Demande d'analyse rapport hijackthis

marie_hockey31 · le 6 février 2009

ComboFix 09-02-06.01 - Ruedi 2009-02-06 16:31:29.2 - NTFSx86

Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.991.615 [GMT -5:00]

Lancé depuis: c:\documents and settings\Ruedi\Bureau\ComboFix.exe

Commutateurs utilisés :: c:\documents and settings\Ruedi\Bureau\CFScript.txt

AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Outdated)

* Un nouveau point de restauration a été créé

* Resident AV is active

FILE ::

C:\love.exe

c:\windows\system32\bodulika.dll

c:\windows\system32\bugirasa.dll

c:\windows\system32\dititeha.dll

c:\windows\system32\dupimino.dll

c:\windows\system32\fedoniko.dll

c:\windows\system32\fonopeja.dll

c:\windows\system32\garafufe.dll

c:\windows\system32\gegihasu.dll

c:\windows\system32\jahanane.dll

c:\windows\system32\jazisate.dll

c:\windows\system32\monajole.dll

c:\windows\system32\motipewo.dll

c:\windows\system32\munubigu.dll

c:\windows\system32\nilekiza.dll

c:\windows\system32\nipujija.dll

c:\windows\system32\ohzrad.dll

c:\windows\system32\papubovu.dll

c:\windows\system32\rotawapo.dll

c:\windows\system32\sokizuvi.dll

c:\windows\system32\tadeyike.dll

c:\windows\system32\tokihawi.dll

c:\windows\system32\vaveseyi.dll

c:\windows\system32\wayomora.dll

c:\windows\system32\yohajizi.dll

c:\windows\system32\yuhituka.dll

c:\windows\system32\zovosefi.dll

c:\windows\system32\zutaheki.dll

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86\DIFxAPI.dll

c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86\DifXInstall32.exe

c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86\GEARAspiWDM.inf

c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86\gearaspiwdmx86.cat

c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86\x86\GEARAspi.dll

c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86\x86\GEARAspiWDM.sys

C:\love.exe

c:\program files\%systemdir%

c:\program files\%systemdir%\4w4y

c:\program files\%systemdir%\f&ll

c:\program files\%systemdir%\ffe.e

c:\program files\%systemdir%\m4x[5]

c:\program files\%systemdir%\m4x[c]

c:\program files\%systemdir%\mirc.ini

c:\program files\%systemdir%\remote.ini

c:\program files\%systemdir%\v1rg1n

c:\program files\%systemdir%\XGun

c:\windows\system32\bugirasa.dll

c:\windows\system32\dititeha.dll

c:\windows\system32\dupimino.dll

c:\windows\system32\fedoniko.dll

c:\windows\system32\fonopeja.dll

c:\windows\system32\garafufe.dll

c:\windows\system32\gegihasu.dll

c:\windows\system32\jahanane.dll

c:\windows\system32\jazisate.dll

c:\windows\system32\monajole.dll

c:\windows\system32\motipewo.dll

c:\windows\system32\munubigu.dll

c:\windows\system32\nilekiza.dll

c:\windows\system32\nipujija.dll

c:\windows\system32\ohzrad.dll

c:\windows\system32\papubovu.dll

c:\windows\system32\rotawapo.dll

c:\windows\system32\sokizuvi.dll

c:\windows\system32\tadeyike.dll

c:\windows\system32\tokihawi.dll

c:\windows\system32\vaveseyi.dll

c:\windows\system32\yohajizi.dll

c:\windows\system32\yuhituka.dll

c:\windows\system32\zovosefi.dll

c:\windows\system32\zutaheki.dll

c:\windows\system32\winlogon.exe . . . est infecté!!

.

((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_PARTIZAN

-------\Service_Partizan

((((((((((((((((((((((((((((( Fichiers créés du 2009-01-06 au 2009-02-06 ))))))))))))))))))))))))))))))))))))

.

2009-02-02 20:56 . 2009-02-02 20:56 <REP> d-------- c:\program files\Trend Micro

2009-02-02 15:23 . 2009-02-02 15:23 <REP> d-------- c:\program files\ESTsoft

2009-02-02 15:23 . 2009-02-02 15:24 <REP> d-------- c:\documents and settings\Ruedi\Application Data\ESTsoft

2009-01-30 18:26 . 2008-11-06 02:03 <REP> d-------- C:\SDFix

2009-01-30 15:34 . 2009-01-30 15:34 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware

2009-01-30 15:34 . 2009-01-30 15:34 <REP> d-------- c:\documents and settings\Ruedi\Application Data\Malwarebytes

2009-01-30 15:34 . 2009-01-30 15:34 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-01-30 15:34 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2009-01-30 15:34 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2009-01-16 18:59 . 2009-01-16 18:59 <REP> d-------- c:\program files\Windows Media Connect 2

2009-01-16 18:57 . 2009-01-16 18:57 <REP> d-------- c:\windows\system32\LogFiles

2009-01-16 18:57 . 2009-01-16 19:02 <REP> d-------- c:\windows\system32\drivers\UMDF

2009-01-11 10:00 . 2009-01-11 10:00 <REP> d-------- c:\documents and settings\All Users\Application Data\Messenger Plus!

2009-01-11 09:43 . 2009-01-11 09:43 <REP> d-------- c:\program files\Windows Live

2009-01-11 09:43 . 2009-01-11 09:43 <REP> d-------- c:\program files\Messenger Plus! Live

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-06 21:37 25,773 ----a-w c:\windows\system32\drivers\regguard.sys

2009-01-30 22:19 --------- d-----w c:\program files\CCleaner

2009-01-30 22:08 --------- d-----w c:\program files\LimeWire

2009-01-29 22:30 --------- d-----w c:\documents and settings\Ruedi\Application Data\LimeWire

2009-01-11 14:43 --------- d-----w c:\program files\MSN Messenger

2008-12-21 14:05 --------- d-----w c:\program files\iTunes

2008-12-21 13:57 --------- d-----w c:\program files\iPod

2008-12-21 13:56 --------- d-----w c:\program files\Bonjour

2008-12-21 13:55 --------- d-----w c:\program files\QuickTime

2008-12-21 13:55 --------- d-----w c:\program files\Fichiers communs\Apple

2008-12-11 11:57 333,184 ----a-w c:\windows\system32\drivers\srv.sys

2006-10-26 13:32 81,920 ----a-w c:\documents and settings\Ruedi\Application Data\ezpinst.exe

2006-10-26 13:32 47,360 ----a-w c:\documents and settings\Ruedi\Application Data\pcouffin.sys

2008-02-25 18:09 2 --shatr c:\windows\winstart.bat

.

------- Sigcheck -------

2008-04-13 21:34 512000 dd73d6b9f6b4cb630cf35b438b540174 c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\winlogon.exe

2006-10-20 14:54 506368 8d52aedd07247b743a4d9bd372f69109 c:\windows\system32\winlogon.exe

.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"UnHackMe"="c:\progra~1\Greatis\REGRUN~1\UnHackMe.exe" [2007-12-17 1026048]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"KernelFaultCheck"="c:\windows\system32\dumprep 0 -k" [X]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]

"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]

"SoundMAX"="c:\program files\Analog Devices\SoundMAX\Smax4.exe" [2004-09-23 860160]

"SiSRaid"="c:\program files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe" [2005-05-18 905216]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 49263]

"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-07-19 221184]

"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-06-08 458752]

"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-06-08 217088]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]

"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-12-21 1443072]

"RegRun WinBait"="c:\windows\winbait.exe" [2000-12-12 16384]

"@RegRunOnSecure"="c:\progra~1\Greatis\REGRUN~1\OnSecure.exe" [2003-01-22 57856]

"pizadidoto"="c:\windows\system32\yohilimu.dll" [bU]

"CPM5791c005"="c:\windows\system32\wayomora.dll" [bU]

"combofix"="c:\windows\system32\CF1122.exe" [2009-02-06 400896]

"SiSPower"="SiSPower.dll" [2005-08-25 c:\windows\system32\SiSPower.dll]

"NWEReboot"="" [bU]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"combofix"="c:\windows\system32\CF1122.exe" [2009-02-06 400896]

"KB926239"="apphelp.dll" [2004-08-10 c:\windows\system32\apphelp.dll]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-10 15360]

c:\documents and settings\Ruedi\Menu D‚marrer\Programmes\D‚marrage\

Webshots.lnk - c:\program files\Webshots\Launcher.exe [2006-10-24 45056]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{F552DDE6-2090-4bf4-B924-6141E87789A5}"= "c:\program files\Greatis\RegRunSuite\RRShell.dll" [2004-11-02 368711]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\khffcda]

[bU]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\NavLogon]

[bU]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0Partizan\0

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk

backup=c:\windows\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Utility Tray.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Utility Tray.lnk

backup=c:\windows\pss\Utility Tray.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Ruedi^Menu Démarrer^Programmes^Démarrage^Webshots.lnk]

path=c:\documents and settings\Ruedi\Menu Démarrer\Programmes\Démarrage\Webshots.lnk

backup=c:\windows\pss\Webshots.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\@RegRunOnSecure]

--a------ 2003-01-22 11:03 57856 c:\progra~1\Greatis\REGRUN~1\OnSecure.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

--a------ 2005-09-03 14:18 94208 c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

--a------ 2004-08-10 07:00 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\egui]

--a------ 2007-12-21 08:21 1443072 c:\program files\ESET\ESET NOD32 Antivirus\egui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]

--a------ 2005-06-08 14:44 196608 c:\program files\Logitech\Video\ManifestEngine.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]

--a------ 2005-06-08 15:24 458752 c:\program files\Logitech\Video\ISStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]

--a------ 2005-06-08 15:14 217088 c:\program files\Logitech\Video\LogiTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]

--a------ 2005-07-19 17:32 221184 c:\windows\system32\LVCOMSX.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]

--a------ 2007-01-19 11:55 5674352 c:\program files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

--a------ 2001-07-09 10:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

--a------ 2008-09-06 15:09 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Registry]

--a------ 2007-12-17 12:28 390656 c:\program files\Greatis\RegRunSuite\lsoon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegRun WinBait]

--a------ 2000-12-12 19:56 16384 c:\windows\WinBait.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Regrun2]

--a------ 2007-12-17 12:30 356864 c:\progra~1\Greatis\REGRUN~1\WatchDog.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiSRaid]

--------- 2005-05-18 13:44 905216 c:\program files\Silicon Integrated Systems\SiSRaidPackage\Sraid.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX]

--a------ 2004-09-23 11:41 860160 c:\program files\Analog Devices\SoundMAX\SMax4.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]

--a------ 2004-10-14 08:11 1388544 c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

--a------ 2006-10-12 03:10 49263 c:\program files\Java\jre1.5.0_09\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

--a------ 2007-05-23 17:25 68856 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnHackMe]

--a------ 2007-12-17 12:30 1026048 c:\progra~1\Greatis\REGRUN~1\Unhackme.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiSPower]

-ra------ 2005-08-25 06:05 49152 c:\windows\system32\SiSPower.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=

"c:\\Program Files\\MSN Messenger\\livecall.exe"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\WINDOWS\\system32\\dllhost.exe"=

"c:\\Program Files\\ESET\\ESET NOD32 Antivirus\\ekrn.exe"=

"c:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\WINDOWS\\system32\\muzapp.exe"=

"c:\\WINDOWS\\system32\\spoolsv.exe"=

"c:\\WINDOWS\\system32\\wuauclt.exe"=

"c:\\Program Files\\Fichiers communs\\Microsoft Shared\\VS7DEBUG\\MDM.EXE"=

R0 SiSRaid1;SiSRaid1;c:\windows\system32\drivers\SiSRaid1.sys [2006-10-20 46464]

R0 szkg5;szkg;c:\windows\system32\drivers\SZKG.sys [2008-05-13 34432]

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2007-12-21 33800]

R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2007-12-21 468224]

R3 RegGuard;RegGuard;c:\windows\system32\drivers\regguard.sys [2008-02-25 25773]

S3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\windows\system32\drivers\A3AB.sys [2005-03-22 450400]

.

Contenu du dossier 'Tâches planifiées'

2009-02-06 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job

- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]

.

- - - - ORPHELINS SUPPRIMES - - - -

BHO-{2B419F91-D843-400B-98EF-ADC5B7689691} - (no file)

BHO-{393C2547-B2AB-422C-87AF-385238C73416} - (no file)

BHO-{C03FD59D-9104-44B7-929A-9EAA0BA05211} - (no file)

BHO-{fcedb34b-b927-4557-a9c2-60518aa20f1b} - (no file)

SSODL-SSODL-{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - (no file)

MSConfigStartUp-pizadidoto - c:\windows\system32\yohilimu.dll

.

------- Examen supplémentaire -------

.

uStart Page = hxxp://www.sympatico.ca/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

mStart Page = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/stp/yme/*http://www.yahoo.com

mSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/yme/*http://www.yahoo.com/ext/search/search.html

uInternet Settings,ProxyOverride = *.local

IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm

IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-06 16:39:19

Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès

Fichiers cachés: 0

**************************************************************************

.

--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]

"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

------------------------ Autres processus actifs ------------------------

.

c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\windows\ehome\ehrecvr.exe

c:\windows\ehome\ehSched.exe

c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\program files\Analog Devices\SoundMAX\SMAgent.exe

c:\windows\ehome\mcrdsvc.exe

c:\windows\system32\dllhost.exe

c:\windows\system32\wscntfy.exe

c:\windows\ehome\ehmsas.exe

c:\progra~1\Webshots\Webshots.scr

.

**************************************************************************

.

Heure de fin: 2009-02-06 16:42:32 - La machine a redémarré [Ruedi]

ComboFix-quarantined-files.txt 2009-02-06 21:42:08

ComboFix2.txt 2009-02-06 18:07:34

Avant-CF: 78 436 626 432 octets libres

Après-CF: 78,466,744,320 octets libres

305 --- E O F --- 2009-02-06 19:09:07

Falkra · le 7 février 2009

Ouvre le bloc notes. Copie-colle dedans le contenu de la boite code qui suit :

@echo off
echo.
echo  -=Extractions de la BdR=-
echo.

set cle=HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager
echo %cle%
regedit /E c:\reggM1.txt "%cle%"
echo  ------------->>c:\reggM1.txt

set cle=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies
echo %cle%
regedit /E c:\reggM2.txt "%cle%"
echo  ------------->>c:\reggM2.txt

copy c:\reggM?.txt c:\regfile.txt>nul
del c:\reggM?.txt
notepad c:\regfile.txt
del c:\regfile.txt

Sauvegarde cela sur le bureau en donnant comme nom lib.bat (pas d'extension texte donc).
Le fichier va être créé avec une icône d'engrenage, place-le sur le bureau, double clique dessus et poste le rapport qui va s'afficher.

marie_hockey31 · le 7 février 2009

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

"BootExecute"=hex(7):61,00,75,00,74,00,6f,00,63,00,68,00,65,00,63,00,6b,00,20,\

00,61,00,75,00,74,00,6f,00,63,00,68,00,6b,00,20,00,2a,00,00,00,50,00,61,00,\

72,00,74,00,69,00,7a,00,61,00,6e,00,00,00

"CriticalSectionTimeout"=dword:00278d00

"EnableMCA"=dword:00000001

"EnableMCE"=dword:00000000

"ExcludeFromKnownDlls"=hex(7):00,00

"GlobalFlag"=dword:00000000

"HeapDeCommitFreeBlockThreshold"=dword:00000000

"HeapDeCommitTotalFreeThreshold"=dword:00000000

"HeapSegmentCommit"=dword:00000000

"HeapSegmentReserve"=dword:00000000

"ObjectDirectories"=hex(7):5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,00,\

00,5c,00,52,00,50,00,43,00,20,00,43,00,6f,00,6e,00,74,00,72,00,6f,00,6c,00,\

00,00,00,00

"ProtectionMode"=dword:00000001

"ResourceTimeoutCount"=dword:0009e340

"ProcessorControl"=dword:00000002

"RegisteredProcessors"=dword:00000002

"LicensedProcessors"=dword:00000002

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppCompatibility]

"AppCompatCache"=hex:ef,be,ad,de,60,00,00,00,60,00,00,00,00,00,00,00,0e,00,00,\

00,05,00,00,00,51,00,00,00,31,00,00,00,59,00,00,00,4a,00,00,00,07,00,00,00,\

3b,00,00,00,38,00,00,00,46,00,00,00,2e,00,00,00,1b,00,00,00,1c,00,00,00,4f,\

00,00,00,34,00,00,00,25,00,00,00,53,00,00,00,54,00,00,00,5d,00,00,00,49,00,\

00,00,37,00,00,00,00,00,00,00,24,00,00,00,2c,00,00,00,41,00,00,00,5b,00,00,\

00,50,00,00,00,2a,00,00,00,43,00,00,00,19,00,00,00,04,00,00,00,30,00,00,00,\

1e,00,00,00,1a,00,00,00,18,00,00,00,4b,00,00,00,28,00,00,00,5c,00,00,00,3c,\

00,00,00,12,00,00,00,3f,00,00,00,33,00,00,00,0f,00,00,00,09,00,00,00,21,00,\

00,00,3e,00,00,00,10,00,00,00,17,00,00,00,57,00,00,00,2f,00,00,00,5f,00,00,\

00,23,00,00,00,06,00,00,00,42,00,00,00,16,00,00,00,26,00,00,00,4d,00,00,00,\

11,00,00,00,4c,00,00,00,2d,00,00,00,45,00,00,00,15,00,00,00,39,00,00,00,29,\

00,00,00,4e,00,00,00,03,00,00,00,47,00,00,00,01,00,00,00,1f,00,00,00,08,00,\

00,00,20,00,00,00,36,00,00,00,0c,00,00,00,1d,00,00,00,0b,00,00,00,35,00,00,\

00,14,00,00,00,3a,00,00,00,52,00,00,00,13,00,00,00,5a,00,00,00,0a,00,00,00,\

5e,00,00,00,0d,00,00,00,32,00,00,00,58,00,00,00,55,00,00,00,40,00,00,00,27,\

00,00,00,44,00,00,00,56,00,00,00,2b,00,00,00,48,00,00,00,22,00,00,00,02,00,\

00,00,3d,00,00,00,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,57,00,49,00,4e,\

00,44,00,4f,00,57,00,53,00,5c,00,52,00,75,00,6e,00,47,00,75,00,61,00,72,00,\

64,00,2e,00,65,00,78,00,65,00,00,00,63,00,64,00,61,00,2e,00,64,00,6c,00,6c,\

00,00,00,74,00,73,00,2e,00,73,00,63,00,72,00,00,00,64,00,5c,00,61,00,39,00,\

37,00,62,00,64,00,34,00,31,00,32,00,65,00,66,00,37,00,38,00,63,00,32,00,30,\

00,62,00,39,00,37,00,64,00,35,00,64,00,31,00,65,00,33,00,39,00,36,00,35,00,\

66,00,37,00,34,00,39,00,31,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,\

00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,65,00,\

00,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,1b,ea,70,ef,2a,c8,01,00,be,06,00,00,00,00,00,\

80,c0,84,65,b4,e5,c5,01,5c,00,3f,00,3f,00,5c,00,63,00,3a,00,5c,00,66,00,31,\

00,37,00,32,00,38,00,30,00,36,00,62,00,62,00,37,00,35,00,61,00,35,00,61,00,\

30,00,61,00,62,00,30,00,35,00,30,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,\

00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,\

62,00,33,00,64,00,35,00,36,00,61,00,34,00,64,00,34,00,38,00,64,00,39,00,62,\

00,31,00,64,00,30,00,30,00,32,00,62,00,39,00,63,00,63,00,38,00,64,00,61,00,\

63,00,30,00,32,00,32,00,65,00,64,00,5c,00,73,00,70,00,32,00,67,00,64,00,72,\

00,5c,00,74,00,7a,00,63,00,68,00,61,00,6e,00,67,00,65,00,2e,00,65,00,78,00,\

65,00,00,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,96,f0,69,82,cf,c5,01,e0,ec,0a,00,00,00,\

00,00,f4,fa,0c,ab,49,26,c9,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,57,\

00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,00,73,00,79,00,73,00,74,00,65,00,\

6d,00,33,00,32,00,5c,00,64,00,66,00,72,00,67,00,6e,00,74,00,66,00,73,00,2e,\

00,65,00,78,00,65,00,00,00,75,00,73,00,5c,00,44,00,57,00,48,00,57,00,69,00,\

7a,00,72,00,64,00,2e,00,65,00,78,00,65,00,00,00,72,00,65,00,6e,00,7a,00,79,\

00,2e,00,65,00,78,00,65,00,00,00,34,00,37,00,32,00,38,00,62,00,64,00,33,00,\

65,00,66,00,35,00,39,00,65,00,38,00,38,00,5c,00,75,00,70,00,64,00,61,00,74,\

00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,60,db,8f,d1,7e,c4,01,00,9a,01,00,\

00,00,00,00,54,9e,14,67,62,25,c9,01,5c,00,3f,00,3f,00,5c,00,63,00,3a,00,5c,\

00,34,00,38,00,63,00,34,00,31,00,61,00,33,00,35,00,61,00,34,00,34,00,36,00,\

62,00,62,00,64,00,66,00,63,00,38,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,\

00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,\

5c,00,32,00,35,00,30,00,35,00,65,00,30,00,36,00,30,00,65,00,63,00,62,00,66,\

00,38,00,37,00,39,00,37,00,37,00,37,00,34,00,36,00,61,00,35,00,61,00,62,00,\

61,00,61,00,61,00,37,00,62,00,63,00,39,00,36,00,5c,00,75,00,70,00,64,00,61,\

00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,\

65,00,00,00,5c,00,6c,00,61,00,75,00,6e,00,63,00,68,00,65,00,72,00,2e,00,65,\

00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,f8,46,b1,4f,7f,c6,01,e0,ec,\

0a,00,00,00,00,00,fc,5d,01,b0,49,26,c9,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,\

00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,00,73,00,79,00,73,00,\

74,00,65,00,6d,00,33,00,32,00,5c,00,77,00,64,00,66,00,6d,00,67,00,72,00,2e,\

00,65,00,78,00,65,00,00,00,6e,00,73,00,5c,00,53,00,79,00,6d,00,61,00,6e,00,\

74,00,65,00,63,00,20,00,53,00,68,00,61,00,72,00,65,00,64,00,5c,00,63,00,63,\

00,41,00,70,00,70,00,2e,00,65,00,78,00,65,00,00,00,65,00,35,00,32,00,61,00,\

63,00,36,00,31,00,37,00,64,00,34,00,36,00,38,00,63,00,5c,00,75,00,70,00,64,\

00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,\

78,00,65,00,00,00,5c,00,53,00,65,00,74,00,75,00,70,00,43,00,6c,00,6f,00,6e,\

00,65,00,44,00,56,00,44,00,32,00,39,00,30,00,31,00,53,00,6c,00,79,00,73,00,\

6f,00,66,00,74,00,5b,00,31,00,5d,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,80,db,4f,aa,90,98,c5,01,\

00,98,00,00,00,00,00,00,d6,a9,6b,49,b4,e5,c5,01,5c,00,3f,00,3f,00,5c,00,43,\

00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,69,00,\

6c,00,65,00,73,00,5c,00,47,00,72,00,65,00,61,00,74,00,69,00,73,00,5c,00,52,\

00,65,00,67,00,52,00,75,00,6e,00,53,00,75,00,69,00,74,00,65,00,5c,00,55,00,\

6e,00,68,00,61,00,63,00,6b,00,6d,00,65,00,2e,00,65,00,78,00,65,00,00,00,5f,\

00,36,00,2e,00,45,00,58,00,45,00,00,00,31,00,2d,00,4b,00,42,00,39,00,32,00,\

38,00,33,00,36,00,36,00,2d,00,58,00,38,00,36,00,2e,00,65,00,78,00,65,00,00,\

00,64,00,33,00,38,00,35,00,31,00,63,00,5c,00,75,00,70,00,64,00,61,00,74,00,\

65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,d7,89,7b,d2,40,\

c8,01,00,a8,0f,00,00,00,00,00,cc,65,1d,c0,4e,45,c9,01,5c,00,3f,00,3f,00,5c,\

00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,\

69,00,6c,00,65,00,73,00,5c,00,4a,00,61,00,76,00,61,00,5c,00,6a,00,72,00,65,\

00,31,00,2e,00,35,00,2e,00,30,00,5f,00,30,00,39,00,5c,00,62,00,69,00,6e,00,\

5c,00,6a,00,75,00,73,00,63,00,68,00,65,00,64,00,2e,00,65,00,78,00,65,00,00,\

00,72,00,65,00,73,00,73,00,2e,00,65,00,78,00,65,00,00,00,66,00,38,00,66,00,\

64,00,32,00,35,00,38,00,63,00,64,00,62,00,38,00,31,00,35,00,35,00,5c,00,75,\

00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,\

2e,00,65,00,78,00,65,00,00,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,fb,2d,f0,\

d5,ed,c6,01,6f,c0,00,00,00,00,00,00,d0,7d,cf,44,b4,e5,c5,01,5c,00,3f,00,3f,\

00,5c,00,43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,00,\

53,00,6f,00,66,00,74,00,77,00,61,00,72,00,65,00,44,00,69,00,73,00,74,00,72,\

00,69,00,62,00,75,00,74,00,69,00,6f,00,6e,00,5c,00,44,00,6f,00,77,00,6e,00,\

6c,00,6f,00,61,00,64,00,5c,00,38,00,64,00,31,00,37,00,34,00,38,00,37,00,62,\

00,34,00,36,00,36,00,65,00,39,00,30,00,35,00,39,00,35,00,31,00,33,00,34,00,\

32,00,30,00,65,00,66,00,38,00,66,00,35,00,37,00,33,00,64,00,65,00,31,00,5c,\

00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,\

65,00,2e,00,65,00,78,00,65,00,00,00,5c,00,53,00,65,00,74,00,75,00,70,00,41,\

00,6e,00,79,00,44,00,56,00,44,00,36,00,30,00,38,00,32,00,5b,00,31,00,5d,00,\

2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,80,1c,\

c6,14,fb,e0,c8,01,78,b5,0b,00,00,00,00,00,88,fc,9c,39,4e,45,c9,01,5c,00,3f,\

00,3f,00,5c,00,63,00,3a,00,5c,00,35,00,38,00,63,00,34,00,63,00,31,00,38,00,\

30,00,63,00,65,00,39,00,39,00,62,00,31,00,64,00,30,00,30,00,36,00,5c,00,6d,\

00,72,00,74,00,73,00,74,00,75,00,62,00,2e,00,65,00,78,00,65,00,00,00,77,00,\

6e,00,6c,00,6f,00,61,00,64,00,5c,00,64,00,63,00,39,00,65,00,38,00,66,00,38,\

00,61,00,61,00,37,00,35,00,31,00,63,00,64,00,32,00,37,00,35,00,63,00,61,00,\

63,00,61,00,31,00,38,00,39,00,64,00,63,00,35,00,66,00,30,00,61,00,39,00,38,\

00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,\

74,00,65,00,2e,00,65,00,78,00,65,00,00,00,65,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,b1,23,1c,a1,07,c9,01,78,b8,00,00,00,00,00,00,a0,db,01,7a,49,26,c9,01,5c,\

