TrojanSpy.MSIL.URSNIF.THCBFBO

March 26, 2020

PLATFORM:

Windows

OVERALL RISK RATING:

DAMAGE POTENTIAL:

DISTRIBUTION POTENTIAL:

REPORTED INFECTION:

SYSTEM IMPACT RATING:

INFORMATION EXPOSURE:

Threat Type: Trojan Spy
Destructiveness: No
Encrypted:
In the wild: Yes

OVERVIEW

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

TECHNICAL DETAILS

File Size:

8,704 bytes

File Type:

EXE

Memory Resident:

Yes

Initial Samples Received Date:

26 Mar 2020

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy adds the following processes:

notepad.exe {username}

Autostart Technique

This Trojan Spy drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

%User Startup%\{username}

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows 2003(32-bit), XP and 2000(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit), 10(64-bit).)

Other System Modifications

This Trojan Spy deletes the following files:

%System Root%\Python27\Lib\email\test\data\msg_39.txt
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp
%System Root%\Python27\Lib\test\cjkencodings\johab.txt
%User Profile%\Documents\excel2k\XLS2KE03.xls
%System Root%\Python27\include\datetime.h
%System Root%\Python27\include\abstract.h
%System Root%\Python27\include\patchlevel.h
%System Root%\Python27\Lib\test\cjkencodings\cp949.txt
%System Root%\Python27\Lib\test\cjkencodings\shift_jis-utf8.txt
%AppDataLocal%\Microsoft\Windows Mail\Stationery\HandPrints.jpg
%System Root%\Python27\Lib\email\test\data\msg_18.txt
%System Root%\Python27\Lib\test\leakers\README.txt
%System Root%\Python27\Lib\email\test\data\msg_38.txt
%System Root%\Python27\include\sysmodule.h
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Notebook.jpg
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp
%System Root%\Python27\include\dtoa.h
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp
%System Root%\Python27\Lib\test\cjkencodings\gb18030-utf8.txt
%System Root%\Python27\tcl\tix8.4.3\pref\Blue.cs
F:\data\photos\stunning.jpg
%System Root%\Python27\include\graminit.h
%System Root%\Python27\include\cellobject.h
%System Root%\Python27\tcl\tix8.4.3\pref\WmDefault.cs
%System Root%\Python27\Lib\email\test\data\msg_05.txt
F:\data\photos\long_exposure.jpg
%All Users Profile%\VMware\VMware Tools\Unity Filters\adobeflashcs3.txt
%System Root%\Users\Public\Pictures\Sample Pictures\Tulips.jpg
%System Root%\Python27\Lib\test\test_doctest4.txt
%User Temp%\jawshtml.html
%System Root%\Python27\Lib\test\cjkencodings\iso2022_jp-utf8.txt
%Desktop%\word2k\DOC2KE01.doc
%AppDataLocal%\Microsoft\Internet Explorer\MSIMGSIZ.DAT
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp
%System Root%\Python27\include\descrobject.h
%System Root%\Python27\Lib\idlelib\Icons\tk.gif
%System Root%\Python27\tcl\tk8.5\images\logoMed.gif
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Peacock.jpg
%User Temp%\dd_vcredistMSI0FD5.txt
%Desktop%\Transmag.doc
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\pkcs11.txt
%System Root%\Python27\Lib\test\imghdrdata\python.bmp
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\container.dat
%Desktop%\excel2k\XLS2KE04.xls
%System Root%\Python27\tcl\tk8.5\demos\images\earth.gif
%User Temp%\dd_NDP452-KB2901907-x86-x64-AllOS-ENU_decompression_log.txt
%System Root%\Python27\include\ast.h
%System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\top_level.txt
%System Root%\Python27\Lib\test\sgml_input.html
%System Root%\Users\Public\Pictures\Sample Pictures\Desert.jpg
%System Root%\Python27\include\genobject.h
%System Root%\Python27\include\fileobject.h
%System Root%\Python27\Lib\test\zipdir.zip
%User Profile%\Documents\word2k\DOC2KE03.doc
%System Root%\Python27\include\compile.h
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KExx.PPT
%System Root%\Python27\Tools\pynche\webcolors.txt
%All Users Profile%\Microsoft\Windows\Power Efficiency Diagnostics\energy-report.html
%User Profile%\Documents\powerpoint2k\PPT2KE01.ppt
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp
%System Root%\Python27\Lib\email\test\data\msg_04.txt
%Desktop%\excel2k\XLS2KE05.xls
%System Root%\Python27\Lib\site-packages\Pillow-6.0.0.dist-info\top_level.txt
%System Root%\Python27\Lib\email\test\data\msg_12.txt
%System Root%\excel2k\XLS2KE01.xls
%System Root%\Python27\include\marshal.h
%System Root%\Python27\Lib\test\test_doctest2.txt
%System Root%\Python27\Lib\email\test\data\msg_42.txt
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\TRRBlacklist.txt
%System Root%\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg
%Desktop%\word2k\DOC2KE05.doc
%Application Data%\Microsoft\Windows\IECompatUACache\Low\container.dat
%System Root%\Python27\include\pymath.h
%System Root%\Python27\Lib\test\imghdrdata\python.gif
%System Root%\Python27\Lib\email\test\data\msg_37.txt
%System Root%\Python27\tcl\tix8.4.3\bitmaps\file.gif
%System Root%\Python27\include\object.h
%System Root%\Python27\include\pyctype.h
%System Root%\Python27\tcl\tix8.4.3\pref\SGIGray.cs
%System Root%\Python27\tcl\tix8.4.3\bitmaps\srcfile.gif
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\LastBld.dat
%System Root%\Python27\Lib\test\exception_hierarchy.txt
%System Root%\Users\All Users\Microsoft\RAC\StateData\RacWmiDataBookmarks.dat
%All Users Profile%\Microsoft\Network\Downloader\qmgr0.dat
%AppDataLocal%\Microsoft\Internet Explorer\tabiconcache.dat
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp
%System Root%\Users\Public\Documents\excel2k\XLS2KE03.xls
%System Root%\Python27\include\pystrcmp.h
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp
%System Root%\powerpoint2k\PPT2KExx.PPT
%System Root%\Python27\include\symtable.h
%System Root%\Python27\Lib\email\test\data\msg_14.txt
%AppDataLocal%\Microsoft\Windows\AppCache\6A582BR6\container.dat
%System Root%\Python27\include\ucnhash.h
%System Root%\Python27\include\weakrefobject.h
%System Root%\excel2k\XLS2KE05.xls
%User Profile%\Documents\powerpoint2k\PPT2KE03.ppt
%System Root%\Python27\Lib\email\test\data\msg_10.txt
%All Users Profile%\Microsoft\Windows Defender\Scans\History\CacheManager\MpSfc.bin
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Monet.jpg
%System Root%\Python27\Tools\versioncheck\README.txt
%System Root%\Users\Public\Documents\Email and Password List.txt
%AppDataLocal%\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg
%System Root%\Python27\include\import.h
%System Root%\Python27\Lib\email\test\data\msg_41.txt
%System Root%\Python27\Lib\idlelib\help.html
%AppDataLocal%\Microsoft\Windows\WebCache\WebCacheV01.dat
%System Root%\Python27\Lib\test\cjkencodings\big5-utf8.txt
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache.bin
%System Root%\Python27\Lib\email\test\data\msg_17.txt
%AppDataLocal%\Microsoft\Windows\WebCacheLock.dat
%System Root%\Python27\include\floatobject.h
%System Root%\Python27\Lib\email\test\data\msg_08.txt
%User Temp%\Microsoft .NET Framework 4.5.2 Setup_20161212_135033207-MSI_netfx_Full_GDR_x64.msi.txt
%System Root%\Python27\Lib\idlelib\Icons\openfolder.gif
%System Root%\word2k\DOC2KE03.doc
%System Root%\Python27\Lib\test\imghdrdata\python.jpg
%Application Data%\Microsoft\Windows\IEDownloadHistory\container.dat
%System Root%\Python27\Lib\test\ieee754.txt
%System Root%\Python27\tcl\tk8.5\images\pwrdLogo200.gif
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\SiteSecurityServiceState.txt
%System Root%\Python27\Lib\idlelib\TODO.txt
%System Root%\Python27\include\pystate.h
%System Root%\Python27\Lib\email\test\data\msg_31.txt
%System Root%\Python27\include\pyerrors.h
%System Root%\Python27\include\boolobject.h
%System Root%\Python27\Lib\email\test\data\msg_03.txt
%System Root%\Python27\include\sliceobject.h
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\AlternateServices.txt
%User Profile%\Documents\word2k\DOC2KE01.doc
%System Root%\Python27\include\timefuncs.h
%System Root%\Python27\include\pythread.h
%System Root%\Python27\include\pgenheaders.h
%All Users Profile%\Microsoft\Network\Downloader\qmgr1.dat
%System Root%\Users\Public\Documents\word2k\DOC2KE02.doc
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp
%System Root%\Python27\Lib\test\tokenize_tests.txt
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KE01.ppt
%System Root%\Python27\include\node.h
%System Root%\Python27\tcl\tix8.4.3\pref\Gray.cs
%System Root%\Python27\include\pyexpat.h
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\prefs.js
%User Profile%\Documents\powerpoint2k\PPT2KE04.ppt
%All Users Profile%\VMware\VMware Tools\Unity Filters\visualstudio2005.txt
%System Root%\Python27\Lib\idlelib\Icons\idle_48.gif
%System Root%\Python27\include\unicodeobject.h
%AppDataLocal%\Microsoft\Windows\AppCache\container.dat
%System Root%\Python27\Lib\email\test\data\msg_32.txt
%System Root%\Python27\tcl\tix8.4.3\bitmaps\textfile.gif
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KE03.ppt
%Desktop%\powerpoint2k\PPT2KE03.ppt
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Connectivity.gif
%System Root%\Python27\Lib\email\test\data\msg_01.txt
%Application Data%\Microsoft\Windows\IETldCache\container.dat
%System Root%\Python27\Lib\email\test\data\msg_30.txt
%AppDataLocal%\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg
%User Temp%\dd_SetupUtility.txt
%AppDataLocal%Low\Microsoft\Windows\AppCache\LY14JQYG\container.dat
%System Root%\Python27\tcl\tk8.5\images\logo100.gif
%System Root%\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
%System Root%\Python27\include\Python.h
%System Root%\Python27\include\parsetok.h
%System Root%\Python27\include\pymacconfig.h
%System Root%\Users\Public\Documents\word2k\DOC2KE01.doc
%System Root%\Python27\tcl\tix8.4.3\bitmaps\plusarm.gif
%System Root%\Python27\Lib\test\audiodata\pluck-pcm32.wav
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Pine_Lumber.jpg
%User Profile%\Documents\excel2k\XLS2KE02.xls
%System Root%\Users\Public\Pictures\Sample Pictures\Koala.jpg
%System Root%\Python27\include\bufferobject.h
%System Root%\Python27\Lib\email\test\data\msg_13.txt
%System Root%\Python27\include\bytesobject.h
%User Temp%\dd_wcf_CA_smci_20161212_135110_351.txt
%System Root%\Python27\include\classobject.h
%System Root%\Users\Public\Documents\word2k\DOC2KExx.doc
%System Root%\Python27\Lib\test\cjkencodings\gb2312.txt
%System Root%\Python27\include\osdefs.h
%System Root%\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
%System Root%\Python27\Tools\pynche\websafe.txt
%System Root%\Python27\include\pyport.h
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp
%Desktop%\excel2k\XLS2KE01.xls
%System Root%\word2k\DOC2KE04.doc
%Application Data%\Microsoft\Windows\IECompatUACache\container.dat
%System Root%\powerpoint2k\PPT2KE04.ppt
%System Root%\Python27\include\bytearrayobject.h
%System Root%\Python27\include\Python-ast.h
%System Root%\Python27\include\ceval.h
%System Root%\Python27\include\longobject.h
%User Temp%\Microsoft .NET Framework 4.5.2 Setup_20161212_135033207.html
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp
%System Root%\Python27\tcl\tk8.5\images\logo64.gif
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\SecurityPreloadState.txt
%System Root%\Python27\include\pystrtod.h
%AppDataLocal%\Microsoft\Windows\1033\StructuredQuerySchema.bin
%System Root%\Python27\Tools\pynche\X\rgb.txt
%System Root%\Python27\include\eval.h
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp
%System Root%\$Recycle.Bin\S-1-5-21-2407829820-1079796033-203259571-500\$IC8HJH8.zip
%System Root%\powerpoint2k\PPT2KE03.ppt
%System Root%\Python27\Lib\test\cjkencodings\hz-utf8.txt
%System Root%\Python27\Lib\test\test_doctest3.txt
%AppDataLocal%\GDIPFONTCACHEV1.DAT
%AppDataLocal%Low\Microsoft\Internet Explorer\EmieSiteList\container.dat
%System Root%\Python27\include\pgen.h
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp
%System Root%\Python27\Lib\email\test\data\msg_36.txt
%System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\LICENSE.txt
%System Root%\Users\Public\Documents\word2k\DOC2KE04.doc
%System Root%\Python27\tcl\tk8.5\images\pwrdLogo150.gif
%System Root%\Python27\Lib\idlelib\Icons\plusnode.gif
%System Root%\Python27\Lib\email\test\data\msg_19.txt
%User Profile%\Documents\word2k\DOC2KE05.doc
%Application Data%\Microsoft\Windows\IECompatCache\Low\container.dat
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Stucco.gif
%System Root%\Python27\include\stringobject.h
%System Root%\Python27\README.txt
%System Root%\Python27\Lib\email\test\data\msg_09.txt
%System Root%\Python27\include\tupleobject.h
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\urlCache.bin
%Desktop%\powerpoint2k\PPT2KExx.PPT
%User Profile%\Documents\excel2k\XLS2KExx.xls
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp
%System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\entry_points.txt
%System Root%\Python27\Lib\test\cjkencodings\gbk-utf8.txt
%Application Data%\Microsoft\Windows\IECompatCache\container.dat
%System Root%\word2k\DOC2KE02.doc
%System Root%\Python27\Lib\email\test\data\msg_12a.txt
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Psychedelic.jpg
%System Root%\Python27\Lib\idlelib\README.txt
%System Root%\Python27\Lib\test\imghdrdata\python.png
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp
%All Users Profile%\VMware\VMware Tools\Unity Filters\vistasidebar.txt
%System Root%\Python27\Lib\test\testtar.tar
%System Root%\Users\Public\Music\Sample Music\Kalimba.mp3
%System Root%\Python27\Lib\idlelib\help.txt
%System Root%\Python27\tcl\tix8.4.3\bitmaps\warning.gif
%System Root%\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
%System Root%\Python27\include\pycapsule.h
%System Root%\Python27\Lib\test\cjkencodings\euc_jp.txt
%System Root%\Python27\include\bitset.h
%System Root%\Python27\include\errcode.h
%AppDataLocal%Low\Microsoft\Internet Explorer\EmieUserList\container.dat
%System Root%\Python27\Lib\email\test\data\msg_46.txt
%AppDataLocal%\Microsoft\Internet Explorer\frameiconcache.dat
%System Root%\Python27\include\structmember.h
%Desktop%\word2k\DOC2KExx.doc
%User Temp%\Guest.bmp
%System Root%\Python27\Lib\email\test\data\msg_06.txt
%AppDataLocal%\Microsoft\Windows Mail\Stationery\SoftBlue.jpg
%System Root%\Python27\Lib\idlelib\Icons\minusnode.gif
%System Root%\Python27\include\code.h
%System Root%\Users\Public\Documents\excel2k\XLS2KE01.xls
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp
%User Temp%\dd_wcf_CA_smci_20161212_135109_353.txt
%AppDataLocal%\Microsoft\Internet Explorer\EmieBrowserModeList\container.dat
%User Profile%\Documents\word2k\DOC2KE04.doc
%System Root%\Python27\tcl\tix8.4.3\pref\TK.cs
%System Root%\Python27\Tools\pynche\namedcolors.txt
%System Root%\Users\Public\Documents\excel2k\XLS2KE05.xls
%System Root%\Python27\Lib\test\floating_points.txt
%System Root%\Python27\tcl\tix8.4.3\bitmaps\minus.gif
%System Root%\Python27\Lib\idlelib\Icons\folder.gif
%AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\{AD285A8B-713F-11E9-85F8-005056BC44A9}.dat
%User Profile%\Documents\excel2k\XLS2KE05.xls
%System Root%\Python27\Lib\email\test\data\msg_21.txt
%System Root%\Python27\include\moduleobject.h
%System Root%\Python27\Lib\test\audiodata\pluck-pcm16.wav
%System Root%\Users\Public\Documents\excel2k\XLS2KE04.xls
%System Root%\Python27\Lib\test\cjkencodings\iso2022_kr-utf8.txt
%Desktop%\excel2k\XLS2KE03.xls
%System Root%\Python27\include\metagrammar.h
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp
%System Root%\excel2k\XLS2KE02.xls
%System Root%\Python27\Lib\email\test\data\msg_29.txt
%User Profile%\Documents\fp_18.0.0.203_archive.zip
%Desktop%\Email and Password List.js
%System Root%\Python27\Lib\email\test\data\msg_35.txt
%System Root%\Python27\Lib\test\cjkencodings\euc_kr-utf8.txt
%System Root%\Python27\include\objimpl.h
%All Users Profile%\VMware\VMware Tools\manifest.txt
%System Root%\Python27\include\py_curses.h
%Desktop%\excel2k\XLS2KE02.xls
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp
%System Root%\word2k\DOC2KExx.doc
%All Users Profile%\Microsoft\User Account Pictures\{username}.dat
%System Root%\word2k\DOC2KE05.doc
%System Root%\Python27\Tools\webchecker\README.txt
%System Root%\Python27\Lib\email\test\data\msg_20.txt
%All Users Profile%\Microsoft\Windows Defender\Scans\mpcache-B1C01FED9F08520A4647901EFB883A6A3B247F8D.bin
%System Root%\Python27\Lib\email\test\data\msg_24.txt
%System Root%\Python27\Tools\pynche\X\xlicense.txt
%System Root%\Python27\Lib\test\cjkencodings\gbk.txt
%System Root%\Python27\include\token.h
%System Root%\Python27\include\pyconfig.h
%System Root%\Python27\include\intrcheck.h
%System Root%\Python27\Lib\test\cjkencodings\hz.txt
%System Root%\Python27\Lib\idlelib\extend.txt
%System Root%\Python27\Lib\test\cjkencodings\iso2022_jp.txt
%AppDataLocal%\Microsoft\Windows Mail\Stationery\White_Chocolate.jpg
%Desktop%\Email and Password List.txt
%System Root%\Python27\Lib\test\cjkencodings\euc_kr.txt
%System Root%\Python27\Lib\email\test\data\msg_22.txt
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp
%System Root%\Python27\Lib\lib2to3\Grammar.txt
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp
%System Root%\excel2k\XLS2KE04.xls
%System Root%\Python27\include\modsupport.h
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Stars.jpg
%User Temp%\dd_vcredistUI0FD5.txt
%System Root%\Python27\Tools\Scripts\README.txt
%System Root%\Python27\Lib\test\cjkencodings\big5.txt
%System Root%\Python27\Lib\idlelib\Icons\python.gif
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp
%All Users Profile%\VMware\VMware Tools\Unity Filters\vmwarefilters.txt
%System Root%\Python27\include\pyarena.h
%System Root%\Python27\tcl\tix8.4.3\bitmaps\folder.gif
%Application Data%\Microsoft\Windows\DNTException\container.dat
%Desktop%\word2k\DOC2KE02.doc
%System Root%\Python27\Lib\test\cjkencodings\big5hkscs-utf8.txt
%System Root%\Python27\LICENSE.txt
%System Root%\Python27\include\longintrepr.h
%System Root%\Python27\include\rangeobject.h
%System Root%\Python27\tcl\tix8.4.3\pref\Bisque.cs
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Roses.jpg
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\urlCache-current.bin
%System Root%\Python27\Lib\test\test_doctest.txt
%System Root%\Email and Password List.txt
%AppDataLocal%\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg
%System Root%\Python27\include\memoryobject.h
%System Root%\Users\Public\Documents\Email and Password List.js
%System Root%\Python27\Lib\email\test\data\msg_16.txt
%AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.1\LICENSE.txt
%AppDataLocal%\Microsoft\Windows\History\Low\History.IE5\container.dat
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp
%System Root%\Python27\include\pyfpe.h
%System Root%\Python27\tcl\tix8.4.3\demos\bitmaps\tix.gif
%System Root%\Python27\Lib\test\cjkencodings\euc_jisx0213.txt
%System Root%\Python27\include\intobject.h
%System Root%\Python27\include\pygetopt.h
%System Root%\Python27\Lib\test\cjkencodings\gb2312-utf8.txt
%System Root%\Python27\include\structseq.h
%System Root%\Python27\tcl\tix8.4.3\bitmaps\openfold.gif
%System Root%\Python27\Lib\idlelib\CREDITS.txt
%System Root%\Python27\Lib\test\audiodata\pluck-pcm8.wav
%All Users Profile%\VMware\VMware Tools\Unity Filters\microsoftoffice2003.txt
%System Root%\Python27\tcl\tk8.5\images\logoLarge.gif
%System Root%\Users\All Users\Microsoft\RAC\StateData\RacMetaData.dat
%System Root%\Python27\include\traceback.h
%System Root%\Python27\Lib\email\test\data\msg_23.txt
%System Root%\Python27\Lib\email\test\data\msg_44.txt
%All Users Profile%\Microsoft\Windows NT\MSScan\WelcomeScan.jpg
%User Profile%\Documents\powerpoint2k\PPT2KExx.PPT
%System Root%\Python27\Lib\email\test\data\msg_25.txt
%System Root%\Python27\Lib\test\cjkencodings\gb18030.txt
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Tiki.gif
%System Root%\Python27\tcl\tk8.5\images\pwrdLogo175.gif
%System Root%\Python27\Lib\test\cjkencodings\johab-utf8.txt
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Blue_Gradient.jpg
%System Root%\Python27\Lib\test\cjkencodings\euc_jp-utf8.txt
%System Root%\Python27\include\grammar.h
%Desktop%\powerpoint2k\PPT2KE04.ppt
%User Profile%\Documents\excel2k\XLS2KE01.xls
%System Root%\powerpoint2k\PPT2KE01.ppt
%AppDataLocal%\Microsoft\Internet Explorer\UrlBlockManager\urlblocklist.bin
%User Profile%\Documents\Email and Password List.js
%System Root%\Python27\Lib\email\test\data\msg_15.txt
%User Profile%\Documents\Email and Password List.txt
%System Root%\Python27\Lib\idlelib\idle_test\README.txt
%System Root%\Python27\tcl\tix8.4.3\bitmaps\minusarm.gif
%System Root%\Python27\include\pymactoolbox.h
%System Root%\Python27\include\pymem.h
%AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{4555A5E7-C06D-11E6-8AB1-005056BC3E18}.dat
%User Temp%\dd_vcredistMSI0FC1.txt
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Pretty_Peacock.jpg
%System Root%\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp
%System Root%\Python27\Lib\email\test\data\msg_34.txt
%System Root%\Python27\include\opcode.h
%AppDataLocal%\Microsoft\Internet Explorer\EmieUserList\container.dat
%System Root%\Python27\include\pydebug.h
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp
%System Root%\Python27\tcl\tix8.4.3\bitmaps\no_entry.gif
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Sand_Paper.jpg
%Desktop%\powerpoint2k\PPT2KE01.ppt
%System Root%\Python27\include\dictobject.h
%System Root%\Python27\Lib\site-packages\README.txt
F:\wlines.zip
%System Root%\Python27\include\frameobject.h
%System Root%\Python27\tcl\tk8.5\demos\images\earthris.gif
%All Users Profile%\Microsoft\User Account Pictures\user.bmp
%User Profile%\Documents\powerpoint2k\PPT2KE05.ppt
%All Users Profile%\Microsoft\Windows\DRM\blackbox.bin
%System Root%\Python27\NEWS.txt
%System Root%\Python27\tcl\tk8.5\images\tai-ku.gif
%System Root%\Python27\Tools\pynche\README.txt
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp
%System Root%\word2k\DOC2KE01.doc
%System Root%\Python27\tcl\tix8.4.3\bitmaps\act_fold.gif
%System Root%\Python27\include\warnings.h
%System Root%\Python27\Lib\lib2to3\PatternGrammar.txt
%System Root%\Python27\Lib\test\cjkencodings\shift_jisx0213.txt
%System Root%\Python27\Tools\pynche\html40colors.txt
%System Root%\Python27\Lib\idlelib\Icons\idle_16.gif
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp
%System Root%\excel2k\XLS2KE03.xls
%System Root%\Python27\Lib\email\test\data\PyBanner048.gif
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-current.bin
%Application Data%\Microsoft\Windows\PrivacIE\container.dat
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\pluginreg.dat
%System Root%\Python27\include\pythonrun.h
%System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\dependency_links.txt
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp
%System Root%\Python27\Lib\test\formatfloat_testcases.txt
%System Root%\Users\Public\Music\Sample Music\Sleep Away.mp3
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KE02.ppt
%All Users Profile%\Microsoft\OFFICE\DATA\opa12.dat
%System Root%\Python27\Lib\test\cjkencodings\shift_jis.txt
%System Root%\Python27\tcl\tix8.4.3\bitmaps\info.gif
%System Root%\Python27\Lib\test\cjkencodings\euc_jisx0213-utf8.txt
%System Root%\Python27\tcl\tix8.4.3\pref\WmDefault.txt
%AppDataLocal%\Microsoft\Internet Explorer\EmieSiteList\container.dat
%All Users Profile%\Microsoft\User Account Pictures\guest.bmp
%System Root%\Users\Default\NTUSER.DAT
%User Profile%\Documents\word2k\DOC2KE02.doc
%System Root%\Python27\Lib\email\test\data\msg_27.txt
%System Root%\Users\All Users\Microsoft\RAC\StateData\RacWmiEventData.dat
%System Root%\Python27\Lib\email\test\data\msg_43.txt
%System Root%\Python27\Lib\email\test\data\msg_33.txt
%All Users Profile%\VMware\VMware Tools\Unity Filters\googledesktop.txt
%System Root%\Python27\include\complexobject.h
%System Root%\Users\Public\Documents\word2k\DOC2KE03.doc
%System Root%\powerpoint2k\PPT2KE02.ppt
%Desktop%\excel2k\XLS2KExx.xls
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp
%System Root%\Python27\include\codecs.h
%System Root%\Python27\Lib\test\cjkencodings\cp949-utf8.txt
%Desktop%\word2k\DOC2KE03.doc
%System Root%\Python27\tcl\tix8.4.3\pref\TixGray.cs
%User Profile%\Documents\excel2k\XLS2KE04.xls
%System Root%\Python27\include\listobject.h
%System Root%\Python27\Lib\test\audiodata\pluck-pcm24.wav
%All Users Profile%\VMware\VMware Tools\Unity Filters\adobephotoshopcs3.txt
%System Root%\Python27\Lib\test\cmath_testcases.txt
%Desktop%\note.txt
%AppDataLocal%\Google\Chrome\User Data\Crashpad\settings.dat
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Tanspecks.jpg
F:\data\dolist.txt
%User Temp%\{username}.bmp
%System Root%\powerpoint2k\PPT2KE05.ppt
%Desktop%\powerpoint2k\PPT2KE02.ppt
%System Root%\excel2k\XLS2KExx.xls
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KE04.ppt
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KE05.ppt
%User Temp%\dd_vcredistUI0FC1.txt
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Wrinkled_Paper.gif
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp
%User Profile%\Documents\powerpoint2k\PPT2KE02.ppt
%System Root%\Python27\tcl\tk8.5\images\pwrdLogo75.gif
%System Root%\Python27\include\methodobject.h
%System Root%\Python27\tcl\tix8.4.3\bitmaps\plus.gif
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-child.bin
%System Root%\Python27\Lib\email\test\data\msg_26.txt
%All Users Profile%\VMware\RawdskCompatibility\native\regdata.dat
F:\data\tmp.doc
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-child-current.bin
%AppDataLocal%\Microsoft\Internet Explorer\brndlog.txt
%AppDataLocal%\Microsoft\Feeds Cache\container.dat
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp
%System Root%\Python27\Lib\email\test\data\msg_07.txt
%Desktop%\word2k\DOC2KE04.doc
%System Root%\Users\Public\Documents\excel2k\XLS2KE02.xls
%User Profile%\Documents\word2k\DOC2KExx.doc
%AppDataLocal%\Google\Software Reporter Tool\settings.dat
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp
%System Root%\Python27\include\iterobject.h
%System Root%\Email and Password List.js
%System Root%\Python27\tcl\tk8.5\demos\images\tcllogo.gif
%System Root%\Python27\Lib\email\test\data\msg_02.txt
%System Root%\Python27\Lib\email\test\data\msg_28.txt
%System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\top_level.txt
%System Root%\Python27\Lib\email\test\data\msg_40.txt
%Desktop%\AAljoOV.jpg
%Application Data%\Microsoft\Office\Recent\index.dat
%System Root%\Python27\Lib\idlelib\NEWS.txt
%AppDataLocal%Low\Microsoft\Internet Explorer\EmieBrowserModeList\container.dat
%System Root%\Python27\Lib\test\cjkencodings\shift_jisx0213-utf8.txt
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Cave_Drawings.gif
%AppDataLocal%Low\Microsoft\Windows\AppCache\container.dat
%System Root%\Users\Public\Documents\word2k\DOC2KE05.doc
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Bears.jpg
%System Root%\Python27\include\cobject.h
%System Root%\Python27\include\asdl.h
%System Root%\Python27\include\setobject.h
%System Root%\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg
%System Root%\Python27\Lib\test\test_difflib_expect.html
%System Root%\Python27\Lib\test\cjkencodings\iso2022_kr.txt
%System Root%\Python27\include\bytes_methods.h
%System Root%\Users\Public\Documents\excel2k\XLS2KExx.xls
%System Root%\Python27\Lib\test\math_testcases.txt
%System Root%\Python27\include\cStringIO.h
%System Root%\Python27\Lib\site-packages\pythonnet-2.1.0.dist-info\top_level.txt
%System Root%\Python27\Lib\idlelib\Icons\idle_32.gif
%System Root%\Python27\tcl\tk8.5\images\pwrdLogo100.gif
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Garden.jpg
%System Root%\Python27\Lib\test\cjkencodings\big5hkscs.txt
%System Root%\Python27\include\funcobject.h
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Small_News.jpg
%System Root%\Python27\Lib\email\test\data\msg_45.txt
%System Root%\Python27\Lib\email\test\data\msg_11.txt
%System Root%\Python27\tcl\tix8.4.3\pref\TkWin.cs
%System Root%\Python27\Lib\idlelib\HISTORY.txt
%Desktop%\powerpoint2k\PPT2KE05.ppt
%System Root%\Users\Public\Pictures\Sample Pictures\Penguins.jpg
%System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\entry_points.txt
%System Root%\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
%System Root%\Python27\include\enumobject.h

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). . %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Desktop on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Dropping Routine

This Trojan Spy drops the following files:

