Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

External WD HD infected with Win32:Kryptik.LQL

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Re: External WD HD infected with Win32:Kryptik.LQL

Unread postby ssmad » May 25th, 2013, 8:34 pm

Gmer Part3

.text C:\Windows\system32\lsass.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Windows\system32\lsass.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 0000000077040400
.text C:\Windows\system32\lsass.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Windows\system32\lsass.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Windows\system32\lsass.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
.text C:\Windows\system32\lsass.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Windows\system32\lsass.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Windows\system32\lsass.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Windows\system32\lsass.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000077040470
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000077040460
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000077040370
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000077040480
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 00000000770403e0
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000077040320
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000000770403b0
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000077040490
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000000770403a0
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000000770402f0
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000077040350
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000077040290
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000000770402b0
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000000770403d0
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000077040330
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0x15e590}
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000077040410
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000077040240
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000000770401e0
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000077040250
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0x15e090}
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000000770404a0
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000000770404b0
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000077040300
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000077040360
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000000770402a0
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000000770402c0
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000077040380
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000077040340
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000077040450
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000077040260
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 0000000077040400
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Windows\system32\lsm.exe[724] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000077040470
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000077040460
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000077040370
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000077040480
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 00000000770403e0
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000077040320
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000000770403b0
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000077040490
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000000770403a0
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000000770402f0
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000077040350
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000077040290
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000000770402b0
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000000770403d0
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000077040330
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0x15e590}
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000077040410
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000077040240
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000000770401e0
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000077040250
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0x15e090}
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000000770404a0
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000000770404b0
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000077040300
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000077040360
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000000770402a0
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000000770402c0
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000077040380
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000077040340
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000077040450
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000077040260
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 0000000077040400
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Windows\system32\winlogon.exe[772] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dceecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000100070470
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000100070460
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000100070370
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000100070480
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 00000001000703e0
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000100070320
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000001000703b0
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000100070390
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000001000702e0
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000100070440
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000001000702d0
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000100070310
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000001000703c0
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000001000703f0
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000100070230
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0xffffffff8918e890}
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000100070490
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000001000703a0
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000001000702f0
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000100070350
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000100070290
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000001000702b0
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000001000703d0
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000100070330
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0xffffffff8918e590}
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000100070410
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000100070240
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000001000701e0
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000100070250
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0xffffffff8918e090}
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000001000704a0
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000001000704b0
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000100070300
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000100070360
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000001000702a0
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000001000702c0
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000100070380
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000100070340
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000100070450
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000100070260
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000100070270
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 0000000100070400
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000001000701f0
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000100070210
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000100070200
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000100070420
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000100070430
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000100070220
.text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000100070280
.text C:\Windows\system32\svchost.exe[868] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dceecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000077040470
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000077040460
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000077040370
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000077040480
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 00000000770403e0
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000077040320
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000000770403b0
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000077040490
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000000770403a0
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000000770402f0
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000077040350
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000077040290
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000000770402b0
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000000770403d0
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000077040330
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0x15e590}
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000077040410
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000077040240
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000000770401e0
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000077040250
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0x15e090}
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000000770404a0
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000000770404b0
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000077040300
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000077040360
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000000770402a0
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000000770402c0
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000077040380
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000077040340
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000077040450
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000077040260
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 0000000077040400
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000077040470
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000077040460
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000077040370
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000077040480
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 00000000770403e0
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000077040320
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000000770403b0
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000077040490
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000000770403a0
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000000770402f0
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000077040350
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000077040290
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000000770402b0
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000000770403d0
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000077040330
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0x15e590}
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000077040410
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000077040240
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000000770401e0
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000077040250
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0x15e090}
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000000770404a0
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000000770404b0
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000077040300
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000077040360
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000000770402a0
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000000770402c0
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000077040380
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000077040340
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000077040450
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000077040260
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 0000000077040400
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Windows\System32\svchost.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Windows\System32\svchost.exe[408] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dceecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000077040470
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000077040460
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000077040370
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000077040480
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 00000000770403e0
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000077040320
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000000770403b0
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000077040490
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000000770403a0
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000000770402f0
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000077040350
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000077040290
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000000770402b0
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000000770403d0
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000077040330
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0x15e590}
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000077040410
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000077040240
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000000770401e0
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000077040250
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0x15e090}
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000000770404a0
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000000770404b0
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000077040300
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000077040360
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000000770402a0
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000000770402c0
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000077040380
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000077040340
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000077040450
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000077040260
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 0000000077040400
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Windows\System32\svchost.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Windows\System32\svchost.exe[468] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dceecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000077040470
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000077040460
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000077040370
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000077040480
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 00000000770403e0
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000077040320
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000000770403b0
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000077040490
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000000770403a0
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000000770402f0
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000077040350
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000077040290
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000000770402b0
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000000770403d0
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000077040330
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0x15e590}
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000077040410
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000077040240
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000000770401e0
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000077040250
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0x15e090}
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000000770404a0
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000000770404b0
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000077040300
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000077040360
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000000770402a0
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000000770402c0
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000077040380
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000077040340
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000077040450
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000077040260
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 0000000077040400
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Windows\system32\svchost.exe[644] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dceecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000077040470
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000077040460
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000077040370
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000077040480
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 00000000770403e0
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000077040320
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000000770403b0
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000077040490
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000000770403a0
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000000770402f0
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000077040350
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000077040290
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000000770402b0
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000000770403d0
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000077040330
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0x15e590}
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000077040410
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000077040240
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000000770401e0
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000077040250
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0x15e090}
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000000770404a0
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000000770404b0
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000077040300
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000077040360
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000000770402a0
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000000770402c0
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000077040380
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000077040340
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000077040450
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000077040260
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 0000000077040400
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Windows\system32\svchost.exe[1160] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dceecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000077040470
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000077040460
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000077040370
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000077040480
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 00000000770403e0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000077040320
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000000770403b0
ssmad
Regular Member
 
Posts: 41
Joined: May 25th, 2013, 12:10 pm
Advertisement
Register to Remove

Re: External WD HD infected with Win32:Kryptik.LQL

Unread postby ssmad » May 25th, 2013, 8:35 pm

Gmer Part4

.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000077040490
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000000770403a0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000000770402f0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000077040350
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000077040290
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000000770402b0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000000770403d0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000077040330
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0x15e590}
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000077040410
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000077040240
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000000770401e0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000077040250
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0x15e090}
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000000770404a0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000000770404b0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000077040300
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000077040360
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000000770402a0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000000770402c0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000077040380
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000077040340
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000077040450
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000077040260
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 0000000077040400
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dceecd 1 byte [62]
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000077040470
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000077040460
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000077040370
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000077040480
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 00000000770403e0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000077040320
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000000770403b0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000077040490
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000000770403a0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000000770402f0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000077040350
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000077040290
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000000770402b0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000000770403d0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000077040330
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0x15e590}
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000077040410
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000077040240
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000000770401e0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000077040250
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0x15e090}
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000000770404a0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000000770404b0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000077040300
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000077040360
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000000770402a0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000000770402c0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000077040380
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000077040340
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000077040450
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000077040260
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 0000000077040400
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dceecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000077040470
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000077040460
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000077040370
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000077040480
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 00000000770403e0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000077040320
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000000770403b0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000077040490
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000000770403a0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000000770402f0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000077040350
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000077040290
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000000770402b0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000000770403d0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000077040330
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0x15e590}
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000077040410
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000077040240
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000000770401e0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000077040250
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0x15e090}
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000000770404a0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000000770404b0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000077040300
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000077040360
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000000770402a0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000000770402c0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000077040380
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000077040340
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000077040450
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000077040260
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 0000000077040400
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dceecd 1 byte [62]
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000077040470
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000077040460
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000077040370
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000077040480
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 00000000770403e0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000077040320
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000000770403b0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000077040490
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000000770403a0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000000770402f0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000077040350
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000077040290
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000000770402b0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000000770403d0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000077040330
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0x15e590}
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000077040410
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000077040240
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000000770401e0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000077040250
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0x15e090}
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000000770404a0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000000770404b0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000077040300
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000077040360
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000000770402a0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000000770402c0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000077040380
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000077040340
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000077040450
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000077040260
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 0000000077040400
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1764] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000074e3a30a 1 byte [62]
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe[1796] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000074e3a30a 1 byte [62]
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe[1832] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000074e3a30a 1 byte [62]
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe[1832] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000747b1465 2 bytes [7B, 74]
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe[1832] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000747b14bb 2 bytes [7B, 74]
.text ... * 2
.text C:\Windows\system32\svchost.exe[1928] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dceecd 1 byte [62]
.text C:\Program Files (x86)\D-Link\DWA-131 revA\WlanWpsSvc.exe[1992] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000074e3a30a 1 byte [62]
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000076eb3ae0 5 bytes JMP 00000001004b075c
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000076eb7a90 5 bytes JMP 00000001004b03a4
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000077040470
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000077040460
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000076ee1490 5 bytes JMP 00000001004b0b14
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000076ee14f0 5 bytes JMP 00000001004b0ecc
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000077040370
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000077040480
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 00000001004b163c
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000077040320
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000000770403b0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000076ee1810 5 bytes JMP 00000001004b1284
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000077040490
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000000770403a0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000000770402f0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000077040350
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000077040290
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000000770402b0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000000770403d0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000077040330
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0x15e590}
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000077040410
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000077040240
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000000770401e0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000077040250
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0x15e090}
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000000770404a0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000000770404b0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000077040300
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000077040360
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000000770402a0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000000770402c0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000077040380
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000077040340
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000077040450
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000077040260
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 00000001004b19f4
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076dceecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe366e00 5 bytes JMP 000007ff7e381dac
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe366f2c 5 bytes JMP 000007ff7e380ecc
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe367220 5 bytes JMP 000007ff7e381284
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe36739c 5 bytes JMP 000007ff7e38163c
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe367538 5 bytes JMP 000007ff7e3819f4
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe3675e8 5 bytes JMP 000007ff7e3803a4
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe36790c 5 bytes JMP 000007ff7e38075c
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe367ab4 5 bytes JMP 000007ff7e380b14
.text C:\Windows\System32\WUDFHost.exe[2196] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe366e00 5 bytes JMP 000007ff7e381dac
.text C:\Windows\System32\WUDFHost.exe[2196] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe366f2c 5 bytes JMP 000007ff7e380ecc
.text C:\Windows\System32\WUDFHost.exe[2196] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe367220 5 bytes JMP 000007ff7e381284
.text C:\Windows\System32\WUDFHost.exe[2196] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe36739c 5 bytes JMP 000007ff7e38163c
.text C:\Windows\System32\WUDFHost.exe[2196] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe367538 5 bytes JMP 000007ff7e3819f4
.text C:\Windows\System32\WUDFHost.exe[2196] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe3675e8 5 bytes JMP 000007ff7e3803a4
.text C:\Windows\System32\WUDFHost.exe[2196] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe36790c 5 bytes JMP 000007ff7e38075c
.text C:\Windows\System32\WUDFHost.exe[2196] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe367ab4 5 bytes JMP 000007ff7e380b14
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000076eb3ae0 5 bytes JMP 000000010023075c
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000076eb7a90 5 bytes JMP 00000001002303a4
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000077040470
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000077040460
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000076ee1490 5 bytes JMP 0000000100230b14
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000076ee14f0 5 bytes JMP 0000000100230ecc
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000077040370
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000077040480
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 000000010023163c
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000077040320
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000000770403b0
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000076ee1810 5 bytes JMP 0000000100231284
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}
ssmad
Regular Member
 
Posts: 41
Joined: May 25th, 2013, 12:10 pm

Re: External WD HD infected with Win32:Kryptik.LQL

Unread postby ssmad » May 25th, 2013, 8:39 pm

Gmer Part5

.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000077040490
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000000770403a0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000000770402f0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000077040350
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000077040290
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000000770402b0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000000770403d0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000077040330
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0x15e590}
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000077040410
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000077040240
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000000770401e0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000077040250
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0x15e090}
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000000770404a0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000000770404b0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000077040300
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000077040360
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000000770402a0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000000770402c0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000077040380
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000077040340
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000077040450
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000077040260
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 0000000077040400
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Windows\system32\svchost.exe[1272] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dceecd 1 byte [62]
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000077040470
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000077040460
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000077040370
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000077040480
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 00000000770403e0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000077040320
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000000770403b0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000077040490
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000000770403a0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000000770402f0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000077040350
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000077040290
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000000770402b0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000000770403d0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000077040330
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0x15e590}
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000077040410
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000077040240
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000000770401e0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000077040250
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0x15e090}
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000000770404a0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000000770404b0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000077040300
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000077040360
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000000770402a0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000000770402c0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000077040380
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000077040340
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000077040450
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000077040260
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 0000000077040400
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Windows\System32\spoolsv.exe[1580] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dceecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000077040470
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000077040460
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000077040370
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000077040480
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 00000000770403e0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000077040320
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000000770403b0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000077040490
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000000770403a0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000000770402f0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000077040350
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000077040290
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000000770402b0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000000770403d0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000077040330
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0x15e590}
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000077040410
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000077040240
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000000770401e0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000077040250
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0x15e090}
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000000770404a0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000000770404b0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000077040300
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000077040360
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000000770402a0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000000770402c0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000077040380
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000077040340
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000077040450
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000077040260
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 0000000077040400
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dceecd 1 byte [62]
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000077040470
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000077040460
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000077040370
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000077040480
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 00000000770403e0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000077040320
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000000770403b0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000077040490
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000000770403a0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000000770402f0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000077040350
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000077040290
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000000770402b0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000000770403d0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000077040330
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0x15e590}
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000077040410
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000077040240
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000000770401e0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000077040250
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0x15e090}
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000000770404a0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000000770404b0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000077040300
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000077040360
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000000770402a0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000000770402c0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000077040380
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000077040340
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000077040450
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000077040260
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 0000000077040400
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1764] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000074e3a30a 1 byte [62]
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe[1796] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000074e3a30a 1 byte [62]
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe[1832] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000074e3a30a 1 byte [62]
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe[1832] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000747b1465 2 bytes [7B, 74]
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe[1832] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000747b14bb 2 bytes [7B, 74]
.text ... * 2
.text C:\Windows\system32\svchost.exe[1928] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dceecd 1 byte [62]
.text C:\Program Files (x86)\D-Link\DWA-131 revA\WlanWpsSvc.exe[1992] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000074e3a30a 1 byte [62]
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000076eb3ae0 5 bytes JMP 00000001004b075c
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000076eb7a90 5 bytes JMP 00000001004b03a4
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000077040470
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000077040460
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000076ee1490 5 bytes JMP 00000001004b0b14
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000076ee14f0 5 bytes JMP 00000001004b0ecc
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000077040370
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000077040480
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 00000001004b163c
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000077040320
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000000770403b0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000076ee1810 5 bytes JMP 00000001004b1284
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000077040490
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000000770403a0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000000770402f0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000077040350
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000077040290
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000000770402b0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000000770403d0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000077040330
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0x15e590}
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000077040410
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000077040240
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000000770401e0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000077040250
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0x15e090}
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000000770404a0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000000770404b0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000077040300
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000077040360
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000000770402a0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000000770402c0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000077040380
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000077040340
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000077040450
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000077040260
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 00000001004b19f4
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076dceecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe366e00 5 bytes JMP 000007ff7e381dac
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe366f2c 5 bytes JMP 000007ff7e380ecc
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe367220 5 bytes JMP 000007ff7e381284
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe36739c 5 bytes JMP 000007ff7e38163c
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe367538 5 bytes JMP 000007ff7e3819f4
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe3675e8 5 bytes JMP 000007ff7e3803a4
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe36790c 5 bytes JMP 000007ff7e38075c
.text C:\Windows\system32\svchost.exe[2876] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe367ab4 5 bytes JMP 000007ff7e380b14
.text C:\Windows\System32\WUDFHost.exe[2196] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe366e00 5 bytes JMP 000007ff7e381dac
.text C:\Windows\System32\WUDFHost.exe[2196] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe366f2c 5 bytes JMP 000007ff7e380ecc
.text C:\Windows\System32\WUDFHost.exe[2196] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe367220 5 bytes JMP 000007ff7e381284
.text C:\Windows\System32\WUDFHost.exe[2196] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe36739c 5 bytes JMP 000007ff7e38163c
.text C:\Windows\System32\WUDFHost.exe[2196] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe367538 5 bytes JMP 000007ff7e3819f4
.text C:\Windows\System32\WUDFHost.exe[2196] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe3675e8 5 bytes JMP 000007ff7e3803a4
.text C:\Windows\System32\WUDFHost.exe[2196] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe36790c 5 bytes JMP 000007ff7e38075c
.text C:\Windows\System32\WUDFHost.exe[2196] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe367ab4 5 bytes JMP 000007ff7e380b14
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000076eb3ae0 5 bytes JMP 000000010023075c
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000076eb7a90 5 bytes JMP 00000001002303a4
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000077040470
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000077040460
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000076ee1490 5 bytes JMP 0000000100230b14
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000076ee14f0 5 bytes JMP 0000000100230ecc
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000077040370
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000077040480
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 000000010023163c
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000077040320
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000000770403b0
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000076ee1810 5 bytes JMP 0000000100231284
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}



.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000077040490
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000000770403a0
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000000770402f0
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000077040350
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000077040290
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000000770402b0
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000000770403d0
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000077040330
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0x15e590}
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000077040410
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000077040240
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000000770401e0
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000077040250
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0x15e090}
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000000770404a0
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000000770404b0
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000077040300
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000077040360
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000000770402a0
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000000770402c0
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000077040380
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000077040340
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000077040450
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000077040260
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 00000001002319f4
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076dceecd 1 byte [62]
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe366e00 5 bytes JMP 000007ff7e381dac
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe366f2c 5 bytes JMP 000007ff7e380ecc
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe367220 5 bytes JMP 000007ff7e381284
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe36739c 5 bytes JMP 000007ff7e38163c
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe367538 5 bytes JMP 000007ff7e3819f4
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe3675e8 5 bytes JMP 000007ff7e3803a4
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe36790c 5 bytes JMP 000007ff7e38075c
.text C:\Windows\system32\taskhost.exe[204] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe367ab4 5 bytes JMP 000007ff7e380b14
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000076eb3ae0 5 bytes JMP 000000010025075c
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000076eb7a90 5 bytes JMP 00000001002503a4
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000077040470
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000077040460
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000076ee1490 5 bytes JMP 0000000100250b14
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000076ee14f0 5 bytes JMP 0000000100250ecc
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000077040370
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000077040480
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 000000010025163c
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000077040320
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000000770403b0
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000076ee1810 5 bytes JMP 0000000100251284
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000077040490
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000000770403a0
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000000770402f0
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000077040350
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000077040290
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000000770402b0
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000000770403d0
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000077040330
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0x15e590}
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000077040410
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000077040240
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000000770401e0
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000077040250
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0x15e090}
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000000770404a0
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000000770404b0
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000077040300
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000077040360
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000000770402a0
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000000770402c0
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000077040380
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000077040340
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000077040450
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000077040260
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 00000001002519f4
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe366e00 5 bytes JMP 000007ff7e381dac
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe366f2c 5 bytes JMP 000007ff7e380ecc
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe367220 5 bytes JMP 000007ff7e381284
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe36739c 5 bytes JMP 000007ff7e38163c
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe367538 5 bytes JMP 000007ff7e3819f4
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe3675e8 5 bytes JMP 000007ff7e3803a4
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe36790c 5 bytes JMP 000007ff7e38075c
.text C:\Windows\system32\Dwm.exe[2988] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe367ab4 5 bytes JMP 000007ff7e380b14
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000076eb3ae0 5 bytes JMP 00000001001f075c
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000076eb7a90 5 bytes JMP 00000001001f03a4
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000077040470
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000077040460
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000076ee1490 5 bytes JMP 00000001001f0b14
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000076ee14f0 5 bytes JMP 00000001001f0ecc
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000077040370
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000077040480
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 00000001001f163c
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000077040320
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000000770403b0
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000076ee1810 5 bytes JMP 00000001001f1284
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000077040490
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000000770403a0
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000000770402f0
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000077040350
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000077040290
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000000770402b0
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000000770403d0
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000077040330
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0x15e590}
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000077040410
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000077040240
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000000770401e0
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000077040250
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0x15e090}
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000000770404a0
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000000770404b0
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000077040300
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000077040360
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000000770402a0
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000000770402c0
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000077040380
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000077040340
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000077040450
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000077040260
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 00000001001f19f4
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
ssmad
Regular Member
 
Posts: 41
Joined: May 25th, 2013, 12:10 pm

Re: External WD HD infected with Win32:Kryptik.LQL

Unread postby ssmad » May 25th, 2013, 8:40 pm

Gmer Part6

.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Windows\Explorer.EXE[1968] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076dceecd 1 byte [62]
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe366e00 5 bytes JMP 000007ff7e381dac
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe366f2c 5 bytes JMP 000007ff7e380ecc
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe367220 5 bytes JMP 000007ff7e381284
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe36739c 5 bytes JMP 000007ff7e38163c
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe367538 5 bytes JMP 000007ff7e3819f4
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe3675e8 5 bytes JMP 000007ff7e3803a4
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe36790c 5 bytes JMP 000007ff7e38075c
.text C:\Windows\Explorer.EXE[1968] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe367ab4 5 bytes JMP 000007ff7e380b14
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe[2736] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007708faa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe[2736] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007708fb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe[2736] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007708fc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe[2736] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077090018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe[2736] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077091900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe[2736] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000770ac45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe[2736] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 00000000770b1217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe[2736] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 0000000074e3a30a 1 byte [62]
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe[2736] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007602ee09 5 bytes JMP 00000001001801f8
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe[2736] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000076033982 5 bytes JMP 00000001001803fc
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe[2736] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000076037603 5 bytes JMP 0000000100180804
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe[2736] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007603835c 5 bytes JMP 0000000100180600
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe[2736] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007604f52b 5 bytes JMP 0000000100180a08
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe[2736] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000076795181 5 bytes JMP 0000000100191014
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe[2736] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000076795254 5 bytes JMP 0000000100190804
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe[2736] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000767953d5 5 bytes JMP 0000000100190a08
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe[2736] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000767954c2 5 bytes JMP 0000000100190c0c
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe[2736] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000767955e2 5 bytes JMP 0000000100190e10
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe[2736] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007679567c 5 bytes JMP 00000001001901f8
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe[2736] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007679589f 5 bytes JMP 00000001001903fc
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe[2736] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000076795a22 5 bytes JMP 0000000100190600
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000076eb3ae0 5 bytes JMP 000000010049075c
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000076eb7a90 5 bytes JMP 00000001004903a4
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000077040470
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000077040460
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000076ee1490 5 bytes JMP 0000000100490b14
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000076ee14f0 5 bytes JMP 0000000100490ecc
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000077040370
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000077040480
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 000000010049163c
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000077040320
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000000770403b0
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000076ee1810 5 bytes JMP 0000000100491284
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000077040490
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000000770403a0
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000000770402f0
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000077040350
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000077040290
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000000770402b0
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000000770403d0
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000077040330
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0x15e590}
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000077040410
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000077040240
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000000770401e0
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000077040250
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0x15e090}
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000000770404a0
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000000770404b0
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000077040300
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000077040360
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000000770402a0
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000000770402c0
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000077040380
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000077040340
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000077040450
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000077040260
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 00000001004919f4
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076dceecd 1 byte [62]
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe366e00 5 bytes JMP 000007ff7e381dac
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe366f2c 5 bytes JMP 000007ff7e380ecc
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe367220 5 bytes JMP 000007ff7e381284
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe36739c 5 bytes JMP 000007ff7e38163c
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe367538 5 bytes JMP 000007ff7e3819f4
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe3675e8 5 bytes JMP 000007ff7e3803a4
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe36790c 5 bytes JMP 000007ff7e38075c
.text C:\Windows\System32\igfxtray.exe[896] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe367ab4 5 bytes JMP 000007ff7e380b14
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000076eb3ae0 5 bytes JMP 00000001002e075c
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000076eb7a90 5 bytes JMP 00000001002e03a4
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000077040470
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000077040460
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000076ee1490 5 bytes JMP 00000001002e0b14
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000076ee14f0 5 bytes JMP 00000001002e0ecc
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000077040370
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000077040480
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 00000001002e163c
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000077040320
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000000770403b0
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000076ee1810 5 bytes JMP 00000001002e1284
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000077040490
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000000770403a0
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000000770402f0
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000077040350
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000077040290
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000000770402b0
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000000770403d0
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000077040330
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0x15e590}
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000077040410
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000077040240
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000000770401e0
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000077040250
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0x15e090}
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000000770404a0
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000000770404b0
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000077040300
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000077040360
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000000770402a0
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000000770402c0
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000077040380
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000077040340
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000077040450
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000077040260
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 00000001002e19f4
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076dceecd 1 byte [62]
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe366e00 5 bytes JMP 000007ff7e381dac
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe366f2c 5 bytes JMP 000007ff7e380ecc
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe367220 5 bytes JMP 000007ff7e381284
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe36739c 5 bytes JMP 000007ff7e38163c
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe367538 5 bytes JMP 000007ff7e3819f4
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe3675e8 5 bytes JMP 000007ff7e3803a4
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe36790c 5 bytes JMP 000007ff7e38075c
.text C:\Windows\System32\hkcmd.exe[1168] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe367ab4 5 bytes JMP 000007ff7e380b14
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000076eb3ae0 5 bytes JMP 000000010045075c
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000076eb7a90 5 bytes JMP 00000001004503a4
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000077040470
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000077040460
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000076ee1490 5 bytes JMP 0000000100450b14
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000076ee14f0 5 bytes JMP 0000000100450ecc
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000077040370
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000077040480
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 000000010045163c
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000077040320
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000000770403b0
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000076ee1810 5 bytes JMP 0000000100451284
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000077040490
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000000770403a0
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000000770402f0
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000077040350
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000077040290
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000000770402b0
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000000770403d0
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000077040330
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0x15e590}
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000077040410
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000077040240
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000000770401e0
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000077040250
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0x15e090}
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000000770404a0
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000000770404b0
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000077040300
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000077040360
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000000770402a0
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000000770402c0
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000077040380
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000077040340
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000077040450
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000077040260
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 00000001004519f4
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076dceecd 1 byte [62]
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe366e00 5 bytes JMP 000007ff7e381dac
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe366f2c 5 bytes JMP 000007ff7e380ecc
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe367220 5 bytes JMP 000007ff7e381284
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe36739c 5 bytes JMP 000007ff7e38163c
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe367538 5 bytes JMP 000007ff7e3819f4
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe3675e8 5 bytes JMP 000007ff7e3803a4
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe36790c 5 bytes JMP 000007ff7e38075c
.text C:\Windows\System32\igfxpers.exe[832] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe367ab4 5 bytes JMP 000007ff7e380b14
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000076eb3ae0 5 bytes JMP 000000010043075c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000076eb7a90 5 bytes JMP 00000001004303a4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000077040470
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000077040460
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000076ee1490 5 bytes JMP 0000000100430b14
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000076ee14f0 5 bytes JMP 0000000100430ecc
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000077040370
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000077040480
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 000000010043163c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000077040320
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000000770403b0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000076ee1810 5 bytes JMP 0000000100431284
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000077040490
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000000770403a0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000000770402f0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000077040350
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000077040290
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000000770402b0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000000770403d0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000077040330
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0x15e590}
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000077040410
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000077040240
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000000770401e0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000077040250
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0x15e090}
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000000770404a0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000000770404b0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000077040300
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000077040360
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000000770402a0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000000770402c0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000077040380
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000077040340
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000077040450
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000077040260
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 00000001004319f4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076dceecd 1 byte [62]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe366e00 5 bytes JMP 000007ff7e381dac
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe366f2c 5 bytes JMP 000007ff7e380ecc
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe367220 5 bytes JMP 000007ff7e381284
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe36739c 5 bytes JMP 000007ff7e38163c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe367538 5 bytes JMP 000007ff7e3819f4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe3675e8 5 bytes JMP 000007ff7e3803a4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe36790c 5 bytes JMP 000007ff7e38075c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1368] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe367ab4 5 bytes JMP 000007ff7e380b14
.text C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe[2460] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007708faa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe[2460] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007708fb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe[2460] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007708fc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe[2460] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077090018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe[2460] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077091900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe[2460] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000770ac45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe[2460] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 00000000770b1217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe[2460] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 0000000074e3a30a 1 byte [62]
.text C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe[2460] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000076795181 5 bytes JMP 0000000100101014
.text C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe[2460] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000076795254 5 bytes JMP 0000000100100804
.text C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe[2460] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000767953d5 5 bytes JMP 0000000100100a08
.text C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe[2460] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000767954c2 5 bytes JMP 0000000100100c0c
.text C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe[2460] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000767955e2 5 bytes JMP 0000000100100e10
.text C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe[2460] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007679567c 5 bytes JMP 00000001001001f8
.text C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe[2460] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007679589f 5 bytes JMP 00000001001003fc
.text C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe[2460] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000076795a22 5 bytes JMP 0000000100100600
.text C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe[2460] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007602ee09 5 bytes JMP 00000001001101f8
.text C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe[2460] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000076033982 5 bytes JMP 00000001001103fc
.text C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe[2460] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000076037603 5 bytes JMP 0000000100110804
.text C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe[2460] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007603835c 5 bytes JMP 0000000100110600
.text C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe[2460] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007604f52b 5 bytes JMP 0000000100110a08
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2924] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007708faa0 5 bytes JMP 00000001000a0600
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2924] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007708fb38 5 bytes JMP 00000001000a0804
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2924] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007708fc90 5 bytes JMP 00000001000a0c0c
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2924] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077090018 5 bytes JMP 00000001000a0a08
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2924] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077091900 3 bytes JMP 00000001000a0e10
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2924] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 0000000077091904 1 byte [89]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2924] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000770ac45a 5 bytes JMP 00000001000a01f8
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2924] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 00000000770b1217 5 bytes JMP 00000001000a03fc
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2924] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 0000000074e3a30a 1 byte [62]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2924] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007602ee09 5 bytes JMP 00000001000b01f8
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2924] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000076033982 5 bytes JMP 00000001000b03fc
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2924] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000076037603 5 bytes JMP 00000001000b0804
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2924] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007603835c 5 bytes JMP 00000001000b0600
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2924] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007604f52b 5 bytes JMP 00000001000b0a08
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2924] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000076795181 5 bytes JMP 00000001000c1014
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2924] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000076795254 5 bytes JMP 00000001000c0804
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2924] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000767953d5 5 bytes JMP 00000001000c0a08
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2924] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000767954c2 5 bytes JMP 00000001000c0c0c
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2924] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000767955e2 5 bytes JMP 00000001000c0e10
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2924] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007679567c 5 bytes JMP 00000001000c01f8
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2924] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007679589f 5 bytes JMP 00000001000c03fc
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2924] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000076795a22 5 bytes JMP 00000001000c0600
.text C:\Program Files (x86)\D-Link\DWA-131 revA\wirelesscm.exe[2680] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007708faa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\D-Link\DWA-131 revA\wirelesscm.exe[2680] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007708fb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\D-Link\DWA-131 revA\wirelesscm.exe[2680] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007708fc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\D-Link\DWA-131 revA\wirelesscm.exe[2680] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077090018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\D-Link\DWA-131 revA\wirelesscm.exe[2680] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077091900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\D-Link\DWA-131 revA\wirelesscm.exe[2680] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000770ac45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\D-Link\DWA-131 revA\wirelesscm.exe[2680] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 00000000770b1217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\D-Link\DWA-131 revA\wirelesscm.exe[2680] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 0000000074e3a30a 1 byte [62]
.text C:\Program Files (x86)\D-Link\DWA-131 revA\wirelesscm.exe[2680] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000076795181 5 bytes JMP 0000000100251014
.text C:\Program Files (x86)\D-Link\DWA-131 revA\wirelesscm.exe[2680] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000076795254 5 bytes JMP 0000000100250804
.text C:\Program Files (x86)\D-Link\DWA-131 revA\wirelesscm.exe[2680] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000767953d5 5 bytes JMP 0000000100250a08
.text C:\Program Files (x86)\D-Link\DWA-131 revA\wirelesscm.exe[2680] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000767954c2 5 bytes JMP 0000000100250c0c
.text C:\Program Files (x86)\D-Link\DWA-131 revA\wirelesscm.exe[2680] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000767955e2 5 bytes JMP 0000000100250e10
.text C:\Program Files (x86)\D-Link\DWA-131 revA\wirelesscm.exe[2680] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007679567c 5 bytes JMP 00000001002501f8
.text C:\Program Files (x86)\D-Link\DWA-131 revA\wirelesscm.exe[2680] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007679589f 5 bytes JMP 00000001002503fc
.text C:\Program Files (x86)\D-Link\DWA-131 revA\wirelesscm.exe[2680] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000076795a22 5 bytes JMP 0000000100250600
.text C:\Program Files (x86)\D-Link\DWA-131 revA\wirelesscm.exe[2680] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007602ee09 5 bytes JMP 00000001002601f8
.text C:\Program Files (x86)\D-Link\DWA-131 revA\wirelesscm.exe[2680] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000076033982 5 bytes JMP 00000001002603fc
.text C:\Program Files (x86)\D-Link\DWA-131 revA\wirelesscm.exe[2680] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000076037603 5 bytes JMP 0000000100260804
.text C:\Program Files (x86)\D-Link\DWA-131 revA\wirelesscm.exe[2680] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007603835c 5 bytes JMP 0000000100260600
.text C:\Program Files (x86)\D-Link\DWA-131 revA\wirelesscm.exe[2680] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007604f52b 5 bytes JMP 0000000100260a08
.text C:\Program Files\AVAST Software\Avast\AvastUI.exe[2760] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000074e3a30a 1 byte [62]
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000076eb3ae0 5 bytes JMP 000000010039075c
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000076eb7a90 5 bytes JMP 00000001003903a4
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000077040470
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000077040460
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000076ee1490 5 bytes JMP 0000000100390b14
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000076ee14f0 5 bytes JMP 0000000100390ecc
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000077040370
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000077040480
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 000000010039163c
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000077040320
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000000770403b0
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
ssmad
Regular Member
 