00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,\

6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,4c,00,6f,00,67,00,69,00,74,\

00,65,00,63,00,68,00,5c,00,56,00,69,00,64,00,65,00,6f,00,5c,00,4d,00,61,00,\

6e,00,69,00,66,00,65,00,73,00,74,00,45,00,6e,00,67,00,69,00,6e,00,65,00,2e,\

00,65,00,78,00,65,00,00,00,35,00,65,00,63,00,32,00,36,00,66,00,66,00,34,00,\

34,00,35,00,32,00,64,00,63,00,62,00,61,00,32,00,38,00,37,00,39,00,61,00,36,\

00,63,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,\

61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,64,00,61,00,74,00,65,00,2e,\

00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,fb,e2,72,62,6c,c5,01,00,00,03,00,00,00,00,00,30,85,da,45,b4,e5,c5,\

01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,\

61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,41,00,64,00,6f,00,62,\

00,65,00,5c,00,41,00,63,00,72,00,6f,00,62,00,61,00,74,00,20,00,37,00,2e,00,\

30,00,5c,00,52,00,65,00,61,00,64,00,65,00,72,00,5c,00,41,00,63,00,72,00,6f,\

00,52,00,64,00,33,00,32,00,2e,00,65,00,78,00,65,00,00,00,36,00,39,00,34,00,\

65,00,64,00,39,00,66,00,63,00,62,00,34,00,65,00,37,00,62,00,64,00,64,00,62,\

00,35,00,33,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,\

64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,5c,00,6c,00,61,00,75,\

00,6e,00,63,00,68,00,65,00,72,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,eb,47,20,b9,e1,c4,01,00,00,01,00,00,00,00,00,64,e5,5f,7e,a6,\

25,c9,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,\

72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,4e,00,65,00,72,\

00,6f,00,5c,00,4e,00,65,00,72,00,6f,00,20,00,37,00,5c,00,4e,00,65,00,72,00,\

6f,00,20,00,42,00,61,00,63,00,6b,00,49,00,74,00,55,00,70,00,5c,00,4e,00,42,\

00,53,00,68,00,65,00,6c,00,6c,00,2e,00,64,00,6c,00,6c,00,00,00,73,00,58,00,\

50,00,2d,00,4b,00,42,00,39,00,30,00,35,00,34,00,37,00,34,00,2d,00,46,00,52,\

00,41,00,2d,00,78,00,38,00,36,00,2e,00,65,00,78,00,65,00,00,00,5c,00,75,00,\

70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,6f,17,4c,27,b2,c5,01,00,c0,01,00,00,00,00,00,c0,b9,86,\

60,49,26,c9,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,\

67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,45,00,53,\

00,45,00,54,00,5c,00,45,00,53,00,45,00,54,00,20,00,4e,00,4f,00,44,00,33,00,\

32,00,20,00,41,00,6e,00,74,00,69,00,76,00,69,00,72,00,75,00,73,00,5c,00,73,\

00,68,00,65,00,6c,00,6c,00,45,00,78,00,74,00,2e,00,64,00,6c,00,6c,00,00,00,\

34,00,62,00,38,00,37,00,37,00,34,00,62,00,33,00,63,00,36,00,66,00,36,00,32,\

00,31,00,35,00,61,00,33,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,\

75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,2e,be,a9,d4,43,c8,01,00,95,02,00,00,00,00,00,6a,\

c5,34,61,49,26,c9,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,\

6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,59,\

00,61,00,68,00,6f,00,6f,00,21,00,5c,00,43,00,6f,00,6d,00,70,00,61,00,6e,00,\

69,00,6f,00,6e,00,5c,00,49,00,6e,00,73,00,74,00,61,00,6c,00,6c,00,73,00,5c,\

00,63,00,70,00,6e,00,5c,00,79,00,74,00,2e,00,64,00,6c,00,6c,00,00,00,62,00,\

32,00,61,00,37,00,62,00,62,00,64,00,33,00,31,00,30,00,37,00,64,00,38,00,61,\

00,66,00,38,00,32,00,61,00,35,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,\

5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,9c,f3,07,0b,f9,c6,01,40,b8,06,00,00,00,00,\

00,84,0f,20,60,a6,25,c9,01,43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,\

57,00,53,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,6d,\

00,73,00,63,00,74,00,66,00,69,00,6d,00,65,00,2e,00,69,00,6d,00,65,00,00,00,\

6c,00,6c,00,00,00,73,00,6e,00,73,00,76,00,63,00,2e,00,65,00,78,00,65,00,00,\

00,6c,00,6c,00,00,00,00,00,34,00,38,00,64,00,31,00,35,00,66,00,38,00,32,00,\

36,00,34,00,65,00,65,00,62,00,37,00,66,00,64,00,62,00,38,00,34,00,66,00,66,\

00,62,00,62,00,65,00,30,00,64,00,34,00,5c,00,75,00,70,00,64,00,61,00,74,00,\

65,00,5c,00,55,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,ec,d4,1b,32,4f,45,c9,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,\

50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,\

00,5c,00,47,00,6f,00,6f,00,67,00,6c,00,65,00,5c,00,47,00,6f,00,6f,00,67,00,\

6c,00,65,00,54,00,6f,00,6f,00,6c,00,62,00,61,00,72,00,4e,00,6f,00,74,00,69,\

00,66,00,69,00,65,00,72,00,5c,00,47,00,6f,00,6f,00,67,00,6c,00,65,00,54,00,\

6f,00,6f,00,6c,00,62,00,61,00,72,00,4e,00,6f,00,74,00,69,00,66,00,69,00,65,\

00,72,00,2e,00,65,00,78,00,65,00,00,00,30,00,5c,00,75,00,70,00,64,00,61,00,\

74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,46,d9,81,46,89,9d,c7,01,f8,0c,01,\

00,00,00,00,00,2a,0d,03,46,b4,e5,c5,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,\

5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,\

00,73,00,5c,00,47,00,72,00,65,00,61,00,74,00,69,00,73,00,5c,00,52,00,65,00,\

67,00,52,00,75,00,6e,00,53,00,75,00,69,00,74,00,65,00,5c,00,4f,00,6e,00,53,\

00,65,00,63,00,75,00,72,00,65,00,2e,00,65,00,78,00,65,00,00,00,5c,00,4f,00,\

46,00,46,00,49,00,43,00,45,00,31,00,31,00,5c,00,4d,00,53,00,4f,00,58,00,45,\

00,56,00,2e,00,44,00,4c,00,4c,00,00,00,33,00,34,00,5c,00,75,00,70,00,64,00,\

61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,\

00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,54,c8,2f,c2,c2,01,00,\

e2,00,00,00,00,00,00,88,b0,84,45,b4,e5,c5,01,5c,00,3f,00,3f,00,5c,00,43,00,\

3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,00,65,00,68,00,6f,\

00,6d,00,65,00,5c,00,65,00,68,00,74,00,72,00,61,00,79,00,2e,00,65,00,78,00,\

65,00,00,00,64,00,65,00,6f,00,5c,00,4c,00,6f,00,67,00,69,00,54,00,72,00,61,\

00,79,00,2e,00,65,00,78,00,65,00,00,00,65,00,00,00,37,00,32,00,62,00,31,00,\

66,00,32,00,65,00,66,00,62,00,63,00,34,00,35,00,31,00,33,00,65,00,37,00,32,\

00,62,00,30,00,65,00,33,00,61,00,63,00,64,00,36,00,61,00,5c,00,75,00,70,00,\

64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,\

00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,84,69,f0,e3,99,c5,\

01,00,fc,00,00,00,00,00,00,7c,93,a4,44,b4,e5,c5,01,5c,00,3f,00,3f,00,5c,00,\

43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,69,\

00,6c,00,65,00,73,00,5c,00,46,00,69,00,63,00,68,00,69,00,65,00,72,00,73,00,\

20,00,63,00,6f,00,6d,00,6d,00,75,00,6e,00,73,00,5c,00,41,00,70,00,70,00,6c,\

00,65,00,5c,00,4d,00,6f,00,62,00,69,00,6c,00,65,00,20,00,44,00,65,00,76,00,\

69,00,63,00,65,00,20,00,53,00,75,00,70,00,70,00,6f,00,72,00,74,00,5c,00,62,\

00,69,00,6e,00,5c,00,41,00,70,00,70,00,6c,00,65,00,4d,00,6f,00,62,00,69,00,\

6c,00,65,00,44,00,65,00,76,00,69,00,63,00,65,00,53,00,65,00,72,00,76,00,69,\

00,63,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,db,e2,3c,41,\

72,c8,01,00,b0,01,00,00,00,00,00,9e,b3,ec,46,b4,e5,c5,01,5c,00,3f,00,3f,00,\

5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,\

00,69,00,6c,00,65,00,73,00,5c,00,49,00,6e,00,74,00,65,00,72,00,6e,00,65,00,\

74,00,20,00,45,00,78,00,70,00,6c,00,6f,00,72,00,65,00,72,00,5c,00,49,00,45,\

00,58,00,50,00,4c,00,4f,00,52,00,45,00,2e,00,45,00,58,00,45,00,00,00,39,00,\

35,00,38,00,66,00,34,00,31,00,39,00,62,00,39,00,31,00,37,00,64,00,64,00,66,\

00,64,00,62,00,38,00,65,00,65,00,30,00,38,00,66,00,64,00,64,00,38,00,5c,00,\

75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,\

00,2e,00,65,00,78,00,65,00,00,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,\

65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,60,db,\

8f,d1,7e,c4,01,00,6c,01,00,00,00,00,00,c6,2c,05,6a,ad,25,c9,01,5c,00,3f,00,\

3f,00,5c,00,43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,\

00,53,00,6f,00,66,00,74,00,77,00,61,00,72,00,65,00,44,00,69,00,73,00,74,00,\

72,00,69,00,62,00,75,00,74,00,69,00,6f,00,6e,00,5c,00,44,00,6f,00,77,00,6e,\

00,6c,00,6f,00,61,00,64,00,5c,00,49,00,6e,00,73,00,74,00,61,00,6c,00,6c,00,\

5c,00,49,00,45,00,37,00,2d,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,58,\

00,50,00,2d,00,78,00,38,00,36,00,2d,00,66,00,72,00,61,00,2e,00,65,00,78,00,\

65,00,00,00,39,00,38,00,38,00,64,00,36,00,66,00,34,00,5c,00,75,00,70,00,64,\

00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,\

78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

49,4d,2d,63,05,c8,01,20,66,e1,00,00,00,00,00,68,ef,3b,ce,48,26,c9,01,5c,00,\

3f,00,3f,00,5c,00,43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,\

00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,70,00,\

75,00,70,00,64,00,73,00,76,00,63,00,2e,00,65,00,78,00,65,00,00,00,6f,00,77,\

00,6e,00,6c,00,6f,00,61,00,64,00,5c,00,32,00,39,00,33,00,37,00,62,00,33,00,\

30,00,36,00,33,00,62,00,34,00,37,00,31,00,33,00,32,00,37,00,65,00,39,00,36,\

00,33,00,30,00,33,00,37,00,34,00,30,00,30,00,64,00,30,00,32,00,65,00,34,00,\

37,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,\

00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,65,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,2d,26,7e,fd,d1,c6,01,e0,58,00,00,00,00,00,00,64,35,7d,03,4a,26,c9,01,\

5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,\

00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,53,00,69,00,6c,00,69,00,\

63,00,6f,00,6e,00,20,00,49,00,6e,00,74,00,65,00,67,00,72,00,61,00,74,00,65,\

00,64,00,20,00,53,00,79,00,73,00,74,00,65,00,6d,00,73,00,5c,00,53,00,69,00,\

53,00,52,00,61,00,69,00,64,00,50,00,61,00,63,00,6b,00,61,00,67,00,65,00,5c,\

00,53,00,72,00,61,00,69,00,64,00,2e,00,65,00,78,00,65,00,00,00,78,00,65,00,\

00,00,38,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,\

00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,64,00,61,00,74,00,65,00,\

2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,4c,de,92,d9,5b,c5,01,00,d0,0d,00,00,00,00,00,5a,cd,be,44,b4,e5,\

c5,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,\

00,57,00,53,00,5c,00,57,00,69,00,6e,00,42,00,61,00,69,00,74,00,2e,00,65,00,\

78,00,65,00,00,00,65,00,63,00,20,00,41,00,6e,00,74,00,69,00,56,00,69,00,72,\

00,75,00,73,00,5c,00,56,00,50,00,54,00,72,00,61,00,79,00,2e,00,65,00,78,00,\

65,00,00,00,65,00,00,00,63,00,39,00,63,00,66,00,31,00,61,00,32,00,36,00,30,\

00,38,00,31,00,32,00,35,00,64,00,30,00,66,00,36,00,32,00,34,00,36,00,37,00,\

38,00,38,00,38,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,\

00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,65,00,78,00,65,00,\

00,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,35,49,93,9f,64,c0,01,00,40,00,00,00,00,00,00,04,d9,6c,45,\

b4,e5,c5,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,\

00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,46,00,69,00,\

63,00,68,00,69,00,65,00,72,00,73,00,20,00,63,00,6f,00,6d,00,6d,00,75,00,6e,\

00,73,00,5c,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,\

53,00,68,00,61,00,72,00,65,00,64,00,5c,00,56,00,53,00,37,00,44,00,45,00,42,\

00,55,00,47,00,5c,00,4d,00,44,00,4d,00,2e,00,45,00,58,00,45,00,00,00,30,00,\

64,00,37,00,31,00,64,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,\

00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,ce,c3,87,db,36,c3,01,48,ea,04,00,00,00,00,00,16,9b,\

55,47,b4,e5,c5,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,57,00,49,00,4e,\

00,44,00,4f,00,57,00,53,00,5c,00,65,00,68,00,6f,00,6d,00,65,00,5c,00,6d,00,\

63,00,72,00,64,00,73,00,76,00,63,00,2e,00,65,00,78,00,65,00,00,00,69,00,56,\

00,69,00,72,00,75,00,73,00,5c,00,56,00,50,00,54,00,72,00,61,00,79,00,2e,00,\

65,00,78,00,65,00,00,00,35,00,37,00,31,00,33,00,32,00,66,00,33,00,61,00,33,\

00,61,00,35,00,38,00,62,00,62,00,34,00,38,00,30,00,36,00,63,00,32,00,36,00,\

37,00,64,00,36,00,64,00,31,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,\

00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,64,00,\

61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,4c,73,71,e1,99,c5,01,00,84,01,00,00,00,00,00,\

f2,f7,79,49,b4,e5,c5,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,57,00,49,\

00,4e,00,44,00,4f,00,57,00,53,00,5c,00,65,00,68,00,6f,00,6d,00,65,00,5c,00,\

65,00,68,00,52,00,65,00,63,00,2e,00,65,00,78,00,65,00,00,00,69,00,63,00,65,\

00,73,00,5c,00,53,00,6f,00,75,00,6e,00,64,00,4d,00,41,00,58,00,5c,00,53,00,\

4d,00,61,00,78,00,34,00,50,00,4e,00,50,00,2e,00,65,00,78,00,65,00,00,00,37,\

00,39,00,62,00,31,00,34,00,33,00,65,00,37,00,30,00,61,00,30,00,35,00,39,00,\

64,00,63,00,62,00,30,00,30,00,35,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,\

00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,\

5c,00,70,00,61,00,74,00,63,00,68,00,6a,00,72,00,65,00,2e,00,65,00,78,00,65,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,13,22,d4,f4,99,c5,01,00,00,01,00,00,00,\

00,00,e6,ad,68,47,b4,e5,c5,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,\

00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,\

5c,00,46,00,69,00,63,00,68,00,69,00,65,00,72,00,73,00,20,00,63,00,6f,00,6d,\

00,6d,00,75,00,6e,00,73,00,5c,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,\

66,00,74,00,20,00,53,00,68,00,61,00,72,00,65,00,64,00,5c,00,53,00,6f,00,75,\

00,72,00,63,00,65,00,20,00,45,00,6e,00,67,00,69,00,6e,00,65,00,5c,00,4f,00,\

53,00,45,00,2e,00,45,00,58,00,45,00,00,00,5c,00,75,00,70,00,64,00,61,00,74,\

00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,\

00,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,97,f9,50,68,55,c3,01,30,5c,01,00,\

00,00,00,00,02,21,d6,11,4e,45,c9,01,43,00,3a,00,5c,00,57,00,49,00,4e,00,44,\

00,4f,00,57,00,53,00,5c,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,\

74,00,2e,00,4e,00,45,00,54,00,5c,00,46,00,72,00,61,00,6d,00,65,00,77,00,6f,\

00,72,00,6b,00,5c,00,76,00,32,00,2e,00,30,00,2e,00,35,00,30,00,37,00,32,00,\

37,00,5c,00,6d,00,73,00,63,00,6f,00,72,00,77,00,6b,00,73,00,2e,00,64,00,6c,\

00,6c,00,00,00,65,00,78,00,65,00,00,00,65,00,00,00,36,00,36,00,64,00,61,00,\

33,00,63,00,30,00,63,00,35,00,32,00,65,00,65,00,5c,00,75,00,70,00,64,00,61,\

00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,\

65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,2e,73,e1,0f,4e,45,c9,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,\

00,5c,00,50,00,52,00,4f,00,47,00,52,00,41,00,7e,00,31,00,5c,00,57,00,69,00,\

6e,00,5a,00,69,00,70,00,5c,00,57,00,5a,00,53,00,48,00,4c,00,53,00,54,00,42,\

00,2e,00,44,00,4c,00,4c,00,00,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,\

74,00,65,00,2e,00,65,00,78,00,65,00,00,00,57,00,6f,00,6c,00,66,00,53,00,50,\

00,2e,00,65,00,78,00,65,00,00,00,65,00,64,00,62,00,34,00,61,00,66,00,32,00,\

65,00,62,00,37,00,36,00,35,00,37,00,33,00,65,00,62,00,5c,00,75,00,70,00,64,\

00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,\

78,00,65,00,00,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,60,72,59,42,fd,bf,01,\

45,60,00,00,00,00,00,00,24,02,11,61,49,26,c9,01,43,00,3a,00,5c,00,57,00,49,\

00,4e,00,44,00,4f,00,57,00,53,00,5c,00,4d,00,69,00,63,00,72,00,6f,00,73,00,\

6f,00,66,00,74,00,2e,00,4e,00,45,00,54,00,5c,00,46,00,72,00,61,00,6d,00,65,\

00,77,00,6f,00,72,00,6b,00,5c,00,76,00,31,00,2e,00,31,00,2e,00,34,00,33,00,\

32,00,32,00,5c,00,6d,00,73,00,63,00,6f,00,72,00,77,00,6b,00,73,00,2e,00,64,\

00,6c,00,6c,00,00,00,65,00,00,00,65,00,65,00,39,00,64,00,34,00,38,00,31,00,\

64,00,32,00,31,00,33,00,32,00,38,00,66,00,32,00,39,00,64,00,5c,00,75,00,70,\

00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,\

65,00,78,00,65,00,00,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,d2,0e,8a,47,b4,e5,c5,01,5c,00,3f,00,3f,00,5c,\

00,63,00,3a,00,5c,00,61,00,66,00,30,00,34,00,66,00,31,00,36,00,37,00,32,00,\

63,00,30,00,61,00,30,00,37,00,65,00,65,00,30,00,63,00,66,00,61,00,36,00,34,\

00,32,00,65,00,65,00,62,00,63,00,36,00,39,00,33,00,38,00,39,00,5c,00,75,00,\

70,00,64,00,61,00,74,00,65,00,5c,00,78,00,6d,00,6c,00,6c,00,69,00,74,00,65,\

00,73,00,65,00,74,00,75,00,70,00,2e,00,65,00,78,00,65,00,00,00,62,00,39,00,\

63,00,63,00,38,00,64,00,61,00,63,00,30,00,32,00,32,00,65,00,64,00,5c,00,75,\

00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,\

2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,4c,30,78,\

fd,d1,c6,01,38,31,08,00,00,00,00,00,fc,7c,0b,aa,49,26,c9,01,5c,00,3f,00,3f,\

00,5c,00,43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,00,\

73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,6d,00,79,00,64,00,6f,\

00,63,00,73,00,2e,00,64,00,6c,00,6c,00,00,00,5c,00,44,00,6f,00,77,00,6e,00,\

6c,00,6f,00,61,00,64,00,5c,00,35,00,39,00,37,00,64,00,38,00,36,00,62,00,37,\

00,39,00,39,00,33,00,33,00,65,00,64,00,61,00,63,00,36,00,66,00,61,00,38,00,\

39,00,37,00,64,00,33,00,33,00,63,00,35,00,33,00,66,00,39,00,31,00,38,00,5c,\

00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,\

65,00,2e,00,65,00,78,00,65,00,00,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,\

00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,60,\

db,8f,d1,7e,c4,01,00,66,01,00,00,00,00,00,16,32,b0,77,49,26,c9,01,5c,00,3f,\

00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,\

20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,46,00,69,00,63,00,68,00,69,00,65,\

00,72,00,73,00,20,00,63,00,6f,00,6d,00,6d,00,75,00,6e,00,73,00,5c,00,41,00,\

68,00,65,00,61,00,64,00,5c,00,4c,00,69,00,62,00,5c,00,4e,00,4d,00,42,00,67,\

00,4d,00,6f,00,6e,00,69,00,74,00,6f,00,72,00,2e,00,65,00,78,00,65,00,00,00,\

6c,00,32,00,2e,00,64,00,6c,00,6c,00,00,00,78,00,61,00,6e,00,64,00,72,00,61,\

00,20,00,4c,00,65,00,64,00,65,00,72,00,6d,00,61,00,6e,00,6e,00,20,00,34,00,\

2e,00,65,00,78,00,65,00,00,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,87,87,44,bc,b0,c5,01,00,70,01,00,00,00,00,00,60,72,c7,45,b4,e5,c5,01,5c,\

00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,\

6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,46,00,69,00,63,00,68,00,69,\

00,65,00,72,00,73,00,20,00,63,00,6f,00,6d,00,6d,00,75,00,6e,00,73,00,5c,00,\

4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,68,00,61,\

00,72,00,65,00,64,00,5c,00,4f,00,46,00,46,00,49,00,43,00,45,00,31,00,31,00,\

5c,00,4d,00,53,00,4f,00,58,00,45,00,56,00,2e,00,44,00,4c,00,4c,00,00,00,32,\

00,33,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,\

61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,64,00,61,00,74,00,65,00,2e,\

00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,3d,f2,b8,d7,6c,c7,01,60,b1,00,00,00,00,00,00,d8,c7,c0,2f,68,25,c9,\

01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,\

57,00,53,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,4c,\

00,56,00,43,00,4f,00,4d,00,53,00,58,00,2e,00,45,00,58,00,45,00,00,00,74,00,\

73,00,2e,00,73,00,63,00,72,00,00,00,61,00,6b,00,73,00,5c,00,54,00,72,00,69,\

00,70,00,65,00,61,00,6b,00,73,00,2e,00,65,00,78,00,65,00,00,00,34,00,61,00,\

37,00,39,00,31,00,61,00,35,00,64,00,65,00,63,00,39,00,36,00,33,00,33,00,32,\

00,61,00,32,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,\

64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,64,00,61,00,74,00,65,\

00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,05,5b,b8,b1,8c,c5,01,00,60,03,00,00,00,00,00,38,07,d9,44,b4,\

e5,c5,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,\

72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,47,00,72,00,65,\

00,61,00,74,00,69,00,73,00,5c,00,52,00,65,00,67,00,52,00,75,00,6e,00,53,00,\

75,00,69,00,74,00,65,00,5c,00,52,00,52,00,53,00,68,00,65,00,6c,00,6c,00,2e,\

00,64,00,6c,00,6c,00,00,00,5c,00,63,00,63,00,41,00,70,00,70,00,2e,00,65,00,\

78,00,65,00,00,00,64,00,38,00,38,00,34,00,65,00,35,00,33,00,34,00,32,00,35,\

00,39,00,37,00,32,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,\

70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,63,1a,79,e6,c0,c4,01,47,a0,05,00,00,00,00,00,e0,6d,2d,\

64,b4,e5,c5,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,\

67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,46,00,69,\

00,63,00,68,00,69,00,65,00,72,00,73,00,20,00,63,00,6f,00,6d,00,6d,00,75,00,\

6e,00,73,00,5c,00,41,00,70,00,70,00,6c,00,65,00,5c,00,4d,00,6f,00,62,00,69,\

00,6c,00,65,00,20,00,44,00,65,00,76,00,69,00,63,00,65,00,20,00,53,00,75,00,\

70,00,70,00,6f,00,72,00,74,00,5c,00,62,00,69,00,6e,00,5c,00,41,00,70,00,70,\

00,6c,00,65,00,4d,00,6f,00,62,00,69,00,6c,00,65,00,44,00,65,00,76,00,69,00,\

63,00,65,00,48,00,65,00,6c,00,70,00,65,00,72,00,2e,00,65,00,78,00,65,00,00,\

00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,ef,ae,4c,42,72,c8,01,f8,26,02,00,00,00,00,00,80,\

ca,1a,b5,4d,45,c9,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,\

6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,41,\

00,6e,00,61,00,6c,00,6f,00,67,00,20,00,44,00,65,00,76,00,69,00,63,00,65,00,\

73,00,5c,00,53,00,6f,00,75,00,6e,00,64,00,4d,00,41,00,58,00,5c,00,53,00,4d,\

00,61,00,78,00,34,00,2e,00,65,00,78,00,65,00,00,00,69,00,74,00,6f,00,72,00,\

2e,00,65,00,78,00,65,00,00,00,38,00,35,00,34,00,35,00,37,00,38,00,30,00,32,\

00,65,00,61,00,34,00,62,00,36,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,\

5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,5c,\

00,70,00,61,00,74,00,63,00,68,00,6a,00,72,00,65,00,2e,00,65,00,78,00,65,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,f5,8f,3b,8c,a1,c4,01,00,20,0d,00,00,00,00,\

00,f2,43,b5,44,b4,e5,c5,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,57,00,\

49,00,4e,00,44,00,4f,00,57,00,53,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,\

00,33,00,32,00,5c,00,73,00,68,00,6d,00,65,00,64,00,69,00,61,00,2e,00,64,00,\

6c,00,6c,00,00,00,00,00,5c,00,63,00,6c,00,69,00,65,00,6e,00,74,00,5c,00,6a,\

00,76,00,6d,00,2e,00,64,00,6c,00,6c,00,00,00,30,00,36,00,66,00,61,00,61,00,\

63,00,34,00,63,00,64,00,33,00,39,00,61,00,36,00,31,00,64,00,35,00,35,00,33,\

00,34,00,66,00,30,00,66,00,39,00,62,00,5c,00,75,00,70,00,64,00,61,00,74,00,\

65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,60,db,8f,d1,7e,c4,01,00,56,02,00,00,\

