SecondWrite DeepView - fc53a277a1d7a514c7a6e5e7c75db076299ebec1dfe4a3db3c4509511a899afa

100

Malicious

This predictive confidence of maliciousness for this sample is 100%.

fc53a277a1d7a514c7a6e5e7c75db076299ebec1dfe4a3db3c4509511a899afa

1.6 MB

Size

2020-04-19 14:03:32

First seen 1 day ago

Windows PE32 Executable

Classification

Full Detail

Ransomware

Low

Trojan

Low

Virus

High

Banker

Low

Bot

Low

Rat

Low

Adware

Low

Infostealer

Low

Worm

Low

Spyware

Low

Indicators

Expand All

SecondWrite Indicators

Forced Code Execution

Automatic Sequence Detection

Program Level Indicators

Anti-Analysis

Attempts to repeatedly call a single API many times in order to delay analysis time

Spam:: explorer.exe (1056) called API GetSystemMetrics 14203 times

Anti-Av

Disables Windows Security features

Registry:: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA

Anti-Sandbox

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

A process attempted to delay the analysis task.

Description:: qocgoAYA.exe tried to sleep 700 seconds, actually delayed analysis time by 700 seconds

Av-Tools

This sample is detected by clamav as: Win.Virus.Virlock-6332874-0

Description:: Win.Virus.Virlock-6332874-0

One or more AV tool detects this sample as malicious: Virus:Win32/Nabucur.A

Description:: Virus:Win32/Nabucur.A

Generic

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Creates executable files on the filesystem

File:: C:\ProgramData\BaYccoIY\CAMIMsAM.exe
File:: C:\Users\Virtual\AppData\Local\Temp\setup.exe
File:: C:\Users\Virtual\AppData\Local\Temp\ikkUcsEo.bat
File:: C:\ProgramData\zSgsgkwE\qocgoAYA.exe
File:: C:\Users\Virtual\AppData\Local\Temp\YcMsIgYE.bat
File:: C:\Users\Virtual\AppData\Local\Temp\kKIEMsAI.bat
File:: C:\Users\Virtual\IsQUAMQg\JSIMwgEo.exe
File:: C:\Users\Virtual\AppData\Local\Temp\OSETUP.DLL

Expresses interest in specific running processes

Process:: qocgoAYA.exe
Process:: JSIMwgEo.exe

Attempts to disable UAC

Http

Performs some HTTP requests

Request:: GET http://google.com/
Request:: GET http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl

HTTP traffic contains suspicious features which may be indicative of malware related traffic

Get No Useragent:: HTTP traffic contains a GET request with no user-agent header
Suspicious Request:: http://google.com/

Network

Performs some DNS requests

Dns :: Request: google.com IP: 172.217.5.238
Dns :: Request: crl.microsoft.com IP: 184.150.154.10

Connects to IP address(es) that are no longer responding to requests (legitimate services will remain up-and-running usually)

Dead Host:: 172.217.22.110:80

Packer

Allocates read-write-execute memory (usually to unpack itself)

PID	API	Arguments
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x003f0000 allocation_type: 4096 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 475136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x028b0000 allocation_type: 4096 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x02930000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x00590000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 36700160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x0c980000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x0ec80000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x0ed80000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x005a0000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x005b0000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x00840000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x00850000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x00860000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x00870000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x02a30000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x02a40000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x02a50000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x02a60000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x02a70000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x02a80000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x02aa0000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x02ab0000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x02ab0000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x02ac0000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x02ab0000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x02ac0000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x02ad0000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x02ae0000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x02af0000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x02b00000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x02b10000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x0f150000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x0f2a0000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x0f2b0000 allocation_type: 4096 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x0f2c0000 allocation_type: 4096 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x0f2d0000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x0f2a0000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x0f2e0000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x0f2a0000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x0f2e0000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x0f2a0000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x0f2e0000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x0f2a0000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x0f2e0000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x0f2a0000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x0f2e0000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x0f2f0000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x0f300000 allocation_type: 12288 process_handle: 0xffffffff
2696	NtAllocateVirtualMemory	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 base_address: 0x0f310000 allocation_type: 12288 process_handle: 0xffffffff

The binary likely contains encrypted or compressed data.

Section:: .text, at virtual address 0x00001000
Entropy:: 7.57111125428
Description:: A section with a high entropy has been found

Entropy:: 0.996469833119
Description:: Overall entropy of this PE file is high

Persistence

Installs itself for autorun at Windows startup

Registry:: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\JSIMwgEo.exe
Registry:: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit

Program-Level-Features

Contains obfuscated control-flow to defeat static analysis.

Service

Creates a service

PID	API	Arguments
2696	CreateServiceW	service_start_name: start_type: 2 password: display_name: yMckgwkS filepath: C:\ProgramData\BaYccoIY\CAMIMsAM.exe service_name: yMckgwkS filepath_r: C:\ProgramData\BaYccoIY\CAMIMsAM.exe desired_access: 983103 service_handle: 0x005dfbb0 error_control: 0 service_type: 16 service_manager_handle: 0x005dfbd8

Static

This sample contains high entropy sections

Section:: .text, at virtual address 0x00001000
Entropy:: 7.57111125428

Stealth

A process created a hidden window

Process:: fc53a277a1d7a514c7a6e5e7c75db076299ebec1dfe4a3db3c4509511a899afa.exe -> C:\Users\Virtual\AppData\Local\Temp\setup.exe

Attempts to modify Explorer settings to prevent file extensions from being displayed

Registry:: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt

Attempts to modify Explorer settings to prevent hidden files from being displayed

Registry:: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden

Attempts to modify Explorer settings to prevent hidden files from being displayed

Yara

Yara Pattern Name	Description
IsPE32	No Description Available
HasRichSignature	Rich Signature Check

Static Analysis

Sections

Name	Virtual Address	Virtual Size	Size of Raw Data	Entropy
.text	0x00001000	0x00185000	0x00184200	7.57111125428
.rdata	0x00186000	0x00001000	0x00000200	2.44165135266
.data	0x00187000	0x0000011b	0x00000200	5.09763524412
.rsrc	0x00188000	0x0000115c	0x00001200	4.96223101428

Resources

Name	Offset	Size	Language	Sub-language	File type
RT_ICON	0x001880a0	0x000010a8	LANG_ENGLISH	SUBLANG_ENGLISH_US	None
RT_GROUP_ICON	0x00189148	0x00000014	LANG_ENGLISH	SUBLANG_ENGLISH_US	None

Imports

Library ntdll.dll:

NtSetDefaultUILanguage

Library user32.dll:

GetCaretBlinkTime
GetMessageExtraInfo

Library kernel32.dll:

GetCurrentProcess

Strings

!This program cannot be run in DOS mode.
Rich!l
`.rdata
@.data
NPfqEH!
R}]t>K
eeZ0&7BN6_
sW.;v7
JsG!;v><dnO9Js
Yw~9Hh
|diBwe
:FH3^.
|>gV ^["x
FH0>B1
R}~9Hj
Q!s)Xjq
ppP|."Q
l94`m?
l94`mT
;Q~SoQTx
f\&mh@
LzLk@X
\\Led\
=!cYm!
yit_EpL_mpv_
ntVfHB
C!gCk`
^[%,y|
^[%,y|
^[%,y|
^[%,y|
:%"S%-
Y%?nR$,_
}/&,_[
wZ%-EP
;\[%6t
-_[;&.
*Z%,_}
AP%,_[#
AP%,_[#
V-A9G'
;p(jW
Sm^CQm
Cm^C_A
KrPa{d
llWh`> g
r!c1l
CWVP]<
RZQ3ik
4h[Q;ik
I AzCRj4N
Mu#jvi
U4TV!e
gt;c)O;A
2tLeIc
2|RIHm
r<n)Hw
Fc2Y+v
{3%S/W
''y8w
e4Pv]u
x3d*6W#
?eb{)R
/Ij.%tm
O@K~q0
Xz h_3
hPS3.Zq
ouOoxT2
d'D!-X
z=9-3T
C$}&VW,
j0{Td6
knF/5})
Qn+)`PiN"
'F Q&^
*'A2//
tI+NBC8
,X4lVm
z&AK_%
T:Mf=xG
]WMFci
bgz[8mH
.[IXt[
_O(:]1
CUTQqxv
9<'E]SEj>N
a#B`j
TB.]3S
ODJ4f9
^>To%/r
^,C~&t
Hr[,Pgk
RC/8fF
PPTA-3
\-x2_8
q7#D+#
:"X&$FD
j4*G71
s;h Yd
Vdc{[OoG
j|0+L`
12h@b|t
9M*xO@
bxn@2-e
zr8@[=
iRP4u[
i~Z8yW
\#g=E4
^fV@m1
<];FSw
<xwEOH
Pp#Dve
6s29^`I
dHz."X
m7.1aNB`
[(canC
zY'3Zp5
%fN]Q;'
X%R*.E
6RWw=3
t{@iE[~<
bIGbT<
j#-YQMA
P0n2hz
$_(9cM^
V5cV4I
=?6{l^
+NQ$Ma
vDGd=s
Y]wE7y
#OTLD}
X[W%"(
( 7hKg
8wq_xfL
=:pS/:
%a+j7b?
nT#LM(
zn"a?w
?JF!=-
I$if8M)
-+ZK.^^
iI!Bv,
, >_'V
GrZ;bbq
>Vm7~*
'jO7m~
;#EM:U
q*GS">
at)@=~
YO9x;\
ECd{4/|$
|24GG
eQ}i#S
R*FaK;"
c;YZo{
9fP~Ef
BJ#wpe
}A;PRQ
>Z]yfXZ
O~!:`,
QV_a2;
x^^aUv
ooiF,FI^
k.XXn}p
a{[c[Q
|2En--
n(aY.0q #
>?G2+A
)sEpa(
fBC+Nj?
t4L/YP
t4L/YP
uQj0}^
#2C$-E
#2C$-E
dHHtu
"u!v[]d
b7G0*'
QHVt,
@Y=seW
oA4d&
D1':-L
OOZmWw14g
f6'v<L
CW|;1qZ>
tg68x9\
DrG=B
|^hBU
H3A1!.:Z
!1O_ay<
7JXal]C?
%"^xV%
r[G Ge
Yz%"8)
lhqxcF
LW2"}!W
<JK~f7
RS$3J!P
4Pnxo4
V1LntQ
/_S?&?
PL,u$?
@X]Tpiv
8n9>U
8n9>U
,zE3dp
9dz~^5l
8z#)8Jc(
zZa9:[
8z#)9J
zZ!98[
8r#)xJa(
R=#r)ca
77SQ*7
!r+nLZi
\hvcUk
)7H&e&-
M-&~%Y
{Ar}KK
.J6V2:
%ta{_h
IV=;Rb
a"HDQ6
$PX|!LU
,+H``dem
!t<Opb
;7+ClB
;7+CmB
;7+ClB
Q!P(J\
o@oRJ#;
XR(j"W
oCkd.3
n_ZjLc
wX(0$Uj3f
YBHhc[
-vl,R{
>i'?nl"
1OAY T1
J6L<J@
r-L8j%
W%:W%"
\X[Q@MU
T%hu8S1
Qs3&Z&
5MK ,H
f@Jz<2
Y$8>ved
<W3}`U
5#[V_a
#</k0vvJ_
[\cv'^
/I'Jiz
D(o6!.
S/'<]3+
~Du+g1
*w#v5&F
$mLZO7
x1Snel
NHP>~wf
l\aA>U
T%>/0Iua
}9GtVW
L["h4
\`K1RY
42[>*3
;S{,'OhqBLl
)]x_.^
$,F="'s
?m+xVR
[4~WdM
JK'un^-
,,!]bG
/Q.)$q
d]F@K@
:IF#yI
)BF~e`
|R"ih;
pM*EO9
iB)1pB)1pB)1pB)1pB)1pB)1pB)1p^
!93u\;
oyeqZW
oFxGlF%M
,vi'u,
>sJ)WZz
=28v3pms
`E)I?O@J
9R'*CX
L(&VC<s
9KgbYa2R
z]m/l=
y?p/])
~TTG y
l`4R#t
k20Y}(
LJLI|w]Rk-B
(^unXy
<$M,N}\
5N9j*;
ob6Ph]8
d0B5dE'U
<{$y0W
o["WjE
":W0Px?~eL
cjP'NTG
CR(_L^F
DgT*D*
R4(Z_p
>D(lF
02E<a6
a@DVGC
>?8KP;
N:)Ix5
\PR1$V
R_ny_r
57\[z6
s<1h=M
pb>m?CE
0]C9e>#
*?x@MWs
$u.P{QV<
s0kv]N
azap#La
C4_F+nqv
[u34i_{?
Yvo,=>$
HxS'H0
*j~Wrd
(g)BF
Y}|=Ol
"4<>i~
B=+,pg?
z|v~%_l
qa/bbp
o,X!o2X
Lc}E%/
`S =.`K]p{
"B%SM\9k
Cid,u]`
H337QIp
q#6rDa
-2?E7.
M p:qwE~
S[2^pj4
|TbHiFx
z>plMm
F.~}fC
-FP5\evA5
(b36O_
"&qWkK
vk3bZQRl
h;Rkq{}f
}jRvLo`
5+}SC}
Dw@7lCb
<wD"p~
IZ24."\g
WMUTMv
Pb?Pg~
9TX<}f
rjGPrBY
:c:2H^
tA+"u1
`e3_h~
x>#@H+/
x_SI#o
=$KP/Z
cbts04
Y:3]q>f
}+`TO9
6>|Zkmu
D<hS**
E'RQww
b7]N;.
I,;fX@E4
h0e9&Fk
pDd#RD
,KiOw1
zE1'(L
Jh'_:>
QlA3Qo
i)T .~
Z=VlIM"
3@u<cM
/5b~8J'
'i(dJC
lNx)One
Xocn6!
[+*aWS/
6$3|f
;4pF41-
hXwrBV
je;/ANO[
h]Dx'z
1#Au8v$
2fvRt%
MJ)B%
i)3zjX
/Qr6BZ
'M7_Gi
R/t"w9[z
@s<hKm
GeVFOF
F4}kjU
j+$Px`$
$|j+$r
5,=k+$
j+$p")_
$0j+$pZ)_
$*j+$pr)_
$"j+$r
jVD|\+Y
c4Pt $
H|=]Hx
5'm@8^
X{v4~J
*rSG>Xo
J51>Py7
%G>DA}t
/S^Po7
C<TcA<,k}
ZM}0HO
ZUw\JI
c[<DQW>
FLcR2t
VJI~2$
B:g4V:]8t
S"V:g4V:I:T
6z:c.x
]<D:K.
Y.T&=:v:G6T:S:t:E8t
]<D:K.
Y.T:S:r&
Y.T:C:x:I:@
LB:I:F
B:o&n:M
V:_&z:K.V
E.@:K<B
Y.T:e8T
]8z:o6x
g.T:i:P
G.x:}:v:M
n:W&r:g:
g.x:](
:@:g4N
E.@:E8Z
]<D:K.
K<V:e8t
]<D:G&F
V:M8T:!6@
]8V:Q8D
]<D:K.
Y.T:M(t
Q>V:g:
k.V:G&n
M8t:a6D
G.T:g:
]<D:K.
6@zC.T
V:M8T:k.z
g.x&&x
g.T:C6D
&@:]8z
M8t:Q8D
z:S:r:g
6z:e8^
Q,V:_&z:K.V
]8R:c.x
G&n:g:
o&T:I:@
]<D:K.
&z:=:v:I&@:M"Z
K6t&I:
Q:T:I:v
K6t&I:F&M
g&x:/&z
n'4V:#&|
6z:W:Z
g.T:Q8
G.x&S.t$I:N
G&x&I:F`
F&I:F`
6@:)4V
U.z:Q8
Q6@&I:F
]:@:+:v
g.J&S.t$
M6@:':v
F&I:F`
Q8z&I&
Q6@&I&
W:r&I:F$
]8R:}:v:g:
Q6@:]8
M"l&I:F`
Q<T&I:F`
M,^:!6T
Q:T:/&x
g"L&I:F`
Z&I:F`
V&I:F`
k8x&I:F&
]8z&]8P
Q(t&I:F&M
W6^&I:F`
Q6@&I:F&M
z&S.t`
k:F:M8
]8R:g&X:K.D
^:S.r:
Q6@:a&D
K<n:Q(P
]8V*I<N
B:g4V:i.Z
E8T:/&n
A6@:g:
Q6@:a&D
g.x:g4V:o&|
6t:U&@
]"J:Q8
Q6@:K&D
S"V:k.P
.@&K6t
].z:M"x
$HZ_&/
RIv_j:
II^_~;
IIb_Z;
v""4*y
v""4>x
v""46{
[TLVm
BET@aE
vWN~s\4
l!ccl!
COU"/`
YOU)SK
nvWJV%
k4{NL5{z
{NL5{NL5zN
N7.qK<
lS+glUx
(=%t!g
GeVD-3
GeVh,&
nDW8,.
q+6r{o
Gca6`DG7`DF
GEG7`DF7`
`DG7`DG7`DF7
cG7`DG7`DF7
aDG7`D
GEG7`DF
GEG7`DF7`|
FcG7`DG7`DG7`Dw
WEG7`DG7`DF
QRG7`DG7`DG7`D
zEG7`DF
GcG7`DG7`Dg
FcG7`DG7`D{
EG7`DG7`
EG7`DF
6`DG7`DG7`DF
6`DG7`DG7`DG
="`a6`DG7`DG7`d
cG7`DG7`DG7@
DG7`DG
cG7`DG7@
DG7`DF
aDG7`DF7
`DG7`DG7`DF7P
7`DG7`DG
gcG7`DG7`DF7
`DG7`DG7`DG7
aDG7`D
a6`DG7`DG
cG7`DF7
Gca6`DG7`DF
{G7`DG7`DG7
`DG7`DG7`DG7@
DG7`DG7`DG
G7`DG7`D{
Gca6`DG7`
aDG7`DF7
Gca6`DG7`DG7`
aDG7`DG7`DF7
Gca6`DG7`DG7`DF
FcG7`DG7`D{
7tQ6`DG7`
Gca6`DG7`DG7`rQ6`DG7`DG7`DF
CEG7`DF
OEG7`DG7`
m6`DG7`DG7`DF
s=6`DG7`DF
6`DG7`
EG7`DF
6`DG7`DG7`DG
GEG7`DG7`DF
GEG7`DG7`DG7`x
mDcG7`DG7`DG7`Dz
`a6`DG7`DF7`
a6`DG7`DG7`t
aDG7`DG7`D{
zEG7`DG7`DF
URG7`DG7`DG7@
a6`DG7`DG7`DF
cG7`DG7
GcG7`DG7`DF7
aDG7`DG7
GEG7`DG7`DG
a6`DG7`DF7`
aDG7`D
GEG7`DG7`DF
GEG7`DG7`DF
C}j'Fc`
GEG7`DF7`
cG7`DG7`D
y6`DG7`DG7`DGw
_EG7`DG7`DF
cG7`DG7`DF7
_EG7`DF7`
a6`DG7`DG7`DF
aDG7`DG7`DG7
cG7`DG7@
a6`DG7`DG
cG7`DG7`DF7
7`DG7`DG7`DF
GEG7`DG7`
&M'gs>
>j2yLA-
>j2yLA-
>j2yLA-
{Oo1]vaQ]hh
m>7|uK\
iNWdKK\^w
aC%Vl
!M`u g
8XW2y-
V,5m!k
l g/k,
+VlV>
C5U2@3
OAxnhn_
l gU/-
sClVF
Cs<Mlu
o(kGu[
o(kWu[
bYA,s*
l e9&1
ebr*~U
BEV $=
]@tIzGR
LCd9)
LCd9(
nFV8mn
Ks}8Nx
:;|0Nd
h__[GM
Yq_.)ok
{p=nW&l
xB8es=n
m<nW"F
9B 1L)
GeV.\}
q/6vdo
zXla^OS
{hDcLit
)) ]OS"
{hDcLit
|EcLit
(D)TD,k
GeWvsi!
nL4OUT
MQT5OU6
jPT4]{
4MQT4MUj
Oo<03oT
s}RL]sY
kM8#p=
yBYVj'
W7T;vm
dG@6T
W7U/uv
I=*3o<*3o<*3n
+3o<*3
+3o<*3
2o<*3o<*3o
o<*3o<*3n<
+3o<*3n<
I=*3o<*3o<*
*3o<*3o<*3.
o<*3o<*3^0EX
+3o<*3o<*3n<
o<*3o<*3n<
o<*3o<*3n<~
o<*3o<*3o<*3
o<*3o<*3n<
I=*3n<*
I=*3o<*3o<*3n
o<*3o<*3^0aX
+3o<*3^p_X
+3o<*3o<*3^`WX
+3o<*3n<~
o<*3n<
o<*3n<
o<*3o<*3
o<*3o<*3
2o<*3o<*3n<*
I=*3o<*
2o<*3o<*3o<*
IJm[;a
^IJm[;a
\+J$fa
FIi{gcX
Be%o4lT
e'-7E3E
G;Q[!
e'-7E3E
A!K7I3
o3a;g+
u_;'5S'/
I{/;g+
k3g7]?
o3a;g+
/7Q=-;Ii
3/ye3#]I'U[
G;K]?
k3]9k37Q
}Q%M#I?
3/KA/Yg
#7I%/{S
#7I%/sg'
%3!5Q'
}3/Mc3
}3/QK1A
}3/UA%
%3/{Q#
-7e'#Q
K')Ys{
uS')}Q%
[g;){I
_Q!wI?/
s]/qi+/II!
3/uq/
k{!5]?
/7A?/AE'
K}#9e)
_]%/A_1
wI7Y3I%Q
qi3#!/;9Is7Q
uk;#;%3#?Q?
qi3#!%3#?Q?
uk;/9e
o3#;%+
{]_/7Q%
7k_/7Q%
%3/OA#
}%{a;A
M3/3I3#
M3/5]?
sQ?/9g3
3/K]?
7%3/A_5
3/ye3#QK1
E3Q}-O3#_g3
3/K]?
3/K]?
3/K]?
-QaK]7
AOsi*qL
mzoY7a
@e:QQ`]
z"a[z/
z!&5_%I
4] 1~
z!&5_%
z!&5U%
z!.5K%Q
M9Tm_"7
D(T.kV
te(*ui4
xk(Rue4
zk(Bug6
te8+ui4
xk8Sue4
zk8Cug6
tex+ui4
xkxSue4
zkxCug6
te(+ui4
xk(Sue4
zk(Cug6
teh+ui4
xkhSue4
zkhCug6
teX+ui4
xkXSue4
zkXCug6
te0*ui4
xk0Rue4
zk0Bug6
q%R2ho
B+V|s:
6*M=I>
:H*YB?
l!gM }
<sb_ssR
bc_;sR
b[h'.!hunO
rb?%x"\
(PQkafP
'PPaUR(
zvz=|pr5F
E16?y=:+m
mJ{=y~w1Ebc%Q
:lqp2F
:lqp2Fx
zt3L{v0Lzt2L
j1Nxv.Nyt3Szu1L
Q{v3Oy
/Mxw3Sgk1Mxv2Sy
zt3Lyt2Oyt3N{v0L
nb'Znb'Znb'Zni,Zc
Nzv3Nzv3Nzv3Nzv3N
59|!UY\a
8:n-/
m3< _
!X>7;
Was^>:
's Xas
*ejd!6
xs"n^yXS
*#id!+
*gld!?
*ekd!u
q\v6pf
q\v6pf
hZx\h]
-gKN?d
*\id!f
*\hd!g
#o_dfS
lg!oGZl
X\x.3f
P68`!ow
2\hdGX
g\hdwN
^od!\Q
W>]x\S
o\hdwNQ
*\zd!?<]
\\hdw_
Wc| \h]|\
h]|\?]
L>]|\?]
!eh2w\
_dd!:Q
z\hdg\Q
?\hdwJQ
\~d!y<]
oF\hd!W
!Nh_l\
3!ghdT\
*\`d!g
GGwk\Gc
ufkZMf
*fid!c{
9ztCa^|
h]|\?_
*evd!m
*\kd!6
*\id!d
.!\?]x
\Jd!I"
fhd!\c
#o_dfS
OB#C"_
h^|\Rt
%.^xVR
IJgE2!
*eed!}kdd
*\id!7
*ecd!6
hd*Shd!
_!eS^9
f\hdB\!
#!\h]x\cF
*eKd!vh2}:Q
*eBd!%<]x
szt\a3v
*eCd!!"
('*8^|v9z
*ghd!k
*\hd!3
*\ld!7<d
*eYd!mn
e!b<]x
*\id!#
jd!M{`3
*qhd! 8
vep_pfc
*eid!^
*fZd!n
tnDf}B
4hdG]7n
4hdG]R
*\Kd!x
h^}\"d
.!\?]x
gVd!3<]x
gxd!xh
*eXd!(
]hdueQ
*eWd!w>]x
4\hdB]9
s \hdT\
\hd=]Ie!
:\hd]h
ghx\\
4\hdu]de
_ftddf
XJz!Ka
>^p7?^
*\kd![w
*\/d!5
7!\h]|\?]
hZx\h0
*e(d!v
h7r\h2}:Q
e!b<]x
.!\?]x
>]|\?d
dw\<]x
>]|\?d
Gf>]xNS
g.d!D]
v\px|f
x\hdw\
hZ9\<2!\Q]x
h]|\?]
.!\?]x
) \h]x\
hdG<]x\t
4hd]h
.!\?]x
5 fh]|\
l\hd!]
*e8d!k
oQ\hd*
hdBid
/o_dfh
2\hd=]
R\t"]>U
+!\h_d\h
o^9frd
T\pddfh
*\5d!o
F\hd]\
\BhdY\
x\hd]\
!ehx|\
!ehx|\
!bh`w\Q
)hd#\<]
\hd!*U
!fhnd\
\\hd\
*e7d!g
*e7d!;
E \hd5\
{!$Ie!
%^|V[_
su_|:R
3!\oe!
hd!]oe!
*\hdw]
!ehdd\h
*\kd!\
4Vk^H|
)!ghY!\U
*]id!F
k^]fw![
D!\h$O\
*gad!7
*"^|fR
*g d!3
So_df?_
3>dd\S
*\)d!a^~
"\RsK"
`fhdG/
vep_pf
#d!=w!H
cvepx|f
M?_l[S
*exd!`
h]|\?d
=p^|VS
hdE\1s
o.fhd!]c
fhd!Wc
h]x\c]
P6:`#o{
*ed!:
hdd\cr
o!e^9
uo_dfR
^8o_df
r_|fc(
R_hd\
Dhdk\'
hdk\'.!
h^|\Rt
n68`!ow
h]|\?]
*\id!R
*evd!M
yrupfc
o_dfR
*fhd!
Ifhd!Kc
h]x\c}
hdE\]@
#pddfh
*eMd!;
yrupfc\
!fh[>\
3!\7d!
!gh^|\.
hd=\'d!
e4d!at
~\hdC\
h]|\?]
]hdwpQ
#hdY\`e
)\hdp
3!\7d!
.!\?]x
f\hdvYQ
\f]8!e
=\4d!a
e4d!at
e4d!at
\f]8!e
\f]8!e
=\4d!a
\f]8!e
!ehx|\
!ehx|\
og><]x
4d!m-/
\f]8!e
\f]8!e
\4d!at
\4d!at
\4d!at
\4d!at
>\U+_$
-!\h^9\
\.d!at
\.d!at
\.d!at
hd^\U!
\.d!at
`\hd+\S
hZx\h]
o`fhdu\
3!gh^|\S
?!gh^|\
h]|\?d
|&hd*\
d!fk[x
}!chdw^Q
}!chdwTQ
}!chdwXQ
}!chdw
}!cjdw\Q
}!cidw\Q
)h`!\<]
d\hd*\nd
r(hd*\nd
?ddWc`
botva3v
{pPchU
hd!co [
]id!ww
gh]`\S5#
eh3w\
ho.\hdw^ *
fh_V\
Z+s!\a
>\U'_$
2\hdC]
u\hdYY
#hdv]Q
\hd+\h
#hdC]-&
hdBZce!
C?dd"Q
*\id!5k
hd!TiZ`
ufzZ9:
eRxq\:
YdLhd+\h
"hd+\Q
!ghdT\
VdZ#zd
C$-iqC:
k^}f?d
-qU9^
"a!_a
#nd!b%Z[
;]|i?^
YfGx
h^|\c8
c \hdT\
EIGq8n
*\hd!f
!\{Z[
W;7q\Rz
t4sfv]|G?d
h!]awoK
%hdT]
vZ?fR~
:D@x_$
h]|\?]
hdrURxq
ufh_`:
su_|:R
hdQZ
hdQZ
y fh^x\
Cmd!^w!R
m#ehY!\
Ks^?:o
WRf+\=
hd!k{7
];]`'nN
c!!'h^c\wh
su_|:h
hd_]>3
"\hd]
ho%\hd
*\hd!&
su_|:R
4s6swpOz
*\hd!E
hw|\xw
a2Okw|
AswtO{
+sw|Oy
0gRz2G
m2Oow|
XGsw|O{v
AswtO{
_sw|Oy
i#gh^x\<^
Gf62uN
f\kf!
3!2af!
!\>kdd
_w!\>A
su_|:W
su_|:R
3=\ge!
]j!]>l
hob\hdt\a
*\id!Q
8\hd>]
4hd!\/d!
hd!N!d!
h^|\;^
*C{d!k
*\kd!j
