample Pictures\Desert.jpg.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70\{username}
  • %All Users Profile%\Microsoft\Windows\WER\ReportQueue\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\{username}.KEKW
  • %System Root%\Users\{username}\Pictures\{username}
  • %System Root%\Python27\tcl\tix8.4.3\demos\bitmaps\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\host\{username}
  • %AppDataLocal%\pip\cache\http\b\a\9\3\5\{username}
  • %System Root%\Python27\Lib\test\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\8\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\{username}.KEKW
  • %Application Data%\Microsoft\Internet Explorer\{username}
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\VMware\{username}
  • %AppDataLocal%\Microsoft\Feeds Cache\M7X9O6Z1\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Caches\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\IECompatData\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\19\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_internal\models\{username}
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\minus.gif.KEKW
  • %AppDataLocal%\pip\cache\http\f\e\d\0\e\{username}
  • %System Root%\Python27\Lib\test\math_testcases.txt.KEKW
  • %System Root%\Users\Public\Libraries\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\42\{username}
  • %Application Data%\Microsoft\Office\Recent\index.dat.KEKW
  • %System Root%\Python27\include\traceback.h.KEKW
  • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\History\CacheManager\MpSfc.bin.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Support\{username}.KEKW
  • %AppDataLocal%\pip\cache\http\5\4\{username}
  • %All Users Profile%\Microsoft\Device Stage\Task\{{GUID}}\{username}
  • %All Users Profile%\VMware\RawdskCompatibility\{username}
  • %System Root%\Python27\Lib\distutils\command\{username}
  • %System Root%\Users\All Users\Microsoft\Device Stage\Task\{username}.KEKW
  • %AppDataLocal%\Microsoft\Windows\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp.KEKW
  • %Application Data%\Microsoft\Windows\Templates\{username}
  • %AppDataLocal%\Python-Eggs\Python-Eggs\Cache\pillow-4.1.0-py2.7-win32.egg-tmp\{username}
  • %System Root%\Users\Public\Documents\powerpoint2k\{username}
  • %AppDataLocal%\Microsoft\Feeds Cache\NNO7APUS\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\tabiconcache.dat.KEKW
  • %System Root%\Users\Public\Pictures\Sample Pictures\Koala.jpg.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95\{username}
  • %System Root%\Python27\Lib\test\leakers\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\33\{username}
  • %User Temp%\dd_NDP452-KB2901907-x86-x64-AllOS-ENU_decompression_log.txt.KEKW
  • %System Root%\Users\All Users\Oracle\Java\javapath_target_313094\{username}.KEKW
  • %AppDataLocal%\pip\cache\http\7\e\9\8\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\{username}.KEKW
  • %System Root%\Python27\Lib\multiprocessing\{username}
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\SentItems\{username}.KEKW
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Psychedelic.jpg.KEKW
  • %AppDataLocal%\pip\cache\http\4\{username}
  • %User Profile%\Contacts\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Device Stage\Task\{{GUID}}\en-US\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Entries\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Inbox\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\msgpack\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\34\{username}
  • %AppDataLocal%\Microsoft\Office\Groove\User\{username}
  • %All Users Profile%\Microsoft\Network\Downloader\qmgr0.dat.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\pnacl\0.57.44.2492\_platform_specific\x86_64\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\70\{username}.KEKW
  • %System Root%\Python27\Lib\idlelib\idle_test\README.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\AIT\{username}
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Sqm\Upload\{username}
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\vmwarefilters.txt.KEKW
  • %System Root%\Users\All Users\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\eHome\{username}
  • %System Root%\Python27\Lib\test\cjkencodings\cp949.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\{username}.KEKW
  • %System Root%\Python27\include\iterobject.h.KEKW
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\cache2\entries\{username}
  • %AppDataLocal%\Google\Chrome\User Data\InterventionPolicyDatabase\2018.9.6.0\{username}
  • %All Users Profile%\Microsoft\OFFICE\DATA\opa12.dat.KEKW
  • %System Root%\Users\Default\Links\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp.KEKW
  • %All Users Profile%\McAfee\MCLOGS\PartnerCustom\SSScheduler\{username}
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\{username}
  • %System Root%\Python27\include\import.h.KEKW
  • %AppDataLocal%\pip\cache\http\0\2\5\{username}
  • %System Root%\Users\Default\AppData\Local\Temp\{username}
  • %All Users Profile%\VMware\VMware Tools\manifest.txt.KEKW
  • %All Users Profile%\Mozilla\updates\308046B0AF4A39CB\updates\{username}
  • %AppDataLocal%\Microsoft\Windows\Burn\{username}
  • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KExx.PPT.KEKW
  • %AppDataLocal%\Microsoft\Internet Explorer\UrlBlockManager\urlblocklist.bin.KEKW
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts\{username}
  • %AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\{username}
  • %System Root%\Users\Public\Documents\excel2k\XLS2KE01.xls.KEKW
  • %AppDataLocal%\Microsoft\Internet Explorer\imagestore\1s32qbz\{username}
  • %User Profile%\Documents\word2k\DOC2KE01.doc.KEKW
  • %System Root%\Users\All Users\VMware\VMware Tools\Unity Filters\{username}
  • %System Root%\Users\All Users\VMware\{username}.KEKW
  • %System Root%\Users\Public\Music\{username}
  • %System Root%\Users\All Users\Microsoft\OFFICE\DATA\{username}
  • %System Root%\Python27\Lib\test\cjkencodings\euc_jp-utf8.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\DRM\Cache\{username}
  • %All Users Profile%\Microsoft\NetFramework\BreadcrumbStore\{username}
  • %User Profile%\Documents\excel2k\XLS2KE02.xls.KEKW
  • %System Root%\Python27\Lib\site-packages\pythonnet-2.1.0.dist-info\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\{username}.KEKW
  • %User Profile%\Documents\powerpoint2k\PPT2KE05.ppt.KEKW
  • %System Root%\Users\All Users\Microsoft\DRM\Server\{username}.KEKW
  • %System Root%\Users\{username}\AppData\Roaming\Microsoft\Windows\{username}
  • %System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\LICENSE.txt.KEKW
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\datareporting\archived\2019-04\{username}
  • %System Root%\Users\All Users\Microsoft\Media Player\{username}
  • %System Root%\Users\All Users\Microsoft\OFFICE\{username}.KEKW
  • %Application Data%\Microsoft\Windows\DNTException\Low\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\{username}
  • %System Root%\Python27\tcl\tcl8.5\tzdata\Arctic\{username}
  • %System Root%\Python27\include\fileobject.h.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Scans\History\Results\Resource\{username}
  • %AppDataLocal%\Microsoft\Feeds\Feeds for United States~\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp.KEKW
  • %AppDataLocal%\pip\cache\http\5\4\3\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp.KEKW
  • %System Root%\Python27\tcl\tcl8.5\tzdata\Canada\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\3UYAQU1F\{username}
  • %AppDataLocal%\Microsoft\Windows\Ringtones\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Connectivity.gif.KEKW
  • %User Temp%\Microsoft .NET Framework 4.5.2 Setup_20161212_135033207.html.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\56\{username}
  • %User Profile%\Documents\powerpoint2k\PPT2KE04.ppt.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\hz.txt.KEKW
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\cache2\doomed\{username}
  • %System Root%\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\{username}
  • %System Root%\Users\All Users\Microsoft\Device Stage\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\WER\{username}
  • %System Root%\Python27\include\eval.h.KEKW
  • %All Users Profile%\Microsoft\Device Stage\Task\{username}
  • %System Root%\Python27\include\intobject.h.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp.KEKW
  • %System Root%\word2k\DOC2KE03.doc.KEKW
  • %System Root%\$Recycle.Bin\S-1-5-21-2407829820-1079796033-203259571-500\{username}
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Maintenance\{username}
  • %AppDataLocal%\Google\Chrome\User Data\ShaderCache\GPUCache\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3\{username}
  • %All Users Profile%\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\{username}
  • %System Root%\excel2k\XLS2KE02.xls.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\VMware Tools\{username}.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\shift_jis-utf8.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Assistance\{username}.KEKW
  • %Application Data%\Microsoft\Vault\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_19.txt.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Scans\History\Results\Quick\{username}
  • %System Root%\Python27\tcl\tcl8.5\tzdata\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Store\{username}
  • %System Root%\Users\All Users\Microsoft\RAC\{username}.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\gbk-utf8.txt.KEKW
  • %All Users Profile%\Microsoft\Windows\Sqm\Sessions\{username}
  • %System Root%\Users\{username}\AppData\{username}
  • %System Root%\Python27\tcl\tcl8.5\tzdata\Africa\{username}
  • %All Users Profile%\McAfee\MCLOGS\PartnerCustom\Un_A\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\61\{username}
  • %System Root%\Python27\Lib\site-packages\setuptools\command\{username}
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\srcfile.gif.KEKW
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-current.bin.KEKW
  • %All Users Profile%\McAfee\MCLOGS\PartnerCustom\McCHSvc\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp.KEKW
  • %All Users Profile%\Microsoft\Windows\DRM\{username}
  • %System Root%\Python27\Tools\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Config\{username}.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\shift_jisx0213-utf8.txt.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_08.txt.KEKW
  • %All Users Profile%\Microsoft\MSDN\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\{AD285A8B-713F-11E9-85F8-005056BC44A9}.dat.KEKW
  • %System Root%\Python27\Lib\test\decimaltestdata\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\LocalCopy\{username}
  • %System Root%\Users\All Users\Microsoft\MSDN\8.0\{username}.KEKW
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp.KEKW
  • %System Root%\Python27\Lib\test\test_doctest.txt.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\pep517\{username}
  • %System Root%\Python27\include\osdefs.h.KEKW
  • %System Root%\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.KEKW
  • %All Users Profile%\Microsoft\Windows NT\MSFax\ActivityLog\{username}
  • %AppDataLocal%\pip\cache\http\0\{username}
  • %AppDataLocal%\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\{username}
  • %AppDataLocal%\Microsoft\Windows\WebCache\WebCacheV01.dat.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\contrib\_securetransport\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\4\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5\{username}
  • %All Users Profile%\Oracle\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\GUFNQG0Q\{username}
  • %User Temp%\acrocef_low\{username}
  • %System Root%\Python27\Doc\{username}
  • %User Profile%\Documents\powerpoint2k\PPT2KE01.ppt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSScan\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\{username}
  • %System Root%\Python27\tcl\tcl8.5\tzdata\America\Argentina\{username}
  • %System Root%\Users\All Users\Microsoft\OFFICE\DATA\{username}.KEKW
  • %AppDataLocal%\Microsoft\Internet Explorer\Tracking Protection\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\LocalCopy\{username}.KEKW
  • %System Root%\Python27\LICENSE.txt.KEKW
  • %System Root%\Users\All Users\Adobe\Setup\{username}
  • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\{username}.KEKW
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\act_fold.gif.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Scans\{username}
  • %System Root%\Python27\Lib\test\cjkencodings\big5hkscs.txt.KEKW
  • %System Root%\Users\{username}\AppData\Local\{username}
  • %System Root%\Python27\tcl\tk8.5\images\logoMed.gif.KEKW
  • %All Users Profile%\Microsoft\RAC\Outbound\{username}
  • %System Root%\Python27\Lib\xml\etree\{username}
  • %Application Data%\Microsoft\Document Building Blocks\1033\{username}
  • %All Users Profile%\Microsoft\Windows\Sqm\{username}
  • %System Root%\Python27\tcl\tix8.4.3\{username}
  • %AppDataLocal%\Google\Chrome\User Data\InterventionPolicyDatabase\2018.9.6.0\_metadata\{username}
  • %System Root%\Python27\tcl\tix8.4.3\pref\TixGray.cs.KEKW
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp.KEKW
  • %System Root%\Recovery\{GUID}\{username}
  • %Start Menu%\Programs\Accessories\Accessibility\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\History\{username}
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\{username}
  • %AppDataLocal%\pip\cache\http\3\8\9\3\{username}
  • %Application Data%\Microsoft\Windows\IEDownloadHistory\container.dat.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.1\LICENSE.txt.KEKW
  • %All Users Profile%\Microsoft\Search\Data\Temp\{username}
  • %System Root%\Python27\include\pyerrors.h.KEKW
  • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\PDYB5D8B\{username}
  • %AppDataLocal%Low\Microsoft\Windows\AppCache\container.dat.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\{username}
  • %System Root%\Users\Public\Pictures\Sample Pictures\Tulips.jpg.KEKW
  • %System Root%\Users\All Users\Microsoft\NetFramework\BreadcrumbStore\{username}
  • %All Users Profile%\Microsoft\Windows\Power Efficiency Diagnostics\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\Updates\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\1\{username}
  • %System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\updates\{username}.KEKW
  • %All Users Profile%\Oracle\Java\installcache_x64\{username}
  • %System Root%\Users\All Users\Microsoft\Network\Connections\{username}.KEKW
  • %System Root%\Email and Password List.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\{username}.KEKW
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\pkcs11.txt.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_27.txt.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\0\{username}
  • %Application Data%\Microsoft\Office\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Power Efficiency Diagnostics\{username}.KEKW
  • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieUserList\{username}
  • %System Root%\Python27\include\pyarena.h.KEKW
  • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieBrowserModeList\{username}
  • %Desktop%\powerpoint2k\PPT2KE04.ppt.KEKW
  • %System Root%\Users\Public\Documents\word2k\DOC2KE02.doc.KEKW
  • %Application Data%\Microsoft\Windows\Printer Shortcuts\{username}
  • %System Root%\Python27\Lib\test\cjkencodings\euc_jp.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp.KEKW
  • %System Root%\Python27\Lib\lib2to3\tests\{username}
  • %System Root%\Users\All Users\Microsoft\DeviceSync\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F0\{username}
  • %System Root%\Users\All Users\McAfee\MCLOGS\{username}.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_04.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\DeviceMetadataStore\{username}
  • %System Root%\Python27\include\setobject.h.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_internal\operations\{username}
  • %Desktop%\word2k\DOC2KE05.doc.KEKW
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\info.gif.KEKW
  • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\8YC9813O\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\{username}
  • %System Root%\Python27\tcl\tix8.4.3\pref\WmDefault.cs.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\contrib\{username}
  • %All Users Profile%\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\DATA\{username}
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\vistasidebar.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Sqm\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\{username}
  • %System Root%\Users\All Users\Adobe\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\{username}
  • %Start Menu%\Programs\{username}
  • %Desktop%\{username}
  • %User Profile%\Documents\excel2k\XLS2KExx.xls.KEKW
  • %AppDataLocal%\pip\cache\http\b\a\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\F0\{username}
  • %System Root%\Python27\tcl\tk8.5\msgs\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43\{username}.KEKW
  • %System Root%\Python27\include\marshal.h.KEKW
  • %System Root%\Python27\Lib\test\audiodata\{username}
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Microsoft Office\{username}
  • %System Root%\Python27\Lib\idlelib\README.txt.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\12\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Definition Updates\Backup\{username}
  • %AppDataLocal%\pip\cache\http\f\e\d\{username}
  • %System Root%\Python27\include\Python.h.KEKW
  • %System Root%\Users\All Users\Microsoft\Network\{username}.KEKW
  • %All Users Profile%\Microsoft\IdentityCRL\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\{username}
  • %All Users Profile%\Oracle\Java\javapath_target_313094\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_41.txt.KEKW
  • %System Root%\Python27\tcl\tk8.5\images\logoLarge.gif.KEKW
  • %System Root%\Python27\tcl\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Quarantine\{username}.KEKW
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_15.txt.KEKW
  • %AppDataLocal%Low\Sun\Java\{username}
  • %System Root%\Python27\Lib\curses\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\MSIMGSIZ.DAT.KEKW
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\{username}
  • %System Root%\Python27\include\graminit.h.KEKW
  • %AppDataLocal%\Microsoft\TaskSchedulerConfig\{username}
  • F:\data\dolist.txt.KEKW
  • %AppDataLocal%\Microsoft\PlayReady\{username}
  • %Start Menu%\Programs\Maintenance\{username}
  • %User Temp%\{username}
  • %AppDataLocal%\Microsoft\Windows Media\{username}
  • %AppDataLocal%\Microsoft\Windows\Burn\Burn\{username}
  • %System Root%\Python27\tcl\tk8.5\images\logo64.gif.KEKW
  • %All Users Profile%\Microsoft\RAC\Temp\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Entries\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\{username}.KEKW
  • %Desktop%\powerpoint2k\PPT2KE03.ppt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\{username}
  • %All Users Profile%\Microsoft\Windows\AIT\{username}
  • %System Root%\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Queue\{username}.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\treebuilders\{username}
  • %User Profile%\Documents\Email and Password List.js.KEKW
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\urlCache.bin.KEKW
  • %System Root%\Python27\include\pythonrun.h.KEKW
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Tablet PC\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\{username}
  • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\550F8967-2EE2-4F33-8E16-1BFFBE114803\{username}
  • %AppDataLocal%\Microsoft Help\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_09.txt.KEKW
  • %System Root%\Python27\include\pymactoolbox.h.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_02.txt.KEKW
  • %AppDataLocal%\Microsoft\Windows\WER\ReportArchive\NonCritical_iexplore.exe_12df8271b62395a348f102b12959f9768e2baf9_0be7f64f\{username}
  • %System Root%\Python27\Lib\test\support\{username}
  • %System Root%\word2k\DOC2KE01.doc.KEKW
  • %System Root%\Users\All Users\Microsoft\IdentityCRL\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\SiteSecurityServiceState.txt.KEKW
  • %System Root%\Python27\Lib\test\tokenize_tests.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70\{username}.KEKW
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Tiki.gif.KEKW
  • %System Root%\Python27\include\stringobject.h.KEKW
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg.KEKW
  • %System Root%\Users\All Users\Microsoft Help\{username}.KEKW
  • %System Root%\Python27\Lib\idlelib\idle_test\{username}
  • %System Root%\Users\All Users\VMware\VMware Tools\{username}.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\packages\{username}
  • %AppDataLocal%\pip\cache\http\2\3\b\{username}
  • %AppDataLocal%\pip\cache\http\4\e\e\3\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\weave\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Ringtones\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp.KEKW
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\{username}
  • %System Root%\Python27\include\grammar.h.KEKW
  • %AppDataLocal%\pip\cache\http\2\3\{username}
  • %System Root%\excel2k\XLS2KE04.xls.KEKW
  • %All Users Profile%\Microsoft\Assistance\Client\1.0\en-US\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\{username}.dat.KEKW
  • %System Root%\Python27\Lib\test\formatfloat_testcases.txt.KEKW
  • %System Root%\Python27\tcl\tcl8\{username}
  • %AppDataLocal%\Microsoft\Windows Media\12.0\{username}
  • %System Root%\Python27\tcl\tk8.5\ttk\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\{username}.KEKW
  • %System Root%\Python27\tcl\tix8.4.3\pref\Blue.cs.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\3\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\{username}
  • %System Root%\Python27\DLLs\{username}
  • %System Root%\Python27\Lib\idlelib\CREDITS.txt.KEKW
  • %All Users Profile%\McAfee\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_39.txt.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\41\{username}
  • %Application Data%\Microsoft\SystemCertificates\My\CTLs\{username}
  • %System Root%\Users\All Users\VMware\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp.KEKW
  • %System Root%\Python27\tcl\tcl8.5\encoding\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\46\{username}
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\{username}.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_internal\cli\{username}
  • %Application Data%\Sun\Java\{username}
  • %Application Data%\Microsoft\Windows\IEDownloadHistory\{username}
  • %AppDataLocal%\Python-Eggs\{username}
  • %AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\RJ6VBH4W.DN2\manifests\{username}
  • %Application Data%\Microsoft\Windows\IETldCache\{username}
  • %System Root%\Users\All Users\Adobe\ARM\{username}
  • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieSiteList\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\{0E1465B0-BA9C-409F-BC32-D934317129CD}\{username}.KEKW
  • %System Root%\Python27\include\complexobject.h.KEKW
  • %System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\updates\{username}
  • %Start Menu%\Programs\Accessories\{username}
  • %System Root%\Python27\Lib\idlelib\TODO.txt.KEKW
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Sqm\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\59\{username}
  • %Application Data%\Microsoft\Windows\IECompatUACache\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\tmp\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_30.txt.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\70\{username}
  • %AppDataLocal%\Mozilla\Firefox\{username}
  • %Application Data%\Identities\{3D0FBFE3-9E5C-4F14-8D00-F0C8FEFA78BA}\{username}
  • %System Root%\Users\All Users\McAfee\{username}.KEKW
  • %All Users Profile%\Microsoft\Windows\Caches\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\{username}
  • %System Root%\Users\All Users\Microsoft\Device Stage\Task\{{GUID}}\{username}
  • %AppDataLocal%\pip\cache\http\a\1\9\{username}
  • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\Un_A\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\{username}
  • %AppDataLocal%\pip\cache\http\b\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_40.txt.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0\{username}
  • %System Root%\Users\All Users\Microsoft\WwanSvc\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\{username}.KEKW
  • %System Root%\powerpoint2k\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Sqm\Manifest\{username}.KEKW
  • %AppDataLocal%\GDIPFONTCACHEV1.DAT.KEKW
  • %All Users Profile%\VMware\RawdskCompatibility\native\C\ProgramData\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\57\{username}
  • %AppDataLocal%\pip\cache\http\3\8\9\3\0\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\{username}.KEKW
  • %System Root%\Python27\tcl\tcl8.5\tzdata\America\Indiana\{username}
  • %System Root%\Users\All Users\Microsoft\Network\Connections\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\pluginreg.dat.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\{username}.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_28.txt.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\gbk.txt.KEKW
  • %All Users Profile%\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_505c7fc25c7e5866de583f14c22e2b4c2a6018c_0a2493a7\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\History\Results\{username}
  • %System Root%\Users\All Users\Adobe\Setup\{username}.KEKW
  • %AppDataLocal%\Microsoft\Windows\WebCacheLock.dat.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\23\{username}
  • %System Root%\Users\All Users\Microsoft\MF\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Assistance\Client\1.0\{username}.KEKW
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Wrinkled_Paper.gif.KEKW
  • %User Profile%\Documents\powerpoint2k\PPT2KExx.PPT.KEKW
  • %User Profile%\Documents\word2k\DOC2KE04.doc.KEKW
  • %System Root%\excel2k\XLS2KE05.xls.KEKW
  • %System Root%\Python27\Lib\idlelib\Icons\folder.gif.KEKW
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\{username}.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportQueue\{username}
  • %System Root%\Python27\include\object.h.KEKW
  • %Start Menu%\Programs\Accessories\System Tools\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\38\{username}
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Quarantine\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\distlib\{username}
  • %System Root%\word2k\{username}
  • %Start Menu%\Programs\ImDisk\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\27\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\14\{username}
  • %System Root%\Users\All Users\McAfee\MCLOGS\Common\SmallInstaller\{username}
  • %System Root%\Users\{username}\{username}
  • %All Users Profile%\Microsoft\RAC\PublishedData\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\user.bmp.KEKW
  • %System Root%\Python27\include\intrcheck.h.KEKW
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\visualstudio2005.txt.KEKW
  • %Desktop%\AAljoOV.jpg.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1D\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\{username}
  • %AppDataLocal%\Google\Software Reporter Tool\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Support\{username}
  • %AppDataLocal%\Google\Chrome\User Data\Crashpad\settings.dat.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\{username}.KEKW
  • %System Root%\Users\Public\Documents\Email and Password List.js.KEKW
  • %Application Data%\Microsoft\{username}
  • %System Root%\Users\Default\NTUSER.DAT.KEKW
  • %System Root%\Users\All Users\Microsoft\Search\Data\Temp\usgthrsvc\{username}.KEKW
  • %System Root%\Python27\include\weakrefobject.h.KEKW
  • %All Users Profile%\McAfee\MCLOGS\{username}
  • %System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\{username}
  • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\{username}
  • %System Root%\Python27\include\bitset.h.KEKW
  • %System Root%\Users\All Users\Microsoft\RAC\StateData\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Assistance\Client\1.0\{username}
  • %System Root%\Python27\Lib\unittest\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\{username}
  • %System Root%\Python27\Lib\test\imghdrdata\python.png.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\ShaderCache\{username}
  • %AppDataLocal%\Google\Chrome\User Data\pnacl\0.57.44.2492\{username}
  • %Application Data%\Microsoft\Windows\IECompatCache\container.dat.KEKW
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp.KEKW
  • F:\data\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\History\Store\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\minidumps\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp.KEKW
  • %All Users Profile%\Microsoft\Windows NT\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\{username}.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_18.txt.KEKW
  • %System Root%\word2k\DOC2KExx.doc.KEKW
  • %System Root%\Python27\tcl\tcl8.5\tzdata\Antarctica\{username}
  • %System Root%\Users\All Users\Microsoft\Search\{username}.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\Safe Browsing\{username}
  • %System Root%\Python27\tcl\tcl8.5\tzdata\America\Kentucky\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\{username}.KEKW
  • %System Root%\Python27\include\genobject.h.KEKW
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp.KEKW
  • %All Users Profile%\Microsoft\Windows\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\EmieBrowserModeList\container.dat.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\{0E1465B0-BA9C-409F-BC32-D934317129CD}\{username}
  • %System Root%\Python27\include\dtoa.h.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\43\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\{username}
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\45\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\ActivityLog\{username}.KEKW
  • %Application Data%\Microsoft\Internet Explorer\UserData\Low\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3\{username}
  • %System Root%\Python27\Lib\site-packages\setuptools\_vendor\packaging\{username}
  • %System Root%\Users\All Users\Microsoft\MSDN\8.0\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_20.txt.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\CertificateRevocation\5140\_metadata\{username}
  • %User Temp%\Guest.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\{username}.KEKW
  • %User Profile%\Documents\word2k\DOC2KExx.doc.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Inbox\{username}.KEKW
  • %System Root%\Users\Public\Documents\word2k\{username}
  • %User Temp%\Deployment\{username}
  • %AppDataLocal%\pip\cache\http\d\{username}
  • %System Root%\Users\All Users\Microsoft\Search\{username}
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\safebrowsing\google4\{username}
  • %System Root%\Users\All Users\Microsoft\MSDN\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\F0\{username}.KEKW
  • %AppDataLocal%Low\Microsoft\Internet Explorer\{username}
  • %All Users Profile%\Microsoft\DeviceSync\{username}
  • %Application Data%\Macromedia\{username}
  • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\Config\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\40\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Garden.jpg.KEKW
  • %System Root%\Users\All Users\Oracle\{username}.KEKW
  • %All Users Profile%\Microsoft\IlsCache\{username}
  • %System Root%\Python27\Lib\xml\parsers\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp.KEKW
  • %AppDataLocal%\pip\cache\http\0\2\5\2\b\{username}
  • %System Root%\word2k\DOC2KE04.doc.KEKW
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\weave\toFetch\{username}
  • %All Users Profile%\Microsoft\Device Stage\{username}