00,00,00,e4,98,e2,7b,70,25,c9,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,\

57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,00,65,00,68,00,6f,00,6d,00,65,\

00,5c,00,65,00,68,00,53,00,63,00,68,00,65,00,64,00,2e,00,65,00,78,00,65,00,\

00,00,58,00,45,00,00,00,64,00,61,00,74,00,65,00,5c,00,4c,00,55,00,41,00,4c,\

00,4c,00,2e,00,45,00,58,00,45,00,00,00,65,00,64,00,5c,00,63,00,63,00,41,00,\

70,00,70,00,2e,00,65,00,78,00,65,00,00,00,4d,00,44,00,4d,00,2e,00,45,00,58,\

00,45,00,00,00,36,00,33,00,33,00,30,00,66,00,35,00,35,00,30,00,61,00,32,00,\

39,00,32,00,35,00,32,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,\

00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,f3,92,46,f5,99,c5,01,00,94,01,\

00,00,00,00,00,d6,4f,09,47,b4,e5,c5,01,5c,00,3f,00,3f,00,5c,00,63,00,3a,00,\

5c,00,37,00,38,00,34,00,38,00,62,00,35,00,30,00,35,00,32,00,65,00,33,00,61,\

00,66,00,31,00,62,00,66,00,33,00,31,00,5c,00,75,00,70,00,64,00,61,00,74,00,\

65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,\

00,5c,00,49,00,6e,00,73,00,74,00,61,00,6c,00,6c,00,5c,00,57,00,69,00,6e,00,\

64,00,6f,00,77,00,73,00,2d,00,4b,00,42,00,38,00,39,00,30,00,38,00,33,00,30,\

00,2d,00,56,00,31,00,2e,00,33,00,38,00,2e,00,65,00,78,00,65,00,00,00,2d,00,\

6a,00,72,00,65,00,31,00,2e,00,35,00,2e,00,30,00,5f,00,30,00,39,00,2e,00,62,\

00,30,00,33,00,5c,00,7a,00,69,00,70,00,70,00,65,00,72,00,2e,00,65,00,78,00,\

65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,38,a4,92,07,80,c6,01,e0,\

ec,0a,00,00,00,00,00,f0,b6,d1,bf,49,26,c9,01,5c,00,3f,00,3f,00,5c,00,43,00,\

3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,00,65,00,68,00,6f,\

00,6d,00,65,00,5c,00,65,00,68,00,6d,00,73,00,61,00,73,00,2e,00,65,00,78,00,\

65,00,00,00,76,00,65,00,55,00,70,00,64,00,61,00,74,00,65,00,5c,00,4c,00,55,\

00,41,00,4c,00,4c,00,2e,00,45,00,58,00,45,00,00,00,63,00,61,00,39,00,33,00,\

66,00,64,00,65,00,64,00,64,00,31,00,34,00,66,00,66,00,34,00,32,00,66,00,65,\

00,62,00,39,00,33,00,32,00,37,00,31,00,39,00,37,00,36,00,5c,00,75,00,70,00,\

64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,\

00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,07,ee,e3,99,c5,\

01,00,b6,00,00,00,00,00,00,d0,5e,c5,4a,b4,e5,c5,01,5c,00,3f,00,3f,00,5c,00,\

43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,69,\

00,6c,00,65,00,73,00,5c,00,41,00,64,00,6f,00,62,00,65,00,5c,00,41,00,63,00,\

72,00,6f,00,62,00,61,00,74,00,20,00,37,00,2e,00,30,00,5c,00,41,00,63,00,74,\

00,69,00,76,00,65,00,58,00,5c,00,50,00,44,00,46,00,53,00,68,00,65,00,6c,00,\

6c,00,2e,00,64,00,6c,00,6c,00,00,00,39,00,61,00,33,00,66,00,61,00,39,00,61,\

00,63,00,61,00,64,00,39,00,64,00,33,00,62,00,66,00,31,00,61,00,5c,00,75,00,\

70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,\

00,65,00,78,00,65,00,00,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,15,c0,f1,a4,\

e1,c4,01,00,b0,01,00,00,00,00,00,6a,3f,c9,72,70,25,c9,01,5c,00,3f,00,3f,00,\

5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,\

00,69,00,6c,00,65,00,73,00,5c,00,47,00,72,00,65,00,61,00,74,00,69,00,73,00,\

5c,00,52,00,65,00,67,00,52,00,75,00,6e,00,53,00,75,00,69,00,74,00,65,00,5c,\

00,4d,00,41,00,4b,00,45,00,43,00,41,00,42,00,2e,00,45,00,58,00,45,00,00,00,\

5c,00,63,00,63,00,50,00,77,00,64,00,53,00,76,00,63,00,2e,00,65,00,78,00,65,\

00,00,00,65,00,36,00,30,00,36,00,30,00,65,00,65,00,32,00,37,00,37,00,5c,00,\

75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,\

00,2e,00,65,00,78,00,65,00,00,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,\

65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,d6,c0,\

9c,15,35,bc,01,00,54,02,00,00,00,00,00,24,bf,a0,5b,b4,e5,c5,01,5c,00,3f,00,\

3f,00,5c,00,43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,\

00,53,00,6f,00,66,00,74,00,77,00,61,00,72,00,65,00,44,00,69,00,73,00,74,00,\

72,00,69,00,62,00,75,00,74,00,69,00,6f,00,6e,00,5c,00,44,00,6f,00,77,00,6e,\

00,6c,00,6f,00,61,00,64,00,5c,00,49,00,6e,00,73,00,74,00,61,00,6c,00,6c,00,\

5c,00,77,00,69,00,6e,00,64,00,6f,00,77,00,73,00,2d,00,6b,00,62,00,38,00,39,\

00,30,00,38,00,33,00,30,00,2d,00,76,00,32,00,2e,00,32,00,2e,00,65,00,78,00,\

65,00,00,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,\

00,65,00,2e,00,65,00,78,00,65,00,00,00,65,00,00,00,74,00,65,00,2e,00,65,00,\

78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,80,\

ee,8d,60,57,0d,c9,01,78,1c,6f,00,00,00,00,00,fa,60,7c,24,4a,26,c9,01,5c,00,\

3f,00,3f,00,5c,00,43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,\

00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,69,00,65,00,\

66,00,72,00,61,00,6d,00,65,00,2e,00,64,00,6c,00,6c,00,00,00,2e,00,30,00,5c,\

00,52,00,65,00,61,00,64,00,65,00,72,00,5c,00,72,00,65,00,61,00,64,00,65,00,\

72,00,5f,00,73,00,6c,00,2e,00,65,00,78,00,65,00,00,00,38,00,32,00,39,00,62,\

00,66,00,35,00,66,00,34,00,30,00,64,00,64,00,31,00,62,00,34,00,36,00,37,00,\

34,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,\

00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,64,00,61,00,74,00,65,00,2e,00,\

65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,80,cf,c3,35,7b,25,c9,01,00,90,5c,00,00,00,00,00,16,9e,ee,2b,4e,45,c9,01,\

5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,\

00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,51,00,75,00,69,00,63,00,\

6b,00,54,00,69,00,6d,00,65,00,5c,00,51,00,54,00,54,00,61,00,73,00,6b,00,2e,\

00,65,00,78,00,65,00,00,00,61,00,64,00,5c,00,64,00,61,00,31,00,35,00,34,00,\

61,00,30,00,37,00,66,00,35,00,62,00,31,00,35,00,64,00,30,00,38,00,62,00,66,\

00,31,00,65,00,65,00,64,00,31,00,62,00,36,00,39,00,64,00,39,00,63,00,36,00,\

37,00,62,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,\

00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,64,00,61,00,74,00,65,00,\

2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,d8,42,31,4e,91,c8,01,00,50,06,00,00,00,00,00,9a,18,0b,45,b4,e5,\

c5,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,\

00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,41,00,6e,00,61,00,\

6c,00,6f,00,67,00,20,00,44,00,65,00,76,00,69,00,63,00,65,00,73,00,5c,00,53,\

00,6f,00,75,00,6e,00,64,00,4d,00,41,00,58,00,5c,00,53,00,4d,00,41,00,67,00,\

65,00,6e,00,74,00,2e,00,65,00,78,00,65,00,00,00,63,00,6b,00,61,00,67,00,65,\

00,5c,00,53,00,72,00,61,00,69,00,64,00,2e,00,65,00,78,00,65,00,00,00,78,00,\

65,00,00,00,61,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,\

00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,dd,87,8b,d6,60,c2,01,00,b0,00,00,00,00,00,00,9e,0d,4f,49,\

b4,e5,c5,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,57,00,49,00,4e,00,44,\

00,4f,00,57,00,53,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,\

5c,00,4d,00,52,00,54,00,2e,00,65,00,78,00,65,00,00,00,65,00,65,00,64,00,69,\

00,6e,00,67,00,46,00,72,00,65,00,6e,00,7a,00,79,00,5c,00,46,00,65,00,65,00,\

64,00,69,00,6e,00,67,00,46,00,72,00,65,00,6e,00,7a,00,79,00,2e,00,65,00,78,\

00,65,00,00,00,53,00,72,00,61,00,69,00,64,00,2e,00,65,00,78,00,65,00,00,00,\

38,00,62,00,62,00,61,00,36,00,61,00,64,00,63,00,35,00,30,00,63,00,63,00,39,\

00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,\

74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,80,2e,39,bc,11,3e,c9,01,c0,41,08,01,00,00,00,00,58,4a,\

08,42,4e,45,c9,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,57,00,49,00,4e,\

00,44,00,4f,00,57,00,53,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,\

32,00,5c,00,61,00,75,00,64,00,69,00,6f,00,64,00,65,00,76,00,2e,00,64,00,6c,\

00,6c,00,00,00,6b,00,5c,00,76,00,32,00,2e,00,30,00,2e,00,35,00,30,00,37,00,\

32,00,37,00,5c,00,72,00,65,00,67,00,74,00,6c,00,69,00,62,00,76,00,31,00,32,\

00,2e,00,65,00,78,00,65,00,00,00,65,00,00,00,00,00,38,00,61,00,63,00,63,00,\

62,00,61,00,39,00,31,00,33,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,\

00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,60,db,8f,d1,7e,c4,01,00,60,07,00,00,00,00,00,\

f2,7b,46,55,a6,25,c9,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,\

00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,\

47,00,72,00,65,00,61,00,74,00,69,00,73,00,5c,00,52,00,65,00,67,00,52,00,75,\

00,6e,00,53,00,75,00,69,00,74,00,65,00,5c,00,57,00,61,00,74,00,63,00,68,00,\

44,00,6f,00,67,00,2e,00,65,00,78,00,65,00,00,00,6c,00,61,00,70,00,73,00,65,\

00,2e,00,65,00,78,00,65,00,00,00,4d,00,44,00,4d,00,2e,00,45,00,58,00,45,00,\

00,00,30,00,63,00,32,00,32,00,66,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,\

00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,e5,b0,82,d2,40,c8,01,00,72,05,00,00,00,\

00,00,08,47,1d,46,b4,e5,c5,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,57,\

00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,00,53,00,6f,00,66,00,74,00,77,00,\

61,00,72,00,65,00,44,00,69,00,73,00,74,00,72,00,69,00,62,00,75,00,74,00,69,\

00,6f,00,6e,00,5c,00,44,00,6f,00,77,00,6e,00,6c,00,6f,00,61,00,64,00,5c,00,\

34,00,38,00,62,00,63,00,31,00,35,00,30,00,31,00,35,00,61,00,64,00,38,00,63,\

00,63,00,35,00,35,00,38,00,31,00,30,00,65,00,66,00,39,00,32,00,31,00,31,00,\

63,00,37,00,64,00,62,00,65,00,63,00,32,00,5c,00,75,00,70,00,64,00,61,00,74,\

00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,80,56,7c,0c,4e,33,c8,01,78,b5,0b,00,\

00,00,00,00,80,9a,2d,c8,4d,45,c9,01,5c,00,3f,00,3f,00,5c,00,63,00,3a,00,5c,\

00,61,00,66,00,30,00,34,00,66,00,31,00,36,00,37,00,32,00,63,00,30,00,61,00,\

30,00,37,00,65,00,65,00,30,00,63,00,66,00,61,00,36,00,34,00,32,00,65,00,65,\

00,62,00,63,00,36,00,39,00,33,00,38,00,39,00,5c,00,75,00,70,00,64,00,61,00,\

74,00,65,00,5c,00,69,00,65,00,73,00,65,00,74,00,75,00,70,00,2e,00,65,00,78,\

00,65,00,00,00,36,00,61,00,32,00,61,00,66,00,62,00,31,00,63,00,38,00,35,00,\

30,00,62,00,61,00,36,00,66,00,35,00,61,00,30,00,5c,00,75,00,70,00,64,00,61,\

00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,\

65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,ed,3d,6e,8d,00,c8,01,c0,98,\

10,00,00,00,00,00,a0,12,ec,d1,48,26,c9,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,\

00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,00,73,00,79,00,73,00,\

74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,00,64,00,6f,00,63,00,76,00,77,\

00,2e,00,64,00,6c,00,6c,00,00,00,4a,00,65,00,72,00,69,00,63,00,68,00,6f,00,\

5c,00,6a,00,65,00,72,00,69,00,63,00,68,00,6f,00,2e,00,65,00,78,00,65,00,00,\

00,00,00,30,00,35,00,35,00,38,00,32,00,33,00,32,00,34,00,37,00,32,00,32,00,\

66,00,38,00,35,00,34,00,34,00,64,00,36,00,30,00,38,00,35,00,65,00,30,00,65,\

00,38,00,30,00,39,00,32,00,38,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,\

5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,8b,17,62,4c,d5,c8,01,\

00,e2,16,00,00,00,00,00,62,6d,ab,77,49,26,c9,01,5c,00,3f,00,3f,00,5c,00,43,\

00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,69,00,\

6c,00,65,00,73,00,5c,00,69,00,54,00,75,00,6e,00,65,00,73,00,5c,00,69,00,54,\

00,75,00,6e,00,65,00,73,00,2e,00,65,00,78,00,65,00,00,00,61,00,74,00,65,00,\

5c,00,33,00,2e,00,31,00,5c,00,46,00,6f,00,74,00,6f,00,53,00,6c,00,61,00,74,\

00,65,00,33,00,31,00,2e,00,65,00,78,00,65,00,00,00,2e,00,65,00,78,00,65,00,\

00,00,63,00,66,00,66,00,36,00,61,00,33,00,32,00,61,00,65,00,65,00,35,00,61,\

00,33,00,65,00,65,00,62,00,61,00,38,00,5c,00,75,00,70,00,64,00,61,00,74,00,\

65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,05,b2,73,73,92,\

c8,01,28,eb,3a,01,00,00,00,00,b4,58,61,8e,4d,45,c9,01,5c,00,3f,00,3f,00,5c,\

00,43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,00,73,00,\

79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,76,00,65,00,72,00,63,00,6c,\

00,73,00,69,00,64,00,2e,00,65,00,78,00,65,00,00,00,6f,00,77,00,6e,00,6c,00,\

6f,00,61,00,64,00,5c,00,53,00,2d,00,31,00,2d,00,35,00,2d,00,31,00,38,00,5c,\

00,61,00,39,00,65,00,39,00,33,00,66,00,38,00,62,00,39,00,39,00,36,00,38,00,\

36,00,34,00,30,00,38,00,37,00,30,00,63,00,36,00,36,00,64,00,36,00,63,00,64,\

00,33,00,37,00,62,00,38,00,31,00,64,00,32,00,5c,00,75,00,70,00,64,00,61,00,\

74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,80,7a,79,0b,\

5b,49,c6,01,00,70,00,00,00,00,00,00,6e,b8,b5,38,4e,45,c9,01,5c,00,3f,00,3f,\

00,5c,00,63,00,3a,00,5c,00,61,00,66,00,30,00,34,00,66,00,31,00,36,00,37,00,\

32,00,63,00,30,00,61,00,30,00,37,00,65,00,65,00,30,00,63,00,66,00,61,00,36,\

00,34,00,32,00,65,00,65,00,62,00,63,00,36,00,39,00,33,00,38,00,39,00,5c,00,\

75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,\

00,2e,00,65,00,78,00,65,00,00,00,31,00,64,00,31,00,39,00,36,00,39,00,63,00,\

37,00,34,00,34,00,32,00,65,00,61,00,62,00,39,00,61,00,64,00,64,00,36,00,5c,\

00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,\

65,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2d,\

26,7e,fd,d1,c6,01,e0,1a,0b,00,00,00,00,00,90,cb,14,cd,49,26,c9,01,5c,00,3f,\

00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,\

20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,\

00,73,00,20,00,4c,00,69,00,76,00,65,00,20,00,54,00,6f,00,6f,00,6c,00,62,00,\

61,00,72,00,5c,00,4d,00,53,00,4e,00,54,00,42,00,55,00,50,00,2e,00,45,00,58,\

00,45,00,00,00,2e,00,65,00,78,00,65,00,00,00,78,00,65,00,00,00,2e,00,65,00,\

78,00,65,00,00,00,35,00,2e,00,30,00,2e,00,62,00,36,00,34,00,5c,00,70,00,61,\

00,74,00,63,00,68,00,2d,00,6a,00,72,00,65,00,31,00,2e,00,35,00,2e,00,30,00,\

5f,00,30,00,33,00,2e,00,62,00,30,00,37,00,5c,00,7a,00,69,00,70,00,70,00,65,\

00,72,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,8f,13,fc,6b,12,c8,01,10,86,01,00,00,00,00,00,d8,b8,94,f7,46,26,c9,01,5c,\

00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,\

53,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,53,00,48,\

00,45,00,4c,00,4c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,00,00,44,00,6f,00,\

77,00,6e,00,6c,00,6f,00,61,00,64,00,5c,00,53,00,2d,00,31,00,2d,00,35,00,2d,\

00,31,00,38,00,5c,00,65,00,65,00,31,00,36,00,30,00,38,00,65,00,34,00,34,00,\

35,00,33,00,62,00,66,00,30,00,31,00,32,00,31,00,31,00,31,00,33,00,36,00,38,\

00,62,00,36,00,35,00,31,00,66,00,33,00,63,00,66,00,31,00,35,00,5c,00,75,00,\

70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,\

00,65,00,78,00,65,00,00,00,42,00,38,00,39,00,33,00,38,00,30,00,33,00,2d,00,\

76,00,32,00,2d,00,78,00,38,00,36,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,ac,ab,f9,27,17,c8,01,00,de,81,00,00,00,00,00,d6,41,bf,38,4e,45,c9,\

01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,\

61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,42,00,6f,00,6e,00,6a,\

00,6f,00,75,00,72,00,5c,00,6d,00,44,00,4e,00,53,00,52,00,65,00,73,00,70,00,\

6f,00,6e,00,64,00,65,00,72,00,2e,00,65,00,78,00,65,00,00,00,6e,00,50,00,69,\

00,6e,00,42,00,6f,00,77,00,6c,00,69,00,6e,00,67,00,2e,00,65,00,78,00,65,00,\

00,00,36,00,61,00,33,00,35,00,63,00,62,00,36,00,38,00,33,00,64,00,61,00,34,\

00,32,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,\

64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,65,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,12,45,3a,27,ce,c7,01,00,80,03,00,00,00,00,00,06,3d,f6,46,b4,\

e5,c5,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,\

72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,46,00,69,00,63,\

00,68,00,69,00,65,00,72,00,73,00,20,00,63,00,6f,00,6d,00,6d,00,75,00,6e,00,\

73,00,5c,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,\

00,68,00,61,00,72,00,65,00,64,00,5c,00,56,00,53,00,37,00,44,00,45,00,42,00,\

55,00,47,00,5c,00,56,00,53,00,37,00,4a,00,49,00,54,00,2e,00,45,00,58,00,45,\

00,00,00,2e,00,65,00,78,00,65,00,00,00,64,00,61,00,74,00,65,00,5c,00,75,00,\

70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,ce,c3,87,db,36,c3,01,60,7a,02,00,00,00,00,00,fb,22,aa,\

7a,0d,1c,c9,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,\

67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,4d,00,53,\

00,4e,00,20,00,4d,00,65,00,73,00,73,00,65,00,6e,00,67,00,65,00,72,00,5c,00,\

6d,00,73,00,6e,00,6d,00,73,00,67,00,72,00,2e,00,65,00,78,00,65,00,00,00,31,\

00,62,00,34,00,33,00,31,00,61,00,61,00,61,00,63,00,39,00,31,00,31,00,35,00,\

38,00,61,00,36,00,30,00,35,00,34,00,39,00,64,00,39,00,30,00,30,00,33,00,30,\

00,34,00,34,00,66,00,64,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,\

75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,37,8b,8f,ea,3b,c7,01,70,95,56,00,00,00,00,00,ce,\

73,a8,45,b4,e5,c5,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,\

6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,47,\

00,72,00,65,00,61,00,74,00,69,00,73,00,5c,00,52,00,65,00,67,00,52,00,75,00,\

6e,00,53,00,75,00,69,00,74,00,65,00,5c,00,6c,00,73,00,6f,00,6f,00,6e,00,2e,\

00,65,00,78,00,65,00,00,00,65,00,64,00,5c,00,63,00,63,00,53,00,65,00,74,00,\

4d,00,67,00,72,00,2e,00,65,00,78,00,65,00,00,00,65,00,35,00,35,00,35,00,31,\

00,62,00,32,00,36,00,61,00,38,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,\

5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,75,78,49,d2,40,c8,01,00,f6,05,00,00,00,00,\

00,7e,f7,2d,46,b4,e5,c5,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,\

72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,\

00,4c,00,69,00,6d,00,65,00,57,00,69,00,72,00,65,00,5c,00,4c,00,69,00,6d,00,\

65,00,57,00,69,00,72,00,65,00,2e,00,65,00,78,00,65,00,00,00,32,00,2e,00,64,\

00,6c,00,6c,00,00,00,68,00,6f,00,74,00,6f,00,53,00,6e,00,61,00,70,00,56,00,\

69,00,65,00,77,00,65,00,72,00,2e,00,65,00,78,00,65,00,00,00,66,00,38,00,66,\

00,33,00,64,00,31,00,32,00,39,00,39,00,5c,00,75,00,70,00,64,00,61,00,74,00,\

65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,dc,0b,8e,2a,43,95,c6,01,00,70,02,00,00,\

00,00,00,b8,fb,01,0c,76,25,c9,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,\

50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,\

00,5c,00,47,00,72,00,65,00,61,00,74,00,69,00,73,00,5c,00,52,00,65,00,67,00,\

52,00,75,00,6e,00,53,00,75,00,69,00,74,00,65,00,5c,00,52,00,65,00,73,00,63,\

00,75,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,00,2e,00,64,00,6c,00,6c,00,\

00,00,2e,00,65,00,78,00,65,00,00,00,38,00,36,00,36,00,65,00,65,00,35,00,32,\

00,33,00,37,00,32,00,37,00,33,00,31,00,38,00,5c,00,75,00,70,00,64,00,61,00,\

74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,1b,16,47,d2,40,c8,01,00,de,0b,\

00,00,00,00,00,14,07,df,58,b4,e5,c5,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,\

5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,00,73,00,79,00,73,00,74,\

00,65,00,6d,00,33,00,32,00,5c,00,4e,00,65,00,72,00,6f,00,43,00,68,00,65,00,\

63,00,6b,00,2e,00,65,00,78,00,65,00,00,00,5c,00,52,00,65,00,61,00,64,00,65,\

00,72,00,5c,00,72,00,65,00,61,00,64,00,65,00,72,00,5f,00,73,00,6c,00,2e,00,\

65,00,78,00,65,00,00,00,63,00,35,00,36,00,39,00,30,00,36,00,39,00,62,00,62,\

00,64,00,34,00,31,00,65,00,34,00,63,00,38,00,66,00,5c,00,75,00,70,00,64,00,\

61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,\

00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,f5,5e,e8,8e,08,c1,01,00,\

60,02,00,00,00,00,00,68,f4,c5,44,b4,e5,c5,01,5c,00,3f,00,3f,00,5c,00,43,00,\

3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,00,73,00,79,00,73,\

00,74,00,65,00,6d,00,33,00,32,00,5c,00,57,00,67,00,61,00,54,00,72,00,61,00,\

79,00,2e,00,65,00,78,00,65,00,00,00,62,00,61,00,74,00,69,00,63,00,73,00,5c,\

00,41,00,73,00,74,00,72,00,6f,00,62,00,61,00,74,00,69,00,63,00,73,00,2e,00,\

65,00,78,00,65,00,00,00,62,00,61,00,38,00,62,00,35,00,31,00,33,00,35,00,64,\

00,63,00,64,00,64,00,62,00,31,00,35,00,63,00,63,00,34,00,5c,00,75,00,70,00,\

64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,\

00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,c2,c3,ab,a2,7b,c7,\

01,80,25,05,00,00,00,00,00,ce,27,6d,4a,b4,e5,c5,01,5c,00,3f,00,3f,00,5c,00,\

43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,00,73,00,79,\

00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,7a,00,69,00,70,00,66,00,6c,00,\

64,00,72,00,2e,00,64,00,6c,00,6c,00,00,00,6c,00,61,00,79,00,65,00,72,00,5c,\

00,77,00,6d,00,70,00,6c,00,61,00,79,00,65,00,72,00,2e,00,65,00,78,00,65,00,\

00,00,2e,00,45,00,58,00,45,00,00,00,58,00,50,00,2d,00,4b,00,42,00,39,00,32,\

00,33,00,37,00,38,00,39,00,2d,00,78,00,38,00,36,00,2d,00,46,00,52,00,41,00,\

2e,00,65,00,78,00,65,00,00,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,\