*\od!x
owVhd+[
hn\\ac
3!\idT
h7r\w!W
`hd!p8
fd!c`[
!Daz:w:h
d(Rzk5
g hdr\
ewgz]|:?2
% hdr_
*\hd!b
*\id!\
g eh3\
ud!Q{;
a eh3\
a ?h!O\
ud!mA;
W;7=\ce!
a fh_E\
*\id!9
Rxq\v0
{YGw^"mh!\a:d
su_|:Q
j\hd^\
hn_\sdp
m gh^D\
(\hd!]
Yfw^>i
gCg-B
W9o+\h
@wZ=6V
Rxp*86r
u\hY3
Umd'UvY
YjUhdz\
]a9Y(V;
R>&1^
hdqV96
"RxqU9
#hd+\$
R>&1^
k!Xh!V\
5-qN9
hd!c(
o \h^|\h
.\hd!]ce!
o \h^|\h
*\hd!`
e!\adt
m!\odt
a!gkdt
o!"i2!
x_$?dd
Chd!\odd
g!\adt
=C;dYex
c!\dt
*\+d!?
BtD!2h$K\
Z w Z>w
m!fc^^
IZbuGB7
<^`BRc
J\Hv>$
J\jZ`"
h]}\?]
h]}\?^
h]}\?^
oGg>x|N
ves_`:S
Q|\W%Y
i!ge_x
XOz:7:R
pd!86p
a$Q;!+
=h^1Jf
*\kd!Ow!
pY!fz^`
*\jd!M
]$^?Vs
[s^?:o
RdtBa^|
c dh^|\Q
a gh^z\S
RdtBadD
4s\v^!G
ocfhd=^E
4RdtBa
e5?fh1
sfv^!G
RdtBa^|
3!:ix|
c!gix|
e=\id!
^MRdtBadd
^b9^xV
48+8Hd!
/]|V?
ebV{u!
o!gk^|
cd!+h1
{s'85?
]hdG\V
{fhd\
[hdYw-
gbnI!w
RdtBadd
!gen,
'a^|VS
hd?\h1
hd\On[
^bz:B:
d-4_`'Vd
W;7?\h1
sY!:]{
*eid!G
4s\v^!G
!N>>dd
4hdd\<
h7?\h1
hzG\4^d\"
hdrUkY!
2on>fw
%+^xVVg
;7\h!
h:\h!
*]sd!Wl!D
>\TMZ$
hd!]hd
hd]oe!
#hd]h!\_hd!
6hd!03
>,hd^]
gho,\
K`e!}$
i gh2*\hd!
hZ>\Vg
.\hdK]
h7\{e!
'\hdOIe!
&hd]/e
su_|:>^
> TMZ$
} ghY!\Q
o ghY!\Q
*]`d!J2
#hd]h!\_hd!
_ gh^}\S
>o\\hd
\}e!at
.\hdK]
hdWYe!
h7\{e!
psRdtBadD
{pBRdtB
4p"RdtBa
oN\hdM
!@hd=\
*\jd!Y
h5?\h1
3Yd!Sw!
*gmd!E
K9^xM=^
f9ztQa
>Lt!P>
{Y\s^>
!hdu]<]
o7Ehd:n
o5fhd*^hd!
U hdryw~
h7=\An[
z0C:-,@
#Nd!Q;
hdrz86p
> w5?6
pBRdtB
oofhdr\
2\hd*^
#hd^^
g#'hot\
q#ghoZ\
g#chda\hoP\
hd=^{f!
YhddbHd!!(Z?\l
o#gh^s\S
=^sf!a
(\hd*^
#k(dbt
3!\Ef!
i#bh(d\Uv
$\hd=^Af!
u#gho|\hd
^je!yR
$\hd!^mf!
&\hd=^{f!
,\hd!^ef!
\hd^ef!
h7\gf!
*^Fd!i
hdBYqf!
&hd^/e
Gd!0k)+
{pBRdtBa3v
*\hd!w
h7r\v^!
dN>2w%
ouEhd:cRdtB
*\hd!)
^\hx|:
}\w!\&
g`g$Z`
gRrCC-
su_|:R
h2w\>2
.>kdd
TNn!S>
W>2w\>
h7?\h1
RdtBa^|
p!D>{Z>XS
_e5?f<0
F\hd^]
H\hd!]
k0gk_x
oeVhd=q
hd!,v^!
h7C\-=
Hv!]>lo
hdr\9z
KJhd`
RdtBa^|
hdr\RdtBa^|
"+>w5?
4sBv^!G
nY(r/:
.,b^xJ
|!&`Zx
}"s%"a
q"w"\>
krgwZ`
hdrZw_|
Z>dtB;Z
pRdtBa^|
RdtBa^|
RdtBa^x
t^5f2dd
J&hdGQW
9,\hnS\
F\hd_Q
\id!_
@\hdQ5i!
9,chdW\
+hd!Qh
#RdtBa^|
!"hd!c
!]h]x\?2
YmZhdC\
Xq^hdu\
X\x!n>
v@hd=\
h7?\x!X>
yd!]v^`
%!\hY!\
*\id!ek7r
4<^"Nv
*e4d!/
4p\RdtB
gf/e:
# b;d!W
9fp_x2
;Ddx|J
9fp_x2
2\wWf
f86:/RdtBa
9fp_x2
;Ddx|J
9fp_x2
2\wWf
f86:/=
eqfv^!G
vez2w:>0
vez2w:>0
Gf<^bN
RdtBa3
^\p_|2
r_,Wx!G
hdrARdtBa
_CwlQGr^p&
69^/Qv^!
oaVhd=
h7r\w!_
ufh_x:S
<0!5ydd
>\RdtBa^|
_flsGG
'dZ:Sb
|#ch%X\
m0MauQ
e:|RdtBa3
$v^!G
su_|:R
)c*Bhd!
eEdxqQ
o[,0_`
4+gd!c
td?$_|
c(_x\b
`d4Udd6
O!\wZ`
Cw_|&R
)So^x&
fhd^SW
U& $h^x\w
o!Xh$d\
&+gd!c
fd?$_|
c(_x\b
#hZ!\(
,6dx&V
@P>!$h
Ehd:%W
h2w\>2=
m$r!=>L
wuVv{/f<
c_FVc!_odG
d!Do_df
h]|\?]
q\;% W=
%>0! i
h^x\?]
Io_dfV
g!\mdd
]hd!]idG
*\id!:
oddfc
d\hdB\/d!
/o_dfc
hzt\aZ`
d2<dT,
#w^xfR
]hd!Yw
o0^hd?
h]|\?]
*\ld!$
+!gh^|\S
vB\!d!
?!fh^^\
#hdv\Q
!fh_|\R
9!eho;\hdG^<_`\S
*\id!.
*\jd!4
hZx\h0
h]|\?]
h]|\?]
h]|\?]
#pddfh
h]|\?]
h]|\?]
h]|\?]
5!f7d!
su_|:<^
{$/d!
1fhd!\c
Oo_dfV
^Q9'N?^9
Gf<^&\Q
*\nd!l
h^U\R|
x6e!a?]
x6e!a?]x
]hdvKq_
hpv%q_
L\hdC]-
hpv%q_
F\hdC]-
]id!-A
ghdD\
fhY:\
ghdD\
fhZO\
9 \h]x\"
!Wap/:f
fh_^\U>
9 \h]e\
"z:!:5e!
]Q ^#>]
.*hd+K
d!5R|C
o;fhd!\
idt$a^~
h]|\?]
h]|\?]
*gid!b
o_df?_
fhdA\o
!$hn}\
)p^|VS
0]|V?]
0]|V?]
!gh^|\S
!fh]|\
3*\hd!
]hdt\a
Mo_dfV
yo_dfV
h]|\?]
fhd!Pc
9!gh_|\S
@bhdw\
o>\hd?
# gh_d\S
WQYk\h
WQYk\h
M]U<^$
:\hdv]t
p\hdB]9e!
oX\hd?
d!aRcG\?]
zBhd*\id
vg7]xVc
h]|\?d
Gs!Yah
*b(d!k
h^|\b)
*\hd!r
m*ehd!
c=!Vh]|\
n*ehd!4
p+d!Tw
,d!5hn-:
oNfhdr
h]|\?]
!hd!\z!Ua
jduid
d?":r
W>]x\t
j\hdt\
Wszt\a
*\hd!28
ver_dfc
jdIid
!ehox\jd
c.}\h]
Z\hd*_
\hd*Xff
*bBf!,
0\h]x^c
{h]x^c
6\_(#WQ
`\hd*\
xBhd*\@f!
Ch]x^cw
Kh]x^c
Ih]x^c
Sl\h]x^cb
Oh]x^c
&\N\#WR
mh]x^cb
&\~]#WR
D\hd*\
wh]x^c
c&@\h]
j\hd*\
m*eSf!a
D\hd*\
clB\h^
c*fzd!$
S*e"f!M
5\h]x\cp
#h^x^W
#h^x\W
#h^x^W
#h^x\W
#h]x^c
cF2\h]
z\hd*\
6\h]x\c
cYO\h]
>\hd*_
"eho&\id
co9\h]
\hd*Zpd!B
f\hd*Ypd!
9\h]x\c
Z\hd*\
Z]hd*\
ZBhd*\
Z^hd*\
ZBhd*\
cPK\h]
c6K\h]
Z\hd*\
Z\hd*\
;!ch$!\h]
~)hd!\hd
c:J\hz
~\hdL\
\hd*Xrd!
ciP\h]
^\hd*Yrd!
cCP\h]
c=P\h]
v\hd*\
c4M\h]
v\hd*\
v\hd*\
r]hd*\
d^hd*\
dBhd*\
d\hd*\
dBhd*\
r\hd*\
d\hd*\
d\hd*\
r\hd*\
d\hd*\
c\O\h]
r\hd*\
o*fhe!
Wh^x]W
c*fie!
+h^x]V
c*fje!#
mf=oW
f\hd*\
[h^x^V
d!-vdd
Qh]x\c
@\hd*\
Qh]x\c
d\hd*\6d!
~\h^x\c
b\hd*\
I\h^x\ci
gh^x\cu
!eho}\hd
;z!\7d!
[h^x\V
!eho5\id
c4@\h]
!eho#\id
J\hd*]
*\hd!3
#ehoK\id
X\hd*^
#eho!\id
Z\hd*]
X\hd*]
c;N\h]
!ehoc\id
q ehoy\id
[h^x\V
[q&!WR
9!ehoU\hd
!h^x\V
# eho{\hd
!ehoc\jd
cf;oQ
*\je!Cv
c*fBd!
`\hd*\
\hdd^c@
y*fCd!
*cme!9
*cne![
*cne!a
*cne!/
*b`e!m
*b`e!;
=vf!&7
!l=/h
=l\.+m
hd!\hd!\hd!\
(d!\(d!\(d!\(d!\(d!\(d!\(d!\(d!\(d!\
?w?>9w
rE;UF7
Ilh%il
Zr;0sc:X
c;&ra;
^rj;5sq
m[k4m#$k
*y>02y
fqR8`qT
XyykZy50!
< ub</
~rJ;Brt;y
[q78$qc8u
S8J"Y8
$-m&$Qmf
(k2"$k
w.Igv-Ud=
o0%ya0X
k,uw<-
*s@:Rs
e$Sml$Zmo$[m
:bX+yb<*
0Lyy0)"|0s
M;jr\;
U$amt$lmW$s
dz-<d5
ByJ0~yG
M0By~0xyN
ri;2r%
T;ur[;e
Q;vrX;brW
C$nmA$t
Q$}my$`mz
B.GgA.A
y.xg|.z
rB;0r$
D"o%ylC
Bd@-Edz-G
Q+tbP+o
<xu|<G
a!&hb!!h
95V3/
01V;<
0t;=1t
&Zog&.on
d!whZ!k
fh^ xh
!a"F!sht
Gh_!ahX
g*.+"`k
9`:)<"4
jV_jV
\ov&Xo
k&!ot&-
'ol&[oa&]ok&2
k8"\kk
Z!ph]!jhE
~an(}aF(s
K(|a@(
VQcV!oVO
$fVLqVP
>&tq=H
"`=Ztf
$t{=Ntg=
kvdQ-wdR
Iw+>Stp=I
_tj=Atd=Jtc
:~sE:s
9:p89;p
93p991
ooQ&zoT%bo
G&woH%(
hdS-tdM-p
@VjVV
|ViMVd
fIVs@V
TVp^V
vtT=ytS=i
C"ekJ
)S`)\`c
rt|=|te
:j?#7j
5j8#3j
-'d--Zj
X-edY,
p(vap(
m#{ji#r
t#VjF#Fjx
p#?kr"
*Qcs*!cf*Uch*\
`9 pc9_
\jo#]jp
Djw#Djt#E
n#Rjz#K
, Xf3/_
)@`p)J
}`F)G`t
8Aqx'(
SnpkNnd
7ih ,i
]e`,^ek+
(oatWV
p$9Ppo
'Znf'Cn
{'Vng'Lnj'Tnu
j']ns'B
5ij +
n`N)p`P)
'Onk'}
IiB HiC
icG*kcN
MpT9Op{9App
~iu xir
Jen,Qer,Peo+
*hcR*qcM
}kEpv9
ti[ v
s=:zp<8D
Xab(eax
d0Tyo0K
ey^0dy]
Ovp?Nvw
zvC?xvB?|vG
rvK?qvJ?w
c>Ywb>X
Swe>Rwk>Vwi>K
Cwt>Bw{
rwK>qwJ>w
Y>gwX>e
Dt}=ptC
Muv<Luu<C
~uG<suE
vuO<uuN
W<luV<d
r>;;r<;:
Urn;Orl;N
B;qrG;wrH
jrL;nrP
Ksl:Oss:N
v:Cst:@
usN:msM
asZ:gsX
Hpq9Bpv9G
Dp~9{p|9y
K9wpH9v
Cqp8Bq{
_n`'Qnd
l'Inr'@
qnJ'pnI
unN'knM
\le%Rld
Hlr%Mlw
Mmv$Cmu$E
|$qm@$p
j##j"
Yjc#Xja#_
S#ojR#l
n"Kkm"O
ukO"tkM"ikS
!\hc!W
@h{!{h
Zic \
Uin Tim @iy
piJ wiH i
:rn3Uu
].%ty\A
u\+vN-
+ ai[T
TuA$fmQ
bQ=P*
_&agc*
(1lA/r
:k=$yc
Rsv1 #
rm&U6
\afk(e
bi<+{
u-8@qz
.8bl,$Rg
,pp wj
?Py~<v
%vlO(o
IWgjd"w
wx%6m>
/#f>[\
_wJ(.h
:fB+Xf
"2k1Y{n!
JerUx
O>7q48
$v -W`Y
4#vjh
:)g*UM
Y/wn>3
hPMyN$
#uf&vu
p&|g(+
9Ips'<
3:|nT[xf) d
R9lw{9
U_e>)x
08OyV_
vV9Qq"!C
<#r-:$
0UBf* @iv]
^an:Sm
)k`EQ
^Y;uuW
S:qsE:h
gaG=wt
\igP`c2W
"Tee*I
$&xhk g
Zpl<)I
w.Pa{.
*{`p])
e|TznjS9
j)*8c>
E$zgJ:
RgnwRR
}!qt::
`kY>dkc
>8qq$0r
h:pw\.%v
TEn/"}i
'Fnz$R
an&6`dR
b-4nN'
"_$j)UC
y:Ast8
.>f7-)
'R`q~!
~:kp^%
yJ.Mus
mg!\a&
#/id,_
pA9nh4
0Xs.9Ea
0jyC&Gb0
lPj`i(5
_dvw]ol
$Pun.!
F$nri8
hY$iem
@kX/5b
~rG$`e
sE+gLU
l4%Xl9
&k"~kz
Lvu?ivt?h
]wf>Ewe
L9opS8
vqO8jqN&
Swd>Dwk
srD;rrK;p
R8aqW8dq]
,`eQ,g
&v?Sv
Vwo>pwn>w
nrW;mrV;l
o!&o &
Xka"^k`
Ggx.Fg
\ae(Sad
:Msp:L
%Wlf%{
m)$km}
Ohp!rhw
c!*c *
E~Vz}Vl
r>zww>
Rok&Qoj&P
Eo~&ao|&=
l@%~lG%}
"nk~"m
g0.Xg6.b
a#(*a=
Uan(Tam
|EVsDVr
Owp>ywv=*t
+r3;*r
joS&ioR
Xba+]b`+db}*
v=Dte={
ktM=jtS=i
rl{%qlJ
7 ;f8/:
=.;g<.9
]`f)\`e)S
r2;(r1;/
Rjk#Qjj#P
yjB#xjA#
Zec,Yeb,X
+Ubn+T
J`s)I`r)H
a7(;a6(,
9Spd9R
Ipr9Lpq
8@qy8G
Ynb'Xna'_
Tnn'Knl'J
{'Enz'|
hjQ#cjP#b
Wih Vio U
Kfl/Jfs
Nfw/Mfv/L
j,Ueo,C
@cy*Gcx*F
k`L)j`S)i
,?*v6?u
h'Uno'I
w"xkv"
ziC yiB
~iG }iF siD r
w+Mbv*
hcQ*ocP*n
9Ep~9D
Dq}'zny'
n@'snF
vnH'unN'k
onP'mnW
X di^/
jfS/ifR
P/nfW/m
d*-Zd)-
bac(aaZ
v4?[v9
B,ce@+
(Bab(A
%s<:bs
Z'fnX%
a%tlM$
~pG9|pE
l(%Yl/%
-%Ql3$
&"+k%"
}-gv1;)
'*n,'v
d=+Ebc
5s4%Elt%U
mk<y]?;w
;Ds/!5bK
&Fo<%ol
#ejE if)0od
;UF79
w kPqV
qkzfk)
O) aFW
wk`-e
w"f.+"`k
e,kMeC
$"D\7"
a"h!a"F
8k@vyk
R"2/R"
?\vg?Rvk
z?Evy?
vAkvv?
S?mvW?a
{>."B)
;Urc0N
Epx9}pG
83q480
f8Xqk8W
&_od&Aol&/o
f%Nll%zlx%{
klO%clS
j3# j
!j?#7j=#+
W#FjM#HjB"S
q"Lkv"C
mkL"bkV
!7h!Q
/ffd/Q
S/afP/g
zdr-zdz-Edy
\e,Sef
},xe~,peE
t+Gbz+
~+hbI+k
=c&*!c
*{cF*|
)6`g)%`d
t)x`y)N`}
VamkJat
haS(baW
rgR-ag
j&_o+%
9nf#+"
8$q(&2
hg!jgZ
9/p0-U
<'qL$^"
P"R(P"
T"m'Yh
kCflkK
s]Mw{kJ
)naWW1
+Gbk)E
Ik+jG#
#'dn$%
"SdA,OaRV\
@i@->d
,i)/if
#`U_Tl
$e")<0iX)
pA'hjt
uB/peU
=oU!/y
^c'[te
^c#[tx
^c0[fA
^c\[fU
^`[XR?
^`!X"x
^d'\R
^i^QEl
^n;VPp
^n8Vhu
^n\V0O
^nRV"g
^mTUd}
^s8KMr
^s%KE/
^rUJso
^r^Js/
^rYJs,
^q"I9v
^q0I7~
^v:NEU
^vRNE+
^v]Nu}
^v/N?`
+uSR~
be#03w*$
F8mq#&
m'SHqe&
kbN)xl)
X%_oOV
0UBf* @iv]
d!?l2W
',l%XO
>VIv($
kTGplSbru,qv:'
qR8>mN
q\0nv$
oB;%G0
~"Giv[b
T5ko"=
o!<sdY(
fiP*C
%,AkU%
'Fnz+R
&f,-Tb
Qwfl]L
hYAbGY2
n[GhcW8
:qsE-ps4:h
G\lls&
kccg('a
QY{p("d
p_@a>_
[bb)vvm%
sJ!ihI
(%`)9>
H&*an).a
wRUuS;
wx%6m>0V
Ek~> uT9
Xavi<Z
:vs}:p
?`ly!de
Q0q<$e
.:(nU'
mj#2iQ/7
Rfvq>)
'.j;U=
jk Ub"
$v -W`Y
#)c Q_jO#
l?ls#'
op<6fN[n
''u``<O
v?hj/Pt
yx=8kF
A;fqsVV
U,gvU8
h+ `bS
&Bm +!
im*?Bt
/jl ?g
#Ukn+V
g*ncGUmfqS
c0^w6R8y~0
%liyR,
j>Il[$
TuA$fmQ
X:gll&"
~Z)tFR
#s[&shj/e
v:_qt$:
]x`;^X
_dvw]ol
(_pp"q
dP{w:>z
bT^pvO
[[i$'x
\0*lI]!
5!tgk)
TEn/"}i
oB]#o<
V>2gv\`
}&7o?#
s:[l[$
>lur'O
b,hb$X
\wii^=
0Xs.9Ea
0jyC+m
sY[U8S
!/o5 "
&,h5'"
!/o5 "
to*Z$o*
Wsa$Ztj/Y6j/R6j/R6j/R6j/R5j/R3j/R
7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S7k.S6k.
5k.S6k.
7k.S7k.S6k.S7a$Ss`%
|9D|9D
<d!\<d!\<d!\<d!\;d!\8d!
9d!\:d!
8d!\8d!
:d!\<d!
2d!\0d!\?d!\?d!\0d!\0d!
4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\4d!\3d!\2d!
1d!\0d!
0d!\0d!
2d!\3d!
4d!\4d!\2d!
4d!\sd!
4d!\4d!\4d!\4d!\3d!\1d!\0d!
1d!\2d!\2d!
4d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\5d!\4d!
3d!\4d!
5d!\5d!\3d!
5d!\sd!
3d!\4d!\4d!
6d!\6d!
6d!\5d!\4d!
3d!\3d!\3d!\4d!
td!\td!
d!\7d!\5d!
6d!\6d!\6d!\7d!\
d!\td!\td!
td!\td!
td!\td!
td!\td!
d!\td!
d!\sd!
Dhd!Zhd!\
oc&Vjf$^
D/qk6e
|{%GBz
NSwf;d8
y-0PS
.[(k`+
rIE;}rp5Ffj/H
pIE:}sq4Gxt1I
u|9Ayp
B}v3Fx
8t&[xc
S;t&[gcs
nR+bH3
)[rmN$
EjE&Z@m
P@hS$b
jhd!Mjf
tg"_s`%
s`%Xra$
nb'[ma$Z
m(Vil)U
[io*Vii,
v2Mjp5
mx=@ox
iv3Mip5N
Vhn+Vhm(V
Uhi,Whk.Q
Whn+Vhm(V
Thb'[hb'Zha$Z
\h`%^ha$Xhc&Y