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Games\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\TabRoaming\{username}
  • %Desktop%\excel2k\XLS2KE02.xls.KEKW
  • %System Root%\Python27\Lib\lib2to3\Grammar.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\{username}.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\iso2022_jp-utf8.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp.KEKW
  • %All Users Profile%\Adobe\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\17\{username}
  • F:\data\photos\stunning.jpg.KEKW
  • %System Root%\Python27\include\memoryobject.h.KEKW
  • %AppDataLocal%\Microsoft\Office\Groove\System\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\lockfile\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\EmieBrowserModeList\{username}
  • %All Users Profile%\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\{username}
  • %System Root%\Python27\Lib\test\tracedmodules\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\GameExplorer\{username}
  • %System Root%\Python27\tcl\tk8.5\images\tai-ku.gif.KEKW
  • %User Profile%\Pictures\{username}
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\OfflineCache\{username}
  • %AppDataLocal%\pip\cache\http\a\1\9\5\3\{username}
  • %System Root%\Users\Default\Desktop\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\{username}
  • %System Root%\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\filters\{username}
  • %All Users Profile%\VMware\RawdskCompatibility\native\regdata.dat.KEKW
  • %System Root%\Users\All Users\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\{username}
  • %All Users Profile%\Microsoft\Windows\Templates\{username}
  • %System Root%\Python27\Lib\ensurepip\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\imagestore\joppu72\{username}
  • %User Temp%\dd_wcf_CA_smci_20161212_135110_351.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\NetFramework\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\{username}.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\CertificateRevocation\{username}
  • %System Root%\Python27\Lib\lib2to3\PatternGrammar.txt.KEKW
  • %System Root%\Python27\Lib\test\cmath_testcases.txt.KEKW
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\cache2\{username}
  • %System Root%\Users\All Users\McAfee\WinCore\{username}.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\FileTypePolicies\34\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Service\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportQueue\{username}.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_25.txt.KEKW
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\{username}
  • %System Root%\Python27\tcl\tix8.4.3\pref\Gray.cs.KEKW
  • %AppDataLocal%\Microsoft\Office\{username}
  • %AppDataLocal%\Microsoft\Windows\History\Low\{username}
  • %System Root%\Python27\include\symtable.h.KEKW
  • %System Root%\Python27\tcl\tix8.4.3\pref\{username}
  • %AppDataLocal%\Google\Chrome\User Data\PepperFlash\{username}
  • %System Root%\Python27\tcl\tk8.5\{username}
  • %Desktop%\powerpoint2k\PPT2KE01.ppt.KEKW
  • %All Users Profile%\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47\{username}
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Administrative Tools\{username}
  • %AppDataLocal%\Microsoft\Windows\GameExplorer\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\AlternateServices.txt.KEKW
  • %System Root%\Users\All Users\Oracle\Java\{username}
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\{username}
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\{username}
  • %System Root%\Python27\Lib\unittest\test\{username}
  • %System Root%\Python27\Lib\test\ieee754.txt.KEKW
  • %System Root%\Python27\Tools\webchecker\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\cachecontrol\caches\{username}
  • %AppDataLocal%\Python-Eggs\Python-Eggs\Cache\pillow-4.1.0-py2.7-win32.egg-tmp\PIL\{username}
  • %System Root%\Python27\include\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_10.txt.KEKW
  • %System Root%\Users\All Users\Adobe\ARM\{username}.KEKW
  • %System Root%\Python27\include\tupleobject.h.KEKW
  • %Application Data%\Microsoft\SystemCertificates\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\{username}
  • %AppDataLocal%\Apps\2.0\{username}
  • %System Root%\Users\All Users\Adobe\ARM\Reader_19.010.20099\{username}
  • %AppDataLocal%\Microsoft\Windows Sidebar\Gadgets\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Notebook.jpg.KEKW
  • %All Users Profile%\Microsoft\Media Player\{username}
  • %All Users Profile%\Microsoft\MSDN\8.0\{username}
  • %AppDataLocal%\pip\cache\http\f\e\{username}
  • %User Profile%\Documents\fp_18.0.0.203_archive\{username}
  • %System Root%\Python27\include\bufferobject.h.KEKW
  • %System Root%\Users\Public\Documents\word2k\DOC2KE03.doc.KEKW
  • %System Root%\Python27\Tools\pynche\namedcolors.txt.KEKW
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\crashes\events\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01\{username}
  • %Application Data%\Microsoft\Windows\IETldCache\container.dat.KEKW
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\{username}
  • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\{username}
  • %AppDataLocal%\Microsoft\Media Player\Sync Playlists\en-US\00007196\{username}
  • %User Profile%\Documents\powerpoint2k\{username}
  • %System Root%\Python27\Lib\test\cjkencodings\euc_jisx0213.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSScan\{username}
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\{username}
  • %System Root%\Users\All Users\Microsoft\Device Stage\Task\{{GUID}}\en-US\{username}.KEKW
  • %All Users Profile%\Microsoft\Network\Connections\{username}
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\{username}
  • %System Root%\Python27\Lib\xml\dom\{username}
  • %System Root%\Python27\tcl\tcl8.5\tzdata\SystemV\{username}
  • %AppDataLocal%\Google\Chrome\User Data\SSLErrorAssistant\7\{username}
  • %All Users Profile%\Oracle\Java\.oracle_jre_usage\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Backup\new\{username}
  • %Desktop%\powerpoint2k\{username}
  • %System Root%\Users\All Users\Mozilla\updates\{username}
  • %System Root%\Python27\Lib\test\cjkencodings\big5-utf8.txt.KEKW
  • %AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\RJ6VBH4W.DN2\{username}
  • %AppDataLocal%\Microsoft\Media Player\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_72da1383309c93bd2441accd728cf953e4fa97a_0a24a840\{username}.KEKW
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\bookmarkbackups\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\{username}.KEKW
  • %System Root%\Users\All Users\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_42.txt.KEKW
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-child-current.bin.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\CertificateRevocation\5140\{username}
  • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{4555A5E7-C06D-11E6-8AB1-005056BC3E18}.dat.KEKW
  • %All Users Profile%\Microsoft\Windows\WER\{username}
  • %All Users Profile%\McAfee\MCLOGS\SmallInstaller\{username}
  • %Application Data%\Microsoft\Windows\Libraries\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\3561288849sdhlie.files\{username}
  • %AppDataLocal%\Google\Chrome\User Data\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\{username}
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\no_entry.gif.KEKW
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\virtual\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\security\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\{username}
  • %System Root%\Python27\include\parsetok.h.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\{username}
  • %User Temp%\Adobe_ADMLogs\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp.KEKW
  • %System Root%\Users\Public\Favorites\{username}
  • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\GatherLogs\{username}
  • %User Profile%\Documents\fp_18.0.0.203_archive.zip.KEKW
  • %Application Data%\Microsoft\Protect\{username}
  • %AppDataLocal%\Google\Chrome\User Data\FileTypePolicies\{username}
  • %System Root%\Users\{username}\Videos\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\container.dat.KEKW
  • %System Root%\Python27\include\listobject.h.KEKW
  • %System Root%\Users\All Users\Microsoft\Vault\{username}.KEKW
  • %All Users Profile%\Microsoft\NetFramework\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Roses.jpg.KEKW
  • %System Root%\Python27\tcl\tix8.4.3\pref\WmDefault.txt.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_12.txt.KEKW
  • %User Temp%\WebInstaller\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Backup\{username}
  • %System Root%\Python27\tcl\dde1.3\{username}
  • %System Root%\Python27\Tools\pynche\README.txt.KEKW
  • %System Root%\Python27\Lib\xml\{username}
  • %AppDataLocal%\Microsoft\Feeds Cache\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_03.txt.KEKW
  • %All Users Profile%\Microsoft\Windows\Start Menu\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp.KEKW
  • %System Root%\Python27\Lib\json\tests\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\HandPrints.jpg.KEKW
  • %Application Data%\Microsoft\Proof\{username}
  • %System Root%\Python27\Tools\versioncheck\README.txt.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\_metadata\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Tablet PC\{username}.KEKW
  • %All Users Profile%\Microsoft\Windows NT\MSFax\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\9IWSW3EX\{username}
  • %System Root%\Python27\include\objimpl.h.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\big5hkscs-utf8.txt.KEKW
  • %System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\{username}.KEKW
  • %Desktop%\word2k\DOC2KExx.doc.KEKW
  • %Application Data%\Macromedia\Flash Player\macromedia.com\support\{username}
  • %All Users Profile%\Mozilla\updates\{username}
  • %System Root%\Python27\Lib\site-packages\setuptools\{username}
  • %System Root%\Python27\include\pyexpat.h.KEKW
  • %System Root%\Python27\Tools\Scripts\{username}
  • %System Root%\Users\Public\Videos\{username}
  • %User Profile%\Documents\word2k\DOC2KE05.doc.KEKW
  • %System Root%\Python27\Lib\idlelib\help.html.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Sqm\Sessions\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp.KEKW
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\adobephotoshopcs3.txt.KEKW
  • %System Root%\Python27\include\cobject.h.KEKW
  • %System Root%\Python27\tcl\tcl8.5\tzdata\Indian\{username}
  • %System Root%\Users\{username}\AppData\Local\Microsoft\{username}
  • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE02.ppt.KEKW
  • %User Temp%\dd_SetupUtility.txt.KEKW
  • %System Root%\Python27\tcl\tcl8.5\tzdata\US\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\11\{username}
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\15\{username}
  • %System Root%\Users\Public\Documents\word2k\DOC2KE01.doc.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\51\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg.KEKW
  • %System Root%\Python27\Lib\test\xmltestdata\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\SecurityPreloadState.txt.KEKW
  • %User Temp%\dd_vcredistMSI0FC1.txt.KEKW
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\urlCache-current.bin.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\packages\ssl_match_hostname\{username}
  • %Application Data%\Microsoft\Internet Explorer\UserData\{username}
  • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Power Efficiency Diagnostics\{username}
  • %Application Data%\Mozilla\Firefox\Crash Reports\{username}
  • %System Root%\Users\All Users\Oracle\Java\{username}.KEKW
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\openfold.gif.KEKW
  • %System Root%\Python27\include\ceval.h.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95\{username}.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\_trie\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\guest.bmp.KEKW
  • %AppDataLocal%\pip\cache\http\5\4\3\d\7\{username}
  • %System Root%\Users\Default\AppData\Local\Microsoft\Windows\GameExplorer\{username}
  • %System Root%\Users\All Users\Microsoft\WwanSvc\Profiles\{username}
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Python 2.7\{username}
  • %System Root%\Users\Public\Documents\excel2k\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\sessionstore-backups\{username}
  • %System Root%\Python27\include\pymacconfig.h.KEKW
  • %Application Data%\Microsoft\Windows\IECompatCache\Low\{username}
  • %System Root%\Python27\Lib\sqlite3\{username}
  • %AppDataLocal%\pip\cache\http\{username}
  • %System Root%\Python27\Lib\lib-tk\test\test_ttk\{username}
  • %System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\entry_points.txt.KEKW
  • %System Root%\Python27\Scripts\{username}
  • %System Root%\Python27\tcl\tcl8.5\{username}
  • %Application Data%\Microsoft\Windows\Recent\{username}
  • %AppDataLocal%\Microsoft\Feeds Cache\JPOHUSHF\{username}
  • %System Root%\Python27\Lib\test\exception_hierarchy.txt.KEKW
  • %System Root%\$Recycle.Bin\S-1-5-21-2407829820-1079796033-203259571-1000\{username}
  • %All Users Profile%\Microsoft\Windows\Sqm\Manifest\{username}
  • %User Temp%\{username}.bmp.KEKW
  • %AppDataLocal%\Microsoft\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp.KEKW
  • %Application Data%\Microsoft\Internet Explorer\Quick Launch\User Pinned\{username}
  • F:\data\tmp.doc.KEKW
  • %System Root%\Python27\Lib\lib2to3\tests\data\fixers\myfixes\{username}
  • %Favorites%\{username}
  • %System Root%\Users\All Users\Microsoft\RAC\PublishedData\{username}.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\certifi\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\{username}
  • %System Root%\Users\Public\Documents\excel2k\XLS2KE05.xls.KEKW
  • %All Users Profile%\Mozilla\updates\308046B0AF4A39CB\updates\0\{username}
  • %Application Data%\Macromedia\Flash Player\#SharedObjects\K48846QH\{username}
  • F:\data\photos\long_exposure.jpg.KEKW
  • %User Profile%\Links\{username}
  • %System Root%\Python27\libs\{username}
  • %System Root%\Users\Public\Documents\Email and Password List.txt.KEKW
  • %AppDataLocal%\Microsoft\Media Player\Sync Playlists\en-US\{username}
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\googledesktop.txt.KEKW
  • %System Root%\Python27\Lib\importlib\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\43\{username}.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\6\{username}
  • %System Root%\Python27\include\structmember.h.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\DeviceMetadataStore\en-US\{username}.KEKW
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\packages\backports\{username}
  • %AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\{username}
  • %System Root%\Python27\include\metagrammar.h.KEKW
  • %System Root%\Users\All Users\Microsoft\DRM\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\{username}.KEKW
  • %AppDataLocal%\Apps\2.0\Data\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\21\{username}
  • %System Root%\Python27\Lib\idlelib\{username}
  • %System Root%\Users\All Users\Oracle\Java\javapath_target_313094\{username}
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\Backup\{username}.KEKW
  • %AppDataLocal%\Microsoft\Internet Explorer\EmieSiteList\{username}
  • %AppDataLocal%\pip\cache\http\b\a\9\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_34.txt.KEKW
  • %System Root%\Python27\include\floatobject.h.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\idna\{username}
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\microsoftoffice2003.txt.KEKW
  • %Application Data%\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\{username}
  • %Desktop%\word2k\DOC2KE02.doc.KEKW
  • %Application Data%\Microsoft\Windows\Network Shortcuts\{username}
  • %Application Data%\Microsoft\Templates\{username}
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\plusarm.gif.KEKW
  • %All Users Profile%\Microsoft\Assistance\{username}
  • %System Root%\Python27\Lib\msilib\{username}
  • %System Root%\Python27\Lib\idlelib\help.txt.KEKW
  • %User Temp%\dd_vcredistUI0FC1.txt.KEKW
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\{username}
  • %System Root%\Python27\tcl\tk8.5\demos\{username}
  • %System Root%\Python27\tcl\tix8.4.3\pref\TK.cs.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\{username}.KEKW
  • %AppDataLocal%\Microsoft\Vault\{username}
  • %Application Data%\{username}
  • %AppDataLocal%\Microsoft\Windows\AppCache\6A582BR6\{username}
  • %System Root%\Users\All Users\Microsoft\Device Stage\Task\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\20\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\{username}.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\LastBld.dat.KEKW
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\{username}
  • %All Users Profile%\VMware\RawdskCompatibility\virtual\{username}
  • %AppDataLocal%\Google\Software Reporter Tool\settings.dat.KEKW
  • %System Root%\Python27\Lib\email\test\{username}
  • %System Root%\Python27\include\datetime.h.KEKW
  • %All Users Profile%\Microsoft\eHome\logs\{username}
  • %System Root%\Users\All Users\Oracle\Java\.oracle_jre_usage\{username}.KEKW
  • %System Root%\Python27\Lib\test\imghdrdata\python.gif.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F0\{username}.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\LocalCopy\{username}
  • %System Root%\Python27\Lib\test\cjkencodings\shift_jis.txt.KEKW
  • %System Root%\Users\Public\Recorded TV\{username}
  • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\{username}
  • %System Root%\Python27\Lib\site-packages\pkg_resources\_vendor\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\43\{username}
  • %Application Data%\Microsoft\Windows\DNTException\{username}
  • %Favorites%\Links for United States\{username}
  • %System Root%\powerpoint2k\PPT2KE03.ppt.KEKW
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Temp\usgthrsvc\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp.KEKW
  • %System Root%\Users\Public\Documents\word2k\DOC2KE05.doc.KEKW
  • %Application Data%\Microsoft\SystemCertificates\My\Keys\{username}
  • %System Root%\Users\Default\AppData\Local\Microsoft\Windows\History\{username}
  • %System Root%\Users\All Users\Microsoft\RAC\StateData\{username}
  • %Desktop%\word2k\DOC2KE04.doc.KEKW
  • %System Root%\Users\{username}\AppData\Roaming\{username}
  • %System Root%\Python27\Lib\email\test\data\{username}
  • %System Root%\Python27\include\cellobject.h.KEKW
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\{username}
  • %User Profile%\Videos\{username}
  • %User Temp%\Microsoft .NET Framework 4.5.2 Setup_20161212_135033207-MSI_netfx_Full_GDR_x64.msi.txt.KEKW
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\{username}
  • %AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\_platform_specific\{username}
  • %System Root%\Python27\Tools\pynche\html40colors.txt.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\9\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\82DF2NUK\{username}
  • %System Root%\Python27\Lib\test\sgml_input.html.KEKW
  • %AppDataLocal%\Microsoft\Feeds\{username}
  • %System Root%\Users\All Users\Microsoft\Windows NT\{username}.KEKW
  • %System Root%\Python27\include\pycapsule.h.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_24.txt.KEKW
  • %System Root%\Python27\include\pystrtod.h.KEKW
  • %AppDataLocal%\Microsoft\Internet Explorer\EmieUserList\container.dat.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Entries\{username}
  • %Application Data%\Microsoft\Windows\PrivacIE\container.dat.KEKW
  • %All Users Profile%\Microsoft\Windows NT\MSFax\Queue\{username}
  • %System Root%\Users\All Users\Microsoft\OFFICE\{username}
  • %System Root%\Python27\Lib\test\test_doctest2.txt.KEKW
  • %System Root%\Python27\include\abstract.h.KEKW
  • %System Root%\Python27\Lib\site-packages\Pillow-6.0.0.dist-info\top_level.txt.KEKW
  • %AppDataLocal%Low\Microsoft\Windows\AppCache\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\47\{username}
  • %System Root%\Users\All Users\McAfee\MCLOGS\Common\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Definition Updates\{username}
  • %System Root%\Python27\Lib\test\test_difflib_expect.html.KEKW
  • %User Profile%\Documents\excel2k\XLS2KE01.xls.KEKW
  • %User Profile%\Downloads\{username}
  • %System Root%\Python27\Lib\test\testtar.tar.KEKW
  • %Application Data%\Microsoft\Windows\IECompatUACache\container.dat.KEKW
  • %System Root%\$Recycle.Bin\{username}
  • %User Profile%\Searches\{username}
  • %System Root%\Python27\README.txt.KEKW
  • %All Users Profile%\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\DomainSuggestions\{username}
  • %User Profile%\Documents\fp_18.0.0.203_archive\18_0_r0_203\{username}
  • %System Root%\Python27\tcl\tix8.4.3\demos\bitmaps\tix.gif.KEKW
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\SentItems\{username}
  • %System Root%\Python27\Lib\test\cjkencodings\big5.txt.KEKW
  • %System Root%\Python27\Lib\lib-tk\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\chardet\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp.KEKW
  • %Desktop%\Transmag.doc.KEKW
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\{username}
  • %Favorites%\Microsoft Websites\{username}
  • %System Root%\Python27\Lib\site-packages\pkg_resources\_vendor\packaging\{username}
  • %System Root%\Python27\include\longintrepr.h.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\58\{username}
  • %All Users Profile%\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_43.txt.KEKW
  • %AppDataLocal%\pip\{username}
  • %AppDataLocal%\Google\Chrome\User Data\Crashpad\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\DRM\{username}
  • %System Root%\Python27\Lib\ctypes\test\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\Crashpad\reports\{username}
  • %System Root%\Users\Public\Pictures\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\26\{username}
  • %Favorites%\Windows Live\{username}
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\warning.gif.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0\{username}.KEKW
  • %System Root%\Python27\include\pyconfig.h.KEKW
  • %System Root%\Users\All Users\McAfee\{username}
  • %Application Data%\Microsoft\Windows\PrivacIE\{username}
  • %System Root%\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.KEKW
  • %All Users Profile%\Oracle\Java\javapath\{username}
  • %System Root%\Users\All Users\Microsoft\MSDN\{username}.KEKW
  • %System Root%\Users\All Users\McAfee\WinCore\{username}
  • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Indexed Rules\25\9.1\{username}
  • %System Root%\Python27\Lib\pydoc_data\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A\{username}.KEKW
  • %System Root%\Python27\tcl\tcl8.5\msgs\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5\{username}
  • %All Users Profile%\Microsoft\Windows\DRM\Cache\{username}
  • %System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\{username}
  • %All Users Profile%\Microsoft\Network\Downloader\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\progress\{username}
  • %User Temp%\chrome_BITS_3756_19263\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\pytoml\{username}
  • %System Root%\Users\All Users\Microsoft\RAC\Outbound\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\RAC\Temp\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_16.txt.KEKW
  • %System Root%\Users\Default\AppData\Local\Microsoft\Windows\{username}
  • %Application Data%\Mozilla\{username}
  • %Application Data%\Microsoft\Windows\IECompatUACache\Low\container.dat.KEKW
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\datareporting\archived\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\DRM\{username}.KEKW
  • %System Root%\Python27\Lib\wsgiref\{username}
  • %System Root%\Users\All Users\Microsoft\Network\Downloader\{username}
  • %User Profile%\Documents\excel2k\{username}
  • %User Profile%\Documents\fp_18.0.0.203_archive\18_0_r0_203_debug\{username}
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\{username}.KEKW
  • %System Root%\Python27\Lib\ensurepip\_bundled\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp.KEKW
  • %All Users Profile%\Oracle\Java\javapath_target_313094\{username}.KEKW
  • %User Profile%\Documents\powerpoint2k\PPT2KE03.ppt.KEKW
  • %AppDataLocal%\pip\cache\http\2\3\b\7\9\{username}
  • %All Users Profile%\Microsoft\OFFICE\{username}
  • %System Root%\Python27\Lib\lib2to3\tests\data\{username}
  • %System Root%\Python27\Lib\idlelib\Icons\openfolder.gif.KEKW
  • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE01.ppt.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\54\{username}
  • %All Users Profile%\Microsoft\Windows NT\MSFax\VirtualInbox\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\62\{username}
  • %System Root%\Users\All Users\Oracle\Java\.oracle_jre_usage\{username}
  • %System Root%\Python27\include\compile.h.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0\{username}
  • %Application Data%\Microsoft\Windows\{username}
  • %System Root%\powerpoint2k\PPT2KE05.ppt.KEKW
  • %System Root%\Users\Default\AppData\Local\{username}
  • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\SSScheduler\{username}.KEKW
  • %AppDataLocal%\{username}
  • %System Root%\Users\All Users\Microsoft\DeviceSync\{username}
  • F:\{username}
  • %System Root%\Python27\Lib\idlelib\Icons\tk.gif.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\RecoveryImproved\{username}
  • %System Root%\Python27\Tools\Scripts\README.txt.KEKW
  • %AppDataLocal%\Microsoft\Internet Explorer\EmieSiteList\container.dat.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\5\{username}
  • %All Users Profile%\Microsoft\Network\{username}
  • %System Root%\Python27\Lib\test\cjkencodings\iso2022_kr.txt.KEKW
  • %Application Data%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\{username}
  • %System Root%\Python27\tcl\tk8.5\demos\images\earth.gif.KEKW
  • %System Root%\Python27\tcl\tcl8.5\tzdata\Mexico\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5\{username}.KEKW
  • %All Users Profile%\Microsoft\Windows\DRM\blackbox.bin.KEKW
  • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo100.gif.KEKW
  • %User Profile%\Documents\word2k\DOC2KE03.doc.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\{username}.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_33.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp.KEKW
  • %System Root%\Python27\include\pymath.h.KEKW
  • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE05.ppt.KEKW
  • %System Root%\Python27\include\methodobject.h.KEKW
  • %System Root%\Python27\Lib\site-packages\pkg_resources\{username}
  • %Application Data%\Mozilla\Firefox\Pending Pings\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\TRRBlacklist.txt.KEKW
  • %System Root%\Users\All Users\Oracle\Java\installcache_x64\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\SSLErrorAssistant\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_01.txt.KEKW
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Stars.jpg.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\{username}
  • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieBrowserModeList\container.dat.KEKW
  • %System Root%\Users\All Users\Microsoft\Search\Data\Temp\{username}.KEKW
  • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\SSScheduler\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\cachecontrol\{username}
  • %System Root%\Python27\Lib\bsddb\{username}
  • %All Users Profile%\Adobe\Setup\{username}
  • %User Temp%\jawshtml.html.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp.KEKW
  • %System Root%\Users\All Users\Oracle\Java\javapath\{username}
  • %AppDataLocal%\Python-Eggs\Python-Eggs\Cache\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\webencodings\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\weave\failed\{username}
  • %System Root%\Users\All Users\Microsoft\RAC\{username}
  • %System Root%\Users\All Users\VMware\VMware Tools\Unity Filters\{username}.KEKW
  • %AppDataLocal%\pip\cache\http\f\e\d\0\{username}
  • %System Root%\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg.KEKW
  • %AppDataLocal%\Microsoft\Windows\History\Low\History.IE5\container.dat.KEKW
  • %System Root%\Users\All Users\Mozilla\{username}
  • %All Users Profile%\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.KEKW
  • %Desktop%\powerpoint2k\PPT2KExx.PPT.KEKW
  • %System Root%\Python27\Lib\site-packages\setuptools\extern\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\UrlBlockManager\{username}
  • %AppDataLocal%\Mozilla\Firefox\Profiles\{username}
  • %System Root%\Python27\tcl\tcl8\8.4\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Support\{username}
  • %User Profile%\Music\{username}
  • %All Users Profile%\Microsoft\Assistance\Client\1.0\{username}
  • %Application Data%\Identities\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Stucco.gif.KEKW
  • %System Root%\{username}
  • %System Root%\Python27\include\structseq.h.KEKW
  • %System Root%\Python27\include\ucnhash.h.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\60\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_internal\req\{username}
  • %System Root%\Python27\Lib\{username}
  • %System Root%\Python27\Lib\json\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\History\CacheManager\{username}
  • %System Root%\Python27\include\bytes_methods.h.KEKW
  • %System Root%\Users\Default\Favorites\{username}
  • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp.KEKW
  • %System Root%\Python27\Lib\lib-tk\test\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\{username}
  • %System Root%\Python27\Lib\ctypes\macholib\{username}
  • %System Root%\Python27\include\errcode.h.KEKW
  • %All Users Profile%\Microsoft\Search\{username}
  • %System Root%\Python27\Lib\site-packages\{username}
  • %User Temp%\mozilla-temp-files\{username}
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp.KEKW
  • %System Root%\Python27\include\bytearrayobject.h.KEKW
  • %AppDataLocal%\Microsoft\Windows Sidebar\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Active\{username}
  • %System Root%\Users\All Users\McAfee\MCLOGS\SmallInstaller\{username}.KEKW
  • %AppDataLocal%\Microsoft\Internet Explorer\imagestore\{username}
  • %System Root%\Python27\tcl\tcl8.5\tzdata\Europe\{username}
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\VMware\VMware Tools\{username}
  • %Desktop%\word2k\DOC2KE03.doc.KEKW
  • %System Root%\Python27\tcl\tix8.4.3\pref\TkWin.cs.KEKW
  • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo75.gif.KEKW
  • %System Root%\Python27\Tools\webchecker\README.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\{username}
  • %System Root%\Python27\tcl\tcl8.5\tzdata\Chile\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\{username}
  • %AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Pine_Lumber.jpg.KEKW
  • %Application Data%\Microsoft\SystemCertificates\My\Certificates\{username}
  • %AppDataLocal%\Microsoft\Windows\History\Low\History.IE5\{username}
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\safebrowsing\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp.KEKW
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Small_News.jpg.KEKW
  • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE04.ppt.KEKW
  • %Favorites%\Links\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\{username}.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\63\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Temp\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Resource\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\{username}
  • %System Root%\Python27\include\opcode.h.KEKW
  • %All Users Profile%\Microsoft\Windows\GameExplorer\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\70\{username}
  • %AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\RJ6VBH4W.DN2\clic...exe_9ae46cec200785df_0001.0003_none_d631acba18f736d8\{username}
  • %System Root%\Python27\Lib\test\cjkencodings\hz-utf8.txt.KEKW