00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,60,db,8f,d1,\

7e,c4,01,00,32,05,00,00,00,00,00,12,c8,e3,77,70,25,c9,01,5c,00,3f,00,3f,00,\

5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,\

00,69,00,6c,00,65,00,73,00,5c,00,47,00,72,00,65,00,61,00,74,00,69,00,73,00,\

5c,00,52,00,65,00,67,00,52,00,75,00,6e,00,53,00,75,00,69,00,74,00,65,00,5c,\

00,72,00,65,00,67,00,72,00,75,00,6e,00,32,00,2e,00,65,00,78,00,65,00,00,00,\

36,00,65,00,38,00,30,00,35,00,61,00,31,00,61,00,34,00,31,00,32,00,64,00,38,\

00,66,00,35,00,34,00,30,00,36,00,38,00,62,00,62,00,34,00,61,00,31,00,5c,00,\

75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,\

00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,87,3b,\

e4,98,41,c8,01,00,5e,32,00,00,00,00,00,d0,ee,22,10,4a,26,c9,01,5c,00,3f,00,\

3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,\

00,46,00,69,00,6c,00,65,00,73,00,5c,00,4d,00,69,00,63,00,72,00,6f,00,73,00,\

6f,00,66,00,74,00,20,00,4f,00,66,00,66,00,69,00,63,00,65,00,5c,00,4f,00,46,\

00,46,00,49,00,43,00,45,00,31,00,31,00,5c,00,4d,00,53,00,4f,00,48,00,54,00,\

4d,00,45,00,44,00,2e,00,45,00,58,00,45,00,00,00,32,00,30,00,2e,00,45,00,58,\

00,45,00,00,00,34,00,64,00,35,00,63,00,33,00,36,00,38,00,39,00,63,00,35,00,\

5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,\

00,65,00,2e,00,65,00,78,00,65,00,00,00,64,00,61,00,74,00,65,00,2e,00,65,00,\

78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

91,19,9d,ad,82,c7,01,60,ef,00,00,00,00,00,00,b2,44,81,38,4e,45,c9,01,5c,00,\

3f,00,3f,00,5c,00,63,00,3a,00,5c,00,61,00,66,00,30,00,34,00,66,00,31,00,36,\

00,37,00,32,00,63,00,30,00,61,00,30,00,37,00,65,00,65,00,30,00,63,00,66,00,\

61,00,36,00,34,00,32,00,65,00,65,00,62,00,63,00,36,00,39,00,33,00,38,00,39,\

00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,6e,00,6c,00,73,00,64,00,\

6c,00,2e,00,65,00,78,00,65,00,00,00,64,00,30,00,38,00,33,00,65,00,64,00,30,\

00,37,00,62,00,37,00,64,00,30,00,37,00,62,00,38,00,65,00,30,00,35,00,30,00,\

38,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,\

00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,64,00,61,00,74,00,65,00,2e,00,\

65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,f5,89,61,fd,d1,c6,01,60,99,07,00,00,00,00,00,20,2e,0e,af,49,26,c9,01,\

5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,\

00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,46,00,69,00,63,00,68,00,\

69,00,65,00,72,00,73,00,20,00,63,00,6f,00,6d,00,6d,00,75,00,6e,00,73,00,5c,\

00,41,00,68,00,65,00,61,00,64,00,5c,00,4c,00,69,00,62,00,5c,00,4e,00,65,00,\

72,00,6f,00,44,00,69,00,67,00,69,00,74,00,61,00,6c,00,45,00,78,00,74,00,2e,\

00,64,00,6c,00,6c,00,00,00,36,00,66,00,34,00,66,00,32,00,64,00,61,00,66,00,\

34,00,37,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,\

00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,64,00,61,00,74,00,65,00,\

2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,f3,bc,12,b1,b0,c5,01,00,80,1b,00,00,00,00,00,d8,40,aa,72,70,25,\

c9,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,\

00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,4d,00,53,00,4e,00,\

20,00,4d,00,65,00,73,00,73,00,65,00,6e,00,67,00,65,00,72,00,5c,00,75,00,73,\

00,6e,00,73,00,76,00,63,00,2e,00,65,00,78,00,65,00,00,00,61,00,38,00,35,00,\

64,00,66,00,64,00,36,00,35,00,65,00,66,00,65,00,33,00,63,00,65,00,37,00,39,\

00,63,00,61,00,38,00,62,00,63,00,65,00,66,00,30,00,35,00,35,00,63,00,61,00,\

38,00,62,00,64,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,\

00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,64,00,61,00,74,00,\

65,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,ff,ee,72,ea,3b,c7,01,70,7b,01,00,00,00,00,00,84,f2,07,92,\

4d,45,c9,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,57,00,49,00,4e,00,44,\

00,4f,00,57,00,53,00,5c,00,53,00,6f,00,66,00,74,00,77,00,61,00,72,00,65,00,\

44,00,69,00,73,00,74,00,72,00,69,00,62,00,75,00,74,00,69,00,6f,00,6e,00,5c,\

00,44,00,6f,00,77,00,6e,00,6c,00,6f,00,61,00,64,00,5c,00,49,00,6e,00,73,00,\

74,00,61,00,6c,00,6c,00,5c,00,77,00,69,00,6e,00,64,00,6f,00,77,00,73,00,2d,\

00,6b,00,62,00,38,00,39,00,30,00,38,00,33,00,30,00,2d,00,76,00,32,00,2e,00,\

34,00,2d,00,64,00,65,00,6c,00,74,00,61,00,2e,00,65,00,78,00,65,00,00,00,75,\

00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,64,00,61,00,\

74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,80,62,ec,0b,50,41,c9,01,c0,a9,0e,00,00,00,00,00,04,06,\

7b,3f,4e,45,c9,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,\

00,67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,45,00,\

53,00,45,00,54,00,5c,00,45,00,53,00,45,00,54,00,20,00,4e,00,4f,00,44,00,33,\

00,32,00,20,00,41,00,6e,00,74,00,69,00,76,00,69,00,72,00,75,00,73,00,5c,00,\

65,00,6b,00,72,00,6e,00,2e,00,65,00,78,00,65,00,00,00,58,00,45,00,00,00,69,\

00,69,00,73,00,2e,00,65,00,78,00,65,00,00,00,37,00,37,00,65,00,32,00,36,00,\

66,00,34,00,36,00,39,00,62,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,\

00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,64,00,\

61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,ee,72,5d,d4,43,c8,01,00,25,07,00,00,00,00,00,\

e4,76,10,47,b4,e5,c5,01,5c,00,3f,00,3f,00,5c,00,63,00,3a,00,5c,00,38,00,35,\

00,32,00,31,00,30,00,38,00,33,00,38,00,61,00,65,00,63,00,33,00,34,00,33,00,\

30,00,37,00,64,00,31,00,37,00,64,00,66,00,39,00,39,00,33,00,30,00,36,00,33,\

00,36,00,5c,00,6d,00,72,00,74,00,73,00,74,00,75,00,62,00,2e,00,65,00,78,00,\

65,00,00,00,61,00,79,00,2e,00,65,00,78,00,65,00,00,00,53,00,43,00,5c,00,76,\

00,70,00,73,00,68,00,65,00,6c,00,6c,00,32,00,2e,00,64,00,6c,00,6c,00,00,00,\

35,00,35,00,65,00,36,00,30,00,39,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,\

00,5c,00,50,00,72,00,65,00,49,00,6e,00,73,00,74,00,61,00,6c,00,6c,00,2e,00,\

65,00,78,00,65,00,00,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,b1,23,1c,a1,07,c9,01,78,b8,00,00,00,00,\

00,00,14,a5,63,25,4a,26,c9,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,\

00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,\

5c,00,41,00,6e,00,61,00,6c,00,6f,00,67,00,20,00,44,00,65,00,76,00,69,00,63,\

00,65,00,73,00,5c,00,53,00,6f,00,75,00,6e,00,64,00,4d,00,41,00,58,00,5c,00,\

53,00,4d,00,61,00,78,00,34,00,50,00,4e,00,50,00,2e,00,65,00,78,00,65,00,00,\

00,00,00,65,00,77,00,65,00,72,00,2e,00,65,00,78,00,65,00,00,00,34,00,37,00,\

35,00,35,00,64,00,35,00,37,00,63,00,38,00,5c,00,75,00,70,00,64,00,61,00,74,\

00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,\

00,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,6b,d3,45,ef,b1,c4,01,00,30,15,00,\

00,00,00,00,e4,1c,ae,44,b4,e5,c5,01,5c,00,3f,00,3f,00,5c,00,63,00,3a,00,5c,\

00,61,00,66,00,30,00,34,00,66,00,31,00,36,00,37,00,32,00,63,00,30,00,61,00,\

30,00,37,00,65,00,65,00,30,00,63,00,66,00,61,00,36,00,34,00,32,00,65,00,65,\

00,62,00,63,00,36,00,39,00,33,00,38,00,39,00,5c,00,75,00,70,00,64,00,61,00,\

74,00,65,00,5c,00,69,00,64,00,6e,00,64,00,6c,00,2e,00,65,00,78,00,65,00,00,\

00,37,00,30,00,32,00,62,00,37,00,37,00,62,00,64,00,61,00,35,00,37,00,37,00,\

37,00,39,00,38,00,64,00,38,00,39,00,66,00,30,00,5c,00,75,00,70,00,64,00,61,\

00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,\

65,00,00,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,f5,89,61,fd,d1,c6,01,68,ff,\

08,00,00,00,00,00,14,87,de,be,49,26,c9,01,43,00,3a,00,5c,00,57,00,49,00,4e,\

00,44,00,4f,00,57,00,53,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,\

32,00,5c,00,6d,00,73,00,63,00,6f,00,72,00,65,00,65,00,2e,00,64,00,6c,00,6c,\

00,00,00,69,00,6f,00,6e,00,5c,00,44,00,6f,00,77,00,6e,00,6c,00,6f,00,61,00,\

64,00,5c,00,53,00,2d,00,31,00,2d,00,35,00,2d,00,31,00,38,00,5c,00,39,00,36,\

00,37,00,38,00,38,00,37,00,32,00,37,00,37,00,66,00,61,00,36,00,64,00,32,00,\

62,00,31,00,62,00,63,00,36,00,34,00,32,00,64,00,35,00,61,00,31,00,62,00,35,\

00,31,00,33,00,31,00,37,00,34,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,\

5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,64,70,1c,06,4e,45,c9,01,5c,00,3f,00,3f,00,5c,00,43,\

00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,00,53,00,79,00,\

73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,6d,00,6d,00,63,00,73,00,68,00,65,\

00,78,00,74,00,2e,00,64,00,6c,00,6c,00,00,00,2e,00,65,00,78,00,65,00,00,00,\

6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,68,00,61,00,72,00,65,00,64,00,5c,\

00,44,00,57,00,5c,00,44,00,57,00,32,00,30,00,2e,00,45,00,58,00,45,00,00,00,\

64,00,6c,00,6c,00,00,00,31,00,31,00,30,00,62,00,35,00,34,00,5c,00,75,00,70,\

00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,\

65,00,78,00,65,00,00,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,60,db,8f,d1,7e,\

c4,01,00,c6,00,00,00,00,00,00,1e,d1,18,4b,b4,e5,c5,01,5c,00,3f,00,3f,00,5c,\

00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,\

69,00,6c,00,65,00,73,00,5c,00,46,00,69,00,63,00,68,00,69,00,65,00,72,00,73,\

00,20,00,63,00,6f,00,6d,00,6d,00,75,00,6e,00,73,00,5c,00,41,00,68,00,65,00,\

61,00,64,00,5c,00,4c,00,69,00,62,00,5c,00,4e,00,4d,00,49,00,6e,00,64,00,65,\

00,78,00,53,00,74,00,6f,00,72,00,65,00,53,00,76,00,72,00,2e,00,65,00,78,00,\

65,00,00,00,33,00,62,00,62,00,38,00,64,00,65,00,35,00,37,00,63,00,38,00,62,\

00,33,00,66,00,33,00,30,00,38,00,34,00,64,00,5c,00,75,00,70,00,64,00,61,00,\

74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,a7,16,d2,\

bb,b0,c5,01,00,20,07,00,00,00,00,00,a2,f0,07,c0,4e,45,c9,01,5c,00,3f,00,3f,\

00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,\

46,00,69,00,6c,00,65,00,73,00,5c,00,46,00,69,00,63,00,68,00,69,00,65,00,72,\

00,73,00,20,00,63,00,6f,00,6d,00,6d,00,75,00,6e,00,73,00,5c,00,4d,00,69,00,\

63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,68,00,61,00,72,00,65,\

00,64,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,4c,00,69,00,\

76,00,65,00,5c,00,57,00,4c,00,4c,00,6f,00,67,00,69,00,6e,00,50,00,72,00,6f,\

00,78,00,79,00,2e,00,65,00,78,00,65,00,00,00,75,00,70,00,64,00,61,00,74,00,\

65,00,2e,00,65,00,78,00,65,00,00,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,\

00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,b3,\

a7,2e,5e,cd,c6,01,50,c1,01,00,00,00,00,00,c8,63,5d,6a,ad,25,c9,01,5c,00,3f,\

00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,\

20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,46,00,69,00,63,00,68,00,69,00,65,\

00,72,00,73,00,20,00,63,00,6f,00,6d,00,6d,00,75,00,6e,00,73,00,5c,00,41,00,\

70,00,70,00,6c,00,65,00,5c,00,4d,00,6f,00,62,00,69,00,6c,00,65,00,20,00,44,\

00,65,00,76,00,69,00,63,00,65,00,20,00,53,00,75,00,70,00,70,00,6f,00,72,00,\

74,00,5c,00,62,00,69,00,6e,00,5c,00,64,00,69,00,73,00,74,00,6e,00,6f,00,74,\

00,65,00,64,00,2e,00,65,00,78,00,65,00,00,00,34,00,30,00,5c,00,75,00,70,00,\

64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,\

00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,ec,f2,60,42,72,c8,01,10,3a,00,00,00,00,00,00,be,57,7b,b1,4d,45,c9,01,5c,\

00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,\

6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,69,00,50,00,6f,00,64,00,5c,\

00,62,00,69,00,6e,00,5c,00,69,00,50,00,6f,00,64,00,53,00,65,00,72,00,76,00,\

69,00,63,00,65,00,2e,00,65,00,78,00,65,00,00,00,64,00,66,00,30,00,31,00,31,\

00,63,00,39,00,65,00,62,00,35,00,35,00,65,00,64,00,62,00,35,00,65,00,62,00,\

30,00,33,00,64,00,61,00,66,00,62,00,38,00,33,00,64,00,39,00,65,00,31,00,34,\

00,32,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,\

61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,64,00,61,00,74,00,65,00,2e,\

00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,ab,4f,71,73,92,c8,01,28,b1,07,00,00,00,00,00,70,d7,00,aa,4d,45,c9,\

01,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,\

69,00,6c,00,65,00,73,00,5c,00,4a,00,61,00,76,00,61,00,5c,00,6a,00,72,00,65,\

00,31,00,2e,00,35,00,2e,00,30,00,5f,00,30,00,39,00,5c,00,62,00,69,00,6e,00,\

5c,00,63,00,6c,00,69,00,65,00,6e,00,74,00,5c,00,6a,00,76,00,6d,00,2e,00,64,\

00,6c,00,6c,00,00,00,4c,00,69,00,62,00,72,00,61,00,72,00,79,00,4e,00,53,00,\

45,00,2e,00,64,00,6c,00,6c,00,00,00,65,00,00,00,53,00,45,00,2e,00,45,00,58,\

00,45,00,00,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,\

64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,64,00,61,00,74,00,65,\

00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,c6,22,09,0c,76,\

25,c9,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,\

4f,00,57,00,53,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,\

00,77,00,6d,00,70,00,73,00,68,00,65,00,6c,00,6c,00,2e,00,64,00,6c,00,6c,00,\

00,00,65,00,72,00,73,00,5c,00,41,00,74,00,6f,00,6d,00,61,00,64,00,65,00,72,\

00,73,00,2e,00,65,00,78,00,65,00,00,00,63,00,37,00,32,00,61,00,65,00,66,00,\

61,00,35,00,66,00,34,00,39,00,31,00,32,00,62,00,37,00,62,00,33,00,36,00,61,\

00,64,00,63,00,62,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,\

70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,64,00,61,00,74,\

00,65,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,60,db,8f,d1,7e,c4,01,00,40,01,00,00,00,00,00,2c,2b,d5,\

72,70,25,c9,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,\

67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,45,00,53,\

00,45,00,54,00,5c,00,45,00,53,00,45,00,54,00,20,00,4e,00,4f,00,44,00,33,00,\

32,00,20,00,41,00,6e,00,74,00,69,00,76,00,69,00,72,00,75,00,73,00,5c,00,65,\

00,67,00,75,00,69,00,2e,00,65,00,78,00,65,00,00,00,00,00,36,00,66,00,62,00,\

39,00,65,00,36,00,35,00,66,00,35,00,34,00,63,00,61,00,65,00,36,00,35,00,64,\

00,64,00,33,00,37,00,37,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,\

75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,64,00,61,\

00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,65,00,78,00,65,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,0d,7d,57,d4,43,c8,01,00,05,16,00,00,00,00,00,b6,\

66,19,45,b4,e5,c5,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,57,00,49,00,\

4e,00,44,00,4f,00,57,00,53,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,\

00,32,00,5c,00,73,00,68,00,67,00,69,00,6e,00,61,00,2e,00,64,00,6c,00,6c,00,\

00,00,5c,00,44,00,6f,00,77,00,6e,00,6c,00,6f,00,61,00,64,00,5c,00,49,00,6e,\

00,73,00,74,00,61,00,6c,00,6c,00,5c,00,4e,00,44,00,50,00,32,00,30,00,2d,00,\

4b,00,42,00,39,00,32,00,38,00,33,00,36,00,35,00,2d,00,58,00,38,00,36,00,2e,\

00,65,00,78,00,65,00,00,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,\

5c,00,61,00,72,00,70,00,69,00,64,00,66,00,69,00,78,00,2e,00,65,00,78,00,65,\

00,00,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,60,db,8f,d1,7e,c4,01,00,0a,01,00,00,00,00,\

00,3e,b7,41,55,a6,25,c9,01,5c,00,3f,00,3f,00,5c,00,63,00,3a,00,5c,00,39,00,\

62,00,62,00,33,00,37,00,36,00,35,00,35,00,35,00,39,00,32,00,31,00,37,00,34,\

00,30,00,66,00,31,00,38,00,32,00,36,00,65,00,63,00,34,00,62,00,5c,00,6d,00,\

72,00,74,00,73,00,74,00,75,00,62,00,2e,00,65,00,78,00,65,00,00,00,5c,00,31,\

00,33,00,38,00,64,00,63,00,61,00,65,00,36,00,36,00,64,00,38,00,63,00,64,00,\

32,00,65,00,65,00,65,00,32,00,32,00,63,00,66,00,34,00,63,00,64,00,37,00,61,\

00,34,00,66,00,39,00,30,00,64,00,30,00,5c,00,75,00,70,00,64,00,61,00,74,00,\

65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,\

00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,60,53,96,f8,3d,c9,01,c0,af,00,00,00,\

00,00,00,bc,38,30,40,4e,45,c9,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,\

57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,00,73,00,79,00,73,00,74,00,65,\

00,6d,00,33,00,32,00,5c,00,77,00,65,00,62,00,63,00,68,00,65,00,63,00,6b,00,\

2e,00,64,00,6c,00,6c,00,00,00,20,00,42,00,61,00,63,00,6b,00,49,00,74,00,55,\

00,70,00,5c,00,4e,00,42,00,53,00,68,00,65,00,6c,00,6c,00,2e,00,64,00,6c,00,\

6c,00,00,00,65,00,72,00,6d,00,61,00,6e,00,6e,00,20,00,34,00,5c,00,41,00,6c,\

00,65,00,78,00,61,00,6e,00,64,00,72,00,61,00,20,00,4c,00,65,00,64,00,65,00,\

72,00,6d,00,61,00,6e,00,6e,00,20,00,34,00,2e,00,65,00,78,00,65,00,00,00,65,\

00,00,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,60,db,8f,d1,7e,c4,01,00,4c,04,\

00,00,00,00,00,b8,05,fe,69,ad,25,c9,01,5c,00,3f,00,3f,00,5c,00,43,00,3a,00,\

5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,\

00,73,00,5c,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,\

4f,00,66,00,66,00,69,00,63,00,65,00,5c,00,4f,00,46,00,46,00,49,00,43,00,45,\

00,31,00,31,00,5c,00,6d,00,73,00,6f,00,68,00,65,00,76,00,2e,00,64,00,6c,00,\

6c,00,00,00,37,00,36,00,30,00,62,00,34,00,61,00,61,00,61,00,33,00,66,00,39,\

00,36,00,38,00,35,00,62,00,63,00,35,00,30,00,64,00,5c,00,75,00,70,00,64,00,\

61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,\

00,65,00,00,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,e1,a0,40,bf,4a,c3,01,38,\

06,01,00,00,00,00,00,24,76,21,4c,b4,e5,c5,01,5c,00,3f,00,3f,00,5c,00,43,00,\

3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,00,65,00,68,00,6f,\

00,6d,00,65,00,5c,00,65,00,68,00,72,00,65,00,63,00,76,00,72,00,2e,00,65,00,\

78,00,65,00,00,00,72,00,5c,00,6d,00,73,00,6e,00,6d,00,73,00,67,00,72,00,2e,\

00,65,00,78,00,65,00,00,00,62,00,62,00,31,00,66,00,32,00,37,00,65,00,65,00,\

36,00,33,00,35,00,36,00,39,00,30,00,65,00,31,00,61,00,34,00,65,00,32,00,37,\

00,65,00,62,00,36,00,39,00,39,00,63,00,30,00,30,00,61,00,5c,00,75,00,70,00,\

64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,\

00,78,00,65,00,00,00,65,00,00,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,60,d4,f7,60,ce,c5,\

01,00,a0,03,00,00,00,00,00,6e,c6,ff,46,b4,e5,c5,01,5c,00,3f,00,3f,00,5c,00,\

43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,00,53,00,79,\

00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,63,00,73,00,63,00,75,00,69,00,\

2e,00,64,00,6c,00,6c,00,00,00,6f,00,5c,00,46,00,78,00,53,00,76,00,72,00,32,\

00,2e,00,65,00,78,00,65,00,00,00,20,00,53,00,68,00,61,00,72,00,65,00,64,00,\

5c,00,53,00,6f,00,75,00,72,00,63,00,65,00,20,00,45,00,6e,00,67,00,69,00,6e,\

00,65,00,5c,00,4f,00,53,00,45,00,2e,00,45,00,58,00,45,00,00,00,37,00,34,00,\

64,00,34,00,35,00,30,00,33,00,62,00,62,00,5c,00,75,00,70,00,64,00,61,00,74,\

00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,60,db,8f,d1,\

7e,c4,01,00,28,05,00,00,00,00,00,a6,f3,45,9a,4d,45,c9,01,5c,00,3f,00,3f,00,\

5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,\

00,69,00,6c,00,65,00,73,00,5c,00,4d,00,53,00,4e,00,20,00,4d,00,65,00,73,00,\

73,00,65,00,6e,00,67,00,65,00,72,00,5c,00,66,00,73,00,73,00,68,00,65,00,78,\

00,74,00,2e,00,38,00,2e,00,31,00,2e,00,30,00,31,00,37,00,38,00,2e,00,30,00,\

30,00,2e,00,64,00,6c,00,6c,00,00,00,65,00,33,00,30,00,35,00,62,00,61,00,30,\

00,38,00,33,00,31,00,62,00,35,00,62,00,32,00,65,00,31,00,37,00,33,00,5c,00,\

75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,00,65,\

00,2e,00,65,00,78,00,65,00,00,00,65,00,00,00,74,00,65,00,2e,00,65,00,78,00,\

65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,56,95,\

89,ea,3b,c7,01,70,e7,04,00,00,00,00,00,1e,ac,8b,6d,a6,25,c9,01,5c,00,3f,00,\

3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,\

00,46,00,69,00,6c,00,65,00,73,00,5c,00,4c,00,6f,00,67,00,69,00,74,00,65,00,\

63,00,68,00,5c,00,56,00,69,00,64,00,65,00,6f,00,5c,00,4c,00,6f,00,67,00,69,\

00,54,00,72,00,61,00,79,00,2e,00,65,00,78,00,65,00,00,00,76,00,65,00,72,00,\

5f,00,32,00,5f,00,36,00,2e,00,45,00,58,00,45,00,00,00,31,00,31,00,5c,00,4d,\

00,53,00,4f,00,58,00,45,00,56,00,2e,00,44,00,4c,00,4c,00,00,00,36,00,36,00,\

5c,00,75,00,70,00,64,00,61,00,74,00,65,00,5c,00,75,00,70,00,64,00,61,00,74,\

00,65,00,2e,00,65,00,78,00,65,00,00,00,64,00,61,00,74,00,65,00,2e,00,65,00,\

78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

d2,a6,b5,66,6c,c5,01,00,50,03,00,00,00,00,00,40,b6,08,45,b4,e5,c5,01

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\CWD]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\CWD\ff060102423da0000407108e0500]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\CWD\ff060102423da0000407108e0500\1]

"Add1"=hex:02,15,40,a0,10,1e,b8,23,00,8e,d8,8b,0e,14,07,81,e1,00,02,1f,c3

"Change1"=hex:01,1d,50,48,0c,55,8b,ec,b8,00,00,9c,59,81,e1,00,02,55,8b,ec,b8,\

00,00,e8,e7,57,90,90,90

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\INSTBI01]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\INSTBI01\ff06010242935100040720730500]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\INSTBI01\ff06010242935100040720730500\1]

"Change1"=hex:01,49,d0,18,22,45,55,8b,ec,1e,b4,43,32,c0,c5,56,06,cd,21,1f,72,\

0a,c4,5e,0a,26,89,0f,33,c0,eb,04,50,e8,fa,02,5d,4d,cb,55,8b,ec,1e,b8,00,43,\

c5,56,06,cd,21,1f,72,0d,c4,5e,0a,80,e1,1f,26,89,0f,33,c0,eb,04,50,e8,fa,02,\

5d,cb

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\INSTBI02]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\INSTBI02\ff06010242468300040790c80400]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\INSTBI02\ff06010242468300040790c80400\1]

"Change1"=hex:01,51,12,46,26,45,55,8b,ec,56,57,1e,b4,43,32,c0,c5,56,06,cd,21,\

1f,72,0a,c4,5e,0a,26,89,0f,33,c0,eb,04,50,e8,4b,03,5f,5e,5d,4d,cb,45,55,8b,\

ec,1e,b4,43,32,c0,c5,56,06,cd,21,1f,72,0a,c4,5e,0a,80,e1,1f,26,89,0f,33,c0,\

eb,04,50,e8,4b,03,5d,4d,cb,90

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\INSTBIN]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\INSTBIN\ff0601024cab7b000407b0ea0400]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\INSTBIN\ff0601024cab7b000407b0ea0400\2]

"Change1"=hex:01,15,f0,3b,08,3d,03,5f,74,03,e9,06,00,3d,03,5f,90,90,e9,06,00

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\INSTSCR]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\INSTSCR\ff060102c47b1f00040750db0100]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\INSTSCR\ff060102c47b1f00040750db0100\e]

"Change1"=hex:01,13,84,1e,07,45,55,8b,ec,68,00,20,45,55,8b,ec,68,02,20

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\LTSPRINT]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\LTSPRINT\ff060102424f3f000306706600]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\LTSPRINT\ff060102424f3f000306706600\1]

"Change1"=hex:01,0b,9c,1c,03,3d,00,01,3d,00,06

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\MYST]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\MYST\ff060102423bab000407102e0600]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\MYST\ff060102423bab000407102e0600\1]

