MZ@ !L!This program cannot be run in DOS mode. $$MWJWJWJԖDVJCaJaGVJiHVJRichWJPEL<\ A,A@ 0oy&o@@BxBd&rnP @i TtB@.textTAA `.dataAA@.idataPBA@@.rsrcd&B&A@@.reloc@ih@BZ8*~&\E$XO~&\Z*~&\El[JgOLEAUT32.DLLNTDLL.DLLUSER32.DLLKERNEL32.DLLMSVBVM60.DLL>NN@@"NN$NXN]N]NzNN N4NxNN9NZNNNNNmNmNyNyNNNNNNNNNNNNNN>NFNp@@%N%N4NhNmNmNNN,N@NNN?NjNNNN#N9NNNNNNNNN.N.N3N3NNNN'N6N6N3NNNrNPNGNN&N6VOOX@@NNNN>N[N NNNNNNN'N'N'N3NtNLNQNNWNNNNNNN3NONNNNNNMNNNNNNWNWNNNNNNNNN#N]NmNmNmNNNNNNVNVNNNNNNNNNNNNNN`OO?OyOOOOOOO OO1OdOOOOO(ObOOOOO%OlOlOOOO/O/O4OOOZOOOOOOO O O O# O O O O O O O O O O O O O O O O O) Ov O O O O O O OO%ODOOOOOOOOOOO4O@@OOO*OOOOOOOOOOOOOOOO6OVO@@~OOO"OEOpOOO0O@OOOOO"OSOOOOOOOSOXOXOO-O:OIOIOXO6#O"O@@<OO$O0OFOWOxOzOOOOOOtOyOyOyO~OOOOOO$O9ONOOOOOOOOOOOOOO OOOgOOOB OR O!O!O!O!O!O!O!O!Ot"O"O"O"O"O!ON%O&%O%Op&O64OY4O@@,&O'O'Oe'O'O'O'OR(O(OM)O)OY*O+O%,O%,O,O-O.O.O`/O`/O`/O/O#0O1O1O(1O1O1O2O2O2O2O2O3O3O<3OA3OA3O4O04O=4OL4OL4OA3O>9O8O8@@^5Oq5O5O5O5O)6O96Ov6O6O6O6O7O7O7O7O7O8O8O8O8O8O7O&=O=O`@~9O9O9O9O9O9O9O9O4:OY:O:O:O:O:O;O?;Oc;O;O;O;O;OHO>HO_HO|HOHOHOHOHO IO IO IO IO IO%IO%IOJOJOJOJOJOJO%IOff@MO}MOKOO@@$>OEOTOqO~OуO$OwOʄOOvOυO(OOچO3OOO;OOOFOOOQOOOO9O>O>OԋOOOOO>O>AOOX@@$OOČOOJOZOOOOOOOCO֑OiOOtOO{OOO4OO>OїOHOOИOOOOOO͙OܙOܙOO4O@@#ΚO՚OOO O O$O?O\OOOЛOOOOOPOOOO8OΡOOOˢOOOOOO`OrOOOOO O4̨O@P@ OO$O̧OѧOѧOOOOOOѧO>0O˸OP @@&^OeOtOOO4O4O[OAOQO;OOO OOOүOOȰOOݱOOOOO8OOOO۶O۶OOOOOOOOOO6OlOp!@x @;OOOĹOOȺOO˻OػOO.OAOqO޼OO"O'O:O OO)O7ODODOWOOOþOþOþOOfOyO4O9OOOOpOOOOOOfOyO:OOOuOuOOOO0OBOOO^O^OO4O!@!@.O5ODO+O;OOOOOmOOOOOO4OH"@"@nOuOOOOOOOOOOOOOOO6 OO"@p"@~OOOOOOOOOOO+OMOOOOOOOOOOOOOO6"OO$@#@>nOOOOOOO>OKO\OxOOO O OOOOO OfOrOOOPOgOO]OiOOO/OFOO/OOOO9OOOOOOOO>OOOOOOOOOOOOOOOOO6oOO%@0$@hOOOOO OCOqOOOKOZOOOOOOOOOOOOOOOOOOXOeOeOxOOOO1O@OOOO|OOOOOOOOOO5O7O^OzOOO|OOVOgOiOzOzOOOOBOGOGOOOCOCOYOkOOOOOAOOOO=ONOOOOOJOJOJO\OtOtOOOO_OqO~OOOOO6PIPP&@&@ PPPPPmPrPrPP P-P<P<PrP6 PL P&@x&@PPPXPPPP P PPP{PPPPPPPPPp Pu Pu P P# P0 P? P? Pu P6/PP'@'@& P P$ P1 P> PO P\ P\ Pm Pz Pz P P P P5 Pi P Pn P@PoPPPPPPPPPPP*P/P/PPPPPP/P6PPP(@'@PPPPPPPPPPPP@PYPPPPPPPPPPPPP6PP)@x(@#^PePtPP PPPPPAPlPPP P-P P4P4P4P@P@POP`PPPPPPPPPPPPPP6PRP)@8)@PPPPPPPPPPPPPPP)P6PEPEPP6 PP*@)@PP$P;P@P@P:PJPWPjPPPPPPPPPPP4.PH+@8*@B~ P P P P P P!P)!P!P!P!Pz"Pz"P#P'#P,#P#P#Pg$P{$P$P$%P$%P%PG&P&P&P&Px'P}'P (P (P"(P(P(P<)P<)PR)P)P)Pl*Pl*Pl*Pq*P*P&+P8+P=+P+P+Pv,P{,P,P-P-P-P-P-P-P-P-PC.PU.Pb.Pq.Pq.P-P@62Pl2P+@p+@/P/P$/P/P/P/P.0P30P30P0P,1P91P}1P}1P1P1P1P12PC2PP2P_2P_2P1P44P@,@+@3P%3P43PI3P3P3P3P3P3P3P3P4P4P4P4P4P3P4g8P,@h,@^5Pe5Pt5P5P5P5P5P6P6P6PI7P7P7P7P7P,8P>8PK8PZ8PZ8P7P6&CPBP-@,@48P9P9P9PW:P\:P\:P:P:P:P:P:P:P:P;PixP>xPuxPxPxPxPyP*yPyPyPyPyPyPyPyP|P|P|P|P|P|P|P }PM}PPPPPFPPƁP@PEPEPPP PPPEP6zP,P84@3@'nPuPP$P9PUPJP P)P.P[PyPPPԇP9PxPzPPPɈP܈PPPPPPjPjP}P}PPPPPPPPPP6PP8@`4@nPuPPPPҏPPPPאPאPP P#P7PPPP P PUPhPyPPP P P'PGP]PqP@P@PMPRPRP_PPPPPPP(P?PPPPߚPPPLPP PFPfPvPvPvPPPP؜PPP&P3P`P`P`P{PLPPPPP}PPPPPOPOPPڦPP$PIPIPIP_PzPKPaPyPPPͩPͩPͩPͩPPPP+P+P-P:P:P?PͪPڪPڪPPPP;P]PլPPPPPPPPPPPPPϭPPP7PˮPЮPPPPP4P4P6PCPCPTPYPPPP PP2PEPxPPͱPYPYPfPfPwP|P PPPPPPPPͳP޳PPP8PߴPߴPPPPPPP#P0P0P5PFPSPiPyPPPP&P&P+PPƷPƷP˷P߷PP.PHPUPUPZPPPP PP'P4P4P9PǹPԹPԹPٹPPPPPPPݻPPP P PP6P5P8@88@.νPսPPPPPPPP$PPvPPPPPPPPPPPPPPQPQP>PPP\PPPPPPPPPPPP PP'P'PP6PP9@ 9@&PPP0P@PEPsPPPPPP~PPJPOPOPTPPP P%P%P%PPSPqP~PPPPPPYPkPxPPPP6PBPX:@9@nPuPPPP+PmPmPPPPP'P'P?PfPfPfPkPkPPP&P5P5PkP6YPP:@:@PPP(PPPPPPPPPPPPPP!PP~PPPPPPPUPPxP1PGP P+PPP>PP(<@;@PPPVPcPhPhPPPPPPP:PIPnPnPPPPPPiP{PPPPP}P6SQQ<@`<@PPP!P&P&PPPP1P\PPPPPPMPfPPPPPP@PEPEPPPQQQEP>]Q!QH=@=@ QQQQKQPQPQQQQQQPQ6OQQ=@p=@QQQQQ1Q_QQQQQQ7Q7Q<Q<QQQQQQ<Q4 Qp>@=@QQQqQQQu Q Q6 QS Q Q Q QQ Q Q Q QN Q Q Q Q Q Q Q Q Q Q Q<Q?@>@nQuQQQZQQQ=QJQYQnQQQQQQQQQQ{QQQQQQ$Q0?@^QeQwQ|Q|QQQQQQQQQQQ>QQ?@?@nQuQQQQ QAQQQQQQQQQQQQQQQQ6` Q QX@@@@^QeQtQQQEQ&Q+Q+QQQQQQ+Q6+Q*+Q@@@@ Q Q Q%Q%QE*QJ*QJ*Q*Q+Q+Q+Q+QJ*Q>7QS7QS7QS7Q7Q7Q7Q7Q7Q7Q 8Q"8QA8Q]8Qr8Q8Q8Q8Q8Q8Q8Q9Q-9QO9Qd9Qd9Q9Q9Q9Q9Q9Q9Q:Q3:Qe;Qz;Qz;Q;Q;QQ>Q>Q>Q>Q>Qy?Q?Q?Q?Q?Q>Q6IQ4IQD@ D@^@Qe@Qt@Q@QeAQ|AQAQFQDGQHQHQ"HQ"HQ'HQ=HQ?HQLHQLHQQHQQHQHQIQIQ$IQ$IQQHQ&tLQJLQD@ .JQ5JQDJQKQ'LQ4LQ6LQCLQCLQ4=NQHE@E@LQLQLQKMQXMQZMQgMQgMQlMQlMQNQNQ!NQ0NQ0NQlMQ6hQgQPF@pE@5NQNQNQ^OQpOQuOQuOQOQ]QQRQISQSQTQTQTQoVQYWQiXQXQXQZQZQ\Q\Q_^Q_^Q^Q^Q^Q_Q_Q_Q_Q_Q_Q_Q`Q`Q{aQeQeQeQfQfQfQ gQgQgQgQgQgQgQgQgQ60QQXG@xF@6iQ%iQ4iQiQiQiQiQjQjQkQ[mQnQoQKoQoQoQpQpQqQrQsQ2sQIsQ^sQ^sQtsQfuQkuQwQwQ9yQ9yQ9yQqyQyQyQyQyQyQyQyQ}QbQ9Q9Q9QQQQ]QoQ|QQQQ6)R(RM@G@QQĂQ>QPQUQUQQOQdQQQ+QBQNQ%QlQdQGQSQ؎QoQQQQQQQQQ%Q QQQQQQQQQɕQ˕QQQQQQQ%Q%Q!Q!Q~QQQQݛQQQޝQޝQޝQdQQQQQğQƟQ۟QݟQQQ Q QQQQQܢQQQ'Q'Q9QOQTQTQYQoQoQoQQ8QFQޥQQQQ/QaQcQxQzQQQQQQQԨQԨQQQ/Q?QrQzQzQQQQQQ¬Q¬Q QQQQQQQQQQ7QQQVQQQQQۼQ"QQQ QQ%QHQFQ\QaQaQQQKQQQQUQ8Q8Q8Q6QhQjQQQQQQQQQQQQQ4QPQQkQQQlQQQQQLQNQcQeQzQ|QQQQQQQBQBQNQNQQQQQQQQ Q QQ%Q%Q%QQQQQQQQQQQ.Q0QEQGQ\Q^QsQuQQQQQQQ(Q0Q0QBQXQ]Q]QbQxQxQQRQQCQHQ^QUQUQUQaQQQQ\Q?Q?QQQVQVQQQdQQQQAQQQvQ Q0QuQQQQQQzQTQQQ_QQQQQNQPQeQgQ|Q~QQQQQQQRRRR#RARRRRE RE RE R{ R R R R R R R R R R R R RRR R RR`RRRRRRRRRRRRR R.RRR1R`RRRRRRRR1R3RHRJR_R_RRRR'RZRRRRRRRRRRRR!R#R#R#R$R$R$R$R&Rw'Rw'Rw'R'R'R(R(R(R(R(R(R(R(R6R RPR@ N@ .+R5+RD+R+R+R+R+R-R-R-R/RB1R2R3RS3R3R4R 5R 5R55R55R6RB8Ry8RJ:RGR@R@R7ARgARARBRBRBRBRhERhGRhGRtGRtGRGRIRKR LRdLRLRMR NR NR'NR'NRPRRRRRRRRRRRRRSRSR"SR"SR'SR=SR=SRTRURURWR0YRZR[R[Ra]R]RY_R_R=aRTaRiaRiaRcReReRHhRHhRchRkRlRplRlR)mRnRnR3nR3nRrRtRtRtRtRtR1xRxxRxRyRyRwzRyzRzRzRd~RRR R RR#R#R/R;RGRӂRRRAR$R$R6R;R;RRچR/RRRRRRҎRjRRRRRR:RRR R7R7RRR˚RRYRRRmRZR\RwRwRBRpRpR|R|RRRWRRR)RRRRRRRRRRRRR'R=RBRBRGR]R]RRRRصRRRRfRһRRʽRRRſRڿRڿRRRLRRRRR*RRR=R)R+RFRFRRPRPR\R\RwRKRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR6VSUS(U@xR@RRRNR`ReReRsR1RRRRR3RYR|RRRRR(RARZRhRZRLRZRjRRRMRYRgRGRURRRRRRWSeSSSSSSSSs Ss S S S S S S S SSSuSSSSSSwSSSSSSSSSSSSSSSw!S"S"S"S^$Sv%Sv%S%S%S%S%S%S2'S(S(S#(S)S*S*S*S,,S-S-S!-S&-S&-So-S}-S-SB.SP.S(0S60S}0S0S2S2SW5Se5S6S7S$7S:S:S):Sc;S;S;S܀SSV@@V@!.{S5{SD{S{S{S{S{S&|S^|S|S|Sv}S~S~SW~Si~S~S~S~S~S~S~S~SGSGSSSSJS\SiSxSxSScS4SPW@W@΁SՁSSMSSłSłSۂSۂSSSvSSSSSS>S*SHX@xW@1>SESTSɄSS)S?SSS%S:S:SKSpS׆SSzS|SSSSSoSoSSS0S0SiSSSSNJS݊SSSSSSSMSMSRSRSSS SSSRS SS6[S2S(Y@X@#NSUSdSSSSSSSߑSSS*S@SWSdSiSiSiSiSSڒSSSSSS3S8S8SS SS%S%S8S6˗SSY@PY@#SŔSԔSSSS)S.S.SOSwSSSSǕSԕSٕSٕSٕSٕSSJSWSmSSSSSSSgSySSSSSSvSɞSS&ܤSS0Z@+.SWSfSSSSSŸSŸS۟SS"S3SASSáSS4SOSSݢSݢS)SkSkSSSSգSSS"S9S`SmSzSzSzSzSzSSSS@33@4S[@[@&ޥSSSnSSSǦSئSSS_ŞSSSSSSSSSSSS+S9S9SIStStSSSSSƪSتSSSSS׫SwS6ASS\@[@"ެSSSnSSǭSS!SSSSSS2SyS SS*S,S,SASWShShShSuSSSSSɱSֱSSSS6SXS]@\@5βSղSS^SSSSSrSSSٴSSSS.S3SaSSSյS!S!S!S;SnSnSSS׶SSSS/SMSbSrSSSSSSηSηS۷SUSZSZSS/SSS^@]@>>SESTSS"SĻSXSXSXSiS{SSS߼S߼SSSSS!SjSjSjSwSSSSɾSɾS|SSSSSdSSSSSDSDSDSDSFSXSXSXSmSSSSSSSSSSySSSSSS>4SS_@^@.~SSSSWS\S\SaSaStSSSSS[SSSESVSSSSSS*S*S*SSSSSSS'S'SSSSSSSSSSSSSSnS:SSqSSSS>ShS`@`@->SESTSwSSSSSSSSSSSSSSS%S6SDSkSkS|SSSSSSSSSS%S%S2SGSGSLSLS-S?SLS[S[SLSlS4S@b@a@JSSS'S8SSSSSSaSShS SSSSSS>SSS)SSoSSS(SIS[SlSnSSSSS#SmS(SS%S6SSSPSRShShShShShShStStSySSSSSSSSSSS;StStSySySSSSSSyS>vSSc@hb@R~SSSSSSSASFSFS[SnSSSSSS SSSSS9SISsSxS}SSSSSSSSSS:StSSSSSSSHS\SSSSSSSS(S(S(S(S*S,S,SKSMSOSOSzSzSzSzSzSSSSSSSSSSSSSSS6S-T<T1T> T Te@d@;TTTT[TTTTTTTTT;TKTcTTTTTTTTTTT\TpTuTuTTRTfTTCTCTPTTTTT"T"T.T.TDTDTDTQTyTTTTTV Th Tu T T TT@@@ 6 TUTUT5TTTT6 )T(Tf@e@9TT$TTbT#T0TnTT|TTTTTT TTTTTTTT T-T-T>T_T_TpTTTTTTTTTT TP!T!T!T8"T"T#T#T &T&T'T'T'TL(T^(Tk(Tz(Tz(T'T4+Tf@f@ )T)T)T)T*T/*T4*T4*T*T*T*T*T*T4*T33@R7Tn6T6*?T>Tg@0g@%7T7T7T7T8T8T8TF8T8TK9TP9TP9T|9T9T :T!:Tv:T;TT>T>T>T>T=T6JTJTh@g@+?T?T?T?T?T@T@T6@T@T;AT@AT@ATlATATATBTfBTCTCTCTDThDTDTETFTFTGTGTGTGTHT\T[TXj@h@]JTKT%KTKT%LT*LT*LTgLTlLTlLTLTLTLTLTLTMTMT MT=MT=MTLMT]MTrMTtMTMTMTMTMTMTMTNTNT#NT#NTMNThNT!OTAOTAOTSOT`OT`OT`PTPTPT0QTQTQTQT5RTvRT&ST2ST2ST2ST2STHSTHST`STeSTlUTlUTUTUTUTUTKVTKVTMVT^VTVTVTVTVTVTVTVTVT#WT#WTWT[XT`XT`XTgZTvZTZTZTl[T~[T[T[T[T`XT>mTHmTl@j@]\T\T\T]T]T]T]T^T ^T ^T4^Te^Tj^Tj^Ty^T^T^T^T^T^T^T^T_T_T)_T)_T._T._TN_T__T_T_T_T_T_T`T`T`T`T`TaTaTbTDbTbTbT*cTwcTcTcTdTdTdTdTdTdTdTdTeTeT gT gT%gT6gTRgTWgTgTgTgTgT]hT]hT]hTohT|hT|hT|hThThThTiTiTjTjTlTlTNlTNlT mTmT+mT:mT:mTjTKnT>qTqTl@8l@nTnTnT&oT8oTMoTRoTRoTwoToToTpTpTFpTpTpTpTlqT~qTqTqTqTpT>7wTvTxm@l@+^rTerTtrTrTrTsT\sTqsTsTsTsTsTtT:tT:tT?tTtTtTtTtTtTtTtTtTuTuTuTuT6uTFuT^uTluTluTxuTuTuTuTuTvTvTvTvTvTuT LjTvT1T6T7T n@m@TTT;TLTqTTُTTTTʐTTQTZT_T_TT TT)T)T_To@4To@Pn@/TTT7TDTWToTTTT˓TړTTTTTTITaTyTTTʔTTTT8TETXTpTTTT̕TەTTTTTT T TTȖTՖTTT T>TTp@@o@2nTuTTTTŗT"T"TGTkTTTTǘTTrTTTəTTTATlTyTTTTњTӚTTTTT T0T0T>TXThTTTTTTTTTTTTT>T;Tp@8p@%~TTTTT TT2T2TRT_TTTTT+TrTT0TXTjTTTɡTաTTTCTCTVT[T[TTTT.T.T[T6TWTq@q@'TTĤT`TTT@TTͦTTQTTTGTLT`TTϨTtTvTTT TTT?TTTTTT!T&T&TT.T;TJTJT&T4ӶT8s@q@XTT$TrTTt@Pt@T%T4TTgTTTTT,TTTjTTTTTTT7TTdTTTTTNTtTT$TT=T0TVTTTTT@TfTTTTTPTvTT&TT?T2TXTTTTTT T T3TTTTT2TXTTTTTBThTTTTgTgTTRTTTTTQTQTwTU]>U>U ?U@U&@U@U@U`AUAUBU6BUBUBUvCUCU&DULDUDUDUEUEUUUUUU#UUtUUUU͊UYUNjUNjUUU>UUUҍUU#UUUU|UUvUvUUaUU[U[UUFUҔU@U@UfU+UU%U%UKU՗UUUU5U[UU UUUUUQUUUЛU+UQUۜUUUU;UaUUUUUKUqUU!UUѡU[UU U1UUUkUkUUU#UoUUU+UwUUUU+UUۧUeUUU;UũUUuUUUU>UdUUUUЭUîUUsUU#UIUӰUUUU3U3UIUIUU;UQUrUU"UUҴU\UU U2UUUlUUUBU̸UU|UU,URUܺUUUU+V[+V+V+V+V+V,V=,Vg,V,V,V,V,V-VI-Vk-V-V-V-V.V+.VM.Vv.V.V.V.V /V//VX/Vz/V/V/V/V0V:0V\0V0V0V0V0V1V>1Vg1V1V1V1V1V 2VI2Vk2V2V2V2V3V+3VM3Vw3V3V3V3V 4V/4VY4V{4V4V4V4V4V4V4V5V36V6V7Vm8Vy8V~8V~8V9V9V9V9V9V~8V>YVXV؈@@:V:V:V6;VK;V`;Vz;V;V;V;V V.>V?V-?Vr?V?V?V @V)@VR@Vq@V@V@VAVAVAVBVDBVCVCVCV$DViDVDVEV:EVlEVEVEVEV#FVLFVkFVFVFVFVFV%GVDGVnGVGVGVGVHV1HVZHVyHVHVHVHV IV3IVRIV|IVIVIVIV JV+JVUJVtJVJVJV KV+KVTKVKVKVKVLV>LVgLVLVLVLVLV=MVfMVMVMVMVMVbNVNVNVNVNVOV;OVdOVOVOVOVPV&PVPPVoPVPVPVPVPV)QVHQVqQVQVQVQV'RVYRVRVRVRVrSVSVSVSVTV,TVKTVtTVTVTVTVUV^UVUVUVUVVV,VVVVVVVVWVJWVLWV_WVWVWVWVWVWVWVWVXVXVXVXVXVWV< fVh@@WYVYVYVZVDZV{ZVZV[V[V[V\V\V\V\VL\V\V\V]V]V]V ^V ^V ^V^V8^Vb^Vg^Vg^V^V^V^V^V^V^V_VH_VH_Vh_V_V_V_V_V_V_V)`V)`VI`Vt`Vt`V`V`V`V`V aV aVaV:bVhbVhbVbVbVbV&cVTcVTcVcVcVcVcVcVdVdV=dVkdVkdVdVdVdVdV0eV5eV5eVeVeVeVeVeV5eV>QjV jV@@fVfVfVFgVTgVgVgVgVphV}hVhVhVhVhViViViViViViViViV&(qVqV@kVkVkVlVlV:lV?lV[lV`lVxlV}lV}lVlVlVmVnVoVtoVtoVoVTpVTpVpVpVpVqVqV>~V ~V@@UqVqVqVsV-sVFsVmsVsVsVsVtV.tV[tV[tV[tVxtVtVtVtV:uVGuVduVquVuVuVuV5vVwvVwvVvVvVvVvVvVvVvVvVvVvV%wV`wVzxVxVxVxVxVxVxVyV.yVUyVyVyV3zV3zVFzVKzVrzVzVzVzV {VL{VY{V{V{V{V{V{V{V{V |VA|VA|V|V|V|V}V}V}V}V}V~V~V~V|V‚V|VAV%VwVDV V֊V)VV>yVV0@@)VVVV7VV-VIVVVVVVVVVVVVoVVVTVVVVVVVVVVV)V.V.VӕVVVVV.V4͜V@X@+VVVVVVVVV%VSVdVVVĘV՘VnVnVVV̙VVVTVTVcVVVVVVVNVSVSVKVZVVVVVVVSV6VGVX@8@EnVVV*VUVjV}V}VVVV$VVTVVVVCVCV~VVVVVVVVVVVVVV VVVV2V2VVRVRVWV VV@@AVV$V5VPViVnVnVpVVVVVVԶVVV V%VoVVVVVVVɼVɼVV]VmVVѽVѽVVVV$VsVοVοVVSVSVdVVVVVVVVVVVV4V4V9V9VRVdVqVVV9V>VV@@5nVuVVVVVVVVVV V V VVVVVV+V9V9VVVVVAVAVRV+V0VPVmVzVVVVVVVVV1V3VLVLVQVQVjV|VVVVQV6VVh@@'nVuVVVVVVVPVVVVV VVVVVVVVVVVVVV&V+V+VPV_VdVdV\VnV{VVVdV6VV@@CNVUVdVV#V8VgViVnVnVVV}VVVVVVVVVV?VfVyVVVVVVVVVVVVVVVQVaVrVVVVVVVSVdVVVVVVVVVVMVRVRVDVVVcVrVrVRV4AV@Д@.V5VDVVVVVV V VVV$V3V3V V4V@@@VVVV,VHVbVuVzVzVlV~VVVVzV V>VV@@7V%VVVVVVVVVsVVVV#VgVgV~VVVVVV!VV*VVVVVVVV VV)V)V?VV VVVVV,VBVZVVVVVVVVVV4GV8@Ж@VVV'VhVVV+VVVVVVVVTVjVoVoV VV*V9V9VoV>LVV@`@'VVV8VFVVVVV\ViVVVVVVVVVVVV V.VzVVVVVV+V+V0V0VVVVVV0V4bV@0@VVVV V:VVVOVTVV VrVrVVVV&V8VEVTVTVV@@W6WW`@И@!WWWWWW+WWWWWWWWWWWWWW WWW/WWWWW|WWWWWW6WWX@@2WWWWWWW< W} W} W\ W W{ W{ W W W W W W W W$ W$ W5 W: W: WN WN WF W_ WAWVW~W~W~WWWWWW!W!W!W&W&W~WWWWW&W6WW@@KnWWWWWWWW6WwWwWW~WWWW^WWWW4WIWrWrWrWrWWWWWWWWWWWWWW*W W#W;W~WWWWW3W3W3W3WSWLWLWLWXWoWWWWW:W:WsWWWWWWTWfWsWWWW6#W#WH@@^WeWtWO W} Wk!Wk!W!W!W!W!W"W"W."W."W."W3"W3"W|#W#W#W#W#W3"W6.W-WP@p@5N$WU$Wd$W$Wm%W&W'W'WP'Ww'Ww'W'W#(W8(W^(W^(W^(W^(W(W(W(W(W(W(W(W(W(W(W)W)W)W)W*W.*WI*WI*WN*W2+W2+W>+WY+W+W+W+W+W+W+W+W-W-W-W-W-W+W>3Wr3WP@x@3.W.W.W.W /W/W=/WP/WU/WZ/Wu/W/W/W/W/W0W0W!0W!0WL0W_0Wd0W0W0W0W0W1W#1W%1WF1WF1WF1WF1WF1Wa1W1W1W1W1W2W2WG2WG2WG2WL2WL2W73WI3WV3We3We3WL2W 7W6 AW@WH@@.7W7W7W7W8W8W8W8W8W79W9W9W9WT:Wz:W:W:W ;W5;Wq;W;W;W;WjW>W>W>W>W:?W??W??Wu@W@W@W@W@W??W6qSW#SW@p@(AWAWAW&BW-BWBBWWBWsBWBWBWCWCWDWEWnFWGWGWHW:IWJWJWxKWiLWMWNWiOW/PW4PWPW9QWQWQWRW#RW#RWRWRWSWSWSW#RW6VWUVW@@@SWSWSW%TWJTWTWTW&UW&UW+UW+UWVW,VW9VWHVWHVW+UW>ZWTZW @@VWWWWW%WW:WW|dWdW@h@%_W_W$_W;_Ws_Ws_W_W `W`W`W.`W\`W\`W`W!aW!aW/aWaWaW2bWNbWhbW{bWbWbWbWbWbWcWcWcWcWcWcWcWdWdWcW6mW.mW@0@3dWdWdW eWCeWCeWeWeWeWeWeW+fW+fWfWfWfWfWTgWdgWhWhW7hWJhWfhWhWhWhWhWiWiWiW,jW=jWBjWjWIkWUkWkWkWlWlW+lW+lW+lW0lW0lWlWmWmW!mW!mW0lW>gvWuW@0@/nW%nW4nWKnWnWnWnWoW"oW"oWBoWpoWpoWoW5pW5pWypWpWpWpWRqWnqWqWqWqWqWrWrWrWrWrWrWrWsWFsWdsWsWsWsWsWsWsWuWuWuWuWuWsW6W9WP@ @JvWvWvWwW1wWhwWmwWwWAxWfxWxWxWxWxWxWxWyWyWyWLyWLyWYyWwyWwyWyWyW+zWzWzW{Wi{W{W{W{W|W|W}W,~W;~W~W~WLWqWWWWWW3W3WRWWWWWfWWׁWWWWW8WWWvWWWӂWWWWWWW,W,WW>W4W@x@?NWUWdWWWWWWWWWWW0WhWmWW8W]WWÇWӇW߇W߇WWWWWWWWkWWWWWߋWWWWW-W_WȍWȍWۍWۍWWEW[WzWWWWWێWWWW WW'W'WW>WW@@D>WEWTWqWWWWWՑWՑWWWW WXW]WW(WMW~WWÓWϓWϓWWWWWWߕWWTWnWݖWݖWW WWWWWWWWW W=WoWؚWؚWWWWUWkWWWWW̛WWWWWWWWWWAW(WWWW4ȬW@(@NWUWdWWWʪWתWWWWW"WWWWWëWëWȫWȫWWWWWWȫW6WW(@@NWUWdW{WWWWWWIWWWWWWWWĮWĮWWWWWWĮW4`W@P@^WeWtWW_WW"W/W/W/W4W4W%W7WDWSWSW4W6rW?W`@ȩ@#WWW;WHWMWMW"WEWGWkWkW~WWXWWWWɶWܶWWW WWW,W9W9W>W>WWW"W1W1W>W6FWWX@@1޸WWW+W8W=W=WW5WYW[WWWWWƺWۺWWWW WWWWϼWWWWW%W8W:WGWTWYWnWWWWW W WWWӾWWWWWW4W@@@.WWWW4WWWWWWWWWWWWW0W=WBWWWWWWWWHWMWWWWWWWW;WWWWWWWWWWW>WJW@h@$nWuWWtWWWWW-WNW[W]WpWpWpWWWWpWWWWW#W#W#W#W2WEWEWJWJWW!W.W=W=WJW>mW#W`@(@ WW$WW$W)W)WWWWWW)W>8WW@@HWWWWWbWWWWWWWW&WSWWWWWaWWWWWWWaWWWW W WWdWdWWWWWrWWWWWWW@W@W@W@WWWrWWWWW,WoWWWWWWWWWWWWWWWWW>9WW@@@>WEWTWJWbWgWgWWWWWWWWWWWWWWW6WWد@h@WWW&WAWlWWWWWWWWWWWWWWWWWWWWWWW>WW@ @ nWuWWWWWWWWW+WWWWWWWW:WVWuWWWWWWWmWWWWWW>tW%Wp@а@%~WWW0WfWWWWWBWWW WWWWW#W[WnWsWWW-WJWWWWWWWWWW WWWW67XXp@@3XXXXX~X# X[ X X X Xh X X X X X X X X X X X XX!X!X/XJX_XrXrXX>XLXgXuXXXXXXXXXXXmXXXXXX>XlX@@XXX XRX_XXXXXXX1XCXPX_X_XX6XTXе@@.X%X4XuXXXXXX%XfXXXXX X X.XOXeXsXxXxXX@XVXdXXXXaXXXXXXXXX X XX*X7XFXFX Xw@px@ XB X@XB#X0@"XY@$X$X5X7XM:XwX>X>X>X(?X(?XH?XU?X~?X~?X?X?X?X?XD@XU@XZ@XZ@XZ@Xp@X@X@X@X@X@X AXAXAX9AXRAXWAXWAXAXAXVBXBXBXBXBXBXCX4CX4CXcCX%DX4DX4DXJDXDXDXDXDXDXDXDXDXDX/EX/EXJEX]EXEXEXEX FX9FX^FX~FXFXFXFXzHXHXHXIXIXIXIXIXHX6CPXPX@0@JXJXJXKXLX%LX*LX*LXvLXLXLXLXLXLXLXLXLXMXMXMXMXNXNXdNXiNXiNXOXOXOXOXOXiNX UX@SXZXhXkX(@*kXnXP@nXqXqXsXmtXctXwX xX<}X`@ع@yXyX$yXAzXezXvzXzXzXzXzXzXzX{X{XB{XX{XX{Xg{X{X{X|X|X|XQ}X`}X}X}X}X}X}X}X|X6XTXX@@1n~Xu~X~X~X~X~X~X~X~X~XMX]XbXbXbXxXXXXXXXXX X%X\XXXŀXX1XOXXXXÁXԁXXXXXXXXXX8XGXX<tX@@XXXWX{XXXXXXXXX4X]XsXsXXXXX!X!XXX9X9XKXXXgXgX!X6QXX @0@:.X5XDXDXTXXXXXX XX"X"X"X8XEXtXXXXXXXˋXXXLXdXXXXXXXXXXXӎXX%X%XOXeXwXXXXXXXXXXXXXXXXXXXҗX>rXߞX @x@'NXUXdX'X`XeXeXXəX֙XۙXۙXX|XXXX.X~XXXXXXXXXXcXhXhXZXiXXXXXϞXϞXhX>XXо@H@ޟXXXXϠXXXAX]XXXXXDXoXXɢXɢXɢX΢XXXXXXXnXXXXXX>XEXh@@XXX@XjX{XX֧XX XXXXXXXX@XEXEX XX)X8X8XEX>XXh@@4X&X5XnXsXsXXXXXXXX-X;XX¬XX*X/X/X=XTXbX9XGXX X X(X6XyXXXX±XݱXݱXݱXX$X$X)X)X5XDX|X|XXXXX)X>0XmX@@@*X6XEX~XXXXXXXX!XXXXXXXX̽XѽXѽXX'XTXTXoXoXoX~XXXXXXX/X/XAXNX]X]XXXXh@,XXNX4X@@@%XX$XXXXXJXLXYXYXlXXXXX8X=XfXXXXXXX X$X$X$XXXXgXyXXXXX4wX@h@.X5XDXbXXXXX'X4X[XhXuXXXXXXXXSXX@H@^XeXtXXXXX_XaXsXsXxXXXXXXXXXXXXXXXX>XcX(@@XXXpXXX+X+XXXX(X:XGXVXVXX>xXX @P@1.X5XDXXX$X$XLXvXXXXXXXXXXXXX0X0XEXtXXXXXXXXXZXXXXXXXXXXXXXXXXX>X*XH@H@=XXXXXXXX[XpXuXuXwXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXX!X!X6XoXoXXXXXXXXX XXXX6 YU Y@p@OXX$X9XvXX!XfXX5X5X5X5XPXXXXXXXXXXXXXXXYYYYYYEYYY\YYYYY-YYYYYYYYYYYY Y;YYgYlYlYY~YYY Y^ Y^ Y^ Yj YX Y] Y] Y Y Y Y Y, Y9 YH YH Y] Y4Y@@)>YEYTY|YYYYYYAY0Y0Y5Y5Y_YpYYYyY~Y.Y.YNYNY[YYYYYYYYzYYYYYYYYYY>bYY(@@YYY YYJYY!YYYYYYYYYYYYYYYYYYYvY]YoY6#Y#Y@p@!YYYYYY:YdYYYYYYY7 YJ Y\ Y Y Y2!Y!Y!Y!Y!Y!Y!Y!Y#YO#Ya#Yn#Y}#Y}#Y!Y>n2Y2Y@(@]$Y1$Y@$Y$Y$Y$Y%Y%YV&Yb&Yb&Yw&Y|&Y|&Y&Y'Y/'Y/'Y/'Y'Y'Y'Y'Y'Y'Y(Y(Y(Y!(Y(Y!)Y4)Y9)Y9)Y9)Y9)YV)Ys)Y)Y)Y *Y*Y*Y*Y*Y*Y*Y*Y>+Y`+Y}+Y+Y+Y,YG,YT,YT,YT,YT,Yg,Y,Y,Y&-YI-Y-Y-Y-Y-Y-Y-Y .Y .Yv.Y.Y/Y/Y/Y/Y/Y/Y/Y 0Y0Y0Y0Y0Y0Y1Y1Y1Y1Y2Y2Y0Y69Y}9Y@@@2Y3Y 3Y23YD3YY3Y^3Y^3Yz3Y3Y3Y3Y34Y4Y4Y4Y4Y4Y4Y5Y+5Y05Y05YM5Y^5Y5Y5Y(6Y56Y56Y56Y76YD6YD6Yg6Y6Y6Y6Y6Y6Y7Y7Y7Y7Y"7Y[7Y7Y7Y7Y7Y7Y7Y7Y8YB8YB8YB8YG8YG8YB9YT9Ya9Yp9Yp9YG8YT:Y6??Y?Y@@+:Y:Y:Y;Y;Y;Y ;YB;Yj;Y~;Y;Y;Y;Y;Y;Y;Y;YY>Y>Y>Y>Y>Y ?Y ?Y=Y6AYAY@@@?Y?Y?Y@Y&@Y7@YN@Y^@Yl@Y@Y@Y@YAYAYAYAYAY@Y6=EY EY@h@NBYmBY|BYBYBYBYCY,CYFCYYCYjCYCYCYCYDYDYDYDYDYCY>HY`HY`@@EYEYEYEYEY@FYMFYmFYoFYFYFYFYFYFYFYGYGY4GY4GY4GY9GY9GY%HY7HYDHYSHYSHY9GY>MYMY@@@,HYIYIY4IYIIYNIYNIYIYIYIYIYJY4JY9JY9JYnJYKYKYKYKY"KYCKYCKYTKYTKYnKYKYKYKYKYKYLY)LYILYKLY`LY`LYeLYeLYWMYiMYvMYMYMYeLY4PY@h@NNYUNYdNYtNYNYNYNYNYNYOY$OYROYWOYWOYRPYdPYqPYPYPYWOY4VY@@%QYQY$QYeQYjQYjQY|QYQYQYQYQY#RYRYRYSYTSYSYSYSYSYSYSYTYTYTYTYTYTYdUYdUYiUYiUY[VYmVYzVYVYVYiUY>{YY6YY@@.WY5WYDWY|WYWYWYXYXY XY XYXY YYYY)YY)YY XY>]Y\Y@ @YYYYZYpZYuZYuZYZYZYZY[YK[Y[Y[Y[Y[Y[Y\Y\Y\Y\Y\Y[Y6cYcY@@6~]Y]Y]Y]Y^Y^Yi^Y^Y^Y^Y?_Y`_Y`_Y_Y_Y_Y_Y_Y_Y_Y.`YK`YX`Y]`Y]`Y]`Y]`Ym`Y`Y`Y`Y`Y`Y`Y,aY9aY;aY~aYaYaYaYaYaYaYaYaYaYbYbYfcYxcYcYcYcYbY>iYGiY`@@*NdYadYpdYdYdYdYdYdY eY2eYVeY|eYeYeYeYfY7fY]fYfYfYfYfYgY>gYcgYcgYgYgYgYgYgYgYgYhYhY hY hY iYiY+iY:iY:iY hYjY4}nY@@jYkYkY5kYJkYkYKlYKlYPlYlYKmYKmYKmYKmYPmYPmYBnYTnYanYpnYpnYPmYqYcqY6YAY @0@9rYrY$rYrYrYrYCsYsYsY0tY?tYtYtYXuYvYqvYvYwYSwYrwYwY5xYxYxYyYyYyY^zYzYs{Y{Y{Y$|Y|Y|Y}Yb}Y}Y}Y ~YjYYYYYYYYY\YaYaYYY%Y4Y4YaYMYY6fY*YX@X@>YŇYԇYYYYbYYYYY)YJYWYWYYYYY'YYYYYYY-YhY؋YYYYYYYYYKYXYZYZYZY\YYYYYYYY#Y0Y0Y0YNYSYSYYYYYYSY Y ǐY6YY`@@>YEYTYΑYYY$Y^YXYvYsYsY_YYY;Y՗Y4YYY٘YYYYIYYYYўYўYYDYDYYYޠY YYYYYYYhYYY|Y|Y|YY Y5Y^YtY8Y8YYȦYGYoYYIYIYIYIYKYŨYŨYըYY^Y˩Y۩YYYYYY YY(Y5Y|YYYӫYY YY?YOYvYYYYYYY(YLY\Y\Y}YYYYͭYͭYͭYYY Y Y Y#YѮYYY"YYYiYYY9YIYͰYݰYݰYݰYݰYYY\YrYƸYmYmYmYYYYYYYԼY YlYYYY:YYYYYYYYYYY)YYYYYxY}Y}Y@YRY_YnYnY}Y6YdY@@QY%Y4YWYYYYYY(YYYMYAY.YcYPY=YY9YY+Y`YlYYYYYYSYYYYY?YLY\YYYYYY/Y#YYY2YYYCYSYxYxYxYYYYYYY Y5YXYZYYYYYYYJYSY`YYYY)Y;YHYWYWYY6YYh@@NYUYdY{YYY9YYYY(YY>YYYYYY{YYYYYY6YY@@D^YeYtY`YYYZNZSZSZSZfZZZZZZZ:ZXZdZ{ZZZZZZZ-ZZZZZZZ&Z&ZZFZKZZZZZZ/ZCZ?ZWZ\Z^ZwZZZZZZ$ZfZZZZZZZ Z Z%ZLZZZZZZZZ5ZZZZ Z ZZmZZZZZZZZZZNZNZZZZZZZXZhZ{ZZZZZZZZZZZZZZZZZ0ZZZ Z Z Z Z Z Z Z Z Zv!Z{!Z{!Z!Z"Z"Z"Z"Z"Z"Z#Z#Z#Z$Z$Z$Z$Z%Z%Z.%Z%Zo&Z&Z&Z&Z&Z&Z&Z&Z'Z'Z*(Z*(Z*(ZF(Z^(Z(Z)Z)Z)Z)Z)Z*Z-*Z*Z*Z +Z +Z+Z#+ZS+ZS+ZS+Zg+Z+Z+Z+Zw,Z,Z,Z,Z,Z,Z,Z,Z:-Z:-Z:-ZM-Zr.Z.Z.Z.Z.Z.Z.Z/Z/Z/Z/Z/Z/Z0Z/0Z/0ZM0Z^0Z0Z0Z0Z0Z0Z1Z1Z,1ZB1ZS1Zh1Zx1Z1Z1Z1Z1Z1Z1Z1Z1Z1Z2Z#2Z@2ZT2Zq2Z2Z2Z2Z2Z2Z2Z3Z3Z$3Z$3ZA3Z]3Zs3Z3Z3Z3Z4Z4Z-4Z;4ZJ4ZJ4Zg4Z4Z4ZW5Zl5Z5Z5Z5Z5Z5Z6Z6Z-6Zh6Z6Z6Z6Z6Z6Z!7Z77ZH7Zq7Z~7Z7Z7Z7Z7Z 8Z 8Z8Z(8Zc8Zs8Zu8Zw8Z8Z8Z8Z8Z8Z8Z8Z8Z8Z8Z8Z&9ZA9Z9Z9Z :Z:Z9:ZJ:Zq:Z~:Z:Z:Z:Z:Z:Z:Z;Z:;ZU;Ze;Zv;Z;Z;Z;Z;Z;Z;Z;Z;Z;Z;Z Z2>ZB>ZS>ZX>Zi>Z>Z>Z>Z>Z>Z>Z)?Z9?Z9?ZJ?ZX?Z?Z7@ZT@ZT@ZT@ZT@Zd@Z@Z@ZHAZHAZAZAZAZ7BZ7BZTBZBZBZBZBZBZCZCZICZVCZVCZfCZxEZ}EZEZEZEZEZEZEZEZ FZFZ*FZ/FZJFZ\FZaFZ|FZFZFZFZFZFZFZFZFZ GZIZIZIZJZJZJZ8JZJJZOJZjJZ|JZJZJZJZJZJZJZJZJZKZ%KZ*KZEKZWKZ\KZwKZKZKZKZKZKZKZKZKZ LZ LZ%LZ@LZRLZWLZrLZLZLZLZLZLZLZLZLZMZ MZ(MZ-MZHMZMMZhMZzMZMZNZNZOZOZ+OZCOZeOZxOZxOZOZOZOZOZOZOZPZ(PZ9PZIPZIPZIPZIPZ`PZPZPZQZ%QZQZQZQZARZzRZRZRZRZRZRZ'SZJSZcSZySZSZSZSZSZTZUZUZUZUZ,UZEUZVUZVUZVUZsUZUZUZUZVZ|VZ|VZVZWZWZ2WZCWZCWZCWZUWZfWZWZWZWZWZWZWZWZXZXZ%XZ=XZKXZKXZ[XZtXZXZXZXZXZ4YZYZYZYZYZYZYZZZZZZZC[ZU[Zb[Zq[Zq[ZZZff@$@]Z6OaZaZ@@@#^Z&^Z5^ZJ^Z^^Zc^Ze^Zx^Zx^Z^Z^Z^Z^Z^Z^Z^Z_Z*_ZK_Z_Z_Z_Z_Z_Z_Z_Z2`Z7`Z<`Z<`Z`Z`Z`ZaZaZ<`Z6jZRjZP@@QaZaZaZaZ+bZqZpZh@x@9kZkZ$kZ9kZSkZhkZkZkZkZkZkZlZ#lZ8lZWlZllZlZlZlZlZlZmZ'mZZkZ@ @$.}Z5}ZD}Z_}Z|}Z}Z}Z}Z}Z}Z1~Z1~Z1~ZB~Z~Z~Z~Z~Z~Z3Z3Z5ZRZ_ZZZZZZZZ0ZBZOZ^Z^ZZ>UZZ0@@ZZ$Z[ZlZZZ'Z'Z:Z?Z?ZՂZZZZZ?Z>ZʅZ@X@ZŃZԃZZ!ZdZZZZZZZZZZZZZ>ΉZqZ0@@nZuZZZȆZZ)ZZȇZvZZZZZZZ6ZHZUZdZdZZ6fZZ@X@ >ZEZTZhZZԋZ%Z6ZDZDZmZ~ZZ׌ZZgZ Z Z Z ZZ4Z4Z@Z@ZEZEZZZZZZEZZ6ZtZ@@ZZZCZpZZZZZZƔZZZZ&ZVZcZcZcZcZcZcZhZhZ9ZKZXZgZgZhZ6ZИZ@@Z%Z4ZgZzZZZZėZėZZZZØZØZėZZ4Z@@@-ZZZ'ZBZfZZZZZZZZ+ZNZZZ]Z_ZoZqZZZZZZМZ6Z6Z6Z6ZLZcZ{Z{ZZZxZZZZ˞Z؞ZZZZP@ ZZ ԢZ ZZ˥Z6XZZ@@!nZuZZZZZZZZZ+ZIZIZZZZZZZZZ Z%Z%Z*Z*Z/Z/Z٫ZZZZZ/Z6,Z޶Z@8@"ZŬZԬZZZZ8Z=Z=ZͯZZZϱZԱZԱZԱZ>ZZZZZZZZZQZZZZZZ¶ZѶZѶZZZ޸Z>6Z޼Z@@$>ZEZTZZZZZȹZZZ$Z$ZJZJZiZzZZZZKZKZ[ZlZyZZZƻZƻZۻZZZZZ¼ZѼZѼZZֽZ>Z5Z@@8>ZEZTZ`ZZZZZԾZ Z>ZZZZZZZZĿZZ.Z.ZVZZZZ:Z:ZZZ7Z9ZBZBZRZTZTZYZZZZZZZZZZZ2Z7Z7ZZ ZZ(Z(Z7ZZ\ZZoZ_Z)Z@ZZ+Z8@ZZ4Z@p@>ZEZTZvZZZZZZ,ZBZOZOZ^ZZZZZZZZ Z ZZZZZZ ZZZlZaZtZ Z ZZiZOZZZjZ`ZZZZZ>~[+[@@Z1Z@ZZZZZZZZZ[[[[Z6[U[@0@[[[f[k[k[[[[[[ [[[[,[9[H[H[[6/ [ [@@@![[$[3[[C[>[>[M[[["[[[[[[ [<[P[P[{[[[[[[[ [ [ [ [ [[69[m8[@h@ [ [ [N [ [ [ [ [ [ [ [ [ [_ [d [d [ [ [ [ [ [ [ [ [2[C[[[[[[[H[[[[([n[n[[[[ [$[O[O[g[[[[[[([-[<[[[[[z[[[[[[[[.[C[Q[b[r[[[[[[[C[[[[[[f[[[[W[W[l[[[["["[M[^[l[|[[[[ [[[[[W[W[h[[[[A[[[[![#[0[0[0[A[w[[[[0 [0 [A [P [ [ [![![]![![![![![!["[#"[2"[G"[U#[v#[#[#[/$[/$[4$[I$[W%[h%[%[&[&[&[&[&[&[&[&['['['['['[,'[M'[i'[!([!([!([!([2([B([U([k([([([)[*[(*[(*[-*[*[*[*[*[+[+[+[+[+[+[2+[B+[O+[+[+[+[+[+[+[+[+[+[+[,[#,[#,[#,[/.[m.[.[.[.[/["/[;/[Q/[j/[/[/[/[/[/[0[*0[F0[b0[x0[0[0[0[0[0[1[*1[;1[b1[y1[12[12[\2[2[3[3[3[3[3[3[ 4[ 4[ 4[N4[d4[w4[4[4[4[&5[+5[+5[T5[6[6[ 8[ 8[8[,8[;8[;8[M8[\8[\8[+5[ ;[=[=[6#H[G[AA1N>[U>[d>[p>[>[>[?[?[?[@[@[A[B[B[B[:B[eB[B['C[4C[7D[^D[D[E[E[E[E[E[E[E[F[F[F[F[6F[QF[QF[dF[wF[F[F[F[F[F[G[G[G[G[G[F[6X[X[AA>H[H[H[H[ZI[I[MJ[J[J[K[0K[K[$L[L[L[L[M[M[EN[N[ O[ O[dO[O[O[P[P[}][][A8AnY[Y[Y[Y[}Z[Z[Z[Z[[[[[[[[[\[\[\[\[\[[[4`[0AA][][][ ^[^[C^[b^[s^[^[^[^[ _[_[]_[]_[]_[]_[__[~_[_[_[_[_[_[_[t`[`[`[`[`[_[<;c[AXA>a[Ea[Ta[sa[a[a[a[a[a[[E[T[d[i[i[([:[G[V[V[i[ [[[[[[4[AA[[[[g[[[[[[[[[[`[ɰ[.[:[?[?[ձ[[[[[?[6[[H A AH[[[[Ȳ[ݲ[[[[[[[ն[Ʒ[[[m[H[#[[ٽ[[[j[E[ [[[[[g[B[[[[[[d[?[[[[[[a[<[[[[[[^[9[[[[[[s[.[D[[M[[ [[[[[[[[[6%]%]`Ap AN[U[d[[[[[[[[[k[O[e[[n["[.[:[Z[[[[[[[[[w[[[?[#[[[[[[[[![[[[[[[[R\i\\\ \!\\2\I\\\\^\u\\\\,\.\E\E\b\z\^\B\&\ \\ \ \ \~ \b \F\*\\\\\\\.\\q\}\\\L\g\\\\G\\\o\'\\\O\\\w \/!\!\"\W#\$\$\%\7&\&\'\_(\)\)\*\?+\+\,\g-\.\.\/\G0\0\1\o2\'3\3\4\O5\6\6\w7\/8\8\9\W:\;\;\<\7=\=\>\_?\@\@\A\?B\B\C\gD\E\E\F\GG\G\H\oI\'J\J\K\OL\M\M\wN\/O\O\P\WQ\R\R\S\7T\T\U\_V\W\W\X\?Y\Y\Z\g[\\\\\]\G^\^\_\o`\'a\a\b\b\b\8c\Sc\ d\d\{e\3f\f\g\[h\i\i\j\;k\k\l\cm\n\n\o\Cp\p\q\kr\r\r\r\r\s\t\yu\]v\Aw\%x\ y\y\z\{\|\}}\}\ ~\~\R\^\{\\w\[\?\#\\\\&\\\,\D\(\>\\G\#\/\S\j\\\\\\\\\~\w\p\i\b\[\T\M\F\?\8\1\*\#\\\\\\\\\\ݧ\֨\ϩ\Ȫ\\\\\\\\\\\{\t\m\f\_\X\Q\J\C\<\5\.\'\ \\\ \\\\\\\\\\\\\\\\\\\\\x\q\j\c\\\U\k\\\\\\\\\\x\q\j\c\\\U\N\G\@\9\2\+\$\\\\\\\\\\\\\\]]]]]]]]] ]| ]u ]n ]g ]`]Y]R]K]D]=]6]/](]!]]] ]]]]]]] ]!]"]#]#]($]>$]$]$]$]b%]t%]%]%]%]$]@6T]R]AA&]']']']']']']']']']']'](]=(]E)] *]*]/*]@*]B*]*]*]*]*]*]+]+]5,]Z,]c,]o,]{,],]-]0-]T-]T-]]-]-]-]-]-].] .]M.]Y.].].].].]1/]=/]}/]/]/]/]0]!0]a0]m0]0]0]0]1]E1]Q1]1]1]1]1])2]52]u2]2]2]2] 3]3]Y3]e3]3]3]3]3]=4]I4]4]4]4]4]!5]-5]m5]5]M6]7]7]{8]8]9]9]9]9]:]V:]w:]:]B]B]QO]O]O]O]O]^P]P]P]P]0Q]Q]Q]Q]iR]yR]R]R]R]R]R]Q]S\]?\]%`]b]6Ԏ]]AAz.c]5c]Dc]c]Ad]d]ze]ze] f]'f]7f]7f]f]f]^g] h]rh]i]Di]i]j]j]j]k]k]fl]l]8m]^m] n]0n]n]o]o]o]p]p]Rq]xq]$r]Jr]r]s]s]s]t]t]lu]u]>v]dv]w]6w]w]x]x]x]y]y]Xz]~z]*{]P{]{]"|]|]|]}]}]r~]~]D]j]]<]]]]]]]^]]0]V]]x]]J]p]]]]]*]*]B]_]d]]]]]]]Ί]Ί]]ڋ]o]o]]]]]]]P]b]o]~]~]]6Ͷ]ٵ]AArN]d]s]7]]M]R]R]]]]]Ғ]Ғ]]]]]]]Ɣ]Ɣ]D]ߕ]\]ǖ]/]]]a]f]]]]]]]Ϛ]]]]%]F]F]%]c]v]]];]O]`]]]]]]]]]]ע]]]#]#]9]Z]{]{]]>]Ϩ]Ԩ]]]]]]8]4]U]W]W]k]|]]]]]]]']]8]K]f]]]]]ݳ]ݳ]ݳ]ݳ]]\]a]a]]]]ɵ]ɵ]a]66]r]PAAR]]ķ]>]V]n]]],]B]D]Z]Z]]s]]]]]]]Ҽ]]]]]]Y]f]f]y]]ʾ]]]]]]u]]]]]]]^]]J]]]]$]]]]M]8]]]]]]].]?]d]d]d]t]]]]]]U]Z]Z]]3]E]R]a]a]Z]6^ ^8AxAm]]]]]]]]]])]]3]]2]G]G]]]]]]]]]]]]=]P]k]{]]]]]]]]_]d]]>]W]t]]]]]]]]]]G]]!]:]W]|]|]|]]]]&]H]M]M]]]]])]]]]j]]]]]k]]]*]]]v]`]e]O^9^^^^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^^^4^ApA ^^^^^^^^^^^^6$K^LJ^ AA^^^w^^^^A^A^F^F^^^^^^^]^b^b^^"^"^^^^c ^ ^e!^!^?"^Q"^V"^V"^#^#^#^#^#^#^#^$^$^N$^$^$^%^X%^%^&^Z'^'^'^(^(^'(^B(^[(^)^)^)^)^)^)^)^)^ *^r*^r*^*^*+^F+^,^,^,^@-^@-^S-^n-^-^.^-.^>.^c.^c.^c.^h.^/^/^ 0^2^(2^}2^2^2^;4^q5^6^:^W:^i:^:^:^:^;^;^=^=^=^>^>^>^>^>^ >^>^>^F?^?^A^A^D^4E^FE^E^E^E^E^E^H^H^*H^OH^OH^OH^TH^TH^H^H^H^ J^J^,J^;J^;J^H^ A6[^lZ^AHA1>L^EL^TL^L^?M^DM^DM^M^N^N^P^QQ^qQ^qQ^Q^R^/R^HT^vT^T^U^U^U^KV^V^V^V^V^W^W^W^W^W^W^W^W^X^X^QX^X^Y^Y^Y^Y^-Z^?Z^LZ^[Z^[Z^Y^TA6s^[s^X AHA\^\^]^~]^]^]^]^]^]^]^^^2^^B^^B^^T^^^^^^^^^^)_^;_^@_^B_^G_^G_^G_^_^_^^`^~`^`^`^`^&a^9a^Ta^ma^"b^6b^Gb^lb^lb^b^b^b^b^b^b^b^ c^c^d^nd^d^d^me^me^e^Nf^f^f^f^g^*g^g^g^h^)h^)h^)h^)h^lh^lh^h^h^h^h^h^"i^'i^'i^\i^i^;j^[j^`j^xj^j^j^j^j^k^k^k^k^k^k^k^0l^l^5m^m^m^n^n^n^n^uo^o^ p^p^8p^Qp^q^q^(q^Mq^Mq^Mq^Mq^q^ r^r^r^r^s^1s^>s^Ms^Ms^r^6=^^X$A At^t^t^>u^du^u^u^u^u^u^u^v^v^Av^iv^v^1w^Dw^_w^xw^w^x^x^x^ y^ y^y^y^Jy^\y^y^y^y^y^z^&z^+z^0z^Hz^z^z^z^z^{^{^{^{^{^|^|^|^|^L|^|^|^a}^}^}^}^}^)~^<~^W~^p~^#^7^H^m^m^^^^^^^^ ^l^^€^Հ^^ ^^Ё^^^^S^e^j^l^q^q^q^^^T^^^d^^І^І^0^^^F^a^^^È^ӈ^ӈ^ӈ^ӈ^^F^W^h^~^^ԉ^^^^Ί^^^^^^^Y^^^^ˋ^~^^^t^^^^^^^1^G^^^ގ^^F^^%^E^J^b^^^ΐ^^^^^^^^^^M^^ǒ^^^3^L^^^$^I^I^N^N^^S^^^=^^^`^^^h^^^^^#^3^3^3^3^v^v^v^^^Ț^^^1^L^e^^.^?^d^d^d^^М^^^^̝^^^ž^Ξ^Ξ^Ξ^H^M^M^^]^o^|^^^M^6^^&A$A~>^E^T^t^^^^^^^â^آ^آ^F^^!^-^2^2^+^8^8^y^^^^^^^^Q^r^^^¦^^ާ^ާ^^X^X^Ȩ^ ^ ^3^^^m^r^r^^Ʃ^%^9^>^>^^^˪^^G^\^o^o^o^o^^^«^«^^^;^Z^^ͬ^^ ^E^a^^F^~^Ү^&^&^z^^n^s^^^^^^^^^ձ^D^^^۲^^^^^´^Ǵ^ٵ^ٵ^ٵ^^^^^M^^ŷ^ʷ^^^^]^o^|^^^^4ڽ^&A&Aκ^պ^^!^\^\^^ݼ^ݼ^^ ^ ^^^^ͽ^ͽ^ ^68^f^(A 'Al^^e^t^^^.^ȿ^c^^^;^^{^^^[^^^5^^2^@^@^^^ ^^^X^^x^^^^^^^^^]^^k^k^^^v^^^^^^^Q^a^s^^^^^^^^^^^^^^@^@^S^n^^^^:^:^^^^^^J^X^]^^&^7^\^\^\^\^l^q^^^^^^J^O^O^^(^:^G^V^V^O^4e^`)A)A^^$^e^^^^^^^^^^#^3^8^8^*^<^I^X^X^8^6__@+A)Ak^J^Y^^^^(^@^X^s^ ^^B^^H^^^(^^h^^^^^^^^^^^^^^^^^'^'^>^^J____K__;_;_Z_o_o_o____?________ _] _o _ _ _ _ _ _(_T_}____@__0_5____ ____ _ _ __ _6_6_;_]____________6(_R(_8,Ah+A1!_%!_4!_!_!_"_"_"_#_ $_$_4$_4$_R$_t$_v$_$_$_$_$_$_%_%_%_"%_P%_~%_%_%_&_S&_c&_c&_o&_|&_&_&_&_&_'_'_v'_{'_{'_(_)(_6(_E(_E(_{'_6__84A`,A.)_5)_D)_)_)_*_D*_p*_*_*_*_ +_L+_x+_+_+_+_(,_T,_,_,_,_-_0-_-_)._._s0_0_/1_W3_3_h4_5_6_ 7_18_`8_8_8_8_8_8_8_8_8_9_#=_=_=_+>_>_>_ ?_4?_A?_b?_?_?_@_ A_1A_A_A_A_A_rB_B_B_B_=C_wC_C_C_C_|D_ E_E_E_E_E_E_F_F_F_F_F_G_G_ H_H_H_H_H_H_H_H_=I_I_I_I_I_BJ_J_J_J_J_J_J_2K_DK_K_K_K_K_K_K_ L_JN_N_O_?O_?O_SO_dO_O_O_O_O_O_O_O_O_%P_YP_P_P_P_Q_/Q_UQ_Q_Q_Q_Q_+R_WR_}R_R_R_nS_S_5T_T_V_V_W_UW_eW_W_W_W_W_X_vX_vX_vX_X_X_`d```` `F`l```` `1 `W ` ` ` ` `- `S ` ` ` ` `) `O `{ ` ` ` `% `K `w ` ` ` ` ``````"`_``````X`d````I``@`P`l``` ` `````````,`T``'`3``````2`0`h`|`|`|````+`M`f````E``8`K`f``d `x ` ` ` ` ` `.!`!`!`"`"`"`9#`$`$`$`%`6%`K%`j%`%`%`%`%`%`s&`&`1'``'`'`'`'`G(`G(`G(`G(`G(`G(`_(`l(`|(`(` )`)`f)`h)`)`)`+`+`+`@+`Z+`Z+`r+`+`+`5-`:-`Y.`Y.`o.`U0`U0`0`0`0`-1`21`J1`1`1`1`1`1`1`1`2`R2`I3`3`4`4`E4`4`(5`<5`<5`M5`r5`r5`r5`r5`~5`~5`~5`5`6` 6` 6`6`6`6`6`6` 6`4;`:AP:A9`9`9`:`":`8:`N:`:`:`:`K;`];`j;`y;`y;`:`4?` ;A:A<`<`$<`<`<`<`=`<=`=`=`=`>`N>`>`>`?`?`?`?`?`?`?`?`6DD`D`;AH;AN@`U@`d@`@`@` A`FA`A`BB`RB`RB`^B`B`B`B`B`EC`JC`JC`C`C`C`D`D`JC`6G`F`@A>A e`e`e`e`e`e`f`f`f`g`g`e`6v`v`?A`>A+g`g`g`2h`Jh`eh`h`!i`i`i`k`n`n`o`o`4o`Zq`nq`q`q`q`q`q`r`r`r`r`s`2s`Et`Yt`jt`t`t`t` u`u`u`u`u`u`u`u`u`6`<`PAA@?ANw`Uw`dw`w`w`x`ey`y`z`z` {` {`{`{`q|`q|`~`~``,`1`_```````_```ˀ``h`|``````g```````/````<`<````y`]``^````0`Q``k`k`k`k``ʑ`ݑ```y``````.`.`.`(`<``>`Z`Z`k````Е`Օ`O`v```"`5`P`i`}`````-````*`=`X`q``````5`:`:````+`+`:`@@6``CAAA[``$```M``E````Ĥ```4`Y`Y``ǥ``Ħ`Ԧ`Ԧ`٦``F`W`i`i`i`````Ҩ````}`}`````0`C`^`w`````ү`````````2`J`^`o`````````5`z`v``````W`v`````ʷ`׷````6``CA(CA-``Ĺ````#`ֺ`/``i`}``T`````!`&```޾````````>`@`@`@`E`]`]````G`Y`f`u`u```T```6`.`DA0DA^`v````,`J`i```H````-`F`[`o``````+`0`0````!`!`0`6`^`FADAf`%`4``I``s``(```N``````````````I``i````t``` `$`=` `4`E`j`j`j`v`{``;``5`c```.``````G````````````````2``-`w`````X`k````````````W`\`\``1`>`M`M`\`6CaSCaSCanCanCaCaCaCaCaCaCaCaCaCaDaDaDaDaDaCa$\a[a6YmalahMAHLAE\a\a\a.]a]ad^a^a``an`a`a`a"aa=aaxcacacacacadadaa>a>a_aaaaaaaِaaaFakaaaaa&adavaaaaa'aaaaaЙaЙaajaaaaaaМaa^aa˝a˝a˝a;aaaaaӞa aaaaaJaԢaa$aaaaaգa9a4aHaYa~a~a~a~a~aŧaܧaaaaa aaaaNa`ama|a|aa4`aPAPA aa$a4a9a9a%a7aDaSaSa9a6½aaQAQA+aaa~aaa!aaaaa{aa*alaaaaa#aajaaaaa.aZaaaaaaJapa aaaZaaLa!aa aa7aPaaaaaaaa aaaaaPabaoa~a~aa4aUATA NaUadatayayaeawaaaaya6abaVA@UAPa%a4aaa aaaAaFaFaiaaaaaa"aDabaaaaa@ajajaaaaa6aaaaa a'a'a3azaaa a a aTauaaaaa.aOaaaaaAabaaaaaaoaaaaaaa|aaa&a8aEaTaTaa6& bbWAVA6nauaaaaaaa%aHataaaaa!a!aaa(aJaaab-bwbbbb[b]bbbbbbBbUbbbbbb4b4bHbMbMbfbzbbbbbMb6[ebRdb[AWA b b b b bK b b b b.bJb#bKbPbwbwbbbbHbHb^bbb]bbbb bFb^bbbbCbSbxb-b-bCbbbbQbbr bw b b b bV!bV!b!b!b!b$b$b$b$b$b$b%b%b%bY&br&b&b&b&b'bK'bc'bc'b)b)b)b4*bD*bD*bD*bZ*b*b*b*b +b+bA,bF,b\,bl,b,b%-b%-b`-b{-b-b0b0b60b60b60b60by0by0b0b0b0b0b!1b*1bL1b1b2b 3b3b5b5b6b8b8b;b;bb;b=b->bt?b?b?b?b@b.@bf@b~@b~@bBb CbJCb]CbxCbCbFbFb&FbKFbKFbKFbFbFbFbFbFb+GbGbGbGbGb Hb"Hb;HbTHbmHbHbHbHbHb?IbIbJbrKbwKbLbLbLbMb-MbMbMb$Nb5Nb7NbHNbHNbNbNbObQb&QbSbSbSbSbSbSbSbSbwTbTbTbUb*Ub*UbUbUbUbUbUbUbVb$Vb$Vb;VbVbVbWbWb0Xb@XbXbXbFZbVZbVZbVZbZb_b `b`b8`bQ`bvbbbbbbbbbbbbbbbbbbKcbPcbPcbdb%db2dbAdbAdbPcb4phb[A[A gb%gb4gbDgbIgbIgb5hbGhbThbchbchbIgb6ьbb(]A \A@hbibibib)jbjb1kblbmbmb&mbmbmbpbqb]rbasbasbsbtbtbwbwb7xbxbxbxbxbxb yb&yb{b}b~bBbb'bbbbb~bbbbԉbԉbԉbb(bc>c>c>c>c>c>c>c?c?c?c?c7?c?cN@c@cBcBcCckEcFcFcFcFcJGcGcGcGc!Hc.Hc.HcHcHcHcHcHcHcHcHcHcIcIcMclMc~McMcMcMcNc/NcPNcOcOcQcRcRcRcRcRcScScSc%Sc%Sc*ScSc_TcTcVcVcWc1XcAXcfXcXcYc'Yc'Yc6YcpYcYcYcYcYcYcZcZc[c[c^c!_c3_c_c_c_c_c_c`c;ac;acCccaccdcdc*dc;dc`dc`dc`dcldcqdcdcdcdcecececececdc4ic gAfA gcgcgcgcgcgcgcgchchcicicicgc6vcMvcXhAHgABicicic.jcjcjcjcjcjcjcjcjcjkcokcokcokc}kckckclclclclclclclcmcmc'ncncncncncncocococococtpcpcpc.qc.qcAqc\qcuqcprcsc[tcotctctctctctctctcJucOucOucvc$vc1vc@vc@vcOuc4xchAhA NwcUwcdwctwcywcywcexcwxcxcxcxcywc6ΡccXlAhA.yc5ycDycycyc7zcWzczczczczczczczc|c0|c5|c5|c|c|c|c}c}c}cH~c~c~cccc-c-c-c-c2c2cc1ccPcPcUcUcccc΅cc=cccΆcކccccccc6ccۈcc ccccc5c{ccccʉccccccccΊcߊcOccccccc-cFcScycccccccdcʍccc&c&cccc cmccϏccccc$c4c6c6c6cBcBcBcBcZcrctccccccccccc c=c^cccccccc9c9c9c9cgccccccÔc۔cccKcpcccccc|ccc˘c5c5c5c:ccccccCcVcqcc$c@ccccccc ccBcBcBcBcBcBcNccc̞c̞cޞccc!ccccڠcccccc6qccnAlAcccccVcLcOccccccccfccbccתccjczcc0c@c@cnc~c~c~cccVcicccccc#cHcHcHcHcTcTcTccccc-c³cdccccccõcicicicnccccKcKcKcKcWc cùc,c,coc%c߻ccۼc cPccccc!c:ccccccccccc4cJcccc%cWccccc1cJccccccccccc?c?c^cccccccccc6d?d@qAnAccc^c~ccRccHcc>cc4cc*cc cccc cccc!c!cAccccjcc c7ccJccwccc;ccccccc+cQc1cAcFcFc%cEcczczcccccccc8cPcicicicicccccc c#c5cBcBc\crccccccNccccccGcGcccccfccNcdcxccccEccccccc_cccc/dddddd+dCdddd&d8dddddd'ddddd<d<d<dHdHdddddd d/d/dd6Kdd`wAhqA{ d d$ d< dO dm d d d d& d dl d d dUddd>ddd'ddmdddVddd?ddd(ddndddWddd@ddd) d do!d"d"dX#d#d$dA%d%d&d*'d'dp(d)d)dY*d*d+dB,d,d-d+.d.dq/d0d0dZ1d1d2dC3d3d4d,5d5dr6d7d7d[8d8d9dD:d:d;d-d>d\?d?d@dEAdAdBd.CdCdtDdEdEd]FdGdGdFHdHdId/JdJduKdLdLd^MdNdNdGOdOdPdEQdQdRd.SdSdtTdUdUd]VdWdWdFXdXdYd/ZdZdu[d\d\d^]d^d^dG_d_d`d0adadvbdcdcd_ddededHfdfdgd1hdhdwidjdjd`kdldldImdmdnd2ododxpdqdqdardsdsdJtdtdud3vdvdywdxdxdbydzdzdK{d{d|d4}d}dz~dddcdddLddd5d؄d{dddddddMddd6dًd|dddedddNddd7dڒd}d dÔdfd ddOddd8dۙd~d!dědgd ddPddd9dܠdd"dŢdhd ddQddd:dݧdd#dƩdid ddRddd;dޮdd$dǰdjd ddSdddddd'ddmdddVddd?ddd(ddndddWddd@ddd)ddodddWddd"dd+dd4dddWdmdmdddddddddddddddd}dXdudddddddd(dddddddddddddd4dwAwAd%d7ddKdKdPdcdddd/d/dgde*e*eeeeVeheueeeeee&+e*e8zAee$e#e-$e$e%e'%eN%eN%e[%ev%ev%e%e`&el&e&e&eW(eW(e(e(e!)e!)e6)ev)ev)e)e*e ,e,e~0e.0ezAO/ew2eW2e64teseA~A4Njefjeuje8kekekekekekeke2meYmememene#ne7ne|nene oeoeoeoepeLpepepepepepe/qe^qeqeqeqeqeqeqeqeqe re re re rerereresesesesesereveueOxe&xezeze =|e6e"eA A}e}e$}e}e}e}e}e'~em~e~e~ee\eieeeeeeeeeEe:e`ebeeeee?eAegegeeeɃeeee,egeeeee:e?eeeBeDehehejeeeeeee-eUeZeˇeeɈeɈeeeeeɊeɊeɊeeeeLeheeeӋee\eeeeee#e;e=e[e[eeэeeގeeePeeee e e e%eUeȐeݐeeeeqezeeeeԓeeeeeeeepeeeޘeereeeneneneߚee!e!eBe!e!e>ededeeeeÜeeee e0e0eLededeeeeÝeee eeeee e/e/e1eLeeeeeeeeeeeݠe5eSe_ekeeseee,e,eJeeee$ese¥eeEeTeeeee޽eee e e"e/ehexexexeeeeeeeTefeseeeeIeee$eA>eEeTeeee@@6ede(A؆A^eeeteeeeeeeeee(e:eGeVeVeeCe9e6eleA`A"eeeeeee;eKeMeyeeeeee#e3eCeCeHeWeoeoe~eeeee1eCePe_e_ee<ehAAeee/eOe\eeeeeeeeNe`eme|e|ee>eeAA.e5eDe`eeeeereeeee e&e6e8e8e_eeeeeeRedeqeeee#e"e ee6MeePApA5eee~ee{eEeeeGe`eeeeeeeeeeeeee0e\eieeee e=eeeWefeLe[e[e[e[eeeee eeeeeeeee6eeЊAxAeeeee8edeeeeeeeFeSeeereeeeeI@Ceeeee&_e*ePAneueeeeezezeeeee@eTeeeee#e$eAeeeeee e eeBeVedereeeeeePePeReeee f f6ZffA`A"fffff3fOfTfTfff*fXfff3fgff6fffffffffffffffff f f6.ffA(A . f5 fD f( f f f_ f f f f f f$ fp ffffWffffff@fVf[f[ffffff[ffzf ff4"f>f>f>f>f?f,?fL?fL?fm?f|?f?f?f@f[@f|@f@f@f@fAf9AfZAfZAfZAfZAfZAf_AfpAfAfAfAfBfBfBfBf5BfBfBfBfBfBfBfBfHCfXCfwCfCfWDfcDfcDfhDfhDf+Ef=EfJEfYEfYEfhDf>ffAA;nFfuFfFfFfGf-Gf2Gf2GfDGf[Gf]GfGfGfGfGfGf)HfWHfHfiIfIfIfIfIfJfFKfKKf(LfLf*Nf*Nf*Nf6Nf6NfNfNf-Of2OfOfOfPf_PfPfPfQfYQfYQfQfQfQfRflRf`Sf~SfSfSfTTfUfVfVf^Wf;XfZfOZfmZfyZf3[f}[f[f]f]f]f]f^f:^fN^ff^f^f`f`f>afVafVafVaflafafafbfbfbfcfcfdfdfffffffffffgfbgfgfWhfhf)if-jf9jf_jf;kfkfkfkfslfslfhmfmfmfofofofofofofofofpf!qfqfqfqfqfrfrfrfrffsffsfsfsfFtfFtfatf}tf%uf%ufAuf]ufvfvfvfvfwf;xfMxfbxfbxftxfxfxfxfxfxfxfxfxf yf.yf.yf@yfayfayfyfzfzfzfzfzf{f|f|f|f}f|~f~f~fiff>f`f=ffffofofނfPf^ffffffуfffff)fLff@fPfPfkfkfffffffff^fnfpfffffffff@fEftffPf\f\f\ffffIfNfqfqfqffdfdffSfSffffffffffffєff:ffffMfffȘfffWfmfffifffff fOfƝfifff#fOff ffff̡ffefjfjf-f?fLf[f[fjfofoffjfhf@?@ff60ffxAؕA%fffffff+f;f=fifyf{fffffDfffffffffff1f1f6f6ffffff6f6Nf%f`AA.fffff\f\fpf:ffffffffffff5f\fafffff%f%f>f%f fffffffIfNfNfff fffNf6YffAA\ffff!fffffffrfYf@ffwffjfQf8fwfof{fff&fofffffffffffffffffffffff=f=f=f=fIfZff%f%fhffffffff ffcffffffff1ftffffffff f ffffff f6mf;f A(A;ffff f fftftffffTfhf}fgf|ffffOfffffffffff:fg>g>gTggggggggggg4gggiggggggg7g<g<ggg g g g<g6< g gA@A g g g g g g gM gO gr gr g g g g g g g g g g g g g6ggAȜA g g g g g g@ g@ gw g g g g gdgvgggg g6ggA@A.g5gDg[g`g`ggggggLgagyggggggggwgggggg4gHA؝A>gEgTghgxgxggggggggggggg g gggggg g6ggОApAggggg;ghggggggggggggggggg6&ggxAANgUgdg|ggg(gCgyg{gggggggggggggggggggggg6P;g:gAAggggDggg/ggg-gKg_gagugugwgggggggggg g gT!gY!g"g"g)#g.