Skip to content

Instantly share code, notes, and snippets.

Show Gist options
  • Save herbiezimmerman/e205b0129c2367ff446ba6b2a6d77a60 to your computer and use it in GitHub Desktop.
Save herbiezimmerman/e205b0129c2367ff446ba6b2a6d77a60 to your computer and use it in GitHub Desktop.
2018-08-24: Hawkeye malspam process details
This file has been truncated, but you can view the full file.
Strings2 v1.3
Copyright © 2016, Geoff McDonald
http://www.split-code.com/
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
\??\C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
en-US
M/d/yyyy
MMMM, yyyy
dddd, MMMM dd, yyyy
MS-Win-Core-Console-L1-1-0
kernel32.dllMS-Win-Core-DateTime-L1-1-0
MS-Win-Core-Debug-L1-1-0
kernelbase.dllMS-Win-Core-DelayLoad-L1-1-0
MS-Win-Core-ErrorHandling-L1-1-0
MS-Win-Core-Fibers-L1-1-0
MS-Win-Core-File-L1-1-0
MS-Win-Core-Handle-L1-1-0
MS-Win-Core-Heap-L1-1-0
MS-Win-Core-Interlocked-L1-1-0
MS-Win-Core-IO-L1-1-0
MS-Win-Core-LibraryLoader-L1-1-0
MS-Win-Core-Localization-L1-1-0
MS-Win-Core-LocalRegistry-L1-1-0
MS-Win-Core-Memory-L1-1-0
MS-Win-Core-Misc-L1-1-0
MS-Win-Core-NamedPipe-L1-1-0
MS-Win-Core-ProcessEnvironment-L1-1-0
MS-Win-Core-ProcessThreads-L1-1-0
MS-Win-Core-Profile-L1-1-0
MS-Win-Core-RtlSupport-L1-1-0
ntdll.dll
MS-Win-Core-String-L1-1-0
MS-Win-Core-Synch-L1-1-0
MS-Win-Core-SysInfo-L1-1-0
MS-Win-Core-ThreadPool-L1-1-0
MS-Win-Core-UMS-L1-1-0
MS-Win-Core-Util-L1-1-0
MS-Win-Core-XState-L1-1-0
MS-Win-Security-Base-L1-1-0
MS-Win-Security-LSALookup-L1-1-0
sechost.dll
MS-Win-Security-SDDL-L1-1-0
MS-Win-Service-Core-L1-1-0
MS-Win-Service-Management-L1-1-0
MS-Win-Service-Management-L2-1-0
MS-Win-Service-winsvc-L1-1-0
P$1t
v'1t
v'1t
v'1t
v'1t
0E5t
v'1t
v'1t
XN3t
XN3t
3++S++
v'1t
v'1t
wt5t
Y\MACHIN
explorer\Fol
iptions\{7C5A40EF-A0FB-4BFC-874A-C0F
P$1t
P$1t
X=8t
~M8t
me2\Wind
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\PropertyBags
C:\Windows\syswow64\ntdll.dll
Wow64ApcRoutine
xception
????
????
C:\Windows\SYSTEM32\wow64.dll
lSX]
dows
d08cc0
fc\MSV
Microsoft Corporation. All rights reserved.
2.0.50727.5420E
vtHu`M[
cs.Deb
onCopyright
20140-8205-570da0ccce8dToken=b7
1934
%Hu$.Gu
x,Gu(
System.Configuration.Install
b$aw2#aw
x,Gul
%HuH
System.Management
1d50a3a
policy.2.0.System.Configuration.Install__b03f5f7f11d
ll.d
x,Gu|
System.Management\6f3b99ed0b791ff4d8aa52f2f0cd0bcf
x,Gu
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\6f3b99ed0b791ff4d8aa52f2f0cd0bcf
tive
\Pro
Files (
U aw
] awln
C:\Program Files (x86)
LIST
:2o-
Q3u!!R
p
/u0
p
/u
Q3u$
Q3up
/u
-up
/u@
Aup
/u
mppqmp
mpYl
qpqmp
qpqmp
36100
S-1-5-21-3643501033-86
38929-
Au(k
IqHu
q"G3ur
p
/u
p
/u
F3u"G3u
F3u"G3up
/u
-up
/u
@up
/u
q6F3u
>X1u
q>X1u
I3u>
p
/uL
p
/u
q6F3u
@u6F3u
I3up
/u
2.uG
2.uG
2.u=
q\,8
2.uG
2.u
2.uG
2.u\
p
/u
q\,8
qT=R
q\,8
@u|,8
q$t8
p;'u
p;'u <'u
p
q3
2.dll
(q
q4
(q
q4
qY4a
_/>u
q\,8
#M"R
30% tt Slip.exe
C:\Users\Bill\Desktop\30% tt Slip.exe
GetCORSystemDirectory
0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
& !
QC:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
& !
uKERNELBASE.dll
C:\Windows\syswow64\KERNELBASE.dll
mscorjit.dll
mscoree.dll
$%&'x
,-./.
4567
<=>?@ABCDEFGHIJK
XYZ[\]^_`ABC
LMNO.
CLRCreateInstance
clrjit.dll
Cor_Enable_Profiling
Actx
[IY-
_P8\
SsHd,
C:\Windows\WinSxs\
[IY-0
Microsoft.Windows.SystemCompatible
Microsoft.Windows.SystemCompatible,processorArchitecture="x86",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.7600.16385"System Default Context
x86_microsoft.windows.systemcompatible_6595b64144ccf1df_6.0.7600.16385_none_49adccbde8169a03
Microsoft.Windows.IsolationAutomation
Microsoft.Windows.IsolationAutomation,processorArchitecture="x86",publicKeyToken="6595b64144ccf1df",type="win32",version="1.0.0.0"C:\Windows\WinSxS\manifests\x86_microsoft.windows.isolationautomation_6595b64144ccf1df_1.0.0.0_none_35d357a66c38ade4.manifest
x86_microsoft.windows.isolationautomation_6595b64144ccf1df_1.0.0.0_none_35d357a66c38ade4
Microsoft.Windows.GdiPlus
Microsoft.Windows.GdiPlus,processorArchitecture="x86",publicKeyToken="6595b64144ccf1df",type="win32",version="1.1.7601.17514"C:\Windows\WinSxS\manifests\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80.manifest
x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
Microsoft.Windows.Common-Controls
Microsoft.Windows.Common-Controls,processorArchitecture="x86",publicKeyToken="6595b64144ccf1df",type="win32",version="5.82.7601.17514"C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af.manifest
x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af
Microsoft.Windows.IsolationAutomation.ProxyStub
Microsoft.Windows.IsolationAutomation.ProxyStub,processorArchitecture="x86",publicKeyToken="6595b64144ccf1df",type="win32",version="1.0.7600.16385"C:\Windows\WinSxS\manifests\x86_microsoft.windows.i..utomation.proxystub_6595b64144ccf1df_1.0.7600.16385_none_9d148a8db8d32238.manifest
x86_microsoft.windows.i..utomation.proxystub_6595b64144ccf1df_1.0.7600.16385_none_9d148a8db8d32238
Microsoft.Windows.Common-Controls.Resources
Microsoft.Windows.Common-Controls.Resources,language="en-us",processorArchitecture="x86",publicKeyToken="6595b64144ccf1df",type="win32",version="5.82.7600.16385"C:\Windows\WinSxS\manifests\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.7600.16385_en-us_020378a8991bbcc2.manifest
x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.7600.16385_en-us_020378a8991bbcc2
en-US
SsHd,
sxsoa.dll
C:\Windows\system32\sxsoa.dll
C:\Windows\SysWOW64\sxsoa.dll
GdiPlus.dll
C:\Windows\system32\GdiPlus.dll
C:\Windows\SysWOW64\GdiPlus.dll
comctl32.dll
C:\Windows\system32\comctl32.dll
C:\Windows\SysWOW64\comctl32.dll
sxsoaps.dll
C:\Windows\system32\sxsoaps.dll
C:\Windows\SysWOW64\sxsoaps.dll
sxsoaps.tlb
C:\Windows\system32\sxsoaps.tlb
C:\Windows\SysWOW64\sxsoaps.tlb
comctl32.dll.mui
C:\Windows\system32\comctl32.dll.mui
C:\Windows\SysWOW64\comctl32.dll.mui
SsHd,
\a*p
ToolbarWindow32
ToolbarWindow32
comctl32.dll
ComboBoxEx32
ComboBoxEx32
comctl32.dll
msctls_trackbar32
msctls_trackbar32
comctl32.dll
msctls_updown32
msctls_updown32
comctl32.dll
msctls_progress32
msctls_progress32
comctl32.dll
msctls_hotkey32
msctls_hotkey32
comctl32.dll
msctls_statusbar32
msctls_statusbar32
comctl32.dll
SysHeader32
SysHeader32
comctl32.dll
SysListView32
SysListView32
comctl32.dll
SysTreeView32
SysTreeView32
comctl32.dll
SysTabControl32
SysTabControl32
comctl32.dll
SysIPAddress32
SysIPAddress32
comctl32.dll
SysPager
SysPager
comctl32.dll
NativeFontCtl
NativeFontCtl
comctl32.dll
Button
Button
comctl32.dll
Static
Static
comctl32.dll
Listbox
Listbox
comctl32.dll
ScrollBar
ScrollBar
comctl32.dll
tooltips_class32
tooltips_class32
comctl32.dll
ButtonListBox
ButtonListBox
comctl32.dll
SysAnimate32
SysAnimate32
comctl32.dll
SysMonthCal32
SysMonthCal32
comctl32.dll
SysDateTimePick32
SysDateTimePick32
comctl32.dll
ReBarWindow32
ReBarWindow32
comctl32.dll
Edit
Edit
comctl32.dll
Combobox
Combobox
comctl32.dll
ComboLBox
ComboLBox
comctl32.dll
GsHd(
sxsoaps.dll
sxsoa.dll
6"9J
SBl?6_d
6"9J
SBl?6_wD
Microsoft.Windows.ActCtx.1
6"9J
SBl?6_wD
Microsoft.Windows.ActCtx.1
GsHd(
IActCtx
GsHd(
sxsoaps.tlb
sxsoa.dll
SsHd,
6"9J
SBl?6_
Microsoft.Windows.ActCtx.1
Microsoft.Windows.ActCtx
GsHd(
######$#########$######
######$%&&&&&&%&&&&&&&&&%&&&&&&
&&&&&&%&0
'('('('('('('('('($%'('(%'('('('('('('('(($%'('('($%'('('('('('('('('('(''('('(%($$%$%$$%$$$%%$$$$%$$%$'$%(($$%''($%$%$$%$%($%''($$$%$%$$%%)$%%%))))'*($+%$+%'('('('('('('('(%'(($+%'($$$%'('('(P
'('('('($%$%$%$%$%$%$%$%$%$%$%$%$%$%%%%%%%$$%$$%%$%$$$$%$%$%$%$%%%%%%%%%%%%%%%%%%%%%%%%%(%%(%%%%%%%%)%%%%%%%%%%%,,,,,,,,,--.,.....-----/--//---/..------//////--,,,,.---------.-----------------P
0000000000000000000000000000000100000000111110000001111111111111$%$%--$%
,%%%"
//'2'''
''($$$$$$$$$$$$$$$$$
$$$$$$$''(((((%%%%%%%%%%%%%%%%%%%%%%%%%((((($%%$''%%%$%$%$%$%%%%%$%3$%$$%%$$$
$'$'$$$'$$$$'$'$$$$$$$$$$'$$$$$$$$$$$$$$$$$$$$$$%%%%%%%%%(%%%%%%%(%(%%%(%%%%(%(%$%$%$%'($%$%$%$%$%40000011$%$%$%$%'($%$%'($%$%$%$%$%$%$%$%'($%$%'($%$%$%$%$%$%'($'($%$%$%$%$%$%%'('($%'($%'('('($%'('('($%'($%'('('('($%'($%$%$%
$%$%
$$$$$$$$$$$$$$$$$$$$$$
,566666
%%%%%%%%%%%%%%%%%%%%%%%
0000000000000000010000000000000000000000000007070070171
888888888888888888888888888
88877
9999
33:;;:<733111111111117
888888888888888=8888888888000000001111001>>>11
??????????;@@7880888888888888888888878111111191001111AA113000188BBBBBBBBBB888::8
77777777777777
818888888888888800000000000
888888888000000000008
CCCCCCCCCC88888888888888888000000000AA3"""8
11D))))))))))))))))))))))))))))))))))))))
0)EEE>>>>>>>>EEEE0
)0000
))))))))))>>66FFFFFFFFFF6.)
)))))
))))))))
))))))))))))))))))))))
)))))))
))))
0)EEE>>>>
EE0)
)))>>
FFFFFFFFFF))GGDDDDDD4
0 @ @ P ` p
))))))
EEE>>
))))
FFFFFFFFFF11)))1
))))))))I
))))))))))))))
)))))
0)EEE>>>>>
P
`
p
)))))
0)E>E>>>>
))))))
))))
))))))))))))
EE>EE
EEE0
DDD333333G3
))))))))
))))))))))))))))))
)))))
)>>>EEEE
>>>0
JJJJJJJ4
))))))))
))))))
)))))
0)EEEEEEE
EE>0
))))))))))
)EEE>>>>
EEE0
DDDDDD
4))))))
))))))))))))))))))
))))))))
)))))))))
)))))))
EEE>>>
EEEEEEEE
@
0
@
)))))))))))))))))))I)I))))))))KILIILLLLLLM
GIIIIIIKMMMMMMMM6FFFFFFFFFF66
))))
)))))))
)))I>II>>>>>>
IIIII
000001
FFFFFFFFFF
)4446666666666666664444400444444FFFFFFFFFFDDDDDDDDDD404040""""NN))))))))
))))))))))))))))))))
>>>>>>>>>>>>>1D>>000600))))
11111111
111111111111111111111111111111111111
444444440444444
4466666
)))))))))))EE>>>>E>>>>10D00DD11)FFFFFFFFFF666666))))))EE>>))))111)EDD))EEDDDDD)))>>>>)))))))))))))1EE>>NNNNNN0)NFFFFFFFFFF
44$$$$$$
)))))))))))6)
@ @ @
@ @
))))))))))
))))
))))))))))))))))))
@ @ @ @ @
@ @ @ @
@ @ @ @
)))))))))
))))
)))))))
))))
))))
)))))))
))))
)))))))))))))))
))))))))@ @ @ @ P
@ @ P
@ @ p
@ @ )))))))))))
1466666666DDDDDDDDDDDDDDDDDDDD
3333333333
)))))
@ @ @
@ @ @ @ @
@ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ )))))))))))))66))))))))
O))))))))))))))))))))))))))""
)))))))))))666))@ @ @ @ @ @ p
@ @ @ @
)))))))))))))
))))>>1
))>>166
))>>
)))IIIIIIIIIIIIIIIIIPPE>>>>>>>EEEEEEEE1DD00000000000666)666G)0
FFFFFFFFFF
JJJJJJJJJJ
@ @ 0
"""""""""""111Q
)))I))))))))))))))))))))
)))))))))1)
@ @
@ @
@ @
I)))))))))))))))>>>EEEE>>111
DD1DDDDDD000
""FFFFFFFFFF))))))))))))))
EEEEEEEEEEEEEEEEE)))))))DD
FFFFFFFFFF
""3333333333333333
@ @
)))))))>>EEE
66@
1111D)))))))))))))))0E>>>>>E>EEEEE>EN)))))))
64444444444000000000444444444
11D))))))))))))))D11>>EE>>N
@ @
))))DDEEEEEE>1111111DD00
66666FFFFFFFFFF
)))FFFFFFFFFF))))))))))))))......66@ @
%%%%%%%%%%%%......................(((((((((%%%%%%%%%%%%%)%%%%%%%%%%%%%%%%%%)))))11110000000000001111111
@ @ @
'('('(((((((%%$%'('('('('($%$%$%P
((((((((''''''''((((((
''''''
((((((((
'((((((((((((((
((((((((********(((((
((''''*/R///(((
((''''*///((((
((''''
///(((((((('''''///
((''''*//
OOOOOOOOOOO
S9222222""TT""TT""""""""""OU
V;;WWW"""2""""""""""2X"""""""""""""3""""""""""""O
YYYYYYZ[\""RYYYYYYYYYYZ[\""
GGGGGGGGG]GGGGGGGGGGGG
33$3333$33%$$$%%$$$%3$333$$$$$333333$3$3$3$$$$G%$$$$%))))%33%%$$33333$%%%%3333%4
JJJJJJJJJJJJJ)))$%))))
@ @
33[G3\\333333333
333333333""33333333333444444444444444444444444444444444444433333333334333333333333333333
3333333
33333333333
JJJJJJJJJJJJJJJJJJJJJJJJYYYYYYYYYYYYYYYYYYYY44444444444444JJJJJJ
\333\\33\\333333333333333333\\330
33333333333333
33333333333343333333333333333
3333
3333
3333
333333333333
3333333333333333333
3333
3333333
3333333""""""""""""""JJJJJJJJJJJJJJ3
33333333
33333333333333
33333""3333
333333""""""""""
333""""""""""""""""""""""333333333333333""""3333333333333333""33
33333
$$$$$$$$$$$$$$$
%%%%%%%%%%%%%%%
$%$$$%%$%$%$%$$$
%$%%$%%%%%%%)
$%$%%333333
""""J""
%%%%%%
))))))
))))))))
)))))))
@ @ @
"""""""""""""""""""""""""""""""-"
3333333333
333330
333333
333333333333
^TT23)__""""TT""""33""""""""2"""3_________0000002`a`a`33___))"33
bbbbbbbbbbbcbcbcbcbcbcbcbcbcbcbcbcbbcbcbcbbbbbbccbccbccbccbccbbbbbbbbbbbbbbbbbbbbbbbbb
ddeefgbhiiiiiiiiiiijijijijijijijijijijijijiijijijiiiiiijjijjijjijjijjiiiiiiiiiiiiiiiikikkiijkkjjjjlmnok
)))))))))))
pppppppppppppppppppppppppppppppppppp))))))))))))))))))))))))))
44DDDD4444444444kkkkkkkkkkkkkkkk
444444444444433
DDDDDDDDDD4444444444
3JJJJJJJJJJJJJJJ44444444444433344JJJJJJJJJJJJJJJ4444444444443333qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
444444433334444444444444444444334444444444444443P
________________
______
____
@ @ @ @ @ @ @ @
)))))))))))))"""FFFFFFFFFF))
$%$%$%$%$%$%)0111"
00"-$%$%$%$%
0 @ @
P ` @
3333333-----------$%$%$%$%$%$%$%%%$%$%$%$%$%$%$%)%%%%%%%%$%$%$$%$%$%$%$%-44$%
)))))
))1)))1))))1)))))))EE>>E3333
))))""""
DD))))))))))))))))))DEEEEEEEEEEEEEEE0
66 !@ 0!
@ @ @ @!P!@ @ `!p!p
))))))>>>>>000r6)))))))>>>>>>>>111DN
)))))))))>>>>>>EE>>DD11
)))1))))))))1D
FFFFFFFFFF
6666@ @
))))
@ @ @ @ @ @ @ @ @ @ P"
ssssssssssssssss
"tttttttttttttttt
"DDDDDDDDDDDDDDDD
"______________
)))))))))))
__________
#@ @ @ #
%%%%%%%
%%%%%
808888888888Z8888888888888
88888
888888888888
8888888888888`#p#
88888888888888""
8888888888888888888888
888888888888:3
@$""""""""""
0000000
"22"""""""""""""<"<
"<""2"""""";""Zu33\
2v;2
88888
88888888888888888888888
TTxyxTzTTT{|}|~
% %0%@%P%`%p%
NSDS
'!R#
'5O=
'1O^
'1Ob
$ $ $
( ( (
, , ,
0 0 0
4 4 4
'<Oc
'<O6
'<OA
'<O3
$
$
$
(
(
(
,
,
,
'<OB
0
0
0
'<O.
4
4
4
8
8
8
<
<
<
@
@
@
'<OH
D
D
D
'<Oj
H
H
H
L
L
L
P
P
P
'6OM
'IOT
'IO'
'8Ov
'BOz
'!R
'6OM
%'fQ
_'5OQ
'6OM
'6OM
; ; ;
'6OM
;$;$;$
'<OB
%q *
@ @ @
D D D
H H H
'<O.
'5O]
T
T
T
'IOT
'IOT
'IOT
'IOT
'<Oc
'BOz
'!R#
'5O=
'1O^
'1Ob
'6OM
'IOT
'8Ov
'BOz
%'fQ
_'5OQ
'6OM
; ; ;
'6OM
;$;$;$
'<O.
'5O]
'IOT
'IOT
'IOT
'IOT
'<Oc
af-ZA
am-ET
ar-AE
ar-BH
ar-DZ
ar-EG
ar-IQ
ar-JO
ar-KW
ar-LB
ar-LY
ar-MA
ar-OM
ar-QA
ar-SA
ar-SY
ar-TN
ar-YE
arn-CL
as-IN
az-Cyrl
az-Cyrl-AZ
az-Latn
az-Latn-AZ
ba-RU
be-BY
bg-BG
bn-BD
bn-IN
bo-CN
br-FR
bs-Cyrl
bs-Cyrl-BA
bs-Latn
bs-Latn-BA
ca-ES
co-FR
cs-CZ
cy-GB
da-DK
de-AT
de-CH
de-DE
de-DE_phoneb
de-LI
de-LU
dsb-DE
dv-MV
el-GR
en-029
en-AU
en-BZ
en-CA
en-GB
en-IE
en-IN
en-JM
en-MY
en-NZ
en-PH
en-SG
en-TT
en-US
en-ZA
en-ZW
es-AR
es-BO
es-CL
es-CO
es-CR
es-DO
es-EC
es-ES
es-ES_tradnl
es-GT
es-HN
es-MX
es-NI
es-PA
es-PE
es-PR
es-PY
es-SV
es-US
es-UY
es-VE
et-EE
eu-ES
fa-IR
fi-FI
fil-PH
fo-FO
fr-BE
fr-CA
fr-CH
fr-FR
fr-LU
fr-MC
fy-NL
ga-IE
gd-GB
gl-ES
gsw-FR
gu-IN
ha-Latn
ha-Latn-NG
he-IL
hi-IN
hr-BA
hr-HR
hsb-DE
hu-HU
hu-HU_technl
hy-AM
id-ID
ig-NG
ii-CN
is-IS
it-CH
it-IT
iu-Cans
iu-Cans-CA
iu-Latn
iu-Latn-CA
ja-JP
ja-JP_radstr
ka-GE
ka-GE_modern
kk-KZ
kl-GL
km-KH
kn-IN
ko-KR
kok-IN
ky-KG
lb-LU
lo-LA
lt-LT
lv-LV
mi-NZ
mk-MK
ml-IN
mn-Cyrl
mn-MN
mn-Mong
mn-Mong-CN
moh-CA
mr-IN
ms-BN
ms-MY
mt-MT
nb-NO
ne-NP
nl-BE
nl-NL
nn-NO
nso-ZA
oc-FR
or-IN
pa-IN
pl-PL
prs-AF
ps-AF
pt-BR
pt-PT
qps-ploc
qps-ploca
qps-plocm
qut-GT
quz-BO
quz-EC
quz-PE
rm-CH
ro-RO
ru-RU
rw-RW
sa-IN
sah-RU
se-FI
se-NO
se-SE
si-LK
sk-SK
sl-SI
sma-NO
sma-SE
smj-NO
smj-SE
smn-FI
sms-FI
sq-AL
sr-Cyrl
sr-Cyrl-BA
sr-Cyrl-CS
sr-Cyrl-ME
sr-Cyrl-RS
sr-Latn
sr-Latn-BA
sr-Latn-CS
sr-Latn-ME
sr-Latn-RS
sv-FI
sv-SE
sw-KE
syr-SY
ta-IN
te-IN
tg-Cyrl
tg-Cyrl-TJ
th-TH
tk-TM
tn-ZA
tr-TR
tt-RU
tzm-Latn
tzm-Latn-DZ
ug-CN
uk-UA
ur-PK
uz-Cyrl
uz-Cyrl-UZ
uz-Latn
uz-Latn-UZ
vi-VN
wo-SN
x-IV_mathan
xh-ZA
yo-NG
zh-CN
zh-CN_stroke
zh-HK
zh-HK_radstr
zh-Hans
zh-Hant
zh-MO
zh-MO_radstr
zh-MO_stroke
zh-SG
zh-SG_stroke
zh-TW
zh-TW_pronun
zh-TW_radstr
zu-ZA
ARA
hh:mm:ss tt
HH:mm:ss
dd/MM/yyyy
dd/MM/yy
yyyy-MM-dd
dd MMMM, yyyy
dddd, dd MMMM, yyyy
MMMM, yyyy
hh:mm:ss
Arabic
Saudi Arabia
Saudi Riyal
Arabic (Saudi Arabia)
dd MMMM
A.D.
hh:mm tt
HH:mm
0409:00000409;0401:00000401
Arab;
Iraq
Iraqi Dinar
Arabic (Iraq)
0409:00000409;0801:00000401
Egypt
Egyptian Pound
Arabic (Egypt)
0409:00000409;0c01:00000401
Libya
Libyan Dinar
Arabic (Libya)
0409:00000409;1001:00000401
H:mm:ss
dd-MM-yyyy
dd-MM-yy
Algeria
Algerian Dinar
Arabic (Algeria)
H:mm
040c:0000040c;1401:00020401
Morocco
Moroccan Dirham
Arabic (Morocco)
040c:0000040c;1801:00020401
Tunisia
Tunisian Dinar
Arabic (Tunisia)
040c:0000040c;1c01:00020401
Oman
Omani Rial
Arabic (Oman)
0409:00000409;2001:00000401
Yemen
Yemeni Rial
Arabic (Yemen)
0409:00000409;2401:00000401
Syria
Syrian Pound
Arabic (Syria)
0409:00000409;2801:00000401
Jordan
Jordanian Dinar
Arabic (Jordan)
0409:00000409;2c01:00000401
Lebanon
Lebanese Pound
Arabic (Lebanon)
0409:00000409;3001:00000401
Kuwait
Kuwaiti Dinar
Arabic (Kuwait)
0409:00000409;3401:00000401
U.A.E.
UAE Dirham
Arabic (U.A.E.)
0409:00000409;3801:00000401
Bahrain
Bahraini Dinar
Arabic (Bahrain)
0409:00000409;3c01:00000401
Qatar
Qatari Rial
Arabic (Qatar)
0409:00000409;4001:00000401
BGR
HH:mm:ss '
H:mm:ss '
d.M.yyyy '
dd.M.yyyy '
d.MM.yyyy '
dd.MM.yyyy '
dd MMMM yyyy '
d MMMM yyyy '
dddd, dd MMMM yyyy '
dddd, d MMMM yyyy '
MMMM yyyy '
Bulgarian
Bulgaria
Bulgarian Lev
Bulgarian (Bulgaria)
HH:mm '
H:mm '
E0402:00030402;0402:00040402;0402:00000402;0402:00020402;0409:00020409
Cyrl;
CAT
HH'H'mm''''ss''''''
d/MM/yy
d/M/yy
dd.MM.yy
dddd, d' / 'MMMM' / 'yyyy
d'/'MMMM'/'yyyy
d' 'MMMM' 'yyyy
MMMM' / 'yyyy
MMMM' de 'yyyy
Catalan
catal
Spain
Espanya
Euro
euro
diumenge
dilluns
dimarts
dimecres
dijous
divendres
dissabte
gener
febrer
abril
maig
juny
juliol
agost
setembre
octubre
novembre
desembre
calendari gregori
Catalan (Catalan)
catal
(catal
NeuN
Infinit
-Infinit
d.C.
HH'H'mm''''
0403:0000040a
Latn;
ZHT
NHS
tt hh:mm:ss
tt h:mm:ss
yyyy/M/d
yyyy/MM/dd
yyyy'
yyyy'
'MM'
'dd'
yyyy'
h:mm:ss
Chinese (Traditional)
Taiwan
New Taiwan Dollar
Chinese (Traditional, Taiwan)
Scp)
N/f
PxeW[
ck!q
tt hh:mm
tt h:mm
_0404:00000404;0404:{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}{B2F9C502-1742-11D4-9790-0080C882687E}
Hani;Hant;
ZHS
yyyy-M-d
yyyy.M.d
yyyy.MM.dd
yy-M-d
yy/M/d
yy.M.d
yy/MM/dd
yyyy'
',dddd
dddd,yyyy'
yyyy.M
d'd 'h'h 'm'm 's's'.fff
Chinese (Simplified)
{SO)
People's Republic of China
-NNS
PRC Yuan Renminbi
hT N
hTmQ
Chinese (Simplified, PRC)
-NNS
peW[
ewz'Y
ewz'Y
lQCQ
0804:00000804;0804:{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}{F3BA9077-6C7E-11D4-97FA-0080C882687E};0804:{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}{FCA121D2-8C6D-41fb-B2DE-A2AD110D4820}
Hani;Hans;
ZHH
d/M/yyyy
Hong Kong S.A.R.
/nyr%RL
?e@S
Hong Kong Dollar
/nc^
'Chinese (Traditional, Hong Kong S.A.R.)
/nyr%RL
?e@S)
xeW[
_0c04:00000c04;0404:{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}{0B883BA0-C1C7-11D4-87F9-0080C882687E}
Singapore
Singapore Dollar
Chinese (Simplified, Singapore)
RaW)
Infinity
-Infinity
1004:00001004;0804:{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}{F3BA9077-6C7E-11D4-97FA-0080C882687E};0804:{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}{54FC610E-6ABD-4685-9DDD-A130BDF1B170};0804:{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}{733B4D81-3BC3-4132-B91A-E9CDD5E2BFC9}
dddd yyyy'
dddd yyyy MM dd
yyyy MM dd
Macao S.A.R.
yr%RL
?e@S
Macao Pataca
#Chinese (Traditional, Macao S.A.R.)
yr%RL
?e@S)
_1404:00001404;0404:{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}{0B883BA0-C1C7-11D4-87F9-0080C882687E}
CSY
dop.
odp.
h.mm.ss tt
H.mm.ss
d.M.yyyy
d-M-yy
d. MMMM yyyy
MMMM yyyy
h.mm.ss
Czech
tina
Czech Republic
republika
Czech Koruna
Koruna
pond
tvrtek
sobota
leden
ezen
duben
erven
ervenec
srpen
listopad
prosinec
ledna
nora
ezna
dubna
ervna
ervence
srpna
listopadu
prosince
gregori
kalend
Czech (Czech Republic)
tina (
republika)
Nen
+nekone
-nekone
n. l.
h.mm tt
H.mm
0405:00000405;0409:00020409
DAN
dd. MMMM yyyy
Danish
dansk
Denmark
Danmark
Danish Krone
Dansk krone
ndag
mandag
tirsdag
onsdag
torsdag
fredag
rdag
januar
februar
marts
april
juni
juli
august
september
oktober
november
december
Den gregorianske kalender
Danish (Denmark)
dansk (Danmark)
-INF
d. MMMM
0406:00000406;0409:00000409
DEU
H:mm:ss' Uhr'
HH:mm:ss' Uhr'
HHmmss
dd.MM.yyyy
dd.MMM.yyyy
d.MM.yy
d.M.yy
dddd, d. MMMM yyyy
d. MMM yyyy
H' Std. 'm' Min. 's' Sek.'
d' T 'H' Std. 'm' Min.'
H' Std. 'm' Min.'
H' h 'm' min 's' s'
H' h 'm' min 's,fff' s'
H' h 'm' min'
HH:mm:ss,fff
German
Deutsch
Germany
Deutschland
Sonntag
Montag
Dienstag
Mittwoch
Donnerstag
Freitag
Samstag
Januar
Februar
April
Juni
Juli
August
September
Oktober
November
Dezember
Gregorianischer Kalender
German (Germany)
Deutsch (Deutschland)
n. def.
+unendlich
-unendlich
n. Chr.
H.mm' Uhr'
0407:00000407;0409:00000409
HH:mm:ss' h'
H:mm:ss' h'
dd. M. yy
d. MMM yy
H' h 'm' min 's.fff' s'
HH:mm:ss.fff
Switzerland
Schweiz
Swiss Franc
Schweizer Franken
German (Switzerland)
Deutsch (Schweiz)
H.mm' h'
HH.mm' h'
HHmm
H' h'
H' Uhr'
0807:00000807;100C:0000100C
dd.M.yyyy
dddd, dd. MMMM yyyy
d.MMMM yyyy
d.MMMyyyy
d MMM yyyy
Austria
sterreich
nner
German (Austria)
Deutsch (
sterreich)
HH:mm' Uhr'
H:mm' Uhr'
0c07:00000407
Luxembourg
Luxemburg
German (Luxembourg)
Deutsch (Luxemburg)
1007:00000407
Liechtenstein
German (Liechtenstein)
Deutsch (Liechtenstein)
0807:00000807;1407:00000407
ELL
h:mm:ss tt
dd/MMM/yyyy
dddd, d MMMM yyyy
d MMMM yyyy
Greek
Greece
Greek (Greece)
h:mm tt
0409:00000409;0408:00000408
Grek;
ENG
M/d/yyyy
M/d/yy
MM/dd/yy
MM/dd/yyyy
dd-MMM-yy
dddd, MMMM dd, yyyy
MMMM dd, yyyy
English
United States
US Dollar
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
March
June
July
October
December
Gregorian Calendar
English (United States)
MMMM dd
0409:00000409
dd MMMM yyyy
United Kingdom
UK Pound Sterling
Pound Sterling
English (United Kingdom)
0809:00000809
d/MM/yyyy
dd-MMMM-yyyy
Australia
Australian Dollar
English (Australia)
0c09:00000409
yy-MM-dd
M/dd/yy
dd-MMM-yyyy
MMMM-dd-yy
MMMM d, yyyy
d-MMM-yy
Canada
Canadian Dollar
English (Canada)
)1009:00000409;1009:00011009;1009:00001009
a.m.
p.m.
New Zealand
New Zealand Dollar
English (New Zealand)
1409:00000409
Ireland
English (Ireland)
1809:00001809;0409:00000409
South Africa
South African Rand
Rand
English (South Africa)
1c09:00000409
Jamaica
Jamaican Dollar
English (Jamaica)
2009:00000409
Caribbean
English (Caribbean)
2409:00000409
dddd, dd MMMM yyyy
Belize
Belize Dollar
English (Belize)
2809:00000409
Trinidad and Tobago
Trinidad y Tobago
Trinidad Dollar
English (Trinidad and Tobago)
English (Trinidad y Tobago)
2c09:00000409
Zimbabwe
Zimbabwe Dollar
English (Zimbabwe)
3009:00000409
Republic of the Philippines
Philippines
Philippine Peso
%English (Republic of the Philippines)
English (Philippines)
3409:00000409
ESP
dddd, dd' de 'MMMM' de 'yyyy
dddd d' de 'MMMM' de 'yyyy
d' de 'MMMM' de 'yyyy
Spanish
espa
Espa
domingo
lunes
martes
rcoles
jueves
viernes
bado
enero
febrero
marzo
mayo
junio
julio
agosto
septiembre
noviembre
diciembre
calendario gregoriano
!Spanish (Spain, Traditional Sort)
,Espa
ol (Espa
a, alfabetizaci
n tradicional)
Infinito
-Infinito
040a:0000040a;0409:00000409
Espa
Mexico
xico
Mexican Peso
Peso
Spanish (Mexico)
Espa
ol (M
xico)
080a:0000080a;0409:00020409
#Spanish (Spain, International Sort)
.Espa
ol (Espa
a, alfabetizaci
n internacional)
0c0a:0000040a;0409:00000409
Guatemala
Guatemalan Quetzal
Quetzal
Spanish (Guatemala)
Espa
ol (Guatemala)
100a:0000080a;0409:00020409
Costa Rica
Costa Rican Colon
Spanish (Costa Rica)
Espa
ol (Costa Rica)
140a:0000080a;0409:00020409
Panama
Panam
Panamanian Balboa
Balboa
Spanish (Panama)
Espa
ol (Panam
180a:0000080a;0409:00020409
Dominican Republic
blica Dominicana
Dominican Peso
Spanish (Dominican Republic)
Espa
ol (Rep
blica Dominicana)
1c0a:0000080a;0409:00020409
Bs. F.
Bolivarian Republic of Venezuela
"Republica Bolivariana de Venezuela
Venezuelan Bolivar
*Spanish (Bolivarian Republic of Venezuela)
,Espa
ol (Republica Bolivariana de Venezuela)
200a:0000080a;0409:00020409
Colombia
Colombian Peso
Spanish (Colombia)
Espa
ol (Colombia)
240a:0000080a;0409:00020409
Peru
Peruvian Nuevo Sol
Nuevo Sol
Spanish (Peru)
Espa
ol (Per
280a:0000080a;0409:00020409
Argentina
Argentine Peso
Spanish (Argentina)
Espa
ol (Argentina)
2c0a:0000080a;0409:00020409
Ecuador
US Dolar
Spanish (Ecuador)
Espa
ol (Ecuador)
300a:0000080a;0409:00020409
Chile
Chilean Peso
Spanish (Chile)
Espa
ol (Chile)
340a:0000080a;0409:00020409
Uruguay
Peso Uruguayo
Spanish (Uruguay)
Espa
ol (Uruguay)
380a:0000080a;0409:00020409
Paraguay
Paraguay Guarani
Guaran
Spanish (Paraguay)
Espa
ol (Paraguay)
3c0a:0000080a;0409:00020409
Bolivia
Boliviano
Spanish (Bolivia)
Espa
ol (Bolivia)
400a:0000080a;0409:00020409
MM-dd-yyyy
El Salvador
Spanish (El Salvador)
Espa
ol (El Salvador)
440a:0000080a;0409:00020409
Honduras
Honduran Lempira
Lempira
Spanish (Honduras)
Espa
ol (Honduras)
480a:0000080a;0409:00020409
Nicaragua
Nicaraguan Cordoba Oro
rdoba
Spanish (Nicaragua)
Espa
ol (Nicaragua)
4c0a:0000080a;0409:00020409
Puerto Rico
Spanish (Puerto Rico)
Espa
ol (Puerto Rico)
)0409:00020409;500a:0000080a;0409:00000409
FIN
d. MMMM'ta 'yyyy
dd. MMMM'ta 'yyyy
Finnish
suomi
Finland
Suomi
sunnuntai
maanantai
tiistai
keskiviikko
torstai
perjantai
lauantai
tammikuu
helmikuu
maaliskuu
huhtikuu
toukokuu
hein
elokuu
syyskuu
lokakuu
marraskuu
joulukuu
tammi
helmi
maalis
huhti
touko
hein
syys
loka
marras
joulu
gregoriaaninen kalenteri
Finnish (Finland)
suomi (Suomi)
d. MMMM'ta'
)040b:0000040b;040b:0001083b;0409:00000409
FRA
dddd d MMMM yyyy
d MMM yy
HH.mm
HH' h 'mm
French
fran
France
dimanche
lundi
mardi
mercredi
jeudi
vendredi
samedi
dim.
lun.
mar.
mer.
jeu.
ven.
sam.
janvier
vrier
mars
avril
juin
juillet
septembre
octobre
cembre
janv.
avr.
juil.
sept.
oct.
nov.
calendrier gr
gorien
French (France)
fran
ais (France)
Non Num
rique
+Infini
-Infini
d MMMM
ap. J.-C.
HH'h'mm
040c:0000040c;0409:00000409
H' h 'mm
H' h 'm' min 's' s '
Belgium
Belgique
French (Belgium)
fran
ais (Belgique)
080c:0000080c;0409:00000409
yy MM dd
Dollar canadien
French (Canada)
fran
ais (Canada)
)1009:00001009;0c0c:00011009;1009:00000409
Suisse
Franc suisse
French (Switzerland)
fran
ais (Suisse)
100c:0000100c;0807:00000807
French (Luxembourg)
fran
ais (Luxembourg)
)140c:0000100C;140c:0000040c;0409:00000409
Principality of Monaco
Principaut
de Monaco
French (Monaco)
fran
ais (Principaut
de Monaco)
180c:0000040c;0409:00000409
IWR
dd/MMMM/yyyy
dd '
'MMMM yyyy
dd MMM yy
dddd dd MMMM yyyy
dddd dd '
'MMMM yyyy
ddd dd '
'MMMM yyyy
Hebrew
Israel
Israeli New Shekel
Hebrew (Israel)
0409:00000409;040d:0000040d
Hebr;
HUN
yyyy.MM.dd.
yyyy. MM. dd.
yyyy. MMMM d.
yyyy. MMMM
Hungarian
magyar
Hungary
Magyarorsz
Hungarian Forint
forint
rnap
kedd
szerda
ntek
szombat
janu
febru
rcius
prilis
nius
lius
augusztus
szeptember
jan.
febr.
aug.
szept.
okt.
dec.
Gergely-napt
Hungarian (Hungary)
magyar (Magyarorsz
nem sz
gtelen
negat
gtelen
MMMM d.
i.sz.
040e:0000040e;0409:00020409
ISL
d. M. yyyy.
d. M. ''''yy.
Icelandic
slenska
Iceland
sland
Icelandic Krona
sunnudagur
nudagur
judagur
vikudagur
fimmtudagur
studagur
laugardagur
sun.
fim.
lau.
febr
vember
desember
feb.
apr.
sep.
des.
gregor
skt t
matal
Icelandic (Iceland)
slenska (
sland)
040f:0000040f;0409:00000409
ITA
HH.mm.ss
dd.M.yy
Italian
italiano
Italy
Italia
domenica
luned
marted
mercoled
gioved
venerd
sabato
gennaio
febbraio
aprile
maggio
giugno
luglio
settembre
ottobre
dicembre
Italian (Italy)
italiano (Italia)
Non un numero reale
+Infinito
0410:00000410;0409:00000409
dd. MM. yy
Svizzera
Franco svizzero
Italian (Switzerland)
italiano (Svizzera)
)0810:0000100C;0810:00000410;0409:00000409
JAN
HSMR
yy/MM/dd' ('ddd')'
yy/M/d' ('ddd')'
yyyy/MM/dd' ('ddd')'
yyyy'
' dddd
yyyy'
'MM'
'dd'
' dddd
Japanese
Japan
Japanese Yen
Japanese (Japan)
e,g)
NaN (
pe$P)
Q0411:{03B5835F-F03C-411B-9CE2-AA23E1171E36}{A76C93D9-5523-4E90-AAFA-4DB112F9AC76}
Hani;Hira;Jpan;Kana;
KOR
yyyy'
' M'
' d'
' dddd
yyyy'
' M'
' d'
' M'
' d'
' dddd
' M'
' d'
yyyy'
' MM'
' dd'
' dddd
yyyy'
' MM'
' dd'
yyyy'
' M'
Korean
Korea
Korean Won
Korean (Korea)
' d'
Q0412:{A028AE76-01B1-46C2-99C4-ACD9858AE02F}{B5FE1F02-D5F2-4445-9C03-C568F23C99A1}
Hang;Hani;Kore;
NLD
HH.mm.ss' uur'
HH:mm:ss' uur'
d-M-yyyy
Dutch
Nederlands
Netherlands
Nederland
zondag
maandag
dinsdag
woensdag
donderdag
vrijdag
zaterdag
januari
februari
maart
augustus
Gregoriaanse kalender
Dutch (Netherlands)
Nederlands (Nederland)
HH.mm' uur'
HH:mm' uur'
0413:00020409;0413:00000413
Belgi
Dutch (Belgium)
Nederlands (Belgi
NaN (Niet-een-getal)
oneindig
-oneindig
H.mm' u.'
0813:00000813;0409:00000409
NOR
'kl 'HH.mm.ss
Norwegian (Bokm
norsk (bokm
Norway
Norge
Norwegian Krone
Norsk krone
gregoriansk kalender
Norwegian, Bokm
l (Norway)
norsk, bokm
l (Norge)
'kl 'HH.mm
0414:00000414;0409:00000409
NYN
Norwegian (Nynorsk)
norsk (nynorsk)
Noreg
ndag
tysdag
laurdag
Norwegian, Nynorsk (Norway)
norsk, nynorsk (Noreg)
0814:00000414;0409:00000409
PLK
Polish
polski
Poland
Polska
Polish Zloty
niedziela
poniedzia
wtorek
roda
czwartek
stycze
luty
marzec
kwiecie
czerwiec
lipiec
sierpie
wrzesie
dziernik
grudzie
stycznia
lutego
marca
kwietnia
maja
czerwca
lipca
sierpnia
wrze
dziernika
listopada
grudnia
Kalendarz gregoria
Polish (Poland)
polski (Polska)
nie jest liczb
+niesko
czono
-niesko
czono
)0415:00000415;0415:00010415;0409:00020409
PTG
dddd, d' de 'MMMM' de 'yyyy
Portuguese
Portugu
Brazil
Brasil
Real
segunda-feira
a-feira
quarta-feira
quinta-feira
sexta-feira
janeiro
fevereiro
maio
junho
julho
setembro
outubro
novembro
dezembro
Calend
rio gregoriano
Portuguese (Brazil)
Portugu
s (Brasil)
NaN (N
um n
mero)
dd' de 'MMMM
)0416:00000416;0409:00020409;0409:00000409
yy.MM.dd
d/MMM/yy
d.MMM.yy
HH'H'mm'm'
portugu
Portugal
Janeiro
Fevereiro
Abril
Maio
Junho
Julho
Agosto
Setembro
Outubro
Novembro
Dezembro
Portuguese (Portugal)
portugu
s (Portugal)
0816:00000816;0409:00000409
ROM
Romanian
Romania
Romanian Leu
duminic
luni
miercuri
vineri
ianuarie
februarie
martie
aprilie
iunie
iulie
septembrie
octombrie
noiembrie
decembrie
ian.
mai.
iun.
iul.
calendarul gregorian
Romanian (Romania)
(Rom
nia)
70418:00010418;0418:00020418;0418:00000418;0409:00020409
RUS
Russian
Russia
Russian Ruble
Russian (Russia)
0419:00000419;0409:00000409
HRV
d.M.yyyy.
d.M.yy.
dd.MM.yyyy.
d. M. yy.
dd.MM.yy.
dd. MM. yy.
d. MMMM yyyy.
dd. MMMM yyyy.
dddd, d. MMMM yyyy.
Croatian
hrvatski
Croatia
Hrvatska
Croatian Kuna
hrvatska kuna
nedjelja
ponedjeljak
utorak
srijeda
etvrtak
petak
subota
sije
velja
ujak
travanj
svibanj
lipanj
srpanj
kolovoz
rujan
studeni
prosinac
sije
velja
ujka
travnja
svibnja
lipnja
srpnja
kolovoza
rujna
studenog
prosinca
gregorijanski kalendar
Croatian (Croatia)
hrvatski (Hrvatska)
041a:0000041a;0409:00020409
SRB
Din.
d. M. yyyy
d. M. yy
Serbian (Latin)
srpski
Serbia and Montenegro (Former)
Srbija i Crna Gora (Prethodno)
Serbian Dinar
dinar
nedelja
ponedeljak
sreda
mart
avgust
septembar
oktobar
novembar
decembar
/Serbian (Latin, Serbia and Montenegro (Former))
'srpski (Srbija i Crna Gora (Prethodno))
+beskona
nost
-beskona
nost
n.e.
081a:0000081a;0409:00000409
Serbian (Cyrillic)
2Serbian (Cyrillic, Serbia and Montenegro (Former))
0c1a:00000c1a;0409:00000409
Serbia
Srbija
Serbian (Latin, Serbia)
srpski (Srbija)
241a:0000081a;0409:00020409
Serbian (Cyrillic, Serbia)
281a:00000c1a;0409:00020409
Montenegro
Crna Gora
Serbian (Latin, Montenegro)
srpski (Crna Gora)
2c1a:0000081a;0409:00020409
Serbian (Cyrillic, Montenegro)
301a:00000c1a;0409:00020409
Croatian (Latin)
Bosnia and Herzegovina
Bosna i Hercegovina
Convertible Marks
konvertibilna marka
(Croatian (Latin, Bosnia and Herzegovina)
hrvatski (Bosna i Hercegovina)
101a:0000041a;0409:00000409
BOS
Bosnian (Latin)
bosanski
'Bosnian (Latin, Bosnia and Herzegovina)
bosanski (Bosna i Hercegovina)
141a:0000041a;0409:00000409
'Serbian (Latin, Bosnia and Herzegovina)
srpski (Bosna i Hercegovina)
181a:0000081a;0409:00000409
*Serbian (Cyrillic, Bosnia and Herzegovina)
1c1a:00000c1a;0409:00000409
SKY
Slovak
sloven
Slovakia
Slovensk
republika
nede
pondelok
utorok
streda
tvrtok
piatok
marec
janu
febru
augusta
septembra
novembra
decembra
gregori
nsky kalend
Slovak (Slovakia)
sloven
ina (Slovensk
republika)
Nie je
041b:0000041b;0409:00020409
SQI
h:mm:ss.tt
yyyy-MM
h:mm:ss.
Albanian
shqipe
Albania
Shqip
Albanian Lek
e diel
e mart
e m
rkur
e enjte
e premte
e shtun
janar
shkurt
prill
qershor
korrik
gusht
shtator
tetor
ntor
dhjetor
kalendari gregorian
Albanian (Albania)
shqipe (Shqip
ria)
infinit
-infinit
h:mm.tt
041c:0000041c;0409:00000409
SVE
'kl 'H:mm:ss
'den 'd MMMM yyyy
dddd' den 'd MMMM yyyy
Swedish
svenska
Sweden
Sverige
Swedish Krona
Svensk krona
ndag
tisdag
rdag
augusti
Swedish (Sweden)
svenska (Sverige)
'den 'd MMMM
'kl 'H:mm
041d:0000041d;0409:00000409
Swedish (Finland)
svenska (Finland)
)081d:0000041d;081d:0000083b;0409:00000409
THA
dd MMM yyyy
'dddd'
' d MMMM yyyy
ddd d MMMM yyyy
Thai
Thailand
Thai Baht
Thai (Thailand)
0409:00000409;041e:0000041e
Thai;
TRK
dd MMMM yyyy dddd
Turkish
Turkey
rkiye
Turkish Lira
rk Liras
Pazar
Pazartesi
amba
embe
Cuma
Cumartesi
Ocak
ubat
Mart
Nisan
Haziran
Temmuz
ustos
Ekim
Aral
Gregoryen Takvimi
Turkish (Turkey)
e (T
rkiye)
041f:0000041f;0409:00000409
URD
Urdu
Islamic Republic of Pakistan
Pakistan Rupee
Christian Calendar
#Urdu (Islamic Republic of Pakistan)
0420:00000420;0409:00000409
IND
Indonesian
Bahasa Indonesia
Indonesia
Indonesian Rupiah
Rupiah
Minggu
Senin
Selasa
Rabu
Kamis
Jumat
Sabtu
Januari
Februari
Maret
Agustus
Nopember
Desember
Agust
kalendar Masehi
Indonesian (Indonesia)
Bahasa Indonesia (Indonesia)
0421:00000409;0409:00000409
UKR
d MMMM yyyy'
MMMM yyyy'
Ukrainian
Ukraine
Ukrainian Grivna
Ukrainian (Ukraine)
)0422:00020422;0422:00000422;0409:00000409
BEL
Belarusian
Belarus
Belarusian Ruble
Belarusian (Belarus)
)0423:00000423;0409:00000409;0419:00000419
SLV
Slovenian
slovenski
Slovenia
Slovenija
ponedeljek
torek
etrtek
petek
junij
julij
gregorijanski koledar
Slovenian (Slovenia)
slovenski (Slovenija)
neskon
nost
-neskon
nost
0424:00000424;0409:00020409
ETI
d.MM.yyyy
d. MMMM yyyy'. a.'
dd. MMMM yyyy'. a.'
MMMM yyyy'. a.'
Estonian
eesti
Estonia
Eesti
Estonian Kroon
Kroon
esmasp
teisip
kolmap
neljap
reede
laup
jaanuar
veebruar
aprill
juuni
juuli
oktoober
detsember
jaan
veebr
sept
dets
Gregoriuse kalender
Estonian (Estonia)
eesti (Eesti)
avaldamatu
plussl
pmatus
miinusl
pmatus
0425:00000425
LVI
yy.MM.dd.
dddd, yyyy'. gada 'd. MMMM
Latvian
latvie
Latvia
Latvija
Latvian Lats
Lats
tdiena
pirmdiena
otrdiena
tre
diena
ceturtdiena
piektdiena
sestdiena
janv
febru
maijs
nijs
lijs
augusts
septembris
oktobris
novembris
decembris
janv
febru
mart
maij
august
septembr
oktobr
novembr
decembr
Gregora kalend
Latvian (Latvia)
latvie
u (Latvija)
bezgal
-bezgal
gada
0426:00010426;0426:00000426
LTH
yyyy 'm.' MMMM d 'd.'
yyyy 'm.' MMMM
Lithuanian
lietuvi
Lithuania
Lietuva
Lithuanian Litas
Litas
sekmadienis
pirmadienis
antradienis
iadienis
ketvirtadienis
penktadienis
tadienis
sausis
vasaris
kovas
balandis
gegu
elis
liepa
rugpj
rugs
spalis
lapkritis
gruodis
sausio
vasario
kovo
baland
gegu
elio
liepos
rugpj
rugs
spalio
lapkri
gruod
Grigaliaus kalendorius
Lithuanian (Lithuania)
lietuvi
(Lietuva)
begalyb
-begalyb
MMMM d 'd.'
0427:00010427
FAR
Persian
Iran
Iranian Rial
VIT
Vietnamese
ng Vi
Vietnam
t Nam
Vietnamese Dong
Chu
Hai
ng Gi
Tha
ng Hai
Tha
ng Ba
Tha
ng T
Tha
ng N
ng Sa
ng Ba
ng Ta
ng Chi
ng M
ng M
ng M
i Hai
Thg1
Thg2
Thg3
Thg4
Thg5
Thg6
Thg7
Thg8
Thg9
Thg10
Thg11
Thg12
Vietnamese (Vietnam)
ng Vi
t (Vi
t Nam)
0409:00000409;042a:0000042a
HYE
d/MMM/yyyy
d MMMM, yyyy
d-MMM-yyyy
ddd, d-MMMM-yyyy
ddd, dd-MMMM-yyyy
Armenian
Armenia
Armenian Dram
Armenian (Armenia)
)042b:0000042b;0409:00000409;0419:00000419
Armn;
AZE
man.
Azeri (Latin)
rbaycan
Azerbaijan
rbaycan
Azerbaijanian Manat
manat
Bazar
Bazar
Yanvar
Fevral
Aprel
Avgust
Sentyabr
Oktyabr
Noyabr
Dekabr
yanvar
fevral
aprel
iyun
iyul
sentyabr
oktyabr
noyabr
dekabr
Qriqorian
Azeri (Latin, Azerbaijan)
rbaycan
(Az
rbaycan)
)042c:0000042c;082c:0000082c;0419:00000419
Azeri (Cyrillic)
Azeri (Cyrillic, Azerbaijan)
)082c:0000082c;042c:0000042c;0419:00000419
EUQ
dddd, yyyy.'eko' MMMM'k 'd
yyyy.'eko' MMMM
Basque
euskara
Espainia
igandea
astelehena
asteartea
asteazkena
osteguna
ostirala
larunbata
urtarrila
otsaila
martxoa
apirila
maiatza
ekaina
uztaila
abuztua
iraila
urria
azaroa
abendua
urt.
ots.
api.
eka.
uzt.
abu.
ira.
urr.
aza.
abe.
egutegi gregoriotarra
Basque (Basque)
euskara (euskara)
Infinitu
-Infinitu
042d:0000040a
MKD
Macedonian (FYROM)
Macedonia (FYROM)
Macedonian Denar
2Macedonian (Former Yugoslav Republic of Macedonia)
042f:0000042f;0409:00000409
TNA
Setswana
Aforika Borwa
Latshipi
Mosupologo
Labobedi
Laboraro
Labone
Labotlhano
Lamatlhatso
Ltp.
Mos.
Lbd.
Lbr.
Lbn.
Lbt.
Lmt.
Ferikgong
Tlhakole
Mopitloe
Moranang
Motsheganong
Seetebosigo
Phukwi
Phatwe
Lwetse
Diphalane
Ngwanatsele
Sedimothole
Fer.
Tlhak.
Mop.
Mor.
Motsh.
Seet.
Phukw.
Phatw.
Lwets.
Diph.
Ngwan.
Sed.
Setswana (South Africa)
Setswana (Aforika Borwa)
0432:00000432;0432:00000409
XHS
isiXhosa
uMzantsi Afrika
iCawa
uMvulo
uLwesibini
uLwesithathu
uLwesine
uLwesihlanu
uMgqibelo
Mqungu
Mdumba
Kwindla
Tshazimpuzi
Canzibe
Silimela
Khala
Thupha
Msintsi
Dwarha
Nkanga
Mnga
isiXhosa (South Africa)
isiXhosa (uMzantsi Afrika)
0434:00000409;0409:00000409
ZUL
isiZulu
iNingizimu Afrika
iSonto
uMsombuluko
uLwesibili
Son.
Mso.
Tha.
Hla.
Mgq.
uMasingana
uNhlolanja
uNdasa
uMbaso
uNhlaba
uNhlangulana
uNtulikazi
uNcwaba
uMandulo
uMfumfu
uLwezi
uZibandlela
Mas.
Nhlo.
Nda.
Mba.
Nhla.
Nhlang.
Ntu.
Ncwa.
Man.
Mfu.
Lwe.
Zib.
isiZulu (South Africa)
isiZulu (iNingizimu Afrika)
0435:00000409;0409:00000409
AFK
yyyy/MMM/dd
Afrikaans
Suid Afrika
Sondag
Maandag
Dinsdag
Woensdag
Donderdag
Vrydag
Saterdag
Maan
Dins
Woen
Dond
Januarie
Februarie
Maart
Junie
Julie
Augustus
Afrikaans (South Africa)
Afrikaans (Suid Afrika)
0436:00000409;0409:00000409
KAT
Lari
yyyy '
' dd MM, dddd
Georgian
Georgia
Georgian (Georgia)
dd MM
E0437:00010437;0437:00020437;0437:00000437;0409:00000409;0419:00000419
Geor;
FOS
Faroese
royskt
Faroe Islands
royar
nadagur
sdagur
mikudagur
sdagur
ggjadagur
leygardagur
leyg
Gregorianski
lmanakkin
Faroese (Faroe Islands)
royskt (F
royar)
0438:00000406;0409:00000409
HIN
0 A
* B 0 M 5 > 9 M (
* 0 > 9 M (
Hindi
9 ?
& @
India
- > 0 $
Indian Rupee
0 A * / >
0 5 ? 5 > 0
8 K . 5 > 0
2 5 > 0
, A ' 5 > 0
A 0 A 5 > 0
6 A
M 0 5 > 0
6 ( ? 5 > 0
0 5 ? .
8 K . .
2 .
, A ' .
A 0 A .
6 A
M 0 .
6 ( ? .
( 5 0 @
+ 0 5 0 @
. > 0 M
* M 0 H 2
B (
A 2 >
8 M $
8 ? $ . M , 0
M $ B , 0
( 5 . M , 0
& ? 8 . M , 0
M 0 G
< @
H 2 G ( M ! 0
Hindi (India)
9 ?
& @
- > 0 $ )
)0409:00000409;0439:00010439;0439:00000439
Deva;
MTS
ddMMyyyy
dddd, d' ta'' 'MMMM yyyy
d' ta'' 'MMMM yyyy
Maltese
Malti
Malta
It-Tnejn
It-Tlieta
L-Erbg
amis
Il-
Is-Sibt
Jannar
Frar
Marzu
Mejju
unju
Lulju
Awissu
Settembru
Ottubru
Novembru
embru
Kalendarju
Maltese (Malta)
Malti (Malta)
d' ta'' 'MMMM
)0409:00000409;043a:0000043a;043a:0001043a
NSM
MMMM d'. b. 'yyyy
Sami (Northern)
davvis
megiella
Norga
kruvdno
sotnabeaivi
vuoss
gaskavahkku
duorastat
bearjadat
vvardat
sotn
vuos
gask
duor
bear
ajagem
guovvam
njuk
cuo
miessem
geassem
suoidnem
borgem
golggotm
bmam
juovlam
guov
njuk
mies
geas
suoi
borg
golg
juov
ajagim
guovvam
njuk
cuo
miessem
geassem
suoidnem
borgem
golggotm
bmam
juovlam
Sami, Northern (Norway)
davvis
megiella (Norga)
MMMM d'. b. '
043b:0000043b;0409:00000409
nnodat
disdat
Sami, Northern (Sweden)
davvis
megiella (Ruo
083b:0000083b;0409:00000409
Suopma
Sami, Northern (Finland)
davvis
megiella (Suopma)
)0c3b:0001083b;0c3b:0002083b;0409:00000409
LSM
Sami (Lule)
julevus
megiella
Vuodna
biejvve
nnodahka
dijstahka
gasskavahkko
duorastahka
bierjjedahka
vvodahka
bier
jakm
guovvam
sjnjuktjam
vuoratjism
moarmesm
biehtsem
sjnjilltjam
rggem
rag
dism
dism
javllam
snju
vuor
moar
bieh
snji
javl
jakm
guovvam
sjnjuktjam
vuoratjism
moarmesm
biehtsem
sjnjilltjam
rggem
rag
dism
dism
javllam
Sami, Lule (Norway)
julevus
megiella (Vuodna)
103b:0000043b;0409:00000409
Svierik
jllek
Sami, Lule (Sweden)
julevus
megiella (Svierik)
143b:0000083b;0409:00000409
SSM
Sami (Southern)
arjelsaemiengiele
vnoe
aejlege
anta
jsta
gaskev
hkoe
duarsta
bearjadahke
laavvardahke
duar
bearj
laav
engele
goevte
njoktje
voerhtje
suehpede
ruffie
snjaltje
etske
erede
golke
rahka
goeve
goevt
njok
voer
sueh
ruff
snja
golk
rahk
goev
engelen
goevten
njoktjen
voerhtjen
suehpeden
ruffien
snjaltjen
etsken
ereden
golken
rahkan
goeven
Sami, Southern (Norway)
arjelsaemiengiele (N
rje)
183b:0000043b;0409:00000409
Sveerje
Sami, Southern (Sweden)
arjelsaemiengiele (Sveerje)
1c3b:0000083b;0409:00000409
SKS
MMMM d'. p. 'yyyy
Sami (Skolt)
nnam
sspei
ssargg
ibargg
nelljdpei
lvvm
ttamm
njuh
vue
suei
lggm
skamm
rosttovm
njuh
suei
rost
jjmannu
lvvmannu
ttammannu
njuh
mannu
ssmannu
ssmannu
suei
nnmannu
mannu
mannu
lggmannu
skamm
mannu
rosttovmannu
Sami, Skolt (Finland)
ll (L
nnam)
MMMM d'. p. '
)203b:0001083b;203b:0002083b;0409:00000409
ISM
Sami (Inari)
mikiel
Suom
evro
pasepeivi
vuossarg
majebarg
koskokko
tuor
stuppeivi
ivem
kuov
njuh
vyesim
kesim
syeinim
porgem
roovv
skamm
juovl
kuov
vyes
kesi
syei
porg
roov
Sami, Inari (Finland)
mikiel
(Suom
)243b:0001083b;243b:0002083b;0409:00000409
MLY
Malay
Bahasa Melayu
Malaysia
Malaysian Ringgit
Ringgit Malaysia
Ahad
Isnin
Khamis
Jumaat
Julai
Ogos
Disember
Sept
Malay (Malaysia)
Bahasa Melayu (Malaysia)
Brunei Darussalam
Brunei Dollar
Ringgit
Malay (Brunei Darussalam)
!Bahasa Melayu (Brunei Darussalam)
KAZ
d MMMM yyyy '
dd MMMM yyyy '
Kazakh
Kazakhstan
Tenge
Kazakh (Kazakhstan)
)043f:0000043f;0409:00000409;0419:00000419
KIR
d'-'MMMM yyyy'-
MMMM yyyy'-
Kyrgyz
Kyrgyzstan
Kyrgyz (Kyrgyzstan)
0440:00000440;0409:00000409
SWK
Kiswahili
Kenya
Kenyan Shilling
Shilingi
Jumapili
Jumatatu
Jumanne
Jumatano
Alhamisi
Ijumaa
Jumamosi
Jumap.
Jumat.
Juman.
Alh.
Iju.
Jumam.
Machi
Aprili
Agosti
Septemba
Oktoba
Novemba
Decemba
Kalenda ya Gregori
Kiswahili (Kenya)
UZB
so'm
dd/MM yyyy
yyyy 'yil' d-MMMM
Uzbek (Latin)
U'zbek
Uzbekistan
U'zbekiston Respublikasi
Uzbekistan Som
yakshanba
dushanba
seshanba
chorshanba
payshanba
juma
shanba
yak.
dsh.
sesh.
chr.
psh.
Grigorianski
Uzbek (Latin, Uzbekistan)
!U'zbek (U'zbekiston Respublikasi)
d-MMMM
)0443:00000409;0843:00000843;0419:00000419
yyyy '
' d-MMMM
Uzbek (Cyrillic)
Uzbek (Cyrillic, Uzbekistan)
)0843:00000843;0443:00000409;0419:00000419
TAT
Tatar
Tatar (Russia)
)0444:00000444;0409:00000409;0419:00000419
BEN
tt hh.mm.ss
tt h.mm.ss
hh.mm.ss
Bengali
Bengali (India)
tt hh.mm
tt h.mm
70445:00020445;0445:00000445;0445:00010445;0409:00000409
Beng;
PAN
0
A
8
5
G
0
6
>
.
Punjabi
*
p
>
,
@
-
>
0
$
0
A
*
?
$
5
>
0
8
K
.
5
>
0
.
p
2
5
>
0
,
A
q
'
5
>
0
5
@
0
5
>
0
6
A
q
0
5
>
0
6
(
?
q
0
5
>
0
$
.
8
K
.
.
.
p
2
.
,
A
q
'
.
5
@
0
.
6
A
0
.
6
(
?
q
0
.
(
5
0
@
^
0
5
0
@
.
>
0
*
M
0
H
2
B
(
A
2
>
8
$
8
$
p
,
0
$
B
,
0
(
5
p
,
0
&
8
p
,
0
M
0
G
[
@
2
p
!
0
Punjabi (India)
*
p
>
,
@
-
>
0
$
)
)0409:00000409;0446:00000446;0439:00010439
Guru;
GUJ
Gujarati
Gujarati (India)
)0409:00000409;0447:00000447;0439:00010439
Gujr;
TAM
Tamil
Tamil (India)
0409:00000409;0449:00000449
Taml;
TEL
Telugu
Telugu (India)
)0409:00000409;044a:0000044a;0439:00010439
Telu;
KAN
Kannada
Kannada (India)
)0409:00000409;044b:0000044b;0439:00010439
Knda;
MLR
Malayalam
.
2
/
>
3
-
>
0
$
0
B
*
>
/
1
>
4
M
$
?
3
>
4
M
J
5
M
5
>
4
M
,
A
'
(
>
4
M
5
M
/
>
4
>
4
M
5
F
3
M
3
?
/
>
4
M
6
(
?
/
>
4
M
>
/
|
.
$
?
~
.
J
5
M
5
.
,
A
'
{
.
5
M
/
>
4
5
F
3
M
3
?
.
6
(
?
.
(
A
5
0
?
+
F
,
M
1
A
5
0
?
.
>
1
M
*
M
1
?
2
M
.
F
/
M
B
#
M
B
2
H
8
M
1
1
M
8
F
*
M
1
1
,
1
M
K
,
1
M
(
5
,
1
M
!
?
8
,
1
M
M
3
@
7
M
2
#
M
1
M
Malayalam (India)
.
2
/
>
3
-
>
0
$
5
F
044c:0000044c;0409:00000409
Mlym;
MAR
* B .
Marathi
. 0 > @
3 5 > 0
3 .
> ( G 5 > 0 @
+ G , M 0 A 5 > 0 @
* M 0 ? 2
. G
A 2 H
8 M
8 * M
, 0
K , 0
( K 5 M 9 G
, 0
! ? 8 G
, 0
> ( G .
+ G , M 0 A .
8 * M
K .
( K 5 M 9 G
! ? 8 G
M 0
E 2 G ( M ! 0
Marathi (India)
. 0 > @
- > 0 $ )
)0409:00000409;044e:0000044e;044e:00000439
SAN
Sanskrit
8 M
C $
- > 0 $ . M
0 A M /
. M
0 5 ? 5 > 8 0
8 K . 5 > 8 0
2 5 > 8 0
, A ' 5 > 8 0
A 0 A 5 > 8 0
6 A
M 0 5 > 8 0
6 ( ? 5 > 8 0
M 0 ? 8 M $ > , M &
Sanskrit (India)
8 M
C $
- > 0 $ . M )
0409:00000409;044f:00000439
MNG
yyyy '
' MMMM d
yyyy '
' MMMM
Mongolian (Cyrillic)
Mongolia
Tugrik
VIII
Mongolian (Cyrillic, Mongolia)
0450:00000450;0409:00000409
WEL
Welsh
Cymraeg
y Deyrnas Unedig
Dydd Sul
Dydd Llun
Dydd Mawrth
Dydd Mercher
Dydd Iau
Dydd Gwener
Dydd Sadwrn
Llun
Ionawr
Chwefror
Mawrth
Ebrill
Mehefin
Gorffennaf
Awst
Medi
Hydref
Tachwedd
Rhagfyr
Chwe
Tach
Rhag
calendr Gregori
Welsh (United Kingdom)
Cymraeg (y Deyrnas Unedig)
0452:00000452;0809:00000809
GAL
Galician
galego
Espa
luns
rcores
xoves
venres
bado
xaneiro
febreiro
xullo
decembro
xull
Calendario Gregoriano
Galician (Galician)
galego (galego)
0456:0000040a
KOK
Konkani
# @
0 A * /
/ $ > 0
8 K . > 0
3 > 0
, ? 0 G 8 M $ > 0
8 A
M 0 > 0
6 G ( 5 > 0
/ .
, ? 0 G .
8 A
M 0 .
6 G ( .
( K 5 G . M , 0
Konkani (India)
# @
- > 0 $ )
0409:00000409;0457:00000439
SYR
Syriac
Syriac (Syria)
0409:00000409;045a:0000045a
Syrc;
DIV
ddd, yyyy MMMM dd
yyyy, MMMM
hh:mm
Divehi
Maldives
Rufiyaa
Divehi (Maldives)
0409:00000409;0465:00000465
Thaa;
QUZ
Quechua
runasimi
Bolivia Suyu
intichaw
killachaw
atipachaw
quyllurchaw
Ch' askachaw
Illapachaw
k'uychichaw
Qulla puquy
Hatun puquy
Pauqar waray
ayriwa
Aymuray
Inti raymi
Anta Sitwa
Qhapaq Sitwa
Uma raymi
Kantaray
Ayamarq'a
Kapaq Raymi
Quechua (Bolivia)
runasimi (Qullasuyu)
)400a:0000080a;046b:0000080a;0409:00000409
Ecuador Suyu
Quechua (Ecuador)
runasimi (Ecuador)
)300a:0000080a;086b:0000080a;0409:00000409
Peru Suyu
Quechua (Peru)
runasimi (Piruw)
)280a:0000080a;0c6b:0000080a;0409:00000409
SOT
Sesotho sa Leboa
Afrika Borwa
Lamorena
upologo
Labohlano
Mokibelo
Pherekgong
Hlakola
Mopitlo
Mosegamanye
Ngoatobo
Phuphu
Phato
Lewedi
Diphalana
Dibatsela
Manthole
Pher
Hlak
Ngwat
Phup
Phat
Sesotho sa Leboa (South Africa)
Sesotho sa Leboa (Afrika Borwa)
046c:0000046c;0409:00000409
dflt
yyyy MMMM
Invariant Language
Invariant Country
International Monetary Fund
&Invariant Language (Invariant Country)
%Invariant Language (Invariant Region)
MRI
MMMM, yy
Maori
Reo M
Aotearoa
tapu
hina
pare
mere
horoi
Kohi-t
Hui-tanguru
Pout
-te-rangi
Paenga-wh
Haratua
Pipiri
ngongoi
Here-turi-k
Mahuru
Whiringa-
-nuku
Whiringa-
-rangi
Hakihea
Kohi
Hara
Pipi
Here
Mahu
Nuku
Rangi
Haki
Maori (New Zealand)
Reo M
ori (Aotearoa)
0481:00000481;1409:00000409
BSH
d MMMM yyyy '
Bashkir
Bashkir (Russia)
046d:0000046d
Indian Rupee;
Rupee;
English (India)
dd MMMM;
ORI
Oriya
Oriya (India)
0448:00000448
Orya;
TKM
yyyy '
.' MMMM d
yyyy '
.' MMMM dd
yyyy '
.' MMMM
Turkmen
rkmen
Turkmenistan
rkmenistan
Turkmen manat
enbe
enbe
enbe
enbe
Anna
enbe
enbe
anwar
Fewral
Awgust
Sent
grigorian
ylhasaby
Turkmen (Turkmenistan)
rkmen
e (T
rkmenistan)
ksizlik
ksizlik
0442:00000442;0409:00000409
TAJ
HH:mm:ss
Tajik (Cyrillic)
Tajikistan
Ruble
Tajik (Cyrillic, Tajikistan)
0428:00000428
FRI
Frisian
Frysk
Nederl
Snein
Moandei
Tiisdei
Woansdei
Tongersdei
Freed
Sneon
jannewaris
febrewaris
maaie
july
septimber
novimber
desimber
jann
febr
Frisian (Netherlands)
Frysk (Nederl
0462:00020409
TIB
yyyy'
' M'
yyyy'
' M'
' d dddd
yyyy'
d'H'mm'ss'.fff
Tibetan
PRC Renminbi
Tibetan (PRC)
' M'
'd;MM/dd;
0451:00000451
Tibt;
IRI
r.n.
i.n.
Irish
Gaeilge
Domhnaigh
Luain
adaoin
ardaoin
hAoine
Sathairn
Domh
Luan
Sath
Feabhra
Aibre
Bealtaine
Meitheamh
nasa
mhair
Deireadh F
mhair
Samhain
Nollaig
Feabh
Bealt
Meith
Samh
Noll
ilire Greag
rach
Irish (Ireland)
Gaeilge (
ire)
083c:00001809
NEP
5 ? 9 > ( @
, G 2 A
MMMM,yyyy
Nepali
( G * > 2 @
Nepal
( G * > 2
Nepalese Rupees
0 A * H / >
$ 5 > 0
2 5 > 0
, ? 9 @ 5 > 0
8 K .
, A '
, ? 9 @
6 A
M 0
6 ( ?
+ G , M 0 A
0 @
* M 0 ? 2
8 G * M
G . M , 0
K , 0
( K - G . M , 0
! ? 8 G . M , 0
+ G ,
8 G * M
( K -
! ? 8
M 0 G
@
M / > 2 G # M ! G 0
Nepali (Nepal)
( G * > 2 @
( G * > 2 )
infinity
-infinity
a.d.
8 K
, A
, ?
6 A
0461:00000461
dddd, d MMMM, yyyy
English (Malaysia)
English (Singapore)
Bosnian (Cyrillic)
*Bosnian (Cyrillic, Bosnia and Herzegovina)
201a:0000201a
%yyyy'
' M'
'd'
+yyyy'
' M'
'd'
' dddd
yyyy'
' M'
!Mongolian (Traditional Mongolian)
&Mongolian (Traditional Mongolian, PRC)
' d'
';MM/dd;
0850:00000850
Mong;
PIL
Filipino
Pilipinas
Linggo
Lunes
Martes
Mierkoles
Huebes
Biernes
Sabado
Mier
Hueb
Bier
Saba
Enero
Pebrero
Marso
Mayo
Hunyo
Hulyo
Septyembre
Oktubre
Nobyembre
Disyembre
Agos
kaledaryong Gregoryano
Filipino (Philippines)
Filipino (Pilipinas)
Anno Domini
0464:00000409
RMS
HH:mm:ss' Ura'
H:mm:ss' Ura'
dd/M/yy
Romansh
Rumantsch
Svizra
Franc svizzer
dumengia
glindesdi
mesemna
gievgia
venderdi
sonda
schaner
favrer
avrigl
matg
zercladur
fanadur
avust
settember
october
schan
favr
zercl
sett
chalender gregorian
Romansh (Switzerland)
Rumantsch (Svizra)
betg def.
+infinit
s. Cr.
HH:mm' Ura'
H:mm' Ura'
H' Ura'
0417:00000807
LTZ
H:mm:ss' Auer'
HH:mm:ss' Auer'
dd/MM/yy
Luxembourgish
tzebuergesch
Sonndeg
indeg
nschdeg
ttwoch
Donneschdeg
Freideg
Samschdeg
Gregorianesche Kalenner
Luxembourgish (Luxembourg)
tzebuergesch (Luxembourg)
n. num.
+onendlech
-onendlech
n. Chr
H.mm' Auer'
046e:0000046e
MOH
Mohawk
Kanien'k
Awentatokent
Awentata
n'ke
Ratironhia'kehron
n:ke
Okaristii
Ronwaia'tanentaktonhne
Tsothohrk
Enniska
Ennisk
Oneraht
Onerahtohk
Ohiari:Ha
Ohiarihk
Sesk
Seskehk
Kent
Kentenhk
Tsoth
hrha
Mohawk (Mohawk)
047c:00000409
INU
ddd, MMMM dd,yyyy
MMMM dd,yyyy
Inuktitut (Latin)
Inuktitut
kanata
Kanataup Kiinaujanga;
Naattiinguja
Naggajjau
Aippiq
Pingatsiq
Sitammiq
Tallirmiq
Sivataarvik
Jaannuari
Viivvuari
Maatsi
Iipuri
Juuni
Aaggiisi
Sitipiri
Utupiri
Nuvipiri
Tisipiri
Ulluqsiutit
Inuktitut (Latin, Canada)
Inuktitut (Kanatami)
085d:0000085d;1009:00000409
PAS
yyyy, dd, MMMM, dddd
yyyy, dd, MMMM
Pashto
Afghanistan
Afghani
Pashto (Afghanistan)
d MMMM;
0463:00000463
MAP
Mapudungun
Mapudungun (Chile)
047a:0000080a
SNH
yyyy MMMM'
'dd'
'dddd
Sinhala
Sri Lanka
Sri Lanka Rupee
Sinhala (Sri Lanka)
)045b:0000045b;045b:0001045b;0409:00000409
Sinh;
GRN
HH:mm:ss:fff
H:mm:ss:fff
Greenlandic
kalaallisut
Greenland
Kalaallit Nunaat
korunni
sapaat
ataasinngorneq
marlunngorneq
pingasunngorneq
sisamanngorneq
tallimanngorneq
arfininngorneq
ping
martsi
apriili
maaji
aggusti
septembari
oktobari
novembari
decembari
qaamatisiutit gregorianerisooq
Greenlandic (Greenland)
kalaallisut (Kalaallit Nunaat)
046f:00000406;0406:00000406
YAK
MM.dd.yyyy
MM.dd.yy
MMMM d yyyy '
MMMM dd yyyy '
MMMM yyyy '
Yakut
Yakut (Russia)
A.D.
)0485:00000485;0419:00000419;0409:00000409
ASM
yyyy,MMMM dd, dddd
MMMM,yy
h tt m tt s tt
hh tt mm tt ss tt
H tt m tt S tt
HH tt mm tt SS tt
Assamese
Assamese (India)
044d:0000044d;0409:00000409
LAO
Lao P.D.R.
Lao (Lao P.D.R.)
H:mm tt
0454:00000454;0409:00000409
Laoo;
dddd,MMMM dd,yyyy
h:mm:ss:ff
Inuktitut (Syllabics)
Inuktitut (Syllabics, Canada)
)045d:0001045d;085d:0000085d;1009:00000409
Cans;
UYG
yyyy-'
' MMMM d-'
yyyy-'
' MMMM d-'
' dddd
yyyy-'
' MMMM
Uyghur
Uyghur (PRC)
MMMM d'-
0480:00010480;0409:00000409
Estados Unidos
lar de EE.UU.
calendario gregoriano en ingl
Spanish (United States)
Espa
ol (Estados Unidos)
dd' de 'MMMM;
540a:0000080a;0409:00000409
USB
dddd, 'dnja' d. MMMM yyyy
Upper Sorbian
hornjoserb
mska
njed
wutora
srjeda
pjatk
apryl
meja
awgust
nowember
januara
februara
apryla
meje
junija
julija
awgusta
oktobra
nowembra
gregorianska protyka
Upper Sorbian (Germany)
hornjoserb
ina (N
mska)
njedefinowane
+njek
-njek
po Chr.
H.mm 'hod
dnja
7042e:0002042e;042e:0001042e;0407:00000407;0409:00000409
LSB
Lower Sorbian
dolnoserb
Nimska
ponje
tora
srjoda
stwortk
gregorianska pratyja
Lower Sorbian (Germany)
dolnoserb
ina (Nimska)
+njeko
-njeko
H.mm 'go
KHM
' MM '
' yyyy
. mm
. ss
Khmer
Cambodia
Riel
x179A
Soriyeakitek
Khmer (Cambodia)
' dd '
' MM
0453:00000453;0409:00000409
Khmr;
BRE
Breton
brezhoneg
Meurzh
Merc'her
Yaou
Gwener
Sadorn
Meu.
Mer.
Gwe.
Sad.
Genver
C'hwevrer
Ebrel
Mezheven
Gouere
Eost
Gwengolo
Kerzu
Gen.
C'hwe.
Meur.
Ebr.
Mezh.
Goue.
Gwen.
deiziadur gregorian
Breton (France)
brezhoneg (Fra
+Anfin
-Anfin
g. J.-K.
COS
Corsican
Corsu
dumenica
marti
mercuri
ghjovi
venderi
sabbatu
dum.
ghj.
sab.
ghjennaghju
ferraghju
marzu
maghju
ghjunghju
lugliu
aostu
nuvembre
ghje
ferr
marz
apri
magh
ghju
lugl
aost
otto
nuve
dice
calendariu gregurianu
Corsican (France)
Corsu (France)
Mica numericu
+Infinitu
dopu J-C
OCI
dddd,' lo 'd MMMM' de 'yyyy
Occitan
Fran
dimenge
diluns
dimars
cres
genier
febrier
junh
julh
gen.
abr.
jun.
jul.
set.
de genier
de febrier
de mar
d'abril
de mai
de junh
de julh
d'agost
de setembre
d'octobre
de novembre
de desembre
calendier gregorian
Occitan (France)
Occitan (Fran
Non Numeric
+Infinit
sus-Crist
ALS
Alsatian
Els
ssisch
nkrisch
Sund
Mond
Dienschd
Mittwuch
Dunnerschd
Frid
mschd
Feverje
pril
Augscht
Oktower
Nowember
Fev.
Apr.
Aug.
Sept.
Okt.
Now.
Dez.
Gregorischer K
lender
Alsatian (France)
ssisch (Fr
nkrisch)
Ohne Nummer
+Unendlich
-Unendlich
Vor J.-C.
AMH
dddd '
' MMMM d '
' yyyy
dd HH:mm:ss.fff
Amharic
Ethiopia
Ethiopian Birr
Amharic (Ethiopia)
MMMM d
_045e:{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}{8F96574E-C86C-4bd6-9666-3F7327D4CBE8};0409:00000409
Ethi;
YIM
yyyy'
' M'
' d'
dddd, yyyy'
' M'
' d'
yyyy'
' M'
' d'
', dddd
yyyy'
' M'
Yi (PRC)
' d'
0478:{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}{409C8376-007B-4357-AE8E-26316EE3FB0D};0804:00000804;0804:{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}{F3BA9077-6C7E-11D4-97FA-0080C882687E};0804:{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}{54FC610E-6ABD-4685-9DDD-A130BDF1B170};0804:{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}{733B4D81-3BC3-4132-B91A-E9CDD5E2BFC9}
Yiii;
QUT
K'iche
juq'ij
kaq'ij
oxq'ij
kajq'ij
joq'ij
waqq'ij
wuqq'ij
kajq
waqq
wuqq
nab'e ik'
ukab' ik'
rox ik'
ukaj ik'
uro' ik'
uwaq ik'
uwuq ik'
uwajxaq ik'
ub'elej ik'
ulaj ik'
ujulaj ik'
ukab'laj ik'
nab'e
ukab
ukaj
uwaq
uwuq
uwajxaq
ub'elej
ulaj
ujulaj
ukab'laj
K'iche (Guatemala)
100a:0000080a;0409:00000409
WLF
Wolof
Senegal
XOF Senegal
Wolof (Senegal)
Wolof (S
gal)
)0488:00000488;040c:0000040c;0409:00000409
HAU
Safe
Yamma
Hausa (Latin)
Hausa
Nigeria
Nigerian Naira
Naira
Lahadi
Litinin
Talata
Laraba
Alhamis
Juma'a
Asabar
Januwaru
Febreru
Maris
Afrilu
Mayu
Yuni
Yuli
Agusta
Satumba
Oktocba
Nuwamba
Disamba
Hausa (Latin, Nigeria)
Hausa (Nigeria)
)0468:00000468;0409:00000409;040c:0000040c
YBA
Owuro
Yoruba
Aiku
Isegun
Ojo'ru
Ojo'bo
Abameta
Osu kinni
Osu keji
Osu keta
Osu kerin
Osu karun
Osu kefa
Osu keje
Osu kejo
Osu kesan
Osu kewa
Osu kokanla
Osu keresi
kin.
kej.
ket.
ker.
kar.
kef.
kes.
kew.
kok.
Yoruba (Nigeria)
)046a:0000046a;046a:00000409;046a:0000040c
IBO
Ututu
Efifie
Igbo
Onwa mbu
Onwa ibua
Onwa ato
Onwa ano
Onwa ise
Onwa isi
Onwa asa
Onwa asato
Onwa itolu
Onwa iri
Onwa iri n'ofu
Onwa iri n'ibua
mbu.
ibu.
ato.
ano.
asa.
ito.
iri.
n'of.
n'ib.
Igbo (Nigeria)
)0470:00000470;0409:00000409;040c:0000040c
KIN
saa moya z.m.
saa moya z.n.
Kinyarwanda
Rwanda
Rwandan Franc
Ifaranga
Ku wa mbere
Ku wa kabiri
Ku wa gatatu
Ku wa kane
Ku wa gatanu
Ku wa gatandatu
Ku cyumweru
mbe.
kab.
gat.
kan.
cyu.
Mutarama
Gashyantare
Werurwe
Mata
Gicurasi
Kamena
Nyakanga
Kanama
Nzeli
Ukwakira
Ugushyingo
Ukuboza
Ukwa
Kinyarwanda (Rwanda)
046a:00000409
Bangladesh
Bangladeshi Taka
Bengali (Bangladesh)
)0845:00000445;0845:00010445;0409:00000409
DRI
Dari
Gregorian Localized
Dari (Afghanistan)
048c:00000463
TZM
Tamazight (Latin)
Tamazight
Djaza
Dinar
Acer
Arime
Aram
Amhadh
Sedh
Yenayer
Furar
Maghres
Yebrir
Yunyu
Yulyu
Ghuct
Cutenber
Ktuber
Wambir
Dujanbir
Tamazight (Latin, Algeria)
Tamazight (Djaza
GAE
Scottish Gaelic
idhlig
An R
oghachd Aonaichte
Nota Bhreatannach
mhnaich
Diluain
Diciadain
Diardaoin
Dihaoine
Disathairne
Am Faoilleach
An Gearran
Am M
An Giblean
An C
itean
An t-
gmhios
An t-Iuchar
An L
nastal
An t-Sultain
An D
mhair
An t-Samhain
An D
bhlachd
miosachan Greag
rianach
Scottish Gaelic (United Kingdom)
idhlig (An R
oghachd Aonaichte)
Neo-chr
ochnachd
-Neo-chr
ochnachd
0491:00011809
h::mm::ss tt
d//MM//yyyy
dddd, d '
f' MMMM '
f' yyyy
h::mm::ss
Pseudo Language
!!!]
Pseudo
nited
tates
ollar
nited
tates
ollar
!!]
!!]
!!!]
!!!]
!!!]
!!]
!!!]
!!!]
!!!]
!!]
!!]
!!]
!!]
!!]
!!!]
!!!]
!!!]
!!!]
Gregorian Calendar [Pse
do !!!]
Gregorian Calendar [
Pseudo Language (Pseudo)
) !!! !!]
t a
mber
sitive
nfinity
gative
nfinity
.!!!]
!!!]
Pseudo Mirrored
!!!]
!Pseudo Language (Pseudo Mirrored)
) !!! !!! !]
0409:00000409;09ff:000009ff
!!!]
Pseudo Asia
!!]
qpspanese Yen
Pseudo Language (Pseudo Asia)
) !!! !!! ]
Q05fe:{03B5835F-F03C-411B-9CE2-AA23E1171E36}{A76C93D9-5523-4E90-AAFA-4DB112F9AC76}
Hani;Hira;Kana;
Chinese
Norwegian
norsk
Serbian
srpski (Latinica)
Azeri
rbaycan
(Lat
Uzbek
O'zbekcha (Lotin)
Mongolian
Bosnian
bosanski (Latinica)
Tajik
Inuktitut (Qaliujaaqpait)
Gregorian
Gregorian Calendar (English)
gg y/M/d
gg y/M/d' ('ddd')'
y/M/d
y/M/d' ('ddd')'
gg yy/MM/dd
gg yy/MM/dd' ('ddd')'
gg y'
gg y'
gg y'
' dddd
' dddd
gg yy'
'MM'
'dd'
gg yy'
'MM'
'dd'
' dddd
'MM'
'dd'
'MM'
'dd'
' dddd
'Yck
yyy/M/d
yyy/MM/dd
yyy-MM-dd
ggyyy'
ggyyy'
ggyyy'
'MM'
'dd'
Taiwan Calendar
gg yyyy-MM-dd
gg yyyy'
' M'
gg yyyy'
' M'
' d'
' dddd
gg yyyy'
' M'
' d'
gg yyyy'
' MM'
' dd'
' dddd
gg yyyy'
' MM'
' dd'
dd/MM/yyyy '
'dddd'
' d MMMM gg yyyy
C.E.
Julian
Japanese Lunisolar
Chinese Lunisolar
Saka
Lunar ETO Chinese
Lunar ETO Korean
Lunar ETO Rokuyou
Korean Lunisolar
Taiwan Lunisolar
@y@y@y@y@y@y@y@y@y@y
pxpxpxpxpxpxpxpxpxpx
JvJvJvJvJvJvJvJvJvJv
JuJuJuJuJuJuJuJuJuJu
JtJtJtJtJtJtJtJtJtJt
JsJsJsJsJsJsJsJsJsJs
`q`q`q`q`q`q`q`q`q`q
PhPhPhPhPhPhPhPhPhPh
h h h h h h h h h h
f`f`f`f`f`f`f`f`f`f`f
*#*#*#*#*#*#*#*#*#
b b b b b b b b b b X X X X X X X X X X N N N N N N N N N N D D D D D D D D D D : : : : : : : : : :
1:1;1<1=1>1w1x1y1T1
111213141515161718191:1;1<1=1>1?1@1B1C1D1E1E1E1E1E1E1G1I1K1M1O1O1O1O1O1P1Q1R1R1R1R1R1R1S1V1
@ P ` p
0
@
`
p
`
p
0 @ P ` p
! !0!@!P!`!