Posts: 41
Joined: May 25th, 2013, 12:10 pm

Re: External WD HD infected with Win32:Kryptik.LQL

Unread postby ssmad » May 25th, 2013, 8:42 pm

Gmer Part7

.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000076ee1810 5 bytes JMP 0000000100391284
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000077040490
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000000770403a0
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000000770402f0
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000077040350
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000077040290
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000000770402b0
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000000770403d0
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000077040330
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0x15e590}
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000077040410
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000077040240
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000000770401e0
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000077040250
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0x15e090}
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000000770404a0
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000000770404b0
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000077040300
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000077040360
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000000770402a0
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000000770402c0
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000077040380
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000077040340
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000077040450
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000077040260
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 00000001003919f4
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076dceecd 1 byte [62]
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe366e00 5 bytes JMP 000007ff7e381dac
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe366f2c 5 bytes JMP 000007ff7e380ecc
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe367220 5 bytes JMP 000007ff7e381284
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe36739c 5 bytes JMP 000007ff7e38163c
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe367538 5 bytes JMP 000007ff7e3819f4
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe3675e8 5 bytes JMP 000007ff7e3803a4
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe36790c 5 bytes JMP 000007ff7e38075c
.text C:\Windows\system32\SearchIndexer.exe[3592] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe367ab4 5 bytes JMP 000007ff7e380b14
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4028] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076dceecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000076eb3ae0 5 bytes JMP 00000001001b075c
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000076eb7a90 5 bytes JMP 00000001001b03a4
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000077040470
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000077040460
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000076ee1490 5 bytes JMP 00000001001b0b14
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000076ee14f0 5 bytes JMP 00000001001b0ecc
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000077040370
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000077040480
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 00000001001b163c
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000077040320
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000000770403b0
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000076ee1810 5 bytes JMP 00000001001b1284
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000077040490
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000000770403a0
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000000770402f0
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000077040350
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000077040290
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000000770402b0
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000000770403d0
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000077040330
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0x15e590}
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000077040410
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000077040240
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000000770401e0
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000077040250
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0x15e090}
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000000770404a0
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000000770404b0
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000077040300
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000077040360
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000000770402a0
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000000770402c0
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000077040380
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000077040340
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000077040450
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000077040260
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 00000001001b19f4
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe366e00 5 bytes JMP 000007ff7e381dac
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe366f2c 5 bytes JMP 000007ff7e380ecc
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe367220 5 bytes JMP 000007ff7e381284
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe36739c 5 bytes JMP 000007ff7e38163c
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe367538 5 bytes JMP 000007ff7e3819f4
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe3675e8 5 bytes JMP 000007ff7e3803a4
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe36790c 5 bytes JMP 000007ff7e38075c
.text C:\Windows\System32\svchost.exe[3296] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe367ab4 5 bytes JMP 000007ff7e380b14
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4628] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007708faa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4628] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007708fb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4628] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007708fc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4628] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077090018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4628] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077091900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4628] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000770ac45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4628] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 00000000770b1217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4628] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 0000000074e3a30a 1 byte [62]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4628] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000076795181 5 bytes JMP 00000001000a1014
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4628] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000076795254 5 bytes JMP 00000001000a0804
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4628] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000767953d5 5 bytes JMP 00000001000a0a08
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4628] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000767954c2 5 bytes JMP 00000001000a0c0c
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4628] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000767955e2 5 bytes JMP 00000001000a0e10
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4628] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007679567c 5 bytes JMP 00000001000a01f8
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4628] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007679589f 5 bytes JMP 00000001000a03fc
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4628] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000076795a22 5 bytes JMP 00000001000a0600
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4628] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007602ee09 5 bytes JMP 00000001000b01f8
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4628] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000076033982 5 bytes JMP 00000001000b03fc
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4628] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000076037603 5 bytes JMP 00000001000b0804
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4628] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007603835c 5 bytes JMP 00000001000b0600
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4628] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007604f52b 5 bytes JMP 00000001000b0a08
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000076eb3ae0 5 bytes JMP 00000001003c075c
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000076eb7a90 5 bytes JMP 00000001003c03a4
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000077040470
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000077040460
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000076ee1490 5 bytes JMP 00000001003c0b14
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000076ee14f0 5 bytes JMP 00000001003c0ecc
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000077040370
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000077040480
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 00000001003c163c
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000077040320
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000000770403b0
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000076ee1810 5 bytes JMP 00000001003c1284
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000077040490
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000000770403a0
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000000770402f0
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000077040350
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000077040290
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000000770402b0
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000000770403d0
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000077040330
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0x15e590}
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000077040410
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000077040240
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000000770401e0
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000077040250
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0x15e090}
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000000770404a0
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000000770404b0
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000077040300
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000077040360
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000000770402a0
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000000770402c0
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000077040380
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000077040340
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000077040450
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000077040260
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 00000001003c19f4
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Windows\System32\svchost.exe[788] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076dceecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe366e00 5 bytes JMP 000007ff7e381dac
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe366f2c 5 bytes JMP 000007ff7e380ecc
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe367220 5 bytes JMP 000007ff7e381284
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe36739c 5 bytes JMP 000007ff7e38163c
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe367538 5 bytes JMP 000007ff7e3819f4
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe3675e8 5 bytes JMP 000007ff7e3803a4
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe36790c 5 bytes JMP 000007ff7e38075c
.text C:\Windows\System32\svchost.exe[788] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe367ab4 5 bytes JMP 000007ff7e380b14
.text C:\Windows\System32\svchost.exe[788] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000076918550 5 bytes JMP 000000010065075c
.text C:\Windows\System32\svchost.exe[788] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007691d440 5 bytes JMP 0000000100651284
.text C:\Windows\System32\svchost.exe[788] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007691f874 5 bytes JMP 0000000100650ecc
.text C:\Windows\System32\svchost.exe[788] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000076924d4c 5 bytes JMP 00000001006503a4
.text C:\Windows\System32\svchost.exe[788] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000076938c20 5 bytes JMP 0000000100650b14
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4584] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007708faa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4584] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007708fb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4584] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007708fc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4584] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077090018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4584] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077091900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4584] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000770ac45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4584] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 00000000770b1217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4584] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 0000000074e3a30a 1 byte [62]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4584] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000076795181 5 bytes JMP 0000000100101014
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4584] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000076795254 5 bytes JMP 0000000100100804
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4584] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000767953d5 5 bytes JMP 0000000100100a08
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4584] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000767954c2 5 bytes JMP 0000000100100c0c
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4584] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000767955e2 5 bytes JMP 0000000100100e10
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4584] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007679567c 5 bytes JMP 00000001001001f8
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4584] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007679589f 5 bytes JMP 00000001001003fc
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4584] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000076795a22 5 bytes JMP 0000000100100600
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4584] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007602ee09 5 bytes JMP 00000001001101f8
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4584] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000076033982 5 bytes JMP 00000001001103fc
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4584] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000076037603 5 bytes JMP 0000000100110804
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4584] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007603835c 5 bytes JMP 0000000100110600
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4584] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007604f52b 5 bytes JMP 0000000100110a08
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ee13c0 5 bytes JMP 0000000077040470
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ee1410 5 bytes JMP 0000000077040460
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ee1570 5 bytes JMP 0000000077040370
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ee15c0 5 bytes JMP 0000000077040480
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ee15d0 5 bytes JMP 00000000770403e0
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ee1680 5 bytes JMP 0000000077040320
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ee16b0 5 bytes JMP 00000000770403b0
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ee16d0 5 bytes JMP 0000000077040390
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ee1710 5 bytes JMP 00000000770402e0
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076ee1760 5 bytes JMP 0000000077040440
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ee1790 5 bytes JMP 00000000770402d0
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ee17b0 5 bytes JMP 0000000077040310
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ee17f0 5 bytes JMP 00000000770403c0
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ee1840 5 bytes JMP 00000000770403f0
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ee19a0 1 byte JMP 0000000077040230
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 2 0000000076ee19a2 3 bytes {JMP 0x15e890}
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ee1b60 5 bytes JMP 0000000077040490
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ee1b90 5 bytes JMP 00000000770403a0
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ee1c70 5 bytes JMP 00000000770402f0
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ee1c80 5 bytes JMP 0000000077040350
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ee1ce0 5 bytes JMP 0000000077040290
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ee1d70 5 bytes JMP 00000000770402b0
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ee1d90 5 bytes JMP 00000000770403d0
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ee1da0 1 byte JMP 0000000077040330
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 2 0000000076ee1da2 3 bytes {JMP 0x15e590}
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ee1e10 5 bytes JMP 0000000077040410
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ee1e40 5 bytes JMP 0000000077040240
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ee2100 5 bytes JMP 00000000770401e0
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ee21c0 1 byte JMP 0000000077040250
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 2 0000000076ee21c2 3 bytes {JMP 0x15e090}
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ee21f0 5 bytes JMP 00000000770404a0
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ee2200 5 bytes JMP 00000000770404b0
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ee2230 5 bytes JMP 0000000077040300
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ee2240 5 bytes JMP 0000000077040360
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ee22a0 5 bytes JMP 00000000770402a0
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ee22f0 5 bytes JMP 00000000770402c0
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ee2320 5 bytes JMP 0000000077040380
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ee2330 5 bytes JMP 0000000077040340
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ee2620 5 bytes JMP 0000000077040450
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ee2820 5 bytes JMP 0000000077040260
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ee2830 5 bytes JMP 0000000077040270
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ee2840 5 bytes JMP 0000000077040400
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ee2a00 5 bytes JMP 00000000770401f0
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ee2a10 5 bytes JMP 0000000077040210
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ee2a80 5 bytes JMP 0000000077040200
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ee2ae0 5 bytes JMP 0000000077040420
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ee2af0 5 bytes JMP 0000000077040430
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ee2b00 5 bytes JMP 0000000077040220
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ee2be0 5 bytes JMP 0000000077040280
.text C:\Windows\system32\AUDIODG.EXE[2704] C:\Windows\System32\kernel32.dll!GetBinaryTypeW + 189 0000000076dceecd 1 byte [62]
.text C:\Users\SS\Desktop\mbtrlnv7.exe[4708] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007708faa0 5 bytes JMP 0000000100030600
.text C:\Users\SS\Desktop\mbtrlnv7.exe[4708] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007708fb38 5 bytes JMP 0000000100030804
.text C:\Users\SS\Desktop\mbtrlnv7.exe[4708] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007708fc90 5 bytes JMP 0000000100030c0c
.text C:\Users\SS\Desktop\mbtrlnv7.exe[4708] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077090018 5 bytes JMP 0000000100030a08
.text C:\Users\SS\Desktop\mbtrlnv7.exe[4708] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077091900 5 bytes JMP 0000000100030e10
ssmad
Regular Member
 
Posts: 41
Joined: May 25th, 2013, 12:10 pm

Re: External WD HD infected with Win32:Kryptik.LQL

Unread postby ssmad » May 25th, 2013, 8:43 pm

Gmer Part8

.text C:\Users\SS\Desktop\mbtrlnv7.exe[4708] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000770ac45a 5 bytes JMP 00000001000301f8
.text C:\Users\SS\Desktop\mbtrlnv7.exe[4708] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 00000000770b1217 5 bytes JMP 00000001000303fc
.text C:\Users\SS\Desktop\mbtrlnv7.exe[4708] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 0000000074e3a30a 1 byte [62]
.text C:\Users\SS\Desktop\mbtrlnv7.exe[4708] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000076795181 5 bytes JMP 0000000100241014
.text C:\Users\SS\Desktop\mbtrlnv7.exe[4708] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000076795254 5 bytes JMP 0000000100240804
.text C:\Users\SS\Desktop\mbtrlnv7.exe[4708] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000767953d5 5 bytes JMP 0000000100240a08
.text C:\Users\SS\Desktop\mbtrlnv7.exe[4708] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000767954c2 5 bytes JMP 0000000100240c0c
.text C:\Users\SS\Desktop\mbtrlnv7.exe[4708] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000767955e2 5 bytes JMP 0000000100240e10
.text C:\Users\SS\Desktop\mbtrlnv7.exe[4708] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007679567c 5 bytes JMP 00000001002401f8
.text C:\Users\SS\Desktop\mbtrlnv7.exe[4708] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007679589f 5 bytes JMP 00000001002403fc
.text C:\Users\SS\Desktop\mbtrlnv7.exe[4708] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000076795a22 5 bytes JMP 0000000100240600
.text C:\Users\SS\Desktop\mbtrlnv7.exe[4708] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007602ee09 5 bytes JMP 00000001002501f8
.text C:\Users\SS\Desktop\mbtrlnv7.exe[4708] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000076033982 5 bytes JMP 00000001002503fc
.text C:\Users\SS\Desktop\mbtrlnv7.exe[4708] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000076037603 5 bytes JMP 0000000100250804
.text C:\Users\SS\Desktop\mbtrlnv7.exe[4708] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007603835c 5 bytes JMP 0000000100250600
.text C:\Users\SS\Desktop\mbtrlnv7.exe[4708] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007604f52b 5 bytes JMP 0000000100250a08

---- Threads - GMER 2.1 ----

Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [4028:2420] 000007fefd9f0168
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [4028:3700] 000007fefba32a7c
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [4028:3944] 000007fef230d618
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [4028:3096] 000007fef9875124
Thread C:\Windows\System32\svchost.exe [788:4388] 000007fef1649688

---- Registry - GMER 2.1 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DisplayName aswFsBlk
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Group FSFilter Activity Monitor
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Description avast! mini-filter driver (aswFsBlk)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Tag 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances@DefaultInstance aswFsBlk Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude 388400
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ImagePath \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DisplayName aswMonFlt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Group FSFilter Anti-Virus
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Description avast! mini-filter driver (aswMonFlt)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances@DefaultInstance aswMonFlt Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude 320700
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ImagePath \SystemRoot\System32\Drivers\aswrdr2.sys
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DisplayName aswRdr
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Group PNP_TDI
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DependOnService tcpip?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Description avast! WFP Redirect driver
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@MSIgnoreLSPDefault
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@WSIgnoreLSPDefault nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@DisplayName aswRvrt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Description avast! Revert
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@BootCounter 7
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@TickCounter 18565
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@SystemRoot \Device\Harddisk0\Partition2\Windows
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@ImproperShutdown 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DisplayName aswSnx
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Group FSFilter Virtualization
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Description avast! virtualization driver (aswSnx)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Tag 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances@DefaultInstance aswSnx Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Altitude 137600
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@DisplayName aswSP
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Description avast! Self Protection
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@BehavShield 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFilesFolder \DosDevices\C:\Program Files
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@GadgetFolder \DosDevices\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DisplayName avast! Network Shield Support
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Group PNP_TDI
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DependOnService tcpip?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Description avast! Network Shield TDI driver
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Tag 9
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@DisplayName aswVmm
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Description avast! VM Monitor
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Type 32
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ImagePath "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DisplayName avast! Antivirus
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Group ShellSvcGroup
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DependOnService aswMonFlt?RpcSS?
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@WOW64 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ObjectName LocalSystem
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ServiceSidType 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Description Manages and implements avast! antivirus services for this computer. This includes the resident protection, the virus chest and the scheduler.
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DisplayName aswFsBlk
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Group FSFilter Activity Monitor
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Description avast! mini-filter driver (aswFsBlk)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Tag 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances@DefaultInstance aswFsBlk Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude 388400
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ImagePath \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DisplayName aswMonFlt
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Group FSFilter Anti-Virus
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Description avast! mini-filter driver (aswMonFlt)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances@DefaultInstance aswMonFlt Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude 320700
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@ImagePath \SystemRoot\System32\Drivers\aswrdr2.sys
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@DisplayName aswRdr
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Group PNP_TDI
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@DependOnService tcpip?
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Description avast! WFP Redirect driver
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@MSIgnoreLSPDefault
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@WSIgnoreLSPDefault nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Start 0
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@DisplayName aswRvrt
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Description avast! Revert
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@BootCounter 7
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@TickCounter 18565
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@SystemRoot \Device\Harddisk0\Partition2\Windows
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@ImproperShutdown 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@DisplayName aswSnx
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Group FSFilter Virtualization
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Description avast! virtualization driver (aswSnx)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Tag 2
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances@DefaultInstance aswSnx Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Altitude 137600
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@DisplayName aswSP
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Description avast! Self Protection
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@BehavShield 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFilesFolder \DosDevices\C:\Program Files
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@GadgetFolder \DosDevices\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@DisplayName avast! Network Shield Support
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Group PNP_TDI
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@DependOnService tcpip?
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Description avast! Network Shield TDI driver
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Tag 9
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Start 0
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@DisplayName aswVmm
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Description avast! VM Monitor
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Type 32
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ImagePath "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DisplayName avast! Antivirus
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Group ShellSvcGroup
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DependOnService aswMonFlt?RpcSS?
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@WOW64 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ObjectName LocalSystem
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ServiceSidType 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Description Manages and implements avast! antivirus services for this computer. This includes the resident protection, the virus chest and the scheduler.

---- EOF - GMER 2.1 ----
ssmad
Regular Member
 
Posts: 41
Joined: May 25th, 2013, 12:10 pm

Re: External WD HD infected with Win32:Kryptik.LQL

Unread postby deltalima » May 26th, 2013, 8:52 am

Hi ssmad,

Run OTL Script

  • Double-click OTL.exe (Right click and choose "Run as administrator" in Vista/Win7).
  • Copy and Paste the following code into the Image textbox. Do not include the word Code
    Code: Select all
    :Commands
    [CREATERESTOREPOINT]
    
    :processes
    killallprocesses
    
    :files
    attrib H:\*.* /s /c
    :commands
    [EMPTYTEMP]
    [EMPTYFLASH]
    [EMPTYJAVA]
    [RESETHOSTS]
    [REBOOT]
    
  • Then click the Run Fix button at the top.
  • Click Image.
  • OTL may ask to reboot the machine. Please do so if asked.
  • The report should appear in Notepad after the reboot.Copy and Paste that report in your next reply.
User avatar
deltalima
Admin/Teacher
Admin/Teacher
 
Posts: 7614
Joined: February 28th, 2009, 4:38 pm
Location: UK

Re: External WD HD infected with Win32:Kryptik.LQL

Unread postby ssmad » May 27th, 2013, 2:45 am

hey deltalima,

sorry for the delay in reply...

User: Default

User: Default User

User: Public

User: SS
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: Public

User: SS

Total Java Files Cleaned = 0.00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.69.0 log created on 05272013_113835

Files\Folders moved on Reboot...
C:\Users\SS\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
ssmad
Regular Member
 
Posts: 41
Joined: May 25th, 2013, 12:10 pm

Re: External WD HD infected with Win32:Kryptik.LQL

Unread postby deltalima » May 27th, 2013, 5:38 am

Hi ssmad,

Did you have the external USB drive connected when you ran the OTL fix?
User avatar
deltalima
Admin/Teacher
Admin/Teacher
 
Posts: 7614
Joined: February 28th, 2009, 4:38 pm
Location: UK

Re: External WD HD infected with Win32:Kryptik.LQL

Unread postby ssmad » May 27th, 2013, 8:46 am

hey,
I think it didn't detect it when i started the computer. i reconnected it and ran the scan again.