#g#g$g$g"$g$g$g'%g,%g%g2&g2&g7&g&g&g&g&g&g\'g8(gK(g`(g(g(g(g(g()g()g()g;)g)g)g)g<*g<*g*g*g*gU+gZ+g+g+go,go,go,gt,g,g%-g*-g*-g.g#.g$/g&/g\/g\/g/g-0g20g0g0gG1gL1g1g2g2g2g52g2g2g2g3g3g-4g4g4g5g5g5g6g 6gb6g6g6g6g 7g7g7g7g~8g8g9g9g9g49gn9gn9g9g9g9g9g9g9g9g9g9g:g:g:g:g:g9g4g>g>g>g>g>g>g?g?g ?g/?g/?g>g6DgzDgأAA.?g?g@g@gc@g@g@g@g!Ag}Ag}Ag}AgAgAgAgAgAg Bg7BgPBgPBgPBghBgBgBgBgBgBgBgCg-Cg-CgCCgWCgWCgoCg{Cg{Cg{CgCgCg?DgQDg^DgmDgmDgCg6JgJgAA%EgEg$EgEg-Fg/FgwFgwFgFgFgFgFg$Gg$GgHg#HgHgIgIgCIgsIgIgIgIgIgIgIgIgIgIgIgIgzJgJgJgJgJgIg6RgRgxAȤA*nKguKgKgKgKgggAAggggOggg+ggggwggg#g#g/gBgcgcghghg6gVghguggghgܝg9gsgPg Cggxgggggbgögigggggg9gdgkggSgg0g5ggAA)gggggwgwggggggggg#g#g>gRg_ggggg1g>gPgRgRgRgggggggggg g gg7gPggȭAجA:ggg~gggggggggg#ggg#g(gggggggg(g5gCgEg_g_gdg~ggggggg gg-g;g;g;gHg^gtgtggggggggggg>grghAAgggggg"g'g'g8ghghg;glggggggglgqgqg4gIgVgegegqg7 gggAAXZgagpg;gVggg^gggg$g7g~ggg5ggggggggggggggLgLgLgLgZggggg.gggg8g:ggggggdggggggggggg8gcggggggkgkgkgggggg'g=g=g=gggggggggg7g ggA A$*gUgdg~gggg3ggggg2g2gCg\gmgggggg1g1gAgZgZgZggggig~ggggg7CggJgرAA;gggg[gvggg?gKgKg[gggggg&gggggegjgjgggggnggggKgagagwgwggggggggggggggwg|g|g g!g.g=g=g|g7 h h hAA?ZggggHhhhhIhhhhhhhChJhyhhhhzhhhhhhhhEhJhJhhhhhhhLhQhQh~hhhhhhNhehhw h| h| h h" h h h hU hj hw h h h h4hA0Ahhhhhahphuhuhhhh8hyhhhhhhhhhhhhhh<h<hh hHhIhHh8AAJEhLh[hhh4hhhRhh;hrhh\hmhhhhhh h h h;!hH!h!h!h!h!hn"h"h"h"h"h"h #h3#h[#h[#h[#h#h#h#h#h#h$h%hA%h]%h%h%h%h%h%h%h%h%h%h &h &h&h5&h5&hN&hn&h&h&h&h&h&h&h6'hG'he'hx'hh(hu(h(h(h(h(h(h(h(h)hV)h)h)h%*hj*h*h*h*h*h*h*h+hU+hZ+hu+h+h,h,h,h9,h,h,h,h,h,h,h-h-h-h0-hK-ha-ht-h-h-h-h-h-h-h-h.h).h@.h[.h].hx.hx.h.h.h.h.h.h.h.h/h)/h+/hF/hF/h^/hu/h/h/h/h/h/h/h0h20hM0hl0h0h0h0h0h0h1h41hQ1hl1hn1h1h1h1h1h1h1h 2h(2hK2hf2h2h2h2h2h3h"3h$3h?3h?3h[3hv3h3h3h3h3h4h4h#4h#4h(4hC4h^4hx4h4h4h4h4h4h4h4h4h5h5h35hN5hP5hk5hk5hk5h5h5h5h5h5h5h5h6h.6h.6hR6h8h8h8h[9h9h9h9h9h9h9h1:h:h:h:h:h9;h`;hw;h;h;h;h\h>h5>h>h>h>h?h?h/?h?h?h?h @h @h#@h@h@h@hAhAhAhAhAhAhAhAhBhsBhsBhBhBhBhChjChjChChChChDhgDhgDh}DhDhDhDhDhDhEhEhmEhEhEh0FhCFhHFhXFhsFhFhFhFhFhFhFh GhGhFGhSGhiGhiGhyGhGhGhGhHh Hh HhHhHh HhMh Mh`AvLh&NhFNh-NhPhPhPhAPhRhRhAZRhUhUhA,Uh~\h\h\hAk[h`h`h`h8A `h;ehehBeh`AdhcrhrhjrhAqh 9}hJ}h@}hhhh nhuhh`hӂhCh hŃh@hh#h hh .h5hh .h5h hŇhFhh .h5h hʼnhCh hŊh NhUhӋh NhUh ތhhfh֍hFhh&hh hh hh .h5h hőh NhUh ޒhh nhuh hh hhhhhfhٖhShƗh6hh hhhhhh1h1hBh8hh7UiWiUi@A(Auh|hhhhhhhUhh]hhhEhh'hhhhh_hIhhhh%hhSh`hh!hqhh5hBhhh8h8h8hh4iiiiiiyiiii)iiiiili,iiiii i i[ i[ i` i i i% i i- i i i i i i i i iFiSiii;iiTii6iiiijiiiisiiiiCiiiYiiuiiiiiiiiIiiiiiiTidii iiiii!i7iWiipiii i i i i i i"i"i$i$i%i%iV%iV%im%i%i%i&i&iK&ik&i&i&i&i&i&i&i&i'i'i/'iE'i/i/i 0i0i1i3iC4i}5i6i?7i7iI8i :iK;i;iUi ?i?iJAiJAi[AikAiAi3BiBiBiBiDiDiDiDEiEiEi+FixFiFiGi_GiGiGiFHiHiHi-IizIiIiJiaJiJiJiDKiIKiMiMiMi0Ni2Ni[Ni[NiNiwOiPiPiPi1QiQiRiRiRiRiRiSiSiSiSiSiSiSiTiTiTiTiTiTiUi$UiUiUiUiSiZiZi[i[i~^i^i^i_i_iaibibi1ci8ci@EZE dExFgigihililimimi 6ni=niSqiwqiZqiriri yiyizizi{i{i|i|i~i,iii~iiąii˅iiiLiiTizi%]ieiAiiNiSiSibiiДii8iii~iDi iКiiViC @\DPECfECiiUi\iniiuiti٪i{i ii"iiiiiiUiixiiiiiei[i Liii?iFiiiiiiiiii7iZiipAA'Ui\ikii{iiiii#ii iFirii iGisiiii;iiiiiii iii3i8i8iiiiii8iqiiyipiwi>jujpAA+iiiWi\i\ikiiiiii i%i%iji~iiiiii4jyj,j8j8j8j8jNjNjfjfj}jjjjj:jLjYjhjhjjjMj+jjjjj j j j j" jLjjSj!j"j!j"j6%j>%j&j$&j-j~.j;.j3j3j3j6j6j7j7j9j9j':j:j%IjIjAE;jL;j[;j;j;j;jljH?j@j@j_Aj%Bj*BjBjDjDjFjFjFjGjGHjIjIjD4DBDBAE(E EpCLj%Lj~NjNjRjRjRjUjUjUjpXjXjwXj?YjMZj^j$_j^j%aj,ajajfbjbjdjdjejfjfj|hjhj5ijjjzjMjjjDjIjjڡjjj*j?jjjgjgjgjɥjΥjΥjjj|jjjjΥj7jjjA`A&jjjjjjjީjjjj>jjzjMjjjDjIjjڰjjj*j?jjjgjgjgjɴjδjδjjj|jjjjδjjjjjvj}jjj7jj jAhAf%j,j;jj{jjj2j|jjjjjjjjHjHjHjTjj:jjjjcjcjcjoj5jUjjjj~j~j~jjPjpjjjjjjjjkjjjj.jjjjjrjjjjajajajjjjbjjjjjjjj@jajajjjj j,j,j>jzjjjjjjjj4jj'j,j,jjjjjj,j7kbk k@A0Akkk kk$k$kak}kkkkk3kDkk kkkLkkkkkkkkkhkhkkkJkJkkk,k,k|kk k k^ kn k k k@ kP k k k" k2 k k k k k k k k k kj k kkkk0kkkmkkkkkkkkkk1kCkCkCkk kukkk7kkkHkkkk#k#k5kAkAkWkmkkkkUkWkkkkkkk<kLkkkkkk*kk-k2k2kkkkkk2k?333333?pF6k=kAA#kkk^ kp k k kS!k!kW"k"k[#k#k_$k$ko%k%ky&k'kS'k(k)k)ky*k+k+k'+k,k,k<,k,k*-k-k-k .k1k1k3k3k5k25km5kQ7k8k8kc9k9k9k;k;k=k=k=k=k=k=k>k?k]AkAkBkCkCkCkhDkDkMEkEkEk'Fk=FkOFkTFkTFkFk:GkGkGkHk*HkakCakCakak)bktbkbkckck+ck0ck0ckckdk`dkvdkdkekekekekekfkMfkcfkfkfkgk gk gkgkgk9hkOhkhkhkhkhkhkoikik&jkk>kk#knkkkk%k*k*kkk[kqkkkkkkkkGk]k֜kkkkk}kk4kJkÞkٞkkkkjkkkkkk'k=kSkekjkjkkkHkkJkTkTkTk`k`kvkäk"kƦkѧkѧkѧkݧkݧklQlll%l2ll2l2l'l6llll lk lx lx lx l l l l l l lL l l l7 l l l lTlll?llllllllllll7%ulul/ulA`Alll5l^ll]l_lll/l4l4ll.l.l;lvl8l l(llll&llll9 l l"l#l$l3%l'l(lu*lF-l90l1l1l1l1l 2l 2l'3l3l5l6l8l8l8l9lT9l9l:l:l&:lA:l;l;l';l';lEl?lDAlBlClCl&DlDlFlGlIlIlIlIlIlJl&Jl&JlKl Kl Kl*LlLlNlOlQlQlQlQlRlRl5RlYRlYRlTlTlTl,UlUlWlXlZlZlZlZl[l[l8[l\[l\[l]l]l]l0]ll]l6^l}^l_l2_l^_l_l_l_l_lalalblelaelShljl3kl%nlplplplplpl7qlqlslslslGtlLtlLtltlululululLtlxlxlylylm}l}lt}lllllʃll%1l8lPAUl\l.lllQlćl7lll>lyl*l*l%llAllċllllflَl"l1l܏llllDlKllll lll$l+lllllGllRlll_lfll2ll$lllKlRlʽlѽll llJllQl7lQllAA#ElLl[llNlllXlilllhll4l9l9llllll0ll7l9mmAPAL^lnl}ll2llBll~llglgllll lvlvlllllGlGlYllllll*lll lll5mmm\mnmsmsmmMmMm_mdmdmzm>m>mm mm m mm" m" m= m m m m mQmmm0m5m5mmmmmm5m>"mj"mAATmmm%m7m<m<mmmmmmmm m mcmmmmmm/m4mmDmImmmmWmymmmmmmmm-mBmDmVmhmhmmmmmmmmmmm-mmmmm#mmm,m1m1mmml m m m m m m m!m%!m!m!m!m."m@"mM"m\"m\"m!m$%m0A ~#m#m#m#m#m#m#m$m$m$m$m%m%m &m6GmGGmPAA+'m%'m4'm'm'm'm'm)ml*m*m++m+m-m}/mO0m0m)3m5m5m17m;mJ=mJ=m\=ma=ma=mm=m>miCmDmDmDmEmEmEm_FmdFmdFm GmGm(Gm7Gm7GmdFm6mmAxAb~HmHmHmIm Im%Im%ImKm%Km!Lm"Mm#Nm$Om%Pm&Qm'Rm(Sm2TmmEmTmΆmmmmm߈mm(mNmtmmmm m2mXm{mmĊmmm6m\mmm΋mm;mEmQm#mjmؓmSm_mϗmpmwmwmmmmmmmmɟmm~mmmummmm/m4m4m@mЪmƫmƫmثmݫmݫm'mmmʮmmUmmm7mmmm]m2mmmmmymmmmm$m)m)m5mmmmYmkmxmmmm6x&n%nAAzmmmNm`mememNmqmmmmm,mRmxmmmm m0mVm|mmmmm:m`mmmm>mImm.mm mSmlmMmYmbmmmm~mXmmmmmmmm)mhmsmmXmm6m}mmwmmmmmmmmnnnnnnnnnnnnnInnnndn n` n nnn?nnn nn#nn ni!ni!nu!n&#n5$n5$n5$nG$nL$nL$nX$n$n$n$n%n%n%n%n%n$n6=n(=nAA0'n'n$'n'n'n'n'nw)n)n~*ne+n+n2,n-n.nG.n.ny0n2n2n3ns3n*4nW4n4n4n6n6n6n6nO8n29n29nD9nI9nI9nU9n:n;n;nCn>n$>n>n>n>n>ne@nAndAnAnCnZEnCFnFnFn In InpInKnKnKn&MnNnNnNn*Nn/Nn/Nn;NnOnPnPn(Qn-Qn-QnQnQnQnRnRn-Qn6nqnAA}SnSn$SnSnSnSnSnSnSnTnUnVnXnZn_ZnZnZnE[nE[nM]nM]n_]nd]nd]np]n^n_n_n`nbndnddndndnJenJenRgnRgndgnignignugnhnininjnjnlnSnnSnnonononqnVsnsnsnsntntnndnn n n nn"n"n.nnnnnnPnUnUnn nn(n(nUn6U7o6oAAnnunnnnnnnnn`nn)nLnrnnnn n0nVn|nnnnn:nnUnNnnWnnnnnn*n}nZnnnnngn_nnnnnnnnnnnn+n0n0n4oG5oG5oG5oS5o5o5o5ow6o6o6o6o6o5o6UEoDoXAA'7o7o8o~8o8o8o8oN:od:o:o;or;o.=o.=o:=o:=oP=of=o>o?o?o?o:@o@oAoBoCoCoCoCoCo DoDoDoDoDoDoDoDoDo6wovoAAJEoEoEo^FosFoGoxIo0KowKoMoOoPoQoQoRoRoRoUoVoVoWoWoXoXoXo!XoYo^o"^o8^o4_o4_o4_oF_oK_oK_o_o_oY`oaoco"do|fogo:ioUiopioNjoNjololonono'no,no,no8nooojtoototouououououovovovovovovovovovo6ooAA>xoExoTxoxoxoxoxozo`{ov{or|or|ow|ow|oY}ot}o}o~o_~o_~od~oAo\oooGoGoLo*oEoxoo0o0o5omooooςoςooooToioioioioioooooooooo͇oEooo6o'oIo'o'ooo>o>oJoo o;o,oNo,o,oooCoCoOoOoWo;oooooooooաooo5oooooooŪo oVo%oloǬo2o2o>oooooooo o oo÷oзo߷o߷o o6o1oAA1.o5oDooйoչoչooosooҾooo1oHo]o]oooooooop>pPpUpUpappp]pSpSppppwpppppp6.p.pB8B&pppNp`pepeppAp%p p p!p"p#p$px%p_&p&p&p(p*p*p*p*p*p*p@,p--p--p-p-p-pQ.pc.pp.p.p.p-p6qqBB$^/pe/pt/p/p0p0p0p1p1p2p43p05p6p87pO8pf8p8p8p8p8p 9p 9p 9p 9p 9p:p;pf;p;p=p?p?p?p?p?p?pqApFpGpGpGpHpHpHpIpKpMpNpOp2OpTOpTOpjPpPpRpTpTpTpTpTpTpLVpZpZp [p \p \p \pM]p7_pap_apsbpbp4cpNepNepgpKhpjpjpjpjp0kpgkpkpkpkpmpmpmpmpopppqpqprprprpVsp@up!wphwp{xpxp-qK-qZ-qZ-q,q6kqkq BBj~.q.q.q/q /q%/q%/q:/qO/q]/q:1qH1qk1q1q1q1q2q&2qI2ql2q2q3q3q5q7q7q7q7q7q7q7q(8q9q&9qX;q$=q$=q6=q;=q;=qG=qU=q>q@qfBqtBqBqCqCqFqGqGqGqGqGqHqHqIqNqNq,Nq(Oq(Oq(Oq6OqOq$PqRqSqSqSqUqWqXqXq@YqWZqk[q[q]qo_qo_q_q_q_q_q_q)aqeqeqeqfqfqfqfqVhqRiqRiqiqiqiqjqjqjqkqkqiq6Xqq B B/^lqelqtlqlqmqmqmqmqnqpqqqrqsq0sq)tq)tq@tqUtqUtqhuququqwqwqzqzq{q{q{q{q{q}qqNqSqiq_q_q_qلqބqބqqqqqqބq6wqqx B Bmqqq~qqqqqqkq#qqVqˎq`q~qqqqqMqMqqq%q*q*q6qq2qqqqqqqqJq6q}qqqqq֦qq qtqtq:q:qLqQqQq]qqYqqôqٴqյqյqյqkqgqgqyq~q~qȸq,qqtqq̾qqqq;qVqlqqqqqzqzqqqqq4qqAqFq\qeqeqeqeqqqqqqqqqqqq6qqXB B+qqqqqqqqqCq&qmqqeqqqqqqEqEqqqqqq(qqqwq|qqqqqqqqqqqqqq6rrBB?qqqqqqqqqCq[qqqqqqqqqqqeqq1q6qLqBrBrBrTrYrYrrrrrIr_rzrr r r r r r r r rrrrrrrr0r5r5rrrrrr5r6yr՜rhBBNrUrdrrrrrrrrrrr rgr^rrr|r|rrrrr r"rt$r$r&r(r(r(r(r(rz*r.rR0rW0rm0ri1ri1ri1ry2r]4r56r|6r6r8r:r:r:r:r:rDsCsCsssSs9swssئs)ss.sIs`sususs׫sܫs]s]sWsWsisnsnszssssǶsѷsѷsѷsѷsݷsWs\s\sss s/s/s\ss6gssBhB&.s5sDssлsջsջssssssssss+sssssssss]sbsxsnsnsnssssssssss6;ss(B0B;sss~ssssZs8ssssesss ssssss$s sPsssssssssussAsFs\sRsRsRssBsssssssBs8s8ssss\sns{ssss66t%6tpBPBsss>sPsUsUsjs&st>ttVtotttttttttttS t[ t[ tm tr tr t~ t~ t~ t tu t ttt%t-t-t?tDtDtPtPtPttGtntUtttttttt"t"t"t]tt@t'tntttttttttt{ththtztttt- t tt"t#t%t%t%t%t%t%t%t&t&t't(tF)t)t+t+t+t,t,t ,t ,t ,tG,t-t*-t(/to/t/t2t2t"2t'2t'2t32t32t32t3t4t4t4t4t@5tE5tE5t5t5t 6t6t6tE5t6NtVNt BBL>7tE7tT7t7t7t7t7t9t9t:ti:t:tt>t>t&?tq?t?t@t@ta@tw@t@tAtQAtgAtAtAt2Bt}BtBt Ct"Ct]CtCtCt7DtsDtDtDtMEtEtEtEtcFtyFtFt'GtpGtItItItItJtJtJtdJtKtLtLtLtLtqMtvMtvMtNt-Nt:NtINtINtvMt6t;tx"B B^Ot%Ot4OtOtOtOtOtQtQtQtQtRtBRthRtRtStUtWtWtmZtyZt\t`tMbtRbthbtxctxctxctctctctctctdtgtht)itktktImtrtstststttttttttttttttdvt`wt`wtrwtwwtwwtwt%xtxtmztzt|tV~tttɃtՃtttttttttttttÏt͐t͐t͐tِtStXtXtttt+t+tXt6[tth#B"B/tttt0t5t5tJtlt7tt6tLtgttMtRttڟt!t|ttttt%t%t%t7tt>tnt~t~t\ttBttͽtAtAttξt:tt tttttttttt*t/t/t;tttttttttitntntt%t2tAtAtntt6aPuOuH(B$Bttt~tttt`tutYtttDttttotttttttt6tMtbtbtxttttttttttFtttttttttptttt}t}ttttttttttt3tDtItttUtUtgtltltxttttytttttouGuWuuuTuTuvuuuuuuuuuuu u$ uj uj u0 u0 uB uG uG uS uuOuTujufufufuuuuuuuuuuuLuuuu u"uf"u"u#u#u>#u\#uF$u]$ur$ur$u%u%u%u%u%u (u%(u*u*u,u,u,u,u,u,u[.u2u2u3u4u4u4u6uN8u9u9u::u:u:u:u:u;u;uDuCDuCDuODuEuJuJuJuKuKuKuFMuONuONuONu[NuNuNuNuOuOuOuOuOuNu6fsurux)Bp(B?PuQuQuQuQuQuQujSuSu1UuIVuVuWuWuXuXuXuZu*Zu@[u[[ur\uv]u]u^u_u_u`uauaucududududududu#du9duDfuIfuhuhuIju[ju`ju`juljuku\puapuwpumqumqumququququrururururuqu6Ouu`*B)B-susutu~tutututuZvuovu!xu9yuyuxzuzuzuzu{u{u{u{u|u~u#~ururu2uDuIuIuUu؃uEuJu`uVuVuVuЉuՉuՉuzuuuuuՉu6uu+B*BT΋uՋuu^upuuuuu@uUuwu[uuZuuuuטuuuuuuuuu u u u/uuˤuu>uYuyuuuuuu;uuuɰuűuűuűu[uWuWuiununuuu~udu}uu5uuüu u2u7u7uCuutuyuuuuuuuu#u#uuuuuu#uPu6kuu(-B,BAuuu>uPuUuUuu+uuuu;uuuuu1u{uOu[u[uuuupuuu u#uuuu9uOuuuuduzuu uSuuuuuuuuuuuuuuuuu!u!uuuuuu!u6'uu.BP-B)uuu^upuuuuuu:uuuu uuuuuu-uuuRuduiuiuuuuEuJu`uMuMuMuuuuquuuuuu6v vP/B(.BGuuu>uSuhu}uuuuuuuuuuPuPuuu1u{u{uuu_u_uu.uxuxuuu]u]uuuBuBuTuYuYueuu|vvZvZvv8v8v^vvv<vvvv v vY vF vF v v v vj v| v v v v v6&v7&v00Bx/B,vvv>vPvUvUvjvvvvv?vvvvvvvvvvvQvvvvv[!v#v#v#v$v$v$v$vR%vW%vW%v%v&v&v*&v*&vW%v6yvyv2BX0B.'v5'vD'v'v'v'v'v)v+vh-v-v-v-v-v .vF.vl.v.v.v.v.v!/vG/vm/v/v/v/v0v+0vQ0vw0v0v0v0v1v51v[1v1v1v1v1v2v?2ve2v2v5v6v97v:8v`8v8v:v:vZ=vZ=vZ=vf=v?vCv@EvEEv[EvkFvkFvkFv}FvFvFvFvFv@IvKvbKvLvLvLv!Ov&OvQvQvQvQvISv XvYvYvYvZvZvZvZvZvZvZvZvZvZv4[v[v[v]v&^v`v'cvncvdvdvevgvgvjvjvjvjv}lvqvzsvsvsvtvtvtvtvtvtvtvvvwvwvwvwv/xv4xv4xvxvxvxvyvyv4xvzv6{vרv3B2B?{v{v${v{v{v{v{v{v}vyv]vv̈́vvvvvvwJwwãwãwãwӤwwwwAwܩw-wwwwwiwwѬwww wSwmwwww;wGwwwwwfw|wwww0wFwUwUwUwwwwwwwwwwww wwwwwKwPwfwhwhwhwwwwwwwwww6ewwx;BX:BEwww.w@wEwEwZwwww0wRwYwpwwwwwww|wwwww"wwwwwwwwwwwVw6wwwUwwwwwwwwwwwwwwBwGw]w`w`w`wlwwwwwwwwww6xUxx@x@x@x@xAxBx9Gx>GxTGx]Hx]Hx]Hx]HxiHxHxHxHxIxIxIxIxIxHx6^x9^x>B=B$KxKx$KxKxKxKxKxKxMxAOxYPxPxQxQxQxTxUxUxUxUxUxYWx[x[x[x\x\x\xQ]xV]xV]x]x ^x^x)^x)^xV]x6[xx@B>BW^_xe_xt_x_x`x`x`x`x/`xaxcxdxexHfxcfxhxIjxIjx[jx`jx`jxljxkxkxmxmx?oxqxqxqxqxqx(qxrx$wx)wx?wx;xx;xx;xxMxxRxxRxxxxxx`yxF{x`}x~xxxxxxxxxx&xx߆xWxrx͊xnjxnjxٌxތxތxxxx!x7xAxAxAxAxMxǔx̔x̔xqxxxxx̔x6y{yBB8@Bxxx~xx^xx$xoxxxxxxxx_x_xXxXxdxrxVxxxcxxxxxïxѯxxmx{x³xxxxx"x0xx,x1xGxCxCxCxQxxMxRxhxdxdxdxrxxnxsxxxxxx(x$x$x6x;x;xIxxxxxxx8xxxxUxcxxxFxnxnxzxxxMx[xxx@xgxgxsxxxExSxxx6x]x]xixwx xxxxxxxxpx yy&y/y/y/y=yynysyy y y y yB yK yK yW y y y y=yOy\ykyky yAyIyyyy%>yEyBBeyly{y]yy7y7y%1y2y CB4y yyyy7y7yKyyUyyYyYyycyygyykyyoyys ys yb!y!yf"y"y"yH'y'yL(yQ(y(yU)yU)y*y[+y+y_,y,yc-y-yg.y.yk/y/yo0y0ys1y1y1yi6yp6yL8y{8yS8yQy>UyUyDB@DBRyRy-RyRyRy SySySySyTyTy!TyITyTyTyTyTyTyTyTyTyTyWUyiUyvUyUyUyTy4QXy(EBDB^VyeVytVyVyXWyeWyeWy{Wy{WyWyWyXy(Xy5XyDXyDXyWy4RZyEBPEBXyXyXyYYyfYy|Yy|YyYyYyZy)Zy6ZyEZyEZyYy4\yFBEBZyZyZy][y[y[y[y[y[y[y[y\y\y\y\y\y[y>`y`yFB(FBN]y^]ym]y]y^y^y^y^y^y1_yC_yY_y^_y^_yc_yy_yy_y_y_y_y_y_yj`y|`y`y`y`y_y>iySiyGBFB1^aynay}ayay+byQbygbycy6cyMcybcybcyscycycydydydyeyeyey6eyeyeyeyfyXgyXgygygygygygyhy hy hyhy&hy&hy=hyvhyvhy{hy{hyiy)iy6iyEiyEiy{hy>oyGoy`HBGB&>jyNjy]jyjy ky1kyGkykyly1lyHly]ly]lylylyMmyMmymymymymymymynynynynyny2nyknyknypnypny oyoy+oy:oy:oypnyGpy;qyBqytyuyty yEyTyyĴyy_yryyy yyy#yJyyyyyyyEyRyayfyyy!y0y0y0yyyy%yyyyyyyyyyyyyyy0y7yyyyyyyynyyyyy yyyyyyyyyyySy1y8y%y,y>yEyyyyyyyyy/y)yy0yNBMB:y9yHy]ybybyyyyyyyy8yLyLyyyyy4yIyNyoyoyyyyyyyyyyy$y$y4yMy^y^yoyyy1y6ykyyyyyyyyyuyy#yyyyyyyy>zzPBNB>yfyuyyy2y7y7yJyyyyy/y?yOyhyyyyyyyy&y7yyyyyy*y=yyyyyyyy7zzpzzzzzzzzzzzzzzzzz'z3z3z@zEzXz]z}z}z}z}z}zzzzz*zezzzz z z z z z z' z6 z z z z z z z z z zH zV zk zk zz z z z z z z z z z z zN z z zzzzzzzzzzPzzzzzTzzzzzzz zzzzQzVzzzz'zzdzkzzzzzzezlz z z z!z!z,#zL#z3#z)$z:$z0$z%z&z%z)'z0'z?(zF(zy)z)z*z*z+zp,z9-z-zH.z.z_/z/zy0z1z1z2z2z&3z3z;4z4zK5z5zY6z6zV7z7zf8z8zv9z9z:z ;z;zz?z?z'@z@z'AzAz(BzBz8CzCzHDzDzTEzEzQFzFzGzHzOIzIzWJzJzWKzKzXLzLzhMzMzxNz OzOzPzPz)QzQz9RzTzTzUzHXzXzTBWz Yz_z^z~`z[cz#fz tz4yzUB`UB~uzuzuzuzuzuzIvzRvzRvzWvzWvzlvzvzvzvzvzvzwz wz]wz+xz+xz0xz0xzxzxzxzxzxz0xz6|z|zVBVB!zz%zz4zzUzzfzzzzzzzzzz{z2{zQ{zq{z~{z{z{z{z{z{z{z{z{z{z{z{z{z{z{z|z|z|z|z|z{z>~z~~z~z~z~z~zzzz z zzzzzz z4EzWBXWBzzzՁzzz7zWzxzzzz z3zZzzzΑzzzBziznznz zz)z8z8znzz7 zZz'zXBXB#zzКzzz:zzzmzzzzzҜz zzQzgzzzzzzzzҝzzzzzzzz zzzz4zYBXBΟz՟zz zazfzfzxzzzzázաzzzzzzz6zozZBPYB,nzuzzzãzãzzzzgzƤz&zz8zzz6zzzz§z2zzzjzzzz zz+z+z+z;zWzWzgzlzlz4zFzSzbzbzlzdz5!z(zpZB8ZB zzzz>zڲzzzzz>z7νzBzսz@\Bh[B4zzzz,zGzzzz̴zzzzzzzzzŵzzzzzzzzz6zzz$zBzzzAzTzTzzzzzzѼzѼzּzּz{zzzzȽzȽzּz?zmzz\Bh\BJzZzizϿzSzzczezzzzzzzzzzzzzzz7yzzzp]B\Bzzzvzzz*z=zBzGzzzz~z~zzzBzzzz z%z%zEzWzdzszsz%z=`zgz]B]B:zAzPzqzz zzzz%zzzzz,z>zKzZzZzz?izzpzx^B^B:zAzPzz4zzzzzzzzmzmzrzrz5zGzTzczczrz?yzzz_B^BJzQz`zzDzzzzzzzz}z}zzzEzWzdzszszz5 zzh_B(_B Zzazpzzzzzzzzzzzz5RzYz_B_B zzzFz&z&z+z+zz0z=zLzLz+z7,zyz3zP`B_Bz!z0zzzzzzzzzz z zz zz&z&z z?Uzz\z`Bx`Bz*z9zzzzz!z#z#z/z/z4z4z!z3z@zOzOz4z5?zFz@aB`BJzQz`zzoz&z3zCzCzHzHz zz*z9z9zHz5zzaBhaB zzz&z9z>z>zzzzzz>z5zzbBaBzzzz~zzzzzzczuzzzzz5zzbB8bBJzQz`zzzzzzzzzzzzzz zz5qzxzbBbB :zAzPzmzzzzz=zOz\zkzkzz5Xz_zhcB cB*z1z@zazz\z\z\zazaz$z6zCzRzRzaz{o{{fBcB%z,z;zzzzzzzzQzzzz:z:zLzyzyzzzzzzzzzzzzzzz,z=zzzz z zNzdztzzzzzzzzdztzzzzzzzzzzzOz[zhzhzz{{#{{{^{n{n{{{{!{1{1{O{_{o{o{{{{{{{{{ {{){){G{W{g{g{{{{{{{{{{{!{!{!{r{{{{{ {{,{,{i{y{{{{{{{#{3{C{C{{{{{{{{{M{{l{{{ { { { { {6 {i {i {i {i { { { { { { { {1 {r { {n {s {T {5 {5 {] {r {r {r { {~{q{q{{{{{{{{{{ { {[{{{{{{{ {5 %{%{gBfB({{+{{{F{{{{ {{{_{_{{{{{{{{${x{X{ { {[ {=!{q!{!{!{!{v"{{"{{"{${${${%{%{{"{N'{U'{M({T({({7-{(.{-{0hBgBJ){Q){`){**{*{+{+{,{!,{9,{O,{O,{{,{,{,{,{,{-{-{-{-{-{,{b/{5B4{I4{hB`hB/{/{/{0{-0{D0{o0{0{0{0{0{0{1{1{v1{1{u2{2{s3{x3{x3{4{ 4{-4{<4{<4{x3{ M{(M{M{M{M{+O{2O{UQ{=Q{Q{RR{S{S{U{U{<Y{iBhiBU{V{V{bV{V{V{V{W{X{X{X{X{X{X{X{X{HY{ZY{gY{vY{vY{X{5D^{K^{jBiB6JZ{QZ{`Z{yZ{Z{Z{Z{Z{Z{Z{Z{[{[{[{>[{`[{e[{e[{[{[{[{[{[{[{[{[{\{8\{\{\{\{\{\{\{]{]{]{]{A]{P]{c]{c]{h]{h]{h]{h]{u]{z]{z]{^{"^{/^{>^{>^{z]{6qr{r{mBjB>`{E`{T`{g`{z`{`{`{`{`{`{`{`{a{Aa{a{a{a{a{a{a{a{b{b{b{b{b{b{#c{(c{(c{(c{5c{Ic{Ic{Ic{ac{yc{c{c{c{c{c{c{d{*d{/d{/d{Ed{td{d{d{e{e{e{e{e{3e{Le{ke{e{e{e{e{e{e{e{e{f{If{Nf{Nf{Nf{Nf{ef{f{f{f{f{f{f{f{f{f{f{g{&g{Lg{cg{wg{g{g{g{g{]h{_h{rh{h{h{h{h{h{h{i{i{ i{8i{:i{Ri{ji{ji{i{i{i{i{i{i{i{j{j{6j{dj{j{j{j{j{j{j{k{(k{;k{=k{Bk{Bk{Dk{Ik{Ik{Ik{Ik{ak{zk{k{k{l{l{l{*l{l{l{l{m{m{m{n{Fn{Co{Co{Co{^o{o{#p{(p{(p{(p{#q{0q{5q{5q{q{q{q{r{r{5q{s{qu{v{v{v{6{~{nBnB+>w{Ew{Tw{w{w{w{x{y{z{z{~z{z{z{z{_{{l{{{{{{{{8|{]|{b|{|{|{|{|{$}{L}{\}{^}{}{}{}{}{}{}{}{}{~{~{~{~{~{}{ {{ {{ ;{B{Á{ ;{B{ ˂{҂{ [{b{ {{|{{f{օ{F{{7h{{o{pBoBV*{1{@{X{g{{{{{{{{LJ{{{"{"{N{j{j{}{{{{7{R{{{{{҉{߉{{${1{S{v{{{Ȋ{Պ{{3{@{b{{{{ԋ{{{{{9{F{n{{{{ƌ{ڌ{ڌ{{{{{<{X{u{u{0{{{{D{ {Β{{{{{4{F{S{b{b{{ {{{{{/{h{6{{ޞ{{]{{{7{S{!{qBxqB{{{{{9{9{i{{{֣{{{${V{d{{{{Τ{{{{{{{{{{{{=ͨ{Ԩ{rB rBڦ{{{.{3{H{M{b{d{y{{{{{{{{{է{է{ڧ{ڧ{{{{Ǩ{Ǩ{ڧ{?3{{:{xsBrB.{Ʃ{թ{{{"{${7{7{S{{{Ǫ{ܪ{{#{U{j{{{ͫ{{{{{({F{W{{{ˬ{ج{{{;{;{;{;{;{@{@{{{{-{-{@{?ʱ{ {ѱ{PtBsB){*{9{b{g{|{{{{{{ʯ{ϯ{{{{{{{2{7{L{N{c{e{z{|{{{{{{{Ұ{װ{װ{{{{ı{ı{װ{7@{p{G{(uBxtB)ʲ{Ѳ{{{{&{E{S{r{{{{̳{ڳ{#{1{z{{{{Դ{{+{9{{{ٵ{{{{-{;{;{H{M{M{ {{+{:{:{M{{{{7K{{R{uBpuB*{={L{{{{q{л{л{л{{{ { {{{{){6{E{E{{ w{~{7z{{{HvBvB{!{0{ƿ{{{{{{F{X{e{t{t{{ {{?{={{wBvB"J{]{l{{.{3{3{}{{{{{{{{|{{{{{{{{{{{{{{{{{{{{?+{{2{wB8wB%{{{@{{{{{{){.{.{?{P{{{{P{z{|{{{{{{{{{{{{{{ {{%{%{{7{{{`xBxB{-{<{{{{{K{X{e{{{{{{{4{A{W{W{i{v{{{{?8{{@{8zBxBjZ{v{{{H{M{M{{{{{{{{!{2{{{{N{N{N{S{d{y{{{g{{{5{{{{{{{{ {g{{{{{{{{{{{{h{{{E{{{{{{{{%{{{{{{{,{9{{{{{{{0{0{5{F{n{{{{^{`{{{{{{{{{{{{{{{{{#{2{2{{7{{{zB`zB{{{{b{o{{{{{{{{Z{g{}{}{{{{{{7{{{H{BzBj{}{{{B{O{{{{{{{{:{G{]{]{o{|{{{{{:{{p{B{7{6{{8|B{B%{ {{g{{{{r{{{{ {{{{!{&{&{&{7{N{{{{{ { {{{{{{{{{{{{72||9||B`|B{{{'||||2|C|T|v|||||||||I|_|d|d|||||||,|,|d|7z | | |}B}B ||,|w||+|+||||||*|/|/|1|6|6|6|{||||# |0 |F |F |X |e |t |t ||7|F||X~B}B#Z |m || | |@ | | | | |$ |L | | | | | | | | | | | | | | | | ||||||||| |7|||(B~B'|||@||||r|||||,|1|1|3|8|8|8|c|||||/|/||||||Q|^|t|t||||||7<||C|BPB$||||]|n||||| | ||%|*|,|1|1|1|]|p|}|}|||||||||||'|6|6||7 !|Q!|!|BB|-|<||c||||?|?|?|D|||||d|d|d|d|||| | | |!|!||7%|B&|&| BB!|!|!|G"|T"|#|O#|#|#| $|4$|$|$|$|$|$|$|$|$|$|$|%|%|%|%|%|$|7')|n)|.)|BHB&|&|&|A'|'|'|'|'|'|'|(|(|(|(|)|)|!)|!)|'|7!-|p-|(-| BB)| *|*|g*|*|-+|2+|2+|2+|u+|+|+|+|,|,|,|,|,| -|-|-|+|70|D1|1|BHB-| .|.|g.|t.|.|.|+/|u/|/|/|/|/|/|/|0|0|0|0|0|0|0|0|/|?5|`5| 5|8B؂B1|1|2|P2|2|2|3|R3|3|3|3|3|3|3|4|4|4|4|4|4|5|5|3|78|'9|8|B`B5|5| 6|W6|6|6|7|X7|e7|e7|{7|{7|7|7|8|8|8|8|8|8|8|8|7|?"@||@|)@|ЄBB79|9|9|9:|:|:|;|.;|];|;|;|;|;|;|<|&<|3<|A<|C<|S<|S<|S<|`<|<|<|=|=|=|b=|=|=|=|=|:>|:>|J>|[>|[>|[>|h>|~>|~>|>|>|>|>|>|?|?|?|?|@| @|@|@|>|7K|XK| K|PBBSA|-A||)|`BȗB$||| |||4|P|^||||+||||||l|||||||||$|$|)|)||| |||)|=||ؘBB ||)|>|{||||||||||||||5||0BB |||||t||||||i|;| |4+|BxB|||||||I|||||||||||||U|Z|||||||||||7|||B(Bz|||||H|b|v|||||||||||||7||| BB|||||-|2|2||\| | | |||||||||||e|w||||| || y||+| || S|Z|}}}}}}}f}}m}7}}}BЛB }}.}K}}}}}}z}}}}}}79}}@}B8BZ}o}~}}u}z}d}d}i}i}}}$}3}3}i}" } } } } } } } }?a}}h}0B؜Bz } } } }G } } } } }8}G}\}\}a}a}-}?}L}[}[}a}7}}}BXBz}}}}8}}}}}}}}}}k}}}}}}}}} }} W}^}=}}@BB }} }}}}M}_}l}{}{}}5}}BhB$J}Q}`}x}}}}}}}}},}?}}}}}q}s}s}s}}}}}}}}}}\}n}{}}}}6v*}6*}B(BU>}h}o}~}}}}}}}}F}W} }" }m } } } } } } }!}:!}!}!}!}"}"}&"}&"}="}J"}O"}O"}"}"}4#}4#}Q#}S#}`#}`#}o#}#}#}#}#}D$}I$}$}$}$}N%}S%}X%}g%}%}%}&}&}&}&}&}o&}o&}q&}&}&}&}&}'}'} '} '}'}'}Z)}_)})})} *}*})*})*} '}A+},}<.}0BРB~,},},},},},}$-}D-}F-}F-}F-}-}-}-}-}-}N.}`.}m.}|.}|.}-}}/}/}0}?4}+5}4}BpB0}0}0}0}0}0}1}A1}1}1}2}2}3}3}3}3}3}3}3}3}4}4}4}4}4}3}5}5}6}6} 7}"7}>H;}:}B8B7}7}7}7}8}28}^8}8}8}9}9} :} :}:}:}:}:}:}:}:}:}7}?}?}?}BB;};};}1=}6=}6=}=}=}>}>}I?}I?}[?}h?}w?}w?}6=}e@} A}A}7*C}ZC}1C}xB@B A}A}A}B}B}B}B}C}C}$C}$C}B}?E}E}E}أBB C}C}D}~D}D}D}fE}xE}E}E}E}D}64K} K}BB*^F}F}F}F}F}F}F}F}G}G}8G}IG}IG}mG}G}G}G}G}IH}]H}_H}H}H}H}H}H}H}H}H}H}H}H}pI}uI}5J}:J}J}J}J}J}J}J}H}K}L} L}L}BM}IM}M}M}>T}5T}ХBB,nN}uN}N}N}N}N}N}N};O}[O}nO}O}O}O}O}O}P}$P}9P}XP}mP}rP}P}uQ}Q}Q}R}R}R}'R}'R}'R},R},R}dR}R}XS}]S}S}S} T}T}'T}'T},R}>X}X}BBT}U}U}6U}6U}XU}gU}yU}U}U}U}U}U}V}FV}FV}FV}ZV}zV}V}V}V}V}W}W}LX}LX}^X}kX}zX}zX}V}>]}e]}8BB">Y}EY}TY}TY}vY}Y}Y}Y}Y}Z}Z}Z}Z}Z}Z}Z}$[}$[}$[}$[}8[}X[}][}][}[}[}\}\}*]}*]}<]}I]}X]}X]}][} ^}^}_}_}c}c}c}e}e}i}j}i}Bh}k}k}اBl}r} s}r}B^q}x}x}x}(B8w}sy}y}uz}|z}^|}e|}Q}}}} }}6+}}BB~}}}}}+}+}8}H}H}_}v}}}}ŀ}׀}}}}}}}}}5}Q}Q}j}-}?}}}}}}}}}7}I}}}}}}:}K}}}}'}'}=}S}،}}}U}}}}<}]}}}}=}=}m}}}ʒ}}}\}}}}D}D}t}}}}}}} }}}}}}W}g}}}8}>}d}j}}}}ݞ}֟}ܠ}ܠ}ܠ} }}$}B}}.}}}"}0}<}N}^}j}j}}}ƥ}ܥ}}}}-}}}}}ګ}!}I}%}%}1}}Ȯ}U}W}W}c}}}}k}}}}m}4}}ô}ô}ϴ}ϴ}}+};};}}}}}}͵}ݵ}}} }}-}=}M}]}m}}}}}ɶ}ٶ} } }|}}}}ȷ}ط}ط}}}}$}4}4}R}b}b}}}}}}}ܸ}}}q}}{}}}p}}}Ѿ}}ѿ}*}/}?}}M}}}}}}M}}}}l}}3}3}C}v}v}} }}}}-}>}}}}}}}}}}}}}}}}}},}}}}3}3}}}}W}i}v}}}}@EF FB%FTD\#FC6} }B`B}%}4}}}}}}}'}}}>}O}O}}}}}}}}b}r}r}}"}}}}}=}q}M}c} }}}}}}}}}}(}}}}}} }}}}s}s}%}*}*}G}S}S}t}}}}}}A}A}}}}O}Q}}}}}}}}!}!}!}3}C}i}i}}}Q}V}V}l}}>}C}C}Y}y}+}0}0}F}f}}}}3} }_}_}u}}G}L}L}b}}f}k}k}}}}}}} } }}}}}} }4}BBH}}}v}}}}}}}}}}}}}}} }}}}}}} }~}~}~}}}}}*}s}}}}}?}D}D}D}Z}}}}}}}}}}}}!}1}z}}}}\}l}}}} } }}}}}} }6 ~ ~бBB0~}}}~i~~ ~:~~~~Y~~E~~~c~~~ ~ ~ ~ ~ ~(~~~A~A~~^~c~~x ~ ~ ~ ~ ~ ~& ~ ~ ~ ~J ~\ ~i ~x ~x ~ ~'/~w~7~B?~~~~~~~'~)~>~@~U~W~l~n~~~K~k~~~ ~~~s~~~~~~~~~~O~~~,~,~X~X~n~1~~Z~y~y~~~~~~~~~%~[~~~~~~(~2~~~~~~~~ ~r"~y"~$~$~%~%~'~'~'~'~H)~q)~O)~u*~e+~+~,~u-~<~=~=~@~;@~ @~B~B~]C~dC~PE~WE~F~F~F~H~H~Q~Q~S~S~`W~gW~CX~JX~$[~+[~]~^~`~`~7q~r~q~BB>%a~,a~;a~Ma~Ra~Ra~b~pc~pc~c~c~c~c~c~c~c~d~oe~6f~f~g~h~Yi~ j~j~k~(l~8l~l~l~l~l~m~m~m~m~m~;n~n~n~o~o~o~o~o~o~p~Ap~Cp~Tp~`p~bp~sp~sp~p~p~p~q~q~q~q~q~p~5Ƅ~̈́~жBB7r~r~r~Es~s~s~s~~~~~/~~~ϴ~~~~~O~\~~~~~T~T~~~~~~~Ʒ~Ʒ~~7~l~~BB~~~%~ݹ~Y~^~^~~~~ܽ~~~~~~~~~~~I~_~k~~p~~~~~~~~~.~;~G~G~~~n~~E~e~r~~~~R~W~~~~~$~)~Z~q~~~~ ~&~H~b~~~~~(~B~R~t~~~~~~(~B~d~~~~~~~~2~T~`~~~~~~~6~H~b~r~r~~~~~ ~&~6~X~r~~~~~ ~&~3~U~o~~~~~~~3~U~o~t~6~6~6~6~6~B~N~Z~~~~~~~~~#~#~5~A~A~~~/~~~~~~b~b~t~~~~B~~q~~~@~~Z~Z~~~~~~~~~~q~x~L~S~5~~B8B)~~+~~~~~5~~~~~~~~~%~(~8~~~~,~~l~~~~~~~ ~ ~~~~~~~~~~5  BBu~~~-~?~U~U~g~l~n~~~~~~v~~~~~~~~ ~~~~~~~~T~~~~~~~~~~~~~~~~/~~'~~5q (#5GTTkk'/Aacjjj a         p            &[ B>KKMZZm|TT6.! xBB7~ShPUUZ!!>>|".:ZT (((5ER        @DD@NE0|EHBmE KE+EP/E`DE@DECCDD%E4ECE@Ea?i?65yxBB??@o@AkBHC%DDjE FFGHGIIJiKFL#MMhN OOPQR"SS$TTTTTU U U U U VgVV?WXYY]ZZ[C\\L]5^__`axbccddefff%g%g*ggrhwhhhhiaiiii-j:jjjjkk;kyk_lkllZmfmfmfmmn+n0n=njnynnnnnnXoopp"p/p\pkppppppKqqqrr"rOr^rrrrrr>ssstttBtQtttttt0u9E9T9f9k9k99; ;7;7;7;;<<<==== >7>c>h>h>[?m?z???h>?AFAUB?hih0BpBBBBC-C-CG>G`G}GGGGGGGGH#HfHtHHHHHHIII#I#I#I8IIIII]IvIvIJJ.J@JNJJJJKKKKKILILiLLLLMYMyMMNN+NqNNNCOOOP[PPPP.Q.QQQQ+R2nmBXB>kZkikkkkl2lGlGldllllllllmmmmml>[qq@BBnnnoQoQo}ooppppppppp q qp6tXtBhBqqqqBrVrrrrr!s!s!s&s&st/tD BB!{||\|i||.}~$Koqׁ쁀쁀 (776؈0BHB7IXx焀焀8XeDžDž!6;;Ncvx††ↀ7ddyt5 $+ ׌ތsxsxpuᒀC㔀 [bpu krpߘ KR噀 [b kr7 BB/zĝ=W~ɞΞ$)<ATYlq̟џ䟀韀۠ࠀࠀ*x?BB0ʣڣ飀>;@@ͦҦEJtyҧק :?sx穀44Naffewfv?`XBBꭀ m5!&&°԰ᰀ&=BB$ Nzbb\n{5hB BŷϸԸԸpԸ7ȽϽBBjqw||½½迀\cBABEE)E+F5Ѐ=Ѐրրր6؀7߀߀߀BB؀؀؀yـ~ـ~ـڀ"ڀ'ڀ'ڀڀڀۀI܀܀݀݀݀ހހހހހހV߀h߀u߀߀߀ހ7xB0B"(--=lKPUDVcrr7pBBel{}I,1&U,370BB bggq$(:j| 7hoBhBNSSc1U4FSbb7hoxBB5<KMZ__ 4FSbb[v&7=l>=BB5M\y, n ~ ~  $Wp3d}!!$#&&&&&$)=)B+S+m+,,,,,,---h.u.u.J/W/W/|////0!00R11334)4B4[444555%5%51565C5H5H5O55556L6X6r667777X7X7m777788:8 999x:;;J<<<<<<=====<BBB7\q!rfqBBoBBBC5CCCCCCDkEyEEEEFF:GGG^KKK5LOSSVVKWWX(YYYkZ[[[ \q\]]N^^^^g_n____0`k`w`````aa bpbb}c dde'eeeefffWggggggnh{hhCijk kl#m#m0m5mmmnTnTnbnnoooooop#p#p(q:qGqVqVq#pssFtKtttEv_vLvw www5x:xxxVy[yyyvz{z{ {7DQY%QYBJQg놁2R)eQQYDgSϒ֒֓ݓ7BB%,;r{{ʘʘu֙]͚4Uћ֛֛`v wfh̞ڞڞꞁ&4DTY#%YYk|||fv*;tt!!4ɤˤۤۤ礁 .ĥĥaqG{!**ʨ44Щީf᪁ccp~~*;;;Xft㬁^kmmyୁୁEUerĮĮĮĮ$ aȰͰͰ\hh~ుDDDIIbtI6YB8B1մUUhP涁 "LYqqqv.rԹ BOggggtyy0=LLyB$޿PB žԾ;׿׿>ǁƁBB9.>MmffÁ)Á.Á3ÁsÁÁÁÁÁ8āHāHāgāāāāāāŁ%Ł5Ł7ŁMŁRŁRŁTŁŁŁŁŁŁŁŁuƁƁƁƁƁŁRȁ}ʁdʁTˁ$́́́΁΁ρՁՁՁ<\Xtt<\ <\ RSDSZ D8H:\_AVZ\Наши разработки\HiJackThis\HiJackThis.pdbt.rdatat.rdata$zzzdbg .text.text$03.text$1PA.text$2A.dataA.bssB@.idata$5@Bd.idata$2B.idata$3B@.idata$4BX.idata$6Bp .rsrc$01pB%.rsrc$02% % %d%%P%䃂%% %%%샂%8%%4%耂%p%%l%%%%%%Ԅ%|%,%4%%䀂%%܃%|%Ԃ%%%%%h%%X%%8%x%%%0%d%%%%؀%%%(%%%H% %%0%%ԁ%%%%%T%Ȃ%(%%t%T%t%,%X%%؃%%%d%%Є%`%%%$%胂%$%܀%%|%%Ё%%%%%P%`%x%%t%%t%ԃ%%<%T%%L%%%L%T%%`%%,%H%8%%%%% %삂%(%h%%%p%%\%X%섂%Ѓ%@%p%D%P%%%̃%0%4%%%0%%Ȅ%%%%%%\%%|%%%%0%%%8%%%Ă%%p%l%P%%%%쀂%̂%ā%脂%8%%%h%%Ȁ%%%쁂%%Ԁ%%%%%%4%%@%%p%%H%(% %D%́%$%,%@%%% %L%%\% %H%L%ȃ% %%%Ѐ%%%H%(%%܁%%؁%%%d%%؂%%܂%`%%Ą%%%D%%%%肂%\%<%%(%%%%l%䄂%%%̄%h%ă%d%$%<%%<%%$%%D%h%܄%%% %%؄%%|%%l%ȁ%聂%̀%t% %%%%@%%@% %4%D%%L%,%%%%䁂%䂂%<%\%%%%%%%8%X%4%x%%%x%0%Ђ%%%%`%T%Ā%x%X%l%,hLC0@ DȊ}qHiJackThisForkCreates a report of non-standard parameters of registry and file system for selectively removal of items related to the activities of malware and security risks1:wB4 N+:Q@\7:O3f `ӓMcKfrmEULA B"#&KltK  Vh 00 %f  6 hF( @ WW55 **EEkk44XX /1]CvY. 'Dy|U_ZXn8**'jeU[sQ--ffxxy`ps;f]]33n[[hZZd::W naaB>5+@fMy郃ppi{{qqgGGA;;9ssZZZ茌??DD~~rr{ ,, iiNNNܬ@@/.|{B?:Ch`]T+K%%---ἼSS32i~imn@Uma[]b1Uֶ 㠠`_Xb}nxQ_pd^_`b&dd""#맧zx{ʇnt{ma``aiHz^^^sss鳴̓ryMV./1$?.TNw~}<<<便po|z QQ\\Z{{sEE;;UU__LL// ޼mmzzXXPPff펎}}zzuu$$44%%66&&!!55HH  CC艉MM""  $$]]ԆNNQQhhssoo__FFȃ֖\\煅yy@D%ų½ee,,8855#%)޴ϣݵɱ佖伓ư?( @## ,, (LMP >nKYd*$$"(jdAj""uullQQvggo@#7}}}㖖LLONc5V5[  y}فOQoU]U 諫ppqꊕzMl=lG}Md٫𳳳Ոxx$$** []円VVSS++99BBDD!!bb  **xy99||uu..ͺwwZZVWα(0` %K35 ! ' +);A/ ):N c(r-}020.){!paOB4#& 'b* #D6sYY5jM2 # 0!!Q0F}zC jF "%pppeee=fff?fff?eee?fff?fff?fff?eee?fff?eee?fff?%%o qw # lw.1̊ϊϊϊϊϊϊϊϊϊ&&,=7nPVvV 90?BB5]@q/gXf_WoX34?MM?oU8vOHV][\tDs +U?Ar\HD[bUTZYlWn "? [S5q=X^]ZY\p&KN ? DSbTS[Z[hX:|6?Zuf\Y_lt=V9?DDzzUqncl>s+0[?##w%%U&&NQ{rr9990HN}t%j(?jjmVV[eee& I>>>92(!;a?JJJqqjjsszzLLL4442224OoX?EEE\\FFFF``GGG TqxK ?~~~\\\kk@@33CC||-7w VV::{ ?222sss==00EEKKL)2>`YYYYI~nnSS?vvKK;;58eim)+-`ZZZZZU>>aa?mmXXGHXp~x778b]]]\]]J gg?~~ee[bs{xJJJi^^^^^^^&CEEhh?ssv~nv~fghj_____``N vvee?FFFIII~bcdMwArArArCvG}MTYxBB##NNWW?{jqnqdd $" C C=2$@AwghAf7aaa aaa aaa aaa aaa aaa ddc33=LrO[\\ /1]CvY.W'Dy|U_ZXn8+**'jeU[sQffxxy`ps;fj33n[[hZZd::W naaB>5+@fMy#Bppi{{qqgGGA;;9iZZZ??DD~~rr{ ,, NNN@@/.|{B?:Ch`]T+K%%nneS---SS32i~imn@Uma[]b1U|Z `_Xb}nxQ_pd^_`b&ddzZ""#zx{nt{ma``aiHznnrZ^^^sssryMV./1$?.TNw~}jjrV<<nKYd*P$$"(jdAjvuullQQvggo@#7 r}}}LLONc5V5[  GG&6OQoU]U ppqzMl=lG}MdZYxx$$** ##'-VVSS++99BBDD!!+.dbb  **HHDF 99||uu..wwZZVWα$Form1&'5^ F!txtEULAxWF cmdNotAgreeI Do Not Accept @'wDBTahoma<cmdAgreeI Accept(@'wDBTahomaGlblAware  HiJackThis is free and open source program. It is provided "AS IS" without warranty of any kind. You may use this software at your own risk. This software is not permitted for commercial purposes. You need to read and accept license agreement to continue:xX2 %DBTahomaa lblWelcomeWelcome to HiJackThis Fork 3xh%I Constantia HDLD0:FC#HD,DLnPFCHDD oFC-HD D0FC4HD\DFCFCHDD  B 4GCE HDܐDpGCpGCHDDdGCGCHD̑D\GC O GCEHDD,HC J (HCD4HD̎DpHC F lHC(E HD DHC lL HCE EHDDhIC 4Q HCEDD(Ez HD|DXDICDIChTemp\VB448HDDXICIChTemp\VB448HDDIC G ICEEE\En$HD\DP @JC@JChTemp\VB448821DHD,D JCJCjj jj HDD JCJCjj jjHDlD \KC\KCicrosoft Visual Studio\VHD\D8KC )HDNLD@4NCJNCNCNCNC OC*^ EJ@< E,OCo0ELOC[OCjOCyOCOCOCNClNCxBBBD$4BD$4BD$8BD$8Bl$۝9l$龞9 HDNDhPCPCH$PC,PC(PC,PC TPC0g^ EdvF@\ EtPCo0EPCPCPCPCPCPCPCPC,PCOCxBBBPCl$[OQ6l$Q6l$R6l$xR6l$R6l$S6l$QT6l$T61HD|N̗D-  dT tQC^ExQCQC|QCQC QC^ ^EE^E@D EQCo0ERCRC5RCBRCORC\RCQCRC(RCQCPCxBBBQCQCl$C'J=l$CJ=l$K=l$`Q=l$Z=l$f[=l$i_=l$d=l$g=,HD|NܖD8@RCJRCRCRCRC  SCh)^ EJ@@ E$+HDNDV<^CКJ<^CD^C@^CD^C l^C)^ EhF@@ E^Co0E^C^C_C#_C0_C=_CJ_CW_Cd_Cq_C~_C_C_C_C_C_C`C `C4`C_C_C_C_C`C'`CD^C]CxBBB`C`CD$4BD$4Bl$饣9l$9l${9l$9l$鑪9l$鄫9l$Ǭ9l$麰9l$鍴9l$p9l$39l$9l$I9l$<9l$9l$9l$U9l$9l$9l$.9l$?Q9l$?9l$9%HD7l$@7l$0A7l$A7l$KVJ7l$KJ7l$L7l$N7l$Q7l$]7l$a7l$i7l$l7l$p7l$t7l$7w7l$zz7l$m~7l$鐂7l$37l$և7l$i7l$鼍7l$?7l$"7HD|NlD8cC8cCHcCcCcCcC cCpw^ @Lo8_ ExH@d EdCo0EcdCpdC}dCdCdCdCdCdCdCdCdCdCdC eCeC&eC3eC@eCMeCl$O2 >l$O >l$O8 >l$O>l$ON>l$O>l$Od>l$[>l$[j>l$[>l$[p>HD%l$>%l$@%l$*C%l$mD%l$0G%l$I%l$M%l$ R%l$ W%l$X%l$Z%l$w_%l$wa%'HDnCKnCXnCenCrnCnCnCnClClCmC-mC:mCGmCTmCamCnmC{mCmCkC8kCxBBBfmCsmCl$S7l$7l$7l$,7l$7l$7l$7l$7l$7l$~7l$7l$7l$G8l$Z8l$M8l$8l$s 8l$8l$y8l$<8l$8l$"8l$8l$(8l$8l$.8l$8l$8l$g8l$8l$-8l$8l$&8l$v'8l$y)8l$,-8l$08l$08P 77rI2Y^l8B86KLP$v.)K7 LLPսHitFZe EpxKP[P|<5Eܔ߅ J<P?HbO[@ d%JP2!+AlS* 24KPwLS9& '-$M,P:wB4 N&NB|PJKK]x d/_LQLP%H#=s"2 "GKP,hD5>JlHDNDTrCrC,ErCrCrCrChldsC$Fp8l$D8l$H8l$Y8l$]8l$a8l$(o8l$t8l$z8l$a8l$ą8l$里8l$8l$魖8l$頛8l$鳞8l$馢8l$y8l$|8l$?8l$钵8l$U8l$8l$8l$N8l$!8l$8l$8l$8l$-8l$9l$ 9l$ 9l$y9l$\9l$59l$99l$A9l$xK9l$kV9l$~[9l$^9l$_9l$7`9HDCXCrCCCCڐCC֏CCC CC#C0C=CClCxBBB(C5CClCxBBBCCF1wAA=$fW09368265E-85FE-11d1-8BE3-0000F8754DA1MSCOMCTL.OCXMSComctlLib.TreeViewTreeView{{H8H%;#$,j(6("$,j(6(!$,j(6(~ƚ EEEmz )*~L֑bqa_Fo F#>̮wg F4u` W 9368265E-85FE-11d1-8BE3-0000F8754DA1MSCOMCTL.OCXMSComctlLib.ImageListImageListHD|N|D,C R (CE8C@Cl$>l$>l$*>l$>l$ >l$>l$>l$>l$>l$>l$w>l$e>l$oh>l$k>l$N>HD|N D@lClCE|CCCC"hlC 7{r$&EE@8pmr@8( Pgr@<( \gr@@E E@DAEC AE@HE@=E4C8 DE@;E C PE @pDKDDDDOD\DDDDJDWDdDA DN D[ DR D_ Dl Dy D D D`_` ```hhhhhhhhhhhhh hh hh hh hh hh hh hh hh hh hTCpCxB~BBBBBBBDODiDvDDDDDDDDDDD D D D, D `b` `c`hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh|CpCxB~BBBBBB9 DF D` Dm Dz D D D D D D D D D D D D D# D0 D= Dh:hh:hh9hh8hh8hh7hh7hh6hh6hh5hh5h`?``@``A`CpCxB~BBBBBBHDUDoD|DDDDDDDDDDbDCpCxBBBD!D`X``Y``Z``[`CpCxB~BBBBBBaDnD{DDh0h/hC``D``E`CpCxB~BBBBBBsD?DLDYDfDh.h-hF``G``H`DCpCxB~BBBBBBDDDDD`I``J``K``M``N``O`h,hh,hh+hh+hh*hh*hlCpCxB~BBBBBBDDDDDDPD]DjDwDDDh)hh(hh'hh&hh%hh$hh#h`T`CpCxB~BBBBBBDDDDDDDD`B`h4hh3hh2h1hCpCxB~BBBBBBD DD%D2D`U`h"h!hh h`V``W`CpCxB~BBBBBBDD D-D:DGDTD`\``]` hh hh hh hh hh hh hh hh hh hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh CpCxB~BBBBBBDDDDDDDD DD$D1D>DKDXDeDrDDDDDDDDDDDDDDhhhh4CpCxB~BBBBBB(D5Dl$5l$5l$饰5l$鸰5l$K5l$龷5l$5l$鴻5l$'5l$隽5l$ 5l$逿5l$5l$f5l$5l$5l$5l$5l$55l$5l${5l$5l$5l$5l$5l$5l$}5l$5l$S5l$5l$5l$5l$5l$b5l$e5l$H5l$5l$5l$5l$5l$5l$ 6l$ 6l$`6l$6l$6l$6l$6l$6l$R6l$6l$x6l$6l$~6l$6l$6l$76l$6l$6l$6l$6l$6l$6l$<6l$6l$6l$!6l$"6l$;#6l$^$6l$a%6l$%6l$&6l$&6l$ '6l$'6l$(6l$(6l$ )6l$)6l$)6l$*6l$*6l$x+6l$+6l$n,6l$,6l$d-6l$-6l$Z.6l$.6l$@/6l$/6l$606l$06l$,16l$16l$"26l$26l$36l$36l$36l$q46l$56l$66l$J66l$66l$@76l$76l$&86l$86l$ 96l$96l$:6l$:6l$:6l${;6l$;6l$a<6l$<6l$G=6l$=6l$>6l$P?6l$?6l$@6l$y@6l$@6l$_A6l$A6l$EB6l$B6l$;C6l$C6l$1D6l$D6l$'E6l$E6l$F6l$F6l$G6l$G6l$ H6l$J6l$K6l$N6l$UN6l$hO6HDNETDx E@lTD E>@E D hE @EHD E@E !D E @pE@ E@`EM"D$pEM@EJ#D4EJ@ >E #D  E @$ED&D E@P`EN&D$̇EN@ TD0'DX ؇E@XFE|'DoE@\p,DK,DX,De,Dr,D,D,D,D,D,D,D,D,D,D,D-D-D-D(-D5-DB-DO-D\-Di-Dv-D-D-D-D-D-D-D-D-D-D-D.D.D.D,.D9.DF.DS.D`.Dm.Dz.D.D.D.D.D.D.D.D.D.D.D /D/D#/D0/D=/DJ/DW/Dd/Dq/D~/D/D/D/D/D/D/D/D/D 0D0D'0D40DA0DN0D[0Dh0Du0D0D, D DxBBBU*Do*Dz0Dm0D)DT D DxBBB*D| D DxBBB|*D D DxBBB*D D DxBBB*D D DxBBB*D D DxBBBD D DxBBB*Dl D DxBBB*D D DxBBB D DxBBBC,D D DxBBB/D/D D DxBBBP,D4 D DxBBB\ D DxBBB D DxBBB,D D DxBBB),D D DxBBB D DxBBB2+D$D DxBBBLD DxBBB+DtD DxBBBD DxBBB6,DD DxBBB*DD DxBBBD DxBBB+D<D DxBBB?+DdD DxBBB,DD DxBBB+DD DxBBB%+DD DxBBB +DD DxBBB,D DxBBBTD DxBBB+D|D DxBBBL+DD DxBBBY+DD DxBBBD DxBBB+DD DxBBB)DDD DxBBB+DlD DxBBB+DD DxBBB)DD DxBBBs+DD DxBBB*D D DxBBB)D4D DxBBB*D\D DxBBB;*DD DxBBB.*DD DxBBB)DD DxBBBD DxBBBf+D$D DxBBBLD DxBBB,DtD DxBBB+DD DxBBB*DD DxBBB/D/D/DD DxBBBD DxBBB)D<D DxBBB*DdD DxBBBD DxBBBD DxBBBD DxBBBD DxBBB!*D,D DxBBB+DTD DxBBB+D|D DxBBBD DxBBBD DxBBB)DD DxBBBD DxBBBDD DxBBBlD DxBBBD DxBBB*DD DxBBBD DxBBB+D D DxBBB4D DxBBBl$;?&l$?&l$N&l$]&l$3_&l$6n&l$K)}&l$&l$鿍&l$7Ž&l$酐&l$鈑&l${&l$;&l$!&l$;锉'l$CDz'l$隸'l$?]'l$G'l$KK(l$OM(l$WYO(l$[ S(l$_/X(l$#Y(l$_(l$e(l$[g(l$h(l$j(l$k(l$m(l$n(l$q(l$x(l$z(l$&|(l$鹄(l$ (l$(l$邒(l$;e(l$(l$g雳(l$?(l$q(l$ (l$w釻(l${ (l$鍾(l$c(l$k(l$(l$(l$(l$o(l$B(l$)l$HY)l$黗)l$)l$*l$%*l$Gc*l$骀*l$*l$ +l$c+l$J+l$驋+l$̦+l$+l$+l$,l$,l$-l$~>-l$Y-l$-l$-l$:-l$o.l$鐊.l$S.l$v.l$.l$.l$C/l$/l$饌/l$X/l$ /l$0l$a 0l$d0l$0l$銞0l$0l$"1l$D1l$\1l$ 1l$|1l$鏯1l$b1l$U1l$1l$ K2l$K2l$qz2l$z2l$3l$:3l$3l$@4l$/4l$g4l$g4l$g4l$?4l$24l$4l$5l$5l$5l$!5l$%5l$g(5l$Z*5l$,5l$05l$95l$;?5l$;?5/HD|NlD  U 1D:E1D1D 1D1DhlpND, x (EE:E:E@P ;EJPDȷ ;EJ@T ;EI QDȷ ;EI@ X;EpQDط ;E@\;EpQD ;Ep@`;EH(RD ;EH@d;E[RD E @=E _D8  >E @=E_D8 >E@ =E X`D8 >E @$=E`D8 $>E@(=E aD8 0>E @ ,DlaDX <>E@ 0H>EEaDx X>EE@4=EaD8 h>E@8=ETbD8 t>E@ <D~bDX |>E~@@=EbD8 >E@D>EXcD >E@HE@LE@PE@ TD. dDX >E.@XE@\E@`EbhDx @Eb@tD8 CE>@h;E4@uD CE4@ lDuDX CE@p;E2uD CE2@tED @FE@=E!TD8 PFE!@=ErD8 \FEr@D͇DODDnjDKDXDeDrDDDDDDDڇDDDDDD(D5DBD\DiDvDDDDDDĈDшDވDDDDDD,D9DFDSD`DmDzDDDDDDȉDՉDDDD DD#D0D=DJDWDdDqD~DDDDDD̊DيDDDD DD'D4DADND[DhDuDDDDDDËDЋD݋DDDDD+D8DEDRD_DlDyDDDDDDԌDDDDDD"D/DD8D0DxBBB D@8D0DxBBBh8D0DxBBB8D0DxBBB#D8D0DxBBB8D0DxBBBD9D0DxBBBD09D0DxBBBDX9D0DxBBB:D9D0DxBBBD9D0DxBBB9D0DxBBBDD9D0DxBBBXD :D0DxBBBDH:D0DxBBBp:D0DxBBBD:D0DxBBBD:D0DxBBB:D0DxBBBъD;D0DxBBBD8;D0DxBBB`;D0DxBBBFD;D0DxBBB;D0DxBBB9D;D0DxBBBD0DxBBBD0>D0DxBBBDX>D0DxBBBȋD>D0DxBBBՋD>D0DxBBBD>D0DxBBBD>D0DxBBBD ?D0DxBBBDH?D0DxBBBp?D0DxBBB?D0DxBBB?D0DxBBBD?D0DxBBBD@D0DxBBB8@D0DxBBB]DD`@D0DxBBB`D@D0DxBBBJD@D0DxBBBmD@D0DxBBBdDAD0DxBBB~D(AD0DxBBBWDPAD0DxBBBDxAD0DxBBBDAD0DxBBBAD0DxBBBݍDAD0DxBBBPD\D߇DDCD҇DBD0DxBBB@BD0DxBBBhBD0DxBBBBD0DxBBBBD0DxBBBBD0DxBBBDCD0DxBBB0CD0DxBBBDXCD0DxBBBCD0DxBBBDCD0DxBBBCD0DxBBBCD0DxBBBÍD DD0DxBBBHDD0DxBBBpDD0DxBBBaDDD0DxBBB̌DDD0DxBBBDD0DxBBB(DED0DxBBBnD8ED0DxBBB`ED0DxBBB{DED0DxBBBED0DxBBBED0DxBBBDFD0DxBBBD(FD0DxBBBPFD0DxBBBDxFD0DxBBBFD0DxBBBDFD0DxBBBFD0DxBBBGD0DxBBBЍD@GD0DxBBBhGD0DxBBBBDGD0DxBBBGD0DxBBBGD0DxBBBDHD0DxBBBrD0HD0DxBBBeDXHD0DxBBBDHD0DxBBBDHD0DxBBB͉DHD0DxBBBHD0DxBBB ID0DxBBBɈDHID0DxBBBpID0DxBBBDID0DxBBBBBBBID0DxBBBDID0DxBBB DJD0DxBBB8JD0DxBBBuD`JD0DxBBBDJD0DxBBBNDJD0DxBBBJD0DxBBBֈDKD0DxBBBD(KD0DxBBBKDPKD0DxBBBDxKD0DxBBBDKD0DxBBBKD0DxBBBSDKD0DxBBBwDLD0DxBBBD@LD0DxBBBhLD0DxBBB-DLD0DxBBBLD0DxBBBLD0DxBBBDMD0DxBBBD0MD0DxBBBXMD0DxBBBjDMD0DxBBBMD0DxBBBMD0DxBBBMD0DxBBB ND0DxBBBHND0DxBBBX$hh0DPBX$hh0DPBX$hh0DPBl$]8l$8l$S8l$F8l$'8l$8l$8l$BH9l$j9l$w9l$鋆9l$9l$遑9l$$9l$9l$9l$9l$鐚9l$9l$Ɲ9l$# 9l$̟9l$O9l$?29l$O9l$W阣9l$9l$'9l$页9l$鴷9l$釹9l$ʺ9l$齼9l$09l$'#9l$9l$9l$9l$O9l$"9l$9l$x9l$39l$9l$9l$t:l$:l$:l$ :l$:l$#:l$6 :l$(:l$L.:l$7Q:l$Z:l$?]:l$8i:l$K:l$鎄:l$q:l$:l$:l$::l$w:l$:l$:l$/F:l$/9:l$:l$:l$K2;l$;l$kX;l$O;l$;l$o1;l$;l$o ;l$_ ;l$W ;l$ ;l$#;l$F;l$i;l$,;l$;l$;l$u;l$8;l$;l$;l$;l$$;l$/;l$M;l$MP;l$Y;l$[;l$];l$9a;l$a;l$?b;l$sb;l$d;l$f;l$h;l$h;l$Ci;l$;l$C釃;l$j;l$靅;l$І;l$;l$6;l$ci;l$鼌;l$;l$";l$U;l$H;l$;l$N;l$達;l$c鴕;l$g闖;l$w*;l$o;l$3;l$鳝;l$v;l$9;l${;l$鏡;l$O钩;l$Se;l$Ȫ;l$_黱;N YTM$X~ 686DD FCE D4HC08E(DIC\EcEl4D<$DC E@D;KChE@LD9GCcEE\D*PFCEhD`IC1E`tDtGC|4EFl||DECE0/FD:, ICE`DJC5FGF@D88GCE(_FLDNxHCED MCl0EFĬDK<$KCFجDLCcEF,0D=GCEdD HCEHpDDdJC@HDlChHDD`[CDHHD,ԘDhCDIH(DgD@hC%E4D1 D~CELDD,zCE\D DCEh;IhD(DxrC(E|DdDCED?DCED&D D`ED0DbCEHD+`DOCHĭD DHHH HHH@HHH(H H @`^ @x\ @Z @X @PGPG`GpGpGGGGGGGGGGGGGTGF(GHGdGGGGGG(G@G\GlG|GGGGGGȒFȒFFF؅F FGGGG4GPG`GxGGGGGGGG(G1.142.131.072.180http SendMessageA^EB]uWL{43826d1e-e718-42ee-bc55-a1e261c37bfe}  LL $  q <<, (,LL, $,0<H CreateFileAdDE@ H th EB GetFileSizedDXEL T thdEBGetFileAttributesAdDEX ` thEBDXEd l thEB FindWindowAtDEp x th(EBFindWindowExAtD`E| thpEB LoadStringAtDE thEB LoadLibraryAdDE thEBRegOpenKeyExAԾD4E thDEBRegEnumKeyExA   ԾD|E thEBRegEnumValueAԾDE thEBRegQueryValueExAԾD$E th8EBRegQueryInfoKeyAԾDpE thEBT  <!