PPO@ %v)&Zb2` @tzres.dll,-302 @tzres.dll,-301Q:{hdz!&ExplorerStartupLogC:\Users\exploitfil1\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etl  sO& 8 PUP@n30'|DQRa%%MPAn30'|DQRa^j^j\P=An30'|DQRawjwj8n30'|DQRaymam˔p-ARC: AK: Determine if this process has write access to the state store.=%n30'|DQRaymam,p-ARC: AK: Result hr=0 fHasWriteAccess=1 fSingleSessionEnabled=1 cOtherSessions=0 sessionType=3zan30'|DQRa-L-LC:\Users\exploitfil1\AppData\Local\Microsoft\Windows\Application ShortcutsȆn30'|DQRa.L-LyC:\Users\exploitfil1\AppData\Local\Microsoft\Windows\Application ShortcutsZ@Yun30'|DQRa-L-LֽC:\Users\exploitfil1\Desktopln30'|DQRaSISIbc(&IOpI n30'|DQRa.L-L^C:\Users\exploitfil1\Desktop`ZYfn30'|DQRa-L-LFۯC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\LibrariesCn30'|DQRa.L-L{ܯC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\LibrariesZYn30'|DQRa-L-L%⯁C:\Users\exploitfil1\Documentsln30'|DQRaSISI䯁(&IOpI n30'|DQRa.L-LZ?寁C:\Users\exploitfil1\DocumentsXYLn30'|DQRa-L-LꯁC:\Users\exploitfil1\Musicl n30'|DQRaSISI(&IOpI n30'|DQRa.L-L`C:\Users\exploitfil1\MusicX@Y,n30'|DQRa-L-L!X󯁲C:\Users\exploitfil1\PictureslLn30'|DQRaSISIi (&IOpI n30'|DQRa.L-L=eC:\Users\exploitfil1\PicturesXYn30'|DQRa-L-LC:\Users\exploitfil1\VideoslHn30'|DQRaSISI(&IOpI n30'|DQRa.L-LCC:\Users\exploitfil1\VideosXY>n30'|DQRa-L-LC:\Users\exploitfil1\Downloadslnn30'|DQRaSISI(&IOpI Hn30'|DQRa.L-L1 C:\Users\exploitfil1\DownloadsZZ@Yz n30'|DQRa-L-LC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Start MenulY n30'|DQRaSISI(&IOpI  n30'|DQRa.L-LC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Start MenunZY"n30'|DQRa-L-LC*C:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Start Menu\ProgramslA*n30'|DQRaSISI$(&IOpI "+n30'|DQRa.L-LH%C:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Start Menu\ProgramszZ Y <n30'|DQRa-L-LG&0C:\ProgramData\Microsoft\Windows\Start MenulBn30'|DQRaSISI4(&IOpI  Cn30'|DQRa.L-L 5C:\ProgramData\Microsoft\Windows\Start Menu`XYLn30'|DQRa-L-Li:C:\ProgramData\Microsoft\Windows\Start Menu\ProgramslQn30'|DQRaSISIs>(&IOpI  Rn30'|DQRa.L-L>C:\ProgramData\Microsoft\Windows\Start Menu\Programs`sZ`Y#cn30'|DQRa-L-LIC:\Users\Public\Desktoplhn30'|DQRaSISIM(&IOpI  in30'|DQRa.L-LNC:\Users\Public\DesktoppZ Y8tn30'|DQRa-L-L{TC:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned$vn30'|DQRa.L-Lo#VC:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned@ZYP n30'|DQRa-L-Lshell:::{4234d49b-0245-4df3-b780-3893943456e1}P \n30'|DQRa.L-Lashell:::{4234d49b-0245-4df3-b780-3893943456e1}aZYlO n30'|DQRaSISIα(&IOpI  l n30'|DQRaSISIh<ు(&IOpI  0 & U8Pl= n30'|DQRaSISI鱁(&IOpI  l n30'|DQRaSISIȱﱁ(&IOpI  l n30'|DQRaSISIes(&IOpI  l n30'|DQRaSISI(&IOpI  Pn30'|DQRaOO:Gn30'|DQRaQQfcSoftware\Wow6432Node\Microsoft\Active Setup\Installed Componentsln30'|DQRaSSJ({3af36230-a269-11d1-b5bf-0000f8051515}exploitfil1mn30'|DQRaSSe'){44BBA840-CC51-11CF-AAFA-00AA00B6015C}exploitfil1[pn30'|DQRaTS*{44BBA840-CC51-11CF-AAFA-00AA00B6015C}exploitfil1pn30'|DQRaSS *{44BBA855-CC51-11CF-AAFA-00AA00B6015F}exploitfil1*qn30'|DQRaSSE+{45ea75a0-a269-11d1-b5bf-0000f8051515}exploitfil1rn30'|DQRaSS=W,{4f645220-306d-11d2-995d-00c04f98bbc9}exploitfil1Jsn30'|DQRaSS,{5fd399c0-a70a-11d1-9948-00c04f98bbc9}exploitfil1sn30'|DQRaSSu -{630b1da0-b465-11d1-9948-00c04f98bbc9}exploitfil1tn30'|DQRaSS!-{6fab99d0-bab8-11d1-994a-00c04f98bbc9}exploitfil1-un30'|DQRaSS-{7790769C-0471-11d2-AF11-00C04FA35D02}exploitfil1un30'|DQRaSSB.{89820200-ECBD-11cf-8B85-00AA005B4383}exploitfil1dvn30'|DQRaSS.{89B4C1CD-B018-4511-B0A1-5476DBF70820}exploitfil1wn30'|DQRaTS/{89B4C1CD-B018-4511-B0A1-5476DBF70820}exploitfil1wn30'|DQRaSS/{9381D8F2-0288-11D0-9501-00AA00B911A5}exploitfil1bxn30'|DQRaSSU0{C9E9A340-D1F1-11D0-821E-444553540600}exploitfil1xn30'|DQRaSST0{de5aed00-a4bf-11d1-9948-00c04f98bbc9}exploitfil1cyn30'|DQRaSS0{E92B03AB-B707-11d2-9CBD-0000F87A369E}exploitfil1yn30'|DQRaSS1{EC43E638-09F0-38CC-A585-72FCCDDF035C}exploitfil1zn30'|DQRaSS1t1{89820200-ECBD-11cf-8B85-00AA005B4383}exploitfil1,{n30'|DQRaSS1{3af36230-a269-11d1-b5bf-0000f8051515}exploitfil1{n30'|DQRaSS$2{44BBA840-CC51-11CF-AAFA-00AA00B6015C}exploitfil1?+n30'|DQRaTSf{44BBA840-CC51-11CF-AAFA-00AA00B6015C}exploitfil1+n30'|DQRaSS{44BBA855-CC51-11CF-AAFA-00AA00B6015F}exploitfil1a,n30'|DQRaSS{45ea75a0-a269-11d1-b5bf-0000f8051515}exploitfil1,n30'|DQRaSSj{4f645220-306d-11d2-995d-00c04f98bbc9}exploitfil1E-n30'|DQRaSS!{5fd399c0-a70a-11d1-9948-00c04f98bbc9}exploitfil1-n30'|DQRaSSy{630b1da0-b465-11d1-9948-00c04f98bbc9}exploitfil1.n30'|DQRaSSA{6fab99d0-bab8-11d1-994a-00c04f98bbc9}exploitfil1.n30'|DQRaSS{7790769C-0471-11d2-AF11-00C04FA35D02}exploitfil1.n30'|DQRaSS{89B4C1CD-B018-4511-B0A1-5476DBF70820}exploitfil1n30'|DQRa%% N C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,InstallPn30'|DQRa-L-Li C:\Windows\SysWOW64\Rundll32.exePn30'|DQRacIcI Pn30'|DQRajj=db P˙n30'|DQRakjqg PNn30'|DQRajjt P̱n30'|DQRakj|'w P[Ĭn30'|DQRajjL PbȬn30'|DQRakj P8ڬn30'|DQRajj Pݬn30'|DQRakjԓ P'n30'|DQRarrB= P](n30'|DQRasr P(+n30'|DQRarr P+n30'|DQRasr PK.n30'|DQRarr P.n30'|DQRasr] P=n30'|DQRadIcI PP An30'|DQRaxx PP Fn30'|DQRayx h y&h 8 PUPKn30'|DQRallp PKLn30'|DQRamlK PP &Mn30'|DQRaxx PP Pn30'|DQRayxS- PdQn30'|DQRarr; PQn30'|DQRasr+ zn30'|DQRa-L-LB%C:\Users\exploitfil1sWr7n30'|DQRa.L-L6&C:\Users\exploitfil1\`Yn30'|DQRa.L-L"z'C:\Windows\SysWOW64\Rundll32.exe [Y@@ionچn30'|DQRaGC:\Windows\SysWOW64\rundll32.exeAppۛn30'|DQRa/+C:\Windows\SysWOW64\rundll32.exeۛn30'|DQRa +C:\Windows\SysWOW64\rundll32.exen30'|DQRa%%3s5(&IOpIM Rundll32.exe00000000D;n30'|DQRa%% k C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Installx;n30'|DQRaTSk{89B4C1CD-B018-4511-B0A1-5476DBF70820}exploitfil1W=;n30'|DQRaSSEk{9381D8F2-0288-11D0-9501-00AA00B911A5}exploitfil1t ;n30'|DQRaSSk{C9E9A340-D1F1-11D0-821E-444553540600}exploitfil1a;n30'|DQRaSSY-k{de5aed00-a4bf-11d1-9948-00c04f98bbc9}exploitfil1-L;n30'|DQRaSSek{E92B03AB-B707-11d2-9CBD-0000F87A369E}exploitfil1I;n30'|DQRaSSk{EC43E638-09F0-38CC-A585-72FCCDDF035C}exploitfil1P;n30'|DQRaUUnkP;n30'|DQRaVU۳k;n30'|DQRaRQG6kSoftware\Wow6432Node\Microsoft\Active Setup\Installed Componentsil1+;n30'|DQRaQQ `6kSoftware\Microsoft\Active Setup\Installed Componentsos;n30'|DQRaSS>k{2C7339CF-2B09-4501-B3F3-F3508C9228ED}exploitfil1;n30'|DQRaTSHk{2C7339CF-2B09-4501-B3F3-F3508C9228ED}exploitfil1U;n30'|DQRaSS'Ik{3af36230-a269-11d1-b5bf-0000f8051515}exploitfil1;n30'|DQRaSSIk{44BBA840-CC51-11CF-AAFA-00AA00B6015C}exploitfil1;n30'|DQRaTS[Jk{44BBA840-CC51-11CF-AAFA-00AA00B6015C}exploitfil1n;n30'|DQRaSStJk{44BBA855-CC51-11CF-AAFA-00AA00B6015F}exploitfil1[;n30'|DQRaSSrJk{45ea75a0-a269-11d1-b5bf-0000f8051515}exploitfil1;n30'|DQRaSS Kk{4f645220-306d-11d2-995d-00c04f98bbc9}exploitfil1oe;n30'|DQRaSSzKk{5fd399c0-a70a-11d1-9948-00c04f98bbc9}exploitfil1;n30'|DQRaSSKk{630b1da0-b465-11d1-9948-00c04f98bbc9}exploitfil1nj<n30'|DQRaSS&Lk{6fab99d0-bab8-11d1-994a-00c04f98bbc9}exploitfil1t<n30'|DQRaSStzLk{7790769C-0471-11d2-AF11-00C04FA35D02}exploitfil1|Dc<n30'|DQRaSSXLk{78E345F7-E976-3595-9C30-2458D6A8EC32}exploitfil1<n30'|DQRaSSMk{89820200-ECBD-11cf-8B85-00AA005B4340}exploitfil1<n30'|DQRaTSkPk{89820200-ECBD-11cf-8B85-00AA005B4340}exploitfil1'<n30'|DQRaSSnjPk{89820200-ECBD-11cf-8B85-00AA005B4383}exploitfil1abDn30'|DQRaTSOq{89820200-ECBD-11cf-8B85-00AA005B4383}exploitfil1IDn30'|DQRaSS q{89B4C1CD-B018-4511-B0A1-5476DBF70820}exploitfil1:Dn30'|DQRaTS q{89B4C1CD-B018-4511-B0A1-5476DBF70820}exploitfil1 gDn30'|DQRaSS q{9381D8F2-0288-11D0-9501-00AA00B911A5}exploitfil1tJDn30'|DQRaSS q{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}exploitfil1Dn30'|DQRaTSWq{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}exploitfil1/Dn30'|DQRaSSq{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}exploitfil1Dn30'|DQRaTS'cq{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}exploitfil1 ( ۉ& U8P;Dn30'|DQRaSSs'$q{C9E9A340-D1F1-11D0-821E-444553540600}exploitfil1RDn30'|DQRaSS{$q{de5aed00-a4bf-11d1-9948-00c04f98bbc9}exploitfil1|DDn30'|DQRaSST?%q{E92B03AB-B707-11d2-9CBD-0000F87A369E}exploitfil1nDn30'|DQRaSS%q{89820200-ECBD-11cf-8B85-00AA005B4383}exploitfil1s Dn30'|DQRa%% )qC:\Windows\System32\ie4uinit.exe -UserConfigplo9Dn30'|DQRa-L-L*qC:\Windows\System32\ie4uinit.exe00AEn30'|DQRa.L-LIɃ(&IOpI Il]Rn30'|DQRaSISIǑɃ(&IOpI -3l6Rn30'|DQRaSISICɃ(&IOpI RalSn30'|DQRaSISI<Ƀ(&IOpI l Sn30'|DQRaSISIɃ(&IOpI owNVn30'|DQRa-L-L!$˃C:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-msp\lVn30'|DQRaSISIr˃(&IOpI lžVn30'|DQRaSISIO ̃(&IOpI fiVn30'|DQRa.L-LṼC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms1Z a23lVn30'|DQRaSISIõ(&IOpI lZVn30'|DQRaSISIU,̃(&IOpI 0AXn30'|DQRa-L-LS}̓C:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-mslXn30'|DQRaSISI(̓(&IOpI 0Al Yn30'|DQRaSISIhO̓(&IOpI lYn30'|DQRaSISIؗ̓(&IOpI fi"Yn30'|DQRa.L-LI̓C:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms1Za9c iYn30'|DQRa-L-Lؓ̓knownfolder:{FDD39AD0-238F-46AF-ADB4-6C85480369C7}a1jYn30'|DQRa-L-L,S̓C:\Users\exploitfil1\DocumentslA}Yn30'|DQRaSISI<̓(&IOpI loYn30'|DQRa.L-L ̓C:\Users\exploitfil1\Documents`sZ@aeYn30'|DQRa.L-L@P̓knownfolder:{FDD39AD0-238F-46AF-ADB4-6C85480369C7} Xa\Yn30'|DQRa/L/Lub̓ZECYn30'|DQRa0L/LU̓ZC:\Users\exploitfil1\Desktop\ Yn30'|DQRa/L/L=>̓Zfi;Yn30'|DQRa0L/L%`̓ZC:\Users\exploitfil1\Desktop438Yn30'|DQRa-L-L#̓C:\Users\exploitfil1\Documents1!Yn30'|DQRa.L-L̓C:\Users\exploitfil1\Documentsd``a0Q Zn30'|DQRa-L-LB'6΃\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Documents}e Zn30'|DQRa.L-L.8΃\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Documentsd``a qZn30'|DQRa-L-Lr<΃\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Documents3f- @Zn30'|DQRa.L-L>΃\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Documents XaD!Zn30'|DQRa-L-LR-?΃shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\::{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}  & U8P -/Zn30'|DQRa.L-LSL΃shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\::{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}p]@a2Zn30'|DQRa-L-L.N΃C:\Users\exploitfil1\DocumentsR4Zn30'|DQRa.L-L[O΃C:\Users\exploitfil1\Documentsd`aZn30'|DQRa.L-LeV΃\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Documentsd`aDZn30'|DQRa-L-L~Z΃\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Documentsste r҃(&IOpI l`n30'|DQRaSISI҃(&IOpI 0Al`n30'|DQRaSISI*҃(&IOpI l`n30'|DQRaSISI˞҃(&IOpI fil`n30'|DQRaSISI҃(&IOpI itl`n30'|DQRaSISI҃(&IOpI enlp`n30'|DQRaSISIn҃(&IOpI -LlGan30'|DQRaSISIM҃(&IOpI C8l`an30'|DQRaSISIFӃ(&IOpI \UlGgan30'|DQRaSISI`Ӄ(&IOpI lnan30'|DQRaSISI Ӄ(&IOpI ltan30'|DQRaSISI+Ӄ(&IOpI lO{an30'|DQRaSISI}Ӄ(&IOpI r:lan30'|DQRaSISIӃ(&IOpI lan30'|DQRaSISIa-Ӄ(&IOpI lan30'|DQRaSISIm2Ӄ(&IOpI itl+an30'|DQRaSISIQ<Ӄ(&IOpI l%an30'|DQRaSISI9AӃ(&IOpI lan30'|DQRaSISI.HӃ(&IOpI -Lan30'|DQRa-L-LDjӃC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-msl bn30'|DQRaSISI%rӃ(&IOpI ?\lbn30'|DQRaSISI~Ӄ(&IOpI lol<+bn30'|DQRaSISIӃ(&IOpI 3bn30'|DQRa.L-LӃC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms\alLbn30'|DQRaSISIӃ(&IOpI \e{bn30'|DQRa-L-L-;ӃC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-msolbn30'|DQRaSISI]Ӄ(&IOpI Ralbn30'|DQRaSISI}Ӄ(&IOpI 80lbn30'|DQRaSISIӃ(&IOpI  X & U8P\bn30'|DQRa.L-L>ӃC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms\aɹbn30'|DQRa-L-LӃknownfolder:{18989B1D-99B5-455B-841C-AB7C74E4DDFC}|Dmbn30'|DQRa-L-LkӃC:\Users\exploitfil1\Videoslbn30'|DQRaSISI+Ӄ(&IOpI {0Ybn30'|DQRa.L-L@ӃC:\Users\exploitfil1\Videos09]abn30'|DQRa.L-L4&Ӄknownfolder:{18989B1D-99B5-455B-841C-AB7C74E4DDFC}X`a\bn30'|DQRa/L/L`hӃZbn30'|DQRa0L/LԎӃZC:\Users\exploitfil1\Desktopnts\bn30'|DQRa/L/LӃZ?