All processes killed
========== COMMANDS ==========
Restore point Set: OTL Restore Point
========== PROCESSES ==========
========== FILES ==========
< attrib H:\*.* /s /c >
A SH H:\$RECYCLE.BIN\S-1-5-21-1413790130-785985914-1171661357-1000\desktop.ini
A SH H:\$RECYCLE.BIN\S-1-5-21-4258883480-3971689447-331516866-1172\desktop.ini
H H:\.Trashes\b3fdadef.com
A H:\.Trashes\Desktop.ini
A H:\100EOS5D\IMG_3879.CR2
A H:\100EOS5D\IMG_3880.CR2
A H:\100EOS5D\IMG_3881.CR2
A H:\100EOS5D\IMG_3882.CR2
A H:\100EOS5D\IMG_3883.CR2
A H:\100EOS5D\IMG_3884.CR2
A H:\100EOS5D\IMG_3885.CR2
A H:\100EOS5D\IMG_3886.CR2
A H:\100EOS5D\IMG_3887.CR2
A H:\100EOS5D\IMG_3888.CR2
A H:\100EOS5D\IMG_3889.CR2
A H:\100EOS5D\IMG_3890.CR2
A H:\100EOS5D\IMG_3891.CR2
A H:\100EOS5D\IMG_3892.CR2
A H:\100EOS5D\IMG_3893.CR2
A H:\100EOS5D\IMG_3894.CR2
A H:\100EOS5D\IMG_3895.CR2
A H:\100EOS5D\IMG_3896.CR2
A H:\100EOS5D\IMG_3897.CR2
A H:\100EOS5D\IMG_3898.CR2
A H:\100EOS5D\IMG_3899.CR2
A H:\100EOS5D\IMG_3900.CR2
A H:\100EOS5D\IMG_3901.CR2
A H:\100EOS5D\IMG_3902.CR2
A H:\100EOS5D\IMG_3903.CR2
A H:\100EOS5D\IMG_3904.CR2
A H:\100EOS5D\IMG_3905.CR2
A H:\100EOS5D\IMG_3906.CR2
A H:\100EOS5D\IMG_3907.CR2
A H:\100EOS5D\IMG_3908.CR2
A H:\100EOS5D\IMG_3909.CR2
A H:\100EOS5D\IMG_3910.CR2
A H:\100EOS5D\IMG_3911.CR2
A H:\100EOS5D\IMG_3912.CR2
A H:\100EOS5D\IMG_3913.CR2
A H:\100EOS5D\IMG_3914.CR2
A H:\100EOS5D\IMG_3915.CR2
A H:\100EOS5D\IMG_3916.CR2
A H:\100EOS5D\IMG_3917.CR2
A H:\100EOS5D\IMG_3918.CR2
A H:\100EOS5D\IMG_3919.CR2
A H:\100EOS5D\IMG_3920.CR2
A H:\100EOS5D\IMG_3921.CR2
A H:\100EOS5D\IMG_3922.CR2
A H:\100EOS5D\IMG_3923.CR2
A H:\100EOS5D\IMG_3924.CR2
A H:\100EOS5D\IMG_3925.CR2
A H:\100EOS5D\IMG_3926.CR2
A H:\100EOS5D\IMG_3927.CR2
A H:\100EOS5D\IMG_3928.CR2
A H:\100EOS5D\IMG_3929.CR2
A H:\100EOS5D\IMG_3930.CR2
A H:\100EOS5D\IMG_3931.CR2
A H:\100EOS5D\IMG_3932.CR2
A H:\100EOS5D\IMG_3933.CR2
A H:\100EOS5D\IMG_3934.CR2
A H:\100EOS5D\IMG_3935.CR2
A H:\100EOS5D\IMG_3936.CR2
A H:\100EOS5D\IMG_3937.CR2
A H:\100EOS5D\IMG_3938.CR2
A H:\100EOS5D\IMG_3940.CR2
A H:\100EOS5D\IMG_3941.CR2
A H:\100EOS5D\IMG_3942.CR2
A H:\100EOS5D\IMG_3943.CR2
A H:\100EOS5D\IMG_3944.CR2
A H:\100EOS5D\IMG_3945.CR2
A H:\100EOS5D\IMG_3946.CR2
A H:\100EOS5D\IMG_3947.CR2
A H:\100EOS5D\IMG_3948.CR2
A H:\100EOS5D\IMG_3949.CR2
A H:\100EOS5D\IMG_3950.CR2
A H:\100EOS5D\IMG_3951.CR2
A H:\100EOS5D\IMG_3952.CR2
A H:\100EOS5D\IMG_3953.CR2
A H:\100EOS5D\IMG_3954.CR2
A H:\100EOS5D\IMG_3955.CR2
A H:\100EOS5D\IMG_3956.CR2
A H:\100EOS5D\IMG_3957.CR2
A H:\100EOS5D\IMG_3958.CR2
A H:\100EOS5D\IMG_3959.CR2
A H:\100EOS5D\IMG_3960.CR2
A H:\100EOS5D\IMG_3961.CR2
A H:\100EOS5D\IMG_3962.CR2
A H:\100EOS5D\IMG_3963.CR2
A H:\100EOS5D\IMG_3964.CR2
A H:\100EOS5D\IMG_3965.CR2
A H:\100EOS5D\IMG_3966.CR2
A H:\100EOS5D\IMG_3967.CR2
A H:\100EOS5D\IMG_3968.CR2
A H:\100EOS5D\IMG_3969.CR2
A H:\100EOS5D\IMG_3970.CR2
A H:\100EOS5D\IMG_3971.CR2
A H:\100EOS5D\IMG_3972.CR2
A H:\100EOS5D\IMG_3973.CR2
A H:\100EOS5D\IMG_3974.CR2
A H:\100EOS5D\IMG_3975.CR2
A H:\100EOS5D\IMG_3976.CR2
A H:\100EOS5D\IMG_3977.CR2
A H:\100EOS5D\IMG_3978.CR2
A H:\100EOS5D\IMG_3979.CR2
A H:\100EOS5D\IMG_3992.CR2
A H:\100EOS5D\IMG_3993.CR2
A H:\100EOS5D\IMG_3994.CR2
A H:\100EOS5D\IMG_3995.CR2
A H:\100EOS5D\IMG_3996.CR2
A H:\100EOS5D\IMG_3997.CR2
A H:\100EOS5D\IMG_3998.CR2
A H:\100EOS5D\IMG_3999.CR2
A H:\100EOS5D\IMG_4000.CR2
A H:\100EOS5D\IMG_4001.CR2
A H:\100EOS5D\IMG_4002.CR2
A H:\100EOS5D\IMG_4003.CR2
A H:\100EOS5D\IMG_4004.CR2
A H:\100EOS5D\IMG_4005.CR2
A H:\100EOS5D\IMG_4006.CR2
A H:\100EOS5D\IMG_4007.CR2
A H:\100EOS5D\IMG_4008.CR2
A H:\100EOS5D\IMG_4009.CR2
A H:\100EOS5D\IMG_4010.CR2
A H:\100EOS5D\IMG_4011.CR2
A H:\100EOS5D\IMG_4012.CR2
A H:\100EOS5D\IMG_4013.CR2
A H:\100EOS5D\IMG_4014.CR2
A H:\100EOS5D\IMG_4015.CR2
A H:\100EOS5D\IMG_4016.CR2
A H:\100EOS5D\IMG_4017.CR2
A H:\100EOS5D\IMG_4018.CR2
A H:\100EOS5D\IMG_4019.CR2
A H:\100EOS5D\IMG_4020.CR2
A H:\100EOS5D\IMG_4021.CR2
A H:\100EOS5D\IMG_4022.CR2
A H:\100EOS5D\IMG_4023.CR2
A H:\100EOS5D\IMG_4024.CR2
A H:\100EOS5D\IMG_4025.CR2
A H:\100EOS5D\IMG_4026.CR2
A H:\100EOS5D\IMG_4027.CR2
A H:\100EOS5D\IMG_4028.CR2
A H:\100EOS5D\IMG_4029.CR2
A H:\100EOS5D\IMG_4030.CR2
A H:\100EOS5D\IMG_4031.CR2
A H:\100EOS5D\IMG_4032.CR2
A H:\100EOS5D\IMG_4033.CR2
A H:\100EOS5D\IMG_4034.CR2
A H:\100EOS5D\IMG_4035.CR2
A H:\100EOS5D\IMG_4036.CR2
A H:\100EOS5D\IMG_4037.CR2
A H:\100EOS5D\IMG_4038.CR2
A H:\100EOS5D\IMG_4039.CR2
A H:\100EOS5D\IMG_4040.CR2
A H:\100EOS5D\IMG_4041.CR2
A H:\100EOS5D\IMG_4042.CR2
A H:\100EOS5D\IMG_4043.CR2
A H:\100EOS5D\IMG_4044.CR2
A H:\100EOS5D\IMG_4045.CR2
A H:\100EOS5D\IMG_4046.CR2
A H:\100EOS5D\IMG_4047.CR2
A H:\100EOS5D\IMG_4048.CR2
A H:\100EOS5D\IMG_4049.CR2
A H:\100EOS5D\IMG_4050.CR2
A H:\100EOS5D\IMG_4051.CR2
A H:\100EOS5D\IMG_4052.CR2
A H:\100EOS5D\IMG_4053.CR2
A H:\100EOS5D\IMG_4054.CR2
A H:\100EOS5D\IMG_4055.CR2
A H:\100EOS5D\IMG_4056.CR2
A H:\100EOS5D\IMG_4057.CR2
A H:\100EOS5D\IMG_4058.CR2
A H:\100EOS5D\IMG_4059.CR2
A H:\100EOS5D\IMG_4060.CR2
A H:\100EOS5D\IMG_4061.CR2
A H:\100EOS5D\IMG_4062.CR2
A H:\100EOS5D\IMG_4063.CR2
A H:\100EOS5D\IMG_4064.CR2
A H:\100EOS5D\IMG_4065.CR2
A H:\100EOS5D\IMG_4066.CR2
A H:\100EOS5D\IMG_4067.CR2
A H:\100EOS5D\IMG_4068.CR2
A H:\100EOS5D\IMG_4069.CR2
A H:\100EOS5D\IMG_4070.CR2
A H:\100EOS5D\IMG_4071.CR2
A H:\100EOS5D\IMG_4072.CR2
A H:\100EOS5D\IMG_4073.CR2
A H:\100EOS5D\IMG_4074.CR2
A H:\100EOS5D\IMG_4075.CR2
A H:\100EOS5D\IMG_4076.CR2
A H:\100EOS5D\IMG_4077.CR2
A H:\100EOS5D\IMG_4078.CR2
A H:\100EOS5D\IMG_4079.CR2
A H:\100EOS5D\IMG_4080.CR2
A H:\100EOS5D\IMG_4081.CR2
A H:\100EOS5D\IMG_4082.CR2
A H:\100EOS5D\IMG_4083.CR2
A H:\100EOS5D\IMG_4084.CR2
A H:\100EOS5D\IMG_4085.CR2
A H:\100EOS5D\IMG_4086.CR2
A H:\100EOS5D\IMG_4087.CR2
A H:\100EOS5D\IMG_4088.CR2
A H:\100EOS5D\IMG_4089.CR2
A H:\100EOS5D\IMG_4090.CR2
A H:\100EOS5D\IMG_4091.CR2
A H:\100EOS5D\IMG_4092.CR2
A H:\100EOS5D\IMG_4093.CR2
A H:\100EOS5D\IMG_4094.CR2
A H:\100EOS5D\IMG_4095.CR2
A H:\100EOS5D\IMG_4096.CR2
A H:\100EOS5D\IMG_4097.CR2
A H:\100EOS5D\IMG_4098.CR2
A H:\100EOS5D\IMG_4102.CR2
A H:\100EOS5D\IMG_4103.CR2
A H:\100EOS5D\IMG_4104.CR2
A H:\100EOS5D\IMG_4105.CR2
A H:\100EOS5D\IMG_4106.CR2
A H:\100EOS5D\IMG_4107.CR2
A H:\100EOS5D\IMG_4115.CR2
A H:\100EOS5D\IMG_4116.CR2
A H:\100EOS5D\IMG_4117.CR2
A H:\100EOS5D\IMG_4118.CR2
A H:\100EOS5D\IMG_4119.CR2
A H:\100EOS5D\IMG_4120.CR2
A H:\100EOS5D\IMG_4121.CR2
A H:\100EOS5D\IMG_4122.CR2
A H:\100EOS5D\IMG_4123.CR2
A H:\100EOS5D\IMG_4124.CR2
A H:\100EOS5D\IMG_4125.CR2
A H:\100EOS5D\IMG_4126.CR2
A H:\100EOS5D\IMG_4127.CR2
A H:\100EOS5D\IMG_4128.CR2
A H:\100EOS5D\IMG_4129.CR2
A H:\100EOS5D\IMG_4130.CR2
A H:\100EOS5D\IMG_4131.CR2
A H:\100EOS5D\IMG_4132.CR2
A H:\100EOS5D\IMG_4133.CR2
A H:\100EOS5D\IMG_4134.CR2
A H:\100EOS5D\IMG_4135.CR2
A H:\100EOS5D\IMG_4136.CR2
A H:\100EOS5D\IMG_4137.CR2
A H:\100EOS5D\IMG_4138.CR2
A H:\100EOS5D\IMG_4139.CR2
A H:\100EOS5D\IMG_4140.CR2
A H:\100EOS5D\IMG_4141.CR2
A H:\100EOS5D\IMG_4142.CR2
A H:\100EOS5D\IMG_4143.CR2
A H:\100EOS5D\IMG_4144.CR2
A H:\100EOS5D\IMG_4145.CR2
A H:\100EOS5D\IMG_4146.CR2
A H:\100EOS5D\IMG_4147.CR2
A H:\100EOS5D\IMG_4148.CR2
A H:\100EOS5D\IMG_4149.CR2
A H:\100EOS5D\IMG_4150.CR2
A H:\100EOS5D\IMG_4151.CR2
A H:\100EOS5D\IMG_4152.CR2
A H:\100EOS5D\IMG_4153.CR2
A H:\100EOS5D\IMG_4154.CR2
A H:\100EOS5D\IMG_4155.CR2
A H:\100EOS5D\IMG_4156.CR2
A H:\100EOS5D\IMG_4157.CR2
A H:\100EOS5D\IMG_4158.CR2
A H:\100EOS5D\IMG_4159.CR2
A H:\100EOS5D\IMG_4160.CR2
A H:\100EOS5D\IMG_4161.CR2
A H:\100EOS5D\IMG_4162.CR2
A H:\100EOS5D\IMG_4163.CR2
A H:\100EOS5D\IMG_4164.CR2
A H:\100EOS5D\IMG_4165.CR2
A H:\100EOS5D\IMG_4166.CR2
A H:\100EOS5D\IMG_4167.CR2
A H:\100EOS5D\IMG_4170.CR2
A H:\100EOS5D\IMG_4171.CR2
A H:\100EOS5D\IMG_4172.CR2
A H:\100EOS5D\IMG_4173.CR2
A H:\100EOS5D\IMG_4174.CR2
A H:\100EOS5D\IMG_4175.CR2
A H:\100EOS5D\IMG_4176.CR2
A H:\100EOS5D\IMG_4177.CR2
A H:\100EOS5D\IMG_4178.CR2
A H:\100EOS5D\IMG_4179.CR2
A H:\100EOS5D\IMG_4180.CR2
A H:\100EOS5D\IMG_4181.CR2
A H:\100EOS5D\IMG_4182.CR2
A H:\100EOS5D\IMG_4183.CR2
A H:\100EOS5D\IMG_4184.CR2
A H:\100EOS5D\IMG_4185.CR2
A H:\100EOS5D\IMG_4186.CR2
A H:\100EOS5D\IMG_4187.CR2
A H:\100EOS5D\IMG_4188.CR2
A H:\100EOS5D\IMG_4189.CR2
A H:\100EOS5D\IMG_4190.CR2
A H:\100EOS5D\IMG_4191.CR2
A H:\100EOS5D\IMG_4192.CR2
A H:\100EOS5D\IMG_4193.CR2
A H:\100EOS5D\IMG_4194.CR2
A H:\100EOS5D\IMG_4195.CR2
A H:\100EOS5D\IMG_4196.CR2
A H:\100EOS5D\IMG_4197.CR2
A H:\100EOS5D\IMG_4198.CR2
A H:\100EOS5D\IMG_4199.CR2
A H:\100EOS5D\IMG_4200.CR2
A H:\100EOS5D\IMG_4201.CR2
A H:\100EOS5D\IMG_4202.CR2
A H:\100EOS5D\IMG_4203.CR2
A H:\100EOS5D\IMG_4210.CR2
A H:\100EOS5D\IMG_4211.CR2
A H:\100EOS5D\IMG_4212.CR2
A H:\100EOS5D\IMG_4213.CR2
A H:\100EOS5D\IMG_4214.CR2
A H:\100EOS5D\IMG_4215.CR2
A H:\100EOS5D\IMG_4216.CR2
A H:\100EOS5D\IMG_4217.CR2
A H:\100EOS5D\IMG_4218.CR2
A H:\100EOS5D\IMG_4219.CR2
A H:\100EOS5D\IMG_4220.CR2
A H:\100EOS5D\IMG_4221.CR2
A H:\100EOS5D\IMG_4222.CR2
A H:\100EOS5D\IMG_4223.CR2
A H:\100EOS5D\IMG_4224.CR2
A H:\100EOS5D\IMG_4225.CR2
A H:\100EOS5D\IMG_4226.CR2
A H:\100EOS5D\IMG_4227.CR2
A H:\100EOS5D\IMG_4228.CR2
A H:\100EOS5D\IMG_4229.CR2
A H:\100EOS5D\IMG_4230.CR2
A H:\100EOS5D\IMG_4231.CR2
A H:\100EOS5D\IMG_4232.CR2
A H:\100EOS5D\IMG_4233.CR2
A H:\100EOS5D\IMG_4234.CR2
A H:\100EOS5D\IMG_4235.CR2
A H:\100EOS5D\IMG_4236.CR2
A H:\100EOS5D\IMG_4237.CR2
A H:\100EOS5D\IMG_4238.CR2
A H:\100EOS5D\IMG_4239.CR2
A H:\100EOS5D\IMG_4240.CR2
A H:\100EOS5D\IMG_4241.CR2
A H:\100EOS5D\IMG_4242.CR2
A H:\100EOS5D\IMG_4243.CR2
A H:\100EOS5D\IMG_4244.CR2
A H:\100EOS5D\IMG_4245.CR2
A H:\100EOS5D\IMG_4246.CR2
A H:\100EOS5D\IMG_4247.CR2
A H:\100EOS5D\IMG_4248.CR2
A H:\100EOS5D\IMG_4249.CR2
A H:\100EOS5D\IMG_4250.CR2
A H:\100EOS5D\IMG_4251.CR2
A H:\100EOS5D\IMG_4252.CR2
A H:\100EOS5D\IMG_4253.CR2
A H:\100EOS5D\IMG_4254.CR2
A H:\100EOS5D\IMG_4255.CR2
A H:\100EOS5D\IMG_4256.CR2
A H:\100EOS5D\IMG_4257.CR2
A H:\100EOS5D\IMG_4258.CR2
A H:\100EOS5D\IMG_4259.CR2
A H:\100EOS5D\IMG_4260.CR2
A H:\100EOS5D\IMG_4261.CR2
A H:\100EOS5D\IMG_4262.CR2
A H:\100EOS5D\IMG_4263.CR2
A H:\100EOS5D\IMG_4264.CR2
A H:\100EOS5D\IMG_4265.CR2
A H:\100EOS5D\IMG_4266.CR2
A H:\100EOS5D\IMG_4267.CR2
A H:\100EOS5D\IMG_4268.CR2
A H:\100EOS5D\IMG_4269.CR2
A H:\100EOS5D\IMG_4270.CR2
A H:\100EOS5D\IMG_4271.CR2
A H:\100EOS5D\IMG_4272.CR2
A H:\100EOS5D\IMG_4273.CR2
A H:\100EOS5D\IMG_4274.CR2
A H:\100EOS5D\IMG_4275.CR2
A H:\100EOS5D\IMG_4276.CR2
A H:\100EOS5D\IMG_4277.CR2
A H:\100EOS5D\IMG_4278.CR2
A H:\100EOS5D\IMG_4279.CR2
A H:\100EOS5D\IMG_4280.CR2
A H:\100EOS5D\IMG_4281.CR2
A H:\100EOS5D\IMG_4282.CR2
A H:\100EOS5D\IMG_4283.CR2
A H:\100EOS5D\IMG_4284.CR2
A H:\100EOS5D\IMG_4285.CR2
A H:\100EOS5D\IMG_4286.CR2
A H:\100EOS5D\IMG_4287.CR2
A H:\100EOS5D\IMG_4288.CR2
A H:\100EOS5D\IMG_4289.CR2
A H:\100EOS5D\IMG_4290.CR2
A H:\100EOS5D\IMG_4291.CR2
A H:\100EOS5D\IMG_4292.CR2
A H:\100EOS5D\IMG_4293.CR2
A H:\100EOS5D\IMG_4294.CR2
A H:\100EOS5D\IMG_4295.CR2
A H:\100EOS5D\IMG_4296.CR2
A H:\100EOS5D\IMG_4297.CR2
A H:\100EOS5D\IMG_4298.CR2
A H:\100EOS5D\IMG_4299.CR2
A H:\100EOS5D\IMG_4300.CR2
A H:\100EOS5D\IMG_4301.CR2
A H:\100EOS5D\IMG_4302.CR2
A H:\100EOS5D\IMG_4303.CR2
A H:\100EOS5D\IMG_4304.CR2
A H:\100EOS5D\IMG_4305.CR2
A H:\100EOS5D\IMG_4306.CR2
A H:\100EOS5D\IMG_4307.CR2
A H:\100EOS5D\IMG_4308.CR2
A H:\100EOS5D\IMG_4309.CR2
A H:\100EOS5D\IMG_4310.CR2
A H:\100EOS5D\IMG_4311.CR2
A H:\100EOS5D\IMG_4312.CR2
A H:\100EOS5D\IMG_4313.CR2
A H:\100EOS5D\IMG_4314.CR2
A H:\100EOS5D\IMG_4315.CR2
A H:\100EOS5D\IMG_4316.CR2
A H:\100EOS5D\IMG_4317.CR2
A H:\100EOS5D\IMG_4318.CR2
A H:\100EOS5D\IMG_4319.CR2
A H:\100EOS5D\IMG_4320.CR2
A H:\100EOS5D\IMG_4321.CR2
A H:\100EOS5D\IMG_4322.CR2
A H:\100EOS5D\IMG_4323.CR2
A H:\100EOS5D\IMG_4324.CR2
A H:\100EOS5D\IMG_4325.CR2
A H:\100EOS5D\IMG_4326.CR2
A H:\100EOS5D\IMG_4327.CR2
A H:\100EOS5D\IMG_4328.CR2
A H:\100EOS5D\IMG_4329.CR2
A H:\100EOS5D\IMG_4330.CR2
A H:\100EOS5D\IMG_4331.CR2
A H:\100EOS5D\IMG_4332.CR2
A H:\100EOS5D\IMG_4333.CR2
A H:\100EOS5D\IMG_4334.CR2
A H:\100EOS5D\IMG_4335.CR2
A H:\100EOS5D\IMG_4336.CR2
A H:\100EOS5D\IMG_4337.CR2
A H:\100EOS5D\IMG_4338.CR2
A H:\100EOS5D\IMG_4339.CR2
A H:\100EOS5D\IMG_4340.CR2
A H:\100EOS5D\IMG_4341.CR2
A H:\100EOS5D\IMG_4342.CR2
A H:\100EOS5D\IMG_4343.CR2
A H:\100EOS5D\IMG_4344.CR2
A H:\100EOS5D\IMG_4345.CR2
A H:\100EOS5D\IMG_4346.CR2
A H:\100EOS5D\IMG_4347.CR2
A H:\100EOS5D\IMG_4348.CR2
A H:\100EOS5D\IMG_4349.CR2
A H:\100EOS5D\IMG_4350.CR2
A H:\100EOS5D\IMG_4351.CR2
A H:\100EOS5D\IMG_4352.CR2
A H:\100EOS5D\IMG_4353.CR2
A H:\100EOS5D\IMG_4354.CR2
A H:\100EOS5D\IMG_4355.CR2
A H:\100EOS5D\IMG_4356.CR2
A H:\100EOS5D\IMG_4357.CR2
A H:\100EOS5D\IMG_4358.CR2
A H:\100EOS5D\IMG_4359.CR2
A H:\100EOS5D\IMG_4360.CR2
A H:\100EOS5D\IMG_4361.CR2
A H:\100EOS5D\IMG_4362.CR2
A H:\100EOS5D\IMG_4363.CR2
A H:\100EOS5D\IMG_4364.CR2
A H:\100EOS5D\IMG_4365.CR2
A H:\100EOS5D\IMG_4366.CR2
A H:\100EOS5D\IMG_4367.CR2
A H:\100EOS5D\IMG_4368.CR2
A H:\100EOS5D\IMG_4369.CR2
A H:\100EOS5D\IMG_4370.CR2
A H:\100EOS5D\IMG_4371.CR2
A H:\100EOS5D\IMG_4373.CR2
A H:\100EOS5D\IMG_4374.CR2
A H:\100EOS5D\IMG_4375.CR2
A H:\100EOS5D\IMG_4376.CR2
A H:\100EOS5D\IMG_4377.CR2
A H:\100EOS5D\IMG_4378.CR2
A H:\100EOS5D\IMG_4382.CR2
A H:\100EOS5D\IMG_4383.CR2
A H:\100EOS5D\IMG_4384.CR2
A H:\100EOS5D\IMG_4385.CR2
A H:\100EOS5D\IMG_4386.CR2
A H:\100EOS5D\IMG_4387.CR2
A H:\100EOS5D\IMG_4388.CR2
A H:\100EOS5D\IMG_4389.CR2
A H:\100EOS5D\IMG_4390.CR2
A H:\100EOS5D\IMG_4391.CR2
A H:\100EOS5D\IMG_4392.CR2
A H:\100EOS5D\IMG_4393.CR2
A H:\100EOS5D\IMG_4394.CR2
A H:\100EOS5D\IMG_4395.CR2
A H:\100EOS5D\IMG_4396.CR2
A H:\100EOS5D\IMG_4397.CR2
A H:\100EOS5D\IMG_4398.CR2
A H:\100EOS5D\IMG_4399.CR2
A H:\100EOS5D\IMG_4400.CR2
A H:\100EOS5D\IMG_4401.CR2
A H:\100EOS5D\IMG_4402.CR2
A H:\100EOS5D\IMG_4403.CR2
A H:\100EOS5D\IMG_4404.CR2
A H:\100EOS5D\IMG_4405.CR2
A H:\100EOS5D\IMG_4406.CR2
A H:\100EOS5D\IMG_4407.CR2
A H:\100EOS5D\IMG_4408.CR2
A H:\100EOS5D\IMG_4409.CR2
A H:\100EOS5D\IMG_4410.CR2
A H:\100EOS5D\IMG_4411.CR2
A H:\100EOS5D\IMG_4412.CR2
A H:\100EOS5D\IMG_4413.CR2
A H:\100EOS5D\IMG_4414.CR2
A H:\100EOS5D\IMG_4415.CR2
A H:\100EOS5D\IMG_4416.CR2
A H:\100EOS5D\IMG_4417.CR2
A H:\100EOS5D\IMG_4418.CR2
A H:\100EOS5D\IMG_4420.CR2
A H:\100EOS5D\IMG_4421.CR2
A H:\100EOS5D\IMG_4422.CR2
A H:\100EOS5D\IMG_4426.CR2
A H:\100EOS5D\IMG_4427.CR2
A H:\100EOS5D\IMG_4428.CR2
A H:\100EOS5D\IMG_4429.CR2
A H:\100EOS5D\IMG_4430.CR2
A H:\100EOS5D\IMG_4431.CR2
A H:\100EOS5D\IMG_4432.CR2
A H:\100EOS5D\IMG_4433.CR2
A H:\100EOS5D\IMG_4434.CR2
A H:\100EOS5D\IMG_4435.CR2
A H:\100EOS5D\IMG_4436.CR2
A H:\100EOS5D\IMG_4437.CR2
A H:\100EOS5D\IMG_4438.CR2
A H:\100EOS5D\IMG_4439.CR2
A H:\100EOS5D\IMG_4440.CR2
A H:\100EOS5D\IMG_4441.CR2
A H:\100EOS5D\IMG_4442.CR2
A H:\100EOS5D\IMG_4443.CR2
A H:\100EOS5D\IMG_4444.CR2
A H:\100EOS5D\IMG_4446.CR2
A H:\100EOS5D\IMG_4447.CR2
A H:\100EOS5D\IMG_4448.CR2
A H:\100EOS5D\IMG_4449.CR2
A H:\100EOS5D\IMG_4450.CR2
A H:\100EOS5D\IMG_4451.CR2
A H:\100EOS5D\IMG_4452.CR2
A H:\100EOS5D\IMG_4453.CR2
A H:\100EOS5D\IMG_4454.CR2
A H:\100EOS5D\IMG_4455.CR2
A H:\100EOS5D\IMG_4456.CR2
A H:\100EOS5D\IMG_4457.CR2
A H:\100EOS5D\IMG_4458.CR2
A H:\100EOS5D\IMG_4459.CR2
A H:\100EOS5D\IMG_4463.CR2
A H:\100EOS5D\IMG_4464.CR2
A H:\100EOS5D\IMG_4472.CR2
A H:\100EOS5D\IMG_4473.CR2
A H:\100EOS5D\IMG_4474.CR2
A H:\100EOS5D\IMG_4475.CR2
A H:\100EOS5D\IMG_4476.CR2
A H:\100EOS5D\IMG_4477.CR2
A H:\100EOS5D\IMG_4478.CR2
A H:\100EOS5D\IMG_4479.CR2
A H:\100EOS5D\IMG_4480.CR2
A H:\100EOS5D\IMG_4481.CR2
A H:\100EOS5D\IMG_4482.CR2
A H:\100EOS5D\IMG_4483.CR2
A H:\100EOS5D\IMG_4484.CR2
A H:\100EOS5D\IMG_4485.CR2
A H:\100EOS5D\IMG_4486.CR2
A H:\100EOS5D\IMG_4487.CR2
A H:\100EOS5D\IMG_4488.CR2
A H:\100EOS5D\IMG_4489.CR2
A H:\100EOS5D\IMG_4490.CR2
A H:\100EOS5D\IMG_4491.CR2
A H:\100EOS5D\IMG_4492.CR2
A H:\100EOS5D\IMG_4493.CR2
A H:\100EOS5D\IMG_4494.CR2
A H:\100EOS5D\IMG_4495.CR2
A H:\100EOS5D\IMG_4496.CR2
A H:\100EOS5D\IMG_4497.CR2
A H:\100EOS5D\IMG_4498.CR2
A H:\100EOS5D\IMG_4499.CR2
A H:\100EOS5D\IMG_4500.CR2
A H:\100EOS5D\IMG_4501.CR2
A H:\100EOS5D\IMG_4502.CR2
A H:\100EOS5D\IMG_4503.CR2
A H:\100EOS5D\IMG_4504.CR2
A H:\100EOS5D\IMG_4505.CR2
A H:\100EOS5D\IMG_4506.CR2
A H:\100EOS5D\IMG_4507.CR2
A H:\100EOS5D\IMG_4508.CR2
A H:\100EOS5D\IMG_4509.CR2
A H:\100EOS5D\IMG_4510.CR2
A H:\100EOS5D\IMG_4511.CR2
A H:\100EOS5D\IMG_4512.CR2
A H:\100EOS5D\IMG_4513.CR2
A H:\100EOS5D\IMG_4516.CR2
A H:\100EOS5D\IMG_4517.CR2
A H:\100EOS5D\IMG_4518.CR2
A H:\100EOS5D\IMG_4519.CR2
A H:\100EOS5D\IMG_4520.CR2
A H:\100EOS5D\IMG_4521.CR2
A H:\100EOS5D\IMG_4522.CR2
A H:\100EOS5D\IMG_4533.CR2
A H:\100EOS5D\IMG_4534.CR2
A H:\100EOS5D\IMG_4535.CR2
A H:\100EOS5D\IMG_4536.CR2
A H:\100EOS5D\IMG_4537.CR2
A H:\100EOS5D\IMG_4538.CR2
A H:\100EOS5D\IMG_4539.CR2
A H:\100EOS5D\IMG_4540.CR2
A H:\100EOS5D\IMG_4541.CR2
A H:\100EOS5D\IMG_4542.CR2
A H:\100EOS5D\IMG_4543.CR2
A H:\100EOS5D\IMG_4544.CR2
A H:\100EOS5D\IMG_4545.CR2
A H:\100EOS5D\IMG_4546.CR2
A H:\100EOS5D\IMG_4547.CR2
A H:\100EOS5D\IMG_4548.CR2
A H:\100EOS5D\IMG_4549.CR2
A H:\100EOS5D\IMG_4550.CR2
A H:\100EOS5D\IMG_4551.CR2
A H:\100EOS5D\IMG_4552.CR2
A H:\100EOS5D\IMG_4553.CR2
A H:\100EOS5D\IMG_4554.CR2
A H:\100EOS5D\IMG_4555.CR2
A H:\100EOS5D\IMG_4556.CR2
A H:\100EOS5D\IMG_4557.CR2
A H:\100EOS5D\IMG_4558.CR2
A H:\100EOS5D\IMG_4559.CR2
A H:\100EOS5D\IMG_4560.CR2
A H:\100EOS5D\IMG_4561.CR2
A H:\100EOS5D\IMG_4562.CR2
A H:\100EOS5D\IMG_4563.CR2
A H:\100EOS5D\IMG_4564.CR2
A H:\100EOS5D\IMG_4565.CR2
A H:\100EOS5D\IMG_4566.CR2
A H:\100EOS5D\IMG_4567.CR2
A H:\100EOS5D\IMG_4568.CR2
A H:\100EOS5D\IMG_4569.CR2
A H:\100EOS5D\IMG_4570.CR2
A H:\100EOS5D\IMG_4571.CR2
A H:\100EOS5D\IMG_4572.CR2
A H:\100EOS5D\IMG_4573.CR2
A H:\100EOS5D\IMG_4574.CR2
A H:\100EOS5D\IMG_4575.CR2
A H:\100EOS5D\IMG_4576.CR2
A H:\100EOS5D\IMG_4577.CR2
A H:\100EOS5D\IMG_4578.CR2
A H:\100EOS5D\MVI_3939.MOV
A H:\100EOS5D\MVI_3939.THM
A H:\100EOS5D\MVI_3980.MOV
A H:\100EOS5D\MVI_3980.THM
A H:\100EOS5D\MVI_3981.MOV
A H:\100EOS5D\MVI_3981.THM
A H:\100EOS5D\MVI_3982.MOV
A H:\100EOS5D\MVI_3982.THM
A H:\100EOS5D\MVI_3983.MOV
A H:\100EOS5D\MVI_3983.THM
A H:\100EOS5D\MVI_3984.MOV
A H:\100EOS5D\MVI_3984.THM
A H:\100EOS5D\MVI_3985.MOV
A H:\100EOS5D\MVI_3985.THM
A H:\100EOS5D\MVI_3986.MOV
A H:\100EOS5D\MVI_3986.THM
A H:\100EOS5D\MVI_3987.MOV
A H:\100EOS5D\MVI_3987.THM
A H:\100EOS5D\MVI_3988.MOV
A H:\100EOS5D\MVI_3988.THM
A H:\100EOS5D\MVI_3989.MOV
A H:\100EOS5D\MVI_3989.THM
A H:\100EOS5D\MVI_3990.MOV
A H:\100EOS5D\MVI_3990.THM
A H:\100EOS5D\MVI_3991.MOV
A H:\100EOS5D\MVI_3991.THM
A H:\100EOS5D\MVI_4099.MOV
A H:\100EOS5D\MVI_4099.THM
A H:\100EOS5D\MVI_4100.MOV
A H:\100EOS5D\MVI_4100.THM
A H:\100EOS5D\MVI_4101.MOV
A H:\100EOS5D\MVI_4101.THM
A H:\100EOS5D\MVI_4108.MOV
A H:\100EOS5D\MVI_4108.THM
A H:\100EOS5D\MVI_4109.MOV
A H:\100EOS5D\MVI_4109.THM
A H:\100EOS5D\MVI_4110.MOV
A H:\100EOS5D\MVI_4110.THM
A H:\100EOS5D\MVI_4111.MOV
A H:\100EOS5D\MVI_4111.THM
A H:\100EOS5D\MVI_4112.MOV
A H:\100EOS5D\MVI_4112.THM
A H:\100EOS5D\MVI_4113.MOV
A H:\100EOS5D\MVI_4113.THM
A H:\100EOS5D\MVI_4114.MOV
A H:\100EOS5D\MVI_4114.THM
A H:\100EOS5D\MVI_4168.MOV
A H:\100EOS5D\MVI_4168.THM
A H:\100EOS5D\MVI_4169.MOV
A H:\100EOS5D\MVI_4169.THM
A H:\100EOS5D\MVI_4204.MOV
A H:\100EOS5D\MVI_4204.THM
A H:\100EOS5D\MVI_4205.MOV
A H:\100EOS5D\MVI_4205.THM
A H:\100EOS5D\MVI_4206.MOV
A H:\100EOS5D\MVI_4206.THM
A H:\100EOS5D\MVI_4207.MOV
A H:\100EOS5D\MVI_4207.THM
A H:\100EOS5D\MVI_4208.MOV
A H:\100EOS5D\MVI_4208.THM
A H:\100EOS5D\MVI_4209.MOV
A H:\100EOS5D\MVI_4209.THM
A H:\100EOS5D\MVI_4372.MOV
A H:\100EOS5D\MVI_4372.THM
A H:\100EOS5D\MVI_4379.MOV
A H:\100EOS5D\MVI_4379.THM
A H:\100EOS5D\MVI_4380.MOV
A H:\100EOS5D\MVI_4380.THM
A H:\100EOS5D\MVI_4381.MOV
A H:\100EOS5D\MVI_4381.THM
A H:\100EOS5D\MVI_4419.MOV
A H:\100EOS5D\MVI_4419.THM
A H:\100EOS5D\MVI_4423.MOV
A H:\100EOS5D\MVI_4423.THM
A H:\100EOS5D\MVI_4424.MOV
A H:\100EOS5D\MVI_4424.THM
A H:\100EOS5D\MVI_4425.MOV
A H:\100EOS5D\MVI_4425.THM
A H:\100EOS5D\MVI_4445.MOV
A H:\100EOS5D\MVI_4445.THM
A H:\100EOS5D\MVI_4460.MOV
A H:\100EOS5D\MVI_4460.THM
A H:\100EOS5D\MVI_4461.MOV
A H:\100EOS5D\MVI_4461.THM
A H:\100EOS5D\MVI_4462.MOV
A H:\100EOS5D\MVI_4462.THM
A H:\100EOS5D\MVI_4465.MOV
A H:\100EOS5D\MVI_4465.THM
A H:\100EOS5D\MVI_4466.MOV
A H:\100EOS5D\MVI_4466.THM
A H:\100EOS5D\MVI_4467.MOV
A H:\100EOS5D\MVI_4467.THM
A H:\100EOS5D\MVI_4468.MOV
A H:\100EOS5D\MVI_4468.THM
A H:\100EOS5D\MVI_4469.MOV
A H:\100EOS5D\MVI_4469.THM
A H:\100EOS5D\MVI_4470.MOV
A H:\100EOS5D\MVI_4470.THM
A H:\100EOS5D\MVI_4471.MOV
A H:\100EOS5D\MVI_4471.THM
A H:\100EOS5D\MVI_4514.MOV
A H:\100EOS5D\MVI_4514.THM
A H:\100EOS5D\MVI_4515.MOV
A H:\100EOS5D\MVI_4515.THM
A H:\100EOS5D\MVI_4523.MOV
A H:\100EOS5D\MVI_4523.THM
A H:\100EOS5D\MVI_4524.MOV
A H:\100EOS5D\MVI_4524.THM
A H:\100EOS5D\MVI_4525.MOV
A H:\100EOS5D\MVI_4525.THM
A H:\100EOS5D\MVI_4526.MOV
A H:\100EOS5D\MVI_4526.THM
A H:\100EOS5D\MVI_4527.MOV
A H:\100EOS5D\MVI_4527.THM
A H:\100EOS5D\MVI_4528.MOV
A H:\100EOS5D\MVI_4528.THM
A H:\100EOS5D\MVI_4529.MOV
A H:\100EOS5D\MVI_4529.THM
A H:\100EOS5D\MVI_4530.MOV
A H:\100EOS5D\MVI_4530.THM
A H:\100EOS5D\MVI_4531.MOV
A H:\100EOS5D\MVI_4531.THM
A H:\100EOS5D\MVI_4532.MOV
A H:\100EOS5D\MVI_4532.THM
A H:\101GOPRO\GOPR1951.MP4
A H:\101GOPRO\GOPR1952.MP4
A H:\101GOPRO\GOPR1953.MP4
A H:\101GOPRO\GOPR1954.MP4
A H:\101GOPRO\GOPR1955.MP4
A H:\101GOPRO\GOPR1956.MP4
A H:\101GOPRO\GP011951.MP4
A H:\101GOPRO\GP011952.MP4
A H:\101GOPRO\GP011953.MP4
A H:\101GOPRO\GP011954.MP4
A H:\101GOPRO\GP011955.MP4
A H:\101GOPRO\GP021952.MP4
A H:\101GOPRO\GP021953.MP4
A H:\101GOPRO\GP021954.MP4
A H:\101GOPRO\GP031952.MP4
A H:\101GOPRO\GP031953.MP4
A H:\101GOPRO\GP031954.MP4
A H:\101GOPRO\GP041952.MP4
A H:\101GOPRO\GP041954.MP4
A H:\101GOPRO\GP051954.MP4
A H:\Day1 Nusai\100GOPRO\GOPR0001.LRV
A H:\Day1 Nusai\100GOPRO\GOPR0001.MP4
A H:\Day1 Nusai\100GOPRO\GOPR0001.THM
A H:\Day1 Nusai\100GOPRO\GOPR0002.LRV
A H:\Day1 Nusai\100GOPRO\GOPR0002.MP4
A H:\Day1 Nusai\100GOPRO\GOPR0002.THM
A H:\Day1 Nusai\100GOPRO\GOPR0003.LRV
A H:\Day1 Nusai\100GOPRO\GOPR0003.MP4
A H:\Day1 Nusai\100GOPRO\GOPR0003.THM
A H:\Day1 Nusai\100GOPRO\GOPR0004.LRV
A H:\Day1 Nusai\100GOPRO\GOPR0004.MP4
A H:\Day1 Nusai\100GOPRO\GOPR0004.THM
A H:\Day1 Nusai\100GOPRO\GOPR0005.MP4
A H:\Day1 Nusai\100GOPRO\GOPR0006.MP4
A H:\Day1 Nusai\100GOPRO\GOPR0007.MP4
A H:\Day1 Nusai\100GOPRO\GP010002.LRV
A H:\Day1 Nusai\100GOPRO\GP010002.MP4
A H:\Day1 Nusai\5D II\IMG_0537.CR2
A H:\Day1 Nusai\5D II\IMG_0538.CR2
A H:\Day1 Nusai\5D II\IMG_0539.CR2
A H:\Day1 Nusai\5D II\IMG_0540.CR2
A H:\Day1 Nusai\5D II\IMG_0541.CR2
A H:\Day1 Nusai\5D II\IMG_0542.CR2
A H:\Day1 Nusai\5D II\IMG_0543.CR2
A H:\Day1 Nusai\5D II\IMG_0544.CR2
A H:\Day1 Nusai\5D II\IMG_0545.CR2
A H:\Day1 Nusai\5D II\IMG_0546.CR2
A H:\Day1 Nusai\5D II\IMG_0555.CR2
A H:\Day1 Nusai\5D II\IMG_0556.CR2
A H:\Day1 Nusai\5D II\IMG_0557.CR2
A H:\Day1 Nusai\5D II\IMG_0558.CR2
A H:\Day1 Nusai\5D II\IMG_0559.CR2
A H:\Day1 Nusai\5D II\IMG_0560.CR2
A H:\Day1 Nusai\5D II\IMG_0561.CR2
A H:\Day1 Nusai\5D II\IMG_0562.CR2
A H:\Day1 Nusai\5D II\IMG_0563.CR2
A H:\Day1 Nusai\5D II\IMG_0564.CR2
A H:\Day1 Nusai\5D II\IMG_0565.CR2
A H:\Day1 Nusai\5D II\IMG_0566.CR2
A H:\Day1 Nusai\5D II\IMG_0567.CR2
A H:\Day1 Nusai\5D II\IMG_0568.CR2
A H:\Day1 Nusai\5D II\IMG_0569.CR2
A H:\Day1 Nusai\5D II\IMG_0581.CR2
A H:\Day1 Nusai\5D II\IMG_0582.CR2
A H:\Day1 Nusai\5D II\IMG_0583.CR2
A H:\Day1 Nusai\5D II\IMG_0584.CR2
A H:\Day1 Nusai\5D II\IMG_0585.CR2
A H:\Day1 Nusai\5D II\IMG_0586.CR2
A H:\Day1 Nusai\5D II\IMG_0587.CR2
A H:\Day1 Nusai\5D II\IMG_0588.CR2
A H:\Day1 Nusai\5D II\IMG_0589.CR2
A H:\Day1 Nusai\5D II\IMG_0590.CR2
A H:\Day1 Nusai\5D II\IMG_0591.CR2
A H:\Day1 Nusai\5D II\IMG_0592.CR2
A H:\Day1 Nusai\5D II\IMG_0593.CR2
A H:\Day1 Nusai\5D II\IMG_0597.CR2
A H:\Day1 Nusai\5D II\IMG_0598.CR2
A H:\Day1 Nusai\5D II\IMG_0599.CR2
A H:\Day1 Nusai\5D II\IMG_0600.CR2
A H:\Day1 Nusai\5D II\IMG_0601.CR2
A H:\Day1 Nusai\5D II\IMG_0602.CR2
A H:\Day1 Nusai\5D II\IMG_0603.CR2
A H:\Day1 Nusai\5D II\IMG_0604.CR2
A H:\Day1 Nusai\5D II\IMG_0605.CR2
A H:\Day1 Nusai\5D II\IMG_0606.CR2
A H:\Day1 Nusai\5D II\IMG_0607.CR2
A H:\Day1 Nusai\5D II\IMG_0608.CR2
A H:\Day1 Nusai\5D II\IMG_0609.CR2
A H:\Day1 Nusai\5D II\IMG_0610.CR2
A H:\Day1 Nusai\5D II\IMG_0611.CR2
A H:\Day1 Nusai\5D II\IMG_0615.CR2
A H:\Day1 Nusai\5D II\IMG_0616.CR2
A H:\Day1 Nusai\5D II\IMG_0617.CR2
A H:\Day1 Nusai\5D II\IMG_0618.CR2
A H:\Day1 Nusai\5D II\IMG_0619.CR2
A H:\Day1 Nusai\5D II\IMG_0625.CR2
A H:\Day1 Nusai\5D II\IMG_0626.CR2
A H:\Day1 Nusai\5D II\IMG_0627.CR2
A H:\Day1 Nusai\5D II\IMG_0628.CR2
A H:\Day1 Nusai\5D II\IMG_0629.CR2
A H:\Day1 Nusai\5D II\IMG_0630.CR2
A H:\Day1 Nusai\5D II\IMG_0631.CR2
A H:\Day1 Nusai\5D II\IMG_0632.CR2
A H:\Day1 Nusai\5D II\IMG_0633.CR2
A H:\Day1 Nusai\5D II\IMG_0634.CR2
A H:\Day1 Nusai\5D II\IMG_0635.CR2
A H:\Day1 Nusai\5D II\IMG_0636.CR2
A H:\Day1 Nusai\5D II\IMG_0637.CR2
A H:\Day1 Nusai\5D II\IMG_0638.CR2
A H:\Day1 Nusai\5D II\IMG_0639.CR2
A H:\Day1 Nusai\5D II\IMG_0640.CR2
A H:\Day1 Nusai\5D II\IMG_0641.CR2
A H:\Day1 Nusai\5D II\IMG_0642.CR2
A H:\Day1 Nusai\5D II\IMG_0643.CR2
A H:\Day1 Nusai\5D II\IMG_0644.CR2
A H:\Day1 Nusai\5D II\IMG_0645.CR2
A H:\Day1 Nusai\5D II\IMG_0646.CR2
A H:\Day1 Nusai\5D II\IMG_0647.CR2
A H:\Day1 Nusai\5D II\IMG_0651.CR2
A H:\Day1 Nusai\5D II\IMG_0652.CR2
A H:\Day1 Nusai\5D II\IMG_0653.CR2
A H:\Day1 Nusai\5D II\IMG_0654.CR2
A H:\Day1 Nusai\5D II\IMG_0655.CR2
A H:\Day1 Nusai\5D II\IMG_0656.CR2
A H:\Day1 Nusai\5D II\IMG_0657.CR2
A H:\Day1 Nusai\5D II\IMG_0658.CR2
A H:\Day1 Nusai\5D II\IMG_0659.CR2
A H:\Day1 Nusai\5D II\IMG_0660.CR2
A H:\Day1 Nusai\5D II\IMG_0661.CR2
A H:\Day1 Nusai\5D II\IMG_0662.CR2
A H:\Day1 Nusai\5D II\IMG_0663.CR2
A H:\Day1 Nusai\5D II\IMG_0664.CR2
A H:\Day1 Nusai\5D II\IMG_0677.CR2
A H:\Day1 Nusai\5D II\IMG_0678.CR2
A H:\Day1 Nusai\5D II\MVI_0547.MOV
A H:\Day1 Nusai\5D II\MVI_0547.THM
A H:\Day1 Nusai\5D II\MVI_0548.MOV
A H:\Day1 Nusai\5D II\MVI_0548.THM
A H:\Day1 Nusai\5D II\MVI_0549.MOV
A H:\Day1 Nusai\5D II\MVI_0549.THM
A H:\Day1 Nusai\5D II\MVI_0550.MOV
A H:\Day1 Nusai\5D II\MVI_0550.THM
A H:\Day1 Nusai\5D II\MVI_0551.MOV
A H:\Day1 Nusai\5D II\MVI_0551.THM
A H:\Day1 Nusai\5D II\MVI_0552.MOV
A H:\Day1 Nusai\5D II\MVI_0552.THM
A H:\Day1 Nusai\5D II\MVI_0553.MOV
A H:\Day1 Nusai\5D II\MVI_0553.THM
A H:\Day1 Nusai\5D II\MVI_0554.MOV
A H:\Day1 Nusai\5D II\MVI_0554.THM
A H:\Day1 Nusai\5D II\MVI_0570.MOV
A H:\Day1 Nusai\5D II\MVI_0570.THM
A H:\Day1 Nusai\5D II\MVI_0571.MOV
A H:\Day1 Nusai\5D II\MVI_0571.THM
A H:\Day1 Nusai\5D II\MVI_0572.MOV
A H:\Day1 Nusai\5D II\MVI_0572.THM
A H:\Day1 Nusai\5D II\MVI_0573.MOV
A H:\Day1 Nusai\5D II\MVI_0573.THM
A H:\Day1 Nusai\5D II\MVI_0574.MOV
A H:\Day1 Nusai\5D II\MVI_0574.THM
A H:\Day1 Nusai\5D II\MVI_0575.MOV
A H:\Day1 Nusai\5D II\MVI_0575.THM
A H:\Day1 Nusai\5D II\MVI_0576.MOV
A H:\Day1 Nusai\5D II\MVI_0576.THM
A H:\Day1 Nusai\5D II\MVI_0577.MOV
A H:\Day1 Nusai\5D II\MVI_0577.THM
A H:\Day1 Nusai\5D II\MVI_0578.MOV
A H:\Day1 Nusai\5D II\MVI_0578.THM
A H:\Day1 Nusai\5D II\MVI_0579.MOV
A H:\Day1 Nusai\5D II\MVI_0579.THM
A H:\Day1 Nusai\5D II\MVI_0580.MOV
A H:\Day1 Nusai\5D II\MVI_0580.THM
A H:\Day1 Nusai\5D II\MVI_0594.MOV
A H:\Day1 Nusai\5D II\MVI_0594.THM
A H:\Day1 Nusai\5D II\MVI_0595.MOV
A H:\Day1 Nusai\5D II\MVI_0595.THM
A H:\Day1 Nusai\5D II\MVI_0596.MOV
A H:\Day1 Nusai\5D II\MVI_0596.THM
A H:\Day1 Nusai\5D II\MVI_0612.MOV
A H:\Day1 Nusai\5D II\MVI_0612.THM
A H:\Day1 Nusai\5D II\MVI_0613.MOV
A H:\Day1 Nusai\5D II\MVI_0613.THM
A H:\Day1 Nusai\5D II\MVI_0614.MOV
A H:\Day1 Nusai\5D II\MVI_0614.THM
A H:\Day1 Nusai\5D II\MVI_0620.MOV
A H:\Day1 Nusai\5D II\MVI_0620.THM
A H:\Day1 Nusai\5D II\MVI_0621.MOV
A H:\Day1 Nusai\5D II\MVI_0621.THM
A H:\Day1 Nusai\5D II\MVI_0622.MOV
A H:\Day1 Nusai\5D II\MVI_0622.THM
A H:\Day1 Nusai\5D II\MVI_0623.MOV
A H:\Day1 Nusai\5D II\MVI_0623.THM
A H:\Day1 Nusai\5D II\MVI_0624.MOV
A H:\Day1 Nusai\5D II\MVI_0624.THM
A H:\Day1 Nusai\5D II\MVI_0648.MOV
A H:\Day1 Nusai\5D II\MVI_0648.THM
A H:\Day1 Nusai\5D II\MVI_0649.MOV
A H:\Day1 Nusai\5D II\MVI_0649.THM
A H:\Day1 Nusai\5D II\MVI_0650.MOV
A H:\Day1 Nusai\5D II\MVI_0650.THM
A H:\Day1 Nusai\60D\MVI_5219.MOV
A H:\Day1 Nusai\60D\MVI_5220.MOV
A H:\Day1 Nusai\60D\MVI_5221.MOV
A H:\Day1 Nusai\60D\MVI_5222.MOV
A H:\Day1 Nusai\60D\MVI_5223.MOV
A H:\Day1 Nusai\60D\MVI_5224.MOV
A H:\Day1 Nusai\60D\MVI_5225.MOV
A H:\Day1 Nusai\60D\MVI_5226.MOV
A H:\Day1 Nusai\60D\MVI_5227.MOV
A H:\Day1 Nusai\60D\MVI_5228.MOV
A H:\Day1 Nusai\60D\MVI_5229.MOV
A H:\Day1 Nusai\60D\MVI_5230.MOV
A H:\Day1 Nusai\60D\MVI_5231.MOV
A H:\Day1 Nusai\60D\MVI_5232.MOV
ssmad
Regular Member
 