\i eEAppData\!ci \Emp\VB448   ,,,,  = 0$(,048<@DHLPTX\`dhlptx|| - 4modLSP.EnumWinsockProtocol ,DD, ,04@  ,,, X00<i , Ei D$Ex?o, ,, `XX<i Eti <E(i (<EL< !i E!i E!i E!i EN3f `ӓ ! $!$i jOE `ӓ ( (,i ,E۶m۶m۶m۶m۶mۄ    $$dDD th EBSysAllocStringByteLenDXE thpEBL 4Forc!dPi St@5Ɩ!=h8+3qClass!JT- C:\Windows\SysWOW64\msvbvm60.dll\3VBRUN8E HElE 0oSetEnvironmentVariableWDEE  thEBGetEnvironmentVariableWDEE  th EB VirtualAllocDED E thT EB VirtualFreeDE E$ th EB HeapAllocDE E(0 th EBDEE4< th!EB msvbvm60NewEnumFraFixingH!ED@H thh!EBH!E4\)e\DAppData\LcaXh&Num_Catalog_Entries"\Catalog_Entries\0p)E0*E tht&EB Crypt32.dllpO10 - Broken Internet access because of LSP chain gap (# in chain of  missing)O10webhdll.dllVO10 - Hijacked Internet access by WebHancer newdotRO10 - Hijacked Internet access by New.Netcnmib.dll CryptCATOpenXO10 - Hijacked Internet access by CommonName*8` `, $(,PT\    @@ pp  Wintrust.dllCryptCATAdminAcquireContextp)E)E  th)EBCryptCATAdminAcquireContext2p)E)E th)EBCryptCATAdminReleaseContext$CryptCATAdminCalcHashFromFileHandlep)EP*E$ tht*EB%CryptCATAdminCalcHashFromFileHandle2p)E*E(0 th*EB!CryptCATAdminEnumCatalogFromHashp)E +E4< th0+EBCryptCATCatalogInfoFromContextp)Eh+E@H th+EB#CryptCATAdminReleaseCatalogContextp)E+ELT th+EBp)Et(EX` th,EBCryptCATClosep)EP,Edl th`,EBCryptCATEnumerateMemberp)E,Epx th,EBWinVerifyTrustp)E,E| th,EBWTHelperProvDataFromStateDatap)E0-E thP-EBWTHelperGetProvSignerFromChainp)E-E th-EBchkDoMD5 CertDuplicateCertificateContext&E-E th .EBCertFreeCertificateContext&ED.E th`.EBCertNameToStrW&E.E th.EB"CertGetCertificateContextProperty&E.E th/EBCertGetNameStringW&EPushFetchUserNameSerializeToHexStringSerializeToArrayDeSerializeArrayDeSerializeHexString6P4)^E8UnpackO25_EntryNameDate FixIDBackups\"UpdateBackupEntry,yyyy\/mm\/dd - hh:nn - BackupDateToDate.reg filescmdnumSectionsnameorig attrib DateC DateM DateA AccessCheckԾDlaE thxaEBMapGenericMaskԾDaE thaEBDuplicateTokenԾDaE thbEB5ConvertSecurityDescriptorToStringSecurityDescriptorWԾD@bE thxbEB5ConvertStringSecurityDescriptorToSecurityDescriptorWԾDbE thbEB SDhashBackupAllocFileregpathhivetype redir emptykey paramdatadataDecodedBackupAllocReg BackupAddCommand$BackupServiceStateBackupFileYj;tsN;6Tdd<'*  (!?(i E?@, ,0 i04 46 68 8< <@ @D!}'D H HJ JL LP PT TV VX XZ Z\ \^ ^` `b b,4  <!i eE CreateNamedPipeWHiveNameHiveNameAndSIDSIDDEeE th0fEBDEpD  thdfEBDE,D thfEBPeekNamedPipeDEfE$ thfEBDisconnectNamedPipeDEgE(0 th,gEBDE̻D4< th`gEBInitClearRepeatAddKeysAddKeyMoveNextKeyAndHiveValueHiveIsSidServiceIsSidUserIsSidDefaultCloneUniq_ClearKeysUniq_ExistsUniq_AddKeyUniq_MoveNextUniq_RepeatPrintAllN4i dED!i eE= BackupKeyBackup created via 'HiJackThis Fork' using 'Autobackup registry (ABR)' by D.Kuznetsov\ABRmnuViewExpand####-##-##fĤIx8<dGq Go 1 GB.-abr.exe /days:\restore.exe \restore_x64.exeO3f `ӓ\HJT.txtTError while creating registry backup (ABR) ABR_CreateBackupbackups\ CUSTOMmnuFindNextRes. size =   HHABR_RunBackup \ABR\restore_x64.exerestore.exe[]*ABR_RecoverFromBackupsysdir.txtHJT.txtABR_EnumBackups ABR_RemoveBackup.RemoveRegistryBackupALL1mnuFindFind(ABR_RemoveByBackupIDlBackupID=*ABR_RestoreByBackupIDdSoftware\Microsoft\Windows\Windows Error ReportingDisabledDontShowUILoggingDisabledhSOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebugAutoReturnValueDisableWERwinmgmts:{impersonationLevel=impersonate}!root\default:SystemRestoreRestoreSRP_RestoreSRP_Remove$SRSetRestorePointASrClient.dllN3f `ӓShowSRP.SRP_IsService_Available 2 GB.SRP_Create_APItSOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestoreFSystemRestorePointCreationFrequency6Restore Point by HiJackThis@:System Restore is turned off. Error = TFailure to end the restore point. Error = CreateRestorePointSRP_Createlwinmgmts:{impersonationLevel=impersonate}!root\defaultSystemRestoreGet EnableMethods_inParametersSpawnInstance_ DriveProperties_ItemWaitTillEnabledExecMethod_mnuFileVerify"SRP_EnableService6WbemScripting.SWbemDateTime6Select * from SystemRestoreExecQueryCountSequenceNumberDescriptionCreationTimeGetVarDateEnumSRP 2modBackup_BackupSplitLinesBackupLine="ListBackups - EndError! Backup entry for this item is no longer exists. Cannot continue.(BackupLoadBackupByID<BackupFindBackupIDByDateOrName2BackupFindBackupIDByFixID,GetListIndexByBackupID&ListBackups - Beginyyyy-mm-ddVERB_FILE_COPY*modBackup_ListBackups(DeleteBackup - Beginbackups$DeleteBackup - End,modBackup_DeleteBackupsBackup= (VError! RestoreBackup: unknown object type: HError! RestoreBackup: unknown verb: Verifier.dlllRegID=!VerifierIsPerUserSettingsEnabledyEyE@H thyEB\Oh! I forgot to implement this recovery type: .. Remind me about this.RestoreBackup Item=rInvalid using BackupExtractFixRegKeyByRegID! RecovType = :BackupExtractFixRegKeyByRegID,BackupValidateFileHashlFileID=(BackupExtractCommand>SRP_ExtractSeqIDFromDescriptionsDescr=FILE_BASEDREGISTRY_BASEDINI_BASEDSERVICE_BASEDCUSTOM_BASEDHError! Unknown RecovType mapping! - mnuFileTriageClose(VERB_GENERAL_RESTORE,VERB_RESTORE_INI_VALUE,VERB_RESTORE_REG_VALUE(VERB_RESTORE_REG_KEY$VERB_FILE_REGISTER$VERB_SERVICE_STATE"VERB_WMI_CONSUMER&VERB_RESTART_SYSTEMFError! Unknown VerbType mapping! - OBJ_FILEOBJ_ABR_BACKUPOBJ_REG_VALUEOBJ_REG_KEYOBJ_SERVICE OBJ_WMI_CONSUMER OBJ_OS OBJ_REG_METADATAJError! Unknown ObjectType mapping! - \x0\u000&H__vbaVarAdd__vbaRecAssignmnuFileTriage__vbaLenVar__vbaStrComp__vbaBoolStr__vbaFpI4__vbaCopyBytes__vbaVarNot__vbaVarCmpNe__vbaCyI2mnuFileCopymnuFind__vbaVarAnd__vbaI4ErrVar__vbaDateR8__vbaNextEachCollAd__vbaLateMemSt__vbaForEachCollAd__vbaVarSub__vbaVarTstGt__vbaVarLateMemCallSt__vbaVarLateMemCallLdRf__vbaVarCmpEq__vbaVarTstEq__vbaVar2VecDeleteFileW__vbaLenBstrB=LȼXGã mnuFileSave__vbaVarTstLt__vbaI2VarwLS9& __vbaStrLike__vbaVargVarRef__vbaStrVarCopy__vbaVarVargNofree__vbaStrErrVarCopyfraSave__vbaVarTstNe__vbaDateVar__vbaI4Var__vbaI4StrStartupList v. fork)CH%FD3&?~E|/C{?BscrSaveSectionsmnuViewRefreshmnuViewmnuHelpStr1mnuOptionsShowCLSIDmnuOptionsShowCmtsmnuOptionsStr2mnuOptionsShowPrivacymnuFileStr2mnuOptionsShowLargeHostsmnuOptionsStr1mnuOptionsShowEmptymnuHelpWarningmnuFileStr1mnuPopupNotepadmnuOptionsShowUsersmnuPopupVerifyFilemnuPopupFileRunScannermnuOptionsShowLargeZonesmnuOptionsShowHardwaremnuViewStr1mnuPopupRegkeyCopymnuPopupCopyNodemnuPopupCopyPathmnuOptionsmnuPopupCLSIDRunScannerchkSectionFilesmnuPopupSaveTreemnuPopupRegJumpchkSectionDisabledmnuPopupFilenameCopychkSectionUserschkSectionHardwarecmdAbortcmdSaveOKcmdSaveCancelchkSectionHijackmnuPopupCopyTreemnuViewCollapsemnuPopupFileGoogle[|2K>F1tvwMain FSeIncreaseBasePriorityPrivilege NtSuspendProcessntdll.dllGetProcesses_Zw$PauseProcess. PID:NtResumeProcess&ResumeProcess. PID:x64\sysnative%SystemRoot%.\Sysnative\taskkill.exe,\System32\taskkill.exe/F /PID ??\%Systemroot%SystemrootgĤIx8AutoStartFoldersIOSUBSYS folder8AutoStartFoldersVMM32 folderTaskScheduler.TaskSchedulerJobsSystem$IniFilessystem.iniIniFileswin.ini.URLScriptPoliciesBatFiles(BatFileswinstart.bat(BatFilesdosstart.bat(BatFilesautoexec.bat$BatFilesconfig.sys&BatFilesautoexec.nt"BatFilesconfig.ntOnRebootActions4OnRebootActionsWininit.iniHostsFilePath4OnRebootActionsWininit.bakShellCommandsServices WinLogonAutoruns(WinLogonGPExtensionsBHOsIEToolbarsUser IEToolbarsSystemIEMenuExtDPFsExplorerClonesProtocolsUtilityManagerHostsFile6ShellServiceObjectDelayLoadMPRServicesCmdProcAutorunWinsockLSP3rdPartyAppsICQmIRCmIRCmirc.inimIRCrfilesmIRCafilesmIRCperform.ini ResetWebSettingsURLPrefix URLDefaultPrefix msconfig9xmsconfigxpStoppedServices&StoppedOnlyServices DisabledServicesXPSecurity XPSecurityCenterXPFirewall XPFirewallDomain$XPFirewallStandard(XPFirewallDomainApps*XPFirewallDomainPorts,XPFirewallStandardApps.XPFirewallStandardPorts"DesktopComponentsAppPathsSafeBootMinimalSafeBootNetworkSafeBootAltWindowsDefender.WindowsDefenderDisabledLsaPackagesLsaPackagesAuthLsaPackagesNotiLsaPackagesSecuDrivers(not found!) 0GetHelpStartupList - End&GetHelpStartupList$2GetSectionFromKey - Begin '' ShellValappddesubsupIniMing0AutoStartFolders Startup src: Folders Startup&FoldersUser Startup>AutoStartFolders Common StartupFolders Common$FoldersUser Common.GetSectionFromKey - End"GetSectionFromKey0ConvertCodePageW - Begin,ConvertCodePageW - End ConvertCodePageW__vbaNextEachCollObj__vbaExitEachColl__vbaForEachCollObj__vbaPrintObj!O3f `ӓ6GetStringFromBinary - Beginid: "FileAndIDHybrid: .inf,Strings2GetStringFromBinary - End&GetStringFromBinary.GetBrowsersInfo - Begin(AppID)*GetBrowsersInfo - End,GetEdgeVersion - Begin\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exeMinorVersion(GetEdgeVersion - End0GetChromeVersion - BeginSoftware\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}pv|SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe>SOFTWARE\Google\Chrome\BLBeaconversion,GetChromeVersion - End2GetFirefoxVersion - Begin~SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe@Software\Mozilla\Mozilla FirefoxCurrentVersion.GetFirefoxVersion - End.GetOperaVersion - BeginUnknownzSoftware\Microsoft\Windows\CurrentVersion\App Paths\Opera.exe*GetOperaVersion - End,GetMSIEVersion - BeginSoftware\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXEHSoftware\Microsoft\Internet ExplorersvcVersionSP(GetMSIEVersion - EndGetMSIEVersion*IsSignPresent - Begin&IsSignPresent - End,modUtils_IsSignPresent.DeleteFileForce - Begin Error * when deleting file: *DeleteFileForce - EndDeleteFileEx"TryUnlock - Begin,\Sysnative\takeown.exe*\Sysnative\icacls.exe*\System32\takeown.exe(\System32\icacls.exe/F  /r /d y /grant:r *:F /T /C /L /grant:r "":F /T /C /L. /grant:r *S-1-1-0:F /L5}+EutX(T8 /grant:r *S-1-5-32-544:F /L :F /L ":F /LTryUnlock - EndTryUnlock.vbpExeName32\SystemRoot\\??\Parser.AppPathProcPath:"Parser.AppExeName.Parser.ParseCommandLineCmdLine: zGPɬO.*DeleteFileWEx - Begin.log.tmp 4  4  VirtualProtectDEPF th`FBvba6FD thFBFE thFBFHE thFBSysFreeString E@F  thPFBDED thFBDED$ thFBDED(0 thFBDED4< th FBDED@H thTFB &DeleteFileWEx - End(Parser.DeleteFileWExFmodUtils.ConvertUnixTimeToLocalDatesec:FmodUtils.ConvertFileTimeToLocalDatelpFileTime:DmodUtils.GetWindowsVersion - BeginSystemRoot\System32 SP(Windows @modUtils.GetWindowsVersion - End"GetWindowsVersionWidthAO3f `ӓHeighthdchwnd?2Program is not associatedGetDefaultAppGetTickCount64 GetTickCount64: dDate: GetTickCount: GetSystemUpTimeDateLastScanHJT: HJT: *yyyy\/MM\/dd HH:nn:ssScanAfterRebootTrimSeconds: V}͔OC FormatDateTime: {}\InProcServer32 AppIDGetTitleByCLSID\LocalServer32GetFileByCLSID AppID\GetTitleByAppIDLocalServiceDllSurrogateGetFileByAppID" (folder missing) (file missing)\rundll32.exe"FormatFileMissingole32 IsEqualGUIDFFLT th FB4$amFilFF\`O HH F F0:s *Dw=UnpackZIP4CreateUninstallKey - Begin"Polshyn StanislavSoftware\Microsoft\Windows\CurrentVersion\Uninstall\HiJackThis Fork HiJackThis Fork UninstallString" /uninstall(QuietUninstallString$" /silentuninstallDisplayIcon,0DisplayVersionPublisherContactURLInfoAboutLhttps://github.com/dragokas/hijackthisHelpLinkrhttps://github.com/dragokas/hijackthis/wiki/HJT:-TutorialInstallLocationNoModifyNoRepairEstimatedSizeLanguageInstallDateyyyymmdd$admin@dragokas.comCommentspCreates a report of non-standard parameters of registry and file system for selectively removal of items related to the activities of malware and security risksRegSaveHJTsFilter=sDefFile=|Software\Microsoft\Windows\CurrentVersion\Uninstall\HiJackThisSoftware\Microsoft\Installer\Products\8A9C1670A3F861244B7A7BFAFB422AA40CreateUninstallKey - End$CreateUninstallKeyIgnore#*DSoftware\TrendMicro\HiJackThisFork<Software\TrendMicro\HiJackThisRegReadHJTN{????????-????-????-????-????????????}*J????????-????-????-????-????????????* HTTP:WWW. HTTPS: WWW2. (*.*)|*.*OpenFileDialogSaveFileDialogsTitle=IFileDialogEventsBf6חKt3IFileDialogControlEventsFoZ\m>oEH3bpc(Jg 2OpenFileDialogVista_MultiInitDir: 4OpenFileDialogVista_Simple!sG3^F#ͼ_Ld=x4.FD.F&SaveFileDialogVistaDefSaveFile: FfrmMainfrmADSspy frmCheckDigiSignfrmUnlockRegKey$" __vbaCheckType__vbaVargVarMove__vbaVargVarCopy__vbaStrDate__vbaDateStr.LNK__vbaCyMulI2__vbaR8Cy__vbaStrCy__vbaVarDiv__vbaStrR4 .exe ::{GetModuleHandleW__vbaGet4USER32.DLLLoadStringW__vbaVarMul$GetServiceRunStateSysWOW64\BSYSTEM\CurrentControlSet\services WOW64IsServiceWow64DSystem\CurrentControlSet\Services\ Start&SetServiceStartMode$\sysnative\net.exe"\system32\net.exe STOP "" /yStopService$\sysnative\cmd.exe"\system32\cmd.exeSTART "</d /c START "" net.exe start """StartServiceDeleteNTService\ParametersServiceDll"GetServiceDllPathImagePath&GetServiceImagePath\systemrootsystemrootsystem32\(CleanServiceFileNameBSystem\CurrentControlSet\Services6GetServiceNameByDisplayName$IsMicrosoftServicewinmgmtSchedule4  ? D Epx thP5FBD@ p4h.WEBSITE.PIF4Parser.GetFileFromShortcut Path: ,GetPathFromIDL - Begin IDL: "shell.application*Parser.GetPathFromIDL: Shell32.dll::NameSpaceselfPathItems(GetPathFromIDL - End iAttr=6GetTargetShellLinkW - Begin PP$(lnk is corrupted) FF2GetTargetShellLinkW - End4Parser.GetTargetShellLinkW0Parser.GetHeaderFromFile0Parser.isFileFilledByNUL ISL_Init - BeginMICROSOFT PIFEXL{00021401-0000-0000-C000-000000000046}Eñ/ISL_Init - EndParser.ISL_Init*GetUrlTargetW - Begin InternetShortcutURL( > 10000 ... (Parser.GetUrlTargetW Stady:$Parser.GetFullPathinArray(Parser.GetPIF_target4Parser.GetEncoding - Begin#\'G7?F#\'G7?F;F;Fd8+O]0Parser.GetEncoding - End$Parser.GetEncodingSource:Data: 0x>Parser.GetEncoding_UTF8 - Begin:Parser.GetEncoding_UTF8 - End.Parser.GetEncoding_UTF8*HiJackThis Fork\Tools.HiJackThis Fork\Plugins<HiJackThis Fork\HiJackThis.lnkBHiJackThis Fork\Uninstall HJT.lnk/uninstallJHiJackThis Fork\Tools\StartupList.lnk"/tool+StartupList MB.) :\\NLists startup items in a convenient wayVHiJackThis Fork\Tools\Uninstall Manager.lnk/tool+UninstManJManage the list of installed softwarefHiJackThis Fork\Tools\Digital Signature Checker.lnk/tool+DigiSign$FolderExists - EndRCheck your PE EXE files digital signature^HiJackThis Fork\Tools\Registry Key Unlocker.lnk"/tool+RegUnlockerXUnlock and reset permissions on registry keyBHiJackThis Fork\Tools\ADS Spy.lnk/tool+ADSSpy$[InternetShortcut]TAlternative Data Streams Scanner & RemoverXHiJackThis Fork\Tools\Hosts File Manager.lnk/tool+Hosts8Manage entries in hosts fileRHiJackThis Fork\Tools\Process Manager.lnk/tool+ProcMan:Little tool like Task Manager Root:^HiJackThis Fork\Plugins\Check Browsers' LNK.lnk/tool+CheckLNKLChecks your PC for shortcuts infectionHHiJackThis Fork\Plugins\ClearLNK.lnk/tool+ClearLNKLLNK / URL Shortcuts cleaner & restorer HiJackThis Fork\.urlzURL=http://regist.safezone.cc/hijackthis_help/hijackthis.htmlPHiJackThis Fork\Users manual (short).urlhURL=http://dragokas.com/tools/help/hjt_tutorial.html&HiJackThis Fork.lnk __vbaNextEachVar__vbaExitEachVar__vbaForEachVar$FileExists - Begin\\?\\\.\\\ FileExists - EndbUseWow64: Exists: $modFile.FileExists(FolderExists - BeginFolder: (modFile.FolderExistsFolder:Redirection: FileLenW - BeginFileLenW - End modFile.FileLenW hFile:FileSize:Return:OpenW - BeginAccess: modFile.OpenW6Trying to open too big file: ($Cannot open file: OpenW - EndGetW - Begin pos: cbToRead: LCannot get file pointer! LastDllErr = LCannot set file pointer! LastDllErr = (modFile.GetW. type #8 of buffer is not supported. Path: Recur:>Cannot read file. LastDllErr = GetW - EndBytesRead: modFile.PutWLOFW - Begin.File is too big. Size: LOFW - End CloseW<ToggleWow64FSRedirection - EndOld State: New State: ,ListSubfolders - Begin(ListSubfolders - End,modFile.ListSubfolders"ListFiles - BeginExt-s: Recur: ListFiles - End"modFile.ListFiles Ext-s:(modFile.ListFiles_Ex:\*.*~4GetFilePropVersion - BeginGetValueFromVBP0GetFilePropVersion - End$GetFilePropVersion2GetVersionFromVBP - BeginMajorVerMinorVerBuildVerRevisionVer.GetVersionFromVBP - End"GetVersionFromVBP.GetValueFromVBP - Begin*GetValueFromVBP - EndisPE0\VarFileInfo\Translation \StringFileInfo\\CompanyName$GetFilePropCompanyDataLen: hData: sCodePage: Buf: DirWIH8Parser.GetFileDate - Begin: 0Parser.GetFileDate - End$Parser.GetFileDate$Parser.GetFileNameA:B:"modFile.GetDrives :modRegistry_GetFirstSubFoldersFolder=ExtractFilename ExtractArguments.ReadFileToArray - Begin*ReadFileToArray - EndReadFileToArraysContents=0ReadFileContents - Begin,ReadFileContents - End ReadFileContents(IniGetString - Begin[]$IniGetString - EndIniGetString sFile=sSection=sValue=IniSetString sData=WriteDataToFilebShowWarning=isUnicode=ReadIniWriteIniFileCopyWDestination:$FindOnPath - Begin%PathExt%,FindOnPath - App PathshSoftware\Microsoft\Windows\CurrentVersion\App Paths\ FindOnPath - EndFindOnPathAppName: (Microsoft)0 <== not a Microsoft !!!6Parser.SplitIntoPathAndArgsIn Line:CopyFolder"DeleteFolderForceDeleteFolderMoveFolderGetDOSFilenameGetLongPathproperties$ShowFileProperties\wininit.ini[rename]NUL=$DeleteFileOnReboot(GetSpecialFolderPath CSIDL:4modFile.GetKnownFolderPathKnownFolderID:>modFile.GetKnownFolderPath_GUIDmodFile.MkDirWIsFile:&%ProgramFiles(x86)%%ProgramFiles%%ProgramData%%LOCALAPPDATA%%APPDATA% %TEMP%%PUBLIC%%USERPROFILE%%SystemDrive%.modFile.EnvironUnexpand&GetDiskFreeSpaceExWFGetDiskFreeSpaceEx is failed with: 0modFile.GetFreeDiscSpace8modFile.GetFileSymlinkTarget4ABCDEFGHIJKLMNOPQRSTUVWXYZ  H`T pгo pCreateTask__vbaLsetFixstrFree__vbaVarIdiv__vbaCyI4__vbaCyMul CreateTask - End$CreateTask - Begin Schedule.ServiceConnectConnectedGetFolderbL|* NewTaskŏmSwOR5o޶smAAˡN\饬JtQٴjIaqԏ-L~P߅$2OMw8r>K]+PT [K*w8{NaMb=LkI Mrk en-TT*PathNormalize - Begin !\??\file:///&PathNormalize - End{root}\User_Feed_Synchronization-{????????-????-????-????-????????????} \msfeedssync.exesyncb{root}\Optimize Start Menu Cache Files-S-1-5-21-*Command\{2D3F8A1B-6DCD-4ED5-BDBA-A096594B98EF},$(Arg0)2\WPD\SqmUpload_S-1-5-21-*,\system32\rundll32.exe0portabledeviceapi.dll,#1b{root}\OneDrive Standalone Update Task-S-1-5-21-*b\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe6modTasks.isInTasksWhiteList\\\,$EnumTasks2 - BeginTasks.csv OSver StateDir RunObjArgsNote Error Tasks Task: {root}\Microsoft\R[OK] EnumTasksInITaskFolder: WhiteListed. en-ZAP[Failed] EnumTasksInITaskFolder: File - H => is not Microsoft EDS !!! <======8Task MS file has wrong EDS: x[Failed] EnumTasksInITaskFolder: NOT WhiteListed !!! <====== - (no file)&Customer ExperienceV!H6G`jzdMExec,Application ExperiencetelemetryNvTmMon.exe*OLicenseHeartbeat.exeL\Microsoft\Windows\IME\SQM data senderNvTmRep.exeActivationschtasks.exegwxjrundll32.exe|schtasks.exe|sc.exe|cmd.exe|wscript.exe|Actionsvmshta.exe|pcalua.exe|powershell.exe|svchost.exe|msiexec.exe http:ftp:O22 - Task: (disabled) (telemetry) (activation) (update)  (Microsoft)LoadDataNodeRemoveNodeRootSerializeNodeByNameNodeValueByNameD4SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\TreeIdSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\s@I"AAppendNodeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\Trundll32.exe shell32.dll,ShellExec_RunDLL EnumTasks2 - EndEnumTasks24 _Ft,LoadFile WorkingDirectoryArgumentsComHandlerClassIdData Settings\EnabledtrueAnalyzeTaskKillTask2.job ReadyRunningNot scheduledxp_eos.exewgasetup.exe&O22 - Task (.job): ) SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures.fpEnumJobs yFHC]46%/P&@intdllRtlGetCompressionWorkSpaceSize sFsF| th8sFBRtlCompressBuffer sFpsF thsFB&CERT_E_PATHLENCONSTDEpD thsFBIsBadWritePtrDE tF th0tFBRtlZeroMemoryDEhtF thxtFBDE8D thtFBDED thtFBSizeBufferPointerCompressStreamWriteDataWriteStreamReadDataLoadFileToStreamSaveStreamToFileP4>ParseJob. Unable to open file: ParseJobRead_Job_String>TRUST_E_NOSIGNATURE: Not signedQ_zgFMePȓSignVerify: Wintrust.dllSignVerifyNOT SUPPORTED.@CryptCATAdminEnumCatalogFromHashL{F750E6C3-38EE-11D1-85E5-00C04FC295EE}L{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}6CryptCATAdminAcquireContextFileSize = .dll.ocxSkipCatCheckFCryptCATAdminCalcHashFromFileHandle8Found in catalogue cache (!)fCryptCATAdminEnumCatalogFromHash: CatalogContext = :HasCatRootVulnerability (!!!)<CryptCATCatalogInfoFromContextWinVerifyTrust8WinVerifyTrust: ReturnVal = GetSignerInfo<GetSignerInfo: HashRootCert = Legit signature.6TRUST_E_SUBJECT_NOT_TRUSTED0TRUST_E_PROVIDER_UNKNOWN,TRUST_E_ACTION_UNKNOWN8TRUST_E_SUBJECT_FORM_UNKNOWNCERT_E_REVOKEDCERT_E_EXPIREDCERT_E_PURPOSE$TRUST_E_BAD_DIGESTPTRUST_E_NOSIGNATURE: Not valid signaturebTRUST_E_EXPLICIT_DISTRUST: Signature is forbidden2CRYPT_E_SECURITY_SETTINGS^CERT_E_UNTRUSTEDROOT: Verified, but self-signedCERT_E_CRITICAL&CERT_E_INVALID_NAME*CERT_E_INVALID_POLICY*CERT_E_ISSUERCHAINING CERT_E_MALFORMED$CERT_E_UNTRUSTEDCA6CRYPT_E_NO_REVOCATION_CHECK2TRUST_E_BASIC_CONSTRAINTS,TRUST_E_CERT_SIGNATURE,TRUST_E_COUNTER_SIGNER4TRUST_E_FINANCIAL_CRITERIA,TRUST_E_NO_SIGNER_CERT(TRUST_E_SYSTEM_ERROR$TRUST_E_TIME_STAMP(Other error. Code = ". LastDLLError = $isMicrosoftSign = NGetSignerInfo + CryptCATEnumerateMemberCrypt: ReleaseE(\System32\catroot2\*L{????????????????????????????????????}&\System32\catroot2\ en-PH.HasCatRootVulnerability,GetSignerInfo. Stady: $1.2.840.113549.2.5MD5 RSA(1.2.840.113549.1.1.4(1.2.840.113549.1.1.5SHA-1 RSA*1.2.840.113549.1.1.11SHA-256 RSA*1.2.840.113549.1.1.12SHA-384 RSAIPcreMatch_FirstIndex*1.2.840.113549.1.1.13SHA-512 RSA"1.2.840.10045.4.1SHA-1 ECDSA&1.2.840.10045.4.3.2SHA-256 ECDSA&1.2.840.10045.4.3.3SHA-384 ECDSA&1.2.840.10045.4.3.4SHA-512 ECDSA"1.2.840.10040.4.3SHA-1 DSAIPcreMatch_SearchedText1.3.14.3.2.3MD5 OIWSEC1.3.14.3.2.251.3.14.3.2.26SHA-1 OIWSEC1.3.14.3.2.27 SHA-1 OIWSEC_DSA1.3.14.3.2.281.3.14.3.2.29 SHA-1 OIWSEC_RSA,2.16.840.1.101.3.4.2.1SHA-256 NIST"HKEY_CURRENT_USER,2.16.840.1.101.3.4.2.2SHA-384 NIST,2.16.840.1.101.3.4.2.3SHA-512 NIST(1.2.840.113549.1.1.2MD2 RSA GetHashNameByOIDOID:4GetSignaturesFromStateData4GetCertInfoFromCertificateCN=O=InstancesOf*GetSignerNameFromBLOB"GetCertNameString8ExtractStringFromCertificate<ExtractPropertyFromCertificate\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}.catLoadCatHashes@C:\Windows\System32\mctadmin.exe__NAMESPACE.C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.catPCDD4EEAE6000AC7F40C3802C171E30148030C072PA43489159A520F0D93D032CCAF37E7FE20A8B419P8F43288AD272F3103B6FB1428485EA3014C0BCFEP7F88CD7223F3C813818C994614A89C99FA3B5247P3B1EFD3A66EA28B16697394703A72CA340A05BD5P245C97DF7514E7CF2DF8BE72AE957B9E04741E85P15693E85E02E411116FB8D7FD97205EEE09150A6sfcfiles.dllP6AF4C632A97856E54597922BF67CB179E93D2553P98725873611882C17A9D478FDC46F9C172552D63P8A334AA8052DD244A647306A76B8178FA215F344PF8DB7E1C16F1FFD4AAAD4AAD8DFF0F2445184AEBP31F9FC8BA3805986B721EA7295C65B3A44534274"modWFP.SFCList_XPP06F1AA330B927B753A40E68CDF22E34BCBEF3352P0119E81BE9A14CD8E22F40AC118C687ECBA3F4D8PEE68C3E94AB5D55EB9395116424E25B0CADD9009PB8095F5A89FB47A7017ED794DD4F611E27830E27P7CA9013D43721551E987380B3EAE4B442DC037EAwintrust3IPcre_IgnoreCaseP3AD38A39CE4E88DCDF46995E969FC339D0799858Microsoft.IsMicrosoftFile. File: :IsMicrosoftDriverFile. File: dUnknown architecture, not PE EXE or damaged image.*IsInternalSignPresent>WinTrustVerifyChildNodes. Key: wintrust12WinTrustVerifyNode. Key: <2(sfc.dllRError! Cannot get sfc.dll library handle..SfcGetNextProtectedFilevError: cannot get SfcGetNextProtectedFile function address!$\Error! Cannot get sfcfiles.dll library handle.SfcGetFiles^Error: cannot get SfcGetFiles function address!Error! Can't get a pointer to FileNames with SfcGetFiles function !%systemroot%\&modWFP.SFCList_XP_0sfc_os.dllXError! Cannot get sfc_os.dll library handle..BeginFileMapEnumeration.CloseFileMapEnumeration*GetNextFileMapContentvError: cannot get BeginFileMapEnumeration function address!S-1-5-32-547S-1-5-12S-1-3-0FAILURE !!!Error! Cannot get handle of first element of BeginFileMapEnumeration.2ERROR_INSUFFICIENT_BUFFERvError: cannot get CloseFileMapEnumeration function address!(modWFP.SFCList_VistaS-1-5-18S-1-5-32-544S-1-5-32-545IRegExpMatch_Value|S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464S-1-15-2-1DSYSTEM\CurrentControlSet\services\ServiceSidTypeNT SERVICE\Sandbox_nErrorHandler: ConvertStringSidToSidW failed with code: . Input buffer: D - OwnerShip granted successfully.: - Error in SetSecurityInfo: 0Error in RegSetOwnerShip H - Permissions granted successfully.> - Failed to grant permissions! Error in SetDACL"HKEY_CLASSES_ROOTHKCRHKCU$HKEY_LOCAL_MACHINEHKLMHKEY_USERSHKU*HKEY_PERFORMANCE_DATA&HKEY_CURRENT_CONFIGHKCCHKEY_DYN_DATA Error in GetHKeyHICLASSES_ROOTCURRENT_USERMACHINE USERSPRIVILEGE: Granted CheckAccessWrite"GetRegKeyStringSD"SetRegKeyStringSD\$STR ST )Swinmgmts:{impersonationLevel=Impersonate, (Security, Backup)}!\\.\4modMain2_WMI_GetNamespacesNamespace: Root\WMIName&Root\directory\LDAP(CheckO25Item - Beginwinmgmts:{impersonationLevel=Impersonate, (Security, Backup)}!\\.\root\subscription"root\subscriptionNSELECT * FROM __FilterToConsumerBindingWQLFilterConsumerpowershell.exe2ActiveScriptEventConsumerScriptFilenameScriptTextScriptingEngineKillTimeout / 0CommandLineEventConsumerExecutablePathWorkingDirectoryCommandLineTemplateRunInteractively (WorkDir = Query__timerevent4__IntervalTimerInstruction.TimerId=IntervalBetweenEvents4__AbsoluteTimerInstructionEventDateTime Event=BVTConsumer&cscript KernCap.vbsKernCap.vbsBVTFilterwscript.execscript.exemshta.exeDelete___InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99"O25 - WMI Event:  (no consumer) (no filter)$CheckO25Item - End*modMain2_CheckO25Itemfrom pcre2-16.dll*RemoveSubscriptionWMI__EventFilterQueryLanguagePut_(__EventFilter.Name="@ActiveScriptEventConsumer.Name=">CommandLineEventConsumer.Name="2__FilterToConsumerBindingPath_SetVarDateSkipIfPassedTimerId hy-AM.modMain2_RecoverO25Item bytes$modMain2_StripCode .Name^modMain2_ExtractNameSpaceAndClassNameFromString4modMain2_GetStringInsideQt(CheckO26Item - Begin@VerifierIsPerUserSettingsEnabledVerifier.dll109.69.8.51HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager*ImageExecutionOptionsSoftware\Microsoft\Windows NT\CurrentVersion\Image File Execution Options O26-32Debuggertaskmgr.exeFileDescription195.46.39.40 Process Explorerntsd -dntsd - Debugger: \..\: [Debugger] = VerifierDllsGlobalFlag 0x100&: [VerifierDlls] =  (disabled)F{ApplicationVerifierGlobalSettings}"VerifierProviders195.46.39.39^ - Debugger Global hook: [VerifierProviders] = vSoftware\Microsoft\Windows\CurrentVersion\PackagedAppXDebugxSoftware\Microsoft\Windows\CurrentVersion\PackagedAppXDebug\" - UWP Debugger:  (default) = VSoftware\Classes\ActivatableClasses\PackageXSoftware\Classes\ActivatableClasses\Package\"\DebugInformation$\DebugInformation\DebugPath [DebugPath] = $CheckO26Item - End*modMain2_CheckO26Item&modMain2_FixO26Item: - Too many entries ( > 250 )dSystem\CurrentControlSet\Services\Tcpip\ParametersDataBasePath \hosts$DEFSTARTPAGE$DEFSEARCHPAGE$DEFSEARCHASS$DEFSEARCHCUST UpdateIE_RegVals ar-YE^http://go.microsoft.com/fwlink/p/?LinkId=255141Xhttp://go.microsoft.com/fwlink/?LinkId=54896lSoftware\Microsoft\Internet Explorer,Default_Page_URL,|,vSoftware\Microsoft\Internet Explorer\Main,Default_Page_URL,176.103.130.130|http://www.msn.com|res://iesetup.dll/HardAdmin.htm|res://iesetup.dll/SoftAdmin.htm|res://shdoclc.dll/softAdmin.htm|,zSoftware\Microsoft\Internet Explorer\Search,Default_Page_URL,pSoftware\Microsoft\Internet Explorer,Default_Search_URL,zSoftware\Microsoft\Internet Explorer\Main,Default_Search_URL,~Software\Microsoft\Internet Explorer\Search,Default_Search_URL,lSoftware\Microsoft\Internet Explorer,SearchAssistant,,lSoftware\Microsoft\Internet Explorer,CustomizeSearch,,ZSoftware\Microsoft\Internet Explorer,Search,,bSoftware\Microsoft\Internet Explorer,Search Bar,,dSoftware\Microsoft\Internet Explorer,Search Page,,bSoftware\Microsoft\Internet Explorer,Start Page,,D<SysRoot>\system32\EhStorShell.dll`Software\Microsoft\Internet Explorer,SearchURL,,`Software\Microsoft\Internet Explorer,(Default),,TSoftware\Microsoft\Internet Explorer,www,,vSoftware\Microsoft\Internet Explorer\Main,SearchAssistant,,<<SysRoot>\SysWOW64\shell32.dllvSoftware\Microsoft\Internet Explorer\Main,CustomizeSearch,,Software\Microsoft\Internet Explorer\Main,Search Bar,http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm|Preserve|,*win.ini;windows;run;;$HKCU,TopResultURL,IPcreOptionsCompileSoftware\Microsoft\Internet Explorer\Main,Search Page,http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch|www.bing.com|,jSoftware\Microsoft\Internet Explorer\Main,SearchURL,,nSoftware\Microsoft\Internet Explorer\Main,Startpagina,,VSoftware\Microsoft\Internet Explorer\Main,Start Page,$DEFSTARTPAGE|http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome|http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home|res://iesetup.dll/HardAdmin.htm|res://iesetup.dll/SoftAdmin.htm|about:Tabs|,Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache,http://ru.msn.com/?ocid=iehp|,Software\Microsoft\Internet Explorer\Search,SearchAssistant,$DEFSEARCHASS|,tSoftware\Microsoft\Internet Explorer\SearchURL,SearchURL,,Software\Microsoft\Internet Explorer\Search,CustomizeSearch,$DEFSEARCHCUST|,nSoftware\Microsoft\Internet Explorer\Search,(Default),,tSoftware\Microsoft\Internet Explorer\SearchURL,(Default),,Fsystem.ini;boot;Shell;explorer.exe;IPcre_PatternSoftware\Microsoft\Internet Explorer\Main,First Home Page,|res://iesetup.dll/HardAdmin.htm|res://iesetup.dll/SoftAdmin.htm,jSoftware\Microsoft\Internet Explorer\Main,HomeOldSP,,pSoftware\Microsoft\Internet Explorer\Main,Window Title,, Software\Microsoft\Internet Explorer\Main,Local Page,%SystemRoot%\System32\blank.htm|%SystemRoot%\SysWOW64\blank.htm|%11%\blank.htm|,tSoftware\Microsoft\Internet Explorer\Main,Start Page_bak,,"LoadStuff - Begin,win.ini;windows;load;;Software\Microsoft\Internet Explorer\Main,Extensions Off Page,about:NoAdd-ons|,Software\Microsoft\Internet Explorer\Main,Security Risk Page,about:SecurityRisk|,Software\Microsoft\Internet Explorer\AboutURLs,blank,res://mshtml.dll/blank.htm|,Software\Microsoft\Internet Explorer\AboutURLs,DesktopItemNavigationFailure,res://ieframe.dll/navcancl.htm|res://shdoclc.dll/navcancl.htm|,Software\Microsoft\Internet Explorer\AboutURLs,SecurityRisk,res://ieframe.dll/securityatrisk.htm|,Software\Microsoft\Internet Explorer\AboutURLs,InPrivate,res://ieframe.dll/inprivate.htm|res://ieframe.dll/inprivate_win7.htm|,Software\Microsoft\Internet Explorer\AboutURLs,PostNotCached,res://ieframe.dll/repost.htm|res://mshtml.dll/repost.htm|,Software\Microsoft\Internet Explorer\AboutURLs,NavigationCanceled,res://ieframe.dll/navcancl.htm|res://shdoclc.dll/navcancl.htm|,Software\Microsoft\Internet Explorer\AboutURLs,NoAdd-onsInfo,res://ieframe.dll/noaddoninfo.htm|,|iexplore.exeSoftware\Microsoft\Internet Explorer\AboutURLs,NavigationFailure,res://ieframe.dll/navcancl.htm|res://shdoclc.dll/navcancl.htm|,Software\Microsoft\Internet Explorer\AboutURLs,NoAdd-ons,res://ieframe.dll/noaddon.htm|, ReLoadIE_RegValsSoftware\Microsoft\Internet Connection Wizard,ShellNext,|http://windowsupdate.microsoft.com/,Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName,Links|Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL,,Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer,,Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride,,HKLM\System\CurrentControlSet\services\NlaSvc\Parameters\Internet\ManualProxies,(Default),,HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command,(Default),%ProgramW6432%>\Internet Explorer\iexplore.exef|%ProgramFiles(x86)%\Internet Explorer\iexplore.exeZ%ProgramFiles%\Internet