  • %System Root%\Python27\Lib\email\test\data\PyBanner048.gif.KEKW
  • %System Root%\Python27\Lib\idlelib\Icons\plusnode.gif.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\16\{username}
  • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\McCHSvc\{username}
  • %System Root%\Python27\Tools\i18n\{username}
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache.bin.KEKW
  • %All Users Profile%\Microsoft\Windows NT\MSFax\Inbox\{username}
  • %System Root%\Users\All Users\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\{username}.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\30\{username}
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\{username}
  • %System Root%\Python27\include\sliceobject.h.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_06.txt.KEKW
  • %System Root%\Users\All Users\McAfee\MCLOGS\{username}
  • %AppDataLocal%\Microsoft\Feeds Cache\CRAV926P\{username}
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\{username}.KEKW
  • %System Root%\Python27\include\warnings.h.KEKW
  • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\{username}
  • %System Root%\Users\All Users\Oracle\{username}
  • %System Root%\Python27\Tools\pynche\websafe.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\Updates\{username}.KEKW
  • %All Users Profile%\Microsoft\Windows\DeviceMetadataStore\{username}
  • %System Root%\Python27\include\rangeobject.h.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\WidevineCdm\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_505c7fc25c7e5866de583f14c22e2b4c2a6018c_0a2493a7\{username}.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\{username}
  • %AppDataLocal%\pip\cache\http\d\3\7\{username}
  • %All Users Profile%\Microsoft\{username}
  • %System Root%\Python27\Lib\test\imghdrdata\python.jpg.KEKW
  • %All Users Profile%\Microsoft\Windows\WER\ReportArchive\{username}
  • %System Root%\excel2k\XLS2KE01.xls.KEKW
  • %AppDataLocal%\Microsoft\Credentials\{username}
  • %All Users Profile%\Microsoft\Device Stage\Task\{{GUID}}\en-US\{username}
  • %All Users Profile%\Microsoft\Windows\Power Efficiency Diagnostics\energy-report.html.KEKW
  • %User Temp%\hsperfdata_{username}\{username}
  • %AppDataLocal%\pip\cache\http\3\{username}
  • %System Root%\Recovery\{username}
  • %AppDataLocal%\pip\cache\http\a\6\9\b\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\48\{username}
  • %All Users Profile%\Microsoft\Network\Downloader\qmgr1.dat.KEKW
  • %System Root%\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\VMware Tools\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1D\{username}
  • %System Root%\Python27\Lib\lib-tk\test\test_tkinter\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Quick\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01\{username}
  • %System Root%\Python27\tcl\tk8.5\demos\images\tcllogo.gif.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1D\{username}.KEKW
  • %All Users Profile%\Microsoft\User Account Pictures\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\{username}
  • %System Root%\Users\Public\Music\Sample Music\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp.KEKW
  • %System Root%\Python27\include\frameobject.h.KEKW
  • %AppDataLocal%\pip\cache\http\a\6\{username}
  • %System Root%\Python27\include\token.h.KEKW
  • %System Root%\Python27\include\sysmodule.h.KEKW
  • %All Users Profile%\Microsoft\OFFICE\Groove\{username}
  • %System Root%\Users\All Users\Adobe\{username}.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\pnacl\{username}
  • %System Root%\Python27\include\node.h.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3\{username}.KEKW
  • %AppDataLocal%\Google\Software Reporter Tool\reports\{username}
  • %All Users Profile%\Microsoft\MF\{username}
  • %System Root%\Users\All Users\Microsoft\eHome\logs\{username}
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Startup\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Service\{username}
  • %System Root%\Python27\Lib\lib2to3\tests\data\fixers\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\WER\{username}.KEKW
  • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\McCHSvc\{username}.KEKW
  • %Application Data%\Microsoft\Windows\Recent\AutomaticDestinations\{username}
  • %Application Data%\Microsoft\Internet Explorer\Quick Launch\{username}
  • %System Root%\Python27\Lib\email\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0\{username}
  • %System Root%\Python27\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47\{username}.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\29\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\distlib\_backport\{username}
  • %All Users Profile%\VMware\RawdskCompatibility\native\{username}
  • %System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\updates\0\{username}
  • %System Root%\Users\All Users\Microsoft\Assistance\{username}
  • %System Root%\Python27\Lib\tkinter\{username}
  • %System Root%\Python27\include\boolobject.h.KEKW
  • %System Root%\Users\Default\AppData\Roaming\Media Center Programs\{username}
  • %AppDataLocal%\Google\Chrome\User Data\SSLErrorAssistant\7\_metadata\{username}
  • %System Root%\Python27\include\pyfpe.h.KEKW
  • %AppDataLocal%\pip\cache\http\f\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp.KEKW
  • %Desktop%\excel2k\XLS2KExx.xls.KEKW
  • %AppDataLocal%\Microsoft\Windows\AppCache\6A582BR6\container.dat.KEKW
  • %System Root%\Python27\Lib\tkinter\test\{username}
  • %Application Data%\Microsoft\Document Building Blocks\{username}
  • %AppDataLocal%\Microsoft\Windows\WER\{username}
  • %All Users Profile%\Microsoft\Search\Data\Temp\usgthrsvc\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\datareporting\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Tanspecks.jpg.KEKW
  • %AppDataLocal%\pip\cache\http\a\{username}
  • %System Root%\Python27\include\pystate.h.KEKW
  • %Application Data%\Sun\{username}
  • %AppDataLocal%\Google\Chrome\User Data\InterventionPolicyDatabase\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\GameExplorer\{username}.KEKW
  • %System Root%\Python27\Tools\versioncheck\{username}
  • %System Root%\Users\All Users\Microsoft\DRM\Server\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\10\{username}
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\plus.gif.KEKW
  • %System Root%\Users\Public\Downloads\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Tablet PC\{username}
  • %System Root%\Python27\include\moduleobject.h.KEKW
  • %Desktop%\excel2k\XLS2KE05.xls.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_internal\utils\{username}
  • %System Root%\Users\All Users\McAfee\MCLOGS\Common\SmallInstaller\{username}.KEKW
  • %System Root%\Users\Default\Saved Games\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp.KEKW
  • %AppDataLocal%Low\Microsoft\Windows\{username}
  • %AppDataLocal%\pip\cache\http\a\6\9\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_505c7fc25c7e5866de583f14c22e2b4c2a6018c_0a2493a7\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\{username}.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_internal\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\43\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01\{username}.KEKW
  • %Application Data%\Microsoft\AddIns\{username}
  • %Desktop%\excel2k\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Sand_Paper.jpg.KEKW
  • %AppDataLocal%\pip\cache\http\4\e\e\3\1\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\{username}
  • %System Root%\Python27\Lib\site-packages\PIL\{username}
  • %System Root%\Python27\include\cStringIO.h.KEKW
  • %Application Data%\Microsoft\Windows\IECompatCache\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\{username}.KEKW
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp.KEKW
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp.KEKW
  • %All Users Profile%\Microsoft\Windows\DeviceMetadataStore\en-US\{username}
  • %All Users Profile%\VMware\{username}
  • %System Root%\Users\Default\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\{username}
  • %AppDataLocal%\pip\cache\http\d\3\7\e\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\log\{username}
  • %All Users Profile%\Microsoft\RAC\{username}
  • %System Root%\Users\All Users\VMware\VMware Tools\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\chardet\cli\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\55\{username}
  • %User Profile%\Documents\excel2k\XLS2KE04.xls.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\euc_kr.txt.KEKW
  • %All Users Profile%\Microsoft\Windows NT\MSFax\SentItems\{username}
  • %System Root%\Email and Password List.js.KEKW
  • %System Root%\Users\All Users\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\{username}.KEKW
  • %All Users Profile%\Microsoft\eHome\{username}
  • %System Root%\PerfLogs\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\crashes\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp.KEKW
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp.KEKW
  • %All Users Profile%\Microsoft\RAC\StateData\{username}
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Queue\{username}
  • %System Root%\Users\Public\Documents\excel2k\XLS2KE03.xls.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\{username}.KEKW
  • %System Root%\Python27\Lib\idlelib\Icons\idle_16.gif.KEKW
  • %Application Data%\Microsoft\Windows\IECompatUACache\Low\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Templates\{username}.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_14.txt.KEKW
  • %System Root%\Python27\include\timefuncs.h.KEKW
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\{username}.KEKW
  • %AppDataLocal%\Apps\2.0\Data\RNQG94OQ.QJC\{username}
  • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Indexed Rules\25\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\{username}.KEKW
  • %AppDataLocal%Low\Microsoft\Internet Explorer\Services\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Sqm\Upload\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Network\Downloader\{username}.KEKW
  • %System Root%\Python27\tcl\tk8.5\images\{username}
  • %System Root%\Python27\Lib\lib2to3\{username}
  • %System Root%\Python27\Lib\site-packages\pkg_resources\extern\{username}
  • %System Root%\Users\All Users\{username}
  • %AppDataLocal%\Microsoft\Windows\WER\ReportQueue\{username}
  • %All Users Profile%\Microsoft\Search\Data\{username}
  • %AppDataLocal%\pip\cache\http\4\e\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\{username}
  • %System Root%\Python27\Lib\ctypes\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\colorama\{username}
  • %All Users Profile%\McAfee\MCLOGS\Common\{username}
  • %System Root%\Python27\Lib\multiprocessing\dummy\{username}
  • %Application Data%\Microsoft\Windows\IETldCache\Low\{username}
  • %System Root%\Python27\include\longobject.h.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\iso2022_jp.txt.KEKW
  • %System Root%\Python27\Lib\tkinter\test\test_ttk\{username}
  • %System Root%\Users\All Users\Oracle\Java\installcache_x64\{username}.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\euc_jisx0213-utf8.txt.KEKW
  • %AppDataLocal%\pip\cache\http\2\3\b\7\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_36.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\OFFICE\Groove\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\History\Service\{username}
  • %System Root%\Users\All Users\Microsoft\NetFramework\BreadcrumbStore\{username}.KEKW
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\{username}
  • %System Root%\Python27\include\classobject.h.KEKW
  • %System Root%\Users\Public\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp.KEKW
  • %System Root%\excel2k\XLS2KE03.xls.KEKW
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\{username}
  • %AppDataLocal%\pip\cache\http\4\e\e\{username}
  • %System Root%\Users\Default\Documents\{username}
  • %Application Data%\Microsoft\Word\{username}
  • %All Users Profile%\McAfee\MCLOGS\PartnerCustom\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\31\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_37.txt.KEKW
  • %System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\entry_points.txt.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\SwReporter\40.200.201.3\_metadata\{username}
  • %Application Data%\Microsoft\Windows\IECompatCache\Low\container.dat.KEKW
  • %Application Data%\Microsoft\Windows\SendTo\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\2LHHLFH6\{username}
  • %System Root%\Python27\tcl\tcl8.5\tzdata\Asia\{username}
  • %System Root%\Users\All Users\Microsoft\IlsCache\{username}.KEKW
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\{username}
  • %System Root%\Python27\Lib\logging\{username}
  • %AppDataLocal%\Apps\{username}
  • %All Users Profile%\{username}
  • %AppDataLocal%\Google\Chrome\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Config\{username}
  • %System Root%\excel2k\XLS2KExx.xls.KEKW
  • %System Root%\Users\Public\Desktop\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\_platform_specific\all\{username}
  • %System Root%\Users\All Users\Adobe\ARM\Reader_19.010.20099\{username}.KEKW
  • %AppDataLocal%\Microsoft\Windows\1024\{username}
  • %Application Data%\Microsoft\Office\Recent\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_12a.txt.KEKW
  • %System Root%\Users\Public\Documents\word2k\DOC2KExx.doc.KEKW
  • %AppDataLocal%\Google\{username}
  • %AppDataLocal%\pip\cache\http\3\8\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5\{username}
  • %System Root%\Python27\tcl\tcl8.5\opt0.4\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\{username}.KEKW
  • %System Root%\Python27\Tools\pynche\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\2\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Templates\{username}
  • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo150.gif.KEKW
  • %System Root%\Users\Default\AppData\Local\Microsoft\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\25\{username}
  • %System Root%\Users\All Users\Microsoft\RAC\Outbound\{username}
  • %System Root%\Python27\tcl\tcl8.5\tzdata\Atlantic\{username}
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\adobeflashcs3.txt.KEKW
  • %AppDataLocal%\Microsoft\Media Player\Sync Playlists\{username}
  • %All Users Profile%\McAfee\MCLOGS\PartnerCustom\550F8967-2EE2-4F33-8E16-1BFFBE114803\{username}
  • %All Users Profile%\VMware\VMware Tools\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\Tiles\{username}
  • F:\wlines.zip.KEKW
  • %AppDataLocal%\Microsoft\Feeds\Microsoft Feeds~\{username}
  • %System Root%\Users\All Users\McAfee\MCLOGS\SmallInstaller\{username}
  • %System Root%\Python27\include\unicodeobject.h.KEKW
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\{username}.KEKW
  • %AppDataLocal%\Microsoft\Feeds Cache\NWKETFVL\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\CacheManager\{username}
  • %System Root%\Users\Public\Documents\word2k\DOC2KE04.doc.KEKW
  • %System Root%\Users\All Users\Microsoft\DRM\{username}.KEKW
  • %User Profile%\Documents\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F0\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\extensions\{username}
  • %System Root%\Python27\Lib\test\subprocessdata\{username}
  • %System Root%\Python27\Lib\test\audiodata\pluck-pcm32.wav.KEKW
  • %System Root%\Python27\include\codecs.h.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_31.txt.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\SwReporter\40.200.201.3\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\brndlog.txt.KEKW
  • %Application Data%\Mozilla\Firefox\{username}
  • %System Root%\powerpoint2k\PPT2KE04.ppt.KEKW
  • %AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\RJ6VBH4W.DN2\goog...app_9ae46cec200785df_0001.0003_7581c0cd83ac8659\{username}
  • %System Root%\Users\All Users\Microsoft\OFFICE\Groove\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp.KEKW
  • %System Root%\Python27\tcl\tix8.4.3\pref\Bisque.cs.KEKW
  • %Desktop%\powerpoint2k\PPT2KE05.ppt.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\{username}
  • %System Root%\powerpoint2k\PPT2KE02.ppt.KEKW
  • %System Root%\Python27\Lib\idlelib\Icons\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43\{username}
  • %AppDataLocal%\Microsoft\Windows\1033\StructuredQuerySchema.bin.KEKW
  • %Application Data%\Microsoft\Excel\{username}
  • %Application Data%\Microsoft\Spelling\{username}
  • %User Profile%\Documents\powerpoint2k\PPT2KE02.ppt.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\iso2022_kr-utf8.txt.KEKW
  • %All Users Profile%\Mozilla\{username}
  • %Application Data%\Sun\Java\Deployment\{username}
  • %AppDataLocal%\Microsoft\Feeds Cache\COOE7IBP\{username}
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\{username}
  • %AppDataLocal%\Microsoft\Windows\1033\{username}
  • %All Users Profile%\Microsoft\Windows NT\MSScan\{username}
  • %System Root%\Users\Public\Recorded TV\Sample Media\{username}
  • %All Users Profile%\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_72da1383309c93bd2441accd728cf953e4fa97a_0a24a840\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\2PEMJMIY\{username}
  • %System Root%\Python27\Lib\idlelib\Icons\idle_48.gif.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\{username}
  • %AppDataLocal%Low\Microsoft\Windows\AppCache\LY14JQYG\{username}
  • %System Root%\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\{username}
  • %System Root%\Users\All Users\Adobe\ARM\S\{username}.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_23.txt.KEKW
  • %AppDataLocal%\Microsoft\Office\ONetConfig\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\packaging\{username}
  • %System Root%\Users\All Users\Microsoft\RAC\Temp\{username}.KEKW
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\DATA\{username}
  • %AppDataLocal%\Microsoft\Feeds Cache\NKNYYDHU\{username}
  • %User Temp%\dd_vcredistUI0FD5.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\AIT\{username}.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\{username}
  • %System Root%\Users\All Users\Microsoft\NetFramework\{username}
  • %Application Data%\Microsoft\MMC\{username}
  • %User Profile%\Saved Games\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_32.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Media Player\{username}.KEKW
  • %AppDataLocal%Low\Microsoft\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\{username}.KEKW
  • %System Root%\Python27\Lib\email\mime\{username}
  • %System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\{username}.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\{username}
  • %Desktop%\Email and Password List.txt.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\gb2312.txt.KEKW
  • %System Root%\Python27\include\funcobject.h.KEKW
  • %AppDataLocal%\Microsoft\Internet Explorer\frameiconcache.dat.KEKW
  • %System Root%\Python27\Lib\sqlite3\test\{username}
  • %System Root%\Users\All Users\Oracle\Java\javapath\{username}.KEKW
  • %AppDataLocal%\Microsoft\Internet Explorer\{username}
  • %System Root%\Python27\Tools\pynche\X\rgb.txt.KEKW
  • %AppDataLocal%\Microsoft\Windows\WER\ReportArchive\{username}
  • %System Root%\Users\All Users\Adobe\ARM\S\{username}
  • %Application Data%\Mozilla\Firefox\Crash Reports\events\{username}
  • %All Users Profile%\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3\{username}
  • %All Users Profile%\Microsoft\Windows\Ringtones\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\tmp\si\{username}
  • %System Root%\Python27\Lib\bsddb\test\{username}
  • %AppDataLocal%\Mozilla\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\35\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Cave_Drawings.gif.KEKW
  • %AppDataLocal%\pip\cache\http\5\{username}
  • %All Users Profile%\McAfee\MCLOGS\Common\SmallInstaller\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Ringtones\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Resource\{username}
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0\{username}
  • %System Root%\Python27\Lib\test\imghdrdata\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Bears.jpg.KEKW
  • %System Root%\Python27\Lib\test\audiodata\pluck-pcm24.wav.KEKW
  • %System Root%\Python27\Lib\idlelib\Icons\python.gif.KEKW
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\file.gif.KEKW
  • %System Root%\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.KEKW
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\gmp\WINNT_x86_64-msvc\{username}
  • %System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\top_level.txt.KEKW
  • %Application Data%\Media Center Programs\{username}
  • %Application Data%\Microsoft\Protect\S-1-5-21-2407829820-1079796033-203259571-500\{username}
  • %AppDataLocal%\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\{username}
  • %Desktop%\word2k\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0\{username}.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\pnacl\0.57.44.2492\_metadata\{username}
  • %System Root%\$Recycle.Bin\S-1-5-21-2407829820-1079796033-203259571-500\$IC8HJH8.zip.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\49\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\DeviceMetadataStore\{username}.KEKW
  • %System Root%\Users\Default\Pictures\{username}
  • %Application Data%\Macromedia\Flash Player\#SharedObjects\{username}
  • %System Root%\Python27\include\pyport.h.KEKW
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\prefs.js.KEKW
  • %System Root%\Users\All Users\Microsoft\eHome\{username}.KEKW
  • %System Root%\Python27\tcl\tk8.5\demos\images\earthris.gif.KEKW
  • %AppDataLocal%\pip\cache\http\b\a\9\3\{username}
  • %System Root%\Python27\Lib\lib2to3\pgen2\{username}
  • %System Root%\powerpoint2k\PPT2KE01.ppt.KEKW
  • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE03.ppt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Python 2.7\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\{username}
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\ActivityLog\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\{username}
  • %User Profile%\Documents\excel2k\XLS2KE03.xls.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\{username}.KEKW
  • %AppDataLocal%\pip\cache\http\0\2\5\2\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Java\{username}.KEKW
  • %System Root%\Python27\include\asdl.h.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\{username}.KEKW
  • %Desktop%\excel2k\XLS2KE04.xls.KEKW
  • %System Root%\Users\Public\Documents\{username}
  • %AppDataLocal%\Microsoft\Windows\WebCache\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Java\{username}
  • %System Root%\Users\All Users\Mozilla\{username}.KEKW
  • %All Users Profile%\Microsoft\Vault\{username}
  • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieSiteList\container.dat.KEKW
  • %User Profile%\Documents\excel2k\XLS2KE05.xls.KEKW
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\{username}.KEKW
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Blue_Gradient.jpg.KEKW
  • %System Root%\Python27\Lib\distutils\{username}
  • %User Temp%\dd_wcf_CA_smci_20161212_135109_353.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Python 2.7\{username}.KEKW
  • %Desktop%\note.txt.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\13\{username}
  • %AppDataLocal%\Google\Chrome\User Data\pnacl\0.57.44.2492\_platform_specific\{username}
  • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\{username}
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\{username}
  • %All Users Profile%\Microsoft\OFFICE\DATA\{username}
  • %Desktop%\Email and Password List.js.KEKW
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\gmp\{username}
  • %All Users Profile%\Microsoft\Windows NT\MSFax\Common Coverpages\{username}
  • %All Users Profile%\Microsoft Help\{username}
  • %AppDataLocal%\pip\cache\http\7\e\9\{username}
  • %System Root%\Python27\include\pygetopt.h.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\44\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Quick\{username}.KEKW
  • %System Root%\Python27\Lib\site-packages\Pillow-6.0.0.dist-info\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_17.txt.KEKW
  • %System Root%\Python27\Lib\test\leakers\README.txt.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_38.txt.KEKW
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\White_Chocolate.jpg.KEKW
  • %Application Data%\Microsoft\Excel\XLSTART\{username}
  • %AppDataLocal%\pip\cache\{username}
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\{username}.KEKW
  • %Application Data%\Microsoft\SystemCertificates\My\{username}
  • %System Root%\Python27\include\pythread.h.KEKW
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\DRM\Cache\{username}.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_21.txt.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\36\{username}
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp.KEKW
  • %AppDataLocal%\Microsoft\Office\Groove\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Peacock.jpg.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Indexed Rules\{username}
  • %System Root%\Users\{username}\AppData\Roaming\Microsoft\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_72da1383309c93bd2441accd728cf953e4fa97a_0a24a840\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Quarantine\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\32\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\{username}.KEKW
  • %System Root%\Users\Public\Documents\excel2k\XLS2KE04.xls.KEKW
  • %System Root%\Python27\tcl\tcl8.5\tzdata\Pacific\{username}
  • %System Root%\Users\Default\Music\{username}
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\DATA\{username}.KEKW
  • %AppDataLocal%\Microsoft\Windows\Explorer\{username}
  • %System Root%\Python27\Lib\test\test_doctest4.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Caches\{username}.KEKW
  • %System Root%\Python27\tcl\tix8.4.3\pref\SGIGray.cs.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\{username}
  • %System Root%\Python27\include\code.h.KEKW
  • %System Root%\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\{username}.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95\{username}
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\textfile.gif.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\PepperFlash\32.0.0.171\_metadata\{username}
  • %System Root%\Python27\include\enumobject.h.KEKW
  • %System Root%\Users\Default\Downloads\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Sqm\Sessions\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Sqm\Manifest\{username}
  • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\550F8967-2EE2-4F33-8E16-1BFFBE114803\{username}.KEKW
  • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\{username}
  • %System Root%\Python27\Lib\idlelib\HISTORY.txt.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\johab.txt.KEKW
  • %System Root%\Python27\include\py_curses.h.KEKW
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\thumbnails\{username}
  • %System Root%\Python27\Lib\compiler\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\1D\{username}
  • %System Root%\Python27\tcl\tk8.5\demos\images\{username}
  • %System Root%\Python27\include\pgen.h.KEKW
  • %System Root%\Python27\Lib\test\crashers\{username}
  • %AppDataLocal%\Python-Eggs\Python-Eggs\{username}
  • %System Root%\Python27\include\pydebug.h.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\PepperFlash\32.0.0.171\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_internal\vcs\{username}
  • %Application Data%\Microsoft\Windows\PrivacIE\Low\{username}
  • %User Temp%\CR_E83EE.tmp\{username}
  • %System Root%\Python27\include\patchlevel.h.KEKW
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\{username}
  • %System Root%\Users\Public\Music\Sample Music\Sleep Away.mp3.KEKW
  • %System Root%\Python27\Lib\encodings\{username}
  • %System Root%\Python27\Lib\site-packages\setuptools\_vendor\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_26.txt.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\53\{username}
  • %User Profile%\{username}
  • %System Root%\Users\All Users\Microsoft\eHome\logs\{username}.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\28\{username}
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\{username}
  • %AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\_platform_specific\all\sths\{username}
  • %System Root%\Python27\Tools\pynche\X\{username}
  • %System Root%\Users\All Users\Microsoft\WwanSvc\{username}
  • %System Root%\Users\All Users\Microsoft\Network\{username}
  • %AppDataLocal%Low\Sun\{username}
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\{username}
  • %System Root%\Python27\Tools\pynche\X\xlicense.txt.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Definition Updates\{0E1465B0-BA9C-409F-BC32-D934317129CD}\{username}
  • %System Root%\Python27\tcl\tix8.4.3\demos\samples\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp.KEKW
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp.KEKW
  • %System Root%\Python27\include\pystrcmp.h.KEKW
  • %System Root%\Python27\tcl\tcl8.5\tzdata\Brazil\{username}
  • %System Root%\Users\Public\Videos\Sample Videos\{username}
  • %AppDataLocal%\Google\Chrome\User Data\MEIPreload\{username}
  • %AppDataLocal%\Microsoft\Windows\AppCache\container.dat.KEKW
  • %System Root%\Python27\Lib\site-packages\README.txt.KEKW
  • %System Root%\Python27\include\bytesobject.h.KEKW
  • %AppDataLocal%\Microsoft\Windows\AppCache\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\24\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\{username}
  • %System Root%\Python27\tcl\tcl8.5\tzdata\America\{username}
  • %System Root%\Users\{username}\AppData\Local\Microsoft\Media Player\{username}
  • %All Users Profile%\Mozilla\updates\308046B0AF4A39CB\{username}
  • %System Root%\Python27\tcl\tcl8.5\tzdata\America\North_Dakota\{username}
  • %AppDataLocal%\Apps\2.0\Data\RNQG94OQ.QJC\E1WGPJBQ.PMC\goog...app_9ae46cec200785df_0001.0003_7581c0cd83ac8659\Data\{username}
  • %System Root%\Users\All Users\Microsoft\RAC\StateData\RacMetaData.dat.KEKW
  • %System Root%\Users\Public\Pictures\Sample Pictures\Penguins.jpg.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\{username}
  • %Application Data%\Microsoft\Word\STARTUP\{username}
  • %System Root%\Python27\Lib\test\test_doctest3.txt.KEKW
  • %System Root%\Python27\Lib\site-packages\pythonnet-2.1.0.dist-info\top_level.txt.KEKW
  • %System Root%\Users\{username}
  • %System Root%\Users\Public\Documents\excel2k\XLS2KE02.xls.KEKW
  • %System Root%\Users\All Users\Microsoft\Device Stage\{username}.KEKW
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp.KEKW
  • %AppDataLocal%\Microsoft\Feeds Cache\8TQ1M9OZ\{username}
  • %Application Data%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\{username}
  • %Desktop%\excel2k\XLS2KE03.xls.KEKW
  • %Application Data%\Microsoft\Windows\DNTException\container.dat.KEKW
  • %System Root%\Python27\include\pyctype.h.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\gb18030.txt.KEKW
  • %System Root%\Python27\Lib\xml\sax\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Monet.jpg.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_44.txt.KEKW
  • %Application Data%\Mozilla\Extensions\{username}
  • %AppDataLocal%\pip\cache\http\5\4\3\d\{username}
  • %System Root%\Users\All Users\Microsoft\Vault\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_29.txt.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_45.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\RAC\StateData\RacWmiEventData.dat.KEKW
  • %System Root%\Python27\Lib\distutils\tests\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\EmieUserList\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\pkg_resources\{username}
  • %System Root%\Python27\Lib\test\audiodata\pluck-pcm16.wav.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\{username}.KEKW
  • %AppDataLocal%\pip\cache\http\3\8\9\{username}
  • %User Profile%\AppData\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_13.txt.KEKW