\bn30'|DQRa0L/LlӃZC:\Users\exploitfil1\Desktopbn30'|DQRa-L-L@ӃC:\Users\exploitfil1\Videosbn30'|DQRa.L-LӃC:\Users\exploitfil1\Videos]abn30'|DQRa-L-L)ԃ\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Videos*bn30'|DQRa.L-Le> ԃ\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Videosp^aRaibn30'|DQRa-L-LVԃ\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\VideosSIbn30'|DQRa.L-Lԃ\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Videospv^`a&Ibn30'|DQRa-L-Lyԃshell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\::{A0953C92-50DC-43BF-BE83-3742FED03C9C} cn30'|DQRa.L-Lԃshell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\::{A0953C92-50DC-43BF-BE83-3742FED03C9C}p]acn30'|DQRa-L-L5ԃC:\Users\exploitfil1\Videoscn30'|DQRa.L-LһԃC:\Users\exploitfil1\Videos]aDcn30'|DQRa-L-L$ԃ\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Videos\Wcn30'|DQRa.L-L'&ԃ\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Videos}^a&I$cn30'|DQRa-L-Lw*ԃ\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\VideospI6'cn30'|DQRa.L-L۩+ԃ\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Videosp^a.cn30'|DQRa-L-LW0ԃ\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Videos'|D0cn30'|DQRa.L-LK2ԃ\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Videosp|^ado9dn30'|DQRa-L-L%eԃC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms,`dn30'|DQRa.L-LԃC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms\al1l{dn30'|DQRaSISIg Ճ(&IOpI liEdn30'|DQRa-L-LMq(ՃC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-msl{dn30'|DQRaSISI-Ճ(&IOpI \Llbdn30'|DQRaSISIB8Ճ(&IOpI SIldn30'|DQRaSISIRx@Ճ(&IOpI SI.dn30'|DQRa.L-LEՃC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms\axp=dn30'|DQRa-L-LQՃknownfolder:{4BD8D571-6D19-48D3-BE97-422220080E43}adn30'|DQRa-L-L'oQՃC:\Users\exploitfil1\Music4l0dn30'|DQRaSISI\Ճ(&IOpI dn30'|DQRa.L-L]ՃC:\Users\exploitfil1\Music\aIdn30'|DQRa.L-LlI^Ճknownfolder:{4BD8D571-6D19-48D3-BE97-422220080E43}p\a\kdn30'|DQRa/L/L|_Ճ`Z3Edn30'|DQRa0L/L4_Ճ`ZC:\Users\exploitfil1\Desktop\Cdn30'|DQRa/L/L(`Ճ`Zndn30'|DQRa0L/L.`Ճ`ZC:\Users\exploitfil1\Desktop X w&  8 PUen30'|DQRa-L-L]bՃC:\Users\exploitfil1\Music1,en30'|DQRa.L-LcՃC:\Users\exploitfil1\Musicp6Za en30'|DQRa-L-L}3vՃ\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Music"en30'|DQRa.L-L!wՃ\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Music0]a\?\(en30'|DQRa-L-Ln{Ճ\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Music,+en30'|DQRa.L-L~}Ճ\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Music]a\?\,en30'|DQRa-L-L~Ճshell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\::{1CF1260C-4DD0-4EBB-811F-33C572699FDE} #=en30'|DQRa.L-L.FՃshell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\::{1CF1260C-4DD0-4EBB-811F-33C572699FDE}0]`a?en30'|DQRa-L-LJ ՃC:\Users\exploitfil1\MusicC=Cen30'|DQRa.L-L7AՃC:\Users\exploitfil1\Music7ZacJen30'|DQRa-L-L{Ճ\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\MusicQRaMen30'|DQRa.L-LՃ\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Music0]aSen30'|DQRa-L-L Ճ\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\MusicQRa>Uen30'|DQRa.L-Lk Ճ\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Music]a\en30'|DQRa-L-LՃ\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\MusicQRa^en30'|DQRa.L-LhՃ\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Music]alDžen30'|DQRaSISIԸՃ(&IOpI selRen30'|DQRaSISI:Ճ(&IOpI '|Dlen30'|DQRaSISI>dՃ(&IOpI '|Dlen30'|DQRaSISIr!Ճ(&IOpI '|DlMgn30'|DQRaSISICփ(&IOpI '|Dlcgn30'|DQRaSISI Sփ(&IOpI '|Dlajgn30'|DQRaSISI փ(&IOpI '|Dlosgn30'|DQRaSISI փ(&IOpI '|DWnn30'|DQRa-L-LDۃC:\Users\exploitfil1\Searches\Indexed Locations.search-msl*enn30'|DQRaSISIO ۃ(&IOpI lunn30'|DQRaSISIђۃ(&IOpI  }nn30'|DQRa.L-LۃC:\Users\exploitfil1\Searches\Indexed Locations.search-ms'Y`alƚnn30'|DQRaSISI(ۃ(&IOpI nn30'|DQRa-L-LhۃC:\Users\exploitfil1\Searches\Everywhere.search-msIlAnn30'|DQRaSISIppۃ(&IOpI &Ilnn30'|DQRaSISIdۃ(&IOpI &Inn30'|DQRa.L-LۃC:\Users\exploitfil1\Searches\Everywhere.search-msalon30'|DQRaSISIrۃ(&IOpI on30'|DQRa-L-Lzۃshell:::{323CA680-C24D-4099-B94D-446DD2D7249E}|Don30'|DQRa-L-LۃC:\Users\exploitfil1\DesktopAӃlon30'|DQRaSISIx܃(&IOpI on30'|DQRa.L-L3܃C:\Users\exploitfil1\Desktop0}^aAppon30'|DQRa-L-LG܃C:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\LibrariespId on30'|DQRa.L-L;܃C:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Libraries`a !on30'|DQRa-L-L ܃C:\Users\exploitfil1\Documentsgl%on30'|DQRaSISI#܃(&IOpI o&on30'|DQRa.L-L܃C:\Users\exploitfil1\Documents\`a-L\'on30'|DQRa-L-L-܃C:\Users\exploitfil1\Musicol8,on30'|DQRaSISIT_ ܃(&IOpI SI-on30'|DQRa.L-L ܃C:\Users\exploitfil1\Musicu^`a-on30'|DQRa-L-Lpq ܃C:\Users\exploitfil1\Pictures h h&  U8Pl2on30'|DQRaSISID܃(&IOpI it3on30'|DQRa.L-LH7܃C:\Users\exploitfil1\Picturesb`a4on30'|DQRa-L-L\܃C:\Users\exploitfil1\Videosl\9on30'|DQRaSISI܃(&IOpI ":on30'|DQRa.L-Lx܃C:\Users\exploitfil1\Videosv^a;on30'|DQRa-L-L, ܃C:\Users\exploitfil1\Downloadsl?on30'|DQRaSISI܃(&IOpI 9@on30'|DQRa.L-Lt܃C:\Users\exploitfil1\DownloadsbaazEBon30'|DQRa-L-Ld܃C:\Users\exploitfil1aCon30'|DQRa.L-LI܃C:\Users\exploitfil10\aCon30'|DQRa.L-LQ܃shell:::{323CA680-C24D-4099-B94D-446DD2D7249E}P_`alySon30'|DQRaSISI$܃(&IOpI sljon30'|DQRaSISI2܃(&IOpI itl,qon30'|DQRaSISIJ7܃(&IOpI lLxon30'|DQRaSISI0<܃(&IOpI e6on30'|DQRa-L-LhJ܃C:\Users\exploitfil1\Linkslʙon30'|DQRaSISIDR܃(&IOpI selon30'|DQRaSISIYY܃(&IOpI '|DNon30'|DQRa.L-LZ܃C:\Users\exploitfil1\Links`sZaoP}on30'|DQRavvj܃Pon30'|DQRawv"j܃Ppon30'|DQRavv_m܃Pon30'|DQRawvn܃on30'|DQRa-L-LZq܃C:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Recent37lon30'|DQRaSISIC̀܃(&IOpI ellon30'|DQRaSISI$b܃(&IOpI -5\on30'|DQRa.L-Lw܃C:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Recentaavn30'|DQRa-L-LE C:\Users\exploitfil1\Links\RecentPlaces.lnk vn30'|DQRa.L-L1C:\Users\exploitfil1\Links\RecentPlaces.lnkaa_"vn30'|DQRa-L-LBAC:\Users\exploitfil1\Links\RecentPlaces.lnk7vn30'|DQRa.L-L;C:\Users\exploitfil1\Links\RecentPlaces.lnkdalSvn30'|DQRaSISID(&IOpI lo\TVvn30'|DQRa/L/LHGPZVvn30'|DQRa0L/LrPZC:\Users\exploitfil1\Desktopdeo\Vvn30'|DQRa/L/L쨻PZp_Yvn30'|DQRa0L/LdCPZDesktopPYvn30'|DQRavvP [vn30'|DQRawv [PC^vn30'|DQRavvwPk_vn30'|DQRawv6\evn30'|DQRa/L/LdZ\Up%gvn30'|DQRa0L/LGZDesktop\|vn30'|DQRa/L/LFlZ-Lڊvn30'|DQRa0L/LVZC:\Users\exploitfil1\Desktopies\vn30'|DQRa/L/L#Z!vn30'|DQRa0L/LwZC:\Users\exploitfil1\Desktop)vn30'|DQRa-L-LߎC:\Users\exploitfil1\DesktopMuslvn30'|DQRaSISIK(&IOpI l:vn30'|DQRaSISI(&IOpI vn30'|DQRa.L-L+C:\Users\exploitfil1\Desktopaa30'|Dvn30'|DQRa-L-LȜჲC:\Users\exploitfil1\Links\Desktop.lnkLvn30'|DQRa.L-LჲC:\Users\exploitfil1\Links\Desktop.lnkp]a:(vn30'|DQRa-L-L9ჲC:\Users\exploitfil1\Links\Desktop.lnklvn30'|DQRaSISIჲ(&IOpI vn30'|DQRa.L-L1ჲC:\Users\exploitfil1\Links\Desktop.lnkPdal4vn30'|DQRaSISIӏ(ჲ(&IOpI vn30'|DQRa-L-LO *ჲshell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\::{374DE290-123F-4565-9164-39C4925E467B} wn30'|DQRa.L-Ls5ჲshell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\::{374DE290-123F-4565-9164-39C4925E467B} ^awn30'|DQRa-L-LP07ჲC:\Users\exploitfil1\Downloads P &  8 PUlwn30'|DQRaSISI@<ჲ(&IOpI itl(wn30'|DQRaSISI\Dჲ(&IOpI \Ue*wn30'|DQRa.L-L FჲC:\Users\exploitfil1\Downloadsж]auPz0wn30'|DQRavv JჲP1wn30'|DQRawvKჲP5wn30'|DQRavvUvMჲP6wn30'|DQRawv >NჲeC:\Windows\System32\rundll32.exe94D螞n30'|DQRa.L-LILC:\Windows\System32\rundll32.exe@a`a@@_n30'|DQRaC:\Windows\System32\rundll32.exeSI+n30'|DQRaC:\Windows\System32\rundll32.exe&IVn30'|DQRaC:\Windows\System32\rundll32.exeLinןn30'|DQRa%%@o(&IOpIM rundll32.exe00000000Mߡn30'|DQRa%% <D"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iesetup.dll",IEHardenUserᡞn30'|DQRaTSL>{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}exploitfil1|DP⡞n30'|DQRaSSk>{C9E9A340-D1F1-11D0-821E-444553540600}exploitfil1a 㡞n30'|DQRaSS[?{de5aed00-a4bf-11d1-9948-00c04f98bbc9}exploitfil1l㡞n30'|DQRaSSSZ?{E92B03AB-B707-11d2-9CBD-0000F87A369E}exploitfil1P 䡞n30'|DQRaUU?P䡞n30'|DQRaVU/@䡞n30'|DQRaRQS%@Software\Microsoft\Active Setup\Installed ComponentsP䡞n30'|DQRaPO7@PUn30'|DQRa%%|MLPn30'|DQRa%%MTP :n30'|DQRa%"eenTn30'|DQRa|%UePn30'|DQRa%%ePn30'|DQRa%%fX<n30'|DQRamm yO=n30'|DQRaymamXz-ARC: RefreshCache: smrcf=0x4f/LP>n30'|DQRaJJzPRn30'|DQRabbbP~gn30'|DQRacbXhn30'|DQRaJJC,0sn30'|DQRa-L-L7kC:\Users\exploitfil1\AppData\Local\Microsoft\Windows\Application Shortcutsln30'|DQRaSISI$(&IOpI '|Dn30'|DQRa.L-LH;C:\Users\exploitfil1\AppData\Local\Microsoft\Windows\Application ShortcutsXaPn30'|DQRaJJXn30'|DQRaJJ',2n30'|DQRaymams-ARC: Registered root#0 for change notification: id=0n30'|DQRa-L-LaC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Start Menul%΢n30'|DQRaSISI(&IOpI lТn30'|DQRa.L-LBvC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Start Menu0]aPܢn30'|DQRaJJXޢn30'|DQRaJJ",ߢn30'|DQRaymamV-ARC: Registered root#1 for change notification: id=1]䢞n30'|DQRa-L-LWC:\ProgramData\Microsoft\Windows\Start Menuln30'|DQRaSISI(&IOpI pIl^n30'|DQRaSISI(&IOpI rsn30'|DQRa.L-LC:\ProgramData\Microsoft\Windows\Start Menu^aPn30'|DQRaJJXn30'|DQRaJJR,n30'|DQRaymam-ARC: Registered root#3 for change notification: id=2::P n30'|DQRaJJX n30'|DQRaJJX,  :M&  8 PU n30'|DQRaymamd-ARC: Registered root#6 for change notification: id=3n30'|DQRa-L-LxC:\Users\Public\Desktopl"n30'|DQRaSISIB(&IOpI '|Dl*n30'|DQRaSISI(&IOpI -n30'|DQRa.L-LY'C:\Users\Public\Desktoppe]aP.n30'|DQRaJJ1X.n30'|DQRaJJ+, /n30'|DQRaymamyf-ARC: Registered root#7 for change notification: id=49n30'|DQRa-L-LmXC:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinnedl\n30'|DQRaSISIe6(&IOpI $dcn30'|DQRa.L-L":C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned%]aPon30'|DQRaJJoBXIpn30'|DQRaJJC,pn30'|DQRaymam]C-ARC: Registered root#8 for change notification: id=5\U4qn30'|DQRaymamC-ARC: UpdateCache: smrcf=0x4f'|DPSqn30'|DQRawmmCPn30'|DQRaqmn L[ln30'|DQRaSISI8j(&IOpI l꿣n30'|DQRaSISICw(&IOpI lȣn30'|DQRaSISI}(&IOpI \Slϣn30'|DQRaSISI9(&IOpI pIl&ۣn30'|DQRaSISIR(&IOpI pIlr壞n30'|DQRaSISIڏ(&IOpI  pIP%n30'|DQRaz8n30'|DQRa-L-L@UC:\Users\exploitfil1\Desktop;n30'|DQRa.L-LKC:\Users\exploitfil1\Desktoppy^hRoa?n30'|DQRa-L-LC:\Users\Public\Desktop@n30'|DQRa.L-LyC:\Users\Public\Desktoppy^dBn30'|DQRa-L-Lshell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\::{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0} LQn30'|DQRa.L-L=}shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\::{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}^nRn30'|DQRa-L-LC:\Users\exploitfil1\Documents4{Sn30'|DQRa.L-LC:\Users\exploitfil1\Documents@a@oI\Wn30'|DQRa-L-LpC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Network ShortcutsexpXn30'|DQRa.L-LvC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Network ShortcutsdQRa"mn30'|DQRa-L-LC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Printer Shortcuts:\Wnn30'|DQRa.L-LZC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Printer Shortcuts@f32\P sun30'|DQRa#P n30'|DQRa P<n30'|DQRaJJn30'|DQRa-L-LpOC:\Users\Public\Desktop`n30'|DQRa.L-L2C:\Users\Public\DesktopdX:Ťn30'|DQRa JJ^"$PŤn30'|DQRaJJ"=㤞n30'|DQRa-L-L6C:\Users\exploitfil1\AppData\Local\Microsoft\Windows\Application Shortcuts䤞n30'|DQRa.L-L7C:\Users\exploitfil1\AppData\Local\Microsoft\Windows\Application ShortcutsxeSXn30'|DQRa JJF$Pn30'|DQRaJJf@Gn30'|DQRa-L-LWC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Start Menu,n30'|DQRa.L-L׬XC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Start MenuaaunX#n30'|DQRa JJ1`$PQ$n30'|DQRaJJ`4n30'|DQRa-L-LlqkC:\ProgramData\Microsoft\Windows\Start Menu"6n30'|DQRa.L-LKlC:\ProgramData\Microsoft\Windows\Start MenugXGAn30'|DQRa JJ̚s$  & U8PPCn30'|DQRaJJ 9uSn30'|DQRa-L-LaC:\Users\exploitfil1\DesktopTUn30'|DQRa.L-LAC:\Users\exploitfil1\DesktopPapIX]n30'|DQRa JJ%$P$^n30'|DQRaJJyon30'|DQRa-L-LEC:\Users\Public\Desktoppn30'|DQRa.L-L孒C:\Users\Public\DesktopPbXvn30'|DQRa JJ$PUwn30'|DQRaJJ&юn30'|DQRa-L-L`C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned32$n30'|DQRa.L-LC:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned@X