%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\{username}
%All Users Profile%\Microsoft\Search\Data\Applications\{username}
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\{username}
%Start Menu%\Programs\Administrative Tools\{username}
%AppDataLocal%Low\Mozilla\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Java\{username}
%AppDataLocal%\pip\cache\http\a\1\9\5\{username}
%System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\updates\0\{username}.KEKW
%System Root%\Python27\tcl\tk8.5\images\pwrdLogo175.gif.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pings\{username}
%System Root%\Python27\include\pgenheaders.h.KEKW
%User Temp%\dd_vcredistMSI0FD5.txt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\50\{username}
%System Root%\Python27\Lib\hotshot\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47\{username}
%System Root%\powerpoint2k\PPT2KExx.PPT.KEKW
%AppDataLocal%Low\Microsoft\Internet Explorer\EmieUserList\container.dat.KEKW
%System Root%\Python27\Lib\email\test\data\msg_07.txt.KEKW
%System Root%\Python27\include\Python-ast.h.KEKW
%System Root%\Users\All Users\VMware\RawdskCompatibility\virtual\{username}.KEKW
%System Root%\Python27\Lib\idlelib\Icons\minusnode.gif.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\treeadapters\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp.KEKW
%System Root%\Users\{username}\AppData\Roaming\Microsoft\Windows\Libraries\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\{username}
%Desktop%\word2k\DOC2KE01.doc.KEKW
%AppDataLocal%\pip\cache\http\7\e\9\8\0\{username}
%System Root%\Users\Default\AppData\Roaming\{username}
%System Root%\Python27\include\ast.h.KEKW
%System Root%\Python27\Lib\idlelib\extend.txt.KEKW
%System Root%\Users\All Users\Microsoft\Device Stage\Task\{{GUID}}\{username}.KEKW
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\Un_A\{username}.KEKW
%System Root%\word2k\DOC2KE02.doc.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Store\{username}.KEKW
%System Root%\Python27\NEWS.txt.KEKW
%System Root%\Users\All Users\Microsoft\Assistance\Client\{username}
%System Root%\Python27\Lib\test\zipdir.zip.KEKW
%System Root%\Python27\Lib\test\cjkencodings\johab-utf8.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1D\{username}
%System Root%\Python27\tcl\tk8.5\images\pwrdLogo200.gif.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\VersionManager\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1D\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\util\{username}
%System Root%\Users\All Users\Microsoft\Assistance\Client\{username}.KEKW
%User Temp%\Low\{username}
F:\data\photos\{username}
%System Root%\Users\Public\Pictures\Sample Pictures\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\Common\{username}.KEKW
%Start Menu%\{username}
%Application Data%\Microsoft\UProof\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\{username}.KEKW
%AppDataLocal%\pip\cache\http\a\6\9\b\d\{username}
%System Root%\excel2k\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Pretty_Peacock.jpg.KEKW
%System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\dependency_links.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5\{username}.KEKW
%System Root%\Users\All Users\Microsoft\{username}
%System Root%\Python27\Lib\idlelib\Icons\idle_32.gif.KEKW
%System Root%\Python27\Lib\email\test\data\msg_35.txt.KEKW
%AppDataLocal%\pip\cache\http\7\e\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\{username}
%All Users Profile%\Microsoft\Assistance\Client\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\F0\{username}
%AppDataLocal%\Microsoft\Feeds Cache\container.dat.KEKW
%System Root%\Users\All Users\Mozilla\updates\{username}.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\treewalkers\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\22\{username}
%System Root%\Users\{username}\Music\{username}
%System Root%\Users\Public\Music\Sample Music\Kalimba.mp3.KEKW
%All Users Profile%\Microsoft\Windows Defender\Definition Updates\Updates\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A\{username}
%System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\top_level.txt.KEKW
%System Root%\Python27\tcl\reg1.2\{username}
%System Root%\Python27\include\pymem.h.KEKW
%System Root%\Users\All Users\Microsoft\IdentityCRL\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\{username}.KEKW
%System Root%\Python27\Lib\test\cjkencodings\shift_jisx0213.txt.KEKW
%AppDataLocal%\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\{username}
%System Root%\Python27\Lib\site-packages\pip\_internal\commands\{username}
%AppDataLocal%\Microsoft\Windows Mail\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp.KEKW
%System Root%\word2k\DOC2KE05.doc.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\{username}.KEKW
%System Root%\PerfLogs\Admin\{username}
%System Root%\Python27\tcl\tcl8\8.5\{username}
%AppDataLocal%\pip\cache\http\d\3\7\e\0\{username}
%System Root%\Python27\Lib\test\cjkencodings\cp949-utf8.txt.KEKW
%System Root%\Python27\tcl\tcl8.5\tzdata\Etc\{username}
%System Root%\Python27\Lib\test\cjkencodings\gb2312-utf8.txt.KEKW
%System Root%\Python27\tcl\tix8.4.3\bitmaps\minusarm.gif.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\muffin\{username}
%System Root%\Python27\Lib\test\capath\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\CacheManager\{username}.KEKW
%System Root%\Python27\Tools\pynche\webcolors.txt.KEKW
%AppDataLocal%\Microsoft\Windows Mail\Stationery\SoftBlue.jpg.KEKW
%AppDataLocal%\pip\cache\http\d\3\{username}
%AppDataLocal%\pip\cache\http\2\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\39\{username}
%All Users Profile%\Microsoft\Windows\Sqm\Upload\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\18\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\{username}
%System Root%\Python27\Lib\email\test\data\msg_22.txt.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\{username}
%System Root%\Users\All Users\Microsoft\RAC\PublishedData\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\datareporting\archived\2019-05\{username}
%System Root%\Users\Default\Videos\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\{username}.KEKW
%Application Data%\Microsoft\SystemCertificates\My\CRLs\{username}
%System Root%\Python27\tcl\tcl8\8.4\platform\{username}
%System Root%\Python27\include\descrobject.h.KEKW
%System Root%\Python27\include\dictobject.h.KEKW
%System Root%\Python27\Lib\test\imghdrdata\python.bmp.KEKW
%AppDataLocal%\Google\Chrome\User Data\OriginTrials\{username}
%System Root%\Users\Default\AppData\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\requests\{username}
%AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.1\{username}
%System Root%\Users\Public\Documents\excel2k\XLS2KExx.xls.KEKW
%System Root%\Python27\tcl\tk8.5\images\logo100.gif.KEKW
%System Root%\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\7\{username}
%AppDataLocal%Low\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\Australia\{username}
%System Root%\Users\All Users\Microsoft\MF\{username}
%System Root%\Python27\Lib\test\cjkencodings\gb18030-utf8.txt.KEKW
%Application Data%\Macromedia\Flash Player\macromedia.com\support\flashplayer\{username}
%System Root%\Python27\tcl\tcl8.5\http1.0\{username}
%Desktop%\powerpoint2k\PPT2KE02.ppt.KEKW
%System Root%\Users\All Users\Microsoft\IlsCache\{username}
%System Root%\Python27\include\modsupport.h.KEKW
%Desktop%\excel2k\XLS2KE01.xls.KEKW
%System Root%\Python27\Lib\email\test\data\msg_11.txt.KEKW
%System Root%\Python27\Lib\email\test\data\msg_46.txt.KEKW
%System Root%\Users\All Users\Microsoft Help\{username}
%AppDataLocal%\Microsoft\Internet Explorer\Tiles\pin9728060290\{username}
%All Users Profile%\Oracle\Java\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\52\{username}
%Favorites%\MSN Websites\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\{username}.KEKW
%AppDataLocal%Low\Microsoft\Windows\AppCache\LY14JQYG\container.dat.KEKW
%User Profile%\Documents\Email and Password List.txt.KEKW
%User Temp%\WPDNSE\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\Backup\{username}
%System Root%\Python27\Lib\email\test\data\msg_05.txt.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\2918063365piupsah.files\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\{username}
%AppDataLocal%Low\Sun\Java\Deployment\{username}
%System Root%\Python27\tcl\tix8.4.3\bitmaps\folder.gif.KEKW
%AppDataLocal%\pip\cache\http\a\1\{username}
%AppDataLocal%\Google\Chrome\User Data\SwReporter\{username}
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-child.bin.KEKW
%All Users Profile%\McAfee\WinCore\{username}
%AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.1\_metadata\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg.KEKW
%AppDataLocal%\Deployment\{username}
%AppDataLocal%\Apps\2.0\Data\RNQG94OQ.QJC\E1WGPJBQ.PMC\goog...app_9ae46cec200785df_0001.0003_7581c0cd83ac8659\{username}
%System Root%\Python27\tcl\tix8.4.3\demos\{username}
%AppDataLocal%\Microsoft\Internet Explorer\Recovery\{username}
%System Root%\Python27\Lib\test\cjkencodings\euc_kr-utf8.txt.KEKW
%System Root%\Python27\Lib\idlelib\NEWS.txt.KEKW
%Application Data%\Macromedia\Flash Player\{username}
%Application Data%\Microsoft\Credentials\{username}
%All Users Profile%\VMware\RawdskCompatibility\native\C\{username}
%System Root%\Python27\Lib\site-packages\pip\{username}
%AppDataLocal%\Google\Chrome\User Data\FileTypePolicies\34\_metadata\{username}
%AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\{username}
%AppDataLocal%\Google\Chrome\User Data\BrowserMetrics\{username}
%Application Data%\Macromedia\Flash Player\macromedia.com\{username}
%Application Data%\Mozilla\SystemExtensionsDev\{username}
%User Profile%\Documents\word2k\{username}
%System Root%\Python27\Lib\test\audiodata\pluck-pcm8.wav.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\{username}.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp.KEKW
%AppDataLocal%\pip\cache\http\0\2\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\mpcache-B1C01FED9F08520A4647901EFB883A6A3B247F8D.bin.KEKW
%AppDataLocal%\Apps\2.0\Data\RNQG94OQ.QJC\E1WGPJBQ.PMC\{username}
%AppDataLocal%\Microsoft\Windows\History\{username}
%System Root%\Users\All Users\Microsoft\Windows\DeviceMetadataStore\en-US\{username}
%System Root%\Python27\Lib\test\floating_points.txt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\37\{username}
%System Root%\Python27\Lib\lib2to3\fixes\{username}
%System Root%\Users\All Users\Microsoft\RAC\StateData\RacWmiDataBookmarks.dat.KEKW
%User Profile%\Documents\word2k\DOC2KE02.doc.KEKW
%AppDataLocal%\pip\cache\http\7\{username}
%System Root%\Users\Public\Pictures\Sample Pictures\Desert.jpg.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70\{username}
%All Users Profile%\Microsoft\Windows\WER\ReportQueue\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\{username}.KEKW
%System Root%\Users\{username}\Pictures\{username}
%System Root%\Python27\tcl\tix8.4.3\demos\bitmaps\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\host\{username}
%AppDataLocal%\pip\cache\http\b\a\9\3\5\{username}
%System Root%\Python27\Lib\test\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\8\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\{username}.KEKW
%Application Data%\Microsoft\Internet Explorer\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\VMware\{username}
%AppDataLocal%\Microsoft\Feeds Cache\M7X9O6Z1\{username}
%System Root%\Users\All Users\Microsoft\Windows\Caches\{username}
%AppDataLocal%\Microsoft\Internet Explorer\IECompatData\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\19\{username}
%System Root%\Python27\Lib\site-packages\pip\_internal\models\{username}
%System Root%\Python27\tcl\tix8.4.3\bitmaps\minus.gif.KEKW
%AppDataLocal%\pip\cache\http\f\e\d\0\e\{username}
%System Root%\Python27\Lib\test\math_testcases.txt.KEKW
%System Root%\Users\Public\Libraries\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\42\{username}
%Application Data%\Microsoft\Office\Recent\index.dat.KEKW
%System Root%\Python27\include\traceback.h.KEKW
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\History\CacheManager\MpSfc.bin.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Support\{username}.KEKW
%AppDataLocal%\pip\cache\http\5\4\{username}
%All Users Profile%\Microsoft\Device Stage\Task\{{GUID}}\{username}
%All Users Profile%\VMware\RawdskCompatibility\{username}
%System Root%\Python27\Lib\distutils\command\{username}
%System Root%\Users\All Users\Microsoft\Device Stage\Task\{username}.KEKW
%AppDataLocal%\Microsoft\Windows\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\{username}.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp.KEKW
%Application Data%\Microsoft\Windows\Templates\{username}
%AppDataLocal%\Python-Eggs\Python-Eggs\Cache\pillow-4.1.0-py2.7-win32.egg-tmp\{username}
%System Root%\Users\Public\Documents\powerpoint2k\{username}
%AppDataLocal%\Microsoft\Feeds Cache\NNO7APUS\{username}
%AppDataLocal%\Microsoft\Internet Explorer\tabiconcache.dat.KEKW
%System Root%\Users\Public\Pictures\Sample Pictures\Koala.jpg.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95\{username}
%System Root%\Python27\Lib\test\leakers\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\33\{username}
%User Temp%\dd_NDP452-KB2901907-x86-x64-AllOS-ENU_decompression_log.txt.KEKW
%System Root%\Users\All Users\Oracle\Java\javapath_target_313094\{username}.KEKW
%AppDataLocal%\pip\cache\http\7\e\9\8\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\{username}.KEKW
%System Root%\Python27\Lib\multiprocessing\{username}
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\SentItems\{username}.KEKW
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Psychedelic.jpg.KEKW
%AppDataLocal%\pip\cache\http\4\{username}
%User Profile%\Contacts\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Device Stage\Task\{{GUID}}\en-US\{username}
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Entries\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Inbox\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\msgpack\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\34\{username}
%AppDataLocal%\Microsoft\Office\Groove\User\{username}
%All Users Profile%\Microsoft\Network\Downloader\qmgr0.dat.KEKW
%AppDataLocal%\Google\Chrome\User Data\pnacl\0.57.44.2492\_platform_specific\x86_64\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\70\{username}.KEKW
%System Root%\Python27\Lib\idlelib\idle_test\README.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows\AIT\{username}
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\{username}
%System Root%\Users\All Users\Microsoft\Windows\Sqm\Upload\{username}
%All Users Profile%\VMware\VMware Tools\Unity Filters\vmwarefilters.txt.KEKW
%System Root%\Users\All Users\{username}.KEKW
%System Root%\Users\All Users\Microsoft\eHome\{username}
%System Root%\Python27\Lib\test\cjkencodings\cp949.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\{username}.KEKW
%System Root%\Python27\include\iterobject.h.KEKW
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\cache2\entries\{username}
%AppDataLocal%\Google\Chrome\User Data\InterventionPolicyDatabase\2018.9.6.0\{username}
%All Users Profile%\Microsoft\OFFICE\DATA\opa12.dat.KEKW
%System Root%\Users\Default\Links\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp.KEKW
%All Users Profile%\McAfee\MCLOGS\PartnerCustom\SSScheduler\{username}
%System Root%\Python27\tcl\tix8.4.3\bitmaps\{username}
%System Root%\Python27\include\import.h.KEKW
%AppDataLocal%\pip\cache\http\0\2\5\{username}
%System Root%\Users\Default\AppData\Local\Temp\{username}
%All Users Profile%\VMware\VMware Tools\manifest.txt.KEKW
%All Users Profile%\Mozilla\updates\308046B0AF4A39CB\updates\{username}
%AppDataLocal%\Microsoft\Windows\Burn\{username}
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KExx.PPT.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\UrlBlockManager\urlblocklist.bin.KEKW
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts\{username}
%AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\{username}
%System Root%\Users\Public\Documents\excel2k\XLS2KE01.xls.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\imagestore\1s32qbz\{username}
%User Profile%\Documents\word2k\DOC2KE01.doc.KEKW
%System Root%\Users\All Users\VMware\VMware Tools\Unity Filters\{username}
%System Root%\Users\All Users\VMware\{username}.KEKW
%System Root%\Users\Public\Music\{username}
%System Root%\Users\All Users\Microsoft\OFFICE\DATA\{username}
%System Root%\Python27\Lib\test\cjkencodings\euc_jp-utf8.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows\DRM\Cache\{username}
%All Users Profile%\Microsoft\NetFramework\BreadcrumbStore\{username}
%User Profile%\Documents\excel2k\XLS2KE02.xls.KEKW
%System Root%\Python27\Lib\site-packages\pythonnet-2.1.0.dist-info\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\{username}.KEKW
%User Profile%\Documents\powerpoint2k\PPT2KE05.ppt.KEKW
%System Root%\Users\All Users\Microsoft\DRM\Server\{username}.KEKW
%System Root%\Users\{username}\AppData\Roaming\Microsoft\Windows\{username}
%System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\LICENSE.txt.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\datareporting\archived\2019-04\{username}
%System Root%\Users\All Users\Microsoft\Media Player\{username}
%System Root%\Users\All Users\Microsoft\OFFICE\{username}.KEKW
%Application Data%\Microsoft\Windows\DNTException\Low\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\Arctic\{username}
%System Root%\Python27\include\fileobject.h.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\History\Results\Resource\{username}
%AppDataLocal%\Microsoft\Feeds\Feeds for United States~\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp.KEKW
%AppDataLocal%\pip\cache\http\5\4\3\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp.KEKW
%System Root%\Python27\tcl\tcl8.5\tzdata\Canada\{username}
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\3UYAQU1F\{username}
%AppDataLocal%\Microsoft\Windows\Ringtones\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Connectivity.gif.KEKW
%User Temp%\Microsoft .NET Framework 4.5.2 Setup_20161212_135033207.html.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\56\{username}
%User Profile%\Documents\powerpoint2k\PPT2KE04.ppt.KEKW
%System Root%\Python27\Lib\test\cjkencodings\hz.txt.KEKW
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\cache2\doomed\{username}
%System Root%\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\{username}
%System Root%\Users\All Users\Microsoft\Device Stage\{username}
%System Root%\Users\All Users\Microsoft\Windows\WER\{username}
%System Root%\Python27\include\eval.h.KEKW
%All Users Profile%\Microsoft\Device Stage\Task\{username}
%System Root%\Python27\include\intobject.h.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp.KEKW
%System Root%\word2k\DOC2KE03.doc.KEKW
%System Root%\$Recycle.Bin\S-1-5-21-2407829820-1079796033-203259571-500\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Maintenance\{username}
%AppDataLocal%\Google\Chrome\User Data\ShaderCache\GPUCache\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3\{username}
%All Users Profile%\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\{username}
%System Root%\excel2k\XLS2KE02.xls.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\VMware Tools\{username}.KEKW
%System Root%\Python27\Lib\test\cjkencodings\shift_jis-utf8.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Assistance\{username}.KEKW
%Application Data%\Microsoft\Vault\{username}
%System Root%\Python27\Lib\email\test\data\msg_19.txt.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\History\Results\Quick\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Store\{username}
%System Root%\Users\All Users\Microsoft\RAC\{username}.KEKW
%System Root%\Python27\Lib\test\cjkencodings\gbk-utf8.txt.KEKW
%All Users Profile%\Microsoft\Windows\Sqm\Sessions\{username}
%System Root%\Users\{username}\AppData\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\Africa\{username}
%All Users Profile%\McAfee\MCLOGS\PartnerCustom\Un_A\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\61\{username}
%System Root%\Python27\Lib\site-packages\setuptools\command\{username}
%System Root%\Python27\tcl\tix8.4.3\bitmaps\srcfile.gif.KEKW
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-current.bin.KEKW
%All Users Profile%\McAfee\MCLOGS\PartnerCustom\McCHSvc\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp.KEKW
%All Users Profile%\Microsoft\Windows\DRM\{username}
%System Root%\Python27\Tools\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Config\{username}.KEKW
%System Root%\Python27\Lib\test\cjkencodings\shift_jisx0213-utf8.txt.KEKW
%System Root%\Python27\Lib\email\test\data\msg_08.txt.KEKW
%All Users Profile%\Microsoft\MSDN\{username}
%AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\{AD285A8B-713F-11E9-85F8-005056BC44A9}.dat.KEKW
%System Root%\Python27\Lib\test\decimaltestdata\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\LocalCopy\{username}
%System Root%\Users\All Users\Microsoft\MSDN\8.0\{username}.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp.KEKW
%System Root%\Python27\Lib\test\test_doctest.txt.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\pep517\{username}
%System Root%\Python27\include\osdefs.h.KEKW
%System Root%\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.KEKW
%All Users Profile%\Microsoft\Windows NT\MSFax\ActivityLog\{username}
%AppDataLocal%\pip\cache\http\0\{username}
%AppDataLocal%\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\{username}
%AppDataLocal%\Microsoft\Windows\WebCache\WebCacheV01.dat.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\contrib\_securetransport\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\4\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5\{username}
%All Users Profile%\Oracle\{username}
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\GUFNQG0Q\{username}
%User Temp%\acrocef_low\{username}
%System Root%\Python27\Doc\{username}
%User Profile%\Documents\powerpoint2k\PPT2KE01.ppt.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSScan\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\America\Argentina\{username}
%System Root%\Users\All Users\Microsoft\OFFICE\DATA\{username}.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\Tracking Protection\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\LocalCopy\{username}.KEKW
%System Root%\Python27\LICENSE.txt.KEKW
%System Root%\Users\All Users\Adobe\Setup\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\{username}.KEKW
%System Root%\Python27\tcl\tix8.4.3\bitmaps\act_fold.gif.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\{username}
%System Root%\Python27\Lib\test\cjkencodings\big5hkscs.txt.KEKW
%System Root%\Users\{username}\AppData\Local\{username}
%System Root%\Python27\tcl\tk8.5\images\logoMed.gif.KEKW
%All Users Profile%\Microsoft\RAC\Outbound\{username}
%System Root%\Python27\Lib\xml\etree\{username}
%Application Data%\Microsoft\Document Building Blocks\1033\{username}
%All Users Profile%\Microsoft\Windows\Sqm\{username}
%System Root%\Python27\tcl\tix8.4.3\{username}
%AppDataLocal%\Google\Chrome\User Data\InterventionPolicyDatabase\2018.9.6.0\_metadata\{username}
%System Root%\Python27\tcl\tix8.4.3\pref\TixGray.cs.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp.KEKW
%System Root%\Recovery\{GUID}\{username}
%Start Menu%\Programs\Accessories\Accessibility\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\History\{username}
%System Root%\Users\Default\AppData\Roaming\Microsoft\{username}
%AppDataLocal%\pip\cache\http\3\8\9\3\{username}
%Application Data%\Microsoft\Windows\IEDownloadHistory\container.dat.KEKW
%AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.1\LICENSE.txt.KEKW
%All Users Profile%\Microsoft\Search\Data\Temp\{username}
%System Root%\Python27\include\pyerrors.h.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\PDYB5D8B\{username}
%AppDataLocal%Low\Microsoft\Windows\AppCache\container.dat.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\{username}
%System Root%\Users\Public\Pictures\Sample Pictures\Tulips.jpg.KEKW
%System Root%\Users\All Users\Microsoft\NetFramework\BreadcrumbStore\{username}
%All Users Profile%\Microsoft\Windows\Power Efficiency Diagnostics\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\Updates\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\1\{username}
%System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\updates\{username}.KEKW
%All Users Profile%\Oracle\Java\installcache_x64\{username}
%System Root%\Users\All Users\Microsoft\Network\Connections\{username}.KEKW
%System Root%\Email and Password List.txt.KEKW
%System Root%\Users\All Users\Microsoft\{username}.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\pkcs11.txt.KEKW
%System Root%\Python27\Lib\email\test\data\msg_27.txt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\0\{username}
%Application Data%\Microsoft\Office\{username}
%System Root%\Users\All Users\Microsoft\Windows\Power Efficiency Diagnostics\{username}.KEKW
%AppDataLocal%Low\Microsoft\Internet Explorer\EmieUserList\{username}
%System Root%\Python27\include\pyarena.h.KEKW
%AppDataLocal%Low\Microsoft\Internet Explorer\EmieBrowserModeList\{username}
%Desktop%\powerpoint2k\PPT2KE04.ppt.KEKW
%System Root%\Users\Public\Documents\word2k\DOC2KE02.doc.KEKW
%Application Data%\Microsoft\Windows\Printer Shortcuts\{username}
%System Root%\Python27\Lib\test\cjkencodings\euc_jp.txt.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp.KEKW
%System Root%\Python27\Lib\lib2to3\tests\{username}
%System Root%\Users\All Users\Microsoft\DeviceSync\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F0\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\{username}.KEKW
%System Root%\Python27\Lib\email\test\data\msg_04.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows\DeviceMetadataStore\{username}
%System Root%\Python27\include\setobject.h.KEKW
%System Root%\Python27\Lib\site-packages\pip\_internal\operations\{username}
%Desktop%\word2k\DOC2KE05.doc.KEKW
%System Root%\Python27\tcl\tix8.4.3\bitmaps\info.gif.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\8YC9813O\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\{username}
%System Root%\Python27\tcl\tix8.4.3\pref\WmDefault.cs.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\contrib\{username}
%All Users Profile%\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\DATA\{username}
%All Users Profile%\VMware\VMware Tools\Unity Filters\vistasidebar.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Sqm\{username}.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\{username}
%System Root%\Users\All Users\Adobe\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\{username}
%Start Menu%\Programs\{username}
%Desktop%\{username}
%User Profile%\Documents\excel2k\XLS2KExx.xls.KEKW
%AppDataLocal%\pip\cache\http\b\a\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\F0\{username}
%System Root%\Python27\tcl\tk8.5\msgs\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43\{username}.KEKW
%System Root%\Python27\include\marshal.h.KEKW
%System Root%\Python27\Lib\test\audiodata\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Microsoft Office\{username}
%System Root%\Python27\Lib\idlelib\README.txt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\12\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp.KEKW
%All Users Profile%\Microsoft\Windows Defender\Definition Updates\Backup\{username}
%AppDataLocal%\pip\cache\http\f\e\d\{username}
%System Root%\Python27\include\Python.h.KEKW
%System Root%\Users\All Users\Microsoft\Network\{username}.KEKW
%All Users Profile%\Microsoft\IdentityCRL\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\{username}
%All Users Profile%\Oracle\Java\javapath_target_313094\{username}
%System Root%\Python27\Lib\email\test\data\msg_41.txt.KEKW
%System Root%\Python27\tcl\tk8.5\images\logoLarge.gif.KEKW
%System Root%\Python27\tcl\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Quarantine\{username}.KEKW
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\{username}
%System Root%\Python27\Lib\email\test\data\msg_15.txt.KEKW
%AppDataLocal%Low\Sun\Java\{username}
%System Root%\Python27\Lib\curses\{username}
%AppDataLocal%\Microsoft\Internet Explorer\MSIMGSIZ.DAT.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\{username}
%System Root%\Python27\include\graminit.h.KEKW
%AppDataLocal%\Microsoft\TaskSchedulerConfig\{username}
F:\data\dolist.txt.KEKW
%AppDataLocal%\Microsoft\PlayReady\{username}
%Start Menu%\Programs\Maintenance\{username}
%User Temp%\{username}
%AppDataLocal%\Microsoft\Windows Media\{username}
%AppDataLocal%\Microsoft\Windows\Burn\Burn\{username}
%System Root%\Python27\tcl\tk8.5\images\logo64.gif.KEKW
%All Users Profile%\Microsoft\RAC\Temp\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Entries\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\{username}.KEKW
%Desktop%\powerpoint2k\PPT2KE03.ppt.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\{username}
%All Users Profile%\Microsoft\Windows\AIT\{username}
%System Root%\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Queue\{username}.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\treebuilders\{username}
%User Profile%\Documents\Email and Password List.js.KEKW
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\urlCache.bin.KEKW
%System Root%\Python27\include\pythonrun.h.KEKW
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Tablet PC\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\550F8967-2EE2-4F33-8E16-1BFFBE114803\{username}
%AppDataLocal%\Microsoft Help\{username}
%System Root%\Python27\Lib\email\test\data\msg_09.txt.KEKW
%System Root%\Python27\include\pymactoolbox.h.KEKW
%System Root%\Python27\Lib\email\test\data\msg_02.txt.KEKW
%AppDataLocal%\Microsoft\Windows\WER\ReportArchive\NonCritical_iexplore.exe_12df8271b62395a348f102b12959f9768e2baf9_0be7f64f\{username}
%System Root%\Python27\Lib\test\support\{username}
%System Root%\word2k\DOC2KE01.doc.KEKW
%System Root%\Users\All Users\Microsoft\IdentityCRL\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\SiteSecurityServiceState.txt.KEKW
%System Root%\Python27\Lib\test\tokenize_tests.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70\{username}.KEKW
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Tiki.gif.KEKW
%System Root%\Python27\include\stringobject.h.KEKW
%AppDataLocal%\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg.KEKW
%System Root%\Users\All Users\Microsoft Help\{username}.KEKW
%System Root%\Python27\Lib\idlelib\idle_test\{username}
%System Root%\Users\All Users\VMware\VMware Tools\{username}.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\packages\{username}
%AppDataLocal%\pip\cache\http\2\3\b\{username}
%AppDataLocal%\pip\cache\http\4\e\e\3\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\weave\{username}
%System Root%\Users\All Users\Microsoft\Windows\Ringtones\{username}.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\{username}
%System Root%\Python27\include\grammar.h.KEKW
%AppDataLocal%\pip\cache\http\2\3\{username}
%System Root%\excel2k\XLS2KE04.xls.KEKW
%All Users Profile%\Microsoft\Assistance\Client\1.0\en-US\{username}
%All Users Profile%\Microsoft\User Account Pictures\{username}.dat.KEKW
%System Root%\Python27\Lib\test\formatfloat_testcases.txt.KEKW
%System Root%\Python27\tcl\tcl8\{username}
%AppDataLocal%\Microsoft\Windows Media\12.0\{username}
%System Root%\Python27\tcl\tk8.5\ttk\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\{username}.KEKW
%System Root%\Python27\tcl\tix8.4.3\pref\Blue.cs.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\3\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\{username}
%System Root%\Python27\DLLs\{username}
%System Root%\Python27\Lib\idlelib\CREDITS.txt.KEKW
%All Users Profile%\McAfee\{username}
%System Root%\Python27\Lib\email\test\data\msg_39.txt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\41\{username}
%Application Data%\Microsoft\SystemCertificates\My\CTLs\{username}
%System Root%\Users\All Users\VMware\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp.KEKW
%System Root%\Python27\tcl\tcl8.5\encoding\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\46\{username}
%System Root%\Users\All Users\VMware\RawdskCompatibility\{username}.KEKW
%System Root%\Python27\Lib\site-packages\pip\_internal\cli\{username}
%Application Data%\Sun\Java\{username}
%Application Data%\Microsoft\Windows\IEDownloadHistory\{username}
%AppDataLocal%\Python-Eggs\{username}
%AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\RJ6VBH4W.DN2\manifests\{username}
%Application Data%\Microsoft\Windows\IETldCache\{username}
%System Root%\Users\All Users\Adobe\ARM\{username}
%AppDataLocal%Low\Microsoft\Internet Explorer\EmieSiteList\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\{0E1465B0-BA9C-409F-BC32-D934317129CD}\{username}.KEKW
%System Root%\Python27\include\complexobject.h.KEKW
%System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\updates\{username}
%Start Menu%\Programs\Accessories\{username}
%System Root%\Python27\Lib\idlelib\TODO.txt.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Sqm\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\59\{username}
%Application Data%\Microsoft\Windows\IECompatUACache\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\tmp\{username}
%System Root%\Python27\Lib\email\test\data\msg_30.txt.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\70\{username}
%AppDataLocal%\Mozilla\Firefox\{username}
%Application Data%\Identities\{3D0FBFE3-9E5C-4F14-8D00-F0C8FEFA78BA}\{username}
%System Root%\Users\All Users\McAfee\{username}.KEKW
%All Users Profile%\Microsoft\Windows\Caches\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\{username}
%System Root%\Users\All Users\Microsoft\Device Stage\Task\{{GUID}}\{username}
%AppDataLocal%\pip\cache\http\a\1\9\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\Un_A\{username}
%Application Data%\Mozilla\Firefox\Profiles\{username}
%AppDataLocal%\pip\cache\http\b\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\{username}
%System Root%\Python27\Lib\email\test\data\msg_40.txt.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0\{username}
%System Root%\Users\All Users\Microsoft\WwanSvc\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows\{username}.KEKW
%System Root%\powerpoint2k\{username}
%System Root%\Users\All Users\Microsoft\Windows\Sqm\Manifest\{username}.KEKW
%AppDataLocal%\GDIPFONTCACHEV1.DAT.KEKW
%All Users Profile%\VMware\RawdskCompatibility\native\C\ProgramData\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\57\{username}
%AppDataLocal%\pip\cache\http\3\8\9\3\0\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\{username}.KEKW
%System Root%\Python27\tcl\tcl8.5\tzdata\America\Indiana\{username}
%System Root%\Users\All Users\Microsoft\Network\Connections\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\pluginreg.dat.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\{username}.KEKW
%System Root%\Python27\Lib\email\test\data\msg_28.txt.KEKW
%System Root%\Python27\Lib\test\cjkencodings\gbk.txt.KEKW
%All Users Profile%\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_505c7fc25c7e5866de583f14c22e2b4c2a6018c_0a2493a7\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\History\Results\{username}
%System Root%\Users\All Users\Adobe\Setup\{username}.KEKW
%AppDataLocal%\Microsoft\Windows\WebCacheLock.dat.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\23\{username}
%System Root%\Users\All Users\Microsoft\MF\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Assistance\Client\1.0\{username}.KEKW
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Wrinkled_Paper.gif.KEKW
%User Profile%\Documents\powerpoint2k\PPT2KExx.PPT.KEKW
%User Profile%\Documents\word2k\DOC2KE04.doc.KEKW
%System Root%\excel2k\XLS2KE05.xls.KEKW
%System Root%\Python27\Lib\idlelib\Icons\folder.gif.KEKW
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\{username}.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\{username}
%System Root%\Users\All Users\Microsoft\Windows\WER\ReportQueue\{username}
%System Root%\Python27\include\object.h.KEKW
%Start Menu%\Programs\Accessories\System Tools\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\38\{username}
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Quarantine\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\distlib\{username}
%System Root%\word2k\{username}
%Start Menu%\Programs\ImDisk\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\27\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\14\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\Common\SmallInstaller\{username}
%System Root%\Users\{username}\{username}
%All Users Profile%\Microsoft\RAC\PublishedData\{username}
%All Users Profile%\Microsoft\User Account Pictures\user.bmp.KEKW
%System Root%\Python27\include\intrcheck.h.KEKW
%All Users Profile%\VMware\VMware Tools\Unity Filters\visualstudio2005.txt.KEKW
%Desktop%\AAljoOV.jpg.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1D\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\{username}
%AppDataLocal%\Google\Software Reporter Tool\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Support\{username}
%AppDataLocal%\Google\Chrome\User Data\Crashpad\settings.dat.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\{username}.KEKW
%System Root%\Users\Public\Documents\Email and Password List.js.KEKW
%Application Data%\Microsoft\{username}
%System Root%\Users\Default\NTUSER.DAT.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Temp\usgthrsvc\{username}.KEKW
%System Root%\Python27\include\weakrefobject.h.KEKW
%All Users Profile%\McAfee\MCLOGS\{username}
%System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\{username}
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\{username}
%System Root%\Python27\include\bitset.h.KEKW
%System Root%\Users\All Users\Microsoft\RAC\StateData\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Assistance\Client\1.0\{username}
%System Root%\Python27\Lib\unittest\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\{username}
%System Root%\Python27\Lib\test\imghdrdata\python.png.KEKW
%AppDataLocal%\Google\Chrome\User Data\ShaderCache\{username}
%AppDataLocal%\Google\Chrome\User Data\pnacl\0.57.44.2492\{username}
%Application Data%\Microsoft\Windows\IECompatCache\container.dat.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp.KEKW
F:\data\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\History\Store\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\minidumps\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp.KEKW
%All Users Profile%\Microsoft\Windows NT\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\{username}.KEKW
%System Root%\Python27\Lib\email\test\data\msg_18.txt.KEKW
%System Root%\word2k\DOC2KExx.doc.KEKW
%System Root%\Python27\tcl\tcl8.5\tzdata\Antarctica\{username}
%System Root%\Users\All Users\Microsoft\Search\{username}.KEKW
%AppDataLocal%\Google\Chrome\User Data\Safe Browsing\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\America\Kentucky\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\{username}.KEKW
%System Root%\Python27\include\genobject.h.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp.KEKW
%All Users Profile%\Microsoft\Windows\{username}
%AppDataLocal%\Microsoft\Internet Explorer\EmieBrowserModeList\container.dat.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\{0E1465B0-BA9C-409F-BC32-D934317129CD}\{username}
%System Root%\Python27\include\dtoa.h.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\43\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\{username}
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\45\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\ActivityLog\{username}.KEKW
%Application Data%\Microsoft\Internet Explorer\UserData\Low\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3\{username}
%System Root%\Python27\Lib\site-packages\setuptools\_vendor\packaging\{username}
%System Root%\Users\All Users\Microsoft\MSDN\8.0\{username}
%System Root%\Python27\Lib\email\test\data\msg_20.txt.KEKW
%AppDataLocal%\Google\Chrome\User Data\CertificateRevocation\5140\_metadata\{username}
%User Temp%\Guest.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\{username}.KEKW
%User Profile%\Documents\word2k\DOC2KExx.doc.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Inbox\{username}.KEKW
%System Root%\Users\Public\Documents\word2k\{username}
%User Temp%\Deployment\{username}
%AppDataLocal%\pip\cache\http\d\{username}
%System Root%\Users\All Users\Microsoft\Search\{username}
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\safebrowsing\google4\{username}
%System Root%\Users\All Users\Microsoft\MSDN\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\F0\{username}.KEKW
%AppDataLocal%Low\Microsoft\Internet Explorer\{username}
%All Users Profile%\Microsoft\DeviceSync\{username}
%Application Data%\Macromedia\{username}
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\Config\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\40\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Garden.jpg.KEKW
%System Root%\Users\All Users\Oracle\{username}.KEKW
%All Users Profile%\Microsoft\IlsCache\{username}
%System Root%\Python27\Lib\xml\parsers\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp.KEKW
%AppDataLocal%\pip\cache\http\0\2\5\2\b\{username}
%System Root%\word2k\DOC2KE04.doc.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\weave\toFetch\{username}
%All Users Profile%\Microsoft\Device Stage\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Games\{username}
%AppDataLocal%\Microsoft\Internet Explorer\TabRoaming\{username}
%Desktop%\excel2k\XLS2KE02.xls.KEKW
%System Root%\Python27\Lib\lib2to3\Grammar.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\{username}.KEKW
%System Root%\Python27\Lib\test\cjkencodings\iso2022_jp-utf8.txt.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp.KEKW
%All Users Profile%\Adobe\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\17\{username}
F:\data\photos\stunning.jpg.KEKW
%System Root%\Python27\include\memoryobject.h.KEKW
%AppDataLocal%\Microsoft\Office\Groove\System\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\lockfile\{username}
%AppDataLocal%\Microsoft\Internet Explorer\EmieBrowserModeList\{username}
%All Users Profile%\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\{username}
%System Root%\Python27\Lib\test\tracedmodules\{username}
%System Root%\Users\All Users\Microsoft\Windows\GameExplorer\{username}
%System Root%\Python27\tcl\tk8.5\images\tai-ku.gif.KEKW
%User Profile%\Pictures\{username}
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\OfflineCache\{username}
%AppDataLocal%\pip\cache\http\a\1\9\5\3\{username}
%System Root%\Users\Default\Desktop\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\{username}
%System Root%\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\filters\{username}
%All Users Profile%\VMware\RawdskCompatibility\native\regdata.dat.KEKW
%System Root%\Users\All Users\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\{username}
%All Users Profile%\Microsoft\Windows\Templates\{username}
%System Root%\Python27\Lib\ensurepip\{username}
%AppDataLocal%\Microsoft\Internet Explorer\imagestore\joppu72\{username}
%User Temp%\dd_wcf_CA_smci_20161212_135110_351.txt.KEKW
%System Root%\Users\All Users\Microsoft\NetFramework\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\{username}.KEKW
%AppDataLocal%\Google\Chrome\User Data\CertificateRevocation\{username}
%System Root%\Python27\Lib\lib2to3\PatternGrammar.txt.KEKW
%System Root%\Python27\Lib\test\cmath_testcases.txt.KEKW
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\cache2\{username}
%System Root%\Users\All Users\McAfee\WinCore\{username}.KEKW
%AppDataLocal%\Google\Chrome\User Data\FileTypePolicies\34\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Service\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows\WER\ReportQueue\{username}.KEKW
%System Root%\Python27\Lib\email\test\data\msg_25.txt.KEKW
%System Root%\Users\All Users\VMware\RawdskCompatibility\{username}
%System Root%\Python27\tcl\tix8.4.3\pref\Gray.cs.KEKW
%AppDataLocal%\Microsoft\Office\{username}
%AppDataLocal%\Microsoft\Windows\History\Low\{username}
%System Root%\Python27\include\symtable.h.KEKW
%System Root%\Python27\tcl\tix8.4.3\pref\{username}
%AppDataLocal%\Google\Chrome\User Data\PepperFlash\{username}
%System Root%\Python27\tcl\tk8.5\{username}
%Desktop%\powerpoint2k\PPT2KE01.ppt.KEKW
%All Users Profile%\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Administrative Tools\{username}
%AppDataLocal%\Microsoft\Windows\GameExplorer\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\AlternateServices.txt.KEKW
%System Root%\Users\All Users\Oracle\Java\{username}
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\{username}
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\{username}
%System Root%\Python27\Lib\unittest\test\{username}
%System Root%\Python27\Lib\test\ieee754.txt.KEKW
%System Root%\Python27\Tools\webchecker\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\cachecontrol\caches\{username}
%AppDataLocal%\Python-Eggs\Python-Eggs\Cache\pillow-4.1.0-py2.7-win32.egg-tmp\PIL\{username}
%System Root%\Python27\include\{username}
%System Root%\Python27\Lib\email\test\data\msg_10.txt.KEKW
%System Root%\Users\All Users\Adobe\ARM\{username}.KEKW
%System Root%\Python27\include\tupleobject.h.KEKW
%Application Data%\Microsoft\SystemCertificates\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\{username}
%AppDataLocal%\Apps\2.0\{username}
%System Root%\Users\All Users\Adobe\ARM\Reader_19.010.20099\{username}
%AppDataLocal%\Microsoft\Windows Sidebar\Gadgets\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Notebook.jpg.KEKW
%All Users Profile%\Microsoft\Media Player\{username}
%All Users Profile%\Microsoft\MSDN\8.0\{username}
%AppDataLocal%\pip\cache\http\f\e\{username}
%User Profile%\Documents\fp_18.0.0.203_archive\{username}
%System Root%\Python27\include\bufferobject.h.KEKW
%System Root%\Users\Public\Documents\word2k\DOC2KE03.doc.KEKW
%System Root%\Python27\Tools\pynche\namedcolors.txt.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\crashes\events\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01\{username}
%Application Data%\Microsoft\Windows\IETldCache\container.dat.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\{username}
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\{username}
%AppDataLocal%\Microsoft\Media Player\Sync Playlists\en-US\00007196\{username}
%User Profile%\Documents\powerpoint2k\{username}
%System Root%\Python27\Lib\test\cjkencodings\euc_jisx0213.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSScan\{username}
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\{username}
%System Root%\Users\All Users\Microsoft\Device Stage\Task\{{GUID}}\en-US\{username}.KEKW
%All Users Profile%\Microsoft\Network\Connections\{username}
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\{username}
%System Root%\Python27\Lib\xml\dom\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\SystemV\{username}
%AppDataLocal%\Google\Chrome\User Data\SSLErrorAssistant\7\{username}
%All Users Profile%\Oracle\Java\.oracle_jre_usage\{username}
%AppDataLocal%\Microsoft\Windows Mail\Backup\new\{username}
%Desktop%\powerpoint2k\{username}
%System Root%\Users\All Users\Mozilla\updates\{username}
%System Root%\Python27\Lib\test\cjkencodings\big5-utf8.txt.KEKW
%AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\RJ6VBH4W.DN2\{username}
%AppDataLocal%\Microsoft\Media Player\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\{username}
%System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_72da1383309c93bd2441accd728cf953e4fa97a_0a24a840\{username}.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\bookmarkbackups\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\{username}.KEKW
%System Root%\Users\All Users\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\{username}
%System Root%\Python27\Lib\email\test\data\msg_42.txt.KEKW
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-child-current.bin.KEKW
%AppDataLocal%\Google\Chrome\User Data\CertificateRevocation\5140\{username}
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\{username}
%AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{4555A5E7-C06D-11E6-8AB1-005056BC3E18}.dat.KEKW
%All Users Profile%\Microsoft\Windows\WER\{username}
%All Users Profile%\McAfee\MCLOGS\SmallInstaller\{username}
%Application Data%\Microsoft\Windows\Libraries\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\3561288849sdhlie.files\{username}
%AppDataLocal%\Google\Chrome\User Data\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\{username}
%System Root%\Python27\tcl\tix8.4.3\bitmaps\no_entry.gif.KEKW
%System Root%\Users\All Users\VMware\RawdskCompatibility\virtual\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\{username}
%AppDataLocal%Low\Sun\Java\Deployment\security\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\{username}
%System Root%\Python27\include\parsetok.h.KEKW
%System Root%\Python27\Lib\test\cjkencodings\{username}
%User Temp%\Adobe_ADMLogs\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp.KEKW
%System Root%\Users\Public\Favorites\{username}
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\GatherLogs\{username}
%User Profile%\Documents\fp_18.0.0.203_archive.zip.KEKW
%Application Data%\Microsoft\Protect\{username}
%AppDataLocal%\Google\Chrome\User Data\FileTypePolicies\{username}
%System Root%\Users\{username}\Videos\{username}
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\container.dat.KEKW
%System Root%\Python27\include\listobject.h.KEKW
%System Root%\Users\All Users\Microsoft\Vault\{username}.KEKW
%All Users Profile%\Microsoft\NetFramework\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Roses.jpg.KEKW
%System Root%\Python27\tcl\tix8.4.3\pref\WmDefault.txt.KEKW
%System Root%\Python27\Lib\email\test\data\msg_12.txt.KEKW
%User Temp%\WebInstaller\{username}
%AppDataLocal%\Microsoft\Windows Mail\Backup\{username}
%System Root%\Python27\tcl\dde1.3\{username}
%System Root%\Python27\Tools\pynche\README.txt.KEKW
%System Root%\Python27\Lib\xml\{username}
%AppDataLocal%\Microsoft\Feeds Cache\{username}
%System Root%\Python27\Lib\email\test\data\msg_03.txt.KEKW
%All Users Profile%\Microsoft\Windows\Start Menu\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp.KEKW
%System Root%\Python27\Lib\json\tests\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\HandPrints.jpg.KEKW
%Application Data%\Microsoft\Proof\{username}
%System Root%\Python27\Tools\versioncheck\README.txt.KEKW
%AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\_metadata\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Tablet PC\{username}.KEKW
%All Users Profile%\Microsoft\Windows NT\MSFax\{username}
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\9IWSW3EX\{username}
%System Root%\Python27\include\objimpl.h.KEKW
%System Root%\Python27\Lib\test\cjkencodings\big5hkscs-utf8.txt.KEKW
%System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\{username}.KEKW
%Desktop%\word2k\DOC2KExx.doc.KEKW
%Application Data%\Macromedia\Flash Player\macromedia.com\support\{username}
%All Users Profile%\Mozilla\updates\{username}
%System Root%\Python27\Lib\site-packages\setuptools\{username}
%System Root%\Python27\include\pyexpat.h.KEKW
%System Root%\Python27\Tools\Scripts\{username}
%System Root%\Users\Public\Videos\{username}
%User Profile%\Documents\word2k\DOC2KE05.doc.KEKW
%System Root%\Python27\Lib\idlelib\help.html.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Sqm\Sessions\{username}.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp.KEKW