Explorer\iexplore.exezREG:system.ini;boot;Shell;explorer.exe|%WINDIR%\explorer.exe;REG:system.ini;boot;UserInit;%WINDIR%\System32\userinit.exe|userinit.exe|userinit;4REG:win.ini;windows;load;;2REG:win.ini;windows;run;;(HKCU,SuggestionsURL,IPcreOptionsGeneralxHKCU,SuggestionsURLFallback,http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}L{3A1096B3-9BFA-11D1-AE77-00C04FBBDEBC}CDL)*http://www.google.com\sysdm.cpl|inetcpl.cpl|ncpa.cpl|Firewall.cpl|telephon.cpl|powercfg.cpl|irprops.cpl|joy.cpl|intl.cpl|timedate.cpl|hdwwiz.cpl|mmsys.cpl|main.cpl|desk.cpl|appwiz.cpl|bthprops.cpl*http://search.msn.com0http://ie.search.msn.com198.153.194.60dhdwwiz.cpl|telephon.cpl|appwiz.cpl|ncpa.cpl|sysdm.cpl|desk.cpl|inetcpl.cpl|joy.cpl|mmsys.cpl|Firewall.cpl|powercfg.cpl|intl.cpl|timedate.cpl|main.cpl|tabletpc.cpl|infocardcpl.cpl2http://home.microsoft.com$http://www.msn.com84.200.69.80hdwwiz.cpl|telephon.cpl|appwiz.cpl|ncpa.cpl|sysdm.cpl|desk.cpl|inetcpl.cpl|joy.cpl|mmsys.cpl|Firewall.cpl|powercfg.cpl|intl.cpl|timedate.cpl|main.cpl|collab.cpl|irprops.cpl|tabletpc.cpl|infocardcpl.cpl|bthprops.cpl0http://www.microsoft.comhdwwiz.cpl|telephon.cpl|appwiz.cpl|ncpa.cpl|sysdm.cpl|desk.cpl|inetcpl.cpl|joy.cpl|mmsys.cpl|Firewall.cpl|powercfg.cpl|intl.cpl|timedate.cpl|main.cpl|collab.cpl|irprops.cpl|infocardcpl.cpl|bthprops.cpl4speech.cpl|infocardcpl.cpl84.200.70.40hdwwiz.cpl|appwiz.cpl|ncpa.cpl|sysdm.cpl|desk.cpl|Firewall.cpl|powercfg.cpl|infocardcpl.cpl|bthprops.cplncpa.cpl|sysdm.cpl|desk.cpl|hdwwiz.cpl|Firewall.cpl|powercfg.cpl|appwiz.cpl|infocardcpl.cpl|bthprops.cpl*ncpa.cpl|odbccp32.cplxr12 Lqh*A2antispamlsp.dll*Adlsp.dll*Agbfilt.dll*Antiyfilter.dll*Ao2lsp.dll*Aphish.dll*Asdns.dll*Aslsp.dll*Asnsp.dll*Avgfwafu.dll*Avsda.dll*Betsp.dll*Biolsp.dll*Bmi_lsp.dll*Caslsp.dll*Cavemlsp.dll*Cdnns.dll*Connwsp.dll*Cplsp.dll*Csesck32.dll*Cslsp.dll*Cssp.al*Ctxlsp.dll*Ctxnsp.dll*Cwhook.dll*Cwlsp.dll*Dcsws2.dll*Disksearchservicestub.dll*Drwebsp.dll*Drwhook.dll*Espsock2.dll*Farlsp.dll*Fbm.dll*Fbm_lsp.dll*Fortilsp.dll*Fslsp.dll*Fwcwsp.dll*Fwtunnellsp.dll*Gapsp.dll*Googledesktopnetwork1.dll*Hclsock5.dll*Iapplsp.dll*Iapp_lsp.dll*Ickgw32i.dll*Ictload.dll*Idmmbc.dll*Iga.dll*Imon.dll*Imslsp.dll*Inetcntrl.dll*Ippsp.dll*Ipsp.dll*Iss_clsp.dll*Iss_slsp.dll*Kvwsp.dll*Kvwspxp.dll*Lslsimon.dll*Lsp32.dll*tLspcs.dll*Mclsp.dll*Mdnsnsp.dll*Msafd.dll*Msniffer.dll*Mswsock.dll*Mswsosp.dll*Mwtsp.dll*Mxavlsp.dll*Napinsp.dll*Nblsp.dll*Ndpwsspr.dll*Netd.dll*Nihlsp.dll*Nlaapi.dll*Nl_lsp.dll*Nnsp.dll*Normanpf.dll*Nutafun4.dll*Nvappfilter.dll*Nwws2nds.dll*Nwws2sap.dll*Nwws2slp.dll*Odsp.dll*Pavlsp.dll*Pclsp.dll*Pctlsp.dll*Pfftsp.dll*Pgplsp.dll*Pidlsp.dll*Pnrpnsp.dll*Prifw.dll*Proxy.dll*Prplsf.dll*Pxlsp.dll*Rnr20.dll*Rsvpsp.dll*S5spi.dll*Samnsp.dll*Sarah.dll*Scopinet.dll*Skysocks.dll*Sliplsp.dll*Smnsp.dll*Spacklsp.dll*Spampallsp.dll*Spi.dll*Spidll.dll*Spishare.dll*Spsublsp.dll*Sselsp.dll*Stplayer.dll*Syspy.dll*Tasi.dll*Tasp.dll*Tcpspylsp.dll*Ua_lsp.dll*Ufilter.dll*Vblsp.dll*Vetredir.dll*Vlsp.dll*Vnsp.dll*Wglsp.dll*Whllsp.dll*Whlnsp.dll*Winrnr.dll*Wins4f.dll*Winsflt.dll*WinSysAM.dll*Wps.dll*Wshbth.dll*Wspirda.dll*Wspwsp.dll*Xfilter.dll*xfire_lsp.dll*Xnetlsp.dll*Ypclsp.dll*Zklspr.dll*_Easywall.dll*_Handywall.dll*vsocklib.dll*wlidnsp.dll*ms-itssL{3DD53D40-7B8B-11D0-B013-00AA0059CE02}cdoL{CD00020A-8B95-11D1-82DB-00C04FB1625D}$copernicagentcacheL{AAC34CFD-274D-4A9D-B0DC-C74C05A67E1D}copernicagentL{A979B6BD-E40B-4A07-ABDD-A62C64A4EBF6} dodots4.2.2.6L{9446C008-3810-11D4-901D-00B0D04158D2}DVDL{12D51199-0DB5-46FE-A120-47A3D7D937CC}fileL{79EAC9E7-BAF9-11CE-8C82-00AA004BA90B}ftpL{79EAC9E3-BAF9-11CE-8C82-00AA004BA90B} gopherjavascript198.153.192.50L{79EAC9E4-BAF9-11CE-8C82-00AA004BA90B}L{79EAC9E5-BAF9-11CE-8C82-00AA004BA90B}L{79EAC9E2-BAF9-11CE-8C82-00AA004BA90B} ic32ppL{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}ippitsL{9D148291-B9C8-11D0-A4CC-0000F80149F6}L{3050F3B2-98B5-11CF-BB82-00AA00BDCE0B}junomsgL{C4D10830-379D-11D4-9B2D-00C04F1579A5}lidL{5C135180-9973-46D9-ABF4-148267CBB8BF} local mailtoL{3050F3DA-98B5-11CF-BB82-00AA00BDCE0B}mctp198.153.194.40L{D7B95390-B1C5-11D0-B111-0080C712FE82} mhtmlL{05300401-BCBC-11D0-85E3-00C04FD85AB4}mkL{79EAC9E6-BAF9-11CE-8C82-00AA004BA90B}ms-its50L{F8606A00-F5CF-11D1-B6BB-0000F80149F6}ms-its51198.153.192.404.2.2.1L{F6F1E82D-DE4D-11D2-875C-0000F8105754} ms-itsmso-offdapL{3D9F03FA-7A94-11D3-BE81-0050048385D1} ndwiatL{13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE}resL{3050F3BC-98B5-11CF-BB82-00AA00BDCE0B}sysimagemso-offdap11L{76E67A63-06E9-11D2-A840-006008059382}tve-triggerL{CBD30859-AF45-11D2-B6D6-00C04FBBDE6E}tvL{CBD30858-AF45-11D2-B6D6-00C04FBBDE6E}vbscriptvnd.ms.radioL{3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020}wiaAdguard DNSL{32505114-5902-49B2-880A-1F7738E5A384}DirectDVDL{85A81A02-336B-43FF-998B-FE8E194FBA4D}pcnL{D540F040-F3D9-11D0-95BE-00C04FD93CA5}msencartaL{74D92DF3-6D9D-11D1-8B38-006097DBED7A} msero x-zipzipbegaL{B0D92A71-886B-453B-A649-1B91F93801E7} msrefdf2L{219A97F3-D661-4766-B658-646A771AE49E}df3df4df5df23chatdf5demoofpjoinsaphtmlpL{D1F8BD1E-7967-11D2-B43A-006094B9EADB} sapr3lbxfileL{56831180-F115-11D2-B6AA-00104B2B9943} lbxresL{24508F1B-9E94-40EE-9759-9AF5795ADF52}cetihpzL{CF184AD3-CDCB-4168-A3F7-8E447D129300}aim shellaspL{8D32BA61-D15B-11D4-894B-000000000000}hsp x-asp x-hspL{A57721C9-B905-49B3-8BCA-B99FBB8C627E}bt2L{1730B77B-F429-498F-9B15-4514D83C8294}*copernicdesktopsearchL{D9656C75-5090-45C3-B27E-436FBC7ACFA7} crickL{B861500A-A326-11D3-A248-0080C8F7DE1E}dadb198.153.194.1L{82D6F09F-4AC2-11D3-8BD9-0080ADB8683C} dialuxL{8352FA4C-39C6-11D3-ADBA-00A0244FB1A2} emistpL{0EFAEA2E-11C9-11D3-88E3-0000E867A001} ezstorL{6344A3A0-96A7-11D4-88CC-000000000000} flowto198.153.192.14.2.2.2L{C7101FB0-28FB-11D5-883A-204C4F4F5020}g7psL{9EACF0FB-4FC7-436E-989B-3197142AD979}intu-resL{9CE7D474-16F9-4889-9BB9-53E2008EAE8A}iwdL{EA5F5649-A6C7-11D4-9E3C-0020AF0FFB56}mavencache199.85.127.304.2.2.3L{DB47FDC2-8C38-4413-9C78-D1A68BF24EED}ms-helpL{314111C7-A502-11D2-BBCA-00C04F8EC294} msnimL{828030A1-22C1-4009-854F-8E305202313F}myrmL{4D034FC3-013F-4B95-B544-44D49ABE3E76}nbso<<SysRoot>\system32\SHELL32.dllL{DF700763-3EAD-4B64-9626-22BEEFF3EA47}nimL{3D206AE2-3039-413B-B748-3ACC562EC22A} OWC11.mso-offdappclL{182D0C85-206F-4103-B4FA-DCC1FB0A0A44}pure-goL{4746C79A-2042-4332-8650-48966E44ABA8}qrev199.85.126.30L{9DE24BAC-FC3C-42C4-9FC4-76B3FAFDBD90}rmhL{23C585BB-48FF-4865-8934-185F0A7EB84C} SafeAuthenticateL{8125919B-9BE9-4213-A1D6-75188A22D21E}sdsL{79E0F14C-9C52-4218-89A7-7C4B0563D121}siteadvisor199.85.127.20L{3A5DC592-7723-4EAA-9EE6-AF4222BCF879} smscrdL{FA3F5003-93D4-11D2-8E48-00A0C98BD8C3} stiboL{FFAD3420-6D61-44F6-BA25-293F17152D79}.textwareilluminatorbaseL{CE5CD329-1650-414A-8DB0-4CBF72FAED87} widimg199.85.126.20L{EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA}wlmailhtmlL{03C514A3-1EFB-4856-9F99-10D7BE1653C0} x-atngL{7E8717B0-D862-11D5-8C9E-00010304F989}x-excidL{9D6CC632-1337-4A33-9214-2DA092E776F4} x-mem1,application/vnd-viewerL{C3719F83-7EF8-4BA0-89B0-3360C7AFB7CC} x-mem3L{4F6D06DD-44AB-4F89-BF13-9027B505B15A}ctL{774E529C-2458-48A2-8F57-3ED3105D8612}cwetiL{3AAE7392-E7AA-11D2-969E-00105A088846}livecall tbauth<SysRoot>L{14654CA6-5711-491D-B89A-58E571679951}windows.tbauthmsdaipp{E1D2BF40-A96B-11D1-9C6B-0000F875AC61}|{E1D2BF42-A96B-11D1-9C6B-0000F875AC61}0application/octet-streamL{32B533BB-EDAE-11d0-BD5A-00AA00B92AF1}deflate4.2.2.5{1E66F26B-79EE-11D2-8710-00C04F79ED0D}|{F969FE8E-1937-45AD-AF42-8A4D11CBDC2A}0application/x-msdownloadL{1E66F26B-79EE-11D2-8710-00C04F79ED0D}Fapplication/vnd-backup-octet-stream*application/x-complus*Class Install HandlerL{8f6b0360-b80d-11d0-a9b3-006097942311}gziplzdhtml text/webviewhtmlL{733AC4CB-F1A4-11d0-B951-00A0C90312E1}text/xml0application/vnd.ms-excel:application/vnd.ms-powerpointJapplication/x-microsoft-rpmsg-message{807553E5-5146-11D5-A672-00B0D022E945}|{807563E5-5146-11D5-A672-00B0D022E945}|{32F66A26-7614-11D4-BD11-00104BD3F987}"application/x-icqL{db40c160-09a1-11d3-baf2-000000000000}$application/mswordL{DFF82902-0B96-3B98-6F62-D655E146A23A}L{CD4527E8-4FC7-48DB-9806-10537B501237}"application/x-bt2L{6E1DDCE8-76BC-4390-9488-806E8FB1AD77}:application/x-internet-signupL{A173B69A-1F9B-4823-9FDA-412F641E65D6}text/htmlL{35CEC8A3-2BE6-11D2-8773-92E220524153}x;thI{8D42AD12-D7A1-4797-BCB7-AD89E5FCE4F7}|{F79B2338-A6E7-46D4-9201-422AA6E74F43}text/x-mrmlL{C51721BE-858B-4A66-A8BF-D2882FF49820}*application/xhtml+xmlL{32F66A26-7614-11D4-BD11-00104BD3F987}L{E6FB5E20-DE35-11CF-9C87-00AA005127ED}*aakah.dll*akdllnt.dll*ROUSRNT.DLL*ssohook*KATRACK.DLL*APITRAP.DLL*UmxSbxExw.dll*sockspy.dll*scorillont.dll*wbsys.dll*NVDESK32.DLL*hplun.dll*mfaphook.dll*PAVWAIT.DLL*OCMAPIHK.DLL*MsgPlusLoader.dll*IconCodecService.dll*wl_hook.dll*Google\GOOGLE~1\GOEC62~1.DLL*adialhk.dll*wmfhotfix.dll*interceptor.dll*qaphooks.dll*RMProcessLink.dll*msgrmate.dll*wxvault.dll*ctu33.dll*ati2evxx.dll*vsmvhk.dll*L{7849596a-48ea-486e-8937-a2a3009f31a9}L{fbeb8a05-beee-4442-804e-409d6c4515e9}L{11566B38-955B-4549-930F-7B7482668782}L{7007ACCF-3202-11D1-AAD2-00805FC1270E}L{e57ce738-33e8-4c51-8354-bb4de9d215d1}<<SysRoot>\system32\ntshrui.dllL{BCBCD383-3E06-11D3-91A9-00C04F68105C}L{F5DF91F9-15E9-416B-A7C3-7519B11ECBFC}L{AAA288BA-9A4C-45B0-95D7-94D524869DB5}L{1799460C-0BC8-4865-B9DF-4A36CD703FF0}L{6D972050-A934-44D7-AC67-7C9E0B264220}8<SysRoot>\system32\cscui.dll<<SysRoot>\system32\shell32.dll*crypt32chain*cryptnet*cscdll*ScCertProp*Schedule*SensLogn*termsrv*wlballoon*igfxcui*AtiExtEvent*wzcnotif*208.67.222.222208.67.220.220$Norton ConnectSafe199.85.126.10199.85.127.10ActiveSync*atmgrtok*avldr*Caveo*ckpNotify*Command AntiVirus Download*ComPlusSetup*CwWLEvent*dimsntfy*DPWLN*EFS*FolderGuard*GoToMyPC*IfxWlxEN*igfxcui*IntelWireless*klogon*LBTServ*LBTWlgn*LMIinit*loginkey*MCPClient*MetaFrame*NavLogon*NetIdentity Notification*nwprovau*OdysseyClient*OPXPGina*PCANotify*pcsinst*PFW*PixVue*ppeclt*PRISMAPI.DLL*PRISMGNA.DLL*psfus*QConGina*RAinit*RegCompact*SABWinLogon*SDNotify*Sebring*STOPzilla*sunotify*SymcEventMonitors*T3Notify*TabBtnWL*Timbuktu Pro*tpfnf2*tpgwlnotify*tphotkey*VESWinlogon*WB*WBSrv*WgaLogon*wintask*WLogon*WRNotifier*Zboard*zsnotify*sclgntfy**vrfcore.dll*vfbasics.dll*vfcompat.dll*vfluapriv.dll*vfprint.dll*vfnet.dll*vfntlmless.dll*vfnws.dll*vfcuzz.dll* Google8.8.8.88.8.4.4Verisign64.6.64.664.6.65.6 SkyDNS193.58.251.251Cisco OpenDNS4.2.2.4176.103.130.131Yandex.DNS77.88.8.877.88.8.177.88.8.8877.88.8.277.88.8.777.88.8.3"Comodo Secure DNS8.26.56.268.20.247.20@Verizon / Level 3 Communications209.244.0.3209.244.0.4Dyn216.146.35.35216.146.36.36FreeDNS37.235.1.17437.235.1.177Alternate DNS198.101.242.7223.253.163.53Rejector95.154.128.3278.46.36.8SmartViper208.76.50.50208.76.51.51puntCAT@Neustar DNS Advantage / UltraDNS156.154.70.1156.154.71.1156.154.70.5156.154.71.5GreenTeamDNS81.218.119.11209.88.198.133GTE192.76.85.133206.124.64.1$Hurricane Electric74.82.42.42,Sprintlink General DNS204.117.214.10199.2.252.10204.97.212.10&Chaos Computer Club194.150.168.168213.73.91.3585.214.20.141censurfridns.dk89.233.43.7191.239.100.100CyberGhostFreenom38.132.106.139194.187.251.67185.93.180.131209.58.179.18627.50.70.139DNSReactor45.55.155.25104.236.210.29FDN80.67.169.1280.67.169.40&Lightning Wire Labs81.3.27.5474.113.60.18580.80.80.8080.80.81.81 Quad99.9.9.10 Xiala77.109.148.13677.109.148.137zMicrosoft Enforced Licensing Registration Authority CA (SHA1)PFA6660A94AB45F6A88C0D7874D89A863D74DEE974DigiNotar Services 1024 CAPF8A54E03AADC5692B850496A4C4630FFEAA29D83login.yahoo.comPD018B62DC518907247DF50925BB09ACF4A5CB3ADlogin.live.comPCEA586B2CE593EC7D939898337C57814708AB2BE"DigiNotar Root CAPC060ED44CBD881BD0EF86C0BA287DDCF8167478C*ܑ(NdF $DigiNotar Cyber CAPB86E791620F759F17B8D25E38CA8BE32E7D5EAC2BDigiNotar PKIoverheid CA OverheidPB533345D06F64516403C00DA03187D3BFEF59156P9845A431D51959CAF225322B4A4FE9F223CE6D15:Digisign Server ID - (Enrich)StartScan - EndP8E5BD50D6AE686D65252F843A9D4B96D197730ABP86E817C81A5CA672FE000F36F878C19518D6F844P80962AE4D6C5B442894E95A13E4A699E07D694CF*Microsoft CorporationP7D7F4414CCEF168ADF6BF40753B5BECD78375931mail.google.com(Logging is finished.P6431723036FD26DEA502792FA595922493030F97P63FEAE960BAA91E343CE2BD8B71798C76BDB77D0P637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6global trusteeP61793FCBFA4F9008309BBA5FF12D2CB29CD4151ARDigiNotar PKIoverheid CA Organisatie - G2P5DE83EE82AC5090AEA9D6AC4E7A6E213F946E1796Digisign Server ID (Enrich)P51C3247D60F356C7CA3BAF4C3F429DAC93EE7B74login.skype.comP471C949A8143DB5AD5CDF1C972864A2504FA23C9(DigiNotar Root CA G2FMicrosoft Online Svcs BPOS APAC CA2P43D9BCB568E039D073A74A71D8511F7476089CC3\DigiNotar PKIoverheid CA Overheid en BedrijvenP40AA38731BD189F9CDB5B9DC35E2136F38777AF4ZMicrosoft Enforced Licensing Intermediate PCAP3A850044D8A195CD401A680C012CB0A3B5F8DC08IPcreMatchesP367D4B3B4FCBBC0B767B2EC0CDB2A36EAB71A4EB$addons.mozilla.orgP305F8BD17AA2CBC483A4C41B19A39A0C75DA39D6P2B84BFBB34EE2EF949FE1CBE30AA026416EB2216P2A83E9020591A55FC6DDAD3FB102794C52B24E70www.google.com"StartScan - BeginP1916A2AF346D399F50313C393200F14140456616:e-islem.kktcmerkezbankasi.orgPF92BE5266CC05DB2DC0DC3F2DC74E02DEFD949CB<Microsoft Online Svcs BPOS CA2PF5A874F3987EB0A9961A564B669A9050F770308AFMicrosoft Online Svcs BPOS EMEA CA2PE9809E023B4512AA4D4D53F40569C313C1D0294DFMicrosoft Online Svcs BPOS APAC CA3PE95DD86F32C771F0341743EBD75EC33C74A3DED9fMicrosoft Genuine Windows Phone Public Preview CA01PE38A2B7663B86796436D8DF5898D9FAA6835B238"modMain_LoadStuffPD8CE8D07F9F19D2569C2FB854401BC99C1EB7C3BFMicrosoft Online Svcs BPOS APAC CA1PD43153C8C25F0041287987250F1E3CABAC8C2177FMicrosoft Online Svcs BPOS APAC CA5PD0BB3E3DFBFB86C0EEE2A047E328609E6E1F185E*.EGO.GOV.TRTime spent: PC69F28C825139E65A646C434ACA5A1D200295DB1$Microsoft IPTVe CAPBED412B1334D7DFCEBA3015E5F9F905D571C45CF2Microsoft Online Svcs CA5PA81706D31E6F5C791CD9D3B1B9C63464954BA4F5FMicrosoft Online Svcs BPOS EMEA CA3&Alpha Networks Inc.PA7B5531DDC87129E2C3BB14767953D6745FB14A6FMicrosoft Online Svcs BPOS EMEA CA1PA35A8C727E88BCCA40A3F9679CE8CA00C26789FD2Microsoft Online Svcs CA1PA221D360309B5C3C4097C44CC779ACC5A9845B66,Microsoft Online CA001Service Pack: PA1505D9843C826DD67ED4EA5209804BDBB0DF5022Microsoft Online Svcs CA3P8977E8569D2A633AF01D0394851681CE122683A6FMicrosoft Online Svcs BPOS EMEA CA6P838FFD509DE868F481C29819992E38A4F7082873<Microsoft Online Svcs BPOS CA1 sRule=P7613BF0BA261006CAC3ED2DDBEF343425357F18B2Microsoft Online Svcs CA4P6690C02B922CBD3FF0D0A5994DBD336592887E3FP5D5185DF1EB7DC76015422EC8138A5724BEE2886 AC DG Tresor SSLP5CE339465F41A1E423149F65544095404DE6EBE2LoadStuff - EndP587B59FB52D8A683CBE1CA00E6393D7BB923BC92P4ED8AA06D1BC72CA64C47B1DFE05ACC8D51FC76FP4DF13947493CFF69CDE554881C5F114E97C3D03B*.google.comP4D8547B7F864132A7F62D9B75B068521F10B68E3LCN=Microsoft Online Svcs BPOS APAC CA4 sec.P3A26012171855D4020C973BEC3F4F9DA45BD2B83P374D5B925B0BD83494E656EB8087127275DB83CEFMicrosoft Online Svcs BPOS EMEA CA4P330D8D3FD325A0E5FDDDA27013A2E75E7130165FP23EF3384E21F70F034C467D4CBA6EB61429F174E2Microsoft Online Svcs CA6P09FF2CC86CEEFA8A8BB3F2E3E84D6DA3FABBF63EFMicrosoft Online Svcs BPOS EMEA CA5P09271DD621EBD3910C2EA1D059F99B8181405A17FMicrosoft Online Svcs BPOS APAC CA6P08738A96A4853A52ACEF23F782E8E1FEA7BCED02DSDTestProvider (Safe Boot)P02C2D931062D7B1DC2A5C7F5F0685064081FB221www.live.fiP08E4987249BC450748A4A78133CBF041A3510033$D-LINK CORPORATIONP3EB44E5FFE6DC72DED703E99902722DB38FFD1CB0NIC Certifying AuthorityP4822824ECE7ED1450C039AA077DC1F8AE3489BBFP7311E77EC400109D6A5326D8F6696204FD59AA3B*.xboxlive.comP8B2E65A5DA17FCCCBCDE7EF87B0C0ED5D0701F9FKEEBOX, INCP915A478DB939925DA8D9AEA12D8BBA140D26599CeDellRootP98A04E4163357790C4A79E6D713FF0AF51FE6927NIC CA 2011PC6796490CDEEAAB31AED798752ECD003E6866CB2NIC CA 2014PD2DBF71823B2B8E78F5958096150BFCB97CC388ATRENDnet, Inc.PDB5042ED256FF426867B332887ECCE2D95E79614MCSHOLDING TESTPE1F3591E769865C4E447ACC37EAFC9E2BFE4C576ProcList(Whole EDS function: ##0.000 sec.:CryptCATAdminAcquireContext: JCryptCATAdminCalcHashFromFileHandle: DCryptCATAdminEnumCatalogFromHash: WinVerifyTrust: GetSignerInfo: Release: 2CryptCATEnumerateMember: J G"modMain_StartScanO3f `ӓ(K鞟^Progressbar - F2F3O7-CertO7-Trouble O7-ACLO7-IPSec O23-DModuleList Backup Report Finish2modMain_UpdateProgressBar shpProgress.Tag=/ G>:;$,ProcessRuleReg - Begin Rule: (Default)%2e R0 - R0-32 - : (default)(empty)ProxyEnable R1 - R1-32 -  (enabled) R2 - R2-32 - (ProcessRuleReg - End,modMain_ProcessRuleReg&CheckR3Item - BeginfSoftware\Microsoft\Internet Explorer\URLSearchHooksL{CFBFAE00-17A6-11D0-99CB-00C04FD64497}\ieframe.dll\shdocvw.dll R3 - D: Default URLSearchHook is missing2Microsoft Url Search HookF2-32 - ThreadingModelApartmentR3-32 - (\..\URLSearchHooks: "CheckR3Item - End&modMain_CheckR3Item&CheckR4Item - BeginbSoftware\Microsoft\Internet Explorer\SearchScopesDefaultScopeptagconlogoFixR4ItemtSoftware\Policies\Microsoft\Internet Explorer\SearchScopes&SuggestionsURL_JSONSuggestionsURL,SuggestionsURLFallbackTopResultURL(TopResultURLFallback&R4 - SearchScopes: : [] = "CheckR4Item - EndIRegExpMatchN\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}L{0633EE93-D776-472f-A0FF-E1416B8B2E3A}BingFaviconURL>http://www.bing.com/favicon.ico$FaviconURLFallbackNTLogoPathL\Microsoft\Internet Explorer\Services\NTLogoURLhttp://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast} NTSuggestionsURLhttp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR NTURL{language}mktsetlang@http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IENTSSNTTopResultURLFhttp://search.live.com/results.aspx${ie:sectionHeight}http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSRCheckR4ItemPhttp://search.microsoft.com/results.aspx4http://www.bing.com/search>http://www.bing.com/as/api/qsml:http://api.bing.com/qsml.aspx marketHhttp://api.search.live.com/qsml.aspxq query{searchTerms}srcIEIE-SearchBoxIE-TopResult${referrer:source?}formpcmaxwidth{ie:maxWidth}rowheight{ie:rowHeight}sectionheight,CheckFileItems - Begin.inipCheckFileItems: Spelling error or decrypting error for: REG F0 - boot F1 - windowsjSoftware\Microsoft\Windows NT\CurrentVersion\WinLogonUserInituserinit.exe F2 - \..\WinLogon: hSoftware\Microsoft\Windows NT\CurrentVersion\Windows F3 - F3-32 - \..\Windows: (CheckFileItems - End4modMain_ProcessRuleIniFile4CheckO1Item_DNSApi - Begin$\drivers\etc\hosts\WebBrowser(\system32\dnsapi.dll(\syswow64\dnsapi.dllx32syswow644modMain_CheckO1Item_DNSApi"File is too big:  (Allowed: 0 byte max., current is: byte.)>O1 - DNSApi: File is patched - 0CheckO1Item_DNSApi - End.CheckO1Item_ICS - Begin\hosts.ics>\System32\drivers\etc\hosts.ics.icsDO1 - Unable to read Hosts.ICS file O1 - Hosts.ICS: TO1 - Unable to read Hosts.ICS default file0O1 - Hosts.ICS default: FlushDNS*CheckO1Item_ICS - EndCheckO1Item_ICS&CheckO1Item - Begin6\System32\drivers\etc\hosts O1 - DatabasePath(O1 - Hosts: is emptyJO1 - Hosts: Unable to read Hosts filejO1 - Hosts: is damaged (contains NUL characters only)&127.0.0.1 localhostO1 - Hosts: JO1 - Hosts: Reset contents to defaultjO1 - Hosts default: Unable to read Default Hosts filezO1 - Hosts default: is damaged (contains NUL characters only)(O1 - Hosts default: /flushdnsZO1 - Hosts default: Reset contents to default"CheckO1Item - End&modMain_CheckO1ItemO1 - DNSApi:B%SystemRoot%\System32\drivers\etc hostshosts.newFixO1Item - End"modMain_FixO1Itemdnscacheipconfig.exe&CheckO2Item - BeginSoftware\Microsoft\Windows\CurrentVersion\explorer\Browser Helper ObjectsHKCR\CLSID\{CLSID}xSoftware\Microsoft\Internet Explorer\Extension CompatibilityfSoftware\Microsoft\Windows\CurrentVersion\Ext\StatslSoftware\Microsoft\Windows\CurrentVersion\Ext\SettingsrSoftware\Microsoft\Windows\CurrentVersion\Ext\PreApprovedSoftware\Microsoft\Internet Explorer\ApprovedExtensionsMigrationF\ApprovedExtensionsMigration{CLSID}"modMain_FixO2ItemxSoftware\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID MSHist}} Clsid\\ProgID \Clsid"\Microsoft Office O2-32\..\BHO: {CLSID}"CheckO2Item - End&modMain_CheckO2Itemiexplore.exe O3-32&CheckO3Item - BeginXSoftware\Microsoft\Internet Explorer\ToolbardSoftware\Microsoft\Internet Explorer\Explorer BarsToolbarExplorer BarsxSOFTWARE\Microsoft\Internet Explorer\Extension Compatibility&\system32\msdxm.ocx\ShellBrowser HKCR\"CheckO3Item - End&modMain_CheckO3Item6GetUserNamesAndSids - Begin.DEFAULTS-#-#-#*2GetUserNamesAndSids - End6modMain.GetUserNamesAndSids.CheckO4_RegRuns - Begin)=BG2{ZSoftware\Microsoft\Windows\CurrentVersion\RunRunjSoftware\Microsoft\Windows\CurrentVersion\RunServicesRunServicesbSoftware\Microsoft\Windows\CurrentVersion\RunOnceRunOnceZSOFTWARE\Microsoft\Windows\CurrentVersion\RunrSoftware\Microsoft\Windows\CurrentVersion\RunServicesOnceRunServicesOnce~Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run*Policies\Explorer\Run\Software\Microsoft\Windows\CurrentVersion\Run-Run-AltStartuplSoftware\Microsoft\Windows\CurrentVersion\RunServices-RunServices-dSoftware\Microsoft\Windows\CurrentVersion\RunOnce-RunOnce-tSoftware\Microsoft\Windows\CurrentVersion\RunServicesOnce- RunServicesOnce-"UseAlternateShellSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\ Run32 O4-32 (User '')OneDrive8\Windows Sidebar\Sidebar.exe/autoRun,\System32\mctadmin.exe$\OneDriveSetup.exe/thfirstsetup:\6TaHIw~b\Internet Explorer\Connection Wizard\icwconn1.exe/desktop(\system32\CTFMON.EXE<oobefldr.dll,ShowWelcomeCenter,\system32\oobefldr.dll8\Windows Sidebar\sidebar.exe/detectMem,\system32\internat.exeGlobal Startup<\Windows Defender\MSASCuiL.exeHSoftware\Microsoft\Command ProcessorAutorun"Command ProcessorzHKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram.BootVerificationProgramautochk.exe /q /v *\OptionsjHKLM\System\CurrentControlSet\Control\Session ManagerBootExecuteSession Manager\HKLM\SYSTEM\CurrentControlSet\Control\SafeBootAlternateShellcmd.exeSafeBootautocheck autochk *DfsInitautochk /q /v *&autocheck autochk *6PendingFileRenameOperations8PendingFileRenameOperations2-> DELETE-> BatInit.batWinStart.batDosStart.batAutoExec.batAutoExec.ntConfig.ntREM@echo off" more characters)Jlh %SystemRoot%\system32\mscdexnt.exe<lh %SystemRoot%\system32\redir:lh %SystemRoot%\system32\dosx<SET BLASTER=A220 I5 D1 P330 T3dos=high, umbLdevice=%SystemRoot%\system32\himem.sysFiles=40 ... (yyyy\/mm\/dd O4 - Win9x BAT: O4 - WinNT BAT:  =>  (0 bytes)fSOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceExRunOnceExvSOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnceEx"RunServicesOnceEx O4 -  [Startuptopen|shellexecute|shell\open\command|shell\explore\commandautorun.infautorun$O4 - Autorun.inf: (unknown target)~Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2.modMain.CheckO4_RegRunsHKU\S-1-5-20|shell\AutoRun\command|shell\open\command|shell\explore\command" - MountPoints2: : (default) = *Control Panel\DesktopSCRNSAVE.EXE (None)R\Control Panel\Desktop: [SCRNSAVE.EXE] = *CheckO4_RegRuns - End= lQ5Dk]q0CheckO4_MSConfig - Begin1601/01/01HKU\\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\\\SOFTWARE\Microsoft\Windows\CurrentVersion\Run(\..\StartupApproved\] HKU\S-1-5-18HKU\S-1-5-19h\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupregcommandYEAR MONTHDAYhkey4O4 - MSConfig\startupreg:  [command] = vHKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder backupCommon Startup:O4 - MSConfig\startupfolder:  [backup] =>  [backup] =  (no file),CheckO4_MSConfig - End0modMain.CheckO4_MSConfig>CheckO4_AutostartFolder - BeginHKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"Common AltStartup"Global AltStartupHKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders&Global User Startup,Global User AltStartupHKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell FoldersHKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell FoldersUser StartupUser AltStartup HKCU\&Startup other users...\ (folder)desktop.ini>modMain.CheckO4_AutostartFolder&CheckO4Item - Begin\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolderF\..\StartupApproved\StartupFolder:  -> $ -> (PE EXE)D\..\StartupApproved\StartupFolder::CheckO4_AutostartFolder - EndKH3KI!"CheckO4Item - End&modMain_CheckO4Item"FillUsers - BeginFillUsers - EndFillUsers GetHives - BeginS-1-5-19S-1-5-20GetHives - EndGetHives:StartupApproved\StartupFolder"modMain_FixO4Item (Disk: &CheckO5Item - Begin:HKCU\Control Panel\don't loadHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\don't load O5-32\control.inidon't load>O5 - control.ini: [don't load] control.ini"CheckO5Item - End&modMain_CheckO5Item"modMain_FixO5Item&CheckO6Item - BegintSoftware\Policies\Microsoft\Internet Explorer\RestrictionsSoftware\Policies\Microsoft\Internet Explorer\Toolbars\RestrictionsB%USERPROFILE%\Local Settings\TempIRegExpSubMatchesvSoftware\Policies\Microsoft\Internet Explorer\Control Panel O6-32 - IE Policy:  - presentSOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings$Security_HKLM_only,WindowsPowerShell\v1.0Wbem .PG31CԆO6 - IE Policy: HKLM\..\Internet Settings: [Security_HKLM_only] = 1"CheckO6Item - End&modMain_CheckO6Item6CheckSystemProblems - BeginHKLM\SYSTEM\CurrentControlSet\Control\Session Manager\EnvironmentPath2Iʳ6zzO7 - TroubleShooting: (EV) %PATH% has missing system folder: TEMPTMP\Environment6O7 - TroubleShooting: (EV) "\..\Environment:  = (not exist)4 (wrong type of parameter) = (empty value)"%SystemRoot%\TEMP@%USERPROFILE%\AppData\Local\Temp (folder missing)ZCheckSystemProblems - TroubleShooting: (Disc)`O7 - TroubleShooting: (Disk) Free disk space on  is too low =  MB.`CheckSystemProblems - TroubleShooting: (Network)IPcreMatchO7 - TroubleShooting: (Network) Computer name (hostname) is not set (should be: 2CheckSystemProblems - End&CheckSystemProblems8CheckCertificatesEDS - BeginzSOFTWARE\Microsoft\SystemCertificates\Disallowed\CertificatesBlob& (Well-known cert.)FraudulentUntrusted, (HJT: possible, safe)JO7 - Policy: [Untrusted Certificate] ~O7 - Policy: [Untrusted Certificate] Fix all items from the lognSOFTWARE\Microsoft\SystemCertificates\ROOT\CertificatespSOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\localhost|New Root certificate is detected! Report to developer, please:\n4CheckCertificatesEDS - End(CheckCertificatesEDSL\..\Policies\Explorer: [NoDrives] = 0xVCertCreateCertificateContext failed with 0x2No SubjectName for cert: ParseCertBlob,CheckPolicyACL - BeginHHKEY_LOCAL_MACHINE\SOFTWARE\Policies\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft*CheckPolicies - BegindB1o9HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificatespHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificatesbO7 - Policy: Permissions on key are restricted - (CheckPolicyACL - EndCheckPolicyACLIPcrerSoftware\Microsoft\Windows\CurrentVersion\Policies\SystemFDisableRegistryTools|DisableTaskMgrO7 - Policy: *\..\Policies\System: vSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer0\..\Policies\Explorer: [NoDrivesNoSetTaskbar|TaskbarLockAll|LockTaskbar|NoTrayItemsDisplay|NoChangeStartMenu|NoStartMenuMorePrograms|NoRunNoSMConfigurePrograms|NoViewOnDrive|RestrictRun|DisallowRun|NoControlPanel|NoDispCpl*O7 - Taskbar policy: ,O7 - Explorer Policy: vSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AdvancedStart_ShowRun0\..\Explorer\Advanced: [&CheckPolicies - EndCheckPolicies&CheckO7Item - BeginvHKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local}4oCRx\ipsecPolicy{ActivePolicynSOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\xHKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\ipsecNamewhenChanged(ipsecISAKMPReference"ipsecNFAReferenceIRegExpMatchCollection>ipsecNegotiationPolicyReference4ipsecNegotiationPolicyType8ipsecNegotiationPolicyActionL{62f49e10-6c37-11d1-864c-14a300000000}L{8a171dd2-77e3-11d1-8659-a04f00000000} AllowL{3f91a819-7647-11d1-864d-d46a00000000} BlockL{8a171dd3-77e3-11d1-8659-a04f00000000} Approve securityL{3f91a81a-7647-11d1-864d-d46a00000000}(Inbound pass-throughL{62f49e13-6c37-11d1-864c-14a300000000} Default response(ipsecFilterReferenceipsecData<G\y\8CheckO7Item - Regexp - Beginu@kDѫ,m&M>G V]dd@; 1*/G K&HnIPcreOptionsMatchO#FʚH:\_AVZ\ \HiJackThis\IRegexp.tlbRegexp_InterfaceGGG0oVN֬<"poA%(O0IPcreOptionsReplace2kL3Ajħ!IRegExp%tI`"wL;\IM#.9IPcreOptionsiXaKם#_pcre2_compile_context_create_16@4FG thGB!_pcre2_compile_context_free_16@4F0G thTGB_pcre2_compile_16@24FG thGB_pcre2_code_free_16@4FG thGB+_pcre2_match_data_create_from_pattern_16@8F,G  thXGB_pcre2_match_16@28FG thGB _pcre2_get_ovector_pointer_16@4FG$ thGB_pcre2_match_data_free_16@4F4G(0 thPGB_pcre2_substitute_16@44FG4< thGB!_pcre2_match_context_create_16@4FG@H thGB_pcre2_match_context_free_16@4IRegExpMatch_SubMatchesF4GLT thlGB_pcre2_get_ovector_count_16@4FGX` thGB_pcre2_get_error_message_16@12FGdl thGBIRegExp_UsePcreIRegExp_PCRE2IRegExp_GlobalIRegExp_IgnoreCaseIRegExp_MultilineIRegExp_PatternIRegExp_ReplaceIRegExp_TestIRegExp_ExecuteIRegExpMatch_InitIRegExpMatch_FirstIndexIRegExpMatch_LengthIRegExpMatchCollection_CountIRegExpMatchCollection_ItemIRegExpMatchCollection_EnumeratorFIRegExpMatchCollection_AddIRegExpMatchCollection_InitClassIRegExpSubMatches_CountIRegExpSubMatches_ItemIRegExpSubMatches_EnumeratorIRegExpSubMatches_AddIRegExpSubMatches_InitClassIPcre_OptionsIPcre_InitClassIPcre_TerminateClassIPcre_ReplaceIPcre_TestIPcre_ExecuteIPcre_GlobalSearchIPcreMatch_LastIndexIPcreMatch_LengthIPcreMatch_MatchedTextIPcreMatch_SubMatchCountIPcreMatch_SubMatchValueIPcreMatch_InitIPcreMatches_InitClassIPcreMatches_CountIPcreMatches_ItemIPcreMatches_EnumeratorIPcreMatches_TextIPcreMatches_AppendTextIPcreMatches_AddIPcreOptions_CompileIPcreOptions_GeneralIPcreOptions_MatchIPcreOptions_ReplaceIPcreOptionsCompile_InitClassIP: IPcreOptionsCompile_OptionFlagsIPcreOptionsCompile_AllowDuplicateSubpatternNamesIPcreOptionsCompile_CaseSensitiveIPcreOptionsCompile_AnchoredIPcreOptionsCompile_AutomaticallyInsertCalloutsIPcreOptionsCompile_IgnorePatternWhitspaceAndCommentsIPcreOptionsCompile_DotMatchesAllCharactersIPcreOptionsCompile_GreedyIPcreOptionsCompile_CheckUtfValidityIPcreOptionsCompile_MultilineIPcreOptionsCompile_AllowEmptyClassSource: IPcreOptionsCompile_AlternateBsuxHandlingIPcreOptionsCompile_DollarMatchesEndOfStringOnlyIPcreOptionsCompile_UtfIPcreOptionsCompile_AlternateCircumflexHandlingIPcreOptionsGeneral_GlobalSearchIPcreOptionsMatch_InitClassIPcreOptionsMatch_OptionFlagsIPcreOptionsMatch_AnchoredIPcreOptionsMatch_SubjectIsBeginningOfLineIPcreOptionsMatch_SubjectIsEndOfLineIPcreOptionsMatch_MatchIfEmptyIPcreOptionsMatch_MatchIfEmptyAtStartIPcreOptionsMatch_PerformUtfCheckIPcreOptionsMatch_MatchedEventEnabledIPcreOptionsMatch_MatchedEventSubstitutionCacheSizeIPcreOptionsReplace_InitClassIPcreOptionsReplace_OptionFlagsIPcreOptionsReplace_AnchoredIPcreOptionsReplace_SubjectIsBeginningOfLineIPcreOptionsReplace_SubjectIsEndOfLineIPcreOptionsReplace_MatchIfEmptyIPcreOptionsReplace_MatchIfEmptyAtStartIPcreOptionsReplace_PerformUtfCheckNo rules IPcreOptionsReplace_ErrorOnUnknownCapturingGroupsIPcreOptionsReplace_TreatUnknownCapturingGroupsAsEmptyStringsIPcreOptionsReplace_ExtendedReplacementMatched0.0.0.0 Any IP my IPDNS-serversWINS-serversDHCP-serversGatewayIP"CheckO7Item - End$O7 - IPSec: Name: V$$<i E P T Xi (Eh l p  u !   4 | L X d p  @     (  ( 4 @ L X d p |   ICMPRDPEGPHMPRAWRVDXNS-IDP type: (00|01)(000000)(........)(00000000|FFFFFFFF)(........)(00000000|FFFFFFFF)(00000000)(((06|11)000000........)|((00|01|06|08|11|14|16|1B|42|FF|..)00000000000000))00(00|01|02|03|04|81|82|83|84)00004CheckO7Item - Regexp - EndAnyTCPUDP (Port Destination: (mirrored) - Action: {72385236-70fa-11d1-864c-14a300000000} - No rules - Action: Default response (disabled)&modMain_CheckO7Item<Error in DeSerializeByteStringFree disk space{72385230-70fa-11d1-864c-14a300000000} - Source: my IP - Destination: Any IP (mirrored) - Action: Allow (disabled){72385230-70fa-11d1-864c-14a300000000} - Source: my IP - Destination: Any IP (mirrored) - Action: Inbound pass-through (disabled){7238523c-70fa-11d1-864c-14a300000000} - Source: my IP - Destination: Any IP (mirrored) - Action: Allow (disabled){7238523c-70fa-11d1-864c-14a300000000} - Source: my IP - Destination: Any IP (mirrored) - Action: Inbound pass-through (disabled)FComputer name (hostname) is not setUSERDOMAINUSER-PC"modMain_FixO7ItemHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches2Active Setup Temp FoldersBranchCache$Compress old filesCmdMapping.Content Indexer Cleaner0Downloaded Program FilesGameUpdateFiles(Internet Cache Files"Memory Dump Files&Offline Pages Files Old ChkDsk Files,Previous InstallationsRecycle Bin4Remote Desktop Cache Files4RetailDemo Offline Content(Service Pack CleanupSetup Log Files<System error memory dump files6System error minidump filesTemporary Files*Temporary Setup FilesThumbnail CacheUpdate Cleanup$User file versions.Upgrade Discarded Files@WebClient and WebPublisher CacheJWindows Error Reporting Archive FilesFWindows Error Reporting Queue FilesXWindows Error Reporting System Archive FilesTWindows Error Reporting System Queue FilesLangDisplayNameDWindows Error Reporting Temp Files<Windows ESD installation files2Windows Upgrade Log FilesStateFlags\CleanMgr.exe/SAGERUN:&CheckO8Item - BeginXSoftware\Microsoft\Internet Explorer\MenuExt res://file://0O8 - Context menu item: <\..