Posts: 41
Joined: May 25th, 2013, 12:10 pm

Re: External WD HD infected with Win32:Kryptik.LQL

Unread postby ssmad » May 27th, 2013, 8:51 am

A H:\Day2\100GOPRO\G0010011.JPG
A H:\Day2\100GOPRO\G0010012.JPG
A H:\Day2\100GOPRO\G0010013.JPG
A H:\Day2\100GOPRO\G0010014.JPG
A H:\Day2\100GOPRO\G0010015.JPG
A H:\Day2\100GOPRO\G0010016.JPG
A H:\Day2\100GOPRO\G0010017.JPG
A H:\Day2\100GOPRO\G0010018.JPG
A H:\Day2\100GOPRO\G0010019.JPG
A H:\Day2\100GOPRO\G0010020.JPG
A H:\Day2\100GOPRO\G0010021.JPG
A H:\Day2\100GOPRO\G0010022.JPG
A H:\Day2\100GOPRO\G0010023.JPG
A H:\Day2\100GOPRO\G0010024.JPG
A H:\Day2\100GOPRO\G0010025.JPG
A H:\Day2\100GOPRO\G0010026.JPG
A H:\Day2\100GOPRO\G0010027.JPG
A H:\Day2\100GOPRO\G0010028.JPG
A H:\Day2\100GOPRO\G0010029.JPG
A H:\Day2\100GOPRO\G0010030.JPG
A H:\Day2\100GOPRO\G0010031.JPG
A H:\Day2\100GOPRO\G0010032.JPG
A H:\Day2\100GOPRO\G0010033.JPG
A H:\Day2\100GOPRO\G0010034.JPG
A H:\Day2\100GOPRO\G0010035.JPG
A H:\Day2\100GOPRO\G0010036.JPG
A H:\Day2\100GOPRO\G0010037.JPG
A H:\Day2\100GOPRO\G0010038.JPG
A H:\Day2\100GOPRO\G0010039.JPG
A H:\Day2\100GOPRO\G0020041.JPG
A H:\Day2\100GOPRO\G0020042.JPG
A H:\Day2\100GOPRO\G0020043.JPG
A H:\Day2\100GOPRO\G0020044.JPG
A H:\Day2\100GOPRO\G0020045.JPG
A H:\Day2\100GOPRO\G0020046.JPG
A H:\Day2\100GOPRO\G0020047.JPG
A H:\Day2\100GOPRO\G0020048.JPG
A H:\Day2\100GOPRO\G0020049.JPG
A H:\Day2\100GOPRO\G0020050.JPG
A H:\Day2\100GOPRO\G0020051.JPG
A H:\Day2\100GOPRO\G0020052.JPG
A H:\Day2\100GOPRO\G0020053.JPG
A H:\Day2\100GOPRO\G0020054.JPG
A H:\Day2\100GOPRO\G0020055.JPG
A H:\Day2\100GOPRO\G0020056.JPG
A H:\Day2\100GOPRO\G0020057.JPG
A H:\Day2\100GOPRO\G0020058.JPG
A H:\Day2\100GOPRO\G0020059.JPG
A H:\Day2\100GOPRO\G0020060.JPG
A H:\Day2\100GOPRO\G0020061.JPG
A H:\Day2\100GOPRO\G0020062.JPG
A H:\Day2\100GOPRO\G0020063.JPG
A H:\Day2\100GOPRO\G0020064.JPG
A H:\Day2\100GOPRO\G0020065.JPG
A H:\Day2\100GOPRO\G0020066.JPG
A H:\Day2\100GOPRO\G0020067.JPG
A H:\Day2\100GOPRO\G0020068.JPG
A H:\Day2\100GOPRO\G0020069.JPG
A H:\Day2\100GOPRO\G0020070.JPG
A H:\Day2\100GOPRO\G0020071.JPG
A H:\Day2\100GOPRO\G0020072.JPG
A H:\Day2\100GOPRO\G0020073.JPG
A H:\Day2\100GOPRO\G0020074.JPG
A H:\Day2\100GOPRO\G0020075.JPG
A H:\Day2\100GOPRO\G0020076.JPG
A H:\Day2\100GOPRO\G0020077.JPG
A H:\Day2\100GOPRO\G0020078.JPG
A H:\Day2\100GOPRO\G0020079.JPG
A H:\Day2\100GOPRO\G0020080.JPG
A H:\Day2\100GOPRO\G0020081.JPG
A H:\Day2\100GOPRO\G0020082.JPG
A H:\Day2\100GOPRO\G0020083.JPG
A H:\Day2\100GOPRO\G0020084.JPG
A H:\Day2\100GOPRO\G0020085.JPG
A H:\Day2\100GOPRO\G0020086.JPG
A H:\Day2\100GOPRO\G0020087.JPG
A H:\Day2\100GOPRO\G0020088.JPG
A H:\Day2\100GOPRO\G0020089.JPG
A H:\Day2\100GOPRO\G0020090.JPG
A H:\Day2\100GOPRO\G0020091.JPG
A H:\Day2\100GOPRO\G0020092.JPG
A H:\Day2\100GOPRO\G0020093.JPG
A H:\Day2\100GOPRO\G0020094.JPG
A H:\Day2\100GOPRO\G0020095.JPG
A H:\Day2\100GOPRO\G0020096.JPG
A H:\Day2\100GOPRO\G0020097.JPG
A H:\Day2\100GOPRO\G0020098.JPG
A H:\Day2\100GOPRO\G0020099.JPG
A H:\Day2\100GOPRO\G0020100.JPG
A H:\Day2\100GOPRO\G0020101.JPG
A H:\Day2\100GOPRO\G0020102.JPG
A H:\Day2\100GOPRO\G0020103.JPG
A H:\Day2\100GOPRO\G0020104.JPG
A H:\Day2\100GOPRO\G0020105.JPG
A H:\Day2\100GOPRO\G0020106.JPG
A H:\Day2\100GOPRO\G0020107.JPG
A H:\Day2\100GOPRO\G0020108.JPG
A H:\Day2\100GOPRO\G0020109.JPG
A H:\Day2\100GOPRO\G0020110.JPG
A H:\Day2\100GOPRO\G0020111.JPG
A H:\Day2\100GOPRO\G0020112.JPG
A H:\Day2\100GOPRO\G0020113.JPG
A H:\Day2\100GOPRO\G0020114.JPG
A H:\Day2\100GOPRO\G0020115.JPG
A H:\Day2\100GOPRO\G0020116.JPG
A H:\Day2\100GOPRO\G0020117.JPG
A H:\Day2\100GOPRO\G0020118.JPG
A H:\Day2\100GOPRO\G0020119.JPG
A H:\Day2\100GOPRO\G0020120.JPG
A H:\Day2\100GOPRO\G0020121.JPG
A H:\Day2\100GOPRO\G0020122.JPG
A H:\Day2\100GOPRO\G0020123.JPG
A H:\Day2\100GOPRO\G0020124.JPG
A H:\Day2\100GOPRO\G0020125.JPG
A H:\Day2\100GOPRO\G0020126.JPG
A H:\Day2\100GOPRO\G0020127.JPG
A H:\Day2\100GOPRO\G0020128.JPG
A H:\Day2\100GOPRO\G0020129.JPG
A H:\Day2\100GOPRO\G0020130.JPG
A H:\Day2\100GOPRO\G0020131.JPG
A H:\Day2\100GOPRO\G0020132.JPG
A H:\Day2\100GOPRO\G0020133.JPG
A H:\Day2\100GOPRO\G0020134.JPG
A H:\Day2\100GOPRO\G0020135.JPG
A H:\Day2\100GOPRO\G0020136.JPG
A H:\Day2\100GOPRO\G0020137.JPG
A H:\Day2\100GOPRO\G0020138.JPG
A H:\Day2\100GOPRO\G0020139.JPG
A H:\Day2\100GOPRO\G0020140.JPG
A H:\Day2\100GOPRO\G0020141.JPG
A H:\Day2\100GOPRO\G0020142.JPG
A H:\Day2\100GOPRO\G0020143.JPG
A H:\Day2\100GOPRO\G0020144.JPG
A H:\Day2\100GOPRO\G0020145.JPG
A H:\Day2\100GOPRO\G0020146.JPG
A H:\Day2\100GOPRO\G0020147.JPG
A H:\Day2\100GOPRO\G0020148.JPG
A H:\Day2\100GOPRO\G0020149.JPG
A H:\Day2\100GOPRO\G0020150.JPG
A H:\Day2\100GOPRO\G0020151.JPG
A H:\Day2\100GOPRO\G0020152.JPG
A H:\Day2\100GOPRO\G0020153.JPG
A H:\Day2\100GOPRO\G0020154.JPG
A H:\Day2\100GOPRO\G0020155.JPG
A H:\Day2\100GOPRO\G0020156.JPG
A H:\Day2\100GOPRO\G0020157.JPG
A H:\Day2\100GOPRO\G0020158.JPG
A H:\Day2\100GOPRO\G0020159.JPG
A H:\Day2\100GOPRO\G0020160.JPG
A H:\Day2\100GOPRO\G0020161.JPG
A H:\Day2\100GOPRO\G0020162.JPG
A H:\Day2\100GOPRO\G0020163.JPG
A H:\Day2\100GOPRO\G0020164.JPG
A H:\Day2\100GOPRO\G0020165.JPG
A H:\Day2\100GOPRO\G0020166.JPG
A H:\Day2\100GOPRO\G0020167.JPG
A H:\Day2\100GOPRO\G0020168.JPG
A H:\Day2\100GOPRO\G0020169.JPG
A H:\Day2\100GOPRO\G0020170.JPG
A H:\Day2\100GOPRO\G0020171.JPG
A H:\Day2\100GOPRO\G0020172.JPG
A H:\Day2\100GOPRO\G0020173.JPG
A H:\Day2\100GOPRO\G0020174.JPG
A H:\Day2\100GOPRO\G0020175.JPG
A H:\Day2\100GOPRO\G0020176.JPG
A H:\Day2\100GOPRO\G0020177.JPG
A H:\Day2\100GOPRO\G0020178.JPG
A H:\Day2\100GOPRO\G0020179.JPG
A H:\Day2\100GOPRO\G0020180.JPG
A H:\Day2\100GOPRO\G0020181.JPG
A H:\Day2\100GOPRO\G0020182.JPG
A H:\Day2\100GOPRO\G0020183.JPG
A H:\Day2\100GOPRO\G0020184.JPG
A H:\Day2\100GOPRO\G0020185.JPG
A H:\Day2\100GOPRO\G0020186.JPG
A H:\Day2\100GOPRO\G0020187.JPG
A H:\Day2\100GOPRO\G0020188.JPG
A H:\Day2\100GOPRO\G0020189.JPG
A H:\Day2\100GOPRO\G0020190.JPG
A H:\Day2\100GOPRO\G0020191.JPG
A H:\Day2\100GOPRO\G0020192.JPG
A H:\Day2\100GOPRO\G0020193.JPG
A H:\Day2\100GOPRO\G0020194.JPG
A H:\Day2\100GOPRO\G0020195.JPG
A H:\Day2\100GOPRO\G0020196.JPG
A H:\Day2\100GOPRO\G0020197.JPG
A H:\Day2\100GOPRO\G0020198.JPG
A H:\Day2\100GOPRO\G0020199.JPG
A H:\Day2\100GOPRO\G0020200.JPG
A H:\Day2\100GOPRO\G0020201.JPG
A H:\Day2\100GOPRO\G0020202.JPG
A H:\Day2\100GOPRO\G0020203.JPG
A H:\Day2\100GOPRO\G0020204.JPG
A H:\Day2\100GOPRO\G0020205.JPG
A H:\Day2\100GOPRO\G0020206.JPG
A H:\Day2\100GOPRO\G0020207.JPG
A H:\Day2\100GOPRO\G0020208.JPG
A H:\Day2\100GOPRO\G0020209.JPG
A H:\Day2\100GOPRO\G0020210.JPG
A H:\Day2\100GOPRO\G0020211.JPG
A H:\Day2\100GOPRO\G0020212.JPG
A H:\Day2\100GOPRO\G0020213.JPG
A H:\Day2\100GOPRO\G0020214.JPG
A H:\Day2\100GOPRO\G0020215.JPG
A H:\Day2\100GOPRO\G0020216.JPG
A H:\Day2\100GOPRO\G0020217.JPG
A H:\Day2\100GOPRO\G0020218.JPG
A H:\Day2\100GOPRO\G0020219.JPG
A H:\Day2\100GOPRO\G0020220.JPG
A H:\Day2\100GOPRO\G0020221.JPG
A H:\Day2\100GOPRO\G0020222.JPG
A H:\Day2\100GOPRO\G0020223.JPG
A H:\Day2\100GOPRO\G0020224.JPG
A H:\Day2\100GOPRO\G0020225.JPG
A H:\Day2\100GOPRO\G0020226.JPG
A H:\Day2\100GOPRO\G0020227.JPG
A H:\Day2\100GOPRO\G0020228.JPG
A H:\Day2\100GOPRO\G0020229.JPG
A H:\Day2\100GOPRO\G0020230.JPG
A H:\Day2\100GOPRO\G0020231.JPG
A H:\Day2\100GOPRO\G0020232.JPG
A H:\Day2\100GOPRO\G0020233.JPG
A H:\Day2\100GOPRO\G0020234.JPG
A H:\Day2\100GOPRO\G0020235.JPG
A H:\Day2\100GOPRO\G0020236.JPG
A H:\Day2\100GOPRO\G0020237.JPG
A H:\Day2\100GOPRO\G0020238.JPG
A H:\Day2\100GOPRO\G0020239.JPG
A H:\Day2\100GOPRO\G0020240.JPG
A H:\Day2\100GOPRO\G0020241.JPG
A H:\Day2\100GOPRO\G0020242.JPG
A H:\Day2\100GOPRO\G0020243.JPG
A H:\Day2\100GOPRO\G0020244.JPG
A H:\Day2\100GOPRO\G0020245.JPG
A H:\Day2\100GOPRO\G0020246.JPG
A H:\Day2\100GOPRO\G0020247.JPG
A H:\Day2\100GOPRO\G0020248.JPG
A H:\Day2\100GOPRO\G0020249.JPG
A H:\Day2\100GOPRO\G0020250.JPG
A H:\Day2\100GOPRO\G0020251.JPG
A H:\Day2\100GOPRO\G0020252.JPG
A H:\Day2\100GOPRO\G0020253.JPG
A H:\Day2\100GOPRO\G0020254.JPG
A H:\Day2\100GOPRO\G0020255.JPG
A H:\Day2\100GOPRO\G0020256.JPG
A H:\Day2\100GOPRO\G0020257.JPG
A H:\Day2\100GOPRO\G0020258.JPG
A H:\Day2\100GOPRO\G0020259.JPG
A H:\Day2\100GOPRO\G0020260.JPG
A H:\Day2\100GOPRO\G0020261.JPG
A H:\Day2\100GOPRO\G0020262.JPG
A H:\Day2\100GOPRO\G0020263.JPG
A H:\Day2\100GOPRO\G0020264.JPG
A H:\Day2\100GOPRO\G0020265.JPG
A H:\Day2\100GOPRO\G0020266.JPG
A H:\Day2\100GOPRO\G0020267.JPG
A H:\Day2\100GOPRO\G0020268.JPG
A H:\Day2\100GOPRO\G0020269.JPG
A H:\Day2\100GOPRO\G0020270.JPG
A H:\Day2\100GOPRO\G0020271.JPG
A H:\Day2\100GOPRO\G0020272.JPG
A H:\Day2\100GOPRO\G0020273.JPG
A H:\Day2\100GOPRO\G0020274.JPG
A H:\Day2\100GOPRO\G0020275.JPG
A H:\Day2\100GOPRO\G0020276.JPG
A H:\Day2\100GOPRO\G0020277.JPG
A H:\Day2\100GOPRO\G0020278.JPG
A H:\Day2\100GOPRO\G0020279.JPG
A H:\Day2\100GOPRO\G0020280.JPG
A H:\Day2\100GOPRO\G0020281.JPG
A H:\Day2\100GOPRO\G0020282.JPG
A H:\Day2\100GOPRO\G0020283.JPG
A H:\Day2\100GOPRO\G0020284.JPG
A H:\Day2\100GOPRO\G0020285.JPG
A H:\Day2\100GOPRO\G0020286.JPG
A H:\Day2\100GOPRO\G0020287.JPG
A H:\Day2\100GOPRO\G0020288.JPG
A H:\Day2\100GOPRO\G0020289.JPG
A H:\Day2\100GOPRO\G0020290.JPG
A H:\Day2\100GOPRO\G0020291.JPG
A H:\Day2\100GOPRO\G0020292.JPG
A H:\Day2\100GOPRO\G0020293.JPG
A H:\Day2\100GOPRO\G0020294.JPG
A H:\Day2\100GOPRO\G0020295.JPG
A H:\Day2\100GOPRO\G0020296.JPG
A H:\Day2\100GOPRO\G0020297.JPG
A H:\Day2\100GOPRO\G0020298.JPG
A H:\Day2\100GOPRO\G0020299.JPG
A H:\Day2\100GOPRO\G0020300.JPG
A H:\Day2\100GOPRO\G0020301.JPG
A H:\Day2\100GOPRO\G0020302.JPG
A H:\Day2\100GOPRO\G0020303.JPG
A H:\Day2\100GOPRO\G0020304.JPG
A H:\Day2\100GOPRO\G0020305.JPG
A H:\Day2\100GOPRO\G0020306.JPG
A H:\Day2\100GOPRO\G0020307.JPG
A H:\Day2\100GOPRO\G0020308.JPG
A H:\Day2\100GOPRO\G0020309.JPG
A H:\Day2\100GOPRO\G0020310.JPG
A H:\Day2\100GOPRO\G0020311.JPG
A H:\Day2\100GOPRO\G0020312.JPG
A H:\Day2\100GOPRO\G0020313.JPG
A H:\Day2\100GOPRO\G0020314.JPG
A H:\Day2\100GOPRO\G0020315.JPG
A H:\Day2\100GOPRO\G0020316.JPG
A H:\Day2\100GOPRO\G0020317.JPG
A H:\Day2\100GOPRO\G0020318.JPG
A H:\Day2\100GOPRO\G0020319.JPG
A H:\Day2\100GOPRO\G0020320.JPG
A H:\Day2\100GOPRO\G0020321.JPG
A H:\Day2\100GOPRO\G0020322.JPG
A H:\Day2\100GOPRO\G0020323.JPG
A H:\Day2\100GOPRO\G0020324.JPG
A H:\Day2\100GOPRO\G0020325.JPG
A H:\Day2\100GOPRO\G0020326.JPG
A H:\Day2\100GOPRO\G0020327.JPG
A H:\Day2\100GOPRO\G0020328.JPG
A H:\Day2\100GOPRO\G0020329.JPG
A H:\Day2\100GOPRO\G0020330.JPG
A H:\Day2\100GOPRO\G0020331.JPG
A H:\Day2\100GOPRO\G0020332.JPG
A H:\Day2\100GOPRO\G0020333.JPG
A H:\Day2\100GOPRO\G0020334.JPG
A H:\Day2\100GOPRO\G0020335.JPG
A H:\Day2\100GOPRO\G0020336.JPG
A H:\Day2\100GOPRO\G0020337.JPG
A H:\Day2\100GOPRO\G0020338.JPG
A H:\Day2\100GOPRO\G0020339.JPG
A H:\Day2\100GOPRO\G0020340.JPG
A H:\Day2\100GOPRO\G0020341.JPG
A H:\Day2\100GOPRO\G0020342.JPG
A H:\Day2\100GOPRO\G0020343.JPG
A H:\Day2\100GOPRO\G0020344.JPG
A H:\Day2\100GOPRO\G0020345.JPG
A H:\Day2\100GOPRO\G0020346.JPG
A H:\Day2\100GOPRO\G0020347.JPG
A H:\Day2\100GOPRO\G0020348.JPG
A H:\Day2\100GOPRO\G0020349.JPG
A H:\Day2\100GOPRO\G0020350.JPG
A H:\Day2\100GOPRO\G0020351.JPG
A H:\Day2\100GOPRO\G0020352.JPG
A H:\Day2\100GOPRO\G0020353.JPG
A H:\Day2\100GOPRO\G0020354.JPG
A H:\Day2\100GOPRO\G0020355.JPG
A H:\Day2\100GOPRO\G0020356.JPG
A H:\Day2\100GOPRO\G0020357.JPG
A H:\Day2\100GOPRO\G0020358.JPG
A H:\Day2\100GOPRO\G0020359.JPG
A H:\Day2\100GOPRO\G0020360.JPG
A H:\Day2\100GOPRO\G0020361.JPG
A H:\Day2\100GOPRO\G0020362.JPG
A H:\Day2\100GOPRO\G0020363.JPG
A H:\Day2\100GOPRO\G0020364.JPG
A H:\Day2\100GOPRO\G0020365.JPG
A H:\Day2\100GOPRO\G0020366.JPG
A H:\Day2\100GOPRO\G0020367.JPG
A H:\Day2\100GOPRO\G0020368.JPG
A H:\Day2\100GOPRO\G0020369.JPG
A H:\Day2\100GOPRO\G0020370.JPG
A H:\Day2\100GOPRO\G0020371.JPG
A H:\Day2\100GOPRO\G0020372.JPG
A H:\Day2\100GOPRO\G0020373.JPG
A H:\Day2\100GOPRO\G0020374.JPG
A H:\Day2\100GOPRO\G0020375.JPG
A H:\Day2\100GOPRO\G0020376.JPG
A H:\Day2\100GOPRO\G0020377.JPG
A H:\Day2\100GOPRO\G0020378.JPG
A H:\Day2\100GOPRO\G0020379.JPG
A H:\Day2\100GOPRO\G0020380.JPG
A H:\Day2\100GOPRO\G0020381.JPG
A H:\Day2\100GOPRO\G0020382.JPG
A H:\Day2\100GOPRO\G0020383.JPG
A H:\Day2\100GOPRO\G0020384.JPG
A H:\Day2\100GOPRO\G0020385.JPG
A H:\Day2\100GOPRO\G0020386.JPG
A H:\Day2\100GOPRO\G0020387.JPG
A H:\Day2\100GOPRO\G0020388.JPG
A H:\Day2\100GOPRO\G0020389.JPG
A H:\Day2\100GOPRO\G0020390.JPG
A H:\Day2\100GOPRO\G0020391.JPG
A H:\Day2\100GOPRO\G0020392.JPG
A H:\Day2\100GOPRO\G0020393.JPG
A H:\Day2\100GOPRO\G0020394.JPG
A H:\Day2\100GOPRO\G0020395.JPG
A H:\Day2\100GOPRO\G0020396.JPG
A H:\Day2\100GOPRO\G0020397.JPG
A H:\Day2\100GOPRO\G0020398.JPG
A H:\Day2\100GOPRO\G0020399.JPG
A H:\Day2\100GOPRO\G0020400.JPG
A H:\Day2\100GOPRO\G0020401.JPG
A H:\Day2\100GOPRO\G0020402.JPG
A H:\Day2\100GOPRO\G0020403.JPG
A H:\Day2\100GOPRO\G0020404.JPG
A H:\Day2\100GOPRO\G0020405.JPG
A H:\Day2\100GOPRO\G0020406.JPG
A H:\Day2\100GOPRO\G0020407.JPG
A H:\Day2\100GOPRO\G0020408.JPG
A H:\Day2\100GOPRO\G0020409.JPG
A H:\Day2\100GOPRO\G0020410.JPG
A H:\Day2\100GOPRO\G0020411.JPG
A H:\Day2\100GOPRO\G0020412.JPG
A H:\Day2\100GOPRO\G0020413.JPG
A H:\Day2\100GOPRO\G0020414.JPG
A H:\Day2\100GOPRO\G0020415.JPG
A H:\Day2\100GOPRO\G0020416.JPG
A H:\Day2\100GOPRO\G0020417.JPG
A H:\Day2\100GOPRO\G0020418.JPG
A H:\Day2\100GOPRO\G0020419.JPG
A H:\Day2\100GOPRO\G0020420.JPG
A H:\Day2\100GOPRO\G0020421.JPG
A H:\Day2\100GOPRO\G0020422.JPG
A H:\Day2\100GOPRO\G0020423.JPG
A H:\Day2\100GOPRO\G0020424.JPG
A H:\Day2\100GOPRO\G0020425.JPG
A H:\Day2\100GOPRO\G0020426.JPG
A H:\Day2\100GOPRO\G0020427.JPG
A H:\Day2\100GOPRO\G0020428.JPG
A H:\Day2\100GOPRO\G0020429.JPG
A H:\Day2\100GOPRO\G0020430.JPG
A H:\Day2\100GOPRO\G0020431.JPG
A H:\Day2\100GOPRO\G0020432.JPG
A H:\Day2\100GOPRO\G0020433.JPG
A H:\Day2\100GOPRO\G0020434.JPG
A H:\Day2\100GOPRO\G0020435.JPG
A H:\Day2\100GOPRO\G0020436.JPG
A H:\Day2\100GOPRO\G0020437.JPG
A H:\Day2\100GOPRO\G0020438.JPG
A H:\Day2\100GOPRO\G0020439.JPG
A H:\Day2\100GOPRO\G0020440.JPG
A H:\Day2\100GOPRO\G0020441.JPG
A H:\Day2\100GOPRO\G0020442.JPG
A H:\Day2\100GOPRO\G0020443.JPG
A H:\Day2\100GOPRO\G0020444.JPG
A H:\Day2\100GOPRO\G0020445.JPG
A H:\Day2\100GOPRO\G0020446.JPG
A H:\Day2\100GOPRO\G0020447.JPG
A H:\Day2\100GOPRO\G0020448.JPG
A H:\Day2\100GOPRO\G0020449.JPG
A H:\Day2\100GOPRO\G0020450.JPG
A H:\Day2\100GOPRO\G0020451.JPG
A H:\Day2\100GOPRO\G0020452.JPG
A H:\Day2\100GOPRO\G0020453.JPG
A H:\Day2\100GOPRO\G0020454.JPG
A H:\Day2\100GOPRO\G0020455.JPG
A H:\Day2\100GOPRO\G0020456.JPG
A H:\Day2\100GOPRO\G0020457.JPG
A H:\Day2\100GOPRO\G0020458.JPG
A H:\Day2\100GOPRO\G0020459.JPG
A H:\Day2\100GOPRO\G0020460.JPG
A H:\Day2\100GOPRO\G0020461.JPG
A H:\Day2\100GOPRO\G0020462.JPG
A H:\Day2\100GOPRO\G0020463.JPG
A H:\Day2\100GOPRO\G0020464.JPG
A H:\Day2\100GOPRO\G0020465.JPG
A H:\Day2\100GOPRO\G0020466.JPG
A H:\Day2\100GOPRO\G0020467.JPG
A H:\Day2\100GOPRO\G0020468.JPG
A H:\Day2\100GOPRO\G0020469.JPG
A H:\Day2\100GOPRO\G0020470.JPG
A H:\Day2\100GOPRO\G0020471.JPG
A H:\Day2\100GOPRO\G0020472.JPG
A H:\Day2\100GOPRO\G0020473.JPG
A H:\Day2\100GOPRO\G0020474.JPG
A H:\Day2\100GOPRO\G0020475.JPG
A H:\Day2\100GOPRO\G0020476.JPG
A H:\Day2\100GOPRO\G0020477.JPG
A H:\Day2\100GOPRO\G0020478.JPG
A H:\Day2\100GOPRO\G0020479.JPG
A H:\Day2\100GOPRO\G0020480.JPG
A H:\Day2\100GOPRO\G0020481.JPG
A H:\Day2\100GOPRO\G0020482.JPG
A H:\Day2\100GOPRO\G0020483.JPG
A H:\Day2\100GOPRO\G0020484.JPG
A H:\Day2\100GOPRO\G0020485.JPG
A H:\Day2\100GOPRO\G0020486.JPG
A H:\Day2\100GOPRO\G0020487.JPG
A H:\Day2\100GOPRO\G0020488.JPG
A H:\Day2\100GOPRO\G0020489.JPG
A H:\Day2\100GOPRO\G0020490.JPG
A H:\Day2\100GOPRO\G0020491.JPG
A H:\Day2\100GOPRO\G0020492.JPG
A H:\Day2\100GOPRO\G0020493.JPG
A H:\Day2\100GOPRO\G0020494.JPG
A H:\Day2\100GOPRO\G0020495.JPG
A H:\Day2\100GOPRO\G0020496.JPG
A H:\Day2\100GOPRO\G0020497.JPG
A H:\Day2\100GOPRO\G0020498.JPG
A H:\Day2\100GOPRO\G0020499.JPG
A H:\Day2\100GOPRO\G0020500.JPG
A H:\Day2\100GOPRO\G0020501.JPG
A H:\Day2\100GOPRO\G0020502.JPG
A H:\Day2\100GOPRO\G0020503.JPG
A H:\Day2\100GOPRO\G0020504.JPG
A H:\Day2\100GOPRO\G0020505.JPG
A H:\Day2\100GOPRO\G0020506.JPG
A H:\Day2\100GOPRO\G0020507.JPG
A H:\Day2\100GOPRO\G0020508.JPG
A H:\Day2\100GOPRO\G0020509.JPG
A H:\Day2\100GOPRO\G0020510.JPG
A H:\Day2\100GOPRO\G0020511.JPG
A H:\Day2\100GOPRO\G0020512.JPG
A H:\Day2\100GOPRO\G0020513.JPG
A H:\Day2\100GOPRO\G0020514.JPG
A H:\Day2\100GOPRO\G0020515.JPG
A H:\Day2\100GOPRO\G0020516.JPG
A H:\Day2\100GOPRO\G0020517.JPG
A H:\Day2\100GOPRO\G0020518.JPG
A H:\Day2\100GOPRO\G0020519.JPG
A H:\Day2\100GOPRO\G0020520.JPG
A H:\Day2\100GOPRO\G0020521.JPG
A H:\Day2\100GOPRO\G0020522.JPG
A H:\Day2\100GOPRO\G0020523.JPG
A H:\Day2\100GOPRO\G0020524.JPG
A H:\Day2\100GOPRO\G0020525.JPG
A H:\Day2\100GOPRO\G0020526.JPG
A H:\Day2\100GOPRO\G0020527.JPG
A H:\Day2\100GOPRO\G0020528.JPG
A H:\Day2\100GOPRO\G0020529.JPG
A H:\Day2\100GOPRO\G0020530.JPG
A H:\Day2\100GOPRO\G0020531.JPG
A H:\Day2\100GOPRO\G0020532.JPG
A H:\Day2\100GOPRO\G0020533.JPG
A H:\Day2\100GOPRO\G0020534.JPG
A H:\Day2\100GOPRO\G0020535.JPG
A H:\Day2\100GOPRO\G0020536.JPG
A H:\Day2\100GOPRO\G0020537.JPG
A H:\Day2\100GOPRO\G0020538.JPG
A H:\Day2\100GOPRO\G0020539.JPG
A H:\Day2\100GOPRO\G0020540.JPG
A H:\Day2\100GOPRO\G0020541.JPG
A H:\Day2\100GOPRO\G0020542.JPG
A H:\Day2\100GOPRO\G0020543.JPG
A H:\Day2\100GOPRO\G0020544.JPG
A H:\Day2\100GOPRO\G0020545.JPG
A H:\Day2\100GOPRO\G0020546.JPG
A H:\Day2\100GOPRO\G0020547.JPG
A H:\Day2\100GOPRO\G0020548.JPG
A H:\Day2\100GOPRO\G0020549.JPG
A H:\Day2\100GOPRO\G0020550.JPG
A H:\Day2\100GOPRO\G0020551.JPG
A H:\Day2\100GOPRO\G0020552.JPG
A H:\Day2\100GOPRO\G0020553.JPG
A H:\Day2\100GOPRO\G0020554.JPG
A H:\Day2\100GOPRO\G0020555.JPG
A H:\Day2\100GOPRO\G0020556.JPG
A H:\Day2\100GOPRO\G0020557.JPG
A H:\Day2\100GOPRO\G0020558.JPG
A H:\Day2\100GOPRO\G0020559.JPG
A H:\Day2\100GOPRO\G0020560.JPG
A H:\Day2\100GOPRO\G0020561.JPG
A H:\Day2\100GOPRO\G0020562.JPG
A H:\Day2\100GOPRO\G0020563.JPG
A H:\Day2\100GOPRO\G0020564.JPG
A H:\Day2\100GOPRO\G0020565.JPG
A H:\Day2\100GOPRO\G0020566.JPG
A H:\Day2\100GOPRO\G0020567.JPG
A H:\Day2\100GOPRO\G0020568.JPG
A H:\Day2\100GOPRO\G0020569.JPG
A H:\Day2\100GOPRO\G0020570.JPG
A H:\Day2\100GOPRO\G0020571.JPG
A H:\Day2\100GOPRO\G0020572.JPG
A H:\Day2\100GOPRO\G0020573.JPG
A H:\Day2\100GOPRO\G0020574.JPG
A H:\Day2\100GOPRO\G0020575.JPG
A H:\Day2\100GOPRO\G0020576.JPG
A H:\Day2\100GOPRO\G0020577.JPG
A H:\Day2\100GOPRO\G0020578.JPG
A H:\Day2\100GOPRO\G0020579.JPG
A H:\Day2\100GOPRO\G0020580.JPG
A H:\Day2\100GOPRO\G0020581.JPG
A H:\Day2\100GOPRO\G0020582.JPG
A H:\Day2\100GOPRO\G0020583.JPG
A H:\Day2\100GOPRO\G0020584.JPG
A H:\Day2\100GOPRO\G0020585.JPG
A H:\Day2\100GOPRO\G0020586.JPG