"0"
@"P"
0#@#
P#`#
0$@$P$
% %0%@%P%`%p%
& &0&
@&P&`&p&
'0'
@'P'`'p'
( (0(@(P(`(p(
) )0)@)
P)`)p)
* *
0*@*
P*`*
+ +
0+@+P+`+p+
, ,
0,@,P,`,p,
-0-@-
q.AZ
S0h2
vp33
W{)SI
J<.X
V2m+
0 @ P
P ` p
P
P
`
P
0
@
P
`
p
0 @ P ` p
!0!@!P!`!P
" "P
0"@"P"`"p"
# #0#@#P#P
$ $0$@$P$`$p$
% %0%@%P%`%p%
& &0&@&P&`&p&P
' '0'@'P
P'`'p'
( (0(@(P
P(`(p(P
) )0)P
@)P)`)p)
*0*@*P*`*p*
+0+P
@+P+P
`+p+
, ,0,@,P,P
- -0-@-P-`-P
. .0.@.P.`.p.
/0/@/P
P/`/p/
000P
@0P0`0p0
1 101@1P1`1p1
2 202@2P2P
`2p2P
3 303@3P3`3p3
4 404@4P4`4p4
5 505@5P5`5p5
6 606@6P
`6p6
7 707@7P7`7P
8 808P
@8P8`8p8
9 909@9P9`9p9
: :0:@:P:`:p:
; ;0;@;P;`;P
< <0<@<P<`<p<
= =0=P
@=P=`=p=
> >0>@>P>`>p>
|~x~
`^1^^
krlmn
a`aa
SSPJM
ttqs
rttlol
LPLM
-KQK
[T]^,
|\<`
[)w"
'eRf
<UP]
*nws
LX1Z
b3lmm
17.146
-61.821
33.833
66.025
28.214
2.655
40.356
47.869
41.111
20.027
40.292
44.937
42.551
1.576
-12.333
17.539
-12.435
-169.965
-35.63
-65.159
-25.585
134.504
47.589
14.14
26.094
50.543
13.178
-59.549
-22.189
23.814
32.303
-64.752
50.649
4.642
23.986
-77.635
24.309
90.058
17.33
-88.63
44.169
17.783
-16.712
-64.666
21.406
96.108
9.624
2.338
53.543
28.055
-9.149
160.987
-10.808
-52.975
27.417
90.435
42.767
25.282
4.57
114.748
-3.365
29.887
62.833
-95.914
12.57
104.814
15.943
18.943
7.789
80.681
-.641
15.638
-2.88
23.656
36.554
104.056
-39.117
-72.441
5.685
12.723
-11.83
43.821
3.998
-73.278
-83.881
6.574
20.487
22.103
-79.014
16.315
-24.035
35.051
33.295
56.102
9.556
11.743
42.632
15.399
-61.339
19.051
-70.337
-1.422
-78.871
26.747
29.869
53.183
-8.199
1.533
10.373
58.694
25.253
15.638
38.851
13.669
-88.866
8.622
39.635
49.739
15.333
64.29
25.992
-16.514
179.454
5.865
151.521
61.954
-6.857
46.642
2.338
13.44
-15.491
-.635
11.739
42.19
43.456
7.921
-1.204
36.136
-5.349
12.196
-61.64
74.35
-41.09
51.202
10.382
38.301
23.741
15.478
-90.156
10.967
-10.922
5.097
-59.048
19.09
-72.438
22.5
114.167
14.974
-86.267
45.743
17.099
47.166
19.418
64.929
-18.962
-2.956
119.521
22.671
79.144
-6.108
71.889
32.496
54.295
31.608
34.818
42.768
12.492
7.599
-5.553
33.045
43.797
35.156
136.06
18.236
-77.364
70.971
-8.488
31.212
36.385
16.508
-169.352
.511
37.878
41.464
74.556
40.279
126.663
-.539
174.228
36.097
127.513
29.427
47.452
48.146
67.179
19.074
103.361
33.946
35.809
56.869
24.841
55.338
23.874
6.412
-9.323
48.707
19.487
47.145
9.554
-29.58
28.254
49.778
6.095
27.236
18.044
-19.272
46.698
22.12
113.57
47.203
28.473
46.836
103.067
-13.35
33.754
17.358
-3.526
43.74
7.434
31.889
-6.351
-20.22
57.589
20.259
-10.364
35.933
14.381
21.01
56.854
3.092
73.056
23.909
-102.634
3.192
114.215
-17.906
35.347
17.424
9.401
-16.651
168.022
9.559
8.078
52.342
5.528
65.398
13.242
28.264
83.931
-.615
166.935
4.217
-55.889
12.904
-84.922
-40.306
172.669
31.499
35.00
-23.244
-58.394
-9.213
-75.112
29.316
68.765
52.147
19.378
8.599
-80.41
39.642
-8.346
-6.121
146.858
7.317
134.403
11.904
-15.163
25.414
51.26
-21.146
55.631
10.786
169.134
45.839
25.009
12.023
122.714
18.247
-66.648
63.14
103.89
-2.003
29.923
23.888
44.442
46.906
-56.337
17.244
-62.643
-5.416
54.563
-29.046
25.063
14.9
-14.599
46.12
14.821
8.521
-11.844
43.944
12.459
1.322
103.821
9.46
47.167
40.396
-3.551
13.889
-60.965
13.933
30.152
78.129
20.097
62.915
16.237
35.03
38.469
46.806
8.226
23.685
54.204
10.701
-61.152
15.229
101.1
38.814
71.479
-18.985
-174.586
8.513
7.002
34.356
9.754
39.051
34.93
-7.904
178.574
23.686
120.897
39.201
59.082
-6.307
34.854
1.282
32.388
48.927
31.478
54.071
-2.784
39.45
-98.908
12.285
-1.746
-32.863
-56.007
41.772
63.146
13.185
-61.229
7.674
-66.15
16.803
106.993
17.753
-64.735
41.908
12.447
-22.149
17.18
18.525
166.244
-13.492
-172.89
-26.565
31.501
15.341
47.908
-14.197
27.996
29.869
43.855
20.59
42.5
19.3
44.0
21.0
18.15
-63.10
-90.00
0.00
12.30
-69.58
-7.94
-14.41
-12.14
123.05
0.13
-176.31
-54.26
3.24
19.30
-80.30
49.43
-2.36
-10.30
105.40
10.17
-109.13
-12.30
96.50
-21.14
-159.46
-18.00
152.0
-6.28
71.77
-51.45
-59.00
4.00
-53.00
-15.00
-140.00
-43.00
67.00
16.15
-61.35
13.28
144.47
20.00
-75.12
49.28
-2.35
-53.06
72.31
0.48
-176.38
-0.22
-160.03
49.15
-2.10
6.24
-162.24
14.40
-61.00
-12.50
45.10
16.45
-62.12
12.15
-68.45
-21.30
165.30
-19.02
-169.52
-29.02
167.57
15.12
145.45
5.52
-162.06
-25.04
-130.06
14.15
142.20
15.19
145.74
-54.30
-37.00
-15.56
-5.42
15.28
145.80
-9.00
-172.00
-37.11
-12.29
21.45
-71.35
18.20
-64.50
-13.18
-176.12
54.225
-4.562
41.603
21.715
28.214
-177.332
o-8.58
126.00
ArabArmnBaliBengBopoBraiBugiBuhdCansCariChamCherZyyyCoptXsuxCprtCyrlDsrtDevaEthiGeorGlagGothGrekGujrGuruHaniHangHanoHebrHiraQaaiKndaKanaHrktKaliKharKhmrLaooLatnLepcLimbLinbLyciLydiMlymMongMymrTaluNkooOgamOlckItalXpeoOryaOsmaPhagPhnxRjngRunrSaurShawSinhSundSyloSyrcTglgTagbTaleTamlTeluThaaThaiTibtTfngUgarZzzzVaiiYiii
Actx
SsHd,
C:\Windows\Microsoft.NET\Framework\v2.0.50727\
mscorwks,processorArchitecture="X86",publicKeyToken="000000000000000",type="win32",version="1.0.0.0"C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
Microsoft.VC80.CRT
`+v*
Microsoft.VC80.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.4940"C:\Windows\WinSxS\manifests\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc.manifest
x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc
SsHd,
msvcr80.dll
msvcp80.dll
msvcm80.dll
GsHd(
GsHd(
GsHd(
GsHd(
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
Svpq
i:rq
p4,&
p|,&
ph2&
p8+&
p\+&
ph+&
pd/&
p\1&
pX,&
pP1&
pP2&
p81&
p\4&
ph.&
p$-&
p82&
p,4&
pX/&
ph1&
p\0&
p80&
p<3&
p,2&
PRh
qUSVW
_^[]
>P%
qT
PRh`9
qUSVW
(WVS
_^[]
>X&
qT
PRhX<
qUSVW
_^[]
txoq
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
bvoq
|voq
qUSVW
Pj0h0
uqX3
qqZX
_^[]
ouoq
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
5toq
PRhX<
qUSVW
_^[]
xsoq
PRhX<
qUSVW
_^[]
qUSVW
}zqP
u'PRV
qqZX
_^[]
PRhX<
qUSVW
_^[]
Wqoq
qqoq
i
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
Wooq
qooq
qUSVW
Pj h
uqXPRV
qqZX
_^[]
Xnoq
rnoq
q
qUSVW
u'PRV
qqZX
_^[]
`moq
zmoq
PRh`9
qUSVW
(WVS
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
Bkoq
\koq
PRhX<
qUSVW
_^[]
qUSVW
La:w
qqZX
_^[]
qUSVW
^`:w
_^[]
PRhX<
qUSVW
_^[]
%hoq
?hoq
PRhX<
qUSVW
_^[]
qUSVW
Pj h
)^:w
uqXPRV
qqZX
_^[]
qUSVW
Pj0h
Pj0h
uqXP
uqXPRV
qqZX
_^[]
[eoq
ueoq
q07`
PRh`9
qUSVW
(WVS
xnuq
_^[]
qUSVW
_^[]
Ncoq
hcoq
PRh`9
qUSVW
(WVS
_^[]
qUSVW
_^[]
daoq
~aoq
PRhX<
qUSVW
(X:w
_^[]
PRhX<
qUSVW
vW:w
_^[]
`oq
PRhX<
qUSVW
_^[]
C_oq
]_oq
PRhX<
qUSVW
_^[]
qUSVW
o}uq
_^[]
u]oq
n
qUSVW
u%PRV
qqZX
_^[]
qUSVW
`S:w
u%PRV
qqZX
_^[]
qUSVW
u'PRV
qqZX
_^[]
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
ocal
5:wL-PC
:wS=1
:w:\Pyth
9wScript
?:wm32;C:
W+:ws\Syst
dows\System32\WindowsPowerShell\v1.0\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_ARCHITEW6432=AMD64
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 61 Stepping 4, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=3d04
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files (x86)
ProgramFiles(x86)=C:\Program Files (x86)
ProgramW6432=C:\Program Files
PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
PUBLIC=C:\Users\Public
SESSIONNAME=Console
SSLKEYLOGFILE=C:\Users\Bill\Desktop\SSL\ssl.log
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\Bill\AppData\Local\Temp
TMP=C:\Users\Bill\AppData\Local\Temp
USERDOMAIN=Bill-PC
USERNAME=Bill
USERPROFILE=C:\Users\Bill
windir=C:\Windows
windows_tracing_flags=3
windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
C:\Users\Bill\Desktop\30% tt Slip.exe
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Bill\AppData\Roaming
CommonProgramFiles=C:\Program Files (x86)\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
CommonProgramW6432=C:\Program Files\Common Files
COMPUTERNAME=BILL-PC
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Bill
LOCALAPPDATA=C:\Users\Bill\AppData\Local
LOGONSERVER=\\BILL-PC
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\Python27\;C:\Python27\Scripts;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_ARCHITEW6432=AMD64
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 61 Stepping 4, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=3d04
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files (x86)
ProgramFiles(x86)=C:\Program Files (x86)
ProgramW6432=C:\Program Files
PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
PUBLIC=C:\Users\Public
SESSIONNAME=Console
SSLKEYLOGFILE=C:\Users\B
ill\Desktop\SSL\ssl.log
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\Bill\AppData\Local\Temp
TMP=C:\Users\Bill\AppData\Local\Temp
USERDOMAIN=Bill-PC
USERNAME=Bill
USERPROFILE=C:\Users\Bill
windir=C:\Windows
windows_tracing_flags=3
windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log
'8'8'
< a+b-z
l;uM
J!F4
v<hU
e-FC
54iw
fWg,
OakK
!b%3
}]R2`
lha#5
iF,!zr\
z P5#
/
b
;!M_
~\7/
#gvU
lmY.
EhB0>
,o+M
}xd<C
)WF&
aP "
:C|b
?5`I
T()#O
f E{
cN,)
wO&M
g15I+
8~EW]
$%e0q
>
5B<%
}&M
W\N2|
:yEo
a7Ssc
xVGo_{/Bb.
Cv,H]
[1T^
j/AN
S.p=
!Zmo
[QYp
gE,4
q4We
zk%~
72M+R
F\|;
VZ!)
c\ay
0+6%
z-?$
wp V
e?QC
,4p36
g|VD
E;s
P
t2i>
o%hx
1jz|
M{x$S
>gvO
%<Y:9
U+Idh(
0>.A;
f /
Ehks
\~<%ed
{i-q
7XpV
dyz]
0/Y}
w7@C
8x~-3
Gj[w
a,m-
VqU=
DI2}
]6$U
qGy)
MT:L
.(\<"
Gal
ljp#
SA\
6j#K
P1~=
KZUwQpT
vt@=
s5X)
HQCN
$Tz
&p
%tvO
:SF@\
O>[#
L-IXe
~_%eT
C]cgR
uD(9
y1zP
'elp
u(XL
Q2c|
OrRZ
n
i*w
S;!}
@_xMsg
S?BE
oLz
a,6n
(q#.
0NJPc
Ddqt
pTy,w
{=]F\J
u%+E
Y <)
.T|-w
&GB
4~K@
Yt"H
;[(^
adYK X
w1goRr8
%LvO
z[H6+k
/G0a
~`;y
pv?_
I[TD
O2C 4
h@#X:
E|"0
Fr 4Hf
dI;hx>3
5mW9
izl"
>gwuX
CpS
EBel
Y_=r
5 !T
=<5R
()c"
yZ5;
el>V
~_
s
h:=FN|
@Gt&
fKb+a
2. J
5Qh}^
& ~+
wRTL
YMru
b%*CF-
gc3X
*As=
f]FW._l
uv1L
Bra
"L%J
(T?e
RH[cg~
7!:o
fX=
|,4Tp
5Z`#
I8jb
YMj>
F,c@z
8<$x
)%gj?
dJf|8~h
}jvK
m( &Q
[TCkyX=
tZQ.:
N 4,d
Jwpq
;n1+
c,jZ|
xO2W
DKyVj?3
kg 4
-&X
Z+)%n
}Sw5-
]X@R
[!.0
rK=M
{iAbh
K[fN
4}g
<|rJ
1/'=
o yzF
adZj
z8Ov
;4@Q
TYI9
~tg_
ZMjb
y\EdP
QE`l
R8_B
6[h
WbIq|#
d *'
86Y@
:3}B
'1@y
e-I<
j/o:
3?t&
rI}_9
#RYy@
!-Y<l:W
Ef y
;
qN
ma.A
2*9E
0%e?
LmRyV
F>a}dE
`X;f~
cb[
#%nu
%]a^p
iWA/}
)%voc
<W
u
Ez:nD
C0iH
_+aF
:O>MWw-
Zfjb
g'u".
(Z&}
+9<W5
]>3Tz;
So:9
8%]\
!Q@,
3^l7P
;xQ[
AH'e@t2=
ymc
i1~u
^EI8
pe6<?
Fx_!
R[Xxl
sf
z
]}kJ
W
R]E
VUZx
8 NOC5
Q,bjL
)'gq3
aV4L
KOwl
#!}/
GfZ\
0xJ[
.@;G
x9rU
K/E_
2/V4
|_7w
h!)I
\*d0
Maz:
eZ8<
<jr T.
eJm`Yb
COht
!lQw
<dK
A
{,JWp
l7A?
Zfw1
3-!u
"X=.
j_dm
z21g
X[tA! H
^y8C
pv+d
KD4T
U@>?{]Y
i"7q
Ir"}BK.
H'i>/v
{CY"
nuMWl
voA
s
;5tR@E6
kc:~
bjg
*-.+
+Oj~t
\1
u
Q}1i
)jE'
7V^J
2[U$
LiPS
o% `p
{lIq
fsJ1#8
:[mc
d2/
(t<-
0Gyz
4d<o
c[(g
@BkX
"x
%
q0L^r~J-&v
bpGg
f{/n
N(60&
xkh!
oJjr
~Snz
2`uO7
A%qdP{
Sfs6
%j:M-"
n]=PDVU
[&La
Wtiy
b4_{
qY$EZ
-n93
<itR'
]%_yd
h5fY
#R;^-
AC
P,
q(_a
8)QG
N3'?
=$ %
|{fu
Y,B`
0+mv
Z
Q7nE
iUVB=
E8>l
gfA)
oON0
;xwQ
VID4
-?Z5
KP
\r?zt
JgR`
mTM#w7I
\t?S&
~ 3E
NGJ-5
e)8(
,]eu0
N$<
tRlI
m6'%w
@[.c
)NVE6R0D1W;L
gGvB
nz+h}
Sp=y-
8zl@q
LcaW;
PDF>K
bfN'eO
[
&bk
9#UA
3T:w-
E`;5
Dg4mn
cQN|_
g9v<
w 3X"
'EXn
>2g~
4/I}
`v=]
8ceg[
x!w4
DiT9
UVa
^1p}?
oY.LS
O&~^
R-fQ
4yXUw
;>S&
u#X!
b}UE
k5*W
[^+5
x$fLJ
KbDZ
ASW
J
%n">l$h6
]Y4T2
!8*C
3^{7
b<5M
,6Kr
X~BxE
zRo^
9}pVE
{u5P
A?jm
|
,:
N-6C4
p5vB
3Q
&
)7T/
S2bR
(6ht
ayk-s
h=4C
xIvN
i(Bf
5\mOj
8tJq
mn^e
q6=h
[w1 M
pb 4,
JATj
$ Gl#E=
hK!
TRt~m
u[Fx
l %m
.JQ3
Ot`&?
l;qh
d8P:^=
U
1J
;^s!
Ocn@e7f
5q=kd
f1NLWiE
85xsg+
`
eh
{O}y
*cKz
@AT7
}q K?
<afV
kY,x\
wjKlf*
x#4n
padHL
>W.B
].`2
$[j^
l`7v
Kjt9i
T\Hg
5
bE82>|W
+6^P'M
d~T>
'Gm&a
r.[C0
0*ly
)2Gv
@#F`
s1E}
z!W(
Q{UD
pBy3
/%,8
{ger
=y,d
ghae
VT dv
L#D5t {
KhB<
}V@tR
"L\J
kdGD
}&`xBYE
Xb\1%l#
L|P
etFo[p
Xq_F)
N\i'
2HQ$
B$.d
(2,-
p"e@u
l!a
7J
1
*L.)
6mHh
0DYJw38M
0vb*=
QR-X
9We uh
I>NV
|p\-]
Z%z)
[\ F:8~
?@a #
\V'7
+h
F
#5\Y
v2!"
Zj y
SrgA
'F_^P
MH!1
^iqeP[
{A'*p
C]2'
TUsb<=.S
f-g
B
M\(
'A[8^
>pjW
%Un@H
:7Qe
a(bH
\;20
6M5s
)VwA
G!l02
"pj!
k?>N
}-T(9y
]^1+
pWZ:
qB @
yDu,
YupI
nc\;
7WMG _
~m:FL
2 RM
-\@:
s"q`
pKS }
c[.L
a;}-#
*=eK
/)_&
r<M]
UA83T
.)2i
=/7O
cVTj
ym~E1G
WP[w
u-+G
d1D,
@"F/>
c`{6I
2S~b"p
_j@f
kvgRym
KoZ*
4=]C
$K"|
E1)>
qVNl[2
"K2%
ImpR
z[0&
;Jy82NOT5
oFc%
]kJS
Wf|nTMC
KxE@
.g^L
5
qb
*g03
GfU\
+<vF
`d_8
7B;3
| (*
]xr6
P+j,
IR`5
&iX{
r Y8
?:/c<]
gMx<
Yqur
2
N\
=2&[
H
.f
7x=3g
&Wzu
2wi
1:O<
NAHU
PVz2Q
x7oG
dpEt
,~i
)0-.qk^f
Zao{
y,~;
5vxSX
&OsA
\t1R
>djF
DW'(
:O'B
cjX.
@x;Ry
fA
b
*4_&
P
D1k
#e!*
x^f
&p ;05
]KMoF
S!2A
%S Y8
,s'xv
&!E"
?hIlC
*zY
Hm8[D
}j?a
lCNE
y[u4
"Ma(^
z'_pC
)r!5
]g*sW
YU,?
e2K1
x>(s`
0,Ek
mq%X5
<jcO
W>pgw
,q%|P
uh(x
r>t7G
-$*a
@N)=
2cbS
`XHj
E$n0'O9
_|Q,
;GrNs
C=E\
9|:D
#7pjx!O'(
VH;0z
nQ*P2w
'i
)
g"HO
S%06
C#o!*
C62xO
d1RM
bpQu<`
%S!\
_,yD)?:
m|vuJI
4g x'
jp]M
]F$?
.xOi
b_W^
|#T?
a="e
]f~w
F3clo
ZjDL
z&ktFU|05
~J%]M
X"8 hi
eg(
yj86
axBI
Y({^
kPSh
Z@6[
3zO?
*!/C
jt
:
\AvT
7(Vi
Z, m
<KQj
M?lo#i
3pa0
NO?~4
Lq,Y&
@T[(
\?z9
.74A
F`R~y
jw}9
7E sv
A,=&bc
%GfWJ
1
'q
FS!8
Ny#>
T0;m|
\8L{h
5gpnN
cry-_
XMxD
#o _
Oq%r
H&t1
Z}p;
|3y#&
6~$e
%E'f
L1k/
M#TC
N,fiP
^eBm
lOp=W
cDag
2NG
]0vK_q
2l3"
6d}<
]N7.3n
t({J
'~
,!W)
H_bc
)'<l|"
G$g^
/brUc
.q~i
WK2p-
aF$
Z
fTp0OUdC
As
qn%
YJa2
:1[=
Muc"$5g|
`Dr,G
\e,(3
#c7K
U5&fn
PR?S
_xh%gO
3[
d
li4'
.-s(Z
.^dP_]T
1[a`n\L
4GH|
831C
B)b]
h*p7vq
[wRr
`A[Y$
#OWo
l{+K
iF1=
%G5q'
x_;7
8GAb
UR,o
iCe$
!S.>
L@Waz=
0OPVTB
&)yG
vo^R@
-D;$
Oq^T
mD+=
UO")
\4Rm
1#p5C
$Xg|N
_
3.>
(`,{
EgPi
(^j-
kX5\Z
"0|hBXi
"31C
RYa
w@g<
[~T'
_L|/
VF;eY E
i)JU
Pyk>
2r+"
(DbY
5#z9
}_Bn/s
NI;A
eY|g
2zeg\X
F,w}
3)(S
|I-U
Rf#E
2rJj]L5T
/a`A
tU
f
iDS7
["k'
xd#0%
HMy
$48PqJj
5Q@ p
t.Fxd8g
2S!3
`!4=
uN_d
"0<(
.wS:
= "g
en/s|
hZ*}#'
IA,q
!HTEi
%"HA
]zk,n
{S@>
vE6'
yNV|
)5C3*
P&7d4
Bq=3w
(zOs
,m'!
NLA[
MIwj1/=K
t|BbH
KIBJ
GE:T
FBpc*(6D
mu;[A
3-~>5`
A;xLC
dfaOW6=
UmHT
'SD8
E
[ys
-N$0
=7tH?
`b]KS29
QiDP
#O@4
A Wuo
)J ,
~?6D
I#Y+
hf_g
P Qj2
_F
`i
6h9,
*(!)
q}:3#
-Sy.
F\o
T$Un6
Bi E
:l=0
.,%-
Qs!jv
1W}2
X2h:
y&"PC
wunv
93pD;
\^YGO.5
Me@L
+].!
fr/(
"Hn#
bYv
A?4N
@<j]$"0>
go5U;
-'x8/Z
|jrQX
Bn_S
Hi?K
d)5N
lniW_>E
]uP\
/[L@
5V,8
*[w)r+
T{2W
u\ v
L~OB
&Q`
@>7?
u\$F
QOHP
o0'5q
}d,N
&?jy
YWPX
PNC]
AE
^
OKyl31?M!
hS
v~DdJ
i*!/k
w^&H
9ds
SQJR
P*`2 S
omfn
a;qC
0.#=
/+YL
V^$D*p
-'d8/
\ZhvJ
PRM;C")
AY4@
|6>L
E
V~
DB7Q
C?m`'%3A
jr8X>
0*{;2]
ki^x
\`%y
NLZh<
BD?-5
3K&2
n(0>w
q]
p
Lbu
Z*[t<
Ho&K
@rC6
42+3
Wy'p|
z|wemLS
=iZN
Cd:F
_$0I
1+h<3
`^lzN
TVQ?G&-
E]8D
e?uG
42'A
3/]P
Zb(H.t
k+"M
FD9S
EAob)'5C
lt:Z@
2,}=4_
X(Yr:
Fm$I
>pA4
20)1
Uw%nz
f@vH
53(B
40^Q
[c)I/u
l,#N
k,#1m
y`(J
";fu
USLT
.(e90
][iwK
QSN<D#*
BZ5A
}7?M
c=sE
20%?
1-[N
X`&F,r
i) K
nla{
_c(|
QO]k?
EGB08
6N)5
q+3Az
Z4j<
{($RE
ywpx
LJ?Y
KGuh/-;I
rz@`F
;5rF=
^`[IQ07
OgBN
!M>2
_3e
zI t
dbWq
GESa5
;=8&.
|g!)7p
lF|N%o
;9.H
:6dW
ai/O5{
'!r2)T
`:pB
/-"<
.*XK
U]#C)o
[YNh
w><JX,
W1g9
x%!OB
vtmu
y:1?{
caZb
l-$2n
za)K
#<gv
VTMU
& ]1(
USaoC
IKF4<
:R-9
u/7E~
Y)Zs;
Gn%J
?qB5
31*2
Vx&o{
"So!j#
Pfy
^._x@
-gE
Ls*O
DvG:
86/7
[}+t
b`Uo
~ECQ_3
9;6$,
'5n
c
Q!Rk3
7i:-
+)"*
r~;4$
.Tz/
J$Z,
ig`h
?G
-
O{l`
UvLX
.T ~
q6B[
K%[-
jhai
uwr`hGN
f~Ye
8dUI
>_5A
vJ|!
'Xt&o(
c3d}E%
Qx/T
I{L?
#N]
=;4<
U%Vo7
Cj!F
;m>1
/-&.
Rt"kw
2X~3
)#`4+
XVdrF
LNI7?
=U0<
x2:H
;, {g
_]Rl
{B@N\0
683!)
gAwI j
64)C
51_R
\d*J0v
m-$O
@>3M
?;i\#!/=
fn4T:
,&w7.Y
;W R
,^/"
gs0)
#Io$
!cZw
?=2L
>:h[" .<
em3S9
+%v6-X
1b~0y2
|c'}
GE>F
rY!C}[
o/ ?
NLEM
v~]d
Nzk_
TuKW
p5AZ
9[ R^
60mA8
Y[VDL+2
Jb=I
|~ygoNU
?k\P
Ef<H
a&2K
y{vdlKR
<hYM
Bc9E
^#/H
a_Tn
}DBP^2
8:5#+
&4m b
z;2@|
db[c
B<yMD
egbPX7>
VnIU
(TE9
.O%1
zhpOV
@l]Q
Fg=I
b'3L
r:)Q
}>5C
oO!
H"X*
ge^f
4.k?6
cao}Q
WYTBJ)0
H`;G
V0f8
w$ NA
uslt
fdYs
W[ t
IGUc7
=?:(0
.F!-
~i#+9r
IG@H
@:wKB
ce`NV5<
TlGS
&RC7
,M#/
82oC:
[]XFN-4
Ld?K
t9 :S
2d5(
my6/
)Ou*
'i`}
dp-&
Fl!
><1K
=9gZ!
dl2R8~
*$u5,W
z?Kd
;
x@
|AMf
co,%
t[#E
PNGO
\6l>
}*&TG
{yrz
muT[
EqbV
Z{ &
KlBN
g,8Q
x e
{iqPW
Am^R
Gh>J
c(4M
)Zv(q*
Sz1V
K}NA
?=6>
wytbjIP
:fWK
@a7C
xL~#
\!-F
3-j>5
b`n|P
VXSAI(/
G_:F
iCyK"l
86+E
73aT
^f,L2x
o/&Q
][Pj
y@>LZ.
>8uI@
ac^LT3:
RjEQ
$PA5
B
Xvp
*K!-
b6h
qod~
TR`nB
HJE3;
9Q,8
t.6D}
{}xfnMT
>j[O
De;G
`%1J
am*#
=_
Vb
#Tp"k$
_/`yA!
.hF
Mt+P
EwH;
9708
\~,u
/)f:1
^\jxL
RTO=E$+
C[6B
~8@N
:4qE<
]_ZHP/6
NfAM
L=1
^2d
USHb
TP~q86DR&
0a}/x1
{b&|
FD=E
S-c5
rpiq
rzY`
Jvg[
PqGS
l1=V
E[n
S#Tm5
bI
cl
9k</
-+$,
Pr iu
0V|1
q"J{
v7.<x
`^W_
F@}QH
ikfT\;B
ZrMY
,XI=
2S)5
:
l`
~COh
n/&4p
|c+M
%>ix
XVOW
sup^fEL
d|Wc
6bSG
<]3?
h0!Iz
u6-;w
_]V^
EC8R
D@na(&4B
ks9Y?
1+|<3^
t|[b
Lxi]
RsIU
n3?X
^E _h
5g8+
)' (
p|92"
,Rx-
P|ma
VwMY
/U
r7C\
D>{OF
gidRZ9@
XpKW
*VG;
0Q'3
\$
2c
1z3
C
}d(~
HF?G
TRGa
SO}p75CQ%
qX B|Z
MKDL
xzuckJQ
;gXL
Ab8D
]".G
m5 Hy
t5,:v
m`
7*
+Do~
^\U]
IG<V
HDre,*8F
ow=]C
U/e7
trks
2,i=4
a_m{O
UWR@H'.
F^9E
Mcv
[+\u=
Ip'L
AsD7
53,4
Xz(q}
?[
V
0b3&
kw4-
'Ms(
%g^{
d>tF
31&@
2.\O
Ya'G-s
j*!L
,&c7.
[YguI
OQL:B!(
@X3?
{5=K
>/#~j
ZXMg
v=;IW+
JHAI
{J
u
ecXr
HFTb6
<>9'/
-E ,
}h"*8q
f
/a2%
jv3,
&Lr'
$f]z
._{-v/ ?
y`$z
DB;C
XVKe
t;9GU)
("_3*
WUcqE
KMH6>
<T/;
w19G
mojX`?F
^vQ]
0\MA
6W-9
oqlZbAH
`xS_
2^OC
8Y/;
s4+9u
*Cn}
][T\
,]y+t-
V}4Y
w^"x
B@9A
0*g;2
_]kyM
SUP>F%,
D\7C
omb|
`d)}
RP^l@
FHC19
7O*6
r,4B{
YzP\
LC`
u:F_
h) .j
v]%G
s3
C
RPIQ
R"Sl4
8j;.
,*#+
/U{0
Z{Q]
v;G`
%Vr$m&
a1b{C#
Ov-R
GyJ=
;92:
OMB\
@D ]
NJxk20>L
u}CcI
Le-
1c4'
lx5.
(Nt)
&h_|
Q+a3
T
pngo
qsn\dCJ
bzUa
4`QE
:[1=
C=zNE
fhcQY8?
WoJV
)UF:
/P&2
[#0X
O)_1
nlem
~M
x
hf[u
Y]"v
KIWe9
?A<*2
0H#/
k%-;t
nZ
m
p1(6r
~e-O
'@kz
ZXQY
b<rD
1/$>
0,ZM
W_%E+q
MK@Z
LHvi0.<J
s{AaG
I_r
W'Xq9
El#H
=o@3
1/(0
Tv$my
^8n@
-+ :
,(VI
}{t|
S[!A'm
RPE_
QM{n53AO#
+%b6-
ZXftH
NPK9A '
?W2>
z4<J
=."}i
pnc}
ae*~
SQ_mA
GID2:
8P+7
s-5C|
HF;U
GCqd+)7E
nv<\B
*\-
eq.'
!Gm"
R~oc
XyO[
KB_
t9E^
]4~ }
JH=W
IEsf-+9G
px>^D
jh]w
[_$x
MKYg;
AC>,4
2J%1
m'/=v
$Uq#l%
`0azB"
^E
/iG
Nu,Q
FxI<
:819
ig\v
Z^#w
LJXf:
@B=+3
1I$0
l&.<u
?9vJA
bd_MU4;
SkFR
%QB6
+L".
8
u=
]~T`
y>Jc
&Ws%n'
b2c|D$
1kI
Pw.S
HzK>
"M\
<:3;
x=
>W
+R .
^j'
:\
S_
KI>X
JFtg.,:H
qy?_E
tvq_gFM
e}Xd
7cTH
=^4@
uI{
}ksRY
Co`T
Ij@L
e*6O
^ X~
\ZOi
x?=KY-
q2)7s
(Al{
[YRZ
Ib*
.`1$
iu2+
%Kq&
#e\y
7 t<
\}S_
OFc
x=Ib
!Rn i"
]-^w?
[B
,fD
Kr)N
CuF9
75.6
Z|*s
VTIc
r97ES'
5/l@7
dbp~R
XZUCK*1
Ia<H
M']/
ljck
m.%3o
{b*L
$=hw
WUNV
[|R^
w<Ha
*$a5,
YWesG
MOJ8@
>V1=
y3;I
<-!|h
,S
/
_k(!
j+"0l
x_'I
!:et
TRKS
-^z,u.
W~5Z
x_#y
CA:B
prm[cBI
ayT`
3_PD
9Z0<
e-'O
{<3A}
r6
Q
F V(
ec\d
;C )
R,b4
qohp
\,]v>
ZA +eC
Jq(M
BtE8
64-5
Y{)r~
9 k_
}BNg
L&\.
kibj
~ltSZ
DpaU
JkAM
f+7P
v>@h
_9oA
.,!;
-)WJ
~|u}
T\"B(n
kE{M$n
:8-G
95cV
`h.N4z
& q1(S
lj_y
]a&z
OM[i=
CE@.6
4L'3
o)1?x
+\x*s,
U|3X
v]!w
A?8@
WUJd
s:8FT(
`^Sm
|CAO]1
794"*
<X
S
Ha)
-_0#
ht1*
$Jp%
"d[x
]7m?
~+'UH
|zs{
RZ @&l
mk`z
^b'{
PN\j>
DFA/7
5M(4
p*2@y
x90>z
o3
N
b`Ya
`l)"
u:
;T
owV]
GsdX
MnDP
i.:S
yA#K|
w8/=y
n2 M
a_X`
geZt
X\!u
JHVd8
>@;)1
/G".
j$,:s
mY l
|=4B~
G!W)
fd]e
<D
*
vxsaiHO
9eVJ
?`6B
wK}"
[ ,E
SQF`
DH
a
RN|o64BP$
Q}nb
WxNZ
s8D]
'!^2)
VTbpD
JLG5=
;S.:
v08F
mG}O&p
<:/I
;7eX
bj0P6|
("s3*U
/V
2
bn+$
V&Wp8
Dk"G
<n?2
0.'/
Su#lx
71nB9
Z\WEM,3
Kc>J
=
oc
nvU\
FrcW
[|
'
LmCO
h-9R
x@T|
B@5O
A=k^%#1?
hp6V<
.(y90[
^\Qk
zA?M[/
572 (
Y3i;
z'#QD
xvow
CA6P
B>l_&$2@
iq7W=
/)z:1\
T.d6
W
sqjr
qyX_
IufZ
OpFR
k0<U
E?|PG
hjeS[:A
YqLX
+WH<
1R(4
npkYa@G
_wR^
1]NB
7X.:
kmhV^=D
\tO[
.ZK?
4U+7
`(Ow
nH~P'q
=;0J
<8fY
ck1Q7}
)#t4+V
{@Le
u}\c
Myj^
StJV
o4@Y
3e6)
nz70
*Pv+
(ja~
rto]eDK
c{Vb
5aRF
;\2>
g/<d
[5k=
|)%SF
zxqy
N(^0
mkdl
pxW^
HteY
NoEQ
j/;T
r3*8t
)Bm|
\ZS[
LJCK
jDzL#m
97,F
84bU
_g-M3y
p0'R
<6sG>
_a\JR18
PhCO
"N?3
/`|.w0
@
za%{
EC<D
caVp
FDR`4
:<7%-
{f (6o
s{Za
Kwh\
QrHT
m2>W
GA~RI
jlgU]<C
[sNZ
-YJ>
3T*6
4f7*
o{81!
+Qw,
QOD^
PLzm42@N"
YWLf
u<:HV*
hBxJ!k
j
75*D
62`S
]e+K1w
n.%P
sZ"D~\
p0
@
OMFN
(Yu'p)
d4e~F&
Ry0U
J|M@
><5=
< a+b-z
l;uM
J!F4
v<hU
e-FC
54iw
fWg,
OakK
!b%3
}]R2`
lha#5
iF,!zr\
z P5#
/
b
;!M_
~\7/
#gvU
lmY.
EhB0>
,o+M
}xd<C
)WF&
aP "
:C|b
?5`I
T()#O
f E{
cN,)
wO&M
g15I+
8~EW]
$%e0q
>
5B<%
}&M
W\N2|
:yEo
a7Ssc
xVGo_{/Bb.
Cv,H]
[1T^
j/AN
S.p=
!Zmo
[QYp
gE,4
q4We
zk%~
72M+R
F\|;
VZ!)
c\ay
0+6%
z-?$
wp V
e?QC
,4p36
g|VD
E;s
P
t2i>
o%hx
1jz|
M{x$S
>gvO
%<Y:9
U+Idh(
0>.A;
f /
Ehks
\~<%ed
{i-q
7XpV
dyz]
0/Y}
w7@C
8x~-3
Gj[w
a,m-
VqU=
DI2}
]6$U
qGy)
MT:L
.(\<"
Gal
ljp#
SA\
6j#K
P1~=
KZUwQpT
vt@=
s5X)
HQCN
$Tz
&p
%tvO
:SF@\
O>[#
L-IXe
~_%eT
C]cgR
uD(9
y1zP
'elp
u(XL
Q2c|
OrRZ
n
i*w
S;!}
@_xMsg
S?BE
oLz
a,6n
(q#.
0NJPc
Ddqt
pTy,w
{=]F\J
u%+E
Y <)
.T|-w
&GB
4~K@
Yt"H
;[(^
adYK X
w1goRr8
%LvO
z[H6+k
/G0a
~`;y
pv?_
I[TD
O2C 4
h@#X:
E|"0
Fr 4Hf
dI;hx>3
5mW9
izl"
>gwuX
CpS
EBel
Y_=r
5 !T
=<5R
()c"
yZ5;
el>V
~_
s
h:=FN|
@Gt&
fKb+a
2. J
5Qh}^
& ~+
wRTL
YMru
b%*CF-
gc3X
*As=
f]FW._l
uv1L
Bra
"L%J
(T?e
RH[cg~
7!:o
fX=
|,4Tp
5Z`#
I8jb
YMj>
F,c@z
8<$x
)%gj?
dJf|8~h
}jvK
m( &Q
[TCkyX=
tZQ.:
N 4,d
Jwpq
;n1+
c,jZ|
xO2W
DKyVj?3
kg 4
-&X
Z+)%n
}Sw5-
]X@R
[!.0
rK=M
{iAbh
K[fN
4}g
<|rJ
1/'=
o yzF
adZj
z8Ov
;4@Q
TYI9
~tg_
ZMjb
y\EdP
QE`l
R8_B
6[h
WbIq|#
d *'
86Y@
:3}B
'1@y
e-I<
j/o:
3?t&
rI}_9
#RYy@
!-Y<l:W
Ef y
;
qN
ma.A
2*9E
0%e?
LmRyV
F>a}dE
`X;f~
cb[
#%nu
%]a^p
iWA/}
)%voc
<W
u
Ez:nD
C0iH
_+aF
:O>MWw-
Zfjb
g'u".
(Z&}
+9<W5
]>3Tz;
So:9
8%]\
!Q@,
3^l7P
;xQ[
AH'e@t2=
ymc
i1~u
^EI8
pe6<?
Fx_!
R[Xxl
sf
z
]}kJ
W
R]E
VUZx
8 NOC5
Q,bjL
)'gq3
aV4L
KOwl
#!}/
GfZ\
0xJ[
.@;G
x9rU
K/E_
2/V4
|_7w
h!)I
\*d0
Maz:
eZ8<
<jr T.
eJm`Yb
COht
!lQw
<dK
A
{,JWp
l7A?
Zfw1
3-!u
"X=.
j_dm
z21g
X[tA! H
^y8C
pv+d
KD4T
U@>?{]Y
i"7q
Ir"}BK.
H'i>/v
{CY"
nuMWl
voA
s
;5tR@E6
kc:~
bjg
*-.+
+Oj~t
\1
u
Q}1i
)jE'
7V^J
2[U$
LiPS
o% `p
{lIq
fsJ1#8
:[mc
d2/
(t<-
0Gyz
4d<o
c[(g
@BkX
"x
%
q0L^r~J-&v
bpGg
f{/n
N(60&
xkh!
oJjr
~Snz
2`uO7
A%qdP{
Sfs6
%j:M-"
n]=PDVU
[&La
Wtiy
b4_{
qY$EZ
-n93
<itR'
]%_yd
h5fY
#R;^-
AC
P,
q(_a
8)QG
N3'?
=$ %
|{fu
Y,B`
0+mv
Z
Q7nE
iUVB=
E8>l
gfA)
oON0
;xwQ
VID4
-?Z5
KP
\r?zt
JgR`
mTM#w7I
\t?S&
~ 3E
NGJ-5
e)8(
,]eu0
N$<
tRlI
m6'%w
@[.c
)NVE6R0D1W;L
gGvB
nz+h}
Sp=y-
8zl@q
LcaW;
PDF>K
bfN'eO
[
&bk
9#UA
3T:w-
E`;5
Dg4mn
cQN|_
g9v<
w 3X"
'EXn
>2g~
4/I}
`v=]
8ceg[
x!w4
DiT9
UVa
^1p}?
oY.LS
O&~^
R-fQ
4yXUw
;>S&
u#X!
b}UE
k5*W
[^+5
x$fLJ
KbDZ
ASW
J
%n">l$h6
]Y4T2
!8*C
3^{7
b<5M
,6Kr
X~BxE
zRo^
9}pVE
{u5P
A?jm
|
,:
N-6C4
p5vB
3Q
&
)7T/
S2bR
(6ht
ayk-s
h=4C
xIvN
i(Bf
5\mOj
8tJq
mn^e
q6=h
[w1 M
pb 4,
JATj
$ Gl#E=
hK!
TRt~m
u[Fx
l %m
.JQ3
Ot`&?
l;qh
d8P:^=
U
1J
;^s!
Ocn@e7f
5q=kd
f1NLWiE
85xsg+
`
eh
{O}y
*cKz
@AT7
}q K?
<afV
kY,x\
wjKlf*
x#4n
padHL
>W.B
].`2
$[j^
l`7v
Kjt9i
T\Hg
5
bE82>|W
+6^P'M
d~T>
'Gm&a
r.[C0
0*ly
)2Gv
@#F`
s1E}
z!W(
Q{UD
pBy3
/%,8
{ger
=y,d
ghae
VT dv
L#D5t {
KhB<
}V@tR
"L\J
kdGD
}&`xBYE
Xb\1%l#
L|P
etFo[p
Xq_F)
N\i'
2HQ$
B$.d
(2,-
p"e@u
l!a
7J
1
*L.)
6mHh
0DYJw38M
0vb*=
QR-X
9We uh
I>NV
|p\-]
Z%z)
[\ F:8~
?@a #
\V'7
+h
F
#5\Y
v2!"
Zj y
SrgA
'F_^P
MH!1
^iqeP[
{A'*p
C]2'
TUsb<=.S
f-g
B
M\(
'A[8^
>pjW
%Un@H
:7Qe
a(bH
\;20
6M5s
)VwA
G!l02
"pj!
k?>N
}-T(9y
]^1+
pWZ:
qB @
yDu,
YupI
nc\;
7WMG _
~m:FL
2 RM
-\@:
s"q`
pKS }
c[.L
a;}-#
*=eK
/)_&
r<M]
UA83T
.)2i
=/7O
cVTj
ym~E1G
WP[w
u-+G
d1D,
@"F/>
c`{6I
2S~b"p
_j@f
kvgRym
KoZ*
4=]C
$K"|
E1)>
qVNl[2
"K2%
ImpR
z[0&
;Jy82NOT5
oFc%
]kJS
Wf|nTMC
KxE@
.g^L
5
qb
*g03
GfU\
+<vF
`d_8
7B;3
| (*
]xr6
P+j,
IR`5
&iX{
r Y8
?:/c<]
gMx<
Yqur
2
N\
=2&[
H
.f
7x=3g
&Wzu
2wi
1:O<
NAHU
PVz2Q
x7oG
dpEt
,~i
)0-.qk^f
Zao{
y,~;
5vxSX
&OsA
\t1R
>djF
DW'(
:O'B
cjX.
@x;Ry
fA
b
*4_&
P
D1k
#e!*
x^f
&p ;05
]KMoF
S!2A
%S Y8
,s'xv
&!E"
?hIlC
*zY
Hm8[D
}j?a
lCNE
y[u4
"Ma(^
z'_pC
)r!5
]g*sW
YU,?
e2K1
x>(s`
0,Ek
mq%X5
<jcO
W>pgw
,q%|P
uh(x
r>t7G
-$*a
@N)=
2cbS
`XHj
E$n0'O9
_|Q,
;GrNs
C=E\
9|:D
#7pjx!O'(
VH;0z
nQ*P2w
'i
)
g"HO
S%06
C#o!*
C62xO
d1RM
bpQu<`
%S!\
_,yD)?:
m|vuJI
4g x'
jp]M
]F$?
.xOi
b_W^
|#T?
a="e
]f~w
F3clo
ZjDL
z&ktFU|05
~J%]M
X"8 hi
eg(
yj86
axBI
Y({^
kPSh
Z@6[
3zO?
*!/C
jt
:
\AvT
7(Vi
Z, m
<KQj
M?lo#i
3pa0
NO?~4
Lq,Y&
@T[(
\?z9
.74A
F`R~y
jw}9
7E sv
A,=&bc
%GfWJ
1
'q
FS!8
Ny#>
T0;m|
\8L{h
5gpnN
cry-_
XMxD
#o _
Oq%r
H&t1
Z}p;
|3y#&
6~$e
%E'f
L1k/
M#TC
N,fiP
^eBm
lOp=W
cDag
2NG
]0vK_q
2l3"
6d}<
]N7.3n
t({J
'~
,!W)
H_bc
)'<l|"
G$g^
/brUc
.q~i
WK2p-
aF$
Z
fTp0OUdC
As
qn%
YJa2
:1[=
Muc"$5g|
`Dr,G
\e,(3
#c7K
U5&fn
PR?S
_xh%gO
3[
d
li4'
.-s(Z
.^dP_]T
1[a`n\L
4GH|
831C
B)b]
h*p7vq
[wRr
`A[Y$
#OWo
l{+K
iF1=
%G5q'
x_;7
8GAb
UR,o
iCe$
!S.>
L@Waz=
0OPVTB
&)yG
vo^R@
-D;$
Oq^T
mD+=
UO")
\4Rm
1#p5C
$Xg|N
_
3.>
(`,{
EgPi
(^j-
kX5\Z
"0|hBXi
"31C
RYa
w@g<
[~T'
_L|/
VF;eY E
i)JU
Pyk>
2r+"
(DbY
5#z9
}_Bn/s
NI;A
eY|g
2zeg\X
F,w}
3)(S
|I-U
Rf#E
2rJj]L5T
/a`A
tU
f
iDS7
["k'
xd#0%
HMy
$48PqJj
5Q@ p
t.Fxd8g
2S!3
`!4=
uN_d
"0<(
.wS:
= "g
en/s|
hZ*}#'
IA,q
!HTEi
%"HA
]zk,n
{S@>
vE6'
yNV|
)5C3*
P&7d4
Bq=3w
(zOs
,m'!
!%&',.012345689;<=>?@ABCEGHIKLMNOPQRSTUVX^_bcdfghjopvyz}~
#$()*+-/7:FJWYZ[\]`kqw{|
'8(8(
kernel32.dll
,LMp
18q8
pwo4
wo4h@s4jwo
mwoP
mwo8nwo
nwotowo
p }5p
pl}5px^
x5p
t0}5p
=pd7xo
z5p|x5p
As8]@s
<p`V
woX|
@u\,8
q@u q
/u('>u
/up)>u
q\,8
q@u qI
q\,8
q@u q
q\,8
q@u q
@u\,8
q@u q
q\,8
q@u q
q\,8
q@u q|
q\,8
q@u q
q\,8
q@u q
q\,8
@u q
q\,8
q@u q
q\,8
@u q
q\,8
q@u q
4G#
l*#
lc#
DG#
,g#
( #
u0Za
o\,8
pp
#p`v
pPk
oH pP
L#p d
% pHF#p
opQ#p
Q#p0B
: p0l
R#p
R#p@!
!p@< p
oP< p`C
op< p
< px= ppY
= p P
oD> pp
? pL@ p
@ pDA p
phR#p
C p`-
C p4D p
D p
o,E p
E pHF p
o@G p8
!p0t
H pHI p
I p
X#p`d
\#pTM#pPd
_ pXd
o$a p
o|g#p
f p@
oph p
ody p|y p
{ p0{ pT{ pp{ p
{ pD| p`| p|| p
} p0} pT} pp} p
} p0~ pP~ pp~ p
!p,E#p
oh\#ppg
o,3#p@3#p
oDS#p
o$T#p
W#p0
oP"#p<
pX~8
%8d2N
x^[
@_[
a[
`a[
0b[
pb[
(c[
`c[
p`[
H`[
q\,8
q@u q
xd[
XT#
o\,8
q\,8
q@u q@f
[ qP
q\,8
q@u q
q\,8
q@u q@f
[ qP
q\,8
q@u q@f
[ qP
q\,8
p@u q
q@u q
q@u q
npRh =
qUSVW
_^[]
npRh =
qUSVW
_^[]
npRh =
qUSVW
_^[]
h0
npRh =
qUSVW
_^[]
E.uRh =
qUSVW
_^[]
Rh =
qUSVW
_^[]
Rh =
qUSVW
_^[]
Rh =
qUSVW
_^[]
1oRh =
qUSVW
_^[]
1oRh =
qUSVW
_^[]
qUSVW
h$N0oh
jw]q
_^[]
0oRh =
qUSVW
_^[]
qUSVW
N0oh
_v]q
_^[]
0oRh =
qUSVW
_^[]
qUSVW
h<O0oh
_^[]
0oRh =
qUSVW
_^[]
qUSVW
O0oh
_^[]
0oRh =
qUSVW
_^[]
qUSVW
hTP0oh
_^[]
0oRh =
qUSVW
_^[]
qUSVW
P0oh
_^[]
0oRh =
qUSVW
_^[]
qUSVW
hXV0oh
kp]q
_^[]
0oRh =
qUSVW
_^[]
qUSVW
b0oh
to]q
_^[]
0oRh =
qUSVW
_^[]
qUSVW
hlQ0oh
_n]q
_^[]
0oRh =
qUSVW
_^[]
EV
i
qUSVW
Q0oh
_^[]
0oRh =
qUSVW
_^[]
EV
i
qUSVW
R0oh
_^[]
0oRh =
qUSVW
_^[]
qUSVW
S0oh
_^[]
0oRh =
qUSVW
_^[]
WEV
i
qUSVW
S0oh
_^[]
0oRh =
qUSVW
_^[]
qUSVW
h(T0oh
oh]q
_^[]
0oRh =
qUSVW
_^[]
EV1V
qUSVW
T0oh
+g]q
_^[]
0oRh =
qUSVW
_^[]
qUSVW
h@U0oh
_^[]
0oRh =
qUSVW
_^[]
qUSVW
U0oh
_^[]
0oRh =
qUSVW
_^[]
qUSVW
V0oh
_^[]
0oRh =
qUSVW
C~sq
_^[]
qUSVW
hpW0oh
_^[]
0oRh =
qUSVW
_^[]
qUSVW
W0oh
_^[]
0oRh =
qUSVW
_^[]
qUSVW
X0oh
k`]q
_^[]
0oRh =
qUSVW
_^[]
qUSVW
Y0oh
C_]q
_^[]
0oRh =
qUSVW
_^[]
qUSVW
Y0oh
+^]q
_^[]
0oRh =
qUSVW
_^[]
qUSVW
h,Z0oh
_^[]
}]]q^
]]q^
u\]q^
e\]q^
U\]q^
6\]q
*\]q
Z]q^
Z]q^
Z]q^
Z]q^
Z]q^
jZ]q
^Z]q
RZ]q
FZ]q
:Z]q
.Z]q
"Z]q
Z]q
Y]q^
qj]q
aj]q
Qj]q
Aj]q
1j]q
!j]q
qi]q
ai]q
Qi]q
Ai]q
1i]q
!i]q
U]q^
U]q^
qh]q
ah]q
Qh]q
Ah]q
1h]q
T]q^
}T]q^
T]q
S]q^
}S]q^
9t9x9|9
&ks0
&ks0
4x#u
4x#u
4x#u
T%=o
T%=o
T%=o
T%=o
iR1s
9Tm
q
MS1s
YS1s
9\y#u
9@C
q
?
cq
o
cq
/ cq
pL':
D
q
p(':
D
q
q@u q
q`}Mq
~MqPW
qD~Mqp~Mq
Mq0[
@0
q
][q^
][q^
;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;
@K q0
P*
q
-
q
9P*
q
9l7
q
9Tm
q
9Tm
q
9P*
q
9<F
q
9@C
q
9@C
q
9hX
q
9hW
q
9De
q
9XC
q
9De
q
/
aq
_
aq
o aq
%?9t
P$1t
>(1t
!This program cannot be run in DOS mode.
$
Rich
.text
`.rdata
@.data
.rsrc
QRPV
QRPV
9|$
\$ S
][_^
Rj@S
WVue
T$0VR
PQUV
Rj@j
D$$VP
VWP3
:
uF
:
uF
SUVW
_^][
t>%F
_^][
_^][
D$3UV
D$(W
D$4x
D$5a
D$>f
D$A3
D$Dt
D$9b
u
hW
}
hW
u
hW
t:;L$
u
hW
}
hW
u
hW
t:;L$
PGWS
WPWUj
VPWUj
_^][
VPWUj
jjjj
VPWUj
_^][
QRVW
}3@u
E#+E/_^ZY
}3@u
}3@u%
}3@u&
}3@u
}3@u
}3@u
}3@u
}3@u
}3@u
}3@u
<nt
<ot
^[_]
PVRQ
_^][
vUUVW
_^][
QSUW
^_]3
t6W3
W4SV
D$ V
+G4t
^[_3
D$DS
\$Dj8
L$Th
A0SUP
V8WUR
_^]3
J#T$
V(SU
O0PQ
9F sn
O0PQ
9V r
V ;Q
W0QR
W0QR
][_3
u!;\$
][_^
N$RP
V0WQR
N0WPQ
WlSU
Wt9T$
P;D$
~<+~t
FD)np)nl
O0SPQ
G0SRP
_^[H
Nl#N4
Vlf+Vp
Nl#N4
_^]3
_^][H
_^][
QSUV
Nl#N4
Vl+Vp
Vlf+Vd
Fxf+
#V43
Nl#N4
_^]3
_^][H
_^][
tr9_ tm9_$th
|$$8
9O u
O(9O$u
D$ H
G Vh
W PQ
T$(W
^[_]
~\wuJ
FHQh
NDPh
F\<wu
<ru
y\ru2
t*9Qlu%
FHQh
)Nd)Vh
FLWUP
NHPWj
FhQV
F8^[
~\ruK
FDWWW
FL9~Xu V
V@WQR
x\ru
x\ru
~\wu(j
CP_^][
XSU3
9\$h
5<fu
'<hu
<Ru
T$h9T$
t:<wuE
^_]3
9^Dt
D$p;
T$pR
~\wu
^_][
^_][
t.9Vlt)
FDRh
)Vd)Nh
;FLuK
N@QPj
][_^
][_+
F<
u
~\wW
FDPV
Fd_^
FHPV
Fh_^
9^ u
^(9^$u
V h0%
u
_^]
D$@QP
)D$
D$$)G@
;O\r
GTPQ
GpPj
WhHf
G`9Gh
G`QP
GpPj
GXPQ
TOpRj
w<9G,s
t$,PV
OLH#
T$<PQR
GHtV;
;wHr
GHtR;
;wHr
G(9G,
D$@QP
L$$;
L$$A
L$$u
L$<P
G4PQ
<SUVW
+T$TN
T$HH
L$ #
D$Tt*;
T$$#
L$$J#
+D$8
;l$<
D$DI
D$(+
;l$T
)l$T
T$(+
;l$TsY)l$T
L$4;D$Ts<)D$T
;l$Ts
)l$T
;t$,
L$P+
D$,+
x<_^]
p<O#|$
x8_3
9~ u
~(9~$u
N h0%
9n4u'
9n(u
F(+{
V4P+
F,^3
V0U+
N4W+
V,^3
N,_^3
;O$v
+T$
T$4P
O@;H s
O@;H(s
T$$QUR
D$ )D$
)D$$
Oh;O\sN
;O\r
9Ghs%
Gh9Ghr
GTPQ
GpPj
G`9Gh
OLH#
L$,;
L$,J
L$,uL
L$,J
L$,J
G`9Gh
GTPQ
WpRj
GXPQ
TOpRj
L$ H#
L$,J
L$ E
D$ ;
;wHr
L$ H#
L$,J
L$ E
D$ ;
;wHr
O,+L$
L$(9ODv
L$(+L$
L$4;
L$$+
L$4+
D$(+D$
^][_
w<^]
T$(;P
l$8+n
\$(+^
D$0^][_
F$QR
>
u%j
t
_]^
V4W+
~,_]
vCSU
@;D$
9{<s
A9{<s
t
^_]
QSVW
N(Uh0%
F$UR
]_^3
D$`3
LLH@;
TTl@;
D$4`
T$83
T$,*
T$4f
D$<+
DTLf
u";T$
t$@#
t$H;t$8
~
BA
D$<u
L$ +
T$8f
D$@#
;D$8t
SUVW
;T$$f
|$(f
L$,f
;L$$
l$,f
t$ J
_^][
SUVW
_^][
T$$f
)l$
_^][
_^]I
tx+4
t$$f
\$ f
~6f9
@;D$
~gSV
SVWf
|$ WSPV
@PAQBR
T$<W
|$Dj8
=L9B
5L9B
t VP
5L9B
SSSSS
_^[]
5`9B
95h9B
5`9B
<8=u
VVVVV
wIVSP
5L9B
5L9B
FVSj
5L9B
SVW3
t$9}
WWWWW
t)9u
VVVVV
VVVVV
t!9}
WWWW
VVVV
PPPPP
t79u
t29u
VVVVV
j
X]
WWWWW
_^[]
WWWWW
SSSSS
SSSSS
~,WPV
98t^
tVPV
t/9U
VVVVV
WWWWW
@uwV
WWWWW
9^$u
t
SSSSS
_^[]
8VVVVV
SSSSS
VVVVV
WWWWW
SSSSS
5X9B
5T9B
t&:a
ueSj
5L9B
5L9B
5L9B
5L9B
@_^[
VW}
j?^;
%H9B
Y__^[
9csm
5d#B
=0"B
t
VVVVV
u&h`
PPPPP
<v8V
VVVVV
t
VVVVV
t
VVVVV
=0"B
oV f
o^0f
of@f
onPf
ov`f
o~pf
WWWWW
uaVj
5L9B
uL9=
WWWWW
5L9B
QSVW
SSSSS
SSSSS
QQSV3
=h9B
VVVVj
tCVV
0SSSSS
_^[]
@A;E
WWWWW
@uwV
WWWWW
=x9B
VVVVV
VVVVV
t)j
XP
j
[f
j
[f
VVhU
WWWWW
VVVVV
WWWWW
SSSSS
SSSSS
tl9]
tC9]
%
u$
8
u
AA
Ht$C
CC@@
9
u
Ht(f
j
Xf
j
Xf
CC+]
VVVVV
0WWWWW
X_^]
teh=8A
WWWWW
PPPPP
@u^V
, <Xw
t%HHt
HHtXHHt
HHty+
RPSW
90tV
>If90t
WSj0
WSj
SSSSS
WWWWW
jTh(
j@j ^V
[j@j
u,9E
u,9E
_^[]
0SSSSS
<at9<rt,<wt
SSSSS
tVHtG
tEHt1
uF }
u' }
>=upF
SSSSS
URPQQh
L$,3
UVWS
[_^]
SVWj
_^[]
8csm
S99t
=`9B
>=Yt1j
tNVSP
PPPPP
Y[_^
5`9B
%`9B
>"u&
< tK< tG
5p9B
5X9B
xu
j
@@f9
@@f9
SSS+
@PWSS
t!SS
t
@8
_^[]
Y_^[
Y_^[
5 >B
t+Ht
PPPPP
=<>B
5L>B
5<>B
0SSSSS
BF:
_^[]
VVVVV
;5 -B
5 -B
0A@@Ju
95P>B
ET>B
5 -B
=@/B
Y_^[]
_^[]
Fpt"
SVW3
t{~Bj
t1SW
SSSSS
SSSSS
5`9B
SSSSS
tSj=V
u`9]
5`9B
Y|R9
?sjj
5`9B
5`9B
@Y@P
t\VV
@Y@PW
t
SSSSS
WWWWW
WWWWW
VVVVV
=D0B
D0B
~%9M
QVj
r 8^
=0"B
VW|[;
=0"B
_^[]
VVVVV
u6j
u9j
j@j
^SSSSS
j"^SSSSS
QSWVj
v N+D$
t
SSSSS
tGHt.Ht&
^SSSSS
;t0;
P9B
8VVVVV
t(9u
SSSSS
SSSSS
ti9]
6f;p
r0f;p
tH9]
6f;H
r0f;H
u!f;
t 9]
SSSSS
SSSSS
tA9]
t_8]
t 9]
SVWUj
]_^[
;t$,v-
UQPXY]Y[
-|?B
u8SS3
9] u
9]$SS
t)9]
t"SS9]
9] u
xu
j
9] SS
v$;5$0B
PPPPPPPP
tR:Q
t<:Q
t&:Q
PPPPPPPP
WWWWV
t<Vj
t+WWVPV
VW9]
SSSSS
SSSSS
95l>B
u99u
VVVVV
t
SSSSS
_^[]
SSSSS
t
@f
SVW3
_^[u
VVVVV
WWWWW
<xt
<Xt
u+9u
^_[3
cw_Caw"
awKZaw
awPIaw
ZawYYawLYaw
\iw_scw
Saw\?aw
4awV
4aw&
w-Jaw
aw/wcw
aw]Jaw
{kw(
aw15aw
Qaw%
aw 5aw
DawZ<aw
;aw1
zcwOEiw
Delete
NoRemove
ForceRemove
CreateFileW
CreateFileA
GetModuleHandleA
GetModuleHandleW
GetModuleFileNameA
kernel32.dll
GetModuleFileNameW
mscorlib.dll
1.2.3
n;^
Qkkbal
3_L
>jm
i]Wb
9a&g
MGiI
wn>Jj
#.zf
+o*7
Z* ,
H$6t
52F*
#jT$
=G\
^6o}
[-&LMb#{'
)q
>(
w+OQvr
}!b
R1h58
SKyu
)\ZEo^m/
ru&o
i8P/
?(3w
wXR
H*0"ZOW
{kHw
)T`D
!AxU
l!;b F
:1X:
y9*O
kM`~
Vc0a
dQy/
lDa>
7~8A
C-Yn
gqr<
$/o|
f-=v
mj>zjZ
l6qnk
IiGM>nw
1A26b
i91k
ewh/?y
*5KS
6~_'
F*.f
1wsHp
M8MF
Pe6^
#bML"
`F(>
q-q
vQO+t
[h1R
XsBI
hPU3
^oEZ_
2%k_
w3Xc
[
;g
/P8i
OZw3(?
Z"0*
fP~V
^GP~
b;!l
V_:X1:
NJ2"v
O*9y]
fu`z
/yQA
&]|v
1.2.3
#+3;CScs
!1Aa
bad allocation
Visual C++ CRT: Not enough memory to complete call to strerror.
CorExitProcess
mscoree.dll
runtime error
TLOSS error
SING error
DOMAIN error
R6034
An application has made an attempt to load the C runtime library incorrectly.
Please contact the application's support team for more information.
R6033
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
R6032
- not enough space for locale information
R6031
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
R6030
- CRT not initialized
R6028
- unable to initialize heap
R6027
- not enough space for lowio initialization
R6026
- not enough space for stdio initialization
R6025
- pure virtual function call
R6024
- not enough space for _onexit/atexit table
R6019
- unable to open console device
R6018
- unexpected heap error
R6017
- unexpected multithread lock error
R6016
- not enough space for thread data
This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
R6009
- not enough space for environment
R6008
- not enough space for arguments
R6002
- floating point support not loaded
Microsoft Visual C++ Runtime Library
<program name unknown>
Runtime Error!
Program:
Unknown exception
EncodePointer
KERNEL32.DLL
DecodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
(null)
(null)
( 8PX
700WP
`h````
xpxxxx
Illegal byte sequence
Directory not empty
Function not implemented
No locks available
Filename too long
Resource deadlock avoided
Result too large
Domain error
Broken pipe
Too many links
Read-only file system
Invalid seek
No space left on device
File too large
Inappropriate I/O control operation
Too many open files
Too many open files in system
Invalid argument
Is a directory
Not a directory
No such device
Improper link
File exists
Resource device
Unknown error
Bad address
Permission denied
Not enough space
Resource temporarily unavailable
No child processes
Bad file descriptor
Exec format error
Arg list too long
No such device or address
Input/output error
Interrupted function call
No such process
No such file or directory
Operation not permitted
No error
UTF-8
UTF-16LE
UNICODE
Complete Object Locator'
Class Hierarchy Descriptor'
Base Class Array'
Base Class Descriptor at (
Type Descriptor'
`local static thread guard'
`managed vector copy constructor iterator'
`vector vbase copy constructor iterator'
`vector copy constructor iterator'
`dynamic atexit destructor for '
`dynamic initializer for '
`eh vector vbase copy constructor iterator'
`eh vector copy constructor iterator'
`managed vector destructor iterator'
`managed vector constructor iterator'
`placement delete[] closure'
`placement delete closure'
`omni callsig'
delete[]
new[]
`local vftable constructor closure'
`local vftable'
`RTTI
`udt returning'
`copy constructor closure'
`eh vector vbase constructor iterator'
`eh vector destructor iterator'
`eh vector constructor iterator'
`virtual displacement map'
`vector vbase constructor iterator'
`vector destructor iterator'
`vector constructor iterator'
`scalar deleting destructor'
`default constructor closure'
`vector deleting destructor'
`vbase destructor'
`string'
`local static guard'
`typeof'
`vcall'
`vbtable'
`vftable'
operator
delete
new
__unaligned
__restrict
__ptr64
__clrcall
__fastcall
__thiscall
__stdcall
__pascal
__cdecl
__based(
B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
GetProcessWindowStation
GetUserObjectInformationA
GetLastActivePopup
GetActiveWindow
MessageBoxA
USER32.DLL
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
((((( H
h(((( H
H
!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
July
June
April
March
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
CONOUT$
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
('8PW
700PP
`h`hhh
xppwpp
RSDS
RaiseException
GetLastError
IsBadReadPtr
VirtualProtect
GetProcAddress
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
lstrlenW
GetModuleFileNameW
GetModuleFileNameA
LoadLibraryA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
Module32Next
CloseHandle
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
CreateFileA
CreateFileW
GetModuleHandleW
VirtualAlloc
VirtualFree
HeapFree
GetProcessHeap
FreeLibrary
HeapAlloc
KERNEL32.dll
HeapReAlloc
GetCommandLineA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapCreate
Sleep
ExitProcess
WriteFile
GetStdHandle
HeapSize
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetConsoleCP
GetConsoleMode
ReadFile
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
FlushFileBuffers
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
RtlUnwind
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CompareStringA
CompareStringW
SetEnvironmentVariableA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetEndOfFile
.?AVtype_info@@
.?AVbad_alloc@std@@
.?AVexception@std@@
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
C:\Users\Bill\Desktop\30% tt Slip.exe
C:\Users\Bill\Desktop\30% tt Slip.exe
C:\Users\Bill\Desktop\30% tt Slip.exe
wwwwwwwwwwwwww
wwwwwwwwwwwwww
wwwwwwwwwwwwww
wwwwwwwwwwwwww
wwwwwwwwwwwwww
wwwwwwwwwwwwww
wwwwwwwwwwwwww
wwwwwwwwwwwwww
wwwwww
wwwwww
wwwwww
wwwwww
PNG
IHDR
pHYs
IDATx
IEND
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
FileDescription
Phulli
FileVersion
1.0.0.0
InternalName
Phulli.exe
LegalCopyright
Copyright
2014
OriginalFilename
Phulli.exe
ProductName
Phulli
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
v'1t
{%5t
`T3t
>(1t
0 @
P `
JJVVVVdd
pp~~
0 @
P `
PPPPPPPPPPPPPPPP
00000000000000000000000000000000000000
00000000000000000000000000000000000000000000000
:D3u
U3u$R3u1\3u
jb;
(!o,
l@VK
user32.dll
42)Ry
42)Ry
advapi32.dll
gdi32.dll
[(`!
l*+p
mscoree.dll
ws2_32.dll
Els{Dls
lGhs)
Fhs)
Fhs)
Fhs)
\Mhs)
`Ghs)
xGhs)
Ghs)
Mhs)
Ghs)
Ghs)
`#lp)
T#lp)
Advapi32.dll
Kernel32
kernel32
uxtheme.dll
52)Ry
&Y<`
u$h=
t7&x
22)Ry
[(`!
l*+p
:/b
#9J0
"iz0
"9:0
"i:`
"9:0
"Y:0
bcrypt.dll
"J;0
O++6E++4
"i:0
#
0
"z{0
O+[6e+[7E+[4
shfolder.dll
22)Ry
72)Ry
[(`!
l*+p
:\b=
,2"
"*Lp\
gdiplus.dll
ole32.dll
#
,`<
FHD$
p
&t
;\`l
00
<4
H"BL
%9>`
iphlpapi.dll
CN
N
rasapi32.dll
winhttp.dll
6sp)
]c3o
d3o8
2 <
K$H4
T
X
oleaut32.dll
2
K$H4
T
X
8
0<
52)Ry
30$
$("w,
I@VK
P(iT
'Y[p{
'
[p{
s@
fD
HL
;P
.T
!X
psapi.dll
user32
2j2
4P$L$
/l& p
M
08
M
08
H
08
H
08
i,`L
i^`n
T$8A
K
M
ntdll.dll
\ J`
N@N
!:/2
}R )"%
mR>r
!:/2
}R )"%
!Y}`
:$H;
<(1o4(1o$(1o
'Y[pk
Actx
SsHd,
C:\Windows\Microsoft.NET\Framework\v2.0.50727\
mscorjit,processorArchitecture="X86",publicKeyToken="000000000000000",type="win32",version="1.0.0.0"C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
Microsoft.VC80.CRT
`+v*
Microsoft.VC80.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.4940"C:\Windows\WinSxS\manifests\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc.manifest
x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc
SsHd,
msvcr80.dll
msvcp80.dll
msvcm80.dll
GsHd(
GsHd(
GsHd(
GsHd(
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
Q)u
Y
[^_]
q86P
qK
qK
x2.uG
p\,8
2.uL
X";u
q\TP
X";u
qK
p\,8
p\,8
94
q
!This program cannot be run in DOS mode.
$
.text
`.sdata
.rsrc
@.reloc
z(?
PA(W
p
(?
p
(?
(?
|
.
&8I
&(?
2)
R)
|)
h>
B@
p@
.A
(
$I
@[(+
@[(+
9
8S
<T
DT
rT
9
(J
XGR
XGR
XGR
XGR
XGR
XGR
XGR
XGR
i
*
*N8
(
*"8
BSJB
v2.0.50727
#Strings
#GUlD
#Blop
#GUID
#Blob
#'3'
;4P4
+ n
o%2
%A
#
&O
(
)&f
I&T
(
`&\
(
|&\
(
&u
(
.)C
J)M
d)V
t&b
,
C
u
Phulli
AssemblyCompanyAttribute
System.Reflection
mscorlib
.ctor
Void
System
String
CompilationRelaxationsAttribute
System.Runtime.CompilerServices
Int32
AssemblyTrademarkAttribute
AssemblyProductAttribute
ComVisibleAttribute
System.Runtime.InteropServices
Boolean
AssemblyCopyrightAttribute
AssemblyDescriptionAttribute
RuntimeCompatibilityAttribute
AssemblyFileVersionAttribute
AssemblyTitleAttribute
GuidAttribute
DebuggableAttribute
System.Diagnostics
DebuggingModes
SuppressIldasmAttribute
AssemblyDelaySignAttribute
AssemblyKeyNameAttribute
AssemblyConfigurationAttribute
a266636f-c5a6-425b-9627-636431603b90
Phulli.exe
<Module>
SfptLyMpi00lq7NX7l
nKq9VxkQIiUq5Du51P
X0seuGqTImZH7ff63A
CIaSGI7qhSkLM9V05K
Object
rZdJFvZrRcmjMqUttS
MXnYKyr5JvoHKgV1W0
WindowsFormsApplicationBase
Microsoft.VisualBasic.ApplicationServices
Microsoft.VisualBasic
KDEa7KtwJiKYye1EQv
wMparF4P3xMCCm3YjH
Computer
Microsoft.VisualBasic.Devices
VcbPNav7dYxjFeBTU6
PEN1Mx5QM0LjNOLhoA
VIfOxswrOlv2THKo0g
oe7U9o24Zs3A70OTNS
RIU1c4X6RZ4dXcsjPB`1
Form1
Form
System.Windows.Forms
KBDLLHOOKSTRUCT
ValueType
virtualKey
Enum
TwPmToTef2J15W8fkJ
MulticastDelegate
RQbQFTcXsBH8Xe6mjY
Ud1JbDj065O4qKOCro
NativeWindow
NBqvghWrfp2fwy3nPN
Resources
Phulli.My.Resources
MySettings
Phulli.My
ApplicationSettingsBase
System.Configuration
MySettingsProperty
RunPE
<Module>{CE74107C-822F-4AD1-BC35-4777EE54F52E}
Tth14TuNdaQo23oV29
FENkdyhlpXQb8j2hfl
SFU4mbT3GMret7THonf
PEHHGUoM4osXP9cT59
FZIKnXF6uIkiix2XfV
HUkFs1VieKEV19D6sc
Attribute
cXnXyVnQTDMlgx8DbC`1
E0ygvfyFOpQSnWuCV2
FrvPfmfM9ZthCrC564
RXZZlj9TMWiRM2WBps
nbUkRuJsbYV3UMt60H
XkSFOERW23piJnJ6nC
WKTdD2sS0kU6rMWYSJ
daArXFKf3U2N47MHmb
<PrivateImplementationDetails>{D2EF727A-1CFB-46EC-A65F-D14E122650CF}
__StaticArrayInitTypeSize=32
__StaticArrayInitTypeSize=16
__StaticArrayInitTypeSize=64
__StaticArrayInitTypeSize=18
__StaticArrayInitTypeSize=15
i4saGXhho
List`1
System.Collections.Generic
WeakReference
.cctor
NC9SwW3QF
Monitor
System.Threading
Enter
get_Count
get_Capacity
get_Item
get_IsAlive
set_Item
RemoveRange
set_Capacity
RuntimeHelpers
GetObjectValue
Exit
qgkGbnaN0
get_UseCompatibleTextRendering
Application
SetCompatibleTextRenderingDefault
AuthenticationMode
set_IsSingleInstance
set_EnableVisualStyles
set_SaveMySettingsOnExit
set_ShutdownStyle
ShutdownMode
OnCreateMainForm
set_MainForm
aIxmmE0o4
TgEsNh4dY
LxIULjkM1
User
Jei9sqvCn
EYxvpnkAH
BJtBIjMRu
rtR2Blij1
sSA7rbTAl
hpj1qnGWM
M3DcmZy6k
pp7Qsa2s6
MSpwx2YXt
htmWFsoeM
cmBFQFcTt
GPYhVXElA
IL2xmDNw9
Su1pDW5Qe
nglf9naFY
Hashtable
System.Collections
fM1YtC96m
ExXoRD8gZ
ArgumentException
A23OmMUPY
Instance
TargetInvocationException
Control
get_IsDisposed
Type
GetTypeFromHandle
RuntimeTypeHandle
ContainsKey
Utils
Microsoft.VisualBasic.CompilerServices
GetResourceString
InvalidOperationException
Activator
CreateInstance
ProjectData
SetProjectError
Exception
get_InnerException
get_Message
ClearProjectError
Remove
iZPKdxB6l
Component
System.ComponentModel
Dispose
Equals
GetHashCode
JCLRUiMuU
ToString
jtxED9NwD
E40iN4cNY
instance
nMgMBxmn3
lV20eQcFh
jXSd4evbg
MNJD3Vd09
IContainer
TLOeWEwdV
wI5PiPvrg
pKdb7pfin
Sm7rh6w50
FhbjVGbhy
cbI8kTQsJ
QyjqWAXEu
UtRLHQ5SW
xoJzCmxyk
KAbST7Bo7F
LuaSSbIuS7
UV4SGX0Kry
CSHSa7tBl7
UcySBiBclR
vMoSwiJUc2
l7YS7T0eFT
d2ESWvRxUj
QgnS1IHmUZ
GJESFcBgB9
jJiSc2sBhX
m6PShGg0OH
Y2GSQTMVGm
lATSxfMTuS
EgQSmk7Q7W
q6XSsN3nl8
KwnSUG69cM
emCS97cs6o
XF9Sv9Y4M9
iJwSO2idwv
FXMSK8cDpR
oHkSR9BDtN
QU4SYwdKaV
FlKSoseyML
tnHSptoJsu
UqnSfielWv
jgWSEfl6S9
LSWSiNZbVT
LBDSMGgg0X
GO4S2e0h70
Ro2SVCKQZO
voXS01wfXj
M3BSuYm9PJ
ukrSAg0fPC
EghSJNlXYF
MMaSncgcXk
v6DSgCbra1
fqAS39ohYP
zQ3SZgcJCa
vJ7SNwZFF9
zHeStpoXbG
xtiSIYJV6d
K9bSl4IhIP
wuES4XJ2i7
v8wS5FJEhj
wnQSyfuyBS
grfSH9hDbt
mCaSXrEHWk
wDtS6QYpMi
X8USC9RtFr
LRnSk6gyxn
Int16
yGASdpsysY
z5PSDBfF3C
WiQSe2gMtO
IntPtr
pEqSPqEC4j
U0qSb6A9kG
KeyLog
iG9SrJsrNa
iQnSjMNbA7
Byte
HgrS8wF0sp
cAaSqqjRvY
gT4SLBD4ji
uxSSzEM4Z0
jdbGT6vWZ3
y7bGSpGqjH
EhlGGGL5gB
AOSGaMFcJs
Char
EventHandler
add_Load
Path
System.IO
GetTempPath
Environment
GetFolderPath
SpecialFolder
Concat
get_ExecutablePath
GetFileName
Empty
op_Explicit
WindowsIdentity
System.Security.Principal
GetCurrent
get_Name
Split
TTXuiafcI
disposing
IDisposable
XBDA8shKm
SizeF
System.Drawing
Size
SuspendLayout
Single
ContainerControl
set_AutoScaleDimensions
set_AutoScaleMode
AutoScaleMode
set_ClientSize
set_FormBorderStyle
FormBorderStyle
set_MaximizeBox
set_MinimizeBox
set_Name
set_Opacity
Double
set_ShowIcon
set_ShowInTaskbar
set_WindowState
FormWindowState
ResumeLayout
MSpaDx2YXt
sSAaerbTAl
WithEventsValue
UnhookWindowsHookEx
hHook
user32
qWDJcUNHW
SetWindowsHookExA
XFTn1dFx9
GetAsyncKeyState
a5Lg4QCAw
CallNextHookEx
r4v3QFqoa
Int64
lineSetAppSpecific
tapi32.dll
RIWZInkQE
MgmGetNextMfeStats
rtm.dll
vc4NNLnII
GetForegroundWindow
user32.dll
d0VtjL9L0
GetWindowTextA
GetActiveWindowTitle
Strings
InStr
CompareMethod
Substring
ws3I5Ahei
op_Inequality
HookKeyboard
Process
GetCurrentProcess
get_MainModule
ProcessModule
get_BaseAddress
UnhookKeyboard
Conversions
ToBoolean
KeyboardCallback
Code
wParam
lParam
DateTime
Operators
ConditionalCompareObjectNotEqual
ConcatenateObject
DateAndTime
get_Now
get_Keyboard
Keyboard
get_CtrlKeyDown
get_AltKeyDown
ChrW
CompareString
ToUpper
get_CapsLock
EndsWith
get_Length
ToInteger
WOilHBPks
ProcessStartInfo
set_UseShellExecute
get_CurrentDirectory
set_WorkingDirectory
set_FileName
set_Verb
Start
EndApp
HXC4QZuxi
EventArgs
Thread
IEnumerator`1
Sleep
File
Exists
Delete
WriteAllText
Copy
ServerComputer
get_FileSystem
FileSystemProxy
Microsoft.VisualBasic.MyServices
ReadAllText
DeleteFile
get_Id
ThreadStart
SetApartmentState
ApartmentState
Trim
IsNullOrEmpty
Convert
FromBase64String
WriteAllBytes
get_Network
Network
DownloadFile
Directory
GetFiles
GetDirectories
ReadOnlyCollection`1
System.Collections.ObjectModel
GetEnumerator
get_Current
Contains
IEnumerator
MoveNext
get_NewLine
AppendAllText
Interaction
MsgBox
MsgBoxResult
MsgBoxStyle
ForceSteamLogin
GetProcessesByName
Kill
hZC5ynCgq
MethodInfo
Assembly
Load
get_EntryPoint
IsConnectedToInternet
NetworkInterface
System.Net.NetworkInformation
GetAllNetworkInterfaces
get_NetworkInterfaceType
NetworkInterfaceType
get_OperationalStatus
OperationalStatus
Foldersinstall
FakemsgInstall
MessageBox
Show
DialogResult
MessageBoxButtons
MessageBoxIcon
ServerInstall
MailMessage
System.Net.Mail
SmtpClient
ToDouble
Replace
get_Clock
Clock
get_LocalTime
get_Info
ComputerInfo
get_InstalledUICulture
CultureInfo
System.Globalization
get_OSFullName
MailAddress
set_From
get_To
MailAddressCollection
set_Subject
set_Body
set_Port
set_EnableSsl
NetworkCredential
System.Net
set_Credentials
ICredentialsByHost
Send
unHide
get_Registry
RegistryProxy
SetValue
RegistryValueKind
Microsoft.Win32
TiFyBTiyW
DirectoryInfo
FileSystemInfo
set_Attributes
FileAttributes
Spread
DriveInfo
StreamWriter
GetDrives
get_DriveType
DriveType
TextWriter
WriteLine
Close
SetAttributes
addtostartup
RegistryKey
FileSystem
FileCopy
Registry
CurrentUser
OpenSubKey
DES_Decrypt
input
pass
DESCryptoServiceProvider
System.Security.Cryptography
MD5CryptoServiceProvider
ICryptoTransform
Encoding
System.Text
get_Unicode
GetBytes
HashAlgorithm
ComputeHash
Array
set_Key
SymmetricAlgorithm
set_Mode
CipherMode
CreateDecryptor
TransformFinalBlock
GetString
olddesdc
get_ASCII
NewLateBinding
LateGet
ChangeType
StartStealers
Environ
stealMail
LateCall
stealWebroswers
get_Version
Version
get_OSPlatform
get_OSVersion
VbfHmdY3T
WebClient
StreamReader
Stream
OpenRead
ReadToEnd
CwMXsB1in
FileStream
DoEvents
Pins
get_Attachments
AttachmentCollection
Attachment
Collection`1
Bitcoinsub
DecompressString
compressedText
MemoryStream
GZipStream
System.IO.Compression
BitConverter
ToInt32
Write
set_Position
CompressionMode
Read
get_UTF8
Minecraftsub
Disabler
GetProcesses
get_ProcessName
SendLogs
Graphics
Bitmap
Rectangle
Point
CreateDirectory
get_Screen
Screen
get_Bounds
get_Width
get_Height
FromImage
Image
CopyFromScreen
Save
SendLogsFTP
UploadFTP
Filename
Data
FtpWebRequest
BinaryWriter
WebRequest
Create
ICredentials
set_Method
GetRequestStream
ReadAllBytes
SendLogsPHP
UploadPHP
DownloadString
MWT6RSGIk
get_TimeOfDay
get_Clipboard
ClipboardProxy
GetText
AES_Decrypt
RijndaelManaged
Decrypt
encryptedBytes
secretKey
CryptoStream
CryptoStreamMode
L8wCc1hRC
Rfc2898DeriveBytes
set_KeySize
get_BlockSize
Math
Round
set_IV
get_KeySize
set_Padding
PaddingMode
seekanddestroy
process__1
GetInternalIP
IPAddress
GetHostName
GetHostEntry
IPHostEntry
get_AddressList
get_AddressFamily
AddressFamily
System.Net.Sockets
GetExternalIP
GetBetween
Source
Before
After
IndexOf
GetAntiVirus
ManagementObjectCollection
System.Management
ManagementObjectSearcher
ManagementObject
ManagementObjectEnumerator
get_MachineName
ManagementBaseObject
GetFirewall
d9bkR4Kts
ManagementClass
GetInstances
get_Properties
PropertyDataCollection
PropertyData
get_Value
vkCode
scanCode
flags
time
dwExtraInfo
value__
K_Return
K_Backspace
K_Space
K_Tab
K_Esc
K_Control
K_LControl
K_RControl
K_Delete
K_End
K_Home
K_Insert
K_Shift
K_LShift
K_RShift
K_Pause
K_PrintScreen
K_LWin
K_RWin
K_Alt
K_LAlt
K_RAlt
K_NumLock
K_CapsLock
K_Up
K_Down
K_Right
K_Left
K_F1
K_F2
K_F3
K_F4
K_F5
K_F6
K_F7
K_F8
K_F9
K_F10
K_F11
K_F12
K_F13
K_F14
K_F15
K_F16
K_F17
K_F18
K_F19
K_F20
K_F21
K_F22
K_F23
K_F24
K_Numpad0
K_Numpad1
K_Numpad2
K_Numpad3
K_Numpad4
K_Numpad5
K_Numpad6
K_Numpad7
K_Numpad8
K_Numpad9
K_Num_Add
K_Num_Divide
K_Num_Multiply
K_Num_Subtract
K_Num_Decimal
K_Subtract
K_Decimal
BeginInvoke
IAsyncResult
AsyncCallback
DelegateCallback
DelegateAsyncState
EndInvoke
DelegateAsyncResult
Invoke
aO0GmOhEL3
fcNGsootR5
WmbGUdShtP
oEjGBFxO5A
cCkGwFpqua
SetClipboardViewer
RG6G7hS7Ov
ChangeClipboardChain
qpUGWrsycA
SendMessage
zfXGcHYLj7
Delegate
Combine
rdiGQE3NBB
CreateParams
CreateHandle
Ge0G1gssS5
get_Handle
iThGFZ8NwT
WndProc
Message
get_Msg
get_WParam
get_LParam
op_Equality
Finalize
A1JGxHbNgw
sender
resourceMan
ResourceManager
System.Resources
resourceCulture
get_ResourceManager
ReferenceEquals
get_Assembly
get_Culture
set_Culture
Value
get_CMemoryExecute
GetObject
get_mailpv
get_WebBrowserPassView
Culture
CMemoryExecute
mailpv
WebBrowserPassView
defaultInstance
addedHandler
addedHandlerLockObject
SettingsBase
Synchronized
AutoSaveSettings
get_SaveMySettingsOnExit
get_Default
ObjectFlowControl
CheckForSyncLockOnValueType
ShutdownEventHandler
add_Shutdown
Default
get_Settings
Settings
LM8G9BFwu7
WriteProcessMemory
kernel32
akAGvm2SEr
VirtualProtectEx
ax2GOYR9af
VirtualAllocEx
AQ2GKFloQq
UInt32
SetThreadContext
ExbGRSJm1i
ResumeThread
sosGYtVHNT
ReadProcessMemory
RXKGoF98i9
NtUnmapViewOfSection
ntdll
xyEGpmA1yB
GetThreadContext
Hr7GfiBuLF
StringBuilder
CreateProcessA
data
GetEntryAssembly
get_Location
get_SystemDirectory
get_Chars
GetRandomFileName
ChangeExtension
GetDirectoryName
ToInt16
Buffer
BlockCopy
C4cGEWt59m
Module
N0sm6WrreuGTI
typemdt
FieldInfo
ResolveType
GetFields
MemberInfo
get_MetadataToken
ResolveMethod
MethodBase
CreateDelegate
get_ManifestModule
object
method
callback
result
peNGL8iRuY
XesaTxuYDR
vmiaGudbmY
cZQaWvIRNg
aKja1qWNIE
SortedList
a0cahcrYWG
RwXasrg7vy
rVTaaWKwdZ
xebaSyf9J3
vdHa9lF6pn
UMLaFGfUVN
uYsac0DfeJ
LvCaxS0qDD
erjGzG0Q6L
kkyaOlT87q
ajAavSyPOm
plCaQ9fnZA
eaMawg7IFx
W8kamHKkxJ
aw1aBjQIwT
affaUNVspM
chMa7FiBna
Zero
nZHm6WrQ7ff63
QpoGitp2vS
BinaryReader
NqwGMv76a6
EVYG2J49gd
RtlZeroMemory
kernel32.dll
ByLGVDKOMg
VirtualProtect
lE7G0lRuw1
FindResource
HiAGui5KKc
get_Size
woIGAdsW4R
ToPointer
AccessViolationException
NullReferenceException
uODGJvV4pW
q9BGnLW2iO
UcLGgi3ZDl
CnRG36EqcI
W85GZnr6Zy
iQmGNr3HVS
RSACryptoServiceProvider
set_UseMachineKeyStore
GMeGtV0Slp
GetName
AssemblyName
get_CodeBase
GetType
GetProperty
PropertyInfo
GetValue
PHEGIG96Gl
LoadLibrary
JeJGlrauW8
GetProcAddress
sScG48Gq8Q
J8IG59p3Yt
InNGyRh05k
lRWGH99xXU
OpenProcess
Ke4GXWicjc
CloseHandle
tBIG6EG42p
FileMode
FileAccess
FileShare
oGHGC2qMGA
Rijndael
InitializeArray
RuntimeFieldHandle
ToArray
lGdGkxZDS9
nKUGd5fgAO
RKKGDHIpJR
U6vGeI1PDv
kXUGPVfVKN
aPMGbUVFpP
rR6GrP2DuW
SmnGjocnCC
xi6G80qDG6
C76Gqeb7Hy
pP6ZcS7pdhPo1A76Mq
gDH24Yva5rhLbcCmup
GetManifestResourceStream
RD4skwsOvXgYDoAP2H
get_BaseStream
IL5DaA36efumM1b8AR
WAZbNsQ19q68lBbXrP
lAay1Hruh8lXdpXj98
zCmbEQuVd3e6GnRESv
ReadBytes
PVZEgaZ3wtedmVgiCK
MBQdXQheZ7mgVgq2fu
GetPublicKeyToken
cXwoyxe0rbebdY0Mjl
D2y8bG41ZjnVOVbErN
QEystxcqkMMTu2vn7x
LaRx1dWRCh32ZYwdFW
FlushFinalBlock
XGTS2RmQPrGOd6yS9o
ev3LXc1EeWC2bStUL4
I09dUaftZYAqLrQnWX
zh1OHUDJwES8v6oNha
iZDwPX2Z1Z3ZNt5I0f
PYhEMA9xsMN89UubIH
HikO4fXDGfPOOvLgB9
qfxNXHCYurotUd4El3
ce4DmfsmSrOT856tDgfrkMb
ToBase64String
wrHaKDTE75
CreateEncryptor
UInt64
classthis
comp
info
nativeEntry
nativeSizeOfCode
w44aRlKPuO
kxfaY3qY1m
OubaouIKDP
QCIm6WrzaSGIq
$$method0x6000023-1
$$method0x6000023-2
$$method0x6000032-1
$$method0x6000054-1
$$method0x6000277-1
$$method0x6000277-2
Phulli.Resources.resources
Phulli.Form1.resources
Phulli.g.resources
KEkFYvmbEFnLeY3I2F.4M76e2aSQk0wuKwgUC
aR3nbf8dQp2feLmk31.SplashForm.resources
aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
EditorBrowsableAttribute
EditorBrowsableState
GeneratedCodeAttribute
System.CodeDom.Compiler
DebuggerNonUserCodeAttribute
STAThreadAttribute
DebuggerHiddenAttribute
DebuggerStepThroughAttribute
HideModuleNameAttribute
StandardModuleAttribute
HelpKeywordAttribute
System.ComponentModel.Design
MyGroupCollectionAttribute
ThreadStaticAttribute
CompilerGeneratedAttribute
DesignerGeneratedAttribute
AccessedThroughPropertyAttribute
UnmanagedFunctionPointerAttribute
CallingConvention
FlagsAttribute
KEkFYvmbEFnLeY3I2F.4M76e2aSQk0wuKwgUC
{11111-22222-50001-00000}
file:///
Location
{11111-22222-20001-00001}
{11111-22222-20001-00002}
{11111-22222-30001-00001}
{11111-22222-30001-00002}
{11111-22222-40001-00001}
{11111-22222-40001-00002}
{11111-22222-50001-00001}
{11111-22222-50001-00002}
RSA1
Q^U[A
cbWRVD
.{dx
x[3(
,3$U
Phulli
Copyright
2014
WrapNonExceptionThrows
1.0.0.0
$1f128a07-8438-4dc0-8205-570da0ccce8d
MyTemplate
8.0.0.0
My.Computer
My.Application
My.User
My.Forms
My.WebServices
System.Windows.Forms.Form
Create__Instance__
Dispose__Instance__
My.MyProject.Forms
4System.Web.Services.Protocols.SoapHttpClientProtocol
Create__Instance__
Dispose__Instance__
3System.Resources.Tools.StronglyTypedResourceBuilder
4.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
11.0.0.0
My.Settings
FZIKnXF6uIkiix2XfV.PEHHGUoM4osXP9cT59/HUkFs1VieKEV19D6sc/cXnXyVnQTDMlgx8DbC`1[[System.Object, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]][]
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADPe
WebBrowserPassView
CMemoryExecute
mailpv
!This program cannot be run in DOS mode.