\Internet Explorer\MenuExt\EXCEL.EXEONBttnIE.dll"CheckO8Item - End&modMain_CheckO8Item"modMain_FixO8Item&CheckO9Item - Begin^Software\Microsoft\Internet Explorer\ExtensionsLangNonUnicodeNameFullButtonText ScriptBandCLSIDCLSIDExtension\TreatAs https:*\Messenger\msmsgs.exe \web\related.htmB\Network Diagnostic\xpnetdiag.exe O9-32 - Button: : [Text] = $CheckO11Item - Endgopher://|Software\Microsoft\Internet Explorer\LowRegistry\Extensions\CmdMappingMenuText( - Tools menu item: "CheckO9Item - End&modMain_CheckO9Item"modMain_FixO9Item(CheckO11Item - BeginL\..\Internet Explorer\AdvancedOptions\hSoftware\Microsoft\Internet Explorer\AdvancedOptions`JAVA_VM.JAVA_SUN.BROWSE.ACCESSIBILITY.SEARCHING.VHTTP1.1.MULTIMEDIA.Multimedia.CRYPTO.PRINT.rTOEGANKELIJKHEID.TABS.INTERNATIONAL*.ACCELERATED_GRAPHICSText O11-32LangNonUnicodeName(modMain_CheckO11Item$modMain_FixO11Item(CheckO12Item - BeginlSoftware\Microsoft\Internet Explorer\Plugins\ExtensionFInternet Explorer\Plugins\ExtensionbSoftware\Microsoft\Internet Explorer\Plugins\MIME ftp://LangNonUnicodeCode<Internet Explorer\Plugins\MIMELocation O12-32: [Location] = $CheckO12Item - End(modMain_CheckO12Item$modMain_FixO12Item(CheckO13Item - BeginDefaultPrefixPrefixeswwwwww.home mosaicZSoftware\Microsoft\Windows\CurrentVersion\URL O13-32\..\URL\$CheckO13Item - End(modMain_CheckO13Item$modMain_FixO13Item(CheckO14Item - Begin \inf\iereset.infSearchAssistantCustomizeSearchADMINTOOLS = START_PAGE_URL="MS_START_PAGE_URL SEARCH_PAGE_URL=$MS_START_PAGE_URL=xhttp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htmJO14 - IERESET.INF: SearchAssistant = (modMain_CheckO14Item \INF\iereset.infLangSystemNameFullxhttp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htmJO14 - IERESET.INF: CustomizeSearch = vhttp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch^O14 - IERESET.INF: [Strings] SEARCH_PAGE_URL = $CheckO14Item - Endhttp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=5.5&ar=msnhomehttp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome\O14 - IERESET.INF: [Strings] START_PAGE_URL = bO14 - IERESET.INF: [Strings] MS_START_PAGE_URL = HKLM,"Software\Microsoft\Internet Explorer\Search","SearchAssistant",0,"HKLM,"Software\Microsoft\Internet Explorer\Search","CustomizeSearch",0," START_PAGE_URL=""SEARCH_PAGE_URL="&MS_START_PAGE_URL="$modMain_FixO14Item(CheckO15Item - BeginSoftware\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\DomainsSoftware\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomainsEscDomains O15-32,\..\ESC Trusted Zone: LangDisplayCode$\..\Trusted Zone: *.(O15 - Trusted Zone: Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\RangesSoftware\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscRangesEscRanges LoadAppInit_DLLs4\..\ESC Trusted IP range: ,\..\Trusted IP range: pMy Computer|Intranet|Trusted|Internet|Restricted|Unknown@ivt|file|ftp|http|https|shell|ldap|news|nntp|oecmd|snews|knownfolderBhttp://officeupdate.microsoft.comOSDINFSoftware\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaultsknownfolderUpdatusUserunknown MSSQLMsDtsServerdefaultuser0$Acronis Agent User$modMain_FixO15Item(CheckO16Item - BeginrSOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\,\..\ProtocolDefaults:  - ["] protocol is in " Zone, should be Zone (User: '$CheckO15Item - End(modMain_CheckO15Item SYSTEM\SelectrSoftware\Microsoft\Code Store Database\Distribution Units(\DownloadInformationCODEBASEHhttp://webresponse.one.microsoft.comPhttp://rtc.webresponse.one.microsoft.com6http://office.microsoft.com8http://protect.microsoft.com0http://dql.microsoft.com6http://codecs.microsoft.com:http://download.microsoft.comDhttp://windowsupdate.microsoft.comJhttp://v4.windowsupdate.microsoft.com O16-32 - DPF: ,\DownloadInformation:  [CODEBASE] = vSOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\hSoftware\Microsoft\Windows\CurrentVersion\Ext\Stats\\Contains\Files$CheckO16Item - End(modMain_CheckO16Item$modMain_FixO16Item(CheckO17Item - Begin PID | 2Services\Tcpip\Parameters$Services\VxD\MSTCP0System\CurrentControlSet"System\ControlSet DomainDomainNameSearchListNameServerO17 - HKLM\System\CCS Well-known DNS: $CheckO17Item - EndLangSystemNameJ\Services\Tcpip\Parameters\InterfacesL\Services\Tcpip\Parameters\Interfaces\&\Services\Tcpip\..\fSoftware\Microsoft\Windows\CurrentVersion\Telephony O17-32@ - HKLM\Software\..\Telephony: [O17 - DHCP DNS DependOnService(modMain_CheckO17ItemO17 - DHCP DNS:$modMain_FixO17Item(CheckO18Item - BeginDSoftware\Classes\Protocols\Handler(no CLSID)MSDAIPP.DLLP3F61C6698DEA48E0CA8C05019CF470E54B4782C6(CheckO20Item - BeginGPIOClxPA5F1FE61B58F28A65AE189AF14749DD241A9830D O18 - : [CLSID] = BSoftware\Classes\Protocols\Filter$\Microsoft Shared\$CheckO18Item - End(modMain_CheckO18Item$modMain_FixO18Item(CheckO19Item - Begin12345678VSoftware\Microsoft\Internet Explorer\Styles"Use My StylesheetUser Stylesheet O19-32<\..\Internet Explorer\Styles: ([User Stylesheet] = $CheckO19Item - End(modMain_CheckO19Item$modMain_FixO19Item\SysNative2RequireSignedAppInit_DLLsAppInit_DLLs O20-32J - HKLM\..\Windows: [AppInit_DLLs] = F (disabled because not code signed). (disabled by registry)2 (disabled by SecureBoot)$modMain_FixO20Item(CheckO21Item - BeginxSoftware\Microsoft\Windows NT\CurrentVersion\Winlogon\NotifyDllName6 - HKLM\..\Winlogon\Notify\: [DllName] = zSoftware\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\$CheckO20Item - End(modMain_CheckO20ItemLangSystemCodeSoftware\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoadGROOVEEX.DLL O21-32P - HKLM\..\ShellServiceObjectDelayLoad: WebCheckSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiersIsSafeBoot"FileSyncShell.dll&FileSyncShell64.dllN - HKLM\..\ShellIconOverlayIdentifiers\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks.EnableShellExecuteHooks> - HKLM\..\ShellExecuteHooks: [] - Dependency$CheckO21Item - End(modMain_CheckO21Item$modMain_FixO21Item(CheckO22Item - BeginSoftware\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler*O22 - ScheduledTask: $CheckO22Item - End(modMain_CheckO22Item$modMain_FixO22Item(CheckO23Item - BeginType Group\svchost.exe -kO23 - Service  - ("; "ServiceDll" = $CheckO23Item - End(modMain_CheckO23ItemService=>CheckO23Item_Dependency - Begin UcmCxJO23 - Dependency: Microsoft Service '>' depends on unknown service: '$ (service missing)DependOnGroup6' depends on mixed group: 'VO23 - Dependency: Microsoft Service Group '<' contains unknown service: 'GetUserTypeSal:CheckO23Item_Dependency - End.CheckO23Item_Dependency8CheckO23Item_Drivers - Begin0DRIVERS\DUMP_DUMPFVE.SYS2DRIVERS\DUMP_DISKDUMP.SYS,DRIVERS\DUMP_ATAPI.SYS0DRIVERS\DUMP_DUMPATA.SYS0DRIVERS\DUMP_IASTORA.SYSUserType.DRIVERS\DUMP_MSAHCI.SYS2DRIVERS\DUMP_STORAHCI.SYS0DRIVERS\DUMP_AMDSATA.SYS2DRIVERS\DUMP_AMD_SATA.SYS.Drivers\dump_pvscsi.sys.Drivers\dump_vmscsi.sys0Drivers\dump_megasas.sys2Drivers\DUMP_MEGASAS2.sys"GetUserType - End2Drivers\dump_LSI_SCSI.sys0Drivers\dump_LSI_SAS.sys.Drivers\dump_WMILIB.SYS.Drivers\DUMP_FTOIIS.SYS\DriversO23 - Driver ProductName O23 - Driver R: 4CheckO23Item_Drivers - End(CheckO23Item_Drivers##0.000<PF32>\Common Files\Microsoft Shared\Phone Tools\CoreCon\11.0\bin\IpOverUsbSvc.exet<PF32>\Common Files\Microsoft Shared\Source Engine\OSE.exej<PF32>\Common Files\Microsoft Shared\VS7DEBUG\MDM.exe><SysRoot>\System32\advapi32.dllp\p<PF32>\Windows Kits\8.1\App Certification Kit\fussvc.exe@<PF32>\Skype\Updater\Updater.exe<PF64>\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.exez<PF64>\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXEf<PF64>\Microsoft SQL Server\90\Shared\sqlwriter.exeP<PF64>\Windows Media Player\wmpnetwk.exe6<SysRoot>\ehome\ehRecvr.exe6<SysRoot>\ehome\ehsched.exe6<SysRoot>\ehome\ehstart.dllP<SysRoot>\servicing\TrustedInstaller.exe hxxps:v<SysRoot>\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe<SysRoot>\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe<SysRoot>\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exeLimited UserLengthv<SysRoot>\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exer<SysRoot>\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exer<SysRoot>\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe\<SysRoot>\PCHealth\HelpCtr\Binaries\pchsvc.dllPower User><SysRoot>\System32\aelupsvc.dll><SysRoot>\System32\AJRouter.dll4<SysRoot>\System32\alg.exeH<SysRoot>\System32\APHostService.dll><SysRoot>\System32\appidsvc.dll<<SysRoot>\System32\appinfo.dll><SysRoot>\System32\appmgmts.dllF<SysRoot>\System32\AppReadiness.dllV<SysRoot>\System32\appxdeploymentserver.dllV<SysRoot>\System32\AudioEndpointBuilder.dll><SysRoot>\System32\Audiosrv.dll><SysRoot>\System32\AxInstSV.dll:<SysRoot>\System32\bdesvc.dllX4T4<SysRoot>\System32\bfe.dll8<SysRoot>\System32\bisrv.dll<<SysRoot>\System32\browser.dll><SysRoot>\System32\BthHFSrv.dll<<SysRoot>\System32\bthserv.dll:<SysRoot>\System32\CDPSvc.dllB<SysRoot>\System32\CDPUserSvc.dllUndoOverwrite><SysRoot>\System32\certprop.dll8<SysRoot>\System32\cisvc.exe<<SysRoot>\System32\ClipSVC.dllH<SysRoot>\System32\coremessaging.dll><SysRoot>\System32\cryptsvc.dll:<SysRoot>\System32\cscsvc.dll4<SysRoot>\System32\das.dll:<SysRoot>\System32\dcpsvc.dll@<SysRoot>\System32\defragsvc.dllR<SysRoot>\System32\DeviceSetupManager.dllJ<SysRoot>\System32\DevQueryBroker.dll6<SysRoot>\System32\DFSR.exe><SysRoot>\System32\dhcpcore.dll.SetAllFontCharset - End><SysRoot>\System32\dhcpcsvc.dll<SysRoot>\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe@<SysRoot>\System32\diagtrack.dll<<SysRoot>\System32\dllhost.exe<<SysRoot>\System32\dmadmin.exe6<SysRoot>\System32\rsvp.exe><SysRoot>\System32\dmserver.dllF<SysRoot>\System32\dmwappushsvc.dll><SysRoot>\System32\dnsrslvr.dll<<SysRoot>\System32\dot3svc.dll4<SysRoot>\System32\dps.dll8<SysRoot>\System32\DsSvc.dll:<SysRoot>\System32\eapsvc.dllUndoRemove:<SysRoot>\System32\efssvc.dllL<SysRoot>\System32\embeddedmodesvc.dll<<SysRoot>\System32\emdmgmt.dllV<SysRoot>\System32\EnterpriseAppMgmtSvc.dll8<SysRoot>\System32\ersvc.dll2<SysRoot>\System32\es.dllPictureBox<<SysRoot>\System32\fdPHost.dll><SysRoot>\System32\fdrespub.dll8<SysRoot>\System32\fhsvc.dllJ<SysRoot>\System32\flightsettings.dll><SysRoot>\System32\FntCache.dllD<SysRoot>\System32\FrameServer.dll4<SysRoot>\System32\pla.dll:<SysRoot>\System32\fxssvc.exeZ<SysRoot>\System32\GeofenceMonitorService.dll8<SysRoot>\System32\gpsvc.dll<<SysRoot>\System32\hidserv.dll@<SysRoot>\System32\hvhostsvc.dll8<SysRoot>\System32\icsvc.dllcmbFontSizeTreeView><SysRoot>\System32\icsvcext.dllJ<SysRoot>\System32\IEEtwCollector.exe:<SysRoot>\System32\ikeext.dll8<SysRoot>\System32\imapi.exe@<SysRoot>\System32\ipbusenum.dll><SysRoot>\System32\iphlpsvc.dll><SysRoot>\System32\ipnathlp.dll><SysRoot>\System32\ipsecsvc.dll8<SysRoot>\System32\irmon.dll><SysRoot>\System32\iscsiexe.dll:<SysRoot>\System32\keyiso.dll8<SysRoot>\System32\kmsvc.dll8<SysRoot>\System32\lfsvc.dllP<SysRoot>\System32\LicenseManagerSvc.dll<<SysRoot>\System32\ListSvc.dll<<SysRoot>\System32\lltdsvc.dll:<SysRoot>\System32\lmhsvc.dll<<SysRoot>\System32\locator.exe8<SysRoot>\System32\lsass.exe4<SysRoot>\System32\lsm.dllN<SysRoot>\System32\MessagingService.dll8<SysRoot>\System32\mmcss.dll<<SysRoot>\System32\mnmsrvc.exe<<SysRoot>\System32\moshost.dll:<SysRoot>\System32\mpssvc.dll8<SysRoot>\System32\msdtc.exe><SysRoot>\System32\msdtckrm.dll<<SysRoot>\System32\msiexec.exe/V><SysRoot>\System32\mspmsnsv.dll<<SysRoot>\System32\mswsock.dll:<SysRoot>\System32\ncasvc.dllB<SysRoot>\System32\ncbservice.dllF<SysRoot>\System32\NcdAutoSetup.dll><SysRoot>\System32\netlogon.dll:<SysRoot>\System32\netman.dll><SysRoot>\System32\netprofm.dllD<SysRoot>\System32\netprofmsvc.dllD<SysRoot>\System32\NetSetupSvc.dllB<SysRoot>\System32\NgcCtnrSvc.dll:<SysRoot>\System32\ngcsvc.dll:<SysRoot>\System32\nlasvc.dll:<SysRoot>\System32\nsisvc.dll<<SysRoot>\System32\ntmssvc.dll:<SysRoot>\System32\p2psvc.dll:<SysRoot>\System32\pcasvc.dllD<SysRoot>\System32\peerdistsvc.dllF<SysRoot>\System32\PhoneService.dllT<SysRoot>\System32\PimIndexMaintenance.dllcmbFontV Kջ[Q><SysRoot>\System32\pnrpauto.dll<<SysRoot>\System32\pnrpsvc.dll<<SysRoot>\System32\profsvc.dll<<SysRoot>\System32\provsvc.dll><SysRoot>\System32\qagentRT.dll6<SysRoot>\System32\qmgr.dll8<SysRoot>\System32\qwave.dllUndoInsert<<SysRoot>\System32\rasauto.dll<<SysRoot>\System32\rasmans.dllB<SysRoot>\System32\RDXService.dll:<SysRoot>\System32\regsvc.dll8<SysRoot>\System32\RMapi.dll><SysRoot>\System32\RpcEpMap.dll8<SysRoot>\System32\rpcss.dllUndoAppend><SysRoot>\System32\SCardSvr.dll><SysRoot>\System32\SCardSvr.exeF<SysRoot>\System32\ScDeviceEnum.dll><SysRoot>\System32\schedsvc.dll:<SysRoot>\System32\SDRSVC.dllH<SysRoot>\System32\SearchIndexer.exe4<SysRoot>\System32\ups.exe><SysRoot>\System32\seclogon.dll6<SysRoot>\System32\sens.dllP<SysRoot>\System32\SensorDataService.exeH<SysRoot>\System32\SensorService.dll><SysRoot>\System32\sensrsvc.dll><SysRoot>\System32\services.exe LastDllError = Find<<SysRoot>\System32\sessenv.dll<<SysRoot>\System32\sessmgr.exe:<SysRoot>\System32\shsvcs.dll8<SysRoot>\System32\SLsvc.exeB<SysRoot>\System32\SLUINotify.dll><SysRoot>\System32\smlogsvc.exe<<SysRoot>\System32\smphost.dllF<SysRoot>\System32\SmsRouterSvc.dll><SysRoot>\System32\snmptrap.exel<SysRoot>\System32\spool\drivers\x64\3\PrintConfig.dll<<SysRoot>\System32\spoolsv.exe:<SysRoot>\System32\sppsvc.exeD<SysRoot>\System32\sppuinotify.dll#uN4<=8<SysRoot>\System32\srsvc.dll:<SysRoot>\System32\srvsvc.dll<<SysRoot>\System32\ssdpsrv.dll<<SysRoot>\System32\sstpsvc.dll<<SysRoot>\System32\storsvc.dll<<SysRoot>\System32\svchost.exe8<SysRoot>\System32\svsvc.dll | 8<SysRoot>\System32\swprv.dll<<SysRoot>\System32\sysmain.dll^<SysRoot>\System32\SystemEventsBrokerServer.dll:<SysRoot>\System32\TabSvc.dll<<SysRoot>\System32\tapisrv.dll:<SysRoot>\System32\tbssvc.dll"Windows version: - <<SysRoot>\System32\termsrv.dllN<SysRoot>\System32\tetheringservice.dllF<SysRoot>\System32\themeservice.dllV<SysRoot>\System32\TieringEngineService.exeH<SysRoot>\System32\tileobjserver.dllN<SysRoot>\System32\TimeBrokerServer.dll:<SysRoot>\System32\trkwks.dll@<SysRoot>\System32\UI0Detect.exe><SysRoot>\System32\umpnpmgr.dll6<SysRoot>\System32\umpo.dll8<SysRoot>\System32\umrdp.dll><SysRoot>\System32\unistore.dll><SysRoot>\System32\upnphost.dll O3f `ӓL<SysRoot>\System32\userdataservice.dll<<SysRoot>\System32\usermgr.dll<<SysRoot>\System32\usocore.dll8<SysRoot>\System32\uxsms.dll><SysRoot>\System32\vaultsvc.dll4<SysRoot>\System32\vds.exe8<SysRoot>\System32\vssvc.exe<<SysRoot>\System32\w32time.dll8<SysRoot>\System32\w3ssl.dllH<SysRoot>\System32\WalletService.dllL<SysRoot>\System32\Wat\WatAdminSvc.exeH<SysRoot>\System32\wbem\WmiApSrv.exeD<SysRoot>\System32\wbem\WMIsvc.dll>>> ERROR:><SysRoot>\System32\wbengine.exe><SysRoot>\System32\wbiosrvc.dll:<SysRoot>\System32\wcmsvc.dll<<SysRoot>\System32\wcncsvc.dllN<SysRoot>\System32\WcsPlugInService.dll4<SysRoot>\System32\wdi.dll<<SysRoot>\System32\webclnt.dll:<SysRoot>\System32\wecsvc.dllB<SysRoot>\System32\wephostsvc.dllH<SysRoot>\System32\wercplsupport.dll:<SysRoot>\System32\WerSvc.dll:<SysRoot>\System32\wiarpc.dll><SysRoot>\System32\wiaservc.dll:<SysRoot>\System32\WsmSvc.dlld<SysRoot>\System32\Windows.Internal.Management.dll\<SysRoot>\System32\windows.staterepository.dll<<SysRoot>\System32\winhttp.dll:<SysRoot>\System32\wkssvc.dll<<SysRoot>\System32\wlansvc.dll<<SysRoot>\System32\wlidsvc.dllJ<SysRoot>\System32\workfolderssvc.dll:<SysRoot>\System32\wpcsvc.dllB<SysRoot>\System32\wpdbusenum.dllB<SysRoot>\System32\WpnService.dllJ<SysRoot>\System32\WpnUserService.dll:<SysRoot>\System32\wscsvc.dll,modMain_IsOnIgnoreList@<SysRoot>\System32\WSService.dll<<SysRoot>\System32\wuaueng.dll><SysRoot>\System32\wuauserv.dll<<SysRoot>\System32\WUDFSvc.dll<<SysRoot>\System32\wwansvc.dll:<SysRoot>\System32\wzcsvc.dll<<SysRoot>\system32\lserver.exeJ<SysRoot>\System32\XblAuthManager.dllD<SysRoot>\System32\XblGameSave.dllH<SysRoot>\System32\XboxNetApiSvc.dll<<SysRoot>\System32\xmlprov.dll><SysRoot>\SysWow64\perfhost.exe<<SysRoot>\SysWow64\svchost.exeTrace info: <SysRoot>\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe<SysRoot>\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exex<SysRoot>\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe(IsOnIgnoreList - End:<SysRoot>\system32\mprdim.dll:<SysRoot>\system32\wdfmgr.exe:<SysRoot>\system32\sacsvr.dll><SysRoot>\system32\RSoPProv.exe:<SysRoot>\system32\Dfssvc.exe8<SysRoot>\system32\ntfrs.exe<<SysRoot>\System32\dusmsvc.dllComboBox><SysRoot>\system32\SEMgrSvc.dll@<SysRoot>\System32\SshBroker.dll><SysRoot>\System32\SshProxy.dllD<SysRoot>\System32\TokenBroker.dllD<SysRoot>\System32\debugregsvc.dll^<SysRoot>\System32\assignedaccessmanagersvc.dll FrameShr\<SysRoot>\system32\CapabilityAccessManager.dllP<SysRoot>\System32\DeveloperToolsSvc.exeP<SysRoot>\System32\DevicesFlowBroker.dll<<SysRoot>\system32\DiagSvc.dllL<SysRoot>\System32\GraphicsPerfSvc.dll4<SysRoot>\System32\dns.exe@<SysRoot>\System32\IpxlatCfg.dll:<SysRoot>\System32\lpasvc.dllD<SysRoot>\System32\NaturalAuth.dllV<SysRoot>\System32\PrintWorkflowService.dllN<SysRoot>\System32\SharedRealitySvc.dll\<SysRoot>\System32\Windows.WARP.JITService.dllH<SysRoot>\System32\wfdsconmgrsvc.dll><SysRoot>\system32\spectrum.exeH<SysRoot>\system32\PushToInstall.dllJ<SysRoot>\system32\InstallService.dllB<SysRoot>\System32\XboxGipSvc.dll<<SysRoot>\system32\xbgmsvc.exeLastDllError # 6<SysRoot>\System32\wins.exeF<SysRoot>\System32\WBEM\WinMgmt.exe8<SysRoot>\system32\RsSub.exe8<SysRoot>\system32\RsEng.exe`<SysRoot>\system32\Windows Media\Server\nsum.exe:<SysRoot>\system32\MSTask.exe,WPFFontCache_v0400.exe<<SysRoot>\system32\tcpsvcs.exeN<SysRoot>\system32\inetsrv\inetinfo.exe><SysRoot>\system32\sfmprint.exe6<SysRoot>\System32\snmp.exe4<SysRoot>\System32\ias.dll`<SysRoot>\system32\Windows Media\Server\nspm.exeMpCmdRun.exed<SysRoot>\system32\Windows Media\Server\nspmon.exe`<SysRoot>\system32\Windows Media\Server\nscm.exe:<SysRoot>\system32\regsvc.exe:<SysRoot>\System32\llssrv.exe<<SysRoot>\System32\termsrv.exe8<SysRoot>\system32\RsFsa.exevvv:<SysRoot>\system32\sfmsvc.exe<<SysRoot>\system32\tlntsvr.exe:<SysRoot>\system32\grovel.exe:<SysRoot>\system32\netdde.exe<<SysRoot>\System32\UtilMan.exe<<SysRoot>\system32\clipsrv.exeF<PF64>\Windows Defender\MsMpEng.exel<SysRoot>\system32\Windows Media\NSLite\nslservice.exe:<SysRoot>\system32\faxsvc.exe8<SysRoot>\system32\tftpd.exe<<SysRoot>\SysWow64\mnmsrvc.exeB<PF64>\Windows Defender\mpsvc.dllD<PF64>\Windows Defender\NisSrv.exe - #SarX<PF64>\Microsoft Security Client\MsMpEng.exeV<PF64>\Microsoft Security Client\NisSrv.exe|<PF64>\Windows Defender Advanced Threat Protection\MsSense.exe <PF64> <PF32> aspnet_state.exeMsMpEng.exeNisSrv.exe IgnoreFmshta.exe|pcalua.exe|powershell.exe(IsWinServiceFileName$modMain_FixO23Item(CheckO24Item - BeginnSoftware\Microsoft\Internet Explorer\Desktop\Components SourceSubscribedURLFriendlyNameabout:homeIgnoreNumH131A6951-7F78-11D0-A979-00C04FD705A2 <Windows folder><System>0O24 - Desktop Component [Source] = $[SubscribedURL] = $CheckO24Item - End(modMain_CheckO24Itemexplorer.exe,IsOnIgnoreList - Begin Line: tPlease help us improve HiJackThis by reporting this error.VError message has been copied to clipboard.,Click 'Yes' to submit.Error Details: \An unexpected error has occurred at function: Error # HRESULT: --- EOF ---H[0123456789ABCDEF][0123456789ABCDEF]UnEscapestring::CheckForReadOnlyMedia - Begin6CheckForReadOnlyMedia - End2SetAllFontCharset - BeginCommandButtonOptionButtonTextBoxListBox LabelCheckBoxMBToInt642modMain_SetAllFontCharsetParentFont TahomaCharsetWeightBoldItalicUnderlineSizeStrikeThrough$frmMain.lstResults"frmMain.lstIgnore$frmMain.lstBackups&frmMain.lstHostsMan.frmStartupList2.tvwMain*frmADSspy.lstADSFound.frmADSspy.txtADSContent.frmADSspy.txtScanFolder2frmCheckDigiSign.txtPaths<frmCheckDigiSign.txtExtensions8frmProcMan.lstProcessManager2frmProcMan.lstProcManDLLs2frmUninstMan.lstUninstMan(frmUninstMan.txtName.frmUnlockRegKey.txtKeyst0 Automatic Miriam,modMain_SetFontCharSetDCheckForStartedFromTempDir - Begin\HiJackThis\@CheckForStartedFromTempDir - End4CheckForStartedFromTempDir Guest2SeRemoteShutdownPrivilegelselect * from Win32_OperatingSystem where Primary=trueFwinmgmts:{(Shutdown)}//./root/cimv2Reboot.co.uk|.da.ru|.h1.ru|.me.uk|.ss.ru| .xu.pl&GetUserType - BeginAdministrator0MapSIDToUsername - Begin SID: Default user"Account operators Server operators"Printer operators Backup operatorsLOGON SID,MapSIDToUsername - End MapSIDToUsernamedeleteonrebootIntToInt640IsProcedureAvail - BeginFunction: Dll: ,IsProcedureAvail - End*InitVariables - Begin A"HWvUA(DEDpx thHBDED| thDHBResetStartFreezeGetTimeisFreezedIndex hSystem32\SysWOW64Undo\Program Files\Common Files%UserProfile% \Users.\Documents and SettingspSOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList"ProfilesDirectoryAllUsersProfileProgramData"%ALLUSERSPROFILE%%AppData%Shl%LocalAppData%@\Local Settings\Application DataL{A520A1A4-1780-4FF6-BD18-167343C5AF16}EnvironmentTemp\Local\Temp(\Local Settings\Temp ProfileImagePath\All Users0 ED th bytes, CRC32: FFFFFFFF. Sign: 6frmMain.CreateLogFile - End*frmMain_CreateLogFileNon-Unicode: hcatroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\*.catUTCUTC is unknownPlatform:  (ReleaseId: < <=== Attention! (outdated SP) (ntdll.dll = Time: Language: OS: 0x). Display: NoRan by: (group: ) on (SID: FirstRun: yesnoR <=== Attention! ('Local System' account) QuickSortSpecialPfrmMain.SortSectionsOfResultList - BeginLfrmMain.SortSectionsOfResultList - EndGetArrDims@frmMain_SortSectionsOfResultListOO23 - ServiceO23 - DriverWarning! Wrong format of hit line. Must include dash after the name of the section!DfrmMain_SortSectionsOfResultListExAddRegToFixAddIniToFixAddFileToFixAddProcessToFixAddCustomToFixAddServiceToFix FixIt FixCustomHandler"FixProcessHandler$FixRegistryHandler>MapRegValueTypeToRegRestoreTypeFixFileHandler$\sysnative\sfc.exe (*.log)|*.log|"\System32\sfc.exe/SCANFILE=SFC_RestoreFile"FixServiceHandler2CheckIntegrityHJT - Begin_AVZn.CheckIntegrityHJT - End"CheckIntegrityHJT2InstallUpdatedHJT - Begin<HiJackThis Fork\HiJackThis.exea,XA[nZӣ.InstallUpdatedHJT - End"InstallUpdatedHJT$InstallHJT - Begin InstallHJT - EndInstallHJT602InstallAutorunHJT - Begin /noGUI2HiJackThis Autostart Scan/startupscanh,HJT_SaveReport - Begin__vbaAryRecCopyvAutomatically scan the system with HiJackThis at user logon>\HiJackThis Fork\HiJackThis.exe /startupscan.InstallAutorunHJT - End"InstallAutorunHJT4\HiJackThis Autostart Scan,\explorer.exe /select,*explorer.exe /select,DUnlockFileEx is failed with err = (HJT_SaveReport - EndHJT_SaveReport\system32\system\sytem32N!!! WARNING !!! Timeout is detected !!!.HJT_Shutdown is raised!$SplitByMultiDelimsWarning: *yyyy\/mm\/dd hh:nn:ss4@  (:  $(<__vbaVarNeg__vbaR8Var__vbaFpCy__vbaVarCmpLt__vbaRedimPreserveVar__vbaRedimVarGetProcAddress__vbaEnd__vbaVargParmRef__vbaVarLateMemSt__vbaLenVarB__vbaStrUI1__vbaR8Str__vbaNextEachAry__vbaExitEachAry__vbaForEachAry__vbaGetOwner4__vbaGet3__vbaGosubFree__vbaGosubReturn__vbaGosub__vbaVarIndexLoadRefLockDEPD`h th@HB E\Dlt thtHBLoadTypeLibEx EHx thHBCreateStdDispatch EH th HB (&Interface not found>Class not found in type library"DllGetClassObjectbCan't find dll entry point DllGetClasesObject in DllCanUnloadNowK m26i@S}g_}wK/.ۼDlstBoxInArrtxtBoxInArrchkBoxInArrBtnInArr,dT8@L8@LTcmdStartupListFraSysToolscmdN00bClosecmdN00bScantD< E thHBGetExitCodeProcessdDLH th`HB PostMessageAtDH thHBCreateProcessWdDH thHBCommandLineToArgvWD(H thclsProcess_ProcessRunUnelevated:ProcessRunUnelevated2 - Begin"Shell.ApplicationWindowsFindWindowSWGetProductInfoL{4C96BE40-915C-11CF-99D3-00AA004AE837}L{000214E2-0000-0000-C000-000000000046}L{00020400-0000-0000-C000-000000000046}ApplicationShellExecute@clsProcess_ProcessRunUnelevated26clsProcess_ParseCommandLine Line: t.1H8GetLocaleInfoWdDH thHBGetUserDefaultUILanguagedDH th HBGetSystemDefaultUILanguagedDDH ( th`HBGetSystemDefaultLCIDdDH,4 thHBRtlGetVersionDH8@ thHBdDHDL th0HBGetSidSubAuthorityԾDhHPX th|HBGetSidSubAuthorityCountԾDH\d thHBConvertSidToStringSidWԾDHhp thHBRtlGetNtVersionNumbersDTHt| thlHBNtOpenSymbolicLinkObjectDH thHBIsElevatedNtOpenDirectoryObjectDH thHBGetCodePageInfoGetLangNameFullByCultureCodeRegRead_REG_SZRegRead_REG_DWORDIsProcessElevatedGetUserTypeGetCurrentProcessSIDGetIntegrityLevelGetProductNameGetLangNameByCultureCodeIsWow64BitnessMajorMinorMajorMinorMajorMinorNTDLLNtDllVersionBuildRevisionSPVerOSNameEditionLangDisplayNameFullIsWindowsXPOrGreaterIsWindowsVistaOrGreaterIsWindows7OrGreaterIsWindows8OrGreaterIsWindows8Point1OrGreaterIsWindows10OrGreaterCodepageOEMCodepageOEM_FileCodepageANSICodepageANSI_FileSuiteMaskProductTypeSID_CurrentProcessSafeBootModePlatformReleaseIdIsServerIsDomainControllerIsWin64IsWin32PlatformIDSecureBootIsLocalSystemContextIsSystemCaseSensitive`PTXdtxBclsOSver.Class_Initialize - Beginpwinmgmts:{impersonationLevel=Impersonate}!\\.\root\cimv2FSelect * from Win32_OperatingSystemVersionSafe mode&Windows Server 2016<Safe mode with network support Normal,RtlGetNtVersionNumbersWindows 3.1 Win3x Win9xWindows 95BOSR2Windows 98Second EditionGoldWindows ME WinNTWindows 10 ar-AE"Technical PreviewWindows 8.1,Windows Server 2012 R2Windows 8&Windows Server 2012Windows 7,Windows Server 2008 R2Windows Vista&Windows Server 2008&Windows Server 2003DatacenterEnterprise ServerWeb EditionStorageHomeStandardWindows XPProfessional(Media Center EditionStarter Edition"Tablet PC EditionHome EditionWindows 2000Tablet Edition"Datacenter ServerAdvanced ServerWindows NT 4.0Workstation"Enterprise ServerStandard ServerWindows NT 3.51Windows CE WinCEUnixWindows Unknown (ver: . PT: . Build: $ Registry's data: 0SmallBusiness Restricted ar-TNXSOFTWARE\Microsoft\Windows NT\CurrentVersionReleaseIdUBR( (Domain Controller) + BackOffice BladeCompute ServerDataCenterEmbeddedNTPersonalSingleUserTSSmallBusinessStorage ServerTerminalWH Server"Domain Controller\SYSTEMROOT>clsOSver.Class_Initialize - End2clsOSver.Class_Initialize.GetCodePageInfo - BeginZSYSTEM\CurrentControlSet\Control\Nls\CodePage OEMCPACP*GetCodePageInfo - End0clsOSver.GetCodePageInfo.clsOSver.RegRead_REG_SZ2IsProcessElevated - Begin.IsProcessElevated - End4clsOSver.IsProcessElevated(clsOSver.GetUserType8GetCurrentProcessSID - Begin4GetCurrentProcessSID - EndHPC Edition:clsOSver.GetCurrentProcessSID2GetIntegrityLevel - BeginNot supportedLow"Medium (UIAccess) MediumHigh ProtectedProcess.GetIntegrityLevel - End4clsOSver.GetIntegrityLevelBusinessBusiness N ar-SY&Server Hyper Core V Home NHome China(Home Single LanguageVServer Datacenter (evaluation installation)JServer Datacenter (full installation)JServer Datacenter (core installation)(Enterprise 2015 LTSB ar-MA ar-OMjServer Datacenter without Hyper-V (core installation)jServer Datacenter without Hyper-V (full installation)EducationEducation NEnterprise E*Enterprise EvaluationEnterprise N.Enterprise N Evaluation ar-QA ar-SA>Enterprise 2015 LTSB Evaluation,Enterprise 2015 LTSB NBEnterprise 2015 LTSB N EvaluationJServer Enterprise (full installation)JServer Enterprise (core installation)jServer Enterprise without Hyper-V (core installation) ar-LYVServer Enterprise for Itanium-based SystemsjServer Enterprise without Hyper-V (full installation)XWindows Essential Server Solution ManagementXWindows Essential Server Solution Additional0Windows Home Server 2011Server Standard`Windows Essential Server Solution Management SVC`Windows Essential Server Solution Additional SVCHome Basic*Home Basic EnterpriseHome Basic NHome Premium.Home Premium EnterpriseHome Premium N ar-KW ar-LBRWindows Storage Server 2008 R2 Essentials0Microsoft Hyper-V ServerIoT Core&IoT Core CommercialfWindows Essential Business Server Management ServerdWindows Essential Business Server Messaging Server"Server FoundationbWindows Essential Business Server Security Server Mobile"Mobile EnterpriselWindows MultiPoint Server Standard (full installation)jWindows MultiPoint Server Premium (full installation)ProPro Enterprise Pro N ar-JO<Professional with Media Center4Server For SB Solutions EM.Server For SB SolutionstWindows Server 2008 for Windows Essential Server SolutionsWindows Server 2008 without Hyper-V for Windows Essential Server SolutionsStarter NZWindows Small Business Server 2011 Essentials:Windows Small Business Server:Small Business Server PremiumbSmall Business Server Premium (core installation)2Windows MultiPoint ServerRServer Standard (evaluation installation)FServer Standard (core installation)>Server Standard without Hyper-VfServer Standard without Hyper-V (core installation)0Server Solutions PremiumXServer Solutions Premium (core installation)Starter$Starter Enterprise2Storage Server EnterpriseZStorage Server Enterprise (core installation),Storage Server ExpressTStorage Server Express (core installation)bStorage Server Standard (evaluation installation).Storage Server Standard ar-IQVStorage Server Standard (core installation)dStorage Server Workgroup (evaluation installation)0Storage Server WorkgroupXStorage Server Workgroup (core installation)Ultimate&Ultimate EnterpriseUltimate N ar-EG<Web Server (full installation)<Web Server (core installation) Consumer Preview$An unknown product&Unknown Edition (0x.clsOSver.GetProductNameRUENUA be-BYBG af-ZA sq-AL ar-DZ ar-BHCy-az-AZLt-az-AZ eu-ES ca-ES zh-CN zh-HK zh-MO zh-SG zh-TW zh-CHS zh-CHT hr-HR cs-CZ da-DK div-MV nl-BE nl-NL en-AU en-BZ en-CA en-CB en-IE en-JM en-NZ en-GB en-ZW et-EE fo-FO fa-IR fi-FI fr-BE fr-CA fr-FR fr-LU fr-MC fr-CH gl-ES ka-GE de-AT de-DE de-LI de-LU de-CH el-GR gu-IN he-IL hi-IN hu-HU is-IS id-ID it-IT it-CH ja-JP kn-IN kk-KZ kok-IN ko-KR ky-KZ lv-LV lt-LT mk-MK ms-BN ms-MY mr-IN mn-MN nb-NO nn-NO pl-PL pt-BR pt-PT pa-IN ro-RO sa-INCy-sr-SPLt-sr-SP sk-SK sl-SI es-AR es-BO es-CL es-CO es-CR es-DO es-EC es-SV es-GT es-HN es-MX es-NI es-PA es-PY es-PE es-PR es-ES es-UY es-VE sw-KE sv-FI sv-SE syr-SY ta-IN tt-RU te-IN th-TH tr-TR ur-PKCy-uz-UZLt-uz-UZ vi-VNbSYSTEM\CurrentControlSet\Control\SecureBoot\State*UEFISecureBootEnabled:TrickHashEnumerationInterfacekernel32 legit.GetProcessHeapHeapFreeoleaut32VariantCopy;__vbaR4ErrVar__vbaR4Cy__vbaFpCSngR4__vbaFpCSngR8[NoSign] [MS] __vbaUnkVar__vbaVarSetVarAddrefFixReg.logPLogfile of Registry Key Unlocker (HJT v.2Logging started at: 2Logging finished at: End of file [OK] 6frmUnlockRegKey.cmdGo_Click^https://github.com/dragokas/hijackthis/issues/4Dhttps://safezone.cc/threads/28770/ ERROR<Do not show this message againCompareModeDigiSign.csvExistsAddKeys[not PE File] &legit, but not WHQL (protected) Legit.WHQLprotectedPECertificateInternalRThere are some errors while verification:File nameFull pathLegitimate?WQHL(Microsoft signature?WPF / SFC is PE IssuerSigner nameSigner email$Signature location.Has internal signature?Catalog path0Hash of root certificatePE hash:Algorithm of certificate hash:Algorithm of signature digestResult code,Result message (short)*Result message (full)Time StampXLogfile of Digital Signature Checker (HJT v.`Is legitimate | FileName | Is Microsoft | Is WFP`------------------------------------------------ StringIcon8frmCheckDigiSign.cmdGo_Click:*.exe;*.msi;*.dll;*.sys;*.ocxPE ()|`קA`h__vbaNextEachCollVar__vbaForEachCollVar ImagePicture {20 HiJackThis v. RBUTTONDBLCLKRBUTTONDOWNRBUTTONUPLBUTTONDBLCLKLBUTTONDOWNLBUTTONUPMBUTTONDBLCLKMBUTTONDOWNMBUTTONUPMOUSEMOVEOTHER....: __vbaRaiseEvent__vbaCheckTypeVar langUA /debug$:encryptable:$DATA4:SummaryInformation:$DATAD:DocumentSummaryInformation:$DATAZ:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}:$DATA,:Zone.Identifier:$DATAB:Q30lsldxJoudresxAaaqpcawXc:$DATA":Win32App_1:$DATA:favicon:$DATA.:OECustomProperty:$DATA~Software\Microsoft\Windows\CurrentVersion\App Paths\WORDPAD.EXEProgramFiles :  (.bin (*.bin)|*.bin| (*.txt)|*.txt| bytes).##0.00# %,FindFirstFile() failed::$DATAStreams.txt*Logfile of ADS Spy v. (HJT Fork v.