A H:\Day2\100GOPRO\G0020587.JPG
A H:\Day2\100GOPRO\G0020588.JPG
A H:\Day2\100GOPRO\G0020589.JPG
A H:\Day2\100GOPRO\G0020590.JPG
A H:\Day2\100GOPRO\G0020591.JPG
A H:\Day2\100GOPRO\G0020592.JPG
A H:\Day2\100GOPRO\G0020593.JPG
A H:\Day2\100GOPRO\G0020594.JPG
A H:\Day2\100GOPRO\G0020595.JPG
A H:\Day2\100GOPRO\G0020596.JPG
A H:\Day2\100GOPRO\G0020597.JPG
A H:\Day2\100GOPRO\G0020598.JPG
A H:\Day2\100GOPRO\G0020599.JPG
A H:\Day2\100GOPRO\G0020600.JPG
A H:\Day2\100GOPRO\G0020601.JPG
A H:\Day2\100GOPRO\G0020602.JPG
A H:\Day2\100GOPRO\G0020603.JPG
A H:\Day2\100GOPRO\G0020604.JPG
A H:\Day2\100GOPRO\G0020605.JPG
A H:\Day2\100GOPRO\G0020606.JPG
A H:\Day2\100GOPRO\G0020607.JPG
A H:\Day2\100GOPRO\G0020608.JPG
A H:\Day2\100GOPRO\G0020609.JPG
A H:\Day2\100GOPRO\G0020610.JPG
A H:\Day2\100GOPRO\G0020611.JPG
A H:\Day2\100GOPRO\G0020612.JPG
A H:\Day2\100GOPRO\G0020613.JPG
A H:\Day2\100GOPRO\G0020614.JPG
A H:\Day2\100GOPRO\G0020615.JPG
A H:\Day2\100GOPRO\G0020616.JPG
A H:\Day2\100GOPRO\G0020617.JPG
A H:\Day2\100GOPRO\G0020618.JPG
A H:\Day2\100GOPRO\G0020619.JPG
A H:\Day2\100GOPRO\G0020620.JPG
A H:\Day2\100GOPRO\G0020621.JPG
A H:\Day2\100GOPRO\G0020622.JPG
A H:\Day2\100GOPRO\G0020623.JPG
A H:\Day2\100GOPRO\G0020624.JPG
A H:\Day2\100GOPRO\G0020625.JPG
A H:\Day2\100GOPRO\G0020626.JPG
A H:\Day2\100GOPRO\G0020627.JPG
A H:\Day2\100GOPRO\G0020628.JPG
A H:\Day2\100GOPRO\G0020629.JPG
A H:\Day2\100GOPRO\G0020630.JPG
A H:\Day2\100GOPRO\G0020631.JPG
A H:\Day2\100GOPRO\G0020632.JPG
A H:\Day2\100GOPRO\G0020633.JPG
A H:\Day2\100GOPRO\G0020634.JPG
A H:\Day2\100GOPRO\G0020635.JPG
A H:\Day2\100GOPRO\G0020636.JPG
A H:\Day2\100GOPRO\G0020637.JPG
A H:\Day2\100GOPRO\G0020638.JPG
A H:\Day2\100GOPRO\G0020639.JPG
A H:\Day2\100GOPRO\G0020640.JPG
A H:\Day2\100GOPRO\G0020641.JPG
A H:\Day2\100GOPRO\G0020642.JPG
A H:\Day2\100GOPRO\G0020643.JPG
A H:\Day2\100GOPRO\G0020644.JPG
A H:\Day2\100GOPRO\G0020645.JPG
A H:\Day2\100GOPRO\G0020646.JPG
A H:\Day2\100GOPRO\G0020647.JPG
A H:\Day2\100GOPRO\G0020648.JPG
A H:\Day2\100GOPRO\G0020649.JPG
A H:\Day2\100GOPRO\G0020650.JPG
A H:\Day2\100GOPRO\G0020651.JPG
A H:\Day2\100GOPRO\G0020652.JPG
A H:\Day2\100GOPRO\G0020653.JPG
A H:\Day2\100GOPRO\G0020654.JPG
A H:\Day2\100GOPRO\G0020655.JPG
A H:\Day2\100GOPRO\G0020656.JPG
A H:\Day2\100GOPRO\G0020657.JPG
A H:\Day2\100GOPRO\G0020658.JPG
A H:\Day2\100GOPRO\G0020659.JPG
A H:\Day2\100GOPRO\G0020660.JPG
A H:\Day2\100GOPRO\G0020661.JPG
A H:\Day2\100GOPRO\G0020662.JPG
A H:\Day2\100GOPRO\G0020663.JPG
A H:\Day2\100GOPRO\G0020664.JPG
A H:\Day2\100GOPRO\G0020665.JPG
A H:\Day2\100GOPRO\G0020666.JPG
A H:\Day2\100GOPRO\G0020667.JPG
A H:\Day2\100GOPRO\G0020668.JPG
A H:\Day2\100GOPRO\G0020669.JPG
A H:\Day2\100GOPRO\G0020670.JPG
A H:\Day2\100GOPRO\G0020671.JPG
A H:\Day2\100GOPRO\G0020672.JPG
A H:\Day2\100GOPRO\G0020673.JPG
A H:\Day2\100GOPRO\G0020674.JPG
A H:\Day2\100GOPRO\G0020675.JPG
A H:\Day2\100GOPRO\G0020676.JPG
A H:\Day2\100GOPRO\G0020677.JPG
A H:\Day2\100GOPRO\G0020678.JPG
A H:\Day2\100GOPRO\G0020679.JPG
A H:\Day2\100GOPRO\G0020680.JPG
A H:\Day2\100GOPRO\G0020681.JPG
A H:\Day2\100GOPRO\G0020682.JPG
A H:\Day2\100GOPRO\G0020683.JPG
A H:\Day2\100GOPRO\G0020684.JPG
A H:\Day2\100GOPRO\G0020685.JPG
A H:\Day2\100GOPRO\G0020686.JPG
A H:\Day2\100GOPRO\G0020687.JPG
A H:\Day2\100GOPRO\G0020688.JPG
A H:\Day2\100GOPRO\G0020689.JPG
A H:\Day2\100GOPRO\G0020690.JPG
A H:\Day2\100GOPRO\G0020691.JPG
A H:\Day2\100GOPRO\G0020692.JPG
A H:\Day2\100GOPRO\G0020693.JPG
A H:\Day2\100GOPRO\G0020694.JPG
A H:\Day2\100GOPRO\G0020695.JPG
A H:\Day2\100GOPRO\G0020696.JPG
A H:\Day2\100GOPRO\G0020697.JPG
A H:\Day2\100GOPRO\G0020698.JPG
A H:\Day2\100GOPRO\G0020699.JPG
A H:\Day2\100GOPRO\G0020700.JPG
A H:\Day2\100GOPRO\G0020701.JPG
A H:\Day2\100GOPRO\G0020702.JPG
A H:\Day2\100GOPRO\G0020703.JPG
A H:\Day2\100GOPRO\G0020704.JPG
A H:\Day2\100GOPRO\G0020705.JPG
A H:\Day2\100GOPRO\G0020706.JPG
A H:\Day2\100GOPRO\G0020707.JPG
A H:\Day2\100GOPRO\G0020708.JPG
A H:\Day2\100GOPRO\G0020709.JPG
A H:\Day2\100GOPRO\G0020710.JPG
A H:\Day2\100GOPRO\G0020711.JPG
A H:\Day2\100GOPRO\G0020712.JPG
A H:\Day2\100GOPRO\G0020713.JPG
A H:\Day2\100GOPRO\G0020714.JPG
A H:\Day2\100GOPRO\G0020715.JPG
A H:\Day2\100GOPRO\G0020716.JPG
A H:\Day2\100GOPRO\G0020717.JPG
A H:\Day2\100GOPRO\G0020718.JPG
A H:\Day2\100GOPRO\G0020719.JPG
A H:\Day2\100GOPRO\G0020720.JPG
A H:\Day2\100GOPRO\G0020721.JPG
A H:\Day2\100GOPRO\G0020722.JPG
A H:\Day2\100GOPRO\G0020723.JPG
A H:\Day2\100GOPRO\G0020724.JPG
A H:\Day2\100GOPRO\G0020725.JPG
A H:\Day2\100GOPRO\G0020726.JPG
A H:\Day2\100GOPRO\G0020727.JPG
A H:\Day2\100GOPRO\G0020728.JPG
A H:\Day2\100GOPRO\G0020729.JPG
A H:\Day2\100GOPRO\G0020730.JPG
A H:\Day2\100GOPRO\G0020731.JPG
A H:\Day2\100GOPRO\G0020732.JPG
A H:\Day2\100GOPRO\G0020733.JPG
A H:\Day2\100GOPRO\G0020734.JPG
A H:\Day2\100GOPRO\G0020735.JPG
A H:\Day2\100GOPRO\G0020736.JPG
A H:\Day2\100GOPRO\G0020737.JPG
A H:\Day2\100GOPRO\G0020738.JPG
A H:\Day2\100GOPRO\G0020739.JPG
A H:\Day2\100GOPRO\G0020740.JPG
A H:\Day2\100GOPRO\G0020741.JPG
A H:\Day2\100GOPRO\G0020742.JPG
A H:\Day2\100GOPRO\G0020743.JPG
A H:\Day2\100GOPRO\G0020744.JPG
A H:\Day2\100GOPRO\G0020745.JPG
A H:\Day2\100GOPRO\G0020746.JPG
A H:\Day2\100GOPRO\G0020747.JPG
A H:\Day2\100GOPRO\G0020748.JPG
A H:\Day2\100GOPRO\G0020749.JPG
A H:\Day2\100GOPRO\G0020750.JPG
A H:\Day2\100GOPRO\G0020751.JPG
A H:\Day2\100GOPRO\G0020752.JPG
A H:\Day2\100GOPRO\G0020753.JPG
A H:\Day2\100GOPRO\G0020754.JPG
A H:\Day2\100GOPRO\G0020755.JPG
A H:\Day2\100GOPRO\G0020756.JPG
A H:\Day2\100GOPRO\G0020757.JPG
A H:\Day2\100GOPRO\G0020758.JPG
A H:\Day2\100GOPRO\G0020759.JPG
A H:\Day2\100GOPRO\G0020760.JPG
A H:\Day2\100GOPRO\G0020761.JPG
A H:\Day2\100GOPRO\G0020762.JPG
A H:\Day2\100GOPRO\G0020763.JPG
A H:\Day2\100GOPRO\G0020764.JPG
A H:\Day2\100GOPRO\G0020765.JPG
A H:\Day2\100GOPRO\G0020766.JPG
A H:\Day2\100GOPRO\G0020767.JPG
A H:\Day2\100GOPRO\G0020768.JPG
A H:\Day2\100GOPRO\G0020769.JPG
A H:\Day2\100GOPRO\G0020770.JPG
A H:\Day2\100GOPRO\G0020771.JPG
A H:\Day2\100GOPRO\G0020772.JPG
A H:\Day2\100GOPRO\G0020773.JPG
A H:\Day2\100GOPRO\G0020774.JPG
A H:\Day2\100GOPRO\G0020775.JPG
A H:\Day2\100GOPRO\G0020776.JPG
A H:\Day2\100GOPRO\G0020777.JPG
A H:\Day2\100GOPRO\G0020778.JPG
A H:\Day2\100GOPRO\G0020779.JPG
A H:\Day2\100GOPRO\G0020780.JPG
A H:\Day2\100GOPRO\G0020781.JPG
A H:\Day2\100GOPRO\G0020782.JPG
A H:\Day2\100GOPRO\G0020783.JPG
A H:\Day2\100GOPRO\G0020784.JPG
A H:\Day2\100GOPRO\G0020785.JPG
A H:\Day2\100GOPRO\G0020786.JPG
A H:\Day2\100GOPRO\G0020787.JPG
A H:\Day2\100GOPRO\G0020788.JPG
A H:\Day2\100GOPRO\G0020789.JPG
A H:\Day2\100GOPRO\G0020790.JPG
A H:\Day2\100GOPRO\G0020791.JPG
A H:\Day2\100GOPRO\G0020792.JPG
A H:\Day2\100GOPRO\G0020793.JPG
A H:\Day2\100GOPRO\G0020794.JPG
A H:\Day2\100GOPRO\G0020795.JPG
A H:\Day2\100GOPRO\G0020796.JPG
A H:\Day2\100GOPRO\G0020797.JPG
A H:\Day2\100GOPRO\G0020798.JPG
A H:\Day2\100GOPRO\G0020799.JPG
A H:\Day2\100GOPRO\G0020800.JPG
A H:\Day2\100GOPRO\G0020801.JPG
A H:\Day2\100GOPRO\G0020802.JPG
A H:\Day2\100GOPRO\G0020803.JPG
A H:\Day2\100GOPRO\G0020804.JPG
A H:\Day2\100GOPRO\G0020805.JPG
A H:\Day2\100GOPRO\G0020806.JPG
A H:\Day2\100GOPRO\G0020807.JPG
A H:\Day2\100GOPRO\G0020808.JPG
A H:\Day2\100GOPRO\G0020809.JPG
A H:\Day2\100GOPRO\G0020810.JPG
A H:\Day2\100GOPRO\G0020811.JPG
A H:\Day2\100GOPRO\G0020812.JPG
A H:\Day2\100GOPRO\G0020813.JPG
A H:\Day2\100GOPRO\G0020814.JPG
A H:\Day2\100GOPRO\G0020815.JPG
A H:\Day2\100GOPRO\G0020816.JPG
A H:\Day2\100GOPRO\G0020817.JPG
A H:\Day2\100GOPRO\G0020818.JPG
A H:\Day2\100GOPRO\G0020819.JPG
A H:\Day2\100GOPRO\G0020820.JPG
A H:\Day2\100GOPRO\G0020821.JPG
A H:\Day2\100GOPRO\G0020822.JPG
A H:\Day2\100GOPRO\G0020823.JPG
A H:\Day2\100GOPRO\G0020824.JPG
A H:\Day2\100GOPRO\G0020825.JPG
A H:\Day2\100GOPRO\G0020826.JPG
A H:\Day2\100GOPRO\G0020827.JPG
A H:\Day2\100GOPRO\G0020828.JPG
A H:\Day2\100GOPRO\G0020829.JPG
A H:\Day2\100GOPRO\G0020830.JPG
A H:\Day2\100GOPRO\G0020831.JPG
A H:\Day2\100GOPRO\G0020832.JPG
A H:\Day2\100GOPRO\G0020833.JPG
A H:\Day2\100GOPRO\G0020834.JPG
A H:\Day2\100GOPRO\G0020835.JPG
A H:\Day2\100GOPRO\G0020836.JPG
A H:\Day2\100GOPRO\G0020837.JPG
A H:\Day2\100GOPRO\G0020838.JPG
A H:\Day2\100GOPRO\G0020839.JPG
A H:\Day2\100GOPRO\G0020840.JPG
A H:\Day2\100GOPRO\G0020841.JPG
A H:\Day2\100GOPRO\G0020842.JPG
A H:\Day2\100GOPRO\G0020843.JPG
A H:\Day2\100GOPRO\G0020844.JPG
A H:\Day2\100GOPRO\G0020845.JPG
A H:\Day2\100GOPRO\G0020846.JPG
A H:\Day2\100GOPRO\G0020847.JPG
A H:\Day2\100GOPRO\G0020848.JPG
A H:\Day2\100GOPRO\G0020849.JPG
A H:\Day2\100GOPRO\G0020850.JPG
A H:\Day2\100GOPRO\G0020851.JPG
A H:\Day2\100GOPRO\G0020852.JPG
A H:\Day2\100GOPRO\G0020853.JPG
A H:\Day2\100GOPRO\G0020854.JPG
A H:\Day2\100GOPRO\G0020855.JPG
A H:\Day2\100GOPRO\G0020856.JPG
A H:\Day2\100GOPRO\G0020857.JPG
A H:\Day2\100GOPRO\G0020858.JPG
A H:\Day2\100GOPRO\G0020859.JPG
A H:\Day2\100GOPRO\G0020860.JPG
A H:\Day2\100GOPRO\G0020861.JPG
A H:\Day2\100GOPRO\G0020862.JPG
A H:\Day2\100GOPRO\G0020863.JPG
A H:\Day2\100GOPRO\G0020864.JPG
A H:\Day2\100GOPRO\G0020865.JPG
A H:\Day2\100GOPRO\G0020866.JPG
A H:\Day2\100GOPRO\G0020867.JPG
A H:\Day2\100GOPRO\G0020868.JPG
A H:\Day2\100GOPRO\G0020869.JPG
A H:\Day2\100GOPRO\G0020870.JPG
A H:\Day2\100GOPRO\G0020871.JPG
A H:\Day2\100GOPRO\G0020872.JPG
A H:\Day2\100GOPRO\G0020873.JPG
A H:\Day2\100GOPRO\G0020874.JPG
A H:\Day2\100GOPRO\G0020875.JPG
A H:\Day2\100GOPRO\G0020876.JPG
A H:\Day2\100GOPRO\G0020877.JPG
A H:\Day2\100GOPRO\G0020878.JPG
A H:\Day2\100GOPRO\G0020879.JPG
A H:\Day2\100GOPRO\G0020880.JPG
A H:\Day2\100GOPRO\G0020881.JPG
A H:\Day2\100GOPRO\G0020882.JPG
A H:\Day2\100GOPRO\G0020883.JPG
A H:\Day2\100GOPRO\G0020884.JPG
A H:\Day2\100GOPRO\G0020885.JPG
A H:\Day2\100GOPRO\G0020886.JPG
A H:\Day2\100GOPRO\G0020887.JPG
A H:\Day2\100GOPRO\G0020888.JPG
A H:\Day2\100GOPRO\G0020889.JPG
A H:\Day2\100GOPRO\G0020890.JPG
A H:\Day2\100GOPRO\G0020891.JPG
A H:\Day2\100GOPRO\G0020892.JPG
A H:\Day2\100GOPRO\G0020893.JPG
A H:\Day2\100GOPRO\G0020894.JPG
A H:\Day2\100GOPRO\G0020895.JPG
A H:\Day2\100GOPRO\G0020896.JPG
A H:\Day2\100GOPRO\G0020897.JPG
A H:\Day2\100GOPRO\G0020898.JPG
A H:\Day2\100GOPRO\G0020899.JPG
A H:\Day2\100GOPRO\G0020900.JPG
A H:\Day2\100GOPRO\G0020901.JPG
A H:\Day2\100GOPRO\G0020902.JPG
A H:\Day2\100GOPRO\G0020903.JPG
A H:\Day2\100GOPRO\G0020904.JPG
A H:\Day2\100GOPRO\G0020905.JPG
A H:\Day2\100GOPRO\G0020906.JPG
A H:\Day2\100GOPRO\G0020907.JPG
A H:\Day2\100GOPRO\G0020908.JPG
A H:\Day2\100GOPRO\G0020909.JPG
A H:\Day2\100GOPRO\G0020910.JPG
A H:\Day2\100GOPRO\G0020911.JPG
A H:\Day2\100GOPRO\G0020912.JPG
A H:\Day2\100GOPRO\G0020913.JPG
A H:\Day2\100GOPRO\G0020914.JPG
A H:\Day2\100GOPRO\G0020915.JPG
A H:\Day2\100GOPRO\G0020916.JPG
A H:\Day2\100GOPRO\G0020917.JPG
A H:\Day2\100GOPRO\G0020918.JPG
A H:\Day2\100GOPRO\G0020919.JPG
A H:\Day2\100GOPRO\G0020920.JPG
A H:\Day2\100GOPRO\G0020921.JPG
A H:\Day2\100GOPRO\G0020922.JPG
A H:\Day2\100GOPRO\G0020923.JPG
A H:\Day2\100GOPRO\G0020924.JPG
A H:\Day2\100GOPRO\G0020925.JPG
A H:\Day2\100GOPRO\G0020926.JPG
A H:\Day2\100GOPRO\G0020927.JPG
A H:\Day2\100GOPRO\G0020928.JPG
A H:\Day2\100GOPRO\G0020929.JPG
A H:\Day2\100GOPRO\G0020930.JPG
A H:\Day2\100GOPRO\G0020931.JPG
A H:\Day2\100GOPRO\G0020932.JPG
A H:\Day2\100GOPRO\G0020933.JPG
A H:\Day2\100GOPRO\G0020934.JPG
A H:\Day2\100GOPRO\G0020935.JPG
A H:\Day2\100GOPRO\G0020936.JPG
A H:\Day2\100GOPRO\G0020937.JPG
A H:\Day2\100GOPRO\G0020938.JPG
A H:\Day2\100GOPRO\G0020939.JPG
A H:\Day2\100GOPRO\G0020940.JPG
A H:\Day2\100GOPRO\G0020941.JPG
A H:\Day2\100GOPRO\G0020942.JPG
A H:\Day2\100GOPRO\G0020943.JPG
A H:\Day2\100GOPRO\G0020944.JPG
A H:\Day2\100GOPRO\G0020945.JPG
A H:\Day2\100GOPRO\G0020946.JPG
A H:\Day2\100GOPRO\G0020947.JPG
A H:\Day2\100GOPRO\G0020948.JPG
A H:\Day2\100GOPRO\G0020949.JPG
A H:\Day2\100GOPRO\G0020950.JPG
A H:\Day2\100GOPRO\G0020951.JPG
A H:\Day2\100GOPRO\G0020952.JPG
A H:\Day2\100GOPRO\G0020953.JPG
A H:\Day2\100GOPRO\G0020954.JPG
A H:\Day2\100GOPRO\G0020955.JPG
A H:\Day2\100GOPRO\G0020956.JPG
A H:\Day2\100GOPRO\G0020957.JPG
A H:\Day2\100GOPRO\G0020958.JPG
A H:\Day2\100GOPRO\G0020959.JPG
A H:\Day2\100GOPRO\G0020960.JPG
A H:\Day2\100GOPRO\G0020961.JPG
A H:\Day2\100GOPRO\G0020962.JPG
A H:\Day2\100GOPRO\G0020963.JPG
A H:\Day2\100GOPRO\G0020964.JPG
A H:\Day2\100GOPRO\G0020965.JPG
A H:\Day2\100GOPRO\G0020966.JPG
A H:\Day2\100GOPRO\G0020967.JPG
A H:\Day2\100GOPRO\G0020968.JPG
A H:\Day2\100GOPRO\G0020969.JPG
A H:\Day2\100GOPRO\G0020970.JPG
A H:\Day2\100GOPRO\G0020971.JPG
A H:\Day2\100GOPRO\G0020972.JPG
A H:\Day2\100GOPRO\G0020973.JPG
A H:\Day2\100GOPRO\G0020974.JPG
A H:\Day2\100GOPRO\G0020975.JPG
A H:\Day2\100GOPRO\G0020976.JPG
A H:\Day2\100GOPRO\G0020977.JPG
A H:\Day2\100GOPRO\G0020978.JPG
A H:\Day2\100GOPRO\G0020979.JPG
A H:\Day2\100GOPRO\G0020980.JPG
A H:\Day2\100GOPRO\G0020981.JPG
A H:\Day2\100GOPRO\G0020982.JPG
A H:\Day2\100GOPRO\G0020983.JPG
A H:\Day2\100GOPRO\G0020984.JPG
A H:\Day2\100GOPRO\G0020985.JPG
A H:\Day2\100GOPRO\G0020986.JPG
A H:\Day2\100GOPRO\G0020987.JPG
A H:\Day2\100GOPRO\G0020988.JPG
A H:\Day2\100GOPRO\G0020989.JPG
A H:\Day2\100GOPRO\G0020990.JPG
A H:\Day2\100GOPRO\G0020991.JPG
A H:\Day2\100GOPRO\G0020992.JPG
A H:\Day2\100GOPRO\G0020993.JPG
A H:\Day2\100GOPRO\G0020994.JPG
A H:\Day2\100GOPRO\G0020995.JPG
A H:\Day2\100GOPRO\G0020996.JPG
A H:\Day2\100GOPRO\G0020997.JPG
A H:\Day2\100GOPRO\G0020998.JPG
A H:\Day2\100GOPRO\G0020999.JPG
A H:\Day2\100GOPRO\G0021000.JPG
A H:\Day2\100GOPRO\G0021001.JPG
A H:\Day2\100GOPRO\G0021002.JPG
A H:\Day2\100GOPRO\G0021003.JPG
A H:\Day2\100GOPRO\G0021004.JPG
A H:\Day2\100GOPRO\G0021005.JPG
A H:\Day2\100GOPRO\G0021006.JPG
A H:\Day2\100GOPRO\G0021007.JPG
A H:\Day2\100GOPRO\G0021008.JPG
A H:\Day2\100GOPRO\G0021009.JPG
A H:\Day2\100GOPRO\G0021010.JPG
A H:\Day2\100GOPRO\G0021011.JPG
A H:\Day2\100GOPRO\G0021012.JPG
A H:\Day2\100GOPRO\G0021013.JPG
A H:\Day2\100GOPRO\G0021014.JPG
A H:\Day2\100GOPRO\G0021015.JPG
A H:\Day2\100GOPRO\G0021016.JPG
A H:\Day2\100GOPRO\G0021017.JPG
A H:\Day2\100GOPRO\G0021018.JPG
A H:\Day2\100GOPRO\G0021019.JPG
A H:\Day2\100GOPRO\G0021020.JPG
A H:\Day2\100GOPRO\G0021021.JPG
A H:\Day2\100GOPRO\G0021022.JPG
A H:\Day2\100GOPRO\G0021023.JPG
A H:\Day2\100GOPRO\G0021024.JPG
A H:\Day2\100GOPRO\G0021025.JPG
A H:\Day2\100GOPRO\G0021026.JPG
A H:\Day2\100GOPRO\G0021027.JPG
A H:\Day2\100GOPRO\G0021028.JPG
A H:\Day2\100GOPRO\G0021029.JPG
A H:\Day2\100GOPRO\G0021030.JPG
A H:\Day2\100GOPRO\G0021031.JPG
A H:\Day2\100GOPRO\G0021032.JPG
A H:\Day2\100GOPRO\G0021033.JPG
A H:\Day2\100GOPRO\G0021034.JPG
A H:\Day2\100GOPRO\G0021035.JPG
A H:\Day2\100GOPRO\G0021036.JPG
A H:\Day2\100GOPRO\G0021037.JPG
A H:\Day2\100GOPRO\G0021038.JPG
A H:\Day2\100GOPRO\G0021039.JPG
A H:\Day2\100GOPRO\G0021040.JPG
A H:\Day2\100GOPRO\G0021041.JPG
A H:\Day2\100GOPRO\G0021042.JPG
A H:\Day2\100GOPRO\G0021043.JPG
A H:\Day2\100GOPRO\G0021044.JPG
A H:\Day2\100GOPRO\G0021045.JPG
A H:\Day2\100GOPRO\G0021046.JPG
A H:\Day2\100GOPRO\G0021047.JPG
A H:\Day2\100GOPRO\G0021048.JPG
A H:\Day2\100GOPRO\G0021049.JPG
A H:\Day2\100GOPRO\G0021050.JPG
A H:\Day2\100GOPRO\G0021051.JPG
A H:\Day2\100GOPRO\G0021052.JPG
A H:\Day2\100GOPRO\G0021053.JPG
A H:\Day2\100GOPRO\G0021054.JPG
A H:\Day2\100GOPRO\G0021055.JPG
A H:\Day2\100GOPRO\G0021056.JPG
A H:\Day2\100GOPRO\G0021057.JPG
A H:\Day2\100GOPRO\G0021058.JPG
A H:\Day2\100GOPRO\G0021059.JPG
A H:\Day2\100GOPRO\G0021060.JPG
A H:\Day2\100GOPRO\G0021061.JPG
A H:\Day2\100GOPRO\G0021062.JPG
A H:\Day2\100GOPRO\G0021063.JPG
A H:\Day2\100GOPRO\G0021064.JPG
A H:\Day2\100GOPRO\G0021065.JPG
A H:\Day2\100GOPRO\G0021066.JPG
A H:\Day2\100GOPRO\G0021067.JPG
A H:\Day2\100GOPRO\G0021068.JPG
A H:\Day2\100GOPRO\G0021069.JPG
A H:\Day2\100GOPRO\G0021070.JPG
A H:\Day2\100GOPRO\G0021071.JPG
A H:\Day2\100GOPRO\G0021072.JPG
A H:\Day2\100GOPRO\G0021073.JPG
A H:\Day2\100GOPRO\G0021074.JPG
A H:\Day2\100GOPRO\G0021075.JPG
A H:\Day2\100GOPRO\G0021076.JPG
A H:\Day2\100GOPRO\G0021077.JPG
A H:\Day2\100GOPRO\G0021078.JPG
A H:\Day2\100GOPRO\G0021079.JPG
A H:\Day2\100GOPRO\G0021080.JPG
A H:\Day2\100GOPRO\G0021081.JPG
A H:\Day2\100GOPRO\G0021082.JPG
A H:\Day2\100GOPRO\G0021083.JPG
A H:\Day2\100GOPRO\G0021084.JPG
A H:\Day2\100GOPRO\G0021085.JPG
A H:\Day2\100GOPRO\G0021086.JPG
A H:\Day2\100GOPRO\G0021087.JPG
A H:\Day2\100GOPRO\G0021088.JPG
A H:\Day2\100GOPRO\G0021089.JPG
A H:\Day2\100GOPRO\G0021090.JPG
A H:\Day2\100GOPRO\G0021091.JPG
A H:\Day2\100GOPRO\G0021092.JPG
A H:\Day2\100GOPRO\G0021093.JPG
A H:\Day2\100GOPRO\G0021094.JPG
A H:\Day2\100GOPRO\G0021095.JPG
A H:\Day2\100GOPRO\G0021096.JPG
A H:\Day2\100GOPRO\G0021097.JPG
A H:\Day2\100GOPRO\G0021098.JPG
A H:\Day2\100GOPRO\G0021099.JPG
A H:\Day2\100GOPRO\G0021100.JPG
A H:\Day2\100GOPRO\G0021101.JPG
A H:\Day2\100GOPRO\G0021102.JPG
A H:\Day2\100GOPRO\G0021103.JPG
A H:\Day2\100GOPRO\G0021104.JPG
A H:\Day2\100GOPRO\G0021105.JPG
A H:\Day2\100GOPRO\G0021106.JPG
A H:\Day2\100GOPRO\G0021107.JPG
A H:\Day2\100GOPRO\G0021108.JPG
A H:\Day2\100GOPRO\G0021109.JPG
A H:\Day2\100GOPRO\G0021110.JPG
A H:\Day2\100GOPRO\G0021111.JPG
A H:\Day2\100GOPRO\G0021112.JPG
A H:\Day2\100GOPRO\G0021113.JPG
A H:\Day2\100GOPRO\G0021114.JPG
A H:\Day2\100GOPRO\G0021115.JPG
A H:\Day2\100GOPRO\G0021116.JPG
A H:\Day2\100GOPRO\G0021117.JPG
A H:\Day2\100GOPRO\G0021118.JPG
A H:\Day2\100GOPRO\G0021119.JPG
A H:\Day2\100GOPRO\G0021120.JPG
A H:\Day2\100GOPRO\G0021121.JPG
A H:\Day2\100GOPRO\G0021122.JPG
A H:\Day2\100GOPRO\G0021123.JPG
A H:\Day2\100GOPRO\G0021124.JPG
A H:\Day2\100GOPRO\G0021125.JPG
A H:\Day2\100GOPRO\G0021126.JPG
A H:\Day2\100GOPRO\G0021127.JPG
A H:\Day2\100GOPRO\G0021128.JPG
A H:\Day2\100GOPRO\G0021129.JPG
A H:\Day2\100GOPRO\G0021130.JPG
A H:\Day2\100GOPRO\G0021131.JPG
A H:\Day2\100GOPRO\G0021132.JPG
A H:\Day2\100GOPRO\G0021133.JPG
A H:\Day2\100GOPRO\G0021134.JPG
A H:\Day2\100GOPRO\G0021135.JPG
A H:\Day2\100GOPRO\G0021136.JPG
A H:\Day2\100GOPRO\G0021137.JPG
A H:\Day2\100GOPRO\G0021138.JPG
A H:\Day2\100GOPRO\G0021139.JPG
A H:\Day2\100GOPRO\G0021140.JPG
A H:\Day2\100GOPRO\G0021141.JPG
A H:\Day2\100GOPRO\G0021142.JPG
A H:\Day2\100GOPRO\G0021143.JPG
A H:\Day2\100GOPRO\G0021144.JPG
A H:\Day2\100GOPRO\G0021145.JPG
A H:\Day2\100GOPRO\G0021146.JPG
A H:\Day2\100GOPRO\G0021147.JPG
A H:\Day2\100GOPRO\G0021148.JPG
A H:\Day2\100GOPRO\G0021149.JPG
A H:\Day2\100GOPRO\G0021150.JPG
A H:\Day2\100GOPRO\G0021151.JPG
A H:\Day2\100GOPRO\G0021152.JPG
A H:\Day2\100GOPRO\G0021153.JPG
A H:\Day2\100GOPRO\G0021154.JPG
A H:\Day2\100GOPRO\G0021155.JPG
A H:\Day2\100GOPRO\G0021156.JPG
A H:\Day2\100GOPRO\G0021157.JPG
A H:\Day2\100GOPRO\G0021158.JPG
A H:\Day2\100GOPRO\G0021159.JPG
A H:\Day2\100GOPRO\G0021160.JPG
A H:\Day2\100GOPRO\G0021161.JPG
A H:\Day2\100GOPRO\G0021162.JPG
A H:\Day2\100GOPRO\G0021163.JPG
A H:\Day2\100GOPRO\G0021164.JPG
A H:\Day2\100GOPRO\G0021165.JPG
A H:\Day2\100GOPRO\G0021166.JPG