nXn30'|DQRa JJsM$P n30'|DQRavvPKn30'|DQRawv³Pzn30'|DQRavv0Pyn30'|DQRawvյPn30'|DQRavvTPn30'|DQRawvPn30'|DQRavv;Pn30'|DQRawv_عPîn30'|DQRavvFPn30'|DQRawvPn30'|DQRavv!Pn30'|DQRawvPᵥn30'|DQRavvKPn30'|DQRawvP1n30'|DQRavvP)n30'|DQRawvĹPn30'|DQRavvEP|n30'|DQRawvPn30'|DQRavv@Pzn30'|DQRawvLP¥n30'|DQRavv|\Pån30'|DQRawvpPťn30'|DQRavv,JPƥn30'|DQRawvsn30'|DQRamn8iMicrosoft.Windows.DocumentsYYYp\PŪn30'|DQRavvyEPn30'|DQRawv6+-Pn30'|DQRavvD-Pn30'|DQRawvs-Pn30'|DQRa-L-L80C:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Start Menu\Programsn30'|DQRa.L-LGC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Start Menu\ProgramsLgsLn30'|DQRa-L-LhC:\ProgramData\Microsoft\Windows\Start Menu\ProgramslPfn30'|DQRaSISIy(&IOpI  ghn30'|DQRa.L-L`zC:\ProgramData\Microsoft\Windows\Start Menu\Programs`decrolsn30'|DQRaSISIUr(&IOpI !Ra^zn30'|DQRamm DocumentsMicrosoft.Windows.Documents91{n30'|DQRazmm5Microsoft.Windows.Documentsr2n30'|DQRa-L-LC:\Program Filesl׏n30'|DQRaSISI=(&IOpI "'|D\n30'|DQRa.L-LC:\Program FilesVeid=P SIn30'|DQRaHHϵT n30'|DQRaJJhicT&n30'|DQRaJJǞ'|DP$n30'|DQRaJJ^P ^n30'|DQRaJJ )P n30'|DQRaHH 5TÞn30'|DQRamn %C:\Program Files\Internet Explorer\VisualElementsManifest.xmlNULLsĞn30'|DQRamn C:\Program Files\Internet Explorer\iexplore.VisualElementsManifest.xmlNULLx'[͞n30'|DQRaMV%dvPxn[͞n30'|DQRa vV%dvPPSўn30'|DQRavv={Pўn30'|DQRawv5|Pўn30'|DQRavv|PHўn30'|DQRawva}Jўn30'|DQRamm EInternet ExplorerMicrosoft.InternetExplorer.Default,ўn30'|DQRazmm6rMicrosoft.InternetExplorer.DefaultcatbԞn30'|DQRamnQOMicrosoft.Windows.Pictures JQRaP"gԞn30'|DQRavv RPgԞn30'|DQRawvIR h u& 8 PUP8hԞn30'|DQRavv2SPhԞn30'|DQRawv1`SԞn30'|DQRamm oPicturesMicrosoft.Windows.Pictures9pWԞn30'|DQRazmmRpMicrosoft.Windows.Pictures30'|DԞn30'|DQRa-L-LcC:\Windows\system32\magnify.execԞn30'|DQRa.L-L C:\Windows\system32\magnify.exe`kԞn30'|DQRa-L-LqC:\Windows\system32\magnify.exeԞn30'|DQRa.L-LnC:\Windows\system32\magnify.exeg(F՞n30'|DQRa3I3IC:\Windows\system32\magnify.exeP֞n30'|DQRa4I3IC:\Windows\system32\magnify.exe^[Rܞn30'|DQRamn#NULL J-LP[ܞn30'|DQRavv#P,ܞn30'|DQRawv#Pܞn30'|DQRavv@#Pܞn30'|DQRawvR#ܞn30'|DQRamm @K#Magnifier{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\magnify.exe8dܞn30'|DQRazmmd#{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\magnify.exeach_ݞn30'|DQRa-L-LQj#C:\Windows\system32\narrator.exeQRadݞn30'|DQRa.L-L#C:\Windows\system32\narrator.exe` n30'|DIݞn30'|DQRa-L-L#$C:\Windows\system32\narrator.exeMݞn30'|DQRa.L-L &$C:\Windows\system32\narrator.exe n30'|Dvݞn30'|DQRa3I3IiA$C:\Windows\system32\narrator.exe<n30'|DQRa4I3In+C:\Windows\system32\narrator.exe30'|D^n30'|DQRamn,NULL JsPn30'|DQRavv+,Pn30'|DQRawvB,Pn30'|DQRavv;^,Pn30'|DQRawv,Wn30'|DQRamm ,Narrator{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\narrator.exe8-Ln30'|DQRazmm1,{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\narrator.exe1Cn30'|DQRa-L-Lo,C:\Windows\system32\osk.exen30'|DQRa.L-L,C:\Windows\system32\osk.exe@lJn30'|DQRa-L-L#-C:\Windows\system32\osk.exe n30'|DQRa.L-LH%-C:\Windows\system32\osk.exe`1n30'|DQRa3I3I>-C:\Windows\system32\osk.exen30'|DQRa4I3I-C:\Windows\system32\osk.exe^n30'|DQRamn/NULL J1Pn30'|DQRavv~/PRn30'|DQRawv!/Pn30'|DQRavv/Pˬn30'|DQRawvA//n30'|DQRamm o/On-Screen Keyboard{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\osk.exe8Jn30'|DQRazmm/{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\osk.exe#n30'|DQRa-L-L/C:\Windows\system32\notepad.exe n30'|DQRa.L-L/C:\Windows\system32\notepad.exekMn30'|DQRa-L-L*/C:\Windows\system32\notepad.exe|Pn30'|DQRa.L-Lyg/C:\Windows\system32\notepad.exe@l|n30'|DQRa3I3I};0C:\Windows\system32\notepad.exe n30'|DQRa4I3I1C:\Windows\system32\notepad.exe^=n30'|DQRamn+3NULLnPPDn30'|DQRavv/3PBn30'|DQRawvwc3Pn30'|DQRavvgd3Pin30'|DQRawvn30'|DQRavv7Pmn30'|DQRawv;87Pmn30'|DQRavvFU87Pnn30'|DQRawv~87n30'|DQRamm G7Administrative ToolsMicrosoft.Windows.AdministrativeTools930'|Dąn30'|DQRazmm H7Microsoft.Windows.AdministrativeToolsfn30'|DQRa-L-LNK7C:\Windows\system32\cmd.exen30'|DQRa.L-LBL7C:\Windows\system32\cmd.exe,n30'|DQRa-L-Lc7C:\Windows\system32\cmd.exeIn30'|DQRa.L-Ld7C:\Windows\system32\cmd.exe0*@n30'|DQRa3I3Ig7C:\Windows\system32\cmd.exe{n30'|DQRa4I3I y9C:\Windows\system32\cmd.exe^#n30'|DQRamn3o9NULLYYYaPA&n30'|DQRavv9P&n30'|DQRawv19P&n30'|DQRavvB9P&n30'|DQRawvw\9Cn30'|DQRamm w(9Command Prompt{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\cmd.exe8GDn30'|DQRazmm9{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\cmd.exe30'|Dn30'|DQRamn{+:Microsoft.Windows.Computer JPQn30'|DQRavv,:Pn30'|DQRawv%-:Pn30'|DQRavvt6-:Pn30'|DQRawvM-:n30'|DQRamm ;:This PCMicrosoft.Windows.Computer9n30'|DQRazmm+<:Microsoft.Windows.Computerwn30'|DQRamnh<Microsoft.Windows.ControlPanel JP!n30'|DQRavv@V<Pvn30'|DQRawvx<Pn30'|DQRavvd<Pn30'|DQRawv,<n30'|DQRamm G<Control PanelMicrosoft.Windows.ControlPanel9o* n30'|DQRazmm<Microsoft.Windows.ControlPanelexpn30'|DQRamn'^=Microsoft.Windows.ExplorergPGn30'|DQRavvb=Pn30'|DQRawvjb=Pn30'|DQRavvb=Pbn30'|DQRawvb=n30'|DQRamm v}=File ExplorerMicrosoft.Windows.Explorer9\Sn30'|DQRazmm-~=Microsoft.Windows.Explorer&I]n30'|DQRamnB?Microsoft.Windows.Helppaneft.Pn30'|DQRavv{?Pn30'|DQRawv*?Pn30'|DQRavvR?Pn30'|DQRawv/?n30'|DQRamm B@Help and SupportMicrosoft.Windows.Helppane9n30'|DQRazmm0 @Microsoft.Windows.Helppane'@ n30'|DQRamn_.UNULL JP2(n30'|DQRavv0UP2(n30'|DQRawvR90UP2(n30'|DQRavvJ0UP3(n30'|DQRawvFc0UE(n30'|DQRamm ΁/n30'|DQRa-L-L4rYC:\Windows\system32\compmgmt.mscQRa/n30'|DQRa.L-L tYC:\Windows\system32\compmgmt.msc%b= =/n30'|DQRa-L-LBYC:\Windows\system32\compmgmt.msc >/n30'|DQRa.L-LFYC:\Windows\system32\compmgmt.msc^{r/n30'|DQRamn@YNULL JPt/n30'|DQRavvYPu/n30'|DQRawvYPu/n30'|DQRavvYP@u/n30'|DQRawvYY/n30'|DQRamm ZComputer ManagementMicrosoft.AutoGenerated.{8ABD94FB-E7D6-84A6-A997-C918EDDE0AE5}8t.WO/n30'|DQRazmmG`ZMicrosoft.AutoGenerated.{8ABD94FB-E7D6-84A6-A997-C918EDDE0AE5}30'|Dn/n30'|DQRa-L-L׾ZC:\Windows\system32\dfrgui.exe/n30'|DQRa.L-L ZC:\Windows\system32\dfrgui.exe`#a,D3n30'|DQRa-L-L io\C:\Windows\system32\dfrgui.exeE3n30'|DQRa.L-L\op\C:\Windows\system32\dfrgui.exep&a[3n30'|DQRa3I3I~\C:\Windows\system32\dfrgui.exe|DE4n30'|DQRa4I3I6\C:\Windows\system32\dfrgui.exe^y7n30'|DQRamn 1_NULL{vP`|7n30'|DQRavv<2_P|7n30'|DQRawv2_P|7n30'|DQRavv2_P|7n30'|DQRawv(3_7n30'|DQRamm O?_Defragment and Optimize Drives{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\dfrgui.exe87n30'|DQRazmm@_{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\dfrgui.exe7n30'|DQRa-L-LGC_C:\Windows\system32\eventvwr.mscZ7n30'|DQRa.L-L+D_C:\Windows\system32\eventvwr.msc  CL& 8 PUe@n30'|DQRa-L-L).eC:\Windows\system32\eventvwr.msc@n30'|DQRa.L-L/eC:\Windows\system32\eventvwr.msc QRa^6JAn30'|DQRamneNULL JPLAn30'|DQRavvePAMAn30'|DQRawv ePZMAn30'|DQRavv eP|MAn30'|DQRawv#ecAn30'|DQRamm eEvent ViewerMicrosoft.AutoGenerated.{BB044BFD-25B7-2FAA-22A8-6371A93E0456}8dAn30'|DQRazmmyeMicrosoft.AutoGenerated.{BB044BFD-25B7-2FAA-22A8-6371A93E0456}QRaPjAn30'|DQRa-L-Lu eC:\Windows\system32\iscsicpl.exe3IkAn30'|DQRa.L-L]eC:\Windows\system32\iscsicpl.exe` ULLdGn30'|DQRa-L-LiiC:\Windows\system32\iscsicpl.exeDlGn30'|DQRa.L-LAiC:\Windows\system32\iscsicpl.exe) Hn30'|DQRa3I3I jC:\Windows\system32\iscsicpl.exeEB1(]Jn30'|DQRa4I3IkC:\Windows\system32\iscsicpl.exe-02^Jn30'|DQRamnB+kNULL JP\Kn30'|DQRavv:kPKn30'|DQRawv>kPKn30'|DQRavv"kPKn30'|DQRawvN9kKn30'|DQRamm NliSCSI Initiator{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\iscsicpl.exe8doKn30'|DQRazmmxl{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\iscsicpl.exeteTKn30'|DQRa-L-L4 lC:\Windows\system32\MdSched.exebKn30'|DQRa.L-L22 lC:\Windows\system32\MdSched.exexPPn30'|DQRa-L-LtoC:\Windows\system32\MdSched.exeRPn30'|DQRa.L-LuoC:\Windows\system32\MdSched.exe` ukPn30'|DQRa3I3I.oC:\Windows\system32\MdSched.exe Qn30'|DQRa4I3IoC:\Windows\system32\MdSched.exe^A/Qn30'|DQRamnAIpNULLYYYaP1Qn30'|DQRavvpP92Qn30'|DQRawv1pPR2Qn30'|DQRavvBpPv2Qn30'|DQRawvYp+EQn30'|DQRamm pWindows Memory Diagnostic{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\MdSched.exe8xFQn30'|DQRazmm6p{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\MdSched.exeBKQn30'|DQRa-L-LpC:\Windows\syswow64\odbcad32.exeLQn30'|DQRa.L-LpC:\Windows\syswow64\odbcad32.exe@pv*^Vn30'|DQRa-L-LaksC:\Windows\syswow64\odbcad32.exeQRa$`Vn30'|DQRa.L-LalsC:\Windows\syswow64\odbcad32.exemOfVn30'|DQRa3I3I(sC:\Windows\syswow64\odbcad32.exe[n30'|DQRa4I3IvC:\Windows\syswow64\odbcad32.exe^B ]n30'|DQRamnizwNULL JePP ]n30'|DQRavvxwP ]n30'|DQRawv%wP ]n30'|DQRavvwP ]n30'|DQRawvw ]n30'|DQRamm ]wODBC Data Sources (32-bit){D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\odbcad32.exe8!]n30'|DQRazmmw{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\odbcad32.exer.']n30'|DQRa-L-LwC:\Windows\system32\odbcad32.exevh)]n30'|DQRa.L-L wC:\Windows\system32\odbcad32.exe rt_n30'|DQRa-L-L߽hyC:\Windows\system32\odbcad32.exeT_n30'|DQRa.L-L#iyC:\Windows\system32\odbcad32.exe@vQRa_n30'|DQRa3I3I>xyC:\Windows\system32\odbcad32.exebn30'|DQRa4I3I{C:\Windows\system32\odbcad32.exees\^tgn30'|DQRamn$~NULL JPgn30'|DQRavv|\~Pmgn30'|DQRawv<~Pgn30'|DQRavv ~Pgn30'|DQRawv~ ` Nc& U8P{gn30'|DQRamm ~ODBC Data Sources (64-bit){1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\odbcad32.exe830'|DZgn30'|DQRazmm;~{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\odbcad32.exeRagn30'|DQRa-L-L~C:\Windows\system32\perfmon.mscgn30'|DQRa.L-L#~C:\Windows\system32\perfmon.msc`t\hn30'|DQRa-L-L`~3C:\Windows\system32\perfmon.msc`hn30'|DQRa.L-L5C:\Windows\system32\perfmon.mscx^hn30'|DQRamn1cNULL{WP&hn30'|DQRavvdPxhn30'|DQRawvKdPhn30'|DQRavv_dPhn30'|DQRawv7ehn30'|DQRamm BKuPerformance MonitorMicrosoft.AutoGenerated.{8AA47365-B2B3-1961-69EB-F866E376B12F}8badLhn30'|DQRazmmNuMicrosoft.AutoGenerated.{8AA47365-B2B3-1961-69EB-F866E376B12F}+)n30'|DQRamm Server Manager{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\ServerManager.exe8 *n30'|DQRazmm耭{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\ServerManager.exe/n30'|DQRa-L-LL%C:\Windows\system32\services.mscAA-*1n30'|DQRa.L-L/C:\Windows\system32\services.msc@ycplrn30'|DQRa-L-L ݔC:\Windows\system32\services.msccplGtn30'|DQRa.L-L!ޔC:\Windows\system32\services.msc`tcpl^dn30'|DQRamnDNULLPᄍn30'|DQRavv{Pkn30'|DQRawvχPn30'|DQRavvᇗPn30'|DQRawv2n30'|DQRamm Services{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\services.msc8^n30'|DQRazmmИ{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\services.mscܥn30'|DQRa-L-LC:\Windows\system32\msconfig.exemn30'|DQRa.L-LGC:\Windows\system32\msconfig.exe`z򼏟n30'|DQRa-L-LMoC:\Windows\system32\msconfig.exe}\in30'|DQRa.L-LC:\Windows\system32\msconfig.exe`zُn30'|DQRa3I3IM6C:\Windows\system32\msconfig.exeqn30'|DQRa4I3IZf}C:\Windows\system32\msconfig.exeed.^`n30'|DQRamnNULL JWP쭐n30'|DQRavvq4PIn30'|DQRawvmPcn30'|DQRavv}Pn30'|DQRawvᔙn30'|DQRamm x System Configuration{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\msconfig.exe8dn30'|DQRazmmX{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\msconfig.exe'|Deǐn30'|DQRa-L-Ld婙C:\Windows\system32\msinfo32.exeemoɐn30'|DQRa.L-L򪙄C:\Windows\system32\msinfo32.exe``zmOn30'|DQRa-L-L𝄲C:\Windows\system32\msinfo32.exeSn30'|DQRa.L-L,󝄲C:\Windows\system32\msinfo32.exeqQRann30'|DQRa3I3IC:\Windows\system32\msinfo32.exen30'|DQRa4I3IpC:\Windows\system32\msinfo32.exe^璘n30'|DQRamn}ĞNULL JsPn30'|DQRavvQƞPn30'|DQRawvƞP5n30'|DQRavvΞƞP[n30'|DQRawvƞn30'|DQRamm :՞System Information{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\msinfo32.exe8n30'|DQRazmm՞{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\msinfo32.exen30'|DQRa-L-L*ٞC:\Windows\system32\taskschd.mscDat)n30'|DQRa.L-LڞC:\Windows\system32\taskschd.msc`z30'|Dn30'|DQRa-L-L{C:\Windows\system32\taskschd.mscxe&n30'|DQRa.L-LC:\Windows\system32\taskschd.msc`r]^#n30'|DQRamn9#NULLYYY\P%n30'|DQRavv$P*&n30'|DQRawv$PD&n30'|DQRavv$Pf&n30'|DQRawvO%a:n30'|DQRamm #2Task SchedulerMicrosoft.AutoGenerated.