$mnuPopupView_Click :GetFileMD5__vbaFPIntNtEnumSubKeysToArrayprocesslist.txtPLogfile of Itty Bitty Process Manager v. [pid]@chkSectionDisabled_Click - Beginstop<chkSectionDisabled_Click - End0chkSectionDisabled_Click:chkSectionFiles_Click - Begin6chkSectionFiles_Click - End*chkSectionFiles_Click<chkSectionHijack_Click - Begin8chkSectionHijack_Click - End,chkSectionHijack_Click8chkSectionMSIE_Click - Begin4chkSectionMSIE_Click - End(chkSectionMSIE_Click@chkSectionRegistry_Click - Begin<chkSectionRegistry_Click - End0chkSectionRegistry_Click.cmdSaveOK_Click - Beginstartuplist.txt. (#,00 Kb)*cmdSaveOK_Click - EndcmdSaveOK_Click"Form_Load - Begin/showempty/noclsidsLocal Page/noshowprivate/showcmts/nousers/nohardware&/showlargehostsfile/showlargezones/autosave/autosavepath:Form_Load - EndForm_Load&GetAllEnums - Begin[*user*][*computer*]EnumProcesses(EnumAutoStartFoldersEnumIniFilesEnumAutorunInf*EnumBatAutostartFiles$EnumExplorerClonesEnumBHOsEnumIEToolbars EnumIEExtensionsEnumIEExplBarsEnumIEMenuExtEnumIEBandsEnumDPFsdosstart.bat&EnumActiveXAutoruns*EnumDesktopComponents$EnumURLSearchHooks$EnumIniMappingKeysEnumMountPointsEnumNTScripts&EnumOnRebootActions"EnumShellCommandsEnumServices"EnumDriverFilters"EnumPrintMonitors langEN(EnumWinLogonAutorunsEnumLSAPackagesEnumPolicies,EnumImageFileExecution.EnumContextMenuHandlers$EnumColumnHandlers*EnumShellExecuteHooks&EnumShellExtensionsEnumRunRegKeys EnumRunExRegKeysEnumProtocols$EnumAccUtilManagerEnumWOWEnumSSODL.EnumSharedTaskSchedulerEnumMPRServices*EnumSecurityProvidersEnumAppPaths.EnumCmdProcessorAutorunEnumLSP,Enum3rdPartyAutostartsEnumHijackEnumDisabled ADSSpyFRemoving empty users/hardware nodesSystemTicks"GetAllEnums - EndGetAllEnums2mnuFileCopy_Click - Begin.mnuFileCopy_Click - End"mnuFileCopy_Click2mnuFileSave_Click - Begin.mnuFileSave_Click - End"mnuFileSave_Click6mnuFileTriage_Click - Begin TriageVTriage by XBlock.com - www.spywareguide.com memoryProcessRunRegKeysRegistry valueActiveX ObjectexplorerFileDLLTRIAGERESULTinfowinstart.bat2mnuFileTriage_Click - End&mnuFileTriage_Click@https://www.google.com/search?q=<mnuPopupSaveTree_Click - Beginnode.txt8mnuPopupSaveTree_Click - End,mnuPopupSaveTree_Click8GetStartupListReport - BeginNT RunOnceEx(StartupList report, (StartupList version Started from: Detected: Logged on as ' ' to '8End of report, xXxXxXx bytesxXxXxXx###,###,###4GetStartupListReport - End(GetStartupListReportSSODLUser.GetNodeChildren - Begin =*  **GetNodeChildren - EndGetNodeChildren4UpdateProgressBar: at max!*EnumProcesses - Beginexe&EnumProcesses - End8EnumAutoStartFolders - Begin folderStartup|Software\Microsoft\Windows\CurrentVersion\explorer\Shell FoldersAltStartup|User Startup|Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders User AltStartup|Common Startup|$Common AltStartup|ExportKeyToVariable(User Common Startup|.User Common AltStartup| IOSUBSYS folder|IOSUBSYSVMM32 folder| vmm32Windows Vista common Startup|%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup$NT RunServicesOnceGinaDLL = Windows Vista roaming profile Startup|%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartupWindows Vista roaming profile Startup 2|%USERPROFILE%\Application Data\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders4EnumAutoStartFolders - End,EnumRunRegKeys - Begin NT RunNT RunOnceNT RunServicesfSoftware\Microsoft\Windows\CurrentVersion\RunOnceEx`Software\Microsoft\Windows NT\CurrentVersion\RunhSoftware\Microsoft\Windows NT\CurrentVersion\RunOncepSoftware\Microsoft\Windows NT\CurrentVersion\RunServices(NT RunServicesOnceExxSoftware\Microsoft\Windows NT\CurrentVersion\RunServicesOncelSoftware\Microsoft\Windows NT\CurrentVersion\RunOnceExRunRegkeysUser User RunRegkeysSystemSystem (EnumRunRegKeys - End0EnumRunExRegKeys - BeginvSoftware\Microsoft\Windows\CurrentVersion\RunServicesOnceEx|Software\Microsoft\Windows NT\CurrentVersion\RunServicesOnceEx RunExUser.subvalSystem.sub,EnumRunExRegKeys - End:EnumBatAutostartFiles - Beginbatautoexec.batconfig.sysautoexec.ntconfig.ntremtext6EnumBatAutostartFiles - End,EnumAutorunInf - Beginini:\autorun.inf drive open=shellexecute(EnumAutorunInf - End\Minimal6EnumOnRebootActions - Begin`System\CurrentControlSet\Control\Session Manager\wininit.bakonrebootWininit.iniWininit.bakBootExecute = TOnRebootActionsPendingFileRenameOperationsNULL -> VxD Services0\Control\Session Manager2EnumOnRebootActions - End(EnumIniFiles - Begin,win.ini|windows|load|0*win.ini|windows|run|0.system.ini|boot|shell|0<system.ini|boot|SCRNSAVE.EXE|02system.ini|boot|drivers|0System NT shell4system.ini|386Enh|device|12system.ini|386Enh|mouse|18system.ini|386Enh|keyboard|16system.ini|386Enh|display|12system.ini|386Enh|ebios|1system.iniwin.ini$EnumIniFiles - End4EnumIniMappingKeys - BeginStaticVxD.System NT WinLogon load,System NT WinLogon run*User NT WinLogon load(User NT WinLogon run(System WinLogon load&System WinLogon run$User WinLogon load"User WinLogon run,System NT Windows load"Software\Classes\*System NT Windows run(User NT Windows load&User NT Windows run&System Windows load$System Windows run"User Windows load User Windows run User screensavervHKLM|Software\Microsoft\Windows\CurrentVersion\WinLogon|runHKLM|Software\Microsoft\Windows NT\CurrentVersion\WinLogon|shell~HKLM|Software\Microsoft\Windows NT\CurrentVersion\WinLogon|load|HKLM|Software\Microsoft\Windows NT\CurrentVersion\WinLogon|run"ShellCommandsUser$Software\Classes\.~HKCU|Software\Microsoft\Windows NT\CurrentVersion\WinLogon|load|HKCU|Software\Microsoft\Windows NT\CurrentVersion\WinLogon|runxHKLM|Software\Microsoft\Windows\CurrentVersion\WinLogon|load2EnumShellCommands - Beginrun \VxD\xHKCU|Software\Microsoft\Windows\CurrentVersion\WinLogon|loadvHKCU|Software\Microsoft\Windows\CurrentVersion\WinLogon|run|HKLM|Software\Microsoft\Windows NT\CurrentVersion\Windows|load0EnumIniMappingKeys - End&ShellCommandsSystemzHKLM|Software\Microsoft\Windows NT\CurrentVersion\Windows|run|HKCU|Software\Microsoft\Windows NT\CurrentVersion\Windows|loadzHKCU|Software\Microsoft\Windows NT\CurrentVersion\Windows|runNHKCU|Control Panel\Desktop|SCRNSAVE.EXEGinaDLLvHKLM|Software\Microsoft\Windows\CurrentVersion\Windows|loadtHKLM|Software\Microsoft\Windows\CurrentVersion\Windows|runvHKCU|Software\Microsoft\Windows\CurrentVersion\Windows|loadtHKCU|Software\Microsoft\Windows\CurrentVersion\Windows|runDHKEY_CURRENT_USER\Software\Classescompifhtavbsvbejsjsewshwsfscrtxt \shell (no description)\shell\\command' - $HKEY_CLASSES_ROOT\\ddeexecNT ServicesFHKEY_CURRENT_USER\Software\Classes\&\Software\Classes\.$\Software\Classes\.EnumShellCommands - End<Enum3rdPartyAutostarts - Beginhelp8Enum3rdPartyAutostarts - End<EnumICQAgentAutostarts - Begin&system\explorer.exeBSoftware\Mirabilis\ICQ\Agent\Appsicq8EnumICQAgentAutostarts - End,EnumICQAgentAutostarts4EnumMircAutostarts - BeginmircSoftware\mIRCpSoftware\Microsoft\Windows\CurrentVersion\Uninstall\mIRC Protocols\Filter,irc\Shell\open\command6ChatFile\Shell\open\commandC:\mirc*C:\Program Files\mircD:\mirc*D:\Program Files\mircmirc.ini rfilesRemote: afilesAliases: perform.iniperform*EnumProtocols - Begin0EnumMircAutostarts - End$EnumMircAutostarts6EnumActiveXAutoruns - BeginhSoftware\Microsoft\Active Setup\Installed ComponentsStubPathComponentID2EnumActiveXAutoruns - End EnumDPFs - BeginEnumDPFs - End\VxD,Pluggable MIME filtersFHKEY_CLASSES_ROOT\Protocols\Filters"Protocols\Filter\"Protocols\Handler"Protocol handlersFHKEY_CLASSES_ROOT\Protocols\Handler$Protocols\Handler\&EnumProtocols - End4EnumExplorerClones - Begin*system32\explorer.exe*syswow64\explorer.exe(command\explorer.exe$fonts\explorer.exe*explorer\explorer.exe"wbem\explorer.exe0EnumExplorerClones - End(EnumServices - BeginRSystem\CurrentControlSet\Control\SafeBoot@SafeBoot services (Minimal boot)\Minimal\tHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\\NetworkdSafeBoot services (Minimal boot + network support)\Network\2SafeBoot: Alternate shell"SafeBootAltShell0 (not enabled)\Services"\Control\SafeBoot%systemroot%4HKEY_LOCAL_MACHINE\System\\Control\Class\$EnumServices - EndEnumLSP - BeginTSystem\CurrentControlSet\Services\Winsock2lspWinsockLSPWin95Z\Parameters\Protocol_Catalog9\Catalog_Entries&Namespace Providers\\Parameters\NameSpace_Catalog5\Catalog_EntriesEnumLSP - End8EnumWinLogonAutoruns - BeginVmAppletTaskMan UIHost\Notify Notify\Notify\\GPExtensions.Group policy extensions\GPExtensions\4EnumWinLogonAutoruns - End EnumBHOs - BeginEnumBHOs - End"EnumSSODL - BeginBShellServiceObjectDelayLoadSystemSSODLSystem>ShellServiceObjectDelayLoadUserEnumSSODL - End>EnumSharedTaskScheduler - Begin:EnumSharedTaskScheduler - End.EnumMPRServices - BeginXSystem\CurrentControlSet\Control\MPRServices(\Control\MPRServices*EnumMPRServices - EndEnumWOW - BeginAutoRunHSystem\CurrentControlSet\Control\WOWcmdlinewowcmdlineKnownDlls$KnownDlls (16-bit)\KnownDlls$KnownDlls (32-bit)(ExcludeFromKnownDlls\Control\WOWEnumWOW - End>EnumCmdProcessorAutorun - Begin$CmdProcAutorunUserUser autorun = (CmdProcAutorunSystem"System autorun = :EnumCmdProcessorAutorun - End<EnumImageFileExecution - Begin8EnumImageFileExecution - End>EnumContextMenuHandlers - Begin Folder\Tasks\ CompressedFolderDirectory(Directory\BackgroundChannelShortcutPrinter(AllFileSystemObjects8\shellex\ContextMenuHandlers:\shellex\ContextMenuHandlers\:EnumContextMenuHandlers - End4EnumColumnHandlers - Begin:Folder\shellex\ColumnHandlers0EnumColumnHandlers - End:EnumShellExecuteHooks - BeginSoftware\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks6EnumShellExecuteHooks - End6EnumShellExtensions - Begin \TasksSetKeyTimeSoftware\Microsoft\Windows\CurrentVersion\Shell Extensions\ApprovedShellExtsSystemShellExtsUser2EnumShellExtensions - End4EnumURLSearchHooks - Begin(URLSearchHooksSystem$URLSearchHooksUser0EnumURLSearchHooks - End4EnumAccUtilManager - BeginSoftware\Microsoft\Windows NT\CurrentVersion\Accessibility\Utility Manager Application Path$Start with Windows0EnumAccUtilManager - End EnumJobs - BeginJobs,Jobs (system32 folder)EnumJobs - End*EnumNTScripts - BegindSoftware\Policies\Microsoft\Windows\System\Scripts script Logonscripts.ini LogoffShutdown&ScriptPoliciesLogon"User logon script(ScriptPoliciesLogoffWebBrowser*ScriptPoliciesStartup,ScriptPoliciesShutdown&EnumNTScripts - End(EnumDisabled - Begin6Protection & disabled items$EnumDisabled - End<EnumDisabledMsconfig9x - Beginmsconfig9xUser msconfig9xSystemITBarLayout8EnumDisabledMsconfig9x - End,EnumDisabledMsconfig9x<EnumDisabledMsconfigXP - BeginfSoftware\Microsoft\Shared Tools\MSConfig\startupreg8EnumDisabledMsconfigXP - End,EnumDisabledMsconfigXP*EnumHostsFile - Begin-autolog"drivers\etc\hostsSkipping hosts file, because it is over 1000 lines long. (file is $ lines, totalling  kb)Hosts file lines)&EnumHostsFile - EndEnumHostsFile,EnumIEToolbars - BeginShellBrowserEnumValuesToArray(EnumIEToolbars - End0EnumIEExtensions - Begin,EnumIEExtensions - End,EnumIEExplBars - Begin(EnumIEExplBars - End*EnumIEMenuExt - BeginIEMenuExtUserIEMenuExtSystem&EnumIEMenuExt - End$EnumHijack - BeginHijack pointsattn EnumHijack - End2EnumDefaultPrefix - Begin\DefaultPrefixdefault = \Prefixes.EnumDefaultPrefix - End"EnumDefaultPrefix8EnumResetWebSettings - Begin$SearchAssistant = IEURLsUser$CustomizeSearch = "START_PAGE_URL = (MS_START_PAGE_URL = $SEARCH_PAGE_URL = inf\iereset.infSTART_PAGE_URLSEARCH_PAGE_URL"ResetWebSettings0"ResetWebSettings1"ResetWebSettings2"ResetWebSettings3EnumSubKeysToArray"ResetWebSettings44EnumResetWebSettings - End(EnumResetWebSettings2EnumHostsFilePath - BeginHostsFilePath0DatabasePath = 4\Services\Tcpip\Parameters.EnumHostsFilePath - End"EnumHostsFilePath$EnumIEURLs - BeginIEURLsSystemRSoftware\Microsoft\Internet Explorer\MainVSoftware\Microsoft\Internet Explorer\Search\Software\Microsoft\Internet Explorer\SearchURLhSoftware\Microsoft\Internet Explorer\Desktop\GeneralFirst Home PageLNKCLEANjSoftware\Microsoft\Internet Explorer\SafeMode\Desktop\Software\Microsoft\Internet Explorer\AboutURLs Default_Page_Url$Default_Search_Url SearchSearch BarSearch PageStart PageSearchURLStartpaginaKeyHasValuesStart Page_bakHomeOldSPWindow TitleWallpaperBackupWallpaper blank8DesktopItemNavigationFailure$NavigationCanceled"NavigationFailure$OfflineInformationPostNotCachedInternet(Default) = EnumIEURLs - EndEnumIEURLs6EnumStoppedServices - BeginStopped$Stopped & disabled2EnumStoppedServices - End&EnumStoppedServices,EnumXPSecurity - BeginSecurity Center xpsec6Windows Firewall exceptionsSystem RestoredefenderDSoftware\Microsoft\Security Center(XPSecurityCenterUserhHKEY_CURRENT_USER\Software\Microsoft\Security Center,XPSecurityCenterSystemjHKEY_LOCAL_MACHINE\Software\Microsoft\Security Center '[*]' SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfileSYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile&Network domain modeStandalone mode*XPSecurityRestoreUser8\AuthorizedApplications\ListApplications:Enabled:any computerenabled)disabled)firewall.\GloballyOpenPorts\List Ports port tSoftware\Microsoft\Windows NT\CurrentVersion\systemrestoreLNKCHECKHKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore.XPSecurityRestoreSystemHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\SystemRestoreF\Software\Microsoft\Security Center, LastDllErr: v\Software\Microsoft\Windows NT\CurrentVersion\SystemRestorev\Software\Microsoft\Windows NT\CurrentVersion\systemrestoreSYSTEM\|\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile6EnumSecurityProviders - EndINSTALL\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfileFSoftware\Microsoft\Windows Defender$DisableAntiSpyware,DisableAntiSpyware = 1(EnumXPSecurity - EndEnumXPSecurity2EnumPrintMonitors - Begin UPDATE^System\CurrentControlSet\Control\Print\Monitorsprinter Driver.\Control\Print\Monitors.EnumPrintMonitors - End:EnumSecurityProviders - BegindSystem\CurrentControlSet\Control\SecurityProviders4\Control\SecurityProviders:EnumDesktopComponents - Begin6EnumDesktopComponents - End(EnumAppPaths - BeginfSoftware\Microsoft\Windows\CurrentVersion\App Paths$EnumAppPaths - End.EnumMountPoints - Begin"Security Packages\Control\LsaUNINSTALLER|Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints.\shell\Autoplay\command*EnumMountPoints - End.EnumLSAPackages - BeginHSystem\CurrentControlSet\Control\Lsa.Authentication Packages*Notification PackagesGetFirstSubKey*EnumLSAPackages - EndIteration: Hh:Mm:Ss__vbaLateIdCall__vbaR4VarvError in retrieving page size. GetSystemInfo failed with 0x.Cannot obtain page size2HeapCreate failed with 0x,Cannot create new heap<Class is about to be destroyed&Error creating heap*HeapAlloc return NULLInit_VBS_RegexpVBScript.RegexpfVBScript.Regexp instance creation call is finished.BRegexp failed! Init with UnregCOMGetKeyTimeL{3F4DACA4-160D-11D2-A8E9-00104B365C9F},\system32\vbscript.dll UnregCOM failed!VBScript.Regexp reg. info emulation is failed too. Switching to PCRE...VBScript.Regexp is not functioning! Perhaps, reg. info is damaged. Err: EnumValues.cRegExp.Init_VBS_Regexp`Could not unpack PCRE2 library! Last DLL Error: GlobalIgnoreCaseMultiLinePatternReplaceTestExecuteSubMatchesFirstIndexpcre2-16.dllReplace error #*PCRE2 Error Message: EnumSubKeyshCould not initialize PCRE2 library! Last DLL Error: `Could not compile PCRE context! Last DLL Error: @Could not compile regex! Regex: Errorcode: $, Error Position: ^Could not allocate match data! Last DLL Error: SysAllocStringLenNOvector pointer could not be retrieved!KEY_:Unknown substitution action: $PCRE Match Error: Unknown error #<, PCRE2 error message result #*UnpackLibPCRE - Begin0UnpackLibPCRE - Unpacked.CallLoader: pExeData = \PCRE lib. hash is mismatched or access denied.LUnpackLibPCRE - Hash checked. Result:  __vbaFailedFriendpFileData = pCode = InitShellLoader SpliceVirtualAllocVirtualProtectKeyHasSubKeys"Get module handle$Addr of function:  is (Modify CallByPointerNTDLL.DLLZwUnmapViewOfSectionWideCharToMultiByteOLEAUT32.DLLSysAllocStringByteLenlstrcpynWSysStringLenVirtualFreeVirtualAllocSysReAllocStringSysFreeStringGetMenu0 EPI thXIB GetSubMenu0 EI thIBSetMenuItemBitmaps0 EI thIBGetMenuItemID0 E I th0IBGetMenuItemCount0 EhI th|IBGetMenuItemInfoWSTARTUPLIST0 EI thIB CreateFontWDI th(IB0 ED th\IB"SetMenuIconByNameFindSubMenuGetMenuText ADSSPYCROSS_REDCROSS_BLACK HOSTSKEYPROCMANSETTINGSSIGNATUREValueExistsSetMenuIcons\HiJackThis.exe- EX&clsIniFile_InitFile&Incorrect codepage!.clsIniFile_InitCodepage&clsIniFile_LoadFile4clsIniFile_Class_Terminate2clsIniFile_InitDictionary8clsIniFile_ReleaseDictionaryKeyExists clsIniFile_Flush(clsIniFile_ReadParam,clsIniFile_GetSections0clsIniFile_GetParamNames2clsIniFile_GetParamValues.clsIniFile_ExistSection*clsIniFile_ExistParam(clsIniFile_ExistData:clsIniFile_GetParamNameByData0clsIniFile_CreateSection8clsIniFile_RemoveSectionsAllRemove0clsIniFile_RemoveSection,clsIniFile_RemoveParam0clsIniFile_CountSections,clsIniFile_CountParams__vbaVargVar__vbaLateIdCallSt/autolog__vbaLateIdStAd+:Q@\7iA"E! e:wB4 NKÊDH&q llblWelcomelblAwarecmdAgreecmdNotAgreetxtEULACheckIDEWatchForProcessEULA_AgreeLocalizeGetEULAX4/releaseStartupScanshell32.dlltimeoutsilentautolog]Of D#U NtQueryKeyDTI th`IB NtOpenKeyExDI  thIB NtOpenKeyDI thIB RegFlushKeyԾD I$ th,IBNtSetInformationKeyDdI(0 thxIBNtEnumerateKeyDelKeyDeleteAllSubKeysDI4< thIBGetHKeyGetHiveNameByHandleGetShortHiveNameMapRegTypeToStringMapStringToRegTypeNormalizeKeyNameAndHiveHandleCreateKeyGetStringGetDwordGetBinaryToStringGetBinaryGetMultiSZGetValueTypeGetDataGetKeysCountGetValuesCountEnumValuesAndDataSetStringValSetExpandStringValSetDwordValSetBinaryValSetMultiSZValDelValGetFilenameFromBinaryKeyKeyExportToBinaryGetDefaultProgramRegisterDllUnRegisterDllSetDataJumpWrapNtOpenKeyExIsKeySymLinkGetKeyVirtualTypeNtGetKeyVirtualTypeMapHiveToNtNameMapNtNameToHiveFlushAll @/debug -debug -debug _debug_dbg0Alex.Dragokas.HiJackThis nogui_FR/install-install tool+StartupListtool+UninstMantool+DigiSign tool+RegUnlockertool+ADSSpytool+Hoststool+ProcMantool+CheckLNKtool+ClearLNKUninstManDigiSignCheckerRegUnlocker_UAHostsManProcMansaveLogDebugToFile`Error in frmEULA.Form_Initialize. Err. number = . LastDllErr = 2frmEULA.Form_Load - BeginRLogfile ( tracing ) of HiJackThis Fork v.Command line: _RU langRU_EN langFRaccepteula-uninstall.frmEULA.Form_Load - EndTError in frmEULA.Form_Load. Err. number = MSComCtl.ocxMSComCtl.oca/release:WatchForProcessPID:Localize \n, hListView = Jump GNU GENERAL PUBLIC LICENSE \n Version 2, June 1991 \nx Copyright (C) 1989, 1991 Free Software Foundation, Inc., \n, hTreeView = InByteArray| 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA \n Everyone is permitted to copy and distribute verbatim copies \nz of this license document, but changing it is not allowed. \nN Preamble \n The licenses for most software are designed to take away your \nfreedom to share and change it. By contrast, the GNU General Public \nLicense is intended to guarantee your freedom to share and change free \n SOFTWARE\Classes?>software--to make sure the software is free for all its users. This \n|General Public License applies to most of the Free Software \nFoundation's software and to any other program whose authors commit to \n(SOFTWARE\Wow6432Nodeusing it. (Some other Free Software Foundation software is covered by \nthe GNU Lesser General Public License instead.) You can apply it to \n,your programs, too. \n When we speak of free software, we are referring to freedom, not \nprice. Our General Public Licenses are designed to make sure that you \nhave the freedom to distribute copies of free software (and charge for \nthis service if you wish), that you receive source code or can get it \n"SOFTWARE\Classes\if you want it, that you can change the software or use pieces of it \nin new free programs; and that you know you can do these things. \n To protect your rights, we need to make restrictions that forbid \n8SOFTWARE\Classes\Wow6432Nodeanyone to deny you these rights or to ask you to surrender the rights. \nThese restrictions translate to certain responsibilities for you if you \ntdistribute copies of the software, or if you modify it. \n0GetFilenameFromBinaryKey For example, if you distribute copies of such a program, whether \ngratis or for a fee, you must give the recipients all the rights that \nyou have. You must make sure that they, too, receive or can get the \nWow6432Node\ <?xmlsource code. And you must show them these terms so they know their \nrights. \n We protect your rights with two steps: (1) copyright the software, and \n(2) offer you this license which gives you legal permission to copy, \nRdistribute and/or modify the software. \n Also, for each author's protection and ours, we want to make certain \nthat everyone understands that there is no warranty for this free \n0authors' reputations. \n"KeyExportToBinarysoftware. If the software is modified by someone else and passed on, we \nwant its recipients to know that what they have is not the original, so \nthat any problems introduced by others will not reflect on the original \nSOFTWARE Finally, any free program is threatened constantly by software \npatents. We wish to avoid the danger that redistributors of a free \nprogram will individually obtain patent licenses, in effect making the \n.modification follow. \nprogram proprietary. To prevent this, we have made it clear that any \npatent must be licensed for everyone's free use or not licensed at all. \n The precise terms and conditions for copying, distribution and \nsParam:SOFTWARE\b GNU GENERAL PUBLIC LICENSE \n TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION \n 0. This License applies to any program or other work which contains \nZ Copyright (C) <year> <name of author> \na notice placed by the copyright holder saying it may be distributed \nunder the terms of this General Public License. The "Program", below, \nrefers to any such program or work, and a "work based on the Program" \n&ExportKeyToVariablemeans either the Program or any derivative work under copyright law: \nthat is to say, a work containing the Program or a portion of it, \neither verbatim or with modifications and/or translated into another \n /reg:64SaveHeader:language. (Hereinafter, translation is included without limitation in \nthe term "modification".) Each licensee is addressed as "you". \nActivities other than copying, distribution and modification are not \n\reg.exeexport covered by this License; they are outside its scope. The act of \nrunning the Program is not restricted, and the output from the Program \nis covered only if its contents constitute a work based on the \nGetKeyTimeSetKeyTimeProgram (independent of having been made by running the Program). \nrWhether that is true depends on what the Program does. \n 1. You may copy and distribute verbatim copies of the Program's \n(NtEnumSubKeysToArrayEnumValuessource code as you receive it, in any medium, provided that you \nconspicuously and appropriately publish on each copy an appropriate \ncopyright notice and disclaimer of warranty; keep intact all the \n$EnumSubKeysToArraybackup_notices that refer to this License and to the absence of any warranty; \nand give any other recipients of the Program a copy of this License \n4along with the Program. \nof it, thus forming a work based on the Program, and copy and \nYou may charge a fee for the physical act of transferring a copy, and \nyou may at your option offer warranty protection in exchange for a fee. \n 2. You may modify your copy or copies of the Program or any portion \nKeyHasValuesdistribute such modifications or work under the terms of Section 1 \n|above, provided that you also meet all of these conditions: \n a) You must cause the modified files to carry prominent notices \nKeyHasSubKeysGetFirstSubKey stating that you changed the files and the date of any change. \n b) You must cause any work that you distribute or publish, that in \n whole or in part contains or is derived from the Program or any \nValueExists /y part thereof, to be licensed as a whole at no charge to all third \n^ parties under the terms of this License. \n c) If the modified program normally reads commands interactively \nRcollective works based on the Program. \n when run, you must cause it, when started running for such \n interactive use in the most ordinary way, to print or display an \n announcement including an appropriate copyright notice and a \n DelKey DeleteAllSubKeys notice that there is no warranty (or else, saying that you provide \n a warranty) and that users may redistribute the program under \n these conditions, and telling the user how to view a copy of this \nSetBinaryVal License. (Exception: if the Program itself is interactive but \n does not normally print such an announcement, your work based on \nz the Program is not required to print an announcement.) \n$SetExpandStringValSetDwordValThese requirements apply to the modified work as a whole. If \nidentifiable sections of that work are not derived from the Program, \nand can be reasonably considered independent and separate works in \n:the scope of this License. \nthemselves, then this License, and its terms, do not apply to those \nsections when you distribute them as separate works. But when you \ndistribute the same sections as part of a whole which is a work based \nSetStringValon the Program, the distribution of the whole must be on the terms of \nthis License, whose permissions for other licensees extend to the \nentire whole, and thus to each and every part regardless of who wrote it. \nuTypesToQuery:Thus, it is not the intent of this section to claim rights or contest \nyour rights to work written entirely by you; rather, the intent is to \nexercise the right to control the distribution of derivative or \n"EnumValuesAndDataIn addition, mere aggregation of another work not based on the Program \nwith the Program (or with a work based on the Program) on a volume of \na storage or distribution medium does not bring the other work under \nGetValuesCount 3. You may copy and distribute the Program (or a work based on it, \nunder Section 2) in object code or executable form under the terms of \nSections 1 and 2 above provided that you also do one of the following: \nAdvapi32.dll a) Accompany it with the complete corresponding machine-readable \n source code, which must be distributed under the terms of Sections \n 1 and 2 above on a medium customarily used for software interchange; or, \nRegGetValueW b) Accompany it with a written offer, valid for at least three \n years, to give any third party, for a charge no more than your \n cost of physically performing source distribution, a complete \nGetValueTypeGetData machine-readable copy of the corresponding source code, to be \n distributed under the terms of Sections 1 and 2 above on a medium \nj customarily used for software interchange; or, \nbUseWow64:GetMultiSZ lHive: c) Accompany it with the information you received as to the offer \n to distribute corresponding source code. (This alternative is \n allowed only for noncommercial distribution and only if you \n$MapStringToRegType received the program in object code or executable form with such \nh an offer, in accord with Subsection b above.) \nThe source code for a work means the preferred form of the work for \n8REG_ResourceRequirementsList hHive:making modifications to it. For an executable work, complete source \ncode means all the source code for all modules it contains, plus any \nassociated interface definition files, plus the scripts used to \n$MapRegTypeToStringcontrol compilation and installation of the executable. However, as a \nspecial exception, the source code distributed need not include \nanything that is normally distributed (in either source or binary \n.REG_QWORD_LITTLE_ENDIANform) with the major components (compiler, kernel, and so on) of the \noperating system on which the executable runs, unless that component \nJitself accompanies the executable. \nf END OF TERMS AND CONDITIONS \nIf distribution of executable or object code is made by offering \naccess to copy from a designated place, then offering equivalent \n~access to copy the source code from the same place counts as \n4REG_FullResourceDescriptorKey:distribution of the source code, even though third parties are not \nvcompelled to copy the source along with the object code. \n 4. You may not copy, modify, sublicense, or distribute the Program \n REG_ResourceListREG_QWORDexcept as expressly provided under this License. Any attempt \notherwise to copy, modify, sublicense or distribute the Program is \nvoid, and will automatically terminate your rights under this License. \nREG_MULTI_SZCreateKeyHowever, parties who have received copies, or rights, from you under \nthis License will not have their licenses terminated so long as such \nJparties remain in full compliance. \n\ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. \n 5. You are not required to accept this License, since you have not \nsigned it. However, nothing else grants you permission to modify or \ndistribute the Program or its derivative works. These actions are \n$REG_DWORDBigEndianprohibited by law if you do not accept this License. Therefore, by \nmodifying or distributing the Program (or any work based on the \nProgram), you indicate your acceptance of this License to do so, and \n*REG_DWORDLittleEndianall its terms and conditions for copying, distributing or modifying \nHthe Program or works based on it. \n 6. Each time you redistribute the Program (or any work based on the \nT NO WARRANTY \n DelValProgram), the recipient automatically receives a license from the \noriginal licensor to copy, distribute or modify the Program subject to \n|these terms and conditions. You may not impose any further \nREG_EXPAND_SZREG_BINARYrestrictions on the recipients' exercise of the rights granted herein. \nYou are not responsible for enforcing compliance by third parties to \n this License. \n 7. If, as a consequence of a court judgment or allegation of patent \ninfringement or for any other reason (not limited to patent issues), \nconditions are imposed on you (whether by court order, agreement or \notherwise) that contradict the conditions of this License, they do not \n GetShortHiveNameexcuse you from the conditions of this License. If you cannot \ndistribute so as to satisfy simultaneously your obligations under this \nLicense and any other pertinent obligations, then as a consequence you \n&GetHiveNameByHandlemay not distribute the Program at all. For example, if a patent \nlicense would not permit royalty-free redistribution of the Program by \nall those who receive copies directly or indirectly through you, then \nthe only way you could satisfy both it and this License would be to \njrefrain entirely from distribution of the Program. \nIf any portion of this section is held invalid or unenforceable under \n__vbaPutOwner4any particular circumstance, the balance of the section is intended to \napply and the section as a whole is intended to apply in other \n"circumstances. \nIt is not the purpose of this section to induce you to infringe any \npatents or other property right claims or to contest validity of any \nsuch claims; this section has the sole purpose of protecting the \n~integrity of the free software distribution system, which is \nShared key? __vbaStrBoolGetHKeyimplemented by public license practices. Many people have made \ngenerous contributions to the wide range of software distributed \nthrough that system in reliance on consistent application of that \nSid user? Sid default? system; it is up to the author/donor to decide if he or she is willing \nto distribute software through any other system and a licensee cannot \n,impose that choice. \nxof promoting the sharing and reuse of software generally. \nThis section is intended to make thoroughly clear what is believed to \n`be a consequence of the rest of this License. \n 8. If the distribution and/or use of the Program is restricted in \nHaddress new problems or concerns. \ncertain countries either by patents or by copyrighted interfaces, the \noriginal copyright holder who places the Program under this License \nmay add an explicit geographical distribution limitation excluding \nSid system? HKPDthose countries, so that distribution is permitted only in or among \ncountries not thus excluded. In such case, this License incorporates \nxthe limitation as if written in the body of this License. \nFoundation. \nREG_DWORD 9. The Free Software Foundation may publish revised and/or new versions \nof the General Public License from time to time. Such new versions will \nbe similar in spirit to the present version, but may differ in detail to \n,UBound=Each version is given a distinguishing version number. If the Program \nspecifies a version number of this License which applies to it and "any \nlater version", you have the option of following the terms and conditions \nGetBinaryeither of that version or of any later version published by the Free \nSoftware Foundation. If the Program does not specify a version number of \nthis License, you may choose any version ever published by the Free Software \nREG_LINK 10. If you wish to incorporate parts of the Program into other free \nprograms whose distribution conditions are different, write to the author \nto ask for permission. For software which is copyrighted by the Free \nUser name: Software Foundation, write to the Free Software Foundation; we sometimes \nmake exceptions for this. Our decision will be guided by the two goals \nof preserving the free status of all derivatives of our free software and \nREG_NONE 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO \nWARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE \n~LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT \nJClass is not initialized with .Init()HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT \nWARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT \nNOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND \nRedirected: Array index: FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY \nAND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM \nPROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, \n0REPAIR OR CORRECTION. \n 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN \nWRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY \nMODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE \n"clsHiveEnum.Clone --------- |LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, \nINCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR \nINABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF \n.\\.\pipe\vbPipeHiveEnumHKDDDATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY \nYOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH \nANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN \n>clsHiveEnum.GetHKU_Sids - Beginx How to Apply These Terms to Your New Programs \n If you develop a new program, and you want it to be of the greatest \npossible use to the public, the best way to achieve this is to make it \n:clsHiveEnum.GetHKU_Sids - Endfree software which everyone can redistribute and change under these terms. \n To do so, attach the following notices to the program. It is safest \nto attach them to the start of each source file to most effectively \nKey: convey the exclusion of warranty; and each file should have at least \nthe "copyright" line and a pointer to where the full notice is found. \n <one line to give the program's name and a brief idea of what it does.> \nHive + key: This program is free software; you can redistribute it and/or modify \n it under the terms of the GNU General Public License as published by \n the Free Software Foundation; either version 2 of the License, or \nHive name: T (at your option) any later version. \n This program is distributed in the hope that it will be useful, \n but WITHOUT ANY WARRANTY; without even the implied warranty of \n(clsHiveEnum.NextHive.clsHiveEnum.GetHKU_Sids MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the \nf GNU General Public License for more details. \n You should have received a copy of the GNU General Public License along \nNetwork service Software\Classes with this program; if not, write to the Free Software Foundation, Inc., \n 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. \nAlso add information on how to contact you by electronic and paper mail. \nLocal serviceIf the program is interactive, make it output a short notice like this \nRwhen it starts in an interactive mode: \n Gnomovision version 69, Copyright (C) year name of author \nbnecessary. Here is a sample; alter the names: \n Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. \n This is free software, and you are welcome to redistribute it \nv under certain conditions; type `show c' for details. \nNetShowServicescellThe hypothetical commands `show w' and `show c' should show the appropriate \nparts of the General Public License. Of course, the commands you use may \nbe called something other than `show w' and `show c'; they could even be \nvmouse-clicks or menu items--whatever suits your program. \nYou should also get your employer (if you work as a programmer) or your \nschool, if any, to sign a "copyright disclaimer" for the program, if \n<clsHiveEnum.FillPredefinedKeys Yoyodyne, Inc., hereby disclaims all copyright interest in the program \n `Gnomovision' (which makes passes at compilers) written by James Hacker. \nR <signature of Ty Coon>, 1 April 1989 \n> Ty Coon, President of Vice \n REG_SZThis General Public License does not permit incorporating your program into \nproprietary programs. If your program is a subroutine library, you may \nconsider it more useful to permit linking proprietary applications with the \nlibrary. If this is what you want to do, use the GNU Lesser General \nTPublic License instead of this License. \n0SYSTEM\CurrentControlSet"SYSTEM\ControlSet`Class should be initialized first with .Init !!!(clsHiveEnum.MoveNextd002`0 req_Hivereq_SIDreq_Redirreq_Flagsla_predefHivestate_Hivestate_RedirHive handle: Jrundll32.exe shell32,ShellExec_RunDLL"GetDefaultProgramExtension= modLSP_RenameKeysKeyOldName=sKeyNewName="DllRegisterServer&DllUnregisterServerVThis registry value type is not supported: SetDatarSoftware\Microsoft\Windows\CurrentVersion\Applets\RegeditLastkeyComputer\regedit.exeregedt32.exe, hProcess = 0RegEdit_RegEditSysTreeView32SysListView32PCannot select regedit value. hRegedit = RemoveAttributefError happened when opening reg. root node. Code = 2NtOpenKey(Ex) returns: 0xJError in IsKeySymLink when open hKey1rError happened when opening root node 'SOFTWARE'. Code = "SymbolicLinkValueLError in query SymbolicLinkValue for: . Code = IsKeySymLinkTError in GetKeyVirtualType when open hKey1\REGISTRY\USER\"SOFTWARE\CLASSES\ SOFTWARE\CLASSES_CLASSES\*_CLASSES\Wow6432Node\XError in NtGetKeyVirtualType when open hKey1AttributeCountNodeCountNo <SID>_CLASSES node in phisical registry path after quering by RegGetKeyInfoNameEx. Key: *SOFTWARE\Wow6432Node\No SOFTWARE node in phisical registry path after quering by RegGetKeyInfoNameEx. Key: "GetKeyVirtualTypeElementAttributeGetNode&NtGetKeyVirtualTypenError in RegGetKeyInfoNameEx (strLength = 0), code = 0xError in RegGetKeyInfoNameEx (NtQueryKey, second call), code = 0xError in RegGetKeyInfoNameEx (NtQueryKey, first call), code = 0x&RegGetKeyInfoNameExName\Error in RegOpenKeyEx when open hKey1, code = MapHiveToNtName$RegMapNtNameToHivesGnD#|xv}]ICg9H48='&CXmlAttribute.Parse,Unexpected end of data(XMLDocument.LoadDataType Mismatch1[BH@KvF_AppendAtributeL8<4PvLCĄôSE#F()AppendAttributeTagAttributeTagStyleTagTypeL8<4CXmlElement.AppendAtribute,CXmlElement.AppendNode,CXmlElement.NodeByNameNodeName&CXmlElement.GetNode CXmlElement.Node.CXmlElement.InByteArray"CXmlElement.Parse,Missing closing tag </>.CXmlElement.DecodeCData ]]&gt;*CXmlElement.Serialize</></"CXmlTag.Serialize.CXmlTag.AppendAttributeJAttempt to Append Duplicate AttributeCreateFile.CXmlTag.RemoveAttribute(CXmlTag.TagAttributeCXmlTag.Parse59x(XmlUtil.DecodeEscape$XmlUtil.ParseValue"XmlUtil.ParseName__vbaUI1Str LoadFileToStream.pifDGetFileSizeEx => File is too big: ReadFile SaveStreamToFileWriteFile^Critical error. Main form is initialized twice!)O3f `ӓ@frmMain.FormStart_Stady1 - Begin(Alpha) (Beta) &by Alex Dragokas v. _polyRebootRequiredtestchkConfigTabschkHelp~HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId.THOU SHALT NOT STEAL - ihatewhitelistsArea+ProcessArea-ProcessArea+ModulesArea-Modules Area+Environment Area-EnvironmentArea+AdditionalArea-AdditionalWinHeight83556600WinWidth9000SkipIntroFrameVersion2.7.0.11<frmMain.FormStart_Stady1 - End__vbaFixstrConstruct FormStart_Stady1@frmMain.FormStart_Stady2 - Beginsilentuninstall/md5-md5*mutex_HiJackThis_Forkautostart noGUI~Fingerprint should be: CDD4EEAE6000AC7F40C3802C171E30148030C0726Fingerprint is mathed (OK).FFingerprint is NOT mathed (FAILED).~Fingerprint should be: 05F1F2D5BA84CDD6866B37AB342969515E3D912E<frmMain.FormStart_Stady2 - End FormStart_Stady28frmMain.CheckAutoLog - BeginSysTray4frmMain.CheckAutoLog - End(frmMain_CheckAutoLog:frmMain.LoadResources - Begin6frmMain.LoadResources - End*frmMain.LoadResourcesThe user choose the Close command from the Control menu on the form.TThe Unload statement is invoked from code.wininet.dllThe current Microsoft Windows operating environment session is ending.|The Microsoft Windows Task Manager is closing the application.zAn MDI child form is closing because the MDI form is closing. (*.dll)|*.dll| (*.exe)|*.exe^A form is closing because its owner is closing.b(!!!) Form_QueryUnload initiated (!!!) - Reason: User clicked 'X' while scanning and agreed with forced closing of the program.frmEULAO23 - Service:  (*.*)|*.*|Fixing: lDebug log closed because main form is terminated (!!!)dhttps://safezone.cc/resources/hijackthis-fork.201/https://github.com/dragokas/hijackthis/wiki/How-to-make-a-request-for-help-in-the-PC-cure-section%3F8https://safezone.cc/pravila/^SaveSettings initiated by clicking 'Main menu'.`http://dragokas.com/tools/help/hjt_tutorial.htmlrhttp://regist.safezone.cc/hijackthis_help/hijackthis.html&chkConfigTabs_Clickidx:bSaveSettings initiated by clicking 'Back' button.cmdConfig_Click6cmdConfigBackupDelete_Click8cmdConfigBackupRestore_Click6cmdConfigIgnoreDelAll_Click6cmdConfigIgnoreDelSel_ClickDateLastFixFixesToday*IncreaseNumberOfFixes8frmMain.cmdFix_Click - BeginBackup: 4frmMain.cmdFix_Click - EndcmdFix_Click cmdSaveDef_Click:frmMain.cmdScan_Click - Begin6frmMain.cmdScan_Click - EndcmdScan_ClickCannot unpack Software\Microsoft\Windows\CurrentVersion\App Paths\HiJackThis.exe&Software\TrendMicro.HiJackThis startup scan/v /d /c (cd\& for /L %+ in (1,1,10) do ((timeout /t 1|| ping 127.1 -n 2)& rd /s /q ""&& exit))HJT_Uninstall8frmMain.LoadSettings - BeginLogProcessesLogEnvVars__vbaVarTstGeLogAdditionalHideMicrosoft$IgnoreAllWhiteListCalcMD5ConfirmAutoSelectSkipErrorMsgMinToTrayFontNameFontSizeMS Sans SerifFontOnInterfaceLanguageFileEnglishCheckForUpdatesUpdateToTestUpdateSilentlyProxyTypeProxySocksVerProxyUseAuth>Tasks\HiJackThis Autostart Scan2.6.1.21CryptVerDefStartPage&http://www.msn.com/DefSearchPageDefSearchAssDefSearchCust4frmMain.LoadSettings - End(frmMain_LoadSettings@frmMain.LoadLanguageList - Begin FrenchUkrainian *.lng<frmMain.LoadLanguageList - End0frmMain_LoadLanguageListJfrmMain.cboN00bLanguage_Click - Begin/defaultFfrmMain.cboN00bLanguage_Click - End:frmMain_cboN00bLanguage_Click,Check Browsers LNK.exe^https://dragokas.com/tools/CheckBrowsersLNK.zipClearLNK.exeNhttps://dragokas.com/tools/ClearLNK.zipSaveSettingsCookie: )\bthttps://regist.safezone.cc/hijackthis_help/hijackthis.htmlhttps://www.bleepingcomputer.com/tutorials/comment-utiliser-hijackthis/https://www.bleepingcomputer.com/tutorials/wie-hijackthis-genutzt-wird-um/4frmMain.SaveSettings - Endhttps://www.bleepingcomputer.com/tutorials/como-usar-hijackthis/vhttps://www.linhadefensiva.org/2005/06/hijackthis-completo/https://www.bleepingcomputer.com/tutorials/hoe-gebruik-je-hijackthis/8frmMain.SaveSettings - BeginParseURL4frmMain.lstResults_MouseUp => [], (x32) (no key) (no value)Fhttps://www.google.com/?ie=UTF-8#q= -&SeenAutoMarkWarning*SetFontByUserSettings __vbaFileCloseAllReferer: SOCKS=-1Accept:XAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*Referer:Content-Type:"Invalid Cert AuthDProxy authentification is required8Authentification is requiredSet-Cookie: STATUS: ok~~~RHttpSendRequest call failed; Error code: RHttpOpenRequest call failed; Error code: ://RInternetConnect call failed; Error code: LInternetOpen call failed: Error code: API_HttpCheckUrlGetUrlObjectGetQueryInfo;HttpOnly;;$Set-Cookie: (.+?);LiteCookiesdeleted;GetCleanCookiePDataPack: Unknown type of data is pushed clsDataPack.Push Data: nDataPack: Array is not specified before deserializationHDataPack: EOF during deserializationRDataPack: Unknown type of data is fetched"clsDataPack.FetchByte pos: @clsDataPack.SerializeToHexStringVDataPack: Cannot serialize - array is empty8clsDataPack.SerializeToArrayZDataPack: Cannot deserialize - array is empty8clsDataPack.DeSerializeArray\b(\DataPack: Cannot deserialize - string is empty@clsDataPack.DeSerializeHexString@frmMain.cmdUninstManDelete_ClickFfrmMain.cmdUninstManUninstall_Click<frmMain.cmdUninstManEdit_Click(cmdWebSiteOpen_Click cmdKeyJump_Clickcontrol.exeappwiz.cplfSoftware\Microsoft\Windows\CurrentVersion\UninstallSystemComponentURLUpdateInfoVersionMajorVersionMinor2Inno Setup: Setup Version. (No Uninstall command) (Hidden) (User: BfrmMain.cmdUninstManRefresh_Click-x32 \...\) (Version:  Hidden$uninstall_list.txt>Logfile of Uninstall manager v.$Scan mode: Default&Scan mode: Specific{v}{-} HKLM Common software HKCU( No Uninstall string HKU Sort by AlphabetSort by Date>Uninstall Key Registry Snapshot~Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall<frmMain.cmdUninstManSave_Click000000000000CmdFind_ClickSearch: LengthSearchIttEscSeqToString^$frmSearchfrmUninstManfrmProcMan__vbaVarCmpLe__vbaVarSetVar1[P|<5Eܔ߅%sFHHQg:O3f `ӓW frmSysTray Form1B#$Form15W @DBTahomaDF$ mPopupMenu &PopupMenumSep1-mExit&Exit1,hDFJikPM:O3f `ӓH frmSearch Findb"$Form1&'.15-; DF.CmdFind Find Next7w+ cmdCancelCancel`Hw 0 chkEscSeq Esc-sequencesxo  6 chkRegExpRegular expressionsx(o  0 chkWholeWord Whole wordxo  (frDir Direction X ) optDirEndEndingh(0 optDirBegin Beginningh$ optDirUpUphX( optDirDownDownhw0 chkMatchCase Match casexXo  CmdMore(ww"ltBM6(ֲww迪汭w巩賱|||ȣ꯰zuu븚˹嫟Ħ쩢Խ֥ccǭ짡٪阘繯ÚÞ͹曏‚ɳ㞕ى皐ttН~~iiɩߝrrɜ{{숇Κۄķᐇ__Ϳᐇ{{ä⊄r\\˕sXXǓހٓ䅂냃큁jjssь뀁邂送낂uuȿڃ~{|}}}~}}zz{{||{|ۏyxxwȜrsvvutvvvvvvrtvvuv{vùÜrndfŞΆ|nopq̜mnmmjjδLJydf\^~pii伺ş̅Ǒ%Settings) cmbSearchH ;8 lblEscSeq\[0020], \\, \n, \th &lblWhatWhat:xPg1?HbO[@^E]QE'$ :O3f `ӓ %j frmADSspy #ADS Spy [] fork - written by MerijnB#lt006 h(0` qv|ægg{{~~ɖ~С֫ⷖ׸ǣɜգ٦۬۩ְޫ߭өǪܾsn\~<+Ji};yjz9^i #w$' -09%o?@KU^[i]stvnETY2C/dxMopqKTekl\bfj~]]JLbz:akzDuEsaoamyyytttpppkkkeee\\\XXXTTT     ȩ Ț ȼڽɬȩ⬢ѝ Șɫ,>G?4%꾏զ3MMLLJF:1# 꿋ɬ6VSOPNLHDB: wɲ~~~~~\}LOVWWVUSPMI90'=) xxxxx^^&MNRUVVUSPMI90$.C zssss__7KNRSTTSROLG5.##@)`XXXXaaa ?IMPRRRRPMID1+ ?2XXXXooo 5HJMOPPOMJG90$?2ZZZZdddd%:GIJKKJIG?9052$?1c\\\\qqqq5@?DGGD?94+)8E1b____ffffu俿(C4444405()/-R>" nnnnngggggÕ)@.+++'5 !*W5jdddddhhhhhÏ2?. $))*V eeeeeeiiiiiiÇ)C9.#$;8*kivhgkkkkkkр~~~~~~2CECFA/8 Ţlllllрyyyyyyy'+.%tXXXXXXXXz ]XXXXXXXXm|[XXXXXXXXXXXXXXXXXXXXXXXXXXXX{XXXXXXXXXXXZXXXXXXXXXXXXXXXXYXXXXXXXXX[݅n_\YXXXXXXXXXoXXXXXXXXYDžqo^[XXXYXXXXXXXqܮŢvgԑrrpn^n0????( @yxyYVVěʷٻмԨêӦ輞žٷ˱ŶũڦܬݮީԳչihfѲںq_&BAM|~~w"* m17[kjpgyw;]hATZFY_KUX}&6FMK+g|MMOhda2bruvjhuz~Xad:G^]or{tUMUkmuxfKUrORSn}XSq6::E`KiQpimwQkRlTl|||wwwtttsssmmmeee^^^[[[XXXUUU)ˌģ¢ļӕ~͹¯Ӥ||  ~Гӣ{ DDC@0 vzфö $NJHD@?8 uxttcΥ5LJFA336vmmmTIKMM=GB6%3( ibbWq)-GI=KIEA2&4VPPYY.DEHHF>?/9VRRggrBA>>B?3&':ZUU[[[̰?8797/!#<1fXX\\\} *9,%%& $=hhh^^^^}zz07&#= k]]____qllp"748>;```daaab~ +OraalowdPPPPPPPPPPPPPPPPPPgPPPPPPRssjWTQPPPPPSPPPPPynheTk\gYT[p???( @tgfŸܵͭȲ̩ťҲһǶx~FnztEknzyje p ruxy^{}]!#$'),-.0236;DKV_+Qd~4P^MOP p4S:xPQ]IKarrrpppeee]]]YYYXXXQQQMMMwv{x{{{{{{{t{TOMLKHGFElrjhQ`3B????esnidvTW.9:('*oqk;IJyVYf# @42^<|Wa_ &% +--bAgvX>T!",,c6P}Z8=uu5/Dz[27p$ mTRNMC\-01) uuuKw]u,,,,uUSQOML]uuuuW]\[Z$Form115<Y m@DBTahomaF$ picStatusxPObfraMainx1cmdSave Save log...w1'cmdExitExith0 cmdScanFolder Choose...# txtScanFolder@ DoptScanLocationScan only this folder:x OoptScanLocation!Full scan (all NTFS, ReFS drives)x/ UoptScanLocation%Quick scan (Windows base folder only)x/ *cmdScanScanxw 1: cmdRemoveRemove selected streamsh w T chkIgnoreEncryptable$Ignore safe system info data streamsx P chkCalcMD5,Calculate MD5 checksums of streams' contentsx(' lstADSFoundxOE.3 txtUselessBlabberxxw' Alternate Data Streams (ADS) are pieces of info hidden as metadata on files on NTFS drives. They are not visible in Explorer and the size they take up is not reported by Windows. Recent browser hijackers started using ADS to hide their files, and very few anti-malware scanners detect this. Use ADS Spy to find and remove these streams. Note: this app can also display legitimate ADS streams. Don't delete streams if you are not completely sure they are malicious! -6 cmdViewSaveSave to disk... + cmdViewBackBack( 6 cmdViewEditEdit in Wordpad  + cmdViewCopyCopyx 2 txtADSContentxo #-#mnuPopup PopupMenu&mnuPopupSelAll Select all(mnuPopupSelNone Select none/mnuPopupSelInvertInvert selection mnuPopupStr2-. mnuPopupViewView stream contents3mnuPopupShowFileShow file in Explorer mnuPopupStr1-6 mnuPopupSaveSave scan results to disk...12!+AlS*5DK޽48:O3f `ӓ1W frmProcMan Process ManagerB#lth6 00F( @̙ĔŖÔ̜Ξ͠У{{tt֬zzvvssnnӬΨooЪppť{{gaaRNNc__b^^yyysssnnnmmmgggeeeddd___^^^VVVSSSOOOMMMFFFFFFF5C4FFFFFFFFFF-@"=,A8FFFFFF  ;FFFFF9D<9FF  0FF)FFFF*FF$%FFFFFF!>7:FFFFFF  C?FFFFFF3E2FFFFF&FF#B3FFF'1FF/B.(FFFFFFF 6FFFFFF+FFFFFFFFFFFFFFFFF?YXXXYXhp~VSSSSWQq( @lmfgopnolmpqstvwyz}~~ꂃlmkkqqqpwwttxx{{{{~郃倀傁 ||솆鄄~}튉熅ts눈ꌌttoohhwwۖ†難]]ssgg֛zz嫫՟ee~__mmt[[wwyddqqݹtee^RRlgg^ZZgfffeeVUUljomusxv冃쑎ꕒэ۝ȕܪളytۄ㋆Ձ{܋ꢜnl|{odc蛓zxӍʆ}ѓҐˌ孤Ȥ涬{Ŭ߫ƩءɔԠ֣̚§ɘџѡϢǠԫдͫƧȬʯʠΥΩȫͧЫ˧¢ƦyĪdbaΩĤʮέ˭ɫǪʭëɪ˯Ǭ}}}jjjeee```\\\XXX|ʮty󼳕Ԕnnܣkkjkopyuggkݴr}{gcccccccccdޓi__________a\\\\\\\\\iٝYXYYXXYVYXXXhzp~ٛVSSSSSWsԸSSSWTQq؛NLLLRءNLLLNL}KIIJ؛IIIIIKxHHOFHHHHbFDDD`DD^BBBBBBqBBfջAAAAAAuAAMe}Ň@@@@@m@@@@@=>>[ٚ>>>>>Ӛ9:C<:::ˉ;;;?v߾8;8dž6666E60222227U3220G * *../Uƙ*...*G 4 (((mᵭ (((((+l'&&&),-1+ &&& %1w $$$$$$##$$$ ]#Pڞ"""""""" C]]҃!!!!!!!!!zCҗ俌Â55]ҁZ]鱱?(0` ggkknnppssuuwwzz||灁郃솆愃ss뉈ـxx{{jj撒\\Їeeņ矟ww褤~ZZyy~~qqѢeeܬllĠݶgVVtcc\TT˼SMMjiiqoyw僁~|釅뉇ݏus뜙異竩qmzv~zۄᇃ≅{땐涴έvu{kj~w吊꣝ڎ䜓Įȃx̉}ҍޙהݜ⫡鴫֚ݥ¢ɫɮҕљԞ۬ˡƧ˗ϛџդßƔ͞ԪǦģɪʬʮȜ͢ϧɧţɨřɟղĥͭͰŝɤɨͮ~ϱϲǡɣǢȦʩȧ̭ͭˬƨбввϱŸġàáƤĢţƥǦʩɨ˫˫̬ͮͮϰίѴӶ{qj|||zzzwwwtttoooccc^^^\\\[[[XXXUUUSSSLLLTUvJwKzUǬvIHHHHHyuBBByBBBBBBBBBBvBBBBBäEL܃AAAAAAAAAACyвgAAxߚ??????f??????v????G>>>>>>>>>>>>>>>u>>>>>>xCMd<<<<<<<<<<<<<<<<<<<>>k~~~TTTiiiyyyf-QQQVVVGGG^^^8ɱzzzkkkxxxDDDr444Jۓ󝝝vvvʥ 666}}};McŻnnn5mlҁggg! XMP DataXMP ~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-,+*)('&%$#"!  !,Y p*\(U!~`İ"+.tV`6X\bUk >* r*=* ǒ;FjbՕP@aR `h7 48ᵪ@X a&Z,,Q٤~LӪ7s#e4K1XUaR^V42M`*1ꄡdbUD*DyU( ZU, N2 *UqDU.ؾϕBp*3X2t!Ͽ fy|THدB|UZ\7]LŃ{0ϱb@VfMP1H)h U( ) 4HrHSrH-i杠 K?(ٓi4ƒTies J@;` hhCopy process list to clipboardW lblProcManDblClick+Double-click a file to view its properties.  @  lblConfigInfoRunning processes:hC imgProcManSaveltBM6(j%j"glugltj"j%{?zvvvv555333wkjiÎmEuJmGmmmZZZZZZuuulC|t@ hhSave process list to file..5 mnuProcManProcessManager Popup Menu,mnuProcManKillKill process(es)mnuProcManStr1-2mnuProcManCopyCopy list to clipboard0mnuProcManSaveSave list to disk...mnuProcManStr2-,mnuProcManPropsFile properties1 77rI2Y^ll{jޕYJʞoV:O3f `ӓA@frmUnlockRegKey Registry Key UnlockerB#n@ltf@hF00 %  V+ h;( @NRELFVQ`o`iy6;>9-1/CCJJCDQX^QS]GFJOOUcmkw{vdmyG72&*)--632=2:JRR\RSCTCERsvdbstbr"P0p=LYgx1Qq&/@PZpt1Qq/&PAp[tϩ1Qq/P"p0>M[iy1Qqұ/Pp  >1\Qzq/Pp!+6@IZ1pQq/ P6pLbx1Qq,/KPip1Qq/-P?pRcv1Qqϑܱ/Pp!&,>X1qQq T'S U W.T(1 %+V/J[`^H-DNO]_aI#:FGKM]\"Y=657EBJL$Z?;42&>!,<93QA<8) 'R@C0 XP+*(0` %3f3f3f3e/c-b=3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f/5i;o M{&U,a,_.ah2e43f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f-ai/a2eJz5o Q7j2e3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f2e)^J Ay=b711d3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f.b;3eU5nj*+>q1dJ3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f+`s9jr^/hi(X-`w3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f2e+`XyV4b ;oOj+^3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f%\Ӊ^M!Ky"*^3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f1d//cu9qNn]([.aN/b,2e3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f-aZApzo2j}yXH{Cv3f2eE3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f(^Ad`Kt3iQ ,_3f"3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f%\|N#SCt5c*]3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f2e"*_謺` @x6ZN,_3f3f 0d(-`K2e33f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f/cO :k|2k`~  6i'[/cDt V1d2e.3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f*_z.U`[1ia hAv^/cBFLSX^djotz}h Fx+^t3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f']f*4-'&(+.269=BHNTZ_eiou{vkY+^3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f(^,70+(%$&)-148=DLRWZ_ejpnf%b+^3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f(^-:3.+(%#"$(,064/1>PWZ_ee`*_+^3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f']|,=72.+(&#!!"*;n2e5g2eZDSU[\Y+R+^3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f(^kT,@951.,)'%""0c;lsKy&R}Kw%9i GyDMPTM-=p,`k3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f.bDQ|:@=852/,*(&$L~.Q{;cJx#O{$Q|H?r0cE3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f0d*>nZ4D>;8520.+Dv&Lyj>e%O{Iv+VBh8h e(2T+*^3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f(^i1;85311*]JwA)R~#Mz$P| 8h4h)FW:m1dG3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f1e/cݯ)=C>;86311{1d 3e 4f2dmS-`3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f.b= 8i,5B?;96422&zk'*D{'f*^3f 3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f,aG=nL)8><9743320,.a(c*^3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f-b>1d∞I-+010.+)2WsIy)^3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f1d(^)R}g\Z\i4l/c-aq3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f,a>)_ApacS~/c*_2e3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f/d"(^`']*_.b.b,`)^(]~-aO2e3f3f3f3f3f3f3f3f3f3f#########?####?########?###############x#|#|#x#0####?####( @ 3f1e6i.af-`(0c3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f1dHP+WX Y?r2er3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f2ekEqYd%J|/b3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3fCr !ExkJb+_63f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f+]lo=p{"(Zi2e3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f/`*]Z&Htp9k#U4-_2e3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f1c([ =hʷAeAdW]P-_0c2d3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f2d0a#V+>]}"Gw`D^&WT1c2d3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f2e1c/`!UXmu5iu& Au#R</`D-`.a@3e3f3f3f3f3f3f3f3f3f3f3f3f3f3f2e1b.^$Xh:mw(Y8hEN+]#3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f2d0b*\5bPz6M}kIWzDoF4h/b3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f2e1b&Y2Pxv6YTsF`7O~W,)],^ +^,_.a 1d3f3f3f3f3f3f3f3f3f3f3f2e1c#WG]uq!?ri#u.Ap\~Pa^O9m,__/b 3f3f3f3f3f3f3f3f3f3f2e0b%Xxj9kt X5IVT>Fy+^P2e3f3f3f3f3f3f3f3f3f2e-a 0az[*Dt]Cmgj,^2d3f3f3f3f3f3f3f3f3f2e*^&Gr׸oBnC\r8w,_z2e3f3f3f3f3f3f3f3f3f2e&[8RjTS_ejs|3b*]A3e3f3f3f3f3f3f3f3f3f3e$WrfjEPW]dnwn+_73f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3e2e)_+^bCp:]Di=e$R|6h)^D0d3f3f3f3f3f???(  @5h& 9k@q7k;2e3f3f3f3f3f3f3f3f3f3f3f 8itUa+_3f3f3f3f3f3f3f3f3f3f3f+^t-d;nL+_3f3f3f3f3f3f3f3f3f3f.c*^a&jQ*].b1d3f3f3f3f3f3f3f3f.b 4eF{1L ;l?q-0c3f3f3f3f3f3f3f3f)^!Ivƨ=y*R^-a-*_*^ .a3f3f3f3f3f3f'\9e,y&Hn k^;o,`2e3f3f3f3f2e+_ N.gx Y.a2e3f3f3f3f/cM[iy1Qqұ/Pp  >1\Qzq/Pp!+6@IZ1pQq/ P6pLbx1Qq,/KPip1Qq/-P?pRcv1Qqϑܱ/Pp!&,>X1qQq            3/;(0` %UUUUUU )+**,**+,**+,**,+**,**+,**+,( UUUUUUUUUHHH333UUU3:UUU333HHHUUUUUUUUU333???HHH=D???333UUU???UUU333???;GHHH???333UUU888 UUUUUUUUU333???7}~zz}z{|z|{z}~zz}AHHHHHH???333UUUHHHUUU???UUU333???9g???333UUU888 UUU333???HHHHHH???333UUU888 ^@HHHHHH???333UUUUUU888 UUU333>i???333UUU888 UUU333???HHHHHH???333UUUaFHHHHHH???333UUUUUU888 UUU:lHHH???333UUU888 UUU333???0K!''' ???333\E???HHHHHH??????UUU???UUU888 UUU7hHHHHHH???333UUU888 UUU333T;???333W@333???HHHHHHUUU???333UUU888 :gHHHHHH???333UUU888 UUUZ ???"A333???HHHHHH???333UUU>kHHHHHH???333UUU888 UUU]???+GUUU333???HHHHHH??????3338k???HHHHHH???333UUU888 333`888 0B888 UUU333???HHHUUU***UUU???3337g333???HHHHHH???333UUU888 DU888 ,UUU888 UUU333???333UUUHHHHHH???<g333???... 333 ***  $$$''' ???333UUU888 UUU333???HHHHHH=lUUU[???333UUU888 UUU333???***HHHHHH7j888 UUUi$???333UUU888 UUU333HHH??????HHHHHH8gUUU888 o %???333UUU888 UUUUUUUUU333???HHH=hUUUL???333UUU888 UUU333???:m333333   ??? ???333UUU888 UUUUUUUUU333''' g888 UUU888 UUU333???HHHHHH???333UUU ???333UUUHHHUUU???UUU; s@UUU888 UUU333???HHHHHH888 333UUU  ???333UUUUUU888  9$\q***UUU888 UUU%wyz~{y{nUUU!} ???3331UUUB"""vN$*** ( 0***~$333UUU!| ??????w- O^"???333UUU"{ UUU:~$$$M???,!UUU#L  Fw***, 3.+. 2,+ )... ^#UUU##4 Ix#???333UUU888 UUU333???HHHHHH\#UUU$ss???333UUU888 UUU333???HHHHHH]UUU %$rT 0HHH    HHHbAUUU &kuHHH:_G333UUU333 Q***^:J!???\B???333UUU &??????' ???F333???]@???333UUU0 UUUUUU8!???5 333bD???333UUU888 UUU [!  +u{***...    333 UUU]GHHH???333UUU888 UUU&HHHHHH... E333???HHHHHH???333UUU888 UUU\AHHHHHH???333UUUHHH3:???HHHHHH333 d 333???HHHHHH???333UUU888 _@HHHHHH???333UUU333???HHHHHHZ???333???HHHHHH???333UUUbFHHHHHH???333(kUUU333???HHHHHH*z}~}~~}E???HHHHHH??????<[888 UUU333???HHHHHHU@333???HHHHHHUUUuUUU888 UUU333???HHH''' zA333???HHHHHH_UUU888 UUU333??? ,: AUUU333???HHHHHH)_UUU888 UUU333???  *(* 0+(+ 0*( - /)) /-& 888 UUU333???HHHUUU W UUU888 UUU ???333UUU888 UUU333???HHHHHH???333UUU888 UUU333???333UUUT8@c^HHH???333UUU888 UUU333???HHHHHH???333UUU888 UUU333???mT HHHHHH???333UUU888 UUU333???HHHHHH???333UUU888 UUU333???***#x 888 HHHUUU???333UUU???UUU333???HHHUUU???333UUU???UUU333HHH???333 z ???***333???UUUUUUUUUHHH???***333???UUUUUUUUUHHHUUUUUU & ""Ȅ D "     "D "  D " @ "  D "       @    @ "        @  @ "  D "D 32f ( @ UUUUUUIdcdcddcdcddcdcddcdKUUUUUU???333"""???333UUU333333 333333UUUUUU333## $ "# $ "# %UUU333333UUUUUU???333333UUU333333''' 333333UUUUUU333333UUU???UUU ???333333UUU333kp7$$$333333UUU???UUU333333???UUU333333UUU>f5<333333UUU333333 ***UUU333333UUU+nc F333333UUUUUU333***333UUU333333Ce #$$$UUU333333UUUUUU???_qspsqe ,333UUU333333UUU???UUU ??? M333UUU???UUU333333????333UUU333333 $$$333      $$$ 5333UUUUUU%Be~45UUU333***333888 333$$$UUU 6333UUUUUU888 /;UUU''' ***\ UUU 7~333}dV,9rz ."333??? 8}UUU` 1 333D 92 m1$$$***   $$$HHHUUU :fwqq$$$333333UUU333333HHH ;f|8''' gv UUUUUUfSUUU***~ "***333:Q***#4***333333UUU*** UUUUUU + "o   ???UUU333333UUU UUUg 333333UUU333333HHHUUU333333UUU5*333333UUU W "#! % $#"UUU333333n333333UUU =333UUU???UUU;'UUU333333^g333333UUU w$$$UUU333***WBbeccebecceK... 333333UUUo """ \ 333333UUU333333UUU333333UUU333333UUU'=HHH333333UUU333333UUU333333UUU333333??? e| ???UUU333???UUU333???UUU333???UUU???UUU?V@SI  !B(  @UUUEGUUUUUUUUU???fj??????UUU???f??????>1j??????UUU???f??????***yigV??????UUU???f ;EEM ??????UUUUUU???f&???UUUUUUa, )-YUUU?{`S;[ JX`T \iN3*LLC _G sZ&j***:!T@!w"   j??????UUU333??? Zwj??????UUUz ???0[H??????UUU4q***??????UUU-pUUUUUUUUU&&&&&&&&&&&&&&&&$Form115x'$H@DBTahomaF6 cmdSelectFileAdd file(s) ...xw7fraReportFormatReport format:P 7 8OptCSVCSV (Full log in ANSI)xO  G optPlainText!Plain Text (Short log in Unicode)xh  ) fraFilterFilterP 74 OptExtension by extension' . OptAllFiles All Filesx Z chkIncludeSys3Include files in Windows\System32 (SysWOW64) folderxD chkRecur Recursively (include subfolders)xX5 txtExtensions  .exe;.dll;.sys( CmdExitClose ! cmdGoGoh'" txtPathsX"H lblStatus1 / 1 - File - (in folder)' #shpForehw#shpBackhw lblThisToolaThis tool will create a detail report about digital signature of files/folders you specify below:x1%H#=s"21T`vMAj:O3f `ӓF@ frmUninstMan Remove Programs ManagerB#n@ltf@hF00 %  V+ h;( @ """$$$***000555999===@@@JJJMMMPPPTTTZZZ]]]```eeeiiimmmqqqxxx}}},/KPhp1Qq/!P7pLcyϏ1Qq/Pp",6@J[1qQq/Pp  =1[Qyq/"P0p=LYgx1Qq&/@PZpt1Qq/&PAp[tϩ1Qq/P"p0>M[iy1Qqұ/Pp  >1\Qzq/Pp!+6@IZ1pQq/ P6pLbx1Qq,/KPip1Qq/-P?pRcv1Qqϑܱ/Pp!&,>X1qQq          #ƙAǃ??(0` %UUUUUUUUUUUU???TTTWWW:XXXmVVVOOOFFF@@@<<>>RRRQQQCCC,,,%%%777===555!!! 000===EEEGGGVGGG UUUUUUYYYPPP9RRRlIII:::+++333MMMRRRJJJ444### $$$   ...:::BBBCCCWGGG UUUUUUUUUSSSCRRRIII999### )))AAAKKKFFF444%%%  """444>>>EEEFFFWGGG UUUUUUTTTTTT9RRRlHHH888!!! 111:::777+++  ,,,@@@KKKQQQTTTWWWW UUU\\\ RRRRRR;GGGN777X!!!\m&&&222333+++ !!!   +++333333***...CCCXXXaaagggfffWggg ???\\\ TTTHHH777 $$$#2228@@@cHHHFFF:::*** ***===GGGMMMIIIMMMp___lllrrruuuuuuWwww UUU???***UUUWWW=XXXpQQQCCC000  """555KKKXXX[[[ZZZ^^^jjjsssyyy{{{{{{W UUUUUU333UUUWWW#VVV>QQQQCCCZ111]'''n)))...+++###  ...666777111333EEEXXX``````]]]]]]eeeooouuuwwwxxxYttt#fff\\\ aaaQQQ??? /// ###$///+???4???8???4111.333<;;;c@@@<<<222###,,,@@@MMMPPPKKKKKKlUUUzbbbeeeccc\\\[[[```iiimmmlllccclQQQ8777... ???\\\ bbb\\\:SSSLDDDV+++WXY***Y///P666=888$AAA#NNN>LLLqHHH???555///(((!!!%%%888PPP\\\___]]]XXXy]]]xeeegggddd]]]YYY\\\``````[[[NNN???a///;***... UUUaaa```:]]]mRRRBBB+++(((///333l444:??? MMM!OOO=SSSbRRRQQQOOOIII===999HHH]]]dddccc]]]XXXVVV\\\vaaafbbb]XXX_SSSqRRRRRRNNNHHH<<<222,,,m(((9$$$???QQQXXXNTTTKKK;;;&&&""")))---...M777 HHHUUUbbb4hhhbiiiiiieee^^^yXXXh^^^zhhhiiieee^^^YYYTTTTTTvNNNTEEEB999C777X888<<<<<<888444111///...L---UUU???GGG HHHXFFF>>>222 ######V''' ???ffftttyyy=zzznxxxxxxrrrvooonmmmwnnnmmmhhhbbb]]]XXXNNN@@@o+++]^p&&&***---222444444555V/// UUU/// 333Y222,,,### W  {{{{{{<{{{WuuuqpppooommmmmmwlllzjjjhhhdddZZZLLL;;;'''%%%111999>>>>>>V777 UUU''' ***Y((($$$  W  ttt0rrrWmmmlllhhhcccn___h___bbb^^^SSSDDD333$$$$$$333>>>DDDFFFL???UUU/// ---Y---))) W fffnnnnnn>>====pAAALLL[[[dddkkkm?088>?( @ UUU??????UUU___XXX4XXXPPPCCC:::5559... YYYUUU3QQQEQQQEPPP3QQQTTTHTTTJJJ777***w 9 UUUSSS4QQQNNNMMMJJJFFFAOOOSQQQBBB''' 9 ___HHHFIIIDDD===666,,,???RRRHHH---  w9UUU???DDD===K888000$$$333WWW[[[FFF,,,9... LLLKKK3>>>E***H###H222K666g111+++###'''HHHYYYUUU??? (((wGGG9LLLEEE LLL9HHH:::'''"""...444333r999???222(((>>>SSSIII$$$ 333HHHNNN4***YYYPPP9DDDw999---!!!$$$ :::QQQFFF&&&$$$>>>=== 444DDDHHHF???UUUVVV2OOO???&&& ***MMMLLL000 222@@@CCCH???UUUVVV2PPP~<<< 888===***  ###@@@MMMMMMH___YYYPPP3>>>E!!!M***y999333  333;;;111CCC```jjjjjjH___UUU???::: PPP9UUUFFF*** ---LLLYYYVVVeeesssxxxxxxHUUU???333 HHHVVV;GGGK000O...y333))) 666???555EEE^^^bbb[[[bbbooouuusssMbbb fff___3IIIE&&&HJ///K888;<<<"HHH>>9<<LiKfrmError ERRORB#&KltK  Vh 00 %f  6 hF( @ WW55 **EEkk44XX /1]CvY. 'Dy|U_ZXn8**'jeU[sQ--ffxxy`ps;f]]33n[[hZZd::W naaB>5+@fMy郃ppi{{qqgGGA;;9ssZZZ茌??DD~~rr{ ,, iiNNNܬ@@/.|{B?:Ch`]T+K%%---ἼSS32i~imn@Uma[]b1Uֶ 㠠`_Xb}nxQ_pd^_`b&dd""#맧zx{ʇnt{ma``aiHz^^^sss鳴̓ryMV./1$?.TNw~}<<<便po|z QQ\\Z{{sEE;;UU__LL// ޼mmzzXXPPff펎}}zzuu$$44%%66&&!!55HH  CC艉MM""  $$]]ԆNNQQhhssoo__FFȃ֖\\煅yy@D%ų½ee,,8855#%)޴ϣݵɱ佖伓ư?( @## ,, (LMP >nKYd*$$"(jdAj""uullQQvggo@#7}}}㖖LLONc5V5[  y}فOQoU]U 諫ppqꊕzMl=lG}Md٫𳳳Ոxx$$** []円VVSS++99BBDD!!bb  **xy99||uu..ͺwwZZVWα(0` %K35 ! ' +);A/ ):N c(r-}020.){!paOB4#& 'b* #D6sYY5jM2 # 0!!Q0F}zC jF "%pppeee=fff?fff?eee?fff?fff?fff?eee?fff?eee?fff?%%o qw # lw.1̊ϊϊϊϊϊϊϊϊϊ&&,=7nPVvV 90?BB5]@q/gXf_WoX34?MM?oU8vOHV][\tDs +U?Ar\HD[bUTZYlWn "? [S5q=X^]ZY\p&KN ? DSbTS[Z[hX:|6?Zuf\Y_lt=V9?DDzzUqncl>s+0[?##w%%U&&NQ{rr9990HN}t%j(?jjmVV[eee& I>>>92(!;a?JJJqqjjsszzLLL4442224OoX?EEE\\FFFF``GGG TqxK ?~~~\\\kk@@33CC||-7w VV::{ ?222sss==00EEKKL)2>`YYYYI~nnSS?vvKK;;58eim)+-`ZZZZZU>>aa?mmXXGHXp~x778b]]]\]]J gg?~~ee[bs{xJJJi^^^^^^^&CEEhh?ssv~nv~fghj_____``N vvee?FFFIII~bcdMwArArArCvG}MTYxBB##NNWW?{jqnqdd $" C C=2$@AwghAf7aaa aaa aaa aaa aaa aaa ddc33=LrO[\\ /1]CvY.W'Dy|U_ZXn8+**'jeU[sQffxxy`ps;fj33n[[hZZd::W naaB>5+@fMy#Bppi{{qqgGGA;;9iZZZ??DD~~rr{ ,, NNN@@/.|{B?:Ch`]T+K%%nneS---SS32i~imn@Uma[]b1U|Z `_Xb}nxQ_pd^_`b&ddzZ""#zx{nt{ma``aiHznnrZ^^^sssryMV./1$?.TNw~}jjrV<<nKYd*P$$"(jdAjvuullQQvggo@#7 r}}}LLONc5V5[  GG&6OQoU]U ppqzMl=lG}MdZYxx$$** ##'-VVSS++99BBDD!!+.dbb  **HHDF 99||uu..wwZZVWα$Form15xDF#Picture1xB!cmdNoNoX#cmdYesYesXGchkNoMoreErrorsDo not show this message againxH Label11JKK]x dJ vA8[PU:O3f `ӓ|qKfrmMain B#&KltK  Vh 00 %f  6 hF( @ WW55 **EEkk44XX /1]CvY. 'Dy|U_ZXn8**'jeU[sQ--ffxxy`ps;f]]33n[[hZZd::W naaB>5+@fMy郃ppi{{qqgGGA;;9ssZZZ茌??DD~~rr{ ,, iiNNNܬ@@/.|{B?:Ch`]T+K%%---ἼSS32i~imn@Uma[]b1Uֶ 㠠`_Xb}nxQ_pd^_`b&dd""#맧zx{ʇnt{ma``aiHz^^^sss鳴̓ryMV./1$?.TNw~}<<<便po|z QQ\\Z{{sEE;;UU__LL// ޼mmzzXXPPff펎}}zzuu$$44%%66&&!!55HH  CC艉MM""  $$]]ԆNNQQhhssoo__FFȃ֖\\煅yy@D%ų½ee,,8855#%)޴ϣݵɱ佖伓ư?( @## ,, (LMP >nKYd*$$"(jdAj""uullQQvggo@#7}}}㖖LLONc5V5[  y}فOQoU]U 諫ppqꊕzMl=lG}Md٫𳳳Ոxx$$** []円VVSS++99BBDD!!bb  **xy99||uu..ͺwwZZVWα(0` %K35 ! ' +);A/ ):N c(r-}020.){!paOB4#& 'b* #D6sYY5jM2 # 0!!Q0F}zC jF "%pppeee=fff?fff?eee?fff?fff?fff?eee?fff?eee?fff?%%o qw # lw.1̊ϊϊϊϊϊϊϊϊϊ&&,=7nPVvV 90?BB5]@q/gXf_WoX34?MM?oU8vOHV][\tDs +U?Ar\HD[bUTZYlWn "? [S5q=X^]ZY\p&KN ? DSbTS[Z[hX:|6?Zuf\Y_lt=V9?DDzzUqncl>s+0[?##w%%U&&NQ{rr9990HN}t%j(?jjmVV[eee& I>>>92(!;a?JJJqqjjsszzLLL4442224OoX?EEE\\FFFF``GGG TqxK ?~~~\\\kk@@33CC||-7w VV::{ ?222sss==00EEKKL)2>`YYYYI~nnSS?vvKK;;58eim)+-`ZZZZZU>>aa?mmXXGHXp~x778b]]]\]]J gg?~~ee[bs{xJJJi^^^^^^^&CEEhh?ssv~nv~fghj_____``N vvee?FFFIII~bcdMwArArArCvG}MTYxBB##NNWW?{jqnqdd $" C C=2$@AwghAf7aaa aaa aaa aaa aaa aaa ddc33=LrO[\\ /1]CvY.W'Dy|U_ZXn8+**'jeU[sQffxxy`ps;fj33n[[hZZd::W naaB>5+@fMy#Bppi{{qqgGGA;;9iZZZ??DD~~rr{ ,, NNN@@/.|{B?:Ch`]T+K%%nneS---SS32i~imn@Uma[]b1U|Z `_Xb}nxQ_pd^_`b&ddzZ""#zx{nt{ma``aiHznnrZ^^^sssryMV./1$?.TNw~}jjrV<<nKYd*P$$"(jdAjvuullQQvggo@#7 r}}}LLONc5V5[  GG&6OQoU]U ppqzMl=lG}MdZYxx$$** ##'-VVSS++99BBDD!!