  Soluciones

Motor de exploración mínimo 9.850

Step 1

Los usuarios de Windows ME y XP, antes de llevar a cabo cualquier exploración, deben comprobar que tienen desactivada la opción Restaurar sistema para permitir la exploración completa del equipo.

Step 2

Reiniciar en modo seguro

[ aprenda más ]

Step 3

Identificar y terminar los archivos detectados como TrojanSpy.MSIL.URSNIF.THCBFBO

[ aprenda más ]
  1. Para los usuarios de Windows 98 y ME, puede que el Administrador de tareas de Windows no muestre todos los procesos en ejecución. En tal caso, utilice un visor de procesos de una tercera parte (preferiblemente, el Explorador de procesos) para terminar el archivo de malware/grayware/spyware. Puede descargar la herramienta en cuestión aquí.
  2. Si el archivo detectado aparece en el Administrador de tareas o en el Explorador de procesos, pero no puede eliminarlo, reinicie el equipo en modo seguro. Para ello, consulte este enlace para obtener todos los pasos necesarios.
  3. Si el archivo detectado no se muestra en el Administrador de tareas o el Explorador de procesos, prosiga con los pasos que se indican a continuación.

Step 4

Buscar y eliminar estos archivos

[ aprenda más ]
Puede que algunos de los archivos del componente estén ocultos. Asegúrese de que tiene activada la casilla Buscar archivos y carpetas ocultos en la opción "Más opciones avanzadas" para que el resultado de la búsqueda incluya todos los archivos y carpetas ocultos.
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\{username}
  • %All Users Profile%\Microsoft\Search\Data\Applications\{username}
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\{username}
  • %Start Menu%\Programs\Administrative Tools\{username}
  • %AppDataLocal%Low\Mozilla\{username}
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Java\{username}
  • %AppDataLocal%\pip\cache\http\a\1\9\5\{username}
  • %System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\updates\0\{username}.KEKW
  • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo175.gif.KEKW
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pings\{username}
  • %System Root%\Python27\include\pgenheaders.h.KEKW
  • %User Temp%\dd_vcredistMSI0FD5.txt.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\50\{username}
  • %System Root%\Python27\Lib\hotshot\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47\{username}
  • %System Root%\powerpoint2k\PPT2KExx.PPT.KEKW
  • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieUserList\container.dat.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_07.txt.KEKW
  • %System Root%\Python27\include\Python-ast.h.KEKW
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\virtual\{username}.KEKW
  • %System Root%\Python27\Lib\idlelib\Icons\minusnode.gif.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\treeadapters\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp.KEKW
  • %System Root%\Users\{username}\AppData\Roaming\Microsoft\Windows\Libraries\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\{username}
  • %Desktop%\word2k\DOC2KE01.doc.KEKW
  • %AppDataLocal%\pip\cache\http\7\e\9\8\0\{username}
  • %System Root%\Users\Default\AppData\Roaming\{username}
  • %System Root%\Python27\include\ast.h.KEKW
  • %System Root%\Python27\Lib\idlelib\extend.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Device Stage\Task\{{GUID}}\{username}.KEKW
  • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\Un_A\{username}.KEKW
  • %System Root%\word2k\DOC2KE02.doc.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Store\{username}.KEKW
  • %System Root%\Python27\NEWS.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Assistance\Client\{username}
  • %System Root%\Python27\Lib\test\zipdir.zip.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\johab-utf8.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1D\{username}
  • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo200.gif.KEKW
  • %AppDataLocal%\Microsoft\Internet Explorer\VersionManager\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1D\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\util\{username}
  • %System Root%\Users\All Users\Microsoft\Assistance\Client\{username}.KEKW
  • %User Temp%\Low\{username}
  • F:\data\photos\{username}
  • %System Root%\Users\Public\Pictures\Sample Pictures\{username}
  • %System Root%\Users\All Users\McAfee\MCLOGS\Common\{username}.KEKW
  • %Start Menu%\{username}
  • %Application Data%\Microsoft\UProof\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\{username}.KEKW
  • %AppDataLocal%\pip\cache\http\a\6\9\b\d\{username}
  • %System Root%\excel2k\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Pretty_Peacock.jpg.KEKW
  • %System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\dependency_links.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\{username}
  • %System Root%\Python27\Lib\idlelib\Icons\idle_32.gif.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_35.txt.KEKW
  • %AppDataLocal%\pip\cache\http\7\e\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\{username}
  • %All Users Profile%\Microsoft\Assistance\Client\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\F0\{username}
  • %AppDataLocal%\Microsoft\Feeds Cache\container.dat.KEKW
  • %System Root%\Users\All Users\Mozilla\updates\{username}.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\treewalkers\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\22\{username}
  • %System Root%\Users\{username}\Music\{username}
  • %System Root%\Users\Public\Music\Sample Music\Kalimba.mp3.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Definition Updates\Updates\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A\{username}
  • %System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\top_level.txt.KEKW
  • %System Root%\Python27\tcl\reg1.2\{username}
  • %System Root%\Python27\include\pymem.h.KEKW
  • %System Root%\Users\All Users\Microsoft\IdentityCRL\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\{username}.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\shift_jisx0213.txt.KEKW
  • %AppDataLocal%\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_internal\commands\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp.KEKW
  • %System Root%\word2k\DOC2KE05.doc.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\{username}.KEKW
  • %System Root%\PerfLogs\Admin\{username}
  • %System Root%\Python27\tcl\tcl8\8.5\{username}
  • %AppDataLocal%\pip\cache\http\d\3\7\e\0\{username}
  • %System Root%\Python27\Lib\test\cjkencodings\cp949-utf8.txt.KEKW
  • %System Root%\Python27\tcl\tcl8.5\tzdata\Etc\{username}
  • %System Root%\Python27\Lib\test\cjkencodings\gb2312-utf8.txt.KEKW
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\minusarm.gif.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\muffin\{username}
  • %System Root%\Python27\Lib\test\capath\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\CacheManager\{username}.KEKW
  • %System Root%\Python27\Tools\pynche\webcolors.txt.KEKW
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\SoftBlue.jpg.KEKW
  • %AppDataLocal%\pip\cache\http\d\3\{username}
  • %AppDataLocal%\pip\cache\http\2\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\39\{username}
  • %All Users Profile%\Microsoft\Windows\Sqm\Upload\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\18\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_22.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\{username}
  • %System Root%\Users\All Users\Microsoft\RAC\PublishedData\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp.KEKW
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\datareporting\archived\2019-05\{username}
  • %System Root%\Users\Default\Videos\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\{username}.KEKW
  • %Application Data%\Microsoft\SystemCertificates\My\CRLs\{username}
  • %System Root%\Python27\tcl\tcl8\8.4\platform\{username}
  • %System Root%\Python27\include\descrobject.h.KEKW
  • %System Root%\Python27\include\dictobject.h.KEKW
  • %System Root%\Python27\Lib\test\imghdrdata\python.bmp.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\OriginTrials\{username}
  • %System Root%\Users\Default\AppData\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\requests\{username}
  • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.1\{username}
  • %System Root%\Users\Public\Documents\excel2k\XLS2KExx.xls.KEKW
  • %System Root%\Python27\tcl\tk8.5\images\logo100.gif.KEKW
  • %System Root%\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\7\{username}
  • %AppDataLocal%Low\{username}
  • %System Root%\Python27\tcl\tcl8.5\tzdata\Australia\{username}
  • %System Root%\Users\All Users\Microsoft\MF\{username}
  • %System Root%\Python27\Lib\test\cjkencodings\gb18030-utf8.txt.KEKW
  • %Application Data%\Macromedia\Flash Player\macromedia.com\support\flashplayer\{username}
  • %System Root%\Python27\tcl\tcl8.5\http1.0\{username}
  • %Desktop%\powerpoint2k\PPT2KE02.ppt.KEKW
  • %System Root%\Users\All Users\Microsoft\IlsCache\{username}
  • %System Root%\Python27\include\modsupport.h.KEKW
  • %Desktop%\excel2k\XLS2KE01.xls.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_11.txt.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_46.txt.KEKW
  • %System Root%\Users\All Users\Microsoft Help\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\Tiles\pin9728060290\{username}
  • %All Users Profile%\Oracle\Java\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\52\{username}
  • %Favorites%\MSN Websites\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\{username}.KEKW
  • %AppDataLocal%Low\Microsoft\Windows\AppCache\LY14JQYG\container.dat.KEKW
  • %User Profile%\Documents\Email and Password List.txt.KEKW
  • %User Temp%\WPDNSE\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\Backup\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_05.txt.KEKW
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\2918063365piupsah.files\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\{username}
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\folder.gif.KEKW
  • %AppDataLocal%\pip\cache\http\a\1\{username}
  • %AppDataLocal%\Google\Chrome\User Data\SwReporter\{username}
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-child.bin.KEKW
  • %All Users Profile%\McAfee\WinCore\{username}
  • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.1\_metadata\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg.KEKW
  • %AppDataLocal%\Deployment\{username}
  • %AppDataLocal%\Apps\2.0\Data\RNQG94OQ.QJC\E1WGPJBQ.PMC\goog...app_9ae46cec200785df_0001.0003_7581c0cd83ac8659\{username}
  • %System Root%\Python27\tcl\tix8.4.3\demos\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\{username}
  • %System Root%\Python27\Lib\test\cjkencodings\euc_kr-utf8.txt.KEKW
  • %System Root%\Python27\Lib\idlelib\NEWS.txt.KEKW
  • %Application Data%\Macromedia\Flash Player\{username}
  • %Application Data%\Microsoft\Credentials\{username}
  • %All Users Profile%\VMware\RawdskCompatibility\native\C\{username}
  • %System Root%\Python27\Lib\site-packages\pip\{username}
  • %AppDataLocal%\Google\Chrome\User Data\FileTypePolicies\34\_metadata\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\{username}
  • %AppDataLocal%\Google\Chrome\User Data\BrowserMetrics\{username}
  • %Application Data%\Macromedia\Flash Player\macromedia.com\{username}
  • %Application Data%\Mozilla\SystemExtensionsDev\{username}
  • %User Profile%\Documents\word2k\{username}
  • %System Root%\Python27\Lib\test\audiodata\pluck-pcm8.wav.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp.KEKW
  • %AppDataLocal%\pip\cache\http\0\2\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\mpcache-B1C01FED9F08520A4647901EFB883A6A3B247F8D.bin.KEKW
  • %AppDataLocal%\Apps\2.0\Data\RNQG94OQ.QJC\E1WGPJBQ.PMC\{username}
  • %AppDataLocal%\Microsoft\Windows\History\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\DeviceMetadataStore\en-US\{username}
  • %System Root%\Python27\Lib\test\floating_points.txt.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\37\{username}
  • %System Root%\Python27\Lib\lib2to3\fixes\{username}
  • %System Root%\Users\All Users\Microsoft\RAC\StateData\RacWmiDataBookmarks.dat.KEKW
  • %User Profile%\Documents\word2k\DOC2KE02.doc.KEKW
  • %AppDataLocal%\pip\cache\http\7\{username}
  • %System Root%\Users\Public\Pictures\Sample Pictures\Desert.jpg.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70\{username}
  • %All Users Profile%\Microsoft\Windows\WER\ReportQueue\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\{username}.KEKW
  • %System Root%\Users\{username}\Pictures\{username}
  • %System Root%\Python27\tcl\tix8.4.3\demos\bitmaps\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\host\{username}
  • %AppDataLocal%\pip\cache\http\b\a\9\3\5\{username}
  • %System Root%\Python27\Lib\test\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\8\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\{username}.KEKW
  • %Application Data%\Microsoft\Internet Explorer\{username}
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\VMware\{username}
  • %AppDataLocal%\Microsoft\Feeds Cache\M7X9O6Z1\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Caches\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\IECompatData\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\19\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_internal\models\{username}
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\minus.gif.KEKW
  • %AppDataLocal%\pip\cache\http\f\e\d\0\e\{username}
  • %System Root%\Python27\Lib\test\math_testcases.txt.KEKW
  • %System Root%\Users\Public\Libraries\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\42\{username}
  • %Application Data%\Microsoft\Office\Recent\index.dat.KEKW
  • %System Root%\Python27\include\traceback.h.KEKW
  • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\History\CacheManager\MpSfc.bin.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Support\{username}.KEKW
  • %AppDataLocal%\pip\cache\http\5\4\{username}
  • %All Users Profile%\Microsoft\Device Stage\Task\{{GUID}}\{username}
  • %All Users Profile%\VMware\RawdskCompatibility\{username}
  • %System Root%\Python27\Lib\distutils\command\{username}
  • %System Root%\Users\All Users\Microsoft\Device Stage\Task\{username}.KEKW
  • %AppDataLocal%\Microsoft\Windows\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp.KEKW
  • %Application Data%\Microsoft\Windows\Templates\{username}
  • %AppDataLocal%\Python-Eggs\Python-Eggs\Cache\pillow-4.1.0-py2.7-win32.egg-tmp\{username}
  • %System Root%\Users\Public\Documents\powerpoint2k\{username}
  • %AppDataLocal%\Microsoft\Feeds Cache\NNO7APUS\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\tabiconcache.dat.KEKW
  • %System Root%\Users\Public\Pictures\Sample Pictures\Koala.jpg.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95\{username}
  • %System Root%\Python27\Lib\test\leakers\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\33\{username}
  • %User Temp%\dd_NDP452-KB2901907-x86-x64-AllOS-ENU_decompression_log.txt.KEKW
  • %System Root%\Users\All Users\Oracle\Java\javapath_target_313094\{username}.KEKW
  • %AppDataLocal%\pip\cache\http\7\e\9\8\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\{username}.KEKW
  • %System Root%\Python27\Lib\multiprocessing\{username}
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\SentItems\{username}.KEKW
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Psychedelic.jpg.KEKW
  • %AppDataLocal%\pip\cache\http\4\{username}
  • %User Profile%\Contacts\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Device Stage\Task\{{GUID}}\en-US\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Entries\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Inbox\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\msgpack\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\34\{username}
  • %AppDataLocal%\Microsoft\Office\Groove\User\{username}
  • %All Users Profile%\Microsoft\Network\Downloader\qmgr0.dat.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\pnacl\0.57.44.2492\_platform_specific\x86_64\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\70\{username}.KEKW
  • %System Root%\Python27\Lib\idlelib\idle_test\README.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\AIT\{username}
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Sqm\Upload\{username}
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\vmwarefilters.txt.KEKW
  • %System Root%\Users\All Users\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\eHome\{username}
  • %System Root%\Python27\Lib\test\cjkencodings\cp949.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\{username}.KEKW
  • %System Root%\Python27\include\iterobject.h.KEKW
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\cache2\entries\{username}
  • %AppDataLocal%\Google\Chrome\User Data\InterventionPolicyDatabase\2018.9.6.0\{username}
  • %All Users Profile%\Microsoft\OFFICE\DATA\opa12.dat.KEKW
  • %System Root%\Users\Default\Links\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp.KEKW
  • %All Users Profile%\McAfee\MCLOGS\PartnerCustom\SSScheduler\{username}
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\{username}
  • %System Root%\Python27\include\import.h.KEKW
  • %AppDataLocal%\pip\cache\http\0\2\5\{username}
  • %System Root%\Users\Default\AppData\Local\Temp\{username}
  • %All Users Profile%\VMware\VMware Tools\manifest.txt.KEKW
  • %All Users Profile%\Mozilla\updates\308046B0AF4A39CB\updates\{username}
  • %AppDataLocal%\Microsoft\Windows\Burn\{username}
  • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KExx.PPT.KEKW
  • %AppDataLocal%\Microsoft\Internet Explorer\UrlBlockManager\urlblocklist.bin.KEKW
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts\{username}
  • %AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\{username}
  • %System Root%\Users\Public\Documents\excel2k\XLS2KE01.xls.KEKW
  • %AppDataLocal%\Microsoft\Internet Explorer\imagestore\1s32qbz\{username}
  • %User Profile%\Documents\word2k\DOC2KE01.doc.KEKW
  • %System Root%\Users\All Users\VMware\VMware Tools\Unity Filters\{username}
  • %System Root%\Users\All Users\VMware\{username}.KEKW
  • %System Root%\Users\Public\Music\{username}
  • %System Root%\Users\All Users\Microsoft\OFFICE\DATA\{username}
  • %System Root%\Python27\Lib\test\cjkencodings\euc_jp-utf8.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\DRM\Cache\{username}
  • %All Users Profile%\Microsoft\NetFramework\BreadcrumbStore\{username}
  • %User Profile%\Documents\excel2k\XLS2KE02.xls.KEKW
  • %System Root%\Python27\Lib\site-packages\pythonnet-2.1.0.dist-info\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\{username}.KEKW
  • %User Profile%\Documents\powerpoint2k\PPT2KE05.ppt.KEKW
  • %System Root%\Users\All Users\Microsoft\DRM\Server\{username}.KEKW
  • %System Root%\Users\{username}\AppData\Roaming\Microsoft\Windows\{username}
  • %System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\LICENSE.txt.KEKW
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\datareporting\archived\2019-04\{username}
  • %System Root%\Users\All Users\Microsoft\Media Player\{username}
  • %System Root%\Users\All Users\Microsoft\OFFICE\{username}.KEKW
  • %Application Data%\Microsoft\Windows\DNTException\Low\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\{username}
  • %System Root%\Python27\tcl\tcl8.5\tzdata\Arctic\{username}
  • %System Root%\Python27\include\fileobject.h.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Scans\History\Results\Resource\{username}
  • %AppDataLocal%\Microsoft\Feeds\Feeds for United States~\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp.KEKW
  • %AppDataLocal%\pip\cache\http\5\4\3\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp.KEKW
  • %System Root%\Python27\tcl\tcl8.5\tzdata\Canada\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\3UYAQU1F\{username}
  • %AppDataLocal%\Microsoft\Windows\Ringtones\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Connectivity.gif.KEKW
  • %User Temp%\Microsoft .NET Framework 4.5.2 Setup_20161212_135033207.html.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\56\{username}
  • %User Profile%\Documents\powerpoint2k\PPT2KE04.ppt.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\hz.txt.KEKW
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\cache2\doomed\{username}
  • %System Root%\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\{username}
  • %System Root%\Users\All Users\Microsoft\Device Stage\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\WER\{username}
  • %System Root%\Python27\include\eval.h.KEKW
  • %All Users Profile%\Microsoft\Device Stage\Task\{username}
  • %System Root%\Python27\include\intobject.h.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp.KEKW
  • %System Root%\word2k\DOC2KE03.doc.KEKW
  • %System Root%\$Recycle.Bin\S-1-5-21-2407829820-1079796033-203259571-500\{username}
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Maintenance\{username}
  • %AppDataLocal%\Google\Chrome\User Data\ShaderCache\GPUCache\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3\{username}
  • %All Users Profile%\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\{username}
  • %System Root%\excel2k\XLS2KE02.xls.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\VMware Tools\{username}.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\shift_jis-utf8.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Assistance\{username}.KEKW
  • %Application Data%\Microsoft\Vault\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_19.txt.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Scans\History\Results\Quick\{username}
  • %System Root%\Python27\tcl\tcl8.5\tzdata\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Store\{username}
  • %System Root%\Users\All Users\Microsoft\RAC\{username}.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\gbk-utf8.txt.KEKW
  • %All Users Profile%\Microsoft\Windows\Sqm\Sessions\{username}
  • %System Root%\Users\{username}\AppData\{username}
  • %System Root%\Python27\tcl\tcl8.5\tzdata\Africa\{username}
  • %All Users Profile%\McAfee\MCLOGS\PartnerCustom\Un_A\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\61\{username}
  • %System Root%\Python27\Lib\site-packages\setuptools\command\{username}
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\srcfile.gif.KEKW
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-current.bin.KEKW
  • %All Users Profile%\McAfee\MCLOGS\PartnerCustom\McCHSvc\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp.KEKW
  • %All Users Profile%\Microsoft\Windows\DRM\{username}
  • %System Root%\Python27\Tools\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Config\{username}.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\shift_jisx0213-utf8.txt.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_08.txt.KEKW
  • %All Users Profile%\Microsoft\MSDN\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\{AD285A8B-713F-11E9-85F8-005056BC44A9}.dat.KEKW
  • %System Root%\Python27\Lib\test\decimaltestdata\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\LocalCopy\{username}
  • %System Root%\Users\All Users\Microsoft\MSDN\8.0\{username}.KEKW
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp.KEKW
  • %System Root%\Python27\Lib\test\test_doctest.txt.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\pep517\{username}
  • %System Root%\Python27\include\osdefs.h.KEKW
  • %System Root%\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.KEKW
  • %All Users Profile%\Microsoft\Windows NT\MSFax\ActivityLog\{username}
  • %AppDataLocal%\pip\cache\http\0\{username}
  • %AppDataLocal%\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\{username}
  • %AppDataLocal%\Microsoft\Windows\WebCache\WebCacheV01.dat.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\contrib\_securetransport\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\4\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5\{username}
  • %All Users Profile%\Oracle\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\GUFNQG0Q\{username}
  • %User Temp%\acrocef_low\{username}
  • %System Root%\Python27\Doc\{username}
  • %User Profile%\Documents\powerpoint2k\PPT2KE01.ppt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSScan\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\{username}
  • %System Root%\Python27\tcl\tcl8.5\tzdata\America\Argentina\{username}
  • %System Root%\Users\All Users\Microsoft\OFFICE\DATA\{username}.KEKW
  • %AppDataLocal%\Microsoft\Internet Explorer\Tracking Protection\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\LocalCopy\{username}.KEKW
  • %System Root%\Python27\LICENSE.txt.KEKW
  • %System Root%\Users\All Users\Adobe\Setup\{username}
  • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\{username}.KEKW
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\act_fold.gif.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Scans\{username}
  • %System Root%\Python27\Lib\test\cjkencodings\big5hkscs.txt.KEKW
  • %System Root%\Users\{username}\AppData\Local\{username}
  • %System Root%\Python27\tcl\tk8.5\images\logoMed.gif.KEKW
  • %All Users Profile%\Microsoft\RAC\Outbound\{username}
  • %System Root%\Python27\Lib\xml\etree\{username}
  • %Application Data%\Microsoft\Document Building Blocks\1033\{username}
  • %All Users Profile%\Microsoft\Windows\Sqm\{username}
  • %System Root%\Python27\tcl\tix8.4.3\{username}
  • %AppDataLocal%\Google\Chrome\User Data\InterventionPolicyDatabase\2018.9.6.0\_metadata\{username}
  • %System Root%\Python27\tcl\tix8.4.3\pref\TixGray.cs.KEKW
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp.KEKW
  • %System Root%\Recovery\{GUID}\{username}
  • %Start Menu%\Programs\Accessories\Accessibility\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\History\{username}
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\{username}
  • %AppDataLocal%\pip\cache\http\3\8\9\3\{username}
  • %Application Data%\Microsoft\Windows\IEDownloadHistory\container.dat.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.1\LICENSE.txt.KEKW
  • %All Users Profile%\Microsoft\Search\Data\Temp\{username}
  • %System Root%\Python27\include\pyerrors.h.KEKW
  • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\PDYB5D8B\{username}
  • %AppDataLocal%Low\Microsoft\Windows\AppCache\container.dat.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\{username}
  • %System Root%\Users\Public\Pictures\Sample Pictures\Tulips.jpg.KEKW
  • %System Root%\Users\All Users\Microsoft\NetFramework\BreadcrumbStore\{username}
  • %All Users Profile%\Microsoft\Windows\Power Efficiency Diagnostics\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\Updates\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\1\{username}
  • %System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\updates\{username}.KEKW
  • %All Users Profile%\Oracle\Java\installcache_x64\{username}
  • %System Root%\Users\All Users\Microsoft\Network\Connections\{username}.KEKW
  • %System Root%\Email and Password List.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\{username}.KEKW
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\pkcs11.txt.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_27.txt.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\0\{username}