{C1C6F8AC-40A3-0F5C-146F-65A9DC70BBB4}8';n30'|DQRazmm2Microsoft.AutoGenerated.{C1C6F8AC-40A3-0F5C-146F-65A9DC70BBB4}8@n30'|DQRa-L-Lw5C:\Windows\system32\WF.msc|DAn30'|DQRa.L-L[6C:\Windows\system32\WF.msctas=n30'|DQRa-L-LqC:\Windows\system32\WF.msc x( ֏&x U8P:Bn30'|DQRa.L-L5tC:\Windows\system32\WF.mscrE^_n30'|DQRamn<2NULLG&Pn30'|DQRavv ࡤPSn30'|DQRawvPln30'|DQRavv(Pn30'|DQRawvL?/n30'|DQRamm ܫWindows Firewall with Advanced Security{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\WF.msc8%n30'|DQRazmmw{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\WF.mscxn30'|DQRa-L-L=C:\Windows\SysWOW64n30'|DQRa.L-L/C:\Windows\SysWOW64`vn30'|DQRa3I3IQ𤄲C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exen30'|DQRa4I3IC7C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeB2^rMn30'|DQRamnBNULL J|DPOn30'|DQRavvFçPGPn30'|DQRawv}~çPbPn30'|DQRavvçPPn30'|DQRawveçJcn30'|DQRaymamϧUfhRecentShortcutAdd: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Windows PowerShell (x86).lnk in30'|DQRamm ԧWindows PowerShell (x86){D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\WindowsPowerShell\v1.0\powershell.exe0{jn30'|DQRazmmԧ{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\WindowsPowerShell\v1.0\powershell.exeqn30'|DQRa-L-LUاC:\Windows\syswow64\WindowsPowerShell\v1.0\PowerShell_ISE.exern30'|DQRa.L-LQ3ڧC:\Windows\syswow64\WindowsPowerShell\v1.0\PowerShell_ISE.exeazonn30'|DQRa-L-L8C:\Windows\syswow64\WindowsPowerShell\v1.0\PowerShell_ISE.exe n30'|DQRa.L-L9C:\Windows\syswow64\WindowsPowerShell\v1.0\PowerShell_ISE.exea{\W*Cn30'|DQRa3I3IEPC:\Windows\syswow64\WindowsPowerShell\v1.0\PowerShell_ISE.exern30'|DQRa4I3IP]C:\Windows\syswow64\WindowsPowerShell\v1.0\PowerShell_ISE.exeRa^n30'|DQRamnNULLmPn30'|DQRavv_P`n30'|DQRawv๳Pyn30'|DQRavv񹳄Pn30'|DQRawv0pn30'|DQRamm JгWindows PowerShell ISE (x86){D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\WindowsPowerShell\v1.0\PowerShell_ISE.exe8#n30'|DQRazmmUѳ{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\WindowsPowerShell\v1.0\PowerShell_ISE.exeAFøn30'|DQRa-L-LhسC:\Windows\system32\WindowsPowerShell\v1.0\PowerShell_ISE.exeƸn30'|DQRa.L-LKڳC:\Windows\system32\WindowsPowerShell\v1.0\PowerShell_ISE.exe@axi'n30'|DQRa-L-LBC:\Windows\system32\WindowsPowerShell\v1.0\PowerShell_ISE.exew.*n30'|DQRa.L-LC:\Windows\system32\WindowsPowerShell\v1.0\PowerShell_ISE.exea@|\n30'|DQRa3I3IG~<C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell_ISE.exee.n30'|DQRa4I3I5C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell_ISE.exe'|D^ɺn30'|DQRamn]o+NULLvPpκn30'|DQRavv0.Pκn30'|DQRawv߱.Pκn30'|DQRavvc.PϺn30'|DQRawvg.$n30'|DQRamm }.CWindows PowerShell ISE{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\WindowsPowerShell\v1.0\PowerShell_ISE.exe8nﺟn30'|DQRazmm;D{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\WindowsPowerShell\v1.0\PowerShell_ISE.exeQn30'|DQRa-L-LKC:\Windows\system32\wbadmin.mscn30'|DQRa.L-LLC:\Windows\system32\wbadmin.msc`t;Dn30'|DQRa-L-Lְ{C:\Windows\system32\wbadmin.msc ( & 8 PUJLn30'|DQRa.L-L쀵C:\Windows\system32\wbadmin.mscx^!n30'|DQRamn/NULLPbn30'|DQRavv7Pn30'|DQRawvٶPϞn30'|DQRavv&궵P򞻟n30'|DQRawvحn30'|DQRamm *Windows Server Backup{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\wbadmin.msc8n30'|DQRazmmE{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\wbadmin.msco n30'|DQRa3I3IhC:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exen30'|DQRa4I3ISC:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe^C>n30'|DQRamnƶNULLG&sP Bn30'|DQRavv|ɶPgn30'|DQRawv:ⶄPhn30'|DQRavvTⶄP]hn30'|DQRawvⶄDn~n30'|DQRaymam𶄲UfhRecentShortcutAdd: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apache Tomcat 6.0 Tomcat6\Configure Tomcat.lnkn30'|DQRamm d{򶄲Configure TomcatMicrosoft.AutoGenerated.{1AEC703E-11FC-E192-2CBD-C87D1F2D0072}0Ran30'|DQRazmm[󶄲Microsoft.AutoGenerated.{1AEC703E-11FC-E192-2CBD-C87D1F2D0072}Xn30'|DQRa3I3IC:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe?;n30'|DQRa4I3IlC:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe^|n30'|DQRamnzNULLG&P~n30'|DQRavv똷PDn30'|DQRawvP^n30'|DQRavv'/Pn30'|DQRawvkF@n30'|DQRaymamfUfhRecentShortcutAdd: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apache Tomcat 6.0 Tomcat6\Monitor Tomcat.lnk֖n30'|DQRamm Monitor TomcatMicrosoft.AutoGenerated.{1B07E50E-936B-FF15-DA07-1C3981F0BE1E}0n30'|DQRazmmMicrosoft.AutoGenerated.{1B07E50E-936B-FF15-DA07-1C3981F0BE1E}7}\^p쾟n30'|DQRamn3හNULLYYYPn30'|DQRavvⷄPn30'|DQRawv(BⷄP゚n30'|DQRavvRⷄP5゚n30'|DQRawviⷄn30'|DQRamm -+뷄Tomcat 6.0 Program DirectoryC:\galaxie\deploy\Tomcat6 "9n30'|DQRazmm1뷄C:\galaxie\deploy\Tomcat6^Y_͟n30'|DQRamnkVNULL2Pk͟n30'|DQRavv^Pl͟n30'|DQRawv^P)l͟n30'|DQRavv0^PKl͟n30'|DQRawv^͟n30'|DQRamm oTomcat DocumentationC:\galaxie\deploy\Tomcat6\webapps\docs\index.html (͟n30'|DQRazmm&qC:\galaxie\deploy\Tomcat6\webapps\docs\index.htmlPѨΟn30'|DQRavvp./„PΟn30'|DQRawv(/„PΟn30'|DQRavv/„P_Οn30'|DQRawv/„Οn30'|DQRamm eA„Tomcat Home Pagehttp://tomcat.apache.org/ QRaΟn30'|DQRazmmB„http://tomcat.apache.org/P ϟn30'|DQRavv o„PR ϟn30'|DQRawvnho„Pq ϟn30'|DQRavv!p„P ϟn30'|DQRawva>p„ϟn30'|DQRamm |„Tomcat Host Managerhttp://127.0.0.1:8080/host-manager/html '|Dg ϟn30'|DQRazmmZ|„http://127.0.0.1:8080/host-manager/htmlPFϟn30'|DQRavvG„PFϟn30'|DQRawvg„PGϟn30'|DQRavvC͕„P#Gϟn30'|DQRawvG„+Uϟn30'|DQRamm „Tomcat Managerhttp://127.0.0.1:8080/manager/html Uϟn30'|DQRazmm(„http://127.0.0.1:8080/manager/html}tϟn30'|DQRa3I3I „C:\galaxie\deploy\Tomcat6\Uninstall.exeПn30'|DQRa4I3IڊuÄC:\galaxie\deploy\Tomcat6\Uninstall.exe^oПn30'|DQRamn2ÄNULLG&s H |ޘ& U8PPПn30'|DQRavv.ÄP`Пn30'|DQRawvgÄPПn30'|DQRavv{ÄPПn30'|DQRawvÄL(Пn30'|DQRaymam٨ÄUfhRecentShortcutAdd: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apache Tomcat 6.0 Tomcat6\Uninstall Tomcat 6.0.lnkПn30'|DQRamm MÄUninstall Tomcat 6.0Microsoft.AutoGenerated.{92B81F01-7C79-1CC6-0B37-E1922D2D5DB2} rПn30'|DQRazmmʧÄMicrosoft.AutoGenerated.{92B81F01-7C79-1CC6-0B37-E1922D2D5DB2}sWOPFџn30'|DQRavv1ÄPџn30'|DQRawv_ÄPџn30'|DQRavvpÄPџn30'|DQRawv\Ä џn30'|DQRamm ÄWelcomehttp://127.0.0.1:8080/ sWO8!џn30'|DQRazmm!QÄhttp://127.0.0.1:8080/nbџn30'|DQRa3I3IֈĄC:\Program Files\Java\jre7\bin\javacpl.exeaџn30'|DQRa4I3IfcHĄC:\Program Files\Java\jre7\bin\javacpl.exev^[џn30'|DQRamn$]ĄNULL JPҟn30'|DQRavv`ĄP$ҟn30'|DQRawv!vĄP$ҟn30'|DQRavv]9vĄP$ҟn30'|DQRawvdvĄW:ҟn30'|DQRaymamfĄUfhRecentShortcutAdd: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\About Java.lnk|D<ҟn30'|DQRamm ĄAbout JavaMicrosoft.AutoGenerated.{5D323BE4-1AA0-155B-B19B-C02B2F10E671}0<ҟn30'|DQRazmm ĄMicrosoft.AutoGenerated.{5D323BE4-1AA0-155B-B19B-C02B2F10E671}30'|D`ҟn30'|DQRa3I3I̸ĄC:\Program Files\Java\jre7\bin\javacpl.exexҟn30'|DQRa4I3IĄC:\Program Files\Java\jre7\bin\javacpl.exed^ҟn30'|DQRamntĄNULL JPҟn30'|DQRavvGĄPҟn30'|DQRawvwĄP8ҟn30'|DQRavv7ĄPZҟn30'|DQRawv_Ąҟn30'|DQRaymamńUfhRecentShortcutAdd: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Check For Updates.lnkerӟn30'|DQRamm !ńCheck For UpdatesMicrosoft.AutoGenerated.{9E6EBDDB-25A8-F971-1049-4510576A742B}0aUӟn30'|DQRazmmQńMicrosoft.AutoGenerated.{9E6EBDDB-25A8-F971-1049-4510576A742B}Sӟn30'|DQRa3I3I<ńC:\Program Files\Java\jre7\bin\javacpl.exeCӟn30'|DQRa4I3Ip%eńC:\Program Files\Java\jre7\bin\javacpl.exem^ӟn30'|DQRamnzńNULL JEPӟn30'|DQRavvw{ńPӟn30'|DQRawvn{ńPӟn30'|DQRavv{ńP>ӟn30'|DQRawv{ńӟn30'|DQRaymamńUfhRecentShortcutAdd: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Configure Java.lnk-Lzӟn30'|DQRamm fńConfigure Java{6D809377-6AF0-444B-8957-A3773F02200E}\Java\jre7\bin\javacpl.exe0\W-ӟn30'|DQRazmmń{6D809377-6AF0-444B-8957-A3773F02200E}\Java\jre7\bin\javacpl.exe^ԟn30'|DQRamn ńNULL J1P!ԟn30'|DQRavvAńPoԟn30'|DQRawvOqńPԟn30'|DQRavvńPԟn30'|DQRawv/ń#ԟn30'|DQRamm ńGet Helphttp://java.com/help ~z$ԟn30'|DQRazmmKńhttp://java.com/help^!qԟn30'|DQRamnńNULL JP9sԟn30'|DQRavvńPsԟn30'|DQRawv ńPsԟn30'|DQRavvFńPsԟn30'|DQRawv1ńԟn30'|DQRamm ƄVisit Java.comhttp://java.com/ llvCԟn30'|DQRazmm Ƅhttp://java.com/ԟn30'|DQRa3I3I6ƄC:\Program Files\Java\jdk1.7.0_45\bin\jmc.exedoN՟n30'|DQRa4I3IƄC:\Program Files\Java\jdk1.7.0_45\bin\jmc.exedo^q՟n30'|DQRamnuƄNULLG&Pt՟n30'|DQRavvƄ 0!a& 8 PUP5՟n30'|DQRawvƄPa՟n30'|DQRavv#ƄP՟n30'|DQRawvSƄBe՟n30'|DQRaymam7ƄUfhRecentShortcutAdd: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Java Mission Control.lnk:՟n30'|DQRamm (ƄJava Mission Control{6D809377-6AF0-444B-8957-A3773F02200E}\Java\jdk1.7.0_45\bin\jmc.exe0՟n30'|DQRazmmcƄ{6D809377-6AF0-444B-8957-A3773F02200E}\Java\jdk1.7.0_45\bin\jmc.exeRa^՟n30'|DQRamn_ƄNULL JiP՟n30'|DQRavvorƄP՟n30'|DQRawvƄP֟n30'|DQRavvoƄP9֟n30'|DQRawv7Ƅ ֟n30'|DQRamm %9DŽReference Documentationhttp://docs.oracle.com/javase  ֟n30'|DQRazmmDDŽhttp://docs.oracle.com/javase~+֟n30'|DQRa-L-LoDŽC:\Program Files (x86)o1֟n30'|DQRa.L-L !DŽC:\Program Files (x86)^^@Ub֟n30'|DQRa3I3I=DŽC:\Program Files (x86)\Notepad++\notepad++.exe0D֟n30'|DQRa4I3ILɒDŽC:\Program Files (x86)\Notepad++\notepad++.exeu^ןn30'|DQRamnYDŽNULL7P ןn30'|DQRavv1 DŽP-ןn30'|DQRawvV*DŽP-ןn30'|DQRavvBDŽP.ןn30'|DQRawvjnDŽ=ןn30'|DQRaymam{DŽUfhRecentShortcutAdd: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++\Notepad++.lnk]Eןn30'|DQRamm DŽNotepad++{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Notepad++\notepad++.exe0!Fןn30'|DQRazmm1DŽ{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Notepad++\notepad++.exeat6FYןn30'|DQRa-L-L޿DŽC:\Windows\system32\taskmgr.exeZןn30'|DQRa.L-LbDŽC:\Windows\system32\taskmgr.exe`9>#ٟn30'|DQRa-L-L ɄC:\Windows\system32\taskmgr.exe$ٟn30'|DQRa.L-LT ɄC:\Windows\system32\taskmgr.exe 4 e7ٟn30'|DQRa3I3I ɄC:\Windows\system32\taskmgr.exe~ٟn30'|DQRa4I3IDzɄC:\Windows\system32\taskmgr.exe^ܟn30'|DQRamn ʄNULLrPܟn30'|DQRavvY{ʄP:ܟn30'|DQRawvW˄P:ܟn30'|DQRavv˄P;ܟn30'|DQRawv'˄Uܟn30'|DQRamm "˄Task ManagerMicrosoft.AutoGenerated.{923DD477-5846-686B-A659-0FCCD73851A8}8+Vܟn30'|DQRazmm"˄Microsoft.AutoGenerated.{923DD477-5846-686B-A659-0FCCD73851A8}alax_ܟn30'|DQRa-L-L)˄C:\Windows\system32kܟn30'|DQRa.L-Lu0˄C:\Windows\system32`ܟn30'|DQRa3I3I._˄C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'|Dܟn30'|DQRa4I3Io˄C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe^ Pݟn30'|DQRamnj˄NULL J P4Rݟn30'|DQRavv˄PRݟn30'|DQRawv˄PRݟn30'|DQRavv˄PRݟn30'|DQRawv)˄.Tbݟn30'|DQRaymamd˄UfhRecentShortcutAdd: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Windows PowerShell.lnk8Pdݟn30'|DQRamm ˄Windows PowerShell{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\WindowsPowerShell\v1.0\powershell.exe0eݟn30'|DQRazmmH2˄{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\WindowsPowerShell\v1.0\powershell.exe^N>n30'|DQRamnlF҄NULL{PWBn30'|DQRavvI҄Pin30'|DQRawvc҄P+jn30'|DQRavvc҄Pljn30'|DQRawv9c҄~an30'|DQRaymamq҄UfhRecentShortcutAdd: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware\VMware Tools\dmarrer la journalisation de statistiques de la VM.lnk 8 [& U8P:^n30'|DQRamm ?t҄dmarrer la journalisation de statistiques de la VMMicrosoft.AutoGenerated.{14A21382-6511-3324-B505-306A7D8FF83A}0n30'|DQRazmm˺u҄Microsoft.AutoGenerated.{14A21382-6511-3324-B505-306A7D8FF83A}\PrlBn30'|DQRaSISI8}҄(&IOpI %lnPbn30'|DQRarmn ҄n30'|DQRaymam_m҄-ARC: Committing updated cache to disk. Cache size=76688>n30'|DQRaymamP"Ԅ-ARC: Loading cache to memory after committing updated cache to disk.`un30'|DQRamm L+ V,n30'|DQRaymamh䄲-ARC: Change notify=8192; Item: (40000000) C:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs; need scan=0 YXn30'|DQRaymamb䄲-ARC: Updated state store. Rebalanced=0, Commit hr=0x0.PYn30'|DQRa-L-L~䄲shell:::{4234d49b-0245-4df3-b780-3893943456e1}?