%All Users Profile%\VMware\VMware Tools\Unity Filters\adobephotoshopcs3.txt.KEKW
%System Root%\Python27\include\cobject.h.KEKW
%System Root%\Python27\tcl\tcl8.5\tzdata\Indian\{username}
%System Root%\Users\{username}\AppData\Local\Microsoft\{username}
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KE02.ppt.KEKW
%User Temp%\dd_SetupUtility.txt.KEKW
%System Root%\Python27\tcl\tcl8.5\tzdata\US\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\11\{username}
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\15\{username}
%System Root%\Users\Public\Documents\word2k\DOC2KE01.doc.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\51\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg.KEKW
%System Root%\Python27\Lib\test\xmltestdata\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\SecurityPreloadState.txt.KEKW
%User Temp%\dd_vcredistMSI0FC1.txt.KEKW
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\urlCache-current.bin.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\packages\ssl_match_hostname\{username}
%Application Data%\Microsoft\Internet Explorer\UserData\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A\{username}
%System Root%\Users\All Users\Microsoft\Windows\Power Efficiency Diagnostics\{username}
%Application Data%\Mozilla\Firefox\Crash Reports\{username}
%System Root%\Users\All Users\Oracle\Java\{username}.KEKW
%System Root%\Python27\tcl\tix8.4.3\bitmaps\openfold.gif.KEKW
%System Root%\Python27\include\ceval.h.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95\{username}.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\_trie\{username}
%All Users Profile%\Microsoft\User Account Pictures\guest.bmp.KEKW
%AppDataLocal%\pip\cache\http\5\4\3\d\7\{username}
%System Root%\Users\Default\AppData\Local\Microsoft\Windows\GameExplorer\{username}
%System Root%\Users\All Users\Microsoft\WwanSvc\Profiles\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Python 2.7\{username}
%System Root%\Users\Public\Documents\excel2k\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\sessionstore-backups\{username}
%System Root%\Python27\include\pymacconfig.h.KEKW
%Application Data%\Microsoft\Windows\IECompatCache\Low\{username}
%System Root%\Python27\Lib\sqlite3\{username}
%AppDataLocal%\pip\cache\http\{username}
%System Root%\Python27\Lib\lib-tk\test\test_ttk\{username}
%System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\entry_points.txt.KEKW
%System Root%\Python27\Scripts\{username}
%System Root%\Python27\tcl\tcl8.5\{username}
%Application Data%\Microsoft\Windows\Recent\{username}
%AppDataLocal%\Microsoft\Feeds Cache\JPOHUSHF\{username}
%System Root%\Python27\Lib\test\exception_hierarchy.txt.KEKW
%System Root%\$Recycle.Bin\S-1-5-21-2407829820-1079796033-203259571-1000\{username}
%All Users Profile%\Microsoft\Windows\Sqm\Manifest\{username}
%User Temp%\{username}.bmp.KEKW
%AppDataLocal%\Microsoft\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp.KEKW
%Application Data%\Microsoft\Internet Explorer\Quick Launch\User Pinned\{username}
F:\data\tmp.doc.KEKW
%System Root%\Python27\Lib\lib2to3\tests\data\fixers\myfixes\{username}
%Favorites%\{username}
%System Root%\Users\All Users\Microsoft\RAC\PublishedData\{username}.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\certifi\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\{username}
%System Root%\Users\Public\Documents\excel2k\XLS2KE05.xls.KEKW
%All Users Profile%\Mozilla\updates\308046B0AF4A39CB\updates\0\{username}
%Application Data%\Macromedia\Flash Player\#SharedObjects\K48846QH\{username}
F:\data\photos\long_exposure.jpg.KEKW
%User Profile%\Links\{username}
%System Root%\Python27\libs\{username}
%System Root%\Users\Public\Documents\Email and Password List.txt.KEKW
%AppDataLocal%\Microsoft\Media Player\Sync Playlists\en-US\{username}
%All Users Profile%\VMware\VMware Tools\Unity Filters\googledesktop.txt.KEKW
%System Root%\Python27\Lib\importlib\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\43\{username}.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\6\{username}
%System Root%\Python27\include\structmember.h.KEKW
%System Root%\Users\All Users\Microsoft\Windows\DeviceMetadataStore\en-US\{username}.KEKW
%System Root%\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\packages\backports\{username}
%AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\{username}
%System Root%\Python27\include\metagrammar.h.KEKW
%System Root%\Users\All Users\Microsoft\DRM\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\{username}.KEKW
%AppDataLocal%\Apps\2.0\Data\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\21\{username}
%System Root%\Python27\Lib\idlelib\{username}
%System Root%\Users\All Users\Oracle\Java\javapath_target_313094\{username}
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\Backup\{username}.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\EmieSiteList\{username}
%AppDataLocal%\pip\cache\http\b\a\9\{username}
%System Root%\Python27\Lib\email\test\data\msg_34.txt.KEKW
%System Root%\Python27\include\floatobject.h.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\idna\{username}
%All Users Profile%\VMware\VMware Tools\Unity Filters\microsoftoffice2003.txt.KEKW
%Application Data%\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\{username}
%Desktop%\word2k\DOC2KE02.doc.KEKW
%Application Data%\Microsoft\Windows\Network Shortcuts\{username}
%Application Data%\Microsoft\Templates\{username}
%System Root%\Python27\tcl\tix8.4.3\bitmaps\plusarm.gif.KEKW
%All Users Profile%\Microsoft\Assistance\{username}
%System Root%\Python27\Lib\msilib\{username}
%System Root%\Python27\Lib\idlelib\help.txt.KEKW
%User Temp%\dd_vcredistUI0FC1.txt.KEKW
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\{username}
%System Root%\Python27\tcl\tk8.5\demos\{username}
%System Root%\Python27\tcl\tix8.4.3\pref\TK.cs.KEKW
%System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\{username}.KEKW
%AppDataLocal%\Microsoft\Vault\{username}
%Application Data%\{username}
%AppDataLocal%\Microsoft\Windows\AppCache\6A582BR6\{username}
%System Root%\Users\All Users\Microsoft\Device Stage\Task\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\20\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\{username}.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\LastBld.dat.KEKW
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\{username}
%All Users Profile%\VMware\RawdskCompatibility\virtual\{username}
%AppDataLocal%\Google\Software Reporter Tool\settings.dat.KEKW
%System Root%\Python27\Lib\email\test\{username}
%System Root%\Python27\include\datetime.h.KEKW
%All Users Profile%\Microsoft\eHome\logs\{username}
%System Root%\Users\All Users\Oracle\Java\.oracle_jre_usage\{username}.KEKW
%System Root%\Python27\Lib\test\imghdrdata\python.gif.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F0\{username}.KEKW
%All Users Profile%\Microsoft\Windows Defender\LocalCopy\{username}
%System Root%\Python27\Lib\test\cjkencodings\shift_jis.txt.KEKW
%System Root%\Users\Public\Recorded TV\{username}
%AppDataLocal%\Google\Chrome\User Data\Subresource Filter\{username}
%System Root%\Python27\Lib\site-packages\pkg_resources\_vendor\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\43\{username}
%Application Data%\Microsoft\Windows\DNTException\{username}
%Favorites%\Links for United States\{username}
%System Root%\powerpoint2k\PPT2KE03.ppt.KEKW
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Temp\usgthrsvc\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp.KEKW
%System Root%\Users\Public\Documents\word2k\DOC2KE05.doc.KEKW
%Application Data%\Microsoft\SystemCertificates\My\Keys\{username}
%System Root%\Users\Default\AppData\Local\Microsoft\Windows\History\{username}
%System Root%\Users\All Users\Microsoft\RAC\StateData\{username}
%Desktop%\word2k\DOC2KE04.doc.KEKW
%System Root%\Users\{username}\AppData\Roaming\{username}
%System Root%\Python27\Lib\email\test\data\{username}
%System Root%\Python27\include\cellobject.h.KEKW
%System Root%\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\{username}
%User Profile%\Videos\{username}
%User Temp%\Microsoft .NET Framework 4.5.2 Setup_20161212_135033207-MSI_netfx_Full_GDR_x64.msi.txt.KEKW
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\{username}
%AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\_platform_specific\{username}
%System Root%\Python27\Tools\pynche\html40colors.txt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\9\{username}
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\82DF2NUK\{username}
%System Root%\Python27\Lib\test\sgml_input.html.KEKW
%AppDataLocal%\Microsoft\Feeds\{username}
%System Root%\Users\All Users\Microsoft\Windows NT\{username}.KEKW
%System Root%\Python27\include\pycapsule.h.KEKW
%System Root%\Python27\Lib\email\test\data\msg_24.txt.KEKW
%System Root%\Python27\include\pystrtod.h.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\EmieUserList\container.dat.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Entries\{username}
%Application Data%\Microsoft\Windows\PrivacIE\container.dat.KEKW
%All Users Profile%\Microsoft\Windows NT\MSFax\Queue\{username}
%System Root%\Users\All Users\Microsoft\OFFICE\{username}
%System Root%\Python27\Lib\test\test_doctest2.txt.KEKW
%System Root%\Python27\include\abstract.h.KEKW
%System Root%\Python27\Lib\site-packages\Pillow-6.0.0.dist-info\top_level.txt.KEKW
%AppDataLocal%Low\Microsoft\Windows\AppCache\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\47\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\Common\{username}
%All Users Profile%\Microsoft\Windows Defender\Definition Updates\{username}
%System Root%\Python27\Lib\test\test_difflib_expect.html.KEKW
%User Profile%\Documents\excel2k\XLS2KE01.xls.KEKW
%User Profile%\Downloads\{username}
%System Root%\Python27\Lib\test\testtar.tar.KEKW
%Application Data%\Microsoft\Windows\IECompatUACache\container.dat.KEKW
%System Root%\$Recycle.Bin\{username}
%User Profile%\Searches\{username}
%System Root%\Python27\README.txt.KEKW
%All Users Profile%\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\{username}
%AppDataLocal%\Microsoft\Internet Explorer\DomainSuggestions\{username}
%User Profile%\Documents\fp_18.0.0.203_archive\18_0_r0_203\{username}
%System Root%\Python27\tcl\tix8.4.3\demos\bitmaps\tix.gif.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\SentItems\{username}
%System Root%\Python27\Lib\test\cjkencodings\big5.txt.KEKW
%System Root%\Python27\Lib\lib-tk\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\chardet\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp.KEKW
%Desktop%\Transmag.doc.KEKW
%All Users Profile%\VMware\VMware Tools\Unity Filters\{username}
%Favorites%\Microsoft Websites\{username}
%System Root%\Python27\Lib\site-packages\pkg_resources\_vendor\packaging\{username}
%System Root%\Python27\include\longintrepr.h.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\58\{username}
%All Users Profile%\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\{username}
%System Root%\Python27\Lib\email\test\data\msg_43.txt.KEKW
%AppDataLocal%\pip\{username}
%AppDataLocal%\Google\Chrome\User Data\Crashpad\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows\DRM\{username}
%System Root%\Python27\Lib\ctypes\test\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp.KEKW
%AppDataLocal%\Google\Chrome\User Data\Crashpad\reports\{username}
%System Root%\Users\Public\Pictures\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\26\{username}
%Favorites%\Windows Live\{username}
%System Root%\Python27\tcl\tix8.4.3\bitmaps\warning.gif.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0\{username}.KEKW
%System Root%\Python27\include\pyconfig.h.KEKW
%System Root%\Users\All Users\McAfee\{username}
%Application Data%\Microsoft\Windows\PrivacIE\{username}
%System Root%\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.KEKW
%All Users Profile%\Oracle\Java\javapath\{username}
%System Root%\Users\All Users\Microsoft\MSDN\{username}.KEKW
%System Root%\Users\All Users\McAfee\WinCore\{username}
%AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Indexed Rules\25\9.1\{username}
%System Root%\Python27\Lib\pydoc_data\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A\{username}.KEKW
%System Root%\Python27\tcl\tcl8.5\msgs\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5\{username}
%All Users Profile%\Microsoft\Windows\DRM\Cache\{username}
%System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\{username}
%All Users Profile%\Microsoft\Network\Downloader\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\progress\{username}
%User Temp%\chrome_BITS_3756_19263\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\pytoml\{username}
%System Root%\Users\All Users\Microsoft\RAC\Outbound\{username}.KEKW
%System Root%\Users\All Users\Microsoft\RAC\Temp\{username}
%System Root%\Python27\Lib\email\test\data\msg_16.txt.KEKW
%System Root%\Users\Default\AppData\Local\Microsoft\Windows\{username}
%Application Data%\Mozilla\{username}
%Application Data%\Microsoft\Windows\IECompatUACache\Low\container.dat.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\datareporting\archived\{username}
%System Root%\Users\All Users\Microsoft\Windows\DRM\{username}.KEKW
%System Root%\Python27\Lib\wsgiref\{username}
%System Root%\Users\All Users\Microsoft\Network\Downloader\{username}
%User Profile%\Documents\excel2k\{username}
%User Profile%\Documents\fp_18.0.0.203_archive\18_0_r0_203_debug\{username}
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\{username}.KEKW
%System Root%\Python27\Lib\ensurepip\_bundled\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp.KEKW
%All Users Profile%\Oracle\Java\javapath_target_313094\{username}.KEKW
%User Profile%\Documents\powerpoint2k\PPT2KE03.ppt.KEKW
%AppDataLocal%\pip\cache\http\2\3\b\7\9\{username}
%All Users Profile%\Microsoft\OFFICE\{username}
%System Root%\Python27\Lib\lib2to3\tests\data\{username}
%System Root%\Python27\Lib\idlelib\Icons\openfolder.gif.KEKW
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KE01.ppt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\54\{username}
%All Users Profile%\Microsoft\Windows NT\MSFax\VirtualInbox\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\62\{username}
%System Root%\Users\All Users\Oracle\Java\.oracle_jre_usage\{username}
%System Root%\Python27\include\compile.h.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0\{username}
%Application Data%\Microsoft\Windows\{username}
%System Root%\powerpoint2k\PPT2KE05.ppt.KEKW
%System Root%\Users\Default\AppData\Local\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\SSScheduler\{username}.KEKW
%AppDataLocal%\{username}
%System Root%\Users\All Users\Microsoft\DeviceSync\{username}
F:\{username}
%System Root%\Python27\Lib\idlelib\Icons\tk.gif.KEKW
%AppDataLocal%\Google\Chrome\User Data\RecoveryImproved\{username}
%System Root%\Python27\Tools\Scripts\README.txt.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\EmieSiteList\container.dat.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\5\{username}
%All Users Profile%\Microsoft\Network\{username}
%System Root%\Python27\Lib\test\cjkencodings\iso2022_kr.txt.KEKW
%Application Data%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\{username}
%System Root%\Python27\tcl\tk8.5\demos\images\earth.gif.KEKW
%System Root%\Python27\tcl\tcl8.5\tzdata\Mexico\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5\{username}.KEKW
%All Users Profile%\Microsoft\Windows\DRM\blackbox.bin.KEKW
%System Root%\Python27\tcl\tk8.5\images\pwrdLogo100.gif.KEKW
%User Profile%\Documents\word2k\DOC2KE03.doc.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\{username}.KEKW
%System Root%\Python27\Lib\email\test\data\msg_33.txt.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp.KEKW
%System Root%\Python27\include\pymath.h.KEKW
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KE05.ppt.KEKW
%System Root%\Python27\include\methodobject.h.KEKW
%System Root%\Python27\Lib\site-packages\pkg_resources\{username}
%Application Data%\Mozilla\Firefox\Pending Pings\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\TRRBlacklist.txt.KEKW
%System Root%\Users\All Users\Oracle\Java\installcache_x64\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp.KEKW
%AppDataLocal%\Google\Chrome\User Data\SSLErrorAssistant\{username}
%System Root%\Python27\Lib\email\test\data\msg_01.txt.KEKW
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Stars.jpg.KEKW
%All Users Profile%\Microsoft\Windows Defender\{username}
%AppDataLocal%Low\Microsoft\Internet Explorer\EmieBrowserModeList\container.dat.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Temp\{username}.KEKW
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\SSScheduler\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\cachecontrol\{username}
%System Root%\Python27\Lib\bsddb\{username}
%All Users Profile%\Adobe\Setup\{username}
%User Temp%\jawshtml.html.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp.KEKW
%System Root%\Users\All Users\Oracle\Java\javapath\{username}
%AppDataLocal%\Python-Eggs\Python-Eggs\Cache\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\webencodings\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\weave\failed\{username}
%System Root%\Users\All Users\Microsoft\RAC\{username}
%System Root%\Users\All Users\VMware\VMware Tools\Unity Filters\{username}.KEKW
%AppDataLocal%\pip\cache\http\f\e\d\0\{username}
%System Root%\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg.KEKW
%AppDataLocal%\Microsoft\Windows\History\Low\History.IE5\container.dat.KEKW
%System Root%\Users\All Users\Mozilla\{username}
%All Users Profile%\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.KEKW
%Desktop%\powerpoint2k\PPT2KExx.PPT.KEKW
%System Root%\Python27\Lib\site-packages\setuptools\extern\{username}
%AppDataLocal%\Microsoft\Internet Explorer\UrlBlockManager\{username}
%AppDataLocal%\Mozilla\Firefox\Profiles\{username}
%System Root%\Python27\tcl\tcl8\8.4\{username}
%All Users Profile%\Microsoft\Windows Defender\Support\{username}
%User Profile%\Music\{username}
%All Users Profile%\Microsoft\Assistance\Client\1.0\{username}
%Application Data%\Identities\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Stucco.gif.KEKW
%System Root%\{username}
%System Root%\Python27\include\structseq.h.KEKW
%System Root%\Python27\include\ucnhash.h.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\60\{username}
%System Root%\Python27\Lib\site-packages\pip\_internal\req\{username}
%System Root%\Python27\Lib\{username}
%System Root%\Python27\Lib\json\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\History\CacheManager\{username}
%System Root%\Python27\include\bytes_methods.h.KEKW
%System Root%\Users\Default\Favorites\{username}
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp.KEKW
%System Root%\Python27\Lib\lib-tk\test\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\{username}
%System Root%\Python27\Lib\ctypes\macholib\{username}
%System Root%\Python27\include\errcode.h.KEKW
%All Users Profile%\Microsoft\Search\{username}
%System Root%\Python27\Lib\site-packages\{username}
%User Temp%\mozilla-temp-files\{username}
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp.KEKW
%System Root%\Python27\include\bytearrayobject.h.KEKW
%AppDataLocal%\Microsoft\Windows Sidebar\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\{username}
%AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Active\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\SmallInstaller\{username}.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\imagestore\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\Europe\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\VMware\VMware Tools\{username}
%Desktop%\word2k\DOC2KE03.doc.KEKW
%System Root%\Python27\tcl\tix8.4.3\pref\TkWin.cs.KEKW
%System Root%\Python27\tcl\tk8.5\images\pwrdLogo75.gif.KEKW
%System Root%\Python27\Tools\webchecker\README.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\Chile\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\{username}
%AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Pine_Lumber.jpg.KEKW
%Application Data%\Microsoft\SystemCertificates\My\Certificates\{username}
%AppDataLocal%\Microsoft\Windows\History\Low\History.IE5\{username}
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\safebrowsing\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp.KEKW
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Small_News.jpg.KEKW
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KE04.ppt.KEKW
%Favorites%\Links\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\{username}.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\63\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Temp\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Resource\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\{username}
%System Root%\Python27\include\opcode.h.KEKW
%All Users Profile%\Microsoft\Windows\GameExplorer\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\70\{username}
%AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\RJ6VBH4W.DN2\clic...exe_9ae46cec200785df_0001.0003_none_d631acba18f736d8\{username}
%System Root%\Python27\Lib\test\cjkencodings\hz-utf8.txt.KEKW
%System Root%\Python27\Lib\email\test\data\PyBanner048.gif.KEKW
%System Root%\Python27\Lib\idlelib\Icons\plusnode.gif.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\16\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\McCHSvc\{username}
%System Root%\Python27\Tools\i18n\{username}
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache.bin.KEKW
%All Users Profile%\Microsoft\Windows NT\MSFax\Inbox\{username}
%System Root%\Users\All Users\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\{username}.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\30\{username}
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\{username}
%System Root%\Python27\include\sliceobject.h.KEKW
%System Root%\Python27\Lib\email\test\data\msg_06.txt.KEKW
%System Root%\Users\All Users\McAfee\MCLOGS\{username}
%AppDataLocal%\Microsoft\Feeds Cache\CRAV926P\{username}
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\{username}.KEKW
%System Root%\Python27\include\warnings.h.KEKW
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\{username}
%System Root%\Users\All Users\Oracle\{username}
%System Root%\Python27\Tools\pynche\websafe.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\Updates\{username}.KEKW
%All Users Profile%\Microsoft\Windows\DeviceMetadataStore\{username}
%System Root%\Python27\include\rangeobject.h.KEKW
%AppDataLocal%\Google\Chrome\User Data\WidevineCdm\{username}
%System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_505c7fc25c7e5866de583f14c22e2b4c2a6018c_0a2493a7\{username}.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\{username}
%AppDataLocal%\pip\cache\http\d\3\7\{username}
%All Users Profile%\Microsoft\{username}
%System Root%\Python27\Lib\test\imghdrdata\python.jpg.KEKW
%All Users Profile%\Microsoft\Windows\WER\ReportArchive\{username}
%System Root%\excel2k\XLS2KE01.xls.KEKW
%AppDataLocal%\Microsoft\Credentials\{username}
%All Users Profile%\Microsoft\Device Stage\Task\{{GUID}}\en-US\{username}
%All Users Profile%\Microsoft\Windows\Power Efficiency Diagnostics\energy-report.html.KEKW
%User Temp%\hsperfdata_{username}\{username}
%AppDataLocal%\pip\cache\http\3\{username}
%System Root%\Recovery\{username}
%AppDataLocal%\pip\cache\http\a\6\9\b\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\48\{username}
%All Users Profile%\Microsoft\Network\Downloader\qmgr1.dat.KEKW
%System Root%\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\VMware Tools\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1D\{username}
%System Root%\Python27\Lib\lib-tk\test\test_tkinter\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Quick\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01\{username}
%System Root%\Python27\tcl\tk8.5\demos\images\tcllogo.gif.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1D\{username}.KEKW
%All Users Profile%\Microsoft\User Account Pictures\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\{username}
%System Root%\Users\Public\Music\Sample Music\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp.KEKW
%System Root%\Python27\include\frameobject.h.KEKW
%AppDataLocal%\pip\cache\http\a\6\{username}
%System Root%\Python27\include\token.h.KEKW
%System Root%\Python27\include\sysmodule.h.KEKW
%All Users Profile%\Microsoft\OFFICE\Groove\{username}
%System Root%\Users\All Users\Adobe\{username}.KEKW
%AppDataLocal%\Google\Chrome\User Data\pnacl\{username}
%System Root%\Python27\include\node.h.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3\{username}.KEKW
%AppDataLocal%\Google\Software Reporter Tool\reports\{username}
%All Users Profile%\Microsoft\MF\{username}
%System Root%\Users\All Users\Microsoft\eHome\logs\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Startup\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Service\{username}
%System Root%\Python27\Lib\lib2to3\tests\data\fixers\{username}
%System Root%\Users\All Users\Microsoft\Windows\WER\{username}.KEKW
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\McCHSvc\{username}.KEKW
%Application Data%\Microsoft\Windows\Recent\AutomaticDestinations\{username}
%Application Data%\Microsoft\Internet Explorer\Quick Launch\{username}
%System Root%\Python27\Lib\email\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0\{username}
%System Root%\Python27\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47\{username}.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\29\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\distlib\_backport\{username}
%All Users Profile%\VMware\RawdskCompatibility\native\{username}
%System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\updates\0\{username}
%System Root%\Users\All Users\Microsoft\Assistance\{username}
%System Root%\Python27\Lib\tkinter\{username}
%System Root%\Python27\include\boolobject.h.KEKW
%System Root%\Users\Default\AppData\Roaming\Media Center Programs\{username}
%AppDataLocal%\Google\Chrome\User Data\SSLErrorAssistant\7\_metadata\{username}
%System Root%\Python27\include\pyfpe.h.KEKW
%AppDataLocal%\pip\cache\http\f\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp.KEKW
%Desktop%\excel2k\XLS2KExx.xls.KEKW
%AppDataLocal%\Microsoft\Windows\AppCache\6A582BR6\container.dat.KEKW
%System Root%\Python27\Lib\tkinter\test\{username}
%Application Data%\Microsoft\Document Building Blocks\{username}
%AppDataLocal%\Microsoft\Windows\WER\{username}
%All Users Profile%\Microsoft\Search\Data\Temp\usgthrsvc\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\datareporting\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Tanspecks.jpg.KEKW
%AppDataLocal%\pip\cache\http\a\{username}
%System Root%\Python27\include\pystate.h.KEKW
%Application Data%\Sun\{username}
%AppDataLocal%\Google\Chrome\User Data\InterventionPolicyDatabase\{username}
%System Root%\Users\All Users\Microsoft\Windows\GameExplorer\{username}.KEKW
%System Root%\Python27\Tools\versioncheck\{username}
%System Root%\Users\All Users\Microsoft\DRM\Server\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\10\{username}
%System Root%\Python27\tcl\tix8.4.3\bitmaps\plus.gif.KEKW
%System Root%\Users\Public\Downloads\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Tablet PC\{username}
%System Root%\Python27\include\moduleobject.h.KEKW
%Desktop%\excel2k\XLS2KE05.xls.KEKW
%System Root%\Python27\Lib\site-packages\pip\_internal\utils\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\Common\SmallInstaller\{username}.KEKW
%System Root%\Users\Default\Saved Games\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp.KEKW
%AppDataLocal%Low\Microsoft\Windows\{username}
%AppDataLocal%\pip\cache\http\a\6\9\{username}
%System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_505c7fc25c7e5866de583f14c22e2b4c2a6018c_0a2493a7\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\{username}.KEKW
%System Root%\Python27\Lib\site-packages\pip\_internal\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\43\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01\{username}.KEKW
%Application Data%\Microsoft\AddIns\{username}
%Desktop%\excel2k\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Sand_Paper.jpg.KEKW
%AppDataLocal%\pip\cache\http\4\e\e\3\1\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\{username}
%System Root%\Python27\Lib\site-packages\PIL\{username}
%System Root%\Python27\include\cStringIO.h.KEKW
%Application Data%\Microsoft\Windows\IECompatCache\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\{username}.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp.KEKW
%All Users Profile%\Microsoft\Windows\DeviceMetadataStore\en-US\{username}
%All Users Profile%\VMware\{username}
%System Root%\Users\Default\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\{username}
%AppDataLocal%\pip\cache\http\d\3\7\e\{username}
%AppDataLocal%Low\Sun\Java\Deployment\log\{username}
%All Users Profile%\Microsoft\RAC\{username}
%System Root%\Users\All Users\VMware\VMware Tools\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\chardet\cli\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\55\{username}
%User Profile%\Documents\excel2k\XLS2KE04.xls.KEKW
%System Root%\Python27\Lib\test\cjkencodings\euc_kr.txt.KEKW
%All Users Profile%\Microsoft\Windows NT\MSFax\SentItems\{username}
%System Root%\Email and Password List.js.KEKW
%System Root%\Users\All Users\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\{username}.KEKW
%All Users Profile%\Microsoft\eHome\{username}
%System Root%\PerfLogs\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\crashes\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp.KEKW
%All Users Profile%\Microsoft\RAC\StateData\{username}
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Queue\{username}
%System Root%\Users\Public\Documents\excel2k\XLS2KE03.xls.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\{username}.KEKW
%System Root%\Python27\Lib\idlelib\Icons\idle_16.gif.KEKW
%Application Data%\Microsoft\Windows\IECompatUACache\Low\{username}
%System Root%\Users\All Users\Microsoft\Windows\Templates\{username}.KEKW
%System Root%\Python27\Lib\email\test\data\msg_14.txt.KEKW
%System Root%\Python27\include\timefuncs.h.KEKW
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\{username}.KEKW
%AppDataLocal%\Apps\2.0\Data\RNQG94OQ.QJC\{username}
%AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Indexed Rules\25\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\{username}.KEKW
%AppDataLocal%Low\Microsoft\Internet Explorer\Services\{username}
%System Root%\Users\All Users\Microsoft\Windows\Sqm\Upload\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Network\Downloader\{username}.KEKW
%System Root%\Python27\tcl\tk8.5\images\{username}
%System Root%\Python27\Lib\lib2to3\{username}
%System Root%\Python27\Lib\site-packages\pkg_resources\extern\{username}
%System Root%\Users\All Users\{username}
%AppDataLocal%\Microsoft\Windows\WER\ReportQueue\{username}
%All Users Profile%\Microsoft\Search\Data\{username}
%AppDataLocal%\pip\cache\http\4\e\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\{username}
%System Root%\Python27\Lib\ctypes\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\colorama\{username}
%All Users Profile%\McAfee\MCLOGS\Common\{username}
%System Root%\Python27\Lib\multiprocessing\dummy\{username}
%Application Data%\Microsoft\Windows\IETldCache\Low\{username}
%System Root%\Python27\include\longobject.h.KEKW
%System Root%\Python27\Lib\test\cjkencodings\iso2022_jp.txt.KEKW
%System Root%\Python27\Lib\tkinter\test\test_ttk\{username}
%System Root%\Users\All Users\Oracle\Java\installcache_x64\{username}.KEKW
%System Root%\Python27\Lib\test\cjkencodings\euc_jisx0213-utf8.txt.KEKW
%AppDataLocal%\pip\cache\http\2\3\b\7\{username}
%System Root%\Python27\Lib\email\test\data\msg_36.txt.KEKW
%System Root%\Users\All Users\Microsoft\OFFICE\Groove\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\History\Service\{username}
%System Root%\Users\All Users\Microsoft\NetFramework\BreadcrumbStore\{username}.KEKW
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\{username}
%System Root%\Python27\include\classobject.h.KEKW
%System Root%\Users\Public\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp.KEKW
%System Root%\excel2k\XLS2KE03.xls.KEKW
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\{username}
%AppDataLocal%\pip\cache\http\4\e\e\{username}
%System Root%\Users\Default\Documents\{username}
%Application Data%\Microsoft\Word\{username}
%All Users Profile%\McAfee\MCLOGS\PartnerCustom\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\31\{username}
%System Root%\Python27\Lib\email\test\data\msg_37.txt.KEKW
%System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\entry_points.txt.KEKW
%AppDataLocal%\Google\Chrome\User Data\SwReporter\40.200.201.3\_metadata\{username}
%Application Data%\Microsoft\Windows\IECompatCache\Low\container.dat.KEKW
%Application Data%\Microsoft\Windows\SendTo\{username}
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\2LHHLFH6\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\Asia\{username}
%System Root%\Users\All Users\Microsoft\IlsCache\{username}.KEKW
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\{username}
%System Root%\Python27\Lib\logging\{username}
%AppDataLocal%\Apps\{username}
%All Users Profile%\{username}
%AppDataLocal%\Google\Chrome\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Config\{username}
%System Root%\excel2k\XLS2KExx.xls.KEKW
%System Root%\Users\Public\Desktop\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp.KEKW
%AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\_platform_specific\all\{username}
%System Root%\Users\All Users\Adobe\ARM\Reader_19.010.20099\{username}.KEKW
%AppDataLocal%\Microsoft\Windows\1024\{username}
%Application Data%\Microsoft\Office\Recent\{username}
%System Root%\Python27\Lib\email\test\data\msg_12a.txt.KEKW
%System Root%\Users\Public\Documents\word2k\DOC2KExx.doc.KEKW
%AppDataLocal%\Google\{username}
%AppDataLocal%\pip\cache\http\3\8\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5\{username}
%System Root%\Python27\tcl\tcl8.5\opt0.4\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\{username}.KEKW
%System Root%\Python27\Tools\pynche\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\2\{username}
%System Root%\Users\All Users\Microsoft\Windows\Templates\{username}
%System Root%\Python27\tcl\tk8.5\images\pwrdLogo150.gif.KEKW
%System Root%\Users\Default\AppData\Local\Microsoft\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\25\{username}
%System Root%\Users\All Users\Microsoft\RAC\Outbound\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\Atlantic\{username}
%All Users Profile%\VMware\VMware Tools\Unity Filters\adobeflashcs3.txt.KEKW
%AppDataLocal%\Microsoft\Media Player\Sync Playlists\{username}
%All Users Profile%\McAfee\MCLOGS\PartnerCustom\550F8967-2EE2-4F33-8E16-1BFFBE114803\{username}
%All Users Profile%\VMware\VMware Tools\{username}
%AppDataLocal%\Microsoft\Internet Explorer\Tiles\{username}
F:\wlines.zip.KEKW
%AppDataLocal%\Microsoft\Feeds\Microsoft Feeds~\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\SmallInstaller\{username}
%System Root%\Python27\include\unicodeobject.h.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\{username}.KEKW
%AppDataLocal%\Microsoft\Feeds Cache\NWKETFVL\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\CacheManager\{username}
%System Root%\Users\Public\Documents\word2k\DOC2KE04.doc.KEKW
%System Root%\Users\All Users\Microsoft\DRM\{username}.KEKW
%User Profile%\Documents\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F0\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\extensions\{username}
%System Root%\Python27\Lib\test\subprocessdata\{username}
%System Root%\Python27\Lib\test\audiodata\pluck-pcm32.wav.KEKW
%System Root%\Python27\include\codecs.h.KEKW
%System Root%\Python27\Lib\email\test\data\msg_31.txt.KEKW
%AppDataLocal%\Google\Chrome\User Data\SwReporter\40.200.201.3\{username}
%AppDataLocal%\Microsoft\Internet Explorer\brndlog.txt.KEKW
%Application Data%\Mozilla\Firefox\{username}
%System Root%\powerpoint2k\PPT2KE04.ppt.KEKW
%AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\RJ6VBH4W.DN2\goog...app_9ae46cec200785df_0001.0003_7581c0cd83ac8659\{username}
%System Root%\Users\All Users\Microsoft\OFFICE\Groove\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp.KEKW
%System Root%\Python27\tcl\tix8.4.3\pref\Bisque.cs.KEKW
%Desktop%\powerpoint2k\PPT2KE05.ppt.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\{username}
%System Root%\powerpoint2k\PPT2KE02.ppt.KEKW
%System Root%\Python27\Lib\idlelib\Icons\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43\{username}
%AppDataLocal%\Microsoft\Windows\1033\StructuredQuerySchema.bin.KEKW
%Application Data%\Microsoft\Excel\{username}
%Application Data%\Microsoft\Spelling\{username}
%User Profile%\Documents\powerpoint2k\PPT2KE02.ppt.KEKW
%System Root%\Python27\Lib\test\cjkencodings\iso2022_kr-utf8.txt.KEKW
%All Users Profile%\Mozilla\{username}
%Application Data%\Sun\Java\Deployment\{username}
%AppDataLocal%\Microsoft\Feeds Cache\COOE7IBP\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\{username}
%AppDataLocal%\Microsoft\Windows\1033\{username}
%All Users Profile%\Microsoft\Windows NT\MSScan\{username}
%System Root%\Users\Public\Recorded TV\Sample Media\{username}
%All Users Profile%\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_72da1383309c93bd2441accd728cf953e4fa97a_0a24a840\{username}
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\2PEMJMIY\{username}
%System Root%\Python27\Lib\idlelib\Icons\idle_48.gif.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\{username}
%AppDataLocal%Low\Microsoft\Windows\AppCache\LY14JQYG\{username}
%System Root%\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\{username}
%System Root%\Users\All Users\Adobe\ARM\S\{username}.KEKW
%System Root%\Python27\Lib\email\test\data\msg_23.txt.KEKW
%AppDataLocal%\Microsoft\Office\ONetConfig\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\packaging\{username}
%System Root%\Users\All Users\Microsoft\RAC\Temp\{username}.KEKW
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\DATA\{username}
%AppDataLocal%\Microsoft\Feeds Cache\NKNYYDHU\{username}
%User Temp%\dd_vcredistUI0FD5.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows\AIT\{username}.KEKW
%AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\{username}
%System Root%\Users\All Users\Microsoft\NetFramework\{username}
%Application Data%\Microsoft\MMC\{username}
%User Profile%\Saved Games\{username}
%System Root%\Python27\Lib\email\test\data\msg_32.txt.KEKW
%System Root%\Users\All Users\Microsoft\Media Player\{username}.KEKW
%AppDataLocal%Low\Microsoft\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\{username}.KEKW
%System Root%\Python27\Lib\email\mime\{username}
%System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\{username}.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\{username}
%Desktop%\Email and Password List.txt.KEKW
%System Root%\Python27\Lib\test\cjkencodings\gb2312.txt.KEKW
%System Root%\Python27\include\funcobject.h.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\frameiconcache.dat.KEKW
%System Root%\Python27\Lib\sqlite3\test\{username}
%System Root%\Users\All Users\Oracle\Java\javapath\{username}.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\{username}
%System Root%\Python27\Tools\pynche\X\rgb.txt.KEKW
%AppDataLocal%\Microsoft\Windows\WER\ReportArchive\{username}
%System Root%\Users\All Users\Adobe\ARM\S\{username}
%Application Data%\Mozilla\Firefox\Crash Reports\events\{username}
%All Users Profile%\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3\{username}
%All Users Profile%\Microsoft\Windows\Ringtones\{username}
%AppDataLocal%Low\Sun\Java\Deployment\tmp\si\{username}
%System Root%\Python27\Lib\bsddb\test\{username}
%AppDataLocal%\Mozilla\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\35\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Cave_Drawings.gif.KEKW
%AppDataLocal%\pip\cache\http\5\{username}
%All Users Profile%\McAfee\MCLOGS\Common\SmallInstaller\{username}
%System Root%\Users\All Users\Microsoft\Windows\Ringtones\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Resource\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0\{username}
%System Root%\Python27\Lib\test\imghdrdata\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Bears.jpg.KEKW
%System Root%\Python27\Lib\test\audiodata\pluck-pcm24.wav.KEKW
%System Root%\Python27\Lib\idlelib\Icons\python.gif.KEKW
%System Root%\Python27\tcl\tix8.4.3\bitmaps\file.gif.KEKW
%System Root%\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\gmp\WINNT_x86_64-msvc\{username}
%System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\top_level.txt.KEKW
%Application Data%\Media Center Programs\{username}
%Application Data%\Microsoft\Protect\S-1-5-21-2407829820-1079796033-203259571-500\{username}
%AppDataLocal%\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\{username}
%Desktop%\word2k\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0\{username}.KEKW
%AppDataLocal%\Google\Chrome\User Data\pnacl\0.57.44.2492\_metadata\{username}
%System Root%\$Recycle.Bin\S-1-5-21-2407829820-1079796033-203259571-500\$IC8HJH8.zip.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\49\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows\DeviceMetadataStore\{username}.KEKW
%System Root%\Users\Default\Pictures\{username}
%Application Data%\Macromedia\Flash Player\#SharedObjects\{username}
%System Root%\Python27\include\pyport.h.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\prefs.js.KEKW
%System Root%\Users\All Users\Microsoft\eHome\{username}.KEKW
%System Root%\Python27\tcl\tk8.5\demos\images\earthris.gif.KEKW
%AppDataLocal%\pip\cache\http\b\a\9\3\{username}
%System Root%\Python27\Lib\lib2to3\pgen2\{username}
%System Root%\powerpoint2k\PPT2KE01.ppt.KEKW
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KE03.ppt.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Python 2.7\{username}
%AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\{username}
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\ActivityLog\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\{username}
%User Profile%\Documents\excel2k\XLS2KE03.xls.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\{username}.KEKW
%AppDataLocal%\pip\cache\http\0\2\5\2\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Java\{username}.KEKW
%System Root%\Python27\include\asdl.h.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\{username}.KEKW
%Desktop%\excel2k\XLS2KE04.xls.KEKW
%System Root%\Users\Public\Documents\{username}
%AppDataLocal%\Microsoft\Windows\WebCache\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Java\{username}
%System Root%\Users\All Users\Mozilla\{username}.KEKW
%All Users Profile%\Microsoft\Vault\{username}
%AppDataLocal%Low\Microsoft\Internet Explorer\EmieSiteList\container.dat.KEKW
%User Profile%\Documents\excel2k\XLS2KE05.xls.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\{username}.KEKW
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Blue_Gradient.jpg.KEKW
%System Root%\Python27\Lib\distutils\{username}
%User Temp%\dd_wcf_CA_smci_20161212_135109_353.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Python 2.7\{username}.KEKW
%Desktop%\note.txt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\13\{username}
%AppDataLocal%\Google\Chrome\User Data\pnacl\0.57.44.2492\_platform_specific\{username}
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\{username}
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\{username}
%All Users Profile%\Microsoft\OFFICE\DATA\{username}
%Desktop%\Email and Password List.js.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\gmp\{username}
%All Users Profile%\Microsoft\Windows NT\MSFax\Common Coverpages\{username}
%All Users Profile%\Microsoft Help\{username}
%AppDataLocal%\pip\cache\http\7\e\9\{username}
%System Root%\Python27\include\pygetopt.h.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\44\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Quick\{username}.KEKW
%System Root%\Python27\Lib\site-packages\Pillow-6.0.0.dist-info\{username}
%System Root%\Python27\Lib\email\test\data\msg_17.txt.KEKW
%System Root%\Python27\Lib\test\leakers\README.txt.KEKW
%System Root%\Python27\Lib\email\test\data\msg_38.txt.KEKW
%AppDataLocal%\Microsoft\Windows Mail\Stationery\White_Chocolate.jpg.KEKW
%Application Data%\Microsoft\Excel\XLSTART\{username}
%AppDataLocal%\pip\cache\{username}
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\{username}.KEKW
%Application Data%\Microsoft\SystemCertificates\My\{username}
%System Root%\Python27\include\pythread.h.KEKW
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\{username}
%System Root%\Users\All Users\Microsoft\Windows\DRM\Cache\{username}.KEKW
%System Root%\Python27\Lib\email\test\data\msg_21.txt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\36\{username}
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp.KEKW
%AppDataLocal%\Microsoft\Office\Groove\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Peacock.jpg.KEKW
%AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Indexed Rules\{username}
%System Root%\Users\{username}\AppData\Roaming\Microsoft\{username}
%System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_72da1383309c93bd2441accd728cf953e4fa97a_0a24a840\{username}
%All Users Profile%\Microsoft\Windows Defender\Quarantine\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\32\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\{username}.KEKW
%System Root%\Users\Public\Documents\excel2k\XLS2KE04.xls.KEKW
%System Root%\Python27\tcl\tcl8.5\tzdata\Pacific\{username}
%System Root%\Users\Default\Music\{username}
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\DATA\{username}.KEKW
%AppDataLocal%\Microsoft\Windows\Explorer\{username}
%System Root%\Python27\Lib\test\test_doctest4.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Caches\{username}.KEKW
%System Root%\Python27\tcl\tix8.4.3\pref\SGIGray.cs.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\{username}
%System Root%\Python27\include\code.h.KEKW
%System Root%\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\{username}.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95\{username}
%System Root%\Python27\tcl\tix8.4.3\bitmaps\textfile.gif.KEKW
%AppDataLocal%\Google\Chrome\User Data\PepperFlash\32.0.0.171\_metadata\{username}
%System Root%\Python27\include\enumobject.h.KEKW
%System Root%\Users\Default\Downloads\{username}
%System Root%\Users\All Users\Microsoft\Windows\Sqm\Sessions\{username}
%System Root%\Users\All Users\Microsoft\Windows\Sqm\Manifest\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\550F8967-2EE2-4F33-8E16-1BFFBE114803\{username}.KEKW
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\{username}
%System Root%\Python27\Lib\idlelib\HISTORY.txt.KEKW
%System Root%\Python27\Lib\test\cjkencodings\johab.txt.KEKW
%System Root%\Python27\include\py_curses.h.KEKW
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\thumbnails\{username}
%System Root%\Python27\Lib\compiler\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\1D\{username}
%System Root%\Python27\tcl\tk8.5\demos\images\{username}
%System Root%\Python27\include\pgen.h.KEKW
%System Root%\Python27\Lib\test\crashers\{username}
%AppDataLocal%\Python-Eggs\Python-Eggs\{username}
%System Root%\Python27\include\pydebug.h.KEKW
%AppDataLocal%\Google\Chrome\User Data\PepperFlash\32.0.0.171\{username}
%System Root%\Python27\Lib\site-packages\pip\_internal\vcs\{username}
%Application Data%\Microsoft\Windows\PrivacIE\Low\{username}
%User Temp%\CR_E83EE.tmp\{username}
%System Root%\Python27\include\patchlevel.h.KEKW
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\{username}
%System Root%\Users\Public\Music\Sample Music\Sleep Away.mp3.KEKW
%System Root%\Python27\Lib\encodings\{username}
%System Root%\Python27\Lib\site-packages\setuptools\_vendor\{username}
%System Root%\Python27\Lib\email\test\data\msg_26.txt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\53\{username}
%User Profile%\{username}
%System Root%\Users\All Users\Microsoft\eHome\logs\{username}.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\28\{username}
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\{username}
%AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\_platform_specific\all\sths\{username}
%System Root%\Python27\Tools\pynche\X\{username}
%System Root%\Users\All Users\Microsoft\WwanSvc\{username}
%System Root%\Users\All Users\Microsoft\Network\{username}
%AppDataLocal%Low\Sun\{username}
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\{username}
%System Root%\Python27\Tools\pynche\X\xlicense.txt.KEKW
%All Users Profile%\Microsoft\Windows Defender\Definition Updates\{0E1465B0-BA9C-409F-BC32-D934317129CD}\{username}
%System Root%\Python27\tcl\tix8.4.3\demos\samples\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp.KEKW
%System Root%\Python27\include\pystrcmp.h.KEKW
%System Root%\Python27\tcl\tcl8.5\tzdata\Brazil\{username}
%System Root%\Users\Public\Videos\Sample Videos\{username}
%AppDataLocal%\Google\Chrome\User Data\MEIPreload\{username}
%AppDataLocal%\Microsoft\Windows\AppCache\container.dat.KEKW
%System Root%\Python27\Lib\site-packages\README.txt.KEKW
%System Root%\Python27\include\bytesobject.h.KEKW
%AppDataLocal%\Microsoft\Windows\AppCache\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\24\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\America\{username}
%System Root%\Users\{username}\AppData\Local\Microsoft\Media Player\{username}
%All Users Profile%\Mozilla\updates\308046B0AF4A39CB\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\America\North_Dakota\{username}
%AppDataLocal%\Apps\2.0\Data\RNQG94OQ.QJC\E1WGPJBQ.PMC\goog...app_9ae46cec200785df_0001.0003_7581c0cd83ac8659\Data\{username}
%System Root%\Users\All Users\Microsoft\RAC\StateData\RacMetaData.dat.KEKW
%System Root%\Users\Public\Pictures\Sample Pictures\Penguins.jpg.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\{username}
%Application Data%\Microsoft\Word\STARTUP\{username}
%System Root%\Python27\Lib\test\test_doctest3.txt.KEKW
%System Root%\Python27\Lib\site-packages\pythonnet-2.1.0.dist-info\top_level.txt.KEKW
%System Root%\Users\{username}
%System Root%\Users\Public\Documents\excel2k\XLS2KE02.xls.KEKW
%System Root%\Users\All Users\Microsoft\Device Stage\{username}.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp.KEKW
%AppDataLocal%\Microsoft\Feeds Cache\8TQ1M9OZ\{username}
%Application Data%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\{username}
%Desktop%\excel2k\XLS2KE03.xls.KEKW
%Application Data%\Microsoft\Windows\DNTException\container.dat.KEKW
%System Root%\Python27\include\pyctype.h.KEKW
%System Root%\Python27\Lib\test\cjkencodings\gb18030.txt.KEKW
%System Root%\Python27\Lib\xml\sax\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Monet.jpg.KEKW
%System Root%\Python27\Lib\email\test\data\msg_44.txt.KEKW
%Application Data%\Mozilla\Extensions\{username}
%AppDataLocal%\pip\cache\http\5\4\3\d\{username}
%System Root%\Users\All Users\Microsoft\Vault\{username}
%System Root%\Python27\Lib\email\test\data\msg_29.txt.KEKW
%System Root%\Python27\Lib\email\test\data\msg_45.txt.KEKW
%System Root%\Users\All Users\Microsoft\RAC\StateData\RacWmiEventData.dat.KEKW
%System Root%\Python27\Lib\distutils\tests\{username}
%AppDataLocal%\Microsoft\Internet Explorer\EmieUserList\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\pkg_resources\{username}
%System Root%\Python27\Lib\test\audiodata\pluck-pcm16.wav.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\{username}.KEKW
%AppDataLocal%\pip\cache\http\3\8\9\{username}
%User Profile%\AppData\{username}
%System Root%\Python27\Lib\email\test\data\msg_13.txt.KEKW