  • %Application Data%\Microsoft\Office\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Power Efficiency Diagnostics\{username}.KEKW
  • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieUserList\{username}
  • %System Root%\Python27\include\pyarena.h.KEKW
  • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieBrowserModeList\{username}
  • %Desktop%\powerpoint2k\PPT2KE04.ppt.KEKW
  • %System Root%\Users\Public\Documents\word2k\DOC2KE02.doc.KEKW
  • %Application Data%\Microsoft\Windows\Printer Shortcuts\{username}
  • %System Root%\Python27\Lib\test\cjkencodings\euc_jp.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp.KEKW
  • %System Root%\Python27\Lib\lib2to3\tests\{username}
  • %System Root%\Users\All Users\Microsoft\DeviceSync\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F0\{username}
  • %System Root%\Users\All Users\McAfee\MCLOGS\{username}.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_04.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\DeviceMetadataStore\{username}
  • %System Root%\Python27\include\setobject.h.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_internal\operations\{username}
  • %Desktop%\word2k\DOC2KE05.doc.KEKW
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\info.gif.KEKW
  • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\8YC9813O\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\{username}
  • %System Root%\Python27\tcl\tix8.4.3\pref\WmDefault.cs.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\contrib\{username}
  • %All Users Profile%\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\DATA\{username}
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\vistasidebar.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Sqm\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\{username}
  • %System Root%\Users\All Users\Adobe\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\{username}
  • %Start Menu%\Programs\{username}
  • %Desktop%\{username}
  • %User Profile%\Documents\excel2k\XLS2KExx.xls.KEKW
  • %AppDataLocal%\pip\cache\http\b\a\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\F0\{username}
  • %System Root%\Python27\tcl\tk8.5\msgs\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43\{username}.KEKW
  • %System Root%\Python27\include\marshal.h.KEKW
  • %System Root%\Python27\Lib\test\audiodata\{username}
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Microsoft Office\{username}
  • %System Root%\Python27\Lib\idlelib\README.txt.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\12\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Definition Updates\Backup\{username}
  • %AppDataLocal%\pip\cache\http\f\e\d\{username}
  • %System Root%\Python27\include\Python.h.KEKW
  • %System Root%\Users\All Users\Microsoft\Network\{username}.KEKW
  • %All Users Profile%\Microsoft\IdentityCRL\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\{username}
  • %All Users Profile%\Oracle\Java\javapath_target_313094\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_41.txt.KEKW
  • %System Root%\Python27\tcl\tk8.5\images\logoLarge.gif.KEKW
  • %System Root%\Python27\tcl\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Quarantine\{username}.KEKW
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_15.txt.KEKW
  • %AppDataLocal%Low\Sun\Java\{username}
  • %System Root%\Python27\Lib\curses\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\MSIMGSIZ.DAT.KEKW
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\{username}
  • %System Root%\Python27\include\graminit.h.KEKW
  • %AppDataLocal%\Microsoft\TaskSchedulerConfig\{username}
  • F:\data\dolist.txt.KEKW
  • %AppDataLocal%\Microsoft\PlayReady\{username}
  • %Start Menu%\Programs\Maintenance\{username}
  • %User Temp%\{username}
  • %AppDataLocal%\Microsoft\Windows Media\{username}
  • %AppDataLocal%\Microsoft\Windows\Burn\Burn\{username}
  • %System Root%\Python27\tcl\tk8.5\images\logo64.gif.KEKW
  • %All Users Profile%\Microsoft\RAC\Temp\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Entries\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\{username}.KEKW
  • %Desktop%\powerpoint2k\PPT2KE03.ppt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\{username}
  • %All Users Profile%\Microsoft\Windows\AIT\{username}
  • %System Root%\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Queue\{username}.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\treebuilders\{username}
  • %User Profile%\Documents\Email and Password List.js.KEKW
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\urlCache.bin.KEKW
  • %System Root%\Python27\include\pythonrun.h.KEKW
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Tablet PC\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\{username}
  • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\550F8967-2EE2-4F33-8E16-1BFFBE114803\{username}
  • %AppDataLocal%\Microsoft Help\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_09.txt.KEKW
  • %System Root%\Python27\include\pymactoolbox.h.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_02.txt.KEKW
  • %AppDataLocal%\Microsoft\Windows\WER\ReportArchive\NonCritical_iexplore.exe_12df8271b62395a348f102b12959f9768e2baf9_0be7f64f\{username}
  • %System Root%\Python27\Lib\test\support\{username}
  • %System Root%\word2k\DOC2KE01.doc.KEKW
  • %System Root%\Users\All Users\Microsoft\IdentityCRL\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\SiteSecurityServiceState.txt.KEKW
  • %System Root%\Python27\Lib\test\tokenize_tests.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70\{username}.KEKW
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Tiki.gif.KEKW
  • %System Root%\Python27\include\stringobject.h.KEKW
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg.KEKW
  • %System Root%\Users\All Users\Microsoft Help\{username}.KEKW
  • %System Root%\Python27\Lib\idlelib\idle_test\{username}
  • %System Root%\Users\All Users\VMware\VMware Tools\{username}.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\packages\{username}
  • %AppDataLocal%\pip\cache\http\2\3\b\{username}
  • %AppDataLocal%\pip\cache\http\4\e\e\3\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\weave\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Ringtones\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp.KEKW
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\{username}
  • %System Root%\Python27\include\grammar.h.KEKW
  • %AppDataLocal%\pip\cache\http\2\3\{username}
  • %System Root%\excel2k\XLS2KE04.xls.KEKW
  • %All Users Profile%\Microsoft\Assistance\Client\1.0\en-US\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\{username}.dat.KEKW
  • %System Root%\Python27\Lib\test\formatfloat_testcases.txt.KEKW
  • %System Root%\Python27\tcl\tcl8\{username}
  • %AppDataLocal%\Microsoft\Windows Media\12.0\{username}
  • %System Root%\Python27\tcl\tk8.5\ttk\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\{username}.KEKW
  • %System Root%\Python27\tcl\tix8.4.3\pref\Blue.cs.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\3\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\{username}
  • %System Root%\Python27\DLLs\{username}
  • %System Root%\Python27\Lib\idlelib\CREDITS.txt.KEKW
  • %All Users Profile%\McAfee\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_39.txt.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\41\{username}
  • %Application Data%\Microsoft\SystemCertificates\My\CTLs\{username}
  • %System Root%\Users\All Users\VMware\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp.KEKW
  • %System Root%\Python27\tcl\tcl8.5\encoding\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\46\{username}
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\{username}.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_internal\cli\{username}
  • %Application Data%\Sun\Java\{username}
  • %Application Data%\Microsoft\Windows\IEDownloadHistory\{username}
  • %AppDataLocal%\Python-Eggs\{username}
  • %AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\RJ6VBH4W.DN2\manifests\{username}
  • %Application Data%\Microsoft\Windows\IETldCache\{username}
  • %System Root%\Users\All Users\Adobe\ARM\{username}
  • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieSiteList\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\{0E1465B0-BA9C-409F-BC32-D934317129CD}\{username}.KEKW
  • %System Root%\Python27\include\complexobject.h.KEKW
  • %System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\updates\{username}
  • %Start Menu%\Programs\Accessories\{username}
  • %System Root%\Python27\Lib\idlelib\TODO.txt.KEKW
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Sqm\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\59\{username}
  • %Application Data%\Microsoft\Windows\IECompatUACache\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\tmp\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_30.txt.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\70\{username}
  • %AppDataLocal%\Mozilla\Firefox\{username}
  • %Application Data%\Identities\{3D0FBFE3-9E5C-4F14-8D00-F0C8FEFA78BA}\{username}
  • %System Root%\Users\All Users\McAfee\{username}.KEKW
  • %All Users Profile%\Microsoft\Windows\Caches\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\{username}
  • %System Root%\Users\All Users\Microsoft\Device Stage\Task\{{GUID}}\{username}
  • %AppDataLocal%\pip\cache\http\a\1\9\{username}
  • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\Un_A\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\{username}
  • %AppDataLocal%\pip\cache\http\b\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_40.txt.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0\{username}
  • %System Root%\Users\All Users\Microsoft\WwanSvc\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\{username}.KEKW
  • %System Root%\powerpoint2k\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Sqm\Manifest\{username}.KEKW
  • %AppDataLocal%\GDIPFONTCACHEV1.DAT.KEKW
  • %All Users Profile%\VMware\RawdskCompatibility\native\C\ProgramData\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\57\{username}
  • %AppDataLocal%\pip\cache\http\3\8\9\3\0\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\{username}.KEKW
  • %System Root%\Python27\tcl\tcl8.5\tzdata\America\Indiana\{username}
  • %System Root%\Users\All Users\Microsoft\Network\Connections\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\pluginreg.dat.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\{username}.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_28.txt.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\gbk.txt.KEKW
  • %All Users Profile%\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_505c7fc25c7e5866de583f14c22e2b4c2a6018c_0a2493a7\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\History\Results\{username}
  • %System Root%\Users\All Users\Adobe\Setup\{username}.KEKW
  • %AppDataLocal%\Microsoft\Windows\WebCacheLock.dat.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\23\{username}
  • %System Root%\Users\All Users\Microsoft\MF\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Assistance\Client\1.0\{username}.KEKW
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Wrinkled_Paper.gif.KEKW
  • %User Profile%\Documents\powerpoint2k\PPT2KExx.PPT.KEKW
  • %User Profile%\Documents\word2k\DOC2KE04.doc.KEKW
  • %System Root%\excel2k\XLS2KE05.xls.KEKW
  • %System Root%\Python27\Lib\idlelib\Icons\folder.gif.KEKW
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\{username}.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportQueue\{username}
  • %System Root%\Python27\include\object.h.KEKW
  • %Start Menu%\Programs\Accessories\System Tools\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\38\{username}
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Quarantine\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\distlib\{username}
  • %System Root%\word2k\{username}
  • %Start Menu%\Programs\ImDisk\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\27\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\14\{username}
  • %System Root%\Users\All Users\McAfee\MCLOGS\Common\SmallInstaller\{username}
  • %System Root%\Users\{username}\{username}
  • %All Users Profile%\Microsoft\RAC\PublishedData\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\user.bmp.KEKW
  • %System Root%\Python27\include\intrcheck.h.KEKW
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\visualstudio2005.txt.KEKW
  • %Desktop%\AAljoOV.jpg.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1D\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\{username}
  • %AppDataLocal%\Google\Software Reporter Tool\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Support\{username}
  • %AppDataLocal%\Google\Chrome\User Data\Crashpad\settings.dat.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\{username}.KEKW
  • %System Root%\Users\Public\Documents\Email and Password List.js.KEKW
  • %Application Data%\Microsoft\{username}
  • %System Root%\Users\Default\NTUSER.DAT.KEKW
  • %System Root%\Users\All Users\Microsoft\Search\Data\Temp\usgthrsvc\{username}.KEKW
  • %System Root%\Python27\include\weakrefobject.h.KEKW
  • %All Users Profile%\McAfee\MCLOGS\{username}
  • %System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\{username}
  • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\{username}
  • %System Root%\Python27\include\bitset.h.KEKW
  • %System Root%\Users\All Users\Microsoft\RAC\StateData\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Assistance\Client\1.0\{username}
  • %System Root%\Python27\Lib\unittest\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\{username}
  • %System Root%\Python27\Lib\test\imghdrdata\python.png.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\ShaderCache\{username}
  • %AppDataLocal%\Google\Chrome\User Data\pnacl\0.57.44.2492\{username}
  • %Application Data%\Microsoft\Windows\IECompatCache\container.dat.KEKW
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp.KEKW
  • F:\data\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\History\Store\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\minidumps\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp.KEKW
  • %All Users Profile%\Microsoft\Windows NT\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\{username}.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_18.txt.KEKW
  • %System Root%\word2k\DOC2KExx.doc.KEKW
  • %System Root%\Python27\tcl\tcl8.5\tzdata\Antarctica\{username}
  • %System Root%\Users\All Users\Microsoft\Search\{username}.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\Safe Browsing\{username}
  • %System Root%\Python27\tcl\tcl8.5\tzdata\America\Kentucky\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\{username}.KEKW
  • %System Root%\Python27\include\genobject.h.KEKW
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp.KEKW
  • %All Users Profile%\Microsoft\Windows\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\EmieBrowserModeList\container.dat.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\{0E1465B0-BA9C-409F-BC32-D934317129CD}\{username}
  • %System Root%\Python27\include\dtoa.h.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\43\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\{username}
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\45\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\ActivityLog\{username}.KEKW
  • %Application Data%\Microsoft\Internet Explorer\UserData\Low\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3\{username}
  • %System Root%\Python27\Lib\site-packages\setuptools\_vendor\packaging\{username}
  • %System Root%\Users\All Users\Microsoft\MSDN\8.0\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_20.txt.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\CertificateRevocation\5140\_metadata\{username}
  • %User Temp%\Guest.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\{username}.KEKW
  • %User Profile%\Documents\word2k\DOC2KExx.doc.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Inbox\{username}.KEKW
  • %System Root%\Users\Public\Documents\word2k\{username}
  • %User Temp%\Deployment\{username}
  • %AppDataLocal%\pip\cache\http\d\{username}
  • %System Root%\Users\All Users\Microsoft\Search\{username}
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\safebrowsing\google4\{username}
  • %System Root%\Users\All Users\Microsoft\MSDN\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\F0\{username}.KEKW
  • %AppDataLocal%Low\Microsoft\Internet Explorer\{username}
  • %All Users Profile%\Microsoft\DeviceSync\{username}
  • %Application Data%\Macromedia\{username}
  • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\Config\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\40\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Garden.jpg.KEKW
  • %System Root%\Users\All Users\Oracle\{username}.KEKW
  • %All Users Profile%\Microsoft\IlsCache\{username}
  • %System Root%\Python27\Lib\xml\parsers\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp.KEKW
  • %AppDataLocal%\pip\cache\http\0\2\5\2\b\{username}
  • %System Root%\word2k\DOC2KE04.doc.KEKW
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\weave\toFetch\{username}
  • %All Users Profile%\Microsoft\Device Stage\{username}
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Games\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\TabRoaming\{username}
  • %Desktop%\excel2k\XLS2KE02.xls.KEKW
  • %System Root%\Python27\Lib\lib2to3\Grammar.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\{username}.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\iso2022_jp-utf8.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp.KEKW
  • %All Users Profile%\Adobe\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\17\{username}
  • F:\data\photos\stunning.jpg.KEKW
  • %System Root%\Python27\include\memoryobject.h.KEKW
  • %AppDataLocal%\Microsoft\Office\Groove\System\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\lockfile\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\EmieBrowserModeList\{username}
  • %All Users Profile%\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\{username}
  • %System Root%\Python27\Lib\test\tracedmodules\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\GameExplorer\{username}
  • %System Root%\Python27\tcl\tk8.5\images\tai-ku.gif.KEKW
  • %User Profile%\Pictures\{username}
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\OfflineCache\{username}
  • %AppDataLocal%\pip\cache\http\a\1\9\5\3\{username}
  • %System Root%\Users\Default\Desktop\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\{username}
  • %System Root%\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\filters\{username}
  • %All Users Profile%\VMware\RawdskCompatibility\native\regdata.dat.KEKW
  • %System Root%\Users\All Users\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\{username}
  • %All Users Profile%\Microsoft\Windows\Templates\{username}
  • %System Root%\Python27\Lib\ensurepip\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\imagestore\joppu72\{username}
  • %User Temp%\dd_wcf_CA_smci_20161212_135110_351.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\NetFramework\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\{username}.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\CertificateRevocation\{username}
  • %System Root%\Python27\Lib\lib2to3\PatternGrammar.txt.KEKW
  • %System Root%\Python27\Lib\test\cmath_testcases.txt.KEKW
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\cache2\{username}
  • %System Root%\Users\All Users\McAfee\WinCore\{username}.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\FileTypePolicies\34\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Service\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportQueue\{username}.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_25.txt.KEKW
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\{username}
  • %System Root%\Python27\tcl\tix8.4.3\pref\Gray.cs.KEKW
  • %AppDataLocal%\Microsoft\Office\{username}
  • %AppDataLocal%\Microsoft\Windows\History\Low\{username}
  • %System Root%\Python27\include\symtable.h.KEKW
  • %System Root%\Python27\tcl\tix8.4.3\pref\{username}
  • %AppDataLocal%\Google\Chrome\User Data\PepperFlash\{username}
  • %System Root%\Python27\tcl\tk8.5\{username}
  • %Desktop%\powerpoint2k\PPT2KE01.ppt.KEKW
  • %All Users Profile%\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47\{username}
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Administrative Tools\{username}
  • %AppDataLocal%\Microsoft\Windows\GameExplorer\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\AlternateServices.txt.KEKW
  • %System Root%\Users\All Users\Oracle\Java\{username}
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\{username}
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\{username}
  • %System Root%\Python27\Lib\unittest\test\{username}
  • %System Root%\Python27\Lib\test\ieee754.txt.KEKW
  • %System Root%\Python27\Tools\webchecker\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\cachecontrol\caches\{username}
  • %AppDataLocal%\Python-Eggs\Python-Eggs\Cache\pillow-4.1.0-py2.7-win32.egg-tmp\PIL\{username}
  • %System Root%\Python27\include\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_10.txt.KEKW
  • %System Root%\Users\All Users\Adobe\ARM\{username}.KEKW
  • %System Root%\Python27\include\tupleobject.h.KEKW
  • %Application Data%\Microsoft\SystemCertificates\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\{username}
  • %AppDataLocal%\Apps\2.0\{username}
  • %System Root%\Users\All Users\Adobe\ARM\Reader_19.010.20099\{username}
  • %AppDataLocal%\Microsoft\Windows Sidebar\Gadgets\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Notebook.jpg.KEKW
  • %All Users Profile%\Microsoft\Media Player\{username}
  • %All Users Profile%\Microsoft\MSDN\8.0\{username}
  • %AppDataLocal%\pip\cache\http\f\e\{username}
  • %User Profile%\Documents\fp_18.0.0.203_archive\{username}
  • %System Root%\Python27\include\bufferobject.h.KEKW
  • %System Root%\Users\Public\Documents\word2k\DOC2KE03.doc.KEKW
  • %System Root%\Python27\Tools\pynche\namedcolors.txt.KEKW
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\crashes\events\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01\{username}
  • %Application Data%\Microsoft\Windows\IETldCache\container.dat.KEKW
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\{username}
  • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\{username}
  • %AppDataLocal%\Microsoft\Media Player\Sync Playlists\en-US\00007196\{username}
  • %User Profile%\Documents\powerpoint2k\{username}
  • %System Root%\Python27\Lib\test\cjkencodings\euc_jisx0213.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSScan\{username}
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\{username}
  • %System Root%\Users\All Users\Microsoft\Device Stage\Task\{{GUID}}\en-US\{username}.KEKW
  • %All Users Profile%\Microsoft\Network\Connections\{username}
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\{username}
  • %System Root%\Python27\Lib\xml\dom\{username}
  • %System Root%\Python27\tcl\tcl8.5\tzdata\SystemV\{username}
  • %AppDataLocal%\Google\Chrome\User Data\SSLErrorAssistant\7\{username}
  • %All Users Profile%\Oracle\Java\.oracle_jre_usage\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Backup\new\{username}
  • %Desktop%\powerpoint2k\{username}
  • %System Root%\Users\All Users\Mozilla\updates\{username}
  • %System Root%\Python27\Lib\test\cjkencodings\big5-utf8.txt.KEKW
  • %AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\RJ6VBH4W.DN2\{username}
  • %AppDataLocal%\Microsoft\Media Player\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_72da1383309c93bd2441accd728cf953e4fa97a_0a24a840\{username}.KEKW
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\bookmarkbackups\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\{username}.KEKW
  • %System Root%\Users\All Users\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_42.txt.KEKW
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-child-current.bin.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\CertificateRevocation\5140\{username}
  • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{4555A5E7-C06D-11E6-8AB1-005056BC3E18}.dat.KEKW
  • %All Users Profile%\Microsoft\Windows\WER\{username}
  • %All Users Profile%\McAfee\MCLOGS\SmallInstaller\{username}
  • %Application Data%\Microsoft\Windows\Libraries\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\3561288849sdhlie.files\{username}
  • %AppDataLocal%\Google\Chrome\User Data\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\{username}
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\no_entry.gif.KEKW
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\virtual\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\security\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\{username}
  • %System Root%\Python27\include\parsetok.h.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\{username}
  • %User Temp%\Adobe_ADMLogs\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp.KEKW
  • %System Root%\Users\Public\Favorites\{username}
  • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\GatherLogs\{username}
  • %User Profile%\Documents\fp_18.0.0.203_archive.zip.KEKW
  • %Application Data%\Microsoft\Protect\{username}
  • %AppDataLocal%\Google\Chrome\User Data\FileTypePolicies\{username}
  • %System Root%\Users\{username}\Videos\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\container.dat.KEKW
  • %System Root%\Python27\include\listobject.h.KEKW
  • %System Root%\Users\All Users\Microsoft\Vault\{username}.KEKW
  • %All Users Profile%\Microsoft\NetFramework\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Roses.jpg.KEKW
  • %System Root%\Python27\tcl\tix8.4.3\pref\WmDefault.txt.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_12.txt.KEKW
  • %User Temp%\WebInstaller\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Backup\{username}
  • %System Root%\Python27\tcl\dde1.3\{username}
  • %System Root%\Python27\Tools\pynche\README.txt.KEKW
  • %System Root%\Python27\Lib\xml\{username}
  • %AppDataLocal%\Microsoft\Feeds Cache\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_03.txt.KEKW
  • %All Users Profile%\Microsoft\Windows\Start Menu\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp.KEKW
  • %System Root%\Python27\Lib\json\tests\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\HandPrints.jpg.KEKW
  • %Application Data%\Microsoft\Proof\{username}
  • %System Root%\Python27\Tools\versioncheck\README.txt.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\_metadata\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Tablet PC\{username}.KEKW
  • %All Users Profile%\Microsoft\Windows NT\MSFax\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\9IWSW3EX\{username}
  • %System Root%\Python27\include\objimpl.h.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\big5hkscs-utf8.txt.KEKW
  • %System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\{username}.KEKW
  • %Desktop%\word2k\DOC2KExx.doc.KEKW
  • %Application Data%\Macromedia\Flash Player\macromedia.com\support\{username}
  • %All Users Profile%\Mozilla\updates\{username}
  • %System Root%\Python27\Lib\site-packages\setuptools\{username}
  • %System Root%\Python27\include\pyexpat.h.KEKW
  • %System Root%\Python27\Tools\Scripts\{username}
  • %System Root%\Users\Public\Videos\{username}