`n30'|DQRa.L-LL䄲shell:::{4234d49b-0245-4df3-b780-3893943456e1}^`T`n30'|DQRaJJٲ䄲Pan30'|DQRaJJZ䄲an30'|DQRaymam䄲-ARC: Notify UPDATEDIR: 62 items changed during folder scan.Tan30'|DQRaJJ䄲amTbn30'|DQRaJJ8䄲\JPn30'|DQRaJJ9)儲Tn30'|DQRaJJ\)儲utPXn30'|DQRaJJӸ+儲Pn30'|DQRaJJ_,儲dn30'|DQRamm ?,儲>?-1Pːn30'|DQRaxmmy儲P n30'|DQRa}儲h n30'|DQRa|mmM儲StateChangeX n30'|DQRa~mm8儲X n30'|DQRa}mm儲f n30'|DQRa|mm5N儲AppInstallX n30'|DQRa~mmɧ儲X n30'|DQRa}mm儲l n30'|DQRa%%T儲(&IOpIlP &n30'|DQRao%o%*儲(&IOpI_rolP S n30'|DQRau%u%o儲(&IOpI$ecP,Pn30'|DQRa%%ז儲,n30'|DQRa-L-L@愲C:\Windows\system32\ServerManager.exe97,n30'|DQRa.L-LB愲C:\Windows\system32\ServerManager.exe_DDP,n30'|DQRaamnH愲P,.n30'|DQRabmn:O愲,En30'|DQRa-L-LߕW愲C:\Windows\system32\ServerManager.exe,n30'|DQRa.L-LX愲C:\Windows\system32\ServerManager.exeeP,n30'|DQRaamny\愲P,Un30'|DQRabmnb愲.,yn30'|DQRa-L-L4 j愲C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcutsaN,0(n30'|DQRa.L-Lz愲C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcutsP:\,3n30'|DQRa-L-L_N愲C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned$,JUn30'|DQRa.L-L=愲C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User PinnedPa v ,dn30'|DQRa-L-LW愲C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Server Manager.lnk*,Bn30'|DQRa.L-L^d愲C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Server Manager.lnk2,n30'|DQRa-L-LP愲C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools,n30'|DQRa.L-L愲C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools,xn30'|DQRa-L-LhV愲C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\F  `& 8 PU6,cn30'|DQRa.L-Lu焲C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\2 ,4n30'|DQRa-L-Lr焲C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Server Manager.lnk*,gn30'|DQRa.L-L$焲C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Server Manager.lnkA X, Tn30'|DQRa-L-L I焲C:\x,Tn30'|DQRa.L-L{I焲C:\UX,on30'|DQRa-L-L)[焲C:\x,apn30'|DQRa.L-Lz[焲C:\0P,n30'|DQRavvp焲P,n30'|DQRawvp焲lP >n30'|DQRaq%q%w焲(&IOpI`DolP ~n30'|DQRaZZZ焲(&IOpI,UlP n30'|DQRaZZr焲(&IOpI-aslP n30'|DQRaZZ2|焲(&IOpI.1 FlP In30'|DQRaII焲(&IOpIc\PP kn30'|DQRaII焲(&IOpIh (Undefined)P n30'|DQRaII}'焲(&IOpIl (Undefined)P n30'|DQRaIIM6焲(&IOpIm (Undefined)P n30'|DQRaII5D焲(&IOpIn (Undefined)P ̷n30'|DQRaII5R焲(&IOpId (Undefined)P n30'|DQRaII_焲(&IOpIo (Undefined)P n30'|DQRaII焲(&IOpIf (Undefined)P ln30'|DQRaII焲(&IOpIe (Undefined)P n30'|DQRaIIȊ焲(&IOpIg (Undefined)P n30'|DQRaII֊焲(&IOpIj (Undefined)P n30'|DQRaII焲(&IOpIq (Undefined)P n30'|DQRaII|焲(&IOpIp (Undefined)P ׸n30'|DQRaIIh焲(&IOpIk (Undefined)P n30'|DQRaIIl焲(&IOpIi (Undefined)P n30'|DQRaII0焲(&IOpI (Undefined)P n30'|DQRaII+焲(&IOpI( (Undefined)P .n30'|DQRaIIP;焲(&IOpI( (Undefined)P Fn30'|DQRaIIXK焲(&IOpI( (Undefined)P ^n30'|DQRaIIZ焲(&IOpI( (Undefined)P vn30'|DQRaIIpk焲(&IOpI( (Undefined)P n30'|DQRaIIHy焲(&IOpI) (Undefined)P n30'|DQRaII$焲(&IOpI) (Undefined)T,n30'|DQRaJJ_H$脲:,[n30'|DQRa-L-L$脲C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Server Manager.lnkZ,n30'|DQRa.L-L&脲C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Server Manager.lnkи:\WT n30'|DQRaJJ'脲Pɩn30'|DQRaJJ(脲P,n30'|DQRaJJe)脲l,޴n30'|DQRaSISI0脲(&IOpI &doT,En30'|DQRaJJr_脲 el,n30'|DQRa-L-L_脲C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar4,n30'|DQRa.L-L/a脲C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBaricTX n30'|DQRaJJ2b脲 ToP n30'|DQRaJJc脲P, n30'|DQRaJJd脲l, n30'|DQRaSISIf脲(&IOpI &owT,b n30'|DQRaJJ(f脲 T n30'|DQRaJJg脲 -4Xn30'|DQRaJJ]{턲P<n30'|DQRaJJ~턲Xvn30'|DQRaJJ 턲 Pn30'|DQRaJJA턲Xn30'|DQRaJJU턲 P"n30'|DQRaJJA}턲2n30'|DQRaymama턲-ARC: RefreshCache: smrcf=0x10o H & U8Pn30'|DQRaymam턲-ARC: Change notify=2; Item: (40010000) C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Server Manager.lnk; need scan=1Aun30'|DQRaymam?[턲-ARC: Change notify=8192; Item: (40000000) C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar; need scan=0RC{n30'|DQRaymam턲-ARC: RefreshCache: smrcf=0x10|Dn30'|DQRaymamӇ턲-ARC: Change notify=8192; Item: (40010000) C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Server Manager.lnk; need scan=1m: P,n30'|DQRaJJE턲P,Rn30'|DQRaJJ`턲T,%n30'|DQRaJJ؎턲amP,n30'|DQRaJJd턲,&n30'|DQRaIIoۑ턲C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Server Manager.lnkC:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Server Manager.lnkTn30'|DQRaJJK턲Pn30'|DQRaJJ$턲T, n30'|DQRaJJJ턲edP, n30'|DQRaJJ턲 ,Mn30'|DQRa-L-LԪ턲C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Server Manager.lnkJl,)n30'|DQRaSISIҙ턲(&IOpI &l,?n30'|DQRaSISIm턲(&IOpI &l,Nn30'|DQRaSISI턲(&IOpI &'|D*,wn30'|DQRa.L-L턲C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Server Manager.lnk>:,Q|n30'|DQRa-L-L턲C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Server Manager.lnkl,n30'|DQRaSISIa턲(&IOpI &%l,ͧn30'|DQRaSISI (&IOpI &o%l,n30'|DQRaSISI0(&IOpI &u%l,`n30'|DQRaSISIe^%(&IOpI &%Z,>n30'|DQRa.L-Lt.C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Server Manager.lnk T, n30'|DQRaJJ$N , n30'|DQRa-L-LNC:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar4,?n30'|DQRa.L-LQC:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBarP,n30'|DQRaJJάRl,4n30'|DQRaSISIlZV(&IOpI &soT,n30'|DQRaJJV neT7n30'|DQRaJJLXRaPn30'|DQRaJJXTn30'|DQRaJJX erP"n30'|DQRaJJ\T#n30'|DQRaJJR0] RaX8;n30'|DQRaJJ՛lPDn30'|DQRaJJ+drXuDn30'|DQRaJJr PEn30'|DQRaJJ sXPEn30'|DQRaJJ1s PEn30'|DQRaJJ2sJn30'|DQRaymamqv-ARC: RefreshCache: smrcf=0x10tKn30'|DQRaymamSw-ARC: Change notify=2; Item: (40010000) C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Server Manager.lnk; need scan=1Un30'|DQRaymam}-ARC: Change notify=8192; Item: (40000000) C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar; need scan=0in%Yn30'|DQRaymamf5-ARC: RefreshCache: smrcf=0x10Yn30'|DQRaymam&-ARC: Change notify=8192; Item: (40010000) C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Server Manager.lnk; need scan=1P\n30'|DQRaJJ}{  m& 8 PUP,n30'|DQRaJJl,n30'|DQRaSISI (&IOpI &t , n30'|DQRa-L-L7C:\Windows\system32\ServerManager.exeRa, n30'|DQRa.L-LǭC:\Windows\system32\ServerManager.exenSeP,n30'|DQRaamnDP,tn30'|DQRabmnw, 6n30'|DQRa-L-LMC:\Program Files\Common Filesnkl,?n30'|DQRaSISI{!(&IOpI &,En30'|DQRa.L-LC:\Program Files\Common Files` Ra,Hn30'|DQRa-L-LqC:\Program Files (x86)\Common Files,Qn30'|DQRa.L-L"C:\Program Files (x86)\Common Files@,ATn30'|DQRa-L-Lj$C:\Users\exploitfil1\AppData\Roamingl,[n30'|DQRaSISI)(&IOpI &,gn30'|DQRa.L-LV1C:\Users\exploitfil1\AppData\Roaming$_ n,pn30'|DQRa-L-L4=7C:\ProgramData,vn30'|DQRa.L-L;C:\ProgramData>^ af,N|n30'|DQRa-L-L>C:\Windows,Mn30'|DQRa.L-LBC:\Windows z,n30'|DQRa-L-L BC:\Users\exploitfil1,yn30'|DQRa.L-LHC:\Users\exploitfil1,͕n30'|DQRa-L-LOC:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick LaunchRal,n30'|DQRaSISIg%](&IOpI &l,n30'|DQRaSISI0e(&IOpI & ,nn30'|DQRa.L-L|fC:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch,+n30'|DQRa-L-LQgC:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch ,n30'|DQRa.L-LZyC:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch T,n30'|DQRaJJ"AndP,n30'|DQRaJJzT,n30'|DQRaJJTEn30'|DQRaJJeΆndPn30'|DQRaJJTn30'|DQRaJJ%?Pn30'|DQRaJJLP,*n30'|DQRaJJܨl,@n30'|DQRaUUvT(&IOpIN Ra,qn30'|DQRa-L-LdC:\Windows\system32\ServerManager.exe,n30'|DQRa.L-LC:\Windows\system32\ServerManager.exej@\IP,n30'|DQRaamnEP,n30'|DQRabmn)T,-n30'|DQRaJJאxpP,n30'|DQRaJJ+T,n30'|DQRaJJBaTn30'|DQRaJJ[PPn30'|DQRaJJTn30'|DQRaJJv¥Pn30'|DQRaJJWP, n30'|DQRaJJQl,)n30'|DQRaSISIj(&IOpI &elP,In30'|DQRaamnLqP,Ln30'|DQRabmn\P,qjn30'|DQRaamnP,Mmn30'|DQRabmn,5n30'|DQRa-L-LEC:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Windows PowerShell.lnkl,n30'|DQRaSISI(&IOpI &l,ۚn30'|DQRaSISIr(&IOpI &Jl,n30'|DQRaSISI(&IOpI &",n30'|DQRa.L-LC:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Windows PowerShell.lnk2 ,@n30'|DQRa-L-L_ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System ToolsJ,*n30'|DQRa.L-LIC:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools`bam,n30'|DQRa-L-Lj"C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\  R& U8P6,n30'|DQRa.L-LDH9C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\ c,vn30'|DQRa-L-L̮9C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Windows PowerShell.lnk400",Dn30'|DQRa.L-L^7MC:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Windows PowerShell.lnk2 X,/n30'|DQRa-L-L![C:\x,s0n30'|DQRa.L-L@a\C:\X,Kn30'|DQRa-L-LBYnC:\x,Ln30'|DQRa.L-L¿nC:\@P,jn30'|DQRavvӘP,=on30'|DQRawv|T,zn30'|DQRaJJ<B,n30'|DQRa-L-L{C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows PowerShell.lnkowsb,n30'|DQRa.L-L۞C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows PowerShell.lnk_P,n30'|DQRaJJAT,Vn30'|DQRaJJP,ڙn30'|DQRaJJb,˞n30'|DQRaII C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Windows PowerShell.lnkC:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows PowerShell.lnkTèn30'|DQRaJJ)Pln30'|DQRaJJ=Tªn30'|DQRaJJtPOn30'|DQRaJJ°T,-n30'|DQRaJJAعSeP,ֿn30'|DQRaJJB,n30'|DQRa-L-L`C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Windows PowerShell.lnkkBa",n30'|DQRa.L-LC:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Windows PowerShell.lnk5P,3n30'|DQRaamnʍP,yn30'|DQRabmnT,3n30'|DQRaJJ --LP,h4n30'|DQRaJJT,4n30'|DQRaJJuiT]5n30'|DQRaJJR5erP5n30'|DQRaJJST5n30'|DQRaJJ{'|DP 6n30'|DQRaJJnT<6n30'|DQRaJJplX9n30'|DQRaJJ, P&?n30'|DQRaJJ An30'|DQRaymamw-ARC: RefreshCache: smrcf=0x10ccBn30'|DQRaymam-ARC: Change notify=2; Item: (40010000) C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows PowerShell.lnk; need scan=1PCn30'|DQRaJJgP,Dn30'|DQRaJJ>l,Kn30'|DQRaUU(&IOpIN P,[fn30'|DQRaamnO'P,;in30'|DQRabmn.)T,on30'|DQRaJJ{-P,xpn30'|DQRaJJM-T,pn30'|DQRaJJ-Tlqn30'|DQRaJJш.Pqn30'|DQRaJJ .Tqn30'|DQRaJJ.RCPwun30'|DQRaJJ-1P,vvn30'|DQRaJJ(1l,n30'|DQRaSISI&8(&IOpI &taP,)n30'|DQRaamnGP,+n30'|DQRabmn(M,n30'|DQRa-L-L gC:\Users\exploitfil1\SearchesChl,n30'|DQRaSISIr(&IOpI &1\,3n30'|DQRa.L-L%sC:\Users\exploitfil1\Searches0T@n=,Dn30'|DQRa-L-LuC:\Users\exploitfil1\Contacts0xl,n30'|DQRaSISIᝀ(&IOpI &ge,n30'|DQRa.L-LցC:\Users\exploitfil1\Contacts E,en30'|DQRa-L-LC:\Users\exploitfil1\Favorites1 `!S& 8 PUl,n30'|DQRaSISI%h(&IOpI &'|D,qn30'|DQRa.L-LvC:\Users\exploitfil1\Favorites`o,n30'|DQRa-L-LC:\Users\exploitfil1\Documentsl,yn30'|DQRaSISID(&IOpI &Se,An30'|DQRa.L-L0C:\Users\exploitfil1\Documents@,n30'|DQRa-L-LC:\Users\exploitfil1\Saved Gamesl,n30'|DQRaSISI̩(&IOpI &,W/n30'|DQRa.L-LC:\Users\exploitfil1\Saved Games 30'|Dz,;n30'|DQRa-L-L$C:\Users\exploitfil1,MFn30'|DQRa.L-L2C:\Users\exploitfil1mP,`n30'|DQRaamnFP,in30'|DQRabmn$,n30'|DQRa-L-LlC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnkl,_n30'|DQRaSISI(&IOpI &\Pl,{n30'|DQRaSISIC(&IOpI &\PD,n30'|DQRa.L-LaC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk( '|D,Hn30'|DQRa-L-L C:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools ,1n30'|DQRa.L-L=8C:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System ToolsH,n30'|DQRa-L-L<C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\p6,8/n30'|DQRa.L-LFuRC:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\  a$,/n30'|DQRa-L-LzRC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnkplD,Yn30'|DQRa.L-LmC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnkX,qxn30'|DQRa-L-LdC:\x,yn30'|DQRa.L-L΂C:\pX,n30'|DQRa-L-LgDC:\x,n30'|DQRa.L-L篕C:\pP,vn30'|DQRavvP,n30'|DQRawvsrT,n30'|DQRaJJMa8,n30'|DQRa-L-L?C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnkX,n30'|DQRa.L-LC:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnkDP,n30'|DQRaJJT,n30'|DQRaJJb( ,n30'|DQRa-L-LC:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar4,n30'|DQRa.L-LrC:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar P,Bn30'|DQRaJJRl, n30'|DQRaSISI((&IOpI &ftT,Sn30'|DQRaJJR WiT%n30'|DQRaJJRaPm'n30'|DQRaJJT'n30'|DQRaJJ1 pIP)n30'|DQRaJJ*TZ*n30'|DQRaJJ RaXd5n30'|DQRaJJP9n30'|DQRaJJ' X:n30'|DQRaJJW+ Pg:n30'|DQRaJJ[]X:n30'|DQRaJJo P:n30'|DQRaJJ8=n30'|DQRaymamz8-ARC: RefreshCache: smrcf=0x10g=n30'|DQRaymamw-ARC: Change notify=2; Item: (40010000) C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk; need scan=1 0 &  U8PBn30'|DQRaymam-ARC: Change notify=8192; Item: (40000000) C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar; need scan=0{Dn30'|DQRaymam-ARC: RefreshCache: smrcf=0x10wDn30'|DQRaymam 1-ARC: Change notify=8192; Item: (40010000) C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk; need scan=1P"(&IOpIg'|Dl,nN(n30'|DQRa&V&Vm(&IOpIP,)n30'|DQRaUUWl,)n30'|DQRaUUKX(&IOpIgRal,)n30'|DQRa&V&VhY(&IOpI'|DP,)n30'|DQRaUUYP,)n30'|DQRa?V?VYl,)n30'|DQRa9V9V(&IOpIP,)n30'|DQRa%%l,)n30'|DQRa_N_N(&IOpI PP,)n30'|DQRa%%P,*n30'|DQRa%%9^l,.