A H:\Day2\100GOPRO\G0021167.JPG
A H:\Day2\100GOPRO\G0021168.JPG
A H:\Day2\100GOPRO\G0021169.JPG
A H:\Day2\100GOPRO\G0021170.JPG
A H:\Day2\100GOPRO\G0021171.JPG
A H:\Day2\100GOPRO\G0021172.JPG
A H:\Day2\100GOPRO\G0021173.JPG
A H:\Day2\100GOPRO\G0021174.JPG
A H:\Day2\100GOPRO\G0021175.JPG
A H:\Day2\100GOPRO\G0021176.JPG
A H:\Day2\100GOPRO\G0021177.JPG
A H:\Day2\100GOPRO\G0021178.JPG
A H:\Day2\100GOPRO\G0021179.JPG
A H:\Day2\100GOPRO\G0021180.JPG
A H:\Day2\100GOPRO\G0021181.JPG
A H:\Day2\100GOPRO\G0021182.JPG
A H:\Day2\100GOPRO\G0021183.JPG
A H:\Day2\100GOPRO\G0021184.JPG
A H:\Day2\100GOPRO\G0021185.JPG
A H:\Day2\100GOPRO\G0021186.JPG
A H:\Day2\100GOPRO\G0021187.JPG
A H:\Day2\100GOPRO\G0021188.JPG
A H:\Day2\100GOPRO\G0021189.JPG
A H:\Day2\100GOPRO\G0021190.JPG
A H:\Day2\100GOPRO\G0021191.JPG
A H:\Day2\100GOPRO\G0021192.JPG
A H:\Day2\100GOPRO\G0021193.JPG
A H:\Day2\100GOPRO\G0021194.JPG
A H:\Day2\100GOPRO\G0021195.JPG
A H:\Day2\100GOPRO\G0021196.JPG
A H:\Day2\100GOPRO\G0021197.JPG
A H:\Day2\100GOPRO\G0021198.JPG
A H:\Day2\100GOPRO\G0021199.JPG
A H:\Day2\100GOPRO\G0021200.JPG
A H:\Day2\100GOPRO\G0021201.JPG
A H:\Day2\100GOPRO\G0021202.JPG
A H:\Day2\100GOPRO\G0021203.JPG
A H:\Day2\100GOPRO\G0021204.JPG
A H:\Day2\100GOPRO\G0021205.JPG
A H:\Day2\100GOPRO\G0021206.JPG
A H:\Day2\100GOPRO\G0021207.JPG
A H:\Day2\100GOPRO\G0021208.JPG
A H:\Day2\100GOPRO\G0021209.JPG
A H:\Day2\100GOPRO\G0021210.JPG
A H:\Day2\100GOPRO\G0021211.JPG
A H:\Day2\100GOPRO\G0021212.JPG
A H:\Day2\100GOPRO\G0021213.JPG
A H:\Day2\100GOPRO\G0021214.JPG
A H:\Day2\100GOPRO\G0021215.JPG
A H:\Day2\100GOPRO\G0021216.JPG
A H:\Day2\100GOPRO\G0021217.JPG
A H:\Day2\100GOPRO\G0021218.JPG
A H:\Day2\100GOPRO\G0021219.JPG
A H:\Day2\100GOPRO\G0021220.JPG
A H:\Day2\100GOPRO\G0021221.JPG
A H:\Day2\100GOPRO\G0021222.JPG
A H:\Day2\100GOPRO\G0021223.JPG
A H:\Day2\100GOPRO\G0021224.JPG
A H:\Day2\100GOPRO\G0021225.JPG
A H:\Day2\100GOPRO\G0021226.JPG
A H:\Day2\100GOPRO\G0021227.JPG
A H:\Day2\100GOPRO\G0021228.JPG
A H:\Day2\100GOPRO\G0021229.JPG
A H:\Day2\100GOPRO\G0021230.JPG
A H:\Day2\100GOPRO\G0021231.JPG
A H:\Day2\100GOPRO\G0021232.JPG
A H:\Day2\100GOPRO\G0021233.JPG
A H:\Day2\100GOPRO\G0021234.JPG
A H:\Day2\100GOPRO\G0021235.JPG
A H:\Day2\100GOPRO\G0021236.JPG
A H:\Day2\100GOPRO\G0021237.JPG
A H:\Day2\100GOPRO\G0021238.JPG
A H:\Day2\100GOPRO\G0021239.JPG
A H:\Day2\100GOPRO\G0021240.JPG
A H:\Day2\100GOPRO\G0021241.JPG
A H:\Day2\100GOPRO\G0021242.JPG
A H:\Day2\100GOPRO\G0021243.JPG
A H:\Day2\100GOPRO\G0021244.JPG
A H:\Day2\100GOPRO\G0021245.JPG
A H:\Day2\100GOPRO\G0021246.JPG
A H:\Day2\100GOPRO\G0021247.JPG
A H:\Day2\100GOPRO\G0021248.JPG
A H:\Day2\100GOPRO\G0021249.JPG
A H:\Day2\100GOPRO\G0021250.JPG
A H:\Day2\100GOPRO\G0021251.JPG
A H:\Day2\100GOPRO\G0021252.JPG
A H:\Day2\100GOPRO\G0021253.JPG
A H:\Day2\100GOPRO\G0021254.JPG
A H:\Day2\100GOPRO\G0021255.JPG
A H:\Day2\100GOPRO\G0021256.JPG
A H:\Day2\100GOPRO\G0021257.JPG
A H:\Day2\100GOPRO\G0021258.JPG
A H:\Day2\100GOPRO\G0021259.JPG
A H:\Day2\100GOPRO\G0021260.JPG
A H:\Day2\100GOPRO\G0021261.JPG
A H:\Day2\100GOPRO\G0021262.JPG
A H:\Day2\100GOPRO\G0021263.JPG
A H:\Day2\100GOPRO\G0021264.JPG
A H:\Day2\100GOPRO\G0021265.JPG
A H:\Day2\100GOPRO\G0021266.JPG
A H:\Day2\100GOPRO\G0021267.JPG
A H:\Day2\100GOPRO\G0021268.JPG
A H:\Day2\100GOPRO\G0021269.JPG
A H:\Day2\100GOPRO\G0021270.JPG
A H:\Day2\100GOPRO\G0021271.JPG
A H:\Day2\100GOPRO\G0021272.JPG
A H:\Day2\100GOPRO\G0021273.JPG
A H:\Day2\100GOPRO\G0021274.JPG
A H:\Day2\100GOPRO\G0021275.JPG
A H:\Day2\100GOPRO\G0021276.JPG
A H:\Day2\100GOPRO\G0021277.JPG
A H:\Day2\100GOPRO\G0021278.JPG
A H:\Day2\100GOPRO\G0021279.JPG
A H:\Day2\100GOPRO\G0021280.JPG
A H:\Day2\100GOPRO\G0021281.JPG
A H:\Day2\100GOPRO\G0021282.JPG
A H:\Day2\100GOPRO\G0021283.JPG
A H:\Day2\100GOPRO\G0021284.JPG
A H:\Day2\100GOPRO\G0021285.JPG
A H:\Day2\100GOPRO\G0021286.JPG
A H:\Day2\100GOPRO\G0021287.JPG
A H:\Day2\100GOPRO\G0021288.JPG
A H:\Day2\100GOPRO\G0021289.JPG
A H:\Day2\100GOPRO\G0021290.JPG
A H:\Day2\100GOPRO\G0021291.JPG
A H:\Day2\100GOPRO\G0021292.JPG
A H:\Day2\100GOPRO\G0021293.JPG
A H:\Day2\100GOPRO\G0021294.JPG
A H:\Day2\100GOPRO\G0021295.JPG
A H:\Day2\100GOPRO\G0021296.JPG
A H:\Day2\100GOPRO\G0021297.JPG
A H:\Day2\100GOPRO\G0021298.JPG
A H:\Day2\100GOPRO\G0021299.JPG
A H:\Day2\100GOPRO\G0021300.JPG
A H:\Day2\100GOPRO\G0021301.JPG
A H:\Day2\100GOPRO\G0021302.JPG
A H:\Day2\100GOPRO\G0021303.JPG
A H:\Day2\100GOPRO\G0021304.JPG
A H:\Day2\100GOPRO\G0021305.JPG
A H:\Day2\100GOPRO\G0021306.JPG
A H:\Day2\100GOPRO\G0021307.JPG
A H:\Day2\100GOPRO\G0021308.JPG
A H:\Day2\100GOPRO\G0021309.JPG
A H:\Day2\100GOPRO\G0021310.JPG
A H:\Day2\100GOPRO\G0021311.JPG
A H:\Day2\100GOPRO\G0021312.JPG
A H:\Day2\100GOPRO\G0021313.JPG
A H:\Day2\100GOPRO\G0021314.JPG
A H:\Day2\100GOPRO\G0021315.JPG
A H:\Day2\100GOPRO\G0021316.JPG
A H:\Day2\100GOPRO\G0021317.JPG
A H:\Day2\100GOPRO\G0021318.JPG
A H:\Day2\100GOPRO\G0021319.JPG
A H:\Day2\100GOPRO\G0021320.JPG
A H:\Day2\100GOPRO\G0021321.JPG
A H:\Day2\100GOPRO\G0021322.JPG
A H:\Day2\100GOPRO\G0021323.JPG
A H:\Day2\100GOPRO\G0021324.JPG
A H:\Day2\100GOPRO\G0021325.JPG
A H:\Day2\100GOPRO\G0021326.JPG
A H:\Day2\100GOPRO\G0021327.JPG
A H:\Day2\100GOPRO\G0021328.JPG
A H:\Day2\100GOPRO\G0021329.JPG
A H:\Day2\100GOPRO\G0021330.JPG
A H:\Day2\100GOPRO\G0021331.JPG
A H:\Day2\100GOPRO\G0021332.JPG
A H:\Day2\100GOPRO\G0021333.JPG
A H:\Day2\100GOPRO\G0021334.JPG
A H:\Day2\100GOPRO\G0021335.JPG
A H:\Day2\100GOPRO\G0021336.JPG
A H:\Day2\100GOPRO\G0021337.JPG
A H:\Day2\100GOPRO\G0021338.JPG
A H:\Day2\100GOPRO\G0021339.JPG
A H:\Day2\100GOPRO\G0021340.JPG
A H:\Day2\100GOPRO\G0021341.JPG
A H:\Day2\100GOPRO\G0021342.JPG
A H:\Day2\100GOPRO\G0021343.JPG
A H:\Day2\100GOPRO\G0021344.JPG
A H:\Day2\100GOPRO\G0021345.JPG
A H:\Day2\100GOPRO\G0021346.JPG
A H:\Day2\100GOPRO\G0021347.JPG
A H:\Day2\100GOPRO\G0021348.JPG
A H:\Day2\100GOPRO\G0021349.JPG
A H:\Day2\100GOPRO\G0021350.JPG
A H:\Day2\100GOPRO\G0021351.JPG
A H:\Day2\100GOPRO\G0021352.JPG
A H:\Day2\100GOPRO\G0021353.JPG
A H:\Day2\100GOPRO\G0021354.JPG
A H:\Day2\100GOPRO\G0021355.JPG
A H:\Day2\100GOPRO\G0021356.JPG
A H:\Day2\100GOPRO\G0021357.JPG
A H:\Day2\100GOPRO\G0021358.JPG
A H:\Day2\100GOPRO\G0021359.JPG
A H:\Day2\100GOPRO\G0021360.JPG
A H:\Day2\100GOPRO\G0021361.JPG
A H:\Day2\100GOPRO\G0021362.JPG
A H:\Day2\100GOPRO\G0021363.JPG
A H:\Day2\100GOPRO\G0021364.JPG
A H:\Day2\100GOPRO\G0021365.JPG
A H:\Day2\100GOPRO\G0021366.JPG
A H:\Day2\100GOPRO\G0021367.JPG
A H:\Day2\100GOPRO\G0021368.JPG
A H:\Day2\100GOPRO\G0021369.JPG
A H:\Day2\100GOPRO\G0021370.JPG
A H:\Day2\100GOPRO\G0021371.JPG
A H:\Day2\100GOPRO\G0021372.JPG
A H:\Day2\100GOPRO\G0021373.JPG
A H:\Day2\100GOPRO\G0021374.JPG
A H:\Day2\100GOPRO\G0021375.JPG
A H:\Day2\100GOPRO\G0021376.JPG
A H:\Day2\100GOPRO\G0021377.JPG
A H:\Day2\100GOPRO\G0021378.JPG
A H:\Day2\100GOPRO\G0021379.JPG
A H:\Day2\100GOPRO\G0021380.JPG
A H:\Day2\100GOPRO\G0021381.JPG
A H:\Day2\100GOPRO\G0021382.JPG
A H:\Day2\100GOPRO\G0021383.JPG
A H:\Day2\100GOPRO\G0021384.JPG
A H:\Day2\100GOPRO\G0021385.JPG
A H:\Day2\100GOPRO\G0021386.JPG
A H:\Day2\100GOPRO\G0021387.JPG
A H:\Day2\100GOPRO\G0021388.JPG
A H:\Day2\100GOPRO\G0021389.JPG
A H:\Day2\100GOPRO\G0021390.JPG
A H:\Day2\100GOPRO\G0021391.JPG
A H:\Day2\100GOPRO\G0021392.JPG
A H:\Day2\100GOPRO\G0021393.JPG
A H:\Day2\100GOPRO\G0021394.JPG
A H:\Day2\100GOPRO\G0021395.JPG
A H:\Day2\100GOPRO\G0021396.JPG
A H:\Day2\100GOPRO\G0021397.JPG
A H:\Day2\100GOPRO\G0021398.JPG
A H:\Day2\100GOPRO\G0021399.JPG
A H:\Day2\100GOPRO\G0021400.JPG
A H:\Day2\100GOPRO\G0021401.JPG
A H:\Day2\100GOPRO\G0021402.JPG
A H:\Day2\100GOPRO\G0021403.JPG
A H:\Day2\100GOPRO\G0021404.JPG
A H:\Day2\100GOPRO\G0021405.JPG
A H:\Day2\100GOPRO\G0021406.JPG
A H:\Day2\100GOPRO\G0021407.JPG
A H:\Day2\100GOPRO\G0021408.JPG
A H:\Day2\100GOPRO\G0021409.JPG
A H:\Day2\100GOPRO\G0021410.JPG
A H:\Day2\100GOPRO\G0021411.JPG
A H:\Day2\100GOPRO\G0021412.JPG
A H:\Day2\100GOPRO\G0021413.JPG
A H:\Day2\100GOPRO\G0021414.JPG
A H:\Day2\100GOPRO\G0021415.JPG
A H:\Day2\100GOPRO\G0021416.JPG
A H:\Day2\100GOPRO\G0021417.JPG
A H:\Day2\100GOPRO\G0021418.JPG
A H:\Day2\100GOPRO\G0021419.JPG
A H:\Day2\100GOPRO\G0021420.JPG
A H:\Day2\100GOPRO\G0021421.JPG
A H:\Day2\100GOPRO\G0021422.JPG
A H:\Day2\100GOPRO\G0021423.JPG
A H:\Day2\100GOPRO\G0021424.JPG
A H:\Day2\100GOPRO\G0021425.JPG
A H:\Day2\100GOPRO\G0021426.JPG
A H:\Day2\100GOPRO\G0021427.JPG
A H:\Day2\100GOPRO\G0021428.JPG
A H:\Day2\100GOPRO\G0021429.JPG
A H:\Day2\100GOPRO\G0021430.JPG
A H:\Day2\100GOPRO\G0021431.JPG
A H:\Day2\100GOPRO\G0021432.JPG
A H:\Day2\100GOPRO\G0021433.JPG
A H:\Day2\100GOPRO\G0021434.JPG
A H:\Day2\100GOPRO\G0021435.JPG
A H:\Day2\100GOPRO\G0021436.JPG
A H:\Day2\100GOPRO\G0021437.JPG
A H:\Day2\100GOPRO\G0021438.JPG
A H:\Day2\100GOPRO\G0021439.JPG
A H:\Day2\100GOPRO\G0021440.JPG
A H:\Day2\100GOPRO\G0021441.JPG
A H:\Day2\100GOPRO\G0021442.JPG
A H:\Day2\100GOPRO\G0021443.JPG
A H:\Day2\100GOPRO\G0021444.JPG
A H:\Day2\100GOPRO\G0021445.JPG
A H:\Day2\100GOPRO\G0021446.JPG
A H:\Day2\100GOPRO\G0021447.JPG
A H:\Day2\100GOPRO\G0021448.JPG
A H:\Day2\100GOPRO\G0021449.JPG
A H:\Day2\100GOPRO\G0021450.JPG
A H:\Day2\100GOPRO\G0021451.JPG
A H:\Day2\100GOPRO\G0021452.JPG
A H:\Day2\100GOPRO\G0021453.JPG
A H:\Day2\100GOPRO\G0021454.JPG
A H:\Day2\100GOPRO\G0021455.JPG
A H:\Day2\100GOPRO\G0021456.JPG
A H:\Day2\100GOPRO\G0021457.JPG
A H:\Day2\100GOPRO\G0021458.JPG
A H:\Day2\100GOPRO\G0021459.JPG
A H:\Day2\100GOPRO\G0021460.JPG
A H:\Day2\100GOPRO\G0021461.JPG
A H:\Day2\100GOPRO\G0021462.JPG
A H:\Day2\100GOPRO\G0021463.JPG
A H:\Day2\100GOPRO\G0021464.JPG
A H:\Day2\100GOPRO\G0021465.JPG
A H:\Day2\100GOPRO\G0021466.JPG
A H:\Day2\100GOPRO\G0021467.JPG
A H:\Day2\100GOPRO\G0021468.JPG
A H:\Day2\100GOPRO\G0021469.JPG
A H:\Day2\100GOPRO\G0021470.JPG
A H:\Day2\100GOPRO\G0021471.JPG
A H:\Day2\100GOPRO\G0021472.JPG
A H:\Day2\100GOPRO\G0021473.JPG
A H:\Day2\100GOPRO\G0021474.JPG
A H:\Day2\100GOPRO\G0021475.JPG
A H:\Day2\100GOPRO\G0021476.JPG
A H:\Day2\100GOPRO\G0021477.JPG
A H:\Day2\100GOPRO\G0021478.JPG
A H:\Day2\100GOPRO\G0021479.JPG
A H:\Day2\100GOPRO\G0021480.JPG
A H:\Day2\100GOPRO\G0021481.JPG
A H:\Day2\100GOPRO\G0021482.JPG
A H:\Day2\100GOPRO\G0021483.JPG
A H:\Day2\100GOPRO\G0021484.JPG
A H:\Day2\100GOPRO\G0021485.JPG
A H:\Day2\100GOPRO\G0021486.JPG
A H:\Day2\100GOPRO\G0021487.JPG
A H:\Day2\100GOPRO\G0021488.JPG
A H:\Day2\100GOPRO\G0021489.JPG
A H:\Day2\100GOPRO\G0021490.JPG
A H:\Day2\100GOPRO\G0021491.JPG
A H:\Day2\100GOPRO\G0021492.JPG
A H:\Day2\100GOPRO\G0021493.JPG
A H:\Day2\100GOPRO\G0021494.JPG
A H:\Day2\100GOPRO\G0021495.JPG
A H:\Day2\100GOPRO\G0021496.JPG
A H:\Day2\100GOPRO\G0021497.JPG
A H:\Day2\100GOPRO\G0021498.JPG
A H:\Day2\100GOPRO\G0021499.JPG
A H:\Day2\100GOPRO\G0021500.JPG
A H:\Day2\100GOPRO\G0021501.JPG
A H:\Day2\100GOPRO\G0021502.JPG
A H:\Day2\100GOPRO\G0021503.JPG
A H:\Day2\100GOPRO\G0021504.JPG
A H:\Day2\100GOPRO\G0021505.JPG
A H:\Day2\100GOPRO\G0021506.JPG
A H:\Day2\100GOPRO\G0021507.JPG
A H:\Day2\100GOPRO\G0021508.JPG
A H:\Day2\100GOPRO\G0021509.JPG
A H:\Day2\100GOPRO\G0021510.JPG
A H:\Day2\100GOPRO\G0021511.JPG
A H:\Day2\100GOPRO\G0021512.JPG
A H:\Day2\100GOPRO\G0021513.JPG
A H:\Day2\100GOPRO\G0021514.JPG
A H:\Day2\100GOPRO\G0021515.JPG
A H:\Day2\100GOPRO\G0021516.JPG
A H:\Day2\100GOPRO\G0021517.JPG
A H:\Day2\100GOPRO\G0021518.JPG
A H:\Day2\100GOPRO\G0021519.JPG
A H:\Day2\100GOPRO\G0021520.JPG
A H:\Day2\100GOPRO\G0021521.JPG
A H:\Day2\100GOPRO\G0021522.JPG
A H:\Day2\100GOPRO\G0021523.JPG
A H:\Day2\100GOPRO\G0021524.JPG
A H:\Day2\100GOPRO\G0021525.JPG
A H:\Day2\100GOPRO\G0021526.JPG
A H:\Day2\100GOPRO\G0021527.JPG
A H:\Day2\100GOPRO\G0021528.JPG
A H:\Day2\100GOPRO\G0021529.JPG
A H:\Day2\100GOPRO\G0021530.JPG
A H:\Day2\100GOPRO\G0021531.JPG
A H:\Day2\100GOPRO\G0021532.JPG
A H:\Day2\100GOPRO\G0021533.JPG
A H:\Day2\100GOPRO\G0021534.JPG
A H:\Day2\100GOPRO\G0021535.JPG
A H:\Day2\100GOPRO\G0021536.JPG
A H:\Day2\100GOPRO\G0021537.JPG
A H:\Day2\100GOPRO\G0021538.JPG
A H:\Day2\100GOPRO\G0021539.JPG
A H:\Day2\100GOPRO\G0021540.JPG
A H:\Day2\100GOPRO\G0021541.JPG
A H:\Day2\100GOPRO\G0021542.JPG
A H:\Day2\100GOPRO\G0021543.JPG
A H:\Day2\100GOPRO\G0021544.JPG
A H:\Day2\100GOPRO\G0021545.JPG
A H:\Day2\100GOPRO\G0021546.JPG
A H:\Day2\100GOPRO\G0021547.JPG
A H:\Day2\100GOPRO\G0021548.JPG
A H:\Day2\100GOPRO\G0021549.JPG
A H:\Day2\100GOPRO\G0021550.JPG
A H:\Day2\100GOPRO\G0021551.JPG
A H:\Day2\100GOPRO\G0021552.JPG
A H:\Day2\100GOPRO\G0021553.JPG
A H:\Day2\100GOPRO\G0021554.JPG
A H:\Day2\100GOPRO\G0021555.JPG
A H:\Day2\100GOPRO\G0021556.JPG
A H:\Day2\100GOPRO\G0021557.JPG
A H:\Day2\100GOPRO\G0021558.JPG
A H:\Day2\100GOPRO\G0021559.JPG
A H:\Day2\100GOPRO\G0021560.JPG
A H:\Day2\100GOPRO\G0021561.JPG
A H:\Day2\100GOPRO\G0021562.JPG
A H:\Day2\100GOPRO\G0021563.JPG
A H:\Day2\100GOPRO\G0021564.JPG
A H:\Day2\100GOPRO\G0021565.JPG
A H:\Day2\100GOPRO\G0021566.JPG
A H:\Day2\100GOPRO\G0021567.JPG
A H:\Day2\100GOPRO\G0021568.JPG
A H:\Day2\100GOPRO\G0021569.JPG
A H:\Day2\100GOPRO\G0021570.JPG
A H:\Day2\100GOPRO\G0021571.JPG
A H:\Day2\100GOPRO\G0021572.JPG
A H:\Day2\100GOPRO\G0021573.JPG
A H:\Day2\100GOPRO\G0021574.JPG
A H:\Day2\100GOPRO\G0021575.JPG
A H:\Day2\100GOPRO\G0021576.JPG
A H:\Day2\100GOPRO\G0021577.JPG
A H:\Day2\100GOPRO\G0021578.JPG
A H:\Day2\100GOPRO\G0021579.JPG
A H:\Day2\100GOPRO\G0021580.JPG
A H:\Day2\100GOPRO\G0021581.JPG
A H:\Day2\100GOPRO\G0021582.JPG
A H:\Day2\100GOPRO\G0021583.JPG
A H:\Day2\100GOPRO\G0021584.JPG
A H:\Day2\100GOPRO\G0021585.JPG
A H:\Day2\100GOPRO\G0021586.JPG
A H:\Day2\100GOPRO\G0021587.JPG
A H:\Day2\100GOPRO\G0021588.JPG
A H:\Day2\100GOPRO\G0021589.JPG
A H:\Day2\100GOPRO\G0021590.JPG
A H:\Day2\100GOPRO\G0021591.JPG
A H:\Day2\100GOPRO\G0021592.JPG
A H:\Day2\100GOPRO\G0021593.JPG
A H:\Day2\100GOPRO\G0021594.JPG
A H:\Day2\100GOPRO\G0021595.JPG
A H:\Day2\100GOPRO\G0021596.JPG
A H:\Day2\100GOPRO\G0021597.JPG
A H:\Day2\100GOPRO\G0021598.JPG
A H:\Day2\100GOPRO\G0021599.JPG
A H:\Day2\100GOPRO\G0021600.JPG
A H:\Day2\100GOPRO\G0021601.JPG
A H:\Day2\100GOPRO\G0021602.JPG
A H:\Day2\100GOPRO\G0021603.JPG
A H:\Day2\100GOPRO\G0021604.JPG
A H:\Day2\100GOPRO\G0021605.JPG
A H:\Day2\100GOPRO\G0021606.JPG
A H:\Day2\100GOPRO\G0021607.JPG
A H:\Day2\100GOPRO\G0021608.JPG
A H:\Day2\100GOPRO\G0021609.JPG
A H:\Day2\100GOPRO\G0021610.JPG
A H:\Day2\100GOPRO\G0021611.JPG
A H:\Day2\100GOPRO\G0021612.JPG
A H:\Day2\100GOPRO\G0021613.JPG
A H:\Day2\100GOPRO\G0021614.JPG
A H:\Day2\100GOPRO\G0021615.JPG
A H:\Day2\100GOPRO\G0021616.JPG
A H:\Day2\100GOPRO\G0021617.JPG
A H:\Day2\100GOPRO\G0021618.JPG
A H:\Day2\100GOPRO\G0021619.JPG
A H:\Day2\100GOPRO\G0021620.JPG
A H:\Day2\100GOPRO\G0021621.JPG
A H:\Day2\100GOPRO\G0021622.JPG
A H:\Day2\100GOPRO\G0021623.JPG
A H:\Day2\100GOPRO\G0021624.JPG
A H:\Day2\100GOPRO\G0021625.JPG
A H:\Day2\100GOPRO\G0021626.JPG
A H:\Day2\100GOPRO\G0021627.JPG
A H:\Day2\100GOPRO\G0021628.JPG
A H:\Day2\100GOPRO\G0021629.JPG
A H:\Day2\100GOPRO\G0021630.JPG
A H:\Day2\100GOPRO\G0021631.JPG
A H:\Day2\100GOPRO\G0021632.JPG
A H:\Day2\100GOPRO\G0021633.JPG
A H:\Day2\100GOPRO\G0021634.JPG
A H:\Day2\100GOPRO\G0021635.JPG
A H:\Day2\100GOPRO\G0021636.JPG
A H:\Day2\100GOPRO\G0021637.JPG
A H:\Day2\100GOPRO\G0021638.JPG
A H:\Day2\100GOPRO\G0021639.JPG
A H:\Day2\100GOPRO\G0021640.JPG
A H:\Day2\100GOPRO\G0021641.JPG
A H:\Day2\100GOPRO\G0021642.JPG
A H:\Day2\100GOPRO\G0021643.JPG
A H:\Day2\100GOPRO\G0021644.JPG
A H:\Day2\100GOPRO\G0021645.JPG
A H:\Day2\100GOPRO\G0021646.JPG
A H:\Day2\100GOPRO\G0021647.JPG
A H:\Day2\100GOPRO\G0021648.JPG
A H:\Day2\100GOPRO\G0021649.JPG
A H:\Day2\100GOPRO\G0021650.JPG
A H:\Day2\100GOPRO\G0021651.JPG
A H:\Day2\100GOPRO\G0021652.JPG
A H:\Day2\100GOPRO\G0021653.JPG
A H:\Day2\100GOPRO\G0021654.JPG
A H:\Day2\100GOPRO\G0021655.JPG
A H:\Day2\100GOPRO\G0021656.JPG
A H:\Day2\100GOPRO\G0021657.JPG
A H:\Day2\100GOPRO\G0021658.JPG
A H:\Day2\100GOPRO\G0021659.JPG
A H:\Day2\100GOPRO\G0021660.JPG
A H:\Day2\100GOPRO\G0021661.JPG
A H:\Day2\100GOPRO\G0021662.JPG
A H:\Day2\100GOPRO\G0021663.JPG
A H:\Day2\100GOPRO\G0021664.JPG
A H:\Day2\100GOPRO\G0021665.JPG
A H:\Day2\100GOPRO\G0021666.JPG
A H:\Day2\100GOPRO\G0021667.JPG
A H:\Day2\100GOPRO\G0021668.JPG
A H:\Day2\100GOPRO\G0021669.JPG
A H:\Day2\100GOPRO\G0021670.JPG
A H:\Day2\100GOPRO\G0021671.JPG
A H:\Day2\100GOPRO\G0021672.JPG
A H:\Day2\100GOPRO\G0021673.JPG
A H:\Day2\100GOPRO\G0021674.JPG
A H:\Day2\100GOPRO\G0021675.JPG
A H:\Day2\100GOPRO\G0021676.JPG
A H:\Day2\100GOPRO\G0021677.JPG
A H:\Day2\100GOPRO\G0021678.JPG
A H:\Day2\100GOPRO\G0021679.JPG
A H:\Day2\100GOPRO\G0021680.JPG
A H:\Day2\100GOPRO\G0021681.JPG
A H:\Day2\100GOPRO\G0021682.JPG
A H:\Day2\100GOPRO\G0021683.JPG
A H:\Day2\100GOPRO\G0021684.JPG
A H:\Day2\100GOPRO\G0021685.JPG
A H:\Day2\100GOPRO\G0021686.JPG
A H:\Day2\100GOPRO\G0021687.JPG
A H:\Day2\100GOPRO\G0021688.JPG
A H:\Day2\100GOPRO\G0021689.JPG
A H:\Day2\100GOPRO\G0021690.JPG
A H:\Day2\100GOPRO\G0021691.JPG
A H:\Day2\100GOPRO\G0021692.JPG
A H:\Day2\100GOPRO\G0021693.JPG
A H:\Day2\100GOPRO\G0021694.JPG
A H:\Day2\100GOPRO\G0021695.JPG
A H:\Day2\100GOPRO\G0021696.JPG
A H:\Day2\100GOPRO\G0021697.JPG
A H:\Day2\100GOPRO\G0021698.JPG
A H:\Day2\100GOPRO\G0021699.JPG
A H:\Day2\100GOPRO\G0021700.JPG
A H:\Day2\100GOPRO\G0021701.JPG
A H:\Day2\100GOPRO\G0021702.JPG
A H:\Day2\100GOPRO\G0021703.JPG
A H:\Day2\100GOPRO\G0021704.JPG
A H:\Day2\100GOPRO\G0021705.JPG
A H:\Day2\100GOPRO\G0021706.JPG
A H:\Day2\100GOPRO\G0021707.JPG
A H:\Day2\100GOPRO\G0021708.JPG
A H:\Day2\100GOPRO\G0021709.JPG
A H:\Day2\100GOPRO\G0021710.JPG
A H:\Day2\100GOPRO\G0021711.JPG
A H:\Day2\100GOPRO\G0021712.JPG
A H:\Day2\100GOPRO\G0021713.JPG
A H:\Day2\100GOPRO\G0021714.JPG
A H:\Day2\100GOPRO\G0021715.JPG
A H:\Day2\100GOPRO\G0021716.JPG
A H:\Day2\100GOPRO\G0021717.JPG
A H:\Day2\100GOPRO\G0021718.JPG
A H:\Day2\100GOPRO\G0021719.JPG
A H:\Day2\100GOPRO\G0021720.JPG
A H:\Day2\100GOPRO\G0021721.JPG
A H:\Day2\100GOPRO\G0021722.JPG
A H:\Day2\100GOPRO\G0021723.JPG
A H:\Day2\100GOPRO\G0021724.JPG
A H:\Day2\100GOPRO\G0021725.JPG
A H:\Day2\100GOPRO\G0021726.JPG
A H:\Day2\100GOPRO\G0021727.JPG
A H:\Day2\100GOPRO\G0021728.JPG
A H:\Day2\100GOPRO\G0021729.JPG
A H:\Day2\100GOPRO\G0021730.JPG
A H:\Day2\100GOPRO\G0021731.JPG
A H:\Day2\100GOPRO\G0021732.JPG
A H:\Day2\100GOPRO\G0021733.JPG
A H:\Day2\100GOPRO\G0021734.JPG
A H:\Day2\100GOPRO\G0021735.JPG
A H:\Day2\100GOPRO\G0021736.JPG
A H:\Day2\100GOPRO\G0021737.JPG
A H:\Day2\100GOPRO\G0021738.JPG
A H:\Day2\100GOPRO\G0021739.JPG
A H:\Day2\100GOPRO\G0021740.JPG
A H:\Day2\100GOPRO\G0021741.JPG
A H:\Day2\100GOPRO\G0021742.JPG
A H:\Day2\100GOPRO\G0021743.JPG
A H:\Day2\100GOPRO\G0021744.JPG
A H:\Day2\100GOPRO\G0021745.JPG
A H:\Day2\100GOPRO\G0021746.JPG