  • %User Profile%\Documents\word2k\DOC2KE05.doc.KEKW
  • %System Root%\Python27\Lib\idlelib\help.html.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Sqm\Sessions\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp.KEKW
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\adobephotoshopcs3.txt.KEKW
  • %System Root%\Python27\include\cobject.h.KEKW
  • %System Root%\Python27\tcl\tcl8.5\tzdata\Indian\{username}
  • %System Root%\Users\{username}\AppData\Local\Microsoft\{username}
  • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE02.ppt.KEKW
  • %User Temp%\dd_SetupUtility.txt.KEKW
  • %System Root%\Python27\tcl\tcl8.5\tzdata\US\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\11\{username}
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\15\{username}
  • %System Root%\Users\Public\Documents\word2k\DOC2KE01.doc.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\51\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg.KEKW
  • %System Root%\Python27\Lib\test\xmltestdata\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\SecurityPreloadState.txt.KEKW
  • %User Temp%\dd_vcredistMSI0FC1.txt.KEKW
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\urlCache-current.bin.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\packages\ssl_match_hostname\{username}
  • %Application Data%\Microsoft\Internet Explorer\UserData\{username}
  • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Power Efficiency Diagnostics\{username}
  • %Application Data%\Mozilla\Firefox\Crash Reports\{username}
  • %System Root%\Users\All Users\Oracle\Java\{username}.KEKW
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\openfold.gif.KEKW
  • %System Root%\Python27\include\ceval.h.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95\{username}.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\_trie\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\guest.bmp.KEKW
  • %AppDataLocal%\pip\cache\http\5\4\3\d\7\{username}
  • %System Root%\Users\Default\AppData\Local\Microsoft\Windows\GameExplorer\{username}
  • %System Root%\Users\All Users\Microsoft\WwanSvc\Profiles\{username}
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Python 2.7\{username}
  • %System Root%\Users\Public\Documents\excel2k\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\sessionstore-backups\{username}
  • %System Root%\Python27\include\pymacconfig.h.KEKW
  • %Application Data%\Microsoft\Windows\IECompatCache\Low\{username}
  • %System Root%\Python27\Lib\sqlite3\{username}
  • %AppDataLocal%\pip\cache\http\{username}
  • %System Root%\Python27\Lib\lib-tk\test\test_ttk\{username}
  • %System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\entry_points.txt.KEKW
  • %System Root%\Python27\Scripts\{username}
  • %System Root%\Python27\tcl\tcl8.5\{username}
  • %Application Data%\Microsoft\Windows\Recent\{username}
  • %AppDataLocal%\Microsoft\Feeds Cache\JPOHUSHF\{username}
  • %System Root%\Python27\Lib\test\exception_hierarchy.txt.KEKW
  • %System Root%\$Recycle.Bin\S-1-5-21-2407829820-1079796033-203259571-1000\{username}
  • %All Users Profile%\Microsoft\Windows\Sqm\Manifest\{username}
  • %User Temp%\{username}.bmp.KEKW
  • %AppDataLocal%\Microsoft\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp.KEKW
  • %Application Data%\Microsoft\Internet Explorer\Quick Launch\User Pinned\{username}
  • F:\data\tmp.doc.KEKW
  • %System Root%\Python27\Lib\lib2to3\tests\data\fixers\myfixes\{username}
  • %Favorites%\{username}
  • %System Root%\Users\All Users\Microsoft\RAC\PublishedData\{username}.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\certifi\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\{username}
  • %System Root%\Users\Public\Documents\excel2k\XLS2KE05.xls.KEKW
  • %All Users Profile%\Mozilla\updates\308046B0AF4A39CB\updates\0\{username}
  • %Application Data%\Macromedia\Flash Player\#SharedObjects\K48846QH\{username}
  • F:\data\photos\long_exposure.jpg.KEKW
  • %User Profile%\Links\{username}
  • %System Root%\Python27\libs\{username}
  • %System Root%\Users\Public\Documents\Email and Password List.txt.KEKW
  • %AppDataLocal%\Microsoft\Media Player\Sync Playlists\en-US\{username}
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\googledesktop.txt.KEKW
  • %System Root%\Python27\Lib\importlib\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\43\{username}.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\6\{username}
  • %System Root%\Python27\include\structmember.h.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\DeviceMetadataStore\en-US\{username}.KEKW
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\packages\backports\{username}
  • %AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\{username}
  • %System Root%\Python27\include\metagrammar.h.KEKW
  • %System Root%\Users\All Users\Microsoft\DRM\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\{username}.KEKW
  • %AppDataLocal%\Apps\2.0\Data\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\21\{username}
  • %System Root%\Python27\Lib\idlelib\{username}
  • %System Root%\Users\All Users\Oracle\Java\javapath_target_313094\{username}
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\Backup\{username}.KEKW
  • %AppDataLocal%\Microsoft\Internet Explorer\EmieSiteList\{username}
  • %AppDataLocal%\pip\cache\http\b\a\9\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_34.txt.KEKW
  • %System Root%\Python27\include\floatobject.h.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\idna\{username}
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\microsoftoffice2003.txt.KEKW
  • %Application Data%\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\{username}
  • %Desktop%\word2k\DOC2KE02.doc.KEKW
  • %Application Data%\Microsoft\Windows\Network Shortcuts\{username}
  • %Application Data%\Microsoft\Templates\{username}
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\plusarm.gif.KEKW
  • %All Users Profile%\Microsoft\Assistance\{username}
  • %System Root%\Python27\Lib\msilib\{username}
  • %System Root%\Python27\Lib\idlelib\help.txt.KEKW
  • %User Temp%\dd_vcredistUI0FC1.txt.KEKW
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\{username}
  • %System Root%\Python27\tcl\tk8.5\demos\{username}
  • %System Root%\Python27\tcl\tix8.4.3\pref\TK.cs.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\{username}.KEKW
  • %AppDataLocal%\Microsoft\Vault\{username}
  • %Application Data%\{username}
  • %AppDataLocal%\Microsoft\Windows\AppCache\6A582BR6\{username}
  • %System Root%\Users\All Users\Microsoft\Device Stage\Task\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\20\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\{username}.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\LastBld.dat.KEKW
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\{username}
  • %All Users Profile%\VMware\RawdskCompatibility\virtual\{username}
  • %AppDataLocal%\Google\Software Reporter Tool\settings.dat.KEKW
  • %System Root%\Python27\Lib\email\test\{username}
  • %System Root%\Python27\include\datetime.h.KEKW
  • %All Users Profile%\Microsoft\eHome\logs\{username}
  • %System Root%\Users\All Users\Oracle\Java\.oracle_jre_usage\{username}.KEKW
  • %System Root%\Python27\Lib\test\imghdrdata\python.gif.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F0\{username}.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\LocalCopy\{username}
  • %System Root%\Python27\Lib\test\cjkencodings\shift_jis.txt.KEKW
  • %System Root%\Users\Public\Recorded TV\{username}
  • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\{username}
  • %System Root%\Python27\Lib\site-packages\pkg_resources\_vendor\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\43\{username}
  • %Application Data%\Microsoft\Windows\DNTException\{username}
  • %Favorites%\Links for United States\{username}
  • %System Root%\powerpoint2k\PPT2KE03.ppt.KEKW
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Temp\usgthrsvc\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp.KEKW
  • %System Root%\Users\Public\Documents\word2k\DOC2KE05.doc.KEKW
  • %Application Data%\Microsoft\SystemCertificates\My\Keys\{username}
  • %System Root%\Users\Default\AppData\Local\Microsoft\Windows\History\{username}
  • %System Root%\Users\All Users\Microsoft\RAC\StateData\{username}
  • %Desktop%\word2k\DOC2KE04.doc.KEKW
  • %System Root%\Users\{username}\AppData\Roaming\{username}
  • %System Root%\Python27\Lib\email\test\data\{username}
  • %System Root%\Python27\include\cellobject.h.KEKW
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\{username}
  • %User Profile%\Videos\{username}
  • %User Temp%\Microsoft .NET Framework 4.5.2 Setup_20161212_135033207-MSI_netfx_Full_GDR_x64.msi.txt.KEKW
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\{username}
  • %AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\_platform_specific\{username}
  • %System Root%\Python27\Tools\pynche\html40colors.txt.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\9\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\82DF2NUK\{username}
  • %System Root%\Python27\Lib\test\sgml_input.html.KEKW
  • %AppDataLocal%\Microsoft\Feeds\{username}
  • %System Root%\Users\All Users\Microsoft\Windows NT\{username}.KEKW
  • %System Root%\Python27\include\pycapsule.h.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_24.txt.KEKW
  • %System Root%\Python27\include\pystrtod.h.KEKW
  • %AppDataLocal%\Microsoft\Internet Explorer\EmieUserList\container.dat.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Entries\{username}
  • %Application Data%\Microsoft\Windows\PrivacIE\container.dat.KEKW
  • %All Users Profile%\Microsoft\Windows NT\MSFax\Queue\{username}
  • %System Root%\Users\All Users\Microsoft\OFFICE\{username}
  • %System Root%\Python27\Lib\test\test_doctest2.txt.KEKW
  • %System Root%\Python27\include\abstract.h.KEKW
  • %System Root%\Python27\Lib\site-packages\Pillow-6.0.0.dist-info\top_level.txt.KEKW
  • %AppDataLocal%Low\Microsoft\Windows\AppCache\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\47\{username}
  • %System Root%\Users\All Users\McAfee\MCLOGS\Common\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Definition Updates\{username}
  • %System Root%\Python27\Lib\test\test_difflib_expect.html.KEKW
  • %User Profile%\Documents\excel2k\XLS2KE01.xls.KEKW
  • %User Profile%\Downloads\{username}
  • %System Root%\Python27\Lib\test\testtar.tar.KEKW
  • %Application Data%\Microsoft\Windows\IECompatUACache\container.dat.KEKW
  • %System Root%\$Recycle.Bin\{username}
  • %User Profile%\Searches\{username}
  • %System Root%\Python27\README.txt.KEKW
  • %All Users Profile%\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\DomainSuggestions\{username}
  • %User Profile%\Documents\fp_18.0.0.203_archive\18_0_r0_203\{username}
  • %System Root%\Python27\tcl\tix8.4.3\demos\bitmaps\tix.gif.KEKW
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\SentItems\{username}
  • %System Root%\Python27\Lib\test\cjkencodings\big5.txt.KEKW
  • %System Root%\Python27\Lib\lib-tk\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\chardet\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp.KEKW
  • %Desktop%\Transmag.doc.KEKW
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\{username}
  • %Favorites%\Microsoft Websites\{username}
  • %System Root%\Python27\Lib\site-packages\pkg_resources\_vendor\packaging\{username}
  • %System Root%\Python27\include\longintrepr.h.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\58\{username}
  • %All Users Profile%\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_43.txt.KEKW
  • %AppDataLocal%\pip\{username}
  • %AppDataLocal%\Google\Chrome\User Data\Crashpad\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\DRM\{username}
  • %System Root%\Python27\Lib\ctypes\test\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\Crashpad\reports\{username}
  • %System Root%\Users\Public\Pictures\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\26\{username}
  • %Favorites%\Windows Live\{username}
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\warning.gif.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0\{username}.KEKW
  • %System Root%\Python27\include\pyconfig.h.KEKW
  • %System Root%\Users\All Users\McAfee\{username}
  • %Application Data%\Microsoft\Windows\PrivacIE\{username}
  • %System Root%\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.KEKW
  • %All Users Profile%\Oracle\Java\javapath\{username}
  • %System Root%\Users\All Users\Microsoft\MSDN\{username}.KEKW
  • %System Root%\Users\All Users\McAfee\WinCore\{username}
  • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Indexed Rules\25\9.1\{username}
  • %System Root%\Python27\Lib\pydoc_data\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A\{username}.KEKW
  • %System Root%\Python27\tcl\tcl8.5\msgs\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5\{username}
  • %All Users Profile%\Microsoft\Windows\DRM\Cache\{username}
  • %System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\{username}
  • %All Users Profile%\Microsoft\Network\Downloader\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\progress\{username}
  • %User Temp%\chrome_BITS_3756_19263\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\pytoml\{username}
  • %System Root%\Users\All Users\Microsoft\RAC\Outbound\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\RAC\Temp\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_16.txt.KEKW
  • %System Root%\Users\Default\AppData\Local\Microsoft\Windows\{username}
  • %Application Data%\Mozilla\{username}
  • %Application Data%\Microsoft\Windows\IECompatUACache\Low\container.dat.KEKW
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\datareporting\archived\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\DRM\{username}.KEKW
  • %System Root%\Python27\Lib\wsgiref\{username}
  • %System Root%\Users\All Users\Microsoft\Network\Downloader\{username}
  • %User Profile%\Documents\excel2k\{username}
  • %User Profile%\Documents\fp_18.0.0.203_archive\18_0_r0_203_debug\{username}
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\{username}.KEKW
  • %System Root%\Python27\Lib\ensurepip\_bundled\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp.KEKW
  • %All Users Profile%\Oracle\Java\javapath_target_313094\{username}.KEKW
  • %User Profile%\Documents\powerpoint2k\PPT2KE03.ppt.KEKW
  • %AppDataLocal%\pip\cache\http\2\3\b\7\9\{username}
  • %All Users Profile%\Microsoft\OFFICE\{username}
  • %System Root%\Python27\Lib\lib2to3\tests\data\{username}
  • %System Root%\Python27\Lib\idlelib\Icons\openfolder.gif.KEKW
  • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE01.ppt.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\54\{username}
  • %All Users Profile%\Microsoft\Windows NT\MSFax\VirtualInbox\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\62\{username}
  • %System Root%\Users\All Users\Oracle\Java\.oracle_jre_usage\{username}
  • %System Root%\Python27\include\compile.h.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0\{username}
  • %Application Data%\Microsoft\Windows\{username}
  • %System Root%\powerpoint2k\PPT2KE05.ppt.KEKW
  • %System Root%\Users\Default\AppData\Local\{username}
  • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\SSScheduler\{username}.KEKW
  • %AppDataLocal%\{username}
  • %System Root%\Users\All Users\Microsoft\DeviceSync\{username}
  • F:\{username}
  • %System Root%\Python27\Lib\idlelib\Icons\tk.gif.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\RecoveryImproved\{username}
  • %System Root%\Python27\Tools\Scripts\README.txt.KEKW
  • %AppDataLocal%\Microsoft\Internet Explorer\EmieSiteList\container.dat.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\5\{username}
  • %All Users Profile%\Microsoft\Network\{username}
  • %System Root%\Python27\Lib\test\cjkencodings\iso2022_kr.txt.KEKW
  • %Application Data%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\{username}
  • %System Root%\Python27\tcl\tk8.5\demos\images\earth.gif.KEKW
  • %System Root%\Python27\tcl\tcl8.5\tzdata\Mexico\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5\{username}.KEKW
  • %All Users Profile%\Microsoft\Windows\DRM\blackbox.bin.KEKW
  • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo100.gif.KEKW
  • %User Profile%\Documents\word2k\DOC2KE03.doc.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\{username}.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_33.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp.KEKW
  • %System Root%\Python27\include\pymath.h.KEKW
  • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE05.ppt.KEKW
  • %System Root%\Python27\include\methodobject.h.KEKW
  • %System Root%\Python27\Lib\site-packages\pkg_resources\{username}
  • %Application Data%\Mozilla\Firefox\Pending Pings\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\TRRBlacklist.txt.KEKW
  • %System Root%\Users\All Users\Oracle\Java\installcache_x64\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\SSLErrorAssistant\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_01.txt.KEKW
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Stars.jpg.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\{username}
  • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieBrowserModeList\container.dat.KEKW
  • %System Root%\Users\All Users\Microsoft\Search\Data\Temp\{username}.KEKW
  • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\SSScheduler\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\cachecontrol\{username}
  • %System Root%\Python27\Lib\bsddb\{username}
  • %All Users Profile%\Adobe\Setup\{username}
  • %User Temp%\jawshtml.html.KEKW
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp.KEKW
  • %System Root%\Users\All Users\Oracle\Java\javapath\{username}
  • %AppDataLocal%\Python-Eggs\Python-Eggs\Cache\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\webencodings\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\weave\failed\{username}
  • %System Root%\Users\All Users\Microsoft\RAC\{username}
  • %System Root%\Users\All Users\VMware\VMware Tools\Unity Filters\{username}.KEKW
  • %AppDataLocal%\pip\cache\http\f\e\d\0\{username}
  • %System Root%\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg.KEKW
  • %AppDataLocal%\Microsoft\Windows\History\Low\History.IE5\container.dat.KEKW
  • %System Root%\Users\All Users\Mozilla\{username}
  • %All Users Profile%\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.KEKW
  • %Desktop%\powerpoint2k\PPT2KExx.PPT.KEKW
  • %System Root%\Python27\Lib\site-packages\setuptools\extern\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\UrlBlockManager\{username}
  • %AppDataLocal%\Mozilla\Firefox\Profiles\{username}
  • %System Root%\Python27\tcl\tcl8\8.4\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Support\{username}
  • %User Profile%\Music\{username}
  • %All Users Profile%\Microsoft\Assistance\Client\1.0\{username}
  • %Application Data%\Identities\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Stucco.gif.KEKW
  • %System Root%\{username}
  • %System Root%\Python27\include\structseq.h.KEKW
  • %System Root%\Python27\include\ucnhash.h.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\60\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_internal\req\{username}
  • %System Root%\Python27\Lib\{username}
  • %System Root%\Python27\Lib\json\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\History\CacheManager\{username}
  • %System Root%\Python27\include\bytes_methods.h.KEKW
  • %System Root%\Users\Default\Favorites\{username}
  • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp.KEKW
  • %System Root%\Python27\Lib\lib-tk\test\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\{username}
  • %System Root%\Python27\Lib\ctypes\macholib\{username}
  • %System Root%\Python27\include\errcode.h.KEKW
  • %All Users Profile%\Microsoft\Search\{username}
  • %System Root%\Python27\Lib\site-packages\{username}
  • %User Temp%\mozilla-temp-files\{username}
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp.KEKW
  • %System Root%\Python27\include\bytearrayobject.h.KEKW
  • %AppDataLocal%\Microsoft\Windows Sidebar\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Active\{username}
  • %System Root%\Users\All Users\McAfee\MCLOGS\SmallInstaller\{username}.KEKW
  • %AppDataLocal%\Microsoft\Internet Explorer\imagestore\{username}
  • %System Root%\Python27\tcl\tcl8.5\tzdata\Europe\{username}
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\VMware\VMware Tools\{username}
  • %Desktop%\word2k\DOC2KE03.doc.KEKW
  • %System Root%\Python27\tcl\tix8.4.3\pref\TkWin.cs.KEKW
  • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo75.gif.KEKW
  • %System Root%\Python27\Tools\webchecker\README.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\{username}
  • %System Root%\Python27\tcl\tcl8.5\tzdata\Chile\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\{username}
  • %AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Pine_Lumber.jpg.KEKW
  • %Application Data%\Microsoft\SystemCertificates\My\Certificates\{username}
  • %AppDataLocal%\Microsoft\Windows\History\Low\History.IE5\{username}
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\safebrowsing\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp.KEKW
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Small_News.jpg.KEKW
  • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE04.ppt.KEKW
  • %Favorites%\Links\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\{username}.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\63\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Temp\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Resource\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\{username}
  • %System Root%\Python27\include\opcode.h.KEKW
  • %All Users Profile%\Microsoft\Windows\GameExplorer\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\70\{username}
  • %AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\RJ6VBH4W.DN2\clic...exe_9ae46cec200785df_0001.0003_none_d631acba18f736d8\{username}
  • %System Root%\Python27\Lib\test\cjkencodings\hz-utf8.txt.KEKW
  • %System Root%\Python27\Lib\email\test\data\PyBanner048.gif.KEKW
  • %System Root%\Python27\Lib\idlelib\Icons\plusnode.gif.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\16\{username}
  • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\McCHSvc\{username}
  • %System Root%\Python27\Tools\i18n\{username}
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache.bin.KEKW
  • %All Users Profile%\Microsoft\Windows NT\MSFax\Inbox\{username}
  • %System Root%\Users\All Users\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\{username}.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\30\{username}
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\{username}
  • %System Root%\Python27\include\sliceobject.h.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_06.txt.KEKW
  • %System Root%\Users\All Users\McAfee\MCLOGS\{username}
  • %AppDataLocal%\Microsoft\Feeds Cache\CRAV926P\{username}
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\{username}.KEKW
  • %System Root%\Python27\include\warnings.h.KEKW
  • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\{username}
  • %System Root%\Users\All Users\Oracle\{username}
  • %System Root%\Python27\Tools\pynche\websafe.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\Updates\{username}.KEKW
  • %All Users Profile%\Microsoft\Windows\DeviceMetadataStore\{username}
  • %System Root%\Python27\include\rangeobject.h.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\WidevineCdm\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_505c7fc25c7e5866de583f14c22e2b4c2a6018c_0a2493a7\{username}.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\{username}
  • %AppDataLocal%\pip\cache\http\d\3\7\{username}
  • %All Users Profile%\Microsoft\{username}
  • %System Root%\Python27\Lib\test\imghdrdata\python.jpg.KEKW
  • %All Users Profile%\Microsoft\Windows\WER\ReportArchive\{username}
  • %System Root%\excel2k\XLS2KE01.xls.KEKW
  • %AppDataLocal%\Microsoft\Credentials\{username}
  • %All Users Profile%\Microsoft\Device Stage\Task\{{GUID}}\en-US\{username}
  • %All Users Profile%\Microsoft\Windows\Power Efficiency Diagnostics\energy-report.html.KEKW
  • %User Temp%\hsperfdata_{username}\{username}
  • %AppDataLocal%\pip\cache\http\3\{username}
  • %System Root%\Recovery\{username}
  • %AppDataLocal%\pip\cache\http\a\6\9\b\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\48\{username}
  • %All Users Profile%\Microsoft\Network\Downloader\qmgr1.dat.KEKW
  • %System Root%\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\VMware Tools\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1D\{username}
  • %System Root%\Python27\Lib\lib-tk\test\test_tkinter\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Quick\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01\{username}
  • %System Root%\Python27\tcl\tk8.5\demos\images\tcllogo.gif.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1D\{username}.KEKW
  • %All Users Profile%\Microsoft\User Account Pictures\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\{username}
  • %System Root%\Users\Public\Music\Sample Music\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp.KEKW
  • %System Root%\Python27\include\frameobject.h.KEKW
  • %AppDataLocal%\pip\cache\http\a\6\{username}
  • %System Root%\Python27\include\token.h.KEKW
  • %System Root%\Python27\include\sysmodule.h.KEKW
  • %All Users Profile%\Microsoft\OFFICE\Groove\{username}
  • %System Root%\Users\All Users\Adobe\{username}.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\pnacl\{username}
  • %System Root%\Python27\include\node.h.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3\{username}.KEKW
  • %AppDataLocal%\Google\Software Reporter Tool\reports\{username}
  • %All Users Profile%\Microsoft\MF\{username}
  • %System Root%\Users\All Users\Microsoft\eHome\logs\{username}
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Startup\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Service\{username}
  • %System Root%\Python27\Lib\lib2to3\tests\data\fixers\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\WER\{username}.KEKW
  • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\McCHSvc\{username}.KEKW
  • %Application Data%\Microsoft\Windows\Recent\AutomaticDestinations\{username}
  • %Application Data%\Microsoft\Internet Explorer\Quick Launch\{username}
  • %System Root%\Python27\Lib\email\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0\{username}
  • %System Root%\Python27\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47\{username}.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\29\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\distlib\_backport\{username}
  • %All Users Profile%\VMware\RawdskCompatibility\native\{username}
  • %System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\updates\0\{username}
  • %System Root%\Users\All Users\Microsoft\Assistance\{username}
  • %System Root%\Python27\Lib\tkinter\{username}
  • %System Root%\Python27\include\boolobject.h.KEKW
  • %System Root%\Users\Default\AppData\Roaming\Media Center Programs\{username}
  • %AppDataLocal%\Google\Chrome\User Data\SSLErrorAssistant\7\_metadata\{username}
  • %System Root%\Python27\include\pyfpe.h.KEKW
  • %AppDataLocal%\pip\cache\http\f\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp.KEKW