*n30'|DQRa=V=VT^(&IOpIqerl,J*n30'|DQRa44f^(&IOpI*Dl,q*n30'|DQRaUUR^(&IOpI)l,*n30'|DQRaUU^(&IOpI'|Dl,*n30'|DQRaUU^(&IOpIV(oal,vW+n30'|DQRaBB_(&IOpI& ne,}q+n30'|DQRa7V7V֝(&IOpI, 0Running applications0000000cP,k|+n30'|DQRa%%Po+n30'|DQRa%%p'P8,n30'|DQRa@I@IlPT,n30'|DQRa@I@I~P",n30'|DQRa@I@I{P,n30'|DQRa@I@IX,n30'|DQRaHHG0X+,n30'|DQRaHH0l-n30'|DQRaSISI(&IOpI &P0u-n30'|DQRa%%>@P,-n30'|DQRa?V?VhovP,/-n30'|DQRa?V?VvPXw.n30'|DQRa%%Fn,/n30'|DQRa%%UĹWallpaperEarlyP,/n30'|DQRa%%h7n30'|DQRa-L-L|C:\Windows\web\wallpaper\Windows\img0.jpg 7n30'|DQRa.L-LC:\Windows\web\wallpaper\Windows\img0.jpg`ta9n30'|DQRa-L-L3C:\Windows\web\wallpaper\Windows\img0.jpgr.  R@&" U8P]9n30'|DQRa.L-LYFC:\Windows\web\wallpaper\Windows\img0.jpgtf Cn30'|DQRa-L-LbC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaperCn30'|DQRa.L-LLeC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper@pldrCn30'|DQRaVr\Dn30'|DQRa,,$ C:\Windows\web\wallpaper\Windows\img0.jpgd1 In30'|DQRanNVn,Q!In30'|DQRa%%^WallpaperEarlyn,r!In30'|DQRa%%μ^ImmersiveShelladMn30'|DQRaWVoa`Mn30'|DQRa,,ZC:\Windows\web\wallpaper\Windows\img0.jpgdRn30'|DQRa+cVordjXn30'|DQRaBlnP _Yn30'|DQRaJfP aZn30'|DQRa9md\n30'|DQRaM.VPQan30'|DQRaJJy"Xan30'|DQRaJJ~"Pban30'|DQRaJJL"X5an30'|DQRaJJ" PWan30'|DQRaJJ~"6an30'|DQRa-L-L` "C:\Users\Public\Desktopan30'|DQRa.L-L""C:\Users\Public\Desktop Xan30'|DQRa JJϲ"PRan30'|DQRaJJ."an30'|DQRa-L-LP"C:\Users\Public\Desktopan30'|DQRa.L-Lp"C:\Users\Public\Desktop Xan30'|DQRa JJΡ" Pybn30'|DQRa]H]HW#1#zbn30'|DQRaee[<#CreateViewWindowt\Iz=bn30'|DQRaee7<#CreateViewWindower.P(dn30'|DQRaJJ&$X)dn30'|DQRaJJC$ P?en30'|DQRaII$`@en30'|DQRaII$5km/OPBen30'|DQRaJJ $XKen30'|DQRa JJ$ P|>Uen30'|DQRat$Pfen30'|DQRaoIoI$Pten30'|DQRapIoI}$Pxen30'|DQRa{H{Hk$yzen30'|DQRaeec$CDefView::_pCollectionSink8 -LzԎin30'|DQRaee1'OperationRunningt\Izin30'|DQRaeeM'OperationRunning`ain30'|DQRaIIV'5km/OPin30'|DQRaJJ'Pin30'|DQRaJJ'Xin30'|DQRa JJD' Xin30'|DQRaJJ' Pxin30'|DQRaII'z%in30'|DQRaee['CreateViewWindowzJin30'|DQRaee'CreateViewWindowPin30'|DQRa^H]H'P in30'|DQRa '|΂ln30'|DQRa-L-L/)shell:::{98F275B4-4FFF-11E0-89E2-7B86DFD72085}|ln30'|DQRa.L-LVՏ)shell:::{98F275B4-4FFF-11E0-89E2-7B86DFD72085}`I#eP ,mn30'|DQRa::)P %-mn30'|DQRa I Il)P jmn30'|DQRa I I *P lmn30'|DQRauHuHd"*T mn30'|DQRavHuHLF*>FiP ymn30'|DQRa;:vI*T mn30'|DQRaHHf*>geP unn30'|DQRaHH1*Px|n30'|DQRaF3pOn30'|DQRaee]8UpdateItemspn30'|DQRaee |8UpdateItemspn30'|DQRaee%*8UpdateItemsp/n30'|DQRaeeM<8UpdateItems~pn30'|DQRaeeh8OperationCompletedc~n30'|DQRaeeQ|8OperationCompleted`%n30'|DQRaII85km/OzAn30'|DQRaee8OperationRunningz_n30'|DQRaee8OperationRunning 8 GV&# 8 PUxn30'|DQRaeez88 ~Wn30'|DQRaee)8OperationCompletedTn30'|DQRaHHH8~n30'|DQRaee8OperationCompletedaP#n30'|DQRa|H{H#_9~H#n30'|DQRaeew9FirstPageDisplayedx$n30'|DQRaeeS9ContentsChangedx$n30'|DQRaeel9ContentsChangedP$n30'|DQRa7I7I9x$n30'|DQRaeeޔ9ContentsChangedT%n30'|DQRaHH9'|Dx2%n30'|DQRaee9ContentsChanged`&n30'|DQRaIIQ95km/OT)n30'|DQRaHH69JX|kΠn30'|DQRaLMƤiP8Πn30'|DQRaDD5il|Ѡn30'|DQRaSISILk(&IOpI &|uѠn30'|DQRa-L-LI=kC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Libraries!l|Ѡn30'|DQRaSISIak(&IOpI &l|Ѡn30'|DQRaSISIk(&IOpI &J| Ѡn30'|DQRa.L-L1kC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Libraries0 I|VҠn30'|DQRa-L-LalC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-msJ|1Ҡn30'|DQRa.L-L8lC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms ` | NҠn30'|DQRa-L-Ls/lC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms|oҠn30'|DQRa.L-L1FlC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-mspQ ` |cҠn30'|DQRa-L-L2[lC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms|<Ҡn30'|DQRa.L-LrlC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-mss 0X8Ҡn30'|DQRaMMlP8\Ҡn30'|DQRaED6l|ՠn30'|DQRa-L-L1qnC:\Users\exploitfil1\Favoritesl|lՠn30'|DQRaSISI |n(&IOpI &U|pՠn30'|DQRa.L-LT}nC:\Users\exploitfil1\Favoritest |D|0٠n30'|DQRa-L-LDpshell:::{98F275B4-4FFF-11E0-89E2-7B86DFD72085}|٠n30'|DQRa.L-L2pshell:::{98F275B4-4FFF-11E0-89E2-7B86DFD72085} |DX|D٠n30'|DQRaLM;+pP8[G٠n30'|DQRaDDp|n30'|DQRa-L-L(uC:\Windows\system32\perfmon.msc|n30'|DQRa.L-Ly,uC:\Windows\system32\perfmon.msc0 |'n30'|DQRa-L-L"iuC:\Windows\system32\compmgmt.msc^|n30'|DQRa.L-LWhuC:\Windows\system32\compmgmt.msc0 +|`n30'|DQRa-L-L vC:\Windows\system32\taskmgr.exe|an30'|DQRa.L-LvC:\Windows\system32\taskmgr.exe @ |n30'|DQRa3I3I?vC:\galaxie\deploy\Tomcat6\Uninstall.exe|Qn30'|DQRa4I3I3vC:\galaxie\deploy\Tomcat6\Uninstall.exe|Zn30'|DQRa-L-L֠wC:\Windows\system32\eventvwr.msc@I|n30'|DQRa.L-LGwC:\Windows\system32\eventvwr.msc ` |5n30'|DQRa-L-LgcAwC:\Windows\system32\secpol.msc|E7n30'|DQRa.L-LdBwC:\Windows\system32\secpol.msc ` |{n30'|DQRa-L-LrwC:\Windows\system32\taskschd.msc|n30'|DQRa.L-LyswC:\Windows\system32\taskschd.msc @ |~n30'|DQRa-L-L,7wC:\Windows\system32\perfmon.exe|n30'|DQRa.L-L55wC:\Windows\system32\perfmon.exe X8Jn30'|DQRaMM^wP8BKn30'|DQRaED6w @ r&$ U8Pn30'|DQRa-L-L\xshell:::{98F275B4-4FFF-11E0-89E2-7B86DFD72085}%n30'|DQRa.L-Lxshell:::{98F275B4-4FFF-11E0-89E2-7B86DFD72085} $ oXj\n30'|DQRaLMxP8^n30'|DQRaDDxX8 en30'|DQRaMM 8WyP8Ken30'|DQRaED\WyVn30'|DQRa-L-Lynyshell:::{98F275B4-4FFF-11E0-89E2-7B86DFD72085}&[n30'|DQRa.L-L]yshell:::{98F275B4-4FFF-11E0-89E2-7B86DFD72085}$ ` X׍n30'|DQRaLMzP8 n30'|DQRaDDQzX8n30'|DQRaMMzP88n30'|DQRaED'z`n30'|DQRa-L-LMK{shell:::{98F275B4-4FFF-11E0-89E2-7B86DFD72085}dn30'|DQRa.L-LAM{shell:::{98F275B4-4FFF-11E0-89E2-7B86DFD72085}% @ Xhn30'|DQRaLMhol{P8 n30'|DQRaDDl{X8 n30'|DQRaMM)|P8En30'|DQRaED?|}n30'|DQRa-L-L|shell:::{98F275B4-4FFF-11E0-89E2-7B86DFD72085}n30'|DQRa.L-L|shell:::{98F275B4-4FFF-11E0-89E2-7B86DFD72085}/ Xn30'|DQRaLM}P8n30'|DQRaDDW}X8Mn30'|DQRaMMc~P8n30'|DQRaED3~n,] n30'|DQRa%%'NImmersiveShell-Ln, n30'|DQRa%%NDesktopVisible|Dn, n30'|DQRa%%OStartMenuShown,A n30'|DQRa%%{OLogonFrameworkRegistration|D, n30'|DQRa%%OLogonFrameworkRegistrationaZ,; n30'|DQRa%%OSSO1\ WF n30'|DQRaymam}-ARC: Paused/Resumed root#0 for change notification: Pause=1 Success=1\ wT n30'|DQRaymamiC-ARC: Paused/Resumed root#1 for change notification: Pause=1 Success=1|D\ Qa n30'|DQRaymam6-ARC: Paused/Resumed root#3 for change notification: Pause=1 Success=1\ 2n n30'|DQRaymam-ARC: Paused/Resumed root#6 for change notification: Pause=1 Success=1\ i| n30'|DQRaymami-ARC: Paused/Resumed root#7 for change notification: Pause=1 Success=1\  n30'|DQRaymamr-ARC: Paused/Resumed root#8 for change notification: Pause=1 Success=1t, n30'|DQRa%%O少DesktopApiSurfaceJt, n30'|DQRa%%TaskbarApiSurface; n30'|DQRa-L-LoVC:\Windows\web\wallpaper\Windows\img0.jpg n30'|DQRa.L-LC:\Windows\web\wallpaper\Windows\img0.jpgpP i  n30'|DQRa-L-L[C:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper'|D% n30'|DQRa.L-LfC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper `s P 0 n30'|DQRaPn30'|DQRaJJ&Xn30'|DQRaJJ.' Pn30'|DQRaJJxn30'|DQRa-L-LVY<C:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Printer ShortcutsFi4zn30'|DQRa.L-Lr=C:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Printer Shortcutsl k XCn30'|DQRa JJB Pn30'|DQRavvVCFPn30'|DQRawv#GP&n30'|DQRavvHP!n30'|DQRawv-It,n30'|DQRa%%d<TaskbarApiSurfacePp'n30'|DQRaP0@]n30'|DQRaLLD*Džlas|n30'|DQRa-L-LzۅC:\Windows\ToastData\Windows.SystemToast.AutoPlay.lnkll|n30'|DQRaSISI̢ۅ(&IOpI 'l}|n30'|DQRa.L-LۅC:\Windows\ToastData\Windows.SystemToast.AutoPlay.lnk~   V&% 8 PUP` ^|n30'|DQRa   ۅP` q|n30'|DQRa  eۅl#n30'|DQRa-L-Lͳ 셲C:\Windows\explorer.exel@n30'|DQRa.L-Lu셲C:\Windows\explorer.exeЕ3lun30'|DQRa-L-L 셲C:\Windows\ToastData\Windows.SystemToast.Devices.lnkPaglpn30'|DQRa.L-Lq&셲C:\Windows\ToastData\Windows.SystemToast.Devices.lnko l˕n30'|DQRa-L-L/셲C:\Windows\explorer.exel3͕n30'|DQRa.L-Lt0셲C:\Windows\explorer.exeл;l'֕n30'|DQRa-L-L"6셲C:\Windows\ToastData\Windows.SystemToast.Explorer.lnkl镡n30'|DQRa.L-LiC셲C:\Windows\ToastData\Windows.SystemToast.Explorer.lnkl n30'|DQRa-L-LK셲C:\Windows\explorer.exeln30'|DQRa.L-LL셲C:\Windows\explorer.exeЈ8ln30'|DQRa-L-LS셲C:\Windows\ToastData\Windows.SystemToast.OpenWith.lnkSIl0n30'|DQRa.L-L>_셲C:\Windows\ToastData\Windows.SystemToast.OpenWith.lnk@y -Ll n30'|DQRa-L-L/_g셲C:\Windows\system32\OpenWith.exebral#"n30'|DQRa.L-LF\h셲C:\Windows\system32\OpenWith.exe@ 3atal*n30'|DQRa-L-Ln셲C:\Windows\ToastData\Windows.SystemToast.Print.Notification.lnkl@n30'|DQRa.L-LB|셲C:\Windows\ToastData\Windows.SystemToast.Print.Notification.lnk lMn30'|DQRa-L-Lq셲C:\Windows\explorer.exeluNn30'|DQRa.L-L,a셲C:\Windows\explorer.exeЯ9lRWn30'|DQRa-L-LB3셲C:\Windows\ToastData\Windows.SystemToast.RasToastNotifier.lnklMjn30'|DQRa.L-L셲C:\Windows\ToastData\Windows.SystemToast.RasToastNotifier.lnk@ lvn30'|DQRa-L-L셲C:\Windows\system32\RasApi32.dllMiclFxn30'|DQRa.L-L4 셲C:\Windows\system32\RasApi32.dll@ >l󀖡n30'|DQRa-L-LIt셲C:\Windows\ToastData\Windows.SystemToast.Share.lnkln30'|DQRa.L-LgB셲C:\Windows\ToastData\Windows.SystemToast.Share.lnk P|DlLn30'|DQRa-L-L/R셲C:\Windows\explorer.exelΡn30'|DQRa.L-LW셲C:\Windows\explorer.exeВ 8P2ܜn30'|DQRaV|3n30'|DQRa-L-LͰC:\Program Files\Internet Explorer\images\smallLogo.scale-100.pngl|=n30'|DQRaSISIE(&IOpI 'l|sϠn30'|DQRaSISI"f(&IOpI (te|Eڠn30'|DQRa.L-L!mC:\Program Files\Internet Explorer\images\smallLogo.scale-100.png`@Ral,Էn30'|DQRaRRY3q劗?Cl,_n30'|DQRaRR!Ǚ3q劗?Ctel, -n30'|DQRaRR`\&s x#)B}[dDRal,ٌn30'|DQRaRRes x#)B}[dDt,Mn30'|DQRa%%ʉDesktopApiSurfaceskPpn30'|DQRacmnz< Ppn30'|DQRamno Ppn30'|DQRaemn Ppn30'|DQRasmn Ppn30'|DQRatmnF$ pn30'|DQRa-L-L8C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Server Manager.lnk*pn30'|DQRa.L-LxC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Server Manager.lnkp# ecpp!n30'|DQRa-L-LyC:\Windows\system32\ServerManager.exetepD#n30'|DQRa.L-LEC:\Windows\system32\ServerManager.exe PpH*n30'|DQRaamnjPp?2n30'|DQRabmn* Pp2n30'|DQRafmn Pp2n30'|DQRadmn6 !Z,<n30'|DQRa%%Y'SSO1wn,Dn30'|DQRa%%,StartMenuShown  && 8@P8Pv,"Gn30'|DQRa%% I.DesktopStartupAppsFv,%`n30'|DQRa%%>DesktopStartupApps,D`n30'|DQRa%%>CancelDesktopInitializationScenario,`n30'|DQRa%%?CancelDesktopInitializationScenario,`n30'|DQRa%%?SuspendDesktopStartupAppsRa,`n30'|DQRa%%I,?SuspendDesktopStartupApps::t,an30'|DQRa%%-;?DesktopAndTaskbarRa,xn30'|DQRa-L-LjNC:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned$,;|n30'|DQRa.L-LQC:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned @,n30'|DQRa-L-LukC:\Windows\system32\ServerManager.exeRa, n30'|DQRa.L-LolC:\Windows\system32\ServerManager.exe@ ,`n30'|DQRa-L-LyC:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned'|D$,;n30'|DQRa.L-Lܠ{C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned@ ,n30'|DQRa-L-LC:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User PinnedRa$,n30'|DQRa.L-LXC:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned me:,|n30'|DQRa-L-LC:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Server Manager.lnkZ,n30'|DQRa.L-LC:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Server Manager.lnk , n30'|DQRa-L-LyC:\Windows\system32\ServerManager.exess,{n30'|DQRa.L-LfC:\Windows\system32\ServerManager.exe n:,n30'|DQRaQNQN(&IOpIg ServerManager.exe 0(null)0000001,Ӓn30'|DQRa-L-Ll~C:\Windows\system32\ServerManager.exe n,=n30'|DQRa.L-LKhC:\Windows\system32\ServerManager.exe߆ oo,n30'|DQRaVVdC:\Windows\system32\ServerManager.exeX,n30'|DQRaVVeh,^n30'|DQRaVV,,n30'|DQRa VVC:\Windows\system32\ServerManager.exeB,󰲡n30'|DQRa-L-L5C:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows PowerShell.lnkowsb,n30'|DQRa.L-LqC:\Users\exploitfil1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows PowerShell.lnk~ `,ɲn30'|DQRaQNQN]+(&IOpIg powershell.exe 0(null)000000'|D,벡n30'|DQRaVVAC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeX,n30'|DQRaVVEh,wn30'|DQRaVVFZX,n30'|DQRaVVAm,0n30'|DQRa VVcn::{52205FD8-5DFB-447D-801A-D0B52F2E83E1}X,2n30'|DQRaVVX%p0b,3n30'|DQRaVV$n30'|DQRa-L-LyC:\Windows\system32\ServerManager.exe$(n30'|DQRa.L-LKC:\Windows\system32\ServerManager.exeۆ `$?