This report is generated via an automated analysis system.

SOLUTION

Minimum Scan Engine:

9.850

Step 1

Before doing any scans, Windows 7, Windows 8, Windows 8.1, and Windows 10 users must disable System Restore to allow full scanning of their computers.

Step 2

Restart in Safe Mode

[ Learn More ]

Step 3

Identify and terminate files detected as TrojanSpy.MSIL.URSNIF.THCBFBO

[ Learn More ]

Windows Task Manager may not display all running processes. In this case, please use a third-party process viewer, preferably Process Explorer, to terminate the malware/grayware/spyware file. You may download the said tool here.
If the detected file is displayed in either Windows Task Manager or Process Explorer but you cannot delete it, restart your computer in safe mode. To do this, refer to this link for the complete steps.
If the detected file is not displayed in either Windows Task Manager or Process Explorer, continue doing the next steps.

Step 4

Search and delete these components

[ Learn More ]

There may be some components that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.

%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\{username}
%All Users Profile%\Microsoft\Search\Data\Applications\{username}
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\{username}
%Start Menu%\Programs\Administrative Tools\{username}
%AppDataLocal%Low\Mozilla\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Java\{username}
%AppDataLocal%\pip\cache\http\a\1\9\5\{username}
%System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\updates\0\{username}.KEKW
%System Root%\Python27\tcl\tk8.5\images\pwrdLogo175.gif.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pings\{username}
%System Root%\Python27\include\pgenheaders.h.KEKW
%User Temp%\dd_vcredistMSI0FD5.txt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\50\{username}
%System Root%\Python27\Lib\hotshot\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47\{username}
%System Root%\powerpoint2k\PPT2KExx.PPT.KEKW
%AppDataLocal%Low\Microsoft\Internet Explorer\EmieUserList\container.dat.KEKW
%System Root%\Python27\Lib\email\test\data\msg_07.txt.KEKW
%System Root%\Python27\include\Python-ast.h.KEKW
%System Root%\Users\All Users\VMware\RawdskCompatibility\virtual\{username}.KEKW
%System Root%\Python27\Lib\idlelib\Icons\minusnode.gif.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\treeadapters\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp.KEKW
%System Root%\Users\{username}\AppData\Roaming\Microsoft\Windows\Libraries\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\{username}
%Desktop%\word2k\DOC2KE01.doc.KEKW
%AppDataLocal%\pip\cache\http\7\e\9\8\0\{username}
%System Root%\Users\Default\AppData\Roaming\{username}
%System Root%\Python27\include\ast.h.KEKW
%System Root%\Python27\Lib\idlelib\extend.txt.KEKW
%System Root%\Users\All Users\Microsoft\Device Stage\Task\{{GUID}}\{username}.KEKW
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\Un_A\{username}.KEKW
%System Root%\word2k\DOC2KE02.doc.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Store\{username}.KEKW
%System Root%\Python27\NEWS.txt.KEKW
%System Root%\Users\All Users\Microsoft\Assistance\Client\{username}
%System Root%\Python27\Lib\test\zipdir.zip.KEKW
%System Root%\Python27\Lib\test\cjkencodings\johab-utf8.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1D\{username}
%System Root%\Python27\tcl\tk8.5\images\pwrdLogo200.gif.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\VersionManager\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1D\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\util\{username}
%System Root%\Users\All Users\Microsoft\Assistance\Client\{username}.KEKW
%User Temp%\Low\{username}
F:\data\photos\{username}
%System Root%\Users\Public\Pictures\Sample Pictures\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\Common\{username}.KEKW
%Start Menu%\{username}
%Application Data%\Microsoft\UProof\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\{username}.KEKW
%AppDataLocal%\pip\cache\http\a\6\9\b\d\{username}
%System Root%\excel2k\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Pretty_Peacock.jpg.KEKW
%System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\dependency_links.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5\{username}.KEKW
%System Root%\Users\All Users\Microsoft\{username}
%System Root%\Python27\Lib\idlelib\Icons\idle_32.gif.KEKW
%System Root%\Python27\Lib\email\test\data\msg_35.txt.KEKW
%AppDataLocal%\pip\cache\http\7\e\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\{username}
%All Users Profile%\Microsoft\Assistance\Client\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\F0\{username}
%AppDataLocal%\Microsoft\Feeds Cache\container.dat.KEKW
%System Root%\Users\All Users\Mozilla\updates\{username}.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\treewalkers\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\22\{username}
%System Root%\Users\{username}\Music\{username}
%System Root%\Users\Public\Music\Sample Music\Kalimba.mp3.KEKW
%All Users Profile%\Microsoft\Windows Defender\Definition Updates\Updates\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A\{username}
%System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\top_level.txt.KEKW
%System Root%\Python27\tcl\reg1.2\{username}
%System Root%\Python27\include\pymem.h.KEKW
%System Root%\Users\All Users\Microsoft\IdentityCRL\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\{username}.KEKW
%System Root%\Python27\Lib\test\cjkencodings\shift_jisx0213.txt.KEKW
%AppDataLocal%\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\{username}
%System Root%\Python27\Lib\site-packages\pip\_internal\commands\{username}
%AppDataLocal%\Microsoft\Windows Mail\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp.KEKW
%System Root%\word2k\DOC2KE05.doc.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\{username}.KEKW
%System Root%\PerfLogs\Admin\{username}
%System Root%\Python27\tcl\tcl8\8.5\{username}
%AppDataLocal%\pip\cache\http\d\3\7\e\0\{username}
%System Root%\Python27\Lib\test\cjkencodings\cp949-utf8.txt.KEKW
%System Root%\Python27\tcl\tcl8.5\tzdata\Etc\{username}
%System Root%\Python27\Lib\test\cjkencodings\gb2312-utf8.txt.KEKW
%System Root%\Python27\tcl\tix8.4.3\bitmaps\minusarm.gif.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\muffin\{username}
%System Root%\Python27\Lib\test\capath\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\CacheManager\{username}.KEKW
%System Root%\Python27\Tools\pynche\webcolors.txt.KEKW
%AppDataLocal%\Microsoft\Windows Mail\Stationery\SoftBlue.jpg.KEKW
%AppDataLocal%\pip\cache\http\d\3\{username}
%AppDataLocal%\pip\cache\http\2\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\39\{username}
%All Users Profile%\Microsoft\Windows\Sqm\Upload\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\18\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\{username}
%System Root%\Python27\Lib\email\test\data\msg_22.txt.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\{username}
%System Root%\Users\All Users\Microsoft\RAC\PublishedData\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\datareporting\archived\2019-05\{username}
%System Root%\Users\Default\Videos\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\{username}.KEKW
%Application Data%\Microsoft\SystemCertificates\My\CRLs\{username}
%System Root%\Python27\tcl\tcl8\8.4\platform\{username}
%System Root%\Python27\include\descrobject.h.KEKW
%System Root%\Python27\include\dictobject.h.KEKW
%System Root%\Python27\Lib\test\imghdrdata\python.bmp.KEKW
%AppDataLocal%\Google\Chrome\User Data\OriginTrials\{username}
%System Root%\Users\Default\AppData\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\requests\{username}
%AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.1\{username}
%System Root%\Users\Public\Documents\excel2k\XLS2KExx.xls.KEKW
%System Root%\Python27\tcl\tk8.5\images\logo100.gif.KEKW
%System Root%\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\7\{username}
%AppDataLocal%Low\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\Australia\{username}
%System Root%\Users\All Users\Microsoft\MF\{username}
%System Root%\Python27\Lib\test\cjkencodings\gb18030-utf8.txt.KEKW
%Application Data%\Macromedia\Flash Player\macromedia.com\support\flashplayer\{username}
%System Root%\Python27\tcl\tcl8.5\http1.0\{username}
%Desktop%\powerpoint2k\PPT2KE02.ppt.KEKW
%System Root%\Users\All Users\Microsoft\IlsCache\{username}
%System Root%\Python27\include\modsupport.h.KEKW
%Desktop%\excel2k\XLS2KE01.xls.KEKW
%System Root%\Python27\Lib\email\test\data\msg_11.txt.KEKW
%System Root%\Python27\Lib\email\test\data\msg_46.txt.KEKW
%System Root%\Users\All Users\Microsoft Help\{username}
%AppDataLocal%\Microsoft\Internet Explorer\Tiles\pin9728060290\{username}
%All Users Profile%\Oracle\Java\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\52\{username}
%Favorites%\MSN Websites\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\{username}.KEKW
%AppDataLocal%Low\Microsoft\Windows\AppCache\LY14JQYG\container.dat.KEKW
%User Profile%\Documents\Email and Password List.txt.KEKW
%User Temp%\WPDNSE\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\Backup\{username}
%System Root%\Python27\Lib\email\test\data\msg_05.txt.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\2918063365piupsah.files\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\{username}
%AppDataLocal%Low\Sun\Java\Deployment\{username}
%System Root%\Python27\tcl\tix8.4.3\bitmaps\folder.gif.KEKW
%AppDataLocal%\pip\cache\http\a\1\{username}
%AppDataLocal%\Google\Chrome\User Data\SwReporter\{username}
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-child.bin.KEKW
%All Users Profile%\McAfee\WinCore\{username}
%AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.1\_metadata\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg.KEKW
%AppDataLocal%\Deployment\{username}
%AppDataLocal%\Apps\2.0\Data\RNQG94OQ.QJC\E1WGPJBQ.PMC\goog...app_9ae46cec200785df_0001.0003_7581c0cd83ac8659\{username}
%System Root%\Python27\tcl\tix8.4.3\demos\{username}
%AppDataLocal%\Microsoft\Internet Explorer\Recovery\{username}
%System Root%\Python27\Lib\test\cjkencodings\euc_kr-utf8.txt.KEKW
%System Root%\Python27\Lib\idlelib\NEWS.txt.KEKW
%Application Data%\Macromedia\Flash Player\{username}
%Application Data%\Microsoft\Credentials\{username}
%All Users Profile%\VMware\RawdskCompatibility\native\C\{username}
%System Root%\Python27\Lib\site-packages\pip\{username}
%AppDataLocal%\Google\Chrome\User Data\FileTypePolicies\34\_metadata\{username}
%AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\{username}
%AppDataLocal%\Google\Chrome\User Data\BrowserMetrics\{username}
%Application Data%\Macromedia\Flash Player\macromedia.com\{username}
%Application Data%\Mozilla\SystemExtensionsDev\{username}
%User Profile%\Documents\word2k\{username}
%System Root%\Python27\Lib\test\audiodata\pluck-pcm8.wav.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\{username}.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp.KEKW
%AppDataLocal%\pip\cache\http\0\2\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\mpcache-B1C01FED9F08520A4647901EFB883A6A3B247F8D.bin.KEKW
%AppDataLocal%\Apps\2.0\Data\RNQG94OQ.QJC\E1WGPJBQ.PMC\{username}
%AppDataLocal%\Microsoft\Windows\History\{username}
%System Root%\Users\All Users\Microsoft\Windows\DeviceMetadataStore\en-US\{username}
%System Root%\Python27\Lib\test\floating_points.txt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\37\{username}
%System Root%\Python27\Lib\lib2to3\fixes\{username}
%System Root%\Users\All Users\Microsoft\RAC\StateData\RacWmiDataBookmarks.dat.KEKW
%User Profile%\Documents\word2k\DOC2KE02.doc.KEKW
%AppDataLocal%\pip\cache\http\7\{username}
%System Root%\Users\Public\Pictures\Sample Pictures\Desert.jpg.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70\{username}
%All Users Profile%\Microsoft\Windows\WER\ReportQueue\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\{username}.KEKW
%System Root%\Users\{username}\Pictures\{username}
%System Root%\Python27\tcl\tix8.4.3\demos\bitmaps\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\host\{username}
%AppDataLocal%\pip\cache\http\b\a\9\3\5\{username}
%System Root%\Python27\Lib\test\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\8\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\{username}.KEKW
%Application Data%\Microsoft\Internet Explorer\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\VMware\{username}
%AppDataLocal%\Microsoft\Feeds Cache\M7X9O6Z1\{username}
%System Root%\Users\All Users\Microsoft\Windows\Caches\{username}
%AppDataLocal%\Microsoft\Internet Explorer\IECompatData\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\19\{username}
%System Root%\Python27\Lib\site-packages\pip\_internal\models\{username}
%System Root%\Python27\tcl\tix8.4.3\bitmaps\minus.gif.KEKW
%AppDataLocal%\pip\cache\http\f\e\d\0\e\{username}
%System Root%\Python27\Lib\test\math_testcases.txt.KEKW
%System Root%\Users\Public\Libraries\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\42\{username}
%Application Data%\Microsoft\Office\Recent\index.dat.KEKW
%System Root%\Python27\include\traceback.h.KEKW
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\History\CacheManager\MpSfc.bin.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Support\{username}.KEKW
%AppDataLocal%\pip\cache\http\5\4\{username}
%All Users Profile%\Microsoft\Device Stage\Task\{{GUID}}\{username}
%All Users Profile%\VMware\RawdskCompatibility\{username}
%System Root%\Python27\Lib\distutils\command\{username}
%System Root%\Users\All Users\Microsoft\Device Stage\Task\{username}.KEKW
%AppDataLocal%\Microsoft\Windows\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\{username}.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp.KEKW
%Application Data%\Microsoft\Windows\Templates\{username}
%AppDataLocal%\Python-Eggs\Python-Eggs\Cache\pillow-4.1.0-py2.7-win32.egg-tmp\{username}
%System Root%\Users\Public\Documents\powerpoint2k\{username}
%AppDataLocal%\Microsoft\Feeds Cache\NNO7APUS\{username}
%AppDataLocal%\Microsoft\Internet Explorer\tabiconcache.dat.KEKW
%System Root%\Users\Public\Pictures\Sample Pictures\Koala.jpg.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95\{username}
%System Root%\Python27\Lib\test\leakers\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\33\{username}
%User Temp%\dd_NDP452-KB2901907-x86-x64-AllOS-ENU_decompression_log.txt.KEKW
%System Root%\Users\All Users\Oracle\Java\javapath_target_313094\{username}.KEKW
%AppDataLocal%\pip\cache\http\7\e\9\8\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\{username}.KEKW
%System Root%\Python27\Lib\multiprocessing\{username}
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\SentItems\{username}.KEKW
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Psychedelic.jpg.KEKW
%AppDataLocal%\pip\cache\http\4\{username}
%User Profile%\Contacts\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Device Stage\Task\{{GUID}}\en-US\{username}
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Entries\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Inbox\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\msgpack\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\34\{username}
%AppDataLocal%\Microsoft\Office\Groove\User\{username}
%All Users Profile%\Microsoft\Network\Downloader\qmgr0.dat.KEKW
%AppDataLocal%\Google\Chrome\User Data\pnacl\0.57.44.2492\_platform_specific\x86_64\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\70\{username}.KEKW
%System Root%\Python27\Lib\idlelib\idle_test\README.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows\AIT\{username}
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\{username}
%System Root%\Users\All Users\Microsoft\Windows\Sqm\Upload\{username}
%All Users Profile%\VMware\VMware Tools\Unity Filters\vmwarefilters.txt.KEKW
%System Root%\Users\All Users\{username}.KEKW
%System Root%\Users\All Users\Microsoft\eHome\{username}
%System Root%\Python27\Lib\test\cjkencodings\cp949.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\{username}.KEKW
%System Root%\Python27\include\iterobject.h.KEKW
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\cache2\entries\{username}
%AppDataLocal%\Google\Chrome\User Data\InterventionPolicyDatabase\2018.9.6.0\{username}
%All Users Profile%\Microsoft\OFFICE\DATA\opa12.dat.KEKW
%System Root%\Users\Default\Links\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp.KEKW
%All Users Profile%\McAfee\MCLOGS\PartnerCustom\SSScheduler\{username}
%System Root%\Python27\tcl\tix8.4.3\bitmaps\{username}
%System Root%\Python27\include\import.h.KEKW
%AppDataLocal%\pip\cache\http\0\2\5\{username}
%System Root%\Users\Default\AppData\Local\Temp\{username}
%All Users Profile%\VMware\VMware Tools\manifest.txt.KEKW
%All Users Profile%\Mozilla\updates\308046B0AF4A39CB\updates\{username}
%AppDataLocal%\Microsoft\Windows\Burn\{username}
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KExx.PPT.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\UrlBlockManager\urlblocklist.bin.KEKW
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts\{username}
%AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\{username}
%System Root%\Users\Public\Documents\excel2k\XLS2KE01.xls.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\imagestore\1s32qbz\{username}
%User Profile%\Documents\word2k\DOC2KE01.doc.KEKW
%System Root%\Users\All Users\VMware\VMware Tools\Unity Filters\{username}
%System Root%\Users\All Users\VMware\{username}.KEKW
%System Root%\Users\Public\Music\{username}
%System Root%\Users\All Users\Microsoft\OFFICE\DATA\{username}
%System Root%\Python27\Lib\test\cjkencodings\euc_jp-utf8.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows\DRM\Cache\{username}
%All Users Profile%\Microsoft\NetFramework\BreadcrumbStore\{username}
%User Profile%\Documents\excel2k\XLS2KE02.xls.KEKW
%System Root%\Python27\Lib\site-packages\pythonnet-2.1.0.dist-info\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\{username}.KEKW
%User Profile%\Documents\powerpoint2k\PPT2KE05.ppt.KEKW
%System Root%\Users\All Users\Microsoft\DRM\Server\{username}.KEKW
%System Root%\Users\{username}\AppData\Roaming\Microsoft\Windows\{username}
%System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\LICENSE.txt.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\datareporting\archived\2019-04\{username}
%System Root%\Users\All Users\Microsoft\Media Player\{username}
%System Root%\Users\All Users\Microsoft\OFFICE\{username}.KEKW
%Application Data%\Microsoft\Windows\DNTException\Low\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\Arctic\{username}
%System Root%\Python27\include\fileobject.h.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\History\Results\Resource\{username}
%AppDataLocal%\Microsoft\Feeds\Feeds for United States~\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp.KEKW
%AppDataLocal%\pip\cache\http\5\4\3\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp.KEKW
%System Root%\Python27\tcl\tcl8.5\tzdata\Canada\{username}
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\3UYAQU1F\{username}
%AppDataLocal%\Microsoft\Windows\Ringtones\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Connectivity.gif.KEKW
%User Temp%\Microsoft .NET Framework 4.5.2 Setup_20161212_135033207.html.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\56\{username}
%User Profile%\Documents\powerpoint2k\PPT2KE04.ppt.KEKW
%System Root%\Python27\Lib\test\cjkencodings\hz.txt.KEKW
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\cache2\doomed\{username}
%System Root%\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\{username}
%System Root%\Users\All Users\Microsoft\Device Stage\{username}
%System Root%\Users\All Users\Microsoft\Windows\WER\{username}
%System Root%\Python27\include\eval.h.KEKW
%All Users Profile%\Microsoft\Device Stage\Task\{username}
%System Root%\Python27\include\intobject.h.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp.KEKW
%System Root%\word2k\DOC2KE03.doc.KEKW
%System Root%\$Recycle.Bin\S-1-5-21-2407829820-1079796033-203259571-500\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Maintenance\{username}
%AppDataLocal%\Google\Chrome\User Data\ShaderCache\GPUCache\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3\{username}
%All Users Profile%\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\{username}
%System Root%\excel2k\XLS2KE02.xls.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\VMware Tools\{username}.KEKW
%System Root%\Python27\Lib\test\cjkencodings\shift_jis-utf8.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Assistance\{username}.KEKW
%Application Data%\Microsoft\Vault\{username}
%System Root%\Python27\Lib\email\test\data\msg_19.txt.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\History\Results\Quick\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Store\{username}
%System Root%\Users\All Users\Microsoft\RAC\{username}.KEKW
%System Root%\Python27\Lib\test\cjkencodings\gbk-utf8.txt.KEKW
%All Users Profile%\Microsoft\Windows\Sqm\Sessions\{username}
%System Root%\Users\{username}\AppData\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\Africa\{username}
%All Users Profile%\McAfee\MCLOGS\PartnerCustom\Un_A\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\61\{username}
%System Root%\Python27\Lib\site-packages\setuptools\command\{username}
%System Root%\Python27\tcl\tix8.4.3\bitmaps\srcfile.gif.KEKW
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-current.bin.KEKW
%All Users Profile%\McAfee\MCLOGS\PartnerCustom\McCHSvc\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp.KEKW
%All Users Profile%\Microsoft\Windows\DRM\{username}
%System Root%\Python27\Tools\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Config\{username}.KEKW
%System Root%\Python27\Lib\test\cjkencodings\shift_jisx0213-utf8.txt.KEKW
%System Root%\Python27\Lib\email\test\data\msg_08.txt.KEKW
%All Users Profile%\Microsoft\MSDN\{username}
%AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\{AD285A8B-713F-11E9-85F8-005056BC44A9}.dat.KEKW
%System Root%\Python27\Lib\test\decimaltestdata\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\LocalCopy\{username}
%System Root%\Users\All Users\Microsoft\MSDN\8.0\{username}.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp.KEKW
%System Root%\Python27\Lib\test\test_doctest.txt.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\pep517\{username}
%System Root%\Python27\include\osdefs.h.KEKW
%System Root%\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.KEKW
%All Users Profile%\Microsoft\Windows NT\MSFax\ActivityLog\{username}
%AppDataLocal%\pip\cache\http\0\{username}
%AppDataLocal%\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\{username}
%AppDataLocal%\Microsoft\Windows\WebCache\WebCacheV01.dat.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\contrib\_securetransport\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\4\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5\{username}
%All Users Profile%\Oracle\{username}
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\GUFNQG0Q\{username}
%User Temp%\acrocef_low\{username}
%System Root%\Python27\Doc\{username}
%User Profile%\Documents\powerpoint2k\PPT2KE01.ppt.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSScan\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\America\Argentina\{username}
%System Root%\Users\All Users\Microsoft\OFFICE\DATA\{username}.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\Tracking Protection\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\LocalCopy\{username}.KEKW
%System Root%\Python27\LICENSE.txt.KEKW
%System Root%\Users\All Users\Adobe\Setup\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\{username}.KEKW
%System Root%\Python27\tcl\tix8.4.3\bitmaps\act_fold.gif.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\{username}
%System Root%\Python27\Lib\test\cjkencodings\big5hkscs.txt.KEKW
%System Root%\Users\{username}\AppData\Local\{username}
%System Root%\Python27\tcl\tk8.5\images\logoMed.gif.KEKW
%All Users Profile%\Microsoft\RAC\Outbound\{username}
%System Root%\Python27\Lib\xml\etree\{username}
%Application Data%\Microsoft\Document Building Blocks\1033\{username}
%All Users Profile%\Microsoft\Windows\Sqm\{username}
%System Root%\Python27\tcl\tix8.4.3\{username}
%AppDataLocal%\Google\Chrome\User Data\InterventionPolicyDatabase\2018.9.6.0\_metadata\{username}
%System Root%\Python27\tcl\tix8.4.3\pref\TixGray.cs.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp.KEKW
%System Root%\Recovery\{GUID}\{username}
%Start Menu%\Programs\Accessories\Accessibility\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\History\{username}
%System Root%\Users\Default\AppData\Roaming\Microsoft\{username}
%AppDataLocal%\pip\cache\http\3\8\9\3\{username}
%Application Data%\Microsoft\Windows\IEDownloadHistory\container.dat.KEKW
%AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.1\LICENSE.txt.KEKW
%All Users Profile%\Microsoft\Search\Data\Temp\{username}
%System Root%\Python27\include\pyerrors.h.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\PDYB5D8B\{username}
%AppDataLocal%Low\Microsoft\Windows\AppCache\container.dat.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\{username}
%System Root%\Users\Public\Pictures\Sample Pictures\Tulips.jpg.KEKW
%System Root%\Users\All Users\Microsoft\NetFramework\BreadcrumbStore\{username}
%All Users Profile%\Microsoft\Windows\Power Efficiency Diagnostics\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\Updates\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\1\{username}
%System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\updates\{username}.KEKW
%All Users Profile%\Oracle\Java\installcache_x64\{username}
%System Root%\Users\All Users\Microsoft\Network\Connections\{username}.KEKW
%System Root%\Email and Password List.txt.KEKW
%System Root%\Users\All Users\Microsoft\{username}.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\pkcs11.txt.KEKW
%System Root%\Python27\Lib\email\test\data\msg_27.txt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\0\{username}
%Application Data%\Microsoft\Office\{username}
%System Root%\Users\All Users\Microsoft\Windows\Power Efficiency Diagnostics\{username}.KEKW
%AppDataLocal%Low\Microsoft\Internet Explorer\EmieUserList\{username}
%System Root%\Python27\include\pyarena.h.KEKW
%AppDataLocal%Low\Microsoft\Internet Explorer\EmieBrowserModeList\{username}
%Desktop%\powerpoint2k\PPT2KE04.ppt.KEKW
%System Root%\Users\Public\Documents\word2k\DOC2KE02.doc.KEKW
%Application Data%\Microsoft\Windows\Printer Shortcuts\{username}
%System Root%\Python27\Lib\test\cjkencodings\euc_jp.txt.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp.KEKW
%System Root%\Python27\Lib\lib2to3\tests\{username}
%System Root%\Users\All Users\Microsoft\DeviceSync\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F0\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\{username}.KEKW
%System Root%\Python27\Lib\email\test\data\msg_04.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows\DeviceMetadataStore\{username}
%System Root%\Python27\include\setobject.h.KEKW
%System Root%\Python27\Lib\site-packages\pip\_internal\operations\{username}
%Desktop%\word2k\DOC2KE05.doc.KEKW
%System Root%\Python27\tcl\tix8.4.3\bitmaps\info.gif.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\8YC9813O\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\{username}
%System Root%\Python27\tcl\tix8.4.3\pref\WmDefault.cs.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\contrib\{username}
%All Users Profile%\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\DATA\{username}
%All Users Profile%\VMware\VMware Tools\Unity Filters\vistasidebar.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Sqm\{username}.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\{username}
%System Root%\Users\All Users\Adobe\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\{username}
%Start Menu%\Programs\{username}
%Desktop%\{username}
%User Profile%\Documents\excel2k\XLS2KExx.xls.KEKW
%AppDataLocal%\pip\cache\http\b\a\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\F0\{username}
%System Root%\Python27\tcl\tk8.5\msgs\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43\{username}.KEKW
%System Root%\Python27\include\marshal.h.KEKW
%System Root%\Python27\Lib\test\audiodata\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Microsoft Office\{username}
%System Root%\Python27\Lib\idlelib\README.txt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\12\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp.KEKW
%All Users Profile%\Microsoft\Windows Defender\Definition Updates\Backup\{username}
%AppDataLocal%\pip\cache\http\f\e\d\{username}
%System Root%\Python27\include\Python.h.KEKW
%System Root%\Users\All Users\Microsoft\Network\{username}.KEKW
%All Users Profile%\Microsoft\IdentityCRL\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\{username}
%All Users Profile%\Oracle\Java\javapath_target_313094\{username}
%System Root%\Python27\Lib\email\test\data\msg_41.txt.KEKW
%System Root%\Python27\tcl\tk8.5\images\logoLarge.gif.KEKW
%System Root%\Python27\tcl\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Quarantine\{username}.KEKW
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\{username}
%System Root%\Python27\Lib\email\test\data\msg_15.txt.KEKW
%AppDataLocal%Low\Sun\Java\{username}
%System Root%\Python27\Lib\curses\{username}
%AppDataLocal%\Microsoft\Internet Explorer\MSIMGSIZ.DAT.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\{username}
%System Root%\Python27\include\graminit.h.KEKW
%AppDataLocal%\Microsoft\TaskSchedulerConfig\{username}
F:\data\dolist.txt.KEKW
%AppDataLocal%\Microsoft\PlayReady\{username}
%Start Menu%\Programs\Maintenance\{username}
%User Temp%\{username}
%AppDataLocal%\Microsoft\Windows Media\{username}
%AppDataLocal%\Microsoft\Windows\Burn\Burn\{username}
%System Root%\Python27\tcl\tk8.5\images\logo64.gif.KEKW
%All Users Profile%\Microsoft\RAC\Temp\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Entries\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\{username}.KEKW
%Desktop%\powerpoint2k\PPT2KE03.ppt.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\{username}
%All Users Profile%\Microsoft\Windows\AIT\{username}
%System Root%\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Queue\{username}.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\treebuilders\{username}
%User Profile%\Documents\Email and Password List.js.KEKW
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\urlCache.bin.KEKW
%System Root%\Python27\include\pythonrun.h.KEKW
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Tablet PC\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\550F8967-2EE2-4F33-8E16-1BFFBE114803\{username}
%AppDataLocal%\Microsoft Help\{username}
%System Root%\Python27\Lib\email\test\data\msg_09.txt.KEKW
%System Root%\Python27\include\pymactoolbox.h.KEKW
%System Root%\Python27\Lib\email\test\data\msg_02.txt.KEKW
%AppDataLocal%\Microsoft\Windows\WER\ReportArchive\NonCritical_iexplore.exe_12df8271b62395a348f102b12959f9768e2baf9_0be7f64f\{username}
%System Root%\Python27\Lib\test\support\{username}
%System Root%\word2k\DOC2KE01.doc.KEKW
%System Root%\Users\All Users\Microsoft\IdentityCRL\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\SiteSecurityServiceState.txt.KEKW
%System Root%\Python27\Lib\test\tokenize_tests.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70\{username}.KEKW
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Tiki.gif.KEKW
%System Root%\Python27\include\stringobject.h.KEKW
%AppDataLocal%\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg.KEKW
%System Root%\Users\All Users\Microsoft Help\{username}.KEKW
%System Root%\Python27\Lib\idlelib\idle_test\{username}
%System Root%\Users\All Users\VMware\VMware Tools\{username}.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\packages\{username}
%AppDataLocal%\pip\cache\http\2\3\b\{username}
%AppDataLocal%\pip\cache\http\4\e\e\3\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\weave\{username}
%System Root%\Users\All Users\Microsoft\Windows\Ringtones\{username}.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\{username}
%System Root%\Python27\include\grammar.h.KEKW
%AppDataLocal%\pip\cache\http\2\3\{username}
%System Root%\excel2k\XLS2KE04.xls.KEKW
%All Users Profile%\Microsoft\Assistance\Client\1.0\en-US\{username}
%All Users Profile%\Microsoft\User Account Pictures\{username}.dat.KEKW
%System Root%\Python27\Lib\test\formatfloat_testcases.txt.KEKW
%System Root%\Python27\tcl\tcl8\{username}
%AppDataLocal%\Microsoft\Windows Media\12.0\{username}
%System Root%\Python27\tcl\tk8.5\ttk\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\{username}.KEKW
%System Root%\Python27\tcl\tix8.4.3\pref\Blue.cs.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\3\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\{username}
%System Root%\Python27\DLLs\{username}
%System Root%\Python27\Lib\idlelib\CREDITS.txt.KEKW
%All Users Profile%\McAfee\{username}
%System Root%\Python27\Lib\email\test\data\msg_39.txt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\41\{username}
%Application Data%\Microsoft\SystemCertificates\My\CTLs\{username}
%System Root%\Users\All Users\VMware\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp.KEKW
%System Root%\Python27\tcl\tcl8.5\encoding\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\46\{username}
%System Root%\Users\All Users\VMware\RawdskCompatibility\{username}.KEKW
%System Root%\Python27\Lib\site-packages\pip\_internal\cli\{username}
%Application Data%\Sun\Java\{username}
%Application Data%\Microsoft\Windows\IEDownloadHistory\{username}
%AppDataLocal%\Python-Eggs\{username}
%AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\RJ6VBH4W.DN2\manifests\{username}
%Application Data%\Microsoft\Windows\IETldCache\{username}
%System Root%\Users\All Users\Adobe\ARM\{username}
%AppDataLocal%Low\Microsoft\Internet Explorer\EmieSiteList\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\{0E1465B0-BA9C-409F-BC32-D934317129CD}\{username}.KEKW
%System Root%\Python27\include\complexobject.h.KEKW
%System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\updates\{username}
%Start Menu%\Programs\Accessories\{username}
%System Root%\Python27\Lib\idlelib\TODO.txt.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Sqm\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\59\{username}
%Application Data%\Microsoft\Windows\IECompatUACache\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\tmp\{username}
%System Root%\Python27\Lib\email\test\data\msg_30.txt.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\70\{username}
%AppDataLocal%\Mozilla\Firefox\{username}
%Application Data%\Identities\{3D0FBFE3-9E5C-4F14-8D00-F0C8FEFA78BA}\{username}
%System Root%\Users\All Users\McAfee\{username}.KEKW
%All Users Profile%\Microsoft\Windows\Caches\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\{username}
%System Root%\Users\All Users\Microsoft\Device Stage\Task\{{GUID}}\{username}
%AppDataLocal%\pip\cache\http\a\1\9\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\Un_A\{username}
%Application Data%\Mozilla\Firefox\Profiles\{username}
%AppDataLocal%\pip\cache\http\b\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\{username}
%System Root%\Python27\Lib\email\test\data\msg_40.txt.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0\{username}
%System Root%\Users\All Users\Microsoft\WwanSvc\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows\{username}.KEKW
%System Root%\powerpoint2k\{username}
%System Root%\Users\All Users\Microsoft\Windows\Sqm\Manifest\{username}.KEKW
%AppDataLocal%\GDIPFONTCACHEV1.DAT.KEKW
%All Users Profile%\VMware\RawdskCompatibility\native\C\ProgramData\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\57\{username}
%AppDataLocal%\pip\cache\http\3\8\9\3\0\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\{username}.KEKW
%System Root%\Python27\tcl\tcl8.5\tzdata\America\Indiana\{username}
%System Root%\Users\All Users\Microsoft\Network\Connections\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\pluginreg.dat.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\{username}.KEKW
%System Root%\Python27\Lib\email\test\data\msg_28.txt.KEKW
%System Root%\Python27\Lib\test\cjkencodings\gbk.txt.KEKW
%All Users Profile%\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_505c7fc25c7e5866de583f14c22e2b4c2a6018c_0a2493a7\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\History\Results\{username}
%System Root%\Users\All Users\Adobe\Setup\{username}.KEKW
%AppDataLocal%\Microsoft\Windows\WebCacheLock.dat.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\23\{username}
%System Root%\Users\All Users\Microsoft\MF\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Assistance\Client\1.0\{username}.KEKW
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Wrinkled_Paper.gif.KEKW
%User Profile%\Documents\powerpoint2k\PPT2KExx.PPT.KEKW
%User Profile%\Documents\word2k\DOC2KE04.doc.KEKW
%System Root%\excel2k\XLS2KE05.xls.KEKW
%System Root%\Python27\Lib\idlelib\Icons\folder.gif.KEKW
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\{username}.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\{username}
%System Root%\Users\All Users\Microsoft\Windows\WER\ReportQueue\{username}
%System Root%\Python27\include\object.h.KEKW
%Start Menu%\Programs\Accessories\System Tools\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\38\{username}
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Quarantine\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\distlib\{username}
%System Root%\word2k\{username}
%Start Menu%\Programs\ImDisk\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\27\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\14\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\Common\SmallInstaller\{username}
%System Root%\Users\{username}\{username}
%All Users Profile%\Microsoft\RAC\PublishedData\{username}
%All Users Profile%\Microsoft\User Account Pictures\user.bmp.KEKW
%System Root%\Python27\include\intrcheck.h.KEKW
%All Users Profile%\VMware\VMware Tools\Unity Filters\visualstudio2005.txt.KEKW
%Desktop%\AAljoOV.jpg.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1D\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\{username}
%AppDataLocal%\Google\Software Reporter Tool\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Support\{username}
%AppDataLocal%\Google\Chrome\User Data\Crashpad\settings.dat.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\{username}.KEKW
%System Root%\Users\Public\Documents\Email and Password List.js.KEKW
%Application Data%\Microsoft\{username}
%System Root%\Users\Default\NTUSER.DAT.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Temp\usgthrsvc\{username}.KEKW
%System Root%\Python27\include\weakrefobject.h.KEKW
%All Users Profile%\McAfee\MCLOGS\{username}
%System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\{username}
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\{username}
%System Root%\Python27\include\bitset.h.KEKW
%System Root%\Users\All Users\Microsoft\RAC\StateData\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Assistance\Client\1.0\{username}
%System Root%\Python27\Lib\unittest\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\{username}
%System Root%\Python27\Lib\test\imghdrdata\python.png.KEKW
%AppDataLocal%\Google\Chrome\User Data\ShaderCache\{username}
%AppDataLocal%\Google\Chrome\User Data\pnacl\0.57.44.2492\{username}
%Application Data%\Microsoft\Windows\IECompatCache\container.dat.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp.KEKW
F:\data\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\History\Store\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\minidumps\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp.KEKW
%All Users Profile%\Microsoft\Windows NT\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\{username}.KEKW
%System Root%\Python27\Lib\email\test\data\msg_18.txt.KEKW
%System Root%\word2k\DOC2KExx.doc.KEKW
%System Root%\Python27\tcl\tcl8.5\tzdata\Antarctica\{username}
%System Root%\Users\All Users\Microsoft\Search\{username}.KEKW
%AppDataLocal%\Google\Chrome\User Data\Safe Browsing\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\America\Kentucky\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\{username}.KEKW
%System Root%\Python27\include\genobject.h.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp.KEKW
%All Users Profile%\Microsoft\Windows\{username}
%AppDataLocal%\Microsoft\Internet Explorer\EmieBrowserModeList\container.dat.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\{0E1465B0-BA9C-409F-BC32-D934317129CD}\{username}
%System Root%\Python27\include\dtoa.h.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\43\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\{username}
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\45\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\ActivityLog\{username}.KEKW
%Application Data%\Microsoft\Internet Explorer\UserData\Low\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3\{username}
%System Root%\Python27\Lib\site-packages\setuptools\_vendor\packaging\{username}
%System Root%\Users\All Users\Microsoft\MSDN\8.0\{username}
%System Root%\Python27\Lib\email\test\data\msg_20.txt.KEKW
%AppDataLocal%\Google\Chrome\User Data\CertificateRevocation\5140\_metadata\{username}
%User Temp%\Guest.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\{username}.KEKW
%User Profile%\Documents\word2k\DOC2KExx.doc.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Inbox\{username}.KEKW
%System Root%\Users\Public\Documents\word2k\{username}
%User Temp%\Deployment\{username}
%AppDataLocal%\pip\cache\http\d\{username}
%System Root%\Users\All Users\Microsoft\Search\{username}
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\safebrowsing\google4\{username}
%System Root%\Users\All Users\Microsoft\MSDN\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\F0\{username}.KEKW
%AppDataLocal%Low\Microsoft\Internet Explorer\{username}
%All Users Profile%\Microsoft\DeviceSync\{username}
%Application Data%\Macromedia\{username}
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\Config\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\40\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Garden.jpg.KEKW
%System Root%\Users\All Users\Oracle\{username}.KEKW
%All Users Profile%\Microsoft\IlsCache\{username}
%System Root%\Python27\Lib\xml\parsers\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp.KEKW
%AppDataLocal%\pip\cache\http\0\2\5\2\b\{username}
%System Root%\word2k\DOC2KE04.doc.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\weave\toFetch\{username}
%All Users Profile%\Microsoft\Device Stage\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Games\{username}
%AppDataLocal%\Microsoft\Internet Explorer\TabRoaming\{username}
%Desktop%\excel2k\XLS2KE02.xls.KEKW
%System Root%\Python27\Lib\lib2to3\Grammar.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\{username}.KEKW
%System Root%\Python27\Lib\test\cjkencodings\iso2022_jp-utf8.txt.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp.KEKW
%All Users Profile%\Adobe\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\17\{username}
F:\data\photos\stunning.jpg.KEKW
%System Root%\Python27\include\memoryobject.h.KEKW
%AppDataLocal%\Microsoft\Office\Groove\System\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\lockfile\{username}
%AppDataLocal%\Microsoft\Internet Explorer\EmieBrowserModeList\{username}
%All Users Profile%\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\{username}
%System Root%\Python27\Lib\test\tracedmodules\{username}
%System Root%\Users\All Users\Microsoft\Windows\GameExplorer\{username}
%System Root%\Python27\tcl\tk8.5\images\tai-ku.gif.KEKW
%User Profile%\Pictures\{username}
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\OfflineCache\{username}
%AppDataLocal%\pip\cache\http\a\1\9\5\3\{username}
%System Root%\Users\Default\Desktop\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\{username}
%System Root%\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\filters\{username}
%All Users Profile%\VMware\RawdskCompatibility\native\regdata.dat.KEKW
%System Root%\Users\All Users\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\{username}
%All Users Profile%\Microsoft\Windows\Templates\{username}
%System Root%\Python27\Lib\ensurepip\{username}
%AppDataLocal%\Microsoft\Internet Explorer\imagestore\joppu72\{username}
%User Temp%\dd_wcf_CA_smci_20161212_135110_351.txt.KEKW
%System Root%\Users\All Users\Microsoft\NetFramework\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\{username}.KEKW
%AppDataLocal%\Google\Chrome\User Data\CertificateRevocation\{username}
%System Root%\Python27\Lib\lib2to3\PatternGrammar.txt.KEKW
%System Root%\Python27\Lib\test\cmath_testcases.txt.KEKW
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\cache2\{username}
%System Root%\Users\All Users\McAfee\WinCore\{username}.KEKW
%AppDataLocal%\Google\Chrome\User Data\FileTypePolicies\34\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Service\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows\WER\ReportQueue\{username}.KEKW
%System Root%\Python27\Lib\email\test\data\msg_25.txt.KEKW
%System Root%\Users\All Users\VMware\RawdskCompatibility\{username}
%System Root%\Python27\tcl\tix8.4.3\pref\Gray.cs.KEKW
%AppDataLocal%\Microsoft\Office\{username}
%AppDataLocal%\Microsoft\Windows\History\Low\{username}
%System Root%\Python27\include\symtable.h.KEKW
%System Root%\Python27\tcl\tix8.4.3\pref\{username}
%AppDataLocal%\Google\Chrome\User Data\PepperFlash\{username}
%System Root%\Python27\tcl\tk8.5\{username}
%Desktop%\powerpoint2k\PPT2KE01.ppt.KEKW
%All Users Profile%\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Administrative Tools\{username}
%AppDataLocal%\Microsoft\Windows\GameExplorer\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\AlternateServices.txt.KEKW
%System Root%\Users\All Users\Oracle\Java\{username}
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\{username}
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\{username}
%System Root%\Python27\Lib\unittest\test\{username}
%System Root%\Python27\Lib\test\ieee754.txt.KEKW
%System Root%\Python27\Tools\webchecker\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\cachecontrol\caches\{username}
%AppDataLocal%\Python-Eggs\Python-Eggs\Cache\pillow-4.1.0-py2.7-win32.egg-tmp\PIL\{username}
%System Root%\Python27\include\{username}
%System Root%\Python27\Lib\email\test\data\msg_10.txt.KEKW
%System Root%\Users\All Users\Adobe\ARM\{username}.KEKW
%System Root%\Python27\include\tupleobject.h.KEKW
%Application Data%\Microsoft\SystemCertificates\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\{username}
%AppDataLocal%\Apps\2.0\{username}
%System Root%\Users\All Users\Adobe\ARM\Reader_19.010.20099\{username}
%AppDataLocal%\Microsoft\Windows Sidebar\Gadgets\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Notebook.jpg.KEKW
%All Users Profile%\Microsoft\Media Player\{username}
%All Users Profile%\Microsoft\MSDN\8.0\{username}
%AppDataLocal%\pip\cache\http\f\e\{username}
%User Profile%\Documents\fp_18.0.0.203_archive\{username}
%System Root%\Python27\include\bufferobject.h.KEKW
%System Root%\Users\Public\Documents\word2k\DOC2KE03.doc.KEKW
%System Root%\Python27\Tools\pynche\namedcolors.txt.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\crashes\events\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01\{username}
%Application Data%\Microsoft\Windows\IETldCache\container.dat.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\{username}
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\{username}
%AppDataLocal%\Microsoft\Media Player\Sync Playlists\en-US\00007196\{username}
%User Profile%\Documents\powerpoint2k\{username}
%System Root%\Python27\Lib\test\cjkencodings\euc_jisx0213.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSScan\{username}
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\{username}
%System Root%\Users\All Users\Microsoft\Device Stage\Task\{{GUID}}\en-US\{username}.KEKW
%All Users Profile%\Microsoft\Network\Connections\{username}
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\{username}
%System Root%\Python27\Lib\xml\dom\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\SystemV\{username}
%AppDataLocal%\Google\Chrome\User Data\SSLErrorAssistant\7\{username}
%All Users Profile%\Oracle\Java\.oracle_jre_usage\{username}
%AppDataLocal%\Microsoft\Windows Mail\Backup\new\{username}
%Desktop%\powerpoint2k\{username}
%System Root%\Users\All Users\Mozilla\updates\{username}
%System Root%\Python27\Lib\test\cjkencodings\big5-utf8.txt.KEKW
%AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\RJ6VBH4W.DN2\{username}
%AppDataLocal%\Microsoft\Media Player\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\{username}
%System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_72da1383309c93bd2441accd728cf953e4fa97a_0a24a840\{username}.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\bookmarkbackups\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\{username}.KEKW
%System Root%\Users\All Users\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\{username}
%System Root%\Python27\Lib\email\test\data\msg_42.txt.KEKW
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-child-current.bin.KEKW
%AppDataLocal%\Google\Chrome\User Data\CertificateRevocation\5140\{username}
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\{username}
%AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{4555A5E7-C06D-11E6-8AB1-005056BC3E18}.dat.KEKW
%All Users Profile%\Microsoft\Windows\WER\{username}
%All Users Profile%\McAfee\MCLOGS\SmallInstaller\{username}
%Application Data%\Microsoft\Windows\Libraries\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\3561288849sdhlie.files\{username}
%AppDataLocal%\Google\Chrome\User Data\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\{username}
%System Root%\Python27\tcl\tix8.4.3\bitmaps\no_entry.gif.KEKW
%System Root%\Users\All Users\VMware\RawdskCompatibility\virtual\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\{username}
%AppDataLocal%Low\Sun\Java\Deployment\security\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\{username}
%System Root%\Python27\include\parsetok.h.KEKW
%System Root%\Python27\Lib\test\cjkencodings\{username}
%User Temp%\Adobe_ADMLogs\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp.KEKW
%System Root%\Users\Public\Favorites\{username}
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\GatherLogs\{username}
%User Profile%\Documents\fp_18.0.0.203_archive.zip.KEKW
%Application Data%\Microsoft\Protect\{username}
%AppDataLocal%\Google\Chrome\User Data\FileTypePolicies\{username}
%System Root%\Users\{username}\Videos\{username}
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\container.dat.KEKW
%System Root%\Python27\include\listobject.h.KEKW
%System Root%\Users\All Users\Microsoft\Vault\{username}.KEKW
%All Users Profile%\Microsoft\NetFramework\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Roses.jpg.KEKW
%System Root%\Python27\tcl\tix8.4.3\pref\WmDefault.txt.KEKW
%System Root%\Python27\Lib\email\test\data\msg_12.txt.KEKW
%User Temp%\WebInstaller\{username}
%AppDataLocal%\Microsoft\Windows Mail\Backup\{username}
%System Root%\Python27\tcl\dde1.3\{username}
%System Root%\Python27\Tools\pynche\README.txt.KEKW
%System Root%\Python27\Lib\xml\{username}
%AppDataLocal%\Microsoft\Feeds Cache\{username}
%System Root%\Python27\Lib\email\test\data\msg_03.txt.KEKW
%All Users Profile%\Microsoft\Windows\Start Menu\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp.KEKW
%System Root%\Python27\Lib\json\tests\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\HandPrints.jpg.KEKW
%Application Data%\Microsoft\Proof\{username}
%System Root%\Python27\Tools\versioncheck\README.txt.KEKW
%AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\_metadata\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Tablet PC\{username}.KEKW
%All Users Profile%\Microsoft\Windows NT\MSFax\{username}
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\9IWSW3EX\{username}
%System Root%\Python27\include\objimpl.h.KEKW
%System Root%\Python27\Lib\test\cjkencodings\big5hkscs-utf8.txt.KEKW
%System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\{username}.KEKW
%Desktop%\word2k\DOC2KExx.doc.KEKW