  • %Desktop%\excel2k\XLS2KExx.xls.KEKW
  • %AppDataLocal%\Microsoft\Windows\AppCache\6A582BR6\container.dat.KEKW
  • %System Root%\Python27\Lib\tkinter\test\{username}
  • %Application Data%\Microsoft\Document Building Blocks\{username}
  • %AppDataLocal%\Microsoft\Windows\WER\{username}
  • %All Users Profile%\Microsoft\Search\Data\Temp\usgthrsvc\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\datareporting\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Tanspecks.jpg.KEKW
  • %AppDataLocal%\pip\cache\http\a\{username}
  • %System Root%\Python27\include\pystate.h.KEKW
  • %Application Data%\Sun\{username}
  • %AppDataLocal%\Google\Chrome\User Data\InterventionPolicyDatabase\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\GameExplorer\{username}.KEKW
  • %System Root%\Python27\Tools\versioncheck\{username}
  • %System Root%\Users\All Users\Microsoft\DRM\Server\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\10\{username}
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\plus.gif.KEKW
  • %System Root%\Users\Public\Downloads\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Tablet PC\{username}
  • %System Root%\Python27\include\moduleobject.h.KEKW
  • %Desktop%\excel2k\XLS2KE05.xls.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_internal\utils\{username}
  • %System Root%\Users\All Users\McAfee\MCLOGS\Common\SmallInstaller\{username}.KEKW
  • %System Root%\Users\Default\Saved Games\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp.KEKW
  • %AppDataLocal%Low\Microsoft\Windows\{username}
  • %AppDataLocal%\pip\cache\http\a\6\9\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_505c7fc25c7e5866de583f14c22e2b4c2a6018c_0a2493a7\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\{username}.KEKW
  • %System Root%\Python27\Lib\site-packages\pip\_internal\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\43\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01\{username}.KEKW
  • %Application Data%\Microsoft\AddIns\{username}
  • %Desktop%\excel2k\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Sand_Paper.jpg.KEKW
  • %AppDataLocal%\pip\cache\http\4\e\e\3\1\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\{username}
  • %System Root%\Python27\Lib\site-packages\PIL\{username}
  • %System Root%\Python27\include\cStringIO.h.KEKW
  • %Application Data%\Microsoft\Windows\IECompatCache\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\{username}.KEKW
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp.KEKW
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp.KEKW
  • %All Users Profile%\Microsoft\Windows\DeviceMetadataStore\en-US\{username}
  • %All Users Profile%\VMware\{username}
  • %System Root%\Users\Default\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\{username}
  • %AppDataLocal%\pip\cache\http\d\3\7\e\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\log\{username}
  • %All Users Profile%\Microsoft\RAC\{username}
  • %System Root%\Users\All Users\VMware\VMware Tools\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\chardet\cli\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\55\{username}
  • %User Profile%\Documents\excel2k\XLS2KE04.xls.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\euc_kr.txt.KEKW
  • %All Users Profile%\Microsoft\Windows NT\MSFax\SentItems\{username}
  • %System Root%\Email and Password List.js.KEKW
  • %System Root%\Users\All Users\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\{username}.KEKW
  • %All Users Profile%\Microsoft\eHome\{username}
  • %System Root%\PerfLogs\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\crashes\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp.KEKW
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp.KEKW
  • %All Users Profile%\Microsoft\RAC\StateData\{username}
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Queue\{username}
  • %System Root%\Users\Public\Documents\excel2k\XLS2KE03.xls.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\{username}.KEKW
  • %System Root%\Python27\Lib\idlelib\Icons\idle_16.gif.KEKW
  • %Application Data%\Microsoft\Windows\IECompatUACache\Low\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Templates\{username}.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_14.txt.KEKW
  • %System Root%\Python27\include\timefuncs.h.KEKW
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\{username}.KEKW
  • %AppDataLocal%\Apps\2.0\Data\RNQG94OQ.QJC\{username}
  • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Indexed Rules\25\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\{username}.KEKW
  • %AppDataLocal%Low\Microsoft\Internet Explorer\Services\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Sqm\Upload\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Network\Downloader\{username}.KEKW
  • %System Root%\Python27\tcl\tk8.5\images\{username}
  • %System Root%\Python27\Lib\lib2to3\{username}
  • %System Root%\Python27\Lib\site-packages\pkg_resources\extern\{username}
  • %System Root%\Users\All Users\{username}
  • %AppDataLocal%\Microsoft\Windows\WER\ReportQueue\{username}
  • %All Users Profile%\Microsoft\Search\Data\{username}
  • %AppDataLocal%\pip\cache\http\4\e\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\{username}
  • %System Root%\Python27\Lib\ctypes\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\colorama\{username}
  • %All Users Profile%\McAfee\MCLOGS\Common\{username}
  • %System Root%\Python27\Lib\multiprocessing\dummy\{username}
  • %Application Data%\Microsoft\Windows\IETldCache\Low\{username}
  • %System Root%\Python27\include\longobject.h.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\iso2022_jp.txt.KEKW
  • %System Root%\Python27\Lib\tkinter\test\test_ttk\{username}
  • %System Root%\Users\All Users\Oracle\Java\installcache_x64\{username}.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\euc_jisx0213-utf8.txt.KEKW
  • %AppDataLocal%\pip\cache\http\2\3\b\7\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_36.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\OFFICE\Groove\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\History\Service\{username}
  • %System Root%\Users\All Users\Microsoft\NetFramework\BreadcrumbStore\{username}.KEKW
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\{username}
  • %System Root%\Python27\include\classobject.h.KEKW
  • %System Root%\Users\Public\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp.KEKW
  • %System Root%\excel2k\XLS2KE03.xls.KEKW
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\{username}
  • %AppDataLocal%\pip\cache\http\4\e\e\{username}
  • %System Root%\Users\Default\Documents\{username}
  • %Application Data%\Microsoft\Word\{username}
  • %All Users Profile%\McAfee\MCLOGS\PartnerCustom\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\31\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_37.txt.KEKW
  • %System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\entry_points.txt.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\SwReporter\40.200.201.3\_metadata\{username}
  • %Application Data%\Microsoft\Windows\IECompatCache\Low\container.dat.KEKW
  • %Application Data%\Microsoft\Windows\SendTo\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\2LHHLFH6\{username}
  • %System Root%\Python27\tcl\tcl8.5\tzdata\Asia\{username}
  • %System Root%\Users\All Users\Microsoft\IlsCache\{username}.KEKW
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\{username}
  • %System Root%\Python27\Lib\logging\{username}
  • %AppDataLocal%\Apps\{username}
  • %All Users Profile%\{username}
  • %AppDataLocal%\Google\Chrome\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp.KEKW
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Config\{username}
  • %System Root%\excel2k\XLS2KExx.xls.KEKW
  • %System Root%\Users\Public\Desktop\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\_platform_specific\all\{username}
  • %System Root%\Users\All Users\Adobe\ARM\Reader_19.010.20099\{username}.KEKW
  • %AppDataLocal%\Microsoft\Windows\1024\{username}
  • %Application Data%\Microsoft\Office\Recent\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_12a.txt.KEKW
  • %System Root%\Users\Public\Documents\word2k\DOC2KExx.doc.KEKW
  • %AppDataLocal%\Google\{username}
  • %AppDataLocal%\pip\cache\http\3\8\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5\{username}
  • %System Root%\Python27\tcl\tcl8.5\opt0.4\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\{username}.KEKW
  • %System Root%\Python27\Tools\pynche\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\2\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Templates\{username}
  • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo150.gif.KEKW
  • %System Root%\Users\Default\AppData\Local\Microsoft\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\25\{username}
  • %System Root%\Users\All Users\Microsoft\RAC\Outbound\{username}
  • %System Root%\Python27\tcl\tcl8.5\tzdata\Atlantic\{username}
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\adobeflashcs3.txt.KEKW
  • %AppDataLocal%\Microsoft\Media Player\Sync Playlists\{username}
  • %All Users Profile%\McAfee\MCLOGS\PartnerCustom\550F8967-2EE2-4F33-8E16-1BFFBE114803\{username}
  • %All Users Profile%\VMware\VMware Tools\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\Tiles\{username}
  • F:\wlines.zip.KEKW
  • %AppDataLocal%\Microsoft\Feeds\Microsoft Feeds~\{username}
  • %System Root%\Users\All Users\McAfee\MCLOGS\SmallInstaller\{username}
  • %System Root%\Python27\include\unicodeobject.h.KEKW
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\{username}.KEKW
  • %AppDataLocal%\Microsoft\Feeds Cache\NWKETFVL\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\CacheManager\{username}
  • %System Root%\Users\Public\Documents\word2k\DOC2KE04.doc.KEKW
  • %System Root%\Users\All Users\Microsoft\DRM\{username}.KEKW
  • %User Profile%\Documents\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F0\{username}
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\extensions\{username}
  • %System Root%\Python27\Lib\test\subprocessdata\{username}
  • %System Root%\Python27\Lib\test\audiodata\pluck-pcm32.wav.KEKW
  • %System Root%\Python27\include\codecs.h.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_31.txt.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\SwReporter\40.200.201.3\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\brndlog.txt.KEKW
  • %Application Data%\Mozilla\Firefox\{username}
  • %System Root%\powerpoint2k\PPT2KE04.ppt.KEKW
  • %AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\RJ6VBH4W.DN2\goog...app_9ae46cec200785df_0001.0003_7581c0cd83ac8659\{username}
  • %System Root%\Users\All Users\Microsoft\OFFICE\Groove\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp.KEKW
  • %System Root%\Python27\tcl\tix8.4.3\pref\Bisque.cs.KEKW
  • %Desktop%\powerpoint2k\PPT2KE05.ppt.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\{username}
  • %System Root%\powerpoint2k\PPT2KE02.ppt.KEKW
  • %System Root%\Python27\Lib\idlelib\Icons\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43\{username}
  • %AppDataLocal%\Microsoft\Windows\1033\StructuredQuerySchema.bin.KEKW
  • %Application Data%\Microsoft\Excel\{username}
  • %Application Data%\Microsoft\Spelling\{username}
  • %User Profile%\Documents\powerpoint2k\PPT2KE02.ppt.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\iso2022_kr-utf8.txt.KEKW
  • %All Users Profile%\Mozilla\{username}
  • %Application Data%\Sun\Java\Deployment\{username}
  • %AppDataLocal%\Microsoft\Feeds Cache\COOE7IBP\{username}
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\{username}
  • %AppDataLocal%\Microsoft\Windows\1033\{username}
  • %All Users Profile%\Microsoft\Windows NT\MSScan\{username}
  • %System Root%\Users\Public\Recorded TV\Sample Media\{username}
  • %All Users Profile%\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_72da1383309c93bd2441accd728cf953e4fa97a_0a24a840\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\2PEMJMIY\{username}
  • %System Root%\Python27\Lib\idlelib\Icons\idle_48.gif.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\{username}
  • %AppDataLocal%Low\Microsoft\Windows\AppCache\LY14JQYG\{username}
  • %System Root%\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\{username}
  • %System Root%\Users\All Users\Adobe\ARM\S\{username}.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_23.txt.KEKW
  • %AppDataLocal%\Microsoft\Office\ONetConfig\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\packaging\{username}
  • %System Root%\Users\All Users\Microsoft\RAC\Temp\{username}.KEKW
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\DATA\{username}
  • %AppDataLocal%\Microsoft\Feeds Cache\NKNYYDHU\{username}
  • %User Temp%\dd_vcredistUI0FD5.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\AIT\{username}.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\{username}
  • %System Root%\Users\All Users\Microsoft\NetFramework\{username}
  • %Application Data%\Microsoft\MMC\{username}
  • %User Profile%\Saved Games\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_32.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Media Player\{username}.KEKW
  • %AppDataLocal%Low\Microsoft\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\{username}.KEKW
  • %System Root%\Python27\Lib\email\mime\{username}
  • %System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\{username}.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\{username}
  • %Desktop%\Email and Password List.txt.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\gb2312.txt.KEKW
  • %System Root%\Python27\include\funcobject.h.KEKW
  • %AppDataLocal%\Microsoft\Internet Explorer\frameiconcache.dat.KEKW
  • %System Root%\Python27\Lib\sqlite3\test\{username}
  • %System Root%\Users\All Users\Oracle\Java\javapath\{username}.KEKW
  • %AppDataLocal%\Microsoft\Internet Explorer\{username}
  • %System Root%\Python27\Tools\pynche\X\rgb.txt.KEKW
  • %AppDataLocal%\Microsoft\Windows\WER\ReportArchive\{username}
  • %System Root%\Users\All Users\Adobe\ARM\S\{username}
  • %Application Data%\Mozilla\Firefox\Crash Reports\events\{username}
  • %All Users Profile%\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3\{username}
  • %All Users Profile%\Microsoft\Windows\Ringtones\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\tmp\si\{username}
  • %System Root%\Python27\Lib\bsddb\test\{username}
  • %AppDataLocal%\Mozilla\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\35\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Cave_Drawings.gif.KEKW
  • %AppDataLocal%\pip\cache\http\5\{username}
  • %All Users Profile%\McAfee\MCLOGS\Common\SmallInstaller\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Ringtones\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Resource\{username}
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0\{username}
  • %System Root%\Python27\Lib\test\imghdrdata\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Bears.jpg.KEKW
  • %System Root%\Python27\Lib\test\audiodata\pluck-pcm24.wav.KEKW
  • %System Root%\Python27\Lib\idlelib\Icons\python.gif.KEKW
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\file.gif.KEKW
  • %System Root%\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.KEKW
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\gmp\WINNT_x86_64-msvc\{username}
  • %System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\top_level.txt.KEKW
  • %Application Data%\Media Center Programs\{username}
  • %Application Data%\Microsoft\Protect\S-1-5-21-2407829820-1079796033-203259571-500\{username}
  • %AppDataLocal%\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\{username}
  • %Desktop%\word2k\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0\{username}.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\pnacl\0.57.44.2492\_metadata\{username}
  • %System Root%\$Recycle.Bin\S-1-5-21-2407829820-1079796033-203259571-500\$IC8HJH8.zip.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\49\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\DeviceMetadataStore\{username}.KEKW
  • %System Root%\Users\Default\Pictures\{username}
  • %Application Data%\Macromedia\Flash Player\#SharedObjects\{username}
  • %System Root%\Python27\include\pyport.h.KEKW
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\prefs.js.KEKW
  • %System Root%\Users\All Users\Microsoft\eHome\{username}.KEKW
  • %System Root%\Python27\tcl\tk8.5\demos\images\earthris.gif.KEKW
  • %AppDataLocal%\pip\cache\http\b\a\9\3\{username}
  • %System Root%\Python27\Lib\lib2to3\pgen2\{username}
  • %System Root%\powerpoint2k\PPT2KE01.ppt.KEKW
  • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE03.ppt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Python 2.7\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\{username}
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\{username}.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\ActivityLog\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\{username}
  • %User Profile%\Documents\excel2k\XLS2KE03.xls.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\{username}.KEKW
  • %AppDataLocal%\pip\cache\http\0\2\5\2\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Java\{username}.KEKW
  • %System Root%\Python27\include\asdl.h.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows NT\{username}
  • %System Root%\Users\All Users\Microsoft\Search\Data\{username}.KEKW
  • %Desktop%\excel2k\XLS2KE04.xls.KEKW
  • %System Root%\Users\Public\Documents\{username}
  • %AppDataLocal%\Microsoft\Windows\WebCache\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Java\{username}
  • %System Root%\Users\All Users\Mozilla\{username}.KEKW
  • %All Users Profile%\Microsoft\Vault\{username}
  • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieSiteList\container.dat.KEKW
  • %User Profile%\Documents\excel2k\XLS2KE05.xls.KEKW
  • %System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\{username}.KEKW
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Blue_Gradient.jpg.KEKW
  • %System Root%\Python27\Lib\distutils\{username}
  • %User Temp%\dd_wcf_CA_smci_20161212_135109_353.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Python 2.7\{username}.KEKW
  • %Desktop%\note.txt.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\13\{username}
  • %AppDataLocal%\Google\Chrome\User Data\pnacl\0.57.44.2492\_platform_specific\{username}
  • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\{username}
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\{username}
  • %All Users Profile%\Microsoft\OFFICE\DATA\{username}
  • %Desktop%\Email and Password List.js.KEKW
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\gmp\{username}
  • %All Users Profile%\Microsoft\Windows NT\MSFax\Common Coverpages\{username}
  • %All Users Profile%\Microsoft Help\{username}
  • %AppDataLocal%\pip\cache\http\7\e\9\{username}
  • %System Root%\Python27\include\pygetopt.h.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\44\{username}
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Quick\{username}.KEKW
  • %System Root%\Python27\Lib\site-packages\Pillow-6.0.0.dist-info\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_17.txt.KEKW
  • %System Root%\Python27\Lib\test\leakers\README.txt.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_38.txt.KEKW
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\White_Chocolate.jpg.KEKW
  • %Application Data%\Microsoft\Excel\XLSTART\{username}
  • %AppDataLocal%\pip\cache\{username}
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\{username}.KEKW
  • %Application Data%\Microsoft\SystemCertificates\My\{username}
  • %System Root%\Python27\include\pythread.h.KEKW
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\DRM\Cache\{username}.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_21.txt.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\36\{username}
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\{username}
  • %System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp.KEKW
  • %AppDataLocal%\Microsoft\Office\Groove\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Peacock.jpg.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Indexed Rules\{username}
  • %System Root%\Users\{username}\AppData\Roaming\Microsoft\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_72da1383309c93bd2441accd728cf953e4fa97a_0a24a840\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Quarantine\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\32\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\{username}.KEKW
  • %System Root%\Users\Public\Documents\excel2k\XLS2KE04.xls.KEKW
  • %System Root%\Python27\tcl\tcl8.5\tzdata\Pacific\{username}
  • %System Root%\Users\Default\Music\{username}
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\DATA\{username}.KEKW
  • %AppDataLocal%\Microsoft\Windows\Explorer\{username}
  • %System Root%\Python27\Lib\test\test_doctest4.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows\Caches\{username}.KEKW
  • %System Root%\Python27\tcl\tix8.4.3\pref\SGIGray.cs.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\{username}
  • %System Root%\Python27\include\code.h.KEKW
  • %System Root%\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\{username}.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95\{username}
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\textfile.gif.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\PepperFlash\32.0.0.171\_metadata\{username}
  • %System Root%\Python27\include\enumobject.h.KEKW
  • %System Root%\Users\Default\Downloads\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Sqm\Sessions\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Sqm\Manifest\{username}
  • %System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\550F8967-2EE2-4F33-8E16-1BFFBE114803\{username}.KEKW
  • %All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\{username}
  • %System Root%\Python27\Lib\idlelib\HISTORY.txt.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\johab.txt.KEKW
  • %System Root%\Python27\include\py_curses.h.KEKW
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\thumbnails\{username}
  • %System Root%\Python27\Lib\compiler\{username}
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\1D\{username}
  • %System Root%\Python27\tcl\tk8.5\demos\images\{username}
  • %System Root%\Python27\include\pgen.h.KEKW
  • %System Root%\Python27\Lib\test\crashers\{username}
  • %AppDataLocal%\Python-Eggs\Python-Eggs\{username}
  • %System Root%\Python27\include\pydebug.h.KEKW
  • %AppDataLocal%\Google\Chrome\User Data\PepperFlash\32.0.0.171\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_internal\vcs\{username}
  • %Application Data%\Microsoft\Windows\PrivacIE\Low\{username}
  • %User Temp%\CR_E83EE.tmp\{username}
  • %System Root%\Python27\include\patchlevel.h.KEKW
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\{username}
  • %System Root%\Users\Public\Music\Sample Music\Sleep Away.mp3.KEKW
  • %System Root%\Python27\Lib\encodings\{username}
  • %System Root%\Python27\Lib\site-packages\setuptools\_vendor\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_26.txt.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\53\{username}
  • %User Profile%\{username}
  • %System Root%\Users\All Users\Microsoft\eHome\logs\{username}.KEKW
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\28\{username}
  • %System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\{username}
  • %AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\_platform_specific\all\sths\{username}
  • %System Root%\Python27\Tools\pynche\X\{username}
  • %System Root%\Users\All Users\Microsoft\WwanSvc\{username}
  • %System Root%\Users\All Users\Microsoft\Network\{username}
  • %AppDataLocal%Low\Sun\{username}
  • %System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\{username}
  • %System Root%\Python27\Tools\pynche\X\xlicense.txt.KEKW
  • %All Users Profile%\Microsoft\Windows Defender\Definition Updates\{0E1465B0-BA9C-409F-BC32-D934317129CD}\{username}
  • %System Root%\Python27\tcl\tix8.4.3\demos\samples\{username}
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp.KEKW
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp.KEKW
  • %System Root%\Python27\include\pystrcmp.h.KEKW
  • %System Root%\Python27\tcl\tcl8.5\tzdata\Brazil\{username}
  • %System Root%\Users\Public\Videos\Sample Videos\{username}
  • %AppDataLocal%\Google\Chrome\User Data\MEIPreload\{username}
  • %AppDataLocal%\Microsoft\Windows\AppCache\container.dat.KEKW
  • %System Root%\Python27\Lib\site-packages\README.txt.KEKW
  • %System Root%\Python27\include\bytesobject.h.KEKW
  • %AppDataLocal%\Microsoft\Windows\AppCache\{username}
  • %AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\24\{username}
  • %System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\{username}
  • %System Root%\Python27\tcl\tcl8.5\tzdata\America\{username}
  • %System Root%\Users\{username}\AppData\Local\Microsoft\Media Player\{username}
  • %All Users Profile%\Mozilla\updates\308046B0AF4A39CB\{username}
  • %System Root%\Python27\tcl\tcl8.5\tzdata\America\North_Dakota\{username}
  • %AppDataLocal%\Apps\2.0\Data\RNQG94OQ.QJC\E1WGPJBQ.PMC\goog...app_9ae46cec200785df_0001.0003_7581c0cd83ac8659\Data\{username}
  • %System Root%\Users\All Users\Microsoft\RAC\StateData\RacMetaData.dat.KEKW
  • %System Root%\Users\Public\Pictures\Sample Pictures\Penguins.jpg.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\{username}
  • %Application Data%\Microsoft\Word\STARTUP\{username}
  • %System Root%\Python27\Lib\test\test_doctest3.txt.KEKW
  • %System Root%\Python27\Lib\site-packages\pythonnet-2.1.0.dist-info\top_level.txt.KEKW
  • %System Root%\Users\{username}
  • %System Root%\Users\Public\Documents\excel2k\XLS2KE02.xls.KEKW
  • %System Root%\Users\All Users\Microsoft\Device Stage\{username}.KEKW
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp.KEKW
  • %AppDataLocal%\Microsoft\Feeds Cache\8TQ1M9OZ\{username}
  • %Application Data%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\{username}
  • %Desktop%\excel2k\XLS2KE03.xls.KEKW
  • %Application Data%\Microsoft\Windows\DNTException\container.dat.KEKW
  • %System Root%\Python27\include\pyctype.h.KEKW
  • %System Root%\Python27\Lib\test\cjkencodings\gb18030.txt.KEKW
  • %System Root%\Python27\Lib\xml\sax\{username}
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Monet.jpg.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_44.txt.KEKW
  • %Application Data%\Mozilla\Extensions\{username}
  • %AppDataLocal%\pip\cache\http\5\4\3\d\{username}
  • %System Root%\Users\All Users\Microsoft\Vault\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_29.txt.KEKW
  • %System Root%\Python27\Lib\email\test\data\msg_45.txt.KEKW
  • %System Root%\Users\All Users\Microsoft\RAC\StateData\RacWmiEventData.dat.KEKW
  • %System Root%\Python27\Lib\distutils\tests\{username}
  • %AppDataLocal%\Microsoft\Internet Explorer\EmieUserList\{username}
  • %System Root%\Python27\Lib\site-packages\pip\_vendor\pkg_resources\{username}
  • %System Root%\Python27\Lib\test\audiodata\pluck-pcm16.wav.KEKW
  • %System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\{username}.KEKW
  • %AppDataLocal%\pip\cache\http\3\8\9\{username}
  • %User Profile%\AppData\{username}
  • %System Root%\Python27\Lib\email\test\data\msg_13.txt.KEKW