A H:\Day2\100GOPRO\G0021747.JPG
A H:\Day2\100GOPRO\G0021748.JPG
A H:\Day2\100GOPRO\G0021749.JPG
A H:\Day2\100GOPRO\G0021750.JPG
A H:\Day2\100GOPRO\G0021751.JPG
A H:\Day2\100GOPRO\G0021752.JPG
A H:\Day2\100GOPRO\G0021753.JPG
A H:\Day2\100GOPRO\G0021754.JPG
A H:\Day2\100GOPRO\G0021755.JPG
A H:\Day2\100GOPRO\G0021756.JPG
A H:\Day2\100GOPRO\G0021757.JPG
A H:\Day2\100GOPRO\G0021758.JPG
A H:\Day2\100GOPRO\G0021759.JPG
A H:\Day2\100GOPRO\G0021760.JPG
A H:\Day2\100GOPRO\G0021761.JPG
A H:\Day2\100GOPRO\G0021762.JPG
A H:\Day2\100GOPRO\G0021763.JPG
A H:\Day2\100GOPRO\G0021764.JPG
A H:\Day2\100GOPRO\G0021765.JPG
A H:\Day2\100GOPRO\G0021766.JPG
A H:\Day2\100GOPRO\G0021767.JPG
A H:\Day2\100GOPRO\G0021768.JPG
A H:\Day2\100GOPRO\G0021769.JPG
A H:\Day2\100GOPRO\G0021770.JPG
A H:\Day2\100GOPRO\G0021771.JPG
A H:\Day2\100GOPRO\G0021772.JPG
A H:\Day2\100GOPRO\G0021773.JPG
A H:\Day2\100GOPRO\G0021774.JPG
A H:\Day2\100GOPRO\G0021775.JPG
A H:\Day2\100GOPRO\G0021776.JPG
A H:\Day2\100GOPRO\G0021777.JPG
A H:\Day2\100GOPRO\G0021778.JPG
A H:\Day2\100GOPRO\G0021779.JPG
A H:\Day2\100GOPRO\G0021780.JPG
A H:\Day2\100GOPRO\G0021781.JPG
A H:\Day2\100GOPRO\G0021782.JPG
A H:\Day2\100GOPRO\G0021783.JPG
A H:\Day2\100GOPRO\G0021784.JPG
A H:\Day2\100GOPRO\G0021785.JPG
A H:\Day2\100GOPRO\G0021786.JPG
A H:\Day2\100GOPRO\G0021787.JPG
A H:\Day2\100GOPRO\G0021788.JPG
A H:\Day2\100GOPRO\G0021789.JPG
A H:\Day2\100GOPRO\G0021790.JPG
A H:\Day2\100GOPRO\G0021791.JPG
A H:\Day2\100GOPRO\G0021792.JPG
A H:\Day2\100GOPRO\G0021793.JPG
A H:\Day2\100GOPRO\G0021794.JPG
A H:\Day2\100GOPRO\G0021795.JPG
A H:\Day2\100GOPRO\G0021796.JPG
A H:\Day2\100GOPRO\G0021797.JPG
A H:\Day2\100GOPRO\G0021798.JPG
A H:\Day2\100GOPRO\G0021799.JPG
A H:\Day2\100GOPRO\G0021800.JPG
A H:\Day2\100GOPRO\G0021801.JPG
A H:\Day2\100GOPRO\G0021802.JPG
A H:\Day2\100GOPRO\G0021803.JPG
A H:\Day2\100GOPRO\G0021804.JPG
A H:\Day2\100GOPRO\G0021805.JPG
A H:\Day2\100GOPRO\G0021806.JPG
A H:\Day2\100GOPRO\G0021807.JPG
A H:\Day2\100GOPRO\G0021808.JPG
A H:\Day2\100GOPRO\G0021809.JPG
A H:\Day2\100GOPRO\G0021810.JPG
A H:\Day2\100GOPRO\G0021811.JPG
A H:\Day2\100GOPRO\G0021812.JPG
A H:\Day2\100GOPRO\G0021813.JPG
A H:\Day2\100GOPRO\G0021814.JPG
A H:\Day2\100GOPRO\G0021815.JPG
A H:\Day2\100GOPRO\G0021816.JPG
A H:\Day2\100GOPRO\G0021817.JPG
A H:\Day2\100GOPRO\G0021818.JPG
A H:\Day2\100GOPRO\G0021819.JPG
A H:\Day2\100GOPRO\G0021820.JPG
A H:\Day2\100GOPRO\G0021821.JPG
A H:\Day2\100GOPRO\G0021822.JPG
A H:\Day2\100GOPRO\G0021823.JPG
A H:\Day2\100GOPRO\G0021824.JPG
A H:\Day2\100GOPRO\G0021825.JPG
A H:\Day2\100GOPRO\G0021826.JPG
A H:\Day2\100GOPRO\G0021827.JPG
A H:\Day2\100GOPRO\G0021828.JPG
A H:\Day2\100GOPRO\G0021829.JPG
A H:\Day2\100GOPRO\G0021830.JPG
A H:\Day2\100GOPRO\G0021831.JPG
A H:\Day2\100GOPRO\G0021832.JPG
A H:\Day2\100GOPRO\G0021833.JPG
A H:\Day2\100GOPRO\G0021834.JPG
A H:\Day2\100GOPRO\G0021835.JPG
A H:\Day2\100GOPRO\G0021836.JPG
A H:\Day2\100GOPRO\G0021837.JPG
A H:\Day2\100GOPRO\G0021838.JPG
A H:\Day2\100GOPRO\G0021839.JPG
A H:\Day2\100GOPRO\G0021840.JPG
A H:\Day2\100GOPRO\G0021841.JPG
A H:\Day2\100GOPRO\G0021842.JPG
A H:\Day2\100GOPRO\G0021843.JPG
A H:\Day2\100GOPRO\G0021844.JPG
A H:\Day2\100GOPRO\G0021845.JPG
A H:\Day2\100GOPRO\G0021846.JPG
A H:\Day2\100GOPRO\G0021847.JPG
A H:\Day2\100GOPRO\G0021848.JPG
A H:\Day2\100GOPRO\G0021849.JPG
A H:\Day2\100GOPRO\G0021850.JPG
A H:\Day2\100GOPRO\G0021851.JPG
A H:\Day2\100GOPRO\G0021852.JPG
A H:\Day2\100GOPRO\G0021853.JPG
A H:\Day2\100GOPRO\G0021854.JPG
A H:\Day2\100GOPRO\G0021855.JPG
A H:\Day2\100GOPRO\G0021856.JPG
A H:\Day2\100GOPRO\G0021857.JPG
A H:\Day2\100GOPRO\G0021858.JPG
A H:\Day2\100GOPRO\G0021859.JPG
A H:\Day2\100GOPRO\G0021860.JPG
A H:\Day2\100GOPRO\G0021861.JPG
A H:\Day2\100GOPRO\G0021862.JPG
A H:\Day2\100GOPRO\G0021863.JPG
A H:\Day2\100GOPRO\G0021864.JPG
A H:\Day2\100GOPRO\G0021865.JPG
A H:\Day2\100GOPRO\G0021866.JPG
A H:\Day2\100GOPRO\G0021867.JPG
A H:\Day2\100GOPRO\G0021868.JPG
A H:\Day2\100GOPRO\G0021869.JPG
A H:\Day2\100GOPRO\G0021870.JPG
A H:\Day2\100GOPRO\G0021871.JPG
A H:\Day2\100GOPRO\G0021872.JPG
A H:\Day2\100GOPRO\G0021873.JPG
A H:\Day2\100GOPRO\G0021874.JPG
A H:\Day2\100GOPRO\G0021875.JPG
A H:\Day2\100GOPRO\G0021876.JPG
A H:\Day2\100GOPRO\G0021877.JPG
A H:\Day2\100GOPRO\G0021878.JPG
A H:\Day2\100GOPRO\G0021879.JPG
A H:\Day2\100GOPRO\G0021880.JPG
A H:\Day2\100GOPRO\G0021881.JPG
A H:\Day2\100GOPRO\G0021882.JPG
A H:\Day2\100GOPRO\G0021883.JPG
A H:\Day2\100GOPRO\G0021884.JPG
A H:\Day2\100GOPRO\G0021885.JPG
A H:\Day2\100GOPRO\G0021886.JPG
A H:\Day2\100GOPRO\G0021887.JPG
A H:\Day2\100GOPRO\G0021888.JPG
A H:\Day2\100GOPRO\G0021889.JPG
A H:\Day2\100GOPRO\G0021890.JPG
A H:\Day2\100GOPRO\G0021891.JPG
A H:\Day2\100GOPRO\G0021892.JPG
A H:\Day2\100GOPRO\G0021893.JPG
A H:\Day2\100GOPRO\G0021894.JPG
A H:\Day2\100GOPRO\G0021895.JPG
A H:\Day2\100GOPRO\G0021896.JPG
A H:\Day2\100GOPRO\G0021897.JPG
A H:\Day2\100GOPRO\G0021898.JPG
A H:\Day2\100GOPRO\G0021899.JPG
A H:\Day2\100GOPRO\G0021900.JPG
A H:\Day2\100GOPRO\G0021901.JPG
A H:\Day2\100GOPRO\G0021902.JPG
A H:\Day2\100GOPRO\G0021903.JPG
A H:\Day2\100GOPRO\G0021904.JPG
A H:\Day2\100GOPRO\G0021905.JPG
A H:\Day2\100GOPRO\G0021906.JPG
A H:\Day2\100GOPRO\G0021907.JPG
A H:\Day2\100GOPRO\G0021908.JPG
A H:\Day2\100GOPRO\G0021909.JPG
A H:\Day2\100GOPRO\G0021910.JPG
A H:\Day2\100GOPRO\G0021911.JPG
A H:\Day2\100GOPRO\G0021912.JPG
A H:\Day2\100GOPRO\G0021913.JPG
A H:\Day2\100GOPRO\G0021914.JPG
A H:\Day2\100GOPRO\G0021915.JPG
A H:\Day2\100GOPRO\G0021916.JPG
A H:\Day2\100GOPRO\G0021917.JPG
A H:\Day2\100GOPRO\G0021918.JPG
A H:\Day2\100GOPRO\G0021919.JPG
A H:\Day2\100GOPRO\G0021920.JPG
A H:\Day2\100GOPRO\G0021921.JPG
A H:\Day2\100GOPRO\G0021922.JPG
A H:\Day2\100GOPRO\G0021923.JPG
A H:\Day2\100GOPRO\G0021924.JPG
A H:\Day2\100GOPRO\G0021925.JPG
A H:\Day2\100GOPRO\G0021926.JPG
A H:\Day2\100GOPRO\G0021927.JPG
A H:\Day2\100GOPRO\G0021928.JPG
A H:\Day2\100GOPRO\G0021929.JPG
A H:\Day2\100GOPRO\G0021930.JPG
A H:\Day2\100GOPRO\G0021931.JPG
A H:\Day2\100GOPRO\G0021932.JPG
A H:\Day2\100GOPRO\G0021933.JPG
A H:\Day2\100GOPRO\G0021934.JPG
A H:\Day2\100GOPRO\G0021935.JPG
A H:\Day2\100GOPRO\G0021936.JPG
A H:\Day2\100GOPRO\G0021937.JPG
A H:\Day2\100GOPRO\G0021938.JPG
A H:\Day2\100GOPRO\G0021939.JPG
A H:\Day2\100GOPRO\G0021940.JPG
A H:\Day2\100GOPRO\G0021941.JPG
A H:\Day2\100GOPRO\G0021942.JPG
A H:\Day2\100GOPRO\G0021943.JPG
A H:\Day2\100GOPRO\G0021944.JPG
A H:\Day2\100GOPRO\G0021945.JPG
A H:\Day2\100GOPRO\G0021946.JPG
A H:\Day2\100GOPRO\G0021947.JPG
A H:\Day2\100GOPRO\G0021948.JPG
A H:\Day2\100GOPRO\G0021949.JPG
A H:\Day2\100GOPRO\G0021950.JPG
A H:\Day2\100GOPRO\G0021951.JPG
A H:\Day2\100GOPRO\G0021952.JPG
A H:\Day2\100GOPRO\G0021953.JPG
A H:\Day2\100GOPRO\G0021954.JPG
A H:\Day2\100GOPRO\G0021955.JPG
A H:\Day2\100GOPRO\G0021956.JPG
A H:\Day2\100GOPRO\G0021957.JPG
A H:\Day2\100GOPRO\G0021958.JPG
A H:\Day2\100GOPRO\G0021959.JPG
A H:\Day2\100GOPRO\G0021960.JPG
A H:\Day2\100GOPRO\G0021961.JPG
A H:\Day2\100GOPRO\G0021962.JPG
A H:\Day2\100GOPRO\G0021963.JPG
A H:\Day2\100GOPRO\G0021964.JPG
A H:\Day2\100GOPRO\G0021965.JPG
A H:\Day2\100GOPRO\G0021966.JPG
A H:\Day2\100GOPRO\G0021967.JPG
A H:\Day2\100GOPRO\G0021968.JPG
A H:\Day2\100GOPRO\G0021969.JPG
A H:\Day2\100GOPRO\G0021970.JPG
A H:\Day2\100GOPRO\G0021971.JPG
A H:\Day2\100GOPRO\G0021972.JPG
A H:\Day2\100GOPRO\G0021973.JPG
A H:\Day2\100GOPRO\G0021974.JPG
A H:\Day2\100GOPRO\G0021975.JPG
A H:\Day2\100GOPRO\G0021976.JPG
A H:\Day2\100GOPRO\G0021977.JPG
A H:\Day2\100GOPRO\G0021978.JPG
A H:\Day2\100GOPRO\G0021979.JPG
A H:\Day2\100GOPRO\G0021980.JPG
A H:\Day2\100GOPRO\G0021981.JPG
A H:\Day2\100GOPRO\G0021982.JPG
A H:\Day2\100GOPRO\G0021983.JPG
A H:\Day2\100GOPRO\G0021984.JPG
A H:\Day2\100GOPRO\G0021985.JPG
A H:\Day2\100GOPRO\G0021986.JPG
A H:\Day2\100GOPRO\G0021987.JPG
A H:\Day2\100GOPRO\G0021988.JPG
A H:\Day2\100GOPRO\G0021989.JPG
A H:\Day2\100GOPRO\G0021990.JPG
A H:\Day2\100GOPRO\G0021991.JPG
A H:\Day2\100GOPRO\G0021992.JPG
A H:\Day2\100GOPRO\G0021993.JPG
A H:\Day2\100GOPRO\G0021994.JPG
A H:\Day2\100GOPRO\G0021995.JPG
A H:\Day2\100GOPRO\G0021996.JPG
A H:\Day2\100GOPRO\G0021997.JPG
A H:\Day2\100GOPRO\G0021998.JPG
A H:\Day2\100GOPRO\G0021999.JPG
A H:\Day2\100GOPRO\G0022000.JPG
A H:\Day2\100GOPRO\G0022001.JPG
A H:\Day2\100GOPRO\G0022002.JPG
A H:\Day2\100GOPRO\G0022003.JPG
A H:\Day2\100GOPRO\G0022004.JPG
A H:\Day2\100GOPRO\G0022005.JPG
A H:\Day2\100GOPRO\G0022006.JPG
A H:\Day2\100GOPRO\G0022007.JPG
A H:\Day2\100GOPRO\G0022008.JPG
A H:\Day2\100GOPRO\G0022009.JPG
A H:\Day2\100GOPRO\G0022010.JPG
A H:\Day2\100GOPRO\G0022011.JPG
A H:\Day2\100GOPRO\G0022012.JPG
A H:\Day2\100GOPRO\G0022013.JPG
A H:\Day2\100GOPRO\G0022014.JPG
A H:\Day2\100GOPRO\G0022015.JPG
A H:\Day2\100GOPRO\G0022016.JPG
A H:\Day2\100GOPRO\G0022017.JPG
A H:\Day2\100GOPRO\G0022018.JPG
A H:\Day2\100GOPRO\G0022019.JPG
A H:\Day2\100GOPRO\G0022020.JPG
A H:\Day2\100GOPRO\G0022021.JPG
A H:\Day2\100GOPRO\G0022022.JPG
A H:\Day2\100GOPRO\G0022023.JPG
A H:\Day2\100GOPRO\G0022024.JPG
A H:\Day2\100GOPRO\G0022025.JPG
A H:\Day2\100GOPRO\G0022026.JPG
A H:\Day2\100GOPRO\G0022027.JPG
A H:\Day2\100GOPRO\G0022028.JPG
A H:\Day2\100GOPRO\G0022029.JPG
A H:\Day2\100GOPRO\G0022030.JPG
A H:\Day2\100GOPRO\G0022031.JPG
A H:\Day2\100GOPRO\G0022032.JPG
A H:\Day2\100GOPRO\G0022033.JPG
A H:\Day2\100GOPRO\G0022034.JPG
A H:\Day2\100GOPRO\G0022035.JPG
A H:\Day2\100GOPRO\G0022036.JPG
A H:\Day2\100GOPRO\G0022037.JPG
A H:\Day2\100GOPRO\G0022038.JPG
A H:\Day2\100GOPRO\G0022039.JPG
A H:\Day2\100GOPRO\G0022040.JPG
A H:\Day2\100GOPRO\G0022041.JPG
A H:\Day2\100GOPRO\G0022042.JPG
A H:\Day2\100GOPRO\G0022043.JPG
A H:\Day2\100GOPRO\G0022044.JPG
A H:\Day2\100GOPRO\G0022045.JPG
A H:\Day2\100GOPRO\G0022046.JPG
A H:\Day2\100GOPRO\G0022047.JPG
A H:\Day2\100GOPRO\G0022048.JPG
A H:\Day2\100GOPRO\G0022049.JPG
A H:\Day2\100GOPRO\G0022050.JPG
A H:\Day2\100GOPRO\G0022051.JPG
A H:\Day2\100GOPRO\G0022052.JPG
A H:\Day2\100GOPRO\G0022053.JPG
A H:\Day2\100GOPRO\G0022054.JPG
A H:\Day2\100GOPRO\G0022055.JPG
A H:\Day2\100GOPRO\G0022056.JPG
A H:\Day2\100GOPRO\G0022057.JPG
A H:\Day2\100GOPRO\G0022058.JPG
A H:\Day2\100GOPRO\G0022059.JPG
A H:\Day2\100GOPRO\G0022060.JPG
A H:\Day2\100GOPRO\G0022061.JPG
A H:\Day2\100GOPRO\G0022062.JPG
A H:\Day2\100GOPRO\G0022063.JPG
A H:\Day2\100GOPRO\G0022064.JPG
A H:\Day2\100GOPRO\G0022065.JPG
A H:\Day2\100GOPRO\G0022066.JPG
A H:\Day2\100GOPRO\G0022067.JPG
A H:\Day2\100GOPRO\G0022068.JPG
A H:\Day2\100GOPRO\G0022069.JPG
A H:\Day2\100GOPRO\G0022070.JPG
A H:\Day2\100GOPRO\G0022071.JPG
A H:\Day2\100GOPRO\G0022072.JPG
A H:\Day2\100GOPRO\G0022073.JPG
A H:\Day2\100GOPRO\G0022074.JPG
A H:\Day2\100GOPRO\G0022075.JPG
A H:\Day2\100GOPRO\G0022076.JPG
A H:\Day2\100GOPRO\G0022077.JPG
A H:\Day2\100GOPRO\G0022078.JPG
A H:\Day2\100GOPRO\G0022079.JPG
A H:\Day2\100GOPRO\G0022080.JPG
A H:\Day2\100GOPRO\G0022081.JPG
A H:\Day2\100GOPRO\G0022082.JPG
A H:\Day2\100GOPRO\G0022083.JPG
A H:\Day2\100GOPRO\G0022084.JPG
A H:\Day2\100GOPRO\G0022085.JPG
A H:\Day2\100GOPRO\G0022086.JPG
A H:\Day2\100GOPRO\G0022087.JPG
A H:\Day2\100GOPRO\G0022088.JPG
A H:\Day2\100GOPRO\G0022089.JPG
A H:\Day2\100GOPRO\G0022090.JPG
A H:\Day2\100GOPRO\G0022091.JPG
A H:\Day2\100GOPRO\G0022092.JPG
A H:\Day2\100GOPRO\G0022093.JPG
A H:\Day2\100GOPRO\G0022094.JPG
A H:\Day2\100GOPRO\G0022095.JPG
A H:\Day2\100GOPRO\G0022096.JPG
A H:\Day2\100GOPRO\G0022097.JPG
A H:\Day2\100GOPRO\G0022098.JPG
A H:\Day2\100GOPRO\G0022099.JPG
A H:\Day2\100GOPRO\G0022100.JPG
A H:\Day2\100GOPRO\G0022101.JPG
A H:\Day2\100GOPRO\G0022102.JPG
A H:\Day2\100GOPRO\G0022103.JPG
A H:\Day2\100GOPRO\G0022104.JPG
A H:\Day2\100GOPRO\G0022105.JPG
A H:\Day2\100GOPRO\G0022106.JPG
A H:\Day2\100GOPRO\G0022107.JPG
A H:\Day2\100GOPRO\G0022108.JPG
A H:\Day2\100GOPRO\G0022109.JPG
A H:\Day2\100GOPRO\G0022110.JPG
A H:\Day2\100GOPRO\G0022111.JPG
A H:\Day2\100GOPRO\G0022112.JPG
A H:\Day2\100GOPRO\G0022113.JPG
A H:\Day2\100GOPRO\G0022114.JPG
A H:\Day2\100GOPRO\G0022115.JPG
A H:\Day2\100GOPRO\G0022116.JPG
A H:\Day2\100GOPRO\G0022117.JPG
A H:\Day2\100GOPRO\G0022118.JPG
A H:\Day2\100GOPRO\G0022119.JPG
A H:\Day2\100GOPRO\G0022120.JPG
A H:\Day2\100GOPRO\G0022121.JPG
A H:\Day2\100GOPRO\G0022122.JPG
A H:\Day2\100GOPRO\G0022123.JPG
A H:\Day2\100GOPRO\G0022124.JPG
A H:\Day2\100GOPRO\G0022125.JPG
A H:\Day2\100GOPRO\G0022126.JPG
A H:\Day2\100GOPRO\G0022127.JPG
A H:\Day2\100GOPRO\G0022128.JPG
A H:\Day2\100GOPRO\G0022129.JPG
A H:\Day2\100GOPRO\G0022130.JPG
A H:\Day2\100GOPRO\G0022131.JPG
A H:\Day2\100GOPRO\G0022132.JPG
A H:\Day2\100GOPRO\G0022133.JPG
A H:\Day2\100GOPRO\G0022134.JPG
A H:\Day2\100GOPRO\G0022135.JPG
A H:\Day2\100GOPRO\G0022136.JPG
A H:\Day2\100GOPRO\G0022137.JPG
A H:\Day2\100GOPRO\G0022138.JPG
A H:\Day2\100GOPRO\G0022139.JPG
A H:\Day2\100GOPRO\G0022140.JPG
A H:\Day2\100GOPRO\G0022141.JPG
A H:\Day2\100GOPRO\G0022142.JPG
A H:\Day2\100GOPRO\G0022143.JPG
A H:\Day2\100GOPRO\G0022144.JPG
A H:\Day2\100GOPRO\G0022145.JPG
A H:\Day2\100GOPRO\G0022146.JPG
A H:\Day2\100GOPRO\G0022147.JPG
A H:\Day2\100GOPRO\G0022148.JPG
A H:\Day2\100GOPRO\G0022149.JPG
A H:\Day2\100GOPRO\G0022150.JPG
A H:\Day2\100GOPRO\G0022151.JPG
A H:\Day2\100GOPRO\G0022152.JPG
A H:\Day2\100GOPRO\G0022153.JPG
A H:\Day2\100GOPRO\G0022154.JPG
A H:\Day2\100GOPRO\G0022155.JPG
A H:\Day2\100GOPRO\G0022156.JPG
A H:\Day2\100GOPRO\G0022157.JPG
A H:\Day2\100GOPRO\G0022158.JPG
A H:\Day2\100GOPRO\G0022159.JPG
A H:\Day2\100GOPRO\G0022160.JPG
A H:\Day2\100GOPRO\G0022161.JPG
A H:\Day2\100GOPRO\G0022162.JPG
A H:\Day2\100GOPRO\G0022163.JPG
A H:\Day2\100GOPRO\G0022164.JPG
A H:\Day2\100GOPRO\G0022165.JPG
A H:\Day2\100GOPRO\G0022166.JPG
A H:\Day2\100GOPRO\G0022167.JPG
A H:\Day2\100GOPRO\G0022168.JPG
A H:\Day2\100GOPRO\G0022169.JPG
A H:\Day2\100GOPRO\G0022170.JPG
A H:\Day2\100GOPRO\G0022171.JPG
A H:\Day2\100GOPRO\G0022172.JPG
A H:\Day2\100GOPRO\G0022173.JPG
A H:\Day2\100GOPRO\G0022174.JPG
A H:\Day2\100GOPRO\G0022175.JPG
A H:\Day2\100GOPRO\G0022176.JPG
A H:\Day2\100GOPRO\G0022177.JPG
A H:\Day2\100GOPRO\G0022178.JPG
A H:\Day2\100GOPRO\G0022179.JPG
A H:\Day2\100GOPRO\G0022180.JPG
A H:\Day2\100GOPRO\G0022181.JPG
A H:\Day2\100GOPRO\G0022182.JPG
A H:\Day2\100GOPRO\G0022183.JPG
A H:\Day2\100GOPRO\G0022184.JPG
A H:\Day2\100GOPRO\G0022185.JPG
A H:\Day2\100GOPRO\G0022186.JPG
A H:\Day2\100GOPRO\G0022187.JPG
A H:\Day2\100GOPRO\G0022188.JPG
A H:\Day2\100GOPRO\G0022189.JPG
A H:\Day2\100GOPRO\G0022190.JPG
A H:\Day2\100GOPRO\G0022191.JPG
A H:\Day2\100GOPRO\G0022192.JPG
A H:\Day2\100GOPRO\G0022193.JPG
A H:\Day2\100GOPRO\G0022194.JPG
A H:\Day2\100GOPRO\G0022195.JPG
A H:\Day2\100GOPRO\G0022196.JPG
A H:\Day2\100GOPRO\G0022197.JPG
A H:\Day2\100GOPRO\G0022198.JPG
A H:\Day2\100GOPRO\G0022199.JPG
A H:\Day2\100GOPRO\G0022200.JPG
A H:\Day2\100GOPRO\G0022201.JPG
A H:\Day2\100GOPRO\G0022202.JPG
A H:\Day2\100GOPRO\G0022203.JPG
A H:\Day2\100GOPRO\G0022204.JPG
A H:\Day2\100GOPRO\G0022205.JPG
A H:\Day2\100GOPRO\G0022206.JPG
A H:\Day2\100GOPRO\G0022207.JPG
A H:\Day2\100GOPRO\G0022208.JPG
A H:\Day2\100GOPRO\G0022209.JPG
A H:\Day2\100GOPRO\G0022210.JPG
A H:\Day2\100GOPRO\G0022211.JPG
A H:\Day2\100GOPRO\G0022212.JPG
A H:\Day2\100GOPRO\G0022213.JPG
A H:\Day2\100GOPRO\G0022214.JPG
A H:\Day2\100GOPRO\G0022215.JPG
A H:\Day2\100GOPRO\G0022216.JPG
A H:\Day2\100GOPRO\G0022217.JPG
A H:\Day2\100GOPRO\G0022218.JPG
A H:\Day2\100GOPRO\G0022219.JPG
A H:\Day2\100GOPRO\G0022220.JPG
A H:\Day2\100GOPRO\G0022221.JPG
A H:\Day2\100GOPRO\G0022222.JPG
A H:\Day2\100GOPRO\G0022223.JPG
A H:\Day2\100GOPRO\G0022224.JPG
A H:\Day2\100GOPRO\G0022225.JPG
A H:\Day2\100GOPRO\G0022226.JPG
A H:\Day2\100GOPRO\G0022227.JPG
A H:\Day2\100GOPRO\G0022228.JPG
A H:\Day2\100GOPRO\G0022229.JPG
A H:\Day2\100GOPRO\G0022230.JPG
A H:\Day2\100GOPRO\G0022231.JPG
A H:\Day2\100GOPRO\G0022232.JPG
A H:\Day2\100GOPRO\G0022233.JPG
A H:\Day2\100GOPRO\G0022234.JPG
A H:\Day2\100GOPRO\G0022235.JPG
A H:\Day2\100GOPRO\G0022236.JPG
A H:\Day2\100GOPRO\G0022237.JPG
A H:\Day2\100GOPRO\G0022238.JPG
A H:\Day2\100GOPRO\G0022239.JPG
A H:\Day2\100GOPRO\G0022240.JPG
A H:\Day2\100GOPRO\G0022241.JPG
A H:\Day2\100GOPRO\G0022242.JPG
A H:\Day2\100GOPRO\G0022243.JPG
A H:\Day2\100GOPRO\G0022244.JPG
A H:\Day2\100GOPRO\G0022245.JPG
A H:\Day2\100GOPRO\G0022246.JPG
A H:\Day2\100GOPRO\G0022247.JPG
A H:\Day2\100GOPRO\G0022248.JPG
A H:\Day2\100GOPRO\G0022249.JPG
A H:\Day2\100GOPRO\G0022250.JPG
A H:\Day2\100GOPRO\G0022251.JPG
A H:\Day2\100GOPRO\G0022252.JPG
A H:\Day2\100GOPRO\G0022253.JPG
A H:\Day2\100GOPRO\G0022254.JPG
A H:\Day2\100GOPRO\G0022255.JPG
A H:\Day2\100GOPRO\G0022256.JPG
A H:\Day2\100GOPRO\G0022257.JPG
A H:\Day2\100GOPRO\G0022258.JPG
A H:\Day2\100GOPRO\G0022259.JPG
A H:\Day2\100GOPRO\G0022260.JPG
A H:\Day2\100GOPRO\G0022261.JPG
A H:\Day2\100GOPRO\G0022262.JPG
A H:\Day2\100GOPRO\G0022263.JPG
A H:\Day2\100GOPRO\G0022264.JPG
A H:\Day2\100GOPRO\G0022265.JPG
A H:\Day2\100GOPRO\G0022266.JPG
A H:\Day2\100GOPRO\G0022267.JPG
A H:\Day2\100GOPRO\G0022268.JPG
A H:\Day2\100GOPRO\G0022269.JPG
A H:\Day2\100GOPRO\G0022270.JPG
A H:\Day2\100GOPRO\G0022271.JPG
A H:\Day2\100GOPRO\G0022272.JPG
A H:\Day2\100GOPRO\G0022273.JPG
A H:\Day2\100GOPRO\G0022274.JPG
A H:\Day2\100GOPRO\G0022275.JPG
A H:\Day2\100GOPRO\G0022276.JPG
A H:\Day2\100GOPRO\G0022277.JPG
A H:\Day2\100GOPRO\G0022278.JPG
A H:\Day2\100GOPRO\G0022279.JPG
A H:\Day2\100GOPRO\G0022280.JPG
A H:\Day2\100GOPRO\G0022281.JPG
A H:\Day2\100GOPRO\G0022282.JPG
A H:\Day2\100GOPRO\G0022283.JPG
A H:\Day2\100GOPRO\G0022284.JPG
A H:\Day2\100GOPRO\G0022285.JPG
A H:\Day2\100GOPRO\G0022286.JPG
A H:\Day2\100GOPRO\G0022287.JPG
A H:\Day2\100GOPRO\G0022288.JPG
A H:\Day2\100GOPRO\G0022289.JPG
A H:\Day2\100GOPRO\G0022290.JPG
A H:\Day2\100GOPRO\G0022291.JPG
A H:\Day2\100GOPRO\G0022292.JPG
A H:\Day2\100GOPRO\G0022293.JPG
A H:\Day2\100GOPRO\G0022294.JPG
A H:\Day2\100GOPRO\G0022295.JPG
A H:\Day2\100GOPRO\G0022296.JPG
A H:\Day2\100GOPRO\G0022297.JPG
A H:\Day2\100GOPRO\G0022298.JPG
A H:\Day2\100GOPRO\G0022299.JPG
A H:\Day2\100GOPRO\G0022300.JPG
A H:\Day2\100GOPRO\G0022301.JPG
A H:\Day2\100GOPRO\G0022302.JPG
A H:\Day2\100GOPRO\G0022303.JPG
A H:\Day2\100GOPRO\G0022304.JPG
A H:\Day2\100GOPRO\G0022305.JPG
A H:\Day2\100GOPRO\G0022306.JPG
A H:\Day2\100GOPRO\G0022307.JPG
A H:\Day2\100GOPRO\G0022308.JPG
A H:\Day2\100GOPRO\G0022309.JPG
A H:\Day2\100GOPRO\G0022310.JPG
A H:\Day2\100GOPRO\G0022311.JPG
A H:\Day2\100GOPRO\G0022312.JPG
A H:\Day2\100GOPRO\G0022313.JPG
A H:\Day2\100GOPRO\G0022314.JPG
A H:\Day2\100GOPRO\G0022315.JPG
A H:\Day2\100GOPRO\G0022316.JPG
A H:\Day2\100GOPRO\G0022317.JPG
A H:\Day2\100GOPRO\G0022318.JPG
A H:\Day2\100GOPRO\G0022319.JPG
A H:\Day2\100GOPRO\G0022320.JPG
A H:\Day2\100GOPRO\G0022321.JPG
A H:\Day2\100GOPRO\G0022322.JPG
A H:\Day2\100GOPRO\G0022323.JPG
A H:\Day2\100GOPRO\G0022324.JPG
A H:\Day2\100GOPRO\G0022325.JPG
ssmad
Regular Member
 