%Application Data%\Macromedia\Flash Player\macromedia.com\support\{username}
%All Users Profile%\Mozilla\updates\{username}
%System Root%\Python27\Lib\site-packages\setuptools\{username}
%System Root%\Python27\include\pyexpat.h.KEKW
%System Root%\Python27\Tools\Scripts\{username}
%System Root%\Users\Public\Videos\{username}
%User Profile%\Documents\word2k\DOC2KE05.doc.KEKW
%System Root%\Python27\Lib\idlelib\help.html.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Sqm\Sessions\{username}.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp.KEKW
%All Users Profile%\VMware\VMware Tools\Unity Filters\adobephotoshopcs3.txt.KEKW
%System Root%\Python27\include\cobject.h.KEKW
%System Root%\Python27\tcl\tcl8.5\tzdata\Indian\{username}
%System Root%\Users\{username}\AppData\Local\Microsoft\{username}
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KE02.ppt.KEKW
%User Temp%\dd_SetupUtility.txt.KEKW
%System Root%\Python27\tcl\tcl8.5\tzdata\US\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\11\{username}
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\15\{username}
%System Root%\Users\Public\Documents\word2k\DOC2KE01.doc.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\51\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg.KEKW
%System Root%\Python27\Lib\test\xmltestdata\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\SecurityPreloadState.txt.KEKW
%User Temp%\dd_vcredistMSI0FC1.txt.KEKW
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\urlCache-current.bin.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\packages\ssl_match_hostname\{username}
%Application Data%\Microsoft\Internet Explorer\UserData\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A\{username}
%System Root%\Users\All Users\Microsoft\Windows\Power Efficiency Diagnostics\{username}
%Application Data%\Mozilla\Firefox\Crash Reports\{username}
%System Root%\Users\All Users\Oracle\Java\{username}.KEKW
%System Root%\Python27\tcl\tix8.4.3\bitmaps\openfold.gif.KEKW
%System Root%\Python27\include\ceval.h.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95\{username}.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\_trie\{username}
%All Users Profile%\Microsoft\User Account Pictures\guest.bmp.KEKW
%AppDataLocal%\pip\cache\http\5\4\3\d\7\{username}
%System Root%\Users\Default\AppData\Local\Microsoft\Windows\GameExplorer\{username}
%System Root%\Users\All Users\Microsoft\WwanSvc\Profiles\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Python 2.7\{username}
%System Root%\Users\Public\Documents\excel2k\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\sessionstore-backups\{username}
%System Root%\Python27\include\pymacconfig.h.KEKW
%Application Data%\Microsoft\Windows\IECompatCache\Low\{username}
%System Root%\Python27\Lib\sqlite3\{username}
%AppDataLocal%\pip\cache\http\{username}
%System Root%\Python27\Lib\lib-tk\test\test_ttk\{username}
%System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\entry_points.txt.KEKW
%System Root%\Python27\Scripts\{username}
%System Root%\Python27\tcl\tcl8.5\{username}
%Application Data%\Microsoft\Windows\Recent\{username}
%AppDataLocal%\Microsoft\Feeds Cache\JPOHUSHF\{username}
%System Root%\Python27\Lib\test\exception_hierarchy.txt.KEKW
%System Root%\$Recycle.Bin\S-1-5-21-2407829820-1079796033-203259571-1000\{username}
%All Users Profile%\Microsoft\Windows\Sqm\Manifest\{username}
%User Temp%\{username}.bmp.KEKW
%AppDataLocal%\Microsoft\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp.KEKW
%Application Data%\Microsoft\Internet Explorer\Quick Launch\User Pinned\{username}
F:\data\tmp.doc.KEKW
%System Root%\Python27\Lib\lib2to3\tests\data\fixers\myfixes\{username}
%Favorites%\{username}
%System Root%\Users\All Users\Microsoft\RAC\PublishedData\{username}.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\certifi\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\{username}
%System Root%\Users\Public\Documents\excel2k\XLS2KE05.xls.KEKW
%All Users Profile%\Mozilla\updates\308046B0AF4A39CB\updates\0\{username}
%Application Data%\Macromedia\Flash Player\#SharedObjects\K48846QH\{username}
F:\data\photos\long_exposure.jpg.KEKW
%User Profile%\Links\{username}
%System Root%\Python27\libs\{username}
%System Root%\Users\Public\Documents\Email and Password List.txt.KEKW
%AppDataLocal%\Microsoft\Media Player\Sync Playlists\en-US\{username}
%All Users Profile%\VMware\VMware Tools\Unity Filters\googledesktop.txt.KEKW
%System Root%\Python27\Lib\importlib\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\43\{username}.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\6\{username}
%System Root%\Python27\include\structmember.h.KEKW
%System Root%\Users\All Users\Microsoft\Windows\DeviceMetadataStore\en-US\{username}.KEKW
%System Root%\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\packages\backports\{username}
%AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\{username}
%System Root%\Python27\include\metagrammar.h.KEKW
%System Root%\Users\All Users\Microsoft\DRM\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\{username}.KEKW
%AppDataLocal%\Apps\2.0\Data\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\21\{username}
%System Root%\Python27\Lib\idlelib\{username}
%System Root%\Users\All Users\Oracle\Java\javapath_target_313094\{username}
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\Backup\{username}.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\EmieSiteList\{username}
%AppDataLocal%\pip\cache\http\b\a\9\{username}
%System Root%\Python27\Lib\email\test\data\msg_34.txt.KEKW
%System Root%\Python27\include\floatobject.h.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\idna\{username}
%All Users Profile%\VMware\VMware Tools\Unity Filters\microsoftoffice2003.txt.KEKW
%Application Data%\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\{username}
%Desktop%\word2k\DOC2KE02.doc.KEKW
%Application Data%\Microsoft\Windows\Network Shortcuts\{username}
%Application Data%\Microsoft\Templates\{username}
%System Root%\Python27\tcl\tix8.4.3\bitmaps\plusarm.gif.KEKW
%All Users Profile%\Microsoft\Assistance\{username}
%System Root%\Python27\Lib\msilib\{username}
%System Root%\Python27\Lib\idlelib\help.txt.KEKW
%User Temp%\dd_vcredistUI0FC1.txt.KEKW
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\{username}
%System Root%\Python27\tcl\tk8.5\demos\{username}
%System Root%\Python27\tcl\tix8.4.3\pref\TK.cs.KEKW
%System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\{username}.KEKW
%AppDataLocal%\Microsoft\Vault\{username}
%Application Data%\{username}
%AppDataLocal%\Microsoft\Windows\AppCache\6A582BR6\{username}
%System Root%\Users\All Users\Microsoft\Device Stage\Task\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\20\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\{username}.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\LastBld.dat.KEKW
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\{username}
%All Users Profile%\VMware\RawdskCompatibility\virtual\{username}
%AppDataLocal%\Google\Software Reporter Tool\settings.dat.KEKW
%System Root%\Python27\Lib\email\test\{username}
%System Root%\Python27\include\datetime.h.KEKW
%All Users Profile%\Microsoft\eHome\logs\{username}
%System Root%\Users\All Users\Oracle\Java\.oracle_jre_usage\{username}.KEKW
%System Root%\Python27\Lib\test\imghdrdata\python.gif.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F0\{username}.KEKW
%All Users Profile%\Microsoft\Windows Defender\LocalCopy\{username}
%System Root%\Python27\Lib\test\cjkencodings\shift_jis.txt.KEKW
%System Root%\Users\Public\Recorded TV\{username}
%AppDataLocal%\Google\Chrome\User Data\Subresource Filter\{username}
%System Root%\Python27\Lib\site-packages\pkg_resources\_vendor\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\43\{username}
%Application Data%\Microsoft\Windows\DNTException\{username}
%Favorites%\Links for United States\{username}
%System Root%\powerpoint2k\PPT2KE03.ppt.KEKW
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Temp\usgthrsvc\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp.KEKW
%System Root%\Users\Public\Documents\word2k\DOC2KE05.doc.KEKW
%Application Data%\Microsoft\SystemCertificates\My\Keys\{username}
%System Root%\Users\Default\AppData\Local\Microsoft\Windows\History\{username}
%System Root%\Users\All Users\Microsoft\RAC\StateData\{username}
%Desktop%\word2k\DOC2KE04.doc.KEKW
%System Root%\Users\{username}\AppData\Roaming\{username}
%System Root%\Python27\Lib\email\test\data\{username}
%System Root%\Python27\include\cellobject.h.KEKW
%System Root%\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\{username}
%User Profile%\Videos\{username}
%User Temp%\Microsoft .NET Framework 4.5.2 Setup_20161212_135033207-MSI_netfx_Full_GDR_x64.msi.txt.KEKW
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\{username}
%AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\_platform_specific\{username}
%System Root%\Python27\Tools\pynche\html40colors.txt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\9\{username}
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\82DF2NUK\{username}
%System Root%\Python27\Lib\test\sgml_input.html.KEKW
%AppDataLocal%\Microsoft\Feeds\{username}
%System Root%\Users\All Users\Microsoft\Windows NT\{username}.KEKW
%System Root%\Python27\include\pycapsule.h.KEKW
%System Root%\Python27\Lib\email\test\data\msg_24.txt.KEKW
%System Root%\Python27\include\pystrtod.h.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\EmieUserList\container.dat.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Entries\{username}
%Application Data%\Microsoft\Windows\PrivacIE\container.dat.KEKW
%All Users Profile%\Microsoft\Windows NT\MSFax\Queue\{username}
%System Root%\Users\All Users\Microsoft\OFFICE\{username}
%System Root%\Python27\Lib\test\test_doctest2.txt.KEKW
%System Root%\Python27\include\abstract.h.KEKW
%System Root%\Python27\Lib\site-packages\Pillow-6.0.0.dist-info\top_level.txt.KEKW
%AppDataLocal%Low\Microsoft\Windows\AppCache\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\47\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\Common\{username}
%All Users Profile%\Microsoft\Windows Defender\Definition Updates\{username}
%System Root%\Python27\Lib\test\test_difflib_expect.html.KEKW
%User Profile%\Documents\excel2k\XLS2KE01.xls.KEKW
%User Profile%\Downloads\{username}
%System Root%\Python27\Lib\test\testtar.tar.KEKW
%Application Data%\Microsoft\Windows\IECompatUACache\container.dat.KEKW
%System Root%\$Recycle.Bin\{username}
%User Profile%\Searches\{username}
%System Root%\Python27\README.txt.KEKW
%All Users Profile%\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\{username}
%AppDataLocal%\Microsoft\Internet Explorer\DomainSuggestions\{username}
%User Profile%\Documents\fp_18.0.0.203_archive\18_0_r0_203\{username}
%System Root%\Python27\tcl\tix8.4.3\demos\bitmaps\tix.gif.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\SentItems\{username}
%System Root%\Python27\Lib\test\cjkencodings\big5.txt.KEKW
%System Root%\Python27\Lib\lib-tk\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\chardet\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp.KEKW
%Desktop%\Transmag.doc.KEKW
%All Users Profile%\VMware\VMware Tools\Unity Filters\{username}
%Favorites%\Microsoft Websites\{username}
%System Root%\Python27\Lib\site-packages\pkg_resources\_vendor\packaging\{username}
%System Root%\Python27\include\longintrepr.h.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\58\{username}
%All Users Profile%\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\{username}
%System Root%\Python27\Lib\email\test\data\msg_43.txt.KEKW
%AppDataLocal%\pip\{username}
%AppDataLocal%\Google\Chrome\User Data\Crashpad\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows\DRM\{username}
%System Root%\Python27\Lib\ctypes\test\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp.KEKW
%AppDataLocal%\Google\Chrome\User Data\Crashpad\reports\{username}
%System Root%\Users\Public\Pictures\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\26\{username}
%Favorites%\Windows Live\{username}
%System Root%\Python27\tcl\tix8.4.3\bitmaps\warning.gif.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0\{username}.KEKW
%System Root%\Python27\include\pyconfig.h.KEKW
%System Root%\Users\All Users\McAfee\{username}
%Application Data%\Microsoft\Windows\PrivacIE\{username}
%System Root%\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.KEKW
%All Users Profile%\Oracle\Java\javapath\{username}
%System Root%\Users\All Users\Microsoft\MSDN\{username}.KEKW
%System Root%\Users\All Users\McAfee\WinCore\{username}
%AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Indexed Rules\25\9.1\{username}
%System Root%\Python27\Lib\pydoc_data\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A\{username}.KEKW
%System Root%\Python27\tcl\tcl8.5\msgs\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5\{username}
%All Users Profile%\Microsoft\Windows\DRM\Cache\{username}
%System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\{username}
%All Users Profile%\Microsoft\Network\Downloader\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\progress\{username}
%User Temp%\chrome_BITS_3756_19263\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\pytoml\{username}
%System Root%\Users\All Users\Microsoft\RAC\Outbound\{username}.KEKW
%System Root%\Users\All Users\Microsoft\RAC\Temp\{username}
%System Root%\Python27\Lib\email\test\data\msg_16.txt.KEKW
%System Root%\Users\Default\AppData\Local\Microsoft\Windows\{username}
%Application Data%\Mozilla\{username}
%Application Data%\Microsoft\Windows\IECompatUACache\Low\container.dat.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\datareporting\archived\{username}
%System Root%\Users\All Users\Microsoft\Windows\DRM\{username}.KEKW
%System Root%\Python27\Lib\wsgiref\{username}
%System Root%\Users\All Users\Microsoft\Network\Downloader\{username}
%User Profile%\Documents\excel2k\{username}
%User Profile%\Documents\fp_18.0.0.203_archive\18_0_r0_203_debug\{username}
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\{username}.KEKW
%System Root%\Python27\Lib\ensurepip\_bundled\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp.KEKW
%All Users Profile%\Oracle\Java\javapath_target_313094\{username}.KEKW
%User Profile%\Documents\powerpoint2k\PPT2KE03.ppt.KEKW
%AppDataLocal%\pip\cache\http\2\3\b\7\9\{username}
%All Users Profile%\Microsoft\OFFICE\{username}
%System Root%\Python27\Lib\lib2to3\tests\data\{username}
%System Root%\Python27\Lib\idlelib\Icons\openfolder.gif.KEKW
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KE01.ppt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\54\{username}
%All Users Profile%\Microsoft\Windows NT\MSFax\VirtualInbox\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\62\{username}
%System Root%\Users\All Users\Oracle\Java\.oracle_jre_usage\{username}
%System Root%\Python27\include\compile.h.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0\{username}
%Application Data%\Microsoft\Windows\{username}
%System Root%\powerpoint2k\PPT2KE05.ppt.KEKW
%System Root%\Users\Default\AppData\Local\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\SSScheduler\{username}.KEKW
%AppDataLocal%\{username}
%System Root%\Users\All Users\Microsoft\DeviceSync\{username}
F:\{username}
%System Root%\Python27\Lib\idlelib\Icons\tk.gif.KEKW
%AppDataLocal%\Google\Chrome\User Data\RecoveryImproved\{username}
%System Root%\Python27\Tools\Scripts\README.txt.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\EmieSiteList\container.dat.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\5\{username}
%All Users Profile%\Microsoft\Network\{username}
%System Root%\Python27\Lib\test\cjkencodings\iso2022_kr.txt.KEKW
%Application Data%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\{username}
%System Root%\Python27\tcl\tk8.5\demos\images\earth.gif.KEKW
%System Root%\Python27\tcl\tcl8.5\tzdata\Mexico\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5\{username}.KEKW
%All Users Profile%\Microsoft\Windows\DRM\blackbox.bin.KEKW
%System Root%\Python27\tcl\tk8.5\images\pwrdLogo100.gif.KEKW
%User Profile%\Documents\word2k\DOC2KE03.doc.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\{username}.KEKW
%System Root%\Python27\Lib\email\test\data\msg_33.txt.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp.KEKW
%System Root%\Python27\include\pymath.h.KEKW
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KE05.ppt.KEKW
%System Root%\Python27\include\methodobject.h.KEKW
%System Root%\Python27\Lib\site-packages\pkg_resources\{username}
%Application Data%\Mozilla\Firefox\Pending Pings\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\TRRBlacklist.txt.KEKW
%System Root%\Users\All Users\Oracle\Java\installcache_x64\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp.KEKW
%AppDataLocal%\Google\Chrome\User Data\SSLErrorAssistant\{username}
%System Root%\Python27\Lib\email\test\data\msg_01.txt.KEKW
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Stars.jpg.KEKW
%All Users Profile%\Microsoft\Windows Defender\{username}
%AppDataLocal%Low\Microsoft\Internet Explorer\EmieBrowserModeList\container.dat.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Temp\{username}.KEKW
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\SSScheduler\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\cachecontrol\{username}
%System Root%\Python27\Lib\bsddb\{username}
%All Users Profile%\Adobe\Setup\{username}
%User Temp%\jawshtml.html.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp.KEKW
%System Root%\Users\All Users\Oracle\Java\javapath\{username}
%AppDataLocal%\Python-Eggs\Python-Eggs\Cache\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\webencodings\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\weave\failed\{username}
%System Root%\Users\All Users\Microsoft\RAC\{username}
%System Root%\Users\All Users\VMware\VMware Tools\Unity Filters\{username}.KEKW
%AppDataLocal%\pip\cache\http\f\e\d\0\{username}
%System Root%\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg.KEKW
%AppDataLocal%\Microsoft\Windows\History\Low\History.IE5\container.dat.KEKW
%System Root%\Users\All Users\Mozilla\{username}
%All Users Profile%\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.KEKW
%Desktop%\powerpoint2k\PPT2KExx.PPT.KEKW
%System Root%\Python27\Lib\site-packages\setuptools\extern\{username}
%AppDataLocal%\Microsoft\Internet Explorer\UrlBlockManager\{username}
%AppDataLocal%\Mozilla\Firefox\Profiles\{username}
%System Root%\Python27\tcl\tcl8\8.4\{username}
%All Users Profile%\Microsoft\Windows Defender\Support\{username}
%User Profile%\Music\{username}
%All Users Profile%\Microsoft\Assistance\Client\1.0\{username}
%Application Data%\Identities\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Stucco.gif.KEKW
%System Root%\{username}
%System Root%\Python27\include\structseq.h.KEKW
%System Root%\Python27\include\ucnhash.h.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\60\{username}
%System Root%\Python27\Lib\site-packages\pip\_internal\req\{username}
%System Root%\Python27\Lib\{username}
%System Root%\Python27\Lib\json\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\History\CacheManager\{username}
%System Root%\Python27\include\bytes_methods.h.KEKW
%System Root%\Users\Default\Favorites\{username}
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp.KEKW
%System Root%\Python27\Lib\lib-tk\test\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\{username}
%System Root%\Python27\Lib\ctypes\macholib\{username}
%System Root%\Python27\include\errcode.h.KEKW
%All Users Profile%\Microsoft\Search\{username}
%System Root%\Python27\Lib\site-packages\{username}
%User Temp%\mozilla-temp-files\{username}
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp.KEKW
%System Root%\Python27\include\bytearrayobject.h.KEKW
%AppDataLocal%\Microsoft\Windows Sidebar\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\{username}
%AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Active\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\SmallInstaller\{username}.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\imagestore\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\Europe\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\VMware\VMware Tools\{username}
%Desktop%\word2k\DOC2KE03.doc.KEKW
%System Root%\Python27\tcl\tix8.4.3\pref\TkWin.cs.KEKW
%System Root%\Python27\tcl\tk8.5\images\pwrdLogo75.gif.KEKW
%System Root%\Python27\Tools\webchecker\README.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\Chile\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\{username}
%AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Pine_Lumber.jpg.KEKW
%Application Data%\Microsoft\SystemCertificates\My\Certificates\{username}
%AppDataLocal%\Microsoft\Windows\History\Low\History.IE5\{username}
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\safebrowsing\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp.KEKW
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Small_News.jpg.KEKW
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KE04.ppt.KEKW
%Favorites%\Links\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\{username}.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\63\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Temp\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Resource\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\{username}
%System Root%\Python27\include\opcode.h.KEKW
%All Users Profile%\Microsoft\Windows\GameExplorer\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\70\{username}
%AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\RJ6VBH4W.DN2\clic...exe_9ae46cec200785df_0001.0003_none_d631acba18f736d8\{username}
%System Root%\Python27\Lib\test\cjkencodings\hz-utf8.txt.KEKW
%System Root%\Python27\Lib\email\test\data\PyBanner048.gif.KEKW
%System Root%\Python27\Lib\idlelib\Icons\plusnode.gif.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\16\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\McCHSvc\{username}
%System Root%\Python27\Tools\i18n\{username}
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache.bin.KEKW
%All Users Profile%\Microsoft\Windows NT\MSFax\Inbox\{username}
%System Root%\Users\All Users\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\{username}.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\30\{username}
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\{username}
%System Root%\Python27\include\sliceobject.h.KEKW
%System Root%\Python27\Lib\email\test\data\msg_06.txt.KEKW
%System Root%\Users\All Users\McAfee\MCLOGS\{username}
%AppDataLocal%\Microsoft\Feeds Cache\CRAV926P\{username}
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\{username}.KEKW
%System Root%\Python27\include\warnings.h.KEKW
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\{username}
%System Root%\Users\All Users\Oracle\{username}
%System Root%\Python27\Tools\pynche\websafe.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\Updates\{username}.KEKW
%All Users Profile%\Microsoft\Windows\DeviceMetadataStore\{username}
%System Root%\Python27\include\rangeobject.h.KEKW
%AppDataLocal%\Google\Chrome\User Data\WidevineCdm\{username}
%System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_505c7fc25c7e5866de583f14c22e2b4c2a6018c_0a2493a7\{username}.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\{username}
%AppDataLocal%\pip\cache\http\d\3\7\{username}
%All Users Profile%\Microsoft\{username}
%System Root%\Python27\Lib\test\imghdrdata\python.jpg.KEKW
%All Users Profile%\Microsoft\Windows\WER\ReportArchive\{username}
%System Root%\excel2k\XLS2KE01.xls.KEKW
%AppDataLocal%\Microsoft\Credentials\{username}
%All Users Profile%\Microsoft\Device Stage\Task\{{GUID}}\en-US\{username}
%All Users Profile%\Microsoft\Windows\Power Efficiency Diagnostics\energy-report.html.KEKW
%User Temp%\hsperfdata_{username}\{username}
%AppDataLocal%\pip\cache\http\3\{username}
%System Root%\Recovery\{username}
%AppDataLocal%\pip\cache\http\a\6\9\b\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\48\{username}
%All Users Profile%\Microsoft\Network\Downloader\qmgr1.dat.KEKW
%System Root%\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\VMware Tools\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1D\{username}
%System Root%\Python27\Lib\lib-tk\test\test_tkinter\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Quick\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01\{username}
%System Root%\Python27\tcl\tk8.5\demos\images\tcllogo.gif.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1D\{username}.KEKW
%All Users Profile%\Microsoft\User Account Pictures\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\{username}
%System Root%\Users\Public\Music\Sample Music\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp.KEKW
%System Root%\Python27\include\frameobject.h.KEKW
%AppDataLocal%\pip\cache\http\a\6\{username}
%System Root%\Python27\include\token.h.KEKW
%System Root%\Python27\include\sysmodule.h.KEKW
%All Users Profile%\Microsoft\OFFICE\Groove\{username}
%System Root%\Users\All Users\Adobe\{username}.KEKW
%AppDataLocal%\Google\Chrome\User Data\pnacl\{username}
%System Root%\Python27\include\node.h.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3\{username}.KEKW
%AppDataLocal%\Google\Software Reporter Tool\reports\{username}
%All Users Profile%\Microsoft\MF\{username}
%System Root%\Users\All Users\Microsoft\eHome\logs\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Startup\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Service\{username}
%System Root%\Python27\Lib\lib2to3\tests\data\fixers\{username}
%System Root%\Users\All Users\Microsoft\Windows\WER\{username}.KEKW
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\McCHSvc\{username}.KEKW
%Application Data%\Microsoft\Windows\Recent\AutomaticDestinations\{username}
%Application Data%\Microsoft\Internet Explorer\Quick Launch\{username}
%System Root%\Python27\Lib\email\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0\{username}
%System Root%\Python27\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47\{username}.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\29\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\distlib\_backport\{username}
%All Users Profile%\VMware\RawdskCompatibility\native\{username}
%System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\updates\0\{username}
%System Root%\Users\All Users\Microsoft\Assistance\{username}
%System Root%\Python27\Lib\tkinter\{username}
%System Root%\Python27\include\boolobject.h.KEKW
%System Root%\Users\Default\AppData\Roaming\Media Center Programs\{username}
%AppDataLocal%\Google\Chrome\User Data\SSLErrorAssistant\7\_metadata\{username}
%System Root%\Python27\include\pyfpe.h.KEKW
%AppDataLocal%\pip\cache\http\f\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp.KEKW
%Desktop%\excel2k\XLS2KExx.xls.KEKW
%AppDataLocal%\Microsoft\Windows\AppCache\6A582BR6\container.dat.KEKW
%System Root%\Python27\Lib\tkinter\test\{username}
%Application Data%\Microsoft\Document Building Blocks\{username}
%AppDataLocal%\Microsoft\Windows\WER\{username}
%All Users Profile%\Microsoft\Search\Data\Temp\usgthrsvc\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\datareporting\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Tanspecks.jpg.KEKW
%AppDataLocal%\pip\cache\http\a\{username}
%System Root%\Python27\include\pystate.h.KEKW
%Application Data%\Sun\{username}
%AppDataLocal%\Google\Chrome\User Data\InterventionPolicyDatabase\{username}
%System Root%\Users\All Users\Microsoft\Windows\GameExplorer\{username}.KEKW
%System Root%\Python27\Tools\versioncheck\{username}
%System Root%\Users\All Users\Microsoft\DRM\Server\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\10\{username}
%System Root%\Python27\tcl\tix8.4.3\bitmaps\plus.gif.KEKW
%System Root%\Users\Public\Downloads\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Tablet PC\{username}
%System Root%\Python27\include\moduleobject.h.KEKW
%Desktop%\excel2k\XLS2KE05.xls.KEKW
%System Root%\Python27\Lib\site-packages\pip\_internal\utils\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\Common\SmallInstaller\{username}.KEKW
%System Root%\Users\Default\Saved Games\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp.KEKW
%AppDataLocal%Low\Microsoft\Windows\{username}
%AppDataLocal%\pip\cache\http\a\6\9\{username}
%System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_505c7fc25c7e5866de583f14c22e2b4c2a6018c_0a2493a7\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\{username}.KEKW
%System Root%\Python27\Lib\site-packages\pip\_internal\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\43\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01\{username}.KEKW
%Application Data%\Microsoft\AddIns\{username}
%Desktop%\excel2k\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Sand_Paper.jpg.KEKW
%AppDataLocal%\pip\cache\http\4\e\e\3\1\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\{username}
%System Root%\Python27\Lib\site-packages\PIL\{username}
%System Root%\Python27\include\cStringIO.h.KEKW
%Application Data%\Microsoft\Windows\IECompatCache\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\{username}.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp.KEKW
%All Users Profile%\Microsoft\Windows\DeviceMetadataStore\en-US\{username}
%All Users Profile%\VMware\{username}
%System Root%\Users\Default\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\{username}
%AppDataLocal%\pip\cache\http\d\3\7\e\{username}
%AppDataLocal%Low\Sun\Java\Deployment\log\{username}
%All Users Profile%\Microsoft\RAC\{username}
%System Root%\Users\All Users\VMware\VMware Tools\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\chardet\cli\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\55\{username}
%User Profile%\Documents\excel2k\XLS2KE04.xls.KEKW
%System Root%\Python27\Lib\test\cjkencodings\euc_kr.txt.KEKW
%All Users Profile%\Microsoft\Windows NT\MSFax\SentItems\{username}
%System Root%\Email and Password List.js.KEKW
%System Root%\Users\All Users\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\{username}.KEKW
%All Users Profile%\Microsoft\eHome\{username}
%System Root%\PerfLogs\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\crashes\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp.KEKW
%All Users Profile%\Microsoft\RAC\StateData\{username}
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Queue\{username}
%System Root%\Users\Public\Documents\excel2k\XLS2KE03.xls.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\{username}.KEKW
%System Root%\Python27\Lib\idlelib\Icons\idle_16.gif.KEKW
%Application Data%\Microsoft\Windows\IECompatUACache\Low\{username}
%System Root%\Users\All Users\Microsoft\Windows\Templates\{username}.KEKW
%System Root%\Python27\Lib\email\test\data\msg_14.txt.KEKW
%System Root%\Python27\include\timefuncs.h.KEKW
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\{username}.KEKW
%AppDataLocal%\Apps\2.0\Data\RNQG94OQ.QJC\{username}
%AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Indexed Rules\25\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\{username}.KEKW
%AppDataLocal%Low\Microsoft\Internet Explorer\Services\{username}
%System Root%\Users\All Users\Microsoft\Windows\Sqm\Upload\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Network\Downloader\{username}.KEKW
%System Root%\Python27\tcl\tk8.5\images\{username}
%System Root%\Python27\Lib\lib2to3\{username}
%System Root%\Python27\Lib\site-packages\pkg_resources\extern\{username}
%System Root%\Users\All Users\{username}
%AppDataLocal%\Microsoft\Windows\WER\ReportQueue\{username}
%All Users Profile%\Microsoft\Search\Data\{username}
%AppDataLocal%\pip\cache\http\4\e\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\{username}
%System Root%\Python27\Lib\ctypes\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\colorama\{username}
%All Users Profile%\McAfee\MCLOGS\Common\{username}
%System Root%\Python27\Lib\multiprocessing\dummy\{username}
%Application Data%\Microsoft\Windows\IETldCache\Low\{username}
%System Root%\Python27\include\longobject.h.KEKW
%System Root%\Python27\Lib\test\cjkencodings\iso2022_jp.txt.KEKW
%System Root%\Python27\Lib\tkinter\test\test_ttk\{username}
%System Root%\Users\All Users\Oracle\Java\installcache_x64\{username}.KEKW
%System Root%\Python27\Lib\test\cjkencodings\euc_jisx0213-utf8.txt.KEKW
%AppDataLocal%\pip\cache\http\2\3\b\7\{username}
%System Root%\Python27\Lib\email\test\data\msg_36.txt.KEKW
%System Root%\Users\All Users\Microsoft\OFFICE\Groove\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\History\Service\{username}
%System Root%\Users\All Users\Microsoft\NetFramework\BreadcrumbStore\{username}.KEKW
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\{username}
%System Root%\Python27\include\classobject.h.KEKW
%System Root%\Users\Public\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp.KEKW
%System Root%\excel2k\XLS2KE03.xls.KEKW
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\{username}
%AppDataLocal%\pip\cache\http\4\e\e\{username}
%System Root%\Users\Default\Documents\{username}
%Application Data%\Microsoft\Word\{username}
%All Users Profile%\McAfee\MCLOGS\PartnerCustom\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\31\{username}
%System Root%\Python27\Lib\email\test\data\msg_37.txt.KEKW
%System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\entry_points.txt.KEKW
%AppDataLocal%\Google\Chrome\User Data\SwReporter\40.200.201.3\_metadata\{username}
%Application Data%\Microsoft\Windows\IECompatCache\Low\container.dat.KEKW
%Application Data%\Microsoft\Windows\SendTo\{username}
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\2LHHLFH6\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\Asia\{username}
%System Root%\Users\All Users\Microsoft\IlsCache\{username}.KEKW
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\{username}
%System Root%\Python27\Lib\logging\{username}
%AppDataLocal%\Apps\{username}
%All Users Profile%\{username}
%AppDataLocal%\Google\Chrome\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Config\{username}
%System Root%\excel2k\XLS2KExx.xls.KEKW
%System Root%\Users\Public\Desktop\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp.KEKW
%AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\_platform_specific\all\{username}
%System Root%\Users\All Users\Adobe\ARM\Reader_19.010.20099\{username}.KEKW
%AppDataLocal%\Microsoft\Windows\1024\{username}
%Application Data%\Microsoft\Office\Recent\{username}
%System Root%\Python27\Lib\email\test\data\msg_12a.txt.KEKW
%System Root%\Users\Public\Documents\word2k\DOC2KExx.doc.KEKW
%AppDataLocal%\Google\{username}
%AppDataLocal%\pip\cache\http\3\8\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5\{username}
%System Root%\Python27\tcl\tcl8.5\opt0.4\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\{username}.KEKW
%System Root%\Python27\Tools\pynche\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\2\{username}
%System Root%\Users\All Users\Microsoft\Windows\Templates\{username}
%System Root%\Python27\tcl\tk8.5\images\pwrdLogo150.gif.KEKW
%System Root%\Users\Default\AppData\Local\Microsoft\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\25\{username}
%System Root%\Users\All Users\Microsoft\RAC\Outbound\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\Atlantic\{username}
%All Users Profile%\VMware\VMware Tools\Unity Filters\adobeflashcs3.txt.KEKW
%AppDataLocal%\Microsoft\Media Player\Sync Playlists\{username}
%All Users Profile%\McAfee\MCLOGS\PartnerCustom\550F8967-2EE2-4F33-8E16-1BFFBE114803\{username}
%All Users Profile%\VMware\VMware Tools\{username}
%AppDataLocal%\Microsoft\Internet Explorer\Tiles\{username}
F:\wlines.zip.KEKW
%AppDataLocal%\Microsoft\Feeds\Microsoft Feeds~\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\SmallInstaller\{username}
%System Root%\Python27\include\unicodeobject.h.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\{username}.KEKW
%AppDataLocal%\Microsoft\Feeds Cache\NWKETFVL\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\CacheManager\{username}
%System Root%\Users\Public\Documents\word2k\DOC2KE04.doc.KEKW
%System Root%\Users\All Users\Microsoft\DRM\{username}.KEKW
%User Profile%\Documents\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F0\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\extensions\{username}
%System Root%\Python27\Lib\test\subprocessdata\{username}
%System Root%\Python27\Lib\test\audiodata\pluck-pcm32.wav.KEKW
%System Root%\Python27\include\codecs.h.KEKW
%System Root%\Python27\Lib\email\test\data\msg_31.txt.KEKW
%AppDataLocal%\Google\Chrome\User Data\SwReporter\40.200.201.3\{username}
%AppDataLocal%\Microsoft\Internet Explorer\brndlog.txt.KEKW
%Application Data%\Mozilla\Firefox\{username}
%System Root%\powerpoint2k\PPT2KE04.ppt.KEKW
%AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\RJ6VBH4W.DN2\goog...app_9ae46cec200785df_0001.0003_7581c0cd83ac8659\{username}
%System Root%\Users\All Users\Microsoft\OFFICE\Groove\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp.KEKW
%System Root%\Python27\tcl\tix8.4.3\pref\Bisque.cs.KEKW
%Desktop%\powerpoint2k\PPT2KE05.ppt.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\{username}
%System Root%\powerpoint2k\PPT2KE02.ppt.KEKW
%System Root%\Python27\Lib\idlelib\Icons\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43\{username}
%AppDataLocal%\Microsoft\Windows\1033\StructuredQuerySchema.bin.KEKW
%Application Data%\Microsoft\Excel\{username}
%Application Data%\Microsoft\Spelling\{username}
%User Profile%\Documents\powerpoint2k\PPT2KE02.ppt.KEKW
%System Root%\Python27\Lib\test\cjkencodings\iso2022_kr-utf8.txt.KEKW
%All Users Profile%\Mozilla\{username}
%Application Data%\Sun\Java\Deployment\{username}
%AppDataLocal%\Microsoft\Feeds Cache\COOE7IBP\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\{username}
%AppDataLocal%\Microsoft\Windows\1033\{username}
%All Users Profile%\Microsoft\Windows NT\MSScan\{username}
%System Root%\Users\Public\Recorded TV\Sample Media\{username}
%All Users Profile%\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_72da1383309c93bd2441accd728cf953e4fa97a_0a24a840\{username}
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\2PEMJMIY\{username}
%System Root%\Python27\Lib\idlelib\Icons\idle_48.gif.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\{username}
%AppDataLocal%Low\Microsoft\Windows\AppCache\LY14JQYG\{username}
%System Root%\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\{username}
%System Root%\Users\All Users\Adobe\ARM\S\{username}.KEKW
%System Root%\Python27\Lib\email\test\data\msg_23.txt.KEKW
%AppDataLocal%\Microsoft\Office\ONetConfig\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\packaging\{username}
%System Root%\Users\All Users\Microsoft\RAC\Temp\{username}.KEKW
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\DATA\{username}
%AppDataLocal%\Microsoft\Feeds Cache\NKNYYDHU\{username}
%User Temp%\dd_vcredistUI0FD5.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows\AIT\{username}.KEKW
%AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\{username}
%System Root%\Users\All Users\Microsoft\NetFramework\{username}
%Application Data%\Microsoft\MMC\{username}
%User Profile%\Saved Games\{username}
%System Root%\Python27\Lib\email\test\data\msg_32.txt.KEKW
%System Root%\Users\All Users\Microsoft\Media Player\{username}.KEKW
%AppDataLocal%Low\Microsoft\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\{username}.KEKW
%System Root%\Python27\Lib\email\mime\{username}
%System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\{username}.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\{username}
%Desktop%\Email and Password List.txt.KEKW
%System Root%\Python27\Lib\test\cjkencodings\gb2312.txt.KEKW
%System Root%\Python27\include\funcobject.h.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\frameiconcache.dat.KEKW
%System Root%\Python27\Lib\sqlite3\test\{username}
%System Root%\Users\All Users\Oracle\Java\javapath\{username}.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\{username}
%System Root%\Python27\Tools\pynche\X\rgb.txt.KEKW
%AppDataLocal%\Microsoft\Windows\WER\ReportArchive\{username}
%System Root%\Users\All Users\Adobe\ARM\S\{username}
%Application Data%\Mozilla\Firefox\Crash Reports\events\{username}
%All Users Profile%\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3\{username}
%All Users Profile%\Microsoft\Windows\Ringtones\{username}
%AppDataLocal%Low\Sun\Java\Deployment\tmp\si\{username}
%System Root%\Python27\Lib\bsddb\test\{username}
%AppDataLocal%\Mozilla\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\35\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Cave_Drawings.gif.KEKW
%AppDataLocal%\pip\cache\http\5\{username}
%All Users Profile%\McAfee\MCLOGS\Common\SmallInstaller\{username}
%System Root%\Users\All Users\Microsoft\Windows\Ringtones\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Resource\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0\{username}
%System Root%\Python27\Lib\test\imghdrdata\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Bears.jpg.KEKW
%System Root%\Python27\Lib\test\audiodata\pluck-pcm24.wav.KEKW
%System Root%\Python27\Lib\idlelib\Icons\python.gif.KEKW
%System Root%\Python27\tcl\tix8.4.3\bitmaps\file.gif.KEKW
%System Root%\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\gmp\WINNT_x86_64-msvc\{username}
%System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\top_level.txt.KEKW
%Application Data%\Media Center Programs\{username}
%Application Data%\Microsoft\Protect\S-1-5-21-2407829820-1079796033-203259571-500\{username}
%AppDataLocal%\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\{username}
%Desktop%\word2k\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0\{username}.KEKW
%AppDataLocal%\Google\Chrome\User Data\pnacl\0.57.44.2492\_metadata\{username}
%System Root%\$Recycle.Bin\S-1-5-21-2407829820-1079796033-203259571-500\$IC8HJH8.zip.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\49\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows\DeviceMetadataStore\{username}.KEKW
%System Root%\Users\Default\Pictures\{username}
%Application Data%\Macromedia\Flash Player\#SharedObjects\{username}
%System Root%\Python27\include\pyport.h.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\prefs.js.KEKW
%System Root%\Users\All Users\Microsoft\eHome\{username}.KEKW
%System Root%\Python27\tcl\tk8.5\demos\images\earthris.gif.KEKW
%AppDataLocal%\pip\cache\http\b\a\9\3\{username}
%System Root%\Python27\Lib\lib2to3\pgen2\{username}
%System Root%\powerpoint2k\PPT2KE01.ppt.KEKW
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KE03.ppt.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Python 2.7\{username}
%AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\{username}
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\ActivityLog\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\{username}
%User Profile%\Documents\excel2k\XLS2KE03.xls.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\{username}.KEKW
%AppDataLocal%\pip\cache\http\0\2\5\2\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Java\{username}.KEKW
%System Root%\Python27\include\asdl.h.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\{username}.KEKW
%Desktop%\excel2k\XLS2KE04.xls.KEKW
%System Root%\Users\Public\Documents\{username}
%AppDataLocal%\Microsoft\Windows\WebCache\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Java\{username}
%System Root%\Users\All Users\Mozilla\{username}.KEKW
%All Users Profile%\Microsoft\Vault\{username}
%AppDataLocal%Low\Microsoft\Internet Explorer\EmieSiteList\container.dat.KEKW
%User Profile%\Documents\excel2k\XLS2KE05.xls.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\{username}.KEKW
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Blue_Gradient.jpg.KEKW
%System Root%\Python27\Lib\distutils\{username}
%User Temp%\dd_wcf_CA_smci_20161212_135109_353.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Python 2.7\{username}.KEKW
%Desktop%\note.txt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\13\{username}
%AppDataLocal%\Google\Chrome\User Data\pnacl\0.57.44.2492\_platform_specific\{username}
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\{username}
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\{username}
%All Users Profile%\Microsoft\OFFICE\DATA\{username}
%Desktop%\Email and Password List.js.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\gmp\{username}
%All Users Profile%\Microsoft\Windows NT\MSFax\Common Coverpages\{username}
%All Users Profile%\Microsoft Help\{username}
%AppDataLocal%\pip\cache\http\7\e\9\{username}
%System Root%\Python27\include\pygetopt.h.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\44\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Quick\{username}.KEKW
%System Root%\Python27\Lib\site-packages\Pillow-6.0.0.dist-info\{username}
%System Root%\Python27\Lib\email\test\data\msg_17.txt.KEKW
%System Root%\Python27\Lib\test\leakers\README.txt.KEKW
%System Root%\Python27\Lib\email\test\data\msg_38.txt.KEKW
%AppDataLocal%\Microsoft\Windows Mail\Stationery\White_Chocolate.jpg.KEKW
%Application Data%\Microsoft\Excel\XLSTART\{username}
%AppDataLocal%\pip\cache\{username}
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\{username}.KEKW
%Application Data%\Microsoft\SystemCertificates\My\{username}
%System Root%\Python27\include\pythread.h.KEKW
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\{username}
%System Root%\Users\All Users\Microsoft\Windows\DRM\Cache\{username}.KEKW
%System Root%\Python27\Lib\email\test\data\msg_21.txt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\36\{username}
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp.KEKW
%AppDataLocal%\Microsoft\Office\Groove\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Peacock.jpg.KEKW
%AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Indexed Rules\{username}
%System Root%\Users\{username}\AppData\Roaming\Microsoft\{username}
%System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_72da1383309c93bd2441accd728cf953e4fa97a_0a24a840\{username}
%All Users Profile%\Microsoft\Windows Defender\Quarantine\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\32\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\{username}.KEKW
%System Root%\Users\Public\Documents\excel2k\XLS2KE04.xls.KEKW
%System Root%\Python27\tcl\tcl8.5\tzdata\Pacific\{username}
%System Root%\Users\Default\Music\{username}
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\DATA\{username}.KEKW
%AppDataLocal%\Microsoft\Windows\Explorer\{username}
%System Root%\Python27\Lib\test\test_doctest4.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Caches\{username}.KEKW
%System Root%\Python27\tcl\tix8.4.3\pref\SGIGray.cs.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\{username}
%System Root%\Python27\include\code.h.KEKW
%System Root%\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\{username}.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95\{username}
%System Root%\Python27\tcl\tix8.4.3\bitmaps\textfile.gif.KEKW
%AppDataLocal%\Google\Chrome\User Data\PepperFlash\32.0.0.171\_metadata\{username}
%System Root%\Python27\include\enumobject.h.KEKW
%System Root%\Users\Default\Downloads\{username}
%System Root%\Users\All Users\Microsoft\Windows\Sqm\Sessions\{username}
%System Root%\Users\All Users\Microsoft\Windows\Sqm\Manifest\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\550F8967-2EE2-4F33-8E16-1BFFBE114803\{username}.KEKW
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\{username}
%System Root%\Python27\Lib\idlelib\HISTORY.txt.KEKW
%System Root%\Python27\Lib\test\cjkencodings\johab.txt.KEKW
%System Root%\Python27\include\py_curses.h.KEKW
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\thumbnails\{username}
%System Root%\Python27\Lib\compiler\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\1D\{username}
%System Root%\Python27\tcl\tk8.5\demos\images\{username}
%System Root%\Python27\include\pgen.h.KEKW
%System Root%\Python27\Lib\test\crashers\{username}
%AppDataLocal%\Python-Eggs\Python-Eggs\{username}
%System Root%\Python27\include\pydebug.h.KEKW
%AppDataLocal%\Google\Chrome\User Data\PepperFlash\32.0.0.171\{username}
%System Root%\Python27\Lib\site-packages\pip\_internal\vcs\{username}
%Application Data%\Microsoft\Windows\PrivacIE\Low\{username}
%User Temp%\CR_E83EE.tmp\{username}
%System Root%\Python27\include\patchlevel.h.KEKW
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\{username}
%System Root%\Users\Public\Music\Sample Music\Sleep Away.mp3.KEKW
%System Root%\Python27\Lib\encodings\{username}
%System Root%\Python27\Lib\site-packages\setuptools\_vendor\{username}
%System Root%\Python27\Lib\email\test\data\msg_26.txt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\53\{username}
%User Profile%\{username}
%System Root%\Users\All Users\Microsoft\eHome\logs\{username}.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\28\{username}
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\{username}
%AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\_platform_specific\all\sths\{username}
%System Root%\Python27\Tools\pynche\X\{username}
%System Root%\Users\All Users\Microsoft\WwanSvc\{username}
%System Root%\Users\All Users\Microsoft\Network\{username}
%AppDataLocal%Low\Sun\{username}
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\{username}
%System Root%\Python27\Tools\pynche\X\xlicense.txt.KEKW
%All Users Profile%\Microsoft\Windows Defender\Definition Updates\{0E1465B0-BA9C-409F-BC32-D934317129CD}\{username}
%System Root%\Python27\tcl\tix8.4.3\demos\samples\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp.KEKW
%System Root%\Python27\include\pystrcmp.h.KEKW
%System Root%\Python27\tcl\tcl8.5\tzdata\Brazil\{username}
%System Root%\Users\Public\Videos\Sample Videos\{username}
%AppDataLocal%\Google\Chrome\User Data\MEIPreload\{username}
%AppDataLocal%\Microsoft\Windows\AppCache\container.dat.KEKW
%System Root%\Python27\Lib\site-packages\README.txt.KEKW
%System Root%\Python27\include\bytesobject.h.KEKW
%AppDataLocal%\Microsoft\Windows\AppCache\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\24\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\America\{username}
%System Root%\Users\{username}\AppData\Local\Microsoft\Media Player\{username}
%All Users Profile%\Mozilla\updates\308046B0AF4A39CB\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\America\North_Dakota\{username}
%AppDataLocal%\Apps\2.0\Data\RNQG94OQ.QJC\E1WGPJBQ.PMC\goog...app_9ae46cec200785df_0001.0003_7581c0cd83ac8659\Data\{username}
%System Root%\Users\All Users\Microsoft\RAC\StateData\RacMetaData.dat.KEKW
%System Root%\Users\Public\Pictures\Sample Pictures\Penguins.jpg.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\{username}
%Application Data%\Microsoft\Word\STARTUP\{username}
%System Root%\Python27\Lib\test\test_doctest3.txt.KEKW
%System Root%\Python27\Lib\site-packages\pythonnet-2.1.0.dist-info\top_level.txt.KEKW
%System Root%\Users\{username}
%System Root%\Users\Public\Documents\excel2k\XLS2KE02.xls.KEKW
%System Root%\Users\All Users\Microsoft\Device Stage\{username}.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp.KEKW
%AppDataLocal%\Microsoft\Feeds Cache\8TQ1M9OZ\{username}
%Application Data%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\{username}
%Desktop%\excel2k\XLS2KE03.xls.KEKW
%Application Data%\Microsoft\Windows\DNTException\container.dat.KEKW
%System Root%\Python27\include\pyctype.h.KEKW
%System Root%\Python27\Lib\test\cjkencodings\gb18030.txt.KEKW
%System Root%\Python27\Lib\xml\sax\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Monet.jpg.KEKW
%System Root%\Python27\Lib\email\test\data\msg_44.txt.KEKW
%Application Data%\Mozilla\Extensions\{username}
%AppDataLocal%\pip\cache\http\5\4\3\d\{username}
%System Root%\Users\All Users\Microsoft\Vault\{username}
%System Root%\Python27\Lib\email\test\data\msg_29.txt.KEKW
%System Root%\Python27\Lib\email\test\data\msg_45.txt.KEKW
%System Root%\Users\All Users\Microsoft\RAC\StateData\RacWmiEventData.dat.KEKW
%System Root%\Python27\Lib\distutils\tests\{username}
%AppDataLocal%\Microsoft\Internet Explorer\EmieUserList\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\pkg_resources\{username}
%System Root%\Python27\Lib\test\audiodata\pluck-pcm16.wav.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\{username}.KEKW
%AppDataLocal%\pip\cache\http\3\8\9\{username}
%User Profile%\AppData\{username}
%System Root%\Python27\Lib\email\test\data\msg_13.txt.KEKW