"Add1"=hex:02,15,40,ab,10,1e,b8,23,00,8e,d8,8b,0e,14,07,81,e1,00,02,1f,c3

"Change1"=hex:01,1d,50,49,0c,55,8b,ec,b8,00,00,9c,59,81,e1,00,02,55,8b,ec,b8,\

00,00,e8,e7,61,90,90,90

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\OUTPOST]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\OUTPOST\ff06010242410f000306801500]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\OUTPOST\ff06010242410f000306801500\1]

"Change1"=hex:01,0f,09,0a,05,9a,73,05,ff,01,b8,03,0a,90,90

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\PALED40]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\PALED40\ff060102420032000407401b0100]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\PALED40\ff060102420032000407401b0100\1]

"Change1"=hex:01,07,b7,21,01,d8,0c

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP\ff0601024211e100040750e50700]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP\ff0601024211e100040750e50700\1]

"Change1"=hex:01,1d,3f,e0,0c,8b,46,e8,8b,56,ea,2b,46,fa,1b,56,fc,b8,50,01,ba,\

00,00,90,90,90,90,90,90

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP\ff0601024237e6000407d00e0800]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP\ff0601024237e6000407d00e0800\1]

"Change1"=hex:01,1d,65,e5,0c,8b,46,e8,8b,56,ea,2b,46,fa,1b,56,fc,b8,50,01,ba,\

00,00,90,90,90,90,90,90

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP\ff060102428203000306401600]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP\ff060102428203000306401600\1]

"Change1"=hex:01,0f,28,03,05,33,ed,55,9a,13,b8,00,4c,cd,21

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP\ff0601025621ef000407f07a0700]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP\ff0601025621ef000407f07a0700\3]

"Change1"=hex:01,1d,f3,45,0c,8b,4e,f0,8b,5e,f2,2b,4e,f4,1b,5e,f6,b9,50,01,bb,\

00,00,90,90,90,90,90,90

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP\ff0601025642ea00040750550700]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP\ff0601025642ea00040750550700\3]

"Change1"=hex:01,1d,b7,41,0c,8b,4e,f0,8b,5e,f2,2b,4e,f4,1b,5e,f6,b9,50,01,bb,\

00,00,90,90,90,90,90,90

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP\ff060102564ee6000407b0670700]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP\ff060102564ee6000407b0670700\3]

"Change1"=hex:01,15,7c,35,08,66,8b,46,fc,66,2b,46,f0,66,b8,50,01,00,00,90,90

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP\ff060102565ce5000407d0600700]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP\ff060102565ce5000407d0600700\3]

"Change1"=hex:01,1d,fd,34,0c,8b,4e,f0,8b,5e,f2,2b,4e,f4,1b,5e,f6,b9,50,01,bb,\

00,00,90,90,90,90,90,90

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP\ff0601025674e6000407704d0700]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP\ff0601025674e6000407704d0700\3]

"Change1"=hex:01,1d,cf,3d,0c,8b,4e,f0,8b,5e,f2,2b,4e,f4,1b,5e,f6,b9,50,01,bb,\

00,00,90,90,90,90,90,90

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP\ff06010256b1dd00040760ef0b00]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP\ff06010256b1dd00040760ef0b00\3]

"Change1"=hex:01,15,2c,3b,08,66,8b,46,f0,66,2b,46,f4,66,b8,50,01,00,00,90,90

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP\ff06010256c1ef00040770fb0600]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP\ff06010256c1ef00040770fb0600\3]

"Change1"=hex:01,1d,fd,38,0c,8b,46,f0,8b,56,f2,2b,46,f4,1b,56,f6,b8,50,01,ba,\

00,00,90,90,90,90,90,90

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP\ff06010256e2e400040750600700]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP\ff06010256e2e400040750600700\3]

"Change1"=hex:01,1d,fd,34,0c,8b,4e,f0,8b,5e,f2,2b,4e,f4,1b,5e,f6,b9,50,01,bb,\

00,00,90,90,90,90,90,90

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP\ff06010256eae500040710640700]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP\ff06010256eae500040710640700\3]

"Change1"=hex:01,1d,fd,34,0c,8b,4e,f0,8b,5e,f2,2b,4e,f4,1b,5e,f6,b9,50,01,bb,\

00,00,90,90,90,90,90,90

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP\ff06010256faef00040710c50600]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP\ff06010256faef00040710c50600\3]

"Change1"=hex:01,1d,b7,33,0c,8b,46,f0,8b,56,f2,2b,46,f4,1b,56,f6,b8,50,01,ba,\

00,00,90,90,90,90,90,90

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP16]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP16\ff0601024cd875000407a0db0100]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\SETUP16\ff0601024cd875000407a0db0100\2]

"Change1"=hex:01,23,17,42,0f,8b,c8,8b,d0,8b,5e,0e,2a,e4,89,07,8a,cd,2a,ed,b9,\

0a,00,ba,03,0a,8b,5e,0e,2a,e4,90,90,90,90

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\USA]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\USA\ff06010242059b00040710780600]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\USA\ff06010242059b00040710780600\1]

"Change1"=hex:01,1d,95,44,0c,55,8b,ec,b8,00,00,9c,59,81,e1,00,02,55,8b,ec,b8,\

00,00,e8,67,56,90,90,90

"Change2"=hex:01,25,05,9b,10,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

1e,b8,23,00,8e,d8,8b,0e,14,07,81,e1,00,02,1f,c3

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\VB]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\VB\ff060102ec353f00040780c81300]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\VB\ff060102ec353f00040780c81300\12]

"Change1"=hex:01,11,1b,03,06,81,3e,ba,31,34,03,81,3e,ba,31,09,03

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\VB40016]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\VB40016\ff0702021401ee3e000407d0460e00]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\VB40016\ff0702021401ee3e000407d0460e00\16]

"Change1"=hex:01,11,6d,2a,06,81,3e,6e,36,34,03,81,3e,6e,36,09,03

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\WISE0001]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\WISE0001\ff0601024cf4ef000407604e0100]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppPatches\WISE0001\ff0601024cf4ef000407604e0100\2]

"Change1"=hex:01,0f,8e,00,05,9a,4b,00,0f,02,b8,0c,29,90,90

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\DOS Devices]

"AUX"="\\DosDevices\\COM1"

"MAILSLOT"="\\Device\\MailSlot"

"NUL"="\\Device\\Null"

"PIPE"="\\Device\\NamedPipe"

"PRN"="\\DosDevices\\LPT1"

"UNC"="\\Device\\Mup"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\Environment]

"ComSpec"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\

74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,63,\

00,6d,00,64,00,2e,00,65,00,78,00,65,00,00,00

"Path"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,\

00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,3b,00,25,00,\

53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,3b,00,25,\

00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,\

53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,57,00,62,00,65,00,6d,\

00,00,00

"windir"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,\

00,25,00,00,00

"FP_NO_HOST_CHECK"="NO"

"OS"="Windows_NT"

"PROCESSOR_ARCHITECTURE"="x86"

"PROCESSOR_LEVEL"="15"

"PROCESSOR_IDENTIFIER"="x86 Family 15 Model 44 Stepping 2, AuthenticAMD"

"PROCESSOR_REVISION"="2c02"

"NUMBER_OF_PROCESSORS"="1"

"PATHEXT"=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH"

"TEMP"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,\

00,25,00,5c,00,54,00,45,00,4d,00,50,00,00,00

"TMP"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,\

25,00,5c,00,54,00,45,00,4d,00,50,00,00,00

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\Executive]

"AdditionalCriticalWorkerThreads"=dword:00000000

"AdditionalDelayedWorkerThreads"=dword:00000000

"PriorityQuantumMatrix"=hex:64,b0,db,57,00,00,00,00,7d,f4,c6,01

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\FileRenameOperations]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\kernel]

"ObUnsecureGlobalNames"=hex(7):6e,00,65,00,74,00,66,00,78,00,63,00,75,00,73,00,\

74,00,6f,00,6d,00,70,00,65,00,72,00,66,00,63,00,6f,00,75,00,6e,00,74,00,65,\

00,72,00,73,00,2e,00,31,00,2e,00,30,00,00,00,53,00,68,00,61,00,72,00,65,00,\

64,00,50,00,65,00,72,00,66,00,49,00,50,00,43,00,42,00,6c,00,6f,00,63,00,6b,\

00,00,00,43,00,6f,00,72,00,5f,00,50,00,72,00,69,00,76,00,61,00,74,00,65,00,\

5f,00,49,00,50,00,43,00,42,00,6c,00,6f,00,63,00,6b,00,00,00,43,00,6f,00,72,\

00,5f,00,50,00,75,00,62,00,6c,00,69,00,63,00,5f,00,49,00,50,00,43,00,42,00,\

6c,00,6f,00,63,00,6b,00,5f,00,00,00,00,00

"obcaseinsensitive"=dword:00000001

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\KnownDLLs]

"advapi32"="advapi32.dll"

"comdlg32"="comdlg32.dll"

"DllDirectory"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\

00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,00,00

"gdi32"="gdi32.dll"

"imagehlp"="imagehlp.dll"

"kernel32"="kernel32.dll"

"lz32"="lz32.dll"

"ole32"="ole32.dll"

"oleaut32"="oleaut32.dll"

"olecli32"="olecli32.dll"

"olecnv32"="olecnv32.dll"

"olesvr32"="olesvr32.dll"

"olethk32"="olethk32.dll"

"rpcrt4"="rpcrt4.dll"

"shell32"="shell32.dll"

"url"="url.dll"

"urlmon"="urlmon.dll"

"user32"="user32.dll"

"version"="version.dll"

"wininet"="wininet.dll"

"wldap32"="wldap32.dll"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\Memory Management]

"ClearPageFileAtShutdown"=dword:00000000

"DisablePagingExecutive"=dword:00000000

"LargeSystemCache"=dword:00000000

"NonPagedPoolQuota"=dword:00000000

"NonPagedPoolSize"=dword:00000000

"PagedPoolQuota"=dword:00000000

"PagedPoolSize"=dword:00000000

"SecondLevelDataCache"=dword:00000000

"SystemPages"=dword:00000000

"PagingFiles"=hex(7):43,00,3a,00,5c,00,70,00,61,00,67,00,65,00,66,00,69,00,6c,\

00,65,00,2e,00,73,00,79,00,73,00,20,00,31,00,33,00,34,00,34,00,20,00,32,00,\

36,00,38,00,38,00,00,00,00,00

"PhysicalAddressExtension"=dword:00000001

"SessionViewSize"=dword:00000030

"SessionPoolSize"=dword:00000004

"WriteWatch"=dword:00000001

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\Memory Management\PrefetchParameters]

"VideoInitTime"=dword:00000157

"EnablePrefetcher"=dword:00000003

"AppLaunchMaxNumPages"=dword:00000fa0

"AppLaunchMaxNumSections"=dword:000000aa

"AppLaunchTimerPeriod"=hex:80,69,67,ff,ff,ff,ff,ff

"BootMaxNumPages"=dword:0001f400

"BootMaxNumSections"=dword:00000ff0

"BootTimerPeriod"=hex:00,f2,d8,f8,ff,ff,ff,ff

"MaxNumActiveTraces"=dword:00000008

"MaxNumSavedTraces"=dword:00000008

"RootDirPath"="Prefetch"

"HostingAppList"="DLLHOST.EXE,MMC.EXE,RUNDLL32.EXE"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\Power]

"AcProcessorPolicy"=hex:01,00,00,00,00,00,00,00,00,00,00,00,03,00,00,00,a0,86,\

01,00,a0,86,01,00,a0,86,01,00,28,32,00,00,02,00,00,00,a0,86,01,00,a0,86,01,\

00,a0,86,01,00,28,3c,00,00,03,00,00,00,a0,86,01,00,a0,86,01,00,a0,86,01,00,\

28,50,00,00,01,00,00,00

"DcProcessorPolicy"=hex:01,00,00,00,03,00,00,00,00,00,00,00,03,00,00,00,a0,86,\

01,00,a0,86,01,00,a0,86,01,00,0a,14,00,00,02,00,00,00,a0,86,01,00,a0,86,01,\

00,a0,86,01,00,14,28,00,00,03,00,00,00,a0,86,01,00,a0,86,01,00,a0,86,01,00,\

14,46,00,00,01,00,00,00

"AcPolicy"=hex:01,00,00,00,00,00,00,00,03,00,00,00,10,00,00,00,02,00,00,00,03,\

00,00,00,00,00,00,00,02,00,00,00,01,00,00,00,00,00,00,00,01,00,00,00,00,00,\

00,00,02,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00,32,00,00,00,02,00,00,\

00,04,00,00,00,02,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00,03,00,00,00,\

01,00,00,00,03,00,00,00,03,00,00,00,00,00,00,c0,01,00,00,00,05,00,00,00,01,\

00,00,00,0a,00,00,00,00,00,00,00,03,00,00,00,01,00,01,00,01,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,02,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,03,00,00,00,00,00,b0,04,00,00,\

71,fb,91,7c,34,f2,06,00,fe,e1,91,7c,f4,f2,06,00,00,00,00,00,01,64,64,32,02,\

00,00,00,04,00,00,c0,00,00,00,00

"DcPolicy"=hex:01,00,00,00,00,00,00,00,03,00,00,00,10,00,00,00,02,00,00,00,03,\

00,00,00,00,00,00,00,02,00,00,00,01,00,00,00,00,00,00,00,01,00,00,00,00,00,\

00,00,02,00,00,00,00,00,00,00,00,00,00,00,2c,01,00,00,32,03,2d,00,04,00,00,\

00,04,00,00,00,02,00,00,00,01,00,00,00,32,00,31,00,84,03,00,00,03,00,00,00,\

01,00,00,00,03,00,00,00,03,00,00,00,00,00,00,c0,01,00,00,00,05,00,00,00,01,\

00,00,00,0a,00,00,00,00,00,00,00,03,00,00,00,01,00,01,00,01,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,02,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,03,00,00,00,00,00,2c,01,00,00,\

01,00,32,00,35,00,33,00,34,00,35,00,35,00,34,00,58,02,00,00,01,50,64,32,02,\

00,00,00,04,00,00,c0,00,00,00,00

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\SFC]

"ProgramFilesDir"="C:\\Program Files"

"CommonFilesDir"="C:\\Program Files\\Fichiers communs"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\SubSystems]

"Debug"=hex(2):00,00

"Kmode"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,\

00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,77,00,\

69,00,6e,00,33,00,32,00,6b,00,2e,00,73,00,79,00,73,00,00,00

"Optional"=hex(7):50,00,6f,00,73,00,69,00,78,00,00,00,00,00

"Posix"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,\

00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,70,00,\

73,00,78,00,73,00,73,00,2e,00,65,00,78,00,65,00,00,00

"Required"=hex(7):44,00,65,00,62,00,75,00,67,00,00,00,57,00,69,00,6e,00,64,00,\

6f,00,77,00,73,00,00,00,00,00

"Windows"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\

74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,63,\

00,73,00,72,00,73,00,73,00,2e,00,65,00,78,00,65,00,20,00,4f,00,62,00,6a,00,\

65,00,63,00,74,00,44,00,69,00,72,00,65,00,63,00,74,00,6f,00,72,00,79,00,3d,\

00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,53,00,68,00,61,00,\

72,00,65,00,64,00,53,00,65,00,63,00,74,00,69,00,6f,00,6e,00,3d,00,31,00,30,\

00,32,00,34,00,2c,00,33,00,30,00,37,00,32,00,2c,00,35,00,31,00,32,00,20,00,\

57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,3d,00,4f,00,6e,00,20,00,53,00,75,\

00,62,00,53,00,79,00,73,00,74,00,65,00,6d,00,54,00,79,00,70,00,65,00,3d,00,\

57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,53,00,65,00,72,00,76,00,65,\

00,72,00,44,00,6c,00,6c,00,3d,00,62,00,61,00,73,00,65,00,73,00,72,00,76,00,\

2c,00,31,00,20,00,53,00,65,00,72,00,76,00,65,00,72,00,44,00,6c,00,6c,00,3d,\

00,77,00,69,00,6e,00,73,00,72,00,76,00,3a,00,55,00,73,00,65,00,72,00,53,00,\

65,00,72,00,76,00,65,00,72,00,44,00,6c,00,6c,00,49,00,6e,00,69,00,74,00,69,\

00,61,00,6c,00,69,00,7a,00,61,00,74,00,69,00,6f,00,6e,00,2c,00,33,00,20,00,\

53,00,65,00,72,00,76,00,65,00,72,00,44,00,6c,00,6c,00,3d,00,77,00,69,00,6e,\

00,73,00,72,00,76,00,3a,00,43,00,6f,00,6e,00,53,00,65,00,72,00,76,00,65,00,\

72,00,44,00,6c,00,6c,00,49,00,6e,00,69,00,74,00,69,00,61,00,6c,00,69,00,7a,\

00,61,00,74,00,69,00,6f,00,6e,00,2c,00,32,00,20,00,50,00,72,00,6f,00,66,00,\

69,00,6c,00,65,00,43,00,6f,00,6e,00,74,00,72,00,6f,00,6c,00,3d,00,4f,00,66,\

00,66,00,20,00,4d,00,61,00,78,00,52,00,65,00,71,00,75,00,65,00,73,00,74,00,\

54,00,68,00,72,00,65,00,61,00,64,00,73,00,3d,00,31,00,36,00,00,00

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\SubSystems\CSRSS]

"CsrSrvSharedSectionBase"=dword:7f6f0000

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\WPA]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\WPA\Key-CJ27J3P2XV9J9JCPB4DVT]

"ProductID"="76413-365-0870247-22790"

"DigitalProductID"=hex:a4,00,00,00,03,00,00,00,37,36,34,31,33,2d,33,36,35,2d,\

30,38,37,30,32,34,37,2d,32,32,37,39,30,00,2c,00,00,00,41,32,32,2d,30,30,30,\

30,31,00,00,00,00,00,00,00,60,92,85,2b,f8,73,8f,16,4b,66,db,59,e9,54,00,00,\

00,00,00,00,ca,e6,38,45,92,01,0e,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,35,33,35,32,32,00,00,00,00,00,00,00,b2,04,\

00,00,36,f3,a2,54,80,03,00,00,8e,01,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,69,57,38,dc,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\WPA\MedCtrUpg]

"IsLegacyMCE"=dword:00000000

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\WPA\MediaCenter]

"Installed"=dword:00000001

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\WPA\PIDRange]

"SKURange"="EHome"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\WPA\PnP]

"seed"=dword:68a1ce24

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\WPA\SigningHash-6KCM6KFTX6MD62]

"SigningHashData"=hex:6e,8a,42,44,42,08,0a,64,e7,17,4a,82,36,34,0e,37,4b,60,c2,\

7b,a5,97,f6,06,1b,a9,fb,99,57,a7,a8,a9,f2,1d,57,06,cd,b4,23,9c,9a,0f,f9,86,\

5b,7f,fc,e7,d5,6d,51,14,02,17,49,f7

ⴠⴭⴭⴭⴭⴭⴭ਍Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDriveAutoRun"=dword:03ffffff

"NoDriveTypeAutoRun"=dword:00000143

"NoDrives"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum]

"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"=dword:00000001

"{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}"=dword:40000021

"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"=dword:00000020

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ratings]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system]

"dontdisplaylastusername"=dword:00000000

"legalnoticecaption"=""

"legalnoticetext"=""

"shutdownwithoutlogon"=dword:00000001

"undockwithoutlogon"=dword:00000001

"InstallVisualStyle"=hex(2):43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,\

00,53,00,5c,00,52,00,65,00,73,00,6f,00,75,00,72,00,63,00,65,00,73,00,5c,00,\

54,00,68,00,65,00,6d,00,65,00,73,00,5c,00,52,00,6f,00,79,00,61,00,6c,00,65,\

00,5c,00,52,00,6f,00,79,00,61,00,6c,00,65,00,2e,00,6d,00,73,00,73,00,74,00,\

79,00,6c,00,65,00,73,00,00,00

"InstallTheme"=hex(2):43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,\

00,5c,00,52,00,65,00,73,00,6f,00,75,00,72,00,63,00,65,00,73,00,5c,00,54,00,\

68,00,65,00,6d,00,65,00,73,00,5c,00,52,00,6f,00,79,00,61,00,6c,00,65,00,2e,\

00,74,00,68,00,65,00,6d,00,65,00,00,00

"DisableRegistryTools"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Uninstall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate]

ⴠⴭⴭⴭⴭⴭⴭ਍

Falkra · le 7 février 2009

Ouvre le bloc notes. Copie-colle dedans le contenu de la boite code qui suit, sans ligne blanche vide au début, ça doit commencer par Windows Registry Editor Version 5.00 comme ci dessous :

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]
"BootExecute"=hex(7):61,00,75,00,74,00,6f,00,63,00,68,00,65,00,63,00,6b,00,20,\
 00,61,00,75,00,74,00,6f,00,63,00,68,00,6b,00,20,00,2a,00,00,00,00,00

Sauvegarde cela sur le bureau en donnant comme nom lib.reg (pas d'extension texte donc).
Le fichier va être créé avec une icône de base de registre, double clique dessus et confirme pour l'ajouter au registre.

Confirme moi que ça marche.

marie_hockey31 · le 7 février 2009

ça marche!

Falkra · le 7 février 2009

Rends toi sur ce lien : Virus Total

Clique sur le bouton Parcourir...
Parcours tes dossiers jusque à ce fichier, si tu le trouves :

C:\windows\system32\winlogon.exe

Clique sur Envoyer le fichier, et si VirusTotal dit que le fichier a déjà été analysé, clique sur le bouton Reanalyse le fichier maintenant.
Laisse le site travailler tant que "Situation actuelle : en cours d'analyse" est affiché.
Il est possible que le fichier soit mis en file d'attente en raison d'un grand nombre de demandes d'analyses. Dans ce cas, il te faudra patienter sans réactualiser la page.
Lorsque l'analyse est terminée ("Situation actuelle: terminé"), clique sur Formaté (en haut à gauche)
Une nouvelle fenêtre de ton navigateur va apparaître
Clique alors sur cette image :
Fais un clic droit sur la page, et choisis Sélectionner tout, puis copier
Enfin colle le résultat dans ta prochaine réponse.
NB : Peu importe le résultat, il est important de me communiquer le résultat de toute l'analyse.

Il est possible que tes outils de sécurité réagissent à l'envoi du fichier, auquel cas il faudra leur faire ignorer les alertes.

Tu auras sans doute besoin d'afficher les fichiers cachés et ceux du système :

http://www.libellules.ch/afficher_fichiers.php

marie_hockey31 · le 7 février 2009

Fichier winlogon.exe reçu le 2009.02.07 21:04:51 (CET)Antivirus Version Dernière mise à jour Résultat

a-squared 4.0.0.93 2009.02.06 -

AhnLab-V3 5.0.0.2 2009.02.07 -

AntiVir 7.9.0.76 2009.02.07 -

Authentium 5.1.0.4 2009.02.07 -

Avast 4.8.1335.0 2009.02.07 -

AVG 8.0.0.229 2009.02.07 -

BitDefender 7.2 2009.02.07 -

CAT-QuickHeal 10.00 2009.02.07 -

ClamAV 0.94.1 2009.02.07 -

Comodo 969 2009.02.07 -

DrWeb 4.44.0.09170 2009.02.07 -

eSafe 7.0.17.0 2009.02.05 -

eTrust-Vet 31.6.6346 2009.02.07 -

F-Prot 4.4.4.56 2009.02.06 -

F-Secure 8.0.14470.0 2009.02.07 -

Fortinet 3.117.0.0 2009.02.07 -

GData 19 2009.02.07 -

Ikarus T3.1.1.45.0 2009.02.07 -

K7AntiVirus 7.10.623 2009.02.07 -

Kaspersky 7.0.0.125 2009.02.07 -

McAfee 5518 2009.02.07 -

McAfee+Artemis 5517 2009.02.06 -

Microsoft 1.4306 2009.02.06 -

NOD32 3836 2009.02.07 -

Norman 6.00.02 2009.02.06 -

nProtect 2009.1.8.0 2009.02.07 -

Panda 9.5.1.2 2009.02.07 -

PCTools 4.4.2.0 2009.02.07 -

Prevx1 V2 2009.02.07 -

Rising 21.15.50.00 2009.02.07 -

SecureWeb-Gateway 6.7.6 2009.02.07 -

Sophos 4.38.0 2009.02.07 -

Sunbelt 3.2.1835.2 2009.01.16 -

Symantec 10 2009.02.07 -

TheHacker 6.3.1.5.248 2009.02.07 -

TrendMicro 8.700.0.1004 2009.02.06 -

VBA32 3.12.8.12 2009.02.05 -

ViRobot 2009.2.6.1594 2009.02.06 -

VirusBuster 4.5.11.0 2009.02.07 -

Information additionnelle

File size: 506368 bytes

MD5...: 8d52aedd07247b743a4d9bd372f69109

SHA1..: f1bfc0d191d815ea09af3efcdbbe7797da2e880d

SHA256: 25f0be4b5a61778fdac368835908a6a5e399509ec9ef84d5c00bca6f98e71c57

SHA512: cd2b3a8850df70cfdb67864df4a9ee4c8bcd26a43db3efaedb9811e85052c2d3 821d5ab84036d260162787119aab7b92584f6d3254ec91af5d511e981ec0d267

ssdeep: 6144:7YuZlm8LRlBw662R1pqrc7FmxSqVw/T+SN1TrSnmhPnpdcbFIzdFz/N5Wjy fTNQJ:7VLBhic7Qy1vSneJFDNhp8b

PEiD..: -

TrID..: File type identification Win64 Executable Generic (80.9%) Win32 Executable Generic (8.0%) Win32 Dynamic Link Library (generic) (7.1%) Generic Win/DOS Executable (1.8%) DOS Executable Generic (1.8%)

PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x3d353 timedatestamp.....: 0x41107edc (Wed Aug 04 06:14:52 2004) machinetype.......: 0x14c (I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x6f288 0x6f400 6.82 04f9c7e06d665f55b445bc73b1215882 .data 0x71000 0x4d90 0x2000 6.21 662eceb591c7df2d6e365ae6b9b2da15 .rsrc 0x76000 0xa19c 0xa200 3.69 e9a6edacc9ec7d341c57eae2b54e9ae3 ( 20 imports ) > ADVAPI32.dll: ConvertStringSecurityDescriptorToSecurityDescriptorA, A_SHAInit, A_SHAUpdate, A_SHAFinal, LsaStorePrivateData, LsaRetrievePrivateData, LsaNtStatusToWinError, CryptGetUserKey, CryptGetKeyParam, CryptEncrypt, CryptSetProvParam, CryptSignHashW, CryptDeriveKey, CryptGetProvParam, RegOpenCurrentUser, RegDeleteKeyW, AddAccessAllowedAceEx, RegSetKeySecurity, I_ScSendTSMessage, MD5Init, MD5Update, MD5Final, SetFileSecurityA, AllocateLocallyUniqueId, LsaOpenPolicy, LsaQueryInformationPolicy, LsaFreeMemory, LsaClose, RegNotifyChangeKeyValue, QueryServiceConfigW, SetKernelObjectSecurity, ConvertStringSecurityDescriptorToSecurityDescriptorW, RegEnumKeyExW, GetCurrentHwProfileW, RegCloseKey, RegQueryValueExW, RegOpenKeyW, FreeSid, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, AddAccessAllowedAce, InitializeAcl, GetLengthSid, AllocateAndInitializeSid, RegOpenKeyExW, CreateProcessAsUserW, DuplicateTokenEx, CloseServiceHandle, ControlService, StartServiceW, QueryServiceStatus, OpenServiceW, OpenSCManagerW, EqualSid, GetTokenInformation, RegSetValueExW, RegCreateKeyExW, CryptGenRandom, CryptDestroyHash, CryptVerifySignatureW, CryptSetHashParam, CryptGetHashParam, CryptHashData, CryptCreateHash, CryptDecrypt, ReportEventW, RegisterEventSourceW, CryptImportKey, CryptAcquireContextW, CryptReleaseContext, CryptDestroyKey, RegEnumValueW, RegQueryInfoKeyW, RegDeleteValueW, CredFree, CredDeleteW, CredEnumerateW, CopySid, GetSidLengthRequired, GetSidSubAuthority, GetSidSubAuthorityCount, GetUserNameW, OpenThreadToken, EnumServicesStatusW, ImpersonateLoggedOnUser, RegQueryValueExA, CheckTokenMembership, DeregisterEventSource, LsaGetUserName, RevertToSelf, LookupAccountSidW, IsValidSid, SetTokenInformation, LogonUserW, LookupAccountNameW, OpenProcessToken, SynchronizeWindows31FilesAndWindowsNTRegistry, QueryWindows31FilesMigration, AdjustTokenPrivileges, RegQueryInfoKeyA > AUTHZ.dll: AuthzInitializeResourceManager, AuthzAccessCheck, AuthziFreeAuditEventType, AuthziInitializeAuditEvent, AuthziInitializeAuditParams, AuthziInitializeAuditEventType, AuthziLogAuditEvent, AuthzFreeAuditEvent, AuthzFreeResourceManager, AuthzFreeHandle > CRYPT32.dll: CryptImportPublicKeyInfo, CryptVerifyMessageSignature, CertCreateCertificateContext, CertSetCertificateContextProperty, CertVerifyCertificateChainPolicy, CryptSignMessage, CertCloseStore, CertComparePublicKeyInfo, CryptExportPublicKeyInfo, CertFindExtension, CryptDecryptMessage, CertGetCertificateContextProperty, CertAddCertificateContextToStore, CertOpenStore, CertVerifySubjectCertificateContext, CertGetIssuerCertificateFromStore, CertDuplicateCertificateContext, CertFreeCertificateContext, CertEnumCertificatesInStore, CryptImportPublicKeyInfoEx > GDI32.dll: RemoveFontResourceW, AddFontResourceW > KERNEL32.dll: WTSGetActiveConsoleSessionId, GetTimeFormatW, GetUserDefaultLCID, FileTimeToSystemTime, FileTimeToLocalFileTime, GetProcAddress, LoadLibraryW, GetModuleHandleW, SystemTimeToFileTime, GetSystemTime, SetLastError, TerminateProcess, GetCurrentProcess, CreateTimerQueueTimer, CreateThread, lstrcpynW, GetShortPathNameW, GetProfileStringW, FreeLibrary, ReleaseSemaphore, CreateSemaphoreW, GetSystemInfo, GetComputerNameW, GetEnvironmentVariableW, WaitForSingleObjectEx, LoadResource, FindResourceW, SetThreadExecutionState, DeleteTimerQueueTimer, ResetEvent, GetSystemDirectoryW, TransactNamedPipe, SetNamedPipeHandleState, GetTickCount, CreateFileW, GlobalGetAtomNameW, VirtualLock, VirtualQuery, GetDriveTypeW, Beep, OpenMutexW, QueueUserWorkItem, LeaveCriticalSection, EnterCriticalSection, DisconnectNamedPipe, SearchPathW, lstrcatW, LocalReAlloc, ExpandEnvironmentStringsW, TerminateThread, ResumeThread, GetDiskFreeSpaceExW, GlobalMemoryStatusEx, DeleteFileW, WriteProfileStringW, ReadFile, FindVolumeClose, FindNextVolumeW, FindFirstVolumeW, FormatMessageW, SetPriorityClass, MoveFileExW, WaitForMultipleObjectsEx, GetExitCodeProcess, SleepEx, InterlockedExchange, FindClose, FindFirstFileW, GetWindowsDirectoryW, SetTimerQueueTimer, GetComputerNameA, GetVersionExW, VerSetConditionMask, WriteFile, WaitNamedPipeW, WaitForMultipleObjects, ConnectNamedPipe, DuplicateHandle, OpenProcess, GetOverlappedResult, GetVersionExA, lstrcmpW, SetEnvironmentVariableW, UnregisterWait, CreateNamedPipeW, CreateRemoteThread, CreateActCtxW, GetModuleFileNameW, ExitProcess, LoadLibraryExW, SetErrorMode, SetUnhandledExceptionFilter, GetPrivateProfileStringW, LocalSize, VirtualAlloc, VirtualQueryEx, DebugBreak, CreateFileA, InitializeCriticalSection, ProcessIdToSessionId, SetInformationJobObject, AssignProcessToJobObject, TerminateJobObject, PostQueuedCompletionStatus, PulseEvent, GetQueuedCompletionStatus, CreateIoCompletionPort, CreateJobObjectW, ActivateActCtx, DeactivateActCtx, InterlockedCompareExchange, LoadLibraryA, QueryPerformanceCounter, GetSystemTimeAsFileTime, UnhandledExceptionFilter, GetModuleHandleA, GetStartupInfoA, GetCurrentProcessId, SetThreadPriority, GetCurrentThreadId, lstrcmpiW, GetProfileIntW, LoadLibraryExA, lstrcpyW, lstrlenW, Sleep, LocalAlloc, CreateEventW, GetExitCodeThread, SetThreadAffinityMask, GetProcessAffinityMask, CreateWaitableTimerW, CreateMutexW, OpenEventW, RegisterWaitForSingleObject, WaitForSingleObject, CreateProcessW, SetWaitableTimer, ReleaseMutex, SetEvent, UnregisterWaitEx, CloseHandle, lstrlenA, lstrcpyA, MultiByteToWideChar, GetACP, WideCharToMultiByte, HeapAlloc, GetProcessHeap, HeapFree, lstrcpynA, UnmapViewOfFile, MapViewOfFile, CreateFileMappingW, lstrcmpiA, GetFileSize, SetFilePointer, GlobalAlloc, GlobalFree, GetLastError, LocalFree, lstrcatA, lstrcmpA, GetLogicalDriveStringsA, GetDriveTypeA, GetVolumeInformationW, GlobalMemoryStatus, CreateMutexA, FindResourceExW, LockResource, SizeofResource, VerifyVersionInfoW, GetSystemDirectoryA, GetCurrentThread, DelayLoadFailureHook, BaseInitAppcompatCacheSupport, OpenProfileUserMapping, CloseProfileUserMapping, BaseCleanupAppcompatCacheSupport, InitializeCriticalSectionAndSpinCount, VirtualProtect, CreateEventA, TlsSetValue, DeleteCriticalSection, TlsGetValue, TlsAlloc, VirtualFree, TlsFree > msvcrt.dll: _vsnwprintf, wcslen, wcsncpy, wcsstr, atoi, wcstok, memmove, wcschr, swprintf, swscanf, _local_unwind2, _wcslwr, wcscmp, _snwprintf, malloc, _c_exit, _exit, _XcptFilter, _cexit, exit, _acmdln, __getmainargs, _initterm, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, __3@YAXPAX@Z, __2@YAPAXI@Z, __CxxFrameHandler, _itow, _snprintf, _wtol, _strnicmp, sscanf, wcstombs, sprintf, strchr, strncmp, atof, _ftol, isspace, __set_app_type, wcscpy, _controlfp, wcsncmp, _wcsupr, ceil, wcscat, _except_handler3, free, _wcsicmp > NDdeApi.dll: -, -, -, - > ntdll.dll: RtlAllocateHeap, NtPowerInformation, NtSetSystemPowerState, NtRaiseHardError, RtlDeleteCriticalSection, NtOpenSymbolicLinkObject, NtReplyPort, NtCompleteConnectPort, NtReplyWaitReceivePort, NtAcceptConnectPort, NtCreatePort, RtlConvertSidToUnicodeString, RtlFreeUnicodeString, NtLockProductActivationKeys, RtlTimeToTimeFields, NtUnmapViewOfSection, NtMapViewOfSection, NtOpenSection, NtQuerySymbolicLinkObject, NtQueryVolumeInformationFile, NtSetSecurityObject, RtlAdjustPrivilege, NtOpenFile, NtFsControlFile, RtlAllocateAndInitializeSid, RtlDestroyEnvironment, RtlFreeHeap, NtQueryInformationToken, NtShutdownSystem, RtlEnterCriticalSection, RtlLeaveCriticalSection, RtlInitializeCriticalSection, RtlCreateEnvironment, RtlQueryEnvironmentVariable_U, RtlSetEnvironmentVariable, RtlInitUnicodeString, NtOpenKey, NtQueryValueKey, RtlSubAuthoritySid, RtlInitializeSid, RtlLengthRequiredSid, NtAllocateLocallyUniqueId, RtlGetDaclSecurityDescriptor, RtlCopySid, RtlLengthSid, NtSetInformationThread, NtDuplicateToken, NtDuplicateObject, RtlEqualSid, RtlSetDaclSecurityDescriptor, NtClose, RtlOpenCurrentUser, RtlCreateSecurityDescriptor, RtlAddAce, RtlCreateAcl, RtlNtStatusToDosError, NtOpenDirectoryObject, NtQuerySystemInformation, NtCreateEvent, NtCreatePagingFile, RtlDosPathNameToNtPathName_U, RtlRegisterWait, NtSetValueKey, NtCreateKey, RtlTimeToSecondsSince1980, NtQuerySystemTime, NtPrivilegeObjectAuditAlarm, NtPrivilegeCheck, NtOpenThreadToken, NtOpenProcessToken, RtlUnhandledExceptionFilter, NtQueryInformationProcess, DbgBreakPoint, RtlCheckProcessParameters, RtlSetThreadIsCritical, RtlSetProcessIsCritical, RtlInitString, NtInitiatePowerAction, DbgPrint, NtFilterToken, NtQueryInformationJobObject, NtOpenEvent, RtlGetAce, RtlQueryInformationAcl, NtQuerySecurityObject, RtlCompareUnicodeString, NtSetInformationProcess > PROFMAP.dll: InitializeProfileMappingApi, RemapAndMoveUserW > PSAPI.DLL: EnumProcesses, EnumProcessModules, GetModuleBaseNameW > REGAPI.dll: RegDefaultUserConfigQueryW, RegUserConfigQuery > RPCRT4.dll: RpcServerRegisterIfEx, RpcServerUseProtseqEpW, RpcImpersonateClient, I_RpcMapWin32Status, RpcServerRegisterIf, RpcGetAuthorizationContextForClient, RpcFreeAuthorizationContext, RpcServerListen, RpcRevertToSelf, NdrServerCall2, UuidCreate > Secur32.dll: GetUserNameExW, LsaLookupAuthenticationPackage, LsaRegisterLogonProcess, LsaCallAuthenticationPackage > SETUPAPI.dll: SetupDiDestroyDeviceInfoList, SetupDiEnumDeviceInfo, SetupDiGetClassDevsW, SetupDiGetDeviceRegistryPropertyW > USER32.dll: SetFocus, EnumWindows, CreateWindowStationW, RegisterLogonProcess, RecordShutdownReason, LoadLocalFonts, UnhookWindowsHook, SetWindowsHookW, GetWindowTextW, CallNextHookEx, DialogBoxParamW, GetWindowPlacement, GetSystemMenu, DeleteMenu, SetWindowPlacement, SetUserObjectInformationW, GetAsyncKeyState, PostThreadMessageW, SetUserObjectSecurity, CreateDesktopW, KillTimer, GetMessageTime, SetLogonNotifyWindow, UnlockWindowStation, SetTimer, ReplyMessage, UnregisterHotKey, RegisterHotKey, OpenInputDesktop, GetUserObjectInformationW, CloseDesktop, RegisterDeviceNotificationW, SetThreadDesktop, CreateWindowExW, GetMessageW, TranslateMessage, RegisterWindowMessageW, SetCursor, DefWindowProcW, FindWindowW, MessageBoxW, SendNotifyMessageW, PostQuitMessage, MsgWaitForMultipleObjects, GetWindowRect, GetSystemMetrics, PeekMessageW, DispatchMessageW, SetProcessWindowStation, UpdateWindow, ShowWindow, SetWindowPos, PostMessageW, ExitWindowsEx, EnumDisplayMonitors, SystemParametersInfoW, GetDlgItem, SendMessageW, CreateDialogParamW, DestroyWindow, GetWindowLongW, GetDlgItemTextW, EndDialog, SetWindowLongW, LoadStringW, SetWindowTextW, SetDlgItemTextW, wsprintfW, wsprintfA, LockWindowStation, MBToWCSEx, SetWindowStationUser, UpdatePerUserSystemParameters, DialogBoxIndirectParamW, wvsprintfW, SetLastErrorEx, LoadCursorW, CheckDlgButton, IsDlgButtonChecked, RegisterClassW, CloseWindowStation, LoadImageW, GetParent, GetKeyState, GetDesktopWindow, SetForegroundWindow, SwitchDesktop, OpenDesktopW > USERENV.dll: WaitForUserPolicyForegroundProcessing, GetAllUsersProfileDirectoryW, -, -, -, -, WaitForMachinePolicyForegroundProcessing, -, -, -, UnloadUserProfile, LoadUserProfileW, GetUserProfileDirectoryW, RegisterGPNotification, CreateEnvironmentBlock, DestroyEnvironmentBlock, UnregisterGPNotification, - > VERSION.dll: GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW > WINSTA.dll: WinStationRequestSessionsList, WinStationQueryLogonCredentialsW, WinStationIsHelpAssistantSession, WinStationAutoReconnect, _WinStationWaitForConnect, WinStationDisconnect, _WinStationCallback, WinStationNameFromLogonIdW, _WinStationFUSCanRemoteUserDisconnect, WinStationEnumerate_IndexedW, WinStationGetMachinePolicy, WinStationQueryInformationW, WinStationFreeMemory, WinStationReset, _WinStationNotifyDisconnectPipe, WinStationConnectW, WinStationSetInformationW, WinStationShutdownSystem, WinStationCheckLoopBack, _WinStationNotifyLogon, _WinStationNotifyLogoff > WINTRUST.dll: CryptCATCatalogInfoFromContext, CryptCATAdminCalcHashFromFileHandle, CryptCATAdminAcquireContext, CryptCATAdminEnumCatalogFromHash, CryptCATAdminReleaseCatalogContext, WTHelperProvDataFromStateData, WinVerifyTrust, WTHelperGetProvSignerFromChain, CryptCATAdminReleaseContext > WS2_32.dll: -, getaddrinfo, - ( 0 exports )

CWSandbox info: <a href='http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=8d52aedd07247b743a4d9bd372f69109''>http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=8d52aedd07247b743a4d9bd372f69109' target='_blank'>http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=8d52aedd07247b743a4d9bd372f69109</a>'>http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=8d52aedd07247b743a4d9bd372f69109</a>

Antivirus Version Dernière mise à jour Résultat

a-squared 4.0.0.93 2009.02.06 -

AhnLab-V3 5.0.0.2 2009.02.07 -

AntiVir 7.9.0.76 2009.02.07 -

Authentium 5.1.0.4 2009.02.07 -

Avast 4.8.1335.0 2009.02.07 -

AVG 8.0.0.229 2009.02.07 -

BitDefender 7.2 2009.02.07 -

CAT-QuickHeal 10.00 2009.02.07 -

ClamAV 0.94.1 2009.02.07 -

Comodo 969 2009.02.07 -

DrWeb 4.44.0.09170 2009.02.07 -

eSafe 7.0.17.0 2009.02.05 -

eTrust-Vet 31.6.6346 2009.02.07 -

F-Prot 4.4.4.56 2009.02.06 -

F-Secure 8.0.14470.0 2009.02.07 -

Fortinet 3.117.0.0 2009.02.07 -

GData 19 2009.02.07 -

Ikarus T3.1.1.45.0 2009.02.07 -

K7AntiVirus 7.10.623 2009.02.07 -

Kaspersky 7.0.0.125 2009.02.07 -

McAfee 5518 2009.02.07 -

McAfee+Artemis 5517 2009.02.06 -

Microsoft 1.4306 2009.02.06 -

NOD32 3836 2009.02.07 -

Norman 6.00.02 2009.02.06 -

nProtect 2009.1.8.0 2009.02.07 -

Panda 9.5.1.2 2009.02.07 -

PCTools 4.4.2.0 2009.02.07 -

Prevx1 V2 2009.02.07 -

Rising 21.15.50.00 2009.02.07 -

SecureWeb-Gateway 6.7.6 2009.02.07 -

Sophos 4.38.0 2009.02.07 -

Sunbelt 3.2.1835.2 2009.01.16 -

Symantec 10 2009.02.07 -

TheHacker 6.3.1.5.248 2009.02.07 -

TrendMicro 8.700.0.1004 2009.02.06 -

VBA32 3.12.8.12 2009.02.05 -

ViRobot 2009.2.6.1594 2009.02.06 -

VirusBuster 4.5.11.0 2009.02.07 -

Information additionnelle

File size: 506368 bytes

MD5...: 8d52aedd07247b743a4d9bd372f69109

SHA1..: f1bfc0d191d815ea09af3efcdbbe7797da2e880d

SHA256: 25f0be4b5a61778fdac368835908a6a5e399509ec9ef84d5c00bca6f98e71c57

SHA512: cd2b3a8850df70cfdb67864df4a9ee4c8bcd26a43db3efaedb9811e85052c2d3 821d5ab84036d260162787119aab7b92584f6d3254ec91af5d511e981ec0d267

ssdeep: 6144:7YuZlm8LRlBw662R1pqrc7FmxSqVw/T+SN1TrSnmhPnpdcbFIzdFz/N5Wjy fTNQJ:7VLBhic7Qy1vSneJFDNhp8b

PEiD..: -

TrID..: File type identification Win64 Executable Generic (80.9%) Win32 Executable Generic (8.0%) Win32 Dynamic Link Library (generic) (7.1%) Generic Win/DOS Executable (1.8%) DOS Executable Generic (1.8%)

PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x3d353 timedatestamp.....: 0x41107edc (Wed Aug 04 06:14:52 2004) machinetype.......: 0x14c (I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x6f288 0x6f400 6.82 04f9c7e06d665f55b445bc73b1215882 .data 0x71000 0x4d90 0x2000 6.21 662eceb591c7df2d6e365ae6b9b2da15 .rsrc 0x76000 0xa19c 0xa200 3.69 e9a6edacc9ec7d341c57eae2b54e9ae3 ( 20 imports ) > ADVAPI32.dll: ConvertStringSecurityDescriptorToSecurityDescriptorA, A_SHAInit, A_SHAUpdate, A_SHAFinal, LsaStorePrivateData, LsaRetrievePrivateData, LsaNtStatusToWinError, CryptGetUserKey, CryptGetKeyParam, CryptEncrypt, CryptSetProvParam, CryptSignHashW, CryptDeriveKey, CryptGetProvParam, RegOpenCurrentUser, RegDeleteKeyW, AddAccessAllowedAceEx, RegSetKeySecurity, I_ScSendTSMessage, MD5Init, MD5Update, MD5Final, SetFileSecurityA, AllocateLocallyUniqueId, LsaOpenPolicy, LsaQueryInformationPolicy, LsaFreeMemory, LsaClose, RegNotifyChangeKeyValue, QueryServiceConfigW, SetKernelObjectSecurity, ConvertStringSecurityDescriptorToSecurityDescriptorW, RegEnumKeyExW, GetCurrentHwProfileW, RegCloseKey, RegQueryValueExW, RegOpenKeyW, FreeSid, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, AddAccessAllowedAce, InitializeAcl, GetLengthSid, AllocateAndInitializeSid, RegOpenKeyExW, CreateProcessAsUserW, DuplicateTokenEx, CloseServiceHandle, ControlService, StartServiceW, QueryServiceStatus, OpenServiceW, OpenSCManagerW, EqualSid, GetTokenInformation, RegSetValueExW, RegCreateKeyExW, CryptGenRandom, CryptDestroyHash, CryptVerifySignatureW, CryptSetHashParam, CryptGetHashParam, CryptHashData, CryptCreateHash, CryptDecrypt, ReportEventW, RegisterEventSourceW, CryptImportKey, CryptAcquireContextW, CryptReleaseContext, CryptDestroyKey, RegEnumValueW, RegQueryInfoKeyW, RegDeleteValueW, CredFree, CredDeleteW, CredEnumerateW, CopySid, GetSidLengthRequired, GetSidSubAuthority, GetSidSubAuthorityCount, GetUserNameW, OpenThreadToken, EnumServicesStatusW, ImpersonateLoggedOnUser, RegQueryValueExA, CheckTokenMembership, DeregisterEventSource, LsaGetUserName, RevertToSelf, LookupAccountSidW, IsValidSid, SetTokenInformation, LogonUserW, LookupAccountNameW, OpenProcessToken, SynchronizeWindows31FilesAndWindowsNTRegistry, QueryWindows31FilesMigration, AdjustTokenPrivileges, RegQueryInfoKeyA > AUTHZ.dll: AuthzInitializeResourceManager, AuthzAccessCheck, AuthziFreeAuditEventType, AuthziInitializeAuditEvent, AuthziInitializeAuditParams, AuthziInitializeAuditEventType, AuthziLogAuditEvent, AuthzFreeAuditEvent, AuthzFreeResourceManager, AuthzFreeHandle > CRYPT32.dll: CryptImportPublicKeyInfo, CryptVerifyMessageSignature, CertCreateCertificateContext, CertSetCertificateContextProperty, CertVerifyCertificateChainPolicy, CryptSignMessage, CertCloseStore, CertComparePublicKeyInfo, CryptExportPublicKeyInfo, CertFindExtension, CryptDecryptMessage, CertGetCertificateContextProperty, CertAddCertificateContextToStore, CertOpenStore, CertVerifySubjectCertificateContext, CertGetIssuerCertificateFromStore, CertDuplicateCertificateContext, CertFreeCertificateContext, CertEnumCertificatesInStore, CryptImportPublicKeyInfoEx > GDI32.dll: RemoveFontResourceW, AddFontResourceW > KERNEL32.dll: WTSGetActiveConsoleSessionId, GetTimeFormatW, GetUserDefaultLCID, FileTimeToSystemTime, FileTimeToLocalFileTime, GetProcAddress, LoadLibraryW, GetModuleHandleW, SystemTimeToFileTime, GetSystemTime, SetLastError, TerminateProcess, GetCurrentProcess, CreateTimerQueueTimer, CreateThread, lstrcpynW, GetShortPathNameW, GetProfileStringW, FreeLibrary, ReleaseSemaphore, CreateSemaphoreW, GetSystemInfo, GetComputerNameW, GetEnvironmentVariableW, WaitForSingleObjectEx, LoadResource, FindResourceW, SetThreadExecutionState, DeleteTimerQueueTimer, ResetEvent, GetSystemDirectoryW, TransactNamedPipe, SetNamedPipeHandleState, GetTickCount, CreateFileW, GlobalGetAtomNameW, VirtualLock, VirtualQuery, GetDriveTypeW, Beep, OpenMutexW, QueueUserWorkItem, LeaveCriticalSection, EnterCriticalSection, DisconnectNamedPipe, SearchPathW, lstrcatW, LocalReAlloc, ExpandEnvironmentStringsW, TerminateThread, ResumeThread, GetDiskFreeSpaceExW, GlobalMemoryStatusEx, DeleteFileW, WriteProfileStringW, ReadFile, FindVolumeClose, FindNextVolumeW, FindFirstVolumeW, FormatMessageW, SetPriorityClass, MoveFileExW, WaitForMultipleObjectsEx, GetExitCodeProcess, SleepEx, InterlockedExchange, FindClose, FindFirstFileW, GetWindowsDirectoryW, SetTimerQueueTimer, GetComputerNameA, GetVersionExW, VerSetConditionMask, WriteFile, WaitNamedPipeW, WaitForMultipleObjects, ConnectNamedPipe, DuplicateHandle, OpenProcess, GetOverlappedResult, GetVersionExA, lstrcmpW, SetEnvironmentVariableW, UnregisterWait, CreateNamedPipeW, CreateRemoteThread, CreateActCtxW, GetModuleFileNameW, ExitProcess, LoadLibraryExW, SetErrorMode, SetUnhandledExceptionFilter, GetPrivateProfileStringW, LocalSize, VirtualAlloc, VirtualQueryEx, DebugBreak, CreateFileA, InitializeCriticalSection, ProcessIdToSessionId, SetInformationJobObject, AssignProcessToJobObject, TerminateJobObject, PostQueuedCompletionStatus, PulseEvent, GetQueuedCompletionStatus, CreateIoCompletionPort, CreateJobObjectW, ActivateActCtx, DeactivateActCtx, InterlockedCompareExchange, LoadLibraryA, QueryPerformanceCounter, GetSystemTimeAsFileTime, UnhandledExceptionFilter, GetModuleHandleA, GetStartupInfoA, GetCurrentProcessId, SetThreadPriority, GetCurrentThreadId, lstrcmpiW, GetProfileIntW, LoadLibraryExA, lstrcpyW, lstrlenW, Sleep, LocalAlloc, CreateEventW, GetExitCodeThread, SetThreadAffinityMask, GetProcessAffinityMask, CreateWaitableTimerW, CreateMutexW, OpenEventW, RegisterWaitForSingleObject, WaitForSingleObject, CreateProcessW, SetWaitableTimer, ReleaseMutex, SetEvent, UnregisterWaitEx, CloseHandle, lstrlenA, lstrcpyA, MultiByteToWideChar, GetACP, WideCharToMultiByte, HeapAlloc, GetProcessHeap, HeapFree, lstrcpynA, UnmapViewOfFile, MapViewOfFile, CreateFileMappingW, lstrcmpiA, GetFileSize, SetFilePointer, GlobalAlloc, GlobalFree, GetLastError, LocalFree, lstrcatA, lstrcmpA, GetLogicalDriveStringsA, GetDriveTypeA, GetVolumeInformationW, GlobalMemoryStatus, CreateMutexA, FindResourceExW, LockResource, SizeofResource, VerifyVersionInfoW, GetSystemDirectoryA, GetCurrentThread, DelayLoadFailureHook, BaseInitAppcompatCacheSupport, OpenProfileUserMapping, CloseProfileUserMapping, BaseCleanupAppcompatCacheSupport, InitializeCriticalSectionAndSpinCount, VirtualProtect, CreateEventA, TlsSetValue, DeleteCriticalSection, TlsGetValue, TlsAlloc, VirtualFree, TlsFree > msvcrt.dll: _vsnwprintf, wcslen, wcsncpy, wcsstr, atoi, wcstok, memmove, wcschr, swprintf, swscanf, _local_unwind2, _wcslwr, wcscmp, _snwprintf, malloc, _c_exit, _exit, _XcptFilter, _cexit, exit, _acmdln, __getmainargs, _initterm, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, __3@YAXPAX@Z, __2@YAPAXI@Z, __CxxFrameHandler, _itow, _snprintf, _wtol, _strnicmp, sscanf, wcstombs, sprintf, strchr, strncmp, atof, _ftol, isspace, __set_app_type, wcscpy, _controlfp, wcsncmp, _wcsupr, ceil, wcscat, _except_handler3, free, _wcsicmp > NDdeApi.dll: -, -, -, - > ntdll.dll: RtlAllocateHeap, NtPowerInformation, NtSetSystemPowerState, NtRaiseHardError, RtlDeleteCriticalSection, NtOpenSymbolicLinkObject, NtReplyPort, NtCompleteConnectPort, NtReplyWaitReceivePort, NtAcceptConnectPort, NtCreatePort, RtlConvertSidToUnicodeString, RtlFreeUnicodeString, NtLockProductActivationKeys, RtlTimeToTimeFields, NtUnmapViewOfSection, NtMapViewOfSection, NtOpenSection, NtQuerySymbolicLinkObject, NtQueryVolumeInformationFile, NtSetSecurityObject, RtlAdjustPrivilege, NtOpenFile, NtFsControlFile, RtlAllocateAndInitializeSid, RtlDestroyEnvironment, RtlFreeHeap, NtQueryInformationToken, NtShutdownSystem, RtlEnterCriticalSection, RtlLeaveCriticalSection, RtlInitializeCriticalSection, RtlCreateEnvironment, RtlQueryEnvironmentVariable_U, RtlSetEnvironmentVariable, RtlInitUnicodeString, NtOpenKey, NtQueryValueKey, RtlSubAuthoritySid, RtlInitializeSid, RtlLengthRequiredSid, NtAllocateLocallyUniqueId, RtlGetDaclSecurityDescriptor, RtlCopySid, RtlLengthSid, NtSetInformationThread, NtDuplicateToken, NtDuplicateObject, RtlEqualSid, RtlSetDaclSecurityDescriptor, NtClose, RtlOpenCurrentUser, RtlCreateSecurityDescriptor, RtlAddAce, RtlCreateAcl, RtlNtStatusToDosError, NtOpenDirectoryObject, NtQuerySystemInformation, NtCreateEvent, NtCreatePagingFile, RtlDosPathNameToNtPathName_U, RtlRegisterWait, NtSetValueKey, NtCreateKey, RtlTimeToSecondsSince1980, NtQuerySystemTime, NtPrivilegeObjectAuditAlarm, NtPrivilegeCheck, NtOpenThreadToken, NtOpenProcessToken, RtlUnhandledExceptionFilter, NtQueryInformationProcess, DbgBreakPoint, RtlCheckProcessParameters, RtlSetThreadIsCritical, RtlSetProcessIsCritical, RtlInitString, NtInitiatePowerAction, DbgPrint, NtFilterToken, NtQueryInformationJobObject, NtOpenEvent, RtlGetAce, RtlQueryInformationAcl, NtQuerySecurityObject, RtlCompareUnicodeString, NtSetInformationProcess > PROFMAP.dll: InitializeProfileMappingApi, RemapAndMoveUserW > PSAPI.DLL: EnumProcesses, EnumProcessModules, GetModuleBaseNameW > REGAPI.dll: RegDefaultUserConfigQueryW, RegUserConfigQuery > RPCRT4.dll: RpcServerRegisterIfEx, RpcServerUseProtseqEpW, RpcImpersonateClient, I_RpcMapWin32Status, RpcServerRegisterIf, RpcGetAuthorizationContextForClient, RpcFreeAuthorizationContext, RpcServerListen, RpcRevertToSelf, NdrServerCall2, UuidCreate > Secur32.dll: GetUserNameExW, LsaLookupAuthenticationPackage, LsaRegisterLogonProcess, LsaCallAuthenticationPackage > SETUPAPI.dll: SetupDiDestroyDeviceInfoList, SetupDiEnumDeviceInfo, SetupDiGetClassDevsW, SetupDiGetDeviceRegistryPropertyW > USER32.dll: SetFocus, EnumWindows, CreateWindowStationW, RegisterLogonProcess, RecordShutdownReason, LoadLocalFonts, UnhookWindowsHook, SetWindowsHookW, GetWindowTextW, CallNextHookEx, DialogBoxParamW, GetWindowPlacement, GetSystemMenu, DeleteMenu, SetWindowPlacement, SetUserObjectInformationW, GetAsyncKeyState, PostThreadMessageW, SetUserObjectSecurity, CreateDesktopW, KillTimer, GetMessageTime, SetLogonNotifyWindow, UnlockWindowStation, SetTimer, ReplyMessage, UnregisterHotKey, RegisterHotKey, OpenInputDesktop, GetUserObjectInformationW, CloseDesktop, RegisterDeviceNotificationW, SetThreadDesktop, CreateWindowExW, GetMessageW, TranslateMessage, RegisterWindowMessageW, SetCursor, DefWindowProcW, FindWindowW, MessageBoxW, SendNotifyMessageW, PostQuitMessage, MsgWaitForMultipleObjects, GetWindowRect, GetSystemMetrics, PeekMessageW, DispatchMessageW, SetProcessWindowStation, UpdateWindow, ShowWindow, SetWindowPos, PostMessageW, ExitWindowsEx, EnumDisplayMonitors, SystemParametersInfoW, GetDlgItem, SendMessageW, CreateDialogParamW, DestroyWindow, GetWindowLongW, GetDlgItemTextW, EndDialog, SetWindowLongW, LoadStringW, SetWindowTextW, SetDlgItemTextW, wsprintfW, wsprintfA, LockWindowStation, MBToWCSEx, SetWindowStationUser, UpdatePerUserSystemParameters, DialogBoxIndirectParamW, wvsprintfW, SetLastErrorEx, LoadCursorW, CheckDlgButton, IsDlgButtonChecked, RegisterClassW, CloseWindowStation, LoadImageW, GetParent, GetKeyState, GetDesktopWindow, SetForegroundWindow, SwitchDesktop, OpenDesktopW > USERENV.dll: WaitForUserPolicyForegroundProcessing, GetAllUsersProfileDirectoryW, -, -, -, -, WaitForMachinePolicyForegroundProcessing, -, -, -, UnloadUserProfile, LoadUserProfileW, GetUserProfileDirectoryW, RegisterGPNotification, CreateEnvironmentBlock, DestroyEnvironmentBlock, UnregisterGPNotification, - > VERSION.dll: GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW > WINSTA.dll: WinStationRequestSessionsList, WinStationQueryLogonCredentialsW, WinStationIsHelpAssistantSession, WinStationAutoReconnect, _WinStationWaitForConnect, WinStationDisconnect, _WinStationCallback, WinStationNameFromLogonIdW, _WinStationFUSCanRemoteUserDisconnect, WinStationEnumerate_IndexedW, WinStationGetMachinePolicy, WinStationQueryInformationW, WinStationFreeMemory, WinStationReset, _WinStationNotifyDisconnectPipe, WinStationConnectW, WinStationSetInformationW, WinStationShutdownSystem, WinStationCheckLoopBack, _WinStationNotifyLogon, _WinStationNotifyLogoff > WINTRUST.dll: CryptCATCatalogInfoFromContext, CryptCATAdminCalcHashFromFileHandle, CryptCATAdminAcquireContext, CryptCATAdminEnumCatalogFromHash, CryptCATAdminReleaseCatalogContext, WTHelperProvDataFromStateData, WinVerifyTrust, WTHelperGetProvSignerFromChain, CryptCATAdminReleaseContext > WS2_32.dll: -, getaddrinfo, - ( 0 exports )