Posts: 41
Joined: May 25th, 2013, 12:10 pm

Re: External WD HD infected with Win32:Kryptik.LQL

Unread postby ssmad » May 27th, 2013, 8:55 am

A H:\Day2\100GOPRO\G0022326.JPG
A H:\Day2\100GOPRO\G0022327.JPG
A H:\Day2\100GOPRO\G0022328.JPG
A H:\Day2\100GOPRO\G0022329.JPG
A H:\Day2\100GOPRO\G0022330.JPG
A H:\Day2\100GOPRO\G0022331.JPG
A H:\Day2\100GOPRO\G0022332.JPG
A H:\Day2\100GOPRO\G0022333.JPG
A H:\Day2\100GOPRO\G0022334.JPG
A H:\Day2\100GOPRO\G0022335.JPG
A H:\Day2\100GOPRO\G0022336.JPG
A H:\Day2\100GOPRO\G0022337.JPG
A H:\Day2\100GOPRO\G0022338.JPG
A H:\Day2\100GOPRO\G0022339.JPG
A H:\Day2\100GOPRO\G0022340.JPG
A H:\Day2\100GOPRO\G0022341.JPG
A H:\Day2\100GOPRO\G0022342.JPG
A H:\Day2\100GOPRO\G0022343.JPG
A H:\Day2\100GOPRO\G0022344.JPG
A H:\Day2\100GOPRO\G0022345.JPG
A H:\Day2\100GOPRO\G0022346.JPG
A H:\Day2\100GOPRO\G0022347.JPG
A H:\Day2\100GOPRO\G0022348.JPG
A H:\Day2\100GOPRO\G0022349.JPG
A H:\Day2\100GOPRO\G0022350.JPG
A H:\Day2\100GOPRO\G0022351.JPG
A H:\Day2\100GOPRO\G0022352.JPG
A H:\Day2\100GOPRO\G0022353.JPG
A H:\Day2\100GOPRO\G0022354.JPG
A H:\Day2\100GOPRO\G0022355.JPG
A H:\Day2\100GOPRO\G0022356.JPG
A H:\Day2\100GOPRO\G0022357.JPG
A H:\Day2\100GOPRO\G0022358.JPG
A H:\Day2\100GOPRO\G0022359.JPG
A H:\Day2\100GOPRO\G0022360.JPG
A H:\Day2\100GOPRO\G0022361.JPG
A H:\Day2\100GOPRO\G0022362.JPG
A H:\Day2\100GOPRO\G0022363.JPG
A H:\Day2\100GOPRO\G0022364.JPG
A H:\Day2\100GOPRO\G0022365.JPG
A H:\Day2\100GOPRO\G0022366.JPG
A H:\Day2\100GOPRO\G0022367.JPG
A H:\Day2\100GOPRO\G0022368.JPG
A H:\Day2\100GOPRO\G0022369.JPG
A H:\Day2\100GOPRO\G0022370.JPG
A H:\Day2\100GOPRO\G0022371.JPG
A H:\Day2\100GOPRO\G0022372.JPG
A H:\Day2\100GOPRO\G0022373.JPG
A H:\Day2\100GOPRO\G0022374.JPG
A H:\Day2\100GOPRO\G0022375.JPG
A H:\Day2\100GOPRO\G0022376.JPG
A H:\Day2\100GOPRO\G0022377.JPG
A H:\Day2\100GOPRO\G0022378.JPG
A H:\Day2\100GOPRO\G0022379.JPG
A H:\Day2\100GOPRO\G0022380.JPG
A H:\Day2\100GOPRO\G0022381.JPG
A H:\Day2\100GOPRO\G0022382.JPG
A H:\Day2\100GOPRO\G0022383.JPG
A H:\Day2\100GOPRO\G0022384.JPG
A H:\Day2\100GOPRO\G0022385.JPG
A H:\Day2\100GOPRO\G0022386.JPG
A H:\Day2\100GOPRO\G0022387.JPG
A H:\Day2\100GOPRO\G0022388.JPG
A H:\Day2\100GOPRO\G0022389.JPG
A H:\Day2\100GOPRO\G0022390.JPG
A H:\Day2\100GOPRO\G0022391.JPG
A H:\Day2\100GOPRO\G0022392.JPG
A H:\Day2\100GOPRO\G0022393.JPG
A H:\Day2\100GOPRO\G0022394.JPG
A H:\Day2\100GOPRO\G0022395.JPG
A H:\Day2\100GOPRO\G0022396.JPG
A H:\Day2\100GOPRO\G0022397.JPG
A H:\Day2\100GOPRO\G0022398.JPG
A H:\Day2\100GOPRO\G0022399.JPG
A H:\Day2\100GOPRO\G0022400.JPG
A H:\Day2\100GOPRO\G0022401.JPG
A H:\Day2\100GOPRO\G0022402.JPG
A H:\Day2\100GOPRO\G0022403.JPG
A H:\Day2\100GOPRO\G0022404.JPG
A H:\Day2\100GOPRO\G0022405.JPG
A H:\Day2\100GOPRO\G0022406.JPG
A H:\Day2\100GOPRO\G0022407.JPG
A H:\Day2\100GOPRO\G0022408.JPG
A H:\Day2\100GOPRO\G0022409.JPG
A H:\Day2\100GOPRO\G0022410.JPG
A H:\Day2\100GOPRO\G0022411.JPG
A H:\Day2\100GOPRO\G0022412.JPG
A H:\Day2\100GOPRO\G0022413.JPG
A H:\Day2\100GOPRO\G0022414.JPG
A H:\Day2\100GOPRO\G0022415.JPG
A H:\Day2\100GOPRO\G0022416.JPG
A H:\Day2\100GOPRO\G0022417.JPG
A H:\Day2\100GOPRO\G0022418.JPG
A H:\Day2\100GOPRO\G0022419.JPG
A H:\Day2\100GOPRO\G0022420.JPG
A H:\Day2\100GOPRO\G0022421.JPG
A H:\Day2\100GOPRO\G0022422.JPG
A H:\Day2\100GOPRO\G0022423.JPG
A H:\Day2\100GOPRO\G0022424.JPG
A H:\Day2\100GOPRO\G0022425.JPG
A H:\Day2\100GOPRO\G0022426.JPG
A H:\Day2\100GOPRO\G0022427.JPG
A H:\Day2\100GOPRO\G0022428.JPG
A H:\Day2\100GOPRO\G0022429.JPG
A H:\Day2\100GOPRO\G0022430.JPG
A H:\Day2\100GOPRO\G0022431.JPG
A H:\Day2\100GOPRO\G0022432.JPG
A H:\Day2\100GOPRO\G0022433.JPG
A H:\Day2\100GOPRO\G0022434.JPG
A H:\Day2\100GOPRO\G0022435.JPG
A H:\Day2\100GOPRO\G0022436.JPG
A H:\Day2\100GOPRO\G0022437.JPG
A H:\Day2\100GOPRO\G0022438.JPG
A H:\Day2\100GOPRO\G0022439.JPG
A H:\Day2\100GOPRO\G0022440.JPG
A H:\Day2\100GOPRO\G0022441.JPG
A H:\Day2\100GOPRO\G0022442.JPG
A H:\Day2\100GOPRO\G0022443.JPG
A H:\Day2\100GOPRO\G0022444.JPG
A H:\Day2\100GOPRO\G0022445.JPG
A H:\Day2\100GOPRO\G0022446.JPG
A H:\Day2\100GOPRO\G0022447.JPG
A H:\Day2\100GOPRO\G0022448.JPG
A H:\Day2\100GOPRO\G0022449.JPG
A H:\Day2\100GOPRO\G0022450.JPG
A H:\Day2\100GOPRO\G0022451.JPG
A H:\Day2\100GOPRO\G0022452.JPG
A H:\Day2\100GOPRO\G0022453.JPG
A H:\Day2\100GOPRO\G0022454.JPG
A H:\Day2\100GOPRO\G0022455.JPG
A H:\Day2\100GOPRO\G0022456.JPG
A H:\Day2\100GOPRO\G0022457.JPG
A H:\Day2\100GOPRO\G0022458.JPG
A H:\Day2\100GOPRO\G0022459.JPG
A H:\Day2\100GOPRO\G0022460.JPG
A H:\Day2\100GOPRO\G0022461.JPG
A H:\Day2\100GOPRO\G0022462.JPG
A H:\Day2\100GOPRO\G0022463.JPG
A H:\Day2\100GOPRO\G0022464.JPG
A H:\Day2\100GOPRO\G0022465.JPG
A H:\Day2\100GOPRO\G0022466.JPG
A H:\Day2\100GOPRO\G0022467.JPG
A H:\Day2\100GOPRO\G0022468.JPG
A H:\Day2\100GOPRO\G0022469.JPG
A H:\Day2\100GOPRO\G0022470.JPG
A H:\Day2\100GOPRO\G0022471.JPG
A H:\Day2\100GOPRO\G0022472.JPG
A H:\Day2\100GOPRO\G0022473.JPG
A H:\Day2\100GOPRO\G0022474.JPG
A H:\Day2\100GOPRO\G0022475.JPG
A H:\Day2\100GOPRO\G0022476.JPG
A H:\Day2\100GOPRO\G0022477.JPG
A H:\Day2\100GOPRO\G0022478.JPG
A H:\Day2\100GOPRO\G0022479.JPG
A H:\Day2\100GOPRO\G0022480.JPG
A H:\Day2\100GOPRO\G0022481.JPG
A H:\Day2\100GOPRO\G0022482.JPG
A H:\Day2\100GOPRO\G0022483.JPG
A H:\Day2\100GOPRO\G0022484.JPG
A H:\Day2\100GOPRO\G0022485.JPG
A H:\Day2\100GOPRO\G0022486.JPG
A H:\Day2\100GOPRO\G0022487.JPG
A H:\Day2\100GOPRO\G0022488.JPG
A H:\Day2\100GOPRO\G0022489.JPG
A H:\Day2\100GOPRO\G0022490.JPG
A H:\Day2\100GOPRO\G0022491.JPG
A H:\Day2\100GOPRO\G0022492.JPG
A H:\Day2\100GOPRO\G0022493.JPG
A H:\Day2\100GOPRO\G0022494.JPG
A H:\Day2\100GOPRO\G0022495.JPG
A H:\Day2\100GOPRO\G0022496.JPG
A H:\Day2\100GOPRO\G0022497.JPG
A H:\Day2\100GOPRO\G0022498.JPG
A H:\Day2\100GOPRO\G0022499.JPG
A H:\Day2\100GOPRO\G0022500.JPG
A H:\Day2\100GOPRO\G0022501.JPG
A H:\Day2\100GOPRO\G0022502.JPG
A H:\Day2\100GOPRO\G0022503.JPG
A H:\Day2\100GOPRO\G0022504.JPG
A H:\Day2\100GOPRO\G0022505.JPG
A H:\Day2\100GOPRO\G0022506.JPG
A H:\Day2\100GOPRO\G0022507.JPG
A H:\Day2\100GOPRO\G0022508.JPG
A H:\Day2\100GOPRO\G0022509.JPG
A H:\Day2\100GOPRO\G0022510.JPG
A H:\Day2\100GOPRO\G0022511.JPG
A H:\Day2\100GOPRO\G0022512.JPG
A H:\Day2\100GOPRO\G0022513.JPG
A H:\Day2\100GOPRO\G0022514.JPG
A H:\Day2\100GOPRO\G0022515.JPG
A H:\Day2\100GOPRO\G0022516.JPG
A H:\Day2\100GOPRO\G0022517.JPG
A H:\Day2\100GOPRO\G0022518.JPG
A H:\Day2\100GOPRO\G0022519.JPG
A H:\Day2\100GOPRO\G0022520.JPG
A H:\Day2\100GOPRO\G0022521.JPG
A H:\Day2\100GOPRO\G0022522.JPG
A H:\Day2\100GOPRO\G0022523.JPG
A H:\Day2\100GOPRO\G0022524.JPG
A H:\Day2\100GOPRO\G0022525.JPG
A H:\Day2\100GOPRO\G0022526.JPG
A H:\Day2\100GOPRO\G0022527.JPG
A H:\Day2\100GOPRO\G0022528.JPG
A H:\Day2\100GOPRO\G0022529.JPG
A H:\Day2\100GOPRO\G0022530.JPG
A H:\Day2\100GOPRO\G0022531.JPG
A H:\Day2\100GOPRO\G0022532.JPG
A H:\Day2\100GOPRO\G0022533.JPG
A H:\Day2\100GOPRO\G0022534.JPG
A H:\Day2\100GOPRO\G0022535.JPG
A H:\Day2\100GOPRO\G0022536.JPG
A H:\Day2\100GOPRO\G0022537.JPG
A H:\Day2\100GOPRO\G0022538.JPG
A H:\Day2\100GOPRO\G0022539.JPG
A H:\Day2\100GOPRO\G0022540.JPG
A H:\Day2\100GOPRO\G0022541.JPG
A H:\Day2\100GOPRO\G0022542.JPG
A H:\Day2\100GOPRO\G0022543.JPG
A H:\Day2\100GOPRO\G0022544.JPG
A H:\Day2\100GOPRO\G0022545.JPG
A H:\Day2\100GOPRO\G0022546.JPG
A H:\Day2\100GOPRO\G0022547.JPG
A H:\Day2\100GOPRO\G0022548.JPG
A H:\Day2\100GOPRO\G0022549.JPG
A H:\Day2\100GOPRO\G0022550.JPG
A H:\Day2\100GOPRO\G0022551.JPG
A H:\Day2\100GOPRO\G0022552.JPG
A H:\Day2\100GOPRO\G0022553.JPG
A H:\Day2\100GOPRO\G0022554.JPG
A H:\Day2\100GOPRO\G0022555.JPG
A H:\Day2\100GOPRO\G0022556.JPG
A H:\Day2\100GOPRO\G0022557.JPG
A H:\Day2\100GOPRO\G0022558.JPG
A H:\Day2\100GOPRO\G0022559.JPG
A H:\Day2\100GOPRO\G0022560.JPG
A H:\Day2\100GOPRO\G0022561.JPG
A H:\Day2\100GOPRO\G0022562.JPG
A H:\Day2\100GOPRO\G0022563.JPG
A H:\Day2\100GOPRO\G0022564.JPG
A H:\Day2\100GOPRO\G0022565.JPG
A H:\Day2\100GOPRO\G0022566.JPG
A H:\Day2\100GOPRO\G0022567.JPG
A H:\Day2\100GOPRO\G0022568.JPG
A H:\Day2\100GOPRO\G0022569.JPG
A H:\Day2\100GOPRO\G0022570.JPG
A H:\Day2\100GOPRO\G0022571.JPG
A H:\Day2\100GOPRO\G0022572.JPG
A H:\Day2\100GOPRO\G0022573.JPG
A H:\Day2\100GOPRO\G0022574.JPG
A H:\Day2\100GOPRO\G0022575.JPG
A H:\Day2\100GOPRO\G0022576.JPG
A H:\Day2\100GOPRO\G0022577.JPG
A H:\Day2\100GOPRO\G0022578.JPG
A H:\Day2\100GOPRO\G0022579.JPG
A H:\Day2\100GOPRO\G0022580.JPG
A H:\Day2\100GOPRO\G0022581.JPG
A H:\Day2\100GOPRO\G0022582.JPG
A H:\Day2\100GOPRO\G0022583.JPG
A H:\Day2\100GOPRO\G0022584.JPG
A H:\Day2\100GOPRO\G0022585.JPG
A H:\Day2\100GOPRO\G0022586.JPG
A H:\Day2\100GOPRO\G0022587.JPG
A H:\Day2\100GOPRO\G0022588.JPG
A H:\Day2\100GOPRO\G0022589.JPG
A H:\Day2\100GOPRO\G0022590.JPG
A H:\Day2\100GOPRO\G0022591.JPG
A H:\Day2\100GOPRO\G0022592.JPG
A H:\Day2\100GOPRO\G0022593.JPG
A H:\Day2\100GOPRO\G0022594.JPG
A H:\Day2\100GOPRO\G0022595.JPG
A H:\Day2\100GOPRO\G0022596.JPG
A H:\Day2\100GOPRO\G0022597.JPG
A H:\Day2\100GOPRO\G0022598.JPG
A H:\Day2\100GOPRO\G0022599.JPG
A H:\Day2\100GOPRO\G0022600.JPG
A H:\Day2\100GOPRO\G0022601.JPG
A H:\Day2\100GOPRO\G0022602.JPG
A H:\Day2\100GOPRO\G0022603.JPG
A H:\Day2\100GOPRO\G0022604.JPG
A H:\Day2\100GOPRO\G0022605.JPG
A H:\Day2\100GOPRO\G0022606.JPG
A H:\Day2\100GOPRO\G0022607.JPG
A H:\Day2\100GOPRO\G0022608.JPG
A H:\Day2\100GOPRO\G0022609.JPG
A H:\Day2\100GOPRO\G0022610.JPG
A H:\Day2\100GOPRO\G0022611.JPG
A H:\Day2\100GOPRO\G0022612.JPG
A H:\Day2\100GOPRO\G0022613.JPG
A H:\Day2\100GOPRO\G0022614.JPG
A H:\Day2\100GOPRO\G0022615.JPG
A H:\Day2\100GOPRO\G0022616.JPG
A H:\Day2\100GOPRO\G0022617.JPG
A H:\Day2\100GOPRO\G0022618.JPG
A H:\Day2\100GOPRO\G0022619.JPG
A H:\Day2\100GOPRO\G0022620.JPG
A H:\Day2\100GOPRO\G0022621.JPG
A H:\Day2\100GOPRO\G0022622.JPG
A H:\Day2\100GOPRO\G0022623.JPG
A H:\Day2\100GOPRO\G0022624.JPG
A H:\Day2\100GOPRO\G0022625.JPG
A H:\Day2\100GOPRO\G0022626.JPG
A H:\Day2\100GOPRO\G0022627.JPG
A H:\Day2\100GOPRO\G0022628.JPG
A H:\Day2\100GOPRO\G0022629.JPG
A H:\Day2\100GOPRO\G0022630.JPG
A H:\Day2\100GOPRO\G0022631.JPG
A H:\Day2\100GOPRO\G0022632.JPG
A H:\Day2\100GOPRO\G0022633.JPG
A H:\Day2\100GOPRO\G0022634.JPG
A H:\Day2\100GOPRO\G0022635.JPG
A H:\Day2\100GOPRO\G0022636.JPG
A H:\Day2\100GOPRO\G0022637.JPG
A H:\Day2\100GOPRO\G0022638.JPG
A H:\Day2\100GOPRO\G0022639.JPG
A H:\Day2\100GOPRO\G0022640.JPG
A H:\Day2\100GOPRO\G0022641.JPG
A H:\Day2\100GOPRO\G0022642.JPG
A H:\Day2\100GOPRO\G0022643.JPG
A H:\Day2\100GOPRO\G0022644.JPG
A H:\Day2\100GOPRO\G0022645.JPG
A H:\Day2\100GOPRO\G0022646.JPG
A H:\Day2\100GOPRO\G0022647.JPG
A H:\Day2\100GOPRO\G0022648.JPG
A H:\Day2\100GOPRO\G0022649.JPG
A H:\Day2\100GOPRO\G0022650.JPG
A H:\Day2\100GOPRO\G0022651.JPG
A H:\Day2\100GOPRO\G0022652.JPG
A H:\Day2\100GOPRO\G0022653.JPG
A H:\Day2\100GOPRO\G0022654.JPG
A H:\Day2\100GOPRO\G0022655.JPG
A H:\Day2\100GOPRO\G0022656.JPG
A H:\Day2\100GOPRO\G0022657.JPG
A H:\Day2\100GOPRO\G0022658.JPG
A H:\Day2\100GOPRO\G0022659.JPG
A H:\Day2\100GOPRO\G0022660.JPG
A H:\Day2\100GOPRO\G0022661.JPG
A H:\Day2\100GOPRO\G0022662.JPG
A H:\Day2\100GOPRO\G0022663.JPG
A H:\Day2\100GOPRO\G0022664.JPG
A H:\Day2\100GOPRO\G0022665.JPG
A H:\Day2\100GOPRO\G0022666.JPG
A H:\Day2\100GOPRO\G0022667.JPG
A H:\Day2\100GOPRO\G0022668.JPG
A H:\Day2\100GOPRO\G0022669.JPG
A H:\Day2\100GOPRO\G0022670.JPG
A H:\Day2\100GOPRO\G0022671.JPG
A H:\Day2\100GOPRO\G0022672.JPG
A H:\Day2\100GOPRO\G0022673.JPG
A H:\Day2\100GOPRO\G0022674.JPG
A H:\Day2\100GOPRO\G0022675.JPG
A H:\Day2\100GOPRO\G0022676.JPG
A H:\Day2\100GOPRO\G0022677.JPG
A H:\Day2\100GOPRO\G0022678.JPG
A H:\Day2\100GOPRO\G0022679.JPG
A H:\Day2\100GOPRO\G0022680.JPG
A H:\Day2\100GOPRO\G0022681.JPG
A H:\Day2\100GOPRO\G0022682.JPG
A H:\Day2\100GOPRO\G0022683.JPG
A H:\Day2\100GOPRO\G0022684.JPG
A H:\Day2\100GOPRO\G0022685.JPG
A H:\Day2\100GOPRO\G0022686.JPG
A H:\Day2\100GOPRO\G0022687.JPG
A H:\Day2\100GOPRO\G0022688.JPG
A H:\Day2\100GOPRO\G0022689.JPG
A H:\Day2\100GOPRO\G0022690.JPG
A H:\Day2\100GOPRO\G0022691.JPG
A H:\Day2\100GOPRO\G0022692.JPG
A H:\Day2\100GOPRO\G0022693.JPG
A H:\Day2\100GOPRO\G0022694.JPG
A H:\Day2\100GOPRO\G0022695.JPG
A H:\Day2\100GOPRO\G0022696.JPG
A H:\Day2\100GOPRO\G0022697.JPG
A H:\Day2\100GOPRO\G0022698.JPG
A H:\Day2\100GOPRO\G0022699.JPG
A H:\Day2\100GOPRO\G0022700.JPG
A H:\Day2\100GOPRO\G0022701.JPG
A H:\Day2\100GOPRO\G0022702.JPG
A H:\Day2\100GOPRO\G0022703.JPG
A H:\Day2\100GOPRO\G0022704.JPG
A H:\Day2\100GOPRO\G0022705.JPG
A H:\Day2\100GOPRO\G0022706.JPG
A H:\Day2\100GOPRO\G0022707.JPG
A H:\Day2\100GOPRO\G0022708.JPG
A H:\Day2\100GOPRO\G0022709.JPG
A H:\Day2\100GOPRO\G0022710.JPG
A H:\Day2\100GOPRO\G0022711.JPG
A H:\Day2\100GOPRO\G0022712.JPG
A H:\Day2\100GOPRO\G0022713.JPG
A H:\Day2\100GOPRO\G0022714.JPG
A H:\Day2\100GOPRO\G0022715.JPG
A H:\Day2\100GOPRO\G0022716.JPG
A H:\Day2\100GOPRO\G0022717.JPG
A H:\Day2\100GOPRO\G0022718.JPG
A H:\Day2\100GOPRO\G0022719.JPG
A H:\Day2\100GOPRO\G0022720.JPG
A H:\Day2\100GOPRO\G0022721.JPG
A H:\Day2\100GOPRO\G0022722.JPG
A H:\Day2\100GOPRO\G0022723.JPG
A H:\Day2\100GOPRO\G0022724.JPG
A H:\Day2\100GOPRO\G0022725.JPG
A H:\Day2\100GOPRO\G0022726.JPG
A H:\Day2\100GOPRO\G0022727.JPG
A H:\Day2\100GOPRO\G0022728.JPG
A H:\Day2\100GOPRO\G0022729.JPG
A H:\Day2\100GOPRO\G0022730.JPG
A H:\Day2\100GOPRO\G0022731.JPG
A H:\Day2\100GOPRO\G0022732.JPG
A H:\Day2\100GOPRO\G0022733.JPG
A H:\Day2\100GOPRO\G0022734.JPG
A H:\Day2\100GOPRO\G0022735.JPG
A H:\Day2\100GOPRO\G0022736.JPG
A H:\Day2\100GOPRO\G0022737.JPG
A H:\Day2\100GOPRO\G0022738.JPG
A H:\Day2\100GOPRO\G0022739.JPG
A H:\Day2\100GOPRO\G0022740.JPG
A H:\Day2\100GOPRO\G0022741.JPG
A H:\Day2\100GOPRO\G0022742.JPG
A H:\Day2\100GOPRO\G0022743.JPG
A H:\Day2\100GOPRO\G0022744.JPG
A H:\Day2\100GOPRO\G0022745.JPG
A H:\Day2\100GOPRO\G0022746.JPG
A H:\Day2\100GOPRO\G0022747.JPG
A H:\Day2\100GOPRO\G0022748.JPG
A H:\Day2\100GOPRO\G0022749.JPG
A H:\Day2\100GOPRO\G0022750.JPG
A H:\Day2\100GOPRO\G0022751.JPG
A H:\Day2\100GOPRO\G0022752.JPG
A H:\Day2\100GOPRO\G0022753.JPG
A H:\Day2\100GOPRO\G0022754.JPG
A H:\Day2\100GOPRO\G0022755.JPG
A H:\Day2\100GOPRO\G0022756.JPG
A H:\Day2\100GOPRO\G0022757.JPG
A H:\Day2\100GOPRO\G0022758.JPG
A H:\Day2\100GOPRO\G0022759.JPG
A H:\Day2\100GOPRO\G0022760.JPG
A H:\Day2\100GOPRO\G0022761.JPG
A H:\Day2\100GOPRO\G0022762.JPG
A H:\Day2\100GOPRO\G0022763.JPG
A H:\Day2\100GOPRO\G0022764.JPG
A H:\Day2\100GOPRO\G0022765.JPG
A H:\Day2\100GOPRO\G0022766.JPG
A H:\Day2\100GOPRO\G0022767.JPG
A H:\Day2\100GOPRO\G0022768.JPG
A H:\Day2\100GOPRO\G0022769.JPG
A H:\Day2\100GOPRO\G0022770.JPG
A H:\Day2\100GOPRO\G0022771.JPG
A H:\Day2\100GOPRO\G0022772.JPG
A H:\Day2\100GOPRO\G0022773.JPG
A H:\Day2\100GOPRO\G0022774.JPG
A H:\Day2\100GOPRO\G0022775.JPG
A H:\Day2\100GOPRO\G0022776.JPG
A H:\Day2\100GOPRO\G0022777.JPG
A H:\Day2\100GOPRO\G0022778.JPG
A H:\Day2\100GOPRO\G0022779.JPG
A H:\Day2\100GOPRO\G0022780.JPG
A H:\Day2\100GOPRO\G0022781.JPG
A H:\Day2\100GOPRO\G0022782.JPG
A H:\Day2\100GOPRO\G0022783.JPG
A H:\Day2\100GOPRO\G0022784.JPG
A H:\Day2\100GOPRO\G0022785.JPG
A H:\Day2\100GOPRO\G0022786.JPG
A H:\Day2\100GOPRO\G0022787.JPG
A H:\Day2\100GOPRO\G0022788.JPG
A H:\Day2\100GOPRO\G0022789.JPG
A H:\Day2\100GOPRO\G0022790.JPG
A H:\Day2\100GOPRO\G0022791.JPG
A H:\Day2\100GOPRO\G0022792.JPG
A H:\Day2\100GOPRO\G0022793.JPG
A H:\Day2\100GOPRO\G0022794.JPG
A H:\Day2\100GOPRO\G0022795.JPG
A H:\Day2\100GOPRO\G0022796.JPG
A H:\Day2\100GOPRO\G0022797.JPG
A H:\Day2\100GOPRO\G0022798.JPG
A H:\Day2\100GOPRO\G0022799.JPG
A H:\Day2\100GOPRO\G0022800.JPG
A H:\Day2\100GOPRO\G0022801.JPG
A H:\Day2\100GOPRO\G0022802.JPG
A H:\Day2\100GOPRO\G0022803.JPG
A H:\Day2\100GOPRO\G0022804.JPG
A H:\Day2\100GOPRO\G0022805.JPG
A H:\Day2\100GOPRO\G0022806.JPG
A H:\Day2\100GOPRO\G0022807.JPG
A H:\Day2\100GOPRO\G0022808.JPG
A H:\Day2\100GOPRO\G0022809.JPG
A H:\Day2\100GOPRO\G0022810.JPG
A H:\Day2\100GOPRO\G0022811.JPG
A H:\Day2\100GOPRO\G0022812.JPG
A H:\Day2\100GOPRO\G0022813.JPG
A H:\Day2\100GOPRO\G0022814.JPG
A H:\Day2\100GOPRO\G0022815.JPG
A H:\Day2\100GOPRO\G0022816.JPG
A H:\Day2\100GOPRO\G0022817.JPG
A H:\Day2\100GOPRO\G0022818.JPG
A H:\Day2\100GOPRO\G0022819.JPG
A H:\Day2\100GOPRO\G0022820.JPG
A H:\Day2\100GOPRO\G0022821.JPG
A H:\Day2\100GOPRO\G0022822.JPG
A H:\Day2\100GOPRO\G0022823.JPG
A H:\Day2\100GOPRO\G0022824.JPG
A H:\Day2\100GOPRO\G0022825.JPG
A H:\Day2\100GOPRO\G0022826.JPG
A H:\Day2\100GOPRO\G0022827.JPG
A H:\Day2\100GOPRO\G0022828.JPG
A H:\Day2\100GOPRO\G0022829.JPG
A H:\Day2\100GOPRO\G0022830.JPG
A H:\Day2\100GOPRO\G0022831.JPG
A H:\Day2\100GOPRO\G0022832.JPG
A H:\Day2\100GOPRO\G0022833.JPG
A H:\Day2\100GOPRO\G0022834.JPG
A H:\Day2\100GOPRO\G0022835.JPG
A H:\Day2\100GOPRO\G0022836.JPG
A H:\Day2\100GOPRO\G0022837.JPG
A H:\Day2\100GOPRO\G0022838.JPG
A H:\Day2\100GOPRO\G0022839.JPG
A H:\Day2\100GOPRO\G0022840.JPG
A H:\Day2\100GOPRO\G0022841.JPG
A H:\Day2\100GOPRO\G0022842.JPG
A H:\Day2\100GOPRO\G0022843.JPG
A H:\Day2\100GOPRO\G0022844.JPG
A H:\Day2\100GOPRO\G0022845.JPG
A H:\Day2\100GOPRO\G0022846.JPG
A H:\Day2\100GOPRO\G0022847.JPG
A H:\Day2\100GOPRO\G0022848.JPG
A H:\Day2\100GOPRO\G0022849.JPG
A H:\Day2\100GOPRO\G0022850.JPG
A H:\Day2\100GOPRO\G0022851.JPG
A H:\Day2\100GOPRO\G0022852.JPG
A H:\Day2\100GOPRO\G0022853.JPG
A H:\Day2\100GOPRO\G0022854.JPG
A H:\Day2\100GOPRO\G0022855.JPG
A H:\Day2\100GOPRO\G0022856.JPG
A H:\Day2\100GOPRO\G0022857.JPG
A H:\Day2\100GOPRO\G0022858.JPG
A H:\Day2\100GOPRO\G0022859.JPG
A H:\Day2\100GOPRO\G0022860.JPG
A H:\Day2\100GOPRO\G0022861.JPG
A H:\Day2\100GOPRO\G0022862.JPG
A H:\Day2\100GOPRO\G0022863.JPG
A H:\Day2\100GOPRO\G0022864.JPG
A H:\Day2\100GOPRO\G0022865.JPG
A H:\Day2\100GOPRO\G0022866.JPG
A H:\Day2\100GOPRO\G0022867.JPG
A H:\Day2\100GOPRO\G0022868.JPG
A H:\Day2\100GOPRO\G0022869.JPG
A H:\Day2\100GOPRO\G0022870.JPG
A H:\Day2\100GOPRO\G0022871.JPG
A H:\Day2\100GOPRO\G0022872.JPG
A H:\Day2\100GOPRO\G0022873.JPG
A H:\Day2\100GOPRO\G0022874.JPG
A H:\Day2\100GOPRO\G0022875.JPG
A H:\Day2\100GOPRO\G0022876.JPG
A H:\Day2\100GOPRO\G0022877.JPG
A H:\Day2\100GOPRO\G0022878.JPG
A H:\Day2\100GOPRO\G0022879.JPG
A H:\Day2\100GOPRO\G0022880.JPG
A H:\Day2\100GOPRO\G0022881.JPG
A H:\Day2\100GOPRO\G0022882.JPG
A H:\Day2\100GOPRO\G0022883.JPG
A H:\Day2\100GOPRO\G0022884.JPG
A H:\Day2\100GOPRO\G0022885.JPG
A H:\Day2\100GOPRO\G0022886.JPG
A H:\Day2\100GOPRO\G0022887.JPG
A H:\Day2\100GOPRO\G0022888.JPG
A H:\Day2\100GOPRO\G0022889.JPG
A H:\Day2\100GOPRO\G0022890.JPG
A H:\Day2\100GOPRO\G0022891.JPG
A H:\Day2\100GOPRO\G0022892.JPG
A H:\Day2\100GOPRO\G0022893.JPG
A H:\Day2\100GOPRO\G0022894.JPG
A H:\Day2\100GOPRO\G0022895.JPG
A H:\Day2\100GOPRO\G0022896.JPG
A H:\Day2\100GOPRO\G0022897.JPG
A H:\Day2\100GOPRO\G0022898.JPG
A H:\Day2\100GOPRO\G0022899.JPG
A H:\Day2\100GOPRO\G0022900.JPG
A H:\Day2\100GOPRO\G0022901.JPG
A H:\Day2\100GOPRO\G0022902.JPG
A H:\Day2\100GOPRO\G0022903.JPG
A H:\Day2\100GOPRO\G0022904.JPG
A H:\Day2\100GOPRO\G0022905.JPG
A H:\Day2\100GOPRO\G0022906.JPG
A H:\Day2\100GOPRO\G0022907.JPG
A H:\Day2\100GOPRO\G0022908.JPG
A H:\Day2\100GOPRO\G0022909.JPG
A H:\Day2\100GOPRO\G0022910.JPG
A H:\Day2\100GOPRO\G0022911.JPG
A H:\Day2\100GOPRO\G0022912.JPG
A H:\Day2\100GOPRO\G0022913.JPG
A H:\Day2\100GOPRO\G0022914.JPG
A H:\Day2\100GOPRO\G0022915.JPG
A H:\Day2\100GOPRO\G0022916.JPG
A H:\Day2\100GOPRO\G0022917.JPG
A H:\Day2\100GOPRO\G0022918.JPG
A H:\Day2\100GOPRO\G0022919.JPG
A H:\Day2\100GOPRO\G0022920.JPG
A H:\Day2\100GOPRO\G0022921.JPG
A H:\Day2\100GOPRO\G0022922.JPG
A H:\Day2\100GOPRO\G0022923.JPG
A H:\Day2\100GOPRO\G0022924.JPG
A H:\Day2\100GOPRO\G0022925.JPG
A H:\Day2\100GOPRO\G0022926.JPG
A H:\Day2\100GOPRO\G0022927.JPG
A H:\Day2\100GOPRO\G0022928.JPG
A H:\Day2\100GOPRO\G0022929.JPG
A H:\Day2\100GOPRO\G0022930.JPG
A H:\Day2\100GOPRO\G0022931.JPG
A H:\Day2\100GOPRO\G0022932.JPG
A H:\Day2\100GOPRO\G0022933.JPG
A H:\Day2\100GOPRO\G0022934.JPG
A H:\Day2\100GOPRO\G0022935.JPG
A H:\Day2\100GOPRO\G0022936.JPG
A H:\Day2\100GOPRO\G0022937.JPG
A H:\Day2\100GOPRO\G0022938.JPG
A H:\Day2\100GOPRO\G0022939.JPG
A H:\Day2\100GOPRO\G0022940.JPG
A H:\Day2\100GOPRO\G0022941.JPG
A H:\Day2\100GOPRO\G0022942.JPG
A H:\Day2\100GOPRO\G0022943.JPG
A H:\Day2\100GOPRO\G0022944.JPG
A H:\Day2\100GOPRO\G0022945.JPG
A H:\Day2\100GOPRO\G0022946.JPG
A H:\Day2\100GOPRO\G0022947.JPG
A H:\Day2\100GOPRO\G0022948.JPG
A H:\Day2\100GOPRO\G0022949.JPG
A H:\Day2\100GOPRO\G0022950.JPG
A H:\Day2\100GOPRO\G0022951.JPG
A H:\Day2\100GOPRO\G0022952.JPG
A H:\Day2\100GOPRO\G0022953.JPG
A H:\Day2\100GOPRO\G0022954.JPG
A H:\Day2\100GOPRO\G0022955.JPG
A H:\Day2\100GOPRO\G0022956.JPG
A H:\Day2\100GOPRO\G0022957.JPG
A H:\Day2\100GOPRO\G0022958.JPG
A H:\Day2\100GOPRO\G0022959.JPG
A H:\Day2\100GOPRO\G0022960.JPG
A H:\Day2\100GOPRO\G0022961.JPG
A H:\Day2\100GOPRO\G0022962.JPG
A H:\Day2\100GOPRO\G0022963.JPG
A H:\Day2\100GOPRO\G0022964.JPG
A H:\Day2\100GOPRO\G0022965.JPG
A H:\Day2\100GOPRO\G0022966.JPG
A H:\Day2\100GOPRO\G0022967.JPG
A H:\Day2\100GOPRO\G0022968.JPG
A H:\Day2\100GOPRO\G0022969.JPG
A H:\Day2\100GOPRO\G0022970.JPG
A H:\Day2\100GOPRO\G0022971.JPG
A H:\Day2\100GOPRO\G0022972.JPG
A H:\Day2\100GOPRO\G0022973.JPG
A H:\Day2\100GOPRO\G0022974.JPG
A H:\Day2\100GOPRO\G0022975.JPG
A H:\Day2\100GOPRO\G0022976.JPG
A H:\Day2\100GOPRO\G0022977.JPG
A H:\Day2\100GOPRO\G0022978.JPG
A H:\Day2\100GOPRO\G0022979.JPG
A H:\Day2\100GOPRO\G0022980.JPG
A H:\Day2\100GOPRO\G0022981.JPG
A H:\Day2\100GOPRO\G0022982.JPG
A H:\Day2\100GOPRO\G0022983.JPG
A H:\Day2\100GOPRO\G0022984.JPG
A H:\Day2\100GOPRO\G0022985.JPG
A H:\Day2\100GOPRO\G0022986.JPG
A H:\Day2\100GOPRO\G0022987.JPG
A H:\Day2\100GOPRO\G0022988.JPG
A H:\Day2\100GOPRO\G0022989.JPG
A H:\Day2\100GOPRO\G0022990.JPG
A H:\Day2\100GOPRO\G0022991.JPG
A H:\Day2\100GOPRO\G0022992.JPG
A H:\Day2\100GOPRO\G0022993.JPG
A H:\Day2\100GOPRO\G0022994.JPG
A H:\Day2\100GOPRO\G0022995.JPG
A H:\Day2\100GOPRO\G0022996.JPG
A H:\Day2\100GOPRO\G0022997.JPG
A H:\Day2\100GOPRO\G0022998.JPG
A H:\Day2\100GOPRO\G0022999.JPG
A H:\Day2\100GOPRO\G0023000.JPG
A H:\Day2\100GOPRO\G0023001.JPG
A H:\Day2\100GOPRO\G0023002.JPG
A H:\Day2\100GOPRO\G0023003.JPG
A H:\Day2\100GOPRO\G0023004.JPG
A H:\Day2\100GOPRO\G0023005.JPG
A H:\Day2\100GOPRO\G0023006.JPG
A H:\Day2\100GOPRO\G0023007.JPG
A H:\Day2\100GOPRO\G0023008.JPG
A H:\Day2\100GOPRO\G0023009.JPG
A H:\Day2\100GOPRO\G0023010.JPG
A H:\Day2\100GOPRO\G0023011.JPG
A H:\Day2\100GOPRO\G0023012.JPG
A H:\Day2\100GOPRO\G0023013.JPG
A H:\Day2\100GOPRO\G0023014.JPG
A H:\Day2\100GOPRO\G0023015.JPG
A H:\Day2\100GOPRO\G0023016.JPG
A H:\Day2\100GOPRO\G0023017.JPG
A H:\Day2\100GOPRO\G0023018.JPG
A H:\Day2\100GOPRO\G0023019.JPG
A H:\Day2\100GOPRO\G0023020.JPG
A H:\Day2\100GOPRO\G0023021.JPG
A H:\Day2\100GOPRO\G0023022.JPG
A H:\Day2\100GOPRO\G0023023.JPG
A H:\Day2\100GOPRO\G0023024.JPG
A H:\Day2\100GOPRO\G0023025.JPG
A H:\Day2\100GOPRO\G0023026.JPG
A H:\Day2\100GOPRO\G0023027.JPG
A H:\Day2\100GOPRO\G0023028.JPG
A H:\Day2\100GOPRO\G0023029.JPG
A H:\Day2\100GOPRO\G0023030.JPG
A H:\Day2\100GOPRO\G0023031.JPG
A H:\Day2\100GOPRO\G0023032.JPG
A H:\Day2\100GOPRO\G0023033.JPG
A H:\Day2\100GOPRO\G0023034.JPG
A H:\Day2\100GOPRO\G0023035.JPG
A H:\Day2\100GOPRO\G0023036.JPG
A H:\Day2\100GOPRO\G0023037.JPG
A H:\Day2\100GOPRO\G0023038.JPG
A H:\Day2\100GOPRO\G0023039.JPG
A H:\Day2\100GOPRO\G0023040.JPG
A H:\Day2\100GOPRO\G0023041.JPG
A H:\Day2\100GOPRO\G0023042.JPG
A H:\Day2\100GOPRO\G0023043.JPG
A H:\Day2\100GOPRO\G0023044.JPG
A H:\Day2\100GOPRO\G0023045.JPG
A H:\Day2\100GOPRO\G0023046.JPG
A H:\Day2\100GOPRO\G0023047.JPG
A H:\Day2\100GOPRO\G0023048.JPG
A H:\Day2\100GOPRO\G0023049.JPG
A H:\Day2\100GOPRO\G0023050.JPG
A H:\Day2\100GOPRO\G0023051.JPG
A H:\Day2\100GOPRO\G0023052.JPG
A H:\Day2\100GOPRO\G0023053.JPG
A H:\Day2\100GOPRO\G0023054.JPG
A H:\Day2\100GOPRO\G0023055.JPG
A H:\Day2\100GOPRO\G0023056.JPG
A H:\Day2\100GOPRO\G0023057.JPG
A H:\Day2\100GOPRO\G0023058.JPG
A H:\Day2\100GOPRO\G0023059.JPG
A H:\Day2\100GOPRO\G0023060.JPG
A H:\Day2\100GOPRO\G0023061.JPG
A H:\Day2\100GOPRO\G0023062.JPG
A H:\Day2\100GOPRO\G0023063.JPG
A H:\Day2\100GOPRO\G0023064.JPG
A H:\Day2\100GOPRO\G0023065.JPG
A H:\Day2\100GOPRO\G0023066.JPG
A H:\Day2\100GOPRO\G0023067.JPG
A H:\Day2\100GOPRO\G0023068.JPG
A H:\Day2\100GOPRO\G0023069.JPG
A H:\Day2\100GOPRO\G0023070.JPG
A H:\Day2\100GOPRO\G0023071.JPG
A H:\Day2\100GOPRO\G0023072.JPG
A H:\Day2\100GOPRO\G0023073.JPG
A H:\Day2\100GOPRO\G0023074.JPG
A H:\Day2\100GOPRO\G0023075.JPG
A H:\Day2\100GOPRO\G0023076.JPG
A H:\Day2\100GOPRO\G0023077.JPG
A H:\Day2\100GOPRO\G0023078.JPG
A H:\Day2\100GOPRO\G0023079.JPG
A H:\Day2\100GOPRO\G0023080.JPG
A H:\Day2\100GOPRO\G0023081.JPG
A H:\Day2\100GOPRO\G0023082.JPG
A H:\Day2\100GOPRO\G0023083.JPG
A H:\Day2\100GOPRO\G0023084.JPG
A H:\Day2\100GOPRO\G0023085.JPG
A H:\Day2\100GOPRO\G0023086.JPG
A H:\Day2\100GOPRO\G0023087.JPG
A H:\Day2\100GOPRO\G0023088.JPG
A H:\Day2\100GOPRO\G0023089.JPG
A H:\Day2\100GOPRO\G0023090.JPG
A H:\Day2\100GOPRO\G0023091.JPG
A H:\Day2\100GOPRO\G0023092.JPG
A H:\Day2\100GOPRO\G0023093.JPG
A H:\Day2\100GOPRO\G0023094.JPG
A H:\Day2\100GOPRO\G0023095.JPG
A H:\Day2\100GOPRO\G0023096.JPG
A H:\Day2\100GOPRO\G0023097.JPG
A H:\Day2\100GOPRO\G0023098.JPG
A H:\Day2\100GOPRO\G0023099.JPG
A H:\Day2\100GOPRO\G0023100.JPG
A H:\Day2\100GOPRO\G0023101.JPG
A H:\Day2\100GOPRO\G0023102.JPG
A H:\Day2\100GOPRO\G0023103.JPG
A H:\Day2\100GOPRO\G0023104.JPG
A H:\Day2\100GOPRO\G0023105.JPG
A H:\Day2\100GOPRO\G0023106.JPG
A H:\Day2\100GOPRO\G0023107.JPG
A H:\Day2\100GOPRO\G0023108.JPG
A H:\Day2\100GOPRO\G0023109.JPG
A H:\Day2\100GOPRO\G0023110.JPG
A H:\Day2\100GOPRO\G0023111.JPG
A H:\Day2\100GOPRO\G0023112.JPG
A H:\Day2\100GOPRO\G0023113.JPG
A H:\Day2\100GOPRO\G0023114.JPG
A H:\Day2\100GOPRO\G0023115.JPG
A H:\Day2\100GOPRO\G0023116.JPG
A H:\Day2\100GOPRO\G0023117.JPG
A H:\Day2\100GOPRO\G0023118.JPG
A H:\Day2\100GOPRO\G0023119.JPG
A H:\Day2\100GOPRO\G0023120.JPG
A H:\Day2\100GOPRO\G0023121.JPG
A H:\Day2\100GOPRO\G0023122.JPG
A H:\Day2\100GOPRO\G0023123.JPG
A H:\Day2\100GOPRO\G0023124.JPG
A H:\Day2\100GOPRO\G0023125.JPG
A H:\Day2\100GOPRO\G0023126.JPG
A H:\Day2\100GOPRO\G0023127.JPG
A H:\Day2\100GOPRO\G0023128.JPG
A H:\Day2\100GOPRO\G0023129.JPG
A H:\Day2\100GOPRO\G0023130.JPG
A H:\Day2\100GOPRO\G0023131.JPG
A H:\Day2\100GOPRO\G0023132.JPG
A H:\Day2\100GOPRO\G0023133.JPG
A H:\Day2\100GOPRO\G0023134.JPG
A H:\Day2\100GOPRO\G0023135.JPG
A H:\Day2\100GOPRO\G0023136.JPG
A H:\Day2\100GOPRO\G0023137.JPG
A H:\Day2\100GOPRO\G0023138.JPG
A H:\Day2\100GOPRO\G0023139.JPG
A H:\Day2\100GOPRO\G0023140.JPG
A H:\Day2\100GOPRO\G0023141.JPG
A H:\Day2\100GOPRO\G0023142.JPG
A H:\Day2\100GOPRO\G0023143.JPG
A H:\Day2\100GOPRO\G0023144.JPG
A H:\Day2\100GOPRO\G0023145.JPG
A H:\Day2\100GOPRO\G0023146.JPG
A H:\Day2\100GOPRO\G0023147.JPG
A H:\Day2\100GOPRO\G0023148.JPG
A H:\Day2\100GOPRO\G0023149.JPG
A H:\Day2\100GOPRO\G0023150.JPG
A H:\Day2\100GOPRO\G0023151.JPG
A H:\Day2\100GOPRO\G0023152.JPG
A H:\Day2\100GOPRO\G0023153.JPG
A H:\Day2\100GOPRO\G0023154.JPG
A H:\Day2\100GOPRO\G0023155.JPG
A H:\Day2\100GOPRO\G0023156.JPG
A H:\Day2\100GOPRO\G0023157.JPG
A H:\Day2\100GOPRO\G0023158.JPG
A H:\Day2\100GOPRO\G0023159.JPG
A H:\Day2\100GOPRO\G0023160.JPG
A H:\Day2\100GOPRO\G0023161.JPG
A H:\Day2\100GOPRO\G0023162.JPG
A H:\Day2\100GOPRO\G0023163.JPG
A H:\Day2\100GOPRO\G0023164.JPG
A H:\Day2\100GOPRO\G0023165.JPG
A H:\Day2\100GOPRO\G0023166.JPG
A H:\Day2\100GOPRO\G0023167.JPG
A H:\Day2\100GOPRO\G0023168.JPG
A H:\Day2\100GOPRO\G0023169.JPG
A H:\Day2\100GOPRO\G0023170.JPG
A H:\Day2\100GOPRO\G0023171.JPG
A H:\Day2\100GOPRO\G0023172.JPG
A H:\Day2\100GOPRO\G0023173.JPG
A H:\Day2\100GOPRO\G0023174.JPG
A H:\Day2\100GOPRO\G0023175.JPG
A H:\Day2\100GOPRO\G0023176.JPG
A H:\Day2\100GOPRO\G0023177.JPG
A H:\Day2\100GOPRO\G0023178.JPG
A H:\Day2\100GOPRO\G0023179.JPG
A H:\Day2\100GOPRO\G0023180.JPG
A H:\Day2\100GOPRO\G0023181.JPG
A H:\Day2\100GOPRO\G0023182.JPG
A H:\Day2\100GOPRO\G0023183.JPG
A H:\Day2\100GOPRO\G0023184.JPG
A H:\Day2\100GOPRO\G0023185.JPG
A H:\Day2\100GOPRO\G0023186.JPG
A H:\Day2\100GOPRO\G0023187.JPG
A H:\Day2\100GOPRO\G0023188.JPG
A H:\Day2\100GOPRO\G0023189.JPG
A H:\Day2\100GOPRO\G0023190.JPG
A H:\Day2\100GOPRO\G0023191.JPG
A H:\Day2\100GOPRO\G0023192.JPG
A H:\Day2\100GOPRO\G0023193.JPG
A H:\Day2\100GOPRO\G0023194.JPG
A H:\Day2\100GOPRO\G0023195.JPG
A H:\Day2\100GOPRO\G0023196.JPG
A H:\Day2\100GOPRO\G0023197.JPG
A H:\Day2\100GOPRO\G0023198.JPG
A H:\Day2\100GOPRO\G0023199.JPG
A H:\Day2\100GOPRO\G0023200.JPG
A H:\Day2\100GOPRO\G0023201.JPG
A H:\Day2\100GOPRO\G0023202.JPG
A H:\Day2\100GOPRO\G0023203.JPG
A H:\Day2\100GOPRO\G0023204.JPG
A H:\Day2\100GOPRO\G0023205.JPG
A H:\Day2\100GOPRO\G0023206.JPG
A H:\Day2\100GOPRO\G0023207.JPG
A H:\Day2\100GOPRO\G0023208.JPG
A H:\Day2\100GOPRO\G0023209.JPG
A H:\Day2\100GOPRO\G0023210.JPG
A H:\Day2\100GOPRO\G0023211.JPG
A H:\Day2\100GOPRO\G0023212.JPG
A H:\Day2\100GOPRO\G0023213.JPG
A H:\Day2\100GOPRO\G0023214.JPG
A H:\Day2\100GOPRO\G0023215.JPG
A H:\Day2\100GOPRO\G0023216.JPG
A H:\Day2\100GOPRO\G0023217.JPG
A H:\Day2\100GOPRO\G0023218.JPG
A H:\Day2\100GOPRO\G0023219.JPG
A H:\Day2\100GOPRO\G0023220.