ڳn30'|DQRa3I3IC:\Windows\system32\ServerManager.exe$n30'|DQRa4I3IQC:\Windows\system32\ServerManager.exe$n30'|DQRa3I3InTC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe$n30'|DQRa4I3I}C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePh=n30'|DQRa.nPhPIn30'|DQRacmn uPhIn30'|DQRamnvPhbJn30'|DQRaemnvPh{Jn30'|DQRasmnvPhQn30'|DQRatmnz hRn30'|DQRa-L-L:{C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Server Manager.lnk*hVn30'|DQRa.L-L0~C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Server Manager.lnkp2 h[n30'|DQRa-L-LC:\Windows\system32\ServerManager.exeht]n30'|DQRa.L-LC:\Windows\system32\ServerManager.exe `Phcn30'|DQRaamnPhmn30'|DQRabmn~PhTnn30'|DQRafmn Phonn30'|DQRadmnPhnn30'|DQRagmnePhnn30'|DQRasmntPhsn30'|DQRatmn htn30'|DQRa-L-LC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Server Manager.lnklh n30'|DQRaSISI(&IOpI (lhn30'|DQRaSISID(&IOpI (lh%n30'|DQRaSISĮ(&IOpI (*h n30'|DQRa.L-LC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Server Manager.lnkAPh[n30'|DQRahmn۽P n30'|DQRa@I@IP n30'|DQRa@I@IսP n30'|DQRa@I@I-\P n30'|DQRa@I@IX& n30'|DQRaHH`0X@ n30'|DQRaHH!0P n30'|DQRaIIPn30'|DQRa{H{HD.n30'|DQRaeeWCDefView::_pCollectionSinkWPen30'|DQRaJJK`Xn30'|DQRaJJ jPYn30'|DQRaIIC Pn30'|DQRaIIPn30'|DQRaJJ5\Yn30'|DQRa/L/L@P n30'|DQRa0L/L"@P C:\Users\exploitfil1\Desktop n30'|DQRa-L-LAWC:\Users\exploitfil1\Desktop[n30'|DQRa.L-L7 C:\Users\exploitfil1\Desktop@ n30'|DQRa-L-LP C:\Users\Public\Desktop»n30'|DQRa.L-Lg C:\Users\Public\Desktop@ XKûn30'|DQRa JJ  $|ﻡn30'|DQRa-L-L(C:\Windows\system32\control.exe|n30'|DQRa.L-L)C:\Windows\system32\control.exe Pu㼡n30'|DQRaRwPxxAn30'|DQRa::UPxAn30'|DQRa I Idlxn30'|DQRaSISI"(&IOpI (Px n30'|DQRa I I5Pxn30'|DQRauHuH(Tx)n30'|DQRavHuHq?T\n30'|DQRaHHAP򜽡n30'|DQRaHHyA\un30'|DQRa/L/L ,án30'|DQRaVV 0C:\Windows\system32\ServerManager.exe,&án30'|DQRaV V (&IOpI 000000000,+án30'|DQRaVVn 0C:\Windows\system32\ServerManager.exet,mán30'|DQRa%% DesktopAndTaskbar  &) 8@P8Px,án30'|DQRa%%ɩ SignalDesktopSwitchx,án30'|DQRa%% SignalDesktopSwitchv,án30'|DQRa%% AfterDesktopSwitchlZ,án30'|DQRa%% SSO2?t,án30'|DQRa%%K DesktopFinalTasks'|Dr,án30'|DQRa%% SearchFinalTasksf,~án30'|DQRa%% FinalTasksuT,Fán30'|DQRaJJ J ,án30'|DQRa-L-L6J C:\Users\exploitfil1\AppData\Local\Microsoft\Windows\Burnng,án30'|DQRa.L-LK C:\Users\exploitfil1\AppData\Local\Microsoft\Windows\Burn l1Thán30'|DQRaJJȻL erP{án30'|DQRaJJN P,mán30'|DQRaJJ?N T,Gán30'|DQRaJJR Ra,án30'|DQRa-L-LR C:\Users\exploitfil1\AppData\Local\Microsoft\Windows\Burn\Burn,án30'|DQRa.L-L3T C:\Users\exploitfil1\AppData\Local\Microsoft\Windows\Burn\BurnP׍ @eT*án30'|DQRaJJ_U Pán30'|DQRaJJV P,án30'|DQRaJJV l,án30'|DQRaSISI:d (&IOpI )T,ġn30'|DQRaJJ*q oa,ġn30'|DQRa-L-LIyq C:\Users\exploitfil1\AppData\Local\Microsoft\Windows\Burn\BurnU,*ġn30'|DQRa.L-Lku C:\Users\exploitfil1\AppData\Local\Microsoft\Windows\Burn\Burn @|DT ġn30'|DQRaJJv l1Pa ġn30'|DQRaJJx P,d ġn30'|DQRaJJ=y l,Xġn30'|DQRaSISIc0{ (&IOpI )l,Sġn30'|DQRaSISI׻ (&IOpI )erl,!ġn30'|DQRaSISIy (&IOpI )anl,x'ġn30'|DQRaSISIT (&IOpI )l,-ġn30'|DQRaSISIk (&IOpI ),.ġn30'|DQRa-L-L C:\Users\exploitfil1\AppData\Local\Microsoft\Windows\Burn\Burnl,/;ġn30'|DQRaSISI> (&IOpI )nal,P\ġn30'|DQRaSISI (&IOpI ),^ġn30'|DQRa.L-Ll C:\Users\exploitfil1\AppData\Local\Microsoft\Windows\Burn\Burn-@P,xiġn30'|DQRaJJ Pkġn30'|DQRaJJ ؄ġn30'|DQRa-L-Lx C:\Users\exploitfil1\AppData\Local\Microsoft\Windows\Burngġn30'|DQRa.L-L3} C:\Users\exploitfil1\AppData\Local\Microsoft\Windows\Burn@ \WXġn30'|DQRa JJ#~ PP ġn30'|DQRavvr P6ġn30'|DQRawv΅ Pġn30'|DQRavv Pġn30'|DQRawvHo X,ġn30'|DQRaJJM Ndġn30'|DQRa TUt f,@šn30'|DQRa%%B FinalTasksot,šn30'|DQRa%%1\l DesktopFinalTasksPX šn30'|DQRaHHYx PX Ašn30'|DQRaIHBh~ P\ ɡn30'|DQRa$ Ρn30'|DQRaymam:N\-ARC: RefreshCache: smrcf=0x0el8IΡn30'|DQRaymam]-ARC: UpdateCache: smrcf=0x030'|DP8mΡn30'|DQRawmm90]P8Ρn30'|DQRaqmn dl8Rϡn30'|DQRaSISI;(&IOpI )8ϡn30'|DQRamn;:Microsoft.Windows.ExplorerwsPP8kСn30'|DQRavvVP8UСn30'|DQRawvP8UСn30'|DQRavvP8UСn30'|DQRawv4l8fСn30'|DQRaSISIʎ(&IOpI )-L8lСn30'|DQRamm h4File ExplorerMicrosoft.Windows.Exploreri8mСn30'|DQRazmm(Microsoft.Windows.Explorer8+rСn30'|DQRa-L-LC:\Windows\system32\ServerManager.exeut8sСn30'|DQRa.L-LC:\Windows\system32\ServerManager.exe 8/Сn30'|DQRa-L-Lv;C:\Windows\system32\ServerManager.exe p S&* U8 P8Сn30'|DQRa.L-LC:\Windows\system32\ServerManager.exe 8Сn30'|DQRa3I3IF]C:\Windows\system32\ServerManager.exe8 Сn30'|DQRa4I3IvC:\Windows\system32\ServerManager.exe^8FСn30'|DQRamnwNULL JaP8Сn30'|DQRavvbP8Сn30'|DQRawv*P8Сn30'|DQRavv>;P8Сn30'|DQRawvR8ѡn30'|DQRamm 9Server Manager{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\ServerManager.exe8_ѡn30'|DQRazmm?{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\ServerManager.exe\8Vjѡn30'|DQRa3I3I8-9C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exev18zѡn30'|DQRa4I3ICC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exev1^8ѡn30'|DQRamnoYNULL JP8ѡn30'|DQRavvZP8ѡn30'|DQRawvC\P8ѡn30'|DQRavv:Z\P8Jѡn30'|DQRawvx\8Ƴѡn30'|DQRamm BiWindows PowerShell{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\WindowsPowerShell\v1.0\powershell.exeog8ѡn30'|DQRazmm i{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\WindowsPowerShell\v1.0\powershell.exesP8жѡn30'|DQRarmn :k8^ѡn30'|DQRaymam&r-ARC: Committing updated cache to disk. Cache size=7420832\P ѡn30'|DQRaeo8ҡn30'|DQRaymam!|=-ARC: Loading cache to memory after committing updated cache to disk.d8Jӡn30'|DQRamm yFD??P8^ ӡn30'|DQRaxmmrH|oסn30'|DQRa-L-LqC:\Windows\DesktopTileResources\images\logo.scale-100.pngl|סn30'|DQRaSISIPx(&IOpI *l|Bסn30'|DQRaSISI|(&IOpI +ro|סn30'|DQRa.L-LC:\Windows\DesktopTileResources\images\logo.scale-100.png0Y Pءn30'|DQRaPءn30'|DQRavv P0ءn30'|DQRawvPI١n30'|DQRavv3V`PJ١n30'|DQRawvaPJ١n30'|DQRavvߋaPK١n30'|DQRawvblW١n30'|DQRaSISIi(&IOpI +'|DP^١n30'|DQRa~nP8 n30'|DQRaHHHPn30'|DQRaHHP<n30'|DQRaHH#dn30'|DQRaTUHd8 q;n30'|DQRaHH!!xO n30'|DQRa-L-L_!&shell:::{e345f35f-9397-435c-8f95-4e922c26259e} un30'|DQRa.L-Lw&shell:::{e345f35f-9397-435c-8f95-4e922c26259e}0 p? J !n30'|DQRa-L-LJ9&C:\Windows\system32\connectedsearch-paths.searchconnector-ms Fn30'|DQRa.L-LaN&C:\Windows\system32\connectedsearch-paths.searchconnector-ms  : P On30'|DQRajjW'P8n30'|DQRa44lN'P8&n30'|DQRaJJ#Y'PLn30'|DQRaJJr'x]n30'|DQRa-L-L;}'C:\Windows\System32,_n30'|DQRa.L-L ~'C:\Windows\System32p PA Xjn30'|DQRa JJ'Pon30'|DQRavv*؈'Ppn30'|DQRawvJ'P sn30'|DQRavv 'Ptn30'|DQRawvV'X8tn30'|DQRaJJ*'~\ xn30'|DQRa/L/LY'~  xn30'|DQRa0L/L'~ C:\Users\exploitfil1\DesktopP8 n30'|DQRaJJ 'Pn30'|DQRaJJ'\n30'|DQRa/L/Lu^' n30'|DQRa0L/L' C:\Users\exploitfil1\DesktopAn30'|DQRa-L-Lɠ'C:\Users\exploitfil1\Desktop30'|D !&+ 8 PUn30'|DQRa.L-L%'C:\Users\exploitfil1\Desktop@ < n30'|DQRa-L-LS'C:\Users\Public\Desktop)n30'|DQRa.L-L'C:\Users\Public\DesktopP < X̙n30'|DQRa JJ9j'X8n30'|DQRaJJiT'~\8n30'|DQRa/L/L' 8Yn30'|DQRa0L/Ly' C:\Users\exploitfil1\Desktop\8~n30'|DQRa/L/LԦ' 8n30'|DQRa0L/L' C:\Users\exploitfil1\DesktopP n30'|DQRakjɽ' n30'|DQRa-L-LH,'C:\Windows\system32\connectedsearch-protocol.searchconnector-ms n30'|DQRa.L-LԵ'C:\Windows\system32\connectedsearch-protocol.searchconnector-ms» L P 'n30'|DQRajj'\ n30'|DQRa/L/L`'  n30'|DQRa0L/L;' C:\Users\exploitfil1\DesktopP Hn30'|DQRakj' n30'|DQRa-L-L+'C:\Windows\system32\connectedsearch-history.searchConnector-msAI n30'|DQRa.L-LC'C:\Windows\system32\connectedsearch-history.searchConnector-ms 0L {HP n30'|DQRajj '\ ,n30'|DQRa/L/L'p Ra ~n30'|DQRa0L/L'p C:\Users\exploitfil1\DesktopQRaP n30'|DQRakjN ' n30'|DQRa-L-LB1'C:\Windows\system32\connectedsearch-appcmd.searchConnector-ms  n30'|DQRa.L-L'C:\Windows\system32\connectedsearch-appcmd.searchConnector-ms@ pH RaP  n30'|DQRajj~'\ n30'|DQRa/L/L)'  pn30'|DQRa0L/Lq' C:\Users\exploitfil1\DesktopP n30'|DQRakj1' !n30'|DQRa-L-L'C:\Windows\system32\connectedsearch-music.searchConnector-ms~  1n30'|DQRa.L-L(C:\Windows\system32\connectedsearch-music.searchConnector-ms 0F P 06n30'|DQRajje (\ Cn30'|DQRa/L/L (  2Dn30'|DQRa0L/L( C:\Users\exploitfil1\Desktop30'|DP Dn30'|DQRakj=( Hn30'|DQRa-L-L@(shell:::{5ED4F38C-D3FF-4D61-B506-6820320AEBFE} 2Sn30'|DQRa.L-L(shell:::{5ED4F38C-D3FF-4D61-B506-6820320AEBFE} N Ll ln30'|DQRaSISI@((&IOpI +l 1n30'|DQRaSISIp((&IOpI +RaP ]n30'|DQRajj5;( }vn30'|DQRa-L-Ly(knownfolder:{4BD8D571-6D19-48D3-BE97-422220080E43} &wn30'|DQRa.L-Lu(knownfolder:{4BD8D571-6D19-48D3-BE97-422220080E43} W \ xn30'|DQRa/L/L"( '|D (yn30'|DQRa0L/LH( C:\Users\exploitfil1\Desktop \ yn30'|DQRa/L/L(  yn30'|DQRa0L/L1( C:\Users\exploitfil1\Desktop {n30'|DQRa-L-L5(C:\Users\exploitfil1\Musica ~n30'|DQRa.L-L(C:\Users\exploitfil1\Music@ PY  n30'|DQRa-L-LT(\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Music Jn30'|DQRa.L-L(\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Music^ age Tn30'|DQRa-L-LX(\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\MusicQRa n30'|DQRa.L-L(\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Musicd  ǥn30'|DQRa-L-L (C:\Users\exploitfil1\Music n30'|DQRa.L-L(C:\Users\exploitfil1\Music@ T  n30'|DQRa-L-L)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Music m&, @P 8@P8P Pn30'|DQRa.L-Lj)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\MusicW á  n30'|DQRa-L-L7,)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\MusicQRa )n30'|DQRa.L-LK)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Musicf   n30'|DQRa-L-L )\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Musicexp 7n30'|DQRa.L-L z )\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\MusicR oftP8:n30'|DQRaJJ)X8n30'|DQRaJJ;)~Pn30'|DQRaJJb)bn30'|DQRa-L-L')C:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\LibrariesR n30'|DQRa.L-L()C:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Libraries Q expXn30'|DQRa JJ^.)Pn30'|DQRavv1)Pn30'|DQRawv‡2)Pn30'|DQRavv3)Pn30'|DQRawv4)\ n30'|DQRa/L/LT5)  en30'|DQRa0L/L5) C:\Users\exploitfil1\DesktopP n30'|DQRakj15)P n30'|DQRajj9) xn30'|DQRa-L-LUD)knownfolder:{18989B1D-99B5-455B-841C-AB7C74E4DDFC} n30'|DQRa.L-L!aD)knownfolder:{18989B1D-99B5-455B-841C-AB7C74E4DDFC} P_ \ n30'|DQRa/L/LmfE)~ Ra n30'|DQRa0L/LՍE)~ C:\Users\exploitfil1\Desktop&I\ ln30'|DQRa/L/LE)~  n30'|DQRa0L/L=F)~ C:\Users\exploitfil1\Desktop Nn30'|DQRa-L-L)G)C:\Users\exploitfil1\Videos dn30'|DQRa.L-LH)C:\Users\exploitfil1\Videos Ph  k2n30'|DQRa-L-L,W)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Videos 5n30'|DQRa.L-LY)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Videosa  ;n30'|DQRa-L-L\])\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Videosrs =n30'|DQRa.L-L_)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Videos^ ro ?n30'|DQRa-L-L$t`)C:\Users\exploitfil1\Videos An30'|DQRa.L-La)C:\Users\exploitfil1\Videos P  bIn30'|DQRa-L-Lf)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Videos Kn30'|DQRa.L-Lh)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\VideosP\  :Qn30'|DQRa-L-Lk)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Videos ]Sn30'|DQRa.L-L,m)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Videosf  Zn30'|DQRa-L-Lq)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Videos \n30'|DQRa.L-LZs)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Videos[ of\ fn30'|DQRa/L/Ly) v fn30'|DQRa0L/Ly) C:\Users\exploitfil1\DesktopvP Fgn30'|DQRakj0z)P mn30'|DQRajjN~) R~n30'|DQRa-L-LJ)knownfolder:{FDD39AD0-238F-46AF-ADB4-6C85480369C7}s ~n30'|DQRa.L-L)knownfolder:{FDD39AD0-238F-46AF-ADB4-6C85480369C7}Ј W \ n30'|DQRa/L/LĊ) 2\ Ҁn30'|DQRa0L/L) C:\Users\exploitfil1\Desktop32\\ ^n30'|DQRa/L/LFF)  n30'|DQRa0L/L^d) C:\Users\exploitfil1\Desktop xH Ӕ&-x 8`P8 P n30'|DQRa-L-L )C:\Users\exploitfil1\Documentse n30'|DQRa.L-Lzώ)C:\Users\exploitfil1\Documents c v n30'|DQRa-L-LYƝ)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Documentsn  ܟn30'|DQRa.L-LB)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Documents[  n30'|DQRa-L-L)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Documents-4E  n30'|DQRa.L-LyW)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Documents\ ger én30'|DQRa-L-Le)C:\Users\exploitfil1\Documentsd n30'|DQRa.L-L)C:\Users\exploitfil1\Documents P S ӱn30'|DQRa-L-L)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Documentsv  n30'|DQRa.L-L)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Documents\  n30'|DQRa-L-Lٰ)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Documents1.0  ün30'|DQRa.L-L.)