To manually delete a malware/grayware file from an affected system:

•For Windows 7, Windows Server 2008 (R2), Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2):

Open a Windows Explorer window.
- For Windows 7 and Server 2008 (R2) users, click Start>Computer.
- For Windows 8, 8.1, 10, and Server 2012 (R2) users, right-click on the lower-left corner of the screen,then click File Explorer.
In the Search Computer/This PC input box, type:
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\{username}
%All Users Profile%\Microsoft\Search\Data\Applications\{username}
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\{username}
%Start Menu%\Programs\Administrative Tools\{username}
%AppDataLocal%Low\Mozilla\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Java\{username}
%AppDataLocal%\pip\cache\http\a\1\9\5\{username}
%System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\updates\0\{username}.KEKW
%System Root%\Python27\tcl\tk8.5\images\pwrdLogo175.gif.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pings\{username}
%System Root%\Python27\include\pgenheaders.h.KEKW
%User Temp%\dd_vcredistMSI0FD5.txt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\50\{username}
%System Root%\Python27\Lib\hotshot\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47\{username}
%System Root%\powerpoint2k\PPT2KExx.PPT.KEKW
%AppDataLocal%Low\Microsoft\Internet Explorer\EmieUserList\container.dat.KEKW
%System Root%\Python27\Lib\email\test\data\msg_07.txt.KEKW
%System Root%\Python27\include\Python-ast.h.KEKW
%System Root%\Users\All Users\VMware\RawdskCompatibility\virtual\{username}.KEKW
%System Root%\Python27\Lib\idlelib\Icons\minusnode.gif.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\treeadapters\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp.KEKW
%System Root%\Users\{username}\AppData\Roaming\Microsoft\Windows\Libraries\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\{username}
%Desktop%\word2k\DOC2KE01.doc.KEKW
%AppDataLocal%\pip\cache\http\7\e\9\8\0\{username}
%System Root%\Users\Default\AppData\Roaming\{username}
%System Root%\Python27\include\ast.h.KEKW
%System Root%\Python27\Lib\idlelib\extend.txt.KEKW
%System Root%\Users\All Users\Microsoft\Device Stage\Task\{{GUID}}\{username}.KEKW
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\Un_A\{username}.KEKW
%System Root%\word2k\DOC2KE02.doc.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Store\{username}.KEKW
%System Root%\Python27\NEWS.txt.KEKW
%System Root%\Users\All Users\Microsoft\Assistance\Client\{username}
%System Root%\Python27\Lib\test\zipdir.zip.KEKW
%System Root%\Python27\Lib\test\cjkencodings\johab-utf8.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1D\{username}
%System Root%\Python27\tcl\tk8.5\images\pwrdLogo200.gif.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\VersionManager\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1D\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\util\{username}
%System Root%\Users\All Users\Microsoft\Assistance\Client\{username}.KEKW
%User Temp%\Low\{username}
F:\data\photos\{username}
%System Root%\Users\Public\Pictures\Sample Pictures\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\Common\{username}.KEKW
%Start Menu%\{username}
%Application Data%\Microsoft\UProof\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\{username}.KEKW
%AppDataLocal%\pip\cache\http\a\6\9\b\d\{username}
%System Root%\excel2k\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Pretty_Peacock.jpg.KEKW
%System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\dependency_links.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5\{username}.KEKW
%System Root%\Users\All Users\Microsoft\{username}
%System Root%\Python27\Lib\idlelib\Icons\idle_32.gif.KEKW
%System Root%\Python27\Lib\email\test\data\msg_35.txt.KEKW
%AppDataLocal%\pip\cache\http\7\e\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\{username}
%All Users Profile%\Microsoft\Assistance\Client\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\F0\{username}
%AppDataLocal%\Microsoft\Feeds Cache\container.dat.KEKW
%System Root%\Users\All Users\Mozilla\updates\{username}.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\treewalkers\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\22\{username}
%System Root%\Users\{username}\Music\{username}
%System Root%\Users\Public\Music\Sample Music\Kalimba.mp3.KEKW
%All Users Profile%\Microsoft\Windows Defender\Definition Updates\Updates\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A\{username}
%System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\top_level.txt.KEKW
%System Root%\Python27\tcl\reg1.2\{username}
%System Root%\Python27\include\pymem.h.KEKW
%System Root%\Users\All Users\Microsoft\IdentityCRL\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\{username}.KEKW
%System Root%\Python27\Lib\test\cjkencodings\shift_jisx0213.txt.KEKW
%AppDataLocal%\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\{username}
%System Root%\Python27\Lib\site-packages\pip\_internal\commands\{username}
%AppDataLocal%\Microsoft\Windows Mail\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp.KEKW
%System Root%\word2k\DOC2KE05.doc.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\{username}.KEKW
%System Root%\PerfLogs\Admin\{username}
%System Root%\Python27\tcl\tcl8\8.5\{username}
%AppDataLocal%\pip\cache\http\d\3\7\e\0\{username}
%System Root%\Python27\Lib\test\cjkencodings\cp949-utf8.txt.KEKW
%System Root%\Python27\tcl\tcl8.5\tzdata\Etc\{username}
%System Root%\Python27\Lib\test\cjkencodings\gb2312-utf8.txt.KEKW
%System Root%\Python27\tcl\tix8.4.3\bitmaps\minusarm.gif.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\muffin\{username}
%System Root%\Python27\Lib\test\capath\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\CacheManager\{username}.KEKW
%System Root%\Python27\Tools\pynche\webcolors.txt.KEKW
%AppDataLocal%\Microsoft\Windows Mail\Stationery\SoftBlue.jpg.KEKW
%AppDataLocal%\pip\cache\http\d\3\{username}
%AppDataLocal%\pip\cache\http\2\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\39\{username}
%All Users Profile%\Microsoft\Windows\Sqm\Upload\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\18\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\{username}
%System Root%\Python27\Lib\email\test\data\msg_22.txt.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\{username}
%System Root%\Users\All Users\Microsoft\RAC\PublishedData\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\datareporting\archived\2019-05\{username}
%System Root%\Users\Default\Videos\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\{username}.KEKW
%Application Data%\Microsoft\SystemCertificates\My\CRLs\{username}
%System Root%\Python27\tcl\tcl8\8.4\platform\{username}
%System Root%\Python27\include\descrobject.h.KEKW
%System Root%\Python27\include\dictobject.h.KEKW
%System Root%\Python27\Lib\test\imghdrdata\python.bmp.KEKW
%AppDataLocal%\Google\Chrome\User Data\OriginTrials\{username}
%System Root%\Users\Default\AppData\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\requests\{username}
%AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.1\{username}
%System Root%\Users\Public\Documents\excel2k\XLS2KExx.xls.KEKW
%System Root%\Python27\tcl\tk8.5\images\logo100.gif.KEKW
%System Root%\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\7\{username}
%AppDataLocal%Low\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\Australia\{username}
%System Root%\Users\All Users\Microsoft\MF\{username}
%System Root%\Python27\Lib\test\cjkencodings\gb18030-utf8.txt.KEKW
%Application Data%\Macromedia\Flash Player\macromedia.com\support\flashplayer\{username}
%System Root%\Python27\tcl\tcl8.5\http1.0\{username}
%Desktop%\powerpoint2k\PPT2KE02.ppt.KEKW
%System Root%\Users\All Users\Microsoft\IlsCache\{username}
%System Root%\Python27\include\modsupport.h.KEKW
%Desktop%\excel2k\XLS2KE01.xls.KEKW
%System Root%\Python27\Lib\email\test\data\msg_11.txt.KEKW
%System Root%\Python27\Lib\email\test\data\msg_46.txt.KEKW
%System Root%\Users\All Users\Microsoft Help\{username}
%AppDataLocal%\Microsoft\Internet Explorer\Tiles\pin9728060290\{username}
%All Users Profile%\Oracle\Java\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\52\{username}
%Favorites%\MSN Websites\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\{username}.KEKW
%AppDataLocal%Low\Microsoft\Windows\AppCache\LY14JQYG\container.dat.KEKW
%User Profile%\Documents\Email and Password List.txt.KEKW
%User Temp%\WPDNSE\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\Backup\{username}
%System Root%\Python27\Lib\email\test\data\msg_05.txt.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\2918063365piupsah.files\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\{username}
%AppDataLocal%Low\Sun\Java\Deployment\{username}
%System Root%\Python27\tcl\tix8.4.3\bitmaps\folder.gif.KEKW
%AppDataLocal%\pip\cache\http\a\1\{username}
%AppDataLocal%\Google\Chrome\User Data\SwReporter\{username}
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-child.bin.KEKW
%All Users Profile%\McAfee\WinCore\{username}
%AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.1\_metadata\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg.KEKW
%AppDataLocal%\Deployment\{username}
%AppDataLocal%\Apps\2.0\Data\RNQG94OQ.QJC\E1WGPJBQ.PMC\goog...app_9ae46cec200785df_0001.0003_7581c0cd83ac8659\{username}
%System Root%\Python27\tcl\tix8.4.3\demos\{username}
%AppDataLocal%\Microsoft\Internet Explorer\Recovery\{username}
%System Root%\Python27\Lib\test\cjkencodings\euc_kr-utf8.txt.KEKW
%System Root%\Python27\Lib\idlelib\NEWS.txt.KEKW
%Application Data%\Macromedia\Flash Player\{username}
%Application Data%\Microsoft\Credentials\{username}
%All Users Profile%\VMware\RawdskCompatibility\native\C\{username}
%System Root%\Python27\Lib\site-packages\pip\{username}
%AppDataLocal%\Google\Chrome\User Data\FileTypePolicies\34\_metadata\{username}
%AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\{username}
%AppDataLocal%\Google\Chrome\User Data\BrowserMetrics\{username}
%Application Data%\Macromedia\Flash Player\macromedia.com\{username}
%Application Data%\Mozilla\SystemExtensionsDev\{username}
%User Profile%\Documents\word2k\{username}
%System Root%\Python27\Lib\test\audiodata\pluck-pcm8.wav.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\{username}.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp.KEKW
%AppDataLocal%\pip\cache\http\0\2\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\mpcache-B1C01FED9F08520A4647901EFB883A6A3B247F8D.bin.KEKW
%AppDataLocal%\Apps\2.0\Data\RNQG94OQ.QJC\E1WGPJBQ.PMC\{username}
%AppDataLocal%\Microsoft\Windows\History\{username}
%System Root%\Users\All Users\Microsoft\Windows\DeviceMetadataStore\en-US\{username}
%System Root%\Python27\Lib\test\floating_points.txt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\37\{username}
%System Root%\Python27\Lib\lib2to3\fixes\{username}
%System Root%\Users\All Users\Microsoft\RAC\StateData\RacWmiDataBookmarks.dat.KEKW
%User Profile%\Documents\word2k\DOC2KE02.doc.KEKW
%AppDataLocal%\pip\cache\http\7\{username}
%System Root%\Users\Public\Pictures\Sample Pictures\Desert.jpg.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70\{username}
%All Users Profile%\Microsoft\Windows\WER\ReportQueue\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\{username}.KEKW
%System Root%\Users\{username}\Pictures\{username}
%System Root%\Python27\tcl\tix8.4.3\demos\bitmaps\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\host\{username}
%AppDataLocal%\pip\cache\http\b\a\9\3\5\{username}
%System Root%\Python27\Lib\test\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\8\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\{username}.KEKW
%Application Data%\Microsoft\Internet Explorer\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\VMware\{username}
%AppDataLocal%\Microsoft\Feeds Cache\M7X9O6Z1\{username}
%System Root%\Users\All Users\Microsoft\Windows\Caches\{username}
%AppDataLocal%\Microsoft\Internet Explorer\IECompatData\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\19\{username}
%System Root%\Python27\Lib\site-packages\pip\_internal\models\{username}
%System Root%\Python27\tcl\tix8.4.3\bitmaps\minus.gif.KEKW
%AppDataLocal%\pip\cache\http\f\e\d\0\e\{username}
%System Root%\Python27\Lib\test\math_testcases.txt.KEKW
%System Root%\Users\Public\Libraries\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\42\{username}
%Application Data%\Microsoft\Office\Recent\index.dat.KEKW
%System Root%\Python27\include\traceback.h.KEKW
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\History\CacheManager\MpSfc.bin.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Support\{username}.KEKW
%AppDataLocal%\pip\cache\http\5\4\{username}
%All Users Profile%\Microsoft\Device Stage\Task\{{GUID}}\{username}
%All Users Profile%\VMware\RawdskCompatibility\{username}
%System Root%\Python27\Lib\distutils\command\{username}
%System Root%\Users\All Users\Microsoft\Device Stage\Task\{username}.KEKW
%AppDataLocal%\Microsoft\Windows\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\{username}.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp.KEKW
%Application Data%\Microsoft\Windows\Templates\{username}
%AppDataLocal%\Python-Eggs\Python-Eggs\Cache\pillow-4.1.0-py2.7-win32.egg-tmp\{username}
%System Root%\Users\Public\Documents\powerpoint2k\{username}
%AppDataLocal%\Microsoft\Feeds Cache\NNO7APUS\{username}
%AppDataLocal%\Microsoft\Internet Explorer\tabiconcache.dat.KEKW
%System Root%\Users\Public\Pictures\Sample Pictures\Koala.jpg.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95\{username}
%System Root%\Python27\Lib\test\leakers\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\33\{username}
%User Temp%\dd_NDP452-KB2901907-x86-x64-AllOS-ENU_decompression_log.txt.KEKW
%System Root%\Users\All Users\Oracle\Java\javapath_target_313094\{username}.KEKW
%AppDataLocal%\pip\cache\http\7\e\9\8\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\{username}.KEKW
%System Root%\Python27\Lib\multiprocessing\{username}
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\SentItems\{username}.KEKW
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Psychedelic.jpg.KEKW
%AppDataLocal%\pip\cache\http\4\{username}
%User Profile%\Contacts\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Device Stage\Task\{{GUID}}\en-US\{username}
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Entries\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Inbox\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\msgpack\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\34\{username}
%AppDataLocal%\Microsoft\Office\Groove\User\{username}
%All Users Profile%\Microsoft\Network\Downloader\qmgr0.dat.KEKW
%AppDataLocal%\Google\Chrome\User Data\pnacl\0.57.44.2492\_platform_specific\x86_64\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\70\{username}.KEKW
%System Root%\Python27\Lib\idlelib\idle_test\README.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows\AIT\{username}
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\{username}
%System Root%\Users\All Users\Microsoft\Windows\Sqm\Upload\{username}
%All Users Profile%\VMware\VMware Tools\Unity Filters\vmwarefilters.txt.KEKW
%System Root%\Users\All Users\{username}.KEKW
%System Root%\Users\All Users\Microsoft\eHome\{username}
%System Root%\Python27\Lib\test\cjkencodings\cp949.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\{username}.KEKW
%System Root%\Python27\include\iterobject.h.KEKW
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\cache2\entries\{username}
%AppDataLocal%\Google\Chrome\User Data\InterventionPolicyDatabase\2018.9.6.0\{username}
%All Users Profile%\Microsoft\OFFICE\DATA\opa12.dat.KEKW
%System Root%\Users\Default\Links\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp.KEKW
%All Users Profile%\McAfee\MCLOGS\PartnerCustom\SSScheduler\{username}
%System Root%\Python27\tcl\tix8.4.3\bitmaps\{username}
%System Root%\Python27\include\import.h.KEKW
%AppDataLocal%\pip\cache\http\0\2\5\{username}
%System Root%\Users\Default\AppData\Local\Temp\{username}
%All Users Profile%\VMware\VMware Tools\manifest.txt.KEKW
%All Users Profile%\Mozilla\updates\308046B0AF4A39CB\updates\{username}
%AppDataLocal%\Microsoft\Windows\Burn\{username}
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KExx.PPT.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\UrlBlockManager\urlblocklist.bin.KEKW
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts\{username}
%AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\{username}
%System Root%\Users\Public\Documents\excel2k\XLS2KE01.xls.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\imagestore\1s32qbz\{username}
%User Profile%\Documents\word2k\DOC2KE01.doc.KEKW
%System Root%\Users\All Users\VMware\VMware Tools\Unity Filters\{username}
%System Root%\Users\All Users\VMware\{username}.KEKW
%System Root%\Users\Public\Music\{username}
%System Root%\Users\All Users\Microsoft\OFFICE\DATA\{username}
%System Root%\Python27\Lib\test\cjkencodings\euc_jp-utf8.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows\DRM\Cache\{username}
%All Users Profile%\Microsoft\NetFramework\BreadcrumbStore\{username}
%User Profile%\Documents\excel2k\XLS2KE02.xls.KEKW
%System Root%\Python27\Lib\site-packages\pythonnet-2.1.0.dist-info\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\{username}.KEKW
%User Profile%\Documents\powerpoint2k\PPT2KE05.ppt.KEKW
%System Root%\Users\All Users\Microsoft\DRM\Server\{username}.KEKW
%System Root%\Users\{username}\AppData\Roaming\Microsoft\Windows\{username}
%System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\LICENSE.txt.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\datareporting\archived\2019-04\{username}
%System Root%\Users\All Users\Microsoft\Media Player\{username}
%System Root%\Users\All Users\Microsoft\OFFICE\{username}.KEKW
%Application Data%\Microsoft\Windows\DNTException\Low\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\Arctic\{username}
%System Root%\Python27\include\fileobject.h.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\History\Results\Resource\{username}
%AppDataLocal%\Microsoft\Feeds\Feeds for United States~\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp.KEKW
%AppDataLocal%\pip\cache\http\5\4\3\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp.KEKW
%System Root%\Python27\tcl\tcl8.5\tzdata\Canada\{username}
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\3UYAQU1F\{username}
%AppDataLocal%\Microsoft\Windows\Ringtones\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Connectivity.gif.KEKW
%User Temp%\Microsoft .NET Framework 4.5.2 Setup_20161212_135033207.html.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\56\{username}
%User Profile%\Documents\powerpoint2k\PPT2KE04.ppt.KEKW
%System Root%\Python27\Lib\test\cjkencodings\hz.txt.KEKW
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\cache2\doomed\{username}
%System Root%\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\{username}
%System Root%\Users\All Users\Microsoft\Device Stage\{username}
%System Root%\Users\All Users\Microsoft\Windows\WER\{username}
%System Root%\Python27\include\eval.h.KEKW
%All Users Profile%\Microsoft\Device Stage\Task\{username}
%System Root%\Python27\include\intobject.h.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp.KEKW
%System Root%\word2k\DOC2KE03.doc.KEKW
%System Root%\$Recycle.Bin\S-1-5-21-2407829820-1079796033-203259571-500\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Maintenance\{username}
%AppDataLocal%\Google\Chrome\User Data\ShaderCache\GPUCache\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3\{username}
%All Users Profile%\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\{username}
%System Root%\excel2k\XLS2KE02.xls.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\VMware Tools\{username}.KEKW
%System Root%\Python27\Lib\test\cjkencodings\shift_jis-utf8.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Assistance\{username}.KEKW
%Application Data%\Microsoft\Vault\{username}
%System Root%\Python27\Lib\email\test\data\msg_19.txt.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\History\Results\Quick\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Store\{username}
%System Root%\Users\All Users\Microsoft\RAC\{username}.KEKW
%System Root%\Python27\Lib\test\cjkencodings\gbk-utf8.txt.KEKW
%All Users Profile%\Microsoft\Windows\Sqm\Sessions\{username}
%System Root%\Users\{username}\AppData\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\Africa\{username}
%All Users Profile%\McAfee\MCLOGS\PartnerCustom\Un_A\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\61\{username}
%System Root%\Python27\Lib\site-packages\setuptools\command\{username}
%System Root%\Python27\tcl\tix8.4.3\bitmaps\srcfile.gif.KEKW
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-current.bin.KEKW
%All Users Profile%\McAfee\MCLOGS\PartnerCustom\McCHSvc\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp.KEKW
%All Users Profile%\Microsoft\Windows\DRM\{username}
%System Root%\Python27\Tools\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Config\{username}.KEKW
%System Root%\Python27\Lib\test\cjkencodings\shift_jisx0213-utf8.txt.KEKW
%System Root%\Python27\Lib\email\test\data\msg_08.txt.KEKW
%All Users Profile%\Microsoft\MSDN\{username}
%AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\{AD285A8B-713F-11E9-85F8-005056BC44A9}.dat.KEKW
%System Root%\Python27\Lib\test\decimaltestdata\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\LocalCopy\{username}
%System Root%\Users\All Users\Microsoft\MSDN\8.0\{username}.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp.KEKW
%System Root%\Python27\Lib\test\test_doctest.txt.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\pep517\{username}
%System Root%\Python27\include\osdefs.h.KEKW
%System Root%\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.KEKW
%All Users Profile%\Microsoft\Windows NT\MSFax\ActivityLog\{username}
%AppDataLocal%\pip\cache\http\0\{username}
%AppDataLocal%\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\{username}
%AppDataLocal%\Microsoft\Windows\WebCache\WebCacheV01.dat.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\contrib\_securetransport\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\4\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5\{username}
%All Users Profile%\Oracle\{username}
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\GUFNQG0Q\{username}
%User Temp%\acrocef_low\{username}
%System Root%\Python27\Doc\{username}
%User Profile%\Documents\powerpoint2k\PPT2KE01.ppt.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSScan\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\America\Argentina\{username}
%System Root%\Users\All Users\Microsoft\OFFICE\DATA\{username}.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\Tracking Protection\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\LocalCopy\{username}.KEKW
%System Root%\Python27\LICENSE.txt.KEKW
%System Root%\Users\All Users\Adobe\Setup\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\{username}.KEKW
%System Root%\Python27\tcl\tix8.4.3\bitmaps\act_fold.gif.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\{username}
%System Root%\Python27\Lib\test\cjkencodings\big5hkscs.txt.KEKW
%System Root%\Users\{username}\AppData\Local\{username}
%System Root%\Python27\tcl\tk8.5\images\logoMed.gif.KEKW
%All Users Profile%\Microsoft\RAC\Outbound\{username}
%System Root%\Python27\Lib\xml\etree\{username}
%Application Data%\Microsoft\Document Building Blocks\1033\{username}
%All Users Profile%\Microsoft\Windows\Sqm\{username}
%System Root%\Python27\tcl\tix8.4.3\{username}
%AppDataLocal%\Google\Chrome\User Data\InterventionPolicyDatabase\2018.9.6.0\_metadata\{username}
%System Root%\Python27\tcl\tix8.4.3\pref\TixGray.cs.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp.KEKW
%System Root%\Recovery\{GUID}\{username}
%Start Menu%\Programs\Accessories\Accessibility\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\History\{username}
%System Root%\Users\Default\AppData\Roaming\Microsoft\{username}
%AppDataLocal%\pip\cache\http\3\8\9\3\{username}
%Application Data%\Microsoft\Windows\IEDownloadHistory\container.dat.KEKW
%AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.1\LICENSE.txt.KEKW
%All Users Profile%\Microsoft\Search\Data\Temp\{username}
%System Root%\Python27\include\pyerrors.h.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\PDYB5D8B\{username}
%AppDataLocal%Low\Microsoft\Windows\AppCache\container.dat.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\{username}
%System Root%\Users\Public\Pictures\Sample Pictures\Tulips.jpg.KEKW
%System Root%\Users\All Users\Microsoft\NetFramework\BreadcrumbStore\{username}
%All Users Profile%\Microsoft\Windows\Power Efficiency Diagnostics\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\Updates\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\1\{username}
%System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\updates\{username}.KEKW
%All Users Profile%\Oracle\Java\installcache_x64\{username}
%System Root%\Users\All Users\Microsoft\Network\Connections\{username}.KEKW
%System Root%\Email and Password List.txt.KEKW
%System Root%\Users\All Users\Microsoft\{username}.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\pkcs11.txt.KEKW
%System Root%\Python27\Lib\email\test\data\msg_27.txt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\0\{username}
%Application Data%\Microsoft\Office\{username}
%System Root%\Users\All Users\Microsoft\Windows\Power Efficiency Diagnostics\{username}.KEKW
%AppDataLocal%Low\Microsoft\Internet Explorer\EmieUserList\{username}
%System Root%\Python27\include\pyarena.h.KEKW
%AppDataLocal%Low\Microsoft\Internet Explorer\EmieBrowserModeList\{username}
%Desktop%\powerpoint2k\PPT2KE04.ppt.KEKW
%System Root%\Users\Public\Documents\word2k\DOC2KE02.doc.KEKW
%Application Data%\Microsoft\Windows\Printer Shortcuts\{username}
%System Root%\Python27\Lib\test\cjkencodings\euc_jp.txt.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp.KEKW
%System Root%\Python27\Lib\lib2to3\tests\{username}
%System Root%\Users\All Users\Microsoft\DeviceSync\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F0\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\{username}.KEKW
%System Root%\Python27\Lib\email\test\data\msg_04.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows\DeviceMetadataStore\{username}
%System Root%\Python27\include\setobject.h.KEKW
%System Root%\Python27\Lib\site-packages\pip\_internal\operations\{username}
%Desktop%\word2k\DOC2KE05.doc.KEKW
%System Root%\Python27\tcl\tix8.4.3\bitmaps\info.gif.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\8YC9813O\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\{username}
%System Root%\Python27\tcl\tix8.4.3\pref\WmDefault.cs.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\contrib\{username}
%All Users Profile%\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\DATA\{username}
%All Users Profile%\VMware\VMware Tools\Unity Filters\vistasidebar.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Sqm\{username}.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\{username}
%System Root%\Users\All Users\Adobe\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\{username}
%Start Menu%\Programs\{username}
%Desktop%\{username}
%User Profile%\Documents\excel2k\XLS2KExx.xls.KEKW
%AppDataLocal%\pip\cache\http\b\a\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\F0\{username}
%System Root%\Python27\tcl\tk8.5\msgs\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43\{username}.KEKW
%System Root%\Python27\include\marshal.h.KEKW
%System Root%\Python27\Lib\test\audiodata\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Microsoft Office\{username}
%System Root%\Python27\Lib\idlelib\README.txt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\12\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp.KEKW
%All Users Profile%\Microsoft\Windows Defender\Definition Updates\Backup\{username}
%AppDataLocal%\pip\cache\http\f\e\d\{username}
%System Root%\Python27\include\Python.h.KEKW
%System Root%\Users\All Users\Microsoft\Network\{username}.KEKW
%All Users Profile%\Microsoft\IdentityCRL\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\{username}
%All Users Profile%\Oracle\Java\javapath_target_313094\{username}
%System Root%\Python27\Lib\email\test\data\msg_41.txt.KEKW
%System Root%\Python27\tcl\tk8.5\images\logoLarge.gif.KEKW
%System Root%\Python27\tcl\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Quarantine\{username}.KEKW
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\{username}
%System Root%\Python27\Lib\email\test\data\msg_15.txt.KEKW
%AppDataLocal%Low\Sun\Java\{username}
%System Root%\Python27\Lib\curses\{username}
%AppDataLocal%\Microsoft\Internet Explorer\MSIMGSIZ.DAT.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\{username}
%System Root%\Python27\include\graminit.h.KEKW
%AppDataLocal%\Microsoft\TaskSchedulerConfig\{username}
F:\data\dolist.txt.KEKW
%AppDataLocal%\Microsoft\PlayReady\{username}
%Start Menu%\Programs\Maintenance\{username}
%User Temp%\{username}
%AppDataLocal%\Microsoft\Windows Media\{username}
%AppDataLocal%\Microsoft\Windows\Burn\Burn\{username}
%System Root%\Python27\tcl\tk8.5\images\logo64.gif.KEKW
%All Users Profile%\Microsoft\RAC\Temp\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Entries\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\{username}.KEKW
%Desktop%\powerpoint2k\PPT2KE03.ppt.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\{username}
%All Users Profile%\Microsoft\Windows\AIT\{username}
%System Root%\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Queue\{username}.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\treebuilders\{username}
%User Profile%\Documents\Email and Password List.js.KEKW
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\urlCache.bin.KEKW
%System Root%\Python27\include\pythonrun.h.KEKW
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Tablet PC\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\550F8967-2EE2-4F33-8E16-1BFFBE114803\{username}
%AppDataLocal%\Microsoft Help\{username}
%System Root%\Python27\Lib\email\test\data\msg_09.txt.KEKW
%System Root%\Python27\include\pymactoolbox.h.KEKW
%System Root%\Python27\Lib\email\test\data\msg_02.txt.KEKW
%AppDataLocal%\Microsoft\Windows\WER\ReportArchive\NonCritical_iexplore.exe_12df8271b62395a348f102b12959f9768e2baf9_0be7f64f\{username}
%System Root%\Python27\Lib\test\support\{username}
%System Root%\word2k\DOC2KE01.doc.KEKW
%System Root%\Users\All Users\Microsoft\IdentityCRL\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\SiteSecurityServiceState.txt.KEKW
%System Root%\Python27\Lib\test\tokenize_tests.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70\{username}.KEKW
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Tiki.gif.KEKW
%System Root%\Python27\include\stringobject.h.KEKW
%AppDataLocal%\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg.KEKW
%System Root%\Users\All Users\Microsoft Help\{username}.KEKW
%System Root%\Python27\Lib\idlelib\idle_test\{username}
%System Root%\Users\All Users\VMware\VMware Tools\{username}.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\packages\{username}
%AppDataLocal%\pip\cache\http\2\3\b\{username}
%AppDataLocal%\pip\cache\http\4\e\e\3\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\weave\{username}
%System Root%\Users\All Users\Microsoft\Windows\Ringtones\{username}.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\{username}
%System Root%\Python27\include\grammar.h.KEKW
%AppDataLocal%\pip\cache\http\2\3\{username}
%System Root%\excel2k\XLS2KE04.xls.KEKW
%All Users Profile%\Microsoft\Assistance\Client\1.0\en-US\{username}
%All Users Profile%\Microsoft\User Account Pictures\{username}.dat.KEKW
%System Root%\Python27\Lib\test\formatfloat_testcases.txt.KEKW
%System Root%\Python27\tcl\tcl8\{username}
%AppDataLocal%\Microsoft\Windows Media\12.0\{username}
%System Root%\Python27\tcl\tk8.5\ttk\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\{username}.KEKW
%System Root%\Python27\tcl\tix8.4.3\pref\Blue.cs.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\3\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\{username}
%System Root%\Python27\DLLs\{username}
%System Root%\Python27\Lib\idlelib\CREDITS.txt.KEKW
%All Users Profile%\McAfee\{username}
%System Root%\Python27\Lib\email\test\data\msg_39.txt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\41\{username}
%Application Data%\Microsoft\SystemCertificates\My\CTLs\{username}
%System Root%\Users\All Users\VMware\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp.KEKW
%System Root%\Python27\tcl\tcl8.5\encoding\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\46\{username}
%System Root%\Users\All Users\VMware\RawdskCompatibility\{username}.KEKW
%System Root%\Python27\Lib\site-packages\pip\_internal\cli\{username}
%Application Data%\Sun\Java\{username}
%Application Data%\Microsoft\Windows\IEDownloadHistory\{username}
%AppDataLocal%\Python-Eggs\{username}
%AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\RJ6VBH4W.DN2\manifests\{username}
%Application Data%\Microsoft\Windows\IETldCache\{username}
%System Root%\Users\All Users\Adobe\ARM\{username}
%AppDataLocal%Low\Microsoft\Internet Explorer\EmieSiteList\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\{0E1465B0-BA9C-409F-BC32-D934317129CD}\{username}.KEKW
%System Root%\Python27\include\complexobject.h.KEKW
%System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\updates\{username}
%Start Menu%\Programs\Accessories\{username}
%System Root%\Python27\Lib\idlelib\TODO.txt.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Sqm\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\59\{username}
%Application Data%\Microsoft\Windows\IECompatUACache\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\tmp\{username}
%System Root%\Python27\Lib\email\test\data\msg_30.txt.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\70\{username}
%AppDataLocal%\Mozilla\Firefox\{username}
%Application Data%\Identities\{3D0FBFE3-9E5C-4F14-8D00-F0C8FEFA78BA}\{username}
%System Root%\Users\All Users\McAfee\{username}.KEKW
%All Users Profile%\Microsoft\Windows\Caches\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\{username}
%System Root%\Users\All Users\Microsoft\Device Stage\Task\{{GUID}}\{username}
%AppDataLocal%\pip\cache\http\a\1\9\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\Un_A\{username}
%Application Data%\Mozilla\Firefox\Profiles\{username}
%AppDataLocal%\pip\cache\http\b\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\{username}
%System Root%\Python27\Lib\email\test\data\msg_40.txt.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0\{username}
%System Root%\Users\All Users\Microsoft\WwanSvc\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows\{username}.KEKW
%System Root%\powerpoint2k\{username}
%System Root%\Users\All Users\Microsoft\Windows\Sqm\Manifest\{username}.KEKW
%AppDataLocal%\GDIPFONTCACHEV1.DAT.KEKW
%All Users Profile%\VMware\RawdskCompatibility\native\C\ProgramData\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\57\{username}
%AppDataLocal%\pip\cache\http\3\8\9\3\0\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\{username}.KEKW
%System Root%\Python27\tcl\tcl8.5\tzdata\America\Indiana\{username}
%System Root%\Users\All Users\Microsoft\Network\Connections\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\pluginreg.dat.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\{username}.KEKW
%System Root%\Python27\Lib\email\test\data\msg_28.txt.KEKW
%System Root%\Python27\Lib\test\cjkencodings\gbk.txt.KEKW
%All Users Profile%\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_505c7fc25c7e5866de583f14c22e2b4c2a6018c_0a2493a7\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\History\Results\{username}
%System Root%\Users\All Users\Adobe\Setup\{username}.KEKW
%AppDataLocal%\Microsoft\Windows\WebCacheLock.dat.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\23\{username}
%System Root%\Users\All Users\Microsoft\MF\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Assistance\Client\1.0\{username}.KEKW
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Wrinkled_Paper.gif.KEKW
%User Profile%\Documents\powerpoint2k\PPT2KExx.PPT.KEKW
%User Profile%\Documents\word2k\DOC2KE04.doc.KEKW
%System Root%\excel2k\XLS2KE05.xls.KEKW
%System Root%\Python27\Lib\idlelib\Icons\folder.gif.KEKW
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\{username}.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\{username}
%System Root%\Users\All Users\Microsoft\Windows\WER\ReportQueue\{username}
%System Root%\Python27\include\object.h.KEKW
%Start Menu%\Programs\Accessories\System Tools\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\38\{username}
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Quarantine\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\distlib\{username}
%System Root%\word2k\{username}
%Start Menu%\Programs\ImDisk\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\27\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\14\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\Common\SmallInstaller\{username}
%System Root%\Users\{username}\{username}
%All Users Profile%\Microsoft\RAC\PublishedData\{username}
%All Users Profile%\Microsoft\User Account Pictures\user.bmp.KEKW
%System Root%\Python27\include\intrcheck.h.KEKW
%All Users Profile%\VMware\VMware Tools\Unity Filters\visualstudio2005.txt.KEKW
%Desktop%\AAljoOV.jpg.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1D\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\{username}
%AppDataLocal%\Google\Software Reporter Tool\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Support\{username}
%AppDataLocal%\Google\Chrome\User Data\Crashpad\settings.dat.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\{username}.KEKW
%System Root%\Users\Public\Documents\Email and Password List.js.KEKW
%Application Data%\Microsoft\{username}
%System Root%\Users\Default\NTUSER.DAT.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Temp\usgthrsvc\{username}.KEKW
%System Root%\Python27\include\weakrefobject.h.KEKW
%All Users Profile%\McAfee\MCLOGS\{username}
%System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\{username}
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\{username}
%System Root%\Python27\include\bitset.h.KEKW
%System Root%\Users\All Users\Microsoft\RAC\StateData\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Assistance\Client\1.0\{username}
%System Root%\Python27\Lib\unittest\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\{username}
%System Root%\Python27\Lib\test\imghdrdata\python.png.KEKW
%AppDataLocal%\Google\Chrome\User Data\ShaderCache\{username}
%AppDataLocal%\Google\Chrome\User Data\pnacl\0.57.44.2492\{username}
%Application Data%\Microsoft\Windows\IECompatCache\container.dat.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp.KEKW
F:\data\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\History\Store\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\minidumps\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp.KEKW
%All Users Profile%\Microsoft\Windows NT\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\{username}.KEKW
%System Root%\Python27\Lib\email\test\data\msg_18.txt.KEKW
%System Root%\word2k\DOC2KExx.doc.KEKW
%System Root%\Python27\tcl\tcl8.5\tzdata\Antarctica\{username}
%System Root%\Users\All Users\Microsoft\Search\{username}.KEKW
%AppDataLocal%\Google\Chrome\User Data\Safe Browsing\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\America\Kentucky\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\{username}.KEKW
%System Root%\Python27\include\genobject.h.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp.KEKW
%All Users Profile%\Microsoft\Windows\{username}
%AppDataLocal%\Microsoft\Internet Explorer\EmieBrowserModeList\container.dat.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\{0E1465B0-BA9C-409F-BC32-D934317129CD}\{username}
%System Root%\Python27\include\dtoa.h.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\43\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\{username}
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\45\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\ActivityLog\{username}.KEKW
%Application Data%\Microsoft\Internet Explorer\UserData\Low\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3\{username}
%System Root%\Python27\Lib\site-packages\setuptools\_vendor\packaging\{username}
%System Root%\Users\All Users\Microsoft\MSDN\8.0\{username}
%System Root%\Python27\Lib\email\test\data\msg_20.txt.KEKW
%AppDataLocal%\Google\Chrome\User Data\CertificateRevocation\5140\_metadata\{username}
%User Temp%\Guest.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\{username}.KEKW
%User Profile%\Documents\word2k\DOC2KExx.doc.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Inbox\{username}.KEKW
%System Root%\Users\Public\Documents\word2k\{username}
%User Temp%\Deployment\{username}
%AppDataLocal%\pip\cache\http\d\{username}
%System Root%\Users\All Users\Microsoft\Search\{username}
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\safebrowsing\google4\{username}
%System Root%\Users\All Users\Microsoft\MSDN\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\F0\{username}.KEKW
%AppDataLocal%Low\Microsoft\Internet Explorer\{username}
%All Users Profile%\Microsoft\DeviceSync\{username}
%Application Data%\Macromedia\{username}
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\Config\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\40\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Garden.jpg.KEKW
%System Root%\Users\All Users\Oracle\{username}.KEKW
%All Users Profile%\Microsoft\IlsCache\{username}
%System Root%\Python27\Lib\xml\parsers\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp.KEKW
%AppDataLocal%\pip\cache\http\0\2\5\2\b\{username}
%System Root%\word2k\DOC2KE04.doc.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\weave\toFetch\{username}
%All Users Profile%\Microsoft\Device Stage\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Games\{username}
%AppDataLocal%\Microsoft\Internet Explorer\TabRoaming\{username}
%Desktop%\excel2k\XLS2KE02.xls.KEKW
%System Root%\Python27\Lib\lib2to3\Grammar.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\{username}.KEKW
%System Root%\Python27\Lib\test\cjkencodings\iso2022_jp-utf8.txt.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp.KEKW
%All Users Profile%\Adobe\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\17\{username}
F:\data\photos\stunning.jpg.KEKW
%System Root%\Python27\include\memoryobject.h.KEKW
%AppDataLocal%\Microsoft\Office\Groove\System\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\lockfile\{username}
%AppDataLocal%\Microsoft\Internet Explorer\EmieBrowserModeList\{username}
%All Users Profile%\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\{username}
%System Root%\Python27\Lib\test\tracedmodules\{username}
%System Root%\Users\All Users\Microsoft\Windows\GameExplorer\{username}
%System Root%\Python27\tcl\tk8.5\images\tai-ku.gif.KEKW
%User Profile%\Pictures\{username}
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\OfflineCache\{username}
%AppDataLocal%\pip\cache\http\a\1\9\5\3\{username}
%System Root%\Users\Default\Desktop\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\{username}
%System Root%\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\filters\{username}
%All Users Profile%\VMware\RawdskCompatibility\native\regdata.dat.KEKW
%System Root%\Users\All Users\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\{username}
%All Users Profile%\Microsoft\Windows\Templates\{username}
%System Root%\Python27\Lib\ensurepip\{username}
%AppDataLocal%\Microsoft\Internet Explorer\imagestore\joppu72\{username}
%User Temp%\dd_wcf_CA_smci_20161212_135110_351.txt.KEKW
%System Root%\Users\All Users\Microsoft\NetFramework\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\{username}.KEKW
%AppDataLocal%\Google\Chrome\User Data\CertificateRevocation\{username}
%System Root%\Python27\Lib\lib2to3\PatternGrammar.txt.KEKW
%System Root%\Python27\Lib\test\cmath_testcases.txt.KEKW
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\cache2\{username}
%System Root%\Users\All Users\McAfee\WinCore\{username}.KEKW
%AppDataLocal%\Google\Chrome\User Data\FileTypePolicies\34\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Service\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows\WER\ReportQueue\{username}.KEKW
%System Root%\Python27\Lib\email\test\data\msg_25.txt.KEKW
%System Root%\Users\All Users\VMware\RawdskCompatibility\{username}
%System Root%\Python27\tcl\tix8.4.3\pref\Gray.cs.KEKW
%AppDataLocal%\Microsoft\Office\{username}
%AppDataLocal%\Microsoft\Windows\History\Low\{username}
%System Root%\Python27\include\symtable.h.KEKW
%System Root%\Python27\tcl\tix8.4.3\pref\{username}
%AppDataLocal%\Google\Chrome\User Data\PepperFlash\{username}
%System Root%\Python27\tcl\tk8.5\{username}
%Desktop%\powerpoint2k\PPT2KE01.ppt.KEKW
%All Users Profile%\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Administrative Tools\{username}
%AppDataLocal%\Microsoft\Windows\GameExplorer\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\AlternateServices.txt.KEKW
%System Root%\Users\All Users\Oracle\Java\{username}
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\{username}
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\{username}
%System Root%\Python27\Lib\unittest\test\{username}
%System Root%\Python27\Lib\test\ieee754.txt.KEKW
%System Root%\Python27\Tools\webchecker\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\cachecontrol\caches\{username}
%AppDataLocal%\Python-Eggs\Python-Eggs\Cache\pillow-4.1.0-py2.7-win32.egg-tmp\PIL\{username}
%System Root%\Python27\include\{username}
%System Root%\Python27\Lib\email\test\data\msg_10.txt.KEKW
%System Root%\Users\All Users\Adobe\ARM\{username}.KEKW
%System Root%\Python27\include\tupleobject.h.KEKW
%Application Data%\Microsoft\SystemCertificates\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\{username}
%AppDataLocal%\Apps\2.0\{username}
%System Root%\Users\All Users\Adobe\ARM\Reader_19.010.20099\{username}
%AppDataLocal%\Microsoft\Windows Sidebar\Gadgets\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Notebook.jpg.KEKW
%All Users Profile%\Microsoft\Media Player\{username}
%All Users Profile%\Microsoft\MSDN\8.0\{username}
%AppDataLocal%\pip\cache\http\f\e\{username}
%User Profile%\Documents\fp_18.0.0.203_archive\{username}
%System Root%\Python27\include\bufferobject.h.KEKW
%System Root%\Users\Public\Documents\word2k\DOC2KE03.doc.KEKW
%System Root%\Python27\Tools\pynche\namedcolors.txt.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\crashes\events\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01\{username}
%Application Data%\Microsoft\Windows\IETldCache\container.dat.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\{username}
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\{username}
%AppDataLocal%\Microsoft\Media Player\Sync Playlists\en-US\00007196\{username}
%User Profile%\Documents\powerpoint2k\{username}
%System Root%\Python27\Lib\test\cjkencodings\euc_jisx0213.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSScan\{username}
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\{username}
%System Root%\Users\All Users\Microsoft\Device Stage\Task\{{GUID}}\en-US\{username}.KEKW
%All Users Profile%\Microsoft\Network\Connections\{username}
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\{username}
%System Root%\Python27\Lib\xml\dom\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\SystemV\{username}
%AppDataLocal%\Google\Chrome\User Data\SSLErrorAssistant\7\{username}
%All Users Profile%\Oracle\Java\.oracle_jre_usage\{username}
%AppDataLocal%\Microsoft\Windows Mail\Backup\new\{username}
%Desktop%\powerpoint2k\{username}
%System Root%\Users\All Users\Mozilla\updates\{username}
%System Root%\Python27\Lib\test\cjkencodings\big5-utf8.txt.KEKW
%AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\RJ6VBH4W.DN2\{username}
%AppDataLocal%\Microsoft\Media Player\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\{username}
%System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_72da1383309c93bd2441accd728cf953e4fa97a_0a24a840\{username}.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\bookmarkbackups\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\{username}.KEKW
%System Root%\Users\All Users\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\{username}
%System Root%\Python27\Lib\email\test\data\msg_42.txt.KEKW
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-child-current.bin.KEKW
%AppDataLocal%\Google\Chrome\User Data\CertificateRevocation\5140\{username}
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\{username}
%AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{4555A5E7-C06D-11E6-8AB1-005056BC3E18}.dat.KEKW
%All Users Profile%\Microsoft\Windows\WER\{username}
%All Users Profile%\McAfee\MCLOGS\SmallInstaller\{username}
%Application Data%\Microsoft\Windows\Libraries\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\3561288849sdhlie.files\{username}
%AppDataLocal%\Google\Chrome\User Data\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\{username}
%System Root%\Python27\tcl\tix8.4.3\bitmaps\no_entry.gif.KEKW
%System Root%\Users\All Users\VMware\RawdskCompatibility\virtual\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\{username}
%AppDataLocal%Low\Sun\Java\Deployment\security\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\{username}
%System Root%\Python27\include\parsetok.h.KEKW
%System Root%\Python27\Lib\test\cjkencodings\{username}
%User Temp%\Adobe_ADMLogs\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp.KEKW
%System Root%\Users\Public\Favorites\{username}
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\GatherLogs\{username}
%User Profile%\Documents\fp_18.0.0.203_archive.zip.KEKW
%Application Data%\Microsoft\Protect\{username}
%AppDataLocal%\Google\Chrome\User Data\FileTypePolicies\{username}
%System Root%\Users\{username}\Videos\{username}
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\container.dat.KEKW
%System Root%\Python27\include\listobject.h.KEKW
%System Root%\Users\All Users\Microsoft\Vault\{username}.KEKW
%All Users Profile%\Microsoft\NetFramework\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Roses.jpg.KEKW
%System Root%\Python27\tcl\tix8.4.3\pref\WmDefault.txt.KEKW
%System Root%\Python27\Lib\email\test\data\msg_12.txt.KEKW
%User Temp%\WebInstaller\{username}
%AppDataLocal%\Microsoft\Windows Mail\Backup\{username}
%System Root%\Python27\tcl\dde1.3\{username}
%System Root%\Python27\Tools\pynche\README.txt.KEKW
%System Root%\Python27\Lib\xml\{username}
%AppDataLocal%\Microsoft\Feeds Cache\{username}
%System Root%\Python27\Lib\email\test\data\msg_03.txt.KEKW
%All Users Profile%\Microsoft\Windows\Start Menu\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp.KEKW
%System Root%\Python27\Lib\json\tests\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\HandPrints.jpg.KEKW
%Application Data%\Microsoft\Proof\{username}
%System Root%\Python27\Tools\versioncheck\README.txt.KEKW
%AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\_metadata\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Tablet PC\{username}.KEKW
%All Users Profile%\Microsoft\Windows NT\MSFax\{username}
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\9IWSW3EX\{username}
%System Root%\Python27\include\objimpl.h.KEKW
%System Root%\Python27\Lib\test\cjkencodings\big5hkscs-utf8.txt.KEKW
%System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\{username}.KEKW
%Desktop%\word2k\DOC2KExx.doc.KEKW
%Application Data%\Macromedia\Flash Player\macromedia.com\support\{username}
%All Users Profile%\Mozilla\updates\{username}
%System Root%\Python27\Lib\site-packages\setuptools\{username}
%System Root%\Python27\include\pyexpat.h.KEKW
%System Root%\Python27\Tools\Scripts\{username}
%System Root%\Users\Public\Videos\{username}
%User Profile%\Documents\word2k\DOC2KE05.doc.KEKW
%System Root%\Python27\Lib\idlelib\help.html.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Sqm\Sessions\{username}.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp.KEKW
%All Users Profile%\VMware\VMware Tools\Unity Filters\adobephotoshopcs3.txt.KEKW
%System Root%\Python27\include\cobject.h.KEKW
%System Root%\Python27\tcl\tcl8.5\tzdata\Indian\{username}