Step 5

Reinicie en modo normal y explore el equipo con su producto de Trend Micro para buscar los archivos identificados como TrojanSpy.MSIL.URSNIF.THCBFBO En caso de que el producto de Trend Micro ya haya limpiado, eliminado o puesto en cuarentena los archivos detectados, no serán necesarios más pasos. Puede optar simplemente por eliminar los archivos en cuarentena. Consulte esta página de Base de conocimientos para obtener más información.

Step 6

Restore this file from backup only Microsoft-related files will be restored. If this malware/grayware also deleted files related to programs that are not from Microsoft, please reinstall those programs on you computer again.

  • %System Root%\Python27\Lib\email\test\data\msg_39.txt
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp
  • %System Root%\Python27\Lib\test\cjkencodings\johab.txt
  • %User Profile%\Documents\excel2k\XLS2KE03.xls
  • %System Root%\Python27\include\datetime.h
  • %System Root%\Python27\include\abstract.h
  • %System Root%\Python27\include\patchlevel.h
  • %System Root%\Python27\Lib\test\cjkencodings\cp949.txt
  • %System Root%\Python27\Lib\test\cjkencodings\shift_jis-utf8.txt
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\HandPrints.jpg
  • %System Root%\Python27\Lib\email\test\data\msg_18.txt
  • %System Root%\Python27\Lib\test\leakers\README.txt
  • %System Root%\Python27\Lib\email\test\data\msg_38.txt
  • %System Root%\Python27\include\sysmodule.h
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Notebook.jpg
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp
  • %System Root%\Python27\include\dtoa.h
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp
  • %System Root%\Python27\Lib\test\cjkencodings\gb18030-utf8.txt
  • %System Root%\Python27\tcl\tix8.4.3\pref\Blue.cs
  • F:\data\photos\stunning.jpg
  • %System Root%\Python27\include\graminit.h
  • %System Root%\Python27\include\cellobject.h
  • %System Root%\Python27\tcl\tix8.4.3\pref\WmDefault.cs
  • %System Root%\Python27\Lib\email\test\data\msg_05.txt
  • F:\data\photos\long_exposure.jpg
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\adobeflashcs3.txt
  • %System Root%\Users\Public\Pictures\Sample Pictures\Tulips.jpg
  • %System Root%\Python27\Lib\test\test_doctest4.txt
  • %User Temp%\jawshtml.html
  • %System Root%\Python27\Lib\test\cjkencodings\iso2022_jp-utf8.txt
  • %Desktop%\word2k\DOC2KE01.doc
  • %AppDataLocal%\Microsoft\Internet Explorer\MSIMGSIZ.DAT
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp
  • %System Root%\Python27\include\descrobject.h
  • %System Root%\Python27\Lib\idlelib\Icons\tk.gif
  • %System Root%\Python27\tcl\tk8.5\images\logoMed.gif
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Peacock.jpg
  • %User Temp%\dd_vcredistMSI0FD5.txt
  • %Desktop%\Transmag.doc
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\pkcs11.txt
  • %System Root%\Python27\Lib\test\imghdrdata\python.bmp
  • %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\container.dat
  • %Desktop%\excel2k\XLS2KE04.xls
  • %System Root%\Python27\tcl\tk8.5\demos\images\earth.gif
  • %User Temp%\dd_NDP452-KB2901907-x86-x64-AllOS-ENU_decompression_log.txt
  • %System Root%\Python27\include\ast.h
  • %System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\top_level.txt
  • %System Root%\Python27\Lib\test\sgml_input.html
  • %System Root%\Users\Public\Pictures\Sample Pictures\Desert.jpg
  • %System Root%\Python27\include\genobject.h
  • %System Root%\Python27\include\fileobject.h
  • %System Root%\Python27\Lib\test\zipdir.zip
  • %User Profile%\Documents\word2k\DOC2KE03.doc
  • %System Root%\Python27\include\compile.h
  • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KExx.PPT
  • %System Root%\Python27\Tools\pynche\webcolors.txt
  • %All Users Profile%\Microsoft\Windows\Power Efficiency Diagnostics\energy-report.html
  • %User Profile%\Documents\powerpoint2k\PPT2KE01.ppt
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp
  • %System Root%\Python27\Lib\email\test\data\msg_04.txt
  • %Desktop%\excel2k\XLS2KE05.xls
  • %System Root%\Python27\Lib\site-packages\Pillow-6.0.0.dist-info\top_level.txt
  • %System Root%\Python27\Lib\email\test\data\msg_12.txt
  • %System Root%\excel2k\XLS2KE01.xls
  • %System Root%\Python27\include\marshal.h
  • %System Root%\Python27\Lib\test\test_doctest2.txt
  • %System Root%\Python27\Lib\email\test\data\msg_42.txt
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\TRRBlacklist.txt
  • %System Root%\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg
  • %Desktop%\word2k\DOC2KE05.doc
  • %Application Data%\Microsoft\Windows\IECompatUACache\Low\container.dat
  • %System Root%\Python27\include\pymath.h
  • %System Root%\Python27\Lib\test\imghdrdata\python.gif
  • %System Root%\Python27\Lib\email\test\data\msg_37.txt
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\file.gif
  • %System Root%\Python27\include\object.h
  • %System Root%\Python27\include\pyctype.h
  • %System Root%\Python27\tcl\tix8.4.3\pref\SGIGray.cs
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\srcfile.gif
  • %All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\LastBld.dat
  • %System Root%\Python27\Lib\test\exception_hierarchy.txt
  • %System Root%\Users\All Users\Microsoft\RAC\StateData\RacWmiDataBookmarks.dat
  • %All Users Profile%\Microsoft\Network\Downloader\qmgr0.dat
  • %AppDataLocal%\Microsoft\Internet Explorer\tabiconcache.dat
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp
  • %System Root%\Users\Public\Documents\excel2k\XLS2KE03.xls
  • %System Root%\Python27\include\pystrcmp.h
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp
  • %System Root%\powerpoint2k\PPT2KExx.PPT
  • %System Root%\Python27\include\symtable.h
  • %System Root%\Python27\Lib\email\test\data\msg_14.txt
  • %AppDataLocal%\Microsoft\Windows\AppCache\6A582BR6\container.dat
  • %System Root%\Python27\include\ucnhash.h
  • %System Root%\Python27\include\weakrefobject.h
  • %System Root%\excel2k\XLS2KE05.xls
  • %User Profile%\Documents\powerpoint2k\PPT2KE03.ppt
  • %System Root%\Python27\Lib\email\test\data\msg_10.txt
  • %All Users Profile%\Microsoft\Windows Defender\Scans\History\CacheManager\MpSfc.bin
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Monet.jpg
  • %System Root%\Python27\Tools\versioncheck\README.txt
  • %System Root%\Users\Public\Documents\Email and Password List.txt
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg
  • %System Root%\Python27\include\import.h
  • %System Root%\Python27\Lib\email\test\data\msg_41.txt
  • %System Root%\Python27\Lib\idlelib\help.html
  • %AppDataLocal%\Microsoft\Windows\WebCache\WebCacheV01.dat
  • %System Root%\Python27\Lib\test\cjkencodings\big5-utf8.txt
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache.bin
  • %System Root%\Python27\Lib\email\test\data\msg_17.txt
  • %AppDataLocal%\Microsoft\Windows\WebCacheLock.dat
  • %System Root%\Python27\include\floatobject.h
  • %System Root%\Python27\Lib\email\test\data\msg_08.txt
  • %User Temp%\Microsoft .NET Framework 4.5.2 Setup_20161212_135033207-MSI_netfx_Full_GDR_x64.msi.txt
  • %System Root%\Python27\Lib\idlelib\Icons\openfolder.gif
  • %System Root%\word2k\DOC2KE03.doc
  • %System Root%\Python27\Lib\test\imghdrdata\python.jpg
  • %Application Data%\Microsoft\Windows\IEDownloadHistory\container.dat
  • %System Root%\Python27\Lib\test\ieee754.txt
  • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo200.gif
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\SiteSecurityServiceState.txt
  • %System Root%\Python27\Lib\idlelib\TODO.txt
  • %System Root%\Python27\include\pystate.h
  • %System Root%\Python27\Lib\email\test\data\msg_31.txt
  • %System Root%\Python27\include\pyerrors.h
  • %System Root%\Python27\include\boolobject.h
  • %System Root%\Python27\Lib\email\test\data\msg_03.txt
  • %System Root%\Python27\include\sliceobject.h
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\AlternateServices.txt
  • %User Profile%\Documents\word2k\DOC2KE01.doc
  • %System Root%\Python27\include\timefuncs.h
  • %System Root%\Python27\include\pythread.h
  • %System Root%\Python27\include\pgenheaders.h
  • %All Users Profile%\Microsoft\Network\Downloader\qmgr1.dat
  • %System Root%\Users\Public\Documents\word2k\DOC2KE02.doc
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp
  • %System Root%\Python27\Lib\test\tokenize_tests.txt
  • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE01.ppt
  • %System Root%\Python27\include\node.h
  • %System Root%\Python27\tcl\tix8.4.3\pref\Gray.cs
  • %System Root%\Python27\include\pyexpat.h
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\prefs.js
  • %User Profile%\Documents\powerpoint2k\PPT2KE04.ppt
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\visualstudio2005.txt
  • %System Root%\Python27\Lib\idlelib\Icons\idle_48.gif
  • %System Root%\Python27\include\unicodeobject.h
  • %AppDataLocal%\Microsoft\Windows\AppCache\container.dat
  • %System Root%\Python27\Lib\email\test\data\msg_32.txt
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\textfile.gif
  • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE03.ppt
  • %Desktop%\powerpoint2k\PPT2KE03.ppt
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Connectivity.gif
  • %System Root%\Python27\Lib\email\test\data\msg_01.txt
  • %Application Data%\Microsoft\Windows\IETldCache\container.dat
  • %System Root%\Python27\Lib\email\test\data\msg_30.txt
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg
  • %User Temp%\dd_SetupUtility.txt
  • %AppDataLocal%Low\Microsoft\Windows\AppCache\LY14JQYG\container.dat
  • %System Root%\Python27\tcl\tk8.5\images\logo100.gif
  • %System Root%\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
  • %System Root%\Python27\include\Python.h
  • %System Root%\Python27\include\parsetok.h
  • %System Root%\Python27\include\pymacconfig.h
  • %System Root%\Users\Public\Documents\word2k\DOC2KE01.doc
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\plusarm.gif
  • %System Root%\Python27\Lib\test\audiodata\pluck-pcm32.wav
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Pine_Lumber.jpg
  • %User Profile%\Documents\excel2k\XLS2KE02.xls
  • %System Root%\Users\Public\Pictures\Sample Pictures\Koala.jpg
  • %System Root%\Python27\include\bufferobject.h
  • %System Root%\Python27\Lib\email\test\data\msg_13.txt
  • %System Root%\Python27\include\bytesobject.h
  • %User Temp%\dd_wcf_CA_smci_20161212_135110_351.txt
  • %System Root%\Python27\include\classobject.h
  • %System Root%\Users\Public\Documents\word2k\DOC2KExx.doc
  • %System Root%\Python27\Lib\test\cjkencodings\gb2312.txt
  • %System Root%\Python27\include\osdefs.h
  • %System Root%\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
  • %System Root%\Python27\Tools\pynche\websafe.txt
  • %System Root%\Python27\include\pyport.h
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp
  • %Desktop%\excel2k\XLS2KE01.xls
  • %System Root%\word2k\DOC2KE04.doc
  • %Application Data%\Microsoft\Windows\IECompatUACache\container.dat
  • %System Root%\powerpoint2k\PPT2KE04.ppt
  • %System Root%\Python27\include\bytearrayobject.h
  • %System Root%\Python27\include\Python-ast.h
  • %System Root%\Python27\include\ceval.h
  • %System Root%\Python27\include\longobject.h
  • %User Temp%\Microsoft .NET Framework 4.5.2 Setup_20161212_135033207.html
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp
  • %System Root%\Python27\tcl\tk8.5\images\logo64.gif
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\SecurityPreloadState.txt
  • %System Root%\Python27\include\pystrtod.h
  • %AppDataLocal%\Microsoft\Windows\1033\StructuredQuerySchema.bin
  • %System Root%\Python27\Tools\pynche\X\rgb.txt
  • %System Root%\Python27\include\eval.h
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp
  • %System Root%\$Recycle.Bin\S-1-5-21-2407829820-1079796033-203259571-500\$IC8HJH8.zip
  • %System Root%\powerpoint2k\PPT2KE03.ppt
  • %System Root%\Python27\Lib\test\cjkencodings\hz-utf8.txt
  • %System Root%\Python27\Lib\test\test_doctest3.txt
  • %AppDataLocal%\GDIPFONTCACHEV1.DAT
  • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieSiteList\container.dat
  • %System Root%\Python27\include\pgen.h
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp
  • %System Root%\Python27\Lib\email\test\data\msg_36.txt
  • %System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\LICENSE.txt
  • %System Root%\Users\Public\Documents\word2k\DOC2KE04.doc
  • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo150.gif
  • %System Root%\Python27\Lib\idlelib\Icons\plusnode.gif
  • %System Root%\Python27\Lib\email\test\data\msg_19.txt
  • %User Profile%\Documents\word2k\DOC2KE05.doc
  • %Application Data%\Microsoft\Windows\IECompatCache\Low\container.dat
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Stucco.gif
  • %System Root%\Python27\include\stringobject.h
  • %System Root%\Python27\README.txt
  • %System Root%\Python27\Lib\email\test\data\msg_09.txt
  • %System Root%\Python27\include\tupleobject.h
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\urlCache.bin
  • %Desktop%\powerpoint2k\PPT2KExx.PPT
  • %User Profile%\Documents\excel2k\XLS2KExx.xls
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp
  • %System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\entry_points.txt
  • %System Root%\Python27\Lib\test\cjkencodings\gbk-utf8.txt
  • %Application Data%\Microsoft\Windows\IECompatCache\container.dat
  • %System Root%\word2k\DOC2KE02.doc
  • %System Root%\Python27\Lib\email\test\data\msg_12a.txt
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Psychedelic.jpg
  • %System Root%\Python27\Lib\idlelib\README.txt
  • %System Root%\Python27\Lib\test\imghdrdata\python.png
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\vistasidebar.txt
  • %System Root%\Python27\Lib\test\testtar.tar
  • %System Root%\Users\Public\Music\Sample Music\Kalimba.mp3
  • %System Root%\Python27\Lib\idlelib\help.txt
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\warning.gif
  • %System Root%\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
  • %System Root%\Python27\include\pycapsule.h
  • %System Root%\Python27\Lib\test\cjkencodings\euc_jp.txt
  • %System Root%\Python27\include\bitset.h
  • %System Root%\Python27\include\errcode.h
  • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieUserList\container.dat
  • %System Root%\Python27\Lib\email\test\data\msg_46.txt
  • %AppDataLocal%\Microsoft\Internet Explorer\frameiconcache.dat
  • %System Root%\Python27\include\structmember.h
  • %Desktop%\word2k\DOC2KExx.doc
  • %User Temp%\Guest.bmp
  • %System Root%\Python27\Lib\email\test\data\msg_06.txt
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\SoftBlue.jpg
  • %System Root%\Python27\Lib\idlelib\Icons\minusnode.gif
  • %System Root%\Python27\include\code.h
  • %System Root%\Users\Public\Documents\excel2k\XLS2KE01.xls
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp
  • %User Temp%\dd_wcf_CA_smci_20161212_135109_353.txt
  • %AppDataLocal%\Microsoft\Internet Explorer\EmieBrowserModeList\container.dat
  • %User Profile%\Documents\word2k\DOC2KE04.doc
  • %System Root%\Python27\tcl\tix8.4.3\pref\TK.cs
  • %System Root%\Python27\Tools\pynche\namedcolors.txt
  • %System Root%\Users\Public\Documents\excel2k\XLS2KE05.xls
  • %System Root%\Python27\Lib\test\floating_points.txt
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\minus.gif
  • %System Root%\Python27\Lib\idlelib\Icons\folder.gif
  • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\{AD285A8B-713F-11E9-85F8-005056BC44A9}.dat
  • %User Profile%\Documents\excel2k\XLS2KE05.xls
  • %System Root%\Python27\Lib\email\test\data\msg_21.txt
  • %System Root%\Python27\include\moduleobject.h
  • %System Root%\Python27\Lib\test\audiodata\pluck-pcm16.wav
  • %System Root%\Users\Public\Documents\excel2k\XLS2KE04.xls
  • %System Root%\Python27\Lib\test\cjkencodings\iso2022_kr-utf8.txt
  • %Desktop%\excel2k\XLS2KE03.xls
  • %System Root%\Python27\include\metagrammar.h
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp
  • %System Root%\excel2k\XLS2KE02.xls
  • %System Root%\Python27\Lib\email\test\data\msg_29.txt
  • %User Profile%\Documents\fp_18.0.0.203_archive.zip
  • %Desktop%\Email and Password List.js
  • %System Root%\Python27\Lib\email\test\data\msg_35.txt
  • %System Root%\Python27\Lib\test\cjkencodings\euc_kr-utf8.txt
  • %System Root%\Python27\include\objimpl.h
  • %All Users Profile%\VMware\VMware Tools\manifest.txt
  • %System Root%\Python27\include\py_curses.h
  • %Desktop%\excel2k\XLS2KE02.xls
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp
  • %System Root%\word2k\DOC2KExx.doc
  • %All Users Profile%\Microsoft\User Account Pictures\{username}.dat
  • %System Root%\word2k\DOC2KE05.doc
  • %System Root%\Python27\Tools\webchecker\README.txt
  • %System Root%\Python27\Lib\email\test\data\msg_20.txt
  • %All Users Profile%\Microsoft\Windows Defender\Scans\mpcache-B1C01FED9F08520A4647901EFB883A6A3B247F8D.bin
  • %System Root%\Python27\Lib\email\test\data\msg_24.txt
  • %System Root%\Python27\Tools\pynche\X\xlicense.txt
  • %System Root%\Python27\Lib\test\cjkencodings\gbk.txt
  • %System Root%\Python27\include\token.h
  • %System Root%\Python27\include\pyconfig.h
  • %System Root%\Python27\include\intrcheck.h
  • %System Root%\Python27\Lib\test\cjkencodings\hz.txt
  • %System Root%\Python27\Lib\idlelib\extend.txt
  • %System Root%\Python27\Lib\test\cjkencodings\iso2022_jp.txt
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\White_Chocolate.jpg
  • %Desktop%\Email and Password List.txt
  • %System Root%\Python27\Lib\test\cjkencodings\euc_kr.txt
  • %System Root%\Python27\Lib\email\test\data\msg_22.txt
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp
  • %System Root%\Python27\Lib\lib2to3\Grammar.txt
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp
  • %System Root%\excel2k\XLS2KE04.xls
  • %System Root%\Python27\include\modsupport.h
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Stars.jpg
  • %User Temp%\dd_vcredistUI0FD5.txt
  • %System Root%\Python27\Tools\Scripts\README.txt
  • %System Root%\Python27\Lib\test\cjkencodings\big5.txt
  • %System Root%\Python27\Lib\idlelib\Icons\python.gif
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\vmwarefilters.txt
  • %System Root%\Python27\include\pyarena.h
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\folder.gif
  • %Application Data%\Microsoft\Windows\DNTException\container.dat
  • %Desktop%\word2k\DOC2KE02.doc
  • %System Root%\Python27\Lib\test\cjkencodings\big5hkscs-utf8.txt
  • %System Root%\Python27\LICENSE.txt
  • %System Root%\Python27\include\longintrepr.h
  • %System Root%\Python27\include\rangeobject.h
  • %System Root%\Python27\tcl\tix8.4.3\pref\Bisque.cs
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Roses.jpg
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\urlCache-current.bin
  • %System Root%\Python27\Lib\test\test_doctest.txt
  • %System Root%\Email and Password List.txt
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg
  • %System Root%\Python27\include\memoryobject.h
  • %System Root%\Users\Public\Documents\Email and Password List.js
  • %System Root%\Python27\Lib\email\test\data\msg_16.txt
  • %AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.1\LICENSE.txt
  • %AppDataLocal%\Microsoft\Windows\History\Low\History.IE5\container.dat
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp
  • %System Root%\Python27\include\pyfpe.h
  • %System Root%\Python27\tcl\tix8.4.3\demos\bitmaps\tix.gif
  • %System Root%\Python27\Lib\test\cjkencodings\euc_jisx0213.txt
  • %System Root%\Python27\include\intobject.h
  • %System Root%\Python27\include\pygetopt.h
  • %System Root%\Python27\Lib\test\cjkencodings\gb2312-utf8.txt
  • %System Root%\Python27\include\structseq.h
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\openfold.gif
  • %System Root%\Python27\Lib\idlelib\CREDITS.txt
  • %System Root%\Python27\Lib\test\audiodata\pluck-pcm8.wav
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\microsoftoffice2003.txt
  • %System Root%\Python27\tcl\tk8.5\images\logoLarge.gif
  • %System Root%\Users\All Users\Microsoft\RAC\StateData\RacMetaData.dat
  • %System Root%\Python27\include\traceback.h
  • %System Root%\Python27\Lib\email\test\data\msg_23.txt
  • %System Root%\Python27\Lib\email\test\data\msg_44.txt
  • %All Users Profile%\Microsoft\Windows NT\MSScan\WelcomeScan.jpg
  • %User Profile%\Documents\powerpoint2k\PPT2KExx.PPT
  • %System Root%\Python27\Lib\email\test\data\msg_25.txt
  • %System Root%\Python27\Lib\test\cjkencodings\gb18030.txt
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Tiki.gif
  • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo175.gif
  • %System Root%\Python27\Lib\test\cjkencodings\johab-utf8.txt
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Blue_Gradient.jpg
  • %System Root%\Python27\Lib\test\cjkencodings\euc_jp-utf8.txt
  • %System Root%\Python27\include\grammar.h
  • %Desktop%\powerpoint2k\PPT2KE04.ppt
  • %User Profile%\Documents\excel2k\XLS2KE01.xls
  • %System Root%\powerpoint2k\PPT2KE01.ppt
  • %AppDataLocal%\Microsoft\Internet Explorer\UrlBlockManager\urlblocklist.bin
  • %User Profile%\Documents\Email and Password List.js
  • %System Root%\Python27\Lib\email\test\data\msg_15.txt
  • %User Profile%\Documents\Email and Password List.txt
  • %System Root%\Python27\Lib\idlelib\idle_test\README.txt
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\minusarm.gif
  • %System Root%\Python27\include\pymactoolbox.h
  • %System Root%\Python27\include\pymem.h
  • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{4555A5E7-C06D-11E6-8AB1-005056BC3E18}.dat
  • %User Temp%\dd_vcredistMSI0FC1.txt
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Pretty_Peacock.jpg
  • %System Root%\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp
  • %System Root%\Python27\Lib\email\test\data\msg_34.txt
  • %System Root%\Python27\include\opcode.h
  • %AppDataLocal%\Microsoft\Internet Explorer\EmieUserList\container.dat
  • %System Root%\Python27\include\pydebug.h
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\no_entry.gif
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Sand_Paper.jpg
  • %Desktop%\powerpoint2k\PPT2KE01.ppt
  • %System Root%\Python27\include\dictobject.h
  • %System Root%\Python27\Lib\site-packages\README.txt
  • F:\wlines.zip
  • %System Root%\Python27\include\frameobject.h
  • %System Root%\Python27\tcl\tk8.5\demos\images\earthris.gif
  • %All Users Profile%\Microsoft\User Account Pictures\user.bmp
  • %User Profile%\Documents\powerpoint2k\PPT2KE05.ppt
  • %All Users Profile%\Microsoft\Windows\DRM\blackbox.bin
  • %System Root%\Python27\NEWS.txt
  • %System Root%\Python27\tcl\tk8.5\images\tai-ku.gif
  • %System Root%\Python27\Tools\pynche\README.txt
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp
  • %System Root%\word2k\DOC2KE01.doc
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\act_fold.gif
  • %System Root%\Python27\include\warnings.h
  • %System Root%\Python27\Lib\lib2to3\PatternGrammar.txt
  • %System Root%\Python27\Lib\test\cjkencodings\shift_jisx0213.txt
  • %System Root%\Python27\Tools\pynche\html40colors.txt
  • %System Root%\Python27\Lib\idlelib\Icons\idle_16.gif
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp
  • %System Root%\excel2k\XLS2KE03.xls
  • %System Root%\Python27\Lib\email\test\data\PyBanner048.gif
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-current.bin
  • %Application Data%\Microsoft\Windows\PrivacIE\container.dat
  • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\pluginreg.dat
  • %System Root%\Python27\include\pythonrun.h
  • %System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\dependency_links.txt
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp
  • %System Root%\Python27\Lib\test\formatfloat_testcases.txt
  • %System Root%\Users\Public\Music\Sample Music\Sleep Away.mp3
  • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE02.ppt
  • %All Users Profile%\Microsoft\OFFICE\DATA\opa12.dat
  • %System Root%\Python27\Lib\test\cjkencodings\shift_jis.txt
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\info.gif
  • %System Root%\Python27\Lib\test\cjkencodings\euc_jisx0213-utf8.txt
  • %System Root%\Python27\tcl\tix8.4.3\pref\WmDefault.txt
  • %AppDataLocal%\Microsoft\Internet Explorer\EmieSiteList\container.dat
  • %All Users Profile%\Microsoft\User Account Pictures\guest.bmp
  • %System Root%\Users\Default\NTUSER.DAT
  • %User Profile%\Documents\word2k\DOC2KE02.doc
  • %System Root%\Python27\Lib\email\test\data\msg_27.txt
  • %System Root%\Users\All Users\Microsoft\RAC\StateData\RacWmiEventData.dat
  • %System Root%\Python27\Lib\email\test\data\msg_43.txt
  • %System Root%\Python27\Lib\email\test\data\msg_33.txt
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\googledesktop.txt
  • %System Root%\Python27\include\complexobject.h
  • %System Root%\Users\Public\Documents\word2k\DOC2KE03.doc
  • %System Root%\powerpoint2k\PPT2KE02.ppt
  • %Desktop%\excel2k\XLS2KExx.xls
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp
  • %System Root%\Python27\include\codecs.h
  • %System Root%\Python27\Lib\test\cjkencodings\cp949-utf8.txt
  • %Desktop%\word2k\DOC2KE03.doc
  • %System Root%\Python27\tcl\tix8.4.3\pref\TixGray.cs
  • %User Profile%\Documents\excel2k\XLS2KE04.xls
  • %System Root%\Python27\include\listobject.h
  • %System Root%\Python27\Lib\test\audiodata\pluck-pcm24.wav
  • %All Users Profile%\VMware\VMware Tools\Unity Filters\adobephotoshopcs3.txt
  • %System Root%\Python27\Lib\test\cmath_testcases.txt
  • %Desktop%\note.txt
  • %AppDataLocal%\Google\Chrome\User Data\Crashpad\settings.dat
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Tanspecks.jpg
  • F:\data\dolist.txt
  • %User Temp%\{username}.bmp
  • %System Root%\powerpoint2k\PPT2KE05.ppt
  • %Desktop%\powerpoint2k\PPT2KE02.ppt
  • %System Root%\excel2k\XLS2KExx.xls
  • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE04.ppt
  • %System Root%\Users\Public\Documents\powerpoint2k\PPT2KE05.ppt
  • %User Temp%\dd_vcredistUI0FC1.txt
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Wrinkled_Paper.gif
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp
  • %User Profile%\Documents\powerpoint2k\PPT2KE02.ppt
  • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo75.gif
  • %System Root%\Python27\include\methodobject.h
  • %System Root%\Python27\tcl\tix8.4.3\bitmaps\plus.gif
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-child.bin
  • %System Root%\Python27\Lib\email\test\data\msg_26.txt
  • %All Users Profile%\VMware\RawdskCompatibility\native\regdata.dat
  • F:\data\tmp.doc
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp
  • %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-child-current.bin
  • %AppDataLocal%\Microsoft\Internet Explorer\brndlog.txt
  • %AppDataLocal%\Microsoft\Feeds Cache\container.dat
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp
  • %System Root%\Python27\Lib\email\test\data\msg_07.txt
  • %Desktop%\word2k\DOC2KE04.doc
  • %System Root%\Users\Public\Documents\excel2k\XLS2KE02.xls
  • %User Profile%\Documents\word2k\DOC2KExx.doc
  • %AppDataLocal%\Google\Software Reporter Tool\settings.dat
  • %All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp
  • %System Root%\Python27\include\iterobject.h
  • %System Root%\Email and Password List.js
  • %System Root%\Python27\tcl\tk8.5\demos\images\tcllogo.gif
  • %System Root%\Python27\Lib\email\test\data\msg_02.txt
  • %System Root%\Python27\Lib\email\test\data\msg_28.txt
  • %System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\top_level.txt
  • %System Root%\Python27\Lib\email\test\data\msg_40.txt
  • %Desktop%\AAljoOV.jpg
  • %Application Data%\Microsoft\Office\Recent\index.dat
  • %System Root%\Python27\Lib\idlelib\NEWS.txt
  • %AppDataLocal%Low\Microsoft\Internet Explorer\EmieBrowserModeList\container.dat
  • %System Root%\Python27\Lib\test\cjkencodings\shift_jisx0213-utf8.txt
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Cave_Drawings.gif
  • %AppDataLocal%Low\Microsoft\Windows\AppCache\container.dat
  • %System Root%\Users\Public\Documents\word2k\DOC2KE05.doc
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Bears.jpg
  • %System Root%\Python27\include\cobject.h
  • %System Root%\Python27\include\asdl.h
  • %System Root%\Python27\include\setobject.h
  • %System Root%\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg
  • %System Root%\Python27\Lib\test\test_difflib_expect.html
  • %System Root%\Python27\Lib\test\cjkencodings\iso2022_kr.txt
  • %System Root%\Python27\include\bytes_methods.h
  • %System Root%\Users\Public\Documents\excel2k\XLS2KExx.xls
  • %System Root%\Python27\Lib\test\math_testcases.txt
  • %System Root%\Python27\include\cStringIO.h
  • %System Root%\Python27\Lib\site-packages\pythonnet-2.1.0.dist-info\top_level.txt
  • %System Root%\Python27\Lib\idlelib\Icons\idle_32.gif
  • %System Root%\Python27\tcl\tk8.5\images\pwrdLogo100.gif
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Garden.jpg
  • %System Root%\Python27\Lib\test\cjkencodings\big5hkscs.txt
  • %System Root%\Python27\include\funcobject.h
  • %AppDataLocal%\Microsoft\Windows Mail\Stationery\Small_News.jpg
  • %System Root%\Python27\Lib\email\test\data\msg_45.txt
  • %System Root%\Python27\Lib\email\test\data\msg_11.txt
  • %System Root%\Python27\tcl\tix8.4.3\pref\TkWin.cs
  • %System Root%\Python27\Lib\idlelib\HISTORY.txt
  • %Desktop%\powerpoint2k\PPT2KE05.ppt
  • %System Root%\Users\Public\Pictures\Sample Pictures\Penguins.jpg
  • %System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\entry_points.txt
  • %System Root%\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
  • %System Root%\Python27\include\enumobject.h


Rellene nuestra encuesta!