Kh~;Ehx=F
Rhv3Lhp5N
O4GoL.Hb
PhI;WhI
`Rhv+Rh
Yh`%Yhg"Xhf#_he ^
Ohs6Ih}8K
`s6Ims6K
Lhj/Shj/Rhi,R
^he ]hg"]
K?LhK<R
tEhU:Eh
Vhj/Qhk.Rhu0Shw2Mhp5Ohr7H
hr7Khq4Jhq4I
\ha$_hb'Y
[ho*Uhi,W
Rhv3Lhp5Nhq4H
Jh~;Eh
:Gl~;Gj}8Fi}8E
^he ^he ]hg"]h`%_hb'X
lO)^nB
bLhx.Sh
j~;Gi}8Fh}8
Ihp5Ihp5Hhw2H
Lhj/Shj/R
]ha$_hc&Yhm([
y?GhD>Bh
ThM)Yh
Eh|9Ehs6D
Hhw2Hhv3Ohu0N
Qhh-Qho*Phn+W
Yh`%Yhg"Xhe _he ]he ]hg"]ha$_hc&Y
Thh-Vhk.P
<Bh@9Fh
$]hO']h
Fh}8Fh|9Ehs6D
Hhp5Hhw2H
Phm(Vhm(Uhc&U
Thi,Whk.Qht1S
Dhy?Gh
E>ChG?Ch@:@
C~&czG
Ohv3Ohv3Nht1Nhk.L
Zhb'Zha$Z
_he ^he ]hg"]
*YhC*_h
(^hN*_h
Ahx=@h~;@
Fh|9Ehs6Dhr7Khr7J
Ohv3Nhu0Nht1Mhj/Lhj/Rhi,Rhh-Qho*Phn+W
Thb'[hb'Zh`%Z
^he ^he ]hg"]
Nhs6Ih|9Kh~;Dh
h{>|hz?Chy<Bhy<Ahx=Ah
:Gh}8Gh}8E
Ihp5Ihw2H
Mhj/Lhj/Rhi,Rhh-Q
^he ^hf#]h`%^ha$X
BhF>Ch
Chy<Bhy<Ahy<Ah
:Ah~;Gh~;Fh}8Fhs6Ehr7K
Qhh-Qho*Phn+Whm(V
^he ^hf#]h`%^ha$Xhl)Y
Whu0Rhv3Mhp5Nhr7Hh|9Jh
C5Ph^?Yh
Gh~;Gh}8Fh|9Ehs6D
Ihq4Ihw2I
^he ^hf#]h`%^hb'Xhl)Z
Hh}8Kh
^hG/^h
:Ah~;Gh}8Fh}8E
]hc&Xhm([ho*U
kx/jpK
Gh~;Fh}8F
Khr7Khq4J
Phn+Whm(Vhl)U
QhR:Yh#
|h{>|hz?C
Vhl)Uhc&T
Wht1Rhv3L
:DhD9O
[h{3XhD
Ohv3Ohu0Nht1M
]hc&Xhm([hh-Uhj/P
z>BhD>Bh
KhC2Rh
Lhl%Rh2
Bhy<Bh
Thc&[ha$[hg"Yhe _he ]hf#]
}8Khx=F
4Xh{4_h
Dhq4Khq4Ihp5Ihv3Hhu0Nht1M
_hm(Zhn*Uh
Shp5Nhr7Hh
Rhx9Uh
iLhf L
[ha$Zhg"Yhe _he ]h`%]h
Vhk1Qh
^h{8YhF<U
Gh~;Gh}8Fh|9E
Nhk.Mhj/Shj/R
[ha$Zhg"Y
iLhn$L
Chz?Chx=B
Fh}8Fhs6E
Ihp5Ihw2H
<Gh{>Ah{
3NhI7Yh!
fLhk)L
|h{>|hy<C
Gh~;Gh}8Fh|9E
Phu0Shw2M
r7Oh}8Jhx=Ehz>@h{
JhB3Nh
|hz?Chx=B
Fh}8Fhs6Ehr7K
_he ]h
Uhk.Ph
}h{>|hz?C
Gh~;Gh}8Fh}8Ehs6E
Shr7Oh
Hh}>Rh
1Lh^<X
Bhx=Ah
Lhj/Shh-Rhn+P
Tha$[hg"Yhe
Vht1Qh
A3HhM2Yh
Zh`%Yhe Xhe ^h`%]hl)X
fLhO9L
qhQ7{h
Ahx=Ah~;@h}8Fh|9Ehr7D
:whI5xhN
Bhz?Ah
:Bh}8G
Lhi,Sho*Q
Nh}8Jh
Ehx>Gh
|hz?Chz?B
Nhk.Mh
Rho*Qhn
Whc&Vh`
_hd!]h
JhA0Yh
uhD5|h
Chz?Chx=Bh
)Whb'Th
IhM2JhA
:@h}8Ghs6E
Gh|9Fhq4D
ZhZ<Yh
Ah};EjE
Bhu=Nhv?Vh
@1[hY:Yh&
LhI4Qh0
Fhw2Nhy<O
<|hy?A
M>|`C<KhL
HhV9Ih@
HhP8Ih@1T
HhR;Ih@
jQx?qE
{hw2@hv3O
Qh[>Dh]
ShW6Wh
XhY9YhY
rh(fh
zh4anh
XhX6Th?
T|8pE|4
P?JhT:IhP
cShV6Sh"
|h+rh
`ShQ8S
+Xhv3V
Khy<Ghy<Ahy<Ahz?Ah{>BhD
^<Sh%=Th
Ghy<@hz?Ah{>BhD
Ah{>Ch{>C
`hp3nhe Mha$]
Vhj/Phj/Rhh-R
Vhq4Lh
8Dh~;Eh
:Fhx=Ghz?@
Xh^4[h#>T
GhU8DhP=Ih%
Whl(Uhh
Fhx=Ghy<@
LhW5Mh
ihd!Ehd
^hb'Yhl)Zh
,Vht1Qh
.Lhi,Lhm
*Qhm+W
5[h[8T
Hhg"Xhb'_
l*Vhn-Th
g"Sha$_
Tha$[hg"Y
]hd!\h
Zhm(Tho*Uh
Bh{>Bh
ShT2Ph+
^hc&Yhc&[
-Phm-Uh
[hk0Vhp
0Oht1M
Tho*Vhh-Whj/P
.Lhh/S
Khs6Dh
Sh':Lh
h{>}hy<C
Uhc&Thb'[
Tho*Vhh-Whj
k0Vhp2Rhr
EhD?Gh
Sh!=Lh
\2ZhT1T
Vhl)Uhc&T
^hd!]hd!\hf#\
.Lhk.L
Vhl)Vhc&Thb'[
\he \hg"]
Dhz;FhA9Dh2
Gh|9Fhr7Dhp5Jhw2H
Rhh-Qho*Phm(W
Zhl)[hn+Tho*V
/Uhi1Uh
}hz?|hx=Bh~;@h|9Fhs6Dhq4K
~h{>}hz?Chx=Bh~;@
Mhk.Lhj/S
Phn+Whm(V
1Mhj1S
Qho*Phm(W
Yh`%Yhg"X
Lhv3Mh
[ha$Zha$Yhg"Y
\hg"]ha$_
Rhw3Lhq
PhG*Xh
Jhq4Ihw2Ihv3Ohu0N
Shi,Rhh-Q
Zhm(Thm(U
RhS7[h*
Vhm(Vhm(Uhc&U
^hb'Yhb'Z
[hn+Uhn+V
k/Phw.R
Dhr7Dhq4J
^he ^hd!]hd!\hf#\
[hY:Zh
}hz?|hy<B
Gh}8Fh|9Ehr7Dhq4Jhp5Ihw2H
Lhj/Shj/R
Yha$Zhg"Y
]hg"^h`%_ha$Xhb'Y
Lhk.Lhj/S
[hb'Zha$Z
[hh+Vh
Wh0?Wh<
Mhk.Lhj/S
_hf#_hf#^hd!^hd!\hf#\
Rhz(Xh
Qho*Phn+Whm(V
Zhb'Zha$Z
Xhf#_hf#^
<Wh<>W
QhD+Rhz
:@h~;Gh}8Fh|9E
Ohu0Nht1M
Qho*Phn+Whm(Vhm(U
Thb'[hb'Z
#Yhw-^h#
Ph9>Ph=?Ph7
Dhr7Dhq4Jhq4Ihw2Ihv3Ohu0N
Shj/Rhi,R
Uhm(Uhl)Uhb'Thb'Z
?Ph=?P
Wh6=Wh
*Rhz(YhW.X
Ahx=Ah~;@
#\hJ8^h
lh)>mh*>m
Qho*Phn+Whm(V
!^hd!]hd
Vh2<Vh>>Wh:
Ihp5Ihw2H
Qho*Phn+Whm(Vhm(Uhl)Uhc&T
Yh`%Yhg"X
^hf#^hf#^
YhU/Xh
>nh*>mh+
?nh+>nh
Hhw2Hhu0O
Rhi,Rhi,Q
Vhm(Vhm(U
[hb'[hb'Zha$Zh`%Yhg"X
Wh;5Vh
Th;5Uh;5U
RhE*Rh-
Phn+Phm(Vhm(Uhm(Uhl)U
]hg#\h
n'?Jh+
Khq4Jhp5Ihw2H
Rhi,Rhi,Qhh-Q
Uhc&Thc&[hb'[hb'Zh
;<Wh:<Wh>
ZhJ,Xh
B/Rh!=Y
}h{>}hz?C
:@h~;Gh}8Fh|9E
[hc&[hb'[h
<Wh;<Wh8<W
-XhQ.Zh
Eh|9Ehr7Dhq4Jhq4Ihp5I
Qhi,Qhh-Qho*P
Uhm(Uhl)Uh
Ihp5Ihw2H
Mhu0Nht1Mhk.L
Rhi,Rhh-Qho*P
Uhm(Uh
Phy)[hO-X
3Rh[8Zh
Uhn+Uhn+V
:2Th;2Th
;4Uh;4U
WhR0Phy
Dhq4Khq4I
Nhu0Nhu0Mhk.M
5Uh;4Uh;4Uh;4Uh
;Wh::Wh
:Ah}8Gh}8Eh}8E
Rhj/Rhj/R
(Wh`%Uhd
Lh91Vh9
3Th;2Th;
5Uh;4Uh;4U
}h{>|hz?Chy<Bhy<Ah
Ihp5Ihw2Hhv3O
Yhz)[h>
Dhs6Dhq4K
5Uh;4Uh;4Uh
>Ph[2Ph
Rh&<Rh
Chz?Chy<Bhx=A
Ihq4Ihp5I
$Phl%Zh
Gh?1Lh
<9Vh>8V
B+XhP/Y
Ohv3Nhv
u/Nhj+R
?1[h81[
[h:3Th
:4Uh;4U
Uh;7Uh;7Uh
Uh=9Vh8;V
A+XhP/Y
Jhq4Jhp5I
=1Uh>.T
.[h81[h81[
Uh;7Uh
:7Uh:7Uh:
4Uh;4Uh;4Uh;
;9Vh:9Vh99V
(XhP/Y
s6Dhs7Dhr
.[h81[
1Th:0Th
0Th:3T
:3Th:3Th
3Th:3Th
4Uh:4Uh
89Vh=6Vh3
UhG(XhP/Yh
Bhy<Bhx=Ah
;Gh~;F
Eh|6Dhr4K
;Mh.8Kh4
.Th=.Th=.[
81[h91[h
[h:0Th:0T
0Th:3T
94Uh:4Uh:4U
94Uh:4Uh:4U
4Uh94U
4Uh94Uh94Uh9
84Uh94Uh
5Uh:5Uh
?Wh59Wh
UhF(XhP
W3Ph&7S
.Th=.T
90Th90Th90Th90T
83Th83Th
4Uh94Uh94Uh
27Uh36U
A+[hZ9Yh
?}hx=Ch
2Lh+3Rh
Th<1Uh=.Th=.[h>.[h
[h90Th90T
3Th?2Th?2Th?2Th?2Th?2T
?5Th85Th?5Th
2Uh:5Uh;5Uh
u3Hhv3Nh
u0Oht1N
t.Lhu/S
0Th83T
0Th?3T
>3Th?3T
2Th?5Th?5Th
5Uh85Uh
:5Uh;5Uh;5Uh
z)XhP/X
+[h\4Yh
7JhG6O
OhW8Ih
Zh6/[h
[h>1[h>1[
>1[h?1[h?1[
[h?1Th?
?3Th?3Th?3Th?3Th
0Th>3T
Th?2Th
3Th?3Th
2Uh;5Uh;
&XhP/X
3Th=2Th=
Th=2Uh
Th?5Uh
3Th?3T
3Th83T
Th:2Th
2Uh;5Uh
;4Uh;4U
5Uh24Uh
Qh,?Yh
Zh2.Th<
.[h>1[h>1[h>1[
1Th>0Th
=3Th=3Th=3Th=3Th=3Th
3Th<2Th<2T
Th?5Uh?5Uh?5Uh
Th?5Th
Th?2Th
Th>3Th?3Th>3T
Th;5Uh;5U
5Uh;4U
5Uh=7U
//Zh/,Zh
[h>1[h
1[h=1T
<3Th<3Th<3Th<3Th
Th=2Th
2Uh?5Uh
Th>3Th>3Th?3T
0Th83T
2Uh;5Uh
Th15Uh
&YhU,Xh
Th.2Th
[h6/Th7/[h2
<.[h=.[
.[h>1[
[h>1[h>
1[h=1[
[h<0Th
1Th<0Th
Th>2Th>2T
=3Th>3T
83Th93Th
95Uh85U
Th15Uh
Yh].Zh[0Z
&YhT,XhH
(,Zh*,Zh
,Zh6/Zh
.[h=.[
1[h=1[
2Th>5Th>
>2Th?2T
0Th:3Th
/Zh^.Z
Vh"9Vh"
-2Th(3T
1[h<1[h
0Th33T
=3Th>3Th
[h>3Th?
0Th:3T
0Th:0Th:3T
Th=2Th1
W-ZhR,Y
Uh#5Uh-2Th
.[h31[h31[
.[h21[h21[
10[h20[
3Th33T
Th=2Th=
<3Th=3T
=3Th=3Th=3T
3Th=3Th=3Th>3Th>3T
=3Th=3Th<
<3Th>3Th
0Th:3Th
Yh^.Zh
Qh :Ph
3Th=2Th=2Th
Th<3Th=3T
3Th=3Th
[h>0Th8
90Th:0T
[h:0Th
0Th:3Th:3Th:2Th:
Zh#,Zh
.[h7.[
[h01[h01[
13Th23Th23T
3Th23Th2
3Th23Th23T
3Th<2Th
0Th<3Th<0Th
0Th=3T
ThS-[h
/ZhZ.Zh
&ZhN*XhK
Qh_7Th
Rh-?Qh
-Zh"-Z
4/Zh6/Z
1[h01[
00[h00[h0
13Th23Th
3Th23Th
[h33Th3
3Th<3T
33Th<3Th<3Th<3T
0Th=0Th=
[h90Th90Th90T
90Th:0Th:0Th:0Th
0Th:3T
&ZhM*X
Sh,?Qh
2Th#3T
Zh",Zh!-Zh
5.[h5.[
[h23Th2
[h23Th2
33Th<3T
<3Th<3T
1Th:0Th:0Th:0Th:0Th:0Th
0Th:3T
*YhS*YhS*Y
<Qh&;W
5Uh!2T
13Th23T
<0[h<0[
1Th:0Th:0Th:0Th?0T
*Yh\*Yh
/Yh[.Zh
Uh'5Uh 2T
1[h".[
[h13Th
1Th:0T
^-YhX,YhZ/Y
ZhA+XhP/Yh
Uh&5Uh
Yh(/Zh(
1Th:1Th
1Th81Th
YhY*YhY*Y
.Zh 0Zh&0Zh
(XhP/Yhj%[
,Zh./Z
/[h(.[
21[h21[h21[h
Y*YhZ*Y
&[hG(XhP/Yhv$[h
Ph%8Wh'
Yh,,Zh
/Zh./Z
0[h70[
70[h00[h
[h20Th
71[h01[
.[h21[
.[h1.[h0.[
+Yh[*Yh
/[h&,Z
Zh./Zh
1[h60[
[h70[h60[
60[h70[
60[h70[h
.[h0.[h
[h%*[h
1[h'.[h
+Yh&*Yh&-Y
Yh,,Zh-/Zh-/Zh.
[h60[h60[h60[h60[
60[h70[h70[h7
[h10[h1
71[h71[h
.[h1.[
7.[h0.[
+Yh$*Yh
*Yh%-Yh
Zh$-Zh$
+Yh%*Yh%*Yh&*Yh'
-/Zh./Zh
1[h10[
.[h11[
[h21[h
*Yh&-Y
/Zh".Z
z)XhP/Xh
P0Ph.>[
Zh./Zh./Z
/Zh(.Z
1[h51[h
1[h51[h51[
1[h51[h
51[h61[
61[h61[
1[h01[h
.[h61[
.[h0.[
.[h1.[
+Yh'*Y
Yh"/Zh
&XhP/Xh
?[h-?V
1[h41[h41[h41[h41[
41[h41[
.[h61[h
51[h61[
51[h61[
1[h61[h71[
.[h71[h
.[h7.[h
7.[h7.[h7.[h
Yh-1[h
1[h43[h
,XhM*[
Ph,>Qh%
*Yh$*Y
Yh'-Yh
,/Zh-/Z
-/Zh./Z
/.Zh(.Zh)
Zh*1[h
.[h+1[h+1[
.[h41[h41[h41[h41[h
.[h51[h
51[h51[h51[h51[
1[h71[h61[
.[h5.[
.[h6.[
Zh11[h01[
Th[2Th
,Zh-/Z
.[h51[h
.[h51[h5
.[h61[
/[h5.[
Zh&*Yh'-Y
!,Zh#/Z
XhU,XhH
!?Qh$;Wh$9Vh$
.[h[/[hZ
%-Yh',Yh ,Yh
,Zh,/Z
5.[h4.[
-Zh",Zh
,Zh,/Zh
Zh(1[h
XhT,XhI
!?Qh[;Wh$9V
+YhX+Y
%-Yh&-Y
,Zh#/Zh,/Z
/Zh//Zh
.[h4.[
.[h01[h=
&*Zh'*Yh
/Zh/.Z
8Wh$9Vh[7U
*Yh%-Yh&-Y
/Zh//Zh/
Zh*.Zh*
6.[h7.[h01[h<1[
,Zh-/Zh,,Zh
,,Zh-,Zh-,Zh
1[h+0[
XhJ-Xh
/Zh-/Z
//Zh(/Z
Zh4.[h
.[h31[h>
-/Zh./Zh
,Zh#-Z
-Zh.,Zh.,Z
0[h53[h
XhI-Xh
UhZ4UhY
Xh[*Yh$*Y
//Zh(/Z
Zh+.Zh+.Z
)/Zh*/Zh
4.[h5.[
[h#-[h
-Zh ,[h!
Yh-,Zh
,-Zh--Z
-Zh.,Zh/,Z
Rh&=PhZ
Zh_,Zh
(Xh^+X
XhZ*Yh
-Yh ,Yh
Zh(/Zh
Zh)/Zh
Zh+.Zh
/Zh+.Z
+.Zh+.Z
)/Zh)/Z
)/Zh)/Z
,Zh./Zh//Zh/
,Zh/,Z
*XhT,Z
ThX2Th
Zh_,Zh
(Xh]+X
*Yh%-Y
Yh",Yh
Yh,,Zh,
,,Zh-,Zh
/.Zh(.Zh
/Zh(.Z
Zh)/Zh)/Zh
(/Zh(/Zh
Zh4.[h5
-[h ,[h
-Zh(,Zh),Z
*XhT,Z
Xh\(Xh
Xh^+XhX
XhZ*Yh
#,Zh#,Zh#
Yh./Zh./Z
./Zh//Z
Zh*.Zh*.Zh*/Z
,Zh(/Zh
,Zh//Z
Zh6.[h1.[h/,[
-Zh\*Yh
Xh\(Xh\(X
]+Xh^+X
*Yh&-Y
,Zh./Z
Zh//Zh
//Zh//Zh
Zh)/[h*
S(XhS(Xh](X
*Yh%-Yh
Yh',Yh
/,Zh(,Z
R(XhS(X
S(Xh](X
Yh!,Yh"
",Yh#,Yh#,Y
,Zh-/Z
,Zh(/Z
//Zh//Zh/
//Zh//Z
,Zh-,Zh-,Z
-,Zh-,Z
,Zh(/Z
Zh%-[h%-[
[h(,Zh(,Z
[hz)Zh
9VhY7Uh_
Q(XhR(X
S(Xh\(Xh](Xh^+Xh
&-Yh'-Yh'
,Zh.,Z
.,Zh/,Zh
,Zh-,Zh-,Zh-,Zh-,Z
Yh-,Zh-
.,Zh//Z
Zh4.[h5
1[h00[
.[h].Zh\,Z
XhQ+XhQ(XhQ(XhQ(X
S(Xh\(X
*Yh'-Y
-Yh!-Y
Yh./Zh./Z
-,Zh-,Zh-,Z
-,Zh-,Zh-,Z
,,Zh,,Zh
,,Zh.,Zh
[-[h$-[
[h ,[h ,[h
?QhZ;W
.[h\/ZhS,Z
P(XhP(X
P(XhQ(Xh
*Yh'-Y
-Zh,,Zh
Yh,,Zh,,Zh,,Zh,,Zh
Yh,,Zh
Zh$-[h$-[h%
Zh11[h10[
+YhT,Y
'?QhY;Wh
(XhP(X
P(XhQ(XhR
Xh'-Yh
-Yh!-Yh
Yh#,Yh#
-Zh"-Z
-Zh/,Z
Zh%-[h
[h),[h*
.[h01[
4Uh]2Th
'-Yh -Y
-Yh!-Yh!-Y
-Zh!-Zh
X*ZhY*Z
0[h<3[
Z.ThL.Z
&-Yh&-Y
Yh'-Yh'
*Yh'-Yh
Yh'-Yh
-[h&-[h
[h#,[h
1[h30[
[h>2Th?5Th
_hR(Xh
*Yh$*Y
*Yh&-Y
+Zh_*Z
_*ZhX*Z
Zh[-[h
-[h%-[
-[h&-[h
',[h ,[h"
[hQ.Zh
]+Yh^+Xh^+X
[*Yh[*Y
[*Yh$*Yh$*Yh$*Y
+Yh$*Y
-[h#,[
-[h[-[h
^*Zh_*Zh_*Z
-[h%-[
4/Zh5/Z
.[h31[h3
2Th85Th94T
[hP.ZhP
XhT(XhK
XhS(Xh
Z*Yh[*Y
+Yh[*Y
[*Yh[*Y
*Zh%-Z
X*[hS+Zh\+Zh
X*ZhY*Z
$-[h%-[
-[h ,[
5/Zh6/Z
.[h<1[h
P1[hW/ZhW,Z
_h](Xh
+YhY+YhY+Y
^*Zh_*Z
_*ZhX*Zh
%-[h&-[
/[h1.[
2.[h3.[
.[h<1[
2Th:5Th;4Th
7Uh\5ThR
-ZhU*Yh
&_hK)_h
XhX+YhX+YhX+YhX
*[hS+[
+Zh_*Z
_*ZhX*ZhX*Z
$-[h%-[h
1.[h3.[h3.[h
Wh$8[h
+Zh]+Z
_*ZhX*Zh
[h5/Zh6
2Th:5Th;4T
I(XhH)X
R+_hS+Xh\
)YhV(Y
Yh\+Zh
ZhX*ZhX
$-[h%-[
.[h=1[
YhT-Yh
(XhS(Xh\
XhZ*Yh[*Yh
)YhV(YhV(Y
(YhQ+Y
+Zh_*ZhX*Z
[=ZhA+Vh
]9Vh]7U
YhT-Yh
_hO)_h
_hS(XhS+X
*Yh[*YhZ*Y
+Zh_*Z
_*ZhX*ZhY*Zh
4UhR2T
_hN)_hN&_h
XhX*YhZ*Yh[*Y
Q(YhJ)Y
&XhH)X
XhU(YhV
W(YhP(Y
YhS+Yh
]*Zh^*Z
Zh$-[h%-[h
0Th93T
M)_hM&_
^hI&_h
(Yh\(Y
+Zh_*ZhX
X*ZhY*Z
*[h$-[
$-[h%-[
-[h&-[
&-[h',[
Ph_;Wh
+YhY-Y
-ZhZ-Z
XhI)XhI
XhV(YhV(Y
^*Zh_*ZhX*Z
,Zh7/Zh0
Zh2.[h3.[h3.[
Th_/Uh
J,YhI*Yh
&_hK)_
)_hQ(X
+Yh\+YhS
Xh]*Yh_
&XhI)XhJ
U(YhV(Y
V(YhW(Y
6/Zh7/Z
Zh1/[h
(Uh@*X
3ThU1[
-YhH*Yh
(XhP+X
V(YhW(Y
^*Zh_*Z
_*ZhX*Z
$-[h%-[h
Ph]8Wh\
3ThT1[hJ/Zh
V(YhW(YhP(Yh
YhS+Zh\
+Zh^*Z
^*Zh_*Zh_
-[h%-[
.[h21[h<
5Th;4T
.[hI/Z