%System Root%\Users\{username}\AppData\Local\Microsoft\{username}
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KE02.ppt.KEKW
%User Temp%\dd_SetupUtility.txt.KEKW
%System Root%\Python27\tcl\tcl8.5\tzdata\US\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\11\{username}
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\15\{username}
%System Root%\Users\Public\Documents\word2k\DOC2KE01.doc.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\51\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg.KEKW
%System Root%\Python27\Lib\test\xmltestdata\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\SecurityPreloadState.txt.KEKW
%User Temp%\dd_vcredistMSI0FC1.txt.KEKW
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\urlCache-current.bin.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\packages\ssl_match_hostname\{username}
%Application Data%\Microsoft\Internet Explorer\UserData\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A\{username}
%System Root%\Users\All Users\Microsoft\Windows\Power Efficiency Diagnostics\{username}
%Application Data%\Mozilla\Firefox\Crash Reports\{username}
%System Root%\Users\All Users\Oracle\Java\{username}.KEKW
%System Root%\Python27\tcl\tix8.4.3\bitmaps\openfold.gif.KEKW
%System Root%\Python27\include\ceval.h.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95\{username}.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\_trie\{username}
%All Users Profile%\Microsoft\User Account Pictures\guest.bmp.KEKW
%AppDataLocal%\pip\cache\http\5\4\3\d\7\{username}
%System Root%\Users\Default\AppData\Local\Microsoft\Windows\GameExplorer\{username}
%System Root%\Users\All Users\Microsoft\WwanSvc\Profiles\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Python 2.7\{username}
%System Root%\Users\Public\Documents\excel2k\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\html5lib\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\sessionstore-backups\{username}
%System Root%\Python27\include\pymacconfig.h.KEKW
%Application Data%\Microsoft\Windows\IECompatCache\Low\{username}
%System Root%\Python27\Lib\sqlite3\{username}
%AppDataLocal%\pip\cache\http\{username}
%System Root%\Python27\Lib\lib-tk\test\test_ttk\{username}
%System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\entry_points.txt.KEKW
%System Root%\Python27\Scripts\{username}
%System Root%\Python27\tcl\tcl8.5\{username}
%Application Data%\Microsoft\Windows\Recent\{username}
%AppDataLocal%\Microsoft\Feeds Cache\JPOHUSHF\{username}
%System Root%\Python27\Lib\test\exception_hierarchy.txt.KEKW
%System Root%\$Recycle.Bin\S-1-5-21-2407829820-1079796033-203259571-1000\{username}
%All Users Profile%\Microsoft\Windows\Sqm\Manifest\{username}
%User Temp%\{username}.bmp.KEKW
%AppDataLocal%\Microsoft\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp.KEKW
%Application Data%\Microsoft\Internet Explorer\Quick Launch\User Pinned\{username}
F:\data\tmp.doc.KEKW
%System Root%\Python27\Lib\lib2to3\tests\data\fixers\myfixes\{username}
%Favorites%\{username}
%System Root%\Users\All Users\Microsoft\RAC\PublishedData\{username}.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\certifi\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\{username}
%System Root%\Users\Public\Documents\excel2k\XLS2KE05.xls.KEKW
%All Users Profile%\Mozilla\updates\308046B0AF4A39CB\updates\0\{username}
%Application Data%\Macromedia\Flash Player\#SharedObjects\K48846QH\{username}
F:\data\photos\long_exposure.jpg.KEKW
%User Profile%\Links\{username}
%System Root%\Python27\libs\{username}
%System Root%\Users\Public\Documents\Email and Password List.txt.KEKW
%AppDataLocal%\Microsoft\Media Player\Sync Playlists\en-US\{username}
%All Users Profile%\VMware\VMware Tools\Unity Filters\googledesktop.txt.KEKW
%System Root%\Python27\Lib\importlib\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\43\{username}.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\6\{username}
%System Root%\Python27\include\structmember.h.KEKW
%System Root%\Users\All Users\Microsoft\Windows\DeviceMetadataStore\en-US\{username}.KEKW
%System Root%\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\urllib3\packages\backports\{username}
%AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\{username}
%System Root%\Python27\include\metagrammar.h.KEKW
%System Root%\Users\All Users\Microsoft\DRM\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\{username}.KEKW
%AppDataLocal%\Apps\2.0\Data\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\21\{username}
%System Root%\Python27\Lib\idlelib\{username}
%System Root%\Users\All Users\Oracle\Java\javapath_target_313094\{username}
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\Backup\{username}.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\EmieSiteList\{username}
%AppDataLocal%\pip\cache\http\b\a\9\{username}
%System Root%\Python27\Lib\email\test\data\msg_34.txt.KEKW
%System Root%\Python27\include\floatobject.h.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\idna\{username}
%All Users Profile%\VMware\VMware Tools\Unity Filters\microsoftoffice2003.txt.KEKW
%Application Data%\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\{username}
%Desktop%\word2k\DOC2KE02.doc.KEKW
%Application Data%\Microsoft\Windows\Network Shortcuts\{username}
%Application Data%\Microsoft\Templates\{username}
%System Root%\Python27\tcl\tix8.4.3\bitmaps\plusarm.gif.KEKW
%All Users Profile%\Microsoft\Assistance\{username}
%System Root%\Python27\Lib\msilib\{username}
%System Root%\Python27\Lib\idlelib\help.txt.KEKW
%User Temp%\dd_vcredistUI0FC1.txt.KEKW
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\{username}
%System Root%\Python27\tcl\tk8.5\demos\{username}
%System Root%\Python27\tcl\tix8.4.3\pref\TK.cs.KEKW
%System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\{username}.KEKW
%AppDataLocal%\Microsoft\Vault\{username}
%Application Data%\{username}
%AppDataLocal%\Microsoft\Windows\AppCache\6A582BR6\{username}
%System Root%\Users\All Users\Microsoft\Device Stage\Task\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\20\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\{username}.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\LastBld.dat.KEKW
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\{username}
%All Users Profile%\VMware\RawdskCompatibility\virtual\{username}
%AppDataLocal%\Google\Software Reporter Tool\settings.dat.KEKW
%System Root%\Python27\Lib\email\test\{username}
%System Root%\Python27\include\datetime.h.KEKW
%All Users Profile%\Microsoft\eHome\logs\{username}
%System Root%\Users\All Users\Oracle\Java\.oracle_jre_usage\{username}.KEKW
%System Root%\Python27\Lib\test\imghdrdata\python.gif.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F0\{username}.KEKW
%All Users Profile%\Microsoft\Windows Defender\LocalCopy\{username}
%System Root%\Python27\Lib\test\cjkencodings\shift_jis.txt.KEKW
%System Root%\Users\Public\Recorded TV\{username}
%AppDataLocal%\Google\Chrome\User Data\Subresource Filter\{username}
%System Root%\Python27\Lib\site-packages\pkg_resources\_vendor\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\43\{username}
%Application Data%\Microsoft\Windows\DNTException\{username}
%Favorites%\Links for United States\{username}
%System Root%\powerpoint2k\PPT2KE03.ppt.KEKW
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Temp\usgthrsvc\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp.KEKW
%System Root%\Users\Public\Documents\word2k\DOC2KE05.doc.KEKW
%Application Data%\Microsoft\SystemCertificates\My\Keys\{username}
%System Root%\Users\Default\AppData\Local\Microsoft\Windows\History\{username}
%System Root%\Users\All Users\Microsoft\RAC\StateData\{username}
%Desktop%\word2k\DOC2KE04.doc.KEKW
%System Root%\Users\{username}\AppData\Roaming\{username}
%System Root%\Python27\Lib\email\test\data\{username}
%System Root%\Python27\include\cellobject.h.KEKW
%System Root%\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\{username}
%User Profile%\Videos\{username}
%User Temp%\Microsoft .NET Framework 4.5.2 Setup_20161212_135033207-MSI_netfx_Full_GDR_x64.msi.txt.KEKW
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\{username}
%AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\_platform_specific\{username}
%System Root%\Python27\Tools\pynche\html40colors.txt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\9\{username}
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\82DF2NUK\{username}
%System Root%\Python27\Lib\test\sgml_input.html.KEKW
%AppDataLocal%\Microsoft\Feeds\{username}
%System Root%\Users\All Users\Microsoft\Windows NT\{username}.KEKW
%System Root%\Python27\include\pycapsule.h.KEKW
%System Root%\Python27\Lib\email\test\data\msg_24.txt.KEKW
%System Root%\Python27\include\pystrtod.h.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\EmieUserList\container.dat.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Entries\{username}
%Application Data%\Microsoft\Windows\PrivacIE\container.dat.KEKW
%All Users Profile%\Microsoft\Windows NT\MSFax\Queue\{username}
%System Root%\Users\All Users\Microsoft\OFFICE\{username}
%System Root%\Python27\Lib\test\test_doctest2.txt.KEKW
%System Root%\Python27\include\abstract.h.KEKW
%System Root%\Python27\Lib\site-packages\Pillow-6.0.0.dist-info\top_level.txt.KEKW
%AppDataLocal%Low\Microsoft\Windows\AppCache\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\47\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\Common\{username}
%All Users Profile%\Microsoft\Windows Defender\Definition Updates\{username}
%System Root%\Python27\Lib\test\test_difflib_expect.html.KEKW
%User Profile%\Documents\excel2k\XLS2KE01.xls.KEKW
%User Profile%\Downloads\{username}
%System Root%\Python27\Lib\test\testtar.tar.KEKW
%Application Data%\Microsoft\Windows\IECompatUACache\container.dat.KEKW
%System Root%\$Recycle.Bin\{username}
%User Profile%\Searches\{username}
%System Root%\Python27\README.txt.KEKW
%All Users Profile%\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\{username}
%AppDataLocal%\Microsoft\Internet Explorer\DomainSuggestions\{username}
%User Profile%\Documents\fp_18.0.0.203_archive\18_0_r0_203\{username}
%System Root%\Python27\tcl\tix8.4.3\demos\bitmaps\tix.gif.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\SentItems\{username}
%System Root%\Python27\Lib\test\cjkencodings\big5.txt.KEKW
%System Root%\Python27\Lib\lib-tk\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\chardet\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp.KEKW
%Desktop%\Transmag.doc.KEKW
%All Users Profile%\VMware\VMware Tools\Unity Filters\{username}
%Favorites%\Microsoft Websites\{username}
%System Root%\Python27\Lib\site-packages\pkg_resources\_vendor\packaging\{username}
%System Root%\Python27\include\longintrepr.h.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\58\{username}
%All Users Profile%\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\{username}
%System Root%\Python27\Lib\email\test\data\msg_43.txt.KEKW
%AppDataLocal%\pip\{username}
%AppDataLocal%\Google\Chrome\User Data\Crashpad\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows\DRM\{username}
%System Root%\Python27\Lib\ctypes\test\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp.KEKW
%AppDataLocal%\Google\Chrome\User Data\Crashpad\reports\{username}
%System Root%\Users\Public\Pictures\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\26\{username}
%Favorites%\Windows Live\{username}
%System Root%\Python27\tcl\tix8.4.3\bitmaps\warning.gif.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0\{username}.KEKW
%System Root%\Python27\include\pyconfig.h.KEKW
%System Root%\Users\All Users\McAfee\{username}
%Application Data%\Microsoft\Windows\PrivacIE\{username}
%System Root%\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.KEKW
%All Users Profile%\Oracle\Java\javapath\{username}
%System Root%\Users\All Users\Microsoft\MSDN\{username}.KEKW
%System Root%\Users\All Users\McAfee\WinCore\{username}
%AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Indexed Rules\25\9.1\{username}
%System Root%\Python27\Lib\pydoc_data\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A\{username}.KEKW
%System Root%\Python27\tcl\tcl8.5\msgs\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5\{username}
%All Users Profile%\Microsoft\Windows\DRM\Cache\{username}
%System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\{username}
%All Users Profile%\Microsoft\Network\Downloader\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\progress\{username}
%User Temp%\chrome_BITS_3756_19263\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\pytoml\{username}
%System Root%\Users\All Users\Microsoft\RAC\Outbound\{username}.KEKW
%System Root%\Users\All Users\Microsoft\RAC\Temp\{username}
%System Root%\Python27\Lib\email\test\data\msg_16.txt.KEKW
%System Root%\Users\Default\AppData\Local\Microsoft\Windows\{username}
%Application Data%\Mozilla\{username}
%Application Data%\Microsoft\Windows\IECompatUACache\Low\container.dat.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\datareporting\archived\{username}
%System Root%\Users\All Users\Microsoft\Windows\DRM\{username}.KEKW
%System Root%\Python27\Lib\wsgiref\{username}
%System Root%\Users\All Users\Microsoft\Network\Downloader\{username}
%User Profile%\Documents\excel2k\{username}
%User Profile%\Documents\fp_18.0.0.203_archive\18_0_r0_203_debug\{username}
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\{username}.KEKW
%System Root%\Python27\Lib\ensurepip\_bundled\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp.KEKW
%All Users Profile%\Oracle\Java\javapath_target_313094\{username}.KEKW
%User Profile%\Documents\powerpoint2k\PPT2KE03.ppt.KEKW
%AppDataLocal%\pip\cache\http\2\3\b\7\9\{username}
%All Users Profile%\Microsoft\OFFICE\{username}
%System Root%\Python27\Lib\lib2to3\tests\data\{username}
%System Root%\Python27\Lib\idlelib\Icons\openfolder.gif.KEKW
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KE01.ppt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\54\{username}
%All Users Profile%\Microsoft\Windows NT\MSFax\VirtualInbox\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\62\{username}
%System Root%\Users\All Users\Oracle\Java\.oracle_jre_usage\{username}
%System Root%\Python27\include\compile.h.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0\{username}
%Application Data%\Microsoft\Windows\{username}
%System Root%\powerpoint2k\PPT2KE05.ppt.KEKW
%System Root%\Users\Default\AppData\Local\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\SSScheduler\{username}.KEKW
%AppDataLocal%\{username}
%System Root%\Users\All Users\Microsoft\DeviceSync\{username}
F:\{username}
%System Root%\Python27\Lib\idlelib\Icons\tk.gif.KEKW
%AppDataLocal%\Google\Chrome\User Data\RecoveryImproved\{username}
%System Root%\Python27\Tools\Scripts\README.txt.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\EmieSiteList\container.dat.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\5\{username}
%All Users Profile%\Microsoft\Network\{username}
%System Root%\Python27\Lib\test\cjkencodings\iso2022_kr.txt.KEKW
%Application Data%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\{username}
%System Root%\Python27\tcl\tk8.5\demos\images\earth.gif.KEKW
%System Root%\Python27\tcl\tcl8.5\tzdata\Mexico\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5\{username}.KEKW
%All Users Profile%\Microsoft\Windows\DRM\blackbox.bin.KEKW
%System Root%\Python27\tcl\tk8.5\images\pwrdLogo100.gif.KEKW
%User Profile%\Documents\word2k\DOC2KE03.doc.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\{username}.KEKW
%System Root%\Python27\Lib\email\test\data\msg_33.txt.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp.KEKW
%System Root%\Python27\include\pymath.h.KEKW
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KE05.ppt.KEKW
%System Root%\Python27\include\methodobject.h.KEKW
%System Root%\Python27\Lib\site-packages\pkg_resources\{username}
%Application Data%\Mozilla\Firefox\Pending Pings\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\TRRBlacklist.txt.KEKW
%System Root%\Users\All Users\Oracle\Java\installcache_x64\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp.KEKW
%AppDataLocal%\Google\Chrome\User Data\SSLErrorAssistant\{username}
%System Root%\Python27\Lib\email\test\data\msg_01.txt.KEKW
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Stars.jpg.KEKW
%All Users Profile%\Microsoft\Windows Defender\{username}
%AppDataLocal%Low\Microsoft\Internet Explorer\EmieBrowserModeList\container.dat.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Temp\{username}.KEKW
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\SSScheduler\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\cachecontrol\{username}
%System Root%\Python27\Lib\bsddb\{username}
%All Users Profile%\Adobe\Setup\{username}
%User Temp%\jawshtml.html.KEKW
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp.KEKW
%System Root%\Users\All Users\Oracle\Java\javapath\{username}
%AppDataLocal%\Python-Eggs\Python-Eggs\Cache\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\webencodings\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\weave\failed\{username}
%System Root%\Users\All Users\Microsoft\RAC\{username}
%System Root%\Users\All Users\VMware\VMware Tools\Unity Filters\{username}.KEKW
%AppDataLocal%\pip\cache\http\f\e\d\0\{username}
%System Root%\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg.KEKW
%AppDataLocal%\Microsoft\Windows\History\Low\History.IE5\container.dat.KEKW
%System Root%\Users\All Users\Mozilla\{username}
%All Users Profile%\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.KEKW
%Desktop%\powerpoint2k\PPT2KExx.PPT.KEKW
%System Root%\Python27\Lib\site-packages\setuptools\extern\{username}
%AppDataLocal%\Microsoft\Internet Explorer\UrlBlockManager\{username}
%AppDataLocal%\Mozilla\Firefox\Profiles\{username}
%System Root%\Python27\tcl\tcl8\8.4\{username}
%All Users Profile%\Microsoft\Windows Defender\Support\{username}
%User Profile%\Music\{username}
%All Users Profile%\Microsoft\Assistance\Client\1.0\{username}
%Application Data%\Identities\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Stucco.gif.KEKW
%System Root%\{username}
%System Root%\Python27\include\structseq.h.KEKW
%System Root%\Python27\include\ucnhash.h.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\60\{username}
%System Root%\Python27\Lib\site-packages\pip\_internal\req\{username}
%System Root%\Python27\Lib\{username}
%System Root%\Python27\Lib\json\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\History\CacheManager\{username}
%System Root%\Python27\include\bytes_methods.h.KEKW
%System Root%\Users\Default\Favorites\{username}
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp.KEKW
%System Root%\Python27\Lib\lib-tk\test\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\{username}
%System Root%\Python27\Lib\ctypes\macholib\{username}
%System Root%\Python27\include\errcode.h.KEKW
%All Users Profile%\Microsoft\Search\{username}
%System Root%\Python27\Lib\site-packages\{username}
%User Temp%\mozilla-temp-files\{username}
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp.KEKW
%System Root%\Python27\include\bytearrayobject.h.KEKW
%AppDataLocal%\Microsoft\Windows Sidebar\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\{username}
%AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Active\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\SmallInstaller\{username}.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\imagestore\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\Europe\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\VMware\VMware Tools\{username}
%Desktop%\word2k\DOC2KE03.doc.KEKW
%System Root%\Python27\tcl\tix8.4.3\pref\TkWin.cs.KEKW
%System Root%\Python27\tcl\tk8.5\images\pwrdLogo75.gif.KEKW
%System Root%\Python27\Tools\webchecker\README.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\Chile\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\{username}
%AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Pine_Lumber.jpg.KEKW
%Application Data%\Microsoft\SystemCertificates\My\Certificates\{username}
%AppDataLocal%\Microsoft\Windows\History\Low\History.IE5\{username}
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\safebrowsing\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp.KEKW
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Small_News.jpg.KEKW
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KE04.ppt.KEKW
%Favorites%\Links\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\{username}.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\63\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Temp\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Resource\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\{username}
%System Root%\Python27\include\opcode.h.KEKW
%All Users Profile%\Microsoft\Windows\GameExplorer\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\70\{username}
%AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\RJ6VBH4W.DN2\clic...exe_9ae46cec200785df_0001.0003_none_d631acba18f736d8\{username}
%System Root%\Python27\Lib\test\cjkencodings\hz-utf8.txt.KEKW
%System Root%\Python27\Lib\email\test\data\PyBanner048.gif.KEKW
%System Root%\Python27\Lib\idlelib\Icons\plusnode.gif.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\16\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\McCHSvc\{username}
%System Root%\Python27\Tools\i18n\{username}
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache.bin.KEKW
%All Users Profile%\Microsoft\Windows NT\MSFax\Inbox\{username}
%System Root%\Users\All Users\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\{username}.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\30\{username}
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\{username}
%System Root%\Python27\include\sliceobject.h.KEKW
%System Root%\Python27\Lib\email\test\data\msg_06.txt.KEKW
%System Root%\Users\All Users\McAfee\MCLOGS\{username}
%AppDataLocal%\Microsoft\Feeds Cache\CRAV926P\{username}
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\{username}.KEKW
%System Root%\Python27\include\warnings.h.KEKW
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\{username}
%System Root%\Users\All Users\Oracle\{username}
%System Root%\Python27\Tools\pynche\websafe.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\Updates\{username}.KEKW
%All Users Profile%\Microsoft\Windows\DeviceMetadataStore\{username}
%System Root%\Python27\include\rangeobject.h.KEKW
%AppDataLocal%\Google\Chrome\User Data\WidevineCdm\{username}
%System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_505c7fc25c7e5866de583f14c22e2b4c2a6018c_0a2493a7\{username}.KEKW
%System Root%\Python27\Lib\site-packages\pip\_vendor\{username}
%AppDataLocal%\pip\cache\http\d\3\7\{username}
%All Users Profile%\Microsoft\{username}
%System Root%\Python27\Lib\test\imghdrdata\python.jpg.KEKW
%All Users Profile%\Microsoft\Windows\WER\ReportArchive\{username}
%System Root%\excel2k\XLS2KE01.xls.KEKW
%AppDataLocal%\Microsoft\Credentials\{username}
%All Users Profile%\Microsoft\Device Stage\Task\{{GUID}}\en-US\{username}
%All Users Profile%\Microsoft\Windows\Power Efficiency Diagnostics\energy-report.html.KEKW
%User Temp%\hsperfdata_{username}\{username}
%AppDataLocal%\pip\cache\http\3\{username}
%System Root%\Recovery\{username}
%AppDataLocal%\pip\cache\http\a\6\9\b\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\48\{username}
%All Users Profile%\Microsoft\Network\Downloader\qmgr1.dat.KEKW
%System Root%\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\VMware Tools\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1D\{username}
%System Root%\Python27\Lib\lib-tk\test\test_tkinter\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Quick\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01\{username}
%System Root%\Python27\tcl\tk8.5\demos\images\tcllogo.gif.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\1D\{username}.KEKW
%All Users Profile%\Microsoft\User Account Pictures\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\{username}
%System Root%\Users\Public\Music\Sample Music\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp.KEKW
%System Root%\Python27\include\frameobject.h.KEKW
%AppDataLocal%\pip\cache\http\a\6\{username}
%System Root%\Python27\include\token.h.KEKW
%System Root%\Python27\include\sysmodule.h.KEKW
%All Users Profile%\Microsoft\OFFICE\Groove\{username}
%System Root%\Users\All Users\Adobe\{username}.KEKW
%AppDataLocal%\Google\Chrome\User Data\pnacl\{username}
%System Root%\Python27\include\node.h.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3\{username}.KEKW
%AppDataLocal%\Google\Software Reporter Tool\reports\{username}
%All Users Profile%\Microsoft\MF\{username}
%System Root%\Users\All Users\Microsoft\eHome\logs\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Startup\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Service\{username}
%System Root%\Python27\Lib\lib2to3\tests\data\fixers\{username}
%System Root%\Users\All Users\Microsoft\Windows\WER\{username}.KEKW
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\McCHSvc\{username}.KEKW
%Application Data%\Microsoft\Windows\Recent\AutomaticDestinations\{username}
%Application Data%\Microsoft\Internet Explorer\Quick Launch\{username}
%System Root%\Python27\Lib\email\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0\{username}
%System Root%\Python27\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47\{username}.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\29\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\distlib\_backport\{username}
%All Users Profile%\VMware\RawdskCompatibility\native\{username}
%System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\updates\0\{username}
%System Root%\Users\All Users\Microsoft\Assistance\{username}
%System Root%\Python27\Lib\tkinter\{username}
%System Root%\Python27\include\boolobject.h.KEKW
%System Root%\Users\Default\AppData\Roaming\Media Center Programs\{username}
%AppDataLocal%\Google\Chrome\User Data\SSLErrorAssistant\7\_metadata\{username}
%System Root%\Python27\include\pyfpe.h.KEKW
%AppDataLocal%\pip\cache\http\f\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp.KEKW
%Desktop%\excel2k\XLS2KExx.xls.KEKW
%AppDataLocal%\Microsoft\Windows\AppCache\6A582BR6\container.dat.KEKW
%System Root%\Python27\Lib\tkinter\test\{username}
%Application Data%\Microsoft\Document Building Blocks\{username}
%AppDataLocal%\Microsoft\Windows\WER\{username}
%All Users Profile%\Microsoft\Search\Data\Temp\usgthrsvc\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\datareporting\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Tanspecks.jpg.KEKW
%AppDataLocal%\pip\cache\http\a\{username}
%System Root%\Python27\include\pystate.h.KEKW
%Application Data%\Sun\{username}
%AppDataLocal%\Google\Chrome\User Data\InterventionPolicyDatabase\{username}
%System Root%\Users\All Users\Microsoft\Windows\GameExplorer\{username}.KEKW
%System Root%\Python27\Tools\versioncheck\{username}
%System Root%\Users\All Users\Microsoft\DRM\Server\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\10\{username}
%System Root%\Python27\tcl\tix8.4.3\bitmaps\plus.gif.KEKW
%System Root%\Users\Public\Downloads\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Tablet PC\{username}
%System Root%\Python27\include\moduleobject.h.KEKW
%Desktop%\excel2k\XLS2KE05.xls.KEKW
%System Root%\Python27\Lib\site-packages\pip\_internal\utils\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\Common\SmallInstaller\{username}.KEKW
%System Root%\Users\Default\Saved Games\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp.KEKW
%AppDataLocal%Low\Microsoft\Windows\{username}
%AppDataLocal%\pip\cache\http\a\6\9\{username}
%System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_505c7fc25c7e5866de583f14c22e2b4c2a6018c_0a2493a7\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\{username}.KEKW
%System Root%\Python27\Lib\site-packages\pip\_internal\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\43\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01\{username}.KEKW
%Application Data%\Microsoft\AddIns\{username}
%Desktop%\excel2k\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Sand_Paper.jpg.KEKW
%AppDataLocal%\pip\cache\http\4\e\e\3\1\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\{username}
%System Root%\Python27\Lib\site-packages\PIL\{username}
%System Root%\Python27\include\cStringIO.h.KEKW
%Application Data%\Microsoft\Windows\IECompatCache\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\{username}.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp.KEKW
%All Users Profile%\Microsoft\Windows\DeviceMetadataStore\en-US\{username}
%All Users Profile%\VMware\{username}
%System Root%\Users\Default\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\{username}
%AppDataLocal%\pip\cache\http\d\3\7\e\{username}
%AppDataLocal%Low\Sun\Java\Deployment\log\{username}
%All Users Profile%\Microsoft\RAC\{username}
%System Root%\Users\All Users\VMware\VMware Tools\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\chardet\cli\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\55\{username}
%User Profile%\Documents\excel2k\XLS2KE04.xls.KEKW
%System Root%\Python27\Lib\test\cjkencodings\euc_kr.txt.KEKW
%All Users Profile%\Microsoft\Windows NT\MSFax\SentItems\{username}
%System Root%\Email and Password List.js.KEKW
%System Root%\Users\All Users\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\{username}.KEKW
%All Users Profile%\Microsoft\eHome\{username}
%System Root%\PerfLogs\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\crashes\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp.KEKW
%All Users Profile%\Microsoft\RAC\StateData\{username}
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\Queue\{username}
%System Root%\Users\Public\Documents\excel2k\XLS2KE03.xls.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Definition Updates\{username}.KEKW
%System Root%\Python27\Lib\idlelib\Icons\idle_16.gif.KEKW
%Application Data%\Microsoft\Windows\IECompatUACache\Low\{username}
%System Root%\Users\All Users\Microsoft\Windows\Templates\{username}.KEKW
%System Root%\Python27\Lib\email\test\data\msg_14.txt.KEKW
%System Root%\Python27\include\timefuncs.h.KEKW
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\{username}.KEKW
%AppDataLocal%\Apps\2.0\Data\RNQG94OQ.QJC\{username}
%AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Indexed Rules\25\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\{username}.KEKW
%AppDataLocal%Low\Microsoft\Internet Explorer\Services\{username}
%System Root%\Users\All Users\Microsoft\Windows\Sqm\Upload\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Network\Downloader\{username}.KEKW
%System Root%\Python27\tcl\tk8.5\images\{username}
%System Root%\Python27\Lib\lib2to3\{username}
%System Root%\Python27\Lib\site-packages\pkg_resources\extern\{username}
%System Root%\Users\All Users\{username}
%AppDataLocal%\Microsoft\Windows\WER\ReportQueue\{username}
%All Users Profile%\Microsoft\Search\Data\{username}
%AppDataLocal%\pip\cache\http\4\e\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\{username}
%System Root%\Python27\Lib\ctypes\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\colorama\{username}
%All Users Profile%\McAfee\MCLOGS\Common\{username}
%System Root%\Python27\Lib\multiprocessing\dummy\{username}
%Application Data%\Microsoft\Windows\IETldCache\Low\{username}
%System Root%\Python27\include\longobject.h.KEKW
%System Root%\Python27\Lib\test\cjkencodings\iso2022_jp.txt.KEKW
%System Root%\Python27\Lib\tkinter\test\test_ttk\{username}
%System Root%\Users\All Users\Oracle\Java\installcache_x64\{username}.KEKW
%System Root%\Python27\Lib\test\cjkencodings\euc_jisx0213-utf8.txt.KEKW
%AppDataLocal%\pip\cache\http\2\3\b\7\{username}
%System Root%\Python27\Lib\email\test\data\msg_36.txt.KEKW
%System Root%\Users\All Users\Microsoft\OFFICE\Groove\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\History\Service\{username}
%System Root%\Users\All Users\Microsoft\NetFramework\BreadcrumbStore\{username}.KEKW
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\{username}
%System Root%\Python27\include\classobject.h.KEKW
%System Root%\Users\Public\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp.KEKW
%System Root%\excel2k\XLS2KE03.xls.KEKW
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\{username}
%AppDataLocal%\pip\cache\http\4\e\e\{username}
%System Root%\Users\Default\Documents\{username}
%Application Data%\Microsoft\Word\{username}
%All Users Profile%\McAfee\MCLOGS\PartnerCustom\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\31\{username}
%System Root%\Python27\Lib\email\test\data\msg_37.txt.KEKW
%System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\entry_points.txt.KEKW
%AppDataLocal%\Google\Chrome\User Data\SwReporter\40.200.201.3\_metadata\{username}
%Application Data%\Microsoft\Windows\IECompatCache\Low\container.dat.KEKW
%Application Data%\Microsoft\Windows\SendTo\{username}
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\2LHHLFH6\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\Asia\{username}
%System Root%\Users\All Users\Microsoft\IlsCache\{username}.KEKW
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\{username}
%System Root%\Python27\Lib\logging\{username}
%AppDataLocal%\Apps\{username}
%All Users Profile%\{username}
%AppDataLocal%\Google\Chrome\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Config\{username}
%System Root%\excel2k\XLS2KExx.xls.KEKW
%System Root%\Users\Public\Desktop\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp.KEKW
%AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\_platform_specific\all\{username}
%System Root%\Users\All Users\Adobe\ARM\Reader_19.010.20099\{username}.KEKW
%AppDataLocal%\Microsoft\Windows\1024\{username}
%Application Data%\Microsoft\Office\Recent\{username}
%System Root%\Python27\Lib\email\test\data\msg_12a.txt.KEKW
%System Root%\Users\Public\Documents\word2k\DOC2KExx.doc.KEKW
%AppDataLocal%\Google\{username}
%AppDataLocal%\pip\cache\http\3\8\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5\{username}
%System Root%\Python27\tcl\tcl8.5\opt0.4\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\{username}.KEKW
%System Root%\Python27\Tools\pynche\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\2\{username}
%System Root%\Users\All Users\Microsoft\Windows\Templates\{username}
%System Root%\Python27\tcl\tk8.5\images\pwrdLogo150.gif.KEKW
%System Root%\Users\Default\AppData\Local\Microsoft\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\25\{username}
%System Root%\Users\All Users\Microsoft\RAC\Outbound\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\Atlantic\{username}
%All Users Profile%\VMware\VMware Tools\Unity Filters\adobeflashcs3.txt.KEKW
%AppDataLocal%\Microsoft\Media Player\Sync Playlists\{username}
%All Users Profile%\McAfee\MCLOGS\PartnerCustom\550F8967-2EE2-4F33-8E16-1BFFBE114803\{username}
%All Users Profile%\VMware\VMware Tools\{username}
%AppDataLocal%\Microsoft\Internet Explorer\Tiles\{username}
F:\wlines.zip.KEKW
%AppDataLocal%\Microsoft\Feeds\Microsoft Feeds~\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\SmallInstaller\{username}
%System Root%\Python27\include\unicodeobject.h.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\{username}.KEKW
%AppDataLocal%\Microsoft\Feeds Cache\NWKETFVL\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\CacheManager\{username}
%System Root%\Users\Public\Documents\word2k\DOC2KE04.doc.KEKW
%System Root%\Users\All Users\Microsoft\DRM\{username}.KEKW
%User Profile%\Documents\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F0\{username}
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\extensions\{username}
%System Root%\Python27\Lib\test\subprocessdata\{username}
%System Root%\Python27\Lib\test\audiodata\pluck-pcm32.wav.KEKW
%System Root%\Python27\include\codecs.h.KEKW
%System Root%\Python27\Lib\email\test\data\msg_31.txt.KEKW
%AppDataLocal%\Google\Chrome\User Data\SwReporter\40.200.201.3\{username}
%AppDataLocal%\Microsoft\Internet Explorer\brndlog.txt.KEKW
%Application Data%\Mozilla\Firefox\{username}
%System Root%\powerpoint2k\PPT2KE04.ppt.KEKW
%AppDataLocal%\Apps\2.0\E1ZRTJ0R.MXR\RJ6VBH4W.DN2\goog...app_9ae46cec200785df_0001.0003_7581c0cd83ac8659\{username}
%System Root%\Users\All Users\Microsoft\OFFICE\Groove\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp.KEKW
%System Root%\Python27\tcl\tix8.4.3\pref\Bisque.cs.KEKW
%Desktop%\powerpoint2k\PPT2KE05.ppt.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\{username}
%System Root%\powerpoint2k\PPT2KE02.ppt.KEKW
%System Root%\Python27\Lib\idlelib\Icons\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43\{username}
%AppDataLocal%\Microsoft\Windows\1033\StructuredQuerySchema.bin.KEKW
%Application Data%\Microsoft\Excel\{username}
%Application Data%\Microsoft\Spelling\{username}
%User Profile%\Documents\powerpoint2k\PPT2KE02.ppt.KEKW
%System Root%\Python27\Lib\test\cjkencodings\iso2022_kr-utf8.txt.KEKW
%All Users Profile%\Mozilla\{username}
%Application Data%\Sun\Java\Deployment\{username}
%AppDataLocal%\Microsoft\Feeds Cache\COOE7IBP\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\{username}
%AppDataLocal%\Microsoft\Windows\1033\{username}
%All Users Profile%\Microsoft\Windows NT\MSScan\{username}
%System Root%\Users\Public\Recorded TV\Sample Media\{username}
%All Users Profile%\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_72da1383309c93bd2441accd728cf953e4fa97a_0a24a840\{username}
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\2PEMJMIY\{username}
%System Root%\Python27\Lib\idlelib\Icons\idle_48.gif.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\{username}
%AppDataLocal%Low\Microsoft\Windows\AppCache\LY14JQYG\{username}
%System Root%\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\{username}
%System Root%\Users\All Users\Adobe\ARM\S\{username}.KEKW
%System Root%\Python27\Lib\email\test\data\msg_23.txt.KEKW
%AppDataLocal%\Microsoft\Office\ONetConfig\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\packaging\{username}
%System Root%\Users\All Users\Microsoft\RAC\Temp\{username}.KEKW
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\DATA\{username}
%AppDataLocal%\Microsoft\Feeds Cache\NKNYYDHU\{username}
%User Temp%\dd_vcredistUI0FD5.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows\AIT\{username}.KEKW
%AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\{username}
%System Root%\Users\All Users\Microsoft\NetFramework\{username}
%Application Data%\Microsoft\MMC\{username}
%User Profile%\Saved Games\{username}
%System Root%\Python27\Lib\email\test\data\msg_32.txt.KEKW
%System Root%\Users\All Users\Microsoft\Media Player\{username}.KEKW
%AppDataLocal%Low\Microsoft\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\{username}.KEKW
%System Root%\Python27\Lib\email\mime\{username}
%System Root%\Users\All Users\Mozilla\updates\308046B0AF4A39CB\{username}.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\{username}
%Desktop%\Email and Password List.txt.KEKW
%System Root%\Python27\Lib\test\cjkencodings\gb2312.txt.KEKW
%System Root%\Python27\include\funcobject.h.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\frameiconcache.dat.KEKW
%System Root%\Python27\Lib\sqlite3\test\{username}
%System Root%\Users\All Users\Oracle\Java\javapath\{username}.KEKW
%AppDataLocal%\Microsoft\Internet Explorer\{username}
%System Root%\Python27\Tools\pynche\X\rgb.txt.KEKW
%AppDataLocal%\Microsoft\Windows\WER\ReportArchive\{username}
%System Root%\Users\All Users\Adobe\ARM\S\{username}
%Application Data%\Mozilla\Firefox\Crash Reports\events\{username}
%All Users Profile%\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3\{username}
%All Users Profile%\Microsoft\Windows\Ringtones\{username}
%AppDataLocal%Low\Sun\Java\Deployment\tmp\si\{username}
%System Root%\Python27\Lib\bsddb\test\{username}
%AppDataLocal%\Mozilla\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\35\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Cave_Drawings.gif.KEKW
%AppDataLocal%\pip\cache\http\5\{username}
%All Users Profile%\McAfee\MCLOGS\Common\SmallInstaller\{username}
%System Root%\Users\All Users\Microsoft\Windows\Ringtones\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Resource\{username}
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0\{username}
%System Root%\Python27\Lib\test\imghdrdata\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Bears.jpg.KEKW
%System Root%\Python27\Lib\test\audiodata\pluck-pcm24.wav.KEKW
%System Root%\Python27\Lib\idlelib\Icons\python.gif.KEKW
%System Root%\Python27\tcl\tix8.4.3\bitmaps\file.gif.KEKW
%System Root%\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\gmp\WINNT_x86_64-msvc\{username}
%System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\top_level.txt.KEKW
%Application Data%\Media Center Programs\{username}
%Application Data%\Microsoft\Protect\S-1-5-21-2407829820-1079796033-203259571-500\{username}
%AppDataLocal%\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\{username}
%Desktop%\word2k\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0\{username}.KEKW
%AppDataLocal%\Google\Chrome\User Data\pnacl\0.57.44.2492\_metadata\{username}
%System Root%\$Recycle.Bin\S-1-5-21-2407829820-1079796033-203259571-500\$IC8HJH8.zip.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\49\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows\DeviceMetadataStore\{username}.KEKW
%System Root%\Users\Default\Pictures\{username}
%Application Data%\Macromedia\Flash Player\#SharedObjects\{username}
%System Root%\Python27\include\pyport.h.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\prefs.js.KEKW
%System Root%\Users\All Users\Microsoft\eHome\{username}.KEKW
%System Root%\Python27\tcl\tk8.5\demos\images\earthris.gif.KEKW
%AppDataLocal%\pip\cache\http\b\a\9\3\{username}
%System Root%\Python27\Lib\lib2to3\pgen2\{username}
%System Root%\powerpoint2k\PPT2KE01.ppt.KEKW
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KE03.ppt.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Python 2.7\{username}
%AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\{username}
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\{username}.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\ActivityLog\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\{username}
%User Profile%\Documents\excel2k\XLS2KE03.xls.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\{username}.KEKW
%AppDataLocal%\pip\cache\http\0\2\5\2\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Java\{username}.KEKW
%System Root%\Python27\include\asdl.h.KEKW
%System Root%\Users\All Users\Microsoft\Windows NT\{username}
%System Root%\Users\All Users\Microsoft\Search\Data\{username}.KEKW
%Desktop%\excel2k\XLS2KE04.xls.KEKW
%System Root%\Users\Public\Documents\{username}
%AppDataLocal%\Microsoft\Windows\WebCache\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Java\{username}
%System Root%\Users\All Users\Mozilla\{username}.KEKW
%All Users Profile%\Microsoft\Vault\{username}
%AppDataLocal%Low\Microsoft\Internet Explorer\EmieSiteList\container.dat.KEKW
%User Profile%\Documents\excel2k\XLS2KE05.xls.KEKW
%System Root%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\{username}.KEKW
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Blue_Gradient.jpg.KEKW
%System Root%\Python27\Lib\distutils\{username}
%User Temp%\dd_wcf_CA_smci_20161212_135109_353.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Python 2.7\{username}.KEKW
%Desktop%\note.txt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\13\{username}
%AppDataLocal%\Google\Chrome\User Data\pnacl\0.57.44.2492\_platform_specific\{username}
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\{username}
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\{username}
%All Users Profile%\Microsoft\OFFICE\DATA\{username}
%Desktop%\Email and Password List.js.KEKW
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\gmp\{username}
%All Users Profile%\Microsoft\Windows NT\MSFax\Common Coverpages\{username}
%All Users Profile%\Microsoft Help\{username}
%AppDataLocal%\pip\cache\http\7\e\9\{username}
%System Root%\Python27\include\pygetopt.h.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\44\{username}
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Quick\{username}.KEKW
%System Root%\Python27\Lib\site-packages\Pillow-6.0.0.dist-info\{username}
%System Root%\Python27\Lib\email\test\data\msg_17.txt.KEKW
%System Root%\Python27\Lib\test\leakers\README.txt.KEKW
%System Root%\Python27\Lib\email\test\data\msg_38.txt.KEKW
%AppDataLocal%\Microsoft\Windows Mail\Stationery\White_Chocolate.jpg.KEKW
%Application Data%\Microsoft\Excel\XLSTART\{username}
%AppDataLocal%\pip\cache\{username}
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\{username}.KEKW
%Application Data%\Microsoft\SystemCertificates\My\{username}
%System Root%\Python27\include\pythread.h.KEKW
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\{username}
%System Root%\Users\All Users\Microsoft\Windows\DRM\Cache\{username}.KEKW
%System Root%\Python27\Lib\email\test\data\msg_21.txt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\36\{username}
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\{username}
%System Root%\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp.KEKW
%AppDataLocal%\Microsoft\Office\Groove\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Peacock.jpg.KEKW
%AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Indexed Rules\{username}
%System Root%\Users\{username}\AppData\Roaming\Microsoft\{username}
%System Root%\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_72da1383309c93bd2441accd728cf953e4fa97a_0a24a840\{username}
%All Users Profile%\Microsoft\Windows Defender\Quarantine\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\32\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\{username}.KEKW
%System Root%\Users\Public\Documents\excel2k\XLS2KE04.xls.KEKW
%System Root%\Python27\tcl\tcl8.5\tzdata\Pacific\{username}
%System Root%\Users\Default\Music\{username}
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\OFFICE\DATA\{username}.KEKW
%AppDataLocal%\Microsoft\Windows\Explorer\{username}
%System Root%\Python27\Lib\test\test_doctest4.txt.KEKW
%System Root%\Users\All Users\Microsoft\Windows\Caches\{username}.KEKW
%System Root%\Python27\tcl\tix8.4.3\pref\SGIGray.cs.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\{username}
%System Root%\Python27\include\code.h.KEKW
%System Root%\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\{username}.KEKW
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95\{username}
%System Root%\Python27\tcl\tix8.4.3\bitmaps\textfile.gif.KEKW
%AppDataLocal%\Google\Chrome\User Data\PepperFlash\32.0.0.171\_metadata\{username}
%System Root%\Python27\include\enumobject.h.KEKW
%System Root%\Users\Default\Downloads\{username}
%System Root%\Users\All Users\Microsoft\Windows\Sqm\Sessions\{username}
%System Root%\Users\All Users\Microsoft\Windows\Sqm\Manifest\{username}
%System Root%\Users\All Users\McAfee\MCLOGS\PartnerCustom\550F8967-2EE2-4F33-8E16-1BFFBE114803\{username}.KEKW
%All Users Profile%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\{username}
%System Root%\Python27\Lib\idlelib\HISTORY.txt.KEKW
%System Root%\Python27\Lib\test\cjkencodings\johab.txt.KEKW
%System Root%\Python27\include\py_curses.h.KEKW
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\thumbnails\{username}
%System Root%\Python27\Lib\compiler\{username}
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\Resources\1D\{username}
%System Root%\Python27\tcl\tk8.5\demos\images\{username}
%System Root%\Python27\include\pgen.h.KEKW
%System Root%\Python27\Lib\test\crashers\{username}
%AppDataLocal%\Python-Eggs\Python-Eggs\{username}
%System Root%\Python27\include\pydebug.h.KEKW
%AppDataLocal%\Google\Chrome\User Data\PepperFlash\32.0.0.171\{username}
%System Root%\Python27\Lib\site-packages\pip\_internal\vcs\{username}
%Application Data%\Microsoft\Windows\PrivacIE\Low\{username}
%User Temp%\CR_E83EE.tmp\{username}
%System Root%\Python27\include\patchlevel.h.KEKW
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\{username}
%System Root%\Users\Public\Music\Sample Music\Sleep Away.mp3.KEKW
%System Root%\Python27\Lib\encodings\{username}
%System Root%\Python27\Lib\site-packages\setuptools\_vendor\{username}
%System Root%\Python27\Lib\email\test\data\msg_26.txt.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\53\{username}
%User Profile%\{username}
%System Root%\Users\All Users\Microsoft\eHome\logs\{username}.KEKW
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\28\{username}
%System Root%\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\{username}
%AppDataLocal%\Google\Chrome\User Data\CertificateTransparency\1115\_platform_specific\all\sths\{username}
%System Root%\Python27\Tools\pynche\X\{username}
%System Root%\Users\All Users\Microsoft\WwanSvc\{username}
%System Root%\Users\All Users\Microsoft\Network\{username}
%AppDataLocal%Low\Sun\{username}
%System Root%\Users\All Users\VMware\RawdskCompatibility\native\C\ProgramData\Microsoft\{username}
%System Root%\Python27\Tools\pynche\X\xlicense.txt.KEKW
%All Users Profile%\Microsoft\Windows Defender\Definition Updates\{0E1465B0-BA9C-409F-BC32-D934317129CD}\{username}
%System Root%\Python27\tcl\tix8.4.3\demos\samples\{username}
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp.KEKW
%System Root%\Python27\include\pystrcmp.h.KEKW
%System Root%\Python27\tcl\tcl8.5\tzdata\Brazil\{username}
%System Root%\Users\Public\Videos\Sample Videos\{username}
%AppDataLocal%\Google\Chrome\User Data\MEIPreload\{username}
%AppDataLocal%\Microsoft\Windows\AppCache\container.dat.KEKW
%System Root%\Python27\Lib\site-packages\README.txt.KEKW
%System Root%\Python27\include\bytesobject.h.KEKW
%AppDataLocal%\Microsoft\Windows\AppCache\{username}
%AppDataLocal%Low\Sun\Java\Deployment\cache\6.0\24\{username}
%System Root%\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\America\{username}
%System Root%\Users\{username}\AppData\Local\Microsoft\Media Player\{username}
%All Users Profile%\Mozilla\updates\308046B0AF4A39CB\{username}
%System Root%\Python27\tcl\tcl8.5\tzdata\America\North_Dakota\{username}
%AppDataLocal%\Apps\2.0\Data\RNQG94OQ.QJC\E1WGPJBQ.PMC\goog...app_9ae46cec200785df_0001.0003_7581c0cd83ac8659\Data\{username}
%System Root%\Users\All Users\Microsoft\RAC\StateData\RacMetaData.dat.KEKW
%System Root%\Users\Public\Pictures\Sample Pictures\Penguins.jpg.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\{username}
%Application Data%\Microsoft\Word\STARTUP\{username}
%System Root%\Python27\Lib\test\test_doctest3.txt.KEKW
%System Root%\Python27\Lib\site-packages\pythonnet-2.1.0.dist-info\top_level.txt.KEKW
%System Root%\Users\{username}
%System Root%\Users\Public\Documents\excel2k\XLS2KE02.xls.KEKW
%System Root%\Users\All Users\Microsoft\Device Stage\{username}.KEKW
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp.KEKW
%AppDataLocal%\Microsoft\Feeds Cache\8TQ1M9OZ\{username}
%Application Data%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\{username}
%Desktop%\excel2k\XLS2KE03.xls.KEKW
%Application Data%\Microsoft\Windows\DNTException\container.dat.KEKW
%System Root%\Python27\include\pyctype.h.KEKW
%System Root%\Python27\Lib\test\cjkencodings\gb18030.txt.KEKW
%System Root%\Python27\Lib\xml\sax\{username}
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Monet.jpg.KEKW
%System Root%\Python27\Lib\email\test\data\msg_44.txt.KEKW
%Application Data%\Mozilla\Extensions\{username}
%AppDataLocal%\pip\cache\http\5\4\3\d\{username}
%System Root%\Users\All Users\Microsoft\Vault\{username}
%System Root%\Python27\Lib\email\test\data\msg_29.txt.KEKW
%System Root%\Python27\Lib\email\test\data\msg_45.txt.KEKW
%System Root%\Users\All Users\Microsoft\RAC\StateData\RacWmiEventData.dat.KEKW
%System Root%\Python27\Lib\distutils\tests\{username}
%AppDataLocal%\Microsoft\Internet Explorer\EmieUserList\{username}
%System Root%\Python27\Lib\site-packages\pip\_vendor\pkg_resources\{username}
%System Root%\Python27\Lib\test\audiodata\pluck-pcm16.wav.KEKW
%System Root%\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\{username}.KEKW
%AppDataLocal%\pip\cache\http\3\8\9\{username}
%User Profile%\AppData\{username}
%System Root%\Python27\Lib\email\test\data\msg_13.txt.KEKW
Once located, select the file then press SHIFT+DELETE to delete it.
*Note: Read the following Microsoft page if these steps do not work on Windows 7 and Windows Server 2008 (R2).