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\DocumentsP_ exe n30'|DQRa-L-L)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Documents di  n30'|DQRa.L-L|A)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\DocumentsPh af\ un30'|DQRa/L/L0m)~  n30'|DQRa0L/L)~ C:\Users\exploitfil1\DesktopP n30'|DQRakjԾ)P n30'|DQRajj)  n30'|DQRa-L-L8)knownfolder:{33E28130-4E1E-4676-835A-98395C3BC3BB} n30'|DQRa.L-L)knownfolder:{33E28130-4E1E-4676-835A-98395C3BC3BB}p ^ e\ =n30'|DQRa/L/LL)  n30'|DQRa0L/Lx) C:\Users\exploitfil1\Desktop\ n30'|DQRa/L/L)  @n30'|DQRa0L/L$) C:\Users\exploitfil1\Desktop  n30'|DQRa-L-L)C:\Users\exploitfil1\Pictures n30'|DQRa.L-L#)C:\Users\exploitfil1\Pictures e  n30'|DQRa-L-L)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Pictures # n30'|DQRa.L-Ls/)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Pictures[  n30'|DQRa-L-L)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Pictures n30'|DQRa.L-LWW)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\PicturespQ  n30'|DQRa-L-L)C:\Users\exploitfil1\Pictures n30'|DQRa.L-L)C:\Users\exploitfil1\Pictures Ph  +n30'|DQRa-L-L)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Pictures >n30'|DQRa.L-L&X)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Picturesg  "n30'|DQRa-L-L2)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Pictures &n30'|DQRa.L-L^ )\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\PicturesU  ]-n30'|DQRa-L-L)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Pictures c/n30'|DQRa.L-L9)\\?\Volume{071e00f0-1402-11e4-80b8-806e6f6e6963}\Users\exploitfil1\Pictures[ \ 8n30'|DQRa/L/Lh*  9n30'|DQRa0L/Lʔ* C:\Users\exploitfil1\DesktoptopP x9n30'|DQRakj:* P 6(&. U8@P Bn30'|DQRa-L-LY *C:\Windows\system32\connectedsearch-contacts.searchconnector-ms Sn30'|DQRa.L-L*C:\Windows\system32\connectedsearch-contacts.searchconnector-ms ^ P Wn30'|DQRajju*\ fn30'|DQRa/L/LY!*`  fn30'|DQRa0L/L!*` C:\Users\exploitfil1\DesktopP Bgn30'|DQRakj!* kn30'|DQRa-L-L$*C:\Windows\system32\connectedsearch-zeroinput.searchconnector-ms |n30'|DQRa.L-Lx{/*C:\Windows\system32\connectedsearch-zeroinput.searchconnector-ms» f P =n30'|DQRajj+2*\ n30'|DQRa/L/L=*  Cn30'|DQRa0L/L=* C:\Users\exploitfil1\DesktopP n30'|DQRakjC>* nn30'|DQRa-L-LB*C:\Windows\system32\connectedsearch-suggestions.searchconnector-ms ;n30'|DQRa.L-LM*C:\Windows\system32\connectedsearch-suggestions.searchconnector-msg P P [n30'|DQRajjO*\ n30'|DQRa/L/Lf[*  n30'|DQRa0L/L>[* C:\Users\exploitfil1\DesktopP dn30'|DQRakj:[*r,n30'|DQRa%%\.SearchFinalTasksX,n30'|DQRaVVneq2h,Zn30'|DQRaVV's2~l,ߌn30'|DQRaRR}2t x#)B}[&| B n30'|DQRa-L-L9C:\Windows\system32\mstsc.exe|eD n30'|DQRa.L-L89C:\Windows\system32\mstsc.exe P |! n30'|DQRa-L-Lq9C:\Windows\system32\calc.exe| n30'|DQRa.L-L9C:\Windows\system32\calc.exe |G_ n30'|DQRa-L-Lu9C:\Windows\system32\cmd.exe|` n30'|DQRa.L-Lv9C:\Windows\system32\cmd.exe p |] n30'|DQRa-L-Lq:C:\Windows\system32\comexp.msc| n30'|DQRa.L-Lt:C:\Windows\system32\comexp.msc p |1 n30'|DQRa-L-LH\:C:\Windows\system32\dfrgui.exe|2 n30'|DQRa.L-L]:C:\Windows\system32\dfrgui.exe п | n30'|DQRa-L-L :C:\Windows\system32\iscsicpl.exe| n30'|DQRa.L-L:C:\Windows\system32\iscsicpl.exe  |8n30'|DQRa-L-L:C:\Windows\system32\magnify.exe|n30'|DQRa.L-L:C:\Windows\system32\magnify.exe ||dn30'|DQRa-L-L4&;C:\Windows\system32\MdSched.exe| fn30'|DQRa.L-L@';C:\Windows\system32\MdSched.exe p |tn30'|DQRa-L-LE];C:\Windows\system32\msconfig.exe|n30'|DQRa.L-LE^;C:\Windows\system32\msconfig.exe 0 | n30'|DQRa-L-Lؔ;C:\Windows\system32\msinfo32.exe|1n30'|DQRa.L-Lޕ;C:\Windows\system32\msinfo32.exe |gn30'|DQRa-L-L;C:\Windows\system32\mspaint.exe|in30'|DQRa.L-L;C:\Windows\system32\mspaint.exe 0 |Xn30'|DQRa-L-LY<C:\Windows\system32\narrator.exe|n30'|DQRa.L-L(W<C:\Windows\system32\narrator.exe  |7n30'|DQRa-L-L"X<C:\Windows\system32\notepad.exe|q9n30'|DQRa.L-L{&Y<C:\Windows\system32\notepad.exe P |n30'|DQRa-L-L{/<C:\Windows\system32\odbcad32.exe|@n30'|DQRa.L-L/<C:\Windows\system32\odbcad32.exe p |yn30'|DQRa-L-L><C:\Windows\system32\osk.exe|n30'|DQRa.L-L0C<C:\Windows\system32\osk.exe  |h=n30'|DQRa-L-Lx_=C:\Windows\system32\psr.exe ` 2J;&/` 8 PU| An30'|DQRa.L-L=C:\Windows\system32\psr.exe  |׆n30'|DQRa-L-Lu3=C:\Windows\system32\scw.exe|cn30'|DQRa.L-Lt4=C:\Windows\system32\scw.exe |n30'|DQRa-L-Lb=C:\Windows\system32\ServerManager.exe|In30'|DQRa.L-L߇c=C:\Windows\system32\ServerManager.exeb п |n30'|DQRa-L-L=C:\Windows\system32\services.msc|n30'|DQRa.L-L=C:\Windows\system32\services.msc p |en30'|DQRa-L-L=C:\Windows\system32\wbadmin.msc|fn30'|DQRa.L-L`=C:\Windows\system32\wbadmin.msc  |n30'|DQRa-L-L=C:\Windows\system32\WF.msca|Cn30'|DQRa.L-L5=C:\Windows\system32\WF.msc 0 |Mn30'|DQRa-L-L;]>C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell_ISE.exel1|eOn30'|DQRa.L-L`^>C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell_ISE.exeL te|Zn30'|DQRa3I3I鑜>C:\Program Files\Java\jdk1.7.0_45\bin\jmc.exe\s|en30'|DQRa4I3I>C:\Program Files\Java\jdk1.7.0_45\bin\jmc.exeRa|[n30'|DQRa-L-L%?C:\Program Files\Windows NT\Accessories\wordpad.exe|w]n30'|DQRa.L-L5?C:\Program Files\Windows NT\Accessories\wordpad.exe 0 |n30'|DQRa3I3I&E?C:\Program Files (x86)\Notepad++\notepad++.exem|@n30'|DQRa4I3I R?C:\Program Files (x86)\Notepad++\notepad++.exes|n30'|DQRa-L-L' y?C:\Windows\syswow64\odbcad32.exe|n30'|DQRa.L-Lz?C:\Windows\syswow64\odbcad32.exe |n30'|DQRa-L-Lv?C:\Windows\syswow64\WindowsPowerShell\v1.0\PowerShell_ISE.exe|ԝn30'|DQRa.L-L?C:\Windows\syswow64\WindowsPowerShell\v1.0\PowerShell_ISE.exeA p \Wګn30'|DQRa-L-LƑ@C:\Windows\web\wallpaper\Windows\img0.jpgn30'|DQRa.L-L@C:\Windows\web\wallpaper\Windows\img0.jpgV RaUn30'|DQRa-L-L@C:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper-Ln30'|DQRa.L-Lm@C:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper, 82#n30'|DQRa-L-L7/Bshell:::{98F275B4-4FFF-11E0-89E2-7B86DFD72085}+n30'|DQRa.L-Lo4Bshell:::{98F275B4-4FFF-11E0-89E2-7B86DFD72085}  Xan30'|DQRaLMױWBP8 vn30'|DQRaDDfeBX8 Hn30'|DQRaMMCP8jHn30'|DQRaEDCvn30'|DQRa-L-L {Cshell:::{98F275B4-4FFF-11E0-89E2-7B86DFD72085}aлn30'|DQRa.L-LTCshell:::{98F275B4-4FFF-11E0-89E2-7B86DFD72085}P Xn30'|DQRaLMDP8Jn30'|DQRaDD- DX8Jn30'|DQRaMMP _EP8n30'|DQRaEDd4_El,n30'|DQRaRR{xFt x#)B}[& l,=B!n30'|DQRaRRJGt x#)B}[&?\l,\!n30'|DQRaRRaTGt x#)B}[&loZ,o!n30'|DQRa%%KSGSSO2(v,Gp!n30'|DQRa%%GAfterDesktopSwitche,cp!n30'|DQRa%%[GResumeDesktopStartupAppsP,p!n30'|DQRa%%G|U#n30'|DQRa-L-L(EIC:\Windows\system32\@TileEmpty1x1Image.png|] $n30'|DQRa.L-L(TIC:\Windows\system32\@TileEmpty1x1Image.pngP PK |+n30'|DQRa-L-L2MC:\Windows\system32\@TileEmpty1x1Image.pnga|,+n30'|DQRa.L-LMC:\Windows\system32\@TileEmpty1x1Image.png  r:r&0 8@P8P|s,n30'|DQRa-L-LJNC:\Windows\system32\@TileEmpty1x1Image.png6|Ĵ,n30'|DQRa.L-L@NC:\Windows\system32\@TileEmpty1x1Image.pngВ p 0|-n30'|DQRa-L-LkOC:\Windows\system32\@TileEmpty1x1Image.pnga|.n30'|DQRa.L-LOC:\Windows\system32\@TileEmpty1x1Image.png pO | 0n30'|DQRa-L-L"~QC:\Program Files\Internet Explorer\images\tileLogo.scale-80.pngl|0n30'|DQRaSISI]cQ(&IOpI +l|90n30'|DQRaSISI=Q(&IOpI +3}|n0n30'|DQRa.L-LIQC:\Program Files\Internet Explorer\images\tileLogo.scale-80.png@g 0 |>2n30'|DQRa-L-L_|SC:\Windows\system32\@TileEmpty1x1Image.png|Q2n30'|DQRa.L-LSC:\Windows\system32\@TileEmpty1x1Image.png' PN |4n30'|DQRa-L-L+SC:\Windows\system32\@TileEmpty1x1Image.png|!4n30'|DQRa.L-LSSC:\Windows\system32\@TileEmpty1x1Image.pngP  pO P04n30'|DQRahT|t5n30'|DQRa-L-LTC:\Windows\DesktopTileResources\images\logo.scale-80.png/L|5n30'|DQRa.L-L%TC:\Windows\DesktopTileResources\images\logo.scale-80.png PN |7n30'|DQRa-L-LOKEVC:\Windows\system32\control.exe|N7n30'|DQRa.L-LGaFVC:\Windows\system32\control.exe k8n30'|DQRa-L-L>jVC:\Windows\web\wallpaper\Windows\img0.jpg4Es8n30'|DQRa.L-LeVC:\Windows\web\wallpaper\Windows\img0.jpgB0q L8n30'|DQRa-L-L3VC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper/L8n30'|DQRa.L-LVC:\Users\exploitfil1\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaperp 0b '|D|e;n30'|DQRa-L-LPXC:\Windows\system32\taskmgr.exe|g;n30'|DQRa.L-LmXC:\Windows\system32\taskmgr.exe PH |N?n30'|DQRa-L-L2T[C:\Program Files\Internet Explorer\images\smallLogo.scale-80.png6e6|?n30'|DQRa.L-L{c[C:\Program Files\Internet Explorer\images\smallLogo.scale-80.png> 8-8|@n30'|DQRa-L-L \C:\Windows\system32\ServerManager.exe|ڤ@n30'|DQRa.L-L0 \C:\Windows\system32\ServerManager.exe@L P0zn30'|DQRaLLtT\ szn30'|DQRa|%fRaP\ zn30'|DQRa%%Pzn30'|DQRavvU+Pzn30'|DQRawv,P7zn30'|DQRavvB-P1zn30'|DQRawv.\ yzn30'|DQRaymamr/-ARC: Paused/Resumed root#0 for change notification: Pause=0 Success=1Pzn30'|DQRavv7Pzn30'|DQRawvt_8P;zn30'|DQRavv9Pzn30'|DQRawvb;\ Nzn30'|DQRaymam=-ARC: Paused/Resumed root#1 for change notification: Pause=0 Success=1-LP{n30'|DQRavvEP{n30'|DQRawvFP{n30'|DQRavvGP{n30'|DQRawvH\  {n30'|DQRaymam3I-ARC: Paused/Resumed root#3 for change notification: Pause=0 Success=1vP"{n30'|DQRavvPPE{n30'|DQRawvXQPl{n30'|DQRavv"TP\{n30'|DQRawv*]U\ c{n30'|DQRaymamӲV-ARC: Paused/Resumed root#6 for change notification: Pause=0 Success=1aP6{n30'|DQRavvfP7{n30'|DQRawvgP={n30'|DQRavvOkP?{n30'|DQRawvobl\ B{n30'|DQRaymamm-ARC: Paused/Resumed root#7 for change notification: Pause=0 Success=1P[W{n30'|DQRavvs | @@0v)&1@!8`P8 PPY{n30'|DQRawv}P^{n30'|DQRavvaP_{n30'|DQRawv \ l{n30'|DQRaymam-ARC: Paused/Resumed root#8 for change notification: Pause=0 Success=10h “{n30'|DQRa|mm󌣂StateChangeX D{n30'|DQRa~mm-X {n30'|DQRa}mm@f {n30'|DQRa|mmAppInstallX |{n30'|DQRa~mmX {n30'|DQRa}mm X\ i{n30'|DQRamm \ ${n30'|DQRaymam(-ARC: RefreshCache: smrcf=0x9se\ {n30'|DQRaymamY-ARC: UpdateCache: smrcf=0x9P\ ߹{n30'|DQRawmm{P\ 2{n30'|DQRaqmn k7ǂl\ w{n30'|DQRaSISIeт(&IOpI +l\ A{n30'|DQRaSISIuႆ(&IOpI +0-l\ |n30'|DQRaSISIꂆ(&IOpI +tsl\ 8$|n30'|DQRaSISIx.(&IOpI +{0l\ 1|n30'|DQRaSISI (&IOpI +\Dl\ }?|n30'|DQRaSISI(&IOpI +l\ S|n30'|DQRaSISI (&IOpI +e6l\ `|n30'|DQRaSISI)(&IOpI +Ral\ U9}n30'|DQRaSISI(&IOpI +-8l\ ?}n30'|DQRaSISId滃(&IOpI +l\ Q}n30'|DQRaSISIvǃ(&IOpI +{0l\ en}n30'|DQRaSISIPڃ(&IOpI +\Dl\ }n30'|DQRaSISI(&IOpI +?\l\ R~n30'|DQRaSISIo(&IOpI +lol\ Y]~n30'|DQRaSISIv(&IOpI +RaP\ K~n30'|DQRarmn .:\ ޒ~n30'|DQRaymam4ϙ-ARC: Committing updated cache to disk. Cache size=79904)\ on30'|DQRaymamj-ARC: Loading cache to memory after committing updated cache to disk.4Ed\ Pn30'|DQRamm y??-LP\ n30'|DQRaxmmLdP,dn30'|DQRa_j^j6;P,jen30'|DQRa%%<