M&_hM&_hO)_hH)X
&XhL&_
_hD$_h
G'_h@'_
I)XhJ)X
)YhU(Y
)YhV(YhW(Y
*ZhY*Z
@(Th@(Xh)
QhZ=Ph
UhQ5Uh
,ZhH-YhN+Yh
@'_hA'_
^*Zh_*Z
_*ZhX*Z
-[h!-[h4,[
2Th95Th
YhU0Xh'<[h
Vht$Vh!:^
ThU0ThJ.[
$^hy$^
_hM&XhM&X
&XhI)X
I)XhJ)XhK
V(YhW(Y
W(YhP(Y
Yh^*Zh_*Z
Zh$-[h%
5Th:4Th<
G)Xh <X
}$^h|%^
s%^h|%^
]h~%^h~%^
%^hx%^h
z$^h{$^
^hG'_h@'_
@'_hA'_
M&XhN&X
&XhH)Xh
H)XhI)XhJ
)YhU(YhV(Y
+Zh^*Z
+Zh_*Z
*[h[-[h$
+/Zh6.Zh0
A)ZhI-Xh.
?Vh24Vh
]h~%^h
z$^h{$^hD
^hE$_hE$_hF$_h
G'_h@'_
_hM&XhN&X
&XhI)X
XhJ)Xh
U(YhV(Y
ZhY*Zh
*/Zh*/Zh*/Z
1[h30[h=3[h
%.VhF*Zh
ZhD-Yh
}%^h~%^
]hx%^h
^h@'_h@'_
V(YhW(Y
S+Zh\+Z
+Zh^*Z
*[h(,[
),Zh*,Zh+,Zh4,Z
,Zh5/Zh4/Z
}%^h~%^h~
%^hx%^h
$_h@'_
)YhV(Y
(YhR+YhR
_*ZhX*Zh
),Zh*,Z
*,Zh+,Z
,Zh+/Zh
Yh-,Zh
ThP+[hR+X
YhD-Yh
^h@'_h@'_h
H)XhI)X
)YhV(Yh
Yh\+Zh
+Zh_*ZhX*ZhX
-Zh*,Zh*,Zh
),Zh),Z
,,Zh(/Zh+
ZhF/ZhD-Yhz
%^h{$^h
$_h@'_h@'_hA'_h
&XhH)X
^*Zh_*Z
_*ZhX*Z
Yh -Yh
Zh10[h2
F/ZhD-Yhz
Xhy(Xh~
]hx%^h
$_hG'_
@'_hA'_hA'_h
H)XhI)X
S+Zh\+Z
+Zh]+Zh^*Z
ZhX*ZhX
Yh*.Zh51Zh
$_h|%^h
G'_h@'_hA
_hC&_h
_hN&Xh
XhW(YhW(Y
+ZhX*Z
*YhZ*Yh
Xhx(Xh
|'_h|%^h
%^hx%^h
^h@'_h@
_hA'_h
'_hB'_
H)XhI)X
I)XhJ)X
Yh\+Zh
+Zh_*Z
Zh#-Zh,
*Yh$*Y
).Zh41Z
{$^hD$^hD
G'_h@'_
Yh -Yh%*YhZ
Zh70[h
"^h~%^
^hD$^hD
$_h@'_
V(YhW(Y
+ZhX*Zh
50[h73[h
_(_hZ1_h
}%^h~%^h~%^
%^hx%^hx%^h
F'_hG'_h@'_
L&XhM&X
&XhH)XhI)X
)YhV(YhW(Y
W(YhP(Y
*Yh[*Y
,/Yh(.Zh+
Zh50[h63[h
YhD-Yhz
_h}'_hs
}%^h~%^
)YhV(Y
%*Yh&*Yh'
Z*Yh_*YhS
,Yh#/Y
1Zh50[
M'_hP*^h5
D-Yhz+X
'_hA'_h
)YhV(Y
*Yh%*Yh%
+Yh^+YhS
T(XhQ+Xh^
-.Zh(1Zh
+Yh=+Yh
+Yh;*Yh
_h~&_h|
%^hz$^
G'_h@'_
@'_hA'_
&XhH)X
H)XhI)X
T(YhU(Y
)YhV(Y
+Yh$*Yh$*Yh
)XhH)X
_hT(XhQ+X
Xh%,Yh
?+Yh:*Yh
YhD-Yh
G'_h@'_
@'_hA'_h
YhY+Yh
+YhZ*Yh
+YhY+Yh_
V(XhK)X
2[hZ.[
/(Xh*(X
^hG'_h
L&XhM&XhM
_hN&Xh
H)XhI)XhJ
)YhU(Y
XhP(Xh
)_h,(Xh.(Xh)(X
_h}&_h
%^hx%^hy
%^h{$^hD
'_hA'_
&XhH)X
&_hN)_hJ
)3[h+3[h42[h
_h-(Xh((X
(Xh0+X
^hr%^h
]h~%^h~
G'_h@'_
&XhH)X
XhS+XhS+X
(XhQ(X
W(XhV(X
)XhI)Xh
+XhS*Xh_
Zh)3[h
3[h42[
'\hW0^h
,(Xh/(X
)(Xh4(X
+Yh9+Yh
Zhr&Yh%9_h
2ThC0[
^hr%^hq
}%^h~%^h~
%^hx%^h
^h{$^hD
P(XhQ(Xh
3[h+2[
U&_hP&_h
((Xh+(Xh
?Zi.>V
hS;UhT6U
]hx%^h
^hG'_h@'_h@'_
@'_hA'_hB'_
&XhI)XhK)X
'_h@&_
M)_hI(_h
.0[h(3[
U)_hU)_
*(Xh5(Xh0+Xh2
*Yh((Yh
2ThC0[
_h}&_h
%^hy%^h
%^h{$^
G'_h@'_
_hO&Xh
I)_hJ)_
I)_hI)_hI)_hH
_hB&_h@&_
Xh]-Yh
e!\h@&\hQ
&_hU&_hV&_h
&_hX)_h
.(Xh)(Xh4(X
+Yh+(Y
[h@.ZhE
~(_h|&_h
p"]hp"]
%^hx%^h
^h@'_h@'_hA'_
A&_hA&_
!\hx$\
+XhS+X
&_hU&_hU&_hW
^hR&_h
(Xh0+X
Xh )Xh
)Xh9+X
Yhy+Xh~(_h|&_h
"]hp"]
"^h~%^
%^hx%^hy%^
^hz'^hz'^
&_hL)_
!\hB)\hP/_
^*Xh\+Xh
&_hU&_hV
&_hY)_h
/(Xh*(X
3ThB1[h
$^hy'^hy'^hz'^h{'^
V*XhQ-X
1Zh"0Zh#0Z
H-[hq'Zh
Xh]+XhS+XhQ(X
&_hU&_
W&_hS&_h_)_h
*Yhh"Y
hR8UhJ4Uh
}%^h~%^
}$^h}$^
}$^h~$^
$^hz'^h
^hF&_hG&_
4Yh65[h
+Xh\+Xh
T&_hU&_hV
&_hZ)_
^hr$^h
}%^h}%^h}%^
}$^h~$^h}$^
%^hs$^h
$^hy'^
XhR-Yh\,Yh
Yh&/Yh$
Xh]+Xh
(XhQ(XhW
&_hU&_hU&_
&_hW&_
,(_h/(X
&XhG*_
'^hx'^hz'^h
(_hI+_hJ
+XhU*X
0Zh_.Z
]hP/XhP/[
&_hU&_hU&_
]hp%^hp
K*XhU*X
1Zh%0Zh&0Zh].Z
^hP/YhP/[hM*[
9Th?9Th
Xh^*Xh\+Xh
&_hN'_
&_hY)_h
VhH5UhL
"]hq%]
]hs$^h
)_hC(_
*XhV-X
W-XhQ,X
9Th?9T
Xh]+Xh
|&_h|'^
]hp%^hp
$^h}'^
^hG)_h
)_hA(_hB(_h
,Yh\/Y
\.Yh^.Yh_.Yh
Yh\.ZhV
-[h}&Z
9Th?9Th
[h05[h5
^hU&_hU&_
ThL0[hA
%^hp%^
$^h~'^h
_hK-Xh
\.Yh].Yh^.Y
YhU(YhT)X
9Th?9T
Yh!/Yh&,Yh$
)XhJ)_
L0[hB.Zh
p$^hw%^
_hH*XhH*Xh
*XhJ-X
Z*Yh'*Yh'+XhY
_hR)_h
0YhX4[
ThK,Thx
p$^hw%^hu%^h
i"]hi"]
"]hk%]ht
r'^h|'^h}'^h
E(_hG(_
(_hB+_hC
XhT,Yh
Yh%-Yh,-Yh
Xh--Xh"
Xh 2Yh!
Vh%8Wh
[h75[h5
*XhY-Xh[-Xh
"]hk%]ht%]h
r'^hs'^h|
^h@(_h
+XhM*XhM*XhN*Xh
-XhJ,XhJ
3VhC-T
/Yh!/Y
iZ<UhQ
"]ht%]h
p'^hr'^
^hF(_h
*XhO-Xh
_hb#^hm
[h!0Zh
r)_hp&_h
^hv$^h
%^hv$^hw
q'^hs'^h|&^
^hD(_hE(_hF+_hF
M-XhN-Xh
-XhN-XhN
XhM-XhN-Xh
Yh -Yh
8[h8?Th
]hY4Xh2
2[h/2Zh/
K4UhM3T
$^hs'^h|&^h}&^
&^hx)^h
*XhL-XhL-X
*XhM-X
M-XhN-X
]hk$\h
4[h*4[
5[h,0[
;VhU7Uh
(_hE+_hF+_
+_h@*_h@
XhN-YhO
]hu'\hG-^h\5X
?Uh9:Uh<
0[hA/ZhF,Yh
_hz(_h
^hE+_hF+_
XhI,Yh
-Zh]-ZhZ
j%_hc#^h` ]hp
\hN.^h
N1ZhM/Y
A-XhB-X
YhT,ZhU
0Yh<7Zh
,=Wh$9Vh_
<Uh-4U
YhK/Zh
Xh<2Yh
Xhk%_hc#^h
T1[hT/[
Y7Vh\0UhP
[hU,[h
Th.=Th.=Th.=Th.=T
.=Th/=T
0ThR1ThP
,[hU,[hT
/<Th/<T
.<Th.=Th.=Th.=Th.=T
.=Th/=T
/<Th(<Th
VhR3VhK,Th
ZhP/[hP/[hU,[h
<Th/<T
.<Th.=Th.=Th.=Th.=T
.<Th/=T
/<Th(<Th
?Th6>T
R/ZhP/[hP/[hP/[
<Th/<T
.<Th.=Th.=Th.=Th.=T
/<Th(<Th
?Th6>Th7
$Xh}(^h
YhP/[hP/[hP/[h
<Th/<T
.<Th.=Th.=Th.=T
.=Th/=Th(<T
<Th*?T
ZhP/[hP/[hP/[
W/[hL-[
Th)?Th
.<Th.=Th.=Th.=Th.=T
.<Th/=T
7UhR3T
-ZhL/YhO
XhP/[hP/[hP/[hP/[hP/[hI-[h
<Th/<T
.<Th.=Th.=Th.=Th.=T
.<Th/=T
/<Th(<Th
9Uh$4Uh\2Th
3Vh#1[h&
(YhP/YhP/[hP/[hP/[hP/[hP/[h
<Th/<T
.<Th.=Th.=Th.=Th.=T
.<Th/=T
/<Th(<Th
_hP/[hP/[hP/[hP/[hP/[hW/[h_3[
.<Th.=Th.=Th.=Th.=T
/<Th(<Th
';Uh"=Uh,
^hP/ZhP/[hP/[hP/[hP/[hP/[
.<Th.=Th.=Th.=Th
ZhP/[hP/[hP/[hP/[hP/[hP/[h);[h
Th/=Th.
Th%7Th
2ThY4Th[7Th%
h!:Vh*
_hP/[hP/[hP/[hP/[hP/[hP/[
<Uh/:U
5Th_2T
Th!:Uh#
[h"=Vh4
*^hP/ZhP/[hP/[hP/[hP/[hP/[hP/[
[hX5Th
%]hB+^hP/YhP/[hP/[hP/[hP/[hP/[hP/[h"6[
Vh):Vh
3ThX5T
Th ;Uh
XhG+XhN/Y
P/[^Q.[
Zh[<Th&
5Th[7Th%
':WhZ6V
>Uh#<Vh
hd!\hd!\hd!\hd!\hd!\hd!\hd!\hd!\hd!\h
\hd!$hd!\hd!\hd!\hd!\hd!\hd!\
Y\hd!\hd!\hd!\hd!\hd!\hd!\hd!\
@d!#hd!\hd!\hd!\hd!\j
hd!\hd!\hd!\o
hd!\hd!\hd!\
hd!\hd!\hd!\
hd!\hd!\hd!\
hd!\hd!\hd!\
hd!\hd!\hd!\
hd!\hd!\hd!\
hd!\hd!\hd!\
hd!\hd!\h
hd!\hd!\h
hd!\hd!\h
hd!\hd!\h
hd!\hd!\h
hd!\hd!\h
hd!\hd!\h
hd!\hd!\h
hd!\hd!\
hd!\hd!\
hd!\hd!\
hd!\hd!\
hd!\hd!\
hd!<hd!\
hd!,hd!\
hd!$hd!\
hd!"hd!\
hd!"hd!\
hd! hd!\
hd!,hd!\
hd!,hd!\
hd!,hd!\
hd!,hd!\
hd!,hd!\
hd!$hd!\
hd!$hd!\
hd!$hd!\
hd!$hd!\
hd!$hd!\
hd!$hd!\
hd!$hd!\
hd!$hd!\
hd!$hd!\
hd!$hd!\
hd!$hd!\
hd!$hd!\
hd!$hd!\
hd!$hd!\
hd!$hd!\
hd!$hd!\
hd!$hd!\
hd!$hd!\
hd!$hd!\
hd!$hd!\
hd! hd!\
hd! hd!\
hd! hd!\
hd! hd!\
hd! hd!\
hd! hd!\
hd! hd!\
hd! hd!\
hd! hd!\
hd! hd!\
hd! hd!\
hd! hd!\
hd! hd!\
hd! hd!\
hd! hd!\
hd! hd!\
hd! hd!\
hd! hd!\
hd! hd!\
hd!"hd!\
hd!"hd!\
hd!"hd!\
hd!"hd!\h
hd!"hd!\h
hd!"hd!\h
hd!"hd!\h
hd!"hd!\h
hd!"hd!\h
hd!"hd!\h
hd!"hd!\h
hd!"hd!\hd!\
hd!"hd!\hd!\
hd!"hd!\hd!\
hd!"hd!\hd!\
hd!"hd!\hd!\
hd!"hd!\hd!\
hd!"hd!\hd!\
hd!"hd!\hd!\
hd!"hd!\hd!\
hd!#hd!\hd!\
hd!#hd!\hd!\
hd!#hd!\hd!\
hd!#hd!\hd!\
hd!#hd!\hd!\
hd!#hd!\hd!\
hd!#hd!\hd!\
hd!#hd!\hd!\
hd!#hd!\hd!\
hd!#hd!\hd!\
hd!#hd!\hd!\
hd!#hd!\hd!\
hd!#hd!\hd!\
hd!#hd!\hd!\
hd!#hd!\hd!\
hd!#hd!\hd!\
hd!#hd!\hd!\
hd!#hd!\hd!\
hd!#hd!\hd!\
hd!#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
#hd!\hd!\
hd!#hd!\hd!\
hd!#hd!\hd!\
hd!#hd!\hd!\
hd!#hd!\hd!\
hd!"hd!\hd!\
hd!"hd!\hd!\
hd!"hd!\hd!\
hd! hd!\hd!\
hd! hd!\hd!\
hd!$hd!\hd!\
hd!$hd!\hd!\
hd!,hd!\hd!\
hd!,hd!\hd!\
hd!<hd!\hd!\
hd!<hd!\hd!\
hd!\hd!\
hd!\hd!\hd!\
hd!\hd!\hd!\
hd!\hd!\hd!\
hd!\hd!\hd!\
hd!\hd!\hd!\
hd!\hd!\hd!\
hd!\hd!\hd!\
hd!\hd!\hd!\
hd!\hd!\hd!\
hd!\hd!\hd!\
hd!\hd!\hd!\
hd!\hd!\hd!\
hd!\hd!\hd!\
hd!\hd!\hd!\
hd!\hd!\hd!\
hd!\hd!\hd!\
hd!\hd!\hd!\
#hd!\hd!\hd!\
#hd!\hd!\hd!\
#hd!\hd!\hd!\
#hd!\hd!\hd!\
#hd!\hd!\hd!\
hd! hd!\hd!\hd!\
hd!<hd!\hd!\hd!\
hd!\hd!\hd!\hd!\
hd!\hd!\hd!\hd!\
hd!\hd!\hd!\hd!\
#hd!\hd!\hd!\hd!\
hd!"hd!\hd!\hd!\hd!\
hd!\hd!\hd!\hd!\hd!\
hd!\hd!\hd!\hd!\hd!\
hd!\hd!\hd!\hd!\hd!\
#hd!\hd!\hd!\hd!\hd!\
hd!$hd!\hd!\hd!\hd!\hd!\
hd!\hd!\hd!\hd!\hd!\hd!\
hd!\hd!\hd!\hd!\hd!\hd!\
#hd!\hd!\hd!\hd!\hd!\hd!\
#hd!\hd!\hd!\hd!\hd!\hd!\h
^\hd!<hd!\hd!\hd!\hd!\
yd!\ed!
cd!\ad!
[hg"Yhe _h`%]hl)X
Lh}8Ih
Uhv3Rhs6N
~=3qr7
Qhl)Whb'Thg"Z
Ihu0Ohj/M
\ho*Zht1Whq4L
Ah}8Ghr7E
al<ln~
}hz?|h
:Bh}8Ghr7E
Lhn+Qhc&Vhg"[h
Rh~;Hh
k1Uhr7L
7^h@>_
Nho*Shc&Whg"[
Vh|9Mh
|8Zh{<^hJ
Phg"Th
mLh^:Mh
whx=Kh
"nhw2_hy<O
ahm(Qhn
ShL/Mh <Z
1jhd!Mhb'\hi,Zhi,Q
Ghz?@hD
lhu1rh
Yhe ^h
Fhw2Jht1Oho*Lhl)W
\hm(Yhi,U
Vh|9Ohs8Dh
LhW3[h
{h{>xh~;C
Bhr7Fhv3J
Yhn+Thj,Vh
^he \hb']
Khu0Hhj/M
Xhd!^hf#\
ShA+Th
Ghq4Dhv3I
Shn+Qhl)Vhb'Th`%Zhf#Xhe ^hf#]h`$^h
<Ph<>W
5RhG(T
>sh*>mh
Iht1Ohj/L
>Ph0=P
5RhE)Th
Xhd!_h
Qh{&Th
:2Th;5Th;
3Jho.O
-Sh]5Ph
Qh?/Th
90Th:3T
0Th?3T
2Th?5T
?2Th82T
Th;5Uh
Sh!9Rh#
/Uh7/[h3.[h>1[
[h>0Th>
.[h21[
=3Th=3Th>3T
[h:0Th
Yh{&Zh
[h23Th
0Th=0Th
90Th:0T
[h%6Rh!2U
3Th23Th23Th
%0ZhD&[
Zh60[h7
31[h21[h11[h
[h60[h60[
1.[h0.[h11[h21[h<1[
1[h51[
51[h61[h61[
+Yh'*Yh
-Yh",Yh
Zh(.Zh)
.[h51[
Zh61[h
Xh&-Yh
/Zh(.Zh
.[h31[h8
[h/,Th%
,Zh(.Z
[hZ2Xh
,Zh//Zh(/Zh
)/Zh*/Z
Zh//Zh-
.,Zh/,Z
-Yh!,Yh#
Zh.,[h
-Zh),Z
Zh<2[hL(Th
Yh#,Yh,,Yh-
Zh-,Zh
,Zh)/Z
2[hO+Th\0Yh
XhR(Xh
Yh-,Zh,,Zh
[-[h$-[h%-[h
Zh10[h
5[hI*Th]
Zh,,Zh
QhS3Uh
[*Yh$*Y
$*Yh$*Yh$
',[h,,[h4/[h6/Z
\+[hS+Zh
+Zh_*ZhX*Zh
-[h,,[
5ThT3Th"2[
XhY*Yh
,,[h6/[h0
)_hS(X
+ZhX*Z
R7PhU1T
XhW(Yh
(YhR+Y
,[h7/Z
.[h>0[
$_hG'_h@'_
4PhJ.Th
%^h{$^
^*ZhX*Zh
Zh),[h
[h".UhA
%^hz$^h{$^
&XhI)X
U(YhW(Y
-[h+,Zh
^h@'_hA'_
^*ZhX*Zh
),Zh"-Z
]hx%^h
&XhI)X
(YhR+Y
ThP.Uh.
$_h@'_hA'_
XhV(YhP(Yh
YhS+Yh\
ZhS3Xh
1ThU5[
]h~%^h
U(YhW(Y
Yh -Yh
Yh\+Yh
%^h{$^hD
&XhJ)X
(YhX+Yh[
)Xh1+Xh
G'_hA'_h
_hH)XhI)X
+Xh\+X
,Yh(0Zh
ZhY/Th
]hC'Xh^&_
_hJ)Xh
'_hF&_hM)_
&_hW&_
^hG'_h
+[hu"X
$^hx'^h
Xh 0Zh"0Zh
"^hz)_
T&_hV&_hS&_h
$_hp%^
]hs$^h~'^h
/ZhR,Yh
u"^hw%^
(Yh|'_hp%^h
,Yh%,Y
6Th24Th
'^hx&^h{
(_h@+_
Yh/3Zh
Zh*;[h
27Th#0[h
Uh|(Yh
[h$2Th
\4[h!8[
Xh&.Yh
5Th^5T
2[hQ2[h
UhP/[h
Th^4ThS
4[hY9[
:Th/<Th
.<Th.=Th.=Th(<Th
UhZ6U`
(?Th/<Th/<T
Th*=Uh(=U
ThW,Xh
Ue#=Ut
9VhK3Uh
hd!\hd!\hd!\
hd!"hd!\
hd!\hd!\
hd!\hd!\w$!
hd!\hd!\hd!\hd!\
hd!\hd!\
Thc&Vhf#[ha$^
Qhq7OhC6J
]hw2[h
*]hx:W
?Ah}6Mh
Fhc&Ohd
Cha'th
~hd!Wh`%\
Hh|:Gh?
Whh0Qh
th~;}hp5Fhj/H
:}hq4Ght1I
<Wh3=WhT0W
9Chq3FhO1N
3Th=2Th
3Th=3Th
*Th^,Y
Xh&1Ph%*[
[h70[h00[h0
.[h21[
*Yh'/YhU,Z
.[h61[h71[h
.[h6.[
,-Zh.,Z
-Yh#,Y
Yh'-Zh
*YhY*Zh
-[h5/[
W(YhV(Yh
YhY*Zh
-[h7/[h
_hI)XhH)X
XhR+Yh
z$^hE$^
YhY*Zh
%^hD$^
^hA'_h
YhY*Zh/,Zh-
Th|%Xh
%^h{$^h
^hL&_h
%^h{$^h
}'^hy'^hE&^hL
+3ThZ-ZhT
YhP,Zh
Xh%3Yh$
_h<4^h>
1dhd!Mhg#\hQ
*]h,,]h
-]h43]h
1/o) "
=j*.,g
T=^/l6
1/o) "
it*2#
-28h"D
1/o) "
=j*.,g
z*pM~
dG_$!4oXc
NtSetDefaultUILanguage
ntdll.dll
GetMessageExtraInfo
GetCaretBlinkTime
user32.dll
GetCurrentProcess
kernel32.dll
53Qdwp
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD

Dropped Files

07240c35b56e651a_WYcc.exe

Name: 07240c35b56e651a_WYcc.exe
Size: 521.2 kB
Type: PE32 executable (GUI) Intel 80386, for MS Windows
MD5: feb1d026c8e2462f77ac905cb84defd6
SHA1: b74d73fed1f1044c4556a96ac50c5474ff07ebc9
SHA256: 07240c35b56e651a9e20cae7367b047a725d1401b900d56959d56ce0e797a5d7
SHA512: 776e75c95e850c8e5b1879ff81040c7f713ff4e2c8961f68c33fb7116b1408eb63b2dc499cc15d4bdfdd96d45e410d4c0220e0dc3fb85f7d047bcd86b2b30ae9
Ssdeep: 12288:Us+1RzfPTGVkVZ1o6lV9X037QMP8m/EIhsc:U/TjGyrtxeQW8mPhsc

128f665e499e4d62_oMsi.exe

Name: 128f665e499e4d62_oMsi.exe
Size: 16.5 MB
Type: PE32 executable (GUI) Intel 80386, for MS Windows
MD5: 573e5e354a11b756fc9aaebc7eeef71d
SHA1: a892e84e99a4b47ba5c2afb5cf799a4a79b176f7
SHA256: 128f665e499e4d62af17d299c45388cd16adbca62dd12f9e6325268aa2e7d3ee
SHA512: 59b1d4e4b3b5012118506327dbd438ef92780007b8c70d650b933f73f34ff901d6f02d0e394bae92d045f59a92b60d9d2f5375f05c61dd17cb3e8d645c935a51
Ssdeep: 393216:qrHP3gg2vlujNiUJaV4CnZ68IMT3KnatODpXtWy:qrvQgS4k8SrtIL

1698f9c4ae95467c_uswW.exe

Name: 1698f9c4ae95467c_uswW.exe
Size: 515.6 kB
Type: PE32 executable (GUI) Intel 80386, for MS Windows
MD5: 238391f7d10b19c393c71c2d532bfab7
SHA1: 3d10ecd3a4dda4b9cfbb416695c5824699874567
SHA256: 1698f9c4ae95467c0a5e4c5d20da84af5148b0c84192f9050746a62fd1bddec2
SHA512: b63a077afdaff158b987cdf230ce84940c8fd1dc21275271756354f29b8dd735a91dee798876dd7d328b4d45e92a1a52e52e0e9c2e6babe67264ab8f9bc6c12c
Ssdeep: 12288:YwtdWDLsdoqQt7Mp8ypMh1Oc849cuWLOCnhtqaZs6+:YwtUoiwpohQ3uWLbhttax

23fe9cb18a1007ff_eQAQ.exe

Name: 23fe9cb18a1007ff_eQAQ.exe
Size: 16.5 MB
Type: PE32 executable (GUI) Intel 80386, for MS Windows
MD5: ee4bc63cf67a6d893d91bd970cac9ef1
SHA1: 8e9a49bc66c07b0a94d1bcc2a750e5cdecd3ce81
SHA256: 23fe9cb18a1007ff5c377d622d6231ca20c244f5f37d2ca7abf77c97f2ce06a4
SHA512: cb07460f47da7ea9fd066c8aac8c4a2d1c82144b1462bfc99ca5c1916596a8429fabfa22ef56113924d2263ae87a0466b3a545881be913641f297c4e6b618b51
Ssdeep: 196608:WULdLYQWyG+QDNDD8e4rymLha5mSLJkmN6rUMqJcJqckH0tVRg3EzAb3igPquCs:BFG3DD8prNgLam0zqJcJqct608igT

262259909cddd022_OYYc.exe

Name: 262259909cddd022_OYYc.exe
Size: 504.3 kB
Type: PE32 executable (GUI) Intel 80386, for MS Windows
MD5: 30d928c9b5760fc7e626348ef9c41e46
SHA1: af195503a2f9a558227d817a9501d9f8b386292d
SHA256: 262259909cddd022e2ba1822ce9dfdbd23ca623604cc669608181395969be1bb
SHA512: 389179724928be683c130c8af6cbfbe1296daa3adde65e8c3afbac17828deb25d48487b38c81feb47952b0fdb7f3274ab3cc9db34b1c9349c96d7a1321852361
Ssdeep: 12288:pu/+HNay/aJhZ902MayV4kqCDZecqxbsUOAkUp:pu/+HQ1PnyCkq2ZecubsUOXq

2892a0658e34858f_PcYM.exe

Name: 2892a0658e34858f_PcYM.exe
Size: 527.4 kB
Type: PE32 executable (GUI) Intel 80386, for MS Windows
MD5: 11d3a65bbacb20637b90418d15984a1e
SHA1: 69357989161f34b48d3efee7b2a597a1d8589d26
SHA256: 2892a0658e34858f9ce3f5175e04c0ba5ecb89f2136d65e51bd05622fd274e3d
SHA512: 6b92b18d71cb6f7a54b919ba40a0d506ce08207affc9985081773d05c1bb224865808db93e00645ad2533d69f768a7ad9088858d1e9fc8dbe3fa4d90e6e95e77
Ssdeep: 6144:cSVX3BftV5g4s+W9TCchPJMMJm33akbVsEsatqQ758o9ceuK0dpzakQtwElsob8C:/V3BiznPyMwnVsJQ75AeanqwHLd2+i

2a51101b3188d3b2_vkEy.exe

Name: 2a51101b3188d3b2_vkEy.exe
Size: 555.5 kB
Type: PE32 executable (GUI) Intel 80386, for MS Windows
MD5: 340824bda44f52be66ebe3ca7d8ff325
SHA1: d017d82fda6681238a61a9992d1518acf7c5bab4
SHA256: 2a51101b3188d3b23ac99ab7322a2ceb5d6e2ab65a207ea0c81f07a8123b93de
SHA512: 24ec79d74cd002654d037faa18ee9a8702e6ea546db7baaeabdf0ce7c473b1016a7df85feabd42206e00e30bd7a0de60bac0a42e0d4dd1f31c41597244319f3a
Ssdeep: 12288:XPgw//2gtIcn8aBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAadsewOQ058ivpRL3:fZIw8azdsby58yWPAnjNZ8pm

3c21bae95ac04939_uoAy.exe

Name: 3c21bae95ac04939_uoAy.exe
Size: 565.2 kB
Type: PE32 executable (GUI) Intel 80386, for MS Windows
MD5: 4a088557f702560275507f5c3a0cbaa2
SHA1: e9d7886d3cb0ffd39bfff86380b8dd5b56914a91
SHA256: 3c21bae95ac049396d6e5630f26fc838666f05d7b710f6541f091a790c3d2321
SHA512: ae66ce370ade38b1b586ea86995fa729f3524120bbd61b71691f06fb7180be359a2301de93ba164f3124f376333a442f497590b4459562789f7e7c7e7530725f
Ssdeep: 6144:dAqRMYh305hoPmgv8OKpuKFQ/J49y/ScaBk3XHy5uwRy80nyybt5HDQP7aRv3MOa:GqW6EF5Bmx49yqcGkvwRz07btQnOMGI

45d1eee2de7aa8b3_oMMQ.exe

Name: 45d1eee2de7aa8b3_oMMQ.exe
Size: 504.3 kB
Type: PE32 executable (GUI) Intel 80386, for MS Windows
MD5: 69f9286d969f7135169733357f56e329
SHA1: 9269c352b76911ba8eb3c56f034c58c84be550f7
SHA256: 45d1eee2de7aa8b37235b4fd63e33b423f0318bd2702f4001a2b206634718879
SHA512: e9f9acdaba785d926a3324ce6cfbc848442785488c2a3294e970e5d7ec623cebe09744bb74bcb69853ccd0c5a619f93416a537a607d632ef51a5f37548a99dca
Ssdeep: 12288:0w0S7/UNEZWxvRvbR4knFAi/fyog1Pr/b5O74GB:0w0S7pgvRvb2YUPLtOES

5d4fe5275aa45de4_jYEE.exe

Name: 5d4fe5275aa45de4_jYEE.exe
Size: 4.3 MB
Type: PE32 executable (GUI) Intel 80386, for MS Windows
MD5: 345807d1114a7c5e67c7584c6eb11254
SHA1: 47712a9a0ff749eae3be401e31ef27b29e88c73d
SHA256: 5d4fe5275aa45de4387b89c1456d2dea0ea47fc598ef4da66f1b4db8ee2a6a90
SHA512: d08c58d9b6b745d6db63cd0b5dcf342351248dcf01b593fb5b6a064ecce629f53346ece77b5fee00b9cd3337838e3b529f2df09316a634a62f689f1b7fd6fd13
Ssdeep: 98304:fFj80OamO0cnMz5gjtayeLKO2jxCp8TSB:fxROaoc7jtaKpaN

6aa5b232c4c56ca5_XsQq.exe

Name: 6aa5b232c4c56ca5_XsQq.exe
Size: 498.7 kB
Type: PE32 executable (GUI) Intel 80386, for MS Windows
MD5: 267771ffcaffb461a46c59fa065130f7
SHA1: 6ea9f6c641000c046364cadcd923ba94133414c5
SHA256: 6aa5b232c4c56ca50e0eb79429727b80a60fd92d54f7790cdbb880f1fd8a2749
SHA512: ae9a6bca5dd2a305689ec0322a2357dfec1caabe0e1e1b9fdac47edcbc05a68f611be53e310fec5ff5f4b12a318134aa70a7a5c1b12fbbeac78201b3c6bbca4d
Ssdeep: 12288:+kHwVBE4MXTsZFyd0nUPOwpl4NVA9TWo0PR:9wVi4eTMgO0l4NVo8

7cd118a999d43c65_YEYE.exe

Name: 7cd118a999d43c65_YEYE.exe
Size: 504.8 kB
Type: PE32 executable (GUI) Intel 80386, for MS Windows
MD5: a5ad56017c3456726e6cd524ae72ca79
SHA1: 10da9b4b3cacc3ea5930a6ccf8e01c0181e06049
SHA256: 7cd118a999d43c655b7665a7b871e0fb72364e2fcd75557dc61e8fd703ac6d8d
SHA512: 7353a2ee9effcf47f3565ee4d4031c215085748c98edb0de10558811136e2d64ae9259c8557fa5192cb416605f7eda098aa580831ce45fab38aa23ebd2bb6f2e
Ssdeep: 6144:4XlPqPfPKBMcAz52/nSPhXGn4XorN+W6t7WZyl8v+N4JifK5OCJsaMqohe5KJHqf:ol8Su6KZzA9jv+mifFaMq6jC

7df2d0494b8c1197_ksAc.exe

Name: 7df2d0494b8c1197_ksAc.exe
Size: 556.5 kB
Type: PE32 executable (GUI) Intel 80386, for MS Windows
MD5: 1014a0292f579cd91e1c76b5015e5e42
SHA1: 96881d59f663843ad416103e95741bebdd7f856f
SHA256: 7df2d0494b8c11971a455e9fb1c28a9cde6f4657268342e58c3263a33463c23b
SHA512: 80b29c40e7e81961eafdba47341c4367dd2f2fa4a004420f59cede4077069295465b816948dd1ad2a45b34d16710c1cc736b34238e79807f22b846c54672d239
Ssdeep: 12288:Sa39z61UqqZjmnnjNWGZ0gBIh2IRyOYezhJHnmgHWuVmIprCZrxE9eZec:lNg4Qjh0gBExcxE9bc

86149753ce9f5e35_OQAq.exe

Name: 86149753ce9f5e35_OQAq.exe
Size: 5.7 MB
Type: PE32 executable (GUI) Intel 80386, for MS Windows
MD5: 803f6ac49fbc958fc6b416d1bdc6c461
SHA1: 874d97fe3f1fdc1dd10e5485b1e9e8204defb496
SHA256: 86149753ce9f5e35017c00b15b21bbfc5d133433f71ad3dab7e6441997a47e10
SHA512: 1d75b0382045e6badee2fe716c20499a181cb676189cf5d5aaef0d6af6f00da04ac3588a86acd089f78af1dcd8c45961859000fd21cd7cf0aee7a4b4d911917f
Ssdeep: 49152:3zmHipUmTHMV6gUcdQM2o9D3cyf3sM6qY596XAvCZsDDUeL:vzMV1dlZFPA5oQ6ZsPUeL

8a34100cbe356e7a_DAcq.exe

Name: 8a34100cbe356e7a_DAcq.exe
Size: 503.3 kB
Type: PE32 executable (GUI) Intel 80386, for MS Windows
MD5: c29e03aa1bfc1dca757738bfb9cb3326
SHA1: ec780beab8707445c8a4da4e3cf716c13de701e0
SHA256: 8a34100cbe356e7a2767a8503436c093eed980d6497ad35a1c113e150c5b27f2
SHA512: 1a09742805ea144571e1f41cb87a93b3147c26a18d8f1819c612b6a7f3e581bca280669314dbdec2317d1a9ca6085ae90f528a89c61d6e7cc099be42ac57b098
Ssdeep: 12288:jEAwOx8NAycVfTUhPTtsf+gQPGBzO4mEJQPbx8YOZiWJ:hwOx8iyefkZSePB4mOEN8BZiWJ

8b1af53b5bf2ddec_CQwa.exe

Name: 8b1af53b5bf2ddec_CQwa.exe
Size: 4.3 MB
Type: PE32 executable (GUI) Intel 80386, for MS Windows
MD5: 2d5fe344c5217f530a9b5681c067a9fd
SHA1: a32217fe3bd7417fdb976568b3c908dc9e688c41
SHA256: 8b1af53b5bf2ddec9a7968e4309fd67fea092a06b2cbe0956e7058547a65879a
SHA512: 0532de5c91908182fb6c86c55c21a694f0f1a41d62a56466a85cd32cb07e982944cf63636ba64cbb6ceef1cd6f2268dd6c3cb580ae0f8d3219aecc872f615db5
Ssdeep: 49152:5azQQr0wAFSmaswxnIMkRyDEMmGT674X5ttc3fEwi3Ly+v3W3r+XP7HTOd:AcQr0vSmasenI7wXtF+E5HTm

8f782c8b6e77e4f4_xkwy.exe

Name: 8f782c8b6e77e4f4_xkwy.exe
Size: 561.2 kB
Type: PE32 executable (GUI) Intel 80386, for MS Windows
MD5: 94530ce0c4b09f3b572d447527e9ae19
SHA1: 470d55f9eedc369ece291290faadd6658781ba8c
SHA256: 8f782c8b6e77e4f46dc8e2200a57b2371e9082609b68a1e18e698598e4a7d5c6
SHA512: bfb4ea5b198b3ab4ae1bf4f80558bc467bc1674d59dd070b38bb57cf8b14b6c7f422127a0f6809b1031ec93b6326649cbc6c1fc48723a851840da0350c6e9aa5
Ssdeep: 12288:3ba4eVIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIHK/nShGZ+xUhTscuZVqhQH1KeB:La4eVIIIIIIIIIIIIIIIIIIIIIIIIIIT

97f0fbd78307f6c8_UEMW.exe

Name: 97f0fbd78307f6c8_UEMW.exe
Size: 512.0 kB
Type: PE32 executable (GUI) Intel 80386, for MS Windows
MD5: 3f374f5166d7c52e83f30e1317fcaff6
SHA1: 34378f018b03c288ca14e74ae271c5b86ae8abe8
SHA256: 97f0fbd78307f6c869823438794ed305c82826722d14d4ec157313e918309994
SHA512: 06f4d541008e8c494fb45200bd6e3355c6772703d1baa3a1cba101c528546eb871f49cb45c39eb88afca012c05a8424795ff533ff2815a332b7421c7afa2bb7a
Ssdeep: 12288:ZIMp3vHdYn3EOu/OnrJQRB5ioFAakutSxmG5:ZIjqWn+jrFsxN

be3a7ca9b2e3821b_LUQY.exe

Name: be3a7ca9b2e3821b_LUQY.exe
Size: 539.6 kB
Type: PE32 executable (GUI) Intel 80386, for MS Windows
MD5: eedb4867fa5a3dd3f838b01876c71596
SHA1: e9137fa450dc22856a38f88c9435ada31bf498b2
SHA256: be3a7ca9b2e3821bcb843633776c8f960727a85b482e0fa7c2347a67498f782b
SHA512: 531526e9b4bb91de080ce90474e5ccacfc9e76b0e73dd1bfe4c6399aebfcc2095464520c493ccdcdb08cbecfbb08895ad71bd262e9447bace5adbb72a5f0510f
Ssdeep: 12288:3J2IpNSsh4wQ/5EWwQkJrieG/eIsJ6GZgI:3zpYWm6JerGJ

be4cf70321f6bddb_PosA.exe

Name: be4cf70321f6bddb_PosA.exe
Size: 5.7 MB
Type: PE32 executable (GUI) Intel 80386, for MS Windows
MD5: 6edc42e5f1149f3ad4a7f8e81165bd2d
SHA1: f18b49f7536107075d5f31ec2145f49a770a6a19
SHA256: be4cf70321f6bddb6f61fdc3a6bab7cfcbe70feaf5751fbc650f1e292aa75c42
SHA512: 67c9a6fee184100cfedb1e1ca4337831fbb4d261e2f17888bd9957d04247b611d6c455872e547c874f1482eec37a6cecb6c94fee436c4d9f154b083af8744996
Ssdeep: 49152:7Fscem6RBjBJi6mYKe44AqNeuHoDdrLwV7OJIAhsDekQcpDwe9euha4jbDnQ5ikS:xahRxY+AwBQ1L8iM6kwe9euU4jvQG2pY

c4375dc95f6c3949_REsU.exe

Name: c4375dc95f6c3949_REsU.exe
Size: 503.8 kB
Type: PE32 executable (GUI) Intel 80386, for MS Windows
MD5: ee9c66cc5d1e02f6e4591170110fef16
SHA1: bf165eaf823741bf7bb175e9ef8f10a759041577
SHA256: c4375dc95f6c3949a258af163f0b70bb2d335edb4c1bbbd7d03aa4779adb9f53
SHA512: e9c0523e0c553d7e725dced0c796ac695662e727c049ea17d86116f6ec6e8e10fa040335c98a91778218df6caa02fc712381540a697ca1db825d47a8a2764516
Ssdeep: 12288:0iKsGvFLbKNmY3veyyOTqmtdl1TTjGVXUcpoQi:lR4Jbcdl5ThvIVXUwK

e7c516835dede56f_PUcm.exe

Name: e7c516835dede56f_PUcm.exe
Size: 536.6 kB
Type: PE32 executable (GUI) Intel 80386, for MS Windows
MD5: d2d70de3ebfb8a4cf37dd1fbdf072566
SHA1: 0c3498306e27505473f7606625637584f7c1ef37
SHA256: e7c516835dede56f15fa96a18ed027b5314cf411527a17c58887a6c34e591e02
SHA512: dd9213e69d44a0d3d2846833272583017228feeac53c44ee2b18c92a6488bbe2d4de1265169a4ae26cb3f9fe0060c211916e5b1477468c0867fece8c10c12f4e
Ssdeep: 6144:GVJ19awB1mqrKDX/NRyEFsLQ5kWKvkhv9/5gizDWooaxbYdIPqEwKIOoZEgWP:GZ9awuqWFRVdkDy9qzO8Sy1KIOr9

Network

DNS Requests

Domain	IP Address	Destination Location
google.com	172.217.5.238	US
crl.microsoft.com	184.150.154.10	CA
google.com	172.217.9.206	US
crl.microsoft.com	184.150.154.24	CA

HTTP Requests

http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl

GET /pki/crl/products/CodeSignPCA2.crl HTTP/1.1
Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Mon, 16 Apr 2012 23:49:48 GMT
If-None-Match: "0f6669b2b1ccd1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com

http://google.com/

GET / HTTP/1.1
Host: google.com

Hosts Involved

IP Address	Country of Origin
172.217.16.174	US
172.217.22.110	US
87.245.213.51	GB
172.217.12.46	US

Geolocation

Destination Country

US:: 62%
CA:: 25%
GB:: 12%

File

Type: PE32 executable (GUI) Intel 80386, for MS Windows
CRC32: B4603A9B
MD5: 104edb792781fefee9af7024233f365d
SHA1: c6b133b001afc630effea3ec04503ccb7f571b57
SHA256: fc53a277a1d7a514c7a6e5e7c75db076299ebec1dfe4a3db3c4509511a899afa
SHA512: 97641ff2f8aaee142396a7c84297113c1a1b20a8bbcdeec4ec2a60654e8ce41749865fc97cb068a4d86ada222200483b5f94626985db42fdeeadb737e68b7ed9
Ssdeep: 24576:7t3yjejW82ZKQUklOrBMg4xp3pkqNgD/kFEmKHVQmXKx5bA28UTsCkBC3fB:RIkJ207rZT/sEHin5bA28UTsCkBC35
PEiD: None matched