CWSandbox info: <a href='http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=8d52aedd07247b743a4d9bd372f69109' target='_blank'>http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=8d52aedd07247b743a4d9bd372f69109</a>

Falkra · le 7 février 2009

Impec. On continue, il y a des choses pas courantes à vérifier.

On a fait le plus gros, la mahcine doit mieux tourner, mais ce n'est pas terminé.

Télécharge random's system information tool (RSIT) par random/random et sauvegarde-le sur le Bureau.

Double-clique sur RSIT.exe afin de lancer RSIT.
Clique Continue à l'écran Disclaimer.
Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (<<qui sera affiché) ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).
NB : Les rapports sont sauvegardés dans le dossier C:\rsit
Ca fait deux rapports donc.

marie_hockey31 · le 7 février 2009

Logfile of random's system information tool 1.05 (written by random/random)

Run by Ruedi at 2009-02-07 15:21:50

Microsoft Windows XP Professionnel Service Pack 2

System drive C: has 75 GB (78%) free of 95 GB

Total RAM: 991 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 15:21:57, on 2009-02-07

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\ehome\ehtray.exe

C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe

C:\Program Files\Analog Devices\SoundMAX\Smax4.exe

C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe

C:\WINDOWS\system32\LVCOMSX.EXE

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\PROGRA~1\Webshots\Webshots.scr

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\MSN Messenger\usnsvc.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\internet explorer\iexplore.exe

C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\Ruedi\Bureau\RSIT.exe

C:\Program Files\Trend Micro\HijackThis\Ruedi.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sympatico.ca/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/...rch/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {2B419F91-D843-400B-98EF-ADC5B7689691} - (no file)

O2 - BHO: (no name) - {393C2547-B2AB-422C-87AF-385238C73416} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O2 - BHO: e404 helper - {C03FD59D-9104-44B7-929A-9EAA0BA05211} - (no file)

O2 - BHO: (no name) - {fcedb34b-b927-4557-a9c2-60518aa20f1b} - (no file)

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [siSPower] Rundll32.exe SiSPower.dll,ModeAgent

O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe

O4 - HKLM\..\Run: [soundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray

O4 - HKLM\..\Run: [siSRaid] C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"

O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE

O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe

O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice

O4 - HKLM\..\Run: [RegRun WinBait] C:\WINDOWS\winbait.exe

O4 - HKLM\..\Run: [@RegRunOnSecure] C:\PROGRA~1\Greatis\REGRUN~1\OnSecure.exe

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [pizadidoto] Rundll32.exe "C:\WINDOWS\system32\yohilimu.dll",s

O4 - HKLM\..\Run: [CPM5791c005] Rundll32.exe "c:\windows\system32\wayomora.dll",a

O4 - HKLM\..\Run: [combofix] C:\WINDOWS\system32\CF1122.exe /c C:\ComboFix\Combobatch.bat

O4 - HKLM\..\RunOnce: [KB926239] rundll32.exe apphelp.dll,ShimFlushCache

O4 - HKLM\..\RunOnce: [combofix] C:\WINDOWS\system32\CF1122.exe /c C:\ComboFix\Combobatch.bat

O4 - HKCU\..\RunOnce: [unHackMe] C:\PROGRA~1\Greatis\REGRUN~1\UnHackMe.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-CA/a-UNO1/GAME_UNO1.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1161704464687

O20 - Winlogon Notify: khffcda - C:\WINDOWS\

O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - (no file)

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe

O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--

End of file - 8885 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Vérifier les mises à jour de Windows Live Toolbar.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]

AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2B419F91-D843-400B-98EF-ADC5B7689691}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{393C2547-B2AB-422C-87AF-385238C73416}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]

SSVHelper Class - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll [2006-10-12 434279]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Windows Live Sign-in Helper - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-08-31 322368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]

Google Toolbar Helper - c:\program files\google\googletoolbar3.dll [2007-01-19 2436160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]

Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll [2008-09-01 737776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]

Windows Live Toolbar Helper - C:\Program Files\Windows Live Toolbar\msntb.dll [2007-10-19 546320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C03FD59D-9104-44B7-929A-9EAA0BA05211}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fcedb34b-b927-4557-a9c2-60518aa20f1b}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar3.dll [2007-01-19 2436160]

{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - Windows Live Toolbar - C:\Program Files\Windows Live Toolbar\msntb.dll [2007-10-19 546320]

{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar avec bloqueur de fenêtres pop-up - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-10-26 440384]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"ehTray"=C:\WINDOWS\ehome\ehtray.exe [2005-08-05 64512]

"SiSPower"=C:\WINDOWS\system32\SiSPower.dll [2005-08-25 49152]

"SoundMAXPnP"=C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [2004-10-14 1388544]

"SoundMAX"=C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [2004-09-23 860160]

"SiSRaid"=C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe [2005-05-18 905216]

"NWEReboot"= []

"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

"SunJavaUpdateSched"=C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe [2006-10-12 49263]

"LVCOMSX"=C:\WINDOWS\system32\LVCOMSX.EXE [2005-07-19 221184]

"LogitechVideoRepair"=C:\Program Files\Logitech\Video\ISStart.exe [2005-06-08 458752]

"LogitechVideoTray"=C:\Program Files\Logitech\Video\LogiTray.exe [2005-06-08 217088]

"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2008-09-06 413696]

"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2007-12-21 1443072]

"RegRun WinBait"=C:\WINDOWS\winbait.exe [2000-12-12 16384]

"@RegRunOnSecure"=C:\PROGRA~1\Greatis\REGRUN~1\OnSecure.exe [2003-01-22 57856]

"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []

"pizadidoto"=C:\WINDOWS\system32\yohilimu.dll []

"CPM5791c005"=c:\windows\system32\wayomora.dll []

"combofix"=C:\WINDOWS\system32\CF1122.exe [2009-02-06 400896]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"KB926239"=C:\WINDOWS\system32\apphelp.dll [2004-08-10 126976]

"combofix"=C:\WINDOWS\system32\CF1122.exe [2009-02-06 400896]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"UnHackMe"=C:\PROGRA~1\Greatis\REGRUN~1\UnHackMe.exe [2007-12-17 1026048]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\@RegRunOnSecure]

C:\PROGRA~1\Greatis\REGRUN~1\OnSecure.exe [2003-01-22 57856]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe [2005-09-03 94208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

C:\WINDOWS\system32\ctfmon.exe [2004-08-10 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\egui]

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2007-12-21 1443072]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

C:\WINDOWS\system32\dumprep 0 -k []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]

C:\Program Files\Logitech\Video\ManifestEngine.exe [2005-06-08 196608]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]

C:\Program Files\Logitech\Video\ISStart.exe [2005-06-08 458752]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]

C:\Program Files\Logitech\Video\LogiTray.exe [2005-06-08 217088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]

C:\WINDOWS\system32\LVCOMSX.EXE [2005-07-19 221184]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]

C:\Program Files\MSN Messenger\MsnMsgr.Exe [2007-01-19 5674352]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

C:\Program Files\QuickTime\qttask.exe [2008-09-06 413696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Registry]

C:\Program Files\Greatis\RegRunSuite\lsoon.exe [2007-12-17 390656]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegRun WinBait]

C:\WINDOWS\winbait.exe [2000-12-12 16384]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Regrun2]

C:\PROGRA~1\Greatis\REGRUN~1\WatchDog.exe [2007-12-17 356864]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiSPower]

C:\WINDOWS\system32\SiSPower.dll [2005-08-25 49152]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiSRaid]

C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe [2005-05-18 905216]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX]

C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [2004-09-23 860160]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]

C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [2004-10-14 1388544]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe [2006-10-12 49263]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2007-05-23 68856]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnHackMe]

C:\PROGRA~1\Greatis\REGRUN~1\UnHackMe.exe [2007-12-17 1026048]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]

C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE [2004-12-14 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Utility Tray.lnk]

C:\WINDOWS\system32\sistray.exe [2005-08-25 262144]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Ruedi^Menu Démarrer^Programmes^Démarrage^Webshots.lnk]

C:\PROGRA~1\Webshots\Launcher.exe [2006-07-03 45056]

C:\Documents and Settings\Ruedi\Menu Démarrer\Programmes\Démarrage

Webshots.lnk - C:\Program Files\Webshots\Launcher.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\khffcda]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]

C:\WINDOWS\system32\WgaLogon.dll [2007-04-10 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{F552DDE6-2090-4bf4-B924-6141E87789A5}"=C:\Program Files\Greatis\RegRunSuite\RRShell.dll [2004-11-02 368711]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles

"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDriveTypeAutoRun"=323

"NoDriveAutoRun"=67108863

"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDriveAutoRun"=

"NoDriveTypeAutoRun"=

"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Disabled:Windows Live Messenger 8.1"

"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Disabled:Windows Live Messenger 8.1 (Phone)"

"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"

"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Disabled:Bonjour"

"C:\WINDOWS\Network Diagnostic\xpnetdiag.exe"="C:\WINDOWS\Network Diagnostic\xpnetdiag.exe:*:Disabled:@xpsp3res.dll,-20000"

"C:\WINDOWS\system32\dllhost.exe"="C:\WINDOWS\system32\dllhost.exe:*:Disabled:dllhost"

"C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe"="C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe:*:Disabled:ekrn"

"C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe:*:Disabled:GoogleToolbarNotifier"

"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Disabled:iTunes"

"C:\WINDOWS\system32\muzapp.exe"="C:\WINDOWS\system32\muzapp.exe:*:Disabled:MUZ AOD APP player"

"C:\WINDOWS\system32\spoolsv.exe"="C:\WINDOWS\system32\spoolsv.exe:*:Disabled:spoolsv"

"C:\WINDOWS\system32\wuauclt.exe"="C:\WINDOWS\system32\wuauclt.exe:*:Enabled:wuauclt"

"C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE"="C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE:*:Enabled:MDM"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"

"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2009-02-07 15:21:50 ----D---- C:\rsit

2009-02-06 16:50:39 ----SHD---- C:\RECYCLER

2009-02-06 16:42:48 ----D---- C:\WINDOWS\temp

2009-02-06 16:42:34 ----A---- C:\ComboFix.txt

2009-02-06 16:30:01 ----A---- C:\WINDOWS\zip.exe

2009-02-06 16:30:01 ----A---- C:\WINDOWS\VFIND.exe

2009-02-06 16:30:01 ----A---- C:\WINDOWS\SWXCACLS.exe

2009-02-06 16:30:01 ----A---- C:\WINDOWS\SWSC.exe

2009-02-06 16:30:01 ----A---- C:\WINDOWS\SWREG.exe

2009-02-06 16:30:01 ----A---- C:\WINDOWS\sed.exe

2009-02-06 16:30:01 ----A---- C:\WINDOWS\NIRCMD.exe

2009-02-06 16:30:01 ----A---- C:\WINDOWS\grep.exe

2009-02-06 16:30:01 ----A---- C:\WINDOWS\fdsv.exe

2009-02-06 16:29:52 ----D---- C:\ComboFix

2009-02-06 16:29:51 ----A---- C:\WINDOWS\system32\CF1122.exe

2009-02-06 12:53:10 ----A---- C:\Boot.bak

2009-02-06 12:53:05 ----RASHD---- C:\cmdcons

2009-02-06 12:48:07 ----D---- C:\WINDOWS\ERDNT

2009-02-06 12:48:07 ----D---- C:\Qoobox

2009-02-02 20:56:48 ----D---- C:\Program Files\Trend Micro

2009-02-02 15:23:41 ----D---- C:\Program Files\ESTsoft

2009-02-02 15:23:41 ----D---- C:\Documents and Settings\Ruedi\Application Data\ESTsoft

2009-02-02 10:52:37 ----A---- C:\WINDOWS\Partizan.txt

2009-01-30 18:26:06 ----D---- C:\SDFix

2009-01-30 17:14:01 ----A---- C:\avenger.txt

2009-01-30 15:34:57 ----D---- C:\Documents and Settings\Ruedi\Application Data\Malwarebytes

2009-01-30 15:34:37 ----D---- C:\Program Files\Malwarebytes' Anti-Malware

2009-01-30 15:34:37 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes

2009-01-24 11:11:26 ----A---- C:\WINDOWS\system32\5f8137e7-.txt

2009-01-17 18:12:48 ----HDC---- C:\WINDOWS\$NtUninstallKB929399$

2009-01-17 18:08:46 ----HDC---- C:\WINDOWS\$NtUninstallKB939683$

2009-01-17 18:06:04 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$

2009-01-17 18:05:23 ----HDC---- C:\WINDOWS\$NtUninstallKB936782_WMP11$

2009-01-16 19:01:48 ----HDC---- C:\WINDOWS\$NtUninstallKB926239$

2009-01-16 19:00:56 ----A---- C:\WINDOWS\system32\spmsg.dll

2009-01-16 19:00:54 ----HDC---- C:\WINDOWS\$NtUninstallMSCompPackV1$

2009-01-16 18:59:40 ----D---- C:\Program Files\Windows Media Connect 2

2009-01-16 18:59:26 ----HDC---- C:\WINDOWS\$NtUninstallwmp11$

2009-01-16 18:57:57 ----HDC---- C:\WINDOWS\$NtUninstallWMFDist11$

2009-01-16 18:57:04 ----D---- C:\WINDOWS\system32\LogFiles

2009-01-16 18:56:59 ----HDC---- C:\WINDOWS\$NtUninstallWudf01000$

2009-01-16 18:54:29 ----HDC---- C:\WINDOWS\$NtUninstallKB925766$

2009-01-15 18:04:52 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$

2009-01-11 10:00:48 ----D---- C:\Documents and Settings\All Users\Application Data\Messenger Plus!

2009-01-11 09:43:34 ----D---- C:\Program Files\Windows Live

2009-01-11 09:43:32 ----D---- C:\Program Files\Messenger Plus! Live

======List of files/folders modified in the last 1 months======

2009-02-07 15:21:51 ----D---- C:\WINDOWS\Prefetch

2009-02-07 12:12:33 ----D---- C:\WINDOWS

2009-02-07 12:12:13 ----D---- C:\WINDOWS\system32\config

2009-02-07 12:09:06 ----A---- C:\WINDOWS\ModemLog_Cnxt 2011 D850 56K V.9x DF Modem #2.txt

2009-02-07 11:03:11 ----D---- C:\WINDOWS\Registration

2009-02-07 11:02:55 ----A---- C:\WINDOWS\system32\PARTIZAN.TXT

2009-02-07 01:31:00 ----N---- C:\WINDOWS\SchedLgU.Txt

2009-02-06 19:05:16 ----SHD---- C:\WINDOWS\Installer

2009-02-06 19:05:16 ----SHD---- C:\Config.Msi

2009-02-06 16:40:22 ----D---- C:\WINDOWS\system32\CatRoot2

2009-02-06 16:39:31 ----A---- C:\WINDOWS\system.ini

2009-02-06 16:39:15 ----D---- C:\WINDOWS\system32

2009-02-06 16:38:17 ----D---- C:\WINDOWS\system32\drivers

2009-02-06 16:33:35 ----D---- C:\WINDOWS\AppPatch

2009-02-06 16:33:35 ----D---- C:\Program Files\Fichiers communs

2009-02-06 16:32:24 ----D---- C:\Program Files

2009-02-06 12:55:31 ----SD---- C:\WINDOWS\Tasks

2009-02-06 12:53:10 ----RASH---- C:\boot.ini

2009-02-05 16:34:09 ----D---- C:\backreg

2009-02-05 16:34:04 ----A---- C:\WINDOWS\lsoon.ini

2009-02-03 10:27:44 ----AC---- C:\WINDOWS\NeroDigital.ini

2009-01-30 18:43:08 ----A---- C:\WINDOWS\win.ini

2009-01-30 18:14:02 ----HD---- C:\WINDOWS\inf

2009-01-30 18:14:00 ----D---- C:\WINDOWS\system32\CatRoot

2009-01-30 17:19:51 ----D---- C:\Program Files\CCleaner

2009-01-30 17:08:00 ----D---- C:\Program Files\LimeWire

2009-01-29 17:30:49 ----D---- C:\Documents and Settings\Ruedi\Application Data\LimeWire

2009-01-24 07:27:02 ----D---- C:\WINDOWS\network diagnostic

2009-01-21 23:26:46 ----D---- C:\WINDOWS\Debug

2009-01-17 18:18:12 ----RSHDC---- C:\WINDOWS\system32\dllcache

2009-01-16 19:05:36 ----D---- C:\WINDOWS\ehome

2009-01-16 18:59:39 ----D---- C:\Program Files\Windows Media Player

2009-01-16 18:59:35 ----D---- C:\WINDOWS\Help

2009-01-15 18:41:38 ----SD---- C:\Documents and Settings\Ruedi\Application Data\Microsoft

2009-01-15 18:15:24 ----D---- C:\WINDOWS\security

2009-01-15 18:04:24 ----HD---- C:\WINDOWS\$hf_mig$

2009-01-11 09:43:34 ----D---- C:\Program Files\MSN Messenger

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 easdrv;easdrv; C:\WINDOWS\system32\DRIVERS\easdrv.sys [2007-12-21 30216]

R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2007-12-21 33800]

R1 PQNTDrv;PQNTDrv; C:\WINDOWS\system32\drivers\PQNTDrv.sys [2004-05-05 4228]

R1 SiSkp;SiSkp; C:\WINDOWS\system32\DRIVERS\srvkp.sys [2005-08-25 11904]

R2 eamon;EAMON; C:\WINDOWS\system32\DRIVERS\eamon.sys [2007-12-21 39944]

R2 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2006-04-21 8064]

R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2003-04-09 11043]

R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2005-03-04 127872]

R3 ElbyDelay;ElbyDelay; C:\WINDOWS\System32\Drivers\ElbyDelay.sys [2005-04-12 4608]

R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]

R3 HSF_DP;HSF_DP; C:\WINDOWS\system32\DRIVERS\HSF_DP.sys [2003-11-17 1042432]

R3 HSFHWBS2;HSFHWBS2; C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys [2003-11-17 212224]

R3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2006-10-26 47360]

R3 RegGuard;RegGuard; \??\C:\WINDOWS\system32\Drivers\regguard.sys []

R3 senfilt;senfilt; C:\WINDOWS\system32\drivers\senfilt.sys [2005-02-28 392704]

R3 SiS315;SiS315; C:\WINDOWS\system32\DRIVERS\sisgrp.sys [2005-09-03 261632]

R3 SISNIC;SiS PCI Fast Ethernet Adapter Driver; C:\WINDOWS\system32\DRIVERS\sisnic.sys [2002-07-10 32256]

R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2005-03-28 220992]

R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-10 26624]

R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-10 57600]

R3 usbohci;Pilote miniport de contrôleur hôte ouvert USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-10 17024]

R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2003-11-17 680704]

S1 InCDPass;InCDPass; C:\WINDOWS\system32\drivers\InCDPass.sys []