+.dbb  **HHDF 99||uu..wwZZVWα$Form115 G"@DBTahomaFTimer1 P#tmrStart 200fraOther Other stuffp ? cmdSaveDefAdd checked to ignorelistR0 cmdConfigSettings,G0*cmdHelpHelp,G0 fraSubmit E 74 cmdAnalyzeAnalyze report,8. cmdMainMenu Main MenuR:5 fraScan Scan && fix stuffx ; CmdHidden2FocusGWDBTahoma9 cmdInfoInfo on selected item...R$ < cmdScanScan,G1DBTahoma-cmdFix Fix checked,tFpictLogoRFltJFBMJF6(VEFՙ̪f3333U33̪fU333̀3333U3U333fU3̪3̪f̀3̪3̀33fUU3fU3fU33ffffՙff̪f3ffU3f̪3f̪3̪3fU̪ՙU3̀3̪3fffffU33̪f33̪3U33f3U̪ffU3̪3̀3̪3fՙU3̪f̪3̪3fffffffUՙU̪ff̪fU̪̪U̪33̙f̪̪fUf3̪3U3fՙU3̪f̙U3ff3̪ffU3ՙfU3̪f̪̪fՙ3fffU̪̙U3̪ffU3Uf33fÙ3̪f̀33̪f33̪3̪3fffU3ՙՙՙՙUfff3U̙f33UÙfff3f3f̪3ff̪fffՙ̀U33̪3̀f̀f̪f̪f3̪fՙ̙3ՙf3̪f̙f3ՙfffffffUfՙ̀3fffff̪3U33U3̀33f̪3f̪3f̪3̪3̪3̪3̀33̪f̪̙3̪3̀3̙3U33f̙33ՙf̪3ff̪f̪3Uՙՙ̪33ՙ̀3f̀3̪3̪̀3ff3̀f̪3U3ff3̀33̪3̪f3̀33UU3̪f̪ffՙ̀3̪33̪33̀3̪3Uf̀3f̀3̀f̀3̙U3U3̪3ff̪f3̀3U3fU̪̙3̪3̀3ff̙ՙ̙3U3̪3fUffff̪3U3fU3̪fՙ3̪3̀3̀̀̀ff3f̪3̀33̪3̀3̪fff3̪f3̙f̪33̙3̪f̪f̪3U̪3fU̪ffffՙffՙ̪33fU3̪fՙf̀̀UÙ̪fՙff̪3̪3ՙffff3fU3ՙ̪ff̪33̙33̪33ՙf̪3̪3ՙ̪3ՙfՙfff̪3̪fff3U3fU3Ù̪3fՙf̪fU3̪3ffff̪f3f̪333̪ff̪3ff̀f3̪3Ù3̪3ՙf3fՙfffՙffff̪3̀3̪33̪33̪3̪3ffՙf̪3̀3̪3ՙfՙff̪f̪f33f̀3̀3̙U3ՙUfՙf̪ffffՙf̪f3̪fffՙfՙff̪3̪̀3ffՙՙfUՙf̪̪f̪f̪f̪3̪f̙333fUU3̀3fUUf̀3f̪ffff̀ՙՙՙf3̀3̀3̪3̪3̀3̀U̪3̪ffՙf̪3U3ffՙ̪3f̙3fU̪3f̪3̪3ff̀3U3f̪ffՙfՙ̪ff̪3ՙ̪3ՙfffff3fՙfՙff̪3U̪3f̪3̪3333fU̪̪f3f3̪3̀ffUffU3̙Uՙ̪f̪3ffU3̪fՙՙfffՙf̪3̪3̀3̀3̪3̪f̪3U3ffՙf̀3Uՙ̪3f3̪f3̪3̀3̪f̪f̙3̀3ՙÙ̪fffUfU̪fff3̪33ՙ3UUUÙ3fՙ3U3̀33U3̀3̪3̪3ՙ̀ՙfU3̀3̀3ՙՙ3̀3̙fUfՙUՙՙ̪fU3fՙ̪f333fՙffffՙՙf3̪f̙f̪fՙf̀ՙ̪f3ՙ̙fՙ̪f̀3f̙f3̀3U̪fU̪fUfՙ̪fU3UU3ՙ̙3̀f̪fU̪3̀33̪f̪3̀333UU33fUՙ3̪f̪3̀3̪f̪f̪̪̪f̀33̙U3̪f̪3f33̪fÙ3̪fUfU3̀3̀3U̪3ÙU̪3fՙՙ3ՙ̪f̀3UU3̪f̪f̪f̪fU3ՙՙՙ̙U3ffՙ̪3U3ՙ3Uf̪3UUU3f̀3ff3̪3̀3̪3̪f3U333̀3f̪3ՙf̪f3̪f̪f̙33f̪ffU̪3̪33ffU3fU3fUUf̪̀̀ffՙՙՙffU33ff̪f̪f3̙3̪̪fU3̪fUfU̙3U3̪f3fՙ̀Ù3Ù3̀3̪f̪f̀3̪33̪3̪ffՙՙU̪ff̙U3f̪ffUf̪U33ՙՙU3fՙU̪fՙ̪̪f̀f3̪3Ù3̪fՙ̪ff3̪ՙ̀f33ՙ̪U̪f̪f̪3ՙf̪33̪f̙f̪ff̪fU̪3UÙU3U3Ufՙf̀3̪f̪fU3̪̪f̪̪f̀fU33Uf̪f̪f3̙ff̀3̪3̀3U33̪ffU3̀fՙfUfU3fՙf̪fՙ̙3ՙ̀3f̀3ՙUՙ̙f̪ffU̪3Ù3̪3fՙfՙ̪f̪3ՙ̪fffU3̙f̪f̪fՙ3f̪f̪f̪3̪f̪fՙ̪f̪ffU̪3U̪fÙ33f3fU3ff̪f3f̪fՙՙ̪fՙՙfUՙ̪̪fՙ̙̪̪f̪fU̪f3fU3ՙU̪3̀3̀3UU̪f̪fU3̪fUf̙f̪ff̪fՙff̀f3ՙf̪ff̪fU3ՙfU3ՙf̀3Ù3ՙ̪33̀3U̙3̪fffՙՙ̪f̀f̪f̪fՙ3ՙ3ՙՙՙ̙Uՙՙ̙3̀3̪3Ù33UfՙU3fUՙfՙU3ՙՙ̪f3ffՙՙ̀3ՙf̙U3̀3̪3U̪3̪3̪fUÙ3̪3f3̙ff3̪f̀fՙ̪f̙Uՙ̪fՙ̪ՙՙՙ3̙3ՙU3fU3ՙ3U̪3f3̪f̪ffՙU3̪f̪f3ՙ̪ՙՙՙ3f̪f̪ff̀3Uf̪f̀3f̀3fUfU3ՙ̙U̪f̪̪f̙Uffՙՙՙ̪f̪ffՙ3̪3̀3Uՙ̪fUՙUՙՙ3f̙Uf̪f3̪f̪̪̪ՙ̪f̪̪̙3̪f33ffUՙf3̪f33UfU3̪ՙ̪f̙3ՙ̪fՙ̪f̪ՙ̀f̀3f̀3̪fÙfՙ33U3fU3̙U3̙fՙf̪f̪fff̙33ՙ̀33ՙ3U3ՙU3U3fU3U3̪f̪f̪̪ՙ̙U3ՙfÙ3ՙfU3̪f̪f3U̙3̙U3ffUՙU3̙U̪fՙU̪ffU3f̙Uՙ̪ՙf̪fՙfU3̙3̀fÙ3f̪ffÙf̙f̪̙3̪f̪f̪fՙf̪̙f̪̪̀3UU̪ffffU3̀f̪fՙՙfU3̪f̪ff3ffU3̙3̪f̪fՙՙfU̪̙f̪fՙՙ̪fU3f̪f3̙UU3̙U3fU3ՙՙ̪ffՙՙ3̙U3̀33ffU3fU3̪̪fՙf̪f3fU3UfU3̙U3̙U3̙ffU3ՙU3f̪f̪f̪fՙf̪f̪ՙfU3̪ffU3ՙ̙3̪f̪fU3fU3fU3ՙ̙3fU3̙U3̪ffUf̪fU̙U3U3ՙfU3̪f̪f̙UfUffU3fU3̪f̙U3fU3̙f̪ff̪fU3̪ՙ7^b$-;! cmdHiddena9KV3 fraConfigxH! DBTahomaJ chkConfigTabs Misc Tools+ DBTahoma)G chkConfigTabsBackups 7+ DBTahoma)J chkConfigTabs Ignorelist+ DBTahoma)O chkConfigTabsSettings+ DBTahoma), fraConfigTabsxw# +"*fraMiscToolsScroll.6"F FraRemoveHJT Uninstallx'WDBTahoma: cmdUninstallUninstall HiJackThisxhhjlblUninstallHJT8Remove all HiJackThis Registry entries, backups and quitP IB FraPluginsPluginsx`DBTahoma/ cmdLnkCleanerClearLNKxH: cmdLnkCheckerCheck Browsers' LNKxlblLnkCleanerAboutYClean and restore list of infected shortcuts (.LNK), found via Check Browsers' LNK plugin *glblLnkCheckerAboutQIdentify infected shortcuts (.LNK) which cause unwanted advertisement in browsers *H FraSysTools System toolsxWsDBTahomaDcmdDigiSigCheckerDigital signature checkerx@cmdRegKeyUnlockerRegistry Key Unlockerx 7 cmdARSManUninstall Manager...x@ ~-! cmdADSSpy ADS Spy...x` h{E"cmdDeleteServiceDelete a Windows service...xhzB#cmdDelOnRebootDelete a file on reboot...x(w;$cmdHostsManagerHosts file managerxHhv:%cmdProcessManagerProcess managerxhhtw&lblDigiSigCheckerAboutAVerify authenticode digital signatures on the given list of files *g'lblRegKeyUnlockerAbout1Reset permissions on the given registry keys list *\(lblARSManAbout.Managing items in the Add/Remove Software list r :J)lblADSSpyAboutScan for hidden data streams 9}f*lblDeleteServiceAbout1Delete a Windows Service (O23). USE WITH CAUTION! l4|+lblDelOnRebootAboutiIf a file cannot be removed from the disk, Windows can be setup to delete it when the system is restarted (WyO,lblHostsManagerAboutEditor for the 'hosts' file *xm-lblProcessManagerAbout9Small process manager, working much like the Task Manager huE.FraStartupList StartupListx7pDBTahoma8/cmdStartupListStartupList scanxq0lblStartupListAboutA simple tool that lists all and every auto starting program on your system. Commonly used to troubleshoot malfunctioning systems, trojan/viral infections, new spyware/malware breed and the likes.  rK1FraUpdateCheck Update checkxxlDBTahoma@2chkUpdateSilentlyUpdate in silent mode 8W@3chkUpdateToTestUpdate to test versions ^4chkCheckUpdatesOnStart.Check updates automatically on program startup W95OptProxyDirectDirect connectionJ+6 chkSocks4Socks4W K-7optProxyManualProxyGL18 optProxyIE IE settingsM19txtUpdateProxyPassN"*(+:txtUpdateProxyLogin 7O@;chkUpdateUseProxyAuthUse authorizationP2<txtUpdateProxyPort 8080Q7=txtUpdateProxyHost 7 127.0.0.1U?>cmdCheckUpdateCheck for update onlinehm1? lblUpdatePassPasswordW /@lblUpdateLoginLogin g n-A lblUpdatePortPortg o1BlblUpdateServerServer g GC FraTestStaff Testing staffx+W jDBTahoma<DcmdTaskSchedulerTask Scheduler LoghYk-E vscMiscTools  9 d  M fraConfigTabs fraConfigMainx "DBTahoma"+FfraConfigTabsNestedwF"AG FraInterface Interface0 GDBTahomaUHchkFontWholeInterface&Apply selected font on whole interface0 xW$I cmbFontSized;  JcmbFontxd; gKchkConfigMinimizeToTray6Minimize program to system tray when clicking _ buttonxHYCLchkSkipErrorMsgDo not show error messagesxXWXSMchkSkipIntroFrameSettings Do not show main menu at startupxhD)N lblFontSizeSizet%OlblFontFontxtGPFraIncludeSections Scan areax'bDBTahomaQchkAdditionalScanAdditional scanx8 f%qInclude specific sections, like O4 - RenameOperations, O21 - Column Hanlders / Context menu, O23 - Drivers e.t.c.kRchkAdvLogEnvVarsEnvironment variablesx e%(Include environment variables in logfileeSchkLogProcesses Processesxh d%-Include list of running processes in logfilesBT FraFixing Fix && BackupHDBTahoma%UtxtDefStartPage7&VtxtDefSearchPage7%WtxtDefSearchAss7&XtxtDefSearchCustP 7UY chkConfirm/Confirm fixing && ignoring of items (safe mode)xXEZ chkBackup Make backups before fixing itemsxh `[ chkAutoMark;Mark everything found for fixing after scan (DANGEROUS !!!)xH m\ lblConfigInfoABelow URLs will be used when fixing hijacked/unwanted MSIE pages:x)A\ lblConfigInfoDefault Start Page:xs'B\ lblConfigInfoDefault Search Page:x&G\ lblConfigInfoDefault Search Assistant:x&%G\ lblConfigInfoDefault Search Customize:xP q$B] fraScanOpt Scan optionsx'cDBTahoma^chkConfigStartupScanAdd HiJackThis to startupx` R%QRun HiJackThis scan at Windows startup and show results (if only items are found)`_chkDoMD5 Calculate MD5x i%-Calculate checksum of files (MD5) is possiblen` chkIgnoreAllIgnore ALL Whitelistsxb h%/Include in log any entries regardless whitelistachkIgnoreMicrosoftHide Microsoft entriesxh g%=Do not include in log files and registry related to Microsoft)b vscSettings hx@ E d Q fraConfigTabsfraConfigBackupx w #DBTahoma">c chkShowSRPShow System Restore PointsxxaFdcmdConfigBackupCreateSRPCreate restore point`NecmdConfigBackupCreateRegBackupCreate registry backup _<fcmdConfigBackupDeleteAll Delete all5gcmdConfigBackupDeleteDelete(7hcmdConfigBackupRestoreRestore$i lstBackupsx/Q .34j linSeperator00 P0  \ lblConfigInfoThis is your list of items that were backed up. You can restore them (causing HijackThis to re-detect them unless you place them on the ignorelist) or delete them from here. (Antivirus programs may detect HijackThis backups!)x: g*Kk fraHostsManHosts file managerxH  .DBTahoma8lcmdHostsManOpenOpen in Notepad 4-mcmdHostsManBackBack( 39ncmdHostsManToggleToggle line(s) 26ocmdHostsManDelDelete line(s)x '1%p lstHostsManxX$ 0.x\ lblConfigInfoJNote: changes to the hosts file take effect when you restart your browser.x '5U\ lblConfigInfo'Hosts file located at: C:\WINDOWS\hostsh /U fraConfigTabsfraConfigIgnorelistxH ? !DBTahoma"5qcmdConfigIgnoreDelSelRemove8rcmdConfigIgnoreDelAll Clear all8#s lstIgnorex/A .3_\ lblConfigInfo3The following items will be ignored when scanning: xxI(CtfraN00b Main menux8!o ;DBTahoma(ucboN00bLanguage; TNv cmdN00bScanDo a system scan onlyh>DBTahomaNwcmdN00bHJTQuickStart Online GuidehxADBTahoma[xchkSkipIntroFrame0Do not show this menu after starting the programhCMy cmdN00bClose%None of above, just start the programhB2z cmdN00bTools Misc Toolsh @9{cmdN00bBackupsList of Backupsh` ?[| cmdN00bLog#Do a system scan and save a logfilehH=DBTahoma8} lblInfoChange language: Ph(S4j linSeperator h4j linSeperatorphpB}lblInfoWhat would you like to do?<9~fraHelpHelpxH DBTahomaAchkHelpHistory7w] DBTahoma)AchkHelpPurpose 7w\ DBTahoma)>chkHelpKeys7w[ DBTahoma)DchkHelpSectionsx7wZ DBTahoma)%txtHelpxX/ #-$ lstResultsx.3Z txtNothing8W No suspicious items found! $-.DBTahomaPlblMD5%Calculating MD5 checksum of [file]...XXS ,4 lblStatusStatusJ -' shpProgressxw) shpBackgroundhS w'shpMD5BackgroundxXS x*shpMD5ProgressxXx}lblInfoBelow are the results of the scan. Be careful what you delete, HiJackThis cannot determine what is bad and what merely customized by you. The best thing to do is save a log file and show it to knowledgable folks.x-4! }lblInfoWelcome to HijackThis, the first general browser hijacker detecter and remover as far as I know. This program will be updated to detect general hijacker techniques as long as mainstream spyware removers don't detect the specific hijacker.x(WmnuFileFile%mnuFileSettingsSettings*mnuFileInstallHJT Install HJT+mnuFileUninstHJT Uninstall HJT mnuFileExitExitmnuToolsTools# mnuToolsRegRegistry.mnuToolsRegUnlockKey Key Unlocker" mnuToolsFilesFiles7mnuToolsDigiSignDigital Signature checker8mnuToolsADSSpyAlternative Data Streams Spy- mnuToolsHostsHosts file ManagerDmnuToolsUnlockAndDelFileUnlock && Reset permissions...EmnuToolsDelFileOnReboot Plan to Delete File on Reboot...'mnuToolsServiceServices+mnuToolsDelServDelete Service*mnuToolsShortcuts Shortcuts9mnuToolsShortcutsCheckerCheck Browsers' LNK,mnuToolsShortcutsFixerClearLNK-mnuToolsUninstUninstall Manager,mnuToolsProcManProcess Manager,mnuToolsStartupList StartupList,mnuBasicManual Basic manual)mnuHelpManualRussianRussian4mnuHelpManualEnglishEnglish (outdated)2mnuHelpManualFrenchFrench (outdated)2mnuHelpManualGermanGerman (outdated)4mnuHelpManualSpanishSpanish (outdated):mnuHelpManualPortuguesePortuguese (outdated)0mnuHelpManualDutchDutch (outdated)mnuHelpHelp* mnuHelpManual User's Manual,mnuHelpManualBasic Basic manual8mnuHelpManualSectionsSections' description3mnuHelpManualCmdKeysCommand line keys#mnuHelpSupportSupport, mnuHelpUpdateCheck for updates# mnuHelpAbout About HJT0 mnuResultListResult List Popup% mnuResultFix Fix checked4mnuResultAddToIgnoreAdd to ignore list;mnuResultAddALLToIgnoreAdd ALL to ignore list mnuResultDelim1-+ mnuResultInfoInfo on selected-mnuResultSearchSearch on Google4 mnuResultJumpJump to Registry / File-mnuResultJumpReg Reg.Entry1-mnuResultJumpReg Reg.Entry2-mnuResultJumpReg Reg.Entry3-mnuResultJumpReg Reg.Entry4-mnuResultJumpReg Reg.Entry5-mnuResultJumpReg Reg.Entry6-mnuResultJumpReg Reg.Entry7-mnuResultJumpReg Reg.Entry8-mnuResultJumpReg Reg.Entry9. mnuResultJumpReg  Reg.Entry10#mnuResultJumpDelim-/mnuResultJumpFile File.Entry1/mnuResultJumpFile File.Entry2/mnuResultJumpFile File.Entry3/mnuResultJumpFile File.Entry4/mnuResultJumpFile File.Entry5/mnuResultJumpFile File.Entry6/mnuResultJumpFile File.Entry7/mnuResultJumpFile File.Entry8/mnuResultJumpFile File.Entry90 mnuResultJumpFile  File.Entry10 mnuResultDelim2-) mnuSaveReportSave Report...#mnuResultReScanReScanF mnuDelChoose(Choosing file or folder to unlock/delete,mnuDelChooseFileChoose File...0mnuDelChooseFolderChoose Folder...1NwLS9& )CH%FD3&:O3f `ӓm-frmStartupList2  StartupList 2B#>lt6(& N( DDDDDwxwwwwwwwxL 343wsx7x@wswwwwww( @r'wwwwwwwzwpwwwwxwwwwwwwwwwxwwwwwwwwpDDDDDD    ;03 ;33 3s0?03wwww33??wwww33x?x08?$Form1/DesktopComponents15v"3picFramee" KB$;fraSaveG"L/ cmdSaveCancelCancelw@' cmdSaveOKOKwA# fraSectionsx O"# fraScrollerg P"YchkSectionRegistryDrivers32 librarieshR Drivers32kchkSectionDisabledStopped/disabled servicesxxQStoppedServicesT chkSectionHijackInternet Explorer URLsx IEURLsu chkSectionHardwareItems for other hardware cfgsh<w?Hardware DB MS Sans Serifd chkSectionUsersItems for other usersh>Users DB MS Sans SerifbchkSectionDisabledWindows XP Security Centerxh XPSecuritybchkSectionDisabledMsconfig XP disabled itemsx msconfigxpechkSectionDisabledMsconfig 9x/ME disabled itemsx msconfig9xCchkSectionDisabledZonesxZonesUchkSectionDisabledActiveX kill bitsxKillbitsVchkSectionDisabledHosts file itemsx HostsFilewchkSectionDisabledDisabled items, protectionDisabled DB MS Sans Serif[ chkSectionHijackHosts file pathxp HostsFilePathX chkSectionHijackDefault URL prefixesx  URLPrefixi chkSectionHijackReset web settings URLsxResetWebSettingsd chkSectionHijack Hijack pointsHijack DB MS Sans SerifN chkSectionMSIEActiveX autoruns xActiveXN chkSectionMSIEActiveX objects (DPFs)xDPFsF chkSectionMSIEIE bandsxIEBandsT chkSectionMSIEIE menu extensionsx   IEMenuExtK chkSectionMSIEIE Barsx0   IEExplBarsZ chkSectionMSIEIE Buttons / Toolsx@   IEExtensionsO chkSectionMSIE IE ToolbarsxP   IEToolbarsN chkSectionMSIEBrowser Helper Objectsx`  BHOsh chkSectionMSIEInternet Explorer itemspMSIE DB MS Sans Serifd chkSectionMSIEDesktop Components xDesktopComponentsZ chkSectionMSIEURLSearchHooksxURLSearchHooks`chkSectionRegistry3rd party autostartsh = 3rdPartyAppsjchkSectionRegistryUtility Manager autostartshp8UtilityManagerkchkSectionRegistryCommand processor autostarth#CmdProcAutorunTchkSectionRegistry Winsock LSPsh@; WinsockLSPUchkSectionRegistryApplication pathsh AppPathshchkSectionRegistrySecurity Providersh1SecurityProvidersUchkSectionRegistry MPRServiceshP ) MPRServicesmchkSectionRegistrySharedTaskSchedulerh3SharedTaskSchedulerchkSectionRegistryShellServiceObjectDelayLoadh7ShellServiceObjectDelayLoad=chkSectionRegistryWOWh0<WOW^chkSectionRegistryProtocol handers/filtersh- ProtocolsbchkSectionRegistryRegistry 'Run' subkeysh0 RunExRegkeys[chkSectionRegistryRegistry 'Run' keysh/ RunRegkeys_chkSectionRegistryApproved shell extensionsh! ShellExtsgchkSectionRegistryShellExecuteHooksh5ShellExecuteHooks^chkSectionRegistryColumnHandlersh"ColumnHandlersm chkSectionRegistryContextMenuHandlers h$ContextMenuHandlersj chkSectionRegistryImageFileExecution h&ImageFileExecutionL chkSectionRegistryPolicies h0 +PoliciesV chkSectionRegistry LSA packages hp' LsaPackagese chkSectionRegistryWinlogon autoruns h`9WinLogonAutoruns\chkSectionRegistryPrint monitorsh , PrintMonitors\chkSectionRegistryDriver filtersh% DriverFiltersLchkSectionRegistryServicesh2Services\chkSectionRegistryShell commandsh4 ShellCommandscchkSectionRegistryOn-reboot actionsh@ *OnRebootActionsechkSectionRegistryWinNT script policieshP:ScriptPoliciesUchkSectionRegistry Mountpointsh` ( MountPointsbchkSectionRegistryRegistry-mapped .ini filesh. IniMappingkchkSectionRegistryRegistry itemsRegistry DB MS Sans Serifl chkSectionFilesLoaded/autoloading filesFiles DB MS Sans Serif` chkSectionFilesExplorer.exe clonesxExplorerClonesY chkSectionFilesAutostarting batch filesxBatFilesX chkSectionFilesAutorun.inf filesx AutorunInfsQ chkSectionFiles.Ini file valuesxIniFilesf chkSectionFilesTask Scheduler jobsxTaskSchedulerJobsb chkSectionFilesAutostart foldersxAutoStartFoldersb chkSectionFilesRunning processesxRunningProcesses-scrSaveSections X  N  lblInfoPlease select which sections you want to include in the log file. Disabled sections are not present on your system. Note: you can right-click nodes in the treeview and save only that branch in a log file.x/gM- txtWarning G J-2 cmdRefresh Refresh (F5) w I  picWarninglt ( @"'QGPO'=BT8C>Ga1h!7C0 iN]]25`02_02E`01|j2." b..`22UFFjd)(b,+{ s oe'$j0- t   5:?"D$D%J(H'G'L)L*M,Q.`1V3}|OSQrdZP8 "$%#*1h ^  ( %{,61SIY=5u!i6k"Ys.M\2Pd";O $ZbzNNX>77::::::::::::::::::::;<=?* '#'#w(׵-оȵ ֖ȲѲƵ ƾ(˳ȴzǤۨ1̱ȵǽb 9ϒxȆbɦ/Ӗd$7 uv0za%8Jhtu/Ki^)9z x^/pJ i^!6rK gpaz,qTKK^sy 4}WOOag.|USXYy3}}W ^yi+}}|U\cW{i"2mmWnR_hK&~~jURK]YxJ"2mkoVRdhK`-llj[e_LK"2kNZfTK`&NNPdKKC4MLKK`5IQH>???  HB$>#Click icon to close the warning box/cmdAbort Abort (Esc)P  GpicHelplt ( @uj\${$t")-m,1w)9; ?=Jx5>N HS(f5S0\6p˙}1 o@ЃZȇbiŎqǕylF|]Ρۯʥ㯊Գğδռztohxy⻘saçѵocXƸxɼƻҢsęmmvsȣ~q۴ϩoW{xpÛyү~۸Ϯ؟ȤضӮѬزǤ¢ڶ˫ݺٷӲٻx۹ʯȪ޽ܼ߿ݾٻoʵdZPxkƲ˹ο}cĤ|ѳȫܹܵǫ˳ιíҿѼó²ų;÷nhaROK[XTvuslll^^^VVVCXWMY^WM\_aWڳ^e_ڳFe_`dcfEhgeegZ-`|]tss_jnlpkFjhY`dtH~6{uwzpoklijbCM~{zy}9%.5xqpmFHD`t:;,oxvvornb`IK $kxxxvw{hI<0,ׂw{~[1(0Lw{GI>KL:|ƗJ5ߍJH@@O>ƗJ'򓾾:P@QFߗ@S0 .NÔ@U΢= &ٗÿ@TUR;<--蜚>@TV(%*2  N❜ǔ«@B? 6  =ѠTB +Rѣ?C=3 0UTB- +AV8T#"4>)*:V78T#/T 4/T4/T! VV?  FB$*txtHelp G E-J stbStatusMSComctlLib.StatusBar"D-LB h!C4<~4ͫJz ;K pgbStatusMSComctlLib.ProgressBar/C-LB P!C41BͫE@@LimlMainMSComctlLib.ImageList-LB !C4~ͫJz(systemfolderregistrymemoryexebatdlliniregtextinternetmsieonrebootrunhelpexplorerwinlogoncmdgoodbadunknowndriveattnclockhardwareicquserusersprinterpolicyscriptlspxpsecmircfirewalldefender wintrust1 wintrust2 wintrust3 wintrust4(lt~h( @ʦ """)))UUUMMMBBB999|PP3f3333f333ff3fffff3f3f̙f3333f3333333333f3333333f3f33ff3f3f3f3333f3333333f3̙33333f333ff3ffffff3f33f3ff3f3f3ffff3fffffffff3fffffff3f̙ffff3ff333f3ff33fff33f3ff̙3f3f3333f333ff3fffff̙̙3̙f̙̙̙3f̙3f3f3333f333ff3fffff3f3f̙3ffffffffff!___wwwR%% % % %%%%%%%%%%lt~h( @kyEwEwEwEwEwEwEwEwEwEwEwkykyxxxxxxxxEwkyky]F@:3,&!xEwky{kySHB;4-(!Ewky{kyYLJB;5-(!xEwky{{kyTLIB;4-(Ewky{{kyXLLJC<5.#xEwky{{{kykykykykykykykykykykyky{{{{{{{{{{{kyky{{{{{kykykykykykykyky{{{{kykykykykylt>(( onffo``f`o`fon`n`?  lt~h( @ʦ """)))UUUMMMBBB999|PP3f3333f333ff3fffff3f3f̙f3333f3333333333f3333333f3f33ff3f3f3f3333f3333333f3̙33333f333ff3ffffff3f33f3ff3f3f3ffff3fffffffff3fffffff3f̙ffff3ff333f3ff33fff33f3ff̙3f3f3333f333ff3fffff̙̙3̙f̙̙̙3f̙3f3f3333f333ff3fffff3f3f̙3ffffffffff!___www}}}}}}}}}}_lt>(( DDDDDDDDDwwwwwwlt>(( ? 03DDDDDDDDDwwwwwwlt>(( wwwwwppppppppp 0p3ppx0 ;00lt>((  ׈0; ?8 ;0 ݀3 ݀ ݀0 lt>(( wwwwwppp`p``p`o``p`pfp`po`ppxs rl8ui %Sht+coco lt>(( x             𪪪    _ lt~h( @gN`;V5fD;C[5< kG5IEC<f0\5FdULHED]a7NA8n]Q]^D0ݩئj|huh^˵ŹWQ᫁⬂絎䷑ɹ[bH0”ⶎԭܵàigz$΀5uU4庑˧rerz[Χϩ̨ͩѮ̫Ũ؇)鹀͢ХѨڲ޵ίθc [Ûy&˘ݰسڸ-<iQ&tZ%ΥJ~~̗ Yuчȸ=\VprPnu[ttAV\ h:ۄp5 )mڎmh 40}x 4>!BXpx)Q}-X3_3`?k@lV~a܅pppdddLLL@@@0,@J=<8/& E+(CI.E  B7E_$"L[)E l -FA^9E!*Nv6HW%#4 2:qy?Xd`Z'31bx}PK>VGR;DSkYTaom]Qfi\e5{hgrusMwc~tOUnzp|jU?,0B?ď6( BQjPmR_? lt~h( @ʦkH%zbJs2PkHs%WUI=1%sPkkHH%%sPDZksHW%UI=1%sPԎkH%zbJs2PkH%ssPPkH%zbsJP2kHs%WUI=1s%PkkHH%%sPDZksHW%UI=1s%PԎkH%ܒzbsJP2kH%ssPPkH%zbJs2PksHW%UI=1%sPkkHH%%sPkHs%WUI=1s%PkH%ܒzbsJP2kH%ssPPzzznnnbbbVVVJJJ>>>222&&&yyyy}yyyyqyyyqy#y#wyyq⅔yyqyyy 0  lt~h( @ʦ@@@@@@3f333f3ff333f333333333f3333333ff3ft3f3333f333333̙333ff3f33f3ff3f3ffff3fffffffff3ffffff3f̙fLf3f333ff33fff3f3ff̙f333f3ff3ffff̙̙3̙f̙̙̙3f̙3f333fff3ffff3f3f̙3ffff___wwwz}xYYYYxxYYx88xYx88f8xYx88uff8xYY8ufuu8xYY8fuff8xYY8fuf88YY8f88xY88xYxY?lt~h( @Nߍ'xD(ߐ.S9u;ԔIIN|Yfffkź((((((((((((((((((((((((((((((((((((((((((((((((((( ((((( ((( ######### (((( %  (( ))))'!$ (((( #))))& (( # " (((( ######### ( ((((((((((((((((((((((((((((((((((((((((((((((((((((((x3kn@o  g~61Qlt>(( ;0;03;0;0;00;0;0 0;0;080330333lt>(( NN8{|x~p7{x~{xx{{{᷷0{{wx;{00{pf;{{0lt~h( @ !R $+CdLU$.9Ayv{z | } |~$,8[nlzw}$6;AFFIH^bmrvutt"x#!|#|#{,1/565:;>?EFHJKLNOQSTWVYZ[\^^acgghgkjlkoptwvuyzEcfzKMPQN87,*)&5JA16L~D# 'RdF (Xg?" +[f@3% -akn=2!$ .bprmB;0/49ivuoh\>C:EHUk}ytp^%_I=Z8#O3X8$k;U5 i.j0k1n5o6p7P*E IvO[_uDv_9v]3v_8pZ1l^AsssHHH*****************'''''''''''''''  ')))))))))))))' )))))))))))))' )(&&())))(&))' )&((&)&))&())')&))))))(&)))')&((&)&)&()))' )(&&()))&))))')))))))))))))' $""""""""!#!%''*********************************11111111111111.11111111111111.lt~h( @ʦ 000@@@PPP```ppp(L(LL((LL(L( XlX|h0T(8\  H p   H H HH pH H H H p H p H p 0L|8TH HHHpHHHHH HHHHHpHHHHHHH HHHpHHHH HHHpHHHH HHHpHHH@\Ldp pHpppppHp HpHHppHpHpHpp pHpppppp pHpppppp pHppppp`th HpH HHHpHHH Hp Hp Hplt HpH HHHpHHH Hp Hp Hp HpH HHHpHHH Hp Hp Hp8```888```888`??lt~h( @ʦ 000@@@PPP```ppp(L(LL((LL(L( XlX|h0T(8\  H p   H H HH pH H H H p H p H p 0L|8TH HHHpHHHHH HHHHHpHHHHHHH HHHpHHHH HHHpHHHH HHHpHHH@\Ldp pHpppppHp HpHHppHpHpHpp pHpppppp pHpppppp pHppppp`th HpH HHHpHHH Hp Hp Hplt HpH HHHpHHH Hp Hp Hp HpH HHHpHHH Hp Hp Hp8```888```888`                    Ãlt~h( @ʦ 000@@@PPP```ppp(L(LL((LL(L( XlX|h0T(8\  H p   H H HH pH H H H p H p H p 0L|8TH HHHpHHHHH HHHHHpHHHHHHH HHHpHHHH HHHpHHHH HHHpHHH@\Ldp pHpppppHp HpHHppHpHpHpp pHpppppp pHpppppp pHppppp`th HpH HHHpHHH Hp Hp Hplt HpH HHHpHHH Hp Hp Hp HpH HHHpHHH Hp Hp Hp8```888```888`           ?????lt~h( @ʦ """)))UUUMMMBBB999|PP3f3333f333ff3fffff3f3f̙f3333f3333333333f3333333f3f33ff3f3f3f3333f3333333f3̙33333f333ff3ffffff3f33f3ff3f3f3ffff3fffffffff3fffffff3f̙ffff3ff333f3ff33fff33f3ff̙3f3f3333f333ff3fffff̙̙3̙f̙̙̙3f̙3f3f3333f333ff3fffff3f3f̙3ffffffffff!___www=  lt~h( @ʦkH%zbJs2PkHs%WUI=1%sPkkHH%%sPDZksHW%UI=1%sPԎkH%zbJs2PkH%ssPPkH%zbsJP2kHs%WUI=1s%PkkHH%%sPDZksHW%UI=1s%PԎkH%ܒzbsJP2kH%ssPPkH%zbJs2PksHW%UI=1%sPkkHH%%sPkHs%WUI=1s%PkH%ܒzbsJP2kH%ssPPzzznnnbbbVVVJJJ>>>222&&&           ?lt>((  Џ O Hp Ј px O lt>(( x3"3"""?ltGIF89a """)))UUUMMMBBB999|PP֭3f333f3333f3ffffff3f̙3ff333f333333333f33333333f33f3ff3f3f3f3333f33̙33333f333333f3333f3ffffff3f33ff3f3f3f3fff3ffffffffff3ffff̙fff3fffff3fff333f3f3ff3ff33f̙̙3̙ff̙̙̙3f̙3f̙333f3̙333f3ffffff3f̙̙3f̙3f3f333f3333f3fff̙fff3f̙3f3f̙fffffffff!___www˲ࠠ!,f   d C R7nTx1#H5V|(ƅD⿘ ;bd G:4-}i3Ly ,2 (#nX Cy"e+t45,{MwPk3Ly3LyPkw.{,v&l#i[Mwww6,vbRMww~e ]Mw??lt>(( xwwxwxwwxwwwwxwwxwwxxwxpwxwxwwxwwxlt~h( @]EEEEN.N.EEE]#R#R_kN.ڼN. \%NE]#R]m{ scڼN.!XE]ew  _scڼN.N.N.N.]h{ kgRRscڼN.]x c˦ԶescڼЪˡˡN.]MwMwMwMwscڼڼN.ˡN.Mw*z)z(w%sscڼN.scЪN.e/00-*zĉscN.Mw57A3/)y‰scscscscscMw;ARA2-~MwMw*d*dA;4.Mwe*d*d*d*d0*deMw*d*d*d*dMweMwMwe?lt~h( @N.N.N.N.N.N.N.N.ѤzzzzzmQAN.vN.׈k[N.Žn˗wN.zN.n\}N.s`N.yXN.ǼN.൚ܙnܙnܙnנѿN.N.м㲓ܙnܙnܙnʿN.N.⿩ܙnܙnܙnŬN.ƵǵϽN.N.N.N.N.N.ܼƴ̻N.pP=t]ihN.ӸܙnܙnܙnܙnN.lM:oYN.ίµ˽İN.N.~m? lt~h( @QQjjYY͔č՜˝Ę}}Τwbbѱnnֶ̮ǪнYSSOLLljjvuu]\\gfҷӫytmirdңٝӁgɼeYUΛֿχYݛt֢ެȧ鿙ȨؽEmXws!0C˄ٽBLV]eȴntŔۂ݈ߠ˫شE.u|||ssspppddd&&&jj jjjjj jj   jjj   *//) jj *//) r jjj r jj ,-jjjj3,-$j* D ??"lt>(( 330;30DDOHDDOHDDOHDHDHDHDDDDDHDDDDDH#ltW00f h00 %  B hnS(0`+)mih50jsmyeZkB4;D]NXTZjnHdz&mՋ8{t؉,֌4ޔ;J}Em:h&UԮu/fLj׸p5w^-x΃#В SKԈs݈ρomQͷwWE˦3-܆ȻIۅfq>z]p{+rIM~Zc54};݉P(jrTف-cGqn|PR 20#GNt0*Ug݈vMv]ڂS(4erUT``+00&''1MPCvqlZ{N0]pn#,4@Y[V,XvoLUkL=FGP78BD04:? $;x+,2~!RIds3\-y/u3si%wW&hFg#k4h S#d :$Z3kK5f\CUR![G$W$K#OD0Z88Nf1EJ@9UF\Tg<#G'62"<Tb * &,& # ! @ 5[V^z:A PU X i y'-}wtttgggfffUUUFFF444}|}}|z}|||ꭶ|}歷|}歷|ҿ歫|Ӹ᭲| ̶} ̼ ŧ ̯鏶 ؾ ɯ# ڴ桫߸" ҿ㡦ǝ}" ̴ݡ( Śס(Ů( 魶ɯ(魫ɯ(꭫鎢&Uɤ|&:etttxxxӠ':ee}~{tttxxxx'Hffglk|zy"Hffhmms`dlr=}vw뎴&XfmmssssspsN981+=}vu'GfhmsssppVpppj>930%/);\|&Xhhssspo9anqiCC930%$ ::67\.}5ffhmsspq4>Woj_CC>33%% HbbEc}}[fmmsppo^>aat_CCn`0%MXI )bbQAphsspqiia>_WaCCpssP9VpsshX/ AspYnV3D?3inqssmhfI A^riav]IUBOSa9N;@D.8>1J.E%J]x&s5:ujt*w)j9{[ ff.d]iMK PP*Y4jBE2jH>SCB7;:4G6 ?Kv2676;)HK^1.-,, :6D@D])&#-* 2 .7;;(#$ ).))dej $ % +'6   J   4 bBG  | |k')fnor,rTTUiiifffݬ‚ĸԛƮrِŒ}Wwr{ruWޗvsom}ﴴۗphrׇ} ۜÎpemsґqtnde{ {q~gdo Η|rmxpͦ  ʷ̂eooxh   |ўtier  xՎqdgs .xwjj -A3( CAd0(iF0H@!B;RZeVW ]dp1݈JߍQڑ\Q?uMŜ<ǩBlw=xb ܄Nud%lv[dXm7Y\xAhD ;tb\OvXwnv)aG{;c,CF#x#r!j)|Kk%t'j(lC fj%r.fIX$^Ayt\\ j(c(`2fkMSZD"OIE@H#L6}G :8,3;-( 2 -3:60B-*+8M,y  }mnw o<@uGHgfffyzpflb}xKGD`r|j suhMIZ\[tmPgOVSAL wvcHFaEU~ eoY{dNCRk ?Xn_]QqJi "3,49:;>BW^T*5+0 78<=@21')$(%#-6!&.//wrrWޗom(0`   @dpY9" @}rS7=|W ]mL1 ic| QhF+ [   "# l3\ dC( # # !  +-(# -y ax @ {[=% ((('% " 472-'"-z e$k4vU7"  +//-*' "<B<71,-z!j.)$ hrQ24 -553/+& FLFA;6-z"o72.($ [kL. =v/;;84"<4P4lk ZKF@-z"tA<72-(#4  dD*=1!V)1@D:PTbTgAZ5d;3,"zZ#-z"yKF@<61,'#vY;> ~M 4L5o1^ V^smyhj:A yj x|:%k3939*UPKE@;61+'!xYH q<(#T="|9]BeZk+)m m x)-u2!Z5>@0sZJE?:50+& yYR'! /I6 g|AZ83 z   172-(! ~I2~DF;,\D?:50 {Y[4-' */0xFǷW337 (((& $ 9?;61,(# |6-m@KJ4g E9 }YeA93,&-/nDz$36<< *..-*% @HC?:61,'# y9:ARTB'[YoMG@92 //SC*9ʞZ4:>AD -563/* $ HQMHC>950+'"9)kF6uRYQ8#vLF?1* V{(:@CIO/<<934(D%fhUQLHB>94/+&"9*u1,% &3mL_[FW z%ϪiӠ:AFMQV1@#G8PL^Nf?_3h64* xcLGB=84/*9*z;61,&! $KD,Xv*]OQCGOTZ\ genkPU'-} t  :"a4:;0#wXA=83#9+F@;50+&  v/ȪqՋ8IQWZaf50ji /EE. "  t !G9?A?1"oQ*:+PJE@:4/+% */ڼ}jQV\afg (7LKGEE3( #  s.{ Z &J/uBHEH9kUPJD?:4/*%+/̆ٶOWZcfjm 8#b!\VPJG7.)%   w.{"i'"B0pEQN=/jID>93.) ..˃WZafint :&m%g#a![UP=50+& !|.{"n/' | E5uLXZG2c>83 /+zYafgou{ <)x'q&l$f#a!ZE;61,(.{#r:0) | |Z?L`bL!R(l^dgou{; !=,*}(w'qH\8`82..{#xD;1) sZB{w>8q?,fafjt{  $?#F(R-[0`d`PRy:S(-0 ]tLw3f0`$I"zqp9NJZ.37ȻI{Zh}܅݈Ht3f0`$IW0› wnɊ@Φr=D73fHtcr݈l|݈|jފY?n3f-[$I8|tΓKI?#Чh]zwtYPz7h3f+X#FS*&ϜZƓV&\Ī~Occf݈qLw7h3f.]'O>/)eԦe`e먻ۅjZU}Lw?n3cG(R!C8Qڹqװpkϥi8d褨ܘՐϋϋˈȅƃdƃ8???( @ ^DO2n!q50 Td0  $ ,* +(nRZ" /.) :<141'AP"86 ,' PM>.806.%{3H P;G5,#2j1J|F! X{&a,F[noFJr H.78<jQ?71* 5o8 jR8ˇ6aJ')f~{%"A+i@@/rE3-0d6%3ax;P5E#7<3& #+^BM>"v61f165-<^vgAnn1DI'.&CK@7/$ }B,f@NaMwLBBUݞR<@RP"- :;)D%ww]H71+#@- .:uY^= De`A5܃04NaS ,LPa=D'6@%q/1%fC0'? P1( +&ISDŽhEYnTb& 2~ y")mD;6'PD _<92+#-YɃ¿GRasY*:PFA ( r &u6)b;LF.xN70)&8XrCZexh3 ]dU D% &,\FYQ: p J/OhK^i+> incBKv@  -j-[G1aSR NXK_rCN](e)U1)V6w Z{Za}xAfAm}mtQ/v@'S: '\y]':@:6<-U$F74OYVzb2e<G; %/a /ZU :Sd%h?nLo5g۝C^Sp^#5mY>gwv_L ??[M&Ka#l|ZLuh:V7. !6wqgFVb g^fq 3H9;@GMLITj 0:8<@XYKACf $P?7[QD=N4/O~-ER .5 6 ?"N*;[׀\3?'lt~h( @;9NM\ZWU  ;5 0 wj1 tcZO}p"%<-L810`BK%N(U3lTnU|pvVdy{UuwdkEzg{opee~aazaaXMM}oolggus~pol`_̲~x~if~nlskjyVPv\X{ytSFDϹzYRxfW~quwo}lgs}xmmfffCCCCCC`CCCCCCCCCCCXhkbRCCCCCCCCC_l65xefCCCCCCCZg<FjUCCCCCCCW%uiCCCCCT;~ 9tYCCCCCc,KaCCCp; " {}?nSCCCp3* +vSCCCq4() z#]PCCCr701 !JNCCCo8$/2-GMCCCdE'|&@>=Bs^CCCCCmQ:IA.D\LCCCCCCCCCO[HwVCCCCCCCCCCCCOyOCCCCCCC? ./61 ?(lt~h( @vRTI12uwşuvggiUUe__]\lPOutǨݿa@>ecJ76N>=jQOmj{caO63uGAd[smXA>tjV94[=8zq~]W{ΞZNLdWUh\Zx̉zݗ{pz⛄̌wh٧䶡ẩyC~UoL篓ҥKT(h8T0[4iBكSߏdʄ_Ą`}窈qD 8 OWUTAZUQWMPL\ c%b$h(LV"s/e)_)s6d1]1ck c l$n%{+p)x/s/?b6cz*y,~/5FܛgKkQSVmokfff, 12WMLG;IjJYF#pXV@e^? S\bCBdeN+#og[UHZkc=A4 0/9?2UXsqRA.ws91?9P:xMtvwMainMSComctlLib.TreeView6-LB Z!C401000 lines)F1mnuOptionsShowLargeZones Show large Zones (>1000 domains)2mnuHelp&Help-3 mnuHelpShow&Show help text04mnuHelpWarningShow &warning log5 mnuHelpStr1-#6 mnuHelpAbout &About...7mnuPopupPopup,8mnuPopupShowFileShow this file99mnuPopupShowPropShow this file's properties1:mnuPopupNotepadSend file to Notepad<;mnuPopupFilenameCopyCopy filename to clipboard< mnuPopupStr4-5=mnuPopupVerifyFileVerify file signatureD>mnuPopupFileRunScanner Lookup file on RunScanner.net...C?mnuPopupCLSIDRunScannerLookup CLSID on RunScanner.net9@mnuPopupFileGoogleLookup file on Google....:AmnuPopupCLSIDGoogleLookup CLSID on Google...B mnuPopupStr3-)CmnuPopupRegJump Regedit jumpCDmnuPopupRegkeyCopy#Copy Registry key name to clipboardE mnuPopupStr2-9FmnuPopupCopyNodeCopy node text to clipboardBGmnuPopupCopyPath$Copy node path and text to clipboardEHmnuPopupCopyTree'Copy node and all subnodes to clipboard>ImnuPopupSaveTree Save node and all subnodes as...ENtNNNN4NNNNNNN$ENdNNNNNNNlNN^ENNNNNNNDNNDN4DN4NDNdNNpNNDNNlfNNpN,NNDNDNN(NxNNNNNPNDNDNN{NENDNN,NDNDNNNDNNDNDNDNNDNDNNNN NNN,NDNDNNDNDNDNDNDNDNDNDNDNDN4DDNNEx>E|p;EAEp;EAEp;EFEsKeyszDataInsPartialTextsFullTextm_ReturnStatussURLsMethodsRequestHeadssCookiesPostDatacookiesbValueintValueStrValueVarValueURLReturBytArrylResponseLenErrScripingHeadssFileid_CodepageCompareModesSectionsParametervDefaultvDatasDatabDataHive_requestedSID_requestedRedirection_requestedFlagsaKeyssAppendPlaceholderDestinationClassDoNotUseValueDoNotUseNamehHiveKeyNameValueNamebUseWow64KeyIndex܆E`E܆EE܆EEsMsgp;EKEfrmOwnerfrmExplicitp;EEout_ControlEsarroDictp;ETEp;EpjEobjListlPIDobjProcessobjDLLbDoDLLsFSysFCancelUnloadModeClickWhatpfd@%EF@%E|*FIFileDialogEventsIFileDialogControlEvents@%EL+Fpdf@%E+FpsiFolderpsipResponse@%Ex,FpfdcdwIDCtlbCheckeddwIDItemItemsFilePathDataIndexNodeNamepDatadwSizeoStreamsFilenameG0GGdGGGGGGGGGG|GGȥGGxGposGPGGFGFIRegExpGtGIRegExpMatchG\GIRegExpMatchCollectionGGIRegExpSubMatchesGGIPcreGGIPcreMatchGpGIPcreMatchesGdvGIPcreOptionsGG IPcreOptionsCompileGH3GIPcreOptionsGeneralG(FIPcreOptionsMatchGGIPcreOptionsReplaceG@GsValueInt64sourceStringreplaceVarFirstIndexSubMatches@%EG p_TextToSearchp_ReplaceWithTextp_RegexToMatchp_Enablep_RegexPatternp_ZeroBasedSubMatchIndexp_SearchedTextpa_OvectorArrayp_MatchCountp_MatchOffsetp_ZeroBasedIndexp_Textp_Enabledp_MaxCountp_MatchedTextp_SubstitutionActionp_Cancelp_IndexOperandCountUIntShortIntdwNumstrnumIntnumMBLengthStartPosStrSearchDelimiterCompareMethodBtnInArrp;EE$lstBoxInArrtxtBoxInArrp;EtYE(chkBoxInArrp;E pE,ProcessNameProcessIDWindowHandleProcessHandleFreezeThreadTimeOutMsAsyncSendCloseMsgFileNameCommandLineCurrentDirectoryWindowStyleCloseHandlesvArraylcidstrKeystrParamPathhProcessProductTypeCultureCodeHKeyNameHandleFullHiveNamebIncludeSIDRegTypesRegTypelHivein_out_KeyNamebDoNotExpandbUseHexFormatForBinaryout_KeyTypeuRegTypesToQueryaValueNamesaDataValuesaTypesbExpandValueslDataaDataForceUnlockaSubKeysbRecursivelybEraseArrayaValuesdDateSaveHeaderConvertToANSIdestFilesExtensionUnloadValueTypedwAccessretHandledwAttributesout_KeyTargetbFlagCheckForSymlinkout_SymlinkTargetsNtKeyout_Hiveout_KeyKeyWordBodyAttribElementBeforeParentNodeChildNodeRHSStartbArrayEndPosUhBdPd%SVWeE@EEEEjEDPPhep(ptEQjj(EjRjjPjhȂEQRT3+HB PpQRpPj0l(lE EE dDžhE EhE܋M;dE RlPQTUit+PA PpQhtpRlP(E QR PЍME Q ЍE@RhԁЍP ЍQ@RhLDžLM0E BE@RhxEЍPEPЍPhEЍPMQЍPhEЍPRЍ@PQRPQj E@RhxEЍPEPЍPhEЍPQЍ@RPQj EEg(E@RjHtKEDžDž Pj@QЍE(PRjjjjPjhȂEHDžHRPQRP|&Qj0RPj؀ E((E tEE jhNUt 0PQRPQRj PQj؀ RjdÍM0M0@00PjdËMd _^[]UhBdPd%D SVWeE@EEEEjEDPPhU(tEjQ (EjRjjPjhȂEQRT3+HB PQRPx(@E @wE @DžE EE܋M;3E RPQTU+PA PQj RP(E QRPЍME Rj0PQj؀ E (E!tE"E#jhNEt 0QRPQRPj QRj؀ PjdÍM0M00Qjd 0ËMd _^[]U hBdPd%DSVWeE@E3Pj'}܉}؉}E0ЍMMMQURPE VP(3;ftURe UȍM܉EExhNEt MMÍM0ËEU܋ȉUQUQU_Q M^d []U hBdPd%PSVWeE@3EPhuuuu܉u؉uԉuE0ЍMMVhjjMQjhEȂU=R׋؋EPMQE׍URE׋MPEPQS(3;ft;EP 5ЍM֍MQЍM֍M0UMhN"Et M0M0MÍURjdM0ËME_^d []U hBdPd%SVWeE@3ۺEMЉ]]]܉]؉]ԉ]Љ]̉]ȉ]ĉ]]]]]]]]|URURURURUR]]EP;} hhEQP8UMExEEhESjURPMQURh X||PMQM0UREPjM؃ Qj=p]苕p9UEMĉ]]EЋ5PhE֋ЍM׋MPE+HP P֋ЍMסURURURURURUREPQ8;} j8hEQP8UMԉ]׍UREPMQj UԃjRЍMPhEHFM0f;t,EPSSeЍM׋MQt UMUMPQHtMȉMEMĉ]]UЋ5RhE֋ЍM׋M؋QI PE+‹R֋ЍMסURURURURURUREPQ8;} j8hEQP8UM]׍UR=ЍM׍EPMQUREPj U܃MhnN?Et M0MQUREPMQURj EPMQj$Ë50M֍M֍URjdM֍MËME_^d []UhBdPd% SVWeE@=3Euuuuu܉u׺E׺LEMu܉uסURURURURhUREPQ8;} j8hEQP8=RhE׋ЍMPEP׋йӍMQUREPj EMu܉uURURURURhUREPQ8;} j8hEQP8RhE׋ЍMPEP׋йӍMQUREPj h?NMQUREPj ËM_^d []UhBdPd%SVWeE@EEEEjEjjjjPjhȂDžEDž3+AI RPjEh@hCԂPЅuGEPfDžl'E$P(Q$R謧 $0EUEV8DžE MM܋U; EWDžp&EDžhPMQ|Ѝ$P +R0ЍfDž4E `DžDžQR P QhH&EЍ P`PЍPUR|ЍPЍPP P≅}&hhE QR80 Dž0\Dž\@Q RPQRP Q$Rj $EX@P EYfDžjQ@RZЍ@EZ3ҍ$fDž$PQ@RD Ѝ4$0E[4PDE\4@E]j@Qhx'Ej܃E^'E(E_fDžfDžRP(QUЅuGE`fDžl'E$P(Q$Rã $0cEbj@Ph'Ej܃Ec(E(EdfDžfDžQR(PȅuGEefDžl'E$R(P$Q $0Egj@Rh\(Ej܃Eh(E(EifDžfDžPQ(RuGEjfDžl'E$Q(R$P= $0EmjjhE@QDžDž RP@QЍ$P䀂Ѝ0$0EnfDž,Eoj,Rh(E0PЍ$Ph(EЍ Pj܃f Q$Rj tJEpfDžfDžQR@P# ȅtEqfDž,Et,tLEu@Dž@RP<Eh4EEh4EEjjjMQURjz(Ef(E (PEPjjjjMQjhȂ05EMUЉUEEPMQUREPMQURjM0EPMQj؀ E tE EjhO3EPM0MQURj؀ EPjdËMd _^[]U hBdPd%#OaMQUREPMQUREPMQUREPMQUREPj  0MQURj؀ EPjdÍM0M0M0M0M0ËMd _^[] UhBdPd%xSVWeE@3EMԉEEEEE܉E؉EԉEĉEEEE|MEPQUEREPM0MQj U5TREP֋EHP =tE+PUE@׋MQEӋUREP֋EHP +эEPUE@׍MQEӋUREP֋E܋P+ʋP MQEE@׍UREӋEPMQ֋E؋H@ +э URME@׋EP3f9M3f9U 3f9E 3f uEhh%O(5EP֍MQ֍UR֍EP֍M0Ë5d|Qj֍URjËMfE_^d []UhBdPd%SVWeE@U3MuuEMPE QMVURPQh%OEURjdM0ËMfE_^d []UhBdPd%SVWeE@U3MEEEMU PQMjREPQHh&OE50M֍MËMfE_^d []UhBdPd%0=SVWeE@EEEUMEjE=uhh0DԃDž DžhKEQPUREhvCԂPEPEMQ,REj,,RQL≅44}#jLhKE,P4Q8 DžEj,,Q≅44}&hhKE,R4P8 DžEh,,PR8≅44}#j8hKE,Q4R8 DžE jhPEjhPEEPMQPURPЁP,,RQd≅44}#jdhKE,P4Q8 DžUREPj E jhPEjhPEMQURPEPPЁP,,PRl≅44}#jlhKE,Q4R8 DžEPMQj E @R,,RQh≅44}#jhhKE,P4Q8 Dž@E DžLQEDžDjhPEjhPEEPMQPURPDPMQPjhPEjh QEURxPPhQPXRPEP|P,,PR`≅44}#j`hKE,Q4R8 DžM0XPhQURxPMQURjE jhPEjh4QEEPMQPURPЁP,,RQt≅44}#jthKE,P4Q8 DžUREPj E@Q,,QPh≅44}#jhhKE,R4P8 Dž PQt}Rt Dž ^E?HQjDžE UU܋E;E@QHE+AkDJ T(UEAHBU+PkDA L(EBfDž,BPxQT,RxM+HkDxB PKE xQ UECEԉHDž@@DžDžDž @QRP QfXEDUЃUEFHBU+PkDA L(EGfDž,BPxQT,RxM+HkDxB PDD xQ UEHEԉHDž@@DžDžDž @QRP Q_WEIUЃUEK}EL0DlDž 0hP^EHBU+PkDA L(Q|ЍtPЍplR PpQAlRpPtQj EMfEEOERB(ES QRt}Pt Dž ZETQRjDžE EE܋M; EUBP QT E+BkD Q ЉEVH(B(% ȅtjEWfDž,Dž\DžT ,Q$RTPQRHQUR9_TEXH(@B(% ȅEYQUEZfH$fME[B(EE\Q(E]fDž$fDž(fDž, P$Q(R,P$QURHQRR≅}%hhEPQ8 Dž DžE EE؋M;E^UE+BMQ ME_fDž,,PMQ?EE`UԉHDž@@DžDžDž @PQR PREa;EcQMEdfDž,,REP?EEeMԉHDž@@DžDžDž @RPQ R4R^EgfDž, HDž@@,Q$R@PQRHQUR\EiDž PEjEmQ(SEn PQt}Rt Dž EoHQjDžE UU܋E;EpQRPTU+QkH ʉEqzt2xt&ytErREPUEtDžQEu8ExEzQ( E{ P Qt}Rt Dž [E|H QjDžE UU܋E;E}Q RPTU+QH E~EfDž,,REPEM,Q\DžTDž DžDž TRPQ RNTEDžPEEEfDž,,PMQEDž\DžTDž@DžDž TRPQ RMTEDžEjPȅNE,RRQ|≅}"j|h^EPQ8 Dž,E P PRX≅}#jXh^E QR8 Dž \DžTDžDžDžTQRPQvLTEh^EjPheE(PdRjjjjPPjhȂDžH^EDž@@P3+API U8Dž0@0P+HP@ ^EtdDždRhPPQtRhPMPQjt0dRhPj؀ E tEEjhObxRlPpQtRj dPhQj؀ TPRjdÍ PQRPjdMQhE,URjd|PjdfEȋMd _^[]UhBdPd%kSVWeE@EEEEjEhPCԂPEPEMMEU(UE@EPM؋EPRE}}jh^EMQUR8EEEE,EE@MQU؋MQPE}}jh^EUREP8EEEM0ME@URE؋URQE}}jh^EEPMQ8EEEU4UE@EPM؋EPRE}}jh^EMQUR8EEE E8EE@MQU؋MQPE}}jh^EUREP8EEE M3 ЍMURjjEP蜺 MQURj EEܣEh<`CԂPMQPhM4EjjjjURjhȂfDžXXPEEUM3+AMI h`EUR|ЍMPЍMPhEЍMPhDEEUE+HE@ MQ1 ЍMURjDžTẺ,E,MTQURRQ≅HH}"jh0]EPHQ8 DžUREPMQURj E(PEPjjjjMQjhȂUUDž|@|E3+HE@ ,`EMM(E(REPMQUREP\MQjM0UREPj؀ E tE E!jhOVUREPMQUREPj MQURj؀ EPMQURjEPjdËMd _^[]U hBdPd%Dž/E@fDžfDžRPMQTЅtEAfDž$EC0DDžlPQTRP+QH RWP0FEFMQh,jEЍRPBf 0EGQ Q≅}&hh\UERP8< Dž<tCEHURhLjEЍPQ0EJ EK(t?ELQRݝPBENȯD,EOfDžQ,R諢EPDž@DžDžDž QRPQEQR,PQhhYЍ=uhh0DԃDž8 Dž888 PPRDžDž\Dž̋AQA \PP≅}&hhpjEQR84 Dž4PQj 4ERnETDžDžURhjEЍPMQRP/[0EU}EVhhEfDžhhE4DžRPQREP5ofEWfDžQURwfEZ9EDž0jEPQRO}PQj E]tE^EPP0E`f$f# f#f Ec(PRjjjjPjhȂjEXDžXRPQRPQj0RPj؀ Ed tEeEfjhORPQRPQj RPj؀ Q RP,Q