Screenshots

Behavior Summary

File-Read

C:\Program Files (x86)\desktop.ini
C:\Users\Virtual\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9
C:\Users\Virtual\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
C:\Users\Virtual\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A44F4E7CB3133FF765C39A53AD8FCFDD
C:\Users\Virtual\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9
C:\Users\Virtual\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
C:\Users\Virtual\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A44F4E7CB3133FF765C39A53AD8FCFDD
C:\Users\Virtual\AppData\Local\Temp\Cab33BC.tmp
C:\Users\Virtual\AppData\Local\Temp\Tar33BD.tmp
C:\Users\Virtual\Desktop\KqhVvYgJrY.docx
C:\Users\Virtual\Desktop\TeXnicCenter.lnk
C:\Users\Virtual\Desktop\nRhvcLQlMh.docx
\\?\PIPE\samr

File-Written

C:\ProgramData\BaYccoIY\CAMIMsAM.exe
C:\ProgramData\zSgsgkwE\qocgoAYA.exe
C:\Users\Virtual\AppData\Local\Temp\Cab33BC.tmp
C:\Users\Virtual\AppData\Local\Temp\SetupExe(20200419154016668).log
C:\Users\Virtual\AppData\Local\Temp\Tar33BD.tmp
C:\Users\Virtual\AppData\Local\Temp\YcMsIgYE.bat
C:\Users\Virtual\AppData\Local\Temp\setup.exe
C:\Users\Virtual\IsQUAMQg\JSIMwgEo.exe
\\?\PIPE\samr

File-Deleted

C:\Users\Virtual\AppData\Local\Temp\Cab33BC.tmp
C:\Users\Virtual\AppData\Local\Temp\OSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\Tar33BD.tmp
C:\Users\Virtual\AppData\Local\Temp\YcMsIgYE.bat

File-Opened

C:\
C:\Program Files (x86)\desktop.ini
C:\ProgramData\Microsoft\Windows\WER\ReportArchive
C:\ProgramData\zSgsgkwE\qocgoAYA
C:\Users\
C:\Users\Virtual\
C:\Users\Virtual\AppData\LocalLow
C:\Users\Virtual\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9
C:\Users\Virtual\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
C:\Users\Virtual\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A44F4E7CB3133FF765C39A53AD8FCFDD
C:\Users\Virtual\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9
C:\Users\Virtual\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
C:\Users\Virtual\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A44F4E7CB3133FF765C39A53AD8FCFDD
C:\Users\Virtual\AppData\Local\Microsoft\Windows\WER\ERC
C:\Users\Virtual\AppData\Local\Microsoft\Windows\WER\ReportArchive
C:\Users\Virtual\AppData\Local\Temp\Cab33BC.tmp
C:\Users\Virtual\AppData\Local\Temp\Setup00000b50\OSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\SetupExe(20200419154016668).log
C:\Users\Virtual\AppData\Local\Temp\Tar33BD.tmp
C:\Users\Virtual\AppData\Local\Temp\setup.exe
C:\Users\Virtual\Desktop\KqhVvYgJrY.docx
C:\Users\Virtual\Desktop\TeXnicCenter.lnk
C:\Users\Virtual\Desktop\nRhvcLQlMh.docx
C:\Users\Virtual\IsQUAMQg\JSIMwgEo
C:\Windows\
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui
C:\Windows\SysWOW64\en-US\WININET.dll.mui
C:\Windows\SysWOW64\en-US\urlmon.dll.mui
C:\Windows\System32\en-US\msxml3r.dll.mui
C:\Windows\System32\netmsg.dll
C:\Windows\System32\oleaccrc.dll
\\?\PIPE\samr

Network-Connects IP

172.217.16.174

Network-Resolves URL

google.com

Directory-Created

C:\ProgramData\BaYccoIY
C:\ProgramData\zSgsgkwE
C:\Users\Virtual\AppData\Local\Microsoft\Windows\WER\ERC
C:\Users\Virtual\AppData\Local\Temp\Setup00000668
C:\Users\Virtual\IsQUAMQg

Directory-Removed

C:\Users\Virtual\AppData\Local\Temp\Setup00000668

Directory-Enumerated

C:\Users
C:\Users\Virtual
C:\Users\Virtual\AppData
C:\Users\Virtual\AppData\Local
C:\Users\Virtual\AppData\Local\Temp
C:\Users\Virtual\AppData\Local\Temp\*
C:\Users\Virtual\AppData\Local\Temp\1580_3640\OSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\1580_3640\PSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\1580_3640\SVRSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\1580_3640\WSSSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\CR_C54AF.tmp\OSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\CR_C54AF.tmp\PSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\CR_C54AF.tmp\SVRSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\CR_C54AF.tmp\WSSSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\FILES\SETUP\config.xml
C:\Users\Virtual\AppData\Local\Temp\Low\OSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\Low\PSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\Low\SVRSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\Low\WSSSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\OSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\OneNoteRuntimeCache\OSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\OneNoteRuntimeCache\PSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\OneNoteRuntimeCache\SVRSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\OneNoteRuntimeCache\WSSSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\PSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\SVRSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\Setup00000668
C:\Users\Virtual\AppData\Local\Temp\Setup00000668\*
C:\Users\Virtual\AppData\Local\Temp\Setup00000b50\OSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\Setup00000b50\PSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\Setup00000b50\SVRSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\Setup00000b50\WSSSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\SetupExe(20200419154016668).log
C:\Users\Virtual\AppData\Local\Temp\Updates\OSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\Updates\PSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\Updates\SVRSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\Updates\WSSSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\VBE\OSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\VBE\PSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\VBE\SVRSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\VBE\WSSSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\WPDNSE\OSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\WPDNSE\PSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\WPDNSE\SVRSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\WPDNSE\WSSSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\WSSSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\config.xml
C:\Users\Virtual\AppData\Local\Temp\hsperfdata_Virtual\OSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\hsperfdata_Virtual\PSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\hsperfdata_Virtual\SVRSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\hsperfdata_Virtual\WSSSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\outlook logging\OSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\outlook logging\PSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\outlook logging\SVRSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\outlook logging\WSSSETUP.DLL
C:\Users\Virtual\AppData\Local\Temp\setup.exe

Registry Key-Opened

HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_CLASSES_ROOT\Drive\shellex\FolderExtensions
HKEY_CLASSES_ROOT\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}
HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\
HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\*\
HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\file\
HKEY_CURRENT_USER
HKEY_CURRENT_USER\CLSID\{79eac9d0-baf9-11ce-8c82-00aa004ba90b}\InprocServer32
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office Test\Special\Perf
HKEY_CURRENT_USER\Software\Microsoft\Command Processor
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{01979c6a-42fa-414c-b8aa-eee2c8202018}.check.100
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{01979c6a-42fa-414c-b8aa-eee2c8202018}.check.101
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{11CD958A-C507-4EF3-B3F2-5FD9DFBD2C78}.check.101
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{852FB1F8-5CC6-4567-9C0E-7C330F8807C2}.check.100
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{852FB1F8-5CC6-4567-9C0E-7C330F8807C2}.check.101
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{945a8954-c147-4acd-923f-40c45405a658}.check.42
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{A5268B8E-7DB5-465b-BAB7-BDCDA39A394A}.check.100
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{DAB69A6A-4D2A-4D44-94BF-E0091898C881}.check.100
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.100
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.101
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.102
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.103
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.104
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.106
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Providers\EventLog\{01979c6a-42fa-414c-b8aa-eee2c8202018}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Providers\EventLog\{11CD958A-C507-4EF3-B3F2-5FD9DFBD2C78}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Providers\EventLog\{945a8954-c147-4acd-923f-40c45405a658}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Providers\EventLog\{A5268B8E-7DB5-465b-BAB7-BDCDA39A394A}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Providers\EventLog\{DAB69A6A-4D2A-4D44-94BF-E0091898C881}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Paths\setup.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\ERC
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl
HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\14.0
HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Safer
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Windows Error Reporting
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office Test\Special\Perf
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\10.0\Access\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\10.0\Excel\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\10.0\FrontPage\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\10.0\Outlook\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\10.0\Photodraw\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\10.0\PowerPoint\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\10.0\Publisher\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\10.0\Word\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Access\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Excel\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\FrontPage\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\InfoPath\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\OneNote\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Outlook\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Photodraw\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\PowerPoint\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Publisher\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Word\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\9.0\Access\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\9.0\Excel\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\9.0\FrontPage\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\9.0\Outlook\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\9.0\Photodraw\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\9.0\PowerPoint\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\9.0\Publisher\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\9.0\Word\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllVerifyCertificateChainPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllVerifyRevocation
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\ContextDllCreateObjectContext
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllConvertPublicKeyInfo
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllEncodeObject
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllEncodeObjectEx
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllImportPublicKeyInfoEx
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{000C10F1-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{06C9E010-38CE-11D4-A2A3-00104BD35090}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{1A610570-38CE-11D4-A2A3-00104BD35090}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\SchemeDllRetrieveEncodedObjectW
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\TimeValidDllGetObject
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\UrlDllGetObjectUrl
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CertDllVerifyCertificateChainPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CertDllVerifyRevocation
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CertDllVerifyRevocation\DEFAULT
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\ContextDllCreateObjectContext
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllConvertPublicKeyInfo
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.1.1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.11
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.12
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.2
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.3
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.4
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2001
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2002
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2003
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2004
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2005
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2006
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2007
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2008
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2009
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2130
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2221
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2222
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.2
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.1.1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.4
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.10
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.11
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.12
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.15
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.20
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.25
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.26
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.27
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.28
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.30
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.4
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllImportPublicKeyInfoEx
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptSIPDllGetSignedDataMsg
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptSIPDllPutSignedDataMsg
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptSIPDllVerifyIndirectData
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\SchemeDllRetrieveEncodedObjectW
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\TimeValidDllGetObject
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\UrlDllGetObjectUrl
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\Visual Studio .NET 2003
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\crypt32
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\TVO
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Wintrust\Config
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE\Tracing
HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\Common\Security
HKEY_LOCAL_MACHINE\Software\Microsoft\Office\14.0\Common\Security
HKEY_LOCAL_MACHINE\Software\Microsoft\Office\14.0\Common\Setup
HKEY_LOCAL_MACHINE\Software\Microsoft\Ole
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\TrustedPublisher\Safer
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3131157199-1995805048-2727015567-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\setup.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\PropertySystem
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\AuthRoot
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\ChainEngine\Config
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Safer
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Windows Error Reporting
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\AccessProviders
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LDAP
HKEY_LOCAL_MACHINE\System\Setup
HKEY_LOCAL_MACHINE\software\microsoft\office\14.0\common\filespaths
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\system\CurrentControlSet\control\NetworkProvider\HwOrder

Registry Key-Read

HKEY_CURRENT_USER\Local Settings\MuiCache\6E\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103
HKEY_CURRENT_USER\Local Settings\MuiCache\6E\52C64B7E\@%SystemRoot%\system32\p2pcollab.dll,-8042
HKEY_CURRENT_USER\Local Settings\MuiCache\6E\52C64B7E\@C:\Windows\system32\netshell.dll,-1200
HKEY_CURRENT_USER\Local Settings\MuiCache\6E\52C64B7E\@C:\Windows\system32\prnfldr.dll,-8036
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security\DisableFixSecuritySettings
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security\DisableSecuritySettingsCheck
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security\Safety Warning Level
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{01979c6a-42fa-414c-b8aa-eee2c8202018}.check.100\CheckSetting
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{01979c6a-42fa-414c-b8aa-eee2c8202018}.check.101\CheckSetting
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{11CD958A-C507-4EF3-B3F2-5FD9DFBD2C78}.check.101\CheckSetting
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{852FB1F8-5CC6-4567-9C0E-7C330F8807C2}.check.100\CheckSetting
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{852FB1F8-5CC6-4567-9C0E-7C330F8807C2}.check.101\CheckSetting
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{945a8954-c147-4acd-923f-40c45405a658}.check.42\CheckSetting
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{A5268B8E-7DB5-465b-BAB7-BDCDA39A394A}.check.100\CheckSetting
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0\CheckSetting
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{DAB69A6A-4D2A-4D44-94BF-E0091898C881}.check.100\CheckSetting
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.100\CheckSetting
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.101\CheckSetting
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.102\CheckSetting
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.103\CheckSetting
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.104\CheckSetting
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.106\CheckSetting
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Providers\EventLog\{01979c6a-42fa-414c-b8aa-eee2c8202018}\LastKnownState
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Providers\EventLog\{11CD958A-C507-4EF3-B3F2-5FD9DFBD2C78}\LastKnownState
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Providers\EventLog\{945a8954-c147-4acd-923f-40c45405a658}\LastKnownState
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Providers\EventLog\{A5268B8E-7DB5-465b-BAB7-BDCDA39A394A}\LastKnownState
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Providers\EventLog\{DAB69A6A-4D2A-4D44-94BF-E0091898C881}\LastKnownState
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Hfref\Iveghny\VfDHNZDt\WFVZjtRb.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1000
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1000
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1001
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1004
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1201
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1800
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1804
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1806
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1001
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1004
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1200
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1201
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1405
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1800
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1803
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1804
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1806
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} {0000013A-0000-0000-C000-000000000046} 0xFFFF
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF} {000214E6-0000-0000-C000-000000000046} 0xFFFF
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\State
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\Disabled
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\LastQueuePesterTime
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\QueuePesterInterval
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.docx\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.docx\PerceivedType
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\ShellEx\{00021500-0000-0000-C000-000000000046}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\DisableProcessIsolation
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\EnableShareDenyNone
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\NoOplock
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\UseInProcHandlerCache
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\UseOutOfProcHandlerCache
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\System.HideOnDesktop
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\System.NamespaceCLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\{28636AA6-953D-11D2-B5D6-00C04FD918D0} 34
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\{28636AA6-953D-11D2-B5D6-00C04FD918D0} 6
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21EC2020-3AEA-1069-A2DD-08002B30309D}\SortOrderIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2227A280-3AEA-1069-A2DE-08002B30309D}\LocalizedString
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2227A280-3AEA-1069-A2DE-08002B30309D}\System.ItemNameDisplay
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2227A280-3AEA-1069-A2DE-08002B30309D}\{B725F130-47EF-101A-A5F1-02608C9EEBAC} 10
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{35786D3C-B075-49B9-88DD-029876E11C01}\SortOrderIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\InProcServer32\LoadWithoutCOM
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\LocalizedString
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\SortOrderIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\System.ItemNameDisplay
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\{B725F130-47EF-101A-A5F1-02608C9EEBAC} 10
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}\EnableShareDenyNone
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}\InprocServer32\LoadWithoutCOM
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\InProcServer32\LoadWithoutCOM
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\ShellFolder\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\ShellFolder\CallForAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\ShellFolder\HasNavigationEnum
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\ShellFolder\HideFolderVerbs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\ShellFolder\HideInWebView
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\ShellFolder\HideOnDesktopPerUser
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\ShellFolder\MapNetDriveVerbs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\ShellFolder\NoFileFolderJunction
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\ShellFolder\PinToNameSpaceTree
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\ShellFolder\QueryForInfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\ShellFolder\QueryForOverlay
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\ShellFolder\RestrictedAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\ShellFolder\UseDropHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\ShellFolder\WantsAliasedNotifications
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\ShellFolder\WantsFORDISPLAY
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\ShellFolder\WantsFORPARSING
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\ShellFolder\WantsParseDisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\ShellFolder\WantsUniversalDelegate
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\SortOrderIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}\DriveMask
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.docx\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.12\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.12\CLSID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.12\FriendlyTypeName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.12\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.12\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\CallForAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HasNavigationEnum
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideFolderVerbs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideInWebView
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideOnDesktopPerUser
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\MapNetDriveVerbs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\NoFileFolderJunction
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\PinToNameSpaceTree
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\QueryForInfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\QueryForOverlay
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\RestrictedAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\UseDropHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsAliasedNotifications
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsFORDISPLAY
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsFORPARSING
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsParseDisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsUniversalDelegate
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79eac9d0-baf9-11ce-8c82-00aa004ba90b}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainCacheResyncFiletime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\CryptnetPreFetchMaxMaxAgeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\CryptnetPreFetchMinMaxAgeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\CryptnetPreFetchTriggerPeriodSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableCANameConstraints
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableMandatoryBasicConstraints
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableUnsupportedCriticalExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\EnableWeakSignatureFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlCountInCert
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalByteCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalCertCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalCountPerChain
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxUrlRetrievalByteCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security\DisableFixSecuritySettings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security\DisableSecuritySettingsCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\MaximumAllowedAllocationSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\PageAllocatorSystemHeapIsPrivate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\PageAllocatorUseSystemHeap
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\D945EAF9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AutoUpdateDisableNotify
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\InternetSettingsDisableNotify
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\VistaSp1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3131157199-1995805048-2727015567-1000\ProfileImagePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST\2007
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST\2020
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST\FirstEntry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST\LastEntry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\setup.exe\DontUseDesktopChangeRouter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders\SuppressionPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders\{35786D3C-B075-49b9-88DD-029876E11C01}\SuppressionPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders\{9113A02D-00A3-46B9-BC5F-9C04DADDD5D7}\SuppressionPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders\{b155bdf8-02f0-451e-9a26-ae317cfd7779}\SuppressionPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1000
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1000
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1806
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1001
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1004
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1201
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1405
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1800
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1803
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1804
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1806
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesRecycleBin
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\FormatForDisplayHelper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\LogLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\LogMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\LogMaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}\COCREATESHELLFOLDERONLY
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}\CTXMENU_LIMITEDQI
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}\CTXMENU_NOVERBS
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}\CTXMENU_XPQCMFLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}\NEEDSFILESYSANCESTOR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}\NEEDSSTORAGEANCESTOR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}\NOIPROPERTYSTORE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}\NOLEGACYWEBVIEW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}\NOTAFILESYSTEM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}\NO_WEBVIEW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}\OTNEEDSSFCACHE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}\PINDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}\UNBINDABLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Disabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\QueuePesterInterval
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Security_HKLM_only
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\AutoRun
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\CompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DefaultColor
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DelayedExpansion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DisableUNCCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\EnableExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\PathCompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\*
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\setup.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_HANDLING\*
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_HANDLING\setup.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\ANSI
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\ANSIDISPLAYNAMES
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\APPISOFFICE
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\COINITIALIZE_COMPAREIDS
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\CONTEXTMENU
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\CORELINTERNETENUM
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\DOCOBJECT
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\FILEOPENBOGUSCTRLID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\FLUSHNOWAITALWAYS
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\FORCELFNIDLIST
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\FORCELIBRARYPARSE
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\IGNOREDEFAULTTOKEN
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\IGNOREENUMRESET
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\LOADCOLUMNHANDLER
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\MYCOMPUTERFIRST
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\NODEFVIEWMSGPUMP
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\NOTHREADUSECHECKS
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\NOVALIDATEFSIDS
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\OLDCREATEVIEWWND
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\OLDREGITEMGDN
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\RETURNALLATTRIBS
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\RETURNNONURLSASURLS
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\RequiredFile
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\STAROFFICE5PRINTER
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\STATICJUMPLISTSIZE
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\STRIPFOLDERBIT
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\Version
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\Visual Studio .NET 2003\RequiredFile
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\WIN95BINDTOOBJECT
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\WIN95DEFVIEW
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\setup.exe\WIN95SHLEXEC
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings\StringCacheGeneration
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\LdapClientIntegrity
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\UseHostnameAsAlias
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\UseOldHostResolutionOrder
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DebugFlags
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagLevel
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagMatchAnyMask
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress

Registry Key-Written

HKEY_CURRENT_USER\Local Settings\MuiCache\6E\52C64B7E\LanguageList
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{01979c6a-42fa-414c-b8aa-eee2c8202018}.check.100\CheckSetting
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{11CD958A-C507-4EF3-B3F2-5FD9DFBD2C78}.check.101\CheckSetting
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{852FB1F8-5CC6-4567-9C0E-7C330F8807C2}.check.100\CheckSetting
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{852FB1F8-5CC6-4567-9C0E-7C330F8807C2}.check.101\CheckSetting
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{945a8954-c147-4acd-923f-40c45405a658}.check.42\CheckSetting
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.100\CheckSetting
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.101\CheckSetting
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.102\CheckSetting
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.103\CheckSetting
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.104\CheckSetting
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.106\CheckSetting
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\HRZR_PGYFRFFVBA
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Hfref\Iveghny\VfDHNZDt\WFVZjtRb.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\JSIMwgEo.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qocgoAYA.exe

Mutex-Accessed

1@
JIsYQIME
ZiEIogAM1
dWkMYsEU1
gEQAMQss
è0@
ð0@
ø0@

Processes

Process Name

PID

Parent PID

fc53a277a1d7a514c7a6e5e7c75db076299ebec1dfe4a3db3c4509511a899afa.exe 2696 2360

Filter:

Registry File Process Services Network Synchronization

Show entries

Search:

Time	Repeat	API	Arguments	Result
1587315608.86		NtProtectVirtualMemory	process_identifier: 2696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 1576960 protection: 4 base_address: "0x00401000" process_handle: "0xffffffff"	Status SUCCESS
1587315608.86		NtCreateFile	create_disposition: 3 file_handle: "0x00000070" filepath: "C:\DLLS\ProcessInterceptorDebug.txt" desired_access: "0x40100080" file_attributes: 128 filepath_r: "\??\C:\DLLs\ProcessInterceptorDebug.txt" create_options: 96 status_info: 1 share_access: 3	Status SUCCESS
1587315608.86		GetFileType	file_handle: "0x00000070"	Return Value 1 Status SUCCESS
1587315608.86	2	SetFilePointer	move_method: 2 file_handle: "0x00000070" offset: 0	Return Value 6220 Status SUCCESS
1587315608.86		NtWriteFile	buffer: "" offset: 0 file_handle: "0x00000070" filepath: "C:\DLLS\ProcessInterceptorDebug.txt"	Status SUCCESS
1587315608.86		NtClose	handle: "0x00000070"	Status SUCCESS
1587315608.86		NtCreateFile	create_disposition: 3 file_handle: "0x00000070" filepath: "C:\DLLS\ProcessInterceptorDebug.txt" desired_access: "0x40100080" file_attributes: 128 filepath_r: "\??\C:\DLLs\ProcessInterceptorDebug.txt" create_options: 96 status_info: 1 share_access: 3	Status SUCCESS
1587315608.86		GetFileType	file_handle: "0x00000070"	Return Value 1 Status SUCCESS
1587315608.86	2	SetFilePointer	move_method: 2 file_handle: "0x00000070" offset: 0	Return Value 6279 Status SUCCESS
1587315608.86		NtWriteFile	buffer: "" offset: 0 file_handle: "0x00000070" filepath: "C:\DLLS\ProcessInterceptorDebug.txt"	Status SUCCESS

Showing 1 to 10 of 2,198 entries

Previous1 2 3 4 5…220Next

qocgoAYA.exe 2796 2696

Filter:

Registry File Process Services Network Synchronization

Show entries

Search:

Time	API	Arguments	Result
1587315611.02	NtClose	handle: "0x00000064"	Status SUCCESS
1587315611.02	NtOpenKey	key_handle: "0x00000064" desired_access: "0x00020019" regkey: "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale"	Status SUCCESS
1587315611.02	NtQueryValueKey	key_handle: "0x00000064" key_name: "" value: "" reg_type: 0 information_class: 1 regkey: "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US"	Return Value 3221225524 Status FAILURE
1587315611.02	NtClose	handle: "0x00000064"	Status SUCCESS
1587315611.02	NtOpenKey	key_handle: "0x00000064" desired_access: "0x00020019" regkey: "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale"	Status SUCCESS
1587315611.02	NtQueryValueKey	key_handle: "0x00000064" key_name: "" value: "" reg_type: 0 information_class: 1 regkey: "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US"	Return Value 3221225524 Status FAILURE
1587315611.02	NtClose	handle: "0x00000064"	Status SUCCESS
1587315611.02	NtProtectVirtualMemory	process_identifier: 2796 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 479232 protection: 64 base_address: "0x00401000" process_handle: "0xffffffff"	Status SUCCESS
1587315611.08	NtOpenFile	file_handle: "0x00000064" filepath: "C:\" desired_access: "0x00100000" filepath_r: "\??\C:\" status_info: 1 open_options: 16417 share_access: 0	Status SUCCESS
1587315611.08	NtQueryInformationFile	file_handle: "0x00000064" information_class: 9	Status SUCCESS

Showing 1 to 10 of 2,676 entries

Previous1 2 3 4 5…268Next

cmd.exe 2932 2696

Filter:

Registry File Process Services Network Synchronization

Show entries

Search:

Time	API	Arguments	Result
1587315614.76	GetSystemTimeAsFileTime		Status SUCCESS
1587315614.76	SetUnhandledExceptionFilter		Status FAILURE
1587315614.76	NtOpenThread	access: "0x001fffff" thread_name: "" thread_handle: "0x0000006c" process_identifier: 0	Status SUCCESS
1587315614.76	LdrGetDllHandle	module_name: "KERNEL32.DLL" module_address: "0x7dd60000" stack_pivoted: 0	Status SUCCESS
1587315614.76	LdrGetProcedureAddress	ordinal: 0 function_address: "0x7dd8a84f" function_name: "SetThreadUILanguage" module: "kernel32" module_address: "0x7dd60000"	Status SUCCESS
1587315614.76	RegOpenKeyExW	regkey_r: "Software\Policies\Microsoft\Windows\System" base_handle: "0x80000001" key_handle: "0x00000000" options: 0 access: "0x00020019" regkey: "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System"	Return Value 2 Status FAILURE
1587315614.76	RegOpenKeyExW	regkey_r: "Software\Microsoft\Command Processor" base_handle: "0x80000002" key_handle: "0x00000074" options: 0 access: "0x02000000" regkey: "HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor"	Status SUCCESS
1587315614.76	RegQueryValueExW	key_handle: "0x00000074" regkey_r: "DisableUNCCheck" reg_type: 0 value: "" regkey: "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DisableUNCCheck"	Return Value 2 Status FAILURE
1587315614.76	RegQueryValueExW	key_handle: "0x00000074" regkey_r: "EnableExtensions" reg_type: 4 value: 1 regkey: "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\EnableExtensions"	Status SUCCESS
1587315614.76	RegQueryValueExW	key_handle: "0x00000074" regkey_r: "DelayedExpansion" reg_type: 0 value: "" regkey: "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DelayedExpansion"	Return Value 2 Status FAILURE

Showing 1 to 10 of 73 entries

Previous1 2 3 4 5…8Next

reg.exe 2984 2696

Filter:

Registry File Process Services Network Synchronization

Show entries

Search:

Time	Repeat	API	Arguments	Result
1587315614.95		GetSystemTimeAsFileTime		Status SUCCESS
1587315614.95		SetUnhandledExceptionFilter		Status FAILURE
1587315614.95		LdrLoadDll	module_name: "kernel32.dll" basename: "kernel32" stack_pivoted: 0 flags: 0 module_address: "0x7dd60000"	Status SUCCESS
1587315614.95	2	LdrGetProcedureAddress	ordinal: 0 function_address: "0x7dd7719c" function_name: "SortGetHandle" module: "kernel32" module_address: "0x7dd60000"	Status SUCCESS
1587315614.95		GetSystemWindowsDirectoryW	dirpath: "C:\Windows"	Return Value 10 Status SUCCESS
1587315614.95		NtCreateFile	create_disposition: 1 file_handle: "0x00000078" filepath: "C:\Windows\Globalization\Sorting\sortdefault.nls" desired_access: "0x80100080" file_attributes: 128 filepath_r: "\??\C:\Windows\Globalization\Sorting\sortdefault.nls" create_options: 96 status_info: 1 share_access: 1	Status SUCCESS
1587315614.95		NtCreateSection	file_handle: "0x00000078" object_handle: "0x00000000" desired_access: "0x000f0005" protection: 2 section_name: "" section_handle: "0x0000007c"	Status SUCCESS
1587315614.95		NtMapViewOfSection	section_handle: "0x0000007c" process_identifier: 2984 commit_size: 0 win32_protect: 2 buffer: "" base_address: "0x007c0000" allocation_type: 0 section_offset: 0 view_size: 2945024 process_handle: "0xffffffff"	Status SUCCESS
1587315614.95	2	NtClose	handle: "0x0000007c"	Status SUCCESS
1587315614.95		RegOpenKeyExW	regkey_r: "Software\Microsoft\Windows\CurrentVersion\Policies\System" base_handle: "0x80000001" key_handle: "0x00000000" options: 0 access: "0x02000000" regkey: "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System"	Return Value 2 Status FAILURE

Showing 1 to 10 of 38 entries

Previous1 2 3 4Next

reg.exe 3020 2696

Filter:

Registry File Process Services Network Synchronization

Show entries

Search:

Time	Repeat	API	Arguments	Result
1587315614.89		GetSystemTimeAsFileTime		Status SUCCESS
1587315614.89		SetUnhandledExceptionFilter		Status FAILURE
1587315614.9		LdrLoadDll	module_name: "kernel32.dll" basename: "kernel32" stack_pivoted: 0 flags: 0 module_address: "0x7dd60000"	Status SUCCESS
1587315614.9	2	LdrGetProcedureAddress	ordinal: 0 function_address: "0x7dd7719c" function_name: "SortGetHandle" module: "kernel32" module_address: "0x7dd60000"	Status SUCCESS
1587315614.9		GetSystemWindowsDirectoryW	dirpath: "C:\Windows"	Return Value 10 Status SUCCESS
1587315614.9		NtCreateFile	create_disposition: 1 file_handle: "0x00000078" filepath: "C:\Windows\Globalization\Sorting\sortdefault.nls" desired_access: "0x80100080" file_attributes: 128 filepath_r: "\??\C:\Windows\Globalization\Sorting\sortdefault.nls" create_options: 96 status_info: 1 share_access: 1	Status SUCCESS
1587315614.9		NtCreateSection	file_handle: "0x00000078" object_handle: "0x00000000" desired_access: "0x000f0005" protection: 2 section_name: "" section_handle: "0x0000007c"	Status SUCCESS
1587315614.92		NtMapViewOfSection	section_handle: "0x0000007c" process_identifier: 3020 commit_size: 0 win32_protect: 2 buffer: "" base_address: "0x00810000" allocation_type: 0 section_offset: 0 view_size: 2945024 process_handle: "0xffffffff"	Status SUCCESS
1587315614.92	2	NtClose	handle: "0x0000007c"	Status SUCCESS
1587315614.92		RegOpenKeyExW	regkey_r: "Software\Microsoft\Windows\CurrentVersion\Policies\System" base_handle: "0x80000001" key_handle: "0x00000000" options: 0 access: "0x02000000" regkey: "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System"	Return Value 2 Status FAILURE

Showing 1 to 10 of 38 entries

Previous1 2 3 4Next

reg.exe 2088 2696

Filter:

Registry File Process Services Network Synchronization

Show entries

Search:

Time	Repeat	API	Arguments	Result
1587315615.51		GetSystemTimeAsFileTime		Status SUCCESS
1587315615.51		SetUnhandledExceptionFilter		Status FAILURE
1587315615.51		LdrLoadDll	module_name: "kernel32.dll" basename: "kernel32" stack_pivoted: 0 flags: 0 module_address: "0x7dd60000"	Status SUCCESS
1587315615.51	2	LdrGetProcedureAddress	ordinal: 0 function_address: "0x7dd7719c" function_name: "SortGetHandle" module: "kernel32" module_address: "0x7dd60000"	Status SUCCESS
1587315615.51		GetSystemWindowsDirectoryW	dirpath: "C:\Windows"	Return Value 10 Status SUCCESS
1587315615.51		NtCreateFile	create_disposition: 1 file_handle: "0x00000078" filepath: "C:\Windows\Globalization\Sorting\sortdefault.nls" desired_access: "0x80100080" file_attributes: 128 filepath_r: "\??\C:\Windows\Globalization\Sorting\sortdefault.nls" create_options: 96 status_info: 1 share_access: 1	Status SUCCESS
1587315615.51		NtCreateSection	file_handle: "0x00000078" object_handle: "0x00000000" desired_access: "0x000f0005" protection: 2 section_name: "" section_handle: "0x0000007c"	Status SUCCESS
1587315615.51		NtMapViewOfSection	section_handle: "0x0000007c" process_identifier: 2088 commit_size: 0 win32_protect: 2 buffer: "" base_address: "0x008e0000" allocation_type: 0 section_offset: 0 view_size: 2945024 process_handle: "0xffffffff"	Status SUCCESS
1587315615.51	2	NtClose	handle: "0x0000007c"	Status SUCCESS
1587315615.51		RegOpenKeyExW	regkey_r: "Software\Microsoft\Windows\CurrentVersion\Policies\System" base_handle: "0x80000001" key_handle: "0x00000000" options: 0 access: "0x02000000" regkey: "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System"	Return Value 2 Status FAILURE

Showing 1 to 10 of 38 entries

Previous1 2 3 4Next

setup.exe 1640 2932

Filter:

Registry File Process Services Network Synchronization

Show entries

Search:

Time	Repeat	API	Arguments	Result
1587315616.85		GetSystemTimeAsFileTime		Status SUCCESS
1587315616.85		NtAllocateVirtualMemory	process_identifier: 1640 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 base_address: "0x02190000" allocation_type: 8192 process_handle: "0xffffffff"	Status SUCCESS
1587315616.85		NtFreeVirtualMemory	free_type: 32768 base_address: "0x02190000" process_identifier: 1640 process_handle: "0xffffffff" size: 1638400	Status SUCCESS
1587315616.85		NtAllocateVirtualMemory	process_identifier: 1640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 base_address: "0x02320000" allocation_type: 4096 process_handle: "0xffffffff"	Status SUCCESS
1587315616.87		LdrGetDllHandle	module_name: "KERNEL32.DLL" module_address: "0x7dd60000" stack_pivoted: 0	Status SUCCESS
1587315616.87	4	LdrGetProcedureAddress	ordinal: 0 function_address: "0x7dd74f2b" function_name: "FlsAlloc" module: "kernel32" module_address: "0x7dd60000"	Status SUCCESS
1587315616.87		LdrGetDllHandle	module_name: "KERNEL32.DLL" module_address: "0x7dd60000" stack_pivoted: 0	Status SUCCESS
1587315616.87		LdrGetProcedureAddress	ordinal: 0 function_address: "0x7deb0fcb" function_name: "EncodePointer" module: "kernel32" module_address: "0x7dd60000"	Status SUCCESS
1587315616.87		LdrGetDllHandle	module_name: "KERNEL32.DLL" module_address: "0x7dd60000" stack_pivoted: 0	Status SUCCESS
1587315616.87		LdrGetProcedureAddress	ordinal: 0 function_address: "0x7deb0fcb" function_name: "EncodePointer" module: "kernel32" module_address: "0x7dd60000"	Status SUCCESS

Showing 1 to 10 of 1,927 entries

Previous1 2 3 4 5…193Next

reg.exe 2340 2044

Filter:

Registry File Process Services Network Synchronization

Show entries

Search:

Time	Repeat	API	Arguments	Result
1587315618.25		GetSystemTimeAsFileTime		Status SUCCESS
1587315618.25		SetUnhandledExceptionFilter		Status FAILURE
1587315618.25		LdrLoadDll	module_name: "kernel32.dll" basename: "kernel32" stack_pivoted: 0 flags: 0 module_address: "0x7dd60000"	Status SUCCESS
1587315618.25	2	LdrGetProcedureAddress	ordinal: 0 function_address: "0x7dd7719c" function_name: "SortGetHandle" module: "kernel32" module_address: "0x7dd60000"	Status SUCCESS
1587315618.25		GetSystemWindowsDirectoryW	dirpath: "C:\Windows"	Return Value 10 Status SUCCESS
1587315618.25		NtCreateFile	create_disposition: 1 file_handle: "0x00000078" filepath: "C:\Windows\Globalization\Sorting\sortdefault.nls" desired_access: "0x80100080" file_attributes: 128 filepath_r: "\??\C:\Windows\Globalization\Sorting\sortdefault.nls" create_options: 96 status_info: 1 share_access: 1	Status SUCCESS
1587315618.25		NtCreateSection	file_handle: "0x00000078" object_handle: "0x00000000" desired_access: "0x000f0005" protection: 2 section_name: "" section_handle: "0x0000007c"	Status SUCCESS
1587315618.25		NtMapViewOfSection	section_handle: "0x0000007c" process_identifier: 2340 commit_size: 0 win32_protect: 2 buffer: "" base_address: "0x00870000" allocation_type: 0 section_offset: 0 view_size: 2945024 process_handle: "0xffffffff"	Status SUCCESS
1587315618.25	2	NtClose	handle: "0x0000007c"	Status SUCCESS
1587315618.25		RegOpenKeyExW	regkey_r: "Software\Microsoft\Windows\CurrentVersion\Policies\System" base_handle: "0x80000001" key_handle: "0x00000000" options: 0 access: "0x02000000" regkey: "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System"	Return Value 2 Status FAILURE

Showing 1 to 10 of 38 entries

Previous1 2 3 4Next

Time	Repeat	API	Arguments	Result
1587315191.36	2	GetForegroundWindow		Return Value 65592 Status SUCCESS
1587315191.64		EnumWindows		Return Value 1 Status SUCCESS
1587315191.66		LoadStringW	module_handle: "0x0000000000000000" id: 543 string: "Show hidden icons"	Return Value 17 Status SUCCESS
1587315191.66	2	GetSystemMetrics	index: 45	Return Value 2 Status SUCCESS
1587315191.66		LoadStringW	module_handle: "0x0000000000000000" id: 543 string: "Show hidden icons"	Return Value 17 Status SUCCESS
1587315191.72		GetForegroundWindow		Return Value 65592 Status SUCCESS
1587315191.72		EnumWindows		Return Value 1 Status SUCCESS
1587315191.85		NtDuplicateObject	handle_attributes: 0 source_process_identifier: 1056 source_handle: "0x00000000000007fc" target_process_identifier: 1056 desired_access: "0x000f001f" target_process_handle: "0xffffffffffffffff" target_handle: "0x00000000000007f8" source_process_handle: "0xffffffffffffffff" options: 2	Status SUCCESS
1587315191.85		NtMapViewOfSection	section_handle: "0x00000000000007f8" process_identifier: 1056 commit_size: 0 win32_protect: 2 buffer: "" base_address: "0x0000000003790000" allocation_type: 0 section_offset: 0 view_size: 4096 process_handle: "0xffffffffffffffff"	Status SUCCESS
1587315191.85		NtUnmapViewOfSection	base_address: "0x0000000003790000" region_size: 4096 process_identifier: 1056 process_handle: "0xffffffffffffffff"	Status SUCCESS

Classification

Indicators

Yara

Static Analysis

Sections

Resources

Imports

Library ntdll.dll:

Library user32.dll:

Library kernel32.dll:

Strings

Dropped Files

07240c35b56e651a_WYcc.exe

128f665e499e4d62_oMsi.exe

1698f9c4ae95467c_uswW.exe

23fe9cb18a1007ff_eQAQ.exe

262259909cddd022_OYYc.exe

2892a0658e34858f_PcYM.exe

2a51101b3188d3b2_vkEy.exe

3c21bae95ac04939_uoAy.exe

45d1eee2de7aa8b3_oMMQ.exe

5d4fe5275aa45de4_jYEE.exe

6aa5b232c4c56ca5_XsQq.exe

7cd118a999d43c65_YEYE.exe

7df2d0494b8c1197_ksAc.exe

86149753ce9f5e35_OQAq.exe

8a34100cbe356e7a_DAcq.exe

8b1af53b5bf2ddec_CQwa.exe

8f782c8b6e77e4f4_xkwy.exe

97f0fbd78307f6c8_UEMW.exe

be3a7ca9b2e3821b_LUQY.exe

be4cf70321f6bddb_PosA.exe

c4375dc95f6c3949_REsU.exe

e7c516835dede56f_PUcm.exe

Network

DNS Requests

HTTP Requests

http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl

http://google.com/

Hosts Involved

Geolocation

Destination Country

File

Screenshots

Behavior Summary

File-Read

File-Written

File-Deleted

File-Opened

Network-Connects IP

Network-Resolves URL

Directory-Created

Directory-Removed

Directory-Enumerated

Registry Key-Opened

Registry Key-Read

Registry Key-Written

Mutex-Accessed

Processes

fc53a277a1d7a514c7a6e5e7c75db076299ebec1dfe4a3db3c4509511a899afa.exe26962360

qocgoAYA.exe27962696

cmd.exe29322696

reg.exe29842696

reg.exe30202696

reg.exe20882696

setup.exe16402932

reg.exe23402044

explorer.exe1056300

fc53a277a1d7a514c7a6e5e7c75db076299ebec1dfe4a3db3c4509511a899afa.exe 2696 2360

qocgoAYA.exe 2796 2696

cmd.exe 2932 2696

reg.exe 2984 2696

reg.exe 3020 2696

reg.exe 2088 2696

setup.exe 1640 2932

reg.exe 2340 2044

explorer.exe 1056 300