Step 5

Restart in normal mode and scan your computer with your Trend Micro product for files detected as TrojanSpy.MSIL.URSNIF.THCBFBO. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Step 6

Restore this file from backup only Microsoft-related files will be restored. If this malware/grayware also deleted files related to programs that are not from Microsoft, please reinstall those programs on you computer again.

%System Root%\Python27\Lib\email\test\data\msg_39.txt
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp
%System Root%\Python27\Lib\test\cjkencodings\johab.txt
%User Profile%\Documents\excel2k\XLS2KE03.xls
%System Root%\Python27\include\datetime.h
%System Root%\Python27\include\abstract.h
%System Root%\Python27\include\patchlevel.h
%System Root%\Python27\Lib\test\cjkencodings\cp949.txt
%System Root%\Python27\Lib\test\cjkencodings\shift_jis-utf8.txt
%AppDataLocal%\Microsoft\Windows Mail\Stationery\HandPrints.jpg
%System Root%\Python27\Lib\email\test\data\msg_18.txt
%System Root%\Python27\Lib\test\leakers\README.txt
%System Root%\Python27\Lib\email\test\data\msg_38.txt
%System Root%\Python27\include\sysmodule.h
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Notebook.jpg
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp
%System Root%\Python27\include\dtoa.h
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp
%System Root%\Python27\Lib\test\cjkencodings\gb18030-utf8.txt
%System Root%\Python27\tcl\tix8.4.3\pref\Blue.cs
F:\data\photos\stunning.jpg
%System Root%\Python27\include\graminit.h
%System Root%\Python27\include\cellobject.h
%System Root%\Python27\tcl\tix8.4.3\pref\WmDefault.cs
%System Root%\Python27\Lib\email\test\data\msg_05.txt
F:\data\photos\long_exposure.jpg
%All Users Profile%\VMware\VMware Tools\Unity Filters\adobeflashcs3.txt
%System Root%\Users\Public\Pictures\Sample Pictures\Tulips.jpg
%System Root%\Python27\Lib\test\test_doctest4.txt
%User Temp%\jawshtml.html
%System Root%\Python27\Lib\test\cjkencodings\iso2022_jp-utf8.txt
%Desktop%\word2k\DOC2KE01.doc
%AppDataLocal%\Microsoft\Internet Explorer\MSIMGSIZ.DAT
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp
%System Root%\Python27\include\descrobject.h
%System Root%\Python27\Lib\idlelib\Icons\tk.gif
%System Root%\Python27\tcl\tk8.5\images\logoMed.gif
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Peacock.jpg
%User Temp%\dd_vcredistMSI0FD5.txt
%Desktop%\Transmag.doc
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\pkcs11.txt
%System Root%\Python27\Lib\test\imghdrdata\python.bmp
%AppDataLocal%\Microsoft\Internet Explorer\DOMStore\container.dat
%Desktop%\excel2k\XLS2KE04.xls
%System Root%\Python27\tcl\tk8.5\demos\images\earth.gif
%User Temp%\dd_NDP452-KB2901907-x86-x64-AllOS-ENU_decompression_log.txt
%System Root%\Python27\include\ast.h
%System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\top_level.txt
%System Root%\Python27\Lib\test\sgml_input.html
%System Root%\Users\Public\Pictures\Sample Pictures\Desert.jpg
%System Root%\Python27\include\genobject.h
%System Root%\Python27\include\fileobject.h
%System Root%\Python27\Lib\test\zipdir.zip
%User Profile%\Documents\word2k\DOC2KE03.doc
%System Root%\Python27\include\compile.h
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KExx.PPT
%System Root%\Python27\Tools\pynche\webcolors.txt
%All Users Profile%\Microsoft\Windows\Power Efficiency Diagnostics\energy-report.html
%User Profile%\Documents\powerpoint2k\PPT2KE01.ppt
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp
%System Root%\Python27\Lib\email\test\data\msg_04.txt
%Desktop%\excel2k\XLS2KE05.xls
%System Root%\Python27\Lib\site-packages\Pillow-6.0.0.dist-info\top_level.txt
%System Root%\Python27\Lib\email\test\data\msg_12.txt
%System Root%\excel2k\XLS2KE01.xls
%System Root%\Python27\include\marshal.h
%System Root%\Python27\Lib\test\test_doctest2.txt
%System Root%\Python27\Lib\email\test\data\msg_42.txt
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\TRRBlacklist.txt
%System Root%\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg
%Desktop%\word2k\DOC2KE05.doc
%Application Data%\Microsoft\Windows\IECompatUACache\Low\container.dat
%System Root%\Python27\include\pymath.h
%System Root%\Python27\Lib\test\imghdrdata\python.gif
%System Root%\Python27\Lib\email\test\data\msg_37.txt
%System Root%\Python27\tcl\tix8.4.3\bitmaps\file.gif
%System Root%\Python27\include\object.h
%System Root%\Python27\include\pyctype.h
%System Root%\Python27\tcl\tix8.4.3\pref\SGIGray.cs
%System Root%\Python27\tcl\tix8.4.3\bitmaps\srcfile.gif
%All Users Profile%\Microsoft\Windows Defender\Scans\CleanStore\LastBld.dat
%System Root%\Python27\Lib\test\exception_hierarchy.txt
%System Root%\Users\All Users\Microsoft\RAC\StateData\RacWmiDataBookmarks.dat
%All Users Profile%\Microsoft\Network\Downloader\qmgr0.dat
%AppDataLocal%\Microsoft\Internet Explorer\tabiconcache.dat
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp
%System Root%\Users\Public\Documents\excel2k\XLS2KE03.xls
%System Root%\Python27\include\pystrcmp.h
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp
%System Root%\powerpoint2k\PPT2KExx.PPT
%System Root%\Python27\include\symtable.h
%System Root%\Python27\Lib\email\test\data\msg_14.txt
%AppDataLocal%\Microsoft\Windows\AppCache\6A582BR6\container.dat
%System Root%\Python27\include\ucnhash.h
%System Root%\Python27\include\weakrefobject.h
%System Root%\excel2k\XLS2KE05.xls
%User Profile%\Documents\powerpoint2k\PPT2KE03.ppt
%System Root%\Python27\Lib\email\test\data\msg_10.txt
%All Users Profile%\Microsoft\Windows Defender\Scans\History\CacheManager\MpSfc.bin
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Monet.jpg
%System Root%\Python27\Tools\versioncheck\README.txt
%System Root%\Users\Public\Documents\Email and Password List.txt
%AppDataLocal%\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg
%System Root%\Python27\include\import.h
%System Root%\Python27\Lib\email\test\data\msg_41.txt
%System Root%\Python27\Lib\idlelib\help.html
%AppDataLocal%\Microsoft\Windows\WebCache\WebCacheV01.dat
%System Root%\Python27\Lib\test\cjkencodings\big5-utf8.txt
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache.bin
%System Root%\Python27\Lib\email\test\data\msg_17.txt
%AppDataLocal%\Microsoft\Windows\WebCacheLock.dat
%System Root%\Python27\include\floatobject.h
%System Root%\Python27\Lib\email\test\data\msg_08.txt
%User Temp%\Microsoft .NET Framework 4.5.2 Setup_20161212_135033207-MSI_netfx_Full_GDR_x64.msi.txt
%System Root%\Python27\Lib\idlelib\Icons\openfolder.gif
%System Root%\word2k\DOC2KE03.doc
%System Root%\Python27\Lib\test\imghdrdata\python.jpg
%Application Data%\Microsoft\Windows\IEDownloadHistory\container.dat
%System Root%\Python27\Lib\test\ieee754.txt
%System Root%\Python27\tcl\tk8.5\images\pwrdLogo200.gif
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\SiteSecurityServiceState.txt
%System Root%\Python27\Lib\idlelib\TODO.txt
%System Root%\Python27\include\pystate.h
%System Root%\Python27\Lib\email\test\data\msg_31.txt
%System Root%\Python27\include\pyerrors.h
%System Root%\Python27\include\boolobject.h
%System Root%\Python27\Lib\email\test\data\msg_03.txt
%System Root%\Python27\include\sliceobject.h
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\AlternateServices.txt
%User Profile%\Documents\word2k\DOC2KE01.doc
%System Root%\Python27\include\timefuncs.h
%System Root%\Python27\include\pythread.h
%System Root%\Python27\include\pgenheaders.h
%All Users Profile%\Microsoft\Network\Downloader\qmgr1.dat
%System Root%\Users\Public\Documents\word2k\DOC2KE02.doc
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp
%System Root%\Python27\Lib\test\tokenize_tests.txt
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KE01.ppt
%System Root%\Python27\include\node.h
%System Root%\Python27\tcl\tix8.4.3\pref\Gray.cs
%System Root%\Python27\include\pyexpat.h
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\prefs.js
%User Profile%\Documents\powerpoint2k\PPT2KE04.ppt
%All Users Profile%\VMware\VMware Tools\Unity Filters\visualstudio2005.txt
%System Root%\Python27\Lib\idlelib\Icons\idle_48.gif
%System Root%\Python27\include\unicodeobject.h
%AppDataLocal%\Microsoft\Windows\AppCache\container.dat
%System Root%\Python27\Lib\email\test\data\msg_32.txt
%System Root%\Python27\tcl\tix8.4.3\bitmaps\textfile.gif
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KE03.ppt
%Desktop%\powerpoint2k\PPT2KE03.ppt
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Connectivity.gif
%System Root%\Python27\Lib\email\test\data\msg_01.txt
%Application Data%\Microsoft\Windows\IETldCache\container.dat
%System Root%\Python27\Lib\email\test\data\msg_30.txt
%AppDataLocal%\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg
%User Temp%\dd_SetupUtility.txt
%AppDataLocal%Low\Microsoft\Windows\AppCache\LY14JQYG\container.dat
%System Root%\Python27\tcl\tk8.5\images\logo100.gif
%System Root%\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
%System Root%\Python27\include\Python.h
%System Root%\Python27\include\parsetok.h
%System Root%\Python27\include\pymacconfig.h
%System Root%\Users\Public\Documents\word2k\DOC2KE01.doc
%System Root%\Python27\tcl\tix8.4.3\bitmaps\plusarm.gif
%System Root%\Python27\Lib\test\audiodata\pluck-pcm32.wav
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Pine_Lumber.jpg
%User Profile%\Documents\excel2k\XLS2KE02.xls
%System Root%\Users\Public\Pictures\Sample Pictures\Koala.jpg
%System Root%\Python27\include\bufferobject.h
%System Root%\Python27\Lib\email\test\data\msg_13.txt
%System Root%\Python27\include\bytesobject.h
%User Temp%\dd_wcf_CA_smci_20161212_135110_351.txt
%System Root%\Python27\include\classobject.h
%System Root%\Users\Public\Documents\word2k\DOC2KExx.doc
%System Root%\Python27\Lib\test\cjkencodings\gb2312.txt
%System Root%\Python27\include\osdefs.h
%System Root%\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
%System Root%\Python27\Tools\pynche\websafe.txt
%System Root%\Python27\include\pyport.h
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp
%Desktop%\excel2k\XLS2KE01.xls
%System Root%\word2k\DOC2KE04.doc
%Application Data%\Microsoft\Windows\IECompatUACache\container.dat
%System Root%\powerpoint2k\PPT2KE04.ppt
%System Root%\Python27\include\bytearrayobject.h
%System Root%\Python27\include\Python-ast.h
%System Root%\Python27\include\ceval.h
%System Root%\Python27\include\longobject.h
%User Temp%\Microsoft .NET Framework 4.5.2 Setup_20161212_135033207.html
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp
%System Root%\Python27\tcl\tk8.5\images\logo64.gif
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\SecurityPreloadState.txt
%System Root%\Python27\include\pystrtod.h
%AppDataLocal%\Microsoft\Windows\1033\StructuredQuerySchema.bin
%System Root%\Python27\Tools\pynche\X\rgb.txt
%System Root%\Python27\include\eval.h
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp
%System Root%\$Recycle.Bin\S-1-5-21-2407829820-1079796033-203259571-500\$IC8HJH8.zip
%System Root%\powerpoint2k\PPT2KE03.ppt
%System Root%\Python27\Lib\test\cjkencodings\hz-utf8.txt
%System Root%\Python27\Lib\test\test_doctest3.txt
%AppDataLocal%\GDIPFONTCACHEV1.DAT
%AppDataLocal%Low\Microsoft\Internet Explorer\EmieSiteList\container.dat
%System Root%\Python27\include\pgen.h
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp
%System Root%\Python27\Lib\email\test\data\msg_36.txt
%System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\LICENSE.txt
%System Root%\Users\Public\Documents\word2k\DOC2KE04.doc
%System Root%\Python27\tcl\tk8.5\images\pwrdLogo150.gif
%System Root%\Python27\Lib\idlelib\Icons\plusnode.gif
%System Root%\Python27\Lib\email\test\data\msg_19.txt
%User Profile%\Documents\word2k\DOC2KE05.doc
%Application Data%\Microsoft\Windows\IECompatCache\Low\container.dat
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Stucco.gif
%System Root%\Python27\include\stringobject.h
%System Root%\Python27\README.txt
%System Root%\Python27\Lib\email\test\data\msg_09.txt
%System Root%\Python27\include\tupleobject.h
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\urlCache.bin
%Desktop%\powerpoint2k\PPT2KExx.PPT
%User Profile%\Documents\excel2k\XLS2KExx.xls
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp
%System Root%\Python27\Lib\site-packages\pip-19.0.3.dist-info\entry_points.txt
%System Root%\Python27\Lib\test\cjkencodings\gbk-utf8.txt
%Application Data%\Microsoft\Windows\IECompatCache\container.dat
%System Root%\word2k\DOC2KE02.doc
%System Root%\Python27\Lib\email\test\data\msg_12a.txt
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Psychedelic.jpg
%System Root%\Python27\Lib\idlelib\README.txt
%System Root%\Python27\Lib\test\imghdrdata\python.png
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp
%All Users Profile%\VMware\VMware Tools\Unity Filters\vistasidebar.txt
%System Root%\Python27\Lib\test\testtar.tar
%System Root%\Users\Public\Music\Sample Music\Kalimba.mp3
%System Root%\Python27\Lib\idlelib\help.txt
%System Root%\Python27\tcl\tix8.4.3\bitmaps\warning.gif
%System Root%\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
%System Root%\Python27\include\pycapsule.h
%System Root%\Python27\Lib\test\cjkencodings\euc_jp.txt
%System Root%\Python27\include\bitset.h
%System Root%\Python27\include\errcode.h
%AppDataLocal%Low\Microsoft\Internet Explorer\EmieUserList\container.dat
%System Root%\Python27\Lib\email\test\data\msg_46.txt
%AppDataLocal%\Microsoft\Internet Explorer\frameiconcache.dat
%System Root%\Python27\include\structmember.h
%Desktop%\word2k\DOC2KExx.doc
%User Temp%\Guest.bmp
%System Root%\Python27\Lib\email\test\data\msg_06.txt
%AppDataLocal%\Microsoft\Windows Mail\Stationery\SoftBlue.jpg
%System Root%\Python27\Lib\idlelib\Icons\minusnode.gif
%System Root%\Python27\include\code.h
%System Root%\Users\Public\Documents\excel2k\XLS2KE01.xls
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp
%User Temp%\dd_wcf_CA_smci_20161212_135109_353.txt
%AppDataLocal%\Microsoft\Internet Explorer\EmieBrowserModeList\container.dat
%User Profile%\Documents\word2k\DOC2KE04.doc
%System Root%\Python27\tcl\tix8.4.3\pref\TK.cs
%System Root%\Python27\Tools\pynche\namedcolors.txt
%System Root%\Users\Public\Documents\excel2k\XLS2KE05.xls
%System Root%\Python27\Lib\test\floating_points.txt
%System Root%\Python27\tcl\tix8.4.3\bitmaps\minus.gif
%System Root%\Python27\Lib\idlelib\Icons\folder.gif
%AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\{AD285A8B-713F-11E9-85F8-005056BC44A9}.dat
%User Profile%\Documents\excel2k\XLS2KE05.xls
%System Root%\Python27\Lib\email\test\data\msg_21.txt
%System Root%\Python27\include\moduleobject.h
%System Root%\Python27\Lib\test\audiodata\pluck-pcm16.wav
%System Root%\Users\Public\Documents\excel2k\XLS2KE04.xls
%System Root%\Python27\Lib\test\cjkencodings\iso2022_kr-utf8.txt
%Desktop%\excel2k\XLS2KE03.xls
%System Root%\Python27\include\metagrammar.h
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp
%System Root%\excel2k\XLS2KE02.xls
%System Root%\Python27\Lib\email\test\data\msg_29.txt
%User Profile%\Documents\fp_18.0.0.203_archive.zip
%Desktop%\Email and Password List.js
%System Root%\Python27\Lib\email\test\data\msg_35.txt
%System Root%\Python27\Lib\test\cjkencodings\euc_kr-utf8.txt
%System Root%\Python27\include\objimpl.h
%All Users Profile%\VMware\VMware Tools\manifest.txt
%System Root%\Python27\include\py_curses.h
%Desktop%\excel2k\XLS2KE02.xls
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp
%System Root%\word2k\DOC2KExx.doc
%All Users Profile%\Microsoft\User Account Pictures\{username}.dat
%System Root%\word2k\DOC2KE05.doc
%System Root%\Python27\Tools\webchecker\README.txt
%System Root%\Python27\Lib\email\test\data\msg_20.txt
%All Users Profile%\Microsoft\Windows Defender\Scans\mpcache-B1C01FED9F08520A4647901EFB883A6A3B247F8D.bin
%System Root%\Python27\Lib\email\test\data\msg_24.txt
%System Root%\Python27\Tools\pynche\X\xlicense.txt
%System Root%\Python27\Lib\test\cjkencodings\gbk.txt
%System Root%\Python27\include\token.h
%System Root%\Python27\include\pyconfig.h
%System Root%\Python27\include\intrcheck.h
%System Root%\Python27\Lib\test\cjkencodings\hz.txt
%System Root%\Python27\Lib\idlelib\extend.txt
%System Root%\Python27\Lib\test\cjkencodings\iso2022_jp.txt
%AppDataLocal%\Microsoft\Windows Mail\Stationery\White_Chocolate.jpg
%Desktop%\Email and Password List.txt
%System Root%\Python27\Lib\test\cjkencodings\euc_kr.txt
%System Root%\Python27\Lib\email\test\data\msg_22.txt
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp
%System Root%\Python27\Lib\lib2to3\Grammar.txt
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp
%System Root%\excel2k\XLS2KE04.xls
%System Root%\Python27\include\modsupport.h
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Stars.jpg
%User Temp%\dd_vcredistUI0FD5.txt
%System Root%\Python27\Tools\Scripts\README.txt
%System Root%\Python27\Lib\test\cjkencodings\big5.txt
%System Root%\Python27\Lib\idlelib\Icons\python.gif
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp
%All Users Profile%\VMware\VMware Tools\Unity Filters\vmwarefilters.txt
%System Root%\Python27\include\pyarena.h
%System Root%\Python27\tcl\tix8.4.3\bitmaps\folder.gif
%Application Data%\Microsoft\Windows\DNTException\container.dat
%Desktop%\word2k\DOC2KE02.doc
%System Root%\Python27\Lib\test\cjkencodings\big5hkscs-utf8.txt
%System Root%\Python27\LICENSE.txt
%System Root%\Python27\include\longintrepr.h
%System Root%\Python27\include\rangeobject.h
%System Root%\Python27\tcl\tix8.4.3\pref\Bisque.cs
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Roses.jpg
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\urlCache-current.bin
%System Root%\Python27\Lib\test\test_doctest.txt
%System Root%\Email and Password List.txt
%AppDataLocal%\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg
%System Root%\Python27\include\memoryobject.h
%System Root%\Users\Public\Documents\Email and Password List.js
%System Root%\Python27\Lib\email\test\data\msg_16.txt
%AppDataLocal%\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.1\LICENSE.txt
%AppDataLocal%\Microsoft\Windows\History\Low\History.IE5\container.dat
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp
%System Root%\Python27\include\pyfpe.h
%System Root%\Python27\tcl\tix8.4.3\demos\bitmaps\tix.gif
%System Root%\Python27\Lib\test\cjkencodings\euc_jisx0213.txt
%System Root%\Python27\include\intobject.h
%System Root%\Python27\include\pygetopt.h
%System Root%\Python27\Lib\test\cjkencodings\gb2312-utf8.txt
%System Root%\Python27\include\structseq.h
%System Root%\Python27\tcl\tix8.4.3\bitmaps\openfold.gif
%System Root%\Python27\Lib\idlelib\CREDITS.txt
%System Root%\Python27\Lib\test\audiodata\pluck-pcm8.wav
%All Users Profile%\VMware\VMware Tools\Unity Filters\microsoftoffice2003.txt
%System Root%\Python27\tcl\tk8.5\images\logoLarge.gif
%System Root%\Users\All Users\Microsoft\RAC\StateData\RacMetaData.dat
%System Root%\Python27\include\traceback.h
%System Root%\Python27\Lib\email\test\data\msg_23.txt
%System Root%\Python27\Lib\email\test\data\msg_44.txt
%All Users Profile%\Microsoft\Windows NT\MSScan\WelcomeScan.jpg
%User Profile%\Documents\powerpoint2k\PPT2KExx.PPT
%System Root%\Python27\Lib\email\test\data\msg_25.txt
%System Root%\Python27\Lib\test\cjkencodings\gb18030.txt
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Tiki.gif
%System Root%\Python27\tcl\tk8.5\images\pwrdLogo175.gif
%System Root%\Python27\Lib\test\cjkencodings\johab-utf8.txt
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Blue_Gradient.jpg
%System Root%\Python27\Lib\test\cjkencodings\euc_jp-utf8.txt
%System Root%\Python27\include\grammar.h
%Desktop%\powerpoint2k\PPT2KE04.ppt
%User Profile%\Documents\excel2k\XLS2KE01.xls
%System Root%\powerpoint2k\PPT2KE01.ppt
%AppDataLocal%\Microsoft\Internet Explorer\UrlBlockManager\urlblocklist.bin
%User Profile%\Documents\Email and Password List.js
%System Root%\Python27\Lib\email\test\data\msg_15.txt
%User Profile%\Documents\Email and Password List.txt
%System Root%\Python27\Lib\idlelib\idle_test\README.txt
%System Root%\Python27\tcl\tix8.4.3\bitmaps\minusarm.gif
%System Root%\Python27\include\pymactoolbox.h
%System Root%\Python27\include\pymem.h
%AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{4555A5E7-C06D-11E6-8AB1-005056BC3E18}.dat
%User Temp%\dd_vcredistMSI0FC1.txt
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Pretty_Peacock.jpg
%System Root%\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp
%System Root%\Python27\Lib\email\test\data\msg_34.txt
%System Root%\Python27\include\opcode.h
%AppDataLocal%\Microsoft\Internet Explorer\EmieUserList\container.dat
%System Root%\Python27\include\pydebug.h
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp
%System Root%\Python27\tcl\tix8.4.3\bitmaps\no_entry.gif
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Sand_Paper.jpg
%Desktop%\powerpoint2k\PPT2KE01.ppt
%System Root%\Python27\include\dictobject.h
%System Root%\Python27\Lib\site-packages\README.txt
F:\wlines.zip
%System Root%\Python27\include\frameobject.h
%System Root%\Python27\tcl\tk8.5\demos\images\earthris.gif
%All Users Profile%\Microsoft\User Account Pictures\user.bmp
%User Profile%\Documents\powerpoint2k\PPT2KE05.ppt
%All Users Profile%\Microsoft\Windows\DRM\blackbox.bin
%System Root%\Python27\NEWS.txt
%System Root%\Python27\tcl\tk8.5\images\tai-ku.gif
%System Root%\Python27\Tools\pynche\README.txt
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp
%System Root%\word2k\DOC2KE01.doc
%System Root%\Python27\tcl\tix8.4.3\bitmaps\act_fold.gif
%System Root%\Python27\include\warnings.h
%System Root%\Python27\Lib\lib2to3\PatternGrammar.txt
%System Root%\Python27\Lib\test\cjkencodings\shift_jisx0213.txt
%System Root%\Python27\Tools\pynche\html40colors.txt
%System Root%\Python27\Lib\idlelib\Icons\idle_16.gif
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp
%System Root%\excel2k\XLS2KE03.xls
%System Root%\Python27\Lib\email\test\data\PyBanner048.gif
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-current.bin
%Application Data%\Microsoft\Windows\PrivacIE\container.dat
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\pluginreg.dat
%System Root%\Python27\include\pythonrun.h
%System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\dependency_links.txt
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp
%System Root%\Python27\Lib\test\formatfloat_testcases.txt
%System Root%\Users\Public\Music\Sample Music\Sleep Away.mp3
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KE02.ppt
%All Users Profile%\Microsoft\OFFICE\DATA\opa12.dat
%System Root%\Python27\Lib\test\cjkencodings\shift_jis.txt
%System Root%\Python27\tcl\tix8.4.3\bitmaps\info.gif
%System Root%\Python27\Lib\test\cjkencodings\euc_jisx0213-utf8.txt
%System Root%\Python27\tcl\tix8.4.3\pref\WmDefault.txt
%AppDataLocal%\Microsoft\Internet Explorer\EmieSiteList\container.dat
%All Users Profile%\Microsoft\User Account Pictures\guest.bmp
%System Root%\Users\Default\NTUSER.DAT
%User Profile%\Documents\word2k\DOC2KE02.doc
%System Root%\Python27\Lib\email\test\data\msg_27.txt
%System Root%\Users\All Users\Microsoft\RAC\StateData\RacWmiEventData.dat
%System Root%\Python27\Lib\email\test\data\msg_43.txt
%System Root%\Python27\Lib\email\test\data\msg_33.txt
%All Users Profile%\VMware\VMware Tools\Unity Filters\googledesktop.txt
%System Root%\Python27\include\complexobject.h
%System Root%\Users\Public\Documents\word2k\DOC2KE03.doc
%System Root%\powerpoint2k\PPT2KE02.ppt
%Desktop%\excel2k\XLS2KExx.xls
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp
%System Root%\Python27\include\codecs.h
%System Root%\Python27\Lib\test\cjkencodings\cp949-utf8.txt
%Desktop%\word2k\DOC2KE03.doc
%System Root%\Python27\tcl\tix8.4.3\pref\TixGray.cs
%User Profile%\Documents\excel2k\XLS2KE04.xls
%System Root%\Python27\include\listobject.h
%System Root%\Python27\Lib\test\audiodata\pluck-pcm24.wav
%All Users Profile%\VMware\VMware Tools\Unity Filters\adobephotoshopcs3.txt
%System Root%\Python27\Lib\test\cmath_testcases.txt
%Desktop%\note.txt
%AppDataLocal%\Google\Chrome\User Data\Crashpad\settings.dat
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Tanspecks.jpg
F:\data\dolist.txt
%User Temp%\{username}.bmp
%System Root%\powerpoint2k\PPT2KE05.ppt
%Desktop%\powerpoint2k\PPT2KE02.ppt
%System Root%\excel2k\XLS2KExx.xls
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KE04.ppt
%System Root%\Users\Public\Documents\powerpoint2k\PPT2KE05.ppt
%User Temp%\dd_vcredistUI0FC1.txt
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Wrinkled_Paper.gif
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp
%User Profile%\Documents\powerpoint2k\PPT2KE02.ppt
%System Root%\Python27\tcl\tk8.5\images\pwrdLogo75.gif
%System Root%\Python27\include\methodobject.h
%System Root%\Python27\tcl\tix8.4.3\bitmaps\plus.gif
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-child.bin
%System Root%\Python27\Lib\email\test\data\msg_26.txt
%All Users Profile%\VMware\RawdskCompatibility\native\regdata.dat
F:\data\tmp.doc
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp
%AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache\scriptCache-child-current.bin
%AppDataLocal%\Microsoft\Internet Explorer\brndlog.txt
%AppDataLocal%\Microsoft\Feeds Cache\container.dat
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp
%System Root%\Python27\Lib\email\test\data\msg_07.txt
%Desktop%\word2k\DOC2KE04.doc
%System Root%\Users\Public\Documents\excel2k\XLS2KE02.xls
%User Profile%\Documents\word2k\DOC2KExx.doc
%AppDataLocal%\Google\Software Reporter Tool\settings.dat
%All Users Profile%\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp
%System Root%\Python27\include\iterobject.h
%System Root%\Email and Password List.js
%System Root%\Python27\tcl\tk8.5\demos\images\tcllogo.gif
%System Root%\Python27\Lib\email\test\data\msg_02.txt
%System Root%\Python27\Lib\email\test\data\msg_28.txt
%System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\top_level.txt
%System Root%\Python27\Lib\email\test\data\msg_40.txt
%Desktop%\AAljoOV.jpg
%Application Data%\Microsoft\Office\Recent\index.dat
%System Root%\Python27\Lib\idlelib\NEWS.txt
%AppDataLocal%Low\Microsoft\Internet Explorer\EmieBrowserModeList\container.dat
%System Root%\Python27\Lib\test\cjkencodings\shift_jisx0213-utf8.txt
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Cave_Drawings.gif
%AppDataLocal%Low\Microsoft\Windows\AppCache\container.dat
%System Root%\Users\Public\Documents\word2k\DOC2KE05.doc
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Bears.jpg
%System Root%\Python27\include\cobject.h
%System Root%\Python27\include\asdl.h
%System Root%\Python27\include\setobject.h
%System Root%\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg
%System Root%\Python27\Lib\test\test_difflib_expect.html
%System Root%\Python27\Lib\test\cjkencodings\iso2022_kr.txt
%System Root%\Python27\include\bytes_methods.h
%System Root%\Users\Public\Documents\excel2k\XLS2KExx.xls
%System Root%\Python27\Lib\test\math_testcases.txt
%System Root%\Python27\include\cStringIO.h
%System Root%\Python27\Lib\site-packages\pythonnet-2.1.0.dist-info\top_level.txt
%System Root%\Python27\Lib\idlelib\Icons\idle_32.gif
%System Root%\Python27\tcl\tk8.5\images\pwrdLogo100.gif
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Garden.jpg
%System Root%\Python27\Lib\test\cjkencodings\big5hkscs.txt
%System Root%\Python27\include\funcobject.h
%AppDataLocal%\Microsoft\Windows Mail\Stationery\Small_News.jpg
%System Root%\Python27\Lib\email\test\data\msg_45.txt
%System Root%\Python27\Lib\email\test\data\msg_11.txt
%System Root%\Python27\tcl\tix8.4.3\pref\TkWin.cs
%System Root%\Python27\Lib\idlelib\HISTORY.txt
%Desktop%\powerpoint2k\PPT2KE05.ppt
%System Root%\Users\Public\Pictures\Sample Pictures\Penguins.jpg
%System Root%\Python27\Lib\site-packages\setuptools-40.6.2.dist-info\entry_points.txt
%System Root%\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
%System Root%\Python27\include\enumobject.h

Did this description help? Tell us how we did.

TrojanSpy.MSIL.URSNIF.THCBFBO

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters

TrojanSpy.MSIL.URSNIF.THCBFBO

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters

The Americas

Middle East & Africa

Europe

Asia & Pacific