S1 InCDRm;InCD Reader; C:\WINDOWS\system32\drivers\InCDRm.sys []

S1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-03 14848]

S3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB); C:\WINDOWS\system32\DRIVERS\A3AB.sys [2005-03-22 450400]

S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]

S3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]

S3 LVUSBSta;Logitech USB Monitor Filter; C:\WINDOWS\system32\drivers\lvusbsta.sys [2005-05-27 22016]

S3 MHNDRV;Pilote MHN; C:\WINDOWS\system32\DRIVERS\mhndrv.sys [2004-08-10 11008]

S3 MidiSyn;MidiSyn; C:\WINDOWS\system32\drivers\MidiSyn.sys [2004-09-13 88960]

S3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12288]

S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]

S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]

S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]

S3 pepifilter;Volume Adapter; C:\WINDOWS\system32\DRIVERS\lv302af.sys [2005-05-27 7136]

S3 PID_08A0;QuickCam IM(PID_08A0); C:\WINDOWS\system32\DRIVERS\LV302AV.SYS [2005-05-27 913280]

S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]

S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]

S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2008-11-07 32000]

S3 usbaudio;Pilote USB audio (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264]

S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]

S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]

S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]

S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2006-10-18 38528]

S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]

S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

S4 InCDFs;InCD File System; C:\WINDOWS\system32\drivers\InCDFs.sys []

S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

S4 WS2IFSL;Environnement de prise en charge de Fournisseur de services non-IFS Windows Sockets 2.0; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-10 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-11-07 132424]

R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]

R2 ehRecvr;Media Center Receiver Service; C:\WINDOWS\eHome\ehRecvr.exe [2006-10-09 237568]

R2 ehSched;Service de planification Media Center; C:\WINDOWS\eHome\ehSched.exe [2005-08-05 103424]

R2 ekrn;Eset Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2007-12-21 468224]

R2 McrdSvc;Media Center Extender Service; C:\WINDOWS\ehome\mcrdsvc.exe [2005-08-05 99328]

R2 MDM;Machine Debug Manager; C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]

R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-09-20 45056]

R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-10 14336]

R3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]

S3 aspnet_state;Service d'état ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-04-13 33632]

S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-04-13 68952]

S3 EhttpSrv;Eset HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2007-12-21 19200]

S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-03-17 136952]

S3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2008-09-08 536872]

S3 MHN;MHN; C:\WINDOWS\System32\svchost.exe [2004-08-10 14336]

S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]

S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]

-----------------EOF-----------------

info.txt logfile of random's system information tool 1.05 2009-02-07 15:22:00

======Uninstall list======

-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E06E4F4E-72D6-4497-BFFD-BCB43077C2F4}\setup.exe" -l0xc0c -uninst

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf

ACDSee 7.0 PowerPack-->MsiExec.exe /I{D1D9AE2B-A4E7-41F2-938E-261D7A407EB9}

Adobe Flash Player 9 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete

Adobe Flash Player ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe

Adobe Reader 7.0 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A70000000000}

Adobe Shockwave Player 11-->C:\WINDOWS\system32\adobe\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Adobe\SHOCKW~1\Install.log

Alexandra Ledermann 4-->C:\Program Files\Ubi Soft\Lexis Numérique\Alexandra Ledermann 4\Desinst.exe

ALUpdate-->"C:\Program Files\ESTsoft\ALUpdate\unins000.exe"

ALZip-->"C:\Program Files\ESTsoft\ALZip\unins000.exe"

Apple Mobile Device Support-->MsiExec.exe /I{EC4455AB-F155-4CC1-A4C5-88F3777F9886}

Apple Software Update-->MsiExec.exe /I{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}

Bonjour-->MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}

CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"

CloneDVD2-->"C:\Program Files\Elaborate Bytes\CloneDVD2\CloneDVD2-uninst.exe" /D="C:\Program Files\Elaborate Bytes\CloneDVD2"

Cnxt 2011 D850 56K V.9x DF Modem-->C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_201114F1\HXFSETUP.EXE -U -IVEN_14F1&DEV_2F20&SUBSYS_201114F1

Correctif n° 2 pour Windows XP Édition Media Center 2005-->C:\WINDOWS\$NtUninstallKB900325$\spuninst\spuninst.exe

Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"

Correctif pour Windows XP (KB888795)-->"C:\WINDOWS\$NtUninstallKB888795$\spuninst\spuninst.exe"

Correctif pour Windows XP (KB891593)-->"C:\WINDOWS\$NtUninstallKB891593$\spuninst\spuninst.exe"

Correctif pour Windows XP (KB899337)-->"C:\WINDOWS\$NtUninstallKB899337$\spuninst\spuninst.exe"

Correctif pour Windows XP (KB899510)-->"C:\WINDOWS\$NtUninstallKB899510$\spuninst\spuninst.exe"

Correctif pour Windows XP (KB902841)-->"C:\WINDOWS\$NtUninstallKB902841$\spuninst\spuninst.exe"

Correctif pour Windows XP (KB914440)-->"C:\WINDOWS\$NtUninstallKB914440$\spuninst\spuninst.exe"

Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"

Correctif Windows XP - KB873339-->C:\WINDOWS\$NtUninstallKB873339$\spuninst\spuninst.exe

Correctif Windows XP - KB885835-->C:\WINDOWS\$NtUninstallKB885835$\spuninst\spuninst.exe

Correctif Windows XP - KB885836-->C:\WINDOWS\$NtUninstallKB885836$\spuninst\spuninst.exe

Correctif Windows XP - KB886185-->C:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe

Correctif Windows XP - KB888302-->C:\WINDOWS\$NtUninstallKB888302$\spuninst\spuninst.exe

Correctif Windows XP - KB890859-->"C:\WINDOWS\$NtUninstallKB890859$\spuninst\spuninst.exe"

Correctif Windows XP - KB891781-->C:\WINDOWS\$NtUninstallKB891781$\spuninst\spuninst.exe

Correctif Windows XP - KB895961-->"C:\WINDOWS\$NtUninstallKB895961$\spuninst\spuninst.exe"

DVDFab Platinum 2.9.8.3-->"C:\Program Files\DVDFab Platinum\unins000.exe"

ESET NOD32 Antivirus-->MsiExec.exe /I{57ECFB4D-FE11-491A-9AA0-0AF7C3ABC51D}

FirstClass® Client-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5B35C417-2649-11D6-83D1-0050FC01225C}\setup.exe" -l0x40c -uninst

GameHouse Super Games AIO®-->"C:\Program Files\GameHouse\unins000.exe"

Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar3.dll"

HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall

Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"

Hotfix for Windows Media Format SDK (KB902344)-->"C:\WINDOWS\$NtUninstallKB902344$\spuninst\spuninst.exe"

Hotfix for Windows Media Player 10 (KB903157)-->"C:\WINDOWS\$NtUninstallKB903157$\spuninst\spuninst.exe"

Hotfix for Windows XP (KB915865)-->"C:\WINDOWS\$NtUninstallKB915865$\spuninst\spuninst.exe"

Hotfix for Windows XP (KB926239)-->"C:\WINDOWS\$NtUninstallKB926239$\spuninst\spuninst.exe"

iTunes-->MsiExec.exe /I{EA418519-2160-43A0-AABD-6608DDD8D87F}

J2SE Runtime Environment 5.0 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150030}

J2SE Runtime Environment 5.0 Update 9-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150090}

Kaspersky Online Scanner-->C:\WINDOWS\system32\KASPER~1\KASPER~1\kavuninstall.exe

Lame ACM MP3 Codec-->"C:\WINDOWS\IFinst26.exe" -UC:\Program Files\Lame MP3 Codec\IFU8E6.inf

Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall

LiveUpdate 2.6 (Symantec Corporation)-->C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE /U

Logiciel QuickCam de Logitech-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C43048A9-742C-4DAD-90D2-E3B53C9DB825}\setup.exe" -l0x40c

Logitech Print Service-->C:\PROGRA~1\Logitech\PRINTS~1\UNWISE.EXE C:\PROGRA~1\Logitech\PRINTS~1\INSTALL.LOG

Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"

Menus intelligents (Windows Live Toolbar)-->MsiExec.exe /X{0CC70FEF-5068-4CD5-B4DE-86FFD98EC929}

Messenger Plus! Live-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe"

Microsoft .NET Framework 1.0 Hotfix (KB887998)-->"C:\WINDOWS\$NtUninstallKB887998$\spuninst\spuninst.exe"

Microsoft .NET Framework 1.0 Hotfix (KB930494)-->"C:\WINDOWS\$NtUninstallKB930494$\spuninst\spuninst.exe"

Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}

Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"

Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}

Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}

Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe

Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"

Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"

Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"

Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9}

Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Lecteur Windows Media 10 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Lecteur Windows Media 10 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Lecteur Windows Media 6.4 (KB925398)-->"C:\WINDOWS\$NtUninstallKB925398_WMP64$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB890046)-->"C:\WINDOWS\$NtUninstallKB890046$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB893756)-->"C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB896358)-->"C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB896423)-->"C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB896424)-->"C:\WINDOWS\$NtUninstallKB896424$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB896428)-->"C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB899587)-->"C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB899589)-->"C:\WINDOWS\$NtUninstallKB899589$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB899591)-->"C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB900725)-->"C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB901017)-->"C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB901214)-->"C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB902400)-->"C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB904706)-->"C:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB905414)-->"C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB905749)-->"C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB908519)-->"C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB911562)-->"C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB911567)-->"C:\WINDOWS\$NtUninstallKB911567$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB911927)-->"C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB912919)-->"C:\WINDOWS\$NtUninstallKB912919$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB913580)-->"C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB914388)-->"C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB914389)-->"C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB917344)-->"C:\WINDOWS\$NtUninstallKB917344$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB917422)-->"C:\WINDOWS\$NtUninstallKB917422$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB917953)-->"C:\WINDOWS\$NtUninstallKB917953$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB918118)-->"C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB918439)-->"C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB918899)-->"C:\WINDOWS\$NtUninstallKB918899$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB919007)-->"C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB920213)-->"C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB920214)-->"C:\WINDOWS\$NtUninstallKB920214$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB920670)-->"C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB920683)-->"C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB920685)-->"C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB921398)-->"C:\WINDOWS\$NtUninstallKB921398$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB921503)-->"C:\WINDOWS\$NtUninstallKB921503$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB921883)-->"C:\WINDOWS\$NtUninstallKB921883$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB922616)-->"C:\WINDOWS\$NtUninstallKB922616$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB922760)-->"C:\WINDOWS\$NtUninstallKB922760$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB922819)-->"C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB923191)-->"C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB923414)-->"C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB923689)-->"C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf

Mise à jour de sécurité pour Windows XP (KB923980)-->"C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB924191)-->"C:\WINDOWS\$NtUninstallKB924191$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB924270)-->"C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB924496)-->"C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB924667)-->"C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB925486)-->"C:\WINDOWS\$NtUninstallKB925486$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB925902)-->"C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB926255)-->"C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB926436)-->"C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB927779)-->"C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB927802)-->"C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB928255)-->"C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB928843)-->"C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB929123)-->"C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB930178)-->"C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB931261)-->"C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB931784)-->"C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB932168)-->"C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB933566)-->"C:\WINDOWS\$NtUninstallKB933566$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB933729)-->"C:\WINDOWS\$NtUninstallKB933729$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB935839)-->"C:\WINDOWS\$NtUninstallKB935839$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB935840)-->"C:\WINDOWS\$NtUninstallKB935840$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB936021)-->"C:\WINDOWS\$NtUninstallKB936021$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB937143)-->"C:\WINDOWS\$NtUninstallKB937143$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB937894)-->"C:\WINDOWS\$NtUninstallKB937894$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB938127)-->"C:\WINDOWS\$NtUninstallKB938127$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB938829)-->"C:\WINDOWS\$NtUninstallKB938829$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB941202)-->"C:\WINDOWS\$NtUninstallKB941202$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB941568)-->"C:\WINDOWS\$NtUninstallKB941568$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB941644)-->"C:\WINDOWS\$NtUninstallKB941644$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB941693)-->"C:\WINDOWS\$NtUninstallKB941693$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB943055)-->"C:\WINDOWS\$NtUninstallKB943055$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB943460)-->"C:\WINDOWS\$NtUninstallKB943460$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB943485)-->"C:\WINDOWS\$NtUninstallKB943485$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB944338)-->"C:\WINDOWS\$NtUninstallKB944338$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB944533)-->"C:\WINDOWS\$NtUninstallKB944533$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB944653)-->"C:\WINDOWS\$NtUninstallKB944653$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB945553)-->"C:\WINDOWS\$NtUninstallKB945553$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB946026)-->"C:\WINDOWS\$NtUninstallKB946026$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB947864)-->"C:\WINDOWS\$NtUninstallKB947864$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB948590)-->"C:\WINDOWS\$NtUninstallKB948590$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB948881)-->"C:\WINDOWS\$NtUninstallKB948881$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB950749)-->"C:\WINDOWS\$NtUninstallKB950749$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB950759)-->"C:\WINDOWS\$NtUninstallKB950759$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB953838)-->"C:\WINDOWS\$NtUninstallKB953838$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"

Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"

Mise à jour pour Lecteur Windows Media 10 (KB913800)-->"C:\WINDOWS\$NtUninstallKB913800$\spuninst\spuninst.exe"

Mise à jour pour Lecteur Windows Media 10 (KB926251)-->"C:\WINDOWS\$NtUninstallKB926251$\spuninst\spuninst.exe"

Mise à jour pour Windows XP (KB894391)-->"C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe"

Mise à jour pour Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"

Mise à jour pour Windows XP (KB900485)-->"C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe"

Mise à jour pour Windows XP (KB904942)-->"C:\WINDOWS\$NtUninstallKB904942$\spuninst\spuninst.exe"

Mise à jour pour Windows XP (KB908531)-->"C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe"

Mise à jour pour Windows XP (KB910437)-->"C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe"

Mise à jour pour Windows XP (KB911280)-->"C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe"

Mise à jour pour Windows XP (KB916595)-->"C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe"

Mise à jour pour Windows XP (KB920342)-->"C:\WINDOWS\$NtUninstallKB920342$\spuninst\spuninst.exe"

Mise à jour pour Windows XP (KB920872)-->"C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe"

Mise à jour pour Windows XP (KB922582)-->"C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe"

Mise à jour pour Windows XP (KB927891)-->"C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe"

Mise à jour pour Windows XP (KB930916)-->"C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe"

Mise à jour pour Windows XP (KB931836)-->"C:\WINDOWS\$NtUninstallKB931836$\spuninst\spuninst.exe"

Mise à jour pour Windows XP (KB932823-v3)-->"C:\WINDOWS\$NtUninstallKB932823-v3$\spuninst\spuninst.exe"

Mise à jour pour Windows XP (KB938828)-->"C:\WINDOWS\$NtUninstallKB938828$\spuninst\spuninst.exe"

Mise à jour pour Windows XP (KB942763)-->"C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe"

Mise à jour pour Windows XP (KB942840)-->"C:\WINDOWS\$NtUninstallKB942840$\spuninst\spuninst.exe"

Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"

Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"

Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - FRA\install.exe

MSN-->C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP

Nero 7 Premium-->MsiExec.exe /I{4781569D-5404-1F26-4B2B-6DF444441031}

Norton PartitionMagic 8.0-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{21DBBDD6-93A5-4326-9A04-C9A5C9148502}

Package de base Microsoft de service de chiffrement pour cartes à puce-->"C:\WINDOWS\$NtUninstallbasecsp$\spuninst\spuninst.exe"

PIXELA ImageMixer-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{13413C6C-C640-40B8-917E-CA3062826B18}\setup.exe"

Programme de gestion Camera de Logitech®-->"C:\Program Files\Fichiers communs\Logitech\QCDRV\BIN\SETUP.EXE" UNINSTALL REMOVEPROMPT

QuickTime-->MsiExec.exe /I{8DC42D05-680B-41B0-8878-6C14D24602DB}

RegRun Security Suite Platinum-->C:\Program Files\Greatis\RegRunSuite\R3UR.exe

Samsung Media Studio-->C:\Program Files\InstallShield Installation Information\{C20CE592-B0F8-4D20-BF31-0151CA6331A6}\Setup.exe -runfromtemp -l0x040c -removeonly

Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}

Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}

Security Update pour Microsoft .NET Framework 2.0 (KB928365)-->C:\WINDOWS\system32\msiexec.exe /promptrestart /uninstall {8056AC9E-49C5-4375-9ADE-B2F862C9DF51} /package {7131646D-CD3C-40F4-97B9-CD9E4E6262EF}

SiS 900 PCI Fast Ethernet Adapter Driver-->C:\Progra~1\SiSLan\Uninst.exe

SiS VGA Utilities-->Rundll32 SiSInst.dll,Uninstall VGA,R,oem1.inf

SiSAGP driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DC226AC9-0314-496C-BE6A-B6A132628466}\setup.exe" -l0xc0c

SiSRaidPackage-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{08498FF9-6C9B-4FC2-8DE1-BD98C89CC220}\setup.exe" -l0xc0c

SoundMAX-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\setup.exe" -l0x40c -removeonly

STOPzilla-->MsiExec.exe /X{60CA95A8-0FB9-4AA5-AC3A-035E1E215E3C}

Webshots Desktop-->"C:\Program Files\Webshots\unins000.exe"

Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"

Windows Internet Explorer 7-->"C:\WINDOWS\ie7\spuninst\spuninst.exe"

Windows Live Messenger-->MsiExec.exe /I{F6326B60-1B1D-4ABF-BFCD-7B7404F44411}

Windows Live OneCare safety scanner-->RunDll32.exe "C:\Program Files\Windows Live Safety Center\wlscCore.dll",UninstallFunction WLSC_SCANNER_PRODUCT

Windows Live Sign-in Assistant-->MsiExec.exe /I{49672EC2-171B-47B4-8CE7-50D7806360D7}

Windows Live Toolbar-->"C:\Program Files\Windows Live Toolbar\UnInstall.exe" {0A8C97AD-DEED-4894-B446-3ABA95A77D0D}

Windows Live Toolbar-->MsiExec.exe /X{0A8C97AD-DEED-4894-B446-3ABA95A77D0D}

Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll

Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"

Windows Media Format SDK Hotfix - KB891122-->"C:\WINDOWS\$NtUninstallKB891122$\spuninst\spuninst.exe"

Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"

Windows XP Media Center Edition 2005 KB925766-->"C:\WINDOWS\$NtUninstallKB925766$\spuninst\spuninst.exe"

WinZip-->"C:\Program Files\WinZip\WINZIP32.EXE" /uninstall

XviD MPEG-4 Video Codec-->"C:\Program Files\XviD\unins000.exe"

Yahoo! Toolbar avec bloqueur de fenêtres pop-up-->C:\PROGRA~1\Yahoo!\Common\unyt.exe

======Security center information======

AV: ESET NOD32 Antivirus 3.0 (outdated)

System event log

Computer Name: RUEDI-4D0E3DB60

Event Code: 35

Message: Le service de temps synchronise maintenant l'heure système avec la

source de temps time.windows.com (ntp.m|0x1|10.100.2.2:123->207.46.197.32:123).

Record Number: 5

Source Name: W32Time

Time Written: 20090207130002.000000-300

Event Type: information

User:

Computer Name: RUEDI-4D0E3DB60

Event Code: 7036

Message: Le service Service Messenger Sharing Folders USN Journal Reader est entré dans l'état : en cours d'exécution.

Record Number: 4

Source Name: Service Control Manager

Time Written: 20090207121434.000000-300

Event Type: information

User:

Computer Name: RUEDI-4D0E3DB60

Event Code: 7035

Message: Un contrôle Démarrer a correctement été envoyé au service Service Messenger Sharing Folders USN Journal Reader.

Record Number: 3

Source Name: Service Control Manager

Time Written: 20090207121434.000000-300

Event Type: information

User: AUTORITE NT\SYSTEM

Computer Name: RUEDI-4D0E3DB60

Event Code: 26

Message: Application popup : LogiTray.exe - Composant introuvable : Cette application n'a pas pu démarrer car MFC71.DLL est introuvable. La réinstallation de cette application peut corriger ce problème.

Record Number: 2

Source Name: Application Popup

Time Written: 20090207121223.000000-300

Event Type: information

User:

Computer Name: RUEDI-4D0E3DB60

Event Code: 7036

Message: Le service Service COM de gravage de CD IMAPI est entré dans l'état : arrêté.

Record Number: 1

Source Name: Service Control Manager

Time Written: 20090207121219.000000-300

Event Type: information

User:

Application event log

Computer Name: RUEDI-4D0E3DB60

Event Code: 103

Message: MsnMsgr (2880) \\.\C:\Documents and Settings\Ruedi\Local Settings\Application Data\Microsoft\Messenger\lametyss@hotmail.com\SharingMetadata\Working\database_3C54_A337_54A2_F336\dfsr.db: Le moteur de base de données a arrêté une instance (0).

Record Number: 2256

Source Name: ESENT

Time Written: 20081231195651.000000-300

Event Type: information

User:

Computer Name: RUEDI-4D0E3DB60

Event Code: 102

Message: MsnMsgr (2880) \\.\C:\Documents and Settings\Ruedi\Local Settings\Application Data\Microsoft\Messenger\lametyss@hotmail.com\SharingMetadata\Working\database_3C54_A337_54A2_F336\dfsr.db: Le moteur de base de données a démarré une nouvelle instance (0).

Record Number: 2255

Source Name: ESENT

Time Written: 20081231180925.000000-300

Event Type: information

User:

Computer Name: RUEDI-4D0E3DB60

Event Code: 100

Message: MsnMsgr (2880) Le moteur de base de données 5.01.2600.2780 est démarré.

Record Number: 2254

Source Name: ESENT

Time Written: 20081231180925.000000-300

Event Type: information

User:

Computer Name: RUEDI-4D0E3DB60

Event Code: 11729

Message: Produit : Microsoft Office Professional Edition 2003 -- La configuration a échoué.

Record Number: 2253

Source Name: MsiInstaller

Time Written: 20081231180432.000000-300

Event Type: information

User: AUTORITE NT\SYSTEM

Computer Name: RUEDI-4D0E3DB60

Event Code: 1024

Message: Produit : Microsoft Office Professional Edition 2003 - La mise à jour 'Security Update for Excel 2003 (KB958436): EXCEL' n'a pas pu être installée. Code d'erreur 1603. Windows Installer peut créer des journaux pour faciliter la résolution des éventuelles erreurs d'installation des packages logiciels. Utilisez le lien suivant pour afficher des instructions concernant l'activation des journaux : http://go.microsoft.com/fwlink/?LinkId=23127

Record Number: 2252

Source Name: MsiInstaller

Time Written: 20081231180432.000000-300

Event Type: error

User: AUTORITE NT\SYSTEM

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe

"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem

"windir"=%SystemRoot%

"FP_NO_HOST_CHECK"=NO

"OS"=Windows_NT

"PROCESSOR_ARCHITECTURE"=x86

"PROCESSOR_LEVEL"=15

"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 44 Stepping 2, AuthenticAMD

"PROCESSOR_REVISION"=2c02

"NUMBER_OF_PROCESSORS"=1

"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

"TEMP"=%SystemRoot%\TEMP

"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

Falkra · le 7 février 2009

Désactive Unhackme et regrunsuite (si actif à l'arrière plan), avant ce qui suit.

Télécharge OTMoveIt3 par OldTimer.

Enregistre ce fichier sur le Bureau.
Fais un double clic sur OTMoveIt3.exe pour lancer l'exécution de l'outil. (Note: Si tu utilises Vista, fais un clic droit sur le fichier puis choisir Exécuter en tant qu'administrateur).

Copie les lignes de la zone "Code" ci-dessous dans le Presse-papiers en les sélectionnant toutes puis en appuyant simultanément sur les touches CTRL et C (ou, après les avoir sélectionnées, en faisant un clic droit puis en choisissant Copier):

:processes
explorer.exe 
:files
c:\windows\system32\yohilimu.dll
c:\windows\system32\wayomora.dll
C:\WINDOWS\Partizan.txt
C:\WINDOWS\system32\PARTIZAN.TXT
:reg 
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2B419F91-D843-400B-98EF-ADC5B7689691}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{393C2547-B2AB-422C-87AF-385238C73416}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C03FD59D-9104-44B7-929A-9EAA0BA05211}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fcedb34b-b927-4557-a9c2-60518aa20f1b}]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NWEReboot"=-
"pizadidoto"=-
"CPM5791c005"=-
"combofix"=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"KB926239"=-
"combofix"=-

:commands
[emptytemp] 
[start explorer]

Retourne dans la fenêtre de OTMoveIt3, fais un clic droit dans la zone de gauche intitulée "Paste List Of Files/Folders to Move" (sous la barre jaune) puis choisir Coller.
Clique sur le bouton rouge Moveit!.
Ferme OTMoveIt3
Poste dans ta prochaine réponse le rapport de OTMoveIt3 (contenu du fichier C:\_OTMoveIt\MovedFiles\********_******.log - les *** sont des chiffres représentant la date [moisjourannée] et l'heure)

Note: Si un fichier ou un dossier ne peut pas être déplacé immédiatement, un redémarrage sera peut-être nécessaire pour permettre de terminer le processus de déplacement. Si le redémarrage de la machine vous est demandé, choisir Oui/Yes.

Après ça, et le redémarrage (si requis), relance HijackThis, clique sur "Do a system scan only" puis coche ces lignes si elles sont encore là et clique sur le bouton "Fix checked", en bas à gauche :

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/...rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com

O2 - BHO: (no name) - {2B419F91-D843-400B-98EF-ADC5B7689691} - (no file)

O2 - BHO: (no name) - {393C2547-B2AB-422C-87AF-385238C73416} - (no file)

O2 - BHO: e404 helper - {C03FD59D-9104-44B7-929A-9EAA0BA05211} - (no file)

O2 - BHO: (no name) - {fcedb34b-b927-4557-a9c2-60518aa20f1b} - (no file)

O4 - HKLM\..\Run: [pizadidoto] Rundll32.exe "C:\WINDOWS\system32\yohilimu.dll",s

O4 - HKLM\..\Run: [CPM5791c005] Rundll32.exe "c:\windows\system32\wayomora.dll",a

O4 - HKLM\..\Run: [combofix] C:\WINDOWS\system32\CF1122.exe /c C:\ComboFix\Combobatch.bat

O4 - HKLM\..\RunOnce: [combofix] C:\WINDOWS\system32\CF1122.exe /c C:\ComboFix\Combobatch.bat

O20 - Winlogon Notify: khffcda - C:\WINDOWS\

O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - (no file)

Connexion

Pas encore inscrit ?

Demande d'analyse rapport hijackthis

Messages recommandés

marie_hockey31

Falkra

marie_hockey31

Falkra

marie_hockey31

Falkra

marie_hockey31

Falkra

marie_hockey31

Falkra

Rejoindre la conversation

En ligne récemment 0 membre est en ligne

Zebulon

Outils en ligne

Naviguer