$
zjkEz
zjkGz
zSGZz
zRich
.text
`.rdata
@.data
.rsrc
)4Bf
=X2D
Pj0h
=h2D
=h2D
=h2D
=h2D
=<2D
:=tC
YY9~
Nt'-
5H2D
u$9M
5|2D
tAHt7
Y^[u
PSVW3
@@Ou
;\$H}
;D$H}
D$PP
|$P
L$PQ
YtGj
v0SW
_[t
hl5D
h|5D
SVW3
@SVW
r f=~
t A;M
Qhl6D
O Qh,7D
QhT7D
O$Qh|7D
O(Qh
O,Qh
O0Qh
Qh48D
Qhd8D
O4Qh
JtvJt
u+VWj
u
ht9D
h|9D
YY_^[
u
f9
YYu
j
X9
SVWh
Ph@:D
YYVWj
YY_^
tZf=
tTf=
tNf=
tCf=
t=f=
t7f=
t1f=
=D1D
-(0D
9>uBh
h(<D
t$ W
u\Wh
h<<D
hT<D
hh<D
hx<D
QQSVWh
_^[u
5|2D
8G;}
SVWj
YYF;
YYNy
<VWj
%33333
UUUU#
%33333
SVW
u&j [
YYte
u&j
[
YYt7
YYt
=h2D
VVh
j&Vh6
NSVW
=h2D
_^[]
QSV3
^[t
C"9G
@f9F"
t
PV
@f9G"
@@Ku
QQSW
YYtWC;
@SV3
!f9]
t-;E
sf8E
SVrG
RPQ
f93YYu^h
3f93u9
f93_
Y_^[
5 1D
YY9]
YY9]
YY9]
YY9]
YY9]
YY9]
YYj#
Y_^[
YYu49]
$~"8
VWPS
YY^[
\t
h
FFC;]
FFC;]
tKSWU
tqSVWj
<H t
<F u
f;L$
<F\t
SVj\3
(SVW
=H2D
5@0D
GWCSPQ
j Y;
~
h$
u
h4
0vpSW3
SV3
_f=
FCC;]
YYt
Ny
f!7_^
SUVW
,6USW
GGF;t$
_^][Y
= 1D
uD9]
u?9]
{f="
uJf=
;H0}
9~0~
YYt
G;~0|
Vt4f
_^[]
tDSUW
YYs
SV
9;|$
YYt f
YYt
G;~
SVW3
YYt*h
7Sj@
YVVVj
f93t
tth
u,WVhT
SVWj X
YuDh
ueWj
YYtZFj?V
YYu
SVW3
YYt-
QSSh
F(j?P
;C$|
RWWj
= 1D
@PSS
t>hp
t2@;
tMhH
Yu7j
D$NSP
D$$0
D$,6
f9\$H
t$(W
D$Tj P
9\$,
t#9]
YYt49\$
9\$,t
tMVW
Y_^]
D$FVP
D$ 0
D$$6
t$0f
tff9t$@tI
D$@j P
09t$$
D$ t
L$@QP
YY9t$$t
~`f9
VWu;
YtyVW
@j?h
SVW3
~\S3
PWh_
F,S3
9~0~
G;~0|
PQh,
QQSV
YYtZ
Yt*3
_^[t
j X^
j X[^
t99}
u4SV
WWh2
Y~*S
[_^]
QQSV
9^0W~.S
C;^0|
u SW
9^0~.S
C;^0|
9^0W~$S
C;^0|
uYf!
9FHWt#9F0
;F0|
j_ZRj
u
ht9D
C(H9E
h|9D
9~(~D
G;~(|
9^(~G
C;^(|
9~(~ZS
PPh,
G;~(|
VWj
Yj
9{(YY
u
h
$G;{(
YY_^
9{(YY
YYPh
u
h
9_(YY~{Vf
w`Ph
C;_(|
A;N(|
t"S3
QQSVW
f98t P
t"S3
9^0~BS
C;^0|
t
G;}
=|2D
D$.SPf
D$ P
D$,P
j j
-D1D
- 0D
-L0D
_^][
5|2D
YY9]
F;5d
wD@
Ys2V
_^[t
GWhI
~-Pj
9X0~N
YYu*
F;p0|
PhPWS
MhQj
5D1D
WWWjhP
QPWj
WWh
PWh0
Ep~'
=|2D
E`Pj
SVWh
PjiX
YY_[
D$ j
PjpX
QQSV
WWh#
{SVW
5<0D
t-Ht
t09E
WPVVh
@0CH;
D$`P
D$<
D$PP
L$DQP
D$DP
D$DP
D$DP
D$DP
D$PP
D$d8
?t0j@_+
_^[]
j?Y#
s&WQj
>QZ^&
t|9}
Yt
j
Yt
j
j\j/
Ph|5D
SVWt|H
5|2D
YYSh
YYt;h
5D1D
_^][
F PS
SVW3
90t*
H f91t
f91t
f9p t
h|5D
Yu8h
f90t'P
uzWh
tNh4
t=hD
t,hT
YY|Bh
>\uEh
SVW3
D$8WP
D$ P
D$(P
C;\$
D$,WP
D$@P
D$(P
uQ9=
uPWht
=h2D
=T2D
D$pPS
D$HP
D$tP
D$LP
D$P+D$H
+\$t
+D$x
D$X+D$P
!D$,9
;D$
)D$0
t$0h4
D$4P
t$4hD
t$HV
L$8QP
D$<P
D$\P
+D$<
+D$`h
D$l+D$d@P3
D$\P
L$D+
+D$Dh
+D$dAQ
L$H+L$@AQ
t$Hj
Yt?j
VD^]
t<j"V
YYt.f
SVW3
^@[]
teWV
UUUU#
Bt9HHt.
t"Ht
t!Ht
Ht
Ht
WVSW
f9;YY
Ht'HuE
VWhd
SVWj
af=>
Sf="
u j
h
f=&
VWj Y
YY~'Ph$
YY9^
t
h\
YYt
hd
YY9]
t
hp
f98t
_^][
Yt+j
YYt
YYj(Wh
j BY
Yt>95
r?;5
tJWV
YYu!9
OYYu
YY_^[Y
%t.3
t
@C
t1Jt3JJt#
D$ }
L$ k
9L$ ~
\$(u
T$4t
D$4u
D$ 3
t$<W
\$<}
j
RP
t$<W
T$4w
~
JH
D$H3
D$H%
D$H|
D$QP
F;t$
D$(t
T$8u
D$83
D$8~
FB;T$8|
|$ u
_^[Y]
usVS
YYt%j
t SV
YY^[
t&SW
w-j
j
PQ
8u
9E
w)j
@_^[
tT9u
FF;u
wKt&=
@[_^
YY[t
YYt!
5 1D
t$ j
_^][
QSUV
SSSSj
t$,SW
_^][Y
QQSVW
SSSSj
QSVW
t$WPj
^[_]
YYu<
v
+]
_^[]
VWt+
WVRP
G;L$
[9\$ u*
_^YY
6SV3
|'Sh
t1Ht
Ht HHt;j
F8X_[
9~0~
G;~0|
QQUVWj
Yu U
_^]YY
N<^u
F@YtV3
H
f M
f!G
f G
H
u5
9~0Y
F09~0~
9~0~
Y_^[
Yu#j
>FIu
VVt)
PVWVh
PVWVh
WWhP
bhy|
j$SV
}<jd
}
jd
tQj$
u
9]
X_^[
t-f9
8\t @@f9
Vj$j
ti;>we
9>v1
69>w
|s&@
SVj}
P,RQ
QSW3
9^(u<9]
F(9^
t#f9X
u,j$SW
8u 9]
=|
E
Yu9W
Yt,V
rU;5
QQSW
;F r
vBVW
;C r
h`
E
h`
E
YtcSVj
j
[t
YY_^
u!;F
;G(v
_^[]
Y_^[
;N(v
;s(Yw
hdBD
tGSVW
_^[t
_^][
SUVW
_^][
F@SS
uY8^
YYu=9]
YY_[
0;F`|
FTu%
;F|s$
vHSW
u
;wPu
;_Tt2SV
8F t
F@SWj
YYu&
F@QR
9_`~
0;w`Y|
8xCD
QQS3
0C;^`|
9_(t
SVW3
tr=xCD
t*8_
f9Nvt
tx8V
;FT|
;FPwo
u59U
;FPw
jeX_^
tKPV
YYt=
F<S3
ua9}
tW9]
F<SW
~@AQP
QWPS
~@@PS
YYuB
u=9D$
YYt)f
9CXt
YYu:
QQSV
YuG9]
RSQP
t
WS
RPQV
K(;HXt
;H4s
;G4s
t
QP
t 9_
Ov^[
E
VWS
Y_^]3
(SVW
F@98
F@Sj
YYuS9}
S<VW3
PRWQ
;K$v2
;{ v
s4WV
9^(Wt
YucSSS
Gxt]
QSPW
F@SSj
QSPV
uG9]
9_Xu
SVWu
ti9w
G(SU
u*9D$
!GH!GL
8F
t
@9D$
D$ P
u'9\$$t!
YYt
f
C;\$
QQS3
Vv6S
t'8^ t
;N t#
N@99t
F`9E
0;F`Y|
~`u'
QSUVW
_^][Y
SVWj
QSVW
RWQP
uG9}
FLPj
~$j(3
C0WP
j0WS
8C1W
QQWj
8F1W
F4W3
F4+E
uh+u
F Wj
F$WP
WWj
|
;M
vTPhx
YY_^[
Wu"3
P@YY_^
}\;E
4SB;E
;F4W
L$ r
D$(PV
D$ ;E
D$4rAj
D$4t
T$@RP
D$D;D$<
D$@;D$8s
T$8Rj
D$,P
D$(P
L$,;L$4vr;L$
D$09D$$wb
|$ j
IQRP
YYu)8G
GWj(3
YYuN
uFj0
F$QP
C9D$
t\Sj
YYuC
t
h`
P<YY3
;F4uPj
N$QP
;F4w
;F4s>3
uzG;
N$QP
IQRP
YYu1
F4SW
QSUV
YYuL!F4
_^][Y
YYuT
u.8^
8HXt
P ;T$
P$;T$
QQSW
?SPWS
u0f9^Z
!;t$
FLPj
!~HY
Wt;8C
C fHf
v
hT
C fHf
;~,v
SVWt
t
QP
Y_^]3
C +C$
S$^t
VWwr
C *C$
QSVW
u 9M
ui8O
F(9M
9F,t
YYu!
QSV3
YYu&9D$
t
8Y
u 9Y,u
SVte
f9_Z|
QSVW3
YYu
s`9E
Y_^[
FZf=
L~^f
QSUV
f!nZ
uo8H
tBhh
_^][Y
VZfIf
LV\f!F:
FR_^[
8FSu
8FSu
VWuI
K ;M
8CSt
DC\f
TK\f
8^Su
LN\f
TV\f
|v8X
DF\f;B
_^[Y]
[f9\N\u
f9^ZtD
FZf9\F\t
DF\f
_^[Y]
N,@;
YYuY
F<u
v<;>w
YYu<
rz;~,wu9]
YYuP
Y_^[
;Q$wD
_[Y]
R$+U
<OKK
^<W3
@$SVj
9E$u"
E$Pj
LK\f;J
CZ;E
CZ;E
;A,SVWv
QSVW
YYuD
DF\f;A
DF\f
YYu6
y@8_
| ;u
RPWV
s @;
YYu/3
q @9E
V w+9^(
s @;
YYu!
,90u
4Vj0
;G$u
;G$t1
tM9G
tHj@P
D$$PV
`$WtMf
t
V
G$8^
j$WV
j$SV
QQSV
D$4j
#t$,P
#L$XPQWV
D$0P
uT9E
SVWj:Yj:
Jj_^
;F ~
t PS
VWt.k
YY_^[Y
QQSVW
t.+]
t
PW
4
;t$
^ Wk
j
X9E
F2t#
f9_2v#
G2F;
;F(|
L$ QSPW
u'9D$ t
L$$tN
D$ Q
u5!\$
u
j@
QQSVW
f9^Z
QSUVW
E8_it
8_ht
9_\u S
tw8^
ub9_\t
A9\$
uA9_\t.
8_ct
_l9_\t
9_X|
8_iu
G4s)
_^][Y
9^X|T
8^eYYtF
t98^dt4SP
#F\_[Y
F4W3
NHSW
QQS3
um9M
GDt
h:
u 9^Lu
QQVW
YY_[
t
;U
SVW3
re;u
Y_^[
wHj(
YYu3
t
ho
SSSS
QSUVW
58Odt
8Oiu
_^][Y
Y_^[
f9GPY
FT9]
YYu<
JtzJ
@_^[
Rt:Ht)
Kt9Jt-Jt!Jt
Jt 3
;Eu
;JTu
xL;~Tu
uR9M
@YYt
9Ctu
@H:Bfs
A9y,u
.|49
WRPW
d}zj
41j
;CPQu
RPPP
;QYY
9~ t
;wp|
YPh8
9BL|
9BHv
!""##$%&&&&'(()*+,--./0012345667789:;<======>????@@@@@A>BCDEFFGHIJKfLMNOPQRfSTUVWXYZf[f\]^_`afbcdffffffffffeU
YYuMf
YYu1
YYu"f
VWt
YYu
O
tWVW
_^[]
9GtSj
j0VW
YY_^[
{(;G
t<9E
j?Y3
F( V,
QVWj
F(9X
G( W,f
SPQR
9G@u
X_^[
0SVW
YYt2
@Ph\
QQSVW
;HP~
YYt#
|$ u#QSV
D$@j
D$0P
D$4r
89D$
!D$\9D$$
t@hL
D$DSP
9\$$t
@_^[
um9Z(
G@YY3
QQSV
Y@_Y
t%V3
@,;E
QQSVW3
t
f N
t
f N
Y_^[
:?Vuzj
@YYf
;Al~
@u VS
YY[^
u
9H
j0Y+
u.f
u
PV
u
WV
[^_]
;AP~
YYt2
9P(u
t
<bt
_HVW
LVW3
u29
0t!3
YYt
AAQVj
VWt
YYt*
u%9}
VPh0
ujVW
AX_^
SWj
HTVj
;PT~
|);~
N`W3
_^[Y]
D$xY
D$lY
D$hL
|$@V
D$0R
|$0V
|$@V
|$@V
D$@j
t$,V
|$0V
|$@V
t$4P
]t H
Pj^W
|$0V
|$0V
|$@V
t$<3
|$,F
D$4j
|$HV
t$HP
D$8jW
t$0W
D$$u)W
D$0_^[
9\$(
;D$(|
t$ 3
PPPj
t$(j
D$4V
D$$j
t$8j
D$ j
HHu"
Ytpf
<^tU<btQ<
{HWVS
@_^[]
1t}Ht2H
D$(j
D$$S
P~F=
|$(S
t$03
|$8F
|$(S
1t[It2I
D$(j
D$(S
|$$S
t$03
|$$S
D$$S
YYuR
YYuA
QQV3
@_^[
H`9Q
;x8~
9{@tTV
tG9~
PVVj
YYt6
WVWj^
WWVh
PPPPPV
QQVW
9{$t
Pjbj
YYu&
Vj^W
;JH~
Vj^W
PVj
Vj^W
9XH}
XH9u
_^[t
GHVS@W
YF;s
t
VS
u%W@
u,j0
@I:AIt
YY_^[
E|SW
]d~)V
Ed;G
uhh(
YYu;
YYu,
YYu+
YYu
u?f
YYu
C
YYu/
8^|u
YPSSSj|
9_@ub8^
9_Du
YYu?9E
_^[]
YYtE
9p u
~Rj X
j PV
tT9_
YY^[]
Y9~8t$9~4~
G;~4YY|
YYVS
YY[_^]
t>SW
YYt
Yt
j|W
@IVPj
PAQPj
SVSj
VSj7
<_^[
A;OP~
u'SW
rahct
bolct
txetu
bolbu
|<;~
Y_^[
YY_[^
QQSVW
YY_^[
@SPj
"FC8
D0#P3
VVVj+
,9s@u0
Q@PRh
YYPj
F,^_[
VVVj+
Q@PRh
YYPj
YY_^[
t
9G
YYu
Q@@P
(_^[
8G|u
YYt
YYtN
YYtF
9E t+9E
BRQh
YYP3
VVVjz
Vj
^;
NB;P
t39~
~8VW
_^[]
uH9E
u<9E
_^[]
QSVW
t19~
PPPj!
YY_^
QQSVW
N$Sj
tbSV
~3SW
u
PS
Y_^[
Yue9D$
uA9A
YtJf
u
9G
6YY;
{D_^[
jP3
8XHu4
t]VS
YYSSSSSS
SSjj
ug9}
t
WWV
{HGj
u 9M
u WSj
Ht%Ht
HVWt4
YY_^
T$$u"
9D$$
9D$ s%
9T$$
|
9T$
t&)L$
t$$9T$$
9T$ s
t$$;
+D$
9T$$|
9T$ v
T$$t C<
YYt?GWSV
Y_^[
YYt6GWSV
Y_^[
YYt'V
;Ch~
QSVW
A@@;
YYtQ3
Y_^[
QSVW
Y_^[
D$4P
D$0X
t$$P
@;D$,
Y_^[
D$$tJ
+D$$
Y_^[
YtA9X
v58X
YY^[
Yt9f
_^[]
YY_^[
PWVj
t$$VUj
@_^][Y
u jL
-9u$~
u$Pjn
YY_^[
YYtK
uj9u ~eh
YY_^t
$_^]
@S@PSjo
YYtq
C$VW
QQVW
u 9F$
Pjv3
PjL3
tzPj
Pjv3
Pjv3
PjF3
u09E
Pjv3
jb3
PPPPPP
SVuZ
@@P3
0@;G
SVuA
8&u!
El9X
EhSji
9}tu 9}
9}tY
E<Wj
PPPj
E\Vj)
E\Vj6
uPVj7
}@9}@
}X~.
;E@|
MTNu
+ET;
9M@t
ET;G
EX;F
u\jA
E\jJ
1;uXt @
9M,u
9Mpt ;
^9M,t
{HWP
EH;G
ET@P
u|+G
HPWj
9E,t
k9Ett
E\u+VjJ
E\j6
AAQVjI
E\Vj
u$j6
uT~b
E !uH
EX;w
UH8L
EX;w
u<@@Pj
t ;A
9U,t
9Utt
9uDV
u$WS
u<VWS
u|+G
HHPWj
u0jC
9u u
}$ct
HtNHtCHtHH
t*WjJ
u(WjI
_9u t
VVjj
t
VVS
u(Vj
9u t
}$ct
VVjj
_^[t
t3VW
9GD^}
T$(RQj
9\$
9\$ uD
duK;
D$$~<
|$,C;
t$(W
Y_^[
QQSV3
C9=0
Yt,hHDD
QQSVW
<_^[
QSVW
t!Ht
$SVW
xHSS
Sj^V
Sj^V
Sj^V
Sj^V
Sj^V
SPSVSj^
SVVj
j
XSSP
YYt"
tU9}
AIh`
t+hh
9xLu+
YYu
8A|u
u%WS
|}t
tq;wL~"h
Y_Y]
QSVW
jqW3
YYt VW
tG$
8;|$
QQSVW
t89N
tz9O
Q@SP
8H9E
t-WR
SRWj
SRWj
5RWj
QQQP
uL9]
h^1A
Y_^[
h^1A
YYtE
_^[]
~,W3
_^[]
9{(u
9x,u
9{$t
f99t
99~"
Yj8j
@_^[
VWtE
D$4Y
89D$
8qt
<qtM<vu
9qtA
T$Pu
D$ f9
D$(u
L$$;
~F9D$$u@
D$$S
\$Hu
D$ f
L$(j
Pjv3
t$,h
89D$
9T$Pu&9T$$
t$$h
;AP~
@_^[
_^[3
YYu>
YYu"
YY_^[
;C$|
9_$V
;_$|
PQQQj
}tt2SW
Ehj)
]Xu}
G,;FL
;NHs
9VL|
9FHv
EhVj
u4Vj
Ehj5
u<Vj
90~H
F;0|
$9]@t
Ect<
9]dYYu
8]ct
tHSVW
_^[]
;K@Wt?
;C@u
$SVW3
8Y|u
@@;B
M hd
t
hl
0u#S
YYPj
YYt
YY_[
Yt"S
VWjiS
SVWjk
YYt&j
Y_^[
VVVj+
X9GH}
GH_^
YYt;
VWt,;
@_^[
IttIt;j
<SVW
QSVW
F ;E
F t-
_^[]
u&9G
CH9u
SH9u
u
9u
CHVP
~(WS
t%jJ
}2;~
_^[
PPPPPP
PSjC
D_^[
@PPj
_^[]
x +x$
N$PW
Yu|3
YYuCCC
t/SVW
1;t$
uA!E
WWWjz
@PSWW
YYt
G4h8
tF9M
t4< t03
YY^[
QQSVW
YYt-9_0t(V
t)!E
QQS3
>9_H
@PQR
;9t@B
QSVW
_^[t
SV|h
(QSP
t SV
Yj(3
YY_^[
0;t$
QQS3
~"W3
SVW3
G91u
PjP3
PjO3
uoPV
t,;_
j
X|!~
F$_[
YYt;
YYtx
j?Y9J
v j(W
v jF
F;3|
G@_^
t(9{ u#QP
9{ t
}hj(
M, E0C;_
EHj$
U, M0
M, E0
ELt.
RPWQ
jdRP
jdRP
U@t"RP
9}Dt
U@9}P
E@;F
E<;F
#Mx;E
uG;M
9U<r
9U<wA
MP;N
ML;N
M<#E
_^[]
9~@u
FDtC
u
Sj=
bG;}
TSVW
G,v$
/-,.
<Mt
3
G<u
t 9s
t Sj$
AlHD
t PV
YYu9
K$#E
O$#E
~\VW
Yt
SP
YYjE
89EL|
H9EH
8;E`
E4;EHt
E4;EH
9UXt
ET9UL
9V4u
} E$
#EP#MT
us9u8|
tZ9u
E<9p4t
tH9u8|0
E4j
Y
9u(u
E<8;E`
U\!E@
A4|0
E\P;E`
p j&
s\RP
P;}`
dW|&
VVVj+
Q@PRh
YYPj
U(^D
PPPP
PPPP
Pjv3
u
9{
WWWWWWW
;A`~
WSjF
t,WWWWWWW
QQQjx
Yu
VW
hTCD
!"#
$%%&'
./01
+2+34+567
89:+;
BCDE
FGH%
JKL+
+NO+
+%PQRS
+TUVWXY4Z[\
>]^_`abbcdaaefghijkllllllllmnmnopqrstuuvw
yz{|}~
HtiHt^HtSHtHHt=H
t @
/ta~
<tHHt0H
u
@@
Ft
B@
Ht--
tkHu.
HDPS
j\Sh
YuEj
_^][
hdBD
u19E
Yt!h
~,!]
G80y5
G83-<
Y_^[
SVWj
Wu j
u
hC
tw9q
SUV3
GDu
W
GHh@nD
uQSS
u-SS
_^][Y
9^$W
F$u@j
F$u
hD
u
h<
_]^[
Pj#X
YtVj
Wv(j
unSWh<
@SVW
QShl=D
u%9}
%`3D
% 4D
%|3D
%x3D
%t3D
%p3D
%l3D
%,4D
%(4D
8MZu
hY,A
hh4D
hd4D
h`4D
hD4D
>"uE
j
XPVWW
%$4D
Y_^[
%h3D
%,3D
%$3D
%(3D
WVS3
v N+D$
WVU3
v N+D$
h9-D
hJ-D
h[-D
hz-D
D%2.2X
MS Sans Serif
WebBrowserPassView
%%0.%df
Apple Computer\Preferences\keychain.plist
server
Path
Account
Data
com.apple.Safari
com.apple.WebKit2WebProcess
SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created from logins
ShowGridLines
SaveFilterIndex
ShowInfoTip
MarkOddEvenRows
LoadPasswordsIE
LoadPasswordsFirefox
LoadPasswordsChrome
LoadPasswordsOpera
LoadPasswordsSafari
LoadPasswordsSeaMonkey
UseFirefoxProfileFolder
UseFirefoxInstallFolder
UseChromeProfileFolder
UseOperaPasswordFile
FirefoxProfileFolder
FirefoxInstallFolder
ChromeProfileFolder
OperaPasswordFile
"Account","Login Name","Password","Web Site","Comments"
<meta http-equiv='content-type' content='text/html;charset=%s'>
<table dir="rtl"><tr><td>
<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>
</table>
Aadvapi32.dll
CredReadA
CredFree
CredDeleteA
CredEnumerateA
CredEnumerateW
crypt32.dll
CryptUnprotectData
CryptAcquireContextA
CryptReleaseContext
CryptCreateHash
CryptGetHashParam
CryptHashData
CryptDestroyHash
comctl32.dll
InitCommonControlsEx
Error
Error: Cannot load the common control classes.
3.7.5
!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
******""""""""""""""""""""
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@l
LLLLLLLLLL
0123456789ABCDEF0123456789abcdef
thstndrd
SQLite format 3
0123456789ABCDEF
naturaleftouterightfullinnercross
onoffalseyestruefull
CREATE TABLE sqlite_master(
type text,
name text,
tbl_name text,
rootpage integer,
sql text
)
A?/,.-
22d9
777705555443332
7777
5555443332
667777
5555443332
5555443332
^89/
667777
5555443332
3332
667777
5555443332
443332
667777
5555443332
667777
5555443332
667777
5555443332
667777
5555443332
"89/
667777
5555443332
667777
5555443332
667777
5555443332
667777
5555443332
667777
5555443332
667777
5555443332
667777
5555443332
667777
5555443332
utsrp
MNOPQRSTUVWXYZ[\
12MNOPmRSTUVWXYZ[\
DEFGHIJKLMNOP
RSTUVWXYZ[\
RSTUVWXYZ[\
cdeL
12ijk6n
DEFGHIJKLMNOPvRSTUVWXYZ[\
`abcdef
<\>m
abcdefVW12vtm
^_ aXYZ[\
h)jDEFGHIJKLMNOP
RSTUVWXYZ[\
VWXYZ[\
Bcdep
DEFGHIJKLMNOP~RSTUVWXYZ[\
nDEFGHIJKLMNOPvRSTUVWXYZ[\
^_^<
X129x
^_x3
:DEFGHIJKLMNOP
RSTUVWXYZ[\
,,..
DEFGHIJKLMNOPwRSTUVWXYZ[\
_ijk
m12x
DEFGHIJKLMNOP
RSTUVWXYZ[\
DEFGHIJKLMNOP
RSTUVWXYZ[\
DEFGHIJKLMNOP
RSTUVWXYZ[\
DEFGHIJKLMNOP
RSTUVWXYZ[\
DEFGHIJKLMNOP
RSTUVWXYZ[\
DEFGHIJKLMNOP
RSTUVWXYZ[\
GHEFGHIJKLMNOP
RSTUVWXYZ[\
FGHIJKLMNOP
RSTUVWXYZ[\
VWXB
~8|{
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
HerF
qQ2l
yf8x5
[X]Ti
uLm:.P
^gSG
!$).056;>ACENQV[_`eimuz
)Q+e4"n-.1
s<f`
!|{k
3b1$ j
9Eag
H%&
'_BBc
uFo,w_1#
Iz:__
;py=>/q
!5Ng
##%%&&))**,,//1122447788;;==>>@@CCEEFFIIJJLLOOQQRRTTWWXX[[]]^^aabbddgghhkkmmnnppssuuvvyyzz||
0
wand.dat
@nss3.dll
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe
%programfiles%\Sea Monkey
SOFTWARE\Mozilla
mozilla
%s\bin
PathToExe
%programfiles%\Mozilla Firefox
SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins
-signons.txt
signons2.txt
signons3.txt
signons.sqlite
netmsg.dll
Unknown Error
Error %d: %s
edit
kernel32.dll
open
%2.2X
%s (%s)
Microsoft_WinInet
Microsoft_WinInet_
@dllhost.exe
taskhost.exe
taskhostex.exe
Containers
ContainerId
Name
History
Container_%I64d
AccessCount
CreationTime
ExpiryTime
AccessedTime
ModifiedTime
EntryID
visited:
Microsoft\Windows\WebCache\WebCacheV01.dat
Microsoft\Windows\WebCache\WebCacheV24.dat
0123456789ABCDEF
URL
index.dat
Software\Microsoft\Internet Explorer\IntelliForms\Storage2
https://www.google.com/accounts/servicelogin
http://www.facebook.com/
https://login.yahoo.com/config/login
@internet explorer
http://
https://
:stringdata
wininetcachecredentials
ftp://
dpapi:
caption
menu_%d
dialog_%d
strings
general
sysdatetimepick32
charset
TranslatorName
TranslatorURL
Version
_lng.ini
%-18s: %s
%%-%d.%ds
<td bgcolor=#%s nowrap>%s
<td bgcolor=#%s>%s
<tr>
&nbsp;
<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s
bgcolor="%s"
<table border="1" cellpadding="5">
nowrap
<font color="%s">%s</font>
</table><p>
<item>
<%s>%s</%s>
</item>
<?xml version="1.0" ?>
<%s>
</%s>
@/sort
/nosort
SysListView32
/nosaveload
report.html
commdlg_FindReplace
*.txt
*.csv
*.htm;*.html
*.xml
.cfg
General
WinPos
Sort
Columns
Arial
/stext
/shtml
/sverhtml
/sxml
/stab
/stabular
/scomma
/skeepass
/savelangfile
/deleteregkey
@history.dat
places.sqlite
Mozilla\Profiles
Mozilla\Firefox\Profiles
Mozilla\SeaMonkey\Profiles
Mozilla\SeaMonkey
Mozilla\Firefox
profiles.ini
Profile%d
IsRelative
{Unknown}
Exception %8.8X at address %8.8X in module %s
Registers:
EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8X
ESI=%8.8X EDI=%8.8X EBP=%8.8X ESP=%8.8X
EIP=%8.8X
Stack Data: %s
Code Data: %s
sqlite3.dll
mozsqlite3.dll
NSS_Init
NSS_Shutdown
PK11_GetInternalKeySlot
PK11_FreeSlot
PK11_CheckUserPassword
PK11_Authenticate
PK11SDR_Decrypt
ntdll.dll
NtQuerySystemInformation
NtLoadDriver
NtUnloadDriver
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
NtQueryObject
NtSuspendProcess
NtResumeProcess
Web Data
Login Data
Google\Chrome\User Data
Google\Chrome SxS\User Data
Opera\Opera\wand.dat
Opera\Opera7\profile\wand.dat
Opera
CreateToolhelp32Snapshot
Module32First
Module32Next
Process32First
Process32Next
psapi.dll
GetModuleBaseNameW
EnumProcessModules
GetModuleFileNameExW
EnumProcesses
GetModuleInformation
\systemroot
QueryFullProcessImageNameW
GetProcessTimes
STATIC
EDIT
pstorec.dll
PStoreCreateInstance
@"%s"
Ashell32.dll
SHGetSpecialFolderPathW
AppData
Favorites
Desktop
Start Menu
Programs
Startup
Common Start Menu
Common Programs
Common Desktop
Common Startup
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
shlwapi.dll
SHAutoComplete
%2.2X%2.2X%2.2X
&lt;
&gt;
&quot;
&deg;
&amp;
<br>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>%s<title>%s</title></head>
<body>
%s <h3>%s</h3>
</body></html>
<font
size="%d"
color="#%s"
</b>
</font>
<font color="%s">
<table border="1" cellpadding="5"><tr%s>
width="%s"
<th%s>%s%s%s
</table>
file is encrypted or is not a database
bind or column index out of range
auxiliary database format error
authorization denied
large file support is disabled
library routine called out of sequence
datatype mismatch
constraint failed
table contains no data
locking protocol
unable to open database file
database or disk is full
unknown operation
database disk image is malformed
disk I/O error
interrupted
attempt to write a readonly database
database table is locked
database is locked
callback requested query abort
access permission denied
SQL logic error or missing database
not an error
memory
truncate
persist
delete
foreign_keys
recursive_triggers
read_uncommitted
omit_readlock
writable_schema
automatic_index
reverse_unordered_selects
checkpoint_fullfsync
fullfsync
legacy_file_format
empty_result_callbacks
count_changes
short_column_names
full_column_names
group_concat
count
total
zeroblob
replace
total_changes
changes
last_insert_rowid
quote
sqlite_compileoption_get
sqlite_compileoption_used
sqlite_source_id
sqlite_version
nullif
randomblob
random
ifnull
coalesce
lower
upper
substr
length
typeof
trim
rtrim
ltrim
REAL
INT
NUM
TEXT
sqlite_attach
sqlite_detach
tbl,idx,stat
sqlite_stat1
sqlite_rename_parent
sqlite_rename_trigger
sqlite_rename_table
win32
current_timestamp
%Y-%m-%d %H:%M:%S
current_date
%Y-%m-%d
current_time
%H:%M:%S
THREADSAFE=1
TEMP_STORE=1
OMIT_XFER_OPT
OMIT_UTF16
OMIT_TRACE
OMIT_TEMPDB
OMIT_TCL_VARIABLE
OMIT_SHARED_CACHE
OMIT_SCHEMA_VERSION_PRAGMAS
OMIT_SCHEMA_PRAGMAS
OMIT_QUICKBALANCE
OMIT_PROGRESS_CALLBACK
OMIT_PAGER_PRAGMAS
OMIT_OR_OPTIMIZATION
OMIT_MEMORYDB
OMIT_LOAD_EXTENSION
OMIT_INTEGRITY_CHECK
OMIT_FLOATING_POINT
OMIT_EXPLAIN
OMIT_DATETIME_FUNCS
OMIT_COMPOUND_SELECT
OMIT_CHECK
OMIT_CAST
OMIT_BUILTIN_TEST
OMIT_BETWEEN_OPTIMIZATION
OMIT_AUTOVACUUM
OMIT_AUTOINCREMENT
OMIT_AUTHORIZATION
SQLITE_
failed to allocate %u bytes of memory
failed memory resize %u to %u bytes
NULL
(NULL)
922337203685477580
API call with %s database connection pointer
unopened
invalid
%s-shm
etilqs_
%s\etilqs_
OsError 0x%x (%u)
-journal
-wal
Recovered %d frames from WAL file %s
out of memory
%lld
%!.15g
%s%s
%s-mj%08X
foreign key constraint failed
API called with finalized prepared statement
API called with NULL prepared statement
string or blob too big
unable to use function %s in the requested context
abort at %d in [%s]: %s
constraint failed at %d in [%s]
cannot open savepoint - SQL statements in progress
no such savepoint: %s
rollback
release
cannot %s savepoint - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
cannot start a transaction within a transaction
cannot rollback - no transaction is active
cannot commit - no transaction is active
database schema has changed
sqlite_master
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
too many levels of trigger recursion
into
out of
cannot change %s wal mode from within a transaction
statement aborts at %d: [%s] %s
null
real
integer
misuse of aliased aggregate %s
no such column
ambiguous column name
%s: %s.%s.%s
%s: %s.%s
%s: %s
misuse of aggregate function %.*s()
no such function: %.*s
wrong number of arguments to function %.*s()
%r %s BY term out of range - should be between 1 and %d
too many terms in ORDER BY clause
ORDER
%r ORDER BY term does not match any column in the result set
too many terms in %s BY clause
a GROUP BY clause is required before HAVING
GROUP
aggregate functions are not allowed in the GROUP BY clause
Expression tree is too large (maximum depth %d)
variable number must be between ?1 and ?%d
too many SQL variables
too many columns in %s
_ROWID_
ROWID
oversized integer: %s%s
misuse of aggregate: %s()
unknown function: %.*s()
RAISE() may only be used within a trigger-program
%.*s"%w"%s
%s%.*s"%w"
name=%Q
%s OR name=%Q
type='trigger' AND (%s)
tbl_name=%Q
there is already another table or index with this name: %s
sqlite_
table %s may not be altered
view %s may not be altered
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Cannot add a PRIMARY KEY column
Cannot add a UNIQUE column
Cannot add a REFERENCES column with non-NULL default value
Cannot add a NOT NULL column with default value NULL
Cannot add a column with non-constant default
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
virtual tables may not be altered
Cannot add a column to a view
sqlite_altertab_%s
CREATE TABLE %Q.%s(%s)
DELETE FROM %Q.%s WHERE tbl=%Q
SELECT tbl, idx, stat FROM %Q.sqlite_stat1
invalid name: "%s"
too many attached databases - max %d
cannot ATTACH database within transaction
database %s is already in use
database is already attached
attached databases must use the same text encoding as main database
unable to open database: %s
no such database: %s
cannot detach database %s
cannot DETACH database within transaction
database %s is locked
%s %T cannot reference objects in database %s
no such view
no such table
corrupt database
unknown database %T
object name reserved for internal use: %s
table %T already exists
there is already an index named %s
too many columns on %s
duplicate column name: %s
default value of column [%s] is not constant
table "%s" has more than one primary key
INTEGER
no such collation sequence: %s
,
CREATE TABLE
table
TABLE
view
VIEW
CREATE %s %.*s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
tbl_name='%q'
parameters are not allowed in views
view %s is circularly defined
table %s may not be dropped
use DROP TABLE to delete table %s
use DROP VIEW to delete view %s
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
foreign key on %s should reference only one column of table %T
number of columns in foreign key does not match the number of columns in the referenced table
unknown column "%s" in foreign key definition
indexed columns are not unique
index
altertab_
table %s may not be indexed
views may not be indexed
virtual tables may not be indexed
there is already a table named %s
index %s already exists
sqlite_autoindex_%s_%d
table %s has no column named %s
conflicting ON CONFLICT clauses specified
UNIQUE
CREATE%s INDEX %.*s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
name='%q' AND type='index'
no such index: %S
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
USING
a JOIN clause is required before %s
unable to open a temporary database file for storing temporary tables
unable to identify the object to be reindexed
table %s may not be modified
cannot modify %s because it is a view
rows deleted
text
blob
integer overflow
LIKE or GLOB pattern too complex
ESCAPE expression must be a single character
MATCH
like
glob
BINARY
foreign key mismatch
table %S has %d columns but %d values were supplied
%d values for %d columns
table %S has no column named %s
rows inserted
%s.%s may not be NULL
PRIMARY KEY must be unique
columns
column
are not unique
is not unique
automatic extension loading failed: %s
SET NULL
SET DEFAULT
CASCADE
RESTRICT
NO ACTION
foreign_key_list
from
on_update
on_delete
match
NONE
case_sensitive_like
compile_options
compile_option
wal_checkpoint
wal_autocheckpoint
malformed database schema (%s)
%s - %s
invalid rootpage
unsupported file format
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
statement too long
unknown or unsupported join type: %T %T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
a NATURAL join may not have an ON or USING clause
cannot have both ON and USING clauses in the same join
cannot join using column %s - column not present in both tables
only a single result allowed for a SELECT that is part of an expression
rowid
%s.%s
%s:%d
no such index: %s
sqlite_subquery_%p_
no such table: %s
no tables specified
too many columns in result set
DISTINCT aggregates must have exactly one argument
temporary trigger may not have qualified name
trigger
cannot create triggers on virtual tables
trigger %T already exists
cannot create trigger on system table
BEFORE
AFTER
cannot create %s trigger on view: %S
cannot create INSTEAD OF trigger on table: %S
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
type='trigger' AND name='%q'
no such trigger: %S
no such column: %s
rows updated
_rowid_
cannot VACUUM from within a transaction
cannot VACUUM - SQL statements in progress
ATTACH ':memory:' AS vacuum_db;
ATTACH '' AS vacuum_db;
PRAGMA vacuum_db.synchronous=OFF
BEGIN EXCLUSIVE;
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
CREATE VIRTUAL TABLE %T
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
name='%q' AND type='table'
vtable constructor failed: %s
vtable constructor did not declare schema: %s
hidden
hidden
no such module: %s
NOCASE
auto-index
table %s: xBestIndex returned an invalid plan
at most %d tables in a join
cannot use index: %s
parser stack overflow
set list
near "%T": syntax error
too many arguments on function %T
qualified table names are not allowed on INSERT, UPDATE, and DELETE statements within triggers
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
interrupt
unrecognized token: "%T"
temp
2011-01-28 17:03:50 ed759d5a9edb3bba5f48f243df47be29e3fe8cd7
unable to close due to unfinalised statements
unable to close due to unfinished backup operation
unknown error
unable to delete/modify user-function due to active statements
unknown database: %s
unable to delete/modify collation sequence due to active statements
no such vfs: %s
RTRIM
main
database corruption at line %d of [%.10s]
misuse at line %d of [%.10s]
cannot open file at line %d of [%.10s]
\sqlite3.dll
\mozsqlite3.dll
\nss3.dll
sqlite3_open
sqlite3_prepare
sqlite3_step
sqlite3_column_text
sqlite3_column_int
sqlite3_column_int64
sqlite3_finalize
sqlite3_close
sqlite3_exec
\StringFileInfo\
\VarFileInfo\Translation
%4.4X%4.4X
040904E4
ProductName
FileDescription
FileVersion
ProductVersion
CompanyName
InternalName
LegalCopyright
OriginalFileName
log profile
.save
signIn
vaultcli.dll
VaultOpenVault
VaultCloseVault
VaultEnumerateItems
VaultFree
VaultGetInformation
VaultGetItem
?RSDSiL
f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb
wcscat
_snwprintf
wcsncat
strlen
memset
wcscpy
memcpy
wcschr
_wcsicmp
_wtoi
wcslen
_purecall
wcscmp
memcmp
??2@YAPAXI@Z
??3@YAXPAX@Z
_wcsnicmp
wcsrchr
strcpy
strcmp
malloc
wcstoul
_memicmp
modf
free
wcsncmp
_strlwr
strchr
_wcslwr
_wcsupr
_itow
qsort
strftime
_gmtime64
realloc
memchr
msvcrt.dll
__dllonexit
_onexit
_c_exit
_exit
_XcptFilter
_cexit
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_except_handler3
ImageList_ReplaceIcon
ImageList_Create
ImageList_AddMasked
ImageList_SetImageCount
CreateStatusWindowW
CreateToolbarEx
COMCTL32.dll
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
VERSION.dll
FindCloseUrlCache
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
WININET.dll
LocalFree
GetFileSize
SystemTimeToFileTime
CloseHandle
FileTimeToLocalFileTime
DeleteFileW
CopyFileW
CreateFileW
WriteFile
WideCharToMultiByte
FreeLibrary
LoadLibraryW
GetProcAddress
GetLastError
SetFilePointerEx
CompareFileTime
GetCurrentDirectoryW
ExpandEnvironmentStringsW
MultiByteToWideChar
GlobalLock
FormatMessageW
GetVersionExW
FindClose
GetTempFileNameW
FindFirstFileW
GetFileAttributesW
GetWindowsDirectoryW
GetModuleHandleW
SetFilePointer
ReadFile
GetModuleFileNameW
LockResource
lstrcpyW
lstrlenW
FindResourceW
LoadResource
GlobalAlloc
GlobalUnlock
LoadLibraryExW
GetTempPathW
FindNextFileW
SizeofResource
GetFileTime
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
GetCurrentProcess
DuplicateHandle
OpenProcess
GetCurrentProcessId
WritePrivateProfileStringW
GetPrivateProfileIntW
EnumResourceNamesW
GetPrivateProfileStringW
GetStdHandle
SetErrorMode
ReadProcessMemory
ExitProcess
SetCurrentDirectoryW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
EnumResourceTypesW
UnlockFileEx
GetTempPathA
GetSystemTimeAsFileTime
FormatMessageA
LockFileEx
GetSystemTime
EnterCriticalSection
AreFileApisANSI
GetFullPathNameW
GetDiskFreeSpaceW
DeleteFileA
GetFullPathNameA
InitializeCriticalSection
CreateFileA
GetDiskFreeSpaceA
Sleep
GetSystemInfo
SetEndOfFile
LeaveCriticalSection
GetFileAttributesA
QueryPerformanceCounter
GetFileAttributesExW
DeleteCriticalSection
InterlockedCompareExchange
UnlockFile
FlushFileBuffers
LockFile
GetTickCount
GetModuleHandleA
GetStartupInfoW
KERNEL32.dll
ChildWindowFromPoint
LoadCursorW
SetCursor
GetSysColorBrush
ShowWindow
SetWindowTextW
SetDlgItemInt
UpdateWindow
SetDlgItemTextW
GetDlgItemTextW
GetClientRect
GetSystemMetrics
DeferWindowPos
CreateWindowExW
GetWindowRect
SendDlgItemMessageW
GetDlgItemInt
EndDialog
SetWindowLongW
GetDlgItem
InvalidateRect
GetWindowPlacement
LoadAcceleratorsW
DefWindowProcW
SendMessageW
PostMessageW
RegisterClassW
MessageBoxW
TranslateAcceleratorW
SetMenu
SetWindowPlacement
LoadImageW
LoadIconW
GetWindowLongW
SetFocus
MoveWindow
GetMenuStringW
GetMenuItemCount
CheckMenuItem
CloseClipboard
GetCursorPos
GetParent
SetClipboardData
GetSysColor
EnableWindow
GetMenu
MapWindowPoints
GetDC
GetSubMenu
EmptyClipboard
EnableMenuItem
ReleaseDC
GetClassNameW
OpenClipboard
GetWindowTextW
LoadMenuW
ModifyMenuW
GetMenuItemInfoW
GetDlgCtrlID
DestroyMenu
DialogBoxParamW
CreateDialogParamW
EnumChildWindows
DestroyWindow
LoadStringW
SetWindowPos
PostQuitMessage
GetMessageW
DrawTextExW
IsDialogMessageW
TranslateMessage
BeginDeferWindowPos
DispatchMessageW
EndDeferWindowPos
RegisterWindowMessageW
TrackPopupMenu
USER32.dll
CreateFontIndirectW
DeleteObject
SetTextColor
SetBkMode
GetDeviceCaps
SelectObject
GetStockObject
SetBkColor
GetTextExtentPoint32W
GDI32.dll
GetOpenFileNameW
GetSaveFileNameW
FindTextW
comdlg32.dll
RegCloseKey
RegEnumValueW
RegOpenKeyExW
RegEnumKeyExW
RegQueryValueExW
ADVAPI32.dll
ShellExecuteW
SHGetFileInfoW
SHGetMalloc
SHGetPathFromIDListW
SHBrowseForFolderW
SHELL32.dll
CoUninitialize
CoInitialize
CoTaskMemFree
ole32.dll
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
abe2869f-9b47-4cd9-a358-c22904dba7f7
wwwwwp
wwwwwwwwwwwwwwwwwwww~gww
wwwwwwwwwwwwwwN
wwwwww~fww
wwwww
wwwwwwwwwwp
wwwp
w~f`
wwwwwwwwwwxwwN
wwwwpw~fhw
wwwwwwwwwwx
wwwwp
wwwwwwwwwwx
wwww`
r/fw
wwwwwwwwww
wwwwww
wwww
wwwwwwwwwx
wwwwwwwwwx
wwwwwwwwwx
wwwwwwwwww
wwwwwwwwwwx
wwww
wwwwwwwwwwx
wwwwwwp
wwwwwwwwwwx
wwwwwwww
Gwwp
xpwwwwwwwwwwwx
wwwwwwwwwwwp
Gwwp
wwwwwwwwwwwx
wwwwwwwwwwwwwwwwwwwwwwww
wwwwwwwwwww(
wwwx
*.)7l=
U2 *
r |=
UC7N
M>: C
,Z%
bg%e
KYy(6
); Sg
5B/:w
SzZs
9IC*
66p?||
]$
T&
&+:D!
$!4N
L+-
5JEw%Xg
xVWW
,WXW
k
1uuu
Hstu
%&&@bcd
<<<_
'&&<
)
(((
UUUZ
uPPP*
...(+++JFGG
C
o
&File
&Save Selected Items Ctrl+S
&Properties Alt+Enter
E&xit
&Edit
&Find Ctrl+F
&Copy Selected Items Ctrl+C
Copy &Password Ctrl+P
Select &All Ctrl+A
Deselect All Ctrl+D
&View
Show &Grid Lines
Show &Tooltips
Mark &Odd/Even Rows
&HTML Report - All Items
HTML R&eport - Selected Items
Choose Colum&ns
&Auto Size Columns Ctrl+Plus
&Refresh F5
&Options
&Advanced Options
&Help
&About
Popup1
&Save Selected Items Ctrl+S
&Copy Selected Items Ctrl+C
Copy &Password Ctrl+P
HTML Report - All Items
HTML Report - Selected Items
Choose Colum&ns
&Auto Size Columns Ctrl+Plus
&Properties Alt+Enter
&Refresh F5
Properties
MS Sans Serif
Exception !
MS Sans Serif
Copy Exception
Continue
Terminate Application
The following application error has occurred:
If this problem persists, copy the above exception information to the clipboard, and send it to the author of this software.
Advanced Options
MS Shell Dlg
Load Passwords From...
Internet Explorer
Google Chrome
Safari
Mozilla Firefox
Opera
SeaMonkey
Cancel
Firefox Options
JL
Master password:
Firefox Profile:
Firefox Installation:
Chrome Options
User Data Folder:
Opera Options
wand.dat file:
MS Sans Serif
Translation:
Column Settings
MS Shell Dlg
SysListView32
Move &Up
Move &Down
&Show
&Hide
Default
Cancel
Check the columns that you would like to make visible. Use the Move Up and Move Down buttons to reorder the columns
Width of selected column (in pixels):
%d Passwords
, %d Selected
Created by using
Select a filename to save
Web Browser Passwords%Choose another Firefox profile folder)Choose the installation folder of Firefox,Choose another profile of Chrome Web browser,Choose the password file of Opera (wand.dat)
Loading... %d
Text File
Tab Delimited Text File
Tabular Text File
HTML File - Horizontal
HTML File - Vertical
XML File
Comma Delimited Text File
KeePass csv file
Opera Password File All Files
Internet Explorer 4.0 - 6.0
Internet Explorer 7.0 - 9.0
Firefox 1.x
Firefox 2.x
Firefox 3.0
Firefox
Chrome
Opera
Safari
Internet Explorer 10.0 SeaMonkey
Web Browser User Name
Password
Password Strength
User Name Field
Password Field
Very Weak
Weak
Medium
Strong
Very Strong
VS_VERSION_INFO
StringFileInfo
040904b0
CompanyName
NirSoft
FileDescription
WebBrowserPassView
FileVersion
1.45
InternalName
WebBrowserPassView
LegalCopyright
Copyright
2011 - 2013 Nir Sofer
OriginalFilename
WebBrowserPassView.exe
ProductName
WebBrowserPassView
ProductVersion
1.45
VarFileInfo
Translation
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<dependency>
<dependentAssembly>
<assemblyIdentity type="Win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>
</dependentAssembly>
</dependency>
</assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX`
Z0X03
<<<Obsolete>>
>0!0
.
`
AddTrust AB1&0$
AddTrust External TTP Network1"0
AddTrust External CA Root0
050607080910Z
200530104838Z0
Salt Lake City1
The USERTRUST Network1!0
http://www.usertrust.com1
UTN-USERFirst-Object0
=0;09
3http://crl.usertrust.com/AddTrustExternalCARoot.crl05
)0'0%
http://ocsp.usertrust.com0
9f*<Z,m
&I+j
5"
Salt Lake City1
The USERTRUST Network1!0
http://www.usertrust.com1
UTN-USERFirst-Object0
100510000000Z
150510235959Z0~1
Greater Manchester1
Salford1
COMODO CA Limited1$0"
COMODO Time Stamping Signer0
w<
B
GS@(YC
F@@!
}Pb
;0907
1http://crl.usertrust.com/UTN-USERFirst-Object.crl05
)0'0%
http://ocsp.usertrust.com0
uu,:
*5C|k
Salt Lake City1
The USERTRUST Network1!0
http://www.usertrust.com1
UTN-USERFirst-Object0
110824000000Z
200530104838Z0{1
Greater Manchester1
Salford1
COMODO CA Limited1!0
COMODO Code Signing CA 20
"%jl
O1[P!
w#*OY
;0907
1http://crl.usertrust.com/UTN-USERFirst-Object.crl0t
h0f0=
1http://crt.usertrust.com/UTNAddTrustObject_CA.crt0%
http://ocsp.usertrust.com0
]ZB^
Y.yI
mP5\
=q/;
<a~^I
Greater Manchester1
Salford1
COMODO CA Limited1!0
COMODO Code Signing CA 20
120917000000Z
140917235959Z0
525831
Gush Dan1
Ramat Gan1
5 Hashoshanim st.1
Nir Sofer1
Nir Sofer0
xcM-
0_<`
-;_R
?0=0;
0+0)
https://secure.comodo.net/CPS0A
:0806
0http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
f0d0<
0http://crt.comodoca.com/COMODOCodeSigningCA2.crt0$
http://ocsp.comodoca.com0
support@nirsoft.net0
0qP9o
{aL
@G3$
Greater Manchester1
Salford1
COMODO CA Limited1!0
COMODO Code Signing CA 2
;~u+
-66B
Salt Lake City1
The USERTRUST Network1!0
http://www.usertrust.com1
UTN-USERFirst-Object
131113095028Z0#
"T.#
&[T/R
RoL:A
uRy
K
Qsqih
F~.0
]'~C-
!This program cannot be run in DOS mode.
$
.text
`.rsrc
@.reloc
I MZ
K PE
XKnX(
XKn(
XKXT
BSJB
v2.0.50727
#Strings
#GUID
#Blob
<Module>
CMemoryExecute.dll
CMemoryExecute
mscorlib
System
Object
CONTEXT_FULL
CREATE_SUSPENDED
MEM_COMMIT
MEM_RESERVE
PAGE_EXECUTE_READWRITE
IMAGE_DOS_SIGNATURE
IMAGE_NT_SIGNATURE
.ctor
CreateProcess
VirtualAllocEx
NtUnmapViewOfSection
NtWriteVirtualMemory
NtGetContextThread
NtSetContextThread
NtResumeThread
exeBuffer
hostProcess
optionalArguments
lpApplicationName
lpCommandLine
lpProcessAttributes
lpThreadAttributes
bInheritHandles
dwCreationFlags
lpEnvironment
lpCurrentDirectory
lpStartupInfo
lpProcessInfo
hProcess
lpAddress
dwSize
flAllocationType
flProtect
lpBaseAddress
lpBuffer
nSize
lpNumberOfBytesWritten
hThread
lpContext
SuspendCount
System.Reflection
AssemblyTitleAttribute
AssemblyDescriptionAttribute
AssemblyConfigurationAttribute
AssemblyCompanyAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyTrademarkAttribute
AssemblyCultureAttribute
System.Runtime.InteropServices
ComVisibleAttribute
GuidAttribute
AssemblyVersionAttribute
AssemblyFileVersionAttribute
System.Security.Permissions
SecurityPermissionAttribute
SecurityAction
System.Diagnostics
DebuggableAttribute
DebuggingModes
System.Runtime.CompilerServices
CompilationRelaxationsAttribute
RuntimeCompatibilityAttribute
Byte
Int32
Buffer
Array
BlockCopy
String
IsNullOrEmpty
Concat
IntPtr
Zero
op_Explicit
op_Equality
DllImportAttribute
kernel32.dll
ntdll.dll
System.Security
UnverifiableCodeAttribute
CMemoryExecute
Copyright
2012
$8fcd4931-91a2-4e18-849b-70de34ab75df
1.0.0.0
WrapNonExceptionThrows
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
SkipVerification
RSDS
C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb
_CorDllMain
mscoree.dll
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
FileDescription
CMemoryExecute
FileVersion
1.0.0.0
InternalName
CMemoryExecute.dll
LegalCopyright
Copyright
2012
OriginalFilename
CMemoryExecute.dll
ProductName
CMemoryExecute
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0
!This program cannot be run in DOS mode.
$
Rich
.text
`.rdata
@.data
.rsrc
SUVW3
Pj0h
=HsA
hHsA
hX$A
:=tC
hf$A
Nt'-
B99t]
hh4A
hxEA
t|VW
u$9M
tEHt;
@SVW
\$43
D$@
,0< w
D$$;
9D$D~
;D$D}
t
@;D$D|
D$4Yu
\$0F;t$(
9\$ t
9\$$t
9\$@
|$0YY
t$0t
9\$8t
@j P
QQVW
:=t7
hf$A
Ph$%A
hL%A
PhT%A
ht%A
ht%A
Yu$3
j
WV
j
X9
_^[Y
D$$P
ts9]
D$)P
D$*P
D$*PQ
D$ P
t!SSj
t$(SS
EX,&A
E H&A
E$T&A
E(d&A
E<p&A
Eh4'A
PhL'A
Ph`'A
Phd&A
t=,V
t=\V
t=<V
E@t'A
E <&A
E$H&A
E,d&A
Eh (A
El4(A
hD(A
hT(A
t'hd&A
Ph\(A
Phh(A
ht(A
Vj}X
Ph()A
Ph0)A
Ph@)A
PhL)A
PhX)A
Phd)A
Php)A
hf$A
[SVh
t"j@V
_^[t
YYt @P
hf$A
h,*A
PhX)A
Ph<*A
PhL*A
Ph\*A
Phh*A
Phx*A
_^[t
_^[t
u+VWj
<"u
h
YY_^[
QSVW
h +A
h`,A
Pht(A
Ph\-A
SVWh8=A
hX$A
hh>A
h<.A
YYVW
YY_^
hH.A
hh.A
8hp.A
hx.A
YYu
h</A
hL/A
hX/A
hd/A
hp/A
QQSVWh
_^[u
SVWj
YYF;
QSVj
YYNy
QVWj
,Wj
Y3
(VWj
333310
33331
j?_#
_^]3
QSWh
w9WWh2
SSh
j&Sh6
NSVW
QQSV3
SVu3
YYt
WVVh
WVVh
WVVh
VVWh
VVWh
VVWh
VVWh
VWWh
VWWW
VWWj
Vh(0A
VWPS
h40A
YY^[
\t
hD0A
hH0A
tnSVWj
tJSWU
<0\t
SVj<3
hx4A
hX0A
=PuA
SVWj
5\ A
FVAQPW
h|0A
j Y;
~
hx0A
vcVj
VW3
GFF;u
QQSVW
QSVW
Yt<Wj
uA9]
u<9]
{<"u
uN< tf
;A0}
9~0~
YYt
G;~0|
hp0A
ht0A
_^[]
tCSUW
YYs
SV
9;|$
SVW3
t{SSh
GG9M
9\$t
|$|P
D$,J
D$0hyA
D$$P
D$0P
D$<P
j:Pf
T$<R
=@uA
5HuA
=@uA
8uA
t0@;
5,uA
4uA
=(uA
tDhd1A
5,uA
5,uA
5,uA
5,uA
;
@uA
8uA
;
DuA
(uA
5,uA
<uA
0uA
D$MSP
D$$0
D$,6
8\$H
|$(V
D$Tj P
9\$,
t#9]
YYt49\$
9\$,t
VhP1A
tMVW
5x"A
Y_^]
hX1A
PhH1A
Vhf$A
Phf$A
Phf$A
D$ESP
D$ 0
D$$6
td8\$@tH
D$@j P
9\$$
D$ t
L$@QP
YY9\$$t
G;|$
ht1A
YY_3
hP1A
hX1A
PhH1A
YYSh
YtyVW
hl1A
@j?h
hl1A
hd1A
@@f9
$SW3
F$S3
PQh@4A
h84A
YYtZ
Yt*3
_^[t
j X[
t99}
u4SV
WWh2
Y~*S
[_^]
QSW3
9^(W~0
C;^(|
9~(~I
C;^(|
9^(W~&
C;^(|
9^@Wt
9^(~
u3C;^(|
9~ ~D
G;~ |
SWj2
9^ ~B
C;^ |
<"u
h
C H9E
9~ ~SS
G;~ |
`VWj
9s YY
u
h
F;s
YY_^
hP2A
h`2A
9s YY
YYPh
u
h
9_ YY~uVh
wPPh
C;_ |
A;N |
t#W3
t"S3
9^(~A
C;^(|
t
G;}
=$ A
j j
=, A
=D A
_^][YY
F;5
,0< wFA
GWhI
~,Pj
9Y0~K
YYu'
F;q0|
hf$A
MlQj
SSSjh
QPSj
SSh
Eh~'
9X0~
hH4A
h`vA
E`Pj
PjiX
h 4A
h(4A
h04A
YY_^
SVW3
D$0`5A
D$4PjpX
QQSV
u0VVh#
hX$A
hh4A
9X0~
D$8
hH4A
D$dl5A
D$PP
5\!A
D$DP
L$DQP
D$DP
D$DP
D$DP
D$PP
D$dl5A
D$`t$A
?t0j@_+
_^[]
j?Y#
s&WQj
>QZ^&
ht0A
ht0A
SVht0A
Y~^h
YYu
Yh$6A
Yh06A
YYu>
YYtw
YYtbC;
98t?
j
hH6A
t)9^
hT6A
h\6A
hl6A
YYt"3
Y_^[
YY9]
YY9]
YY9]
YY9]
YY9]
YY9]
YYu-
$ 7A
h 7A
$,7A
h,7A
h<7A
hD7A
hH7A
YYu!
VVhd7A
t*9}
tKWW
9\$0
D$=SP
D$DPj
D$<h08A
uxSSW
v%SSW
@;D$
ShD8A
PWShd8A
D$<P
D$<PSht8A
D$$j@
D$,^
D$0P
D$,P
D$<WP
t$$P
D$@P
SVWt
5t A
5dlA
YYSh
5XlA
5|nA
YYt;h
5XlA
5dlA
5TlA
5<lA
5@lA
5HlA
5LlA
5DlA
5PlA
5|nA
5pnA
6hpnA
5l A
Wht%A
hh%A
hD9A
_^][
F PS
ht%A
ht%A
hT9A
h`9A
hp9A
uzWh`0A
h :A
Wh0:A
h<:A
tNhP:A
t=hd:A
t,h|:A
Y|Ch
>\uEh
SVW3
D$pPS
D$HP
D$tP
D$LP
D$P+D$H
+\$t
+D$x
D$X+D$P
!D$,9
;D$
)D$0
t$0h
D$4P
t$4h
L$8QP
D$<P
D$\P
+D$<
+D$`h
D$l+D$d@P3
D$\P
L$D+
+D$Dh
+D$dAQ
L$H+L$@AQ
t$Hj
YtCj
VD^]
50!A
j~^V
50!A
h8;A
Ph`;A
VPhf$A
YY^[
^@[]
teWV
= uA
Bt9HHt.
t"Ht
u8h,<A
Nh4<A
GhL<A
@h <A
9h@<A
2hT<A
t!Ht
Ht
Ht
hx<A
hh<A
SVWS
Ht'HuC
SVWj
U<>u
I<"u
h =A
h(=A
Wh0=A
YY~"P
YY9_
YYt
h
YY9]
hP2A
h >A
hL>A
hX>A
Pht>A
YY~)
YYuFWVh
9^$W
F$u/j
F$u
W
h4?A
hH?A
hX?A
&<>" '
t 9u
<;t|B
~)WR
t5< w1;]
~ GW
hf$A
SUV3
9_4t0
<
w
w H
9w@t)
X9G$
9w0t(
9w0u
$ u#
9w8t,
>u-9w(u(
_^][
Y9O$uB
SUVW
Yh$CA
YYu"
h4CA
YYu"
hDCA
YYu"
hTCA
YYu"
hdCA
htCA
YYu0
YYt"h
YYt"h,DA
hDDA
SSVPj
tdSV3
YSSj
h\DA
hD7A
hhDA
:-tI
SVW3
Pj(X
SVW3
%,#A
%d#A
%`#A
%\#A
=p{A
hl{A
hp{A
%X#A
%T#A
%P#A
%L#A
%H#A
%D#A
%@#A
%<#A
%(#A
%$#A
% #A
%0#A
=l A
8MZu
l{A
p{A
>"u:F
j
XPVSS
Y_^[
%t#A
%x#A
%2.2X
MS Sans Serif
Mail PassView
Mozilla\Profiles
Thunderbird\Profiles
current
Software\Qualcomm\Eudora\CommandLine
Software\Classes\Software\Qualcomm\Eudora\CommandLine\current
Software\Mozilla\Mozilla Thunderbird
%s\Main
Install Directory
sqlite3.dll
nss3.dll
%programfiles%\Mozilla Thunderbird
ShowGridLines
SaveFilterIndex
AddExportHeaderLine
MarkOddEvenRows
%s %s %s
POP3 User Name
IMAP User Name
HTTPMail User Name
SMTP USer Name
POP3 Server
IMAP Server
HTTPMail Server
SMTP Server
POP3 Password2
IMAP Password2
HTTPMail Password2
SMTP Password2
POP3 Port
IMAP Port
HTTPMail Port
SMTP Port
POP3 Secure Connection
IMAP Secure Connection
HTTPMail Secure Connection
SMTP Secure Connection
SMTP Display Name
SMTP Email Address
POP3 Password
IMAP Password
HTTP Password
SMTP Password
POP3 User
IMAP User
HTTP User
SMTP User
HTTP Server URL
HTTP Port
POP3 Use SPA
IMAP Use SPA
HTTPMail Use SSL
SMTP Use SSL
Display Name
Email
Identities
Username
Software\Microsoft\Internet Account Manager\Accounts
%s\%s
Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
DisplayName
EmailAddress
PopAccount
PopServer
PopPort
PopLogSecure
PopPassword
SMTPAccount
SMTPServer
SMTPPort
SMTPLogSecure
SMTPPassword
Software\IncrediMail\Identities
Identity
%s\Accounts
Settings
UsesIMAP
LoginName
RealName
ReturnAddress
SavePasswordText
Personalities
Server Details
ESMTPUsername
ESMTPPassword
POP3Server
POP3Username
POP3Password
InstallPath
Software\Group Mail
fb.dat
%s@gmail.com
%s@yahoo.com
"Account","Login Name","Password","Web Site","Comments"
www.google.com/Please log in to your Gmail account
www.google.com:443/Please log in to your Gmail account
www.google.com/Please log in to your Google Account
www.google.com:443/Please log in to your Google Account
Software\Microsoft\Windows Messaging Subsystem\Profiles
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Software\Microsoft\Office\15.0\Outlook\Profiles
<meta http-equiv='content-type' content='text/html;charset=%s'>
<table dir="rtl"><tr><td>
<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>
</table>
www.google.com
pop3
imap
smtp
advapi32.dll
CredReadA
CredFree
CredDeleteA
CredEnumerateA
CredEnumerateW
comctl32.dll
InitCommonControlsEx
Error
Error: Cannot load the common control classes.
*.ini
netmsg.dll
Unknown Error
Error %d: %s
edit
kernel32.dll
open
%2.2X
%s (%s)
POP3_credentials
POP3_name
POP3_host
Software\Google\Google Desktop\Mailboxes
Software\Google\Google Talk\Accounts
Microsoft_WinInet
caption
menu_%d
dialog_%d
strings
general
sysdatetimepick32
charset
TranslatorName
TranslatorURL
_lng.ini
%-18s: %s
%%-%d.%ds
<td bgcolor=#%s nowrap>%s
<td bgcolor=#%s>%s
<tr>
&nbsp;
<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s
bgcolor="%s"
<table border="1" cellpadding="5">
nowrap
<font color="%s">%s</font>
</table><p>
<item>
<%s>%s</%s>
</item>
<?xml version="1.0" encoding="ISO-8859-1" ?>
<%s>
</%s>
/sort
/nosort
SysListView32
/noloadsettings
report.html
commdlg_FindReplace
*.txt
*.htm;*.html
*.xml
*.csv
.cfg
General
WinPos
Sort
Columns
Software\NirSoft\MailPassView
MailPassView
Arial
/stext
/shtml
/sverhtml
/sxml
/stab
/scomma
/stabular
/skeepass
/savelangfile
/deleteregkey
Failed to load the executable file !
user_pref("
mail.account.account
server
identities
mail.server
username
type
hostname
port
useSecAuth
true
mail.identity
useremail
fullname
signon.signonfilename
mailbox://
imap://
mailbox://%s@%s
imap://%s@%s
SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins
mailbox://%s
imap://%s
signons.txt
signons.sqlite
none
prefs.js
Password.NET Messenger Service
User.NET Messenger Service
Software\Microsoft\MSNMessenger
Software\Microsoft\MessengerService
Passport.Net\*
Creds
ps:password
WindowsLive:name=*
windowslive:name=
Software\Microsoft\IdentityCRL
Dynamic Salt
Value
{Unknown}
Exception %8.8X at address %8.8X in module %s
Registers:
EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8X
ESI=%8.8X EDI=%8.8X EBP=%8.8X ESP=%8.8X
EIP=%8.8X
Stack Data: %s
Code Data: %s
mozsqlite3.dll
NSS_Init
NSS_Shutdown
PK11_GetInternalKeySlot
PK11_FreeSlot
PK11_CheckUserPassword
PK11_Authenticate
PK11SDR_Decrypt
CreateToolhelp32Snapshot
Module32First
Module32Next
Process32First
Process32Next
psapi.dll
GetModuleBaseNameA
EnumProcessModules
GetModuleFileNameExA
EnumProcesses
GetModuleInformation
\systemroot
STATIC
EDIT
pstorec.dll
PStoreCreateInstance
5e7e8100-9138-11d1-945a-00c04fc308ff
00000000-0000-0000-0000-000000000000
220D5CD0-853A-11D0-84BC-00C04FD43F8F
220D5CD1-853A-11D0-84BC-00C04FD43F8F
220D5CC1-853A-11D0-84BC-00C04FD43F8F
417E2D75-84BD-11D0-84BB-00C04FD43F8F
shell32.dll
SHGetSpecialFolderPathA
AppData
Favorites
Desktop
Start Menu
Programs
Startup
Common Start Menu
Common Programs
Common Desktop
Common Startup
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
shlwapi.dll
SHAutoComplete
%2.2X%2.2X%2.2X
&lt;
&gt;
&quot;
&deg;
&amp;
<br>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>%s<title>%s</title></head>
<body>
%s <h3>%s</h3>
</body></html>
<font
size="%d"
color="#%s"
</b>
</font>
<font color="%s">
<table border="1" cellpadding="5"><tr%s>
width="%s"
<th%s>%s%s%s
</table>
SOFTWARE\Mozilla
mozilla
%s\bin
PathToExe
\sqlite3.dll
\mozsqlite3.dll
sqlite3_open
sqlite3_prepare
sqlite3_step
sqlite3_column_text
sqlite3_column_int
sqlite3_column_int64
sqlite3_finalize
sqlite3_close
sqlite3_exec
amp;
quot;
nbsp;
apos;
iexcl;
cent;
pound;
curren;
yen;
brvbar;
sect;
uml;
copy;
ordf;
laquo;
not;
shy;
reg;
macr;
deg;
plusmn;
sup2;
sup3;
acute;
micro;
para;
middot;
cedil;
sup1;
ordm;
raquo;
frac14;
frac12;
frac34;
iquest;
Agrave;
Aacute;
Acirc;
Atilde;
Auml;
Aring;
AElig;
Ccedil;
Egrave;
Eacute;
Ecirc;
Euml;
Igrave;
Iacute;
Icirc;
Iuml;
ETH;
Ntilde;
Ograve;
Oacute;
Ocirc;
Otilde;
Ouml;
times;
Oslash;
Ugrave;
Uacute;
Ucirc;
Uuml;
Yacute;
THORN;
szlig;
agrave;
aacute;
acirc;
atilde;
auml;
aring;
aelig;
ccedil;
egrave;
eacute;
ecirc;
euml;
igrave;
iacute;
icirc;
iuml;
eth;
ntilde;
ograve;
oacute;
ocirc;
otilde;
ouml;
divide;
oslash;
ugrave;
uacute;
ucirc;
uuml;
yacute;
thorn;
yuml;
A}A}A
Software\Microsoft\Windows Mail
Software\Microsoft\Windows Live Mail
Salt
Account_Name
POP3_Server
IMAP_Server
NNTP_Server
SMTP_Server
POP3_User_Name
IMAP_User_Name
NNTP_User_Name
SMTP_User_Name
POP3_Password2
IMAP_Password2
NNTP_Password2
SMTP_Password2
NNTP_Email_Address
SMTP_Email_Address
SMTP_Port
NNTP_Port
IMAP_Port
POP3_Port
SMTP_Secure_Connection
NNTP_Secure_Connection
IMAP_Secure_Connection
POP3_Secure_Connection
*.oeaccount
\Microsoft\Windows Mail
\Microsoft\Windows Live Mail
Store Root
Software\Yahoo\Pager
Yahoo! User ID
EOptions string
salu
?RSDS
f:\Projects\VS2005\mailpv\Release\mailpv.pdb
strcat
sprintf
strncat
strlen
memset
strcpy
_ultoa
_purecall
strchr
_mbscmp
wcsstr
_strcmpi
atoi
_mbsicmp
memcpy
??2@YAPAXI@Z
??3@YAXPAX@Z
_stricmp
strrchr
_memicmp
malloc
strcmp
strtoul
memcmp
modf
free
_strnicmp
wcsncmp
wcschr
wcslen
_itoa
_strlwr
qsort
strncmp
_mbsnbicmp
_snprintf
_mbsrchr
msvcrt.dll
__dllonexit
_onexit
_c_exit
_exit
_XcptFilter
_cexit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_except_handler3
ImageList_ReplaceIcon
ImageList_AddMasked
ImageList_Create
ImageList_SetImageCount
CreateToolbarEx
COMCTL32.dll
UuidFromStringA
RPCRT4.dll
GetPrivateProfileStringA
MultiByteToWideChar
WideCharToMultiByte
ExpandEnvironmentStringsA
LocalFree
WriteFile
GetPrivateProfileSectionA
FreeLibrary
GetProcAddress
LoadLibraryA
GlobalLock
GlobalUnlock
CreateFileA
GetFileSize
GetModuleFileNameA
FindNextFileA
FindFirstFileA
LoadLibraryExA
SetFilePointer
GetLastError
GetFileAttributesA
GetTempFileNameA
FindClose
FormatMessageA
GetWindowsDirectoryA
ReadFile
GetVersionExA
CloseHandle
GetTempPathA
GlobalAlloc
GetComputerNameA
GetPrivateProfileIntA
WritePrivateProfileStringA
EnumResourceNamesA
GetStdHandle
DeleteFileA
ExitProcess
GetCurrentProcess
ReadProcessMemory
GetCurrentProcessId
GetModuleHandleA
GetCurrentDirectoryA
SetCurrentDirectoryA
OpenProcess
FindResourceA
LoadResource
EnumResourceTypesA
SizeofResource
LockResource
GetStartupInfoA
KERNEL32.dll
SetCursor
ChildWindowFromPoint
LoadCursorA
GetSysColorBrush
ShowWindow
GetDlgItem
CreateWindowExA
InvalidateRect
SetDlgItemInt
BeginPaint
GetClientRect
GetWindow
SetDlgItemTextA
DrawFrameControl
GetDlgItemTextA
SendDlgItemMessageA
SetWindowTextA
GetWindowRect
GetSystemMetrics
GetDlgItemInt
DeferWindowPos
EndPaint
EndDialog
GetWindowPlacement
RegisterClassA
UpdateWindow
SetMenu
LoadAcceleratorsA
SetWindowPos
DefWindowProcA
TranslateAcceleratorA
MessageBoxA
SendMessageA
LoadIconA
GetWindowLongA
SetWindowLongA
SetFocus
BeginDeferWindowPos
EndDeferWindowPos
GetDC
EmptyClipboard
GetSubMenu
MoveWindow
EnableMenuItem
ReleaseDC
CheckMenuItem
GetMenuItemCount
GetMenuStringA
SetClipboardData
EnableWindow
MapWindowPoints
GetCursorPos
LoadImageA
GetSysColor
GetClassNameA
CloseClipboard
GetMenu
OpenClipboard
EnumChildWindows
GetMenuItemInfoA
GetWindowTextA
LoadMenuA
GetParent
LoadStringA
CreateDialogParamA
ModifyMenuA
DestroyWindow
DialogBoxParamA
GetDlgCtrlID
DestroyMenu
PostMessageA
TrackPopupMenu
PostQuitMessage
RegisterWindowMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
DrawTextExA
DispatchMessageA
GetFocus
USER32.dll
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
SelectObject
GetDeviceCaps
SetBkColor
GetTextExtentPoint32A
GDI32.dll
GetSaveFileNameA
GetOpenFileNameA
FindTextA
comdlg32.dll
RegCloseKey
GetUserNameA
RegDeleteKeyA
RegOpenKeyExA
RegEnumKeyA
RegQueryValueExA
RegEnumKeyExA
ADVAPI32.dll
ShellExecuteA
SHBrowseForFolderA
SHGetMalloc
SHGetPathFromIDListA
SHELL32.dll
CoInitialize
CoUninitialize
CoTaskMemFree
ole32.dll
%GKP$^%^&LL(%^$^O&TR$^%^GV6;lxzd
abe2869f-9b47-4cd9-a358-c22904dba7f7
82BD0E67-9FEA-4748-8672-D5EFE5B779B0
wwwwwp
wwwwwwwwwwwwwwwwwwww~gww
wwwwwwwwwwwwwwN
wwwwww~fww
wwwww
wwwp
w~f`
wxwwN
wwwwpw~fhw
{{{{
wwwwp
wwww`
r/fw
{{{x
wwwwww
wwww
wwww
wwwwwwp
wwwx
wwwwwwww
Gwwp
xpwwwx
pwwwwx
wwwwwwwwwwwp
Gwwp
wwwwwwwwwwwx
wwwwwwwwwwwwwwwwwwwwwwww
wwwwwwwwwww(
wwwx
wwwwwwwwwwwwwwp
zzzp
zzww
"""""
{{{{
&File
Select &Folders F6
&Save Selected Items Ctrl+S
&Properties Alt+Enter
E&xit
&Edit
&Find Ctrl+F
&Copy Selected Items Ctrl+C
Copy Password Ctrl+P
Select &All Ctrl+A
Deselect All Ctrl+D
&View
Show &Grid Lines
Add Header Line To CSV/Tab-Delimited File
Mark Odd/Even Rows
&HTML Report - All Items
HTML R&eport - Selected Items
Choose Colum&ns
&Auto Size Columns Ctrl+Plus
&Refresh F5
&Help
&About
Popup1
&Save Selected Items Ctrl+S
&Copy Selected Items Ctrl+C
Copy Password Ctrl+P
HTML Report - All Items
HTML Report - Selected Items
Choose Colum&ns
&Auto Size Columns Ctrl+Plus
&Properties Alt+Enter
&Refresh F5
Properties
MS Sans Serif
Exception !
MS Sans Serif
Copy Exception
Continue
Terminate Application
The following application error has occurred:
If this problem persists, copy the above exception information to the clipboard, and send it to the author of this software.
Select Folders / Files
MS Sans Serif
ThunderBird Profiles:
Browse...
ThunderBird 3 Installation:
Browse...
Netscape Folder:
Browse...
Eudora INI File:
Browse...
Default
Cancel
MS Sans Serif
Translation:
Column Settings
MS Shell Dlg
SysListView32
Move &Up
Move &Down
&Show
&Hide
Default
Cancel
Check the columns that you would like to make visible. Use the Move Up and Move Down buttons to reorder the columns
Width of selected column (in pixels):
%d items
, %d Selected
Created by using
Select a filename to save
Email Accounts List
Select base folder of Netscape!Select base folder of ThunderBird
Select Eudora.ini filename/Select the location of Thunderbird installation
Loading... %d
Text Files
Tab delimited text file
Tabular Text File
HTML File - Horizontal
HTML File - Vertical
XML File
Comma delimited text file
KeePass csv file
Eudora.ini file
POP3
IMAP
HTTP
SMTP
NNTP
Outlook Express
IncrediMail
Eudora
Group Mail Free
MS Outlook
MS Outlook 2002/2003/2007/2010
Gmail
Hotmail/MSN
Yahoo! Mail
Netscape Mail
Thunderbird
Google Desktop
Windows Mail
Windows Live Mail
Outlook 2013
Name
Application
Email
Server
Type
User
Password
Profile
Server Port
Secured
Password Strength
SMTP Server
SMTP Server Port
Very Weak
Weak
Medium
Strong
Very Strong
VS_VERSION_INFO
StringFileInfo
040904b0
CompanyName
NirSoft
FileDescription
Mail Password Recovery
FileVersion
1.80
InternalName
Mail PassView
LegalCopyright
Copyright
2003 - 2013 Nir Sofer
OriginalFilename
mailpv.exe
ProductName
Mail PassView
ProductVersion
1.80
VarFileInfo
Translation
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="NirSoft" type="win32"></assemblyIdentity><description>NirSoft</description><dependency><dependentAssembly><assemblyIdentity type="Win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency></assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
`:JC
}:7D
=+@r6w
ZH\:,
MkG2
RF~
_0|s
;/]t
/N3sC
3JrUYRo
k]~8g*
.2Z5
Xx4Fn
/l
t
K^Cc
Bsy"^
eF%i6
yAhgv
$$*i
hipk=
i(-C
&.b0
<eUP
-ox<
i]f@
F"Kv[
H{5B
}.nL
f
N b[
K4C1&
!Kn b
^t^C
XGpz
XjV7
zT5x
4ELd
P_K7p
Xs,g,
(9o[6
d!m\
f3
}Cu
DN$
b0.
Aq'u=
l."(/
-RYA
:444
I]7e
Mo5"]v
65m2
.Xhf0"
m?'*
,YOKm
J8U*T
a+g(J
^y;Q
%^8yH
5{mW3
.E?gVqX
)0Ir
np\_}J
yrY3
`8&/:
tiHE
59DB
'+$+
NRkmjt7
kk'<L
L2tI
'eA5
_vQ<
A_xJMBLh
Zf)&
@xi<s
sk);{
6^o1
MxrlJ
:Ge%
su {
(P~*
q^)
?kdw
jt[
pC|X
0a^bzC
9p}3
wyWew
Ydvb
,n~eNi
Q#f0
hs(
.
?4h
%lM6
hH9>
Bql~
54Y,
|0uu\
N!S]to
9Ybowq
Cmb2$-
cN[c
Xu^I
LL
1|i
FL2-
h:F)Z`
1u]b{
nfzs%
^*[K
Q/6'
6r);
J=BE
QxwJ
kko_N#
Yzq>
LF:U
HJqx
rT
j
Y6Sx
+{CRD
>579
D#^v8
N|6G-dJL6}
gr{b
/P/*"
&,o
;`@#Ka\
lT7|
+ LJ*
j|&|f
XS~\M +J
y8$*J
K0,S
R:@EW
sV+mO
rT@T
v\e4
*\v7
#_-Y
mQLG
4HHp
2<MW&
2Sl/Y
%i7g
w>OE'
m9Mv^.m
kA 0c
Qb>UgY
;)@.
OS!QH+
YazF
9ixv
Y_/9Ex
#JT@l
`]~<
o1T+
Vz!O
PZltg
yQR E
~k>>
c&,3Q
l'F4
f/(N
BYgRg
:W07
MB7
't6d
yQxG
@=vf90x
K<X=
d]lu9
jDm,
fd&YQ
/|2-
oo|
G=Pw
0e8@
h#%awu:
gl9hw
=9
(
qO_RP
}.SK
L]6.n
q"l2
vnrX-Px5t
+6E!
+IE?:
byJ&
|%#
taZ6
]|1pH
A<:h
WRC,
u \m
Q7\-
g0 {
p FL
:]bpveg
o6<$3V
$k7;}t
X80)
cDSx
QWtk
Y}!XhL
AHk5
hJ!~~
!;%X
NR}2
pvK4
=
\Q
Rbh3
/=+
yDf[
V M)!
)1C+-E
CAUm;e
yn>!
N(MwaT
#D%(w{-*
!QC$
N;E.
O dR
5$vh/iP
u+}~h
u|5~
B<8#
e7^8
]yb~
m%G[T
6l(D
Imfk
;]tm=q
.;cK
TFU
P;x9'
xJ)^
p]\S
^TaH
DZ%J
! T"w
6|]Y'
Q[j7[6G
!?dx
iH!\
}?}L
R,rZ
2Ujp
2\m^E
t{D
mK0r
@
QV?
nxOC
wA)
IRP8
H:/A
6d>B
{Q-Kz
vXa/
VKAm
C3RH
9vZJ
DDDSW
4@m*
)m( l
hYj^h
XBpF
?n`jgh
VrVL
u@W(
+<_W
!a^IQ/+
WS?T!
6B; m
\n <
JS5Z
?Lqt
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
fSystem.Drawing.Icon, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aBj
$this.Icon
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Icon
IconData
IconSize
System.Drawing.Size
System.Drawing.Size
width
height
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
fSystem.Drawing.Icon, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3ajSystem.CodeDom.MemberAttributes, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089mSystem.Globalization.CultureInfo, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089fSystem.Drawing.Size, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
$this.SnapToGrid
$this.TrayLargeIcon
$this.Icon
$this.Locked
$this.DrawGrid
progressBar1.Modifiers
$this.Localizable
$this.Language
$this.GridSize
$this.TrayHeight
progressBar1.Locked
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Icon
IconData
IconSize
System.Drawing.Size
System.Drawing.Size
width
height
ISystem, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
System.CodeDom.MemberAttributes
value__
System.Globalization.CultureInfo
cultureID
m_isReadOnly
compareInfo
textInfo
numInfo
dateTimeInfo
calendar
m_name
m_dataItem
m_useUserOverride
System.Globalization.CompareInfo
System.Globalization.TextInfo%System.Globalization.NumberFormatInfo'System.Globalization.DateTimeFormatInfo
System.Globalization.Calendar
System.Globalization.CompareInfo
win32LCID
culture
m_name
System.Globalization.TextInfo
m_listSeparator
m_isReadOnly
customCultureName
m_nDataItem
m_useUserOverride
m_win32LangID
%System.Globalization.NumberFormatInfo!
numberGroupSizes
currencyGroupSizes
percentGroupSizes
positiveSign
negativeSign
numberDecimalSeparator
numberGroupSeparator
currencyGroupSeparator
currencyDecimalSeparator
currencySymbol
ansiCurrencySymbol nanSymbol
positiveInfinitySymbol
negativeInfinitySymbol
percentDecimalSeparator
percentGroupSeparator
percentSymbol
perMilleSymbol
nativeDigits
m_dataItem
numberDecimalDigits
currencyDecimalDigits
currencyPositivePattern
currencyNegativePattern
numberNegativePattern
percentPositivePattern
percentNegativePattern
percentDecimalDigits
digitSubstitution
isReadOnly
m_useUserOverride
validForParseAsNumber
validForParseAsCurrency
Infinity
-Infinity
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Size
width
height
_CorExeMain
mscoree.dll
.2Rfhn M
m
M
0!0
wwwwwwwwwwwwww
wwwwwwwwwwwwww
wwwwwwwwwwwwww
wwwwwwwwwwwwww
wwwwwwwwwwwwww
wwwwwwwwwwwwww
wwwwwwwwwwwwww
wwwwwwwwwwwwww
wwwwww
wwwwww
wwwwww
wwwwww
PNG
IHDR
pHYs
IDATx
IEND
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
FileDescription
Phulli
FileVersion
1.0.0.0
InternalName
Phulli.exe
LegalCopyright
Copyright
2014
OriginalFilename
Phulli.exe
ProductName
Phulli
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
[^_]
p-;q
L-;q
(-;q
F,?q
e#;q
f&;q
l*cq
Z*cq
*cqP
[^_]
cq3
`+Qq
5+Qq
c*Qq
C*Qq
6(Qq
[^_]
>}jo
V<Aq
#<Aq
Q ;q
@;Aq
;Aq
t:Aq
A:Aq
u9Aq
B9Aq
|8Aq
I8Aq
}7Aq
J7Aq
~6Aq
Q6Aq
*6Aq
{5Aq
95Aq
1mjo
5Aq
y4Aq
y3Aq
[^_]
c
cq
!
cq
,
cq
cq
y cq
> cq
[^_]
[^_]
/F<q
[^_]
7[;q
:Rjo
f%jo
D ko
2Qjo
B
ko
$Mjo
[^_]
[^_]
}bq3
|bq3
TAAq
{bq3
[^_]
ybq3
[^_]
vbq3
[^_]
5vbq3
tbq3
h|:q
[^_]
sbq3
[^_]
obq3
obq3
x3Aq
g0&p
[^_]
U_bq
\ybq
2xbq
lxbq
Hwbq
LXbq
TT>q
[^_]
Wbq3
<Z:q
[^_]
Qbq3
MP:q
[^_]
p;bq3
":bq3
a6>q
\9bq3
-Q:q
4n@q
[^_]
6bq3
~r-s
Ce-s
#e-s
ZY-s
asip
E6:q
NH:q
!H:q
Y-bq
kg p
jHbq
[^_]
M+bq3
!dCq
*bq3
iEbq
WEbq
EEbq
Ebq
Jp<qP
W^@q
[^_]
t%?q
8MZt
[^_]
?%?q
[^_]
[^_]
[^_]
Y#bq
B+:q
[^_]
]l:t
>(1t
big5.nlp
prcp.nlp
prc.nlp
big5.nlp
prc.nlp
prcp.nlp
prc.nlp
prcp.nlp
prc.nlp
xjis.nlp
ksc.nlp
bopomofo.nlp
AEUETHssaeuethIJijOEoeD
LJLjljNJNjnj
DZDzdz
fffiflf
<
<
< #
< +
< 3
< 7
< ;
< ?
< C
< G
< K
< O
< S
< W
< [
< _
< c
< g
< k
< o
< s
< w
< {
<
! <
" <
# <
$ <
% <
& <
' <
( <
* <
+ <
, <
- <
. <
/ <
0 <
2 <
3 <
5 <
6 <
7 <
8 <
9 <
` < '
a < /
<
M
M
q
<
q
M
p
<
p
8
<
8
9
<
<
<
@
<
D
<
H
<
L
<
P
<
T
<
X
<
\
<
`
<
d
<
h
<
l
!
<
p
"
<
t
#
<
x
$
<
|
%
<
&
<
'
<
(
<
*
<
+
<
,
<
-
<
.
<
/
<
0
<
2
<
5
<
\
<
3
<
6
<
s
A
s
B
s
K
?
L
$
r
?
,
r
@
0
r
G
4
<
M
q
<
M
<
M
p
PRhX<
qUSVW
_^[]
PRh`9
qUSVW
(WVS
E$;q
E#;q
_^[]
qUSVW
u'PRV
~7qZX
_^[]
qUSVW
Pj h
[;qP
\;qX3
s}7qZX
_^[]
i
qUSVW
_^[]
qUSVW
s5;q
|7qP
_^[]
qUSVW
{7q
{7qP
u'PRV
z7qZX
_^[]
qUSVW
.z7q
z7qP
z7qZX
_^[]
PRhX<
qUSVW
_^[]
qUSVW
32;q
_^[]
qUSVW
Rx7qP
u%PRV
nw7qZX
_^[]
qUSVW
c0;q
_^[]
qUSVW
k/;q
_^[]
qUSVW
u7qP
t7qZX
_^[]
qUSVW
_^[]
qUSVW
Ts7q
u%PRV
/s7qZX
_^[]
qUSVW
vr7q
7s7qP
u'PRV
Sr7qZX
_^[]
qUSVW
Sr7qP
u'PRV
oq7qZX
_^[]
qUSVW
wq7qP
u'PRV
p7qZX
_^[]
P
5q
j
5q
qUSVW
;);q
_^[]
U 5q
o 5q
qUSVW
o7qP
o7qP
u'PRV
n7qZX
_^[]
PRhX<
qUSVW
_^[]
PRh`9
qUSVW
(WVS
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
t08}
PRhX<
qUSVW
_^[]
PRh`9
qUSVW
(WVS
_^[]
PRhX<
qUSVW
_^[]
}sT
PRh`9
qUSVW
(WVS
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRh`9
qUSVW
(WVS
}
;q
p ;q
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRh`9
qUSVW
(WVS
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
:lU
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
qUSVW
nT7qP
u%PRV
S7qZX
_^[]
qUSVW
_^[]
qUSVW
R7qP
u'PRV
Q7qZX
_^[]
t0P;
qUSVW
Q7qP
u'PRV
P7qZX
_^[]
qUSVW
Pj h$
%.;qP
.;qXPRV
O7qZX
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRh`9
qUSVW
(WVS
_^[]
qUSVW
fL7qP
u'PRV
K7qZX
_^[]
qUSVW
Pj h
(;qP
);qXPRV
J7qZX
_^[]
qUSVW
Pj h
(;qP
J7qP
(;qXPRV
I7qZX
_^[]
p
qUSVW
I7qP
I7qP
u'PRV
H7qZX
_^[]
qUSVW
Pj h
&;qP
&;qXPRV
G7qZX
_^[]
p
qUSVW
Pj hL
$;qP
%;qX3
uF7qZX
_^[]
PRhX<
qUSVW
_^[]
4qRh
qUSVW
_^[]
4qRh
qUSVW
+D7q
R8;P
u`;H
l;H$u
`;H,u
T;H4u
H;H<u
<;HDu
0;HLu
$;HTu
>qPPV
>qXP
_u0X
u'PRV
`C7qZX
_^[]
PSQR
qTqZ
4qRh
qUSVW
R8;P
u`;H
l;H$u
`;H,u
T;H4u
H;H<u
<;HDu
0;HLu
$;HTu
>qPPV
>qXP
_u.X
u%PRV
A7qZX
_^[]
PSQR
WpTqZ
4qRh
qUSVW
R8;P
u`;H
l;H$u
`;H,u
T;H4u
H;H<u
<;HDu
0;HLu
$;HTu
>qPPV
>qXP
_u0X
u'PRV
@7qZX
_^[]
PSQR
nTqZ
qUSVW
<?7q
u%PRV
$?7qZX
_^[]
qUSVW
d>7q
u%PRV
I>7qZX
_^[]
t0lZ
PRhX<
qUSVW
_^[]
t0lZ
PRhX<
qUSVW
_^[]
4qRh
qUSVW
R8;P
u`;H
l;H$u
`;H,u
T;H4u
H;H<u
<;HDu
0;HLu
$;HTu
>qPPV
>qXP
_u.X
u%PRV
;7qZX
_^[]
PSQR
iTqZ
qUSVW
:7qP
u'PRV
97qZX
_^[]
PRhX<
qUSVW
_^[]
4qRh
qUSVW
w87q
R8;P
u`;H
l;H$u
`;H,u
T;H4u
H;H<u
<;HDu
0;HLu
$;HTu
}>qPPV
~>qXP
_u0X
u'PRV
77qZX
_^[]
PSQR
JfTqZ
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
qUSVW
z47qP
u'PRV
37qZX
_^[]
i
qUSVW
37qP
27qZX
_^[]
qUSVW
27qP
17qZX
_^[]
PRh`9
qUSVW
(WVS
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
qUSVW
y(7qZX
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
PRhX<
qUSVW
_^[]
Actx
SsHd,
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
Microsoft.Windows.Common-Controls
Microsoft.Windows.Common-Controls,processorArchitecture="x86",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.7601.17514"C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest
x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2
Microsoft.Windows.Common-Controls.Resources
Microsoft.Windows.Common-Controls.Resources,language="en-us",processorArchitecture="x86",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.7600.16385"C:\Windows\WinSxS\manifests\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9.manifest
x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9
en-US
SsHd,
comctl32.dll
comctl32.dll.mui
SsHd,
\a*L
ToolbarWindow32
6.0.7601.17514!ToolbarWindow32
comctl32.dll
ComboBoxEx32
6.0.7601.17514!ComboBoxEx32
comctl32.dll
msctls_trackbar32
6.0.7601.17514!msctls_trackbar32
comctl32.dll
msctls_updown32
6.0.7601.17514!msctls_updown32
comctl32.dll
msctls_progress32
6.0.7601.17514!msctls_progress32
comctl32.dll
msctls_hotkey32
6.0.7601.17514!msctls_hotkey32
comctl32.dll
msctls_statusbar32
6.0.7601.17514!msctls_statusbar32
comctl32.dll
SysHeader32
6.0.7601.17514!SysHeader32
comctl32.dll
SysListView32
6.0.7601.17514!SysListView32
comctl32.dll
SysTreeView32
6.0.7601.17514!SysTreeView32
comctl32.dll
SysTabControl32
6.0.7601.17514!SysTabControl32
comctl32.dll
SysIPAddress32
6.0.7601.17514!SysIPAddress32
comctl32.dll
SysPager
6.0.7601.17514!SysPager
comctl32.dll
NativeFontCtl
6.0.7601.17514!NativeFontCtl
comctl32.dll
Button
6.0.7601.17514!Button
comctl32.dll
Static
6.0.7601.17514!Static
comctl32.dll
Listbox
6.0.7601.17514!Listbox
comctl32.dll
ScrollBar
6.0.7601.17514!ScrollBar
comctl32.dll
SysLink
6.0.7601.17514!SysLink
comctl32.dll
tooltips_class32
6.0.7601.17514!tooltips_class32
comctl32.dll
ButtonListBox
6.0.7601.17514!ButtonListBox
comctl32.dll
SysAnimate32
6.0.7601.17514!SysAnimate32
comctl32.dll
SysMonthCal32
6.0.7601.17514!SysMonthCal32
comctl32.dll
SysDateTimePick32
6.0.7601.17514!SysDateTimePick32
comctl32.dll
ReBarWindow32
6.0.7601.17514!ReBarWindow32
comctl32.dll
Edit
6.0.7601.17514!Edit
comctl32.dll
Combobox
6.0.7601.17514!Combobox
comctl32.dll
ComboLBox
6.0.7601.17514!ComboLBox
comctl32.dll
DropDown
6.0.7601.17514!DropDown
comctl32.dll
GsHd(
GsHd(
GsHd(
GsHd(
2=AM
SERN
FILE=C:\Users\Bill
windir=C:\Windows
windows_tracing_flags=3
windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
C:\Users\Bill\Desktop\30% tt Slip.exe
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Bill\AppData\Roaming
CommonProgramFiles=C:\Program Files (x86)\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
CommonProgramW6432=C:\Program Files\Common Files
COMPUTERNAME=BILL-PC
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Bill
LOCALAPPDATA=C:\Users\Bill\AppData\Local
LOGONSERVER=\\BILL-PC
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\Python27\;C:\Python27\Scripts;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_ARCHITEW6432=AMD64
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 61 Stepping 4, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=3d04
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files (x86)
ProgramFiles(x86)=C:\Program Files (x86)
ProgramW6432=C:\Program Files
PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
PUBLIC=C:\Users\Public
SESSIONNAME=Console
SSLKEYLOGFILE=C:\Users\Bill\Desktop\SSL\ssl.log
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\Bill\AppData\Local\Temp
TMP=C:\Users\Bill\AppData\Local\Temp
USERDOMAIN=Bill-PC
USERNAME=Bill
USERPROFILE=C:\Users\Bill
windir=C:\Windows
windows_tracing_flags=3
windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log
! #!%"'#)$+%-&/'1(3)5*7+9,;-=.?/A0E1I2M3Q4U5Y6]7a8e9i:m;q<u=y>}?
8c8c
.net clr networking
phulli[2528]
connections established
bytes received
bytes sent
datagrams received
datagrams sent
_global_
=::=::\
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Bill\AppData\Roaming
CommonProgramFiles=C:\Program Files\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
CommonProgramW6432=C:\Program Files\Common Files
COMPUTERNAME=BILL-PC
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Bill
LOCALAPPDATA=C:\Users\Bill\AppData\Local
LOGONSERVER=\\BILL-PC
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\Python27\;C:\Python27\Scripts;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=AMD64
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 61 Stepping 4, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=3d04
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
ProgramFiles(x86)=C:\Program Files (x86)
ProgramW6432=C:\Program Files
PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
PUBLIC=C:\Users\Public
SESSIONNAME=Console
SSLKEYLOGFILE=C:\Users\Bill\Desktop\SSL\ssl.log
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\Bill\AppData\Local\Temp
TMP=C:\Users\Bill\AppData\Local\Temp
USERDOMAIN=Bill-PC
USERNAME=Bill
USERPROFILE=C:\Users\Bill
windir=C:\Windows
windows_tracing_flags=3
windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log
allpackage\csilogfile.log
.log
.log
C:\Users\Bill\Desktop\
C:\Users\Bill\Desktop;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Python27\;C:\Python27\Scripts;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\
C:\Users\Bill\Desktop\30% tt Slip.exe
"C:\Users\Bill\Desktop\30% tt Slip.exe"
C:\Users\Bill\Desktop\30% tt Slip.exe
Winsta0\Default
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\system32
C:\Windows\SYSTEM32
C:\Windows\
\SYSTE
TEM32\
C:\Windows\SYSTEM32\wow64cpu.dll
h-f
C:\Windows\SYSTEM32\wow64.dll
TEM32\
C:\Windows\SYSTEM32\wow64win.dll
\SYSTE
\Sessions\1\Windows\ApiPortection\Sy
Domain
Registry\Machine\System\CurrentControlSet\Services\
ters
erfaces\{846EE342-7039-11DE-9D20-806E6F6E6963}
@=vO
@=vO
@=vO
@=vO
@=vO
@=vO
@=vO
@=vO
@=vO
@=vO
@=vO
@=vO
@=vO
@=vO
@=vO
\Registry\Machine\Software\Wow6432Node\Policies\Microsoft\System\DNSclient
@=vO
@=vO
System
smss.exe
csrss.exe
wininit.exe
csrss.exe
winlogon.exe
services.exe
J}`R
lsass.exe
J}`R
J}`R
lsm.exe
svchost.exe
VBoxService.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
spoolsv.exe
taskhost.exe
svchost.exe
armsvc.exe
sppsvc.exe
dwm.exe
explorer.exe
VBoxTray.exe
svchost.exe
svchost.exe
"(ch
SearchIndexer.exe
wmpnetwk.exe
P-Mon.exe
P-Mon64.exe
P-Exp-64.exe
Wireshark.exe
dumpcap.exe
ost.
conhost.exe
30% tt Slip.exe
WmiPrvSE.exe
SearchProtocolHost.exe
SearchFilterHost.exe
o w
A?? A??
A??
A??
A??
A?? A??!A??"A??#A??$A??%A??&A??'A??(A??)A??*A??+A??,A??-A??.A??/A??0A??1A??2A??3A??4A??5A??6A??7A??8A??9A??:A??;A??<A??=A??>A???A??@A??AA??
B?? B??
B??
B??
B??
B?? B??!B??"B??#B??$B??%B??&B??'B??(B??)B??*B??+B??,B??-B??.B??/B??0B??1B??2B??3B??4B??5B??6B??7B??8B??9B??:B??;B??<B??=B??>B???B??@B??AB??BB??CB??DB??EB??FB??GB??HB??IB??JB??KB??LB??MB??NB??OB??PB??QB??RB??SB??TB??UB??VB??WB??XB??YB??ZB??[B??\B??]B??^B??_B??`B??aB??bB??cB??dB??eB??fB??gB??hB??iB??jB??kB??lB??mB??nB??oB??pB??qB??rB??sB??tB??uB??vB??wB??xB??yB??zB??{B??|B??}B??~B??
C?? C??
C??
C??
C??
C?? C??!C??"C??#C??$C??%C??&C??'C??(C??)C??*C??+C??,C??-C??.C??/C??0C??1C??2C??3C??4C??5C??6C??7C??8C??9C??:C??;C??<C??=C??>C???C??@C??AC??BC??CC??DC??EC??FC??GC??HC??IC??JC??KC??LC??MC??NC??OC??PC??QC??RC??SC??TC??UC??VC??WC??XC??YC??ZC??[C??\C??]C??^C??_C??`C??aC??bC??cC??dC??eC??fC??gC??hC??iC??jC??kC??lC??mC??nC??oC??pC??qC??rC??sC??tC??uC??vC??wC??xC??yC??zC??{C??|C??}C??~C??
D?? D??
D??
D??
D??
D?? D??!D??"D??#D??$D??%D??&D??'D??(D??)D??*D??+D??,D??-D??.D??/D??0D??1D??2D??3D??4D??5D??6D??7D??8D??9D??:D??;D??<D??=D??>D???D??@D??AD??BD??CD??DD??ED??FD??GD??HD??ID??JD??KD??LD??MD??ND??OD??PD??QD??RD??SD??TD??UD??VD??WD??XD??YD??ZD??[D??\D??]D??^D??_D??`D??aD??bD??cD??dD??eD??fD??gD??hD??iD??jD??kD??lD??mD??nD??oD??pD??qD??rD??sD??tD??uD??vD??wD??xD??yD??zD??{D??|D??}D??~D??
E?? E??
E??
E??
E??
E?? E??!E??"E??#E??$E??%E??&E??'E??(E??)E??*E??+E??,E??-E??.E??/E??0E??1E??2E??3E??4E??5E??6E??7E??8E??9E??:E??;E??<E??=E??>E???E??@E??AE??BE??CE??DE??EE??FE??GE??HE??IE??JE??KE??LE??ME??NE??OE??PE??QE??RE??SE??TE??UE??VE??WE??XE??YE??ZE??[E??\E??]E??^E??_E??`E??aE??bE??cE??dE??eE??fE??gE??hE??iE??jE??kE??lE??mE??nE??oE??pE??qE??rE??sE??tE??uE??vE??wE??xE??yE??zE??{E??|E??}E??~E??
A;=8
A:>p
A:>:
A:>:
A:1:
qUSVW
_^[]
A:%5
qUSVW
PPPPPh
_^[]
A::!
A;>>
A:#;
Rh@
}
A::'
A:)>
qUSVW
_^[]
A:3-
qUSVW
zM,q
_^[]
A::7
A::>
A::>
A;8>
A: =
Rh4
}
A::$
A::>
A::>
! #!%"'#)$+%-&/'1(3)5*7+9,;-=.?/A0E1I2M3Q4U5Y6]7a8e9i:m;q<u=y>}?
@25Q
}8}8}
A:">
KA@qY
A::&
A::>
}8}8}
%?9t
P$1t
v'1t
P$1t
P$1t
.1t
.1t
>(1t
!This program cannot be run in DOS mode.
$
Rich
.text
@.rsrc
@.reloc
Q'J
MSCORRC.DLL
RSDS
mscorrc.pdb
VS_VERSION_INFO
StringFileInfo
040904B0
CompanyName
Microsoft Corporation
FileDescription
Microsoft .NET Runtime resources
FileVersion
2.0.50727.4927 (NetFXspW7.050727-4900)
InternalName
mscorrc.dll
LegalCopyright
Microsoft Corporation. All rights reserved.
OriginalFilename
mscorrc.dll
ProductName
Microsoft
.NET Framework
ProductVersion
2.0.50727.4927
Comments
Flavor=Retail
VarFileInfo
Translation
A call to PInvoke function '%1$s' has unbalanced the stack. This is likely because the managed PInvoke signature does not match the unmanaged target signature. Check that the calling convention and parameters of the PInvoke signature match the target unmanaged signature.)The '%1$s' configuration file is invalid.
A callback was made on a garbage collected delegate of type '%1$s'. This may cause application crashes, corruption and data loss. When passing delegates to unmanaged code, they must be kept alive by the managed application until it is guaranteed that they will never be called.
An attempt was made to change the apartment state of the thread to %1$s, but it has already been set to %2$s. When creating a new thread the apartment state shouldbe set before the thread is started. For the main thread of the application, the apartmentstate can be set by specifying either [STAThreadAttribute] or [MTAThreadAttribute] on themain method of the application. If the application really needs to attempt to set the apartment state on a running thread, Thread.TrySetApartmentState should be used and the return value should be consulted to determine if the operation was successful. Note that Thread.TrySetApartmentState will not fire the InvalidApartmentStateChange MDA.
The current thread used to have an apartment state of %1$s, but the application has CoUnitialized this thread and it is now %2$s. This may cause calls on RuntimeCallableWrappers representing some COM components to fail and may also cause COM component that are not multi-threaded to be accessed from multiple threads at the same time which can cause corruption or data loss.
Attempting managed execution inside OS Loader lock. Do not attempt to run managed code inside a DllMain or image initialization function since doing so can cause the application to hang.
An exception was caught but handled while releasing a COM interface pointer through Marshal.Release, Marshal.ReleaseComObject or implicitly after the corresponding RuntimeCallableWrapper was garbage collected. This is the result of a user refcount error or other problem with a COM object's Release. Make sure refcounts are managed properly. While these types of exceptions are caught by the CLR, they can still lead to corruption and data loss so if possible the issue causing the exception should be addressed
An invalid VARIANT was detected during a conversion from an unmanaged VARIANT to a managed object. Passing invalid VARIANTs to the CLR can cause unexpected exceptions, corruption or data loss.
The call to QI for interface '%1$s' with IID '%2$s' failed with HRESULT 0x%3$s (%4$s). One likely reason this failed is that the object does not have a proxy/stub dll properly registered.
Context 0x%1$x is disconnected. No proxy will be used to service the request on the COM component. This may cause corruption or data loss. To avoid this problem, please ensure that all contexts/apartments stay alive until the application is completely done with the RuntimeCallableWrappers that represent COM components that live inside them.
Context 0x%1$x' is disconnected. Releasing the interfaces from the current context (context 0x%2$x).This may cause corruption or data loss. To avoid this problem, please ensure that all contexts/apartments stay alive until the applicationis completely done with the RuntimeCallableWrappers that represent COM components that liveinside them.
A non marshalable COM component is being used from a different apartment/context then the one where it first entered the CLR. Since the component is non marshalable, it will be called directly from the current apartment/context. This may cause corruption or data loss if the component does not support being accessed from multiple threads at once. This is most likely caused by a faulty IMarshal implementation on the part of the COM component.
An invalid IUnknown* was detected during a conversion from a COM component to a managed object. Passing invalid IUnknown pointers to the CLR can cause unexpected exceptions, corruption or data loss.JMarshaling parameter with index %1$i and name '%2$s' from '%3$s' to '%4$s'
Invalid function pointer 0x%1$x was passed into the runtime to be converted to a delegate. Passing in invalid function pointers to be converted to delegates can cause crashes, corruption or data loss.
The assembly named '%1$s' was loaded from '%2$s' using the LoadFrom context. The use of this context can result in unexpected behavior for serialization, casting and dependency resolution. In almost all cases, it is recommended that the LoadFrom context be avoided. This can be done by installing assemblies in the Global Assembly Cache or in the ApplicationBase directory and using Assembly.Load when explicitly loading assemblies.
The CLR has been unable to transition from COM context 0x%1$x to COM context 0x%2$x for 60 seconds. The thread that owns the destination context/apartment is most likely either doing a non pumping wait or processing a very long running operation without pumping Windows messages. This situation generally has a negative performance impact and may even lead to the application becoming non responsive or memory usage accumulating continually over time. To avoid this problem, all single threaded apartment (STA) threads should use pumping wait primitives (such as CoWaitForMultipleHandles) and routinely pump messages during long running operations.
An attempt has been made to free an RCW that is in use. The RCW is in use on the active thread or another thread. Attempting to free an in-use RCW can cause corruption or data loss.
A UTC DateTime is being converted to text in a format that is only correct for local times. This can happen when calling DateTime.ToString using the 'z' format specifier, which will include a local time zone offset in the output. In that case, either use the 'Z' format specifier, which designates a UTC time, or use the 'o' format string, which is the recommended way to persist a DateTime in text. This can also occur when passing a DateTime to be serialized by XmlConvert or DataSet. If using XmlConvert.ToString, pass in XmlDateTimeSerializationMode.RoundtripKind to serialize correctly. If using DataSet, set the DateTimeMode on the DataColumn object to DataSetDateTime.Utc.
The following error occurred while determining how to marshal the parameters of member '%1$s' of type '%2$s': %3$s This is most likely due to an incompatible MarshalAs attribute on one of the parameters.
A COM client has called managed method '%1$s' on type '%2$s'. This method does not have an HRESULT return type and an exception was thrown that was not handled. The exception contains the following message: %3$s. This exception will be caught and zero will be returned to the COM caller if the method's return type is not void.
Attempting to call into managed code without transitioning out first. Do not attempt to run managed code inside low-level native extensibility points, such as the vectored exception handler, since doing so can cause corruption and data loss.
A QueryInterface call was made requesting the class interface of COM visible managed class '%1$s'. However since this class derives from non COM visible class '%2$s', the QueryInterface call will fail. This is done to prevent the non COM visible base class from being constrained by the COM versioning rules.
A QueryInterface call was made requesting the default IDispatch interface of COM visible managed class '%1$s'. However since this class does not have an explicit default interface and derives from non COM visible class '%2$s', the QueryInterface call will fail. This is done to prevent the non COM visible base class from being constrained by the COM versioning rules.
The assembly with display name '%1$s' loaded from code base '%2$s' failed to load in the '%3$s' binding context of the AppDomain with ID %4$d. The cause of the failure was: %5$s
An attempt was made to retrieve a GCHandle from an invalid IntPtr cookie (0x%1$x). The cookie was most likely invalid because the cookie does not represent a GCHandle, the GCHandle has already been freed, the retrieval was attempted in the wrong AppDomain, or the GCHandle was marshaled to native code as a GCHandle but passed back into managed code as an IntPtr where a cast was attempted. Attempting to use an invalid pointer to reclaim a GC handle can cause unexpected exceptions, crashes, corruption or data loss.
An exception was caught but handled while releasing a COM interface pointer through Marshal.Release or Marshal.ReleaseComObject or implicitly after the corresponding RuntimeCallableWrapper was garbage collected. This is the result of a user refcount error or other problem with a COM object's Release. Make sure refcounts are managed properly. The COM interface pointer's original vtable pointer was 0x%1$x. While these types of exceptions are caught by the CLR, they can still lead to corruption and data loss so if possible the issue causing the exception should be addressedGThe first PInvoke call to export '%1$s' in module '%2$s' has been made.
The runtime has encountered a fatal error. The address of the error was at 0x%1$08x, on thread 0x%2$x. The error code is 0x%3$08x. This error may be a bug in the CLR or in the unsafe or non-verifiable portions of user code. Common sources of this bug include user marshaling errors for COM-interop or PInvoke, which may corrupt the stack.
hUser code has attempted to call the following API: '%1$s'. This may result in a deadlock in the process.
An overlapped pointer (0x%1$p) that was not allocated on the GC heap was passed via PInvoke to the Win32 function '%2$s' in module '%3$s'. If the AppDomain is shut down, this can cause heap corruption when the async I/O completes. The best solution is to pass a NativeOverlapped structure retrieved from a call to System.Threading.Overlapped.Pack(). If the AppDomain exits, the CLR will keep this structure alive and pinned until the I/O completes.
An overlapped pointer (0x%1$p) may have been freed before the I/O operation completed. Freeing an overlapped pointer before the I/O operation completes will cause GC heap corruption when the I/O does complete. Note that this MDA may not represent an error if the overlapped operation did not start successfully
The native component calling into the CLR through this ComCallWrapper has performed an illegal cast on this IUnknown or IDispatch pointer. The caller neglected to call QueryInterface for the correct interface before making this call.HA thread has entered fiber mode and therefore debugging must be stopped.
The assembly loaded from code base '%1$s' failed to load in the '%2$s' binding context of the AppDomain with ID %3$d. The cause of the failure was: %4$s
The assembly with display name '%1$s' failed to load in the '%2$s' binding context of the AppDomain with ID %3$d. The cause of the failure was: %4$s-Marshaling field '%1$s' from '%2$s' to '%3$s'
return value
unknown
DLL '%1$s' is attempting managed execution inside OS Loader lock. Do not attempt to run managed code inside a DllMain or image initialization function since doing so can cause the application to hang. %1$s Managed Debugging Assistant
An early bound call (vtable call) was made on the following member of an auto dispatch class interface: '%1$s'. Early bound calls on members of auto dispatch class interfaces are not allowed. Please consider using an explicit interface as the default interface for the type. If a class interface must be called early bound, change it to auto dual. This can be accomplished by marking the class with the following attribute, located in the System.Runtime.InteropServices namespace: [ClassInterface(ClassInterfaceType.AutoDual)]
Method '%1$s', while executing within a constrained execution region, makes a call at IL offset 0x%2$04X to '%3$s', which does not have a sufficiently strong reliability contract and might cause non-deterministic results.
Method '%1$s', while executing within a constrained execution region, makes a call at IL offset 0x%2$04X to '%3$s', which is virtual and cannot be prepared automatically at compile time. The caller must ensure this method is prepared explicitly at runtime before entering the constrained execution region.
Method '%1$s', which contains at least one constrained execution region, cannot be prepared automatically since it has one or more unbound generic type parameters. The caller must ensure this method is prepared explicitly at runtime prior to execution.
Method '%1$s' calls RuntimeHelpers.PrepareConstrainedRegions() at IL offset 0x%2$04X. This is invalid since it does not coincide with the beginning of a try clause.
The CLR marshaler encountered an error while attempting to restore the thread culture after a call from unmanaged to managed where an LCID was used to specify the culture for the call. This will cause the thread's culture to remain set to the one associated with the LCID. The cause of the failure was: %1$s
The CLR marshaler encountered an error while attempting to release the reference to a SafeHandle it acquired in order to marshal the SafeHandle to an unmanaged pointer during a call from managed to unmanaged. This may cause the unmanaged resource the SafeHandle represents to be leaked. The cause of the failure was: %1$s
The CLR marshaler encountered an error while attempting to associate a SafeHandle with an unmanaged resource. This may cause the unmanaged resource to be leaked. The cause of the failure was: %1$s
An exception was thrown from the CleanupNativeData method of a custom marshaler of type '%1$s'. This may cause an unmanaged data leak and should be corrected if possible. The cause of the failure was: %1$s
A SafeHandle or CriticalHandle of type '%1$s' failed to properly release the handle with value 0x%2$p. This usually indicates that the handle was released incorrectly via another means (such as extracting the handle using DangerousGetHandle and closing it directly or building another SafeHandle around it.)
Function DllMain, called with reason DLL_PROCESS_ATTACH, returned FALSE. DLL initialization failed. To ignore the DllMain return, set Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\IgnoreDllMainReturn to 1*Reflection has created a memberInfo cache.
User code running on thread %1$i has attempted to abort thread %2$i. This may result in a corrupt state or resource leaks if the thread being aborted was in the middle of an operation that modifies global state or uses native resources. Aborting threads other than the currently running thread is strongly discouraged.
'%s' is not a valid name.
*Version %d.%d is not a compatible version.
#Shared memory '%hs' already exists.
No metadata was found.
Database is read-only.
/Database file is corrupt and may not be usable.%Version %d of schema '%hs' not found.
9Null value is not allowed in unique index or primary key.#Duplicate record violates index %s.-VARIANT data type is not allowed in an index.
Index %s not found.
No records found.!Record capacity has been reached.9Record violates the primary key constraint for the table.
Primary key value is required.)Access to deleted records is not allowed.
BAttempt to update read-only column failed (column %d, table '%s').5Only one column can be the RID or primary key column.5Primary key column '%s' may not allow the null value.
Object not found.
Column '%s' not found.
%d out of range.
9A token passed to a metadata function has the wrong type.
Internal error 0x%08x.
+Module information inconsistent upon merge.\Ignoring IDL custom attribute '%ls' on '%ls' because it must be used with an integral value.`Ignoring IDL custom attribute '%ls' on '%ls' because it cannot be used on an IUnknown interface.VType '%hs' contains arrays of SafeHandles, which cannot be exported to a type library.XInconsistent method declarations in duplicated types (types: %s; methods: %s): (0x%08x).VInconsistent field declarations in duplicated types (types: %s; fields: %s): (0x%08x).[Inconsistent parameter information in duplicated methods (methods: %s; type: %s): (0x%08x).
^Inconsistent implemented interfaces in duplicated types (types: %s; interfaces: %s): (0x%08x).ZType '%hs' contains arrays of CriticalHandles, which cannot be exported to a type library.CInconsistent layout information in duplicated types (%s): (0x%08x).
VInconsistent event declarations in duplicated types (types: %s; events: %s): (0x%08x).]Inconsistent property declarations in duplicated types (types: %s; properties: %s): (0x%08x).
aInconsistent method implementation flags in duplicated methods (methods: %s; type: %s): (0x%08x)./Custom attributes are not consistent: (0x%08x).
OInconsistent Generic information in duplicated types or methods (%s): (0x%08x).>Differing number of events in duplicated types (%s): (0x%08x).BDiffering number of properties in duplicated types (%s): (0x%08x).ZA TypeRef exists which should, but does not, have a corresponding TypeDef: (%s): (0x%08x).)SizeConst is required for a fixed string.KA MarshalType or MarshalTypeRef setting is required for a custom marshaler.%A filename is required for DllImport.VType library importer has encountered a source interface containing properties: '%ls'.
The enum member '%hs.%ls' has a value that cannot be expressed as a 32-bit integer. Type library enum members must be 32-bit integers.?Differing number of methods in duplicated types (%s): (0x%08x).>Differing number of fields in duplicated types (%s): (0x%08x).WDiffering number of parameters in duplicated method (types: %s; methods: %s): (0x%08x).
Type '%hs' has auto-layout but is being exported. Consider marking the type [ComVisible(false)] since the exported definition is not guaranteed to work.
Cannot export TypedReference.(Default interface is not visible to COM.
System.Array fields without a SafeArraySubType cannot be used from COM. For legacy reasons, they are exported as SAFEARRAYs of VARIANTs. However, at runtime, they are not marshaled as such.
Type library exporter encountered a reference type with layout marked as [MarshalAs(UnmanagedType.Interface)] in a signature. The reference type was instead treated as if it were marked with [MarshalAs(UnmanagedType.IUnknown)].
?The custom attribute is not valid for the target object's type.
Incorrect argument value.NUnable to process the custom attribute value - it may be corrupt or incorrect.5Custom attribute argument %*s should not be repeated.,Unrecognized custom attribute argument: %*s./Custom attribute does not yet support variants.-Custom attribute does not yet support arrays.
Unexpected argument type.4Unexpected property found in custom attribute value.8Argument '%s' cannot be applied to objects of this type.
Incorrect UUID format.WMarshalAs attribute has fields set that are not valid for the specified unmanaged type.1Specified unmanaged type is only valid on fields.#Parameter index cannot be negative.
Multiplier cannot be negative.!Constant size cannot be negative.
Type library exporter encountered a type that derives from a generic class and is not marked as [ClassInterface(ClassInterfaceType.None)]. Class interfaces cannot be exposed for such types. Consider marking the type with [ClassInterface(ClassInterfaceType.None)] and exposing an explicit interface as the default interface to COM using the ComDefaultInterface attribute.
Unable to export this assembly with the specified machine type as the assembly is marked machine specific with a different machine type.tType library importer encountered a source interface on coclass '%ls' with a NewEnum member. This is not supported.
Type library importer encountered a property getter '%ls' on type '%ls' without a valid return type. The importer will attempt to import this property as a method instead.4Duplicate managed types have different visibilities.{[%1] InternalsVisibleTo declarations cannot have a version, culture, public key token, or processor architecture specified.f[%1] Strong-name signed assemblies must specify a public key in their InternalsVisibleTo declarations.
OError (Structural): Table=0x%08x, Col=0x%08x, Row=0x%08x, has rid out of range.\Error (Structural): Table=0x%08x, Col=0x%08x, Row=0x%08x, has coded token type out of range.UError (Structural): Table=0x%08x, Col=0x%08x, Row=0x%08x, has coded rid out of range.WError (Structural): Table=0x%08x, Col=0x%08x, Row=0x%08x, has an invalid String offset.UError (Structural): Table=0x%08x, Col=0x%08x, Row=0x%08x, has an invalid GUID offset.UError (Structural): Table=0x%08x, Col=0x%08x, Row=0x%08x, has an invalid BLOB offset.%Error: Multiple module records found.
Error: Module has no MVID.
Error: TypeRef has no name.-Error: TypeRef has a duplicate, token=0x%08x.
Error: TypeDef has no name.IError: TypeDef has a duplicate based on namespace and name, token=0x%08x.=Warning: TypeDef has a duplicate based on GUID, token=0x%08x.
AError: Signature containing ELEMENT_TYPE_SENTINEL must be VARARG.3Error: Multiple ELEMENT_TYPE_SENTINEL in signature.3Error: Trailing ELEMENT_TYPE_SENTINEL in signature.*Error: Signature is missing argument # %d.
Error: Field of ByRef type.7Error: Synchronized method in ValueType (token=0x%08x).FError: Full name length exceeds maximum allowed (length: %d; max: %d).4Error: Duplicate Assembly Processor record (0x%08x).-Error: Duplicate Assembly OS record (0x%08X).3Error: ManifestResource has invalid flags (0x%08x).'Warning: ExportedType has no TypeDefId.'Error: File has invalid flags (0x%08x).
Error: File has no hash BLOB.
Error: Module has no name.&Error: Module name is fully-qualified.;Error: TypeDef marked as RTSpecialName but not SpecialName.
@Error: FieldLayout2 record has Field token=0x%08x marked Static.7Error: FieldLayout2 record has a duplicate, rid=0x%08x.
Error: ModuleRef has no name.1Warning: ModuleRef has a duplicate, token=0x%08x.,Error: TypeRef has invalid resolution scope.:Error: TypeDef is marked Nested but has no enclosing type.nWarning: Type extends TypeRef which resolves to TypeDef in the same module (TypeRef: 0x%08x; TypeDef: 0x%08x).
Error: Signature has zero size.gError: Signature does not have enough bytes left at byte=0x%08x as indicated by the compression scheme.7Error: Signature has invalid calling convention=0x%08x.OError: Method is marked Static but calling convention=0x%08x is marked HASTHIS.XError: Method is not marked Static, but calling convention=0x%08x is not marked HASTHIS.6Error: Signature has no argument count at byte=0x%08x.XError: Signature missing element type after modifier (modifier: 0x%02x; offset: 0x%08x).2Error: Signature missing token after element 0x%x.FError: Signature has an invalid token (token: 0x%08x; offset: 0x%08x).
"Warning: [CLS] Field in Interface.1Warning: Unrecognized Hash Algorithm ID (0x%08x).6Error: Unrecognized Processor ID (0x%08x) in Assembly.JWarning: Unrecognized Processor ID (0x%08x) in AssemblyRef (token=0x%08x).6Error: Constant parent token (0x%08x) is out of range.'Error: Invalid Assembly flags (0x%04x).9Warning: TypeDef (token=0x%08x) has same name as TypeRef.<Error: InterfaceImpl has invalid implementing type (0x%08x).;Error: InterfaceImpl has invalid implemented type (0x%08x).FError: TypeDef has security information but is not marked HasSecurity.EError: TypeDef is marked HasSecurity but has no security information./Error: Type constructor must have no arguments.>Error: ExportedType has invalid Implementation (token=0x%08x).?Error: MethodImpl has body from another TypeDef (token=0x%08x).7Error: Type constructor has invalid calling convention.0Error: MethodImpl has invalid Type token=0x%08x.
SError: TypeDef that is not an Interface and not the Object class extends Nil token.FError: TypeDef for Object class extends token=0x%08x which is not nil.;Error: TypeDef extends token=0x%08x which is marked Sealed.@Error: TypeDef is a Deleted record but not marked RTSpecialName.CError: TypeDef is marked RTSpecialName but is not a Deleted record.:Error: MethodImpl overrides private method (token=0x%08x).BError: Assembly name contains leading spaces or path or extension.'Error: File has a reserved system name.>Error: MethodImpl has static overriding method (token=0x%08x).4Error: TypeDef is marked Interface but not Abstract.DError: TypeDef is marked Interface but extends non-Nil token=0x%08x.5Warning: TypeDef is marked Interface but has no GUID.8Error: MethodImpl overrides final method (token=0x%08x).HError: TypeDef is a Value Type, Enum or Delegate, but not marked Sealed..Error: Parameter has invalid flags set 0x%08x.3Error: InterfaceImpl has a duplicate, token=0x%08x.
3Error: TypeDef extends an Interface (token=0x%08x).4Error: Type/instance constructor marked PInvokeImpl.'Error: System.Enum is not marked Class.0Error: System.Enum must extend System.ValueType._Error: MethodImpl's Decl (token=0x%08x) and Body (token=0x%08x) method signatures do not match.
Error: Enum has method(s).$Error: Enum implements interface(s).
Error: Enum has properties.#Error: Enum has one or more events.6Error: TypeDef has invalid Method List (> Nmethods+1).4Error: TypeDef has invalid Field List (> Nfields+1).*Error: Constant has illegal type (0x%02x)."Error: Enum has no instance field.)Error: Enum has multiple instance fields.
YError: Event has related method belonging to another type (method: 0x%08x; type: 0x%08x).)Error: Event has no AddOn related method.,Error: Event has no RemoveOn related method.IError: ExportedType has same namespace and name as TypeDef, token 0x%08x.BError: ManifestResource refers to non-PE file but offset is not 0.@Error: Decl.Security is assigned to invalid item (token=0x%08x).6Error: Decl.Security has invalid action flag (0x%08x).7Error: Decl.Security has no associated permission BLOB.BError: ManifestResource has invalid Implementation (token=0x%08x).
7Warning: [CLS] MemberRef has VARARG calling convention.1Error: Constructor, initializer must return void.5Error: Event's Fire method (0x%08x) must return void.
Warning: Invalid locale string.:Error: Constant has parent of invalid type (token=0x%08x).EError: ELEMENT_TYPE_SENTINEL is only allowed in MemberRef signatures.
0Error: Method cannot be both Abstract and Final.)Error: Abstract method marked ForwardRef.*Error: Abstract method marked PInvokeImpl.*Error: Abstract method not marked Virtual.1Error: Non-abstract method not marked ForwardRef.FError: Non-abstract method must have RVA or be PInvokeImpl or Runtime.(Error: PrivateScope method has zero RVA.-Error: Global method marked Abstract,Virtual.YError: Signature contains long form (such as ELEMENT_TYPE_CLASS<token of System.String>).'Warning: Method has multiple semantics.>Error: Method has invalid semantic association (token=0x%08x).JError: Method has semantic association (token=0x%08x) that does not exist.>Error: MethodImpl overrides non-virtual method (token=0x%08x).*Warning: [CLS] Global item (field,method).MError: Method has multiple semantic flags set for association (token=0x%08x).GError: Method has no semantic flags set for association (token=0x%08x).
'Error: Multiple assembly records found.
Error: Assembly has no name.oError: Token 0x%08x following ELEMENT_TYPE_CLASS (_VALUETYPE) in signature is a ValueType (Class,respectively).DError: ClassLayout has parent TypeDef token=0x%08x marked Interface.7Error: AssemblyOS entry has invalid platform ID=0x%08x.
Error: AssemblyRef has no name.>Error: TypeDef is not marked Nested but has an enclosing type.QError: AssemblyRefOS entry for AssemblyRef=0x%08x has invalid platform ID=0x%08x.
Error: File has no name. Error: ExportedType has no name.%Error: TypeDef extends its own child.$Error: ManifestResource has no name.*Error: File has a duplicate, token=0x%08x.7Error: File name is fully-qualified, but should not be.2Error: ExportedType has a duplicate, token=0x%08x.>Error: ManifestResource has a duplicate by name, token=0x%08x.
8Error: ManifestResource is not marked Public or Private.8Warning: [CLS] TypeDef is Enum but has no value__ field.=Error: Field value__ (token=0x%08x) in Enum is marked static.HError: Field value__ (token=0x%08x) in Enum is not marked RTSpecialName.9Error: Field (token=0x%08x) in Enum is not marked static.:Error: Field (token=0x%08x) in Enum is not marked literal.*Warning: [CLS] Enum has no literal fields.JError: Signature of field (token=0x%08x) in Enum does not match enum type.AError: Field value__ (token=0x%08x) in Enum is not the first one.JError: Field (token=0x%08x) is marked RTSpecialName but not named value__.5Error: Field name value__ is reserved for Enums only.#Error: Instance field in Interface.%Error: Non-public field in Interface.KError: Global item (field,method) must be Public, Private, or PrivateScope.1Error: Global item (field,method) must be Static.(Error: Global field has no RVA assigned.HError: InterfaceImpl's implemented type (0x%08x) not marked tdInterface.4Error: Field is marked HasRVA but has no RVA record."Error: Field is assigned zero RVA.;Error: Method has both non-zero RVA and Implementation Map.)Error: Extraneous bits in Flags (0x%08x).
Error: TypeDef extends itself.2Error: System.ValueType must extend System.Object.GWarning: TypeDef extends TypeSpec (0x%08x), not supported in Version 1.
9Error: Value class has neither fields nor size parameter."Error: Interface is marked Sealed.OError: NestedClass token (0x%08x) in NestedClass record is not a valid TypeDef.RError: EnclosingClass token (0x%08x) in NestedClass record is not a valid TypeDef.-Error: Duplicate NestedClass record (0x%08x).VError: Nested type token (0x%08x) has multiple EnclosingClass tokens (0x%08x, 0x%08x).3Error: Zero RVA of field 0x%08x in FieldRVA record.
IError: Invalid field token in FieldRVA record (field: 0x%08x; RVA: 0x%x).FError: Same RVA in another FieldRVA record (RVA: 0x%x; field: 0x%08x).LError: Same field in another FieldRVA record(field: 0x%08x; record: 0x%08x).;Error: Invalid token specified as EntryPoint in CLR header.CError: Instance method token specified as EntryPoint in CLR header.9Error: Invalid type of instance field(0x%08x) of an Enum.%Error: Method has invalid RVA (0x%x).(Error: Literal field has no const value.aError: Class implements interface but not method (class:0x%08x; interface:0x%08x; method:0x%08x).9Error: CustomAttribute has invalid Parent token (0x%08x).7Error: CustomAttribute has invalid Type token (0x%08x).9Error: CustomAttribute has non-constructor Type (0x%08x).=Error: CustomAttribute's Type (0x%08x) has invalid signature.8Error: CustomAttribute's Type (0x%08x) has no signature.:Error: CustomAttribute's blob has invalid prolog (0x%04x).9Error: Method has invalid local signature token (0x%08x).
Error: Signature has token following ELEMENT_TYPE_CLASS (_VALUETYPE) that is not a TypeDef or TypeRef (token: 0x%08x; offset: 0x%08x).rWarning: Class does not implement interface method in this module (class:0x%08x; interface:0x%08x; method:0x%08x).
CLR assembly '%s' was imported from a type library and cannot be re-exported to a type library. Make sure the type library from which the assembly was imported is registered.
!Error: Method has invalid header.GError: EntryPoint method has invalid number of arguments, expecting %d.1Error: EntryPoint method has invalid return type.8Error: EntryPoint method has invalid argument number %d./Error: Illegal use of type 'void' in signature.cError: Multiple implementation of interface method (class:0x%08x; interface:0x%08x; method:0x%08x). Error: GenericParam has no name.$Warning: GenericParam has nil owner.JError: GenericParam has a duplicate based on owner and name, token=0x%08x.LError: GenericParam has a duplicate based on owner and number, token=0x%08x.0Error: GenericParam is out of sequence by owner.1Error: GenericParam is out of sequence by number.kError: GenericParam is co-or-contra variant but its owner, token (0x%08x), is not an interface or delegate.aError: GenericParam is a method type parameter and must be non-variant, not co-or-contra variant.AError: GenericParam has invalid variance value in flags (0x%08x).{Error: GenericParam has inconsistent special constraints ReferenceTypeConstraint and ValueTypeConstraint in flags (0x%08x).
Error: MemberRef has no name.+Error: MemberRef name starts with _VtblGap.+Error: MemberRef name starts with _Deleted.;Error: MemberRef parent is Nil but the module is a PE file.AError: MemberRef signature has invalid calling convention=0x%08x.nError: MemberRef has MethodDef parent, but calling convention is not VARARG (parent:0x%08x; callconv: 0x%08x).HError: MemberRef has different name than parent MethodDef, token=0x%08x.[Error: MemberRef has fixed part of signature different from parent MethodDef, token=0x%08x.1Warning: MemberRef has a duplicate, token=0x%08x.EError: ClassLayout has parent TypeDef token=0x%08x marked AutoLayout.vError: ClassLayout has invalid PackingSize; valid set of values is {1,2,4,...,128} (parent: 0x%08x; PackingSize: %ld).KError: ClassLayout has a duplicate (parent: 0x%08x; duplicate rid: 0x%08x).NError: FieldLayout2 record has invalid offset (field: 0x%08x; offset: 0x%08x).LError: FieldLayout2 record for Field token=0x%08x has TypeDefNil for parent.jError: FieldLayout2 record for field of type that has no ClassLayout record (field: 0x%08x; type: 0x%08x).cError: Explicit offset specified for field of type marked AutoLayout (field: 0x%08x; type: 0x%08x).
9Error: Signature missing function pointer at byte=0x%08x.LError: Signature has function pointer missing argument count at byte=0x%08x.-Error: Signature missing rank at byte=0x%08x.KError: Signature missing count of sized dimensions of array at byte=0x%08x.CError: Signature missing size of dimension of array at byte=0x%08x.GError: Signature missing count of lower bounds of array at byte=0x%08x.=Error: Signature missing lower bound of array at byte=0x%08x.SError: Signature has invalid ELEMENT_TYPE_* (element type: 0x%08x; offset: 0x%08x).<Error: Signature missing size for VALUEARRAY at byte=0x%08x.=Error: Field signature has invalid calling convention=0x%08x.
Error: Method has no name.
Error: Method parent is Nil.,Error: Method has a duplicate, token=0x%08x.
Error: Field has no name.
Error: Field parent is Nil.+Error: Field has a duplicate, token=0x%08x.
.Error: Field marked both InitOnly and Literal.$Error: Literal field must be Static.GError: Item (field,method) is marked RTSpecialName but not SpecialName.;Error: Abstract method in non-abstract type (token=0x%08x).FError: Neither static nor abstract method in interface (token=0x%08x).5Error: Non-public method in interface (token=0x%08x).8Error: Instance constructor in interface (token=0x%08x).
Error: Global constructor.:Error: Static instance constructor in type (token=0x%08x).bError: Constructor/initializer in type (token=0x%08x) is not marked SpecialName and RTSpecialName.>Error: Virtual constructor/initializer in type (token=0x%08x).?Error: Abstract constructor/initializer in type (token=0x%08x).:Error: Non-static type initializer in type (token=0x%08x).dError: Method marked Abstract, Runtime, InternalCall or Imported must have zero RVA, and vice versa.OError: Method marked Final or NewSlot or CheckAccessOnOverride but not Virtual.;Error: Static method cannot be Final or NewSlot or Virtual.
7Error: MethodImpl declared in Interface (token=0x%08x).=Error: MethodImpl has invalid MethodDeclaration token=0x%08x.6Error: MethodImpl has invalid MethodBody token=0x%08x./Error: MethodImpl has a duplicate (rid=0x%08x)./Error: Field has invalid parent (token=0x%08x).@Warning: Parameter out of sequence (parameter: %d; seq.num: %d).nError: Parameter has sequence number exceeding number of arguments (parameter: %d; seq.num: %d; num.args: %d).QError: Parameter #%d is marked HasFieldMarshal but has no marshaling information.RError: Parameter #%d has marshaling information but is not marked HasFieldMarshal.
AError: Parameter #%d is marked HasDefault but has no const value.BError: Parameter #%d has const value but is not marked HasDefault.1Error: Property has invalid scope (token=0x%08x).
Error: Property has no name.!Error: Property has no signature./Error: Property has a duplicate (token=0x%08x).
.Error: Type/instance constructor has zero RVA.CError: Field is marked marshaled but has no marshaling information.DError: Field has marshaling information but is not marked marshaled.9Error: Field is marked HasDefault but has no const value.:Error: Field has const value but is not marked HasDefault.QError: Item (field,method) is marked HasSecurity but has no security information.RError: Item (field,method) has security information but is not marked HasSecurity.2Error: PInvoke item (field,method) must be Static.=Error: PInvoke item (field,method) has no Implementation Map.LError: Item (field,method) has Implementation Map but is not marked PInvoke.<Warning: Item (field,method) has invalid Implementation Map.?Error: Implementation Map has invalid Module Ref, token 0x%08x.EError: Implementation Map has invalid Member Forwarded, token 0x%08x.-Error: Implementation Map has no import name.@Error: Implementation Map has invalid calling convention 0x%04x.3Error: Item (field,method) has invalid access flag.
6Error: Property has invalid calling convention (0x%x).<Error: Property is marked HasDefault but has no const value.=Error: Property has const value but is not marked HasDefault.^Error: Property has related method with invalid semantics (method: 0x%08x; semantics: 0x%08x).?Error: Property has related method with invalid token (0x%08x).\Error: Property has related method belonging to another type (method: 0x%08x; type: 0x%08x).6Error: Constant of type (0x%02x) must have null value.:Error: Constant of type (0x%02x) must have non-null value..Error: Event has invalid scope (token=0x%08x).
Error: Event has no name.,Error: Event has a duplicate (token=0x%08x).2Error: Event has invalid EventType (token=0x%08x).FError: Event's EventType (token=0x%08x) is not a class (flags=0x%08x).[Error: Event has related method with invalid semantics (method: 0x%08x; semantics: 0x%08x).<Error: Event has related method with invalid token (0x%08x).
,Error: GenericParamConstraint has nil owner.ZError: GenericParamConstraint has a duplicate based on owner and constraint, token=0x%08x.hError: GenericParamConstraint is non-contiguous with preceding constraints for same owner, token=0x%08x.!Error: MethodSpec has nil method.RError: MethodSpec has a duplicate based on method and instantiation, token=0x%08x.BError: MethodSpec signature has invalid calling convention=0x%08x.<Error: MethodSpec signature is missing arity at byte=0x%08x.:Error: MethodSpec signature is missing type argument # %d.YError: MethodSpec has generic method of arity %d but instantiation of different arity %d.(Error: MethodSpec method is not generic.KError: Signature missing arity of instantiated generic type at byte=0x%08x.`Error: Signature has generic type of arity %d instantiated at different arity %d at byte=0x%08x.=Error: Method cannot be both generic and a class constructor.AError: Method cannot be both generic and an instance constructor.EError: Method cannot be both generic and defined on an imported type.MError: Method cannot be both generic and have non-default calling convention.
CError: Entry point in CLR header is the token for a generic method.KError: Method signature is generic but is missing its arity at byte=0x%08x.HError: Method signature is generic but its arity is zero at byte=0x%08x.IError: Signature has generic type instantiated at arity 0 at byte=0x%08x.7Error: MethodSpec signature has arity 0 at byte=0x%08x.LError: MethodDef signature has arity %d but the token owns %d GenericParams.MError: Entry point in CLR header is the token for a method in a generic type.RError: MethodImpl overrides non-generic method (token=0x%08x) with generic method.RError: MethodImpl overrides generic method (token=0x%08x) with non-generic method.fError: MethodImpl overrides generic method (token=0x%08x) of arity %d with generic method of arity %d.LError: TypeDef extends a TypeSpec (0x%08x) that is not an instantiated type.AError: Signature has type instantiated at ByRef at offset 0x%08x.BError: MethodSpec has type instantiated at ByRef at offset 0x%08x.$Error: TypeSpec has empty signature.?Error: TypeSpec has signature containing one or more sentinels.2Error: TypeDef is generic but has explicit layout.
mFailed to delay load library '%hs' (Win32 error: %d).
This program can no longer run and will now terminate.zFailed to get entry point '%s' in library '%hs'. Win32 error: %d.
This program can no longer run and will now terminate.
,Error: Attempt to access unloaded AppDomain.
=The module '%1' was expected to contain an assembly manifest.^Cannot load executable '%1' because it contains extra relocations or has relocations stripped.
aThe assembly is built by a runtime newer than the currently loaded runtime, and cannot be loaded.
+Error: Missing method '%2' from class '%1'.
Unable to load file '%1'.
`The located assembly's manifest definition with name '%1' does not match the assembly reference.JThe found private assembly, '%1', was located outside the ApplicationBase.GA module specified in the manifest of assembly '%1' could not be found.
/Assembly '%1' is required to be strongly named.
Strong name signature verification failed for assembly '%1'. The assembly may have been tampered with, or it was delay signed but not fully signed with the correct private key.
7The given assembly name or codebase, '%1', was invalid.AHTTP download of assemblies has been disabled for this appdomain.
4The check of the module's hash failed for file '%1'.
The assembly returned from the host store has a different strong name signature than the corresponding one in GAC. Assembly: '%1'ULoadFrom(), LoadFile(), Load(byte[]) and LoadModule() have been disabled by the host.&Failed to add file to AppDomain cache.
fType '%1' cannot be marshaled as an unmanaged structure; no meaningful size or offset can be computed.
Warning: A StringBuilder buffer has been overflowed by unmanaged code. The process may become unstable. Insufficient capacity allocated to the StringBuilder before marshaling it.1Hash validation failed for file or assembly '%1'.\Could not load type '%1' because the module containing it from assembly '%2' failed to load.JCould not load type '%1' from assembly '%2' because the format is invalid.4Could not create array type '%1' from assembly '%2'.:No server registered or could not load class for CLSID %1.XCould not load type '%1' from assembly '%2' because the method '%3' could not be loaded.MMethod '%3' in type '%1' from assembly '%2' cannot be a static and a virtual.IDerived method '%3' in type '%1' from assembly '%2' cannot reduce access.RCould not get PINVOKE information for method '%3' in type '%1' from assembly '%2'.]Array of type '%1' from assembly '%2' cannot be created because base value type is too large.LMethod '%3' in type '%1' from assembly '%2' does not have an implementation.NCould not load type '%1' from assembly '%2' because the parent does not exist.TCould not load type '%1' from assembly '%2' because the parent type is an interface.TCould not load interface '%1' from assembly '%2' because it must extend from Object.
(StrongName APIs not supported on system.0StrongName APIs could not locate a matching CSP.
0Policy exception occurred while processing '%1'.5Failed to grant required minimum permissions to '%1'.+Failed to grant permission to execute '%1'.
0Strong name validation failed for assembly '%1'.2Assembly '%1' is missing the required strong name.
-The public key for assembly '%1' was invalid.
cThe allocated signature slot for assembly '%1' does not correspond to the generated signature size.
MAn internal error happened in the Common Language Runtime's Execution Engine.
"A security violation has occurred.PAn error relating to remoting occurred during the load of file or assembly '%1'.UAn error relating to serialization occurred during the load of file or assembly '%1'.
The path is not of a legal form.uIllegal layout for type '%1' from assembly '%2': valuetypes with non-public fields may not overlap with other fields.&Lookup of token information timed out.
Specified SAFEARRAY is invalid.NMethod '%1' of COM event interface '%2' is not present on event provider '%3'.uMethods on COM event interfaces must take a single delegate derived class as a parameter and have a void return type.
Strong name validation failed for assembly '%s'. The file may have been tampered with or it was delay signed, but not fully signed with the correct private key.
Strong name validation failed.
Invalid delegate layout.<The Common Language Runtime could not run the given program.5Could not run the given program. _CorExeMain failed.
2The UNC path should be of the form \\server\share.HCustom marshaler '%1' does not implement the ICustomMarshaler interface.
Custom marshaler '%1' does not implement a static GetInstance method that takes a single string parameter and returns an ICustomMarshaler.
<There is not enough space on the disk. Unable to load '%1'.
HThe filename, directory name, or volume label syntax is incorrect: '%1'.
1A procedure imported by '%1' could not be loaded.
\Method '%3' on type '%1' from assembly '%2' is overriding a method that has been overridden.jMethod '%3' on type '%1' from assembly '%2' is overriding a method that is not visible from that assembly.HMethod '%3' on type '%1' from assembly '%2' is overriding a method impl.bMethod '%3' on type '%1' from assembly '%2' tried to override a method with a different signature.iType '%1' from assembly '%2' tried to override method '%3' but does not implement or inherit that method.sMethod '%3' on type '%1' from assembly '%2' tried to implement a method declaration with a different virtual state.pMethod '%3' on type '%1' from assembly '%2' must be virtual to implement a method on an interface or super type.cCould not load type '%1' from assembly '%2' because the method '%3' has no implementation (no RVA).;Size of field of type '%1' from assembly '%2' is too large.
Cannot connect to URL for '%1'.?Type '%1' from assembly '%2' cannot extend from any other type.+Type '%1' from assembly '%2' has zero size.+Could not load TypeSpec from assembly '%2'.<Type '%1' from assembly '%2' has a field of an illegal type.jBody referenced in a method implementation must be defined in the same type. Type: '%1'. Assembly: '%2'.ZBody referenced in a method implementation cannot be static. Type: '%1'. Assembly: '%2'.
+The server or proxy was not found for '%1'.ECode execution is prohibited in an assembly loaded as ReflectionOnly.>CriticalHandles cannot be marshaled from unmanaged to managed.9Ref and out CriticalHandle parameters cannot be abstract.
Invalid managed/unmanaged type combination (CriticalHandles must not have a MarshalAs attribute set and cannot be used in arrays).
Critical handle has been closedNStructures containing CriticalHandle fields are not allowed in this operation.ACriticalHandle fields cannot be created from an unmanaged handle.,Returned CriticalHandles cannot be abstract.:CriticalHandle derived types cannot be stored in Variants.]CriticalHandle subclasses may not override the finalizer. Put logic in ReleaseHandle instead.RAssemblyResolveEvent handlers cannot return Assemblies loaded for reflection only.YReflectionOnlyAssemblyResolve handlers must return Assemblies loaded for reflection only.yMethod '%3' on type '%1' from assembly '%2' tried to implicitly override a method with weaker type parameter constraints.
FFile or assembly name '%1', or one of its dependencies, was not found.
DThe system cannot open file '%1'. There may be too many open files.
Access is denied: '%1'.)The actual object was not found for '%1'.BConnection was established, but data cannot be retrieved for '%1'.%WinInet download failed for URL '%1'.
'The format of the file '%1' is invalid.
Unknown URL protocol: '%1'.=Security problem encountered when connecting to URL for '%1'.
"Invalid custom attribute provided.'Invalid custom attribute provided: '%1'3Thread is running or terminated; it cannot restart..Unable to cast transparent proxy to type '%1'.8The current thread has been chosen as a deadlock victim.&Unable to retrieve thread information..Thread is not running; it cannot be suspended.,Thread is not running; it cannot be resumed.3Thread is not user-suspended; it cannot be resumed.,Thread is dead; priority cannot be accessed.)Thread is dead; state cannot be accessed.
Thread in invalid state.)Thread is suspended; attempting to abort.,PInvoke restriction: cannot return variants. Connection timeout for URL '%1'.%The path contains illegal characters.*Function 0x%08x had not yet been compiled.7The ID 0x%08x had not yet been fully loaded or defined.RThe Module containing function ID 0x%08x is not configured for updateable methods.&Method ID 0x%08x could not be updated.1Profiling error: the method has no associated IL.OProfiling error: the thread is unmanaged and has never run managed code before.QProfiling error: this function may only be called during profiler initialization.UProfiling error: in-process debugging must be enabled during profiler initialization.[Profiling error: cannot get a JIT map because the profiler did not enable JIT map tracking.FProfiling error: BeginInprocDebugging cannot be called more than once.PProfiling error: in-process debugging not allowed during this profiler callback.@Profiling error: the requested information is not yet available.
FError: Cannot increase the maximum nesting level in Edit-and-Continue.7Error: Module must be loaded in Edit-and-Continue mode.
Variable type cannot be changed..Cannot get the local signature for the method.0Field cannot be added to a value or layout type.#Field properties cannot be changed.
VEdit-and-Continue impossible: Zap file was created without Edit-and-Continue flag set.4Internal data structures missing method information.)JIT unable to update internal structures.
*Internal type data structures are missing.
,Not allowed to change interface inheritance.
0Type library exporter cannot load assembly '%2'.-Type library exporter cannot load type '%hs'.
CLR assembly '%2' was imported from a type library and cannot be re-exported to a type library. Make sure the type library from which the assembly was imported is registered._Type library '%s' was exported from a CLR assembly and cannot be re-imported as a CLR assembly.HThe method or field has an invalid ELEMENT_TYPE/NATIVE_TYPE combination.\Vtable slot number associated with member '%s' of type '%s' in type library '%s' is invalid.ICOM register method is invalid (not static) (method: '%hs'; type: '%hs').
COM register method has an invalid signature (method: '%hs'; type: '%hs'). The COM register method must have a single string argument and a return type of void.9Type library exporter cannot load type '%hs' (error: %s).?Type library exporter encountered an unknown signature element.[Successful import of type library may require prior import (library: '%ls'; import: '%ls').`Type library has an invalid namespace and cannot be imported (library: '%ls'; namespace: '%ls').aType library exporter encountered an error while attempting to lay out the TypeInfo '%2': (%1) %3TType library importer has encountered an interface not derived from IUnknown: '%ls'.
Non COM visible value type '%s' is being referenced either from the type currently being exported or from one of its base types.iType '%s' has a method or field with a native type of NATIVE_TYPE_LPTSTR which cannot be exported to COM.[Type '%s' has a char set of auto. Types with a char set of auto cannot be exported to COM.MType '%hs' has an IID of IID_IUnknown or IID_IDispatch, which is not allowed.GThe method '%hs.%hs' has a duplicate dispid, %d, which will be ignored.
The enum member '%hs.%ls' has a value that cannot be expressed as a 32-bit integer. Type library enum members must be 32-bit integers.2Type '%ls' and type '%ls' both have the same UUID.NType '%hs' contains nested arrays, which cannot be exported to a type library.
Error while importing type: parameter referenced a type library that is not available (type: '%ls'; parameter: '%ls'; method: '%ls').
Error while importing type: parameter referenced a type library that is not available (type: '%ls'; parameter: '%d'; method: '%ls').DType library exporter encountered a size agnostic signature element.
Type library exporter failed.
Interface '%ls' is marked as [dual], but does not derive from IDispatch. It will be converted as an IUnknown-derived interface.
4Arrays in structs must be SafeArrays or ByValArrays.QReference types with layout in structs need [MarshalAs(UnmanagedType.Interface)].
:Type '%ls' is invalid and may only be partially converted.vThere was an error converting a type. The name of the type cannot be determined. It is index %d in the type library.
%ls, while processing '%ls'.MType library exporter encountered an error while processing '%ls'. Error: %lslType library exporter encountered an error while attempting to save the type library '%ls': Error: (%x) %ls.
Type library exporter warning: Referenced type is defined in managed component, which is imported from a type library that could not be loaded because it was not registered (type: '%ls'; component: '%ls').
Referenced type is defined in managed component, which is imported from a type library that could not be loaded (type: '%ls'; component: '%ls').bType library importer has encountered an invalid VT type (type: 0x%x; imported member: '%ls.%ls').?Type library exporter cannot load required library MSCOREE.TLB.PType library exporter has encountered an error reading from library MSCOREE.TLB.9Type library importer has encountered an exception: 0x%x.iType library importer has encountered a method with multiple [lcid] parameters while importing '%ls.%ls'.
Type '%ls' imported.eType library importer has encountered a method with an unexpected [out, retval] parameter: '%ls.%ls'.CType library importer has encountered a duplicate type name: '%ls'.mType library exporter could not find the type library for '%ls'. IUnknown was substituted for the interface.
At least one of the arguments for '%ls.%ls' cannot be marshaled by the runtime marshaler. Such arguments will therefore be passed as a pointer and may require unsafe code to manipulate.SThe type library importer could not convert the signature for the member '%ls.%ls'.
The type has explicit layout, and has been exported as an empty record. Types with explicit layout can only be properly exported if all members have an offset of 0 (a union).<Type library exporter warning processing '%ls'. Warning: %lsFType library importer has failed to resolve a referenced type library.gType contains [MarshalAs(AsAny)], which is only valid for PInvoke. The MarshalAs directive was ignored.TThe value of the LCID conversion attribute must not exceed the number of parameters.GThe LCIDConversionAttribute is not allowed on dispatch only interfaces.OThe public struct contains one or more non-public fields that will be exported.
Type '%hs' exported.YThe type had one or more duplicate DISPIDs specified. The duplicate DISPIDs were ignored.
The names list was not valid.VThe reference type had sequential or explicit layout, and so was exported as a struct.rType library exporter encountered a generic type instance in a signature. Generic code may not be exported to COM.sType library exporter encountered a generic type parameter in a signature. Generic code may not be exported to COM.\Type library exporter encountered a generic type. Generic classes may not be exposed to COM.
Could not execute CVTRES.EXE.
2Method's type signature is not PInvoke compatible.
Exception from HRESULT: 5Invalid PInvoke or MarshalDelegateAs metadata format.
Unable to load DLL '%1': %25Unable to find an entry point named '%2' in DLL '%1'.2Method's type signature is not Interop compatible.HNo PInvoke conversion exists for value passed to Object-typed parameter.<Synchronized attribute cannot be used with this method type.
$Main method not found for type '%1'.0Main method for type '%1' has invalid signature.FThe method returned a COM Variant type that is not Interop compatible.KThe method returned a VT_RECORD Variant, which is not supported by Interop.,Unexpected error occurred loading type '%1'.
Multiple methods named Invoke.OMethod's type signature contains a type that cannot be automatically converted./Function pointer was not created by a Delegate.
Not a PInvoke method.
MSCOREE.DLL load error.
Two different copies of MSCORWKS.DLL have been loaded.
First copy:
%s
Second copy:
%s
This is typically caused by having a registered MSCOREE.DLL that is different
from the one that is statically linked with the application.4Custom marshalers can only be specified for classes."No exception available to rethrow.!Specified OLE variant is invalid.&The default domain cannot be unloaded.
3Mscorlib.dll is missing types required by security.\The list of COM source interfaces for type '%1' contains non interface or generic type '%2'.XObject cannot be coerced to the original type of the ByRef VARIANT it was obtained from.4The new wrapper type must have an empty constructor.kStandard DISPID member name is formed incorrectly. The name must be in the following format: [DISPID=XXX].(COM target does not implement IDispatch.uAll named parameters must be specified as [DISPID=XXX] when invoking on a standard members specified as [DISPID=XXX}.cVariant returned from an Invoke call with a DISPID of -4 does not contain a valid IUnknown pointer.VCOM object cannot be used after it has been released using Marshal.ReleaseComObject().JCOM object that has been separated from its underlying RCW cannot be used.kFunction can only be called from inside the class constructor of a class derived from a COM imported class.
:Base type has already registered a type creation callback.8Invalid PInvoke or MarshalDelegateAs calling convention.
Method '%3' on type '%1' from assembly '%2' tried to implicitly implement an interface method with weaker type parameter constraints.
Method '%3' on type '%1' from assembly '%2' tried to explicitly implement a local method with weaker type parameter constraints.
Method '%3' on type '%1' from assembly '%2' tried to explicitly implement a parent method with weaker type parameter constraints.
Method '%3' on type '%1' from assembly '%2' tried to explicitly implement an interface method with weaker type parameter constraints.FA circular dependency was detected when loading file or assembly '%1'.[Invalid PInvoke calling convention. Vararg functions must use the cdecl calling convention.EType '%1' in assembly '%2' cannot be persisted into the native image.NExplicit assembly name must be specified when loading a type as ReflectionOnly|ModuleResolveEvent returned an incompatible Module. ReflectionOnly assemblies cannot bind to normal Modules, nor vice-versa.
Could not load type '%1' from assembly '%2' because a covariant or contravariant type parameter was used illegally in the signature for an argument in method '%3'.
Could not load type '%1' from assembly '%2' because a covariant or contravariant type parameter was used illegally in the signature for the result type in method '%3'.
Could not load type '%1' from assembly '%2' because a covariant or contravariant type parameter was used illegally in an inherited interface.
Could not load type '%1' from assembly '%2' because a covariant or contravariant type parameter was used illegally in a type parameter constraint in method '%3'.
Could not load type '%1' from assembly '%2' because it declares a covariant or contravariant type parameter and is not an interface or delegate.oCould not load type '%1' from assembly '%2' because it uses an illegal variance annotation on a type parameter.
QType '%1' from assembly '%2' contains an invalid method implementation signature.KInternal limitation: too many property methods associated with this method.%Internal limitation: too many fields.UA library name must be specified in a DllImport attribute applied to non-IJW methods.0Generic context-bound objects are not supported.=Context-bound objects with generic methods are not supported.SGenericArguments[%1], '%2', on '%3' violates the constraint of type parameter '%4'.PMethod %1.%2: type argument '%3' violates the constraint of type parameter '%4'.ZType '%1' from assembly '%2' contains more methods than the current implementation allows.|Enumerated types cannot have any generic type parameters, beyond any inherited from their enclosing type (for nested enums).
DebuggerError/Ignoring managed exception from unknown thread.'Catch handler cannot precede try block.yA generic instantiation for type '%1' from assembly '%2' was too deep. Is this generic type defined or used recursively?GIllegal to load assemblies for ReflectionOnly in a verification domain.0JIT Compiler encountered an internal limitation.
DCannot access file '%1' because it is being used by another process.QCannot access file '%1' because another process has locked a portion of the file.
Cannot open file '%1'.
The path is too long after being fully qualified. Make sure the full path is less than 260 characters and the directory name is less than 248 characters.
5The volume does not contain a recognized file system.
'%1' is not a valid file.
9The file or directory for '%1' is corrupt and unreadable.CThe disk structure is corrupt and unreadable. Unable to load '%1'.
GThe specified user does not have a valid profile. Unable to load '%1'.
=Cannot create/shadow copy '%1' when that file already exists.
4The dll initialization routine failed for file '%1'.
0Unable to cast object of type '%1' to type '%2'.4Object contains non-primitive or non-blittable data.;Field passed in is not a marshaled member of the type '%1'.2Requested range extends past the end of the array.
Object type cannot be pinned.+ArrayWithOffset: offset exceeds array size.tRan out of internal resource while executing marshaling operation. Possible cause: overly complex method signature.VA call to GetInstance() for custom marshaler '%1' returned null, which is not allowed.3Array size control parameter index is out of range.6Array size control parameter must be an integral type.@Multiple permission sets specified with the same SecurityAction.wSafeArray cannot be marshaled to this array type because it has either nonzero lower bounds or more than one dimension.oType of the VARIANT specified for a parameter with a custom marshaler is not supported by the custom marshaler.oTypes extending from COM objects should override all methods of an interface implemented by the base COM class.
Error loading file '%s'.
%s.
Error
Error 0x%08x.
%s.
Error: %s.
'Unknown import key operation specified.cRetrieving the COM class factory for component with CLSID %2 failed due to the following error: %1.BStrongName APIs could not locate a matching CSP for assembly '%1'.
Field not found: '%1'.
Method not found: '%1'.XThe interface does not support late bound calls since it does not derive from IDispatch.
MSCOREE is not loaded.$Missing entrypoint in MSCOREE: '%1'.
Unhandled Exception:BCannot print exception string because Exception.ToString() failed.*Fatal stack overflow. Process terminated./Fatal out of memory error. Process terminated.
3Exception from HRESULT: 0x%1. Failed to load '%2'.5Signature for the entry point has too many arguments.'Entry point not found in assembly '%1'.=Specified entry point in assembly '%1' is not a legal method.
Entry point must be static.JEntry point must have a return type of void, integer, or unsigned integer.
xInvalid managed/unmanaged type combination (String fields must be paired with LPStr, LPWStr, LPTStr, BStr or ByValTStr).9Custom marshalers cannot be used on fields of structures.pFixed sized array fields inside structures must have the MarshalAs SizeConst field set to the size of the array.9Fixed sized array fields cannot have a SizeConst of zero.qInvalid managed/unmanaged type combination (Classes with layout fields must be paired with Struct or Interface).hInvalid managed/unmanaged type combination (Arrays fields must be paired with ByValArray or SafeArray).
Invalid managed/unmanaged type combination (Strings cannot be paired with LPTStr for parameters and return types of methods in interfaces exposed to COM).
The type definition of this field has layout information but has an invalid managed/unmanaged type combination or is unmarshalable.
fMismatch has occurred between the runtime type of the array and the sub type recorded in the metadata.OSafeArray of rank %1 has been passed to a method expecting an array of rank %2.+Invalid managed/unmanaged type combination.YInvalid managed/unmanaged type combination (chars must be paired with I1, I2, U1, or U2).gInvalid managed/unmanaged type combination (booleans must be paired with I1, U1, Bool, or VariantBool).UInvalid managed/unmanaged type combination (Byte/SByte must be paired with I1 or U1).WInvalid managed/unmanaged type combination (Int16/UInt16 must be paired with I2 or U2)._Invalid managed/unmanaged type combination (Int32/UInt32 must be paired with I4, U4, or Error).
qInvalid managed/unmanaged type combination (the Decimal class must be paired with Struct, LPStruct, or Currency).cInvalid managed/unmanaged type combination (the Guid class must be paired with Struct or LPStruct).
[Invalid managed/unmanaged type combination (the DateTime class must be paired with Struct).oInvalid managed/unmanaged type combination (Arrays can only be marshaled as LPArray, ByValArray, or SafeArray).
-There is no marshaling support for this type.<Object type must be __ComObject or derived from __ComObject.DNew wrapper type must be __ComObject or be derived from __ComObject.pSource object cannot be converted to the destination type since it does not support all the required interfaces.
>Pointers cannot reference managed objects. Use ByRef instead.CPointers cannot reference marshaled structures. Use ByRef instead.3This type can only be marshaled in restricted ways.TAnsi char arrays cannot be marshaled as ByRef or as unmanaged-to-managed parameters.xAsAny cannot be used on return types, ByRef parameters, ArrayWithOffset, or parameters passed from unmanaged to managed.
VCustom marshalers are only allowed on classes, strings, arrays, and boxed value types.GCOM import type '%1' from assembly '%2' cannot have layout information.5Type '%1' has an invalid default COM interface: '%2'.DType '%1' does not support the specified default COM interface: '%2'1COM Object must be in current process to release.;Type '%1' that has the requested GUID is not a value class.?The specified record cannot be mapped to a managed value class.1Cannot marshal: Encountered unmappable character.
Invalid marshaling metadata.:SafeHandles cannot be marshaled from unmanaged to managed.5Ref and out SafeHandle parameters cannot be abstract.9SafeHandles cannot be returned from managed to unmanaged.~Invalid managed/unmanaged type combination (SafeHandles must not have a MarshalAs attribute set and cannot be used in arrays).
Safe handle has been closed
YInvalid managed/unmanaged type combination (Arrays of CriticalHandles are not supported).:Invalid SafeArraySubType/managed element type combination.*Cannot marshal field '%2' of type '%1': %3
Cannot marshal '%1': %2ZISerializable type '%1' tried to deserialize itself as type '%2' which is an invalid type.
API restriction: The assembly '%1' has already loaded from a different location. It cannot be loaded from a new location within the same appdomain.
Cannot resolve dependency to assembly '%1' because it has not been preloaded. When using the ReflectionOnly APIs, dependent assemblies must be pre-loaded or loaded on demand through the ReflectionOnlyAssemblyResolve event.
This type has a ComVisible(false) parent in its hierarchy, therefore QueryInterface calls for IDispatch or class interfaces are disallowed.zRetrieving the COM class factory for remote component with CLSID %2 from machine %3 failed due to the following error: %1.uCreating an instance of the COM component with CLSID %2 from the IClassFactory failed due to the following error: %1.~Creating an instance of the licensed COM component with CLSID %2 from the IClassFactory failed due to the following error: %1.
Unable to cast COM object of type '%2' to interface type '%3'. This operation failed because the QueryInterface call on the COM component for the interface with IID '%4' failed due to the following error: %1.
Unable to cast COM object of type '%2' to event interface type '%3'. This operation failed because the QueryInterface call on the COM component for the interface with IID '%4' failed due to the following error: '%1' and the COM component does not support the source interface with IID '%5'.
Unable to cast COM object of type '%2' to interface type '%3'. This operation failed because the QueryInterface call on the COM component for the interface with IID '%4' failed due to the following error: '%1' and the COM component does not support IDispatch::Invoke calls for DISPID_NEWENUM.
Unable to cast COM object of type '%2' to standard managed interface type '%3'. This operation failed because the QueryInterface call on the COM component for the managed interface with IID '%4' failed due to the following error: '%1' and the QueryInterface call for the native interface with IID '%5' that corresponds to this managed interface failed due to the following error: %6.
Unable to cast COM object of type '%1' to class type '%2'. COM components that enter the CLR and do not support IProvideClassInfo or that do not have any interop assembly registered will be wrapped in the __ComObject type. Instances of this type cannot be cast to any other class; however they can be cast to interfaces as long as the underlying COM component supports QueryInterface calls for the IID of the interface.
WInvalid managed/unmanaged type combination (Int64/UInt64 must be paired with I8 or U8).\Invalid managed/unmanaged type combination (Int/UInt must be paired with SysInt or SysUInt).KInvalid managed/unmanaged type combination (Single must be paired with R4).KInvalid managed/unmanaged type combination (Double must be paired with R8).
QInvalid managed/unmanaged type combination (pointers must be paired with LPVoid).;The type definition of this type has no layout information.
Invalid managed/unmanaged type combination (Strings parameters and return types must be paired with LPStr, LPWStr, LPTStr, BStr, TBStr, VBByRefStr, or AnsiBStr).iInvalid managed/unmanaged type combination (StringBuilders must be paired with LPStr, LPWStr, or LPTStr).dInvalid managed/unmanaged type combination (Delegates must be paired with FunctionPtr or Interface)._Invalid managed/unmanaged type combination (function pointers must be paired with FunctionPtr).VInvalid managed/unmanaged type combination (Interfaces must be paired with Interface).aInvalid managed/unmanaged type combination (this type must be paired with LPStruct or Interface).XInvalid managed/unmanaged type combination (this value type must be paired with Struct).
Invalid managed/unmanaged type combination (the Object class must be paired with Interface, IUnknown, IDispatch, AsAny, or Struct).
Application has generated an exception that could not be handled.
Process ID=0x%x (%d), Thread ID=0x%x (%d).
Click OK to terminate the application.
Click CANCEL to debug the application.
Application has encountered a user-defined breakpoint.
Process ID=0x%x (%d), Thread ID=0x%x (%d).
Click ABORT to terminate the application.
Click RETRY to debug the application.
Click IGNORE to ignore the breakpoint.LAppDomain cannot be unloaded because it is not local to the current process.FIllegal attempt to replace or redimension a fixed or locked SafeArray.QInvalid unmanaged calling convention: must be one of stdcall, cdecl, or thiscall.TType could not be marshaled because an embedded valuetype has no layout information.
`Could not load type '%1' from assembly '%2' because field '%3' was not given an explicit offset.cType could not be marshaled because an embedded string could not be converted from Unicode to ANSI.
~Type could not be marshaled because the length of an embedded array instance does not match the declared length in the layout.*Failure converting Unicode string to ANSI.*Failure converting ANSI string to Unicode.TThe value of the LCID conversion attribute must not exceed the number of parameters.1There is no marshaling support for nested arrays.0Failure decoding embedded permission set object.
VThe type '%1' in assembly '%2' has a contracting interface set for some instantiations
Attempted to load a 64-bit assembly on a 32-bit platform. Use ReflectionOnlyLoad() instead if trying to load for reflection purposes.
Configuration parser error.Error parsing %s
Parser returned error 0x%08X.EType names passed to Assembly.GetType() must not specify an assembly.TMethods with System.Color parameters or return type cannot be invoked via IDispatch.,Unexpected assembly-qualifier in a typename.%Typename needs an assembly qualifier.CCould not load file or assembly '%1' or one of its dependencies. %2$Signature is not Interop compatible.{Invalid managed/unmanaged type combination (String[] must be paired with an ArraySubType of LPStr, LPWStr, BStr or LPTStr).
Invalid managed/unmanaged type combination (Object[] or System.Array must be paired with an ArraySubType of Struct, Interface, IUnknown or IDispatch).fInvalid managed/unmanaged type combination (DateTime[] must be paired with an ArraySubType of Struct).qInvalid managed/unmanaged type combination (Decimal[] must be paired with an ArraySubType of Struct or Currency).
UInvalid managed/unmanaged type combination (Arrays of SafeHandles are not supported).
eSafe handle's handle field can only be set if the safe handle is not closed and has a ref count of 1.JStructures containing SafeHandle fields are not allowed in this operation.=SafeHandle fields cannot be created from an unmanaged handle.;Failure decoding embedded permission set collection object.(Returned SafeHandles cannot be abstract.YSafeHandle subclasses may not override the finalizer. Put logic in ReleaseHandle instead.
6SafeHandle derived types cannot be stored in Variants.eInvalid managed/unmanaged type combination (System.Array must be paired with SafeArray or Interface).-VariantWrappers cannot be stored in Variants.JThe structure contains fields that are not supported in unmanaged records.[The generic type '%1' was used with the wrong number of generic arguments in assembly '%2'.aA method in the type '%1' from assembly '%2' was used with the wrong number of generic arguments.[Could not load type '%1' from assembly '%2' because field '%3' was given a negative offset.
Unable to set thread priority.9Type '%1' in assembly '%2' is not marked as serializable.[VBByRefStr can only be used in combination with in/out, ByRef managed-to-unmanaged strings.\ArrayWithOffsets can only be marshaled as inout, non-ByRef, managed-to-unmanaged parameters.
Internal error.8Classes with copy-ctors can only be marshaled non-ByRef.
Internal error.'ArgIterators cannot be marshaled ByRef.BHandleRefs cannot be marshaled ByRef or from unmanaged to managed.
8AppDomain cannot be unloaded during object finalization.QAppDomain cannot be unloaded because the thread '%1' cannot be unwound out of it.
Reached the end of the file.
File has not been opened.'Buffer is shorter than requested bytes.
File name was not supplied.
Undefined seek modifier.+Request for permission of type '%1' failed.
Unable to cast COM object of type '%1' to class type '%2'. Instances of types that represent COM components cannot be cast to types that do not represent COM components; however they can be cast to interfaces as long as the underlying COM component supports QueryInterface calls for the IID of the interface.
Unable to cast COM object of type '%1' to class type '%2'. Instances of types that represent COM components cannot be cast to different types that represent COM components; however they can be cast to interfaces as long as the underlying COM component supports QueryInterface calls for the IID of the interface.
%1"Generic types cannot be marshaled.
Thread was being aborted.,Thread was interrupted from a waiting state.=Insufficient memory to continue the execution of the program._Unable to load Jit Compiler: (%s): file may be missing or corrupt. Please check or rerun setup.
Profiling failure<Generic types cannot be marshaled to COM interface pointers.
5Cannot use SizeParamIndex for ByRef array parameters.0This object cannot be marshaled as an IDispatch.BInternal limitation: method signature is too complex or too large.;Internal limitation: structure is too complex or too large.*Array size exceeds addressing limitations.
Struct or class fields cannot be of type StringBuilder. The same effect can usually be achieved by using a String field and preinitializing it to a string with length matching the length of the appropriate buffer. <Unknown>
<In Memory Module>
Thread has not been started.
An instance of the __ComObject type cannot be created unless the type has been obtained using GetTypeFromProgID or GetTypeFromCLSID.
<Unknown %1>/Marshaler restriction: Excessively long string.aThe declaration referenced in a method implementation is inaccessible. Type: '%1' Assembly: '%2'(Vararg calling convention not supported.DThe constructor to deserialize an object of type '%1' was not found.
Member '%1' in class '%2' is not present in the serialized stream and is not marked with System.Runtime.Serialization.OptionalFieldAttribute.IPossible version mismatch. Field '%1' in class '%2' has mismatched types.
Not all delayed fixup objects could be resolved. Such objects could be cyclic IObjectReferences, IObjectReferences that return other IObjectReferences too many times (i.e. objects with too long an IObjectReference chain) or nested valuetypes.(Type is not resolved for member '%1,%2'.BObject '%1' has been disconnected or does not exist at the server.+The method '%1' was not found on type '%2'.
oPaths starting with \\?\GlobalRoot are internal to the kernel and should not be opened by managed applications.NThe generic type '%1' was used with an invalid instantiation in assembly '%2'.0The length for ByValTStr strings cannot be zero.
Error formatting message.
[IL]: Error:
<GlobalFunction>
[mdToken=0x%x]wCOM object is currently in use. It was not released, but was separated from its underlying RCW to prevent further use.
YBody token used in a method implementation is out of range. Type: '%1'. Assembly: '%2'.`Declaration token used in a method implementation is out of range. Type: '%1'. Assembly: '%2'.kDeclaration referenced in a method implementation cannot be on a sealed type. Type: '%1'. Assembly: '%2'.iDeclaration referenced in a method implementation cannot be a final method. Type: '%1'. Assembly: '%2'.iDeclaration referenced in a method implementation must be a virtual method. Type: '%1'. Assembly: '%2'.lSignature of the body and declaration in a method implementation do not match. Type: '%1'. Assembly: '%2'.`Signature for the body in a method implementation cannot be found. Type: '%1'. Assembly: '%2'.gSignature for the declaration in a method implementation cannot be found. Type: '%1'. Assembly: '%2'.KCould not load type '%1' because the assembly containing it failed to load.xCould not load type '%1' from assembly '%2' because objects overlapped at offset %3 and the assembly must be verifiable.
Configuration error.]Could not load type '%1' from assembly '%2'. Internal limitation: Too many generic arguments.
0CLR error: %lx.
The program will now terminate.
Fatal error
,Could not load type '%1' from assembly '%2'.
QCould not load type '%1' from assembly '%2' because the interface does not exist.eCould not load type '%1' from assembly '%2' because it attempts to implement a class as an interface.aCould not load the value type '%1' from assembly '%2' because it has an instance field of itself.^Could not load type '%1' from assembly '%2' because generic types cannot have explicit layout.-Type name '%1' from assembly '%2' is invalid.0'%1' from assembly '%2' has too many dimensions.EManaged method '%3' on type '%1' from assembly '%2' is not supported.DNative method '%3' on type '%1' from assembly '%2' is not supported.`Type '%1' from assembly '%2' does not have sufficient permission to override super type methods.oCould not load type '%1' from assembly '%2' because its enclosing type is not specified with a type definition.
Could not load type '%1' from assembly '%2' because it contains an object field at offset %3 that is incorrectly aligned or overlapped by a non-object field.NCould not load type '%1' from assembly '%2' because the parent type is sealed.7Type '%1' from assembly '%2' has a method with no name.FPrivate method '%3' on type '%1' from assembly '%2' cannot be virtual.]Constructor '%3' on type '%1' from assembly '%2' does not have the correct name or signature.UMethod override '%3' on type '%1' from assembly '%2' cannot find a method to replace.&Method declaration is not a methoddef.=Duplicate definition for runtime implemented delegate method.
Ecalls must have a 0 RVA.
The metadata is corrupt.
The signature is incorrect.!Full Name of Typeref is too long.
Invalid Typeref token./The ClassInterface custom attribute is invalid.?ClassInterface custom attribute does not have the right format.0Illegal or unimplemented ELEM_TYPE in signature.*Forwarding of generic types not supported.
Bad element type in SizeOf.]Type '%1' in assembly '%2' has more than one method with the following custom attribute '%3'.
Type '%1' in assembly '%2' has method '%3' with an incorrect signature for the serialization attribute that it is decorated with.wStructures defined in untrusted code cannot be marshaled to and from native code as either parameters or return values.RType '%1' from assembly '%2' is attempting to implement an inaccessible interface.
OAssembly '%1' security permission grant set is incompatible between appdomains./Unverifiable assembly '%1' failed policy check.BAssembly '%1' already loaded without additional security evidence.
The security object (Permission or PermissionSet) used for performing a Demand caused an error relating to serialization/deserialization.
This application is using the HMAC-SHA-384 or HMAC-SHA-512 keyed hash algorithm. The implementation of these algorithms were updated in service pack 1 of .NET Framework 2.0 and by default do not produce results consistent with the unserviced versions of the classes. For more information about the changes to the algorithms and how to disable this warning message please see the release notes for service pack 1.&[A]%1 cannot be cast to [B]%2. %3. %4.@Type %s originates from '%s' in the context '%s' in a byte arrayAType %s originates from '%s' in the context '%s' at location '%s'
Invalid custom attribute.PThe permission associated with this attribute is missing a required constructor.BUnable to create an instance of the permission for this attribute.(SecurityAction type invalid on assembly.1SecurityAction type invalid on types and methods.5Security custom attribute attached to invalid parent.
HSerialized security custom attribute is truncated or incorrectly formed.>Serialized security custom attribute has unrecognized version.5Security custom attribute has invalid SecurityAction.GSecurity custom attributes cannot be referenced from defining assembly.?Invalid SecurityAction for non-Code Access Security permission.
Failed to load assembly '%s'."Failed to load assembly '%s' - %s.
Failed to load type '%s'.
Failed to load type '%s' - %s.-Security custom attribute cannot be abstract.NSecurity custom attributes do not support array or Type fields and properties."Unsupported enumeration base type.
Failed to locate field '%s'.
Failed to locate property '%s'.1Unexpected exception processing attribute - '%s'.;Unexpected exception processing attribute - HRESULT 0x%08X.
*Fatal internal error. Process terminated.
[HRESULT 0x%08X]
[offset 0x%08X]
[opcode %s]
[operand 0x%08X]
[token 0x%08X]
[exception #0x%08X]
[stack slot 0x%08X]
[local variable #0x%08X]
[argument #0x%08x]
[found %s]
[expected %s]
[local variable '%s']
;A serious error was detected while running managed code: %1&Fatal Execution Engine Error (%p) (%x)`Metadata method count does not match method enumeration length for type '%1' from assembly '%2'.^Metadata field count does not match field enumeration length for type '%1' from assembly '%2'.YType '%1' from assembly '%2' must be declared as a value type to be used as a value type.8Type contains improperly formed type variance signature.\Could not load type '%1' from assembly '%2' because it declares a field in a covariant type.bCustom attributes that are TypeSpecs must be of type ELEMENT_TYPE_VALUETYPE or ELEMENT_TYPE_CLASS.(An unexpected field signature was found.fA valid typedef or typeref token is expected to follow a ELEMENT_TYPE_CLASS or ELEMENT_TYPE_VALUETYPE.3A ELEMENT_TYPE_FNPTR cannot have a field signature.'A ELEMENT_TYPE_FNPTR cannot be generic.RA valid typedef or typeref token is expected to follow a ELEMENT_TYPE_GENERICINST.3Only pointer to void allowed in function arguments.EAn ELEMENT_TYPE_TYPEDBYREF cannot have a ELEMENT_TYPE_BYREF modifier.
Type '%1' in assembly '%2' has method '%3' which is either static, virtual, abstract or generic, but is marked as being a serialization callback method.<%General_AppName% has encountered a user-defined breakpoint.
A breakpoint in an application indicates a program error. After this dialog is dismissed, the application will continue running, but it may be in an unstable state.
No registered JIT debugger was specified.
Click on Retry to have the process wait while attaching a debugger manually.
Click on Cancel to abort the JIT debug request.QFile '%1' was loaded in a passive domain in a manner that makes it unable to run.PCannot override runtime implemented method '%3' on type '%1' from assembly '%2'.
Error
An invalid VARIANT has been passed as argument %i of method '%s' of type '%s'. If this argument is meant to be an interface pointer, add [MarshalAs(UnmanagedType.Interface)] to the managed definition of the argument.
Click CANCEL to break into the debugger and OK to continue.
Invalid VARIANT.
Warning: Components of the Common Language Runtime debugging services are from different builds.
Continuing to run will cause unpredictable results.
In-process component (mscoree.dll) is version %d.%d (%s)
Out-of-process component (mscordbi.dll) is version %d.%d (%s).
.
Application Error
Registered JIT debugger is not available. An attempt to launch a JIT debugger with the following command resulted in an error code of 0x%x (%d). Please check computer settings.
%s
Click on Retry to have the process wait while attaching a debugger manually.
Click on Cancel to abort the JIT debug request.
No debugger found.
Application has generated an exception that could not be handled.
Process ID=0x%x (%d), Thread ID=0x%x (%d).
Click OK to terminate the application.
Click CANCEL to debug the application.
INTERNAL ERROR:
Unhandled exception in Debugger::HandleIPCEvent.
Event ID=0x%x.
Exception code=0x%08x, Eip=0x%08x.
Process ID=0x%x (%d), Thread ID=0x%x (%d).
PPerformance Monitor Extension DLL for CLR. This can only be used on Windows NT.(Could not load on non-Windows NT system.
!IsolatedStorage operation failed.
Unable to open the store.$Unable to create store file mapping.
Unable to map the store file.$Unable to determine store file size.
Unable to create mutex.
Unable to lock the store.
File Write failed.
Cannot set file pointer.%Unable to create the store directory.&Store must be open for this operation.
Store file is corrupt.
Store version is not supported.
Store file is not mapped.
Block size is too small.
Allocation size is too large.
Allowed quota is fully used.
Row not found.
Unable to deprecate old store.
Unable to determine the caller.
Path length is too long.
Machine Store is not supported.DThe DACL for the machine store is incorrect or could not be created.
Unknown opcode [0x%08X].$Unknown calling convention [0x%08X].
Unknown ELEMENT_TYPE [0x%08x].
[return sig]
[field sig]
Internal error.
Stack is too large.
Array name is too long.
1fall through end of the method without returning.
try start >= try end.
try end > code size.
handler start >= handler end.
handler end > code size.
+Try starts in the middle of an instruction./Handler starts in the middle of an instruction.
%Try block overlap with another block.-Try and filter/handler blocks are equivalent.(Shared try has finally or fault handler.*Handler block overlaps with another block.+Handler block is the same as another block.)Filter block overlaps with another block.*Filter block is the same as another block.
Filter contains try.
Filter contains handler.
Nested filters.
filter >= code size..Filter starts in the middle of an instruction.'fallthru the end of an exception block.#fallthru into an exception handler."fallthru into an exception filter.(Leave from outside a try or catch block.%Rethrow from outside a catch handler.*Endfinally from outside a finally handler.1Endfilter from outside an exception filter block.
Missing Endfilter.
Branch into try block.$Branch into exception handler block.#Branch into exception filter block.
Branch out of try block.&Branch out of exception handler block.%Branch out of exception filter block.
Branch out of finally block.
Return out of try block.&Return out of exception handler block.%Return out of exception filter block.2jmp / exception into the middle of an instruction.'Non-compatible types depending on path..Init state for this differs depending on path.0Non-compatible types on stack depending on path.&Stack depth differs depending on path.!Instance variable (this) missing.+Uninitialized this on entering a try block.)Store into this when it is uninitialized.-Return from .ctor when this is uninitialized.
4Return from .ctor before all fields are initialized.'Branch back when this is uninitialized.%ldftn/ldvirtftn not allowed on .ctor."Non-compatible types on the stack.
Unexpected type on the stack.!Missing stack slot for exception.
Stack overflow.
Stack underflow.
Stack empty.
Uninitialized item on stack.#Expected I, I4, or I8 on the stack.#Expected R, R4, or R8 on the stack.)unexpected R, R4, R8, or I8 on the stack.#Expected numeric type on the stack. Expected an ObjRef on the stack.+Expected address of an ObjRef on the stack.
Expected ByRef on the stack.*Expected pointer to function on the stack.-Expected single dimension array on the stack.*Expected value type instance on the stack.,Expected address of value type on the stack.,Unexpected value type instance on the stack.)Local variable is unusable at this point.#Unrecognized local variable number.
Unrecognized argument number.
Unable to resolve token.$Unable to resolve type of the token.2Expected memberRef, memberDef or methodSpec token.%Expected memberRef or fieldDef token.
Expected signature token.
Instruction cannot be verified.-Operand does not point to a valid string ref.
@Return type is ByRef, TypedReference, ArgHandle, or ArgIterator.3Stack must be empty on return from a void function."Return value missing on the stack.)Stack must contain only the return value.
Return uninitialized data.
Illegal array access.(Store non Object type into Object array.+Expected single-dimension zero-based array.1Expected single dimension array of pointer types.
Array field access is denied.
Allowed only in vararg methods.
Value type expected.
Method is not visible.
Field is not visible.
Item is unusable at this point.
Expected static field.
Expected non-static field.%Address of not allowed for this item.!Address of not allowed for ByRef.)Address of not allowed for literal field./Cannot change initonly field outside its .ctor.
Cannot throw this object. Callvirt on a value type method.
Call signature mismatch.
Static function expected.
.ctor expected.
Cannot use callvirt on .ctor.4Only super::ctor or typeof(this)::ctor allowed here.&Possible call to .ctor more than once.
Unrecognized signature.
Cannot resolve Array type.
Array of ELEMENT_TYPE_PTR.
#Unverifiable PE Header/native stub.+Unrecognized metadata, unable to verify IL.
Unrecognized appdomain pointer.
Type load failed.
Module load failed.*Cannot modify an imaged based (RVA) static
7Array of ELEMENT_TYPE_BYREF or ELEMENT_TYPE_TYPEDBYREF.$ELEMENT_TYPE_PTR cannot be verified.
Unexpected vararg.
Unexpected Void.
ByRef of ByRef
Code size is zero.
Unrecognized use of vararg.
Missing call/callvirt/calli.!Cannot pass ByRef to a tail call.
Missing ret.%Void ret type expected for tail call.%Tail call return type not compatible. Stack not empty after tail call.,Method ends in the middle of an instruction.
Branch out of the method.
Finally handler blocks overlap.
Lexical nesting.TMissing ldsfld, stsfld, ldind, stind, ldfld, stfld, ldobj, stobj, initblk, or cpblk.AMissing ldind, stind, ldfld, stfld, ldobj, stobj, initblk, cpblk.4Innermost exception blocks should be declared first.%Calli not allowed on virtual methods.%Call not allowed on abstract methods.#Unexpected array type on the stack.CValue type with NotInGCHeap attribute being created on the GC heap.1Attempt to enter a try block with nonempty stack.*Unrecognized arguments for delegate .ctor.pDelegate .ctor not allowed at the start of a basic block when the function pointer argument is a virtual method.TDup, ldvirtftn, newobj delegate::.ctor() pattern expected (in the same basic block).HLdftn or ldvirtftn instruction required before call to a delegate .ctor..Attempt to load address of an abstract method.+ELEMENT_TYPE_CLASS ValueClass in signature.3ELEMENT_TYPE_VALUETYPE non-ValueClass in signature.;Box operation on TypedReference, ArgHandle, or ArgIterator.3ByRef of TypedReference, ArgHandle, or ArgIterator.3Array of TypedReference, ArgHandle, or ArgIterator.1Stack not empty when leaving an exception filter.2Unrecognized delegate .ctor signature; expected I.7Unrecognized delegate .ctor signature; expected Object.6Mkrefany on TypedReference, ArgHandle, or ArgIterator.%Value type not allowed as catch type. ByRef not allowed as catch type.5filter block should immediately precede handler block
ldvirtftn on static
callvirt on staticOinitlocals must be set for verifiable methods with one or more local variables.7branch/leave to the beginning of a catch/filter handlerVcall to .ctor only allowed to initialize this pointer from within a .ctor. Try newobj.
2Value type, ObjRef type or variable type expected.JExpected address of value type, ObjRef type or variable type on the stack./Unrecognized type parameter of enclosing class.0Unrecognized type parameter of enclosing method.=Unrecognized type argument of referenced class instantiation.>Unrecognized type argument of referenced method instantiation.
Cannot resolve generic type.9Method instantiation contains non boxable type arguments.@Method parent instantiation contains non boxable type arguments.?Field parent instantiation contains non boxable type arguments.CUnrecognized calling convention for an instantiated generic method.4Unrecognized generic method in method instantiation.2Missing ldelema or call following readonly prefix..Missing callvirt following constrained prefix.<Method parent has circular class type parameter constraints.6Method has circular method type parameter constraints.
GMethod instantiation has unsatisfied method type parameter constraints.MMethod parent instantiation has unsatisfied class type parameter constraints.LField parent instantiation has unsatisfied class type parameter constraints.QType operand of box instruction has unsatisfied class type parameter constraints.?The 'this' argument to a constrained call must have ByRef type.IThe operand to a constrained prefix instruction must be a type parameter.SThe readonly prefix may only be applied to calls to array methods returning ByRefs. Illegal write to readonly ByRef..A readonly ByRef cannot be used with mkrefany.>Alignment specified for 'unaligned' prefix must be 1, 2, or 4.
The tail.call (or calli or callvirt) instruction cannot be used to transfer control out of a try, filter, catch, or finally block.OStack height at all points must be determinable in a single forward scan of IL.
Call to base type of valuetype./Cannot construct an instance of abstract class.-Unmanaged pointers are not a verifiable type.
Cannot LDFTN a non-final virtual method for delegate creation if target object is potentially not the same type as the method class.'Accessing type with overlapping fields.OThe 'this' parameter to the call must be the calling method's 'this' parameter.
Expected I4 on the stack.
Notifies a subscribing client when a specified process is initializing the CLR. If this service is stopped, the client will not receive such notification. If this service is disabled, any services that explicitly depend on it will fail to start. RTL_False
Invalid file token.
Invalid token type.
Invalid entry point token.
Invalid token.PInvalid token in v-table fix-up table; use ildasm to find code generation error.%Unable to get nested type properties.
Method token out of range.
Method name too long.#Method name is not null terminated.
Method in an Enum.&Method with non-zero RVA in an Import."Abstract method with non-zero RVA.-Runtime-implemented method with non-zero RVA.'Internal call method with non_NULL RVA.&Abstract method in non-abstract class.
Non-virtual abstract method.
0Non-abstract, non-.cctor method in an interface.#Virtual PInvoke implemented method.
Virtual Static Method.
Virtual Instance Constructor.&Virtual Non-Abstract Interface Method.%Nonvirtual Instance Interface Method."Synchronized Method in Value Type.
Non-Static Global Method.
Global Instance Constructor.iGeneric method or method in generic class is internal call, PInvoke, or is defined in a COM Import class.-Generic method is marked runtime-implemented."Bad use of Runtime Impl attribute."Bad flags on delegate constructor.,Unknown runtime implemented delegate method.0Generic methods should always be mcInstantiated.
Field token out of range.
Invalid Field Access Flags.
Field is Literal and InitOnly.
Non-Static Global Field.
Instance Field in an Interface.
No Instance Field in an Enum.+Non-virtual methods should not be searched.%This method cannot be an Init Method.'Managed native not presently supported.
Bad implementation flags.
Bad unmanaged code entry point.
Generic code may not be varargs.gCould not load type '%1' from assembly '%2' because it cannot inherit directly from the delegate class.TCould not load type '%1' from assembly '%2' because delegate classes must be sealed.;Enclosing type(s) not found for type '%1' in assembly '%2'.;Illegal definition for runtime implemented delegate method.
DMissing definition for required runtime implemented delegate method./Duplicate type with name '%1' in assembly '%2'.
Bad method token.
Cannot get LinkRef.4ECall methods must be packaged into a system module.
Could not get classlayout.1Signature is not IMAGE_CEE_CS_CALLCONV_LOCAL_SIG.
Bad class token.
Bad IL range.$MethodDef without TypeDef as Parent.3MethodSpec or MemberRef has parent with no members.hFields inside generic classes must be referenced using MemberRefs, even in the same module as the class.(Invalid token saved in ManifestResource.
Empty assembly simple name.
Bad IL format.GCould not load type '%1' from assembly '%2' due to value type mismatch.
"Malformed custom attribute header."Malformed custom attribute string.
Bad string token. No string associated with token.SImage has a platform-specific fixup type that is not compatible with this platform.BToken specifying generic type must be either a typeref or typedef.
Array rank may not be zero.*Single-dimensional array rank must be one.LClassLayout has invalid PackingSize; valid set of values is {1,2,4,...,128}.
Array type not expected here.
Bad type visibility flag value./Family flag is not allowed on global functions.)Could not find exported type in metadata.
Expected array type.:Generic member ref must be of type MethodDef or MemberRef.
Expected interface.
Invalid entrypoint information.
cvtres.exe not found.
Failed to delayload a library.
Failed to get dll entrypoint.FMultiple copies of mscoree.dll have been loaded into the same process.
Type has been unloaded.*Attempted to access an unloaded appdomain. Error while unloading appdomain.
Assembly is still being loaded.#Attempt to create appdomain failed.8The module was expected to contain an assembly manifest.hAttempt to load an unverifiable executable with fixups (IAT with more than 2 sections or a TLS section.)bAttempt to LoadLibrary a managed image in an improper way (only assemblies with EAT area allowed).aThis assembly is built by a runtime newer than the currently loaded runtime and cannot be loaded.dCannot set security policy under MultiDomain after non-GAC assemblies have been loaded in appdomain.
Cannot specify assembly evidence under MultiDomain after non-GAC assemblies with default evidence have been loaded in appdomain.
1Host detected a deadlock on a blocking operation.
Host interrupted a wait.
Invalid operation.1CLR has been disabled due to unrecoverable error.
A wait has timed out.nThe leave operation has been attempted on a synchronization primitive that is not owned by the current thread.
An event has been abandoned.-Process exited due to ThreadAbort escalation.+Process exited due to AD Unload escalation.)Process exited due to Timeout escalation.-Process exited due to OutOfMemory escalation./Process exited due to StackOverflow escalation.
&The check of the module's hash failed.
QThe located assembly's manifest definition does not match the assembly reference.?The private assembly was located outside the appbase directory.1A module specified in the manifest was not found.7Modules which are not in the manifest were streamed in.&A strongly-named assembly is required.
Strong name signature could not be verified. The assembly may have been tampered with, or it was delay signed but not fully signed with the correct private key.CAn unexpected error was encountered in the Assembly Cache database.0The given assembly name or codebase was invalid.AHTTP download of assemblies has been disabled for this appdomain.+Uninstall of given assembly is not allowed.
FAssembly in host store has a different signature than assembly in GAC.
Error occurred during a read.
Error occurred during a write.
File is read only.
Ill-formed name.
Data value was truncated.
Old version error.NA shared memory open failed to open at the originally assigned memory address.
RCreate of shared memory failed. A memory mapping of the same name already exists.%No .CLB data in the memory or stream.
Database is read only.:Importing scope is not compatible with the emitting scope.
File is corrupt.%Required version of schema not found.
8Cannot open a incrementally build scope for full update.
6Null value not allowed in unique index or primary key.
Index has been duplicated.1The columns data type is not allowed in an index.
Index not found.
Record not found on lookup.,Too many records were returned for criteria.
Record is a duplicate.
Primary key value is required.
Record is valid but deleted.
Record is emitted out of order.
Data too large.
Column cannot be changed..Too many RID or primary key columns, 1 is max.0Primary key column may not allow the null value.
(Attempted auto-drop of table while open.!Object not found in the database.
Column not found.
Invalid index.
A blob or string was too big.
8A token of the wrong type passed to a metadata function.
,Typelib import: Invalid type, not converted.;Typelib import: Invalid type, not converted - name unknown.!Typelib export: TLBX_E_CTX_NESTEDDTypelib export: General error. See IError info for more information.(Typelib export: SaveAllChanges() failed./Typelib export: Type library is not registered.1Typelib export: Type library could not be loaded./Typelib import: Invalid vartype, not converted.+Typelib export: Could not load mscoree.tlb.CTypelib export: Could not get a required typeinfo from mscoree.tlb.(Typelib import: Fault reading a typelib.7Typelib import: Multiple [lcid] parameters on a method.
4Typelib import: Duplicate or ambiguous return types.:Typelib import: Duplicate name (due to user-defined name).
6Typelib export: Cannot convert non-sequential structs.
,Typelib import: The resolve ref call failed.,Typelib export: Encountered AsAny - ignored.LTypelib export: Encountered an [lcid] attribute set to an invalid parameter.MTypelib export: Encountered an [lcid] attribute on a pure dispatch interface.2Typelib export: Non-public field in public struct.
Typelib export: Bad names list.
3TypeLib export: generic type instance in signature.4TypeLib export: generic type parameter in signature.
2Attempted to define an object that already exists./A guid was not provided where one was required.CMerge: an import typedef matched ns.name, but not version and guid.(Merge: conflict between import and emit.
.TypeLib export: Detected array of SafeHandles.9Merge: Class already in emit scope, but member not found.9Merge: Class already in emit scope, but member not found.(Merge: Parameter information mismatched./Merge: Inconsistency in meta data import scope.@Merge: Class already in emit scope, but interfaceimpl not found.2TypeLib export: Detected array of CriticalHandles.DMerge: Duplicate classes have inconsistent class layout information.DMerge: Field is duplicated but no matching FieldMarshal information.
7Merge: Method is duplicated but no matching event info.:Merge: Method is duplicated but no matching property info.
Bad binary signature.
Bad input parameters.6Merge: duplicated methods have inconsistent ImplFlags."Merge: Inconsistency in meta data.
Cannot resolve typeref.
2No logical space left to create more user strings.
Unexpected TokenRemap.#Unmark all has been called already.)Must call UnmarkAll first before marking.CMerge: duplicated types or methods have inconsistent GenericParams.8Merge: different event counts in import and emit scopes.;Merge: different property counts in import and emit scopes.KMerge: An input scope has a TypeRef which does not have a matching TypeDef.
1TypeLib export: cannot open the module to export.$TypeLib export: cannot load a class.ETypeLib export: the hModule of a loaded class is 0; cannot export it.5TypeLib export: no CLSID or Interface subkey to HKCR.DTypeLib export: attempted to export an Assembly imported from a TLB.DTypeLib import: attempted to import a TLB exported from an Assembly.4TypeLib export: bad Native type in method signature.8TypeLib import: non-increasing vtable (duplicate slots).6TypeLib export: the COM register method is non static.VTypeLib export: the specified COM register method does not have the correct signature.%TypeLib export: cannot load CLR type.-TypeLib export: unknown element in signature.1TypeLib import: reference to an external typelib.BTypeLib import: an imported typelib has an invalid namespace name.$Typelib export: an error on Layout()4Typelib import: Interface not derived from IUnknown._Signature has token following ELEMENT_TYPE_CLASS (_VALUETYPE) that is not a TypeDef or TypeRef.BWarning: Class does not implement interface method in this module.DTypeLib export: attempted to export an Assembly imported from a TLB.
?Typelib export: Non COM visible value type in method signature.mTypelib export: Types which contain the native type NATIVE_TYPE_LPTSTR are not allowed to be exported to COM.STypelib export: Types with a charset of auto are not allowed to be exported to COM.
:Typelib export: The enum value is not legal for a typelib.
Typelib export: Duplicate IID.'Typelib export: detected nested arrays.6Typelib import: parameter type could not be converted.OTypelib import: parameter type could not be converted - parameter name unknown.3TypeLib export: size agnostic element in signature. TypeLib export: exporter failed.<Typelib import: [dual] interface not derived from IDispatch.
Typelib export: bad signature.;Typelib export: non-fixed or non-safearray array in struct..Typelib export: non-interface class in struct.
)Known custom attribute on invalid target.)Known custom attribute had invalid value.+Known custom attribute blob has bad format.8Known custom attribute blob has repeated named argument.5Known custom attribute named argument not recognized.8Known attribute named argument does not support variant.6Known attribute named argument does not support array.-Known attribute parser found unexpected type.;Known attribute parser only handles fields, not properties.YKnown attribute parser found an argument that is invalid for the object it is applied to.#The format of the UUID was invalid.[The MarshalAs attribute has fields set that are not valid for the specified unmanaged type.5The specified unmanaged type is only valid on fields.'The parameter index cannot be negative."The multiplier cannot be negative.%The constant size cannot be negative.
A fixed string requires a size.6A custom marshaler requires the custom marshaler type.*A DllImport attribute requires a filename.>TypeLib import: Detected properties in a source dispinterface./SaveDelta was called without being in EnC mode.
9Merge: different method counts in import and emit scopes.8Merge: different field counts in import and emit scopes.<Merge: different parameter counts in import and emit scopes.
+TypeLib export: Exporting a TypedReference.
RTypeLib export: bitness of assembly does not match bitness of output type library.
Rid is out of range.!Coded token type is out of range.
Coded rid is out of range.
String offset is invalid.
GUID offset is invalid.
Blob offset if invalid.
Multiple module records found.
Module has null MVID.
TypeRef name is NULL.
TypeRef has a duplicate.
TypeDef name is NULL.0TypeDef has a duplicate based on name+namespace.&TypeDef has a duplicate based on GUID.
JTypeDef that is not an Interface and not System.Object extends nil parent.'System.Object extends a non-nil parent.
TypeDef extends sealed class.5TypeDef is Deleted but not marked with RTSpecialName.=TypeDef is marked RTSpecialName, but is not a Deleted record.
MethodImpl's Decl is private..Assembly [Ref] name has path and/or extension.-File has a system name (con, com, aux, etc.).
MethodImpl's body is static.-TypeDef is marked Interface but not Abstract.2TypeDef is marked Interface but parent is not Nil.-TypeDef is marked Interface but GUID is NULL.
TMethodImpl's Decl is final.2TypeDef is marked ValueType but not marked Sealed."Parameter has extra bits in flags.
InterfaceImpl has a duplicate.
MemberRef name is NULL.)MemberRef has an invalid name, _VtblGap*.)MemberRef has an invalid name, _Deleted*."MemberRef parent Nil in a PE file.)MemberRef has invalid calling convention.AMemberRef has Method parent but calling convention is not VARARG./MemberRef name different from parent MethodDef.4MemberRef signature different from parent MethodDef.
MemberRef has a duplicate.0ClassLayout parent TypeDef is marked AutoLayout. ClassLayout has bad PackingSize.
ClassLayout has a duplicate.
FieldLayout2 has bad offset.'FieldLayout2 has field with nil parent.'FieldLayout2 has no ClassLayout record.>FieldLayout2 parent TypeDef is not marked with ExplicitLayout.
%FieldLayout2 has field marked Static.
FieldLayout2 has a duplicate.
ModuleRef name is NULL.
ModuleRef has a duplicate.#TypeRef has a bad resolution scope.&TypeDef marked nested has no encloser.ITypeDef extends a TypeRef which resolves to a TypeDef in the same module."Signature specified is zero-sized.6Signature does not have enough data at specified byte.0Method signature has invalid calling convention.SMethod is marked static but has HASTHIS/EXPLICITTHIS set on the calling convention.?Method is not marked static but is not HASTHIS or EXPLICITTHIS./Method signature is missing the argument count.
Signature missing element type.
Signature missing token.
Signature has bad token.
&Signature is missing function pointer.6Signature has function pointer missing argument count.(Signature is missing rank specification./Signature is missing count of sized dimensions.'Signature is missing size of dimension.+Signature is missing count of lower bounds.#Signature is missing a lower bound.
Signature has bad element type.'Signature has value array missing size./Field signature has invalid calling convention.
Method name is NULL.
Method has parent NIL.
Method has a duplicate.
Field name is NULL.
Field parent is Nil.
Field has a duplicate.
Multiple Assembly records found.
Assembly name is NULL.5E_T_VALUETYPE<class token> or E_T_CLASS<vtype token>.
Class layout on an Interface.
AssemblyOS platform ID invalid.
AssemblyRef name is NULL. TypeDef not nested has encloser.&AssemblyRefOS has invalid platform ID.
File name is NULL.
ExportedType name is NULL.
TypeDef extends its own child.
ManifestResource name is NULL.
File has a duplicate.
File name is fully qualified.
ExportedType has a duplicate.!ManifestResource has a duplicate.
/ManifestResource is neither Public nor Private.
Enum has no value__ field.
Enum's value__ field is static.(Enum's value__ field is not SpecialName.
Enum's field is not static.
Enum's field is not literal.
Enum has no literal fields.8Enum's field signature does not match value__ signature."Enum's value__ field is not first./Field is RTSpecialName but name is not value__. Field value__ in not Enum class.
Instance field in interface.
Non-public field in interface.:Global field or method is neither Public nor PrivateScope.%Global field or method is not static.
Global field has no RVA.
.ctor or .cctor has zero RVA.7Field is marked marshaled but has no marshaling record.8Field has marshaling record but is not marked marshaled.2Field is marked HasDefault but has no const value.:Field has const value record but is not marked HasDefault.AField or method is marked HasSecurity but has no security record.BField or method has security record but is not marked HasSecurity.4Field or method is PInvoke but is not marked Static.5Field or method is marked PInvoke but has no ImplMap.6Field or method has ImplMap but is not marked PInvoke.$Field or method has invalid ImplMap.
ImplMap has invalid ModuleRef.$ImplMap has invalid MemberForwarded.
ImplMap has invalid ImportName.
ImplMap has invalid call conv.(Field or method has invalid access flag.
Field is InitOnly and Literal. Field is Literal but not Static.1Field or method is RTSpec.Name but not Spec.Name."Method is abstract, parent is not.+Method not static or abstract in interface.
Method not public in interface.
.ctor in interface.
global .ctor or .cctor.
static .ctor.8.ctor or .cctor not marked SpecialName or RTSpecialName.
virtual .ctor or .cctor.
abstract .ctor or .cctor.
instance .cctor.KRVA set to zero, but method not abstract or pinvoke or runtime, or reverse. Method is final and not virtual.&Method is static and final or virtual.
Method is abstract and final.#Method is abstract and implemented.
Method is abstract and pinvoke.#Method is abstract and not virtual.+Method is not abstract and not implemented.DMethod is not abstract and not (non-zero RVA or PInvoke or runtime)./Method is PrivateScope and has RVA set to zero.%Global method is abstract or virtual.
Signature uses long form.(Method has multiple semantics (warning).5Method has invalid semantics (not event or property.)5Method has semantics association that does not exist.!MethodImpl's Decl is not virtual.&Global field or method (warning, CLS).'Method has multiple semantic flags set.!Method has no semantic flags set.
"Field in Interface (warning, CLS).#Unrecognized Hash Alg ID (warning)./Unrecognized Processor ID in Assembly(warning).2Unrecognized Processor ID in AssemblyRef(warning).$Constant: parent token out of range.
Invalid flags in Assembly.5There is TypeDef with same name as TypeRef (warning).8In InterfaceImpl, the implementing token is not TypeDef.BIn InterfaceImpl, the implemented token is not TypeDef or TypeRef.=TypeDef has security record but it is not marked HasSecurity.6TypeDef marked HasSecurity but has no security record.
.cctor has arguments.(ExportedType has invalid Implementation.%MethodImpl has body from other class.&.cctor has invalid calling convention.#MethodImpl has invalid Class token.
!MethodImpl declared in Interface./MethodImpl has invalid MethodDeclaration token.(MethodImpl has invalid MethodBody token.
MethodImpl has duplicate.
Bad field parent.$Parameter out of sequence (warning).8Parameter's sequence number exceeds number of arguments.4Parameter marked HasMarshal, has no marshaling info.5Parameter has marshaling info, not marked HasMarshal.
0Parameter marked HasDefault, has no const value.1Parameter has const value, not marked HasDefault.
Property has invalid scope.
Property has no name.
Property has no signature.
Property has a duplicate.
$Property has bad calling convention./Property marked HasDefault, has no const value.0Property has const value, not marked HasDefault.:Property has method that is neither a Setter nor a Getter.'Property has method with invalid token.'Property has method from another class.+Const has non-null blob when it should not.
Const has null value blob.
Event has invalid scope.
Event has no name.
Event has a duplicate.
Event has invalid EventType.!Event's EventType is not a class.1Event has method not (AddOn,RemoveOn,Fire,Other).$Event has method with invalid token.
$Event has method from another class.
Event has no AddOn method.
Event has no RemoveOn method.&ExportedType has same name as TypeDef.0MRes refers to non-PE file with non-zero offset.-Declarative security has invalid owner token..Declarative security has invalid action flags.,Declarative security has no permission blob.-Manifest resource has invalid Implementation.
1MemberRef has VARARG calling conv. (CLS warning).2.ctor or .cctor returns something other than void..Fire method returns something other than void.
Invalid locale.$Constant has parent of invalid type.$E_T_SENTINEL in MethodDef signature.
E_T_SENTINEL <=> VARARG.
Multiple E_T_SENTINELs."E_T_SENTINEL not followed by type.
Signature missing argument.
Field of ByRef type.#Synchronized method in value class.
TypeDef name too long.
Duplicate Assembly Processor./Duplicate Assembly OS (ID+ver.major+ver.minor). Manifest Resource has bad flags.
ExportedType has nil TypeDefId.
File has bad flags.
File has no hash blob.
Module has no name. Module has fully-qualified name.1TypeDef is tdRTSpecialName but not tdSpecialName.
TypeDef extends interface.
.ctor or .cctor is PInvokeImpl.
System.Enum is not a class.)System.Enum extends not System.ValueType./MethodImpl's Decl and Body signatures mismatch.,TypeDef extends System.Enum but has methods.8TypeDef extends System.Enum but implements an interface./TypeDef extends System.Enum but has a property.-TypeDef extends System.Enum but has an event.$TypeDef has MethodList > Nmethods+1."TypeDef has FieldList > Nfields+1.
Constant has wrong type.
Enum has no instance fields."Enum has multiple instance fields.0Validator has been interrupted by the VEHandler.)Validator failed to initialize correctly.
5Interface in InterfaceImpl is not marked tdInterface.1Field marked fdHasFieldRVA but has no RVA record./Field marked fdHasFieldRVA has RVA set to zero.)Method has both non-zero RVA and ImplMap.%TypeDef has extraneous bits in flags.
TypeDef extends itself./System.ValueType does not extend System.Object.!Class extends TypeSpec (warning).
Value Class has zero size.
Interface is sealed."Bad 'nested' token in NestedClass.%Bad 'enclosing' token in NestedClass.
Duplicate NestedClass record..Duplicate NestedClass with different encloser.#RVA set to zero in FieldRVA record.
'Invalid field token in FieldRVA record.!Duplicate RVA in FieldRVA record.#Duplicate field in FieldRVA record.'Bad token as entry point in CLR header.8Entry point in CLR header is a token of instance method.&Enum has non-integral underlying type.
Method has bogus RVA.!Literal field has no const value.BClass implementing an interface does not implement one of methods.
CA has invalid owner.
CA has invalid type.
CA type is not .ctor.
CA type has bad signature.
CA type has no signature.'CA blob has bad prolog (not 0x01 0x00)."Method has invalid LocalSig token.
Method has invalid header.'Entry point has more than one argument. Entry point has bad return type.
Entry point has bad argument.
Illegal 'void' in signature."Multiple implementation of method.
GenericParam name is NULL.
GenericParam has nil owner.-GenericParam has duplicate by owner and name./GenericParam has duplicate by owner and number.(GenericParam is non sequential by owner.)GenericParam is non sequential by number.HGenericParam has variance but its owner is not an interface or delegate.@GenericParam is a method type parameter and must be non-variant.2GenericParam has illegal value for variance flags.OGenericParam has incompatible special constraints reference type and valuetype.
%GenericParamConstraint has nil owner.=GenericParamConstraint has duplicate by owner and constraint.TGenericParamConstraint is non-contiguous with preceeding constraints for same owner.
MethodSpec has nil method.;MethodSpec has duplicate based on method and instantiation.4MethodSpec signature has invalid calling convention.4MethodSpec signature is missing arity specification..MethodSpec signature is missing type argument.BMethodSpec arity of generic method and instantiation do not match.!MethodSpec method is not generic.5Signature missing arity of instantiated generic type.DSignature has generic type of arity instantiated at different arity.6Method cannot be both generic and a class constructor.:Method cannot be both generic and an instance constructor.>Method cannot be both generic and defined on an imported type.FMethod cannot be both generic and have non-default calling convention.
<Entry point in CLR header is the token for a generic method.5Method signature is generic but is missing its arity.2Method signature is generic but its arity is zero.3Signature has generic type instantiated at arity 0.!MethodSpec signature has arity 0.9MethodDef signature has arity n but owns m GenericParams.FEntry point in CLR header is the token for a method in a generic type.<MethodImpl overrides non-generic method with generic method.<MethodImpl overrides non-generic method with generic method.NMethodImpl overrides generic method of arity n with generic method of arity m.<TypeDef extends a TypeSpec that is not an instantiated type.5Signature has type instantiated at ByRef at offset i.5Signature has type instantiated at ByRef at offset i.
TypeSpec has empty signature.8TypeSpec has signature containing one or more sentinels.+TypeDef is generic but has explicit layout.
Unrecoverable API error.
Process was terminated.
Process not synchronized.
A class is not loaded.9An IL variable is not available at the current native IP.;A reference value was found to be bad during dereferencing.KA field in a class is not available, because the runtime optimized it away.2'Native-frame-only' operation on non-native frame.-Cannot Continue on non-continuable exception."The code is currently unavailable.AAttempt to get a ICorDebugFunction for a function that is not IL.
SetIP is not possible because SetIP would move EIP from outside of an exception handling finally clause to a point inside of one.{SetIP is not possible because it would move EIP from within an exception handling finally clause to a point outside of one.
SetIP is not possible, because SetIP would move EIP from outside of an exception handling catch clause to a point inside of one.8SetIP cannot be done on any frame except the leaf frame.
SetIP is not allowed.*Func eval cannot work. Bad starting point.%This object value is no longer valid.:CordbEval::GetResult called before func eval has finished.
KThe in-process version of the debugging API does not support this function.
KA static variable is not available because it has not been initialized yet.(Cannot copy a VC with object refs in it.%SetIP cannot leave or enter a filter./JIT settings for ZAP modules cannot be changed.zSetIP is not possible because it would move EIP from within a finally clause to a point outside of one on WIN64 platforms.xSetIP is not possible because it would move EIP from within a catch clause to a point outside of one on WIN64 platforms.
(The remote device closed the connection.6The connection was closed due to a keep-alive failure.UGeneric error that the device connection has been broken with no chance for recovery.8Cannot use JMC on this code (likely wrong JIT settings).
#The state of the thread is invalid.'This process has already been attached.LReturned from a call to Continue that was not matched with a stopping event.
+Cannot perfrom SetValue on non-leaf frames.|When doing Edit and Continue, some JITs do not allow increasing the maximum level to which exception handling can be nested.YTried to do Edit and Continue on a module that was not started in Edit and Continue mode.&SetIP cannot be done on any exception.UThe 'variable' does not exist because it is a literal optimized away by the compiler.
Process has been detached.:Not allowed to change the signature of an existing method..Cannot get the local signature for the method.8Adding a field to a value or layout class is prohibited.!Cannot change field after adding.)Only support addition of private members.1GetStaticFieldValue called on a non-static field.NReturned if someone tries to call GetStaticFieldValue on a non-instance field.|If a zap file was created without the Edit and Continue flag set, then we cannot do Edit and Continue on it, no matter what.!Lacking information about method.'The JIT is unable to update the method.
1An internal structure about the class is missing.5Internal Runtime Error while doing Edit-and-Continue.EThe field was added via Edit and Continue after the class was loaded.
Module not loaded.!Not allowed to change base class.
Cannot set a breakpoint here.RDebugging is not possible due to an incompatibility within the CLR implementation.bA kernel debugger is enabled on the system. User-mode debugging will trap to the kernel debugger.bA kernel debugger is present on the system. User-mode debugging will trap to the kernel debugger..The debugger's internal helper thread is dead.,Not allowed to change interface inheritance.:The debugger's protocol is incompatible with the debuggee.:The debugger can only handle a finite number of debuggees.EInterop debugging is supported on neither Win9x nor 64-bit platforms.>Cannot call RemapFunction until have received RemapBreakpoint.
Object is in a zombie state.
Function not yet compiled.'The ID is not fully loaded/defined yet.4The Module is not configured for updateable methods.+The Method could not be updated for re-JIT. The Method has no associated IL.-The thread has never run managed code before.?The function may only be called during profiler initialization.;In-process debugging must be enabled during initialization.2Cannot get a JIT map becuase they are not enabled.$BeginInprocDebugging already called./In-process debugging not allowed at this point.+Requested information is not yet available.@The given type is a generic and cannot be used with this method.DThe given function is a generic and cannot be used with this method.
Failed to convert XML to ASN.OLoading this assembly would produce a different grant set from other instances.&Unverifiable code failed policy check.=Assembly already loaded without additional security evidence.
Failure decoding permission set. Failure encoding permission set.
Unrecognized encoding format.(StrongName APIs not supported on system.0StrongName APIs could not locate a matching CSP."Invalid security custom attribute.
PolicyException thrown.,Failed to grant minimum permission requests.&Failed to grant permission to execute.
XML Syntax error.
Strong name validation failed.
Assembly is not strong named.$Strong name key container not found.
Invalid assembly file format.
Invalid assembly public key.
Signature size mismatch.
'Failure during Cryptographic operation.#Unexpected Cryptographic operation.
(Generic problem with a custom attribute.
Missing a required constructor.1Unable to create a permission for this attribute.(SecurityAction type invalid on assembly.1SecurityAction type invalid on types and methods.5Security custom attribute attached to invalid parent.%Bad custom attribute serialized blob.-Bad custom attribute serialized blob version.
Invalid security action code./CA reference to CA definition in same assembly..Use of non-CAS permission with invalid action.<Failed to load assembly containing CA (or required CA type).<Failed to load assembly containing CA (or required CA type).-Failed to load CA type (or required CA type).-Failed to load CA type (or required CA type).
CA type is abstract..Unsupported type for field or property setter.1Unsupported base type for enum field or property.
Could not find a CA field.
Could not find a CA property.
Unexpected exception.
Unexpected exception.
!IsolatedStorage operation failed.
Unable to open the store.$Unable to create store file mapping.
Unable to map the store file.$Unable to determine store file size.
Unable to create mutex.
Unable to lock the store.
File Write failed.
Cannot set file pointer.%Unable to create the store directory.&Store must be open for this operation.
Store file is corrupt.
Store version is not supported.
Store file is not mapped.
Block size is too small.
Allocation size is too large.
Allowed quota is fully used.
Row not found.
Unable to deprecate old store.
Unable to determine the caller.
Path length is too long.
Machine Store is not supported.DThe DACL for the machine store is incorrect or could not be created.
Application exception<The given filter criteria does not match the filter content.NCould not find or load a specific class that was requested through Reflection.7Attempt to invoke non-static method with a null Object.>Uncaught exception thrown by method called through Reflection.$Custom attribute has invalid format.
General Exception
System.Exception'An argument was out of its legal range.;Attempted to store an object of the wrong type in an array.9Attempted to marshal an object across a context boundary.
Operation timed out.
Internal CLR error.
Access to this field is denied.
Array subscript out of range./An operation is not legal in the current state.'An error relating to security occurred.'An error relating to remoting occurred.,An error relating to serialization occurred.$A verification failure has occurred.'An error relating to remoting occurred.0An error relating to ServicedComponent occurred.
0The given key was not present in the dictionary.
Devices not supported.DA datatype misalignment was detected in a load or store instruction.
Thread has aborted. OLE Variant has an invalid type.:An expected resource in the assembly manifest was missing.hA mismatch has occurred between the runtime type of the array and the sub type recorded in the metadata..Uncaught exception during type initialization.
Invalid marshaling directives.
An expected satellite assembly containing the ultimate fallback resources for a given culture was not found or could not be loaded.DThe format of one argument does not meet the contract of the method.dA mismatch has occurred between the runtime rank of the array and the rank recorded in the metadata.,Operation is not supported on this platform.
Invalid IL or CLR metadata.
The operation was cancelled.
:The format of a DLL or executable being loaded is invalid.
Access to this method is denied.
Field does not exist.
Member does not exist.
Method does not exist.4Attempt to combine delegates that are not multicast.
Operation is not supported.FArithmetic, casting or conversion operation overflowed or underflowed.GAn array has the wrong number of dimensions for a particular operation.8This operation must be called from a synchronized block.,Thread was interrupted from a waiting state. Access to this member is denied.
1Thread is in an invalid state for this operation.
Thread is stopping.
Could not find or load a type.2Could not find the specified DllImport entrypoint.+Could not find the specified DllImport Dll.
%An invalid __ComObject has been used.
Not a Number.;An object appears more than once in the wait objects array.
$Reached maximum count for semaphore.&No semaphore of the given name exists.-The wait completed due to an abandoned mutex.
Error during managed I/O.'Could not find or load a specific file.%The object has already been disposed.BRuntime operation halted by call to System.Environment.FailFast().
&The host has forbidden this operation.
Failed to load the runtime.0Failed to find a required export in the runtime.
Install root is not defined.3Expected component of the runtime is not available.
Unknown opcode.
Unknown calling convention.
Unknown ELEMENT_TYPE.
[return sig]
[field sig]
Internal error.
Stack is too large.
Array name is too long.
0fall through end of the method without returning
try start >= try end
try end > code size
handler start >= handler end
handler end > code size
+Try starts in the middle of an instruction./Handler starts in the middle of an instruction.
%Try block overlap with another block.-Try and filter/handler blocks are equivalent.(Shared try has finally or fault handler.*Handler block overlaps with another block.+Handler block is the same as another block.)Filter block overlaps with another block.*Filter block is the same as another block.
Filter contains try.
Filter contains handler.
Nested filters.
filter >= code size.Filter starts in the middle of an instruction.&fallthru the end of an exception block"fallthru into an exception handler!fallthru into an exception filter(Leave from outside a try or catch block.%Rethrow from outside a catch handler.)Endfinally from outside a finally handler0Endfilter from outside an exception filter block
Missing Endfilter.
Branch into try block.$Branch into exception handler block.#Branch into exception filter block.
Branch out of try block.&Branch out of exception handler block.%Branch out of exception filter block.
Branch out of finally block.
Return out of try block.&Return out of exception handler block.%Return out of exception filter block.2jmp / exception into the middle of an instruction.'Non-compatible types depending on path..Init state for this differs depending on path.0Non-compatible types on stack depending on path.&Stack depth differs depending on path.!Instance variable (this) missing.+Uninitialized this on entering a try block.)Store into this when it is uninitialized.-Return from .ctor when this is uninitialized.
4Return from .ctor before all fields are initialized.'Branch back when this is uninitialized.)ldftn and ldvirtftn not allowed on .ctor."Non-compatible types on the stack.
Unexpected type on the stack.!Missing stack slot for exception.
Stack overflow.
Stack underflow.
Stack empty.
Uninitialized item on stack.#Expected I, I4, or I8 on the stack.#Expected R, R4, or R8 on the stack.)unexpected R, R4, R8, or I8 on the stack.#Expected numeric type on the stack. Expected an ObjRef on the stack.+Expected address of an ObjRef on the stack.
Expected ByRef on the stack.*Expected pointer to function on the stack.-Expected single dimension array on the stack.*Expected value type instance on the stack.,Expected address of value type on the stack.,Unexpected value type instance on the stack.)Local variable is unusable at this point.#Unrecognized local variable number.
Unrecognized argument number.
Unable to resolve token.$Unable to resolve type of the token.2Expected memberRef, memberDef or methodSpec token.%Expected memberRef or fieldDef token.
Expected signature token.
Instruction cannot be verified.-Operand does not point to a valid string ref.
@Return type is ByRef, TypedReference, ArgHandle, or ArgIterator.3Stack must be empty on return from a void function."Return value missing on the stack.)Stack must contain only the return value.
Return uninitialized data.
Illegal array access.(Store non Object type into Object array. Expected single dimension array.1Expected single dimension array of pointer types.
Array field access is denied.
Allowed only in vararg methods.
Value type expected.
Method is not visible.
Field is not visible.
Item is unusable at this point.
Expected static field.
Expected non-static field.%Address of not allowed for this item.!Address of not allowed for ByRef.)Address of not allowed for literal field./Cannot change initonly field outside its .ctor.
Cannot throw this object. Callvirt on a value type method.
Call signature mismatch.
Static function expected.
.ctor expected.
Cannot use callvirt on .ctor.4Only super::ctor or typeof(this)::ctor allowed here.&Possible call to .ctor more than once.
Unrecognized signature.
Cannot resolve Array type.
Array of ELEMENT_TYPE_PTR.
#Unverifiable PE Header/native stub.+Unrecognized metadata, unable to verify IL.
Unrecognized appdomain pointer.
Type load failed.
Module load failed.*Cannot modify an imaged based (RVA) static
7Array of ELEMENT_TYPE_BYREF or ELEMENT_TYPE_TYPEDBYREF.$ELEMENT_TYPE_PTR cannot be verified.
Unexpected vararg.
Unexpected Void.
ByRef of ByRef
Code size is zero.
Unrecognized use of vararg. Missing call, callvirt or calli.!Cannot pass ByRef to a tail call.
Missing ret.%Void ret type expected for tail call.%Tail call return type not compatible. Stack not empty after tail call.,Method ends in the middle of an instruction.
Branch out of the method.
Finally handler blocks overlap.
Lexical nesting.SMissing ldsfld, stsfld, ldind, stind, ldfld, stfld, ldobj, stobj, initblk or cpblk.CMissing ldind, stind, ldfld, stfld, ldobj, stobj, initblk or cpblk.4Innermost exception blocks should be declared first.%Calli not allowed on virtual methods.%Call not allowed on abstract methods.#Unexpected array type on the stack.CValue type with NotInGCHeap attribute being created on the GC heap.1Attempt to enter a try block with nonempty stack.*Unrecognized arguments for delegate .ctor.pDelegate .ctor not allowed at the start of a basic block when the function pointer argument is a virtual method.TDup, ldvirtftn, newobj delegate::.ctor() pattern expected (in the same basic block).HLdftn or ldvirtftn instruction required before call to a delegate .ctor..Attempt to load address of an abstract method.+ELEMENT_TYPE_CLASS ValueClass in signature.
3ELEMENT_TYPE_VALUETYPE non-ValueClass in signature.;Box operation on TypedReference, ArgHandle, or ArgIterator.3ByRef of TypedReference, ArgHandle, or ArgIterator.3Array of TypedReference, ArgHandle, or ArgIterator.1Stack not empty when leaving an exception filter.2Unrecognized delegate .ctor signature; expected I.7Unrecognized delegate .ctor signature; expected Object.6Mkrefany on TypedReference, ArgHandle, or ArgIterator.%Value type not allowed as catch type. ByRef not allowed as catch type.5filter block should immediately precede handler block
ldvirtftn on static
callvirt on staticOinitlocals must be set for verifiable methods with one or more local variables.:branch or leave to the beginning of a catch/filter handlerVCall to .ctor only allowed to initialize this pointer from within a .ctor. Try newobj.
2Value type, ObjRef type or variable type expected.JExpected address of value type, ObjRef type or variable type on the stack./Unrecognized type parameter of enclosing class.0Unrecognized type parameter of enclosing method.=Unrecognized type argument of referenced class instantiation.>Unrecognized type argument of referenced method instantiation.
Cannot resolve generic type.9Method instantiation contains non boxable type arguments.@Method parent instantiation contains non boxable type arguments.?Field parent instantiation contains non boxable type arguments.CUnrecognized calling convention for an instantiated generic method.4Unrecognized generic method in method instantiation.3Missing ldelema or call following readonly. prefix./Missing callvirt following constrained. prefix.<Method parent has circular class type parameter constraints.6Method has circular method type parameter constraints.
GMethod instantiation has unsatisfied method type parameter constraints.MMethod parent instantiation has unsatisfied class type parameter constraints.LField parent instantiation has unsatisfied class type parameter constraints.QType operand of box instruction has unsatisfied class type parameter constraints.?The 'this' argument to a constrained call must have ByRef type.IThe operand to a constrained prefix instruction must be a type parameter.SThe readonly prefix may only be applied to calls to array methods returning ByRefs. Illegal write to readonly ByRef..A readonly ByRef cannot be used with mkrefany.>Alignment specified for 'unaligned' prefix must be 1, 2, or 4.
The tail.call (or calli or callvirt) instruction cannot be used to transfer control out of a try, filter, catch, or finally block.OStack height at all points must be determinable in a single forward scan of IL.
Call to base type of valuetype./Cannot construct an instance of abstract class.
'Accessing type with overlapping fields.OThe 'this' parameter to the call must be the calling method's 'this' parameter.
Expected I4 on the stack.
MThread is not scheduled. Thus we may not have OSThreadId, handle, or context.
Handle has been disposed. Cannot intercept this exception.IWhen intercepting an exception, cannot intercept above the current frame.<The intercept frame for this exception has already been set..There is no native patch at the given address.0This API is only allowed when interop debugging./There is already a native patch at the address.3A wait timed out, likely an indication of deadlock."Cannot use the API on this thread.!Method was not JIT'd in EnC mode.AFrame cannot be updated due to change in max nesting of handlers.>Method is in a callable handler/filter. Cannot increase stack.(Frame cannot be updated due to localloc.$Attempt to perform unsupported edit.1Attempt to func eval abort on a suspended thread.
@The LS is not in a good spot to perform the requested operation.nWe failed to resolve assembly given an AssemblyRef token. Assembly may be not loaded yet or not a valid token.IMust be in context of LoadModule callback to perform requested operation.CRequested operation cannot be performed during an attach operation.:NGEN must be supported to perform the requested operation. Trying to shutdown out of order.6Debugging fiber mode managed process is not supported.LMust be in context of CreateProcess callback to perform requested operation.UAll outstanding func-evals have not completed, detaching is not allowed at this time.UAll outstanding steppers have not been closed, detaching is not allowed at this time.
5Cannot have an ICorDebugStepper do a native step-out.XAll outstanding breakpoints have not been closed, detaching is not allowed at this time.5The operation is illegal because of a stack overflow.5The operation failed because it is a GC unsafe point.9The operation failed because the thread is in the prolog.:The operation failed because the thread is in native code.=The operation failed because the thread is in optimized code.8The information requested is not supported by minidumps.9A supplied object or type belongs to the wrong AppDomain.&The thread's context is not available.
QThe operation failed because debuggee and debugger are on incompatible platforms.<The operation failed because the debugging has been disabled9Detach is illegal after an Edit and Continue on a module.
VThe debugger helper thread cannot obtain the locks it needs to perform this operation.
File is empty.
File has no NT headers.
File is PE32+.
File has no COR header.
Flag IL_ONLY not set.
Bad import DLLs. EXE file has no mgd entry point.
Bad base relocations.
Bad managed entry point.$OptHeader.SizeOfCode is set to zero.
File has invalid COR header.
IThe operation was interrupted by the CLR Optimization Service controller.
(Failed to get dependencies for assembly.
Failed to delete native image.HModule contains too many interfaces to successfully compile all methods.
QWRN: Found match in cache, but cannot create assembly from the cache information.!LOG: GAC Lookup was unsuccessful.
?WRN: Comparing the assembly name resulted in the mismatch: NAMEHWRN: Comparing the assembly name resulted in the mismatch: Major VersionHWRN: Comparing the assembly name resulted in the mismatch: Minor VersionJWRN: Comparing the assembly name resulted in the mismatch: Revision NumberGWRN: Comparing the assembly name resulted in the mismatch: Build NumberKWRN: Comparing the assembly name resulted in the mismatch: PUBLIC KEY TOKENBWRN: Comparing the assembly name resulted in the mismatch: CULTUREAWRN: Comparing the assembly name resulted in the mismatch: CUSTOM
PERR: Fatal error occurred attempting to canonicalize the codebase for this bind.
+LOG: Unable to prepare policy cache object.GLOG: Download of application configuration file is already in progress."=== Pre-bind state information ===
LOG: DisplayName = %ws
(%ws)#LOG: Where-ref bind. Location = %ws
LOG: Appbase = %ws
LOG: Initial PrivatePath = %ws
LOG: Dynamic Base = %ws
LOG: Cache Base = %ws
LOG: AppName = %ws
===8LOG: Attempting application configuration file download.GLOG: Download of application configuration file was attempted from %ws.CLOG: Reusing an assembly instance that was previously loaded (%ws).+LOG: Configuration file %ws does not exist.
7LOG: IJW assembly bind returned the same manifest path./LOG: IJW assembly bind returned file not found.=ERR: Assembly with the same identity has already been loaded.
LOG: User = %wsEERR: Publisher policy assembly is found, but there is no config file.
0LOG: Found application configuration file (%ws).
zLOG: Found assembly in DEVOVERRIDE location [%ws], but the assembly reference did not match the assembly definition found.SLOG: Found assembly in DEVOVERRIDE location [%ws], but signature validation failed.
QWRN: Binding redirects specified for assemblies without strong names are ignored.
0ERR: There was an error parsing XML (hr = 0x%x).SWRN: The assemblyIdentity was not processed because the name attribute was missing.@WRN: bindingRedirect tag not processed due to insufficient data.9WRN: codeBase tag not processed because href not present.eWRN: Invalid XML. Encountered more than 1 assemblyIdentity inside single dependentAssembly. Ignoring.0WRN: Private path set. Ignoring duplicate entry.tLOG: Policy not being applied to reference at this time (private, custom, partial, or location-based assembly bind).
(LOG: Re-apply policy for where-ref bind.5LOG: Switch from LoadFrom context to default context.5LOG: Switch from default context to LoadFrom context.&LOG: Codebase matches assembly in GAC.-LOG: Codebase does not match assembly in GAC.jLOG: Where-ref bind Codebase matches what is found in default context. Keep the result in default context.rLOG: Where-ref bind Codebase does not match what is found in default context. Keep the result in LoadFrom context.<LOG: Input is partial name. Skip host assembly store lookup.dERR: Downloaded file was not cached. The web server may be configured to expire content immediately.WWRN: The assembly returned from host store has different signature from the one in GAC.ILOG: Host store returns assembly stream with id = %I64u, context = %I64u..LOG: Host store does not provide debug stream..LOG: Using application configuration file: %ws-LOG: No application configuration file found.
LOG: Assembly Name is: %wsBLOG: The same bind was seen before, and was failed with hr = 0x%x.
'LOG: Using host configuration file: %ws'LOG: Host configuration file not found.
FLOG: Redirect found in host configuration file: %ws redirected to %ws.2LOG: No redirect found in host configuration file.MLOG: Redirect found in application configuration file: %ws redirected to %ws.4LOG: Safe mode is set (publisher policy disallowed).(LOG: Publisher policy file is not found.+LOG: Publisher policy file is found at %ws.DLOG: Publisher policy file redirect is found: %ws redirected to %ws.6LOG: Machine configuration file does not exist at %ws./LOG: Using machine configuration file from %ws.MLOG: Machine configuration policy file redirect found: %ws redirected to %ws.CWRN: Binding redirect encountered, but could not retrieve codebase.*LOG: Using codebase from policy file: %ws.
LOG: Post-policy reference: %ws
LOG: AssemblyStore path = %ws
LWRN: Comparing the assembly name resulted in the mismatch: Retargetable flag"LOG: Retarget policy is not found.CLOG: Name redirect found in retarget config: %ws redirected to %ws.FLOG: Version redirect found in retarget config: %ws redirected to %ws.MLOG: PublicKeyToken redirect found in retarget config: %ws redirected to %ws.$ERR: Parse XML memory stream failed.CERR: bindingRetarget tag is not processed due to insufficient data.
WRN: Invalid processor architecture is specified in assemblyIdentity. Valid processor architectures are neutral/x86/IA64/AMD64.
1LOG: Binding succeeds. Returns assembly from %ws.
9WRN: Application configuration file safe mode disallowed.AWRN: Application configuration file binding redirects disallowed.$WRN: App base probing is disallowed.
(ERR: Failed to apply policy (hr = 0x%x).7LOG: Private path hint found in configuration file: %s.*WRN: Error parsing XML file %ws. Ignoring.SERR: A fatal error occurred when retrieving next codebase for download (hr = 0x%x).(LOG: Attempting download of new URL %ws.[LOG: Probing in application directory failed, but assembly bind was still able to complete.JERR: Failed to complete setup of assembly (hr = 0x%x). Probing terminated.HERR: Unrecoverable error occurred during pre-download check (hr = 0x%x).@WRN: Unable to find URLMON.DLL. Assemblies cannot be downloaded.ALOG: Duplicate download found. Re-using the download in progress.DLOG: Assembly download was successful. Attempting setup of file: %ws3ERR: Unable to extract last modified time from %ws.[WRN: Current version does not support CODEBASEs to .MSI files. Setup is unable to complete.>LOG: Unable to find assembly from extracted CAB location: %ws.+LOG: All probing URLs attempted and failed.PERR: Partial binds to assemblies in the global assembly cache are not supported.
5LOG: Found assembly by looking in the download cache.
LOG: Setting up CAB file.8ERR: Unable to create a temporary directory (hr = 0x%x).0ERR: Unable to extract the CAB file (hr = 0x%x).0LOG: Found matching assembly from CAB file: %ws.3LOG: Successfully extracted assembly from CAB file.=ERR: Unable to create assembly in download cache (hr = 0x%x).0LOG: Unable to find target assembly in CAB file./ERR: Unable to remove temporary directory: %ws.<ERR: Error extracting manifest import from file (hr = 0x%x).LERR: Error retrieving assembly name definition from manifest import = 0x%x).0LOG: Private assembly found in invalid location.kLOG: A partially-specified assembly bind succeeded from the application directory. Need to re-apply policy.?LOG: The post-policy assembly reference requires probing again.QWRN: A duplicate assembly was found while copying the assembly item to the cache.
kLOG: Assembly in default load context is loaded from a different location than the one in LoadFrom context.LERR: Loader location access permission check failed for URL %ws (hr = 0x%x).bERR: Attempt to load an assembly with ProcessorArchitecture incompatible with the running process.
/LOG: Lookup in global assembly cache succeeded.<LOG: Attempting to install assembly using Windows Installer.=LOG: Successfully installed assembly using Windows Installer.
-ERR: Error inserting entry into policy cache.fWRN: Windows Installer was able to provide the requested assembly, but setup of resulting file failed.*LOG: Entering run-from-source setup phase.#ERR: Module integrity check failed.)LOG: Entering download cache setup phase.HERR: The assembly reference did not match the assembly definition found.!ERR: Setup failed with hr = 0x%x.QWRN: Not probing location %ws, because the location falls outside of the appbase.*LOG: Found assembly by looking in the GAC.NERR: Expected to find a pre-jit assembly in cache, but assembly was not found.;ERR: Error occurred constructing the probing codebase list.)ERR: No codebases found to download from.
+ERR: Unable to copy file to cache location.KERR: The private assembly was located outside of appbase. Source Url = %ws._LOG: The asynchronous application configuration file download successful. Download location %ws?LOG: The asynchronous configuration file download unsuccessful.6ERR: Unable to create assembly cache item (hr = 0x%x).\ERR: Unable to commit cache item. Attempt to put assembly in cache unsuccessful (hr = 0x%x).
The operation was successful.
The operation failed.#--- A detailed error log follows.
*** Assembly Binder Log Entry
Bind result: hr = 0x%x. %ws
No description available.
Assembly manager loaded from:
Running under executable FLOG: Partial reference qualified from config file. New reference: %ws.
Calling assembly : %ws.
VNote: There is some performance penalty associated with assembly bind failure logging._To turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog].
.NET Framework components already installed on this computer are incompatible with the version that is being installed. Install the latest version of .NET Framework 3.5 (SP1 or higher) from http://go.microsoft.com/fwlink/?LinkId=108995 instead."Update required for .NET Framework
This application requires .NET Framework 3.5 SP1 or greater. To download this required update go to http://www.microsoft.com/downloads
bERR: Partial GAC binds disallowed. [Partial Name = %ws : Calling Assembly = %ws : EXE Name = %ws].
<b>Application:</b> %s
<b>User:</b> %s
<b>User:</b> unknown
<b>Machine:</b> %s
<b>Issue being diagnosed:</b>%<b>Detected case of partial bind:</b>
Partial binding information was supplied for an assembly.
A partial bind occurs when only part of the assembly display name is provided.
This might result in the binder loading an incorrect assembly.
It is recommended to provide a fully specified textual identity for the assembly, that consists of the simple name, version, culture, and public key token.
See whitepaper http://go.microsoft.com/fwlink/?LinkId=109270 for more information and common solutions to this issue.
%LOG: This is an inspection only bind.*LOG: This bind starts in %ws load context.,LOG: Assembly is loaded in %ws load context.IERR: An assembly with different processor architecture is already loaded.
#Log: framework config is not found.GLOG: Version redirect found in framework config: %ws redirected to %ws.BWRN: appliesTo has already been set. Ignoring duplicate appliesTo."LOG: Global DEVOVERRIDE path = %ws!LOG: Local DEVOVERRIDE path = %ws+LOG: Found assembly in DEVOVERRIDE path %ws2LOG: Did not find assembly in DEVOVERRIDE path %ws
LOG: DEVPATH = %wsBWRN: assemblyStore has already been set. Ignoring duplicate entry.DWRN: devOverridePath has already been set. Ignoring duplicate entry.
bWRN: Comparing the assembly name resulted in mismatch of Processor Architecture: Ref %ws, Def %ws.
ALOG: Reusing a host assembly instance that was previously loaded..LOG: Assembly binding is resolved by the host.4LOG: Codebase hint found in machine config file: %ws,LOG: ProcessorArchitecture is locked to %ws.6LOG: Fusion is hosted. Check host about this assembly.DLOG: Assembly is not in CLR Loaded list. Asking host assembly store.?LOG: Assembly is in CLR Loaded list. Proceed to normal probing./LOG: Try host assembly store with assembly %ws.8WRN: Host assembly store does not contain this assembly.,WRN: Host did not provide an assembly store.ALOG: Bind to native image assembly did not succeed. Use IL image.$LOG: Bind to native image succeeded.JERR: Error encountered when binding to native image assembly. (hr = 0x%x).'LOG: Start validating native image %ws.
WRN: Native image will not be probed in LoadFrom context. Native image will only be probed in default load context, like with Assembly.Load().$WRN: Failure to bind to IL assembly.
WRN: No ngen index exists.'LOG: Start binding of native image %ws.JWRN: Native image does not satisfy request. Looking for next native image.$WRN: No matching native image found.@WRN: Stop validation because the IL assembly is a host assembly.OWRN: Signature of IL assembly does not match record in index. Validation stops.EWRN: TimeStamp of the assembly in GAC does not match record in index.*WRN: Cannot load IL assembly. (hr = 0x%x).,LOG: AppBase is not in local machine or UNC.'LOG: IL assembly found in load context./LOG: [Level %d]Start validating dependency %ws.LWRN: [Level %d] Assembly dependency not found in CLR-loaded-assemblies list.,WRN: [Level %d] Dependency version mismatch.%LOG: Dependency evaluation succeeded.<WRN: The assembly in load context has a different signature.VWRN: [Level %d]Dependency evaluation returned a native image with different signature.
JWRN: A native image is already loaded, but the config mask does not match.;WRN: The assembly is already loaded without a native image.LWRN: A native image is already loaded, but the custom string does not match.7WRN: The native image file cannot be loaded. hr = 0x%x.1WRN: Unspecified native image evaluation failure.+LOG: Start validating all the dependencies.:LOG: Start loading all the dependencies into load context.*LOG: Validation of native image succeeded.*LOG: Validation of dependencies succeeded.'LOG: Loading of dependencies succeeded.$WRN: System assembly is not avaible.*LOG: IL assembly is not in GAC. Probing...!LOG: IL assembly loaded from %ws.
WRN: Error reading ngen index.<LOG: [Level %d]Start validating native image dependency %ws.2LOG: [Level %d]Start validating IL dependency %ws.FWRN: IL assembly is found in load context, but it has no native image.tWRN: Dependency assembly was not found at ngen time, but is found at binding time. Disallow using this native image.KWRN: Dependency is not in host allowed list, and it is found in host store.PWRN: This is a hard dependency, but it is not in non host store assemblies list.
&LOG: IJW explicit bind. File path:%ws.&LOG: EXE explicit bind. File path:%ws.*ERR: IJW assembly bind failure. hr = 0x%x.MLOG: IJW assembly bind returned a different path: %ws. Use the file provided.
,WRN: Assembly binding logging is turned OFF.xTo enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1.
3ERR: Unsupported linked configuration location: %ws7ERR: Error processing linked configurations (hr = 0x%x),WRN: Ignoring duplicate linked configuration)LOG: Processing linked configuration: %ws
!Assembly Name: %s | Domain ID: %dN<b>Detected cases multiple versions of an assembly in a single App Domain:</b>
Multiple versions of the same assembly were loaded into one context of an application domain.
This might lead to runtime failures.
It is recommended that you remove the dependency on multiple versions, and change the app.config file to point to the required version of the assembly only./Context: %s | Domain ID: %d | Assembly Name: %sT<b>Detected cases of same assembly in different contexts in a single App Domain:</b>
The same assembly was loaded into multiple contexts of an application domain.
This might lead to runtime failures.
It is recommended to inspect your application on whether this is intentional or not.
Z0X03
<<<Obsolete>>
>0!0
0p1+0)
"Copyright (c) 1997 Microsoft Corp.1
Microsoft Corporation1!0
Microsoft Root Authority0
070822223102Z
120825070000Z0y1
Washington1
Redmond1
Microsoft Corporation1#0!
Microsoft Code Signing PCA0
%5Iw
kLRb
Il/$>e
J-|o
+~3n
r0p1+0)
"Copyright (c) 1997 Microsoft Corp.1
Microsoft Corporation1!0
Microsoft Root Authority
X't*u
Bk(q
Washington1
Redmond1
Microsoft Corporation1#0!
Microsoft Code Signing PCA0
081022212455Z
100122213455Z0
Washington1
Redmond1
Microsoft Corporation1
0
MOPR1
Microsoft Corporation0
LwGp
Z>c=
=0;09
3http://crl.microsoft.com/pki/crl/products/CSPCA.crl0H
<0:08
,http://www.microsoft.com/pki/certs/CSPCA.crt0
Hsz%
e-mME)Vr
MC@u
gT!E
0p1+0)
"Copyright (c) 1997 Microsoft Corp.1
Microsoft Corporation1!0
Microsoft Root Authority0
060916010447Z
190915070000Z0y1
Washington1
Redmond1
Microsoft Corporation1#0!
Microsoft Timestamping PCA0
ipfx'f
Y")/
mdmJT
v\/}
%M9wt
9 |v
N+"\hE
r0p1+0)
"Copyright (c) 1997 Microsoft Corp.1
Microsoft Corporation1!0
Microsoft Root Authority
SubC
C/{F
(a|H
wTQ:
Washington1
Redmond1
Microsoft Corporation1#0!
Microsoft Timestamping PCA0
080725190217Z
130725191217Z0
Washington1
Redmond1
Microsoft Corporation1
0
MOPR1'0%
nCipher DSE ESN:7A82-688A-9F921%0#
Microsoft Time-Stamp Service0
&-v?
]),<
a?=6
wTrC
=0;09
3http://crl.microsoft.com/pki/crl/products/tspca.crl0H
<0:08
,http://www.microsoft.com/pki/certs/tspca.crt0
NP;L
O,5;
cB(X:
0@EN
Washington1
Redmond1
Microsoft Corporation1#0!
Microsoft Code Signing PCA
1402
mscorrc.dl
http://microsoft.com0
m\u.
Washington1
Redmond1
Microsoft Corporation1#0!
Microsoft Timestamping PCA
090604101136Z0#
o-*Y
BY0d*
%Z0T
\A{X
=::=::\
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Bill\AppData\Roaming
CommonProgramFiles=C:\Program Files (x86)\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
CommonProgramW6432=C:\Program Files\Common Files
COMPUTERNAME=BILL-PC
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Bill
LOCALAPPDATA=C:\Users\Bill\AppData\Local
LOGONSERVER=\\BILL-PC
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\Python27\;C:\Python27\Scripts;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_ARCHITEW6432=AMD64
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 61 Stepping 4, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=3d04
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files (x86)
ProgramFiles(x86)=C:\Program Files (x86)
ProgramW6432=C:\Program Files
PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
PUBLIC=C:\Users\Public
SESSIONNAME=Console
SSLKEYLOGFILE=C:\Users\Bill\Desktop\SSL\ssl.log
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\Bill\AppData\Local\Temp
TMP=C:\Users\Bill\AppData\Local\Temp
USERDOMAIN=Bill-PC
USERNAME=Bill
USERPROFILE=C:\Users\Bill
windir=C:\Windows
windows_tracing_flags=3
windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log
C:\Users\Bill\Desktop\
C:\Users\Bill\Desktop;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Python27\;C:\Python27\Scripts;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\
C:\Users\Bill\Desktop\30% tt Slip.exe
"C:\Users\Bill\Desktop\30% tt Slip.exe"
C:\Users\Bill\Desktop\30% tt Slip.exe
Winsta0\Default
=::=::\
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Bill\AppData\Roaming
CommonProgramFiles=C:\Program Files (x86)\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
CommonProgramW6432=C:\Program Files\Common Files
COMPUTERNAME=BILL-PC
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Bill
LOCALAPPDATA=C:\Users\Bill\AppData\Local
LOGONSERVER=\\BILL-PC
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\Python27\;C:\Python27\Scripts;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_ARCHITEW6432=AMD64
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 61 Stepping 4, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=3d04
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files (x86)
ProgramFiles(x86)=C:\Program Files (x86)
ProgramW6432=C:\Program Files
PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
PUBLIC=C:\Users\Public
SESSIONNAME=Console
SSLKEYLOGFILE=C:\Users\Bill\Desktop\SSL\ssl.log
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\Bill\AppData\Local\Temp
TMP=C:\Users\Bill\AppData\Local\Temp
USERDOMAIN=Bill-PC
USERNAME=Bill
USERPROFILE=C:\Users\Bill
windir=C:\Windows
windows_tracing_flags=3
windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log
C:\Windows\SYSTEM32\
C:\Windows\syswow64
C:\Windows\SysWOW64\ntdll.dll
C:\Users\Bill\Desktop\
C:\Windows\syswow64\kernel32.dll
}H F
C:\Windows\syswow64\KERNELBASE.dll
}H F
"C:\Users\Bill\Desktop\30% tt Slip.exe"
C:\Windows\system32;C:\Windows\system;C:\Windows;
nw(1
! #!%"'#)$+%-&/'1(3)5*7+9,;-=.?/A0E1I2M3Q4U5Y6]7a8e9i:m;q<u=y>}?
4Uu
84Uu
P4Uu@
h4Uuh
4Uu0
4UuX
(5Uu
mscorees.dll
A.Gu
Winsta0\Default
C:\Users\Bill\Desktop\30% tt Slip.exe
\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
sktop\30% tt Slip.exe
d.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Bill
LOCALAPPDATA=C:\Users\Bill\AppData\Local
LOGONSERVER=\\BILL-PC
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\Python27\;C:\Python27\Scripts;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbe
C:\Windows\syswow64\msvcrt.dll
C:\Windows\system32\mscoree.dll
p\30 c
leC:\Users\Bill\Desktop;.;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Python27\;C:\Python27\Scripts;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\
C:\Windows\syswow64\ADVAPI32.dll
C:\Windows\SysWOW64\sechost.dll
QuT.Qu
C:\Windows\syswow64\RPCRT4.dll
C:\Windows\syswow64\SspiCli.dll
C:\Windows\syswow64\CRYPTBASE.dll
c=C:
TSSSP
gramData
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Bill\App
a#Ex
Ne/@
vT{hK
,J(o
|."6
'w*o
9Z53x
cyIt
uXKc
pOHkp
o+"e
}^0]
PAqv
o/
Sj
=8!{
~7>Fm
Hp(dD
}BM`
X` _
M'TO
{iLQ
~|pX
60 G
jIvE
)
%G
q:@"a
r=Nd
6!e}.
Q!X*L
8U`C"Zs
3ugeA{SE
W <r_|
@A*w
\A*w
xA*w
8;Pux
P;Pu
h;Pu
;Pu@
;Puh
(<Pu
@<Pu0
X<PuX
p<Pu
v2.0.50727
C:\Windows\syswow64\SHLWAPI.dll
C:\Windows\syswow64\GDI32.dll
C:\Windows\syswow64\USER32.dll
C:\Windows\syswow64\LPK.dll
C:\Windows\syswow64\USP10.dll
LIST
C:\Windows\syswow64\MSCTF.dll
C:\Windows\system32\IMM32.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
Gu+#Gu
qsHI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
'uHM+u
Tcpip
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
@x:d
?:&p
n30'
C:\Users\Bill\Desktop\30% tt Slip.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\
seC:\Windows\Microsoft.NET\Framework\v2.0.50727;;C:\Windows\system32;C:\WindowC:\Users\Bill\Desktop\30% tt Slip.exe
Pyth
en-US
scoree
eOaE
&eb1
en-US
ar-SA
pt-BR
zh-TW
zh-CN
zh-HK
cs-CZ
da-DK
el-GR
es-ES
fi-FI
fr-FR
de-DE
he-IL
hu-HU
it-IT
ja-JP
ko-KR
nl-NL
nb-NO
pl-PL
pt-PT
ru-RU
sv-SE
tr-TR
bg-BG
hr-HR
et-EE
lv-LV
lt-LT
ro-RO
sr-Latn-CS
sk-SK
sl-SI
th-TH
uk-UA
fy-NL
qps-ploc
qps-plocm
52C64B7E
AcMg
\Win
C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\
p_]Q
C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\MSVCR80.dll
5c[;
me^;
SH;
.0, CulO;
93B;
me="nety;
ti|;
.Ss;
nev;
"/m;
ig`;
deg;
a"8;
er2;
pP);
ue,;
d #;
de&;
rote
tral
yptU
" ke
<add name="Odbc D c
ction na
ion=
0.0.
Cul
re=n
tral
Publ
KeyT
en=b
f5f7
1d50
-uX^{p
p r0u
-u@ }p
lpp7
add
me="
taPr
ecti
Conf
urat
nPro
der"
ype=
bc Data Pr
data>
>
4/>
6
8</p
:ers
<
>mem
@ip>
B
Dpro
F
H
, Pu
."X4
CTX+/c
7l=e8
C8NNe8
9`E$8:
e8Fy
F;e8N~e8
Hpt^
`dnp4
XhsTchs
AppData
Profile
c
q0y
q
qty
q
@0
q
N
q`
;
ql
C:\Users\Bill\Desktop\30% tt Slip.exe
C:\Windows\syswow64\shell32.dll
C:\Windows\syswow64\ole32.dll
C:\Windows\system32\profapi.dll
C:\Users\Bill\AppData\Roaming
C:\Windows\system32\uxtheme.dll
2\MS
file:///C:/Users/Bill/Desktop/
APP_CONFIG_FILE
MACHINE_CONFIG
file:///C:/Users/Bill/Desktop/
C:\Windows\system32\CRYPTSP.dll
:\Users\Bill\AppData\Roaming
C:\Windows\system32\rsaenh.dll
C:\Windows\system32\DNSAPI.dll
C:\Windows\system32\NLAapi.dll
C:\Windows\system32\mswsock.dll
C:\Windows\syswow64\ws2_32.dll
C:\Windows\system32\napinsp.dll
C:\Windows\system32\pnrpnsp.dll
:\Users\Bill\AppData\Roaming
C:\Windows\System32\wship6.dll
C:\Windows\System32\winrnr.dll
C:\Windows\system32\rtutils.dll
C:\Windows\system32\winhttp.dll
qILB
C:\Windows\system32\bcrypt.dll
qILB
qILB
C:\Windows\system32\WINNSI.DLL
C:\Windows\system32\dwmapi.dll
C:\Windows\system32\rasman.dll
sers\Bill\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.2528.1818750
icro
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.2528.1818750
pDat
C:\Users\Bill\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Bill\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
n30'
"vHG
"vpG
AppData\Roaming
rs\Bill
C:\Users\Bill
rs\Bill
APPBASE
.DLL
normnfkd.nlp
normnfkc.nlp
normidna.nlp
bopomofo.nlp
sorttbls.nlp
sorttbls.nlp
bopomofo.nlp
normidna.nlp
normnfkc.nlp
normnfkd.nlp
sorttbls.nlp
bopomofo.nlp
normidna.nlp
normnfkc.nlp
normnfkd.nlp
2.dll
i.?c
ofapi.dl
ENTY
v2.0.50727
ksc.nlp
mscorlib
mscorlib
sortkey.nlp
sortkey.nlp
normnfd.nlp
normnfc.nlp
xjis.nlp
prcp.nlp
big5.nlp
sortkey.nlp
big5.nlp
prcp.nlp
xjis.nlp
normnfc.nlp
normnfd.nlp
n0.P6
big5.nlp
L
{a
ks&#
prcp.nlp
._@8
xjis.nlp
normnfc.nlp
normnfd.nlp
ksc.nlp
prc.nlp
prc.nlp
ENTY
ENTY0
ENTY
ENTY
ENTY`
C:\Users\Bill\Desktop\30% tt Slip.exe
en-US
jww7aw
qs@'
3367513-1000
qCNGE
LIST
LIST
C:\Users\Bill\Desktop\30% tt Slip.exe
C:\Users\Bill\Desktop\30% tt Slip.exe
qCNGE
LIST
LIST
qCNGE
LIST
LIST
qCNGE
LIST
LIST
qCNGE
LIST
LIST
CKM
qCNGE
LIST
LIST
@%SystemRoot%\system32\nlasvc.dll,-1000
qCNGE
LIST
LIST
t:$Bf
qCNGE
LIST
LIST
mvvI
mvvI
C:\Windows\system32\wbem\wmiutils.dll
C:\Windows\system32\wbem\wmiutils.dll
C:\Windows\system32\wbem\wmiutils.dll
qCNGE
LIST
LIST
C:\Windows\system32\wbem\wbemprox.dll
C:\Windows\system32\wbem\wbemprox.dll
C:\Windows\system32\wbem\wbemprox.dll
Security=Impersonation Dynamic False
Windows Management and Instrumentation
C:\Windows\system32\wbem\wbemsvc.dll
qMODI
qMODI
qMODI
qMODI
qMODI
qMODI
qMODI
qMODI
qMODI
qMODI
qMODI
qMODI
qMODI
qMODI
qMODI
qMODI
qMODI
qMODI
qMODI
qMODI
qMODI
qMODI
qMODI
qMODI
qMODI
qMODI
q04
Rkq x
APP_NAME
Microsoft Strong Cryptographic Provider
System.Deployment
System.Management
mscorsn.dll
C:\Users\Bill\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2528.1818765
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
qNAME
PROP
qACTX
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
qINDX
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST8
LISTX
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST8
LIST
LIST
LIST
LIST
LIST8
LIST
LIST
LIST
LIST@/
LIST
LIST
LIST
LISTx#
LIST
LIST
LIST`
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
qCIEN
LIST0$
qNAME
PROP
qMANI
qNAME
PROP
qCASM
qMANI
file:///C:/Windows/Microsoft.NET/Framework/v2.0.50727/
ksc.nlp
prc.nlp
prc.nlp
ksc.nlp
prc.nlp
ksc.nlp
Phulli
Cache
.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
:.q@H.qv_.q
#/qr
#0qz$0q
O1qXQ1q\Q1qDQ1qxQ1qpQ1q`Q1qvQ1qnQ1qpQ1q
R1q
R1q
_1ql
qNASM
LIST
LIST
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
sortkey.nlp
sortkey.nlp
sorttbls.nlp
sorttbls.nlp
big5.nlp
big5.nlp
bopomofo.nlp
bopomofo.nlp
prcp.nlp
prcp.nlp
xjis.nlp
xjis.nlp
normidna.nlp
normidna.nlp
normnfc.nlp
normnfc.nlp
normnfd.nlp
normnfd.nlp
normnfkc.nlp
normnfkc.nlp
normnfkd.nlp
normnfkd.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
CommonLanguageRuntimeLibrary
commonlanguageruntimelibrary
ZAP_STRING
30% tt Slip.exe.config
30% tt Slip.exe.config
qMANI
qCASM
System.Configuration
Microsoft.VisualBasic.DLL
Microsoft.VisualBasic
System.Windows.Forms
System.Runtime.Remoting
Microsoft.VisualBasic
System.Configuration
Microsoft.VisualBasic
microsoft.visualbasic.dll
qMANI
qCASM
qMANI
qCASM
qMANI
qCASM
qMANI
System.Configuration
qMANI
qCASM
qMANI
qCASM
qMANI
qCASM
APPDOMAIN_ID
m32\WindowsPowe
RxR~RxRzR
q
9R
APPBASE
30% tt Slip.exe
Phulli.exe
phulli.exe
fu9?_
fu9?_
+BT_s
Uo8U<
zS:_
#cbu
8tr_
}ci"?
e0"b
Fo|$
TFRA
ZAP_CONFIG_FLAGS
m;C:\Windows\System
wsPowerShell\v1.0\
qNAME
PROP
Microsoft\Windows\Temporary Internet Files
C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
qACTX
LIST
LIST
LIST
LIST
LIST
LIST
LISTp&
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LISTh
LIST
LIST
LISTX&
LIST
LIST
LIST
LIST
LIST
ENTY
ENTY
ENTY
ENTY
Microsoft.VisualBasic
.,v
System
System.Windows.Forms
VJ?5
}s{&
kH,A
$A<ms
System.Web
uugAy.
i9S&
ew\x
System.Xml
System.Runtime.Remoting
System.Xml
System.Web
.Xml
System.Configuration
System.Xml
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\machine.config
C:/Users/Bill/AppData/Local/Microsoft/Windows/Temporary Internet Files
Temporar
C:\Users\Bill\AppData\Local\Microsoft\Windows\Temporary Internet Files
p.exe
Windows\Tempor
l\AppDat
System.Security.Permissions.FileIOPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
Unrestricted
file:///C:/Users/Bill/Desktop/30% tt Slip.exe
__FUSION_APPCFG_DOWNLOAD_ATTEMPTED__
\Microso
36974b8c\Microsoft.V
__FUSION_POLICY_CACHE__
Q^U[A
em.DirectoryServices
qNAME
PROP
h8Fl
C:\Users\Bill\Desktop;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Python27\;C:\Python27\Scripts;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\
jww7aw
RSA1
Q^U[A
cbWRVD
.{dx
x[3(
,3$U
30% tt Slip.exe
qCNDE
System.Drawing
qCNDE
qCNDE
qCNDE
qCNDE
qCNDE
qCNDE
qCNDE
qCNDE
qCNDE
qCNDE
System.Drawing
N@C)+
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LISTh1
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LISTpa
LIST
LIST
LIST
LIST
System.DirectoryServices
LIST(
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\machine.config
qCIEN
LIST`
qCIEN
LISTP
LIST
LIST
LIST`
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST`a
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST`b
LIST
LIST
LIST
LIST
LIST
LIST
LIST _
LIST
LIST
LISTh_
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
qFACT
LIST
LIST
LIST
LIST
qLIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
qNAME
PROP
Syst,c
lp!c
7f11d50a3a
qNAME
PROP
n.Rs
System
<DbProvider
qNAME
PROP
OleD
qNAME
PROP
iant(c
qNASM
LIST
LIST
qNAME
PROP
lCli
qNAME
PROP
System
t="tru
er="tr
en=b03
:[k
:Qk
<add n2c
qLIST
LIST
LISTH
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST8
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LISTp
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LISTp
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LISTh
LIST
LIST
LIST
LIST
LIST
LIST0
LIST
LIST
LIST
LIST`
LIST
LIST
LISTH
LIST
LIST(
LIST
LIST
LIST
LIST
LIST
LIST
LIST
LISTP
LIST`
LISTX
LIST
LIST
LIST
LIST
LIST0
LIST
LISTx
LIST
LIST
LIST
LIST@
LIST
LIST
LIST
LIST
LIST
LIST@
LIST
LISTh
LIST
urat
5c561934
qCIEN
LIST
qCIEN
LIST
qCIEN
LIST
qCIEN
LIST
qCIEN
LIST
qCIEN
KB{2
LISTh
qCIEN
LIST
qCIEN
LIST
qCIEN
LIST
qCIEN
LIST
to Q
qCIEN
LIST
h coK
fer E
rman?
thei)
qCIEN
mij:n
LIST`
Exte
ecti
C:\Windows\System32\fwpuclnt.dll
atio
C:\Windows\System32\wshtcpip.dll
rsionK
qCIEN
LIST8
ntim
.0.0
ion,
5f7f
allow
CIdentityAttributeEnumerator
ies" t
C:\Windows\system32\shfolder.dll
C:\Windows\system32\dhcpcsvc.DLL
C:\Windows\system32\iphlpapi.dll
C:\Windows\system32\dhcpcsvc6.DLL
C:\Windows\system32\rasadhlp.dll
="System.Data.Common.DbProviderConfigurationHandler, System.Data, Versio
qNAME
PROP
data
qNAME
PROP
on=2
qNAME
PROP
ing"$g
qNAME
PROP
tralU
qNAME
PROP
on"
qNAME
PROP
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\System.Configuration.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\System.Configuration.ni.dll
qNAME
PROP
qNAME
PROP
qNAME
PROP
qNAME
PROP
qNAME
PROP
qNAME
PROP
qNAME
PROP
qNAME
PROP
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\5cae93d923c8378370758489e5535820\System.Runtime.Remoting.ni.dll
qNAME
PROP
qNAME
PROP
qNAME
PROP
<add name="AspNetSqlM
System
corli
System
ression=
BaseIdentity
IdentityType
System.Management
System.Deployment
9BuD
}pW
D$u
System.Drawing.dll
system.drawing.dll
@1 u
jsi.ks
Gks
System.Data.SqlXml
bog"eo
System.Data.SqlXml
cKey
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
HMEN
C:\Windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll
n30'
j [>
{`MpQ
=#D}U0
HMEN
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni.dll
B1u.S1u
*2ud
2u
/3u
/3uN/3u003u*03u
?3u2@3u
D3u*D3u
q0D3u
qTn4u
qNASM
LISTX`
LIST
qMANI
System.Runtime.Remoting
qMANI
qCASM
qCASM
qMANI
qCASM
qMANI
System.Windows.Forms
qMANI
qCASM
MTUR
system.windows.forms.dll
System.Windows.Forms
System.Windows.Forms.dll
qMANI
qMANI
qCASM
qMANI
qCASM
qMANI
qCASM
qMANI
system.runtime.remoting.dll
System.Runtime.Remoting.dll
System.Configuration.dll
system.configuration.dll
System.Runtime.Remoting
qMANI
qCASM
qMANI
gurati
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
System.dll
system.dll
System.Security
qCNDE
qCNDE
Accessibility
qCNDE
qCNDE
qCNDE
qCNDE
qCNDE
qCNDE
System.Drawing
qCNDE
qCNDE
qCNDE
Accessibility
System.Security
lp@-
\P.u
n]3u
lP.u
tP.u
dO.u
$O.u
0O.u
DO.u
XO.u
lO.u
0P.u
o<~{s
u{s<~{s
AcMg
dows
.Config
\??\C:\Windows\Microsoft.NET\Framework\v2.0.50
xs&c
<P.u
HP.u
Q.u
,Q.u
8Q.u
DQ.u
XQ.u
dQ.u
xQ.u
?AZH
6Vn]3u
]3u0
]3uX
rsion=2.0.0.
(x8
qhr,u
urity,2.
f5f7f11d50a3a
qNASM
LIST
LIST
qNASM
LISTX
LIST
qNASM
LISTp;
LIST
@%SystemRoot%\system32\napinsp.dll,-1000
@%SystemRoot%\system32\pnrpnsp.dll,-1000
@%SystemRoot%\system32\pnrpnsp.dll,-1001
@%SystemRoot%\system32\wshtcpip.dll,-60103
qNASM
LIST
LIST
qNASM
LIST
LIST
Pfl6=
j [>
j [>
{`MpQ
{`MpQu
-0.dll
-0.dll
ASYC
@%SystemRoot%\system32\shell32.dll,-21781
u CKMe
mbly\GAC_MSIL\S
System.Runtime.Serialization.Formatters.Soap
System.Drawing
SX 2
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\system32\webio.dll
2OR`
Microsoft Package Negotiator
NegoExtender Security Package
C:\Windows\SysWOW64\msv1_0.DLL
C:\Windows\SysWOW64\TsPkg.DLL
C:\Windows\SysWOW64\pku2u.DLL
C:\Windows\system32\credssp.dll
C:\Windows\system32\credssp.dll
$/A*
OLEE85C3591E9454D7794DD0B923101
uwuT
:\Users\Bill\AppData\Roaming
System.Configuration.Install
OLE5B2B7286DB564759A658E75B31EB
LE5B2B7286DB564759A658E75B31EB
OLE5B2B7286DB564759A658E75B31EB
LE5B2B7286DB564759A658E75B31EB
C:\Windows\syswow64\CLBCatQ.DLL
C:\Windows\system32\NTDSAPI.dll
on.I
,:2o
System.Configuration.Install
OLE5B2B7286DB564759A658E75B31EB
:\Users\Bill\AppData\Roaming
:\Users\Bill\AppData\Roaming
OLE5B2B7286DB564759A658E75B31EB
OLE5B2B7286DB564759A658E75B31EB
OLE5B2B7286DB564759A658E75B31EB
OLE5B2B7286DB564759A658E75B31EB
OLE5B2B7286DB564759A658E75B31EB
:\Users\Bill\AppData\Roaming
System.Runtime.Serialization.Formatters.Soap
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
o4D'
_v2.0.50727_32\Syste
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
\System.
8a\System.Drawing.ni
qCNDE
qCNDE
qCNDE
qCNDE
qCNDE
qCNDE
qCNDE
xs@0
System.Security.Permissions.RegistryPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
Unrestricted
System.Configuration.ConfigurationPermissionAttribute, System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
Unrestricted
C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll
|Gee
P=m>
d9@_K
boD
ntim
Remo
ng.n
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\5cae93d923c8378370758489e5535820\System.Runtime.Remoting.ni.dll
BILL-PC
NTDS
Phulli.resources,1.0.0.0,en-US,461d39c4a423da0b
BILL-PC
SARPC_ENDPOINT
Pj h
_^[]
{Fpi
System.DirectoryServices
C:\Windows\syswow64\NSI.dll
tboXtbo
eventlogmessages.dll
Microsoft Enhanced RSA and AES Cryptographic Provider
evice\{902A6B7D-F035-41A6-A06E-631E2332252E}
calrpc:[lsapolicylookup]
evice\{902A6B7D-F035-41A6-A06E-631E2332252E}
aspnet_compiler.exe
installutillib.dll
aspnet.mof.uninstall
NT Authority\NetworkService
microsoft_vsavb.dll
nlst
lstcLU
stem.Management
0oa%
Schannel Security Package
Schannel Security Package
TS Service Security Package
NT Authority\NetworkService
NT Authority\NetworkService
NT Authority\NetworkService
microsoft.jscript.tlb
Microsoft WBEM Call Context
NT Authority\NetworkService
NT Authority\NetworkService
NT Authority\NetworkService
sbscmp20_mscorlib.dll
aspnet_state_perf.ini
microsoft.visualc.dll
microsoft.jscript.dll
microsoft.build.xsd
evice\{902A6B7D-F035-41A6-A06E-631E2332252E}
Microsoft\Windows\Cookies
system.drawing.dll
system.drawing.tlb
jcalrpc:[lsapolicylookup]
system.messaging.dll
evice\{902A6B7D-F035-41A6-A06E-631E2332252E}
uninstallcommon.sql
uninstallsqlstate.sql
hs@5
Zo@6
qLIST
LIST
LIST
LIST
Bill-PC
192.168.1.101
lSet\Ser
Bill-PC
192.168.1.101
lSet\Ser
albasic.
icrosoft WBEM WbemClassObject Marshalling proxy
Microsoft WBEM WbemClassObject Marshalling proxy
Bill
Negotiate
NegoExtender
Kerberos
NTLM
Schannel
TSSSP
pku2u
E=BILL-PC
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Bill
LOCALAPPDATA=C:\Users\Bill\AppData\Local
LOGONSERVER=\\BILL-PC
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\Py
System.Security.Permissions.RegistryPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089H
Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion
WRN: Assembly binding logging is turned OFF.
@%SystemRoot%\System32\wshtcpip.dll,-60101
%SystemRoot%\system32\mswsock.dll
%SystemRoot%\system32\mswsock.dll
:$Bf
%SystemRoot%\system32\NLAapi.dll
@%SystemRoot%\System32\wshqos.dll,-103
System.Security.Permissions.EnvironmentPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
Unrestricted
\Use
\Bil
Desk
p\30
tt S
p.ex
conf
ig\m
hine
onfi
@%SystemRoot%\System32\wshtcpip.dll,-60100
%SystemRoot%\system32\mswsock.dll
@%SystemRoot%\System32\wshtcpip.dll,-60102
%SystemRoot%\system32\mswsock.dll
@%SystemRoot%\System32\wship6.dll,-60100
%SystemRoot%\system32\mswsock.dll
@%SystemRoot%\System32\wship6.dll,-60101
%SystemRoot%\system32\mswsock.dll
@%SystemRoot%\System32\wship6.dll,-60102
%SystemRoot%\system32\mswsock.dll
@%SystemRoot%\System32\wshqos.dll,-100
%SystemRoot%\system32\mswsock.dll
@%SystemRoot%\System32\wshqos.dll,-101
%SystemRoot%\system32\mswsock.dll
@%SystemRoot%\System32\wshqos.dll,-102
%SystemRoot%\system32\mswsock.dll
@%SystemRoot%\System32\wshqos.dll,-103
%SystemRoot%\system32\mswsock.dll
%SystemRoot%\system32\napinsp.dll
@%SystemRoot%\System32\wshqos.dll,-103
mvvI
,{M%
SystemRoot%\system32\pnrpnsp.dll
mvvI
,{M%
SystemRoot%\system32\pnrpnsp.dll
%SystemRoot%\System32\mswsock.dll
%SystemRoot%\System32\winrnr.dll
qCNDE
qCNDE
qCNDE
qCNDE
Tcpip6
onSetAtt
te, msco
, Versio
0.0.0, C
re=neutr
PublicKe
en=b77a5
=9ncalrpc:[epmapper,Security=Impersonation Dynamic False]
C:\Windows\Microsoft.NET\Framework\v2.0.50727\wminet_utils.dll
<k.u
Dk.u
Pk.u
dk.uxk.uxk.u
lGhs
lGhspN
FhsvN
npp%N
npaN
Fhs0&N
FhsnN
;k?C
Fhs\&N
ERNEL32.DLL
qCNDE
qCNDE
qCNDE
qCNDE
Zo(z
System.Xml.dll
system.xml.dll
Kerberos
SystemFunction035
hcpcsvc
Microsoft Kerberos V1.0
lsasspirpc
GDI+ Hook Window
"hcpcsvc6
Negotiate
Schannel
NTLM Security Package
lsasspirpc
PKU2U Security Package
qMANI
qMANI
qCASM
qMANI
I_]F
Microsoft Unified Security Protocol Provider
ocessI
GDI+Atom_2528_1
MTUR
MTUR
PKU2U Security Package
NTLM Security Package
Microsoft Kerberos V1.0
NegoExtender
LMEM
qMANI
SecurityCenter2
qCASM
qMANI
qCASM
qMANI
WbemDefaultPathParser
kls"vls
ls6!ms0!ms
smsT
(Nls
Nls|
8Yls|
P
js
System.Security.Permissions.ReflectionPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
System.Security.Permissions.ReflectionPermissionFlag, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
Flags
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
UnmanagedCode
System.Security.Permissions.FileIOPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
System.Security.Permissions.FileIOPermissionAccess, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
AllFiles
Securi
troc
@t1K
4`@K
stem
At]K
NTLM
WDigest
TSSSP
pku2u
System.Xml
Ghsd'N
`Ghs
`Ghs
Mhs8'N
\Mhs
\Mhs
xGhs
xGhs
0#lp
0#lp
`#lp
`#lp
T#lp
T#lp
BILL-PC
<#lp
<#lp
npD(N
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\461d3b6b3f43e6fbe6c897d5936e17e4\System.Xml.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\461d3b6b3f43e6fbe6c897d5936e17e4\System.Xml.ni.dll
PBjo^Bjo
PjoH
joNrko>rkonUnohUno
polOpoVepoTepoLfpo
2qo(6qo(6qo
7qo48qo88qo 8qoT8qoL8qo<8qo
;qoJ;qo
q${uo
jo|
AjoD
zbo:{bo2{bo8{bo2{bo4{bo<{bo8{bo<{bo<{bo
qD{bo
zbox
;2o(A2o
n2or
3o.
23o:;3oP;3oR;3oV;3ob=3o
>3oPD3o
L3oxM3o
N3ojN3obN3ohN3obN3odN3oxN3o
2oZ
0
2o
lld.0n
lld.
lld.`%
ulld.
q`
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
System.Security.Permissions.SecurityPermissionFlag, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
Flags
System.Security.Permissions.FileIOPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
System.Security.Permissions.FileIOPermissionAccess, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
AllFiles
` `(`
q.0.0, Cu
561934e089
m.Security.Permissions.FileIOPermissionAccess, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
AllFiles
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
8s q
0t q
Pv q8
u q8
System.Security.Permissions.PermissionSetAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
Unrestricted
System.Security.Permissions.ReflectionPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
System.Security.Permissions.ReflectionPermissionFlag, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
Flags
MSCTFIME UI
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
Unrestricted
To enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1.
PRhX<
qUSVW
_^[]
@tzres.dll,-262
GMT Standard Time
@tzres.dll,-261
GMT Daylight Time
cffd014f97d85058154e8f4d31c4
H#lp
GDI+ Hook Window
nblk
T AUTHORITY\SYSTEM
GSSAPI
Digest Authentication for Windows
Kerberos
LMEM
Negotiate
LMEM
Bill-PC\Bill
Schannel
LMEM
<o@B
02>o
Microsoft Strong Cryptographic Provider
System.Management
Microsoft.JScript
System.Management.dll
Microsoft.JScript
system.management.dll
NT AUTHORITY\SYSTEM
NT AUTHORITY\SYSTEM
Atom
YPV_^[]
AcMg
dows
a5c561934e089\System.Windows.Forms.dll.101.Config
p4ZN
Flst
rs\Bill\Desktop\30% tt Slip.exe
HIntel(R) PRO/1000 MT Desktop Adapter
#2%.
VWAN Miniport (IP)-QoS Packet Scheduler-0000
RASMAN
1\Q4
RPCSS
COM Infr
(WAN Miniport
XPRV
_^[]
_^[]
p
p
:Software Loopback Interface 1
nonic
&WAN Miniport (SSTP)
(WAN Miniport (IKEv2)
&WAN Miniport (L2TP)
&WAN Miniport (PPTP)
icrosoft ISATA
ntsvcs
ncalrpc
cryptsp.dll
Negotiate
ncalrpc
NegoExtender
Kerberos
NTLM
Schannel
WDigest
pku2u
CREDSSP
wcal
ncalrpc
ncalrpc
calrpc
aeee
qqqqqqqqqqqqqqqq
MEOW
cture
__RequiredArchitecture
=xLMEM
Bill-PC
192.168.1.101
B+ncalrpc:[OLE5B2B7286DB564759A658E75B31EB]
NT AUTHORITY\SYSTEM
<WAN Miniport (Network Monitor)
|Intel(R) PRO/1000 MT Desktop Adapter-QoS Packet Scheduler-0000
Intel(R) PRO/1000 MT Desktop Adapter-WFP LightWeight Filter-0000
"WAN Miniport (IP)
ZWAN Miniport (IPv6)-QoS Packet Scheduler-0000
HIntel(R) PRO/1000 MT Desktop Adapter
MEOW
Bill-PC
192.168.1.101
=xLMEM
Bill-PC
192.168.1.101
B+ncalrpc:[OLE5B2B7286DB564759A658E75B31EB]
NT AUTHORITY\SYSTEM
(WAN Miniport (PPPOE)
"RAS Async Adapter
:Software Loopback Interface 1
nonic
&WAN Miniport (SSTP)
(WAN Miniport (IKEv2)
&WAN Miniport (L2TP)
&WAN Miniport (PPTP)
{902
2252E}
cessor
Class
onne
Microsoft Unified Security Protocol Provider
nonic
Teredo Tunneling Pseudo-Interface
Teredo Tunneling Pseudo-Interface
{211D11D6-0DE3-433E-B35B-0C9BD5497545}
3-4B556
3-4B556
4B2
3-4B556
4B2
3-4B556
3-4B556
e 4B2
3-4B556
4B2
3-4B556
3-4B556
3-4B556
4B2
3-4B556
4B2
3-4B556
4B2
3-4B556
rces/Phulli.
-+ncalrpc:[OLEE85C3591E9454D7794DD0B923101]
3367513-1000_Classes
stRr
nonic
isatap.localdomain
Microsoft ISATAP Adapter #2
{A8EC83FF-F63B-4A2C-B32C-A073CC6AE773}
MEOW
Bill-PC
192.168.1.101
LMEM
b\2.0.0.0__b77a5c561934e089\bcrypt.dll
\7Xo
t7Xo
D7Xo
System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\
C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
& !
0000000000000000000000000000000000Pp`
` 00@`000P``````````00````
0Pp`
ppp0P0``0`````0`` `
````0P0``
PPP@ @p
0`P`PP@
00@@`P`P
Pp00```` `0
@``0
`@`000``000@`
`pppppp
ppppp0000
pp```````
````` @@@`````````````P`P
Flst
_^[]
``
000000Pp
000P``````````00
0Pp`
P0``0`````0`` `
PPP@ @p
00@@`P`P
`` `0
@``0
`@`00
`pppppp
ppppp
pp`````
@@@````````````
Arab
( al
Microsoft
ul]Q[
A4oY
=mDc
Note: There is some performance penalty associated with assembly bind failure logging.
To turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog].
Phulli.resources,1.0.0.0,en,461d39c4a423da0b
Z'Jo
culture.dll
HMEN
C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\
Hl5~
vS#h
v9m
}
B+ncalrpc:[OLE5B2B7286DB564759A658E75B31EB]
NT AUTHORITY\SYSTEM
Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject
C:\Users\Bill\AppData\Roaming
1A6-A06E-631E2332252E}
Intel(R) PRO/1000 MT Desktop Adapter
|Intel(R) PRO/1000 MT Desktop Adapter-QoS Packet Scheduler-0000
Intel(R) PRO/1000 MT Desktop Adapter-WFP LightWeight Filter-0000
"WAN Miniport (IP)
ZWAN Miniport (IPv6)-QoS Packet Scheduler-0000
HIntel(R) PRO/1000 MT Desk
BILL-PC
TCPIP_{902A6B7D-F035-41A6-A06E-631E2332252E}
Intel(R) PRO/1000 MT Desktop Adapter
nonic
Loopback Pseudo-Interface 1
Software Loopback Interface 1
{846EE342-7039-11DE-9D20-806E6F6E6963}
nonic
Teredo Tunneling Pseudo-Interface
Teredo Tunneling Pseudo-Interface
{211D11D6-0DE3-433E-B35B-0C9BD5497545}
nonic
localdomain
isatap.localdomain
Microsoft ISATAP Adapter #2
{A8EC83FF-F63B-4A2C-B32C-A073CC6AE773}
\{]>
-US,en
MEOW
__ProviderArchite
MEOW
WinSta0\Default
=::=::\
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Bill\AppData\Roaming
CommonProgramFiles=C:\Program Files (x86)\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
CommonProgramW6432=C:\Program Files\Common Files
COMPUTERNAME=BILL-PC
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Bill
LOCALAPPDATA=C:\Users\Bill\AppData\Local
LOGONSERVER=\\BILL-PC
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\Python27\;C:\Python27\Scripts;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_ARCHITEW6432=AMD64
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 61 Stepping 4, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=3d04
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files (x86)
ProgramFiles(x86)=C:\Program Files (x86)
ProgramW6432=C:\Program Files
PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
PUBLIC=C:\Users\Public
SESSIONNAME=Console
SSLKEYLOGFILE=C:\Users\Bill\Desktop\SSL\ssl.log
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\Bill\AppData\Local\Temp
TMP=C:\Users\Bill\AppData\Local\Temp
USERDOMAIN=Bill-PC
USERNAME=Bill
USERPROFILE=C:\Users\Bill
windir=C:\Windows
windows_tracing_flags=3
windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log
hcpcsvc
ameServer
C:\Windows
plugplay
epmapper
epmapper
epmapper
epmapper
epmapper
epmapper
BILL-PC
epmapper
epmapper
ameServer
System.Management
Za{l
b2GDZ
epmapper
hcpcsvc
hcpcsvc
MEOW
nonic
Loopback Pseudo-Interface 1
Software Loopback
stRr
Teredo
g PsW
erfa
o Tunneling Pseu
face
{211D11D6-0DE3-433E-B3
nonic
localdomain
isatap.localdomain
Microsoft ISATAP Adapter #2
{A8EC83FF-F63B-4A2C-B32C-A073CC6AE773}
nonic0
Local Area Connection* 6
8g.u
Pg.u
\g.u
0h.u
Hh.u
LMEM
R:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
*+ncalrpc:[OLE5B2B7286DB564759A658E75B31EB]
NT AUTHORITY\SYSTEM
LMEM
nonicd
Local Area Connection* 8-QoS
zt Scheduler-0000
RAS
RAS
nonicd
Local Area Connection
oS Packet Scheduler-0000
RAS
nonic0
Local Area Co
ion* 5
nonic2
Local
Connection* 10
ASYN
ASYN
opback Pseudo-Interface 1
nonic,
Local Area Connection*
nonic0
Local Area Connection* 2
nonic0
Local Area Connection* 3
nonic0
Local Area Connection* 4
nonic
Reusable ISATAP Interface {B2232BF0-4
B29-9093-4B5569F4D673}
nonicB
Teredo Tunneling Pseudo-Inter
nonic$
isatap.localdomainter
{A8EC83FF-F63B-4A2C-B32C-A073CC6AE773}
>B5.
~>*`
>B5.
>B5.
\{]>
>B5.
>B5.
>B5.
ort (PPT
>B5.
o Tunneling Pseudo-Interface
6Microsoft ISATAP Adapter
#2%.
{902
D-F0
1A6-'c
Bill-PC
192.168.1.101
LMEMh
*oH+,o
}v]n
Microsoft WBEM (non)Standard Marshaling for IWbemServices
Bill-PC
192.168.1.101
LMEMh
calrpc:[dhcpcsvc6,Security=Impersonation Dynamic False]
rue]
MEOW
{Fpi
6Device\{902A6B7D-F035-41A6-A06E-631E2332252E}
CDevice\{902A6B7D-F035-41A6-A06E-631E2332252E}
WinSta0\Default
LMEM
NTLM
LMEM
TSSSP
LMEM
pku2u
LMEM
nw`#
ERNEL32.DLL
qCNDE
qCNDE
qCNDE
qCNDE
0o()
0oP)
0ox)
0oX&
0/o`-
@gsP.
Asyct
qqqqqqqqqqqqqqqq
Asw`
w c<
dPr%
MEOW
MEOW
WinSta0\Default
=::=::\
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Bill\AppData\Roaming
CommonProgramFiles=C:\Program Files (x86)\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
CommonProgramW6432=C:\Program Files\Common Files
COMPUTERNAME=BILL-PC
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Bill
LOCALAPPDATA=C:\Users\Bill\AppData\Local
LOGONSERVER=\\BILL-PC
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\Python27\;C:\Python27\Scripts;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_ARCHITEW6432=AMD64
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 61 Stepping 4, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=3d04
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files (x86)
ProgramFiles(x86)=C:\Program Files (x86)
ProgramW6432=C:\Program Files
PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
PUBLIC=C:\Users\Public
SESSIONNAME=Console
SSLKEYLOGFILE=C:\Users\Bill\Desktop\SSL\ssl.log
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\Bill\AppData\Local\Temp
TMP=C:\Users\Bill\AppData\Local\Temp
USERDOMAIN=Bill-PC
USERNAME=Bill
USERPROFILE=C:\Users\Bill
windir=C:\Windows
windows_tracing_flags=3
windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log
"RAS Async Adapter
g*-l5
fu9?_
_ProviderArchitecture
__RequiredArchitecture
=xLMEM
Bill-PC
192.168.1.101
B+ncalrpc:[OLE5B2B7286DB564759A658E75B31EB]
NT AUTHORITY\SYSTEM
nonic
&WAN Miniport (SSTP)
(WAN Miniport (IKEv2)
&WAN Miniport (L2TP)
&WAN Miniport (PPTP)
0Microsoft ISATAP Adapter
BTeredo Tunneling Pseudo-Interface
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\System.Management.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\System.Management.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
).u ).u ).u,).u,).u8).u8).uD).uD).uP).uP).u\).u\).uh).uh).ut).ut).u
RAS
RAS
nonic^
Local Area Connection-QoS Packet Schedule
nonicb
Local Area Co
ion-WFP LightWeight Filter-0000
nonic0
Local Area Connection* 8
RAS
RAS
nonicd
Local Area Connection* 6-QoS Packet Scheduler-0000
RAS
RAS
nonic*
Local Area Connection
nonicd
Area Connection* 8-QoS Packet Scheduler-0000
RAS
RAS
nonicd
Local Area Connection* 7-QoS Packet Scheduler-0000
RAS
RAS
nonic0
Local Area Connection* 5
nonic2
Local Area Connec
ASYN
ASYN
nonic6
Loopback Pseudo-Interface 1
nonic,
Local Area Connection*
nonic0
Local Are
tion* 3
nonic0
Local Area Co
Flst
onic
Reusable ISAT
face {B2232BF0-4
-9093-4B5569F4D6
o Tunneling Pseu
face
CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}
pCE
K.$>
pCE
K.$>
pCE
pCE
pCE
pCE
K.$>
pCE
AN Miniport (IP)
ZWAN Miniport (IPv6)-QoS Packet Sche
r-0000
HIntel(R) PRO/1000 MT Deskto
apter
#2%.
VWAN Miniport (IP)-Q
acket Scheduler-0000
pWAN Minipor
etwork Monitor)-QoS Packet Scheduler-0000
(WAN
iport (PPPOE)
"RAS Async Adapter
K.$@
K.$@
tem32\WindowsPowerShel
C:\Windows
tem32\wbem\Logs\
&WAN Minipor
STP)
(WAN Miniport
&WAN Miniport (L
&WAN Miniport (PPT
icroso
SATAP
nonic
nonic
Loopback Pseudo-Interface 1
Software Loopback Interface 1
{846EE342-7039-11DE-9D20-806E6F6E6963}
ket Scheduler-0000
{846EE382-7039-11DE-9D20-001D09FA5A1C}
CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}
30% tt slip.exe
netprofm,netman
ERNEL32.DLL
Microsoft Package Negotiator
aPg@
NegoExtender
NegoExtender Security Package
Schannel Security Package
Schannel Security Package
TS Service Security Package
#lp/
System
ncalrpc
ncalrpc
ntsvcs
ntsvcs
ntsvcs
C:\Windows\System32\fwpuclnt.dll
C:\Windows\system32\rasapi32.dll
C:\Windows\SysWOW64\negoexts.DLL
C:\Windows\SysWOW64\Kerberos.DLL
C:\Windows\SysWOW64\schannel.dll
Digest Authentication for Windows
C:\Windows\SysWOW64\wdigest.dll
Microsoft CredSSP Security Provider
C:\Windows\syswow64\CFGMGR32.dll
Security=Impersonation Dynamic True
LMEM8
C:\Windows\system32\RpcRtRemote.dll
qCIEN
LIST
qCIEN
LISTh$
C:\Windows\syswow64\OLEAUT32.dll
C:\Windows\system32\wbemcomn.dll
>B5.
installpersistsqlstate.sql
16e2cffd014f97d85058154e8f4d31c4
installsqlstatetemplate.sql
microsoft.build.framework.dll
microsoft.visualbasic.targets
microsoft.visualbasic.vsa.dll
system.data.oracleclient.dll
system.directoryservices.dll
system.enterpriseservices.dll
system.enterpriseservices.tlb
onic
Reusable ISATAP Interface {B2232B
30% tt Slip_RASMANCS
30% tt Slip_RASMANCS
C:\Windows\tracing
up\(
C:\Windows\tracing
PRVp
_^[]
30% tt Slip_RASAPI32
30% tt Slip_RASAPI32
C:\Windows\tracing
C:\Windows\tracing
B556
QS[\
qNAME
PROP
qNAME
PROP
qNAME
PROP
qNAME
PROP
C6AEW
qNAME
PROP
corlib
CPU0
ncalrpc
calrpc
D-F035-41A6-A06E-631E2332252E}
11d50a3a
ic False
C:\Users\Bill\AppData\Roaming\Microsoft\Windows\Cookies
vbc.exe
\\BILL-PC\root\cimv2:Win32_Processor.DeviceID="CPU0"
k:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
\\BILL-PC\root\cimv2:Win32_Processor.DeviceID="CPU0"
qNASM
LIST
LIST
WM`t
`s`t
WM`t
LMEMH
LMEMH
u 1.
Microsoft ISATAP A
LMEMH
uo@k
b|:@
nterpriseservices.wrapper.dll
t.vsa.vb.codedomprocessor.tlb
t.vsa.vb.codedomprocessor.dll
Asw`
w c<
dPr%
%tPpZ
rs\Bill\AppData\Roaming\WindowsUpdate.exe
??\C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
??\C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
rs\Bil
ata\Ro
e.exe
rs\BilC:\Users\Bill\AppData\Roaming
e.exe
??\C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
rs\Bil
ata\Ro
Window
e.exe
rs\Bill\AppData\Roaming\WindowsUpdate.exe
nonic
Teredo Tunneling Pseudo-Interface
Teredo Tunneling Pseudo-Interface
{211D11D6-0DE3-433E-B35B-0C9BD5497545}
3-4B556
3-4B556
4B2
3-4B556
4B2
3-4B556
3-4B556
e 4B2
3-4B556
4B2
3-4B556
3-4B556
3-4B556
4B2
3-4B556
4B2
3-4B556
4B2
3-4B556
_^[]
WBEM Locator
lP1jh
PSFactoryBuffer
ERNEL32.DLL
ERNEL32.DLL
BILL-PC
cimv2
imv2
sapolicylookup
CMemoryExecute
CMemoryExecute
AcMg
\Win
ls.dll
0`(u
nonic
Teredo Tunneling Pseudo-Interface
Teredo Tunneling Pseudo-Interface
{211D11D6-0DE3-433E-B35B-0C9BD5497545}
-4B29-9093-4B5569F4D673}
{061
BF92-A3C0B8E9C4FC}
CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}
_NO_
ogramW6432=C:\Program Files
PSModulePath
Windows\system32\WindowsPowerShell\v1.0\
les\
PUBLIC=C:\Users\Public
SESSIONNAME=
SSLKEYLOGFILE=C:\Users\Bill\Desktop\
ssl.log
SystemDrive=C:
SystemRoot=C:\Win
TEMP=C:\Users\Bill\AppData\Local\Temp
K.$o
cal\Tem
CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}
windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log
ASYC
MEOW
cture
__RequiredArchitecture
=xLMEM
Bill-PC
192.168.1.101
B+ncalrpc:[OLE5B2B7286DB564759A658E75B31EB]
NT AUTHORITY\SYSTEM
WinSta0\Default
=::=::\
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Bill\AppData\Roaming
CommonProgramFiles=C:\Program Files (x86)\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
CommonProgramW6432=C:\Program Files\Common Files
COMPUTERNAME=BILL-PC
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Bill
LOCALAPPDATA=C:\Users\Bill\AppData\Local
LOGONSERVER=\\BILL-PC
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\Python27\;C:\Python27\Scripts;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_ARCHITEW6432=AMD64
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 61 Stepping 4, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=3d04
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files (x86)
ProgramFiles(x86)=C:\Program Files (x86)
ProgramW6432=C:\Program Files
PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
PUBLIC=C:\Users\Public
SESSIONNAME=Console
SSLKEYLOGFILE=C:\Users\Bill\Desktop\SSL\ssl.log
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\Bill\AppData\Local\Temp
TMP=C:\Users\Bill\AppData\Local\Temp
USERDOMAIN=Bill-PC
USERNAME=Bill
USERPROFILE=C:\Users\Bill
windir=C:\Windows
windows_tracing_flags=3
windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log
CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}
Ppts;
dows;C:\
CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}
C:\Windows\system32\wbem\wbemsvc.dll
C:\Windows\system32\wbem\wbemsvc.dll
C:\Windows\system32\wbem\fastprox.dll
C:\Windows\system32\wbem\fastprox.dll
C:\Windows\system32\wbem\fastprox.dll
\\BILL-PC\ROOT\cimv2:Win32_Processor
C:\Windows\system32\wbem\fastprox.dll
SELECT * FROM AntivirusProduct
ramFile
C:\Windows\system32\wbem\fastprox.dll
C:\Windows\system32\wbem\fastprox.dll
\\BILL-PC\ROOT\cimv2:Win32_Processor
zT A
calrpc
calrpc
alrpc
calrpc
calrpc
calrpc
calrpc
alrpc
calrpc
:=g
t_Enab
bnkn
calrpc
alrpc
#calrpc
System
Cookies
ncalrpc
ncalrpc
Mcalrpc
alrpc
ncalrpc
calrpc
calrpc
ncalrpc
alrpc
ncalrpc
5calrpc
calrpc
alrpc
calrpc
calrpc
ncalrpc
ncalrpc
CMemoryExecute.dll
CMemoryExecute.dll
cmemoryexecute.dll
aspnet_rc.dll
aspnet.mof
aspnet_perf.h
applaunch.exe
b03f5f7f11d50a3a
caspol.exe
cscomp.dll
cmemoryexecute.dll
cvtres.exe
PublicKeyToken
ieexec.exe
iehost.dll
PublicKeyToken
CMemoryExecute.dll
mscordbc.dll
b03f5f7f11d50a3a
T AUTHORITY\SYSTEM
mscorie.dll
PublicKeyToken3a
mscorld.dll
CMemoryExecute.dll
mscorlib.tlb
T AUTHORITY\SYSTEM
mscorrc.dll
mscorsec.dll
t0lZ
MEOW
ASYC
QS[\
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}
Intel(R) PRO/1000 MT Desktop Adapter
192.168.1.1
255.255.255.255
192.168.1.1
255.255.255.255
MTUR\,8
Win32_Processor
\{]>
System.Reflection.IReflect
System.Collections.IEnumerator
System.Collections.IEnumerable
win32_processor
C:\Windows\system32
C:\Program Files (x86)
etEnvironmentVariable
Win32_Processor
Win32_Processor
ASYC
s.dll
normid
normnfc.nl
normnfd.nlp
normnfkc.nlp
normnfkd.nlp
Aerify.dll
Hist
regasm
regsvcs.ex
shfusion.chm
shfusion.dll
shfusres.dll
ktkey.nlp
rs.nlp
subset
sysglobl.d
system.dll
system.tlb
tlbref.dll
vb7.olb
t.dll
webeng
1.10
255.
192.
#2%.
localdomain
Local Area Connection
Intel(R) PRO/1000 MT Desktop Adapter
{902A6B7D-F035-41A6-A06E-631E2332252E}
9D20
9D20
9D20
192.168.1.1
255.255.255.255
{DF.P+)
MEOW
WinSta0\Default
=::=::\
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Bill\AppData\Roaming
CommonProgramFiles=C:\Program Files (x86)\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
CommonProgramW6432=C:\Program Files\Common Files
COMPUTERNAME=BILL-PC
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Bill
LOCALAPPDATA=C:\Users\Bill\AppData\Local
LOGONSERVER=\\BILL-PC
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\Python27\;C:\Python27\Scripts;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_ARCHITEW6432=AMD64
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 61 Stepping 4, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=3d04
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files (x86)
ProgramFiles(x86)=C:\Program Files (x86)
ProgramW6432=C:\Program Files
PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
PUBLIC=C:\Users\Public
SESSIONNAME=Console
SSLKEYLOGFILE=C:\Users\Bill\Desktop\SSL\ssl.log
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\Bill\AppData\Local\Temp
TMP=C:\Users\Bill\AppData\Local\Temp
USERDOMAIN=Bill-PC
USERNAME=Bill
USERPROFILE=C:\Users\Bill
windir=C:\Windows
windows_tracing_flags=3
windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log
C:\Users\Bill\Desktop;.;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Python27\;C:\Python27\Scripts;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\
FIER
Data
SELECT * FROM FirewallProduct
8LE5B2B7286DB564759A658E75B31EB
LE5B2B7286DB564759A658E75B31EB
LE5B2B7286DB564759A658E75B31EB
SLE5B2B7286DB564759A658E75B31EB
LE5B2B7286DB564759A658E75B31EB
eLE5B2B7286DB564759A658E75B31EB
LE5B2B7286DB564759A658E75B31EB
C:\Windows\syswow64\psapi.dll
LE5B2B7286DB564759A658E75B31EB
:\Users\Bill\AppData\Roaming
t.1i
System.Runtime.InteropServices.Expando.IExpando
:\Users\Bill\AppData\Roaming
LE5B2B7286DB564759A658E75B31EB
&LE5B2B7286DB564759A658E75B31EB
C:\Windows\system32\apphelp.dll
\LE5B2B7286DB564759A658E75B31EB
>B5.
LE5B2B7286DB564759A658E75B31EB
LE5B2B7286DB564759A658E75B31EB
LE5B2B7286DB564759A658E75B31EB
LE5B2B7286DB564759A658E75B31EB
:\Users\Bill\AppData\Roaming
LE5B2B7286DB564759A658E75B31EB
:\Users\Bill\AppData\Roaming
LE5B2B7286DB564759A658E75B31EB
LE5B2B7286DB564759A658E75B31EB
LE5B2B7286DB564759A658E75B31EB
:\Users\Bill\AppData\Roaming
nonic
#2%.
localdomain
Local Area Connection
Intel(R) PRO/1000 MT Desktop Adapter
{902A6B7D-F035-41A6-A06E-631E2332252E}
\{]>
'Y[pk
xpthemes.manifest
$JI.
xJ '
CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}
stRr
RAS
RAS
ocal Area Connec
Packet Schedule
pData\Local\Temp\
q-4^
m6}+
*Y`O
stem;C:\Windows;.;C:\P.
;C:\Python27\Scripts;C:\Windows\system32;C:\Windows;
s\System32\Win
rShell\v1.0\
RAS
RAS
RAS
nonic*
Local Area Connection
nonicd
Local Are
tion* 8-QoS Pack
uler-0000
RAS
RAS
ocal Area Connec
QoS Packet Sched
RAS
nonic0
.u!c
nonic6
Loopback Pseudo-Interface 1
Flst
stRr
nonicB
Teredo Tunneling Pseudo-Interface
nonic$
isata
aldomain
erface {A8EC83FF-F63B-4A2C-B32C-A073CC6AE773}
&WAN Miniport (IPv6)
<WAN Miniport (Network Monitor)
|Intel(R) PRO/1000 MT Desktop Adapter-QoS Packet Scheduler-0000
Intel(R) PRO/1000 MT Desktop Adapter-WFP LightWeight Filter-0000
"WAN Miniport (IP)
ZWAN Miniport (IPv6)-QoS Packet Scheduler-0000
HIntel(R) PRO/1000 MT Desktop Adapter
C:\Users\Bill\AppData\Local\Temp\
pWAN Miniport (Network Monitor)-QoS Packet Scheduler-0000
(WAN Miniport (PPPOE)
"RAS A
pter
Flst
Loopback Interfa
&WAN M
(SSTP)
(WAN Minip
\DEVICE\TCPIP_{902A6B7D-F035-41A6-A06E-631E2332252E}
Intel(R) PRO/1000 MT Desktop Adapter
MEOW
b|:@
ProgramFiles
uERNEL32.DLL
ProgramFilesX86
ERNEL32.DLL
o Tunneling
o-Interface
unneling Pseudo
rface
{211D11D6-0DE3-433TV
BD5497545}
atap.localdomain
Microsoft ISAT
WAN Miniport (PPTP)
{DF4A9D2C-8742-4EB1-8703-D395C4183F33}
9/System.dll
ystem32;C:\Wind
system;C:\Windows;.;C:\PS
;C:\Python27\Scripts;C:\Wind
system32;C:\Windows;C:\Windo
ystem32\Wbem;C:\Windows\Syst
\WindowsPowerShell\v1.0\
C:\Users\Bill\AppData\Roaming
_^[]
PSQR
QRd<
_^[]
Flst
_^[]
ALLUSERSPROFIL
Bill\AppData\R
CommonProgra
86)=C:\Program F
6)\Common Files
ogramW6432=C:\Pr
les\Common Files
RNAM
\Windows\system3
FP_NO_HOST_CHE
MEDRIVE=C:
HOMEP
rs\Bill
LOCALAPP
"ros
$sa.
*cwk
0n_s
2e.l
8zat
>fco
@.dl
Fexe
Ltem
N.dl
Tdes
Ztem
\dll
bweb
htem
jdll
p.co
vnet
xs.d
localdom
_^[]
rea
A6B7D-F035-41A6-A06E-631E2332252E}
-001
o(@n
xJ '
m headers
MEOW
WinSta0\Default
=::=::\
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Bill\AppData\Roaming
CommonProgramFiles=C:\Program Files (x86)\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
CommonProgramW6432=C:\Program Files\Common Files
COMPUTERNAME=BILL-PC
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Bill
LOCALAPPDATA=C:\Users\Bill\AppData\Local
LOGONSERVER=\\BILL-PC
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\Python27\;C:\Python27\Scripts;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_ARCHITEW6432=AMD64
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 61 Stepping 4, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=3d04
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files (x86)
ProgramFiles(x86)=C:\Program Files (x86)
ProgramW6432=C:\Program Files
PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
PUBLIC=C:\Users\Public
SESSIONNAME=Console
SSLKEYLOGFILE=C:\Users\Bill\Desktop\SSL\ssl.log
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\Bill\AppData\Local\Temp
TMP=C:\Users\Bill\AppData\Local\Temp
USERDOMAIN=Bill-PC
USERNAME=Bill
USERPROFILE=C:\Users\Bill
windir=C:\Windows
windows_tracing_flags=3
windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log
ersion
.hcpcsvc
2.0.0.0
eutral
neutral
2.0.0.0
eutral
neutral
Culture
2hcpcsvc6
@%SystemRoot%\system32\shell32.dll,-21817
BILL@W~3.TXTbill@
LMEMH
-Interface 1
Software Loopback
nrface 1
{846EE342-7039-11DE-9D20-806E6F6E6963}
or)n
redo Tunneling Pseudo-Interface
Teredo Tunn
Pseudo-Interface
{211D11D6-0DE3-433E-B35B-0C9BD5497545}
nonic
isatap.localdomain
Microsoft ISATAP A
r #2
{A8EC83FF-F63B-4A2C-B32C-A073CC6AE773}
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Bill\AppData\Roaming
CommonProgramFiles=C:\Program Files (x86)\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
CommonProgramW6432=C:\Program Files\Common Files
COMPUTERNAME=BILL-PC
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Bill
LOCALAPPDATA=C:\Users\Bill\AppData\Local
LOGONSERVER=\\BILL-PC
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\Python27\;C:\Python27\Scripts;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_ARCHITEW6432=AMD64
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 61 Stepping 4, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=3d04
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files (x86)
ProgramFiles(x86)=C:\Program Files (x86)
ProgramW6432=C:\Program Files
PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
PUBLIC=C:\Users\Public
SESSIONNAME=Console
SSLKEYLOGFILE=C:\Users\Bill\Desktop\SSL\ssl.log
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\Bill\AppData\Local\Temp
TMP=C:\Users\Bill\AppData\Local\Temp
USERDOMAIN=Bill-PC
USERNAME=Bill
USERPROFILE=C:\Users\Bill
windir=C:\Windows
windows_tracing_flags=3
windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log
Cancel
&Abort
&Retry
&Ignore
&Yes
&Close
Help
&Try Again
&Continue
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
++++++--+-+
++--
-+----++++++++
GpSs
tFTOd8fen=
==()
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
^%S<O_Z__`'""
--~Ts>o_zY
AAAA
EEIIIID
OOOO
xOUUU
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Bill\AppData\Roaming
CommonProgramFiles=C:\Program Files (x86)\Common Fi2
)"w86)=C:\Program Files (x86)\Common Files
CommonProgramW6432=C:\Program Files\Common Files
COMPUTERNAME=BILL-PC
\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Bill
LOCALAPPDATA=C:\Users\Bill\AppData\Local
LOGONSE2
UMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\Python27\;C:\Python27\Scripts;C:\Windows\system32;C:\Windows;C:\Windows\Systg
E=C:2
uBill\AppData\Loc2
tallpackage\csilogfile.log
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Bill\AppData\Roaming
CommonProgramFiles=C:\Program Files (x86)\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
CommonProgramW6432=C:\Program Files\Common Files
COMPUTERNAME=BILL-PC
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Bill
LOCALAPPDATA=C:\Users\Bill\AppData\Local
LOGONSERVER=\\BILL-PC
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\Python27\;C:\Python27\Scripts;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_ARCHITEW6432=AMD64
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 61 Stepping 4, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=3d04
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files (x86)
ProgramFiles(x86)=C:\Program Files (x86)
ProgramW6432=C:\Program Files
PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
PUBLIC=C:\Users\Public
SESSIONNAME=Console
SSLKEYLOGFILE=C:\Users\Bill\Desktop\SSL\ssl.log
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\Bill\AppData\Local\Temp
TMP=C:\Users\Bill\AppData\Local\Temp
USERDOMAIN=Bill-PC
USERNAME=Bill
USERPROFILE=C:\Users\Bill
windir=C:\Windows
windows_tracing_flags=3
windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log
! #!%"'#)$+%-&/'1(3)5*7+9,;-=.?/A0E1I2M3Q4U5Y6]7a8e9i:m;q<u=y>}?
.,oj-,o~-,o
+yfs
V
A
V
A
U
A
@`
@
@@
D
@P
@0
@p
@
@`
,
@
&
@0
@
@P
@8
@h
%
@
%
@
1
@p
@
A
@
@
6
@`$9
@ #6
F
@
@
!
@
@ pP
"
@@$9
P
@
E
@P$9
"
@
@psP
w
@
8
@`
$
@
@
{
@
0
@
+
@
Y
@
L
@
(
@
$
@
r
@
B
@
%
@
*
@
@
)
@
0
@
7
@
,
@
@`
5
@
-
@
:
@
p
@
!
@@
@h
@
@`A<
@PA<
@@A<
@0A<
@ A<
@@
@
@P
@P
@8
@P0=
@
8
@
^
@`
z
@
O
@
p
@
s
@
@p$9
M
@
i
@ 0=
v
@
@@0=
@`sP
8
@
D
@
@
8
@ c
n
@
0
@00=
@0pP
@ $9
u
@
m
@`t]
!
@
@PsP
4
@
c
@
]
@
%
@
@Pt]
1
@@
v
@
h
@
E
@pt]
@@sP
,
@
@ sP
@@t]
@0t]
Y
@p
=
@P
@0$9
@0sP
5
@
7
@
@
@
U
@
#32769
Message
#32774
OLEChannelWnd
Class
ATL:000007FEFBA241F0
#32772
COMTASKSWINDOWCLASS
Task Host Window
MSCTFIME UI
Default IME
MSCTFIME Composition
CicLoaderWndClass
Default IME
CicMarshalWndClass
CicMarshalWnd
CiceroUIWndFrame
TF_FloatingLangBar_WndTitle
CiceroUIWndFrame
MS:SyncNotificationWindow
Media Center SSO
Media Center SSO
Default IME
TreeListWindowClass
SysShadow
!SystemTray_Main
MCI command handling window
Default IME
OleMainThreadWndClass
OleMainThreadWndName
&Restore
Default IME
&Move
WPDShServiceObject
WPDShServiceObject_WND
RelMonGraphWindow
PNIHiddenWnd
ATL:000007FEF4FD52C0
Network Flyout
OLEChannelWnd
TaskSwitcherOverlayWnd
!TaskSwitcherWnd
Battery Meter
s Activation
&Size
Mi&nimize
Ma&ximize
&Close Alt+F4
OLEChannelWnd
MS_WebcheckMonitor
MS_WebcheckMonitor
NativeFontCtl
)#32772
#32770
Roaming
Explorer
BluetoothNotificationAreaIconWindowClass
BluetoothNotificationAreaIconWindowClass
msctls_statusbar32
SysTabControl32
msctls_trackbar32
Default IME
#32772
DWM Notification Window
Ghost
WorkerW
#32772
DDEMLMom
MSCTFIME UI
Default IME
MSCTFIME Composition
DDEMLEvent
OleMainThreadWndClass
OleMainThreadWndName
OLEChannelWnd
OleDdeWndClass
DDE Server Window
Default IME
Shell_TrayWnd
TrayClockWClass
CicMarshalWndClass
CicMarshalWnd
MSCTFIME UI
Button
Button
Start
TrayShowDesktopButtonWClass
Program Manager
CicMarshalWnd
TrayNotifyWnd
tooltips_class32
NotifyIconOverflowWindow
CLIPBRDWNDCLASS
SysLink
SysPager
ToolbarWindow32
User Promoted Notification Area
Overflow Notification Area
ReBarWindow32
System Promoted Notification Area
MSTaskSwWClass
MSTaskListWClass
Jump List
MSCTFIME UI
TaskListOverlayWnd
DV2ControlHost
TaskListThumbnailWnd
OLEChannelWnd
DesktopProgramsMFU
DesktopDestinationList
DesktopSpecialFolders
Desktop User Pane
Desktop More Programs Pane
DesktopLogoffPane
Desktop NSCHost
Desktop OpenBox Host
Desktop Search Open View
Desktop top match
Desktop User Picture
SysListView32
SysHeader32
Qt5ClipboardView
Ghost
BrowserFrameGripperClass
&Del
5:54 PM
Start menu
Running applications
Running applications
Edit
shor
Edit
'NamespaceTreeControl
Wireshark
Static
Static
%SysTreeView32
Favorites
Search Box
AUTHUI.DLL: Shutdown Choices Message Window
Shut down
FloatNotifySink
SearchEditBoxWrapperClass
Wireshark
DirectUIHWND
RICHEDIT50W
Bill
picture
_SearchEditBoxFakeWindow
All Programs
CicMarshalWnd
#32772
OleMainThreadWndName
PROCEXPL
CpuGraphClassChart
CpuGraphClassGraph
&Run... Ctrl+R
&Save Ctrl+S
Save &As... Ctrl+A
&Logoff
&Shutdown
&Restart
S&hutdown
E&xit
&File
Run At &Logon
&Verify Image Signatures
Virus&Total.com
!Progman
CicMarshalWndClass
All Programs
e Control
All Programs
e Control
CiceroUIWndFrame
FolderView
TF_FloatingLangBar_WndTitle
SHELLDLL_DefView
ator
acker
ANIMATION_TIMER_HWND
shor
rame
CiceroUIWndFrame
OLEChannelWnd
$")+
OleMainThreadWndClass
&Restore
ANIMATION_TIMER_HWND
CicMarshalWnd
MSCTFIME UI
#SysIPAddress32
Rena&me
#32772
VBoxTrayToolWndClass
OleMainThreadWndName
VBoxSharedClipboardClass
VBoxSharedClipboardClass
&Move
&Size
Mi&nimize
VBoxTrayToolWnd
&Restore
&Move
&Size
Mi&nimize
Ma&ximize
MSCTFIME UI
Default IME
MSCTFIME Composition
Ma&ximize
ListBox
ListBox
ComboBox
VBoxTrayDnDWnd
VBoxTrayDnDWnd
Default IME
AltTab_KeyHookWnd
#32772
OLEChannelWnd
CLIPBRDWNDCLASS
Default IME
CHECKLIST_ACLUI
SysLink
pma
MMDEVAPI
MMDEVAPI Device Window
msctls_updown32
msctls_progress32
msctls_hotkey32
SysAnimate32
ComboBoxEx32
CicMarshalWndClass
FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}
HiddenFaxWindow
OLEChannelWnd
Class
GraphWindowClass
IMAPI2 Notification Window
IMAPI2 Notification Window
&About Windows
&Edit
Roaming
Explorer
RichEdit20A
&Refresh
&View
Map &network drive...
&Disconnect network drive...
Open &Sync Center...
Folder &options...
&Internet options...
&Tools
Is this copy of Windows &legal?
&About Windows
&Help
#32772
MSCTFIME UI
Default IME
Status &bar
Placeholder
Placeholder
CicMarshalWnd
Address Band Root
UniversalSearchBand
&Close
ScrollBar
ReaderModeCtl
CabinetWClass
orer
CtrlNotifySink
TravelBand
ShellTabWindowClass
Breadcrumb Parent
ConsoleWindowClass
OLEChannelWnd
ComboBox
ComboLBox
ComboLBox
ScrollBar
&Kill Process
Button
&Cancel
&Bring to Front
vbc.exe:908 Properties
Default IME
Total
Started:
Image: 32-bit
&Kill Process
P&roperties
Rena&me
&Delete
Create &shortcut
&Invert Selection
Select &all Ctrl+A
List1
rrow
&Help
&For
Namespace Tree Control
Tree View
Namespace Tree Control
Is this copy of Windows &legal?
&Refresh
&Up one level Alt+Up Arrow
&Forward Alt+Right Arrow
&Back Alt+Left Arrow
&Go To
o&ns
Placeholder
Grou&p by
&More...
&Descending
&Ascending
none
S&ort by
&Arrange by
&Collapse all groups
Expand all gro&ups
Al&ign to grid
&Auto arrange
&Hide file names
Conten&t
Tile&s
&Details
&Paste
&Select All
Scro&ll
&Find...
&Edit
&Close
shor
#32772
OleMainThreadWndClass
rties
)IME
&List
Small ico&ns
&Medium icons
La&rge icons
E&xtra large icons
View &help
Default IME
&Move
elWn
&Size
&File
SysFader
ATL:000007FEF87DB6E0
Default IME
ATL:000007FEF87DE2D0
OLEChannelWnd
Default IME
Groove.Class.BroadcastServices.BroadcastReceiver
Default IME
DUIViewWndClassName
OleMainThreadWndClass
OLEChannelWnd
shortcut
&Toolbars
Temp
ws Explorer
MSCTFIME UI
Default IME
Default IME
MSCTFIME UI
Tools
s Explorer
Open &Sync Center...
&Disconnect network drive...
Map &network drive...
&Tools
CicMarshalWnd
Temp
ws Explorer
*Local Area Connection
ea Connection
&Disconnect network drive...
Open &Sync Center...
Folder &options...
&Internet options...
Is this copy of Windows &legal?
&About Windows
&Help
&Delete
tcut
Cu&t Ctrl+X
&Copy Ctrl+C
&Edit
Status &bar
Placeholder
Placeholder
&Explorer Bar
Status &bar
&Toolbars
&View
&Edit
&Close
&File
C:\Windows\Tools\Wireshark\dumpcap.exe
MSCTFIME UI
Qt5QWindowPopupDropShadowSaveBits
Shell Preview Extension Host
0440
SysDragImage
0-4A
WindowsForms10.Window.0.app.0.378734a
Default IME
MSCTFIME Composition
nuEo
GDI+ Hook Window Class
nuEo
GDI+ Window
Default IME
.NET-BroadcastEventWindow.2.0.0.0.378734a.0
.NET-BroadcastEventWindow.2.0.0.0.378734a.0
Shell Preview Extension Host Foreground Msg
&Up one level Alt+Up Arrow
&Go To
&Refresh
&View
Map &network drive...
&Tools
&Close Alt+F4
&Close
shor
&File
Rena
P&ro
&Edit
&Toolbars
Status &bar
Placeholder
Placeholder
&Explorer Bar
&Back Alt+Left Arrow
&Forward Alt+Right Arrow
&Up one level Alt+Up Arrow
&Go To
&Refresh
&View
Map &network drive...
&Disconnect network drive...
Open &Sync Center...
Folder &options...
&Internet options...
&Tools
Is this copy of Windows &legal?
&About Windows
&Help
Create &shortcut
&Delete
Rena&me
P&roperties
&Close
&File
Cu&t Ctrl+X
&Copy Ctrl+C
&Edit
Status &bar
Placeholder
Placeholder
&Explorer Bar
&Go To
Create &shortcut
Rena&me
P&roperties
&Close
fol
&File
&Back Alt+Left Arrow
&Forward Alt+Right Arrow
&Up one level Alt+Up Arrow
&Refresh
&View
Map &network drive...
&Disconnect network drive...
Open &Sync Center...
Folder &options...
&Internet options...
&Tools
Is this copy of Windows &legal?
&About Windows
&Help
Mi&nimize
Ma&ximize
La&rge icons
E&xtra large icons
Vv?
Vv?
Properties... Ctrl+P
Stac&k... Ctrl+K
Toggle &Bookmark Ctrl+B
Jump To... Ctrl+J
Search Online...
Process Name
Include
Image Path
Image Path
tart Men&u
shor
TreeListWindowClass
&Open... Ctrl+O
&Save... Ctrl+S
Backing Files...
&Capture Events Ctrl+E
Export Configuration...
Import Configuration...
&Copy Ctrl+C
&Find... Ctrl+F
Find &Highlight F4
Find &Bookmark F6
&Auto Scroll Ctrl+A
C&lear Display Ctrl+X
&Edit
OleMainThreadWndName
PROCMON_WINDOW_CLASS
E&xit
admi
%OleMainThreadWndClass
MSCTFIME UI
Qt5QWindowIcon
trato
MSCTFIME UI
SysCredential
ource
TreeListWindowClass
Exclude
Process Name
Highlight
E&vent
Enable &Advanced Output
Filter... Ctrl+L
Reset Filter Ctrl+R
Process Name
hoot
Load Filter
Save Filter...
urce
Organize Filters...
Fi&lter
AltTab
GraphWindowClass
&File
&Up one level Alt+Up Arrow
&Forward Alt+Right Arrow
&Back Alt+Left Arrow
&Go To
Placeholder
QEventDispatcherWin32_Internal_Widget1913784768
OleMainThreadWndClass
Address: C:\Users\Bill\AppData\Local\Temp
ew &Help
OleMainThreadWndName
&Internet options...
Folder &options...
Open &Sync Center...
&Disconnect network drive...
Map &network drive...
t op
&Tools
opti
&Refresh
Is this copy of Windows &legal?
ShellView
Tab1
Shell Preview Extension Host
Namespace Tree Control
Placeholder
&Explorer Bar
Status &bar
&Toolbars
&View
&Edit
&Close
&File
RichEdit20W
Tree View
Namespace Tree Control
&About Windows
&Help
Session
Session
Session
Virtualized
Virtualized
Virtualized
Agressive_Noise_Reduction
Create_File
File_Attrib
File_Delete
Files_Written
Noise_Reduction
Only_Modifying
Reg_CreateKey
CicMarshalWndClass
CicMarshalWnd
Version
Version
Architecture
Architecture
Architecture
Path
Path
Path
Operation
Operation
Operation
Result
Result
Result
Event Class
Event Class
Event Class
Detail
Detail
Detail
Category
Category
Category
Parent PID
Parent PID
Parent PID
User
User
User
Drop Filtered Events
Highlight... Ctrl+H
System Details...
Process Tree... Ctrl+T
Process Activity Summary...
File Summary...
Registry Summary...
Stack Summary...
&Configure Symbols...
&Select Columns...
&History Depth...
&Profiling Events...
Enable &Boot Logging
Show Resolved &Network Addresses Ctrl+N
Link Window
'MSCTFIME Composition
Hacker
SysShadow
ontrol
&Options
MSCTFIME Composition
CLIPBRDWNDCLASS
msctls_statusbar32
Network Summary...
Cross Reference Summary...
Count Occurrences...
&Tools
Always on &Top
Fo&nt...
Highlight &Colors...
P&roperties
Rena&me
&Delete
Create &shortcut
&Copy Ctrl+C
Cu&t Ctrl+X
&Redo Ctrl+Y
&Undo Ctrl+Z
Customize this &folder...
C&hoose details...
&More...
&Descending
&Ascending
(&None)
none
Grou&p by
&More...
&Descending
&Ascending
none
&Invert Selection
Select &all Ctrl+A
Mo&ve to folder...
Copy to &folder...
Paste &shortcut
&Paste Ctrl+V
S&ort by
&Arrange by
&Collapse all groups
Expand all gro&ups
Al&ign to grid
&Auto arrange
&Hide file names
Conten&t
Tile&s
&Details
&List
Small ico&ns
&Medium icons
View &help
&Help...
Command Line Options...
&About...
&Help
Process Monitor - Sysinternals: www.sysinternals.com
MSCTFIME UI
Default IME
SysHeader32
SysListView32
Edit
Edit
tooltips_class32
Image Path
OLEChannelWnd
ToolbarWindow32
Command Line
Command Line
Command Line
Company
Company
Company
Description
Description
Description
Version
Default IME
&Restore
Reg_DeleteKey
Reg_DeleteValue
Reg_SetValue
System &Information... Ctrl+I
Replace &Task Manager
&Search Online... Ctrl+M
&Check VirusTotal.com
&Properties...
ToolbarWindow32
ReBarWindow32
&Confirm Kill
&Configure Colors...
DLLs
&CPU History
&I/O History
Commit &History
&Physical Memory History
Tray &Icons
&Difference Highlight Duration...
&Font...
&Options
&Show Process Tree Ctrl+T
Show Column &Heatmaps
Scroll to N&ew Processes
Show U&nnamed Handles and Mappings
&Check VirusTotal.com
&Submit Unknown Executables
&Always On Top
&Hide When Minimized
Allow &Only One Instance
tooltips_class32
msctls_statusbar32
msctls_trackbar32
ComboBoxEx32
&Refresh Now F5
Or&ganize Column Sets...
Sa&ve Column Set...
&High: 13
L&oad Column Set
Select &Columns...
&View
&Bring to Front
&Restore
&Minimize
Sho&w Processes From All Users
Show Lower &Pane Ctrl+L
&DLLs Ctrl+D
&Handles Ctrl+H
&Lower Pane View
Ma&ximize
&Close
&Window
&Realtime: 24
&High: 13
&Normal: 8
&Idle: 4
&Set Priority
&Kill Process Del
Kill Process &Tree Shift+Del
&Restart
SysShadow
&Create Minidump...
Create &Full Dump...
&Create Dump
&Cancel
#32770
.5 &seconds
&1 second
&2 seconds
&5 seconds
1&0 seconds
&Paused Space
&Update Speed
&Realtime: 24
&Normal: 8
&Idle: 4
Run as &Limited User...
R&un as Administrator...
&Above Normal: 10
&Above Normal: 10
&Below Normal: 6
&Below Normal: 6
Back&ground: 4 (Low I/O and Memory Priority)
Back&ground: 4 (Low I/O and Memory Priority)
Show &Details for All Processes
&10%
&20%
&30%
&Properties...
Search &Online... Ctrl+M
&Process
&Find Handle or DLL... Ctrl+F
F&ind
&Help... F1
&About
&Help
Loc&k
Expl
&Properties...
: www
&Close Handle
MSCTFIME UI
Default IME
MSCTFIME Composition
&40%
&50%
&60%
&70%
&80%
&90%
&Opaque
Opacity
CicMarshalWndClass
CicMarshalWnd
MSCTFIME UI
Configure &Symbols...
&Users
Process Explorer - Sysinternals: www.sysinternals.com [Bill-PC\Bill]
SysHeader32
OLEChannelWnd
ScrollBar
ScrollBar
Static
Static
Edit
SysListView32
'Edit
CLIPBRDWNDCLASS
Qt5ClipboardView
SysShadow
)IME
pnc
#32768
0440
&Bring to Front
&Properties
QTreeViewThemeHelperWindowClass
QTreeViewThemeHelperWindow
)#32772
skbar
Started:
MSCTFIME UI
&Restore
&Move
&Size
Mi&nimize
Ma&ximize
&Defaults
Mar&k
Cop&y Enter
&Move
&Close Alt+F4
&Restore
&Move
0-4A
30% tt Slip.exe:2528 Properties
Total
file
MSCTFIME UI
Default IME
&Restore
Wireshark
Placeholder
&Explorer Bar
&Back Alt+Left Arrow
hrea
&Forward Alt+Right Arrow
&Up one level Alt+Up Arrow
&Go To
Address: C:\Users\Bill\AppData\Roaming
&Resolve addresses
S&uspend
PropertyControlBase
Ma&ximize
&Close Alt+F4
CLIPBRDWNDCLASS
MSCTFIME UI
&Move
&Size
Mi&nimize
Ma&ximize
&Close Alt+F4
SysTabControl32
Tab1
Button
Mo&ve to folder...
Copy to &folder...
Paste &shortcut
&Des
&Paste Ctrl+V
&Copy Ctrl+C
Cu&t Ctrl+X
&Redo Ctrl+Y
s &fold
&Undo Ctrl+Z
Customize this &folder...
C&hoose details...
&More...
&Descending
&Ascending
(&None)
none
trl+V
Folder &options...
ShellView
&Size
Mi&nimize
copy
Shell Preview Extension Host
&Internet options...
&Nor
&Explorer Bar
&Back Alt+Left Arrow
&Forward Alt+Right Arrow
OleMainThreadWndName
WindowsForms10.Window.8.app.0.378734a
0440
Wireshark
MSCTFIME Composition
e Alt+F
User:
Image File
Path:
Version:
Parent:
Command line:
Current directory:
Build Time:
Comment:
Data Execution Prevention (DEP) Status:
Disabled
&Verify
Address Space Load Randomization:
Disabled
Autostart Location:
E&xplore
E&xplore
VirusTotal:
&Submit
Syst
CicMarshalWnd
Control Flow Guard:
Static
vbc.exe(0000038C) (netsvcs) Properties
&Check VirusTotal
User:
Image File
Path:
Version:
Parent:
Command line:
&Log
Current directory:
Build Time:
Comment:
Data Execution Prevention (DEP) Status:
Disabled
&Verify
Address Space Load Randomization:
Disabled
Autostart Location:
E&xplore
E&xplore
VirusTotal:
&Submit
CicMarshalWnd
Control Flow Guard:
Static
Image: 32-bit
30% tt Slip.exe(000009E0) (netsvcs) Properties
MSCTFIME UI
Placeholder
&Explorer Bar
&Back Alt+Left Arrow
&Forward Alt+Right Arrow
&Up one level Alt+Up Arrow
&Go To
&Refresh
&View
Map &network drive...
&Disconnect network drive...
Open &Sync Center...
Folder &options...
&Internet options...
&Tools
&Help
CicMarshalWnd
Tools
s Explorer
&Close
&File
&Edit
&Toolbars
Status &bar
Placeholder
elWnd
ExplorerBrowserNavigation
elWnd
elWnd
ource
elWnd
&admi
elWnd
Is this copy of Windows &legal?
&About Windows
Create &shortcut
&Delete
Rena&me
P&roperties
&Close
&File
Cu&t Ctrl+X
&Copy Ctrl+C
&Edit
Status &bar
Placeholder
Placeholder
&Explorer Bar
&Back Alt+Left Arrow
&Forward Alt+Right Arrow
&Up one level Alt+Up Arrow
&Go To
&Refresh
&View
Map &network drive...
&Disconnect network drive...
Open &Sync Center...
Folder &options...
&Internet options...
&Tools
Is this copy of Windows &legal?
&About Windows
&Help
Al&ign to grid
&Auto arrange
&Hide file names
Conten&t
Tile&s
&Details
&List
Small ico&ns
&Medium icons
La&rge icons
E&xtra large icons
View &help
Administrator: C:\Windows\System32\cmd.exe - strings2.exe -pid 2528
Expand all gro&ups
BrowserNavigation
ws\System32\cmd.exe
Default IME
MSCTFIME Composition
&Restore
&Move
&Size
Mi&nimize
Ma&ximize
&Properties
0-4A
ConsoleWindowClass
nd to
prev
Task Switching
tart
MSCTFIME UI
ipie
#32772
CicMarshalWndClass
OleMainThreadWndClass
OleMainThreadWndName
CicMarshalWnd
MSCTFIME UI
Mar&k
Cop&y Enter
&Paste
&Select All
Scro&ll
&Find...
&Edit
Comp
ed)
&Close
&Del
&Defaults
Address: C:\Windows\Tools\Tools
elWnd
Status &bar
&Toolbars
&View
&Edit
&Close
&File
&Refresh
&Up one level Alt+Up Arrow
&Forward Alt+Right Arrow
&Back Alt+Left Arrow
&Go To
Placeholder
Placeholder
&Explorer Bar
arge
View &Help
elWnd
Help
&Internet options...
Folder &options...
Open &Sync Center...
&Disconnect network drive...
Map &network drive...
nc C
&Tools
ect
Is this copy of Windows &legal?
ShellView
Shell Preview Extension Host
Namespace Tree Control
Tree View
Namespace Tree Control
&About Windows
&Help
cmd.7z"
Compress to "cmd.7z" and email
Add to "cmd.zip"
Compress to "cmd.zip" and email
CRC-32
CRC-64
SHA-1
SHA-256
elWnd
&Open
Open using Resource &Hacker
rator: C:\Windows\System32\cmd.exe
Run as &administrator
Class
hreadWndName
P&roperties
Rena&me
&Delete
Create &shortcut
&Copy Ctrl+C
Cu&t Ctrl+X
&Redo Ctrl+Y
&Undo Ctrl+Z
Customize this &folder...
C&hoose details...
&More...
&Descending
&Ascending
(&None)
none
Grou&p by
&More...
&Descending
&Ascending
none
&Invert Selection
Select &all Ctrl+A
Mo&ve to folder...
Copy to &folder...
Paste &shortcut
&Paste Ctrl+V
S&ort by
&Arrange by
&Collapse all groups
RtlDecodePointer
RtlDecodePointer
DecodePointer
IMue
*#Gu
*#GuH#Gu
+#Gu
8Baw
ME U
v'1t
v'1t
v'1t
U85t
nuEo
nuEo
nuEo
nuEo
>(1t
2xEo
2xEo
les\Common Files
COMPUTERNAME=BILL-PC
SOR_G
=C:\
pack
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Bill\AppData\Roaming
CommonProgramFiles=C:\Program Files (x86)\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
CommonProgramW6432=C:\Program Files\Common Files
COMPUTERNAME=BILL-PC
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Bill
LOCALAPPDATA=C:\Users\Bill\AppData\Local
LOGONSERVER=\\BILL-PC
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\Python27\;C:\Python27\Scripts;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_ARCHITEW6432=AMD64
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 61 Stepping 4, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=3d04
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files (x86)
ProgramFiles(x86)=C:\Program Files (x86)
ProgramW6432=C:\Program Files
PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
PUBLIC=C:\Users\Public
SESSIONNAME=Console
SSLKEYLOGFILE=C:\Users\Bill\Desktop\SSL\ssl.log
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\Bill\AppData\Local\Temp
TMP=C:\Users\Bill\AppData\Local\Temp
USERDOMAIN=Bill-PC
USERNAME=Bill
USERPROFILE=C:\Users\Bill
windir=C:\Windows
windows_tracing_flags=3
windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log
! #!%"'#)$+%-&/'1(3)5*7+9,;-=.?/A0E1I2M3Q4U5Y6]7a8e9i:m;q<u=y>}?
BY)(
B(3
*3
B,3
B.3
B03
B23
B43
B63
B83
B:3
B<3
B>3
B@3
BB3
BD3
BF3
BH3
BJ3
BL3
BN3
B
P3
BR3
BT3
BV3
BV3
BX3
By3
\3
B
`3
Bb3
Bd3
Bf3
B
?3
BA3
B
W3
B
Z3
B^3
B
az-Latn-AZ
linguistic_casing
tr-TR
0 @
P `
JJVVVVdd
pp~~
0 @
P `
PPPPPPPPPPPPPPPP
00000000000000000000000000000000000000
00000000000000000000000000000000000000000000000
0 @
P `
JJVVVVdd
pp~~
0 @
P `
PPPPPPPPPPPPPPPP
00000000000000000000000000000000000000
00000000000000000000000000000000000000000000000
0 @
P `
JJVVVVdd
pp~~
0 @
P `
PPPPPPPPPPPPPPPP
00000000000000000000000000000000000000
00000000000000000000000000000000000000000000000
0 @
P `
JJVVVVdd
pp~~
0 @
P `
PPPPPPPPPPPPPPPP
00000000000000000000000000000000000000
00000000000000000000000000000000000000000000000
######$#########$######
######$%&&&&&&%&&&&&&&&&%&&&&&&
&&&&&&%&0
'('('('('('('('('($%'('(%'('('('('('('('(($%'('('($%'('('('('('('('('('(''('('(%($$%$%$$%$$$%%$$$$%$$%$'$%(($$%''($%$%$$%$%($%''($$$%$%$$%%)$%%%))))'*($+%$+%'('('('('('('('(%'(($+%'($$$%'('('(P
'('('('($%$%$%$%$%$%$%$%$%$%$%$%$%$%%%%%%%$$%$$%%$%$$$$%$%$%$%$%%%%%%%%%%%%%%%%%%%%%%%%%(%%(%%%%%%%%)%%%%%%%%%%%,,,,,,,,,--.,.....-----/--//---/..------//////--,,,,.---------.-----------------P
0000000000000000000000000000000100000000111110000001111111111111$%$%--$%
,%%%"
//'2'''
''($$$$$$$$$$$$$$$$$
$$$$$$$''(((((%%%%%%%%%%%%%%%%%%%%%%%%%((((($%%$''%%%$%$%$%$%%%%%$%3$%$$%%$$$
$'$'$$$'$$$$'$'$$$$$$$$$$'$$$$$$$$$$$$$$$$$$$$$$%%%%%%%%%(%%%%%%%(%(%%%(%%%%(%(%$%$%$%'($%$%$%$%$%40000011$%$%$%$%'($%$%'($%$%$%$%$%$%$%$%'($%$%'($%$%$%$%$%$%'($'($%$%$%$%$%$%%'('($%'($%'('('($%'('('($%'($%'('('('($%'($%$%$%
$%$%
$$$$$$$$$$$$$$$$$$$$$$
,566666
%%%%%%%%%%%%%%%%%%%%%%%
0000000000000000010000000000000000000000000007070070171
888888888888888888888888888
88877
9999
33:;;:<733111111111117
888888888888888=8888888888000000001111001>>>11
??????????;@@7880888888888888888888878111111191001111AA113000188BBBBBBBBBB888::8
77777777777777
818888888888888800000000000
888888888000000000008
CCCCCCCCCC88888888888888888000000000AA3"""8
11D))))))))))))))))))))))))))))))))))))))
0)EEE>>>>>>>>EEEE0
)0000
))))))))))>>66FFFFFFFFFF6.)
)))))
))))))))
))))))))))))))))))))))
)))))))
))))
0)EEE>>>>
EE0)
)))>>
FFFFFFFFFF))GGDDDDDD4
0 @ @ P ` p
))))))
EEE>>
))))
FFFFFFFFFF11)))1
))))))))I
))))))))))))))
)))))
0)EEE>>>>>
P
`
p
)))))
0)E>E>>>>
))))))
))))
))))))))))))
EE>EE
EEE0
DDD333333G3
))))))))
))))))))))))))))))
)))))
)>>>EEEE
>>>0
JJJJJJJ4
))))))))
))))))
)))))
0)EEEEEEE
EE>0
))))))))))
)EEE>>>>
EEE0
DDDDDD
4))))))
))))))))))))))))))
))))))))
)))))))))
)))))))
EEE>>>
EEEEEEEE
@
0
@
)))))))))))))))))))I)I))))))))KILIILLLLLLM
GIIIIIIKMMMMMMMM6FFFFFFFFFF66
))))
)))))))
)))I>II>>>>>>
IIIII
000001
FFFFFFFFFF
)4446666666666666664444400444444FFFFFFFFFFDDDDDDDDDD404040""""NN))))))))
))))))))))))))))))))
>>>>>>>>>>>>>1D>>000600))))
11111111
111111111111111111111111111111111111
444444440444444
4466666
)))))))))))EE>>>>E>>>>10D00DD11)FFFFFFFFFF666666))))))EE>>))))111)EDD))EEDDDDD)))>>>>)))))))))))))1EE>>NNNNNN0)NFFFFFFFFFF
44$$$$$$
)))))))))))6)
@ @ @
@ @
))))))))))
))))
))))))))))))))))))
@ @ @ @ @
@ @ @ @
@ @ @ @
)))))))))
))))
)))))))
))))
))))
)))))))
))))
)))))))))))))))
))))))))@ @ @ @ P
@ @ P
@ @ p
@ @ )))))))))))
1466666666DDDDDDDDDDDDDDDDDDDD
3333333333
)))))
@ @ @
@ @ @ @ @
@ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ )))))))))))))66))))))))
O))))))))))))))))))))))))))""
)))))))))))666))@ @ @ @ @ @ p
@ @ @ @
)))))))))))))
))))>>1
))>>166
))>>
)))IIIIIIIIIIIIIIIIIPPE>>>>>>>EEEEEEEE1DD00000000000666)666G)0
FFFFFFFFFF
JJJJJJJJJJ
@ @ 0
"""""""""""111Q
)))I))))))))))))))))))))
)))))))))1)
@ @
@ @
@ @
I)))))))))))))))>>>EEEE>>111
DD1DDDDDD000
""FFFFFFFFFF))))))))))))))
EEEEEEEEEEEEEEEEE)))))))DD
FFFFFFFFFF
""3333333333333333
@ @
)))))))>>EEE
66@
1111D)))))))))))))))0E>>>>>E>EEEEE>EN)))))))
64444444444000000000444444444
11D))))))))))))))D11>>EE>>N
@ @
))))DDEEEEEE>1111111DD00
66666FFFFFFFFFF
)))FFFFFFFFFF))))))))))))))......66@ @
%%%%%%%%%%%%......................(((((((((%%%%%%%%%%%%%)%%%%%%%%%%%%%%%%%%)))))11110000000000001111111
@ @ @
'('('(((((((%%$%'('('('('($%$%$%P
((((((((''''''''((((((
''''''
((((((((
'((((((((((((((
((((((((********(((((
((''''*/R///(((
((''''*///((((
((''''
///(((((((('''''///
((''''*//
OOOOOOOOOOO
S9222222""TT""TT""""""""""OU
V;;WWW"""2""""""""""2X"""""""""""""3""""""""""""O
YYYYYYZ[\""RYYYYYYYYYYZ[\""
GGGGGGGGG]GGGGGGGGGGGG
33$3333$33%$$$%%$$$%3$333$$$$$333333$3$3$3$$$$G%$$$$%))))%33%%$$33333$%%%%3333%4
JJJJJJJJJJJJJ)))$%))))
@ @
33[G3\\333333333
333333333""33333333333444444444444444444444444444444444444433333333334333333333333333333
3333333
33333333333
JJJJJJJJJJJJJJJJJJJJJJJJYYYYYYYYYYYYYYYYYYYY44444444444444JJJJJJ
\333\\33\\333333333333333333\\330
33333333333333
33333333333343333333333333333
3333
3333
3333
333333333333
3333333333333333333
3333
3333333
3333333""""""""""""""JJJJJJJJJJJJJJ3
33333333
33333333333333
33333""3333
333333""""""""""
333""""""""""""""""""""""333333333333333""""3333333333333333""33
33333
$$$$$$$$$$$$$$$
%%%%%%%%%%%%%%%
$%$$$%%$%$%$%$$$
%$%%$%%%%%%%)
$%$%%333333
""""J""
%%%%%%
))))))
))))))))
)))))))
@ @ @
"""""""""""""""""""""""""""""""-"
3333333333
333330
333333
333333333333
^TT23)__""""TT""""33""""""""2"""3_________0000002`a`a`33___))"33
bbbbbbbbbbbcbcbcbcbcbcbcbcbcbcbcbcbbcbcbcbbbbbbccbccbccbccbccbbbbbbbbbbbbbbbbbbbbbbbbb
ddeefgbhiiiiiiiiiiijijijijijijijijijijijijiijijijiiiiiijjijjijjijjijjiiiiiiiiiiiiiiiikikkiijkkjjjjlmnok
)))))))))))
pppppppppppppppppppppppppppppppppppp))))))))))))))))))))))))))
44DDDD4444444444kkkkkkkkkkkkkkkk
444444444444433
DDDDDDDDDD4444444444
3JJJJJJJJJJJJJJJ44444444444433344JJJJJJJJJJJJJJJ4444444444443333qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
444444433334444444444444444444334444444444444443P
________________
______
____
@ @ @ @ @ @ @ @
)))))))))))))"""FFFFFFFFFF))
$%$%$%$%$%$%)0111"
00"-$%$%$%$%
0 @ @
P ` @
3333333-----------$%$%$%$%$%$%$%%%$%$%$%$%$%$%$%)%%%%%%%%$%$%$$%$%$%$%$%-44$%
)))))
))1)))1))))1)))))))EE>>E3333
))))""""
DD))))))))))))))))))DEEEEEEEEEEEEEEE0
66 !@ 0!
@ @ @ @!P!@ @ `!p!p
))))))>>>>>000r6)))))))>>>>>>>>111DN
)))))))))>>>>>>EE>>DD11
)))1))))))))1D
FFFFFFFFFF
6666@ @
))))
@ @ @ @ @ @ @ @ @ @ P"
ssssssssssssssss
"tttttttttttttttt
"DDDDDDDDDDDDDDDD
"______________
)))))))))))
__________
#@ @ @ #
%%%%%%%
%%%%%
808888888888Z8888888888888
88888
888888888888
8888888888888`#p#
88888888888888""
8888888888888888888888
888888888888:3
@$""""""""""
0000000
"22"""""""""""""<"<
"<""2"""""";""Zu33\
2v;2
88888
88888888888888888888888
TTxyxTzTTT{|}|~
% %0%@%P%`%p%
fr-FR
fr-BE
fr-CA
fr-CH
fr-LU
fr-MC
oc-FR
wo-SN
hu-HU
AEUETHssaeuethIJijOEoeD
LJLjljNJNjnj
DZDzdz
fffiflf
AUBqcccdcmc
dadBd
eVfmGBGyhaHgHPHzinIUk
kAKBkgKKk
kmKMk
kVkWktlmlnlxm
mAMBmbm
mgmmm
WmVMVmWMWnAnFnmnsnVnWoVPapApcpFPHPRpspVpWsrSvWbDbQpfnlslzAEaeAEaeaaAA
aoAOauAU
avAVavAVayAYooOOSSthTHthTHvyVYLLll
tk-TM
sah-RU
mk-MK
km-KH
tzm-Latn-DZ
co-FR
br-FR
moh-CA
rm-CH
arn-CL
hsb-DE
mi-NZ
ur-PK
ug-CN
sq-AL
hr-HR
sr-Latn-CS
sr-Cyrl-CS
hr-BA
bs-Latn-BA
sr-Latn-BA
sr-Cyrl-BA
sr-Cyrl-RS
sr-Cyrl-ME
sr-Latn-RS
sr-Latn-ME
fi-FI
sv-SE
sv-FI
se-SE
se-FI
smj-SE
sma-SE
sms-FI
smn-FI
cs-CZ
pl-PL
sl-SI
da-DK
kl-GL
nb-NO
nn-NO
se-NO
smj-NO
sma-NO
tr-TR
az-Latn-AZ
az-Cyrl-AZ
tr-TR_turkic
az-Latn-AZ_turkic
ro-RO
is-IS
hu-HU
hu-HU_technl
et-EE
lv-LV
lt-LT
sk-SK
es-ES_tradnl
es-ES
es-MX
es-GT
es-CR
es-PA
es-DO
es-VE
es-CO
es-PE
es-AR
es-EC
es-CL
es-UY
es-PY
es-BO
es-SV
es-HN
es-NI
es-PR
qut-GT
cy-GB
mt-MT
lo-LA
th-TH
vi-VN
as-IN
hi-IN
pa-IN
gu-IN
ta-IN
te-IN
kn-IN
mr-IN
sa-IN
kok-IN
bn-IN
bn-BD
ml-IN
or-IN
si-LK
a 4
ne-NP
bo-CN
x-IV_mathan
ja-JP_radstr
zh-TW
zh-HK
zh-TW_pronun
zh-CN_stroke
zh-SG_stroke
zh-MO_stroke
zh-CN
zh-SG
zh-MO
zh-TW_radstr
zh-HK_radstr
zh-MO_radstr
<
<
< #2
< +2
< 32
< 72
< ;2
< ?2
< C2
< G2
< K2
< O2
< S2
< W2
< [2
< _2
< c2
< g2
< k2
< o2
< s2
< w2
< {2
<
! <
" <
# <
$ <
% <
& <
' <
( <
* <
+ <
, <
- <
. <
/ <
0 <
2 <
3 <
5 <
6 <
7 <
8 <
9 <
` < '2
a < /2
<
<
< #2
< +2
< 32
< 72
< ;2
< ?2
< C2
< G2
< K2
< O2
< S2
< W2
< [2
< _2
< c2
< g2
< k2
< o2
< s2
< w2
< {2
<
! <
" <
# <
$ <
% <
& <
' <
( <
* <
+ <
, <
- <
. <
/ <
0 <
2 <
3 <
5 <
6 <
7 <
8 <
9 <
` < '2
a < /2
?
4
L
$4
<
@4
<
D4
<
H4
<
L4
<
P4
<
T4
<
X4
<
\4
<
`4
<
d4
<
h4
<
l4
!
<
p4
"
<
t4
#
<
x4
$
<
|4
%
<
&
<
'
<
(
<
*
<
+
<
,
<
-
<
.
<
/
<
0
<
2
<
3
<
5
<
6
<
8
<
84
9
<
<4
<
M
<
p
<
q
M
p
M
q
\
<
r
?
,4
r
@
04
r
G
44
s
A
s
B
s
K
M
?:
M
C:
M
G:
M
K:
M
O:
M
S:
M
W:
M
[:
M
_:
M
c:
M
g:
M
k:
!
M
o:
"
M
s:
#
M
w:
$
M
{:
%
M
&
M
'
M
(
M
*
M
+
M
,
M
-
M
.
M
/
M
0
M
1
M
2
M
3
M
4
M
5
M
6
M
7
M
8
M
9
M
<
M
<
M
p
<
M
q
<
<
< #
< +
< 3
< 7
< ;
< ?
< C
< G
< K
< O
< S
< W
< [
< _
< c
< g
< k
< o
< s
< w
< {
<
! <
" <
# <
$ <
% <
& <
' <
( <
* <
+ <
, <
- <
. <
/ <
0 <
2 <
3 <
5 <
6 <
7 <
8 <
9 <
` < '
a < /
arn-CL
as-IN
az-Cyrl-AZ
az-Latn-AZ
az-Latn-AZ_turkic
ba-RU
bn-BD
bn-IN
bo-CN
br-FR
bs-Latn-BA
co-FR
cs-CZ
cy-GB
da-DK
de-DE_phoneb
dv-MV
es-AR
es-BO
es-CL
es-CO
es-CR
es-DO
es-EC
es-ES
es-ES_tradnl
es-GT
es-HN
es-MX
es-NI
es-PA
es-PE
es-PR
es-PY
es-SV
es-UY
es-VE
et-EE
fa-IR
fi-FI
fy-NL
gu-IN
hi-IN
hr-BA
hr-HR
hsb-DE
hu-HU
hu-HU_technl
is-IS
ja-JP
ja-JP_radstr
ka-GE_modern
kk-KZ
kl-GL
km-KH
kn-IN
ko-KR
kok-IN
lo-LA
lt-LT
lv-LV
mi-NZ
mk-MK
ml-IN
moh-CA
mr-IN
mt-MT
nb-NO
ne-NP
nn-NO
or-IN
pa-IN
pl-PL
prs-AF
ps-AF
qut-GT
rm-CH
ro-RO
sa-IN
sah-RU
se-FI
se-NO
se-SE
si-LK
sk-SK
sl-SI
sma-NO
sma-SE
smj-NO
smj-SE
smn-FI
sms-FI
sq-AL
sr-Cyrl-BA
sr-Cyrl-CS
sr-Cyrl-ME
sr-Cyrl-RS
sr-Latn-BA
sr-Latn-CS
sr-Latn-ME
sr-Latn-RS
sv-FI
sv-SE
syr-SY
ta-IN
te-IN
th-TH
tk-TM
tr-TR
tr-TR_turkic
tt-RU
tzm-Latn-DZ
ug-CN
uk-UA
ur-PK
vi-VN
x-IV_mathan
zh-CN
zh-CN_stroke
zh-HK
zh-HK_radstr
zh-MO
zh-MO_radstr
zh-MO_stroke
zh-SG
zh-SG_stroke
zh-TW
zh-TW_pronun
zh-TW_radstr
true
@C
q
RELPATH
.config
30% tt Slip.exe
30% tt Slip.exe.config
file:
//?/
//./
\\?\
\\?/
\\.\
\\./
l_intl.nlp
length
capacity
L#
q
l_except.nlp
Service Pack 1
"<>|
"<>|
"<>|
:*?\/
http:
\\?\globalroot
( )
C:\Users\Bill\Desktop\
SHADOW_COPY_DIRS
CACHE_BASE
PRIVATE_BINPATH
DYNAMIC_BASE
APP_CONFIG_FILE
APP_NAME
APPBASE
APP_CONFIG_BLOB
BINPATH_PROBE_ONLY
CODE_DOWNLOAD_DISABLED
DEV_PATH
DISALLOW_APP
DISALLOW_APP_REDIRECTS
DISALLOW_APP_BASE_PROBING
FORCE_CACHE_INSTALL
config\machine.config
MACHINE_CONFIG
HOST_CONFIG
4(
q
4(
q
P*
q
*AllFiles*
*AllLocalFiles*
@C
q
P*
q
41
q
@C
q
System.Security.Permissions.IUnrestrictedPermission
@C
q
@C
q
-
qF
q(!T
84
q
WM_GETCONTROLNAME
WM_GETCONTROLTYPE
@C
q
authenticationMode
qd)T
Accelerator
Cursor
EnhancedMetaFile
Find
ComptibleHDC
Icon
Kernel
Menu
Window
oP,T
ol,T
@C
q
oL-T
o -T
-
qH
MouseZ
Magellan MSWHEEL
MSWHEEL_ROLLMSG
Alignment
Anchor
AutoScroll
AutoSize
Appearance
AutoEllipsis
BorderStyle
CellBorderStyle
Bounds
CheckAlign
ChildIndex
ColumnHeadersHeight
ColumnHeadersVisible
Columns
ColumnSpan
ColumnStyles
Controls
Dock
DisplayRectangle
DisplayStyle
DrawMode
DropDownButtonWidth
FlatAppearance.BorderSize
FlatStyle
FlowBreak
FlowDirection
Font
GripStyle
GrowStyle
Image
ImageIndex
ImageScaling
ImageScalingSize
ImageKey
ImageAlign
Items
LayoutSettings
LinkArea
Links
LayoutStyle
Location
Margin
MaximumSize
MinimumSize
Multiline
Orientation
PreferredSize
Padding
Parent
RightToLeft
RightToLeftLayout
RowHeadersVisible
RowHeadersWidth
Rows
RowSpan
RowStyles
Renderer
ScrollBars
Size
ShowDropDownArrow
ShowCheckMargin
Spring
Style
TableIndex
Text
TextAlign
TextImageRelation
UseCompatibleTextRendering
Visible
WordWrap
WrapContents
SecurityDemand
Trace when security demands occur.
00000000-0000-0000-C000-000000000046
DefWindowProcW
DefWindowProcA
user32.dll
Window.
WindowsForms10
.app.
WindowsForms10.Window.8.app.0.378734a
l7
q
name
H9
q
cultureName
culture.nlp
,:
q
CultureName
l7
q
,:
q
en-US
-
q
1
qHET
en-us
H9
q
,:
q8FT
en-US
\Globalization\
.nlp
C:\Windows
en-US
@C
q
H9
q
Infinity
-Infinity
@C
q
-Infinity
Infinity
Software\Microsoft\.NETFramework
DbgJITDebugLaunchSetting
DbgManagedDebugger
HKEY_LOCAL_MACHINE
HKEY_CURRENT_USER
HKEY_CLASSES_ROOT
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_CURRENT_CONFIG
HKEY_DYN_DATA
@C
q
od/T
WinFormsMouseEnter
WinFormsUnSubclass
P*
q
@C
q
value
Event
Event2
.rem
USERNAME
4Noq
System.EnterpriseServices.IRemoteDispatch
System.EnterpriseServices
file
\:*?"<>|
H9
q
@C
q
H9
q,RT
1f128a07-8438-4dc0-8205-570da0ccce8d1.0Map
AccessControl_MustSpecifyLeafObjectAcl
AccessControl_MustSpecifyContainerAcl
AccessControl_MustSpecifyNonDirectoryObjectAcl
AccessControl_MustSpecifyDirectoryObjectAcl
bindTo
port
secure
tokenimpersonationlevel
impersonate
.appDomain
LICENSE_FILE
LOADER_OPTIMIZATION
Server
Software\Microsoft\Windows NT\CurrentVersion
InstallationType
Client
Server Core
Embedded
settings
system.net
{0}/{1}
args
format
h:
q
<;
q
ks,\T
ksH\T
S
ql\T
@C
q
XS
qpPW
\?:*"<>|
\?:*"<>|
Config_error_loading_XML_file
h=
q
MACHINE/EXE
MACHINE
LOCAL_USER
ROAMING_USER
abcdefghijklmnopqrstuvwxyz012345
ks@aT
file:///
file://
file:
.config
http://
DataDirectory
user.config
C:\Users\Bill\Desktop\30% tt Slip.exe.config
C:\Users\Bill\Desktop\30% tt Slip.exe
http
https
file
gopher
nntp
news
mailto
uuid
telnet
ldap
net.tcp
net.pipe
vsmacros
-
qH
2
q%
i@bT
2
q%
p bT
p@bT
p\bT
pxbT
p4cT
0123456789ABCDEF
0123456789abcdef
MACHINE/EXE/ROAMING_USER/LOCAL_USER
MACHINE/EXE/ROAMING_USER
Config
machine.config
path2
path1
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config
H9
q
"
q(oT
1
q`oT
q,RT
1
qTpT
l7
q
zh-Hant
zh-Hans
Tm
q
Tm
q
-
q
-
q
@
qxsT
mode
access
rights
share
xmlns
XmlCharType.bin
http://www.w3.org/2000/xmlns/
http://www.w3.org/XML/1998/namespace
Xml_UnknownEncoding
ebcdic
MaxCharactersInDocument
XmlSerializeErrorDetails
MaxCharactersFromEntities
Xml_MissingRoot
Xml_UnexpectedEOF1
<?xml
Xml_InvalidXmlDecl
Xml_InvalidTextDecl
Xml_EncodingSwitchAfterResetState
UTF-16
UTF-8
version
encoding
standalone
Xml_InvalidVersionNumber
Xml_UnclosedQuote
Xml_UnexpectedEOF
Name
Xml_BadNameChar
Xml_BadStartNameChar
ucs-2
utf-16
iso-10646-ucs-2
ucs-4
Xml_MissingByteOrderMark
utf-8
D@
q
count
index
bytes
chars
charCount
charIndex
byteCount
byteIndex
DOCTYPE
<!--
CDATA[
Xml_InvalidRootData
Xml_BadDTDLocation
<[CDATA[
Xml_UnexpectedEndTag
Xml_MultipleRoots
Comment
CDATA
Xml_InvalidCommentChars
configuration
xmlns
http://schemas.microsoft.com/.NetConfiguration/v2.0
Config_namespace_invalid
configSections
1
q`
Q8?c
Xml_CDATAEndInText
remove
clear
name
type
sectionGroup
section
Config_tag_name_already_defined_at_this_level
Config_tag_name_already_defined
allowLocation
allowExeDefinition
allowDefinition
restartOnExternalChanges
requirePermission
overrideModeDefault
Xml_ExpectingWhiteSpace
appSettings
location
config
configProtectedData
Empty_attribute
System.Configuration.AppSettingsSection, System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
true
false
Config_invalid_boolean_attribute
connectionStrings
System.Configuration.ConnectionStringsSection, System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
mscorlib
System.Configuration.IgnoreSection, System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
runtime
System.Configuration.IgnoreSection, System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
assemblyBinding
System.Configuration.IgnoreSection, System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
satelliteassemblies
System.Configuration.IgnoreSection, System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
startup
System.Configuration.IgnoreSection, System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.codedom
System.CodeDom.Compiler.CodeDomConfigurationHandler, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.data
System.Data.Common.DbProviderFactoriesConfigurationHandler, System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.data.dataset
System.Configuration.NameValueFileSectionHandler, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.data.odbc
System.Data.Common.DbProviderConfigurationHandler, System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.data.oledb
System.Data.Common.DbProviderConfigurationHandler, System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.data.oracleclient
System.Data.Common.DbProviderConfigurationHandler, System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.data.sqlclient
System.Data.Common.DbProviderConfigurationHandler, System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.diagnostics
System.Diagnostics.SystemDiagnosticsSection, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.runtime.remoting
System.Configuration.IgnoreSection, System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.windows.forms
System.Windows.Forms.WindowsFormsSection, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
windows
System.Configuration.IgnoreSection, System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
Xml_BadAttributeChar
Xml_EntityRefNesting
Xml_InternalError
system.xml.serialization
System.Xml.Serialization.Configuration.SerializationSectionGroup, System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
System.ServiceModel.Configuration.BehaviorsSection, System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
schemaImporterExtensions
System.Xml.Serialization.Configuration.SchemaImporterExtensionsSection, System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.xml.serialization/schemaImporterExtensions
dateTimeSerialization
System.Xml.Serialization.Configuration.DateTimeSerializationSection, System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.xml.serialization/dateTimeSerialization
xmlSerializer
System.Xml.Serialization.Configuration.XmlSerializerSection, System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.xml.serialization/xmlSerializer
Config_base_unrecognized_element
system.net
System.Net.Configuration.NetSectionGroup, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
authenticationModules
System.Net.Configuration.AuthenticationModulesSection, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.net/authenticationModules
connectionManagement
System.Net.Configuration.ConnectionManagementSection, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.net/connectionManagement
defaultProxy
System.Net.Configuration.DefaultProxySection, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.net/defaultProxy
mailSettings
System.Net.Configuration.MailSettingsSectionGroup, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.net/mailSettings
smtp
System.Net.Configuration.SmtpSection, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.net/mailSettings/smtp
requestCaching
System.Net.Configuration.RequestCachingSection, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.net/requestCaching
settings
System.Net.Configuration.SettingsSection, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.net/settings
webRequestModules
System.Net.Configuration.WebRequestModulesSection, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.net/webRequestModules
system.transactions
System.Transactions.Configuration.TransactionsSectionGroup, System.Transactions, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, Custom=null
defaultSettings
System.Transactions.Configuration.DefaultSettingsSection, System.Transactions, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, Custom=null
system.transactions/defaultSettings
machineSettings
System.Transactions.Configuration.MachineSettingsSection, System.Transactions, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, Custom=null
MachineOnly
MachineToApplication
Everywhere
MachineToWebRoot
MachineToRoamingUser
MachineToLocalUser
system.transactions/machineSettings
system.web
System.Web.Configuration.SystemWebSectionGroup, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
anonymousIdentification
System.Web.Configuration.AnonymousIdentificationSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/anonymousIdentification
authentication
System.Web.Configuration.AuthenticationSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/authentication
authorization
System.Web.Configuration.AuthorizationSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/authorization
browserCaps
System.Web.Configuration.HttpCapabilitiesSectionHandler, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/browserCaps
clientTarget
System.Web.Configuration.ClientTargetSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/clientTarget
compilation
System.Web.Configuration.CompilationSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/compilation
customErrors
System.Web.Configuration.CustomErrorsSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/customErrors
deployment
System.Web.Configuration.DeploymentSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/deployment
deviceFilters
System.Web.Mobile.DeviceFiltersSection, System.Web.Mobile, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/deviceFilters
globalization
System.Web.Configuration.GlobalizationSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/globalization
healthMonitoring
System.Web.Configuration.HealthMonitoringSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/healthMonitoring
hostingEnvironment
System.Web.Configuration.HostingEnvironmentSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/hostingEnvironment
httpCookies
System.Web.Configuration.HttpCookiesSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/httpCookies
httpHandlers
System.Web.Configuration.HttpHandlersSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/httpHandlers
httpModules
System.Web.Configuration.HttpModulesSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/httpModules
httpRuntime
System.Web.Configuration.HttpRuntimeSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/httpRuntime
identity
System.Web.Configuration.IdentitySection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/identity
machineKey
System.Web.Configuration.MachineKeySection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/machineKey
membership
System.Web.Configuration.MembershipSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/membership
mobileControls
System.Web.UI.MobileControls.MobileControlsSection, System.Web.Mobile, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/mobileControls
pages
System.Web.Configuration.PagesSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/pages
processModel
System.Web.Configuration.ProcessModelSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/processModel
profile
System.Web.Configuration.ProfileSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/profile
protocols
System.Web.Configuration.ProtocolsSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/protocols
roleManager
System.Web.Configuration.RoleManagerSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/roleManager
securityPolicy
System.Web.Configuration.SecurityPolicySection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/securityPolicy
sessionPageState
System.Web.Configuration.SessionPageStateSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/sessionPageState
sessionState
System.Web.Configuration.SessionStateSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/sessionState
siteMap
System.Web.Configuration.SiteMapSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/siteMap
trace
System.Web.Configuration.TraceSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/trace
trust
System.Web.Configuration.TrustSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/trust
urlMappings
System.Web.Configuration.UrlMappingsSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/urlMappings
webControls
System.Web.Configuration.WebControlsSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/webControls
webParts
System.Web.Configuration.WebPartsSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/webParts
webServices
System.Web.Services.Configuration.WebServicesSection, System.Web.Services, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/webServices
xhtmlConformance
System.Web.Configuration.XhtmlConformanceSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/xhtmlConformance
caching
System.Web.Configuration.SystemWebCachingSectionGroup, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/caching
cache
System.Web.Configuration.CacheSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/caching/cache
outputCache
System.Web.Configuration.OutputCacheSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/caching/outputCache
outputCacheSettings
System.Web.Configuration.OutputCacheSettingsSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/caching/outputCacheSettings
sqlCacheDependency
System.Web.Configuration.SqlCacheDependencySection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.web/caching/sqlCacheDependency
system.webServer
System.Configuration.IgnoreSection, System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
system.runtime.serialization
System.Runtime.Serialization.Configuration.SerializationSectionGroup, System.Runtime.Serialization, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
6J"7
tF2I
1&D%
dataContractSerializer
System.Runtime.Serialization.Configuration.DataContractSerializerSection, System.Runtime.Serialization, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.runtime.serialization/dataContractSerializer
system.serviceModel
System.ServiceModel.Configuration.ServiceModelSectionGroup, System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
behaviors
system.serviceModel/behaviors
bindings
System.ServiceModel.Configuration.BindingsSection, System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.serviceModel/bindings
client
System.ServiceModel.Configuration.ClientSection, System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.serviceModel/client
comContracts
System.ServiceModel.Configuration.ComContractsSection, System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.serviceModel/comContracts
ks(!U
commonBehaviors
System.ServiceModel.Configuration.CommonBehaviorsSection, System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.serviceModel/commonBehaviors
diagnostics
System.ServiceModel.Configuration.DiagnosticSection, System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.serviceModel/diagnostics
extensions
System.ServiceModel.Configuration.ExtensionsSection, System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.serviceModel/extensions
machineSettings
System.ServiceModel.Configuration.MachineSettingsSection, SMDiagnostics, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.serviceModel/machineSettings
serviceHostingEnvironment
System.ServiceModel.Configuration.ServiceHostingEnvironmentSection, System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.serviceModel/serviceHostingEnvironment
services
System.ServiceModel.Configuration.ServicesSection, System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.serviceModel/services
system.serviceModel.activation
System.ServiceModel.Activation.Configuration.ServiceModelActivationSectionGroup, System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
ks<-U
diagnostics
System.ServiceModel.Activation.Configuration.DiagnosticSection, System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.serviceModel.activation/diagnostics
net.pipe
System.ServiceModel.Activation.Configuration.NetPipeSection, System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.serviceModel.activation/net.pipe
net.tcp
System.ServiceModel.Activation.Configuration.NetTcpSection, System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
system.serviceModel.activation/net.tcp
ksx4U
System.Configuration.ProtectedConfigurationSection, System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
Config_client_config_too_many_configsections_elements
Config_location_location_not_allowed
Config_unrecognized_configuration_section
Config_section_cannot_be_used_in_location
Config_sections_must_be_unique
Config_section_locked
configSource
Config_source_syntax_error
configProtectionProvider
Protection_provider_syntax_error
appSettings
system.diagnostics
connectionStrings
<?xml
<!DOCTYPE
PUBLIC
apos
quot
<configProtectedData defaultProvider="RsaProtectedConfigurationProvider">
<providers>
<add name="RsaProtectedConfigurationProvider" type="System.Configuration.RsaProtectedConfigurationProvider,System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" description="Uses RsaCryptoServiceProvider to encrypt and decrypt" keyContainerName="NetFrameworkConfigurationKey" cspProviderName="" useMachineContainer="true" useOAEP="false"/>
<add name="DataProtectionConfigurationProvider" type="System.Configuration.DpapiProtectedConfigurationProvider,System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" description="Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt" useMachineProtection="true" keyEntropy=""/>
</providers>
</configProtectedData>
system.net
<connectionStrings>
<add name="LocalSqlServer" connectionString="data source=.\SQLEXPRESS;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|aspnetdb.mdf;User Instance=true" providerName="System.Data.SqlClient"/>
</connectionStrings>
ks0HU
ks@IU
ksPJU
ks`KU
ROAMING_USER
LOCAL_USER
MACHINE/EXE
1
qpOU
MACHINE/EXE/ROAMING_USER
ks NU
ROAMING_USER
1
q$QU
MACHINE/EXE/ROAMING_USER/LOCAL_USER
ksDPU
LOCAL_USER
system.net/
kslUU
@C
q
8s q
0t q
@C
q
qtTU
dummy
q UU
@C
q
@C
q
@C
q
qlUU
@C
q
Q8?
q$WU
RFLCT.InvalidFieldFail
RFLCT.InvalidPropFail
Pv q
1
ql[U
performanceCounters
httpWebRequest
ipv6
servicePointManager
socket
webProxyScript
ks<]U
lock
ksl]U
lockAttributes
lockAllAttributesExcept
lockItem
lockElements
lockAllElementsExcept
@C
q
q `U
1
qxaU
@C
q
q4^U
+
qltU
1
qTcU
b<]U
alwaysUseCompletionPortsForConnect
alwaysUseCompletionPortsForAccept
ks,eU
<F
q
kstdU
<F
q
<F
q
+
qD
1
qXfU
@C
q
ks,dU
checkCertificateName
checkCertificateRevocationList
dnsRefreshTimeout
enableDnsRoundRobin
expect100Continue
useNagleAlgorithm
<F
q
<F
q
ks$hU
<F
q
ksXhU
<F
q
<F
q
+
qD
1
q<kU
@C
q
q(iU
ks@gU
enabled
<F
q
ksdlU
+
qD
1
qhmU
@C
q
ks lU
pl]U
maximumResponseHeadersLength
maximumErrorResponseLength
maximumUnauthorizedUploadLength
useUnsafeHeaderParsing
-
q@
-
q@
ks oU
<F
q
kspoU
+
qD
1
qTqU
@C
q
ks<nU
p<]U
downloadTimeout
+
q(tU
kslrU
ksHsU
+
qD
@C
q
ks(rU
@C
q
q0gU
<F
q
ksdlU
+
qD
@C
q
q@uU
XS
q
.NET CLR Networking
Connections Established
Bytes Received
Bytes Sent
Datagrams Received
Datagrams Sent
_Global_
Machine
Category
8)
q
XS
q
DYNIL
REMOTE
BINARY
SOAP
REMOTINGCHANNELS
CACHE
RESMGRFILEFORMAT
PERF
CORRECTNESS
MEMORYFAILPOINT
System.Diagnostics.PerformanceCounterPermission, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
84
q
{0}[{1}]
Phulli[2528]
,:
q0
-
q
H9
q
,:
q
C:\Windows
@C
q
H9
ql
:
qX
@C
q
-Infinity
Infinity
l7
q
H9
q
-
q
en-us
-
q
BILL-PC
bill-pc
bill-pc:009
SYSTEM\CurrentControlSet\Services\
\Performance
Library
netfxperf.dll
IsMultiInstance
First Counter
1
qX
.net clr networking
systemdiagnosticssharedsingleinstance
netfxcustomperfcounters.1.0
CategoryOptions
FileMappingSize
Counter Names
Global\
+
q0
h=
q
connections established
bytes received
bytes sent
datagrams received
datagrams sent
@C
q
Global\netfxcustomperfcounters.1.0.net clr networking
Global\.net clr networking
D:(A;OICI;FRFWGRGW;;;AU)(A;OICI;FRFWGRGW;;;S-1-5-33)
.net clr networking
1
q<
-
q
-
q
.net clr networking
.net clr networking
.net clr networking
.net clr networking
.net clr networking
.net clr networking
.net clr networking
.net clr networking
L }p@
L }p@
L }p
{0:x4}
127.0.0.1
System.Net.SocketPermission, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
@C
q
84
q
P*
q
<F
q
<F
q
4x#u
name
priority
port
1
q$
secure
True
False
\y#u
bindTo
machineName
suppressChannelData
useIpAddress
exclusiveAddressUse
impersonate
protectionLevel
rejectRemoteRequests
authorizationModule
255.255.255.255
0xff.0xff.0xff.0xff
0377.0377.0377.0377
127.0.0.1
\N
q
http
HO
q
tcp://
z#u
$%!u
TcpListener
maxdatasize
tracemode
@C
q
System.Net
System.Net.HttpListener
System.Net.Sockets
System.Net.Cache
@C
q
System.Configuration.Internal.ConfigurationManagerInternal, System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
XS
qX
system.diagnostics
@C
q
@C
q
assert
sources
sharedListeners
switches
trace
assertuienabled
logfilename
<F
q
+
qp
@C
q
+
qD
filemappingsize
@C
q
+
qD
1
qX
+
qD
+
qD
1
q@
+
qD
+
qD
+
qD
+
qD
listeners
autoflush
indentsize
useGlobalLock
+
qD
+
qD
<F
q
<F
q
+
qD
@C
q
+
qD
@C
q
+
q
1
qT
XS
q
@C
q
+
q,
+
qD
1
q8
XS
q
@C
q
Default
filter
name
traceOutputOptions
type
initializeData
+
q`
1
q$
@C
q
@C
q
System.Diagnostics.DefaultTraceListener
@C
q
+
qD
+
qD
1
q\
XS
q|
@C
q
@C
q
@C
q
Critical
Error
Warning
Information
Verbose
ActivityTracing
@C
q
+
qD
+
qD
XS
q4
@C
q
@C
q
@C
q
+
ql
@C
q
Socket
SetSocketOption
Start
Bind
127.0.0.1
DoBind
Listen
LocalEndPoint
@C
q
tcp://127.0.0.1:49171
BeginAcceptSocket
BeginAccept
@C
q
L }p
System.Diagnostics.Trace.CorrelationManagerSlot
qd)T
qd)T
Remoting_Channel_CannotBeSecured
q0w q
@C
q
4(
q
XAPPDMN
@C
q
5
q@
+
qD
property name
prop
LeaseLifeTimeServiceProperty
@C
q
aaef470e_c2f2_4f08_a0f4_e38ee8265c86
@C
q
p@*T
1
q|
1z+
eba8d1f1_440d_4576_864c_082cdec1a9a8
/eba8d1f1_440d_4576_864c_082cdec1a9a8/
/eba8d1f1_440d_4576_864c_082cdec1a9a8/
.rem
/eba8d1f1_440d_4576_864c_082cdec1a9a8/1f128a07-8438-4dc0-8205-570da0ccce8d1.0.rem
1f128a07-8438-4dc0-8205-570da0ccce8d1.0.rem
soap:
http://schemas.microsoft.com/clr/
http://schemas.microsoft.com/clr/assem/
http://schemas.microsoft.com/clr/ns/
http://schemas.microsoft.com/clr/nsassem/
1
q
1
q$
1
q(
1
q,
1
q0
@C
q
Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase+RemoteCommunicator, Microsoft.VisualBasic, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
@C
q
@C
q
1
qT
1
qX
1
q\
1
q`
@C
q
D:(A;;GA;;;CO)(A;;GR;;;AU)
/nosplash
-nosplash
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
84
q
GetType
GetHashCode
@C
q
@C
q
@C
q
@C
q
@C
q
@C
q
@C
q
RemoteActivationService.rem
Connect
/RemoteActivationService.rem
Remote
mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
@C
q
qXyU
Phulli, Version=1.0.0.0, Culture=neutral, PublicKeyToken=461d39c4a423da0b
Phulli.Form1, Phulli, Version=1.0.0.0, Culture=neutral, PublicKeyToken=461d39c4a42
Connect
/RemoteActivationService.rem
Remote
4(
q
@C
q
@C
q
@C
q
KEkFYvmbEFnLeY3I2F.4M76e2aSQk0wuKwgUC
h"
q
@C
q
@C
q
System\CurrentControlSet\Control\Lsa
FIPSAlgorithmPolicy
c|w{
9JLX
~=d]
2:
I
T`00P
V++}
L&&jl66Z~??A
Oh44\Q
sb11S*
RF##e
&N''i
X,,t4
v;;M
R)){
>^//q
,@ `
r99K
f33U
x<<D%
p88H
uB!!c
z==G
D""fT**~;
;d22Vt::N
H$$l
Cn77Y
J%%o\..r8
|>>Bq
j55_
P((x
Z--w
P`00
gg}V++
jL&&Zl66A~??
\h44
Sb11?*
eF##^
iN''
tX,,.4
RRMv;;a
{R))>
q^//
`@
Kr99
MMUf33
PPDx<<
Hp88
cB!!0
DD9.
~~Gz==
]]+2
fD""~T**
Vd22Nt::
lH$$
Yn77
xxoJ%%r\..$8
tt!>
ppB|>>
aa_j55
UUxP((z
wZ--
0P`0
g+}V+
&jL&6Zl6?A~?
4\h4
1Sb1
#eF#
'iN'
,tX,
R;Mv;
){R)
/q^/
`@
9Kr9J
M3Uf3
P<Dx<
8Hp8
!cB!
~=Gz=d
"fD"*~T*
2Vd2:Nt:
$lH$\
7Yn7m
x%oJ%.r\.
p>B|>
a5_j5W
U(xP(
-wZ-
00P`
++}V
=&&jL66Zl??A~
44\h
11Sb
##eF
''iN
,,tX
-6nn
;;Mv
})){R
//q^
`@
g99KrJJ
33Uf
<<Dx
!88Hp
!!cB
==Gzdd
+2ss
""fD**~T
22Vd::Nt
$$lH\\
77Ynmm
%%oJ..r\
!>KK
>>B|
55_jWW
3"ii
((xP
)--wZ
P~AeS
-Xt!
X>k'
Q3`bS
pHhX
|
G|B
lZrN
6-9'
$6.:
ZwKi
T~Fb
&x nY
*?#1
>8$4,
pHl\t
WBPQ
S~Ae
Xt!)I
Q3EbS
+XpHh
@Cwg
pNlZr
'6-9d
[T:$6.
iZwK
*C<"
Df;4[
bT~F
1*?#0
f7tN
,8$4_
(<IA
tHl\B
eS~A
U 0m
Xti)I
EbSw
hXpH
*fU(
H2+p
rNlZ
9'6-
!h\T
[.:$6g
KiZw
Df~4[
Bc"@
j_FbT~
#1*?
h4,8$@_
2\tHlWB
PQAeS~
U vm
Ebdw
HhXpE
y|
G
ZrNl
=-9'6
!h[T
6.:$
g
awKiZ
~4[C)v
j~FbT
1?#1*
[_=o
$4,8
l\tH
5
q V
Property can only be set to Nothing8
WinForms_RecursiveFormCreate4
WinForms_SeeInnerException
ot3KVzw2/7mOWk5pERhAz74r7/OVMU4e6VrOEutrwrbfDbtfeN81CpXPUZAEitM24VJersJUC30DFOZeqZCl1w==X
e45zmH/EeFQDWFWsUEa23UsTUTJnEjX4naorcI4EopY=X
U33lTFzMo8Y3Gu+LI/4e9cl0MLi3LyKCYZSDa2bKpCw=
900000
DAsaMA1AiWAMiX7/2niNpvJ+E0CcAZ0/P/PUZITbhX0UWQ8oMH0QOkPNxtwLtBAsX
wY0LEe9y+2yGXhDXmfDrHo+J8EmuP1ocrF5FrTuC1PY=X
3/BxGIs7loR7FQ9LFgYmxASj436ZcTD4lx8u+gtq6ug=
PN4TW3peZ3UeXi7asDB56E4dMEf6JrdkxXNUlrUjLlWcjHK1wZ5CpLZZKB/ocuFWy9Kw0Q8tIc1Qv7OEgqzD+w==
yesemail
noftp
nophp
clearie
clearff
bindfiles
downloadfiles
websitevisitor
websiteblocker
Disablenotify
DisableSSL
Disablefakerror
startup
screeny
clip$
DisableTaskManager
logger
stealers
Disablemelt
Disablereg
Disablecmd
Disablemsconfig
Disablespreaders
steam&
\Windows Update.exe
----[
]----
Form1
[ctrl]
[alt]
[ralt]
[shift]
[del]
[esc]
[/cap]
[cap]
[BS]
[BS]
[SS]
[/ctrl]
[/lalt]
[/ralt]
[/shift]
runas$
\WindowsUpdate.exe
Disablemelt
SysInfo.txt
SysInfo.txt
SysInfo.txt
SysInfo.txt
\pid.txt
\pid.txt
\pid.txt
\pidloc.txt
\pidloc.txt
\pidloc.txt
HawkEyeKeylogger
HawkEyeKeylogger
HawkEyeKeylogger
HawkEyeKeylogger
HawkEyeKeylogger
HawkEyeKeylogger
HawkEyeKeylogger
Disablestealers
Disablelogger
noftp
nophp
Disableclip$
\WindowsUpdate.exe
bindfiles
BSPLIT2
BSPLIT1
.exe
EBFile_
EBFile_
BFile_
BFile_
downloadfiles
http://
DFile_
.exe
http://
DFile_
.exe
websitevisitor
http://
dontclearie
dontclearff2
\Mozilla\Firefox\Profiles2
\Mozilla\Firefox\Profiles
cookie2
\Mozilla\Firefox\Profiles
cookie
websiteblocker$
\drivers\etc\hosts
127.0.0.1
Disablesteam
Disablespreaders
\Steam
\config"
\SteamAppData.vdf(
\ClientRegistry.blob
steam
Disablefakerror$
\WindowsUpdate.exe6
Microsoft Application Error
Disablelogger
True
False
Disableclip
True
False
Disablestealers
True
False
Dear HawkEye Customers!
This is an email notification generated by
after successful injection of your server.
Best Regards
Admin
HawkEye Logger Details:
Server Name: *
Keylogger Enabled: 8
Clipboard-Logger Enabled: J
Time Logs will be delivered: Every >
minutes
Stealers Enabled:
Time Log will be delivered: Average 2 to 4 minutes
Local Date and Time: ,
Installed Language: (
Operating System: .
Internal IP Address: .
External IP Address: 0
Installed Anti-Virus: ,
Installed Firewall:
Disablenotify
noftpL
HawkEye_Keylogger_Execution_Confirmed_
.txt
nophpL
HawkEye_Keylogger_Execution_Confirmed_
.txtT
HawkEye Keylogger | Execution Confirmed |
EnableSSL
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
autorun.inf
[autorun]
open=Sys.exe
action=Run win32
Sys.exe
autorun.inf
Sys.exe$
\WindowsUpdate.exe$
\WindowsUpdate.exeZ
Software\Microsoft\Windows\CurrentVersion\Run
Windows Update$
\WindowsUpdate.exe
CMemoryExecute
Runj
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
bitcoin
AppData&
\bitcoin\wallet.dat
AppData&
\bitcoin\wallet.dat
_wallet.dat
AppData&
\bitcoin\wallet.dat
wallet.dat
CMemoryExecute
system32T
Microsoft.NET\Framework\v2.0.50727\vbc.exe
/stext "
holdermail.txt"
holdermail.txt
holdermail.txt
holdermail.txt
==============================================
Operating System Intel Recovery
==============================================
PC Name:
Local Time: ,
Installed Language:
Net Version: :
Operating System Platform: 8
Operating System Version: (
Operating System: .
Internal IP Address: .
External IP Address: 0
Installed Anti-Virus: ,
Installed Firewall:
==============================================
WEB Browser Password Stealer
==============================================
==============================================
Mail Messenger Password Stealer
==============================================
==============================================
Internet Download Manager Stealer
==============================================
==============================================
JDownloader Password Stealer
==============================================
noftpD
HawkEye_Keylogger_Stealer_Records_
.txt
nophpD
HawkEye_Keylogger_Stealer_Records_
.txtL
HawkEye Keylogger | Stealer Records |
EnableSSL
CMemoryExecute
system32T
Microsoft.NET\Framework\v2.0.50727\vbc.exe
/stext "
holderwb.txt"
holderwb.txt
holderwb.txt
holderwb.txt
==============================================
Operating System Intel Recovery
==============================================
PC Name:
Local Time: ,
Installed Language:
Net Version: :
Operating System Platform: 8
Operating System Version: (
Operating System: .
Internal IP Address: .
External IP Address: 0
Installed Anti-Virus: ,
Installed Firewall:
==============================================
WEB Browser Password Stealer
==============================================
==============================================
Mail Messenger Password Stealer
==============================================
==============================================
Internet Download Manager Stealer
==============================================
==============================================
JDownloader Password Stealer
==============================================
noftpD
HawkEye_Keylogger_Stealer_Records_
.txt
nophpD
HawkEye_Keylogger_Stealer_Records_
.txtL
HawkEye Keylogger | Stealer Records |
EnableSSL
noftp
C:\Users\H
\AppData\Roaming\jagex_cache\regPin\
_Pin0.jpeg
C:\Users\H
\AppData\Roaming\jagex_cache\regPin\
_Pin0.jpeg
C:\Users\H
\AppData\Roaming\jagex_cache\regPin\
_Pin1.jpeg
C:\Users\H
\AppData\Roaming\jagex_cache\regPin\
_Pin2.jpeg
C:\Users\H
\AppData\Roaming\jagex_cache\regPin\
_Pin3.jpeg
C:\Users\H
\AppData\Roaming\jagex_cache\regPin\
_Pin4.jpeg
nophp
C:\Users\H
\AppData\Roaming\jagex_cache\regPin\
_Pin0.jpegP
HawkEye Keylogger | RuneScape Stealer |
Dear HawkEye Customers!
As you can see, this email has the attached file, containing RuneScape Bank Pins.
Best Regards
Admin
C:\Users\H
\AppData\Roaming\jagex_cache\regPin\
_Pin0.jpeg
C:\Users\H
\AppData\Roaming\jagex_cache\regPin\
_Pin1.jpeg
C:\Users\H
\AppData\Roaming\jagex_cache\regPin\
_Pin2.jpeg
C:\Users\H
\AppData\Roaming\jagex_cache\regPin\
_Pin3.jpeg
C:\Users\H
\AppData\Roaming\jagex_cache\regPin\
_Pin4.jpeg
EnableSSL
noftp
_wallet.dat
_wallet.dat
nophp
wallet.datL
HawkEye Keylogger | BitCoin Stealer |
Dear HawkEye Customers!
Steals the Wallet.DAT file that holds the users bitcoin currency.
Best Regards
Admin
wallet.dat
EnableSSL
noftp*
\.minecraft\lastlogin*
\.minecraft\lastlogin
nophp*
\.minecraft\lastloginP
HawkEye Keylogger | MineCraft Stealer |
Dear HawkEye Customers!
As you can see, this email has the attached file, containing MineCraft Username and Password. Please download it then decrypt the login credential / information with MineCraft Decryptor.
Best Regards
Admin*
\.minecraft\lastlogin
EnableSSL$
DisableTaskManager
Taskmgr$
DisableTaskManager
taskmgr
Disablecmd
Disablemsconfig
msconfig
Disablereg
regedit
DisablestartupJ
HawkEye Keylogger | Keylog Records |
==============================================
ClipBoard Records
==============================================
**********************************************
Keylog Records
==============================================
Disablescreeny
screens
screens$
screens\screenshot
.jpeg$
screens\screenshot
.jpeg
EnableSSL
==============================================
ClipBoard Records
==============================================
**********************************************
Keylog Records
==============================================
HawkEye_Keylogger_Keylog_Records_
.txt
Disablescreeny
screens
screens$
screens\screenshot
.jpeg$
screens\screenshot
.jpeg
ftp://
STOR
ftp://
STOR
==============================================
ClipBoard Records
==============================================
**********************************************
Keylog Records
==============================================
HawkEye_Keylogger_Keylog_Records_
.txt
?fname=
&data=
[--------
-------]
099u787978786:
http://whatismyipaddress.com/,
<!-- do not script -->,
<!-- do not script -->
&#46;
\root\SecurityCenter2<
SELECT * FROM AntivirusProduct
displayName
\root\SecurityCenter2:
SELECT * FROM FirewallProduct
displayName
win32_processor
processorID
Phulli.Resources
CMemoryExecute
mailpv$
WebBrowserPassView
x86h
:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
ot3KVzw2/7mOWk5pERhAz74r7/OVMU4e6VrOEutrwrbfDbtfeN81CpXPUZAEitM24VJersJUC30DFOZeqZCl1w==
e45zmH/EeFQDWFWsUEa23UsTUTJnEjX4naorcI4EopY=
U33lTFzMo8Y3Gu+LI/4e9cl0MLi3LyKCYZSDa2bKpCw=
900000
DAsaMA1AiWAMiX7/2niNpvJ+E0CcAZ0/P/PUZITbhX0UWQ8oMH0QOkPNxtwLtBAs
wY0LEe9y+2yGXhDXmfDrHo+J8EmuP1ocrF5FrTuC1PY=
3/BxGIs7loR7FQ9LFgYmxASj436ZcTD4lx8u+gtq6ug=
PN4TW3peZ3UeXi7asDB56E4dMEf6JrdkxXNUlrUjLlWcjHK1wZ5CpLZZKB/ocuFWy9Kw0Q8tIc1Qv7OEgqzD+w==
yesemail
noftp
nophp
clearie
clearff
bindfiles
downloadfiles
websitevisitor
websiteblocker
Disablenotify
DisableSSL
Disablefakerror
startup
screeny
clip
DisableTaskManager
logger
stealers
Disablemelt
Disablereg
Disablecmd
Disablemsconfig
Disablespreaders
steam
C:\Users\Bill\AppData\Local\Temp\
@C
q
Desktop
Programs
Personal
MyDocuments
Favorites
Startup
Recent
SendTo
StartMenu
MyMusic
DesktopDirectory
MyComputer
Templates
ApplicationData
LocalApplicationData
InternetCache
Cookies
History
CommonApplicationData
System
ProgramFiles
MyPictures
CommonProgramFiles
C:\Users\Bill\AppData\Roaming\Windows Update.exe
file
Config
machine.config
.appVPath
http://
https://
source
prefix
true
false
configuration
None
AllExceptIntranet
iriParsing
Reset
IgnoreComments
IgnoreWhitespace
IgnoreProcessingInstructions
Xml_DtdIsProhibitedEx
Xml_DoubleBaseUri
IO.IO_NoPermissionToDirectoryName
IO.FileNotFound_FileName
[Resource lookup failed - null or empty resource name]
mscorlib
[Resource lookup failed - infinite recursion or critical failure detected.]
@C
q
System.Resources.ResourceReader
System.Resources.RuntimeResourceSet
System.String[], mscorlib, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.DateTime[], mscorlib, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap, System.Drawing, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Imaging.Metafile, System.Drawing, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Point, System.Drawing, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.PointF, System.Drawing, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Size, System.Drawing, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.SizeF, System.Drawing, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Font, System.Drawing, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Icon, System.Drawing, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Color, System.Drawing, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Windows.Forms.Cursor, System.Windows.Forms, Culture=neutral, PublicKeyToken=b77a5c561934e089
System.Windows.Forms.Padding, System.Windows.Forms, Culture=neutral, PublicKeyToken=b77a5c561934e089
System.Windows.Forms.LinkArea, System.Windows.Forms, Culture=neutral, PublicKeyToken=b77a5c561934e089
System.Windows.Forms.ImageListStreamer, System.Windows.Forms, Culture=neutral, PublicKeyToken=b77a5c561934e089
@C
q
1
qD
.resources.dll
, Version=
, PublicKeyToken=
<invariant>
MissingManifestResource_NoNeutralDisk
baseName:
locationInfo:
<null>
.resources
@C
q
@C
q
h"
q
@d
q
De
q
J
qX^T
Dg
q
Object reference not set to an instance of an object.s being used by another process.yToken=b77a5c561934e089
Object reference not set to an instance of an object.s being used by another process.yToken=b77a5c561934e089
@C
q
Could not find file '{0}'.
$2fN
utf-8
C:\Users\Bill\Desktop\30% tt Slip.exe
30% tt Slip.exe
@C
q
WindowsForms10.Window.0.app.0.378734a
Phulli.Resources
1
q`
CMemoryExecute
/configuration/satelliteassemblies
assembly
zh-CHT
zh-CHS
l7
qp
l7
q
H9
q
-
q
-
q
h"
q
@d
q|
c
q4
J
qX^T
Dg
q
System.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
System.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
@C
q
!This program cannot be run in DOS mode.
$
.text
`.rsrc
@.reloc
I MZ
K PE
XKnX(
XKn(
XKXT
BSJB
v2.0.50727
#Strings
#GUID
#Blob
<Module>
CMemoryExecute.dll
CMemoryExecute
mscorlib
System
Object
CONTEXT_FULL
CREATE_SUSPENDED
MEM_COMMIT
MEM_RESERVE
PAGE_EXECUTE_READWRITE
IMAGE_DOS_SIGNATURE
IMAGE_NT_SIGNATURE
.ctor
CreateProcess
VirtualAllocEx
NtUnmapViewOfSection
NtWriteVirtualMemory
NtGetContextThread
NtSetContextThread
NtResumeThread
exeBuffer
hostProcess
optionalArguments
lpApplicationName
lpCommandLine
lpProcessAttributes
lpThreadAttributes
bInheritHandles
dwCreationFlags
lpEnvironment
lpCurrentDirectory
lpStartupInfo
lpProcessInfo
hProcess
lpAddress
dwSize
flAllocationType
flProtect
lpBaseAddress
lpBuffer
nSize
lpNumberOfBytesWritten
hThread
lpContext
SuspendCount
System.Reflection
AssemblyTitleAttribute
AssemblyDescriptionAttribute
AssemblyConfigurationAttribute
AssemblyCompanyAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyTrademarkAttribute
AssemblyCultureAttribute
System.Runtime.InteropServices
ComVisibleAttribute
GuidAttribute
AssemblyVersionAttribute
AssemblyFileVersionAttribute
System.Security.Permissions
SecurityPermissionAttribute
SecurityAction
System.Diagnostics
DebuggableAttribute
DebuggingModes
System.Runtime.CompilerServices
CompilationRelaxationsAttribute
RuntimeCompatibilityAttribute
Byte
Int32
Buffer
Array
BlockCopy
String
IsNullOrEmpty
Concat
IntPtr
Zero
op_Explicit
op_Equality
DllImportAttribute
kernel32.dll
ntdll.dll
System.Security
UnverifiableCodeAttribute
CMemoryExecute
Copyright
2012
$8fcd4931-91a2-4e18-849b-70de34ab75df
1.0.0.0
WrapNonExceptionThrows
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
SkipVerification
RSDS
C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb
_CorDllMain
mscoree.dll
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
FileDescription
CMemoryExecute
FileVersion
1.0.0.0
InternalName
CMemoryExecute.dll
LegalCopyright
Copyright
2012
OriginalFilename
CMemoryExecute.dll
ProductName
CMemoryExecute
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0
Bill
+
q(
@C
q
Form1
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
MS UI Gothic
Tahoma
DefaultFont
P*
q
Menu
Window
Accelerator
Cursor
EnhancedMetaFile
Find
Icon
Kernel
@C
q
GdiPlusInitialization
Tracks GDI+ initialization and teardown
GdiPlusIgnoreAtom
Ignores the use of global atoms for startup/shutdown
Gdiplus.dll
GDI+Atom
GDI+Atom_2528_1
q8+T
-
q8
~)OOK
Htk-E
W>WZ
a-<Uu
.NET SystemEvents
2.0.0.0
.NET-BroadcastEventWindow.{0}.{1}.{2}
.NET-BroadcastEventWindow.2.0.0.0.378734a.0
L }p
L }p
@C
q
p@*T
@C
q
000C060B-0000-0000-C000-000000000046
{000C0601-0000-0000-C000-000000000046}
o8+T
wfc.ico
""""""""""""""""""""""""""""""""
"("""(
"("""(
"("""(
nnnnn
"("""(
"("""(
nnnnn
"("""(
nnnnn
YYYY
YYYY
333333338
YYYY
YYYY
YYYY
"""""(?
"""""(?
"""""(?
"""""(?
"""""(?
"""""(333333338
""""""""""""""""
""""""""
3338
3338
6;;;777763
7__;;777767
:____;;;777676
_cc_c__;;;;777
_c____;_;7
c___;;;
HLL(H%()$(
cccc_c__6
___^____:[67676
||||||T|TxTTTTT
||||||||||
7c_;
^ c_6
LLLH
_____
p ||T
@C
q
XC
q
encoding
stream
(A
q
path
SHA1
nonny-killers@yandex.com
encoding
stream
(A
q
path
C:\Users\Bill\AppData\Roaming
\pidloc.txt
C:\Users\Bill\AppData\Roaming\pidloc.txt
C:\Users\Bill\AppData\Roaming
\pidloc.txt
C:\Users\Bill\AppData\Roaming\pidloc.txt
HawkEyeKeylo
SHA1
nonny-killers@yandex.com
HawkEyeKeylo4
hans1234
smtp.yandex.com
ftp.yourhost.com
YourUsername
YourPassword
http://www.site.com/logs.php
@C
q
@C
q
@C
q
@C
q
@C
q
q8-W
GetHostEntry
GetHostByName
192.168.1.101
codepages.nlp
NLS_CodePage_{0}_{1}_{2}_{3}_{4}
4J
q
http://whatismyipaddress.com/
DownloadString
net_webclient
DownloadData
1
q`1W
@C
q
L }p
@C
q
q(!T
WebRequest
Create
webRequestModules
q`3W
@C
q
ql4W
@C
q
ks,5W
ks(6W
@C
q
qD5W
1
qx6W
https:
http:
file:
ftp:
+
qD<W
ksl8W
+
qD
XS
qx5W
@C
q
qx9W
prefix
@C
q
@C
q
@C
q
q0<W
+
qT>W
kst=W
@C
q
ks(7W
@C
q
ks(7W
ksh?W
ks$@W
+
qHAW
1
qt@W
@C
q
ksD7W
@C
q
q8AW
pH?W
kshAW
ksD7W
1
q$CW
@C
q
q0BW
ks`7W
@C
q
ks`7W
+
qxDW
@C
q
p(7W
pD7W
p`7W
XS
q
HTTP/
q4EW
pTEW
}p
-
q^
HttpWebRequest
defaultProxy
qXGW
@C
q
@C
q
module
bypasslist
proxy
useDefaultCredentials
kslHW
<F
q
ksdlU
<F
q
ks4KW
@C
q
q0IW
autoDetect
scriptLocation
bypassonlocal
proxyaddress
usesystemdefault
ksXMW
+
q@PW
kshLW
ks`OW
+
qD
@C
q
XS
q
@C
q
+
qxRW
+
qD
@C
q
q4QW
XS
q
plHW
+
qD
ks|SW
+
qD
XS
qdIW
pTUW
Unknown error (0x
pdVW
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
requestCaching
ks0ZW
qpZW
@C
q
q0ZW
@C
q
defaultHttpCachePolicy
defaultFtpCachePolicy
defaultPolicyLevel
disableAllCaching
isPrivateCache
unspecifiedMaximumAge
+
q$_W
<F
q
ks<\W
<F
q
ksp\W
ksT_W
ks,[W
@C
q
+
q\fW
P{["
maximumAge
maximumStale
minimumFresh
policyLevel
ks,cW
ksXcW
ks eW
+
qD
1
qpeW
@C
q
XS
q4]W
@C
q
qLfW
+
q4hW
ksTgW
+
qD
@C
q
XS
q|]W
ks|fW
CONNECT
HEAD
POST
MKCOL
p0kW
!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
p0iW
pLiW
pdiW
p0iW
pLiW
pdiW
Content-Type
Accept
Connection
Expect
Referer
User-Agent
GetResponse
EndGetResponse
Transfer-Encoding
@C
q
@C
q
0
q`mW
}p8k{p
q`mW
qd)T
qd)T
q`W q
q W q
TimerThread#
::ThreadProc() - Exception:
TimerThreadTimer#
::Fire() -
net_log_exception_in_callback
localhost
loopback
whatismyipaddress.com
@C
q
net_log_proxy_script_execution_error
net_log_proxy_autodetect_script_location_parse_error
net_log_proxy_autodetect_failed
/.NET/NetClasses/HttpWebRequest/CONNECT__Group$$/
p<tW
://proxy
http://whatismyipaddress.com
connectionManagement
q$uW
@C
q
q0vW
@C
q
2
q/
{m[
ks0yW
ks,zW
@C
q
qHyW
1
q|zW
+
qD
+
qD
XS
q|yW
@C
q
1
q(}W
1
qp~W
Host
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
& !
Bill-PC
@C
q
HTTP/1.1 403 Forbidden
Date: Fri, 24 Aug 2018 16:38:12 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d8e97abac85c9d73cc24dd5ae90a3bddc1535128692; expires=Sat, 24-Aug-19 16:38:12 GMT; path=/; domain=.whatismyipaddress.com; HttpOnly
Cache-Control: max-age=15
Expires: Fri, 24 Aug 2018 16:38:27 GMT
X-Frame-Options: SAMEORIGIN
Server: cloudflare
CF-RAY: 44f73f77b4e286b5-ARN
64
Access Denied (CF1). Scripted access not permitted. Please contact support@whatismyipaddress.com.
0
+
qD
+
q|
Continue
Unauthorized
}pH
@C
q
@C
q
InternalResolveFast
whatismyipaddress.com
@C
q
net_log_retrieving_localhost_exception
net_log_resolved_servicepoint_may_not_be_remote_server
tsrR~
@C
q
q8~W
Connect
Close
Dispose
Content-Length
Accept-Encoding
Keep-Alive
Proxy-Connection
chunked
100-continue
gzip, deflate
gzip
deflate
Request:
Accept-Ranges
Cache-Control
Date
Expires
ETag
Last-Modified
Location
Proxy-Authenticate
Set-Cookie2
Set-Cookie
WWW-Authenticate
X-AspNet-Version
X-Powered-By
Allow
Authorization
Accept-Charset
Accept-Language
Cookie
Content-MD5
Content-Range
Content-Encoding
Content-Language
Content-Location
From
If-Match
If-Range
If-None-Match
If-Modified-Since
If-Unmodified-Since
Max-Forwards
Pragma
Proxy-Authorization
Range
Retry-After
Trailer
Upgrade
Vary
Warning
}p<&
1
q0
Q8?4
ta\lW
@C
q
h=
q
}p m|p
}p0m|p
net_log_sending_headers
net_connclosed
Send
net_requestaborted
Receive
net_log_received_status_line
net_log_received_headers
microsoft-iis
Bad Request ( The HTTP request includes a non-supported header. Contact the Server administrator. )
HTTP/
Forbidden
@C
q
Fri, 24 Aug 2018 16:38:12 GMT
text/html; charset=UTF-8
chunked
Transfer-Encoding
@C
q
@C
q
keep-alive
Connection
+
qD
@C
q
__cfduid=d8e97abac85c9d73cc24dd5ae90a3bddc1535128692; expires=Sat, 24-Aug-19 16:38:12 GMT; path=/; domain=.whatismyipaddress.com; HttpOnly
max-age=15
Fri, 24 Aug 2018 16:38:27 GMT
SAMEORIGIN
X-Frame-Options
+
qt
@C
q
cloudflare
44f73f77b4e286b5-ARN
CF-RAY
+
q4
@C
q
keep-alive
close
ConnectStream
net_log_buffered_n_bytes
net_log_cache_validation_failed_resubmit
net_log_cache_refused_server_response
net_cache_not_accept_response
net_servererror
net_tooManyRedirections
net_resubmitprotofailed
net_redirect_perm
net_resubmitcanceled
net_log_server_response_error_code
net_need_writebuffering
net_log_resubmitting_request
net_httpstatuscode_
@C
q
:
qh
n
q.
@C
q.
Continue
SwitchingProtocols
Created
Accepted
NonAuthoritativeInformation
NoContent
ResetContent
PartialContent
MultipleChoices
Ambiguous
MovedPermanently
Moved
Found
Redirect
SeeOther
RedirectMethod
NotModified
UseProxy
Unused
TemporaryRedirect
RedirectKeepVerb
BadRequest
Unauthorized
PaymentRequired
Forbidden
NotFound
MethodNotAllowed
NotAcceptable
ProxyAuthenticationRequired
RequestTimeout
Conflict
Gone
LengthRequired
PreconditionFailed
RequestEntityTooLarge
RequestUriTooLong
UnsupportedMediaType
RequestedRangeNotSatisfiable
ExpectationFailed
InternalServerError
NotImplemented
BadGateway
ServiceUnavailable
GatewayTimeout
HttpVersionNotSupported
net_httpstatuscode_Forbidden
System
h"
q
@d
q$
J
qX^T
Dg
q
The request was aborted: {0}. error: {0}., Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
The request was aborted: {0}. error: {0}., Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
@C
q
Forbidden
The remote server returned an error: {0}.
Read
net_timeout
@C
q
Abort
@C
q
net_webstatus_
@C
q
Success
NameResolutionFailure
ConnectFailure
ReceiveFailure
SendFailure
PipelineFailure
RequestCanceled
ProtocolError
ConnectionClosed
TrustFailure
SecureChannelFailure
ServerProtocolViolation
KeepAliveFailure
Pending
Timeout
ProxyNameResolutionFailure
UnknownError
MessageLengthLimitExceeded
CacheEntryNotFound
RequestProhibitedByCachePolicy
RequestProhibitedByProxy
net_webstatus_RequestCanceled
The request was canceled
The request was aborted: {0}.
@g^=
_\QV
1
q<
COMPUTERNAME
51372AE0-CAE7-11CF-BE81-00AA00A2FA25
000001ce-0000-0000-C000-000000000046
@C
q
qd)T
qd)T
@C
q
//./root/cimv2
root
Delete
\wminet_utils.dll
ResetSecurity
SetSecurity
BlessIWbemServices
BlessIWbemServicesObject
GetPropertyHandle
WritePropertyValue
Clone
VerifyClientKey
GetQualifierSet
GetNames
BeginEnumeration
Next
EndEnumeration
GetPropertyQualifierSet
GetObjectText
SpawnDerivedClass
SpawnInstance
CompareTo
GetPropertyOrigin
InheritsFrom
GetMethod
PutMethod
DeleteMethod
BeginMethodEnumeration
NextMethod
EndMethodEnumeration
GetMethodQualifierSet
GetMethodOrigin
QualifierSet_Get
QualifierSet_Put
QualifierSet_Delete
QualifierSet_GetNames
QualifierSet_BeginEnumeration
QualifierSet_Next
QualifierSet_EndEnumeration
GetCurrentApartmentType
GetDemultiplexedStub
CreateInstanceEnumWmi
CreateClassEnumWmi
ExecQueryWmi
ExecNotificationQueryWmi
PutInstanceWmi
PutClassWmi
CloneEnumWbemClassObject
ConnectServerWmi
C:\Windows\Microsoft.NET\Framework\v2.0.50727\\wminet_utils.dll
p"1j
<o0 X
<od X
<o4
X
<oh
X
InvalidOperation_SwitcherCtxMismatch
ExecutionContext_UndoFailed
p(2W
@C
q
q(!T
q4
X
qd)T
@C
q
Unknown
String
ExpandString
Binary
DWord
MultiString
QWord
o
qD
qd)T
qd)T
qd)T
qd)T
mailpv
qd)T
qd)T
<;
q
l7
q
M/d/yyyy
dddd, MMMM dd, yyyy
MMMM, yyyy
h:mm:ss tt
0000
00000
000000
0000000
dDfFgGmMoOrRstTuUyY
@C
q
yyyy'-'MM'-'ddTHH':'mm':'ss zzz
yyyy'-'MM'-'dd'T'HH':'mm':'ss.fffffffK
ddd, dd MMM yyyy HH':'mm':'ss 'GMT'
yyyy'-'MM'-'dd'T'HH':'mm':'ss
yyyy'-'MM'-'dd HH':'mm':'ss'Z'
M/d/yyyy h:mm:ss tt
l7
q
Name
Win32_OperatingSystem
select
qd)T
from
select * from meta_class
where
@C
q
1
q0
System.Void
Handle Count
Pool Paged Bytes
Pool Nonpaged Bytes
Elapsed Time
Virtual Bytes Peak
Virtual Bytes
Private Bytes
Page File Bytes
Page File Bytes Peak
Working Set Peak
Working Set
ID Thread
ID Process
Priority Base
Priority Current
% User Time
% Privileged Time
Start Address
Thread State
Thread Wait Reason
2
q/
w\"X
,("X
\SystemRoot\System32\smss.exe
smss.exe
\\?\
+
q,'X
@C
q
destFileName
sourceFileName
Argument_EmptyFileName
SeDebugPrivilege
qd,X
qd)T
qd)T
UnicodeText
DeviceIndependentBitmap
Bitmap
EnhancedMetafile
MetaFilePict
SymbolicLink
DataInterchangeFormat
TaggedImageFileFormat
OEMText
Palette
PenData
RiffAudio
WaveAudio
FileDrop
Locale
HTML Format
Rich Text Format
PersistentObject
System.String
WindowsForms10PersistentObject
@C
q
Ipx;T
Ip`.X
IpH/X
Ip .X
Ip,0X
IpP0X
[--------5:38:12 PM-------]
Quarantine
@C
q
@C
q
IO.IO_SharingViolation_File
The process cannot access the file '{0}' because it is being used by another process.
Idle
.exe
_ThreadCallbackMessage
q\5X
@C
q
WindowsForms12
qD6X
WebBrowserPassView
__GENUS
DC12A681-737F-11CF-884D-00AA004B2E24
System.Management.IWbemClassObjectFreeThreaded
__path
__PATH
__RELPATH
q$8X
q|8X
qd)T
qd)T
file:///C:/Users/Bill/Desktop/30% tt Slip.exe
Phulli
ql:X
@C
q
qD:X
RSA1
Q^U[A
cbWRVD
.{dx
x[3(
,3$U
XS
q(<X
@C
q
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
/stext "C:\Users\Bill\AppData\Local\Temp\holdermail.txt"
op_Explicit
op_Implicit
op_True
op_False
op_UnaryNegation
op_OnesComplement
op_UnaryPlus
op_Addition
op_Subtraction
op_Multiply
op_Division
op_Exponent
op_IntegerDivision
op_Concatenate
op_LeftShift
op_RightShift
op_Modulus
op_BitwiseOr
op_ExclusiveOr
op_BitwiseAnd
op_Like
op_Equality
op_Inequality
op_LessThan
op_LessThanOrEqual
op_GreaterThanOrEqual
op_GreaterThan
CType
IsTrue
IsFalse
Like
@C
q
@C
q
@C
q
@C
q
@C
q
@C
q
@C
q
System.__ComObject
@C
q
@C
q
@C
q
NoViableOverloadCandidates1
NoArgumentCountOverloadCandidates1
NoTypeArgumentCountOverloadCandidates1
ArgumentMismatch3
OmittedArgument1
NamedParamNotFound2
NamedParamArrayArgument1
NamedArgUsedTwice2
OmittedParamArrayArgument
ArgumentNarrowingCopyBack3
ArgumentNarrowing3
ArgumentMismatchAmbiguousCopyBack3
ArgumentMismatchAmbiguous3
ArgumentMismatchCopyBack3
0-udJX
pxMX
<rnq
<rnq
<rnq
<rnq
<rnq
<rnq
<rnq
<rnq
<rnq
<rnq
<rnq
<rnq
<rnq
<rnq
<rnq
<rnq
<rnq
<rnq
<rnq
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
==================================================
Name : Bill Outlook
Application : MS Outlook 2002/2003/2007/2010
Email : bill@outlook.local
Server : pop.gmail.com
Server Port :
Secured : No
Type : POP3
User : bill_outlook
Password : bill_outlook
Profile : Outlook
Password Strength : Very Weak
SMTP Server : smtp.gmail.com
SMTP Server Port :
==================================================
qd)T
file:///C:/Users/Bill/Desktop/30% tt Slip.exe
Phulli
+
q dX
@C
q
qLdX
RSA1
Q^U[A
cbWRVD
.{dx
x[3(
,3$U
XS
q
p fX
@C
q
-
q\
C:\Users\Bill\AppData\Local\Temp\holderwb.txt
2.0.50727.5420
@C
q
q<jX
Win32S
Win32Windows
Win32NT
WinCE
Unix
Xbox
MacOSX
==============================================
Operating System Intel Recovery
==============================================
PC Name: BILL-PC
Local Time: 8/24/2018 5:38:26 PM
Installed Language: en-US
Net Version: 2.0.50727.5420
Operating System Platform: Win32NT
Operating System Version: 6.1.7601.65536
Operating System: Microsoft Windows 7 Professional
Internal IP Address: 192.168.1.101
External IP Address:
Installed Anti-Virus:
Installed Firewall:
==============================================
WEB Browser Password Stealer
==============================================
==============================================
Mail Messenger Password Stealer
==============================================
==================================================
Name : Bill Outlook
Application : MS Outlook 2002/2003/2007/2010
Email : bill@outlook.local
Server : pop.gmail.com
Server Port :
Secured : No
Type : POP3
User : bill_outlook
Password : bill_outlook
Profile : Outlook
Password Strength : Very Weak
SMTP Server : smtp.gmail.com
SMTP Server Port :
==================================================
==============================================
Internet Download Manager Stealer
==============================================
==============================================
JDownloader Password Stealer
==============================================
qX{X
}p8
mailSettings
smtp
{0}/{1}/{2}
@C
q
@C
q
from
network
specifiedPickupDirectory
deliveryMethod
+
qP
ks\~X
@C
q
86;9
host
port
defaultCredentials
clientDomain
password
userName
targetName
+
q|
<F
q
Validation_scalar_range_violation_not_different
Validation_scalar_range_violation_not_equal
Validation_scalar_range_violation_not_outside_range
Validation_scalar_range_violation_not_in_range
+
qD
@C
q
XS
q
@C
q
pickupDirectoryLocation
+
qD
1
qp
@C
q
XS
q`
.ctor
host=
SmtpClient
SMTPSVC/
1
q<
@C
q
1
q0
@C
q
@C
q
MailAddressInvalidFormat
MailAddressUnsupportedFormat
@C
q
__CLASS
T%=o
@C
q
Arg_NullReferenceException
Object reference not set to an instance of an object.
qd)T
@C
q
C:\Users\Bill\AppData\Roaming
+
q\
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
'$'n
n'$'
'$' n
n '$'
('$'n)
-'$'n
'$'-n
'$'n-
(n'$')
-n'$'
n-'$'
n'$'-
-n '$'
-'$' n
n '$'-
'$' n-
'$'- n
n- '$'
('$' n)
(n '$')
@C
q
@C
q
@C
q
suffix
*Local Area Connection
[Capturing from Local Area Connection - 8/24/2018 5:44:16 PM]
iuc[BS][BS]cmp6[BS][V]
[*Local Area Connection - 8/24/2018 5:44:24 PM]
nbns
C:\Users\Bill\AppData\Roaming
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
[--------5:38:12 PM-------]
Quarantine
[--------5:51:45 PM-------]
16e2cffd014f97d85058154e8f4d31c4
C:\Users\Bill\AppData\Roaming
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q|
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qp
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qd
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qt
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qX
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qh
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qL
C:\Users\Bill\AppData\Roaming
@C
q
*
q|
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q|
@C
q
+
q\
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q@
C:\Users\Bill\AppData\Roaming
@C
q
*
qp
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qp
@C
q
+
qP
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q4
C:\Users\Bill\AppData\Roaming
@C
q
*
qd
@+
q|
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qd
@C
q
+
qD
@C
q
*
qt
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q(
C:\Users\Bill\AppData\Roaming
@C
q
*
qX
@+
qp
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qX
@C
q
+
q8
@C
q
*
qh
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qL
@+
qd
+
q|
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qL
@C
q
+
q,
@C
q
*
q\
@+
qt
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q@
@+
qX
+
qp
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q@
@C
q
+
q
@C
q
*
qP
@+
qh
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q4
@+
qL
+
qd
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q4
@C
q
@C
q
*
qD
@+
q\
+
qt
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q(
@+
q@
+
qX
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q(
@C
q
@C
q
*
q8
@+
qP
+
qh
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q4
Y
+
qL
Y
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q,
@+
qD
+
q\
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q(
+
q@
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q
@+
q8
+
qP
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q4
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q,
+
qD
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q(
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q !Y
+
q8!Y
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qp%Y
@+
q
@C
q
qp%Y
@C
q
qp%Y
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q,(Y
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qd,Y
@+
q
@C
q
qd,Y
@C
q
qd,Y
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q /Y
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qX3Y
@+
q
@C
q
qX3Y
@C
q
qX3Y
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qL:Y
@+
q
@C
q
qL:Y
@C
q
qL:Y
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q|>Y
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q@AY
@+
q
@C
q
q@AY
@C
q
q@AY
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qpEY
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q4HY
@+
q
@C
q
q4HY
@C
q
q4HY
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qdLY
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qtOY
C:\Users\Bill\AppData\Roaming
@C
q
q(OY
@+
q
@C
q
q(OY
@C
q
q(OY
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qXSY
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qtUY
+
qhVY
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qxXY
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qLZY
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qh\Y
+
q\]Y
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
ql_Y
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q@aY
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q\cY
+
qPdY
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q`fY
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q4hY
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qPjY
+
qDkY
C:\Users\Bill\AppData\Roaming
@C
q
*
qtkY
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qtmY
@C
q
+
qTmY
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q(oY
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qDqY
+
q8rY
C:\Users\Bill\AppData\Roaming
@C
q
*
qhrY
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qtsY
/
qhtY
@C
q
qtsY
+
qHtY
@C
q
qtsY
*
qxtY
@+
q
@C
q
qtsY
@C
q
qtsY
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q8xY
+
q,yY
C:\Users\Bill\AppData\Roaming
@C
q
*
q\yY
@+
qtyY
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qhzY
/
q\{Y
@C
q
qhzY
+
q<{Y
@C
q
qhzY
*
ql{Y
@+
q
@C
q
qhzY
@C
q
qhzY
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qP
@+
qh
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qP
@C
q
+
q0
@C
q
*
q`
@+
qx
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qD
@+
q\
+
qt
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qD
@C
q
+
q$
@C
q
*
qT
@+
ql
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q8
@+
qP
+
qh
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q8
@C
q
@C
q
*
qH
@+
q`
+
qx
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q,
@+
qD
+
q\
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q,
@C
q
@C
q
*
q<
@+
qT
+
ql
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q
@+
q8
+
qP
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q
@C
q
@C
q
*
q0
@+
qH
+
q`
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q,
+
qD
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q$
@+
q<
+
qT
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q8
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q0
+
qH
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q,
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q$
+
q<
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q0
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q$
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qx
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
ql
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q|
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q`
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qp
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qT
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qd
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qH
C:\Users\Bill\AppData\Roaming
@C
q
*
qx
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qx
@C
q
+
qX
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q<
C:\Users\Bill\AppData\Roaming
@C
q
*
ql
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
ql
@C
q
+
qL
@C
q
*
q|
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q<
Z
+
q0
C:\Users\Bill\AppData\Roaming
@C
q
*
q`
@+
qx
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q`
Z
@C
q
+
q@
Z
@C
q
*
qp
Z
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q$
C:\Users\Bill\AppData\Roaming
@C
q
*
qT
@+
ql
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qT
@C
q
+
q4
@C
q
*
qd
@+
q|
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qH
@+
q`
+
qx
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qH
@C
q
+
q(
@C
q
*
qX
@+
qp
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q< Z
@+
qT Z
+
ql Z
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qH!Z
/
q<"Z
@C
q
qH!Z
@C
q
qH!Z
*
qL"Z
@+
qd"Z
+
q|"Z
@C
q
qH!Z
@C
q
qH!Z
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q0'Z
@+
qH'Z
+
q`'Z
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q<(Z
/
q0)Z
@C
q
q<(Z
@C
q
q<(Z
*
q@)Z
@+
qX)Z
+
qp)Z
@C
q
q<(Z
@C
q
q<(Z
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q$.Z
@+
q<.Z
+
qT.Z
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q0/Z
/
q$0Z
@C
q
q0/Z
@C
q
q0/Z
*
q40Z
@+
qL0Z
+
qd0Z
@C
q
q0/Z
@C
q
q0/Z
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q05Z
+
qH5Z
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q$6Z
@C
q
q$6Z
@C
q
q$6Z
*
q(7Z
@+
q@7Z
+
qX7Z
@C
q
q$6Z
@C
q
q$6Z
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q$<Z
+
q<<Z
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q4>Z
+
qL>Z
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q0CZ
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q(EZ
+
q@EZ
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qxIZ
@+
q
+
q$JZ
@C
q
qxIZ
@C
q
qxIZ
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q4LZ
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qlPZ
@+
q
@C
q
qlPZ
@C
q
qlPZ
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q(SZ
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q`WZ
@+
q
@C
q
q`WZ
@C
q
q`WZ
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qT^Z
@+
q
@C
q
qT^Z
@C
q
qT^Z
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qHeZ
@+
q
@C
q
qHeZ
@C
q
qHeZ
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qxiZ
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q<lZ
@+
q
@C
q
q<lZ
@C
q
q<lZ
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qlpZ
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q|sZ
C:\Users\Bill\AppData\Roaming
@C
q
q0sZ
@+
q
@C
q
q0sZ
@C
q
q0sZ
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q`wZ
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q|yZ
+
qpzZ
C:\Users\Bill\AppData\Roaming
@C
q
q$zZ
@+
q
@C
q
q$zZ
@C
q
q$zZ
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qT~Z
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qd
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qt
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qX
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qh
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qL
C:\Users\Bill\AppData\Roaming
@C
q
*
q|
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q|
@C
q
+
q\
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q@
C:\Users\Bill\AppData\Roaming
@C
q
*
qp
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qp
@C
q
+
qP
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q4
C:\Users\Bill\AppData\Roaming
@C
q
*
qd
@+
q|
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qd
@C
q
+
qD
@C
q
*
qt
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q(
C:\Users\Bill\AppData\Roaming
@C
q
*
qX
@+
qp
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qX
@C
q
+
q8
@C
q
*
qh
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qL
@+
qd
+
q|
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qL
@C
q
+
q,
@C
q
*
q\
@+
qt
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q@
@+
qX
+
qp
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q@
@C
q
+
q
@C
q
*
qP
@+
qh
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q4
@+
qL
+
qd
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q4
@C
q
@C
q
*
qD
@+
q\
+
qt
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q(
@+
q@
+
qX
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q(
@C
q
@C
q
*
q8
@+
qP
+
qh
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q4
+
qL
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q,
@+
qD
+
q\
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q(
+
q@
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q
@+
q8
+
qP
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q4
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q,
+
qD
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q(
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q8
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q,
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qd [
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qt
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qh
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qx
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q\
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
ql
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q\ [
+
qP![
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q`#[
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q4%[
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qP'[
+
qD([
C:\Users\Bill\AppData\Roaming
@C
q
*
qt([
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qt*[
@C
q
+
qT*[
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q(,[
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qD.[
+
q8/[
C:\Users\Bill\AppData\Roaming
@C
q
*
qh/[
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qt0[
/
qh1[
@C
q
qt0[
+
qH1[
@C
q
qt0[
*
qx1[
@+
q
@C
q
qt0[
@C
q
qt0[
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q85[
+
q,6[
C:\Users\Bill\AppData\Roaming
@C
q
*
q\6[
@+
qt6[
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qh7[
/
q\8[
@C
q
qh7[
+
q<8[
@C
q
qh7[
*
ql8[
@+
q
@C
q
qh7[
@C
q
qh7[
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q,<[
+
q =[
C:\Users\Bill\AppData\Roaming
@C
q
*
qP=[
@+
qh=[
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q\>[
/
qP?[
@C
q
q\>[
+
q0?[
@C
q
q\>[
*
q`?[
@+
qx?[
@C
q
q\>[
@C
q
q\>[
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q C[
C:\Users\Bill\AppData\Roaming
@C
q
*
qDD[
@+
q\D[
+
qtD[
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qPE[
/
qDF[
@C
q
qPE[
+
q$F[
@C
q
qPE[
*
qTF[
@+
qlF[
@C
q
qPE[
@C
q
qPE[
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q8K[
@+
qPK[
+
qhK[
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qDL[
/
q8M[
@C
q
qDL[
@C
q
qDL[
*
qHM[
@+
q`M[
+
qxM[
@C
q
qDL[
@C
q
qDL[
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q,R[
@+
qDR[
+
q\R[
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q8S[
/
q,T[
@C
q
q8S[
@C
q
q8S[
*
q<T[
@+
qTT[
+
qlT[
@C
q
q8S[
@C
q
q8S[
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q Y[
@+
q8Y[
+
qPY[
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q,Z[
/
q [[
@C
q
q,Z[
@C
q
q,Z[
*
q0[[
@+
qH[[
+
q`[[
@C
q
q,Z[
@C
q
q,Z[
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q,`[
+
qD`[
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q a[
@C
q
q a[
@C
q
q a[
*
q$b[
@+
q<b[
+
qTb[
@C
q
q a[
@C
q
q a[
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q g[
+
q8g[
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q0i[
+
qHi[
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q,n[
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q$p[
+
q<p[
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qtt[
@+
q
+
q u[
@C
q
qtt[
@C
q
qtt[
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q0w[
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qh{[
@+
q
@C
q
qh{[
@C
q
qh{[
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q$~[
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qx
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
ql
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q|
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q`
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qp
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qT
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qd
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qH
C:\Users\Bill\AppData\Roaming
@C
q
*
qx
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qx
@C
q
+
qX
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q<
C:\Users\Bill\AppData\Roaming
@C
q
*
ql
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
ql
@C
q
+
qL
@C
q
*
q|
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q0
C:\Users\Bill\AppData\Roaming
@C
q
*
q`
@+
qx
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q`
@C
q
+
q@
@C
q
*
qp
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q$
C:\Users\Bill\AppData\Roaming
@C
q
*
qT
@+
ql
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qT
@C
q
+
q4
@C
q
*
qd
@+
q|
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qH
@+
q`
+
qx
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qH
@C
q
+
q(
@C
q
*
qX
@+
qp
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q<
@+
qT
+
ql
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q<
@C
q
@C
q
*
qL
@+
qd
+
q|
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q0
@+
qH
+
q`
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q0
@C
q
@C
q
*
q@
@+
qX
+
qp
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q$
@+
q<
+
qT
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q$
@C
q
@C
q
*
q4
@+
qL
+
qd
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q0
+
qH
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q(
@+
q@
+
qX
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q$
+
q<
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q4
+
qL
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q0
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q(
+
q@
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q$
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q4 \
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
ql
\
@+
q
@C
q
ql
\
@C
q
ql
\
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q(
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qH"\
@+
q
@C
q
qH"\
@C
q
qH"\
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qx&\
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q<)\
@+
q
@C
q
q<)\
@C
q
q<)\
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
ql-\
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q|0\
C:\Users\Bill\AppData\Roaming
@C
q
q00\
@+
q
@C
q
q00\
@C
q
q00\
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q`4\
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q|6\
+
qp7\
C:\Users\Bill\AppData\Roaming
@C
q
q$7\
@+
q
@C
q
q$7\
@C
q
q$7\
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qT;\
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qp=\
+
qd>\
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qt@\
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qHB\
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qdD\
+
qXE\
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qhG\
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q<I\
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qXK\
+
qLL\
C:\Users\Bill\AppData\Roaming
@C
q
*
q|L\
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q|N\
@C
q
+
q\N\
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q0P\
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qLR\
+
q@S\
C:\Users\Bill\AppData\Roaming
@C
q
*
qpS\
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q|T\
/
qpU\
@C
q
q|T\
+
qPU\
@C
q
q|T\
@+
q
@C
q
q|T\
@C
q
q|T\
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q$W\
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q@Y\
+
q4Z\
C:\Users\Bill\AppData\Roaming
@C
q
*
qdZ\
@+
q|Z\
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qp[\
/
qd\\
@C
q
qp[\
+
qD\\
@C
q
qp[\
*
qt\\
@+
q
@C
q
qp[\
@C
q
qp[\
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q4`\
+
q(a\
C:\Users\Bill\AppData\Roaming
@C
q
*
qXa\
@+
qpa\
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qdb\
/
qXc\
@C
q
qdb\
+
q8c\
@C
q
qdb\
*
qhc\
@+
q
@C
q
qdb\
@C
q
qdb\
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q(g\
C:\Users\Bill\AppData\Roaming
@C
q
*
qLh\
@+
qdh\
+
q|h\
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qXi\
/
qLj\
@C
q
qXi\
+
q,j\
@C
q
qXi\
*
q\j\
@+
qtj\
@C
q
qXi\
@C
q
qXi\
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q@o\
@+
qXo\
+
qpo\
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qLp\
/
q@q\
@C
q
qLp\
+
q q\
@C
q
qLp\
*
qPq\
@+
qhq\
@C
q
qLp\
@C
q
qLp\
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q4v\
@+
qLv\
+
qdv\
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q@w\
/
q4x\
@C
q
q@w\
@C
q
q@w\
*
qDx\
@+
q\x\
+
qtx\
@C
q
q@w\
@C
q
q@w\
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q(}\
@+
q@}\
+
qX}\
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q4~\
/
q(
@C
q
q4~\
@C
q
q4~\
*
q8
@+
qP
+
qh
@C
q
q4~\
@C
q
q4~\
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q4
+
qL
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q,
@+
qD
+
q\
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q(
+
q@
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q
@+
q8
+
qP
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q4
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q,
+
qD
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q(
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q8
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q,
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qt
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qh
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qx
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q\
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
ql
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qP
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q`
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qD
C:\Users\Bill\AppData\Roaming
@C
q
*
qt
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qt
@C
q
+
qT
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q8
C:\Users\Bill\AppData\Roaming
@C
q
*
qh
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qh
@C
q
+
qH
@C
q
*
qx
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q,
C:\Users\Bill\AppData\Roaming
@C
q
*
q\
@+
qt
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q\
@C
q
+
q<
@C
q
*
ql
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qP
@+
qh
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qP
@C
q
+
q0
@C
q
*
q`
@+
qx
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qD
@+
q\
+
qt
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qD
@C
q
+
q$
@C
q
*
qT
@+
ql
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q8
@+
qP
+
qh
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qD ]
/
q8
]
@C
q
qD ]
@C
q
qD ]
*
qH
]
@+
q`
]
+
qx
]
@C
q
qD ]
@C
q
qD ]
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q,
@+
qD
+
q\
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q,
@C
q
@C
q
*
q<
@+
qT
+
ql
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q
@+
q8
+
qP
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q
@C
q
@C
q
*
q0
@+
qH
+
q`
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q,
+
qD
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q$
@+
q<
+
qT
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q $]
+
q8$]
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q0&]
+
qH&]
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q,+]
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q$-]
+
q<-]
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qt1]
@+
q
+
q 2]
@C
q
qt1]
@C
q
qt1]
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q04]
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qh8]
@+
q
@C
q
qh8]
@C
q
qh8]
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q$;]
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q\?]
@+
q
@C
q
q\?]
@C
q
q\?]
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qPF]
@+
q
@C
q
qPF]
@C
q
qPF]
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qDM]
@+
q
@C
q
qDM]
@C
q
qDM]
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qtQ]
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q8T]
@+
q
@C
q
q8T]
@C
q
q8T]
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qhX]
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qx[]
C:\Users\Bill\AppData\Roaming
@C
q
q,[]
@+
q
@C
q
q,[]
@C
q
q,[]
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q\_]
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qxa]
+
qlb]
C:\Users\Bill\AppData\Roaming
@C
q
q b]
@+
q
@C
q
q b]
@C
q
q b]
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q|d]
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qPf]
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qlh]
+
q`i]
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qpk]
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qDm]
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q`o]
+
qTp]
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qdr]
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q8t]
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qTv]
+
qHw]
C:\Users\Bill\AppData\Roaming
@C
q
*
qxw]
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qxy]
@C
q
+
qXy]
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q,{]
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qH}]
+
q<~]
C:\Users\Bill\AppData\Roaming
@C
q
*
ql~]
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
ql
@C
q
+
qL
@C
q
*
q|
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q0
C:\Users\Bill\AppData\Roaming
@C
q
*
q`
@+
qx
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q`
@C
q
+
q@
@C
q
*
qp
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q$
C:\Users\Bill\AppData\Roaming
@C
q
*
qT
@+
ql
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qT
@C
q
+
q4
@C
q
*
qd
@+
q|
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qH
@+
q`
+
qx
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qH
@C
q
+
q(
@C
q
*
qX
@+
qp
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q<
@+
qT
+
ql
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q<
@C
q
@C
q
*
qL
@+
qd
+
q|
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q0
@+
qH
+
q`
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q0
@C
q
@C
q
*
q@
@+
qX
+
qp
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q$
@+
q<
+
qT
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q$
@C
q
@C
q
*
q4
@+
qL
+
qd
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q0
+
qH
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q(
@+
q@
+
qX
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q$
+
q<
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q4
+
qL
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q0
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q(
+
q@
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q$
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q4
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q(
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q|
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qp
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qd
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qt
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qX
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qh
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qL ^
C:\Users\Bill\AppData\Roaming
@C
q
*
q| ^
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q|
@C
q
+
q\
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q0
^
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q@
C:\Users\Bill\AppData\Roaming
@C
q
*
qp
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qp
@C
q
+
qP
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q4
C:\Users\Bill\AppData\Roaming
@C
q
*
qd
@+
q|
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qd
@C
q
+
qD
@C
q
*
qt
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q(
C:\Users\Bill\AppData\Roaming
@C
q
*
qX
@+
qp
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qX ^
@C
q
+
q8 ^
@C
q
*
qh ^
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q($^
C:\Users\Bill\AppData\Roaming
@C
q
*
qL%^
@+
qd%^
+
q|%^
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qX&^
/
qL'^
@C
q
qX&^
+
q,'^
@C
q
qX&^
*
q\'^
@+
qt'^
@C
q
qX&^
@C
q
qX&^
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q@,^
@+
qX,^
+
qp,^
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qL-^
/
q@.^
@C
q
qL-^
+
q .^
@C
q
qL-^
*
qP.^
@+
qh.^
@C
q
qL-^
@C
q
qL-^
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q43^
@+
qL3^
+
qd3^
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q@4^
/
q45^
@C
q
q@4^
@C
q
q@4^
*
qD5^
@+
q\5^
+
qt5^
@C
q
q@4^
@C
q
q@4^
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q(:^
@+
q@:^
+
qX:^
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q4;^
/
q(<^
@C
q
q4;^
@C
q
q4;^
*
q8<^
@+
qP<^
+
qh<^
@C
q
q4;^
@C
q
q4;^
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q4A^
+
qLA^
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q(B^
@C
q
q(B^
@C
q
q(B^
*
q,C^
@+
qDC^
+
q\C^
@C
q
q(B^
@C
q
q(B^
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q(H^
+
q@H^
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q J^
@+
q8J^
+
qPJ^
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q4O^
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q,Q^
+
qDQ^
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q|U^
@+
q
+
q(V^
@C
q
q|U^
@C
q
q|U^
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q X^
+
q8X^
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qp\^
@+
q
@C
q
qp\^
@C
q
qp\^
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q,_^
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qdc^
@+
q
@C
q
qdc^
@C
q
qdc^
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q f^
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qXj^
@+
q
@C
q
qXj^
@C
q
qXj^
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qLq^
@+
q
@C
q
qLq^
@C
q
qLq^
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q|u^
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q@x^
@+
q
@C
q
q@x^
@C
q
q@x^
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qp|^
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qt
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qh
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qx
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q\
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
ql
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qP
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q`
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qD
C:\Users\Bill\AppData\Roaming
@C
q
*
qt
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qt
@C
q
+
qT
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q8
C:\Users\Bill\AppData\Roaming
@C
q
*
qh
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qh
@C
q
+
qH
@C
q
*
qx
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q,
C:\Users\Bill\AppData\Roaming
@C
q
*
q\
@+
qt
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q\
@C
q
+
q<
@C
q
*
ql
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qP
@+
qh
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qP
@C
q
+
q0
@C
q
*
q`
@+
qx
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qD
@+
q\
+
qt
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qD
@C
q
+
q$
@C
q
*
qT
@+
ql
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q8
@+
qP
+
qh
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q8
@C
q
@C
q
*
qH
@+
q`
+
qx
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q,
@+
qD
+
q\
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q,
@C
q
@C
q
*
q<
@+
qT
+
ql
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q
@+
q8
+
qP
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q
@C
q
@C
q
*
q0
@+
qH
+
q`
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q,
+
qD
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q$
@+
q<
+
qT
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q8
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q0
+
qH
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q,
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q$
+
q<
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q0
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q$
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qD
_
@+
q
@C
q
qD
_
@C
q
qD
_
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qx
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
ql
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q|!_
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qP#_
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
ql%_
+
q`&_
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qp(_
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qD*_
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q`,_
+
qT-_
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qd/_
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q81_
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qT3_
+
qH4_
C:\Users\Bill\AppData\Roaming
@C
q
*
qx4_
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qx6_
@C
q
+
qX6_
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q,8_
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qH:_
+
q<;_
C:\Users\Bill\AppData\Roaming
@C
q
*
ql;_
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qx<_
/
ql=_
@C
q
qx<_
+
qL=_
@C
q
qx<_
*
q|=_
@+
q
@C
q
qx<_
@C
q
qx<_
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q ?_
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q<A_
+
q0B_
C:\Users\Bill\AppData\Roaming
@C
q
*
q`B_
@+
qxB_
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qlC_
/
q`D_
@C
q
qlC_
+
q@D_
@C
q
qlC_
*
qpD_
@+
q
@C
q
qlC_
@C
q
qlC_
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q0H_
+
q$I_
C:\Users\Bill\AppData\Roaming
@C
q
*
qTI_
@+
qlI_
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q`J_
/
qTK_
@C
q
q`J_
+
q4K_
@C
q
q`J_
*
qdK_
@+
q|K_
@C
q
q`J_
@C
q
q`J_
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q$O_
C:\Users\Bill\AppData\Roaming
@C
q
*
qHP_
@+
q`P_
+
qxP_
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qTQ_
/
qHR_
@C
q
qTQ_
+
q(R_
@C
q
qTQ_
*
qXR_
@+
qpR_
@C
q
qTQ_
@C
q
qTQ_
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q<W_
@+
qTW_
+
qlW_
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qHX_
/
q<Y_
@C
q
qHX_
@C
q
qHX_
*
qLY_
@+
qdY_
+
q|Y_
@C
q
qHX_
@C
q
qHX_
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q0^_
@+
qH^_
+
q`^_
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q<__
/
q0`_
@C
q
q<__
@C
q
q<__
*
q@`_
@+
qX`_
+
qp`_
@C
q
q<__
@C
q
q<__
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q$e_
@+
q<e_
+
qTe_
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q0f_
/
q$g_
@C
q
q0f_
@C
q
q0f_
*
q4g_
@+
qLg_
+
qdg_
@C
q
q0f_
@C
q
q0f_
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q0l_
+
qHl_
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q$m_
@C
q
q$m_
@C
q
q$m_
*
q(n_
@+
q@n_
+
qXn_
@C
q
q$m_
@C
q
q$m_
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q$s_
+
q<s_
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q4u_
+
qLu_
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q0z_
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q(|_
+
q@|_
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q$
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q4
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q(
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q|
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qp
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qd
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qt
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qX
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qh
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qL
C:\Users\Bill\AppData\Roaming
@C
q
*
q|
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q|
@C
q
+
q\
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q@
C:\Users\Bill\AppData\Roaming
@C
q
*
qp
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qp
@C
q
+
qP
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q4
C:\Users\Bill\AppData\Roaming
@C
q
*
qd
@+
q|
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qd
@C
q
+
qD
@C
q
*
qt
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q(
C:\Users\Bill\AppData\Roaming
@C
q
*
qX
@+
qp
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qX
@C
q
+
q8
@C
q
*
qh
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qL
@+
qd
+
q|
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qL
@C
q
+
q,
@C
q
*
q\
@+
qt
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q@
@+
qX
+
qp
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q@
@C
q
+
q
@C
q
*
qP
@+
qh
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q4
@+
qL
+
qd
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q4
@C
q
@C
q
*
qD
@+
q\
+
qt
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q(
@+
q@
+
qX
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q(
@C
q
@C
q
*
q8
@+
qP
+
qh
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q4
+
qL
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q,
@+
qD
+
q\
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q(
+
q@
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q
@+
q8
+
qP
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q4
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q,
+
qD
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q(
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q8
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q,
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qd `
@+
q
@C
q
qd `
@C
q
qd `
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q #`
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qX'`
@+
q
@C
q
qX'`
@C
q
qX'`
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qL.`
@+
q
@C
q
qL.`
@C
q
qL.`
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q|2`
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q@5`
@+
q
@C
q
q@5`
@C
q
q@5`
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qp9`
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q4<`
@+
q
@C
q
q4<`
@C
q
q4<`
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qd@`
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qtC`
C:\Users\Bill\AppData\Roaming
@C
q
q(C`
@+
q
@C
q
q(C`
@C
q
q(C`
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qXG`
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qtI`
+
qhJ`
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qxL`
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qLN`
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qhP`
+
q\Q`
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qlS`
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q@U`
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q\W`
+
qPX`
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q`Z`
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q4\`
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qP^`
+
qD_`
C:\Users\Bill\AppData\Roaming
@C
q
*
qt_`
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qta`
@C
q
+
qTa`
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q(c`
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qDe`
+
q8f`
C:\Users\Bill\AppData\Roaming
@C
q
*
qhf`
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qtg`
/
qhh`
@C
q
qtg`
+
qHh`
@C
q
qtg`
*
qxh`
@+
q
@C
q
qtg`
@C
q
qtg`
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q8l`
+
q,m`
C:\Users\Bill\AppData\Roaming
@C
q
*
q\m`
@+
qtm`
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qhn`
/
q\o`
@C
q
qhn`
+
q<o`
@C
q
qhn`
*
qlo`
@+
q
@C
q
qhn`
@C
q
qhn`
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q,s`
+
q t`
C:\Users\Bill\AppData\Roaming
@C
q
*
qPt`
@+
qht`
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q\u`
/
qPv`
@C
q
q\u`
+
q0v`
@C
q
q\u`
*
q`v`
@+
qxv`
@C
q
q\u`
@C
q
q\u`
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q z`
C:\Users\Bill\AppData\Roaming
@C
q
*
qD{`
@+
q\{`
+
qt{`
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qP|`
/
qD}`
@C
q
qP|`
+
q$}`
@C
q
qP|`
*
qT}`
@+
ql}`
@C
q
qP|`
@C
q
qP|`
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q8
@+
qP
+
qh
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q8
@C
q
@C
q
*
qH
@+
q`
+
qx
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q,
@+
qD
+
q\
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q,
@C
q
@C
q
*
q<
@+
qT
+
ql
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q
@+
q8
+
qP
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q
@C
q
@C
q
*
q0
@+
qH
+
q`
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q,
+
qD
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q$
@+
q<
+
qT
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q8
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q0
+
qH
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q,
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q$
+
q<
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q0
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q$
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qx
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
ql
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q|
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q`
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qp
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qT
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qd
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qH
C:\Users\Bill\AppData\Roaming
@C
q
*
qx
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qx
@C
q
+
qX
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q<
C:\Users\Bill\AppData\Roaming
@C
q
*
ql
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
ql
@C
q
+
qL
@C
q
*
q|
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q0
C:\Users\Bill\AppData\Roaming
@C
q
*
q`
@+
qx
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q`
@C
q
+
q@
@C
q
*
qp
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q$
C:\Users\Bill\AppData\Roaming
@C
q
*
qT
@+
ql
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qT
@C
q
+
q4
@C
q
*
qd
@+
q|
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qH
a
@+
q`
a
+
qx
a
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qH
@C
q
+
q(
@C
q
*
qX
@+
qp
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q<
@+
qT
+
ql
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q<
@C
q
@C
q
*
qL
@+
qd
+
q|
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q0
@+
qH
+
q`
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q0
@C
q
@C
q
*
q@
@+
qX
+
qp
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q$"a
@+
q<"a
+
qT"a
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q0#a
/
q$$a
@C
q
q0#a
@C
q
q0#a
*
q4$a
@+
qL$a
+
qd$a
@C
q
q0#a
@C
q
q0#a
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q0)a
+
qH)a
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q$*a
@C
q
q$*a
@C
q
q$*a
*
q(+a
@+
q@+a
+
qX+a
@C
q
q$*a
@C
q
q$*a
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q$0a
+
q<0a
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q42a
+
qL2a
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q07a
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q(9a
+
q@9a
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qx=a
@+
q
+
q$>a
@C
q
qx=a
@C
q
qx=a
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q4@a
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qlDa
@+
q
@C
q
qlDa
@C
q
qlDa
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q(Ga
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q`Ka
@+
q
@C
q
q`Ka
@C
q
q`Ka
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qTRa
@+
q
@C
q
qTRa
@C
q
qTRa
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qHYa
@+
q
@C
q
qHYa
@C
q
qHYa
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qx]a
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q<`a
@+
q
@C
q
q<`a
@C
q
q<`a
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qlda
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q|ga
C:\Users\Bill\AppData\Roaming
@C
q
q0ga
@+
q
@C
q
q0ga
@C
q
q0ga
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q`ka
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q|ma
+
qpna
C:\Users\Bill\AppData\Roaming
@C
q
q$na
@+
q
@C
q
q$na
@C
q
q$na
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
[Capturing from Local Area Connection - 8/24/2018 5:44:16 PM]
iuc[BS][BS]cmp6[BS][V]
[*Local Area Connection - 8/24/2018 5:44:24 PM]
nbns
Bill-PC
192.168.1.1
255.255.255.255
p$sa
@C
q
p<sa
+
q<
p$ta
{902A6B7D-F035-41A6-A06E-631E2332252E}
localdomain
Intel(R) PRO/1000 MT Desktop Adapter
Local Area Connection
pL~a
p,va
p<va
5
q$
pHwa
@C
q
p(wa
5
q$
plxa
5
q$
ppya
5
q$
ptza
5
q$
px{a
@C
q
p(wa
p |a
p |a
p`}a
p<~a
pX~a
ph~a
@C
q
5
q$
stRr
stRr
tsrR~
@C
q
@C
q
{846EE342-7039-11DE-9D20-806E6F6E6963}
Software Loopback Interface 1
Loopback Pseudo-Interface 1
5
q$
@C
q
5
q$
@C
q
5
q$
5
q$
5
q$
@C
q
{211D11D6-0DE3-433E-B35B-0C9BD5497545}
Teredo Tunneling Pseudo-Interface
Teredo Tunneling Pseudo-Interface
5
q$
@C
q
5
q$
5
q$
pX,W
5
q$
@C
q
{A8EC83FF-F63B-4A2C-B32C-A073CC6AE773}
localdomain
Microsoft ISATAP Adapter #2
isatap.localdomain
5
q$
@C
q
@C
q
5
q$
@C
q
@C
q
{902A6B7D-F035-41A6-A06E-631E2332252E}
Intel(R) PRO/1000 MT Desktop Adapter
192.168.1.101
255.255.255.0
192.168.1.1
255.255.255.255
192.168.1.1
255.255.255.255
@C
q
.
q
@C
q
@C
q
pX,W
pX,W
pX,W
\DEVICE\TCPIP_{902A6B7D-F035-41A6-A06E-631E2332252E}
Intel(R) PRO/1000 MT Desktop Adapter
192.168.1.1
255.255.255.255
@C
q
p(+W
@C
q
+
qD
SMTPSVC/smtp.yandex.com
nonny-killers@
nonny-killers
yandex
nonny-killers@yandex.com
nonny-killers
yandex.com
nonny-killers@
nonny-killers
yandex
nonny-killers@yandex.com
nonny-killers
yandex.com
@C
q
HawkEye Keylogger | Keylog Records |
@C
q
@C
q
+
q(
@C
q
BILL-PC
BILL-PC
win32_processor
@C
q
@C
q
@C
q
n5o~
l5oT
@C
q
@C
q
@C
q
@C
q
@C
q
@C
q
@C
q
@C
q
@C
q
@C
q
System.Management, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Management.WbemDefPath
System.Management.WbemDefPath, System.Management, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Management
system.management
System.Management.WbemDefPath, system.management
WbemDefPath
system.management
WbemDefPath, system.management
system.management
System.Management.WbemDefPath, system.management
system.management, version=2.0.0.0, culture=neutral, publickeytoken=b03f5f7f11d50a3a
System.Management.WbemDefPath, system.management, version=2.0.0.0, culture=neutral, publickeytoken=b03f5f7f11d50a3a
system.management
WbemDefPath, system.management
win32_processor
win32_processor
win32_processor
\\.\root\cimv2
@C
q
@C
q
system.management
System.Management.WbemDefPath, system.management
system.management
WbemDefPath, system.management
system.management
System.Management.WbemDefPath, system.management
system.management, version=2.0.0.0, culture=neutral, publickeytoken=b03f5f7f11d50a3a
System.Management.WbemDefPath, system.management, version=2.0.0.0, culture=neutral, publickeytoken=b03f5f7f11d50a3a
system.management
WbemDefPath, system.management
\\.\root\cimv2
4N;o
qd)T
qd)T
+
qD
1
q\
=o$
+
qD
\\.\root\cimv2
\\.\root\cimv2
win32_processor
84
q
84
q
\\BILL-PC\ROOT\cimv2:Win32_Processor
@C
q
@C
q
system.management
System.Management.WbemDefPath, system.management
system.management
WbemDefPath, system.management
system.management
System.Management.WbemDefPath, system.management
system.management, version=2.0.0.0, culture=neutral, publickeytoken=b03f5f7f11d50a3a
System.Management.WbemDefPath, system.management, version=2.0.0.0, culture=neutral, publickeytoken=b03f5f7f11d50a3a
system.management
WbemDefPath, system.management
Win32_Processor
+
qD
1
qT
+
qD
1
qd
+
qD
\\.\root\cimv2
=ot
+
qD
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
\\BILL-PC\root\cimv2:Win32_Processor.DeviceID="CPU0"
@C
q
@C
q
system.management
System.Management.WbemDefPath, system.management
system.management
WbemDefPath, system.management
system.management
System.Management.WbemDefPath, system.management
system.management, version=2.0.0.0, culture=neutral, publickeytoken=b03f5f7f11d50a3a
System.Management.WbemDefPath, system.management, version=2.0.0.0, culture=neutral, publickeytoken=b03f5f7f11d50a3a
system.management
WbemDefPath, system.management
\\.\root\cimv2
+
qD
\\.\root\cimv2
processorID
1
qD
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qT b
@+
q
@C
q
qT b
@C
q
qT b
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q|
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q`"b
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q|$b
+
qp%b
C:\Users\Bill\AppData\Roaming
@C
q
q$%b
@+
q
@C
q
q$%b
@C
q
q$%b
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qT)b
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qp+b
+
qd,b
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qt.b
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qH0b
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qd2b
+
qX3b
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qh5b
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q<7b
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qX9b
+
qL:b
C:\Users\Bill\AppData\Roaming
@C
q
*
q|:b
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q|<b
@C
q
+
q\<b
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q0>b
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qL@b
+
q@Ab
C:\Users\Bill\AppData\Roaming
@C
q
*
qpAb
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q|Bb
/
qpCb
@C
q
q|Bb
+
qPCb
@C
q
q|Bb
@+
q
@C
q
q|Bb
@C
q
q|Bb
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q$Eb
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q@Gb
+
q4Hb
C:\Users\Bill\AppData\Roaming
@C
q
*
qdHb
@+
q|Hb
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qpIb
/
qdJb
@C
q
qpIb
+
qDJb
@C
q
qpIb
*
qtJb
@+
q
@C
q
qpIb
@C
q
qpIb
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q4Nb
+
q(Ob
C:\Users\Bill\AppData\Roaming
@C
q
*
qXOb
@+
qpOb
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qdPb
/
qXQb
@C
q
qdPb
+
q8Qb
@C
q
qdPb
*
qhQb
@+
q
@C
q
qdPb
@C
q
qdPb
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q(Ub
C:\Users\Bill\AppData\Roaming
@C
q
*
qLVb
@+
qdVb
+
q|Vb
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qXWb
/
qLXb
@C
q
qXWb
+
q,Xb
@C
q
qXWb
*
q\Xb
@+
qtXb
@C
q
qXWb
@C
q
qXWb
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q@]b
@+
qX]b
+
qp]b
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qL^b
/
q@_b
@C
q
qL^b
+
q _b
@C
q
qL^b
*
qP_b
@+
qh_b
@C
q
qL^b
@C
q
qL^b
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q4db
@+
qLdb
+
qddb
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q@eb
/
q4fb
@C
q
q@eb
@C
q
q@eb
*
qDfb
@+
q\fb
+
qtfb
@C
q
q@eb
@C
q
q@eb
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q(kb
@+
q@kb
+
qXkb
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q4lb
/
q(mb
@C
q
q4lb
@C
q
q4lb
*
q8mb
@+
qPmb
+
qhmb
@C
q
q4lb
@C
q
q4lb
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q4rb
+
qLrb
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q(sb
@C
q
q(sb
@C
q
q(sb
*
q,tb
@+
qDtb
+
q\tb
@C
q
q(sb
@C
q
q(sb
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q(yb
+
q@yb
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q {b
@+
q8{b
+
qP{b
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q4
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q,
+
qD
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q(
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q8
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q,
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qt
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qh
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qx
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q\
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
ql
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qP
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q`
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qD
C:\Users\Bill\AppData\Roaming
@C
q
*
qt
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qt
@C
q
+
qT
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q8
C:\Users\Bill\AppData\Roaming
@C
q
*
qh
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qh
@C
q
+
qH
@C
q
*
qx
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q,
C:\Users\Bill\AppData\Roaming
@C
q
*
q\
@+
qt
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q\
@C
q
+
q<
@C
q
*
ql
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qP
@+
qh
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qP
@C
q
+
q0
@C
q
*
q`
@+
qx
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qD
@+
q\
+
qt
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qD
@C
q
+
q$
@C
q
*
qT
@+
ql
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q8
@+
qP
+
qh
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q8
@C
q
@C
q
*
qH
@+
q`
+
qx
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q,
@+
qD
+
q\
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q,
@C
q
@C
q
*
q<
@+
qT
+
ql
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q
@+
q8
+
qP
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q
@C
q
@C
q
*
q0
@+
qH
+
q`
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q,
+
qD
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q$
c
@+
q<
c
+
qT
c
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q8
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q0
+
qH
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q,
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q$
+
q<
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q c
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q0"c
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qh&c
@+
q
@C
q
qh&c
@C
q
qh&c
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q$)c
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q\-c
@+
q
@C
q
q\-c
@C
q
q\-c
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qP4c
@+
q
@C
q
qP4c
@C
q
qP4c
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qD;c
@+
q
@C
q
qD;c
@C
q
qD;c
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qt?c
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q8Bc
@+
q
@C
q
q8Bc
@C
q
q8Bc
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qhFc
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qxIc
C:\Users\Bill\AppData\Roaming
@C
q
q,Ic
@+
q
@C
q
q,Ic
@C
q
q,Ic
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q\Mc
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qxOc
+
qlPc
C:\Users\Bill\AppData\Roaming
@C
q
q Pc
@+
q
@C
q
q Pc
@C
q
q Pc
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q|Rc
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qPTc
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qlVc
+
q`Wc
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qpYc
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qD[c
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q`]c
+
qT^c
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qd`c
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q8bc
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qTdc
+
qHec
C:\Users\Bill\AppData\Roaming
@C
q
*
qxec
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qxgc
@C
q
+
qXgc
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q,ic
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qHkc
+
q<lc
C:\Users\Bill\AppData\Roaming
@C
q
*
qllc
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qxmc
/
qlnc
@C
q
qxmc
+
qLnc
@C
q
qxmc
*
q|nc
@+
q
@C
q
qxmc
@C
q
qxmc
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q pc
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q<rc
+
q0sc
C:\Users\Bill\AppData\Roaming
@C
q
*
q`sc
@+
qxsc
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qltc
/
q`uc
@C
q
qltc
+
q@uc
@C
q
qltc
*
qpuc
@+
q
@C
q
qltc
@C
q
qltc
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q0yc
+
q$zc
C:\Users\Bill\AppData\Roaming
@C
q
*
qTzc
@+
qlzc
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q`{c
/
qT|c
@C
q
q`{c
+
q4|c
@C
q
q`{c
*
qd|c
@+
q||c
@C
q
q`{c
@C
q
q`{c
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qH
@+
q`
+
qx
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qH
@C
q
+
q(
@C
q
*
qX
@+
qp
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q<
@+
qT
+
ql
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q<
@C
q
@C
q
*
qL
@+
qd
+
q|
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q0
@+
qH
+
q`
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q0
@C
q
@C
q
*
q@
@+
qX
+
qp
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q$
@+
q<
+
qT
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q$
@C
q
@C
q
*
q4
@+
qL
+
qd
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q0
+
qH
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q(
@+
q@
+
qX
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q$
+
q<
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q4
+
qL
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q0
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q(
+
q@
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q$
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q4
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q(
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q|
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qp
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qd
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qt
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qX
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qh
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qL
C:\Users\Bill\AppData\Roaming
@C
q
*
q|
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q|
@C
q
+
q\
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q@
C:\Users\Bill\AppData\Roaming
@C
q
*
qp
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qp
@C
q
+
qP
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q4
C:\Users\Bill\AppData\Roaming
@C
q
*
qd
@+
q|
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qd
@C
q
+
qD
@C
q
*
qt
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q(
C:\Users\Bill\AppData\Roaming
@C
q
*
qX
@+
qp
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qd
d
/
qX
@C
q
qd
d
+
q8
@C
q
qd
d
*
qh
@+
q
@C
q
qd
d
@C
q
qd
d
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qL
@+
qd
+
q|
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qL
@C
q
+
q,
@C
q
*
q\
@+
qt
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q@
@+
qX
+
qp
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q@
@C
q
+
q
@C
q
*
qP
@+
qh
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q4!d
@+
qL!d
+
qd!d
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q@"d
/
q4#d
@C
q
q@"d
@C
q
q@"d
*
qD#d
@+
q\#d
+
qt#d
@C
q
q@"d
@C
q
q@"d
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q((d
@+
q@(d
+
qX(d
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q4)d
/
q(*d
@C
q
q4)d
@C
q
q4)d
*
q8*d
@+
qP*d
+
qh*d
@C
q
q4)d
@C
q
q4)d
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q4/d
+
qL/d
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q(0d
@C
q
q(0d
@C
q
q(0d
*
q,1d
@+
qD1d
+
q\1d
@C
q
q(0d
@C
q
q(0d
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q(6d
+
q@6d
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q 8d
@+
q88d
+
qP8d
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q4=d
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q,?d
+
qD?d
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q|Cd
@+
q
+
q(Dd
@C
q
q|Cd
@C
q
q|Cd
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q Fd
+
q8Fd
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qpJd
@+
q
@C
q
qpJd
@C
q
qpJd
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q,Md
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qdQd
@+
q
@C
q
qdQd
@C
q
qdQd
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q Td
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qXXd
@+
q
@C
q
qXXd
@C
q
qXXd
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qL_d
@+
q
@C
q
qL_d
@C
q
qL_d
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q|cd
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q@fd
@+
q
@C
q
q@fd
@C
q
q@fd
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qpjd
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q4md
@+
q
@C
q
q4md
@C
q
q4md
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qdqd
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qttd
C:\Users\Bill\AppData\Roaming
@C
q
q(td
@+
q
@C
q
q(td
@C
q
q(td
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qXxd
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qtzd
+
qh{d
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qx}d
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q\
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
ql
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qP
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q`
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qD
C:\Users\Bill\AppData\Roaming
@C
q
*
qt
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qt
@C
q
+
qT
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q8
C:\Users\Bill\AppData\Roaming
@C
q
*
qh
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qh
@C
q
+
qH
@C
q
*
qx
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q,
C:\Users\Bill\AppData\Roaming
@C
q
*
q\
@+
qt
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q\
@C
q
+
q<
@C
q
*
ql
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qP
@+
qh
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qP
@C
q
+
q0
@C
q
*
q`
@+
qx
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qD
@+
q\
+
qt
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qD
@C
q
+
q$
@C
q
*
qT
@+
ql
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q8
@+
qP
+
qh
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q8
@C
q
@C
q
*
qH
@+
q`
+
qx
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q,
@+
qD
+
q\
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q,
@C
q
@C
q
*
q<
@+
qT
+
ql
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q
@+
q8
+
qP
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q
@C
q
@C
q
*
q0
@+
qH
+
q`
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q,
+
qD
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q$
@+
q<
+
qT
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q8
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q0
+
qH
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q,
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q$
+
q<
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q0
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q$
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qx
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q\
e
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
ql
e
C:\Users\Bill\AppData\Roaming
@C
q
q
e
@+
q
@C
q
q
e
@C
q
q
e
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q|
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q`
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qp
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qT
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qd
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qT!e
+
qH"e
C:\Users\Bill\AppData\Roaming
@C
q
*
qx"e
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qx$e
@C
q
+
qX$e
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q,&e
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qH(e
+
q<)e
C:\Users\Bill\AppData\Roaming
@C
q
*
ql)e
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qx*e
/
ql+e
@C
q
qx*e
+
qL+e
@C
q
qx*e
*
q|+e
@+
q
@C
q
qx*e
@C
q
qx*e
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q -e
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q</e
+
q00e
C:\Users\Bill\AppData\Roaming
@C
q
*
q`0e
@+
qx0e
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
ql1e
/
q`2e
@C
q
ql1e
+
q@2e
@C
q
ql1e
*
qp2e
@+
q
@C
q
ql1e
@C
q
ql1e
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q06e
+
q$7e
C:\Users\Bill\AppData\Roaming
@C
q
*
qT7e
@+
ql7e
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q`8e
/
qT9e
@C
q
q`8e
+
q49e
@C
q
q`8e
*
qd9e
@+
q|9e
@C
q
q`8e
@C
q
q`8e
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q$=e
C:\Users\Bill\AppData\Roaming
@C
q
*
qH>e
@+
q`>e
+
qx>e
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qT?e
/
qH@e
@C
q
qT?e
+
q(@e
@C
q
qT?e
*
qX@e
@+
qp@e
@C
q
qT?e
@C
q
qT?e
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q<Ee
@+
qTEe
+
qlEe
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qHFe
/
q<Ge
@C
q
qHFe
@C
q
qHFe
*
qLGe
@+
qdGe
+
q|Ge
@C
q
qHFe
@C
q
qHFe
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q0Le
@+
qHLe
+
q`Le
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q<Me
/
q0Ne
@C
q
q<Me
@C
q
q<Me
*
q@Ne
@+
qXNe
+
qpNe
@C
q
q<Me
@C
q
q<Me
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q$Se
@+
q<Se
+
qTSe
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q0Te
/
q$Ue
@C
q
q0Te
@C
q
q0Te
*
q4Ue
@+
qLUe
+
qdUe
@C
q
q0Te
@C
q
q0Te
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q0Ze
+
qHZe
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q$[e
@C
q
q$[e
@C
q
q$[e
*
q(\e
@+
q@\e
+
qX\e
@C
q
q$[e
@C
q
q$[e
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q$ae
+
q<ae
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q4ce
+
qLce
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q0he
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q(je
+
q@je
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qxne
@+
q
+
q$oe
@C
q
qxne
@C
q
qxne
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q4qe
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qlue
@+
q
@C
q
qlue
@C
q
qlue
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q(xe
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q`|e
@+
q
@C
q
q`|e
@C
q
q`|e
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q|
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qp
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qd
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qt
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qX
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qh
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qL
C:\Users\Bill\AppData\Roaming
@C
q
*
q|
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q|
@C
q
+
q\
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q@
C:\Users\Bill\AppData\Roaming
@C
q
*
qp
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qp
@C
q
+
qP
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q4
C:\Users\Bill\AppData\Roaming
@C
q
*
qd
@+
q|
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qd
@C
q
+
qD
@C
q
*
qt
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q(
C:\Users\Bill\AppData\Roaming
@C
q
*
qX
@+
qp
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qX
@C
q
+
q8
@C
q
*
qh
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qL
@+
qd
+
q|
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qL
@C
q
+
q,
@C
q
*
q\
@+
qt
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q@
@+
qX
+
qp
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q@
@C
q
+
q
@C
q
*
qP
@+
qh
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q4
@+
qL
+
qd
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q4
@C
q
@C
q
*
qD
@+
q\
+
qt
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q(
@+
q@
+
qX
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q(
@C
q
@C
q
*
q8
@+
qP
+
qh
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q4
+
qL
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q,
@+
qD
+
q\
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q(
+
q@
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q
@+
q8
+
qP
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q4
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q,
+
qD
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q(
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q8
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q,
f
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q| f
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q@#f
@+
q
@C
q
q@#f
@C
q
q@#f
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qp'f
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q4*f
@+
q
@C
q
q4*f
@C
q
q4*f
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qd.f
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qt1f
C:\Users\Bill\AppData\Roaming
@C
q
q(1f
@+
q
@C
q
q(1f
@C
q
q(1f
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qX5f
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qt7f
+
qh8f
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qx:f
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qL<f
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qh>f
+
q\?f
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qlAf
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q@Cf
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q\Ef
+
qPFf
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q`Hf
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q4Jf
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qPLf
+
qDMf
C:\Users\Bill\AppData\Roaming
@C
q
*
qtMf
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qtOf
@C
q
+
qTOf
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q(Qf
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qDSf
+
q8Tf
C:\Users\Bill\AppData\Roaming
@C
q
*
qhTf
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qtUf
/
qhVf
@C
q
qtUf
+
qHVf
@C
q
qtUf
*
qxVf
@+
q
@C
q
qtUf
@C
q
qtUf
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q8Zf
+
q,[f
C:\Users\Bill\AppData\Roaming
@C
q
*
q\[f
@+
qt[f
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qh\f
/
q\]f
@C
q
qh\f
+
q<]f
@C
q
qh\f
*
ql]f
@+
q
@C
q
qh\f
@C
q
qh\f
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q,af
+
q bf
C:\Users\Bill\AppData\Roaming
@C
q
*
qPbf
@+
qhbf
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q\cf
/
qPdf
@C
q
q\cf
+
q0df
@C
q
q\cf
*
q`df
@+
qxdf
@C
q
q\cf
@C
q
q\cf
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q hf
C:\Users\Bill\AppData\Roaming
@C
q
*
qDif
@+
q\if
+
qtif
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qPjf
/
qDkf
@C
q
qPjf
+
q$kf
@C
q
qPjf
*
qTkf
@+
qlkf
@C
q
qPjf
@C
q
qPjf
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q8of
+
q,pf
C:\Users\Bill\AppData\Roaming
@C
q
*
q\pf
@+
qtpf
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qhqf
/
q\rf
@C
q
qhqf
+
q<rf
@C
q
qhqf
*
qlrf
@+
q
@C
q
qhqf
@C
q
qhqf
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q,vf
+
q wf
C:\Users\Bill\AppData\Roaming
@C
q
*
qPwf
@+
qhwf
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q\xf
/
qPyf
@C
q
q\xf
+
q0yf
@C
q
q\xf
*
q`yf
@+
qxyf
@C
q
q\xf
@C
q
q\xf
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q }f
C:\Users\Bill\AppData\Roaming
@C
q
*
qD~f
@+
q\~f
+
qt~f
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qD
@C
q
+
q$
@C
q
*
qT
@+
ql
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q8
@+
qP
+
qh
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q8
@C
q
@C
q
*
qH
@+
q`
+
qx
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q,
@+
qD
+
q\
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q,
@C
q
@C
q
*
q<
@+
qT
+
ql
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q
@+
q8
+
qP
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q
@C
q
@C
q
*
q0
@+
qH
+
q`
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q,
+
qD
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q$
@+
q<
+
qT
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q8
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q0
+
qH
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q,
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q$
+
q<
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q0
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q$
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qx
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
ql
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q|
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q`
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qp
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qT
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qd
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qH
C:\Users\Bill\AppData\Roaming
@C
q
*
qx
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qx
@C
q
+
qX
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q<
C:\Users\Bill\AppData\Roaming
@C
q
*
ql
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
ql
@C
q
+
qL
@C
q
*
q|
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q0
C:\Users\Bill\AppData\Roaming
@C
q
*
q`
@+
qx
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q`
@C
q
+
q@
@C
q
*
qp
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q$ g
C:\Users\Bill\AppData\Roaming
@C
q
*
qT g
@+
ql g
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q`
g
/
qT
@C
q
q`
g
+
q4
@C
q
q`
g
*
qd
@+
q|
@C
q
q`
g
@C
q
q`
g
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qH
@+
q`
+
qx
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qH
@C
q
+
q(
@C
q
*
qX
@+
qp
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q<
@+
qT
+
ql
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q<
@C
q
@C
q
*
qL
@+
qd
+
q|
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q0
@+
qH
+
q`
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q0 g
@C
q
@C
q
*
q@ g
@+
qX g
+
qp g
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q$%g
@+
q<%g
+
qT%g
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q0&g
/
q$'g
@C
q
q0&g
@C
q
q0&g
*
q4'g
@+
qL'g
+
qd'g
@C
q
q0&g
@C
q
q0&g
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q0,g
+
qH,g
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q$-g
@C
q
q$-g
@C
q
q$-g
*
q(.g
@+
q@.g
+
qX.g
@C
q
q$-g
@C
q
q$-g
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q$3g
+
q<3g
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q45g
+
qL5g
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q0:g
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q(<g
+
q@<g
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qx@g
@+
q
+
q$Ag
@C
q
qx@g
@C
q
qx@g
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q4Cg
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qlGg
@+
q
@C
q
qlGg
@C
q
qlGg
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q(Jg
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q`Ng
@+
q
@C
q
q`Ng
@C
q
q`Ng
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qTUg
@+
q
@C
q
qTUg
@C
q
qTUg
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qH\g
@+
q
@C
q
qH\g
@C
q
qH\g
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qx`g
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q<cg
@+
q
@C
q
q<cg
@C
q
q<cg
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qlgg
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q|jg
C:\Users\Bill\AppData\Roaming
@C
q
q0jg
@+
q
@C
q
q0jg
@C
q
q0jg
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q`ng
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q|pg
+
qpqg
C:\Users\Bill\AppData\Roaming
@C
q
q$qg
@+
q
@C
q
q$qg
@C
q
q$qg
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qTug
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qpwg
+
qdxg
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qtzg
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qH|g
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qd~g
+
qX
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qh
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qL
C:\Users\Bill\AppData\Roaming
@C
q
*
q|
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q|
@C
q
+
q\
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q@
C:\Users\Bill\AppData\Roaming
@C
q
*
qp
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qp
@C
q
+
qP
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q4
C:\Users\Bill\AppData\Roaming
@C
q
*
qd
@+
q|
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qd
@C
q
+
qD
@C
q
*
qt
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q(
C:\Users\Bill\AppData\Roaming
@C
q
*
qX
@+
qp
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qX
@C
q
+
q8
@C
q
*
qh
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qL
@+
qd
+
q|
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qL
@C
q
+
q,
@C
q
*
q\
@+
qt
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q@
@+
qX
+
qp
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q@
@C
q
+
q
@C
q
*
qP
@+
qh
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q4
@+
qL
+
qd
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q4
@C
q
@C
q
*
qD
@+
q\
+
qt
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q(
@+
q@
+
qX
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q(
@C
q
@C
q
*
q8
@+
qP
+
qh
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q4
+
qL
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q,
@+
qD
+
q\
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q(
+
q@
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q
@+
q8
+
qP
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q4
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q,
+
qD
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q(
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q8
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q,
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
Start menu
Start menu
[
[Start menu
[Start menu -
8/24/2018 5:53:
2018
8/24/2018 5:53:59 PM
[Start menu - 8/24/2018 5:53:59 PM
[Start menu - 8/24/2018 5:53:59 PM]
[Start menu - 8/24/2018 5:53:59 PM]
[Capturing from Local Area Connection - 8/24/2018 5:44:16 PM]
iuc[BS][BS]cmp6[BS][V]
[*Local Area Connection - 8/24/2018 5:44:24 PM]
nbns
[Start menu - 8/24/2018 5:53:59 PM]
[Capturing from Local Area Connection - 8/24/2018 5:44:16 PM]
iuc[BS][BS]cmp6[BS][V]
[*Local Area Connection - 8/24/2018 5:44:24 PM]
nbns
[Start menu - 8/24/2018 5:53:59 PM]
c
Start menu
Start menu
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q8
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q0 h
+
qH h
@C
q
@C
q
Start menu
Start menu
[Capturing from Local Area Connection - 8/24/2018 5:44:16 PM]
iuc[BS][BS]cmp6[BS][V]
[*Local Area Connection - 8/24/2018 5:44:24 PM]
nbns
[Start menu - 8/24/2018 5:53:59 PM]
cm
Start menu
Start menu
Start menu
Start menu
[Capturing from Local Area Connection - 8/24/2018 5:44:16 PM]
iuc[BS][BS]cmp6[BS][V]
[*Local Area Connection - 8/24/2018 5:44:24 PM]
nbns
[Start menu - 8/24/2018 5:53:59 PM]
cmd
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qh
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qx
@C
q
@+
q
@C
q
@C
q
Start menu
Start menu
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qt h
C:\Users\Bill\AppData\Roaming
@C
q
q( h
@+
q
@C
q
q( h
@C
q
q( h
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qX$h
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qt&h
+
qh'h
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qx)h
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qL+h
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qh-h
+
q\.h
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
ql0h
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q@2h
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q\4h
+
qP5h
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q`7h
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q49h
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qP;h
+
qD<h
C:\Users\Bill\AppData\Roaming
@C
q
*
qt<h
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qt>h
@C
q
+
qT>h
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q(@h
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qDBh
+
q8Ch
C:\Users\Bill\AppData\Roaming
@C
q
*
qhCh
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qtDh
/
qhEh
@C
q
qtDh
+
qHEh
@C
q
qtDh
*
qxEh
@+
q
@C
q
qtDh
@C
q
qtDh
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q8Ih
+
q,Jh
C:\Users\Bill\AppData\Roaming
@C
q
*
q\Jh
@+
qtJh
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qhKh
/
q\Lh
@C
q
qhKh
+
q<Lh
@C
q
qhKh
*
qlLh
@+
q
@C
q
qhKh
@C
q
qhKh
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q,Ph
+
q Qh
C:\Users\Bill\AppData\Roaming
@C
q
*
qPQh
@+
qhQh
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q\Rh
/
qPSh
@C
q
q\Rh
+
q0Sh
@C
q
q\Rh
*
q`Sh
@+
qxSh
@C
q
q\Rh
@C
q
q\Rh
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q Wh
C:\Users\Bill\AppData\Roaming
@C
q
*
qDXh
@+
q\Xh
+
qtXh
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qPYh
/
qDZh
@C
q
qPYh
+
q$Zh
@C
q
qPYh
*
qTZh
@+
qlZh
@C
q
qPYh
@C
q
qPYh
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q8_h
@+
qP_h
+
qh_h
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qD`h
/
q8ah
@C
q
qD`h
@C
q
qD`h
*
qHah
@+
q`ah
+
qxah
@C
q
qD`h
@C
q
qD`h
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q,fh
@+
qDfh
+
q\fh
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q8gh
/
q,hh
@C
q
q8gh
@C
q
q8gh
*
q<hh
@+
qThh
+
qlhh
@C
q
q8gh
@C
q
q8gh
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q mh
@+
q8mh
+
qPmh
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q,nh
/
q oh
@C
q
q,nh
@C
q
q,nh
*
q0oh
@+
qHoh
+
q`oh
@C
q
q,nh
@C
q
q,nh
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q,th
+
qDth
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q uh
@C
q
q uh
@C
q
q uh
*
q$vh
@+
q<vh
+
qTvh
@C
q
q uh
@C
q
q uh
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q {h
+
q8{h
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q0}h
+
qH}h
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q,
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q$
+
q<
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q0
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q$
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qx
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
ql
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q|
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q`
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qp
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qT
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qd
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qH
C:\Users\Bill\AppData\Roaming
@C
q
*
qx
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qx
@C
q
+
qX
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q<
C:\Users\Bill\AppData\Roaming
@C
q
*
ql
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
ql
@C
q
+
qL
@C
q
*
q|
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q0
C:\Users\Bill\AppData\Roaming
@C
q
*
q`
@+
qx
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q`
@C
q
+
q@
@C
q
*
qp
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q$
C:\Users\Bill\AppData\Roaming
@C
q
*
qT
@+
ql
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qT
@C
q
+
q4
@C
q
*
qd
@+
q|
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qH
@+
q`
+
qx
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qH
@C
q
+
q(
@C
q
*
qX
@+
qp
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q<
@+
qT
+
ql
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q<
@C
q
@C
q
*
qL
@+
qd
+
q|
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q0
@+
qH
+
q`
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q0
@C
q
@C
q
*
q@
@+
qX
+
qp
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q$
@+
q<
+
qT
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q$
@C
q
@C
q
*
q4
@+
qL
+
qd
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q0
+
qH
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q(
@+
q@
+
qX
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q$
i
+
q<
i
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q4
+
qL
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q0
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q(
+
q@
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q$
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q4
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
ql!i
@+
q
@C
q
ql!i
@C
q
ql!i
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q($i
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q`(i
@+
q
@C
q
q`(i
@C
q
q`(i
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qT/i
@+
q
@C
q
qT/i
@C
q
qT/i
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qH6i
@+
q
@C
q
qH6i
@C
q
qH6i
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qx:i
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q<=i
@+
q
@C
q
q<=i
@C
q
q<=i
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qlAi
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q|Di
C:\Users\Bill\AppData\Roaming
@C
q
q0Di
@+
q
@C
q
q0Di
@C
q
q0Di
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q`Hi
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q|Ji
+
qpKi
C:\Users\Bill\AppData\Roaming
@C
q
q$Ki
@+
q
@C
q
q$Ki
@C
q
q$Ki
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qTOi
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qpQi
+
qdRi
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qtTi
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qHVi
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qdXi
+
qXYi
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qh[i
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q<]i
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qX_i
+
qL`i
C:\Users\Bill\AppData\Roaming
@C
q
*
q|`i
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q|bi
@C
q
+
q\bi
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q0di
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qLfi
+
q@gi
C:\Users\Bill\AppData\Roaming
@C
q
*
qpgi
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q|hi
/
qpii
@C
q
q|hi
+
qPii
@C
q
q|hi
@+
q
@C
q
q|hi
@C
q
q|hi
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q$ki
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q@mi
+
q4ni
C:\Users\Bill\AppData\Roaming
@C
q
*
qdni
@+
q|ni
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qpoi
/
qdpi
@C
q
qpoi
+
qDpi
@C
q
qpoi
*
qtpi
@+
q
@C
q
qpoi
@C
q
qpoi
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q4ti
+
q(ui
C:\Users\Bill\AppData\Roaming
@C
q
*
qXui
@+
qpui
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qdvi
/
qXwi
@C
q
qdvi
+
q8wi
@C
q
qdvi
*
qhwi
@+
q
@C
q
qdvi
@C
q
qdvi
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q({i
C:\Users\Bill\AppData\Roaming
@C
q
*
qL|i
@+
qd|i
+
q||i
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qX}i
/
qL~i
@C
q
qX}i
+
q,~i
@C
q
qX}i
*
q\~i
@+
qt~i
@C
q
qX}i
@C
q
qX}i
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q@
@+
qX
+
qp
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q@
@C
q
+
q
@C
q
*
qP
@+
qh
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q4
@+
qL
+
qd
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q4
@C
q
@C
q
*
qD
@+
q\
+
qt
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q(
@+
q@
+
qX
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q(
@C
q
@C
q
*
q8
@+
qP
+
qh
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q4
+
qL
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q,
@+
qD
+
q\
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q(
+
q@
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q
@+
q8
+
qP
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q4
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q,
+
qD
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q(
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q8
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q,
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qt
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qh
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qx
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q\
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
ql
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qP
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q`
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qD
C:\Users\Bill\AppData\Roaming
@C
q
*
qt
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qt
@C
q
+
qT
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q8
C:\Users\Bill\AppData\Roaming
@C
q
*
qh
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qh
@C
q
+
qH
@C
q
*
qx
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q,
C:\Users\Bill\AppData\Roaming
@C
q
*
q\
@+
qt
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q\ j
@C
q
+
q< j
@C
q
*
ql j
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q,
j
+
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qP
@+
qh
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qP
@C
q
+
q0
@C
q
*
q`
@+
qx
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qD
@+
q\
+
qt
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qD
@C
q
+
q$
@C
q
*
qT
@+
ql
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q8
@+
qP
+
qh
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q8
@C
q
@C
q
*
qH
@+
q`
+
qx
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q,#j
@+
qD#j
+
q\#j
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q8$j
/
q,%j
@C
q
q8$j
@C
q
q8$j
*
q<%j
@+
qT%j
+
ql%j
@C
q
q8$j
@C
q
q8$j
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q *j
@+
q8*j
+
qP*j
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q,+j
/
q ,j
@C
q
q,+j
@C
q
q,+j
*
q0,j
@+
qH,j
+
q`,j
@C
q
q,+j
@C
q
q,+j
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q,1j
+
qD1j
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q 2j
@C
q
q 2j
@C
q
q 2j
*
q$3j
@+
q<3j
+
qT3j
@C
q
q 2j
@C
q
q 2j
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q 8j
+
q88j
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q0:j
+
qH:j
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q,?j
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q$Aj
+
q<Aj
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qtEj
@+
q
+
q Fj
@C
q
qtEj
@C
q
qtEj
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q0Hj
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qhLj
@+
q
@C
q
qhLj
@C
q
qhLj
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q$Oj
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q\Sj
@+
q
@C
q
q\Sj
@C
q
q\Sj
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qPZj
@+
q
@C
q
qPZj
@C
q
qPZj
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qDaj
@+
q
@C
q
qDaj
@C
q
qDaj
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qtej
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q8hj
@+
q
@C
q
q8hj
@C
q
q8hj
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qhlj
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qxoj
C:\Users\Bill\AppData\Roaming
@C
q
q,oj
@+
q
@C
q
q,oj
@C
q
q,oj
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q\sj
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qxuj
+
qlvj
C:\Users\Bill\AppData\Roaming
@C
q
q vj
@+
q
@C
q
q vj
@C
q
q vj
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q|xj
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qPzj
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
ql|j
+
q`}j
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qp
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qT
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qd
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qH
C:\Users\Bill\AppData\Roaming
@C
q
*
qx
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qx
@C
q
+
qX
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q<
C:\Users\Bill\AppData\Roaming
@C
q
*
ql
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
ql
@C
q
+
qL
@C
q
*
q|
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q0
C:\Users\Bill\AppData\Roaming
@C
q
*
q`
@+
qx
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q`
@C
q
+
q@
@C
q
*
qp
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q$
C:\Users\Bill\AppData\Roaming
@C
q
*
qT
@+
ql
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qT
@C
q
+
q4
@C
q
*
qd
@+
q|
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qH
@+
q`
+
qx
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qH
@C
q
+
q(
@C
q
*
qX
@+
qp
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q<
@+
qT
+
ql
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q<
@C
q
@C
q
*
qL
@+
qd
+
q|
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q0
@+
qH
+
q`
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q0
@C
q
@C
q
*
q@
@+
qX
+
qp
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q$
@+
q<
+
qT
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q$
@C
q
@C
q
*
q4
@+
qL
+
qd
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q0
+
qH
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q(
@+
q@
+
qX
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q$
+
q<
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q4
+
qL
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q0
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q(
+
q@
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q$
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q4
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q(
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q|
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qp
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qd
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qt
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qX
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qh
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qL
C:\Users\Bill\AppData\Roaming
@C
q
*
q|
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q|
@C
q
+
q\
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q0!k
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qL#k
+
q@$k
C:\Users\Bill\AppData\Roaming
@C
q
*
qp$k
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q|%k
/
qp&k
@C
q
q|%k
+
qP&k
@C
q
q|%k
@+
q
@C
q
q|%k
@C
q
q|%k
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q$(k
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q@*k
+
q4+k
C:\Users\Bill\AppData\Roaming
@C
q
*
qd+k
@+
q|+k
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qp,k
/
qd-k
@C
q
qp,k
+
qD-k
@C
q
qp,k
*
qt-k
@+
q
@C
q
qp,k
@C
q
qp,k
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q41k
+
q(2k
C:\Users\Bill\AppData\Roaming
@C
q
*
qX2k
@+
qp2k
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qd3k
/
qX4k
@C
q
qd3k
+
q84k
@C
q
qd3k
*
qh4k
@+
q
@C
q
qd3k
@C
q
qd3k
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q(8k
C:\Users\Bill\AppData\Roaming
@C
q
*
qL9k
@+
qd9k
+
q|9k
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qX:k
/
qL;k
@C
q
qX:k
+
q,;k
@C
q
qX:k
*
q\;k
@+
qt;k
@C
q
qX:k
@C
q
qX:k
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q@@k
@+
qX@k
+
qp@k
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qLAk
/
q@Bk
@C
q
qLAk
+
q Bk
@C
q
qLAk
*
qPBk
@+
qhBk
@C
q
qLAk
@C
q
qLAk
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q4Gk
@+
qLGk
+
qdGk
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q@Hk
/
q4Ik
@C
q
q@Hk
@C
q
q@Hk
*
qDIk
@+
q\Ik
+
qtIk
@C
q
q@Hk
@C
q
q@Hk
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q(Nk
@+
q@Nk
+
qXNk
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q4Ok
/
q(Pk
@C
q
q4Ok
@C
q
q4Ok
*
q8Pk
@+
qPPk
+
qhPk
@C
q
q4Ok
@C
q
q4Ok
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q4Uk
+
qLUk
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q(Vk
@C
q
q(Vk
@C
q
q(Vk
*
q,Wk
@+
qDWk
+
q\Wk
@C
q
q(Vk
@C
q
q(Vk
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q(\k
+
q@\k
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q ^k
@+
q8^k
+
qP^k
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q4ck
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q,ek
+
qDek
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q|ik
@+
q
+
q(jk
@C
q
q|ik
@C
q
q|ik
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q lk
+
q8lk
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qppk
@+
q
@C
q
qppk
@C
q
qppk
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q,sk
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qdwk
@+
q
@C
q
qdwk
@C
q
qdwk
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q zk
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qX~k
@+
q
@C
q
qX~k
@C
q
qX~k
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qt
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qh
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qx
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q\
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
ql
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qP
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q`
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qD
C:\Users\Bill\AppData\Roaming
@C
q
*
qt
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qt
@C
q
+
qT
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q8
C:\Users\Bill\AppData\Roaming
@C
q
*
qh
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qh
@C
q
+
qH
@C
q
*
qx
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q,
C:\Users\Bill\AppData\Roaming
@C
q
*
q\
@+
qt
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q\
@C
q
+
q<
@C
q
*
ql
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qP
@+
qh
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qP
@C
q
+
q0
@C
q
*
q`
@+
qx
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qD
@+
q\
+
qt
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qD
@C
q
+
q$
@C
q
*
qT
@+
ql
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q8
@+
qP
+
qh
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q8
@C
q
@C
q
*
qH
@+
q`
+
qx
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q,
@+
qD
+
q\
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q,
@C
q
@C
q
*
q<
@+
qT
+
ql
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q
@+
q8
+
qP
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q
@C
q
@C
q
*
q0
@+
qH
+
q`
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q,
+
qD
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q$
@+
q<
+
qT
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q8
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q0
+
qH
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q,
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q$
+
q<
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q0
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qh l
@+
q
@C
q
qh l
@C
q
qh l
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q$
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qt"l
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q8%l
@+
q
@C
q
q8%l
@C
q
q8%l
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qh)l
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qx,l
C:\Users\Bill\AppData\Roaming
@C
q
q,,l
@+
q
@C
q
q,,l
@C
q
q,,l
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q\0l
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qx2l
+
ql3l
C:\Users\Bill\AppData\Roaming
@C
q
q 3l
@+
q
@C
q
q 3l
@C
q
q 3l
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q|5l
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qP7l
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
ql9l
+
q`:l
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qp<l
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qD>l
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q`@l
+
qTAl
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qdCl
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q8El
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qTGl
+
qHHl
C:\Users\Bill\AppData\Roaming
@C
q
*
qxHl
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qxJl
@C
q
+
qXJl
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q,Ll
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qHNl
+
q<Ol
C:\Users\Bill\AppData\Roaming
@C
q
*
qlOl
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qxPl
/
qlQl
@C
q
qxPl
+
qLQl
@C
q
qxPl
*
q|Ql
@+
q
@C
q
qxPl
@C
q
qxPl
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q Sl
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q<Ul
+
q0Vl
C:\Users\Bill\AppData\Roaming
@C
q
*
q`Vl
@+
qxVl
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qlWl
/
q`Xl
@C
q
qlWl
+
q@Xl
@C
q
qlWl
*
qpXl
@+
q
@C
q
qlWl
@C
q
qlWl
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q0\l
+
q$]l
C:\Users\Bill\AppData\Roaming
@C
q
*
qT]l
@+
ql]l
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q`^l
/
qT_l
@C
q
q`^l
+
q4_l
@C
q
q`^l
*
qd_l
@+
q|_l
@C
q
q`^l
@C
q
q`^l
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q$cl
C:\Users\Bill\AppData\Roaming
@C
q
*
qHdl
@+
q`dl
+
qxdl
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qTel
/
qHfl
@C
q
qTel
+
q(fl
@C
q
qTel
*
qXfl
@+
qpfl
@C
q
qTel
@C
q
qTel
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q<kl
@+
qTkl
+
qlkl
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qHll
/
q<ml
@C
q
qHll
@C
q
qHll
*
qLml
@+
qdml
+
q|ml
@C
q
qHll
@C
q
qHll
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q0rl
@+
qHrl
+
q`rl
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q<sl
/
q0tl
@C
q
q<sl
@C
q
q<sl
*
q@tl
@+
qXtl
+
qptl
@C
q
q<sl
@C
q
q<sl
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q$yl
@+
q<yl
+
qTyl
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q0zl
/
q${l
@C
q
q0zl
@C
q
q0zl
*
q4{l
@+
qL{l
+
qd{l
@C
q
q0zl
@C
q
q0zl
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q0
+
qH
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q(
@+
q@
+
qX
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q$
+
q<
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q4
+
qL
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q0
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q(
+
q@
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q$
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q4
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q(
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q|
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qp
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qd
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qt
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qX
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qh
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qL
C:\Users\Bill\AppData\Roaming
@C
q
*
q|
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q|
@C
q
+
q\
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q@
C:\Users\Bill\AppData\Roaming
@C
q
*
qp
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qp
@C
q
+
qP
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q4
C:\Users\Bill\AppData\Roaming
@C
q
*
qd
@+
q|
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qd
@C
q
+
qD
@C
q
*
qt
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q(
C:\Users\Bill\AppData\Roaming
@C
q
*
qX
@+
qp
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qX
@C
q
+
q8
@C
q
*
qh
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qL
@+
qd
+
q|
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qL
@C
q
+
q,
@C
q
*
q\
@+
qt
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q@
@+
qX
+
qp
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q@
@C
q
+
q
@C
q
*
qP
@+
qh
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q4
@+
qL
+
qd
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q4
@C
q
@C
q
*
qD
@+
q\
+
qt
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q(
@+
q@
+
qX
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q(
m
@C
q
@C
q
*
q8
m
@+
qP
m
+
qh
m
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q4
+
qL
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q,
@+
qD
+
q\
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q(
+
q@
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q
@+
q8
+
qP
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q4 m
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q,"m
+
qD"m
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q|&m
@+
q
+
q('m
@C
q
q|&m
@C
q
q|&m
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q )m
+
q8)m
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qp-m
@+
q
@C
q
qp-m
@C
q
qp-m
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q,0m
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qd4m
@+
q
@C
q
qd4m
@C
q
qd4m
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q 7m
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qX;m
@+
q
@C
q
qX;m
@C
q
qX;m
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qLBm
@+
q
@C
q
qLBm
@C
q
qLBm
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q|Fm
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q@Im
@+
q
@C
q
q@Im
@C
q
q@Im
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qpMm
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q4Pm
@+
q
@C
q
q4Pm
@C
q
q4Pm
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qdTm
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qtWm
C:\Users\Bill\AppData\Roaming
@C
q
q(Wm
@+
q
@C
q
q(Wm
@C
q
q(Wm
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qX[m
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qt]m
+
qh^m
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qx`m
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qLbm
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qhdm
+
q\em
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qlgm
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q@im
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q\km
+
qPlm
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q`nm
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q4pm
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qPrm
+
qDsm
C:\Users\Bill\AppData\Roaming
@C
q
*
qtsm
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qtum
@C
q
+
qTum
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q(wm
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qDym
+
q8zm
C:\Users\Bill\AppData\Roaming
@C
q
*
qhzm
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qt{m
/
qh|m
@C
q
qt{m
+
qH|m
@C
q
qt{m
*
qx|m
@+
q
@C
q
qt{m
@C
q
qt{m
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q,
C:\Users\Bill\AppData\Roaming
@C
q
*
q\
@+
qt
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q\
@C
q
+
q<
@C
q
*
ql
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qP
@+
qh
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qP
@C
q
+
q0
@C
q
*
q`
@+
qx
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qD
@+
q\
+
qt
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qD
@C
q
+
q$
@C
q
*
qT
@+
ql
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q8
@+
qP
+
qh
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q8
@C
q
@C
q
*
qH
@+
q`
+
qx
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q,
@+
qD
+
q\
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q,
@C
q
@C
q
*
q<
@+
qT
+
ql
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q
@+
q8
+
qP
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q
@C
q
@C
q
*
q0
@+
qH
+
q`
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q,
+
qD
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q$
@+
q<
+
qT
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q8
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q0
+
qH
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q,
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q$
+
q<
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q0
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q$
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qx
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
ql
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q|
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q`
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qp
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qT
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qd
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qH
C:\Users\Bill\AppData\Roaming
@C
q
*
qx
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qx
@C
q
+
qX
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q, n
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q<
C:\Users\Bill\AppData\Roaming
@C
q
*
ql
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qx
n
/
ql
@C
q
qx
n
+
qL
@C
q
qx
n
*
q|
@+
q
@C
q
qx
n
@C
q
qx
n
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q0
C:\Users\Bill\AppData\Roaming
@C
q
*
q`
@+
qx
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q`
@C
q
+
q@
@C
q
*
qp
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q$
C:\Users\Bill\AppData\Roaming
@C
q
*
qT
@+
ql
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qT
@C
q
+
q4
@C
q
*
qd
@+
q|
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q$ n
C:\Users\Bill\AppData\Roaming
@C
q
*
qH!n
@+
q`!n
+
qx!n
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qT"n
/
qH#n
@C
q
qT"n
+
q(#n
@C
q
qT"n
*
qX#n
@+
qp#n
@C
q
qT"n
@C
q
qT"n
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q<(n
@+
qT(n
+
ql(n
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qH)n
/
q<*n
@C
q
qH)n
@C
q
qH)n
*
qL*n
@+
qd*n
+
q|*n
@C
q
qH)n
@C
q
qH)n
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q0/n
@+
qH/n
+
q`/n
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q<0n
/
q01n
@C
q
q<0n
@C
q
q<0n
*
q@1n
@+
qX1n
+
qp1n
@C
q
q<0n
@C
q
q<0n
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q$6n
@+
q<6n
+
qT6n
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q07n
/
q$8n
@C
q
q07n
@C
q
q07n
*
q48n
@+
qL8n
+
qd8n
@C
q
q07n
@C
q
q07n
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q0=n
+
qH=n
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q$>n
@C
q
q$>n
@C
q
q$>n
*
q(?n
@+
q@?n
+
qX?n
@C
q
q$>n
@C
q
q$>n
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q$Dn
+
q<Dn
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q4Fn
+
qLFn
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q0Kn
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q(Mn
+
q@Mn
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qxQn
@+
q
+
q$Rn
@C
q
qxQn
@C
q
qxQn
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q4Tn
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qlXn
@+
q
@C
q
qlXn
@C
q
qlXn
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q([n
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q`_n
@+
q
@C
q
q`_n
@C
q
q`_n
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qTfn
@+
q
@C
q
qTfn
@C
q
qTfn
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qHmn
@+
q
@C
q
qHmn
@C
q
qHmn
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qxqn
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q<tn
@+
q
@C
q
q<tn
@C
q
q<tn
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qlxn
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q|{n
C:\Users\Bill\AppData\Roaming
@C
q
q0{n
@+
q
@C
q
q0{n
@C
q
q0{n
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qp
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qd
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qt
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qX
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qh
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qL
C:\Users\Bill\AppData\Roaming
@C
q
*
q|
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q|
@C
q
+
q\
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q@
C:\Users\Bill\AppData\Roaming
@C
q
*
qp
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qp
@C
q
+
qP
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q4
C:\Users\Bill\AppData\Roaming
@C
q
*
qd
@+
q|
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qd
@C
q
+
qD
@C
q
*
qt
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q(
C:\Users\Bill\AppData\Roaming
@C
q
*
qX
@+
qp
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qX
@C
q
+
q8
@C
q
*
qh
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qL
@+
qd
+
q|
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qL
@C
q
+
q,
@C
q
*
q\
@+
qt
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q@
@+
qX
+
qp
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q@
@C
q
+
q
@C
q
*
qP
@+
qh
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q4
@+
qL
+
qd
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q4
@C
q
@C
q
*
qD
@+
q\
+
qt
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q(
@+
q@
+
qX
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q(
@C
q
@C
q
*
q8
@+
qP
+
qh
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q4
+
qL
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q,
@+
qD
+
q\
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q(
+
q@
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q
@+
q8
+
qP
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q4
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q,
+
qD
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q(
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q8
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q,
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qp
o
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q4
o
@+
q
@C
q
q4
o
@C
q
q4
o
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qt
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qh
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qx
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qh!o
+
q\"o
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
ql$o
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q@&o
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q\(o
+
qP)o
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q`+o
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q4-o
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qP/o
+
qD0o
C:\Users\Bill\AppData\Roaming
@C
q
*
qt0o
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qt2o
@C
q
+
qT2o
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q(4o
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qD6o
+
q87o
C:\Users\Bill\AppData\Roaming
@C
q
*
qh7o
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qt8o
/
qh9o
@C
q
qt8o
+
qH9o
@C
q
qt8o
*
qx9o
@+
q
@C
q
qt8o
@C
q
qt8o
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q8=o
+
q,>o
C:\Users\Bill\AppData\Roaming
@C
q
*
q\>o
@+
qt>o
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qh?o
/
q\@o
@C
q
qh?o
+
q<@o
@C
q
qh?o
*
ql@o
@+
q
@C
q
qh?o
@C
q
qh?o
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q,Do
+
q Eo
C:\Users\Bill\AppData\Roaming
@C
q
*
qPEo
@+
qhEo
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q\Fo
/
qPGo
@C
q
q\Fo
+
q0Go
@C
q
q\Fo
*
q`Go
@+
qxGo
@C
q
q\Fo
@C
q
q\Fo
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q Ko
C:\Users\Bill\AppData\Roaming
@C
q
*
qDLo
@+
q\Lo
+
qtLo
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qPMo
/
qDNo
@C
q
qPMo
+
q$No
@C
q
qPMo
*
qTNo
@+
qlNo
@C
q
qPMo
@C
q
qPMo
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q8So
@+
qPSo
+
qhSo
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qDTo
/
q8Uo
@C
q
qDTo
@C
q
qDTo
*
qHUo
@+
q`Uo
+
qxUo
@C
q
qDTo
@C
q
qDTo
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q,Zo
@+
qDZo
+
q\Zo
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q8[o
/
q,\o
@C
q
q8[o
@C
q
q8[o
*
q<\o
@+
qT\o
+
ql\o
@C
q
q8[o
@C
q
q8[o
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q ao
@+
q8ao
+
qPao
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q,bo
/
q co
@C
q
q,bo
@C
q
q,bo
*
q0co
@+
qHco
+
q`co
@C
q
q,bo
@C
q
q,bo
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q,ho
+
qDho
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q io
@C
q
q io
@C
q
q io
*
q$jo
@+
q<jo
+
qTjo
@C
q
q io
@C
q
q io
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q oo
+
q8oo
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q0qo
+
qHqo
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q,vo
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q$xo
+
q<xo
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qt|o
@+
q
+
q }o
@C
q
qt|o
@C
q
qt|o
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q0
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q$
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qx
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
ql
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q|
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q`
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qp
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qT
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qd
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qH
C:\Users\Bill\AppData\Roaming
@C
q
*
qx
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qx
@C
q
+
qX
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q<
C:\Users\Bill\AppData\Roaming
@C
q
*
ql
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
ql
@C
q
+
qL
@C
q
*
q|
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q0
C:\Users\Bill\AppData\Roaming
@C
q
*
q`
@+
qx
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q`
@C
q
+
q@
@C
q
*
qp
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q$
C:\Users\Bill\AppData\Roaming
@C
q
*
qT
@+
ql
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qT
@C
q
+
q4
@C
q
*
qd
@+
q|
@C
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qT
@C
q
+
q4
@C
q
*
qd
@+
q|
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qH
@+
q`
+
qx
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qH
@C
q
+
q(
@C
q
*
qX
@+
qp
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q<
@+
qT
+
ql
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q<
@C
q
@C
q
*
qL
@+
qd
+
q|
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q0
@+
qH
+
q`
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q0
@C
q
@C
q
*
q@
@+
qX
+
qp
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q$
@+
q<
+
qT
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q$
@C
q
@C
q
*
q4
@+
qL
+
qd
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q0
+
qH
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q(
@+
q@
+
qX
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q$
p
+
q<
p
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q4
+
qL
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q0
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q(
+
q@
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q$
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q4
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
ql!p
@+
q
@C
q
ql!p
@C
q
ql!p
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q($p
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q`(p
@+
q
@C
q
q`(p
@C
q
q`(p
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qT/p
@+
q
@C
q
qT/p
@C
q
qT/p
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qH6p
@+
q
@C
q
qH6p
@C
q
qH6p
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qx:p
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q<=p
@+
q
@C
q
q<=p
@C
q
q<=p
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qlAp
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q|Dp
C:\Users\Bill\AppData\Roaming
@C
q
q0Dp
@+
q
@C
q
q0Dp
@C
q
q0Dp
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q`Hp
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q|Jp
+
qpKp
C:\Users\Bill\AppData\Roaming
@C
q
q$Kp
@+
q
@C
q
q$Kp
@C
q
q$Kp
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qTOp
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qpQp
+
qdRp
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qtTp
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qHVp
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qdXp
+
qXYp
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qh[p
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q<]p
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qX_p
+
qL`p
C:\Users\Bill\AppData\Roaming
@C
q
*
q|`p
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q|bp
@C
q
+
q\bp
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q0dp
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qLfp
+
q@gp
C:\Users\Bill\AppData\Roaming
@C
q
*
qpgp
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q|hp
/
qpip
@C
q
q|hp
+
qPip
@C
q
q|hp
@+
q
@C
q
q|hp
@C
q
q|hp
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q$kp
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q@mp
+
q4np
C:\Users\Bill\AppData\Roaming
@C
q
*
qdnp
@+
q|np
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qpop
/
qdpp
@C
q
qpop
+
qDpp
@C
q
qpop
*
qtpp
@+
q
@C
q
qpop
@C
q
qpop
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q4tp
+
q(up
C:\Users\Bill\AppData\Roaming
@C
q
*
qXup
@+
qpup
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qdvp
/
qXwp
@C
q
qdvp
+
q8wp
@C
q
qdvp
*
qhwp
@+
q
@C
q
qdvp
@C
q
qdvp
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q({p
C:\Users\Bill\AppData\Roaming
@C
q
*
qL|p
@+
qd|p
+
q||p
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qX}p
/
qL~p
@C
q
qX}p
+
q,~p
@C
q
qX}p
*
q\~p
@+
qt~p
@C
q
qX}p
@C
q
qX}p
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q@
@+
qX
+
qp
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q@
@C
q
+
q
@C
q
*
qP
@+
qh
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q4
@+
qL
+
qd
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q4
@C
q
@C
q
*
qD
@+
q\
+
qt
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q(
@+
q@
+
qX
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q(
@C
q
@C
q
*
q8
@+
qP
+
qh
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q4
+
qL
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q,
@+
qD
+
q\
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q(
+
q@
@C
q
@C
q0
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qD
sableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qT
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qd
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qH
C:\Users\Bill\AppData\Roaming
@C
q
*
qx
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qx
@C
q
+
qX
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q<
C:\Users\Bill\AppData\Roaming
@C
q
*
ql
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
ql
@C
q
+
qL
@C
q
*
q|
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q0
C:\Users\Bill\AppData\Roaming
@C
q
*
q`
@+
qx
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q`
@C
q
+
q@
@C
q
*
qp
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q$
C:\Users\Bill\AppData\Roaming
@C
q
*
qT
@+
ql
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qT
@C
q
+
q4
@C
q
*
qd
@+
q|
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qH
@+
q`
+
qx
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qH
@C
q
+
q(
@C
q
*
qX
@+
qp
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q<
@+
qT
+
ql
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q<
@C
q
@C
q
*
qL
@+
qd
+
q|
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q0
@+
qH
+
q`
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q0
@C
q
@C
q
*
q@
@+
qX
+
qp
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q$
@+
q<
+
qT
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q$
@C
q
@C
q
*
q4
@+
qL
+
qd
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q0
+
qH
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q(
@+
q@
+
qX
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q$
+
q<
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q4
+
qL
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q0
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q(
+
q@
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q$
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q4
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q(
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qT
q
@+
q
@C
q
qT
q
@C
q
qT
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q|"q
C:\Users\Bill\AppData\Roaming
@C
q
q0"q
@+
q
@C
q
q0"q
@C
q
q0"q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q`&q
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q|(q
+
qp)q
C:\Users\Bill\AppData\Roaming
@C
q
q$)q
@+
q
@C
q
q$)q
@C
q
q$)q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qT-q
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qp/q
+
qd0q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qt2q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qH4q
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qd6q
+
qX7q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qh9q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q<;q
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qX=q
+
qL>q
C:\Users\Bill\AppData\Roaming
@C
q
*
q|>q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q|@q
@C
q
+
q\@q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q0Bq
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qLDq
+
q@Eq
C:\Users\Bill\AppData\Roaming
@C
q
*
qpEq
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q|Fq
/
qpGq
@C
q
q|Fq
+
qPGq
@C
q
q|Fq
@+
q
@C
q
q|Fq
@C
q
q|Fq
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q$Iq
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q@Kq
+
q4Lq
C:\Users\Bill\AppData\Roaming
@C
q
*
qdLq
@+
q|Lq
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qpMq
/
qdNq
@C
q
qpMq
+
qDNq
@C
q
qpMq
*
qtNq
@+
q
@C
q
qpMq
@C
q
qpMq
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q4Rq
+
q(Sq
C:\Users\Bill\AppData\Roaming
@C
q
*
qXSq
@+
qpSq
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qdTq
/
qXUq
@C
q
qdTq
+
q8Uq
@C
q
qdTq
*
qhUq
@+
q
@C
q
qdTq
@C
q
qdTq
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q(Yq
C:\Users\Bill\AppData\Roaming
@C
q
*
qLZq
@+
qdZq
+
q|Zq
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qX[q
/
qL\q
@C
q
qX[q
+
q,\q
@C
q
qX[q
*
q\\q
@+
qt\q
@C
q
qX[q
@C
q
qX[q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q@aq
@+
qXaq
+
qpaq
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qLbq
/
q@cq
@C
q
qLbq
+
q cq
@C
q
qLbq
*
qPcq
@+
qhcq
@C
q
qLbq
@C
q
qLbq
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q4hq
@+
qLhq
+
qdhq
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q@iq
/
q4jq
@C
q
q@iq
@C
q
q@iq
*
qDjq
@+
q\jq
+
qtjq
@C
q
q@iq
@C
q
q@iq
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q(oq
@+
q@oq
+
qXoq
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q4pq
/
q(qq
@C
q
q4pq
@C
q
q4pq
*
q8qq
@+
qPqq
+
qhqq
@C
q
q4pq
@C
q
q4pq
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q4vq
+
qLvq
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q(wq
@C
q
q(wq
@C
q
q(wq
*
q,xq
@+
qDxq
+
q\xq
@C
q
q(wq
@C
q
q(wq
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q(}q
+
q@}q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q
@+
q8
+
qP
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q4
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q,
+
qD
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q(
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q8
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q,
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qt
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qh
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qx
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q\
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qx
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q\
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
ql
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qP
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q`
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qD
C:\Users\Bill\AppData\Roaming
@C
q
*
qt
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qt
@C
q
+
qT
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q8
C:\Users\Bill\AppData\Roaming
@C
q
*
qh
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qh
@C
q
+
qH
@C
q
*
qx
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q,
C:\Users\Bill\AppData\Roaming
@C
q
*
q\
@+
qt
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q\
@C
q
+
q<
@C
q
*
ql
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qP
@+
qh
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qP
@C
q
+
q0
@C
q
*
q`
@+
qx
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qD
@+
q\
+
qt
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qD
@C
q
+
q$
@C
q
*
qT
@+
ql
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q8
@+
qP
+
qh
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q8
@C
q
@C
q
*
qH
@+
q`
+
qx
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q,
@+
qD
+
q\
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q, r
@C
q
@C
q
*
q< r
@+
qT r
+
ql r
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q
@+
q8
+
qP
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q
@C
q
@C
q
*
q0
@+
qH
+
q`
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q,
+
qD
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q$
@+
q<
+
qT
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q8
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q0
+
qH
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q,#r
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q$%r
+
q<%r
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qt)r
@+
q
+
q *r
@C
q
qt)r
@C
q
qt)r
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q0,r
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qh0r
@+
q
@C
q
qh0r
@C
q
qh0r
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q$3r
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q\7r
@+
q
@C
q
q\7r
@C
q
q\7r
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qP>r
@+
q
@C
q
qP>r
@C
q
qP>r
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qDEr
@+
q
@C
q
qDEr
@C
q
qDEr
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qtIr
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q8Lr
@+
q
@C
q
q8Lr
@C
q
q8Lr
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qhPr
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qxSr
C:\Users\Bill\AppData\Roaming
@C
q
q,Sr
@+
q
@C
q
q,Sr
@C
q
q,Sr
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q\Wr
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qxYr
+
qlZr
C:\Users\Bill\AppData\Roaming
@C
q
q Zr
@+
q
@C
q
q Zr
@C
q
q Zr
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q|\r
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qP^r
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
ql`r
+
q`ar
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qpcr
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qDer
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q`gr
+
qThr
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qdjr
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q8lr
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qTnr
+
qHor
C:\Users\Bill\AppData\Roaming
@C
q
*
qxor
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qxqr
@C
q
+
qXqr
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q,sr
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qHur
+
q<vr
C:\Users\Bill\AppData\Roaming
@C
q
*
qlvr
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qxwr
/
qlxr
@C
q
qxwr
+
qLxr
@C
q
qxwr
*
q|xr
@+
q
@C
q
qxwr
@C
q
qxwr
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q zr
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q<|r
+
q0}r
C:\Users\Bill\AppData\Roaming
@C
q
*
q`}r
@+
qx}r
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
ql~r
/
q`
@C
q
ql~r
+
q@
@C
q
ql~r
*
qp
@+
q
@C
q
ql~r
@C
q
ql~r
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q$
C:\Users\Bill\AppData\Roaming
@C
q
*
qT
@+
ql
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qT
@C
q
+
q4
@C
q
*
qd
@+
q|
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qH
@+
q`
+
qx
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qH
@C
q
+
q(
@C
q
*
qX
@+
qp
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q<
@+
qT
+
ql
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q<
@C
q
@C
q
*
qL
@+
qd
+
q|
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q0
@+
qH
+
q`
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q0
@C
q
@C
q
*
q@
@+
qX
+
qp
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q$
@+
q<
+
qT
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q$
@C
q
@C
q
*
q4
@+
qL
+
qd
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q0
+
qH
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q(
@+
q@
+
qX
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q$
+
q<
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q4
+
qL
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q0
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q(
+
q@
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q$
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q4
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q(
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q|
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qp
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qd
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qt
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qX
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qh
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qL
C:\Users\Bill\AppData\Roaming
@C
q
*
q|
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q|
@C
q
+
q\
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q@
C:\Users\Bill\AppData\Roaming
@C
q
*
qp
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q| s
/
qp
s
@C
q
q| s
+
qP
s
@C
q
q| s
@+
q
@C
q
q| s
@C
q
q| s
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q4
C:\Users\Bill\AppData\Roaming
@C
q
*
qd
@+
q|
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qd
@C
q
+
qD
@C
q
*
qt
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q(
C:\Users\Bill\AppData\Roaming
@C
q
*
qX
@+
qp
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qX
@C
q
+
q8
@C
q
*
qh
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qL
@+
qd
+
q|
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qL
@C
q
+
q,
@C
q
*
q\
@+
qt
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q@$s
@+
qX$s
+
qp$s
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qL%s
/
q@&s
@C
q
qL%s
+
q &s
@C
q
qL%s
*
qP&s
@+
qh&s
@C
q
qL%s
@C
q
qL%s
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q4+s
@+
qL+s
+
qd+s
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q@,s
/
q4-s
@C
q
q@,s
@C
q
q@,s
*
qD-s
@+
q\-s
+
qt-s
@C
q
q@,s
@C
q
q@,s
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q(2s
@+
q@2s
+
qX2s
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q43s
/
q(4s
@C
q
q43s
@C
q
q43s
*
q84s
@+
qP4s
+
qh4s
@C
q
q43s
@C
q
q43s
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q49s
+
qL9s
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q(:s
@C
q
q(:s
@C
q
q(:s
*
q,;s
@+
qD;s
+
q\;s
@C
q
q(:s
@C
q
q(:s
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q(@s
+
q@@s
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q Bs
@+
q8Bs
+
qPBs
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q4Gs
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q,Is
+
qDIs
@C
q
@C
q
@C
q
q8~W
.
qlIs
.
qx
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qpNs
@+
q
@C
q
qpNs
@C
q
qpNs
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q,Qs
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qdUs
@+
q
@C
q
qdUs
@C
q
qdUs
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q Xs
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qX\s
@+
q
@C
q
qX\s
@C
q
qX\s
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qLcs
@+
q
@C
q
qLcs
@C
q
qLcs
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q|gs
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q@js
@+
q
@C
q
q@js
@C
q
q@js
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qpns
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q4qs
@+
q
@C
q
q4qs
@C
q
q4qs
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qdus
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qtxs
C:\Users\Bill\AppData\Roaming
@C
q
q(xs
@+
q
@C
q
q(xs
@C
q
q(xs
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qX|s
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qt~s
+
qh
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qx
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q\
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
ql
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qP
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q`
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qD
C:\Users\Bill\AppData\Roaming
@C
q
*
qt
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qt
@C
q
+
qT
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q8
C:\Users\Bill\AppData\Roaming
@C
q
*
qh
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qh
@C
q
+
qH
@C
q
*
qx
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q,
C:\Users\Bill\AppData\Roaming
@C
q
*
q\
@+
qt
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q\
@C
q
+
q<
@C
q
*
ql
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qP
@+
qh
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qP
@C
q
+
q0
@C
q
*
q`
@+
qx
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qD
@+
q\
+
qt
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qD
@C
q
+
q$
@C
q
*
qT
@+
ql
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q8
@+
qP
+
qh
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q8
@C
q
@C
q
*
qH
@+
q`
+
qx
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q,
@+
qD
+
q\
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q,
@C
q
@C
q
*
q<
@+
qT
+
ql
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q
@+
q8
+
qP
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q
@C
q
@C
q
*
q0
@+
qH
+
q`
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q,
+
qD
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q$
@+
q<
+
qT
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q8
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q0
+
qH
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q,
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q$
+
q<
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q0
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q$
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qx
t
C:\Users\Bill\AppData\Roaming
@C
q
q,
t
@+
q
@C
q
q,
t
@C
q
q,
t
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
ql
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q|
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q`
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qp
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qT
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qd!t
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q8#t
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qT%t
+
qH&t
C:\Users\Bill\AppData\Roaming
@C
q
*
qx&t
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qx(t
@C
q
+
qX(t
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q,*t
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qH,t
+
q<-t
C:\Users\Bill\AppData\Roaming
@C
q
*
ql-t
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qx.t
/
ql/t
@C
q
qx.t
+
qL/t
@C
q
qx.t
*
q|/t
@+
q
@C
q
qx.t
@C
q
qx.t
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q 1t
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q<3t
+
q04t
C:\Users\Bill\AppData\Roaming
@C
q
*
q`4t
@+
qx4t
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
ql5t
/
q`6t
@C
q
ql5t
+
q@6t
@C
q
ql5t
*
qp6t
@+
q
@C
q
ql5t
@C
q
ql5t
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q0:t
+
q$;t
C:\Users\Bill\AppData\Roaming
@C
q
*
qT;t
@+
ql;t
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q`<t
/
qT=t
@C
q
q`<t
+
q4=t
@C
q
q`<t
*
qd=t
@+
q|=t
@C
q
q`<t
@C
q
q`<t
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q$At
C:\Users\Bill\AppData\Roaming
@C
q
*
qHBt
@+
q`Bt
+
qxBt
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qTCt
/
qHDt
@C
q
qTCt
+
q(Dt
@C
q
qTCt
*
qXDt
@+
qpDt
@C
q
qTCt
@C
q
qTCt
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q<It
@+
qTIt
+
qlIt
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qHJt
/
q<Kt
@C
q
qHJt
@C
q
qHJt
*
qLKt
@+
qdKt
+
q|Kt
@C
q
qHJt
@C
q
qHJt
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q0Pt
@+
qHPt
+
q`Pt
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q<Qt
/
q0Rt
@C
q
q<Qt
@C
q
q<Qt
*
q@Rt
@+
qXRt
+
qpRt
@C
q
q<Qt
@C
q
q<Qt
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q$Wt
@+
q<Wt
+
qTWt
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q0Xt
/
q$Yt
@C
q
q0Xt
@C
q
q0Xt
*
q4Yt
@+
qLYt
+
qdYt
@C
q
q0Xt
@C
q
q0Xt
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q0^t
+
qH^t
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q$_t
@C
q
q$_t
@C
q
q$_t
*
q(`t
@+
q@`t
+
qX`t
@C
q
q$_t
@C
q
q$_t
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q$et
+
q<et
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q4gt
+
qLgt
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q0lt
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q(nt
+
q@nt
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qxrt
@+
q
+
q$st
@C
q
qxrt
@C
q
qxrt
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q4ut
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qlyt
@+
q
@C
q
qlyt
@C
q
qlyt
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q(|t
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q|
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qp
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qd
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qt
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qX
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qh
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qL
C:\Users\Bill\AppData\Roaming
@C
q
*
q|
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q|
@C
q
+
q\
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q@
C:\Users\Bill\AppData\Roaming
@C
q
*
qp
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qp
@C
q
+
qP
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q4
C:\Users\Bill\AppData\Roaming
@C
q
*
qd
@+
q|
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qd
@C
q
+
qD
@C
q
*
qt
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q(
C:\Users\Bill\AppData\Roaming
@C
q
*
qX
@+
qp
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qX
@C
q
+
q8
@C
q
*
qh
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
qL
@+
qd
+
q|
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qL
@C
q
+
q,
@C
q
*
q\
@+
qt
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q@
@+
qX
+
qp
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q@
@C
q
+
q
@C
q
*
qP
@+
qh
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q4
@+
qL
+
qd
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q4
@C
q
@C
q
*
qD
@+
q\
+
qt
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q(
@+
q@
+
qX
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q(
@C
q
@C
q
*
q8
@+
qP
+
qh
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q4
+
qL
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q,
@+
qD
+
q\
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q(
+
q@
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q
@+
q8
+
qP
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q4
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q,
+
qD
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q(
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q8
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q,
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
qL u
@+
q
@C
q
qL u
@C
q
qL u
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q|$u
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q@'u
@+
q
@C
q
q@'u
@C
q
q@'u
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qp+u
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
q4.u
@+
q
@C
q
q4.u
@C
q
q4.u
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qd2u
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qt5u
C:\Users\Bill\AppData\Roaming
@C
q
q(5u
@+
q
@C
q
q(5u
@C
q
q(5u
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qX9u
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qt;u
+
qh<u
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qx>u
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qL@u
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qhBu
+
q\Cu
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qlEu
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q@Gu
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q\Iu
+
qPJu
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q`Lu
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q4Nu
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qPPu
+
qDQu
C:\Users\Bill\AppData\Roaming
@C
q
*
qtQu
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qtSu
@C
q
+
qTSu
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q(Uu
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qDWu
+
q8Xu
C:\Users\Bill\AppData\Roaming
@C
q
*
qhXu
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qtYu
/
qhZu
@C
q
qtYu
+
qHZu
@C
q
qtYu
*
qxZu
@+
q
@C
q
qtYu
@C
q
qtYu
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q8^u
+
q,_u
C:\Users\Bill\AppData\Roaming
@C
q
*
q\_u
@+
qt_u
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qh`u
/
q\au
@C
q
qh`u
+
q<au
@C
q
qh`u
*
qlau
@+
q
@C
q
qh`u
@C
q
qh`u
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q,eu
+
q fu
C:\Users\Bill\AppData\Roaming
@C
q
*
qPfu
@+
qhfu
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q\gu
/
qPhu
@C
q
q\gu
+
q0hu
@C
q
q\gu
*
q`hu
@+
qxhu
@C
q
q\gu
@C
q
q\gu
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q lu
C:\Users\Bill\AppData\Roaming
@C
q
*
qDmu
@+
q\mu
+
qtmu
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qPnu
/
qDou
@C
q
qPnu
+
q$ou
@C
q
qPnu
*
qTou
@+
qlou
@C
q
qPnu
@C
q
qPnu
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q8tu
@+
qPtu
+
qhtu
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qDuu
/
q8vu
@C
q
qDuu
@C
q
qDuu
*
qHvu
@+
q`vu
+
qxvu
@C
q
qDuu
@C
q
qDuu
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q,{u
@+
qD{u
+
q\{u
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
q8|u
/
q,}u
@C
q
q8|u
@C
q
q8|u
*
q<}u
@+
qT}u
+
ql}u
@C
q
q8|u
@C
q
q8|u
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
*
q
@+
q8
+
qP
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q
@C
q
@C
q
*
q0
@+
qH
+
q`
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q,
+
qD
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
*
q$
@+
q<
+
qT
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q8
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q0
+
qH
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q,
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q$
+
q<
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q0
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
+
q$
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qx
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
ql
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q|
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q`
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qp
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qT
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qd
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qH
C:\Users\Bill\AppData\Roaming
@C
q
*
qx
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qx
@C
q
+
qX
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q<
C:\Users\Bill\AppData\Roaming
@C
q
*
ql
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
ql
@C
q
+
qL
@C
q
*
q|
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q0
C:\Users\Bill\AppData\Roaming
@C
q
*
q`
@+
qx
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q`
@C
q
+
q@
@C
q
*
qp
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
q$
C:\Users\Bill\AppData\Roaming
@C
q
*
qT
@+
ql
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qT
@C
q
+
q4
@C
q
*
qd
@+
q|
@C
q
@C
q
Bill-PC
192.168.1.1
255.255.255.255
@C
q
{902A6B7D-F035-41A6-A06E-631E2332252E}
localdomain
Intel(R) PRO/1000 MT Desktop Adapter
Local Area Connection
5
q$
@C
q
5
q$
5
q$
5
q$
5
q$
@C
q
@C
q
pt v
5
q$
stRr
stRr
tsrR~
@C
q
p v
@C
q
{846EE342-7039-11DE-9D20-806E6F6E6963}
Software Loopback Interface 1
Loopback Pseudo-Interface 1
p
v
pl
v
5
q$
@C
q
5
q$
@C
q
5
q$
5
q$
5
q$
@C
q
{211D11D6-0DE3-433E-B35B-0C9BD5497545}
Teredo Tunneling Pseudo-Interface
Teredo Tunneling Pseudo-Interface
5
q$
@C
q
5
q$
5
q$
pX,W
5
q$
@C
q
{A8EC83FF-F63B-4A2C-B32C-A073CC6AE773}
localdomain
Microsoft ISATAP Adapter #2
isatap.localdomain
p4 v
5
q$
@C
q
p@ v
pP v
@C
q
p@!v
pP!v
pt!v
5
q$
p4"v
p4"v
@C
q
@C
q
{902A6B7D-F035-41A6-A06E-631E2332252E}
Intel(R) PRO/1000 MT Desktop Adapter
192.168.1.101
255.255.255.0
192.168.1.1
255.255.255.255
192.168.1.1
255.255.255.255
+
qP&v
@C
q
q@&v
pP'v
@C
q
p|'v
@C
q
p$(v
pX,W
pH(v
pX(v
pX,W
p|(v
pX,W
p$(v
pX(v
p<)v
\DEVICE\TCPIP_{902A6B7D-F035-41A6-A06E-631E2332252E}
Intel(R) PRO/1000 MT Desktop Adapter
192.168.1.1
255.255.255.255
pp+v
@C
q
noftp
nophp
q`,v
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q|.v
+
qp/v
C:\Users\Bill\AppData\Roaming
@C
q
q$/v
@+
q
@C
q
q$/v
@C
q
q$/v
\.minecraft\lastlogin
C:\Users\Bill\AppData\Roaming\.minecraft\lastlogin
C:\Users\Bill\AppData\Roaming\.minecraft\lastlogin
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qh3v
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
+
qx6v
C:\Users\Bill\AppData\Roaming
@C
q
q,6v
@+
q
@C
q
q,6v
@C
q
q,6v
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q\:v
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qx<v
+
ql=v
C:\Users\Bill\AppData\Roaming
@C
q
q =v
@+
q
@C
q
q =v
@C
q
q =v
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
q|?v
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qPAv
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qlCv
+
q`Dv
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qpFv
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
qDHv
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q`Jv
+
qTKv
C:\Users\Bill\AppData\Roaming
@C
q
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
@C
q
+
qdMv
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q8Ov
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qTQv
+
qHRv
C:\Users\Bill\AppData\Roaming
@C
q
*
qxRv
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
qxTv
@C
q
+
qXTv
@C
q
@+
q
@C
q
@C
q
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q,Vv
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
qHXv
+
q<Yv
C:\Users\Bill\AppData\Roaming
@C
q
*
qlYv
@+
q
@C
q
@C
q
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
qxZv
/
ql[v
@C
q
qxZv
+
qL[v
@C
q
qxZv
*
q|[v
@+
q
@C
q
qxZv
@C
q
qxZv
DisableTaskManager
DisableTaskManager
Disablecmd
Disablemsconfig
Disablereg
Disablestartup
q ]v
C:\Users\Bill\AppData\Roaming
C:\Users\Bill\AppData\Roaming
@C
q
q<_v
+
q0`v
C:\Users\Bill\AppData\Roaming
@C
q
*
q``v
@+
qx`v
@C
q
@C
q0
\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
C:\Users\Bill\AppData\Roaming\WindowsUpdate.exe
@C
q
/
q|
@C
q
+
q\
@C
q
@+
q
@C
q
qd`v
@C
q
qd`v
@C
q
qd`v
@C
q
qd`v
+
q$cv
@C
q
qd`v
*
qTcv
@+
qlcv
@C
q
qd`v
@C
q
qd`v
@C
q
qd`v
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
q\jv
/
qPkv
@C
q
q\jv
+
q0kv
@C
q
q\jv
*
q`kv
@+
qxkv
@C
q
q\jv
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
qDlv
/
q8mv
@C
q
qDlv
@C
q
qDlv
*
qHmv
@+
q`mv
+
qxmv
@C
q
qDlv
@C
q
@C
q
qDlv
@C
q
qDlv
@C
q
qDlv
*
qHnv
@+
q`nv
+
qxnv
@C
q
qDlv
@C
q
qDlv
@C
q
qDlv
@C
q
qDlv
@C
q
qDlv
*
q4ov
@+
qLov
+
qdov
@C
q
qDlv
@C
q
qDlv
@C
q
qDlv
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
q<vv
/
q0wv
@C
q
q<vv
@C
q
q<vv
*
q@wv
@+
qXwv
+
qpwv
@C
q
q<vv
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
q$xv
@C
q
q$xv
@C
q
q$xv
*
q(yv
@+
q@yv
+
qXyv
@C
q
q$xv
@C
q
@C
q
q$xv
@C
q
q$xv
@C
q
q$xv
*
q(zv
@+
q@zv
+
qXzv
@C
q
q$xv
@C
q
q$xv
@C
q
q$xv
@C
q
q$xv
@C
q
q$xv
@+
q,{v
+
qD{v
@C
q
q$xv
@C
q
q$xv
@C
q
q$xv
qt}v
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
*
q
@+
q8
+
qP
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
@+
q
+
q8
@C
q
@C
q
@C
q
@C
q
@C
q
@+
q
+
q8
@C
q
@C
q
@C
q
@C
q
@C
q
@+
q
+
q$
@C
q
@C
q
@C
q
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
@+
q
+
q0
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
@C
q
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
1
qh
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
@C
q
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
1
qH
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
+
qx
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
+
qx
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
+
qd
@C
q
@+
q
@C
q
@C
q
@C
q
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
1
q(
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
+
qp
@C
q
@+
q
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
/
qx
@C
q
+
qX
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
+
qX
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
+
qD
@C
q
*
qt
@+
q
@C
q
@C
q
@C
q
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
/
qp
@C
q
+
qP
@C
q
@+
q
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
/
qX
@C
q
+
q8
@C
q
*
qh
@+
q
@C
q
@C
q
@C
q
@C
q
+
q8
@C
q
*
qh
@+
q
@C
q
@C
q
@C
q
@C
q
+
q$
@C
q
*
qT
@+
ql
@C
q
@C
q
@C
q
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
/
qP
@C
q
+
q0
@C
q
*
q`
@+
qx
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
/
q8
@C
q
@C
q
*
qH
@+
q`
+
qx
@C
q
@C
q
@C
q
@C
q
@C
q
*
qH
@+
q`
+
qx
@C
q
@C
q
@C
q
@C
q
@C
q
*
q4
@+
qL
+
qd
@C
q
@C
q
@C
q
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
/
q0
@C
q
@C
q
*
q@
@+
qX
+
qp
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
*
q(
@+
q@
+
qX
@C
q
@C
q
@C
q
@C
q
@C
q
*
q(
@+
q@
+
qX
@C
q
@C
q
@C
q
@C
q
@C
q
@+
q,
+
qD
@C
q
@C
q
@C
q
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
*
q
@+
q8
+
qP
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
@+
q
+
q8
@C
q
@C
q
@C
q
@C
q
@C
q
@+
q
+
q8
@C
q
@C
q
@C
q
@C
q
@C
q
@+
q
+
q$
@C
q
@C
q
@C
q
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
@+
q
+
q0
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
@C
q
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
1
qh
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
@C
q
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
1
qH
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
+
qx
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
+
qx
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
+
qd w
@C
q
@+
q
@C
q
@C
q
@C
q
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
1
q(
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
+
qp
@C
q
@+
q
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
/
qx
@C
q
+
qX
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
+
qX
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
+
qD
@C
q
*
qt
@+
q
@C
q
@C
q
@C
q
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
/
qp
@C
q
+
qP
@C
q
@+
q
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
/
qX
@C
q
+
q8
@C
q
*
qh
@+
q
@C
q
@C
q
@C
q
@C
q
+
q8 w
@C
q
*
qh w
@+
q
@C
q
@C
q
@C
q
@C
q
+
q$!w
@C
q
*
qT!w
@+
ql!w
@C
q
@C
q
@C
q
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
q\(w
/
qP)w
@C
q
q\(w
+
q0)w
@C
q
q\(w
*
q`)w
@+
qx)w
@C
q
q\(w
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
qD*w
/
q8+w
@C
q
qD*w
@C
q
qD*w
*
qH+w
@+
q`+w
+
qx+w
@C
q
qD*w
@C
q
@C
q
qD*w
@C
q
qD*w
@C
q
qD*w
*
qH,w
@+
q`,w
+
qx,w
@C
q
qD*w
@C
q
qD*w
@C
q
qD*w
@C
q
qD*w
@C
q
qD*w
*
q4-w
@+
qL-w
+
qd-w
@C
q
qD*w
@C
q
qD*w
@C
q
qD*w
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
q<4w
/
q05w
@C
q
q<4w
@C
q
q<4w
*
q@5w
@+
qX5w
+
qp5w
@C
q
q<4w
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
q$6w
@C
q
q$6w
@C
q
q$6w
*
q(7w
@+
q@7w
+
qX7w
@C
q
q$6w
@C
q
@C
q
q$6w
@C
q
q$6w
@C
q
q$6w
*
q(8w
@+
q@8w
+
qX8w
@C
q
q$6w
@C
q
q$6w
@C
q
q$6w
@C
q
q$6w
@C
q
q$6w
@+
q,9w
+
qD9w
@C
q
q$6w
@C
q
q$6w
@C
q
q$6w
qt;w
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
op>w
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
*
q Aw
@+
q8Aw
+
qPAw
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
@+
q Cw
+
q8Cw
@C
q
@C
q
@C
q
@C
q
@C
q
@+
q Dw
+
q8Dw
@C
q
@C
q
@C
q
@C
q
@C
q
@+
q
+
q$Ew
@C
q
@C
q
@C
q
qTGw
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
oPJw
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
@+
q
+
q0Mw
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
@C
q
q4Sw
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
o0Vw
1
qhVw
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
@C
q
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
1
qHbw
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
+
qxfw
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
+
qxgw
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
+
qdhw
@C
q
@+
q
@C
q
@C
q
@C
q
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
1
q(nw
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
+
qppw
@C
q
@+
q
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
/
qxrw
@C
q
+
qXrw
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
+
qXsw
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
+
qDtw
@C
q
*
qttw
@+
q
@C
q
@C
q
@C
q
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
q|{w
/
qp|w
@C
q
q|{w
+
qP|w
@C
q
q|{w
@+
q
@C
q
q|{w
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
qd}w
/
qX~w
@C
q
qd}w
+
q8~w
@C
q
qd}w
*
qh~w
@+
q
@C
q
qd}w
@C
q
@C
q
qd}w
@C
q
qd}w
+
q8
@C
q
qd}w
*
qh
@+
q
@C
q
qd}w
@C
q
qd}w
@C
q
qd}w
@C
q
qd}w
+
q$
@C
q
qd}w
*
qT
@+
ql
@C
q
qd}w
@C
q
qd}w
@C
q
qd}w
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
/
qP
@C
q
+
q0
@C
q
*
q`
@+
qx
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
/
q8
@C
q
@C
q
*
qH
@+
q`
+
qx
@C
q
@C
q
@C
q
@C
q
@C
q
*
qH
@+
q`
+
qx
@C
q
@C
q
@C
q
@C
q
@C
q
*
q4
@+
qL
+
qd
@C
q
@C
q
@C
q
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
/
q0
@C
q
@C
q
*
q@
@+
qX
+
qp
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
*
q(
@+
q@
+
qX
@C
q
@C
q
@C
q
@C
q
@C
q
*
q(
@+
q@
+
qX
@C
q
@C
q
@C
q
@C
q
@C
q
@+
q,
+
qD
@C
q
@C
q
@C
q
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
*
q
@+
q8
+
qP
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
@+
q
+
q8
@C
q
@C
q
@C
q
@C
q
@C
q
@+
q
+
q8
@C
q
@C
q
@C
q
@C
q
@C
q
@+
q
+
q$
@C
q
@C
q
@C
q
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
@+
q
+
q0
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
@C
q
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
1
qh
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
@C
q
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
1
qH
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
@+
q
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
+
qx
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
+
qx
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
+
qd
@C
q
@+
q
@C
q
@C
q
@C
q
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
1
q(
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
+
qp
@C
q
@+
q
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
/
qx
@C
q
+
qX
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
+
qX
@C
q
@+
q
@C
q
@C
q
@C
q
@C
q
+
qD
@C
q
*
qt
@+
q
@C
q
@C
q
@C
q
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
/
qp
@C
q
+
qP
@C
q
@+
q
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
/
qX
@C
q
+
q8
@C
q
*
qh
@+
q
@C
q
@C
q
@C
q
@C
q
+
q8
@C
q
*
qh
@+
q
@C
q
@C
q
@C
q
@C
q
+
q$
@C
q
*
qT
@+
ql
@C
q
@C
q
@C
q
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
/
qP
@C
q
+
q0
@C
q
*
q`
@+
qx
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
/
q8
@C
q
@C
q
*
qH
@+
q`
+
qx
@C
q
@C
q
@C
q
@C
q
@C
q
*
qH
@+
q`
+
qx
@C
q
@C
q
@C
q
@C
q
@C
q
*
q4
@+
qL
+
qd
@C
q
@C
q
@C
q
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
q
4(
q
4(
q
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
/
q0
@C
q
@C
q
*
q@
@+
qX
+
qp
@C
q
@C
q
holdermail.txt
C:\Users\Bill\AppData\Local\Temp\holdermail.txt
@C
q
@C
q
@C
q
*
q(
@+
q@
+
qX
@C
q
@C
q
@C
q
@C
q
@C
q
*
q(
@+
q@
+
qX
@C
q
@C
q
@C
q
@C
q
@C
q
@+
q,
+
qD
@C
q
@C
q
@C
q
Could not find file '
Could not find file '{0}'.
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt
Could not find file 'C:\Users\Bill\AppData\Local\Temp\holdermail.txt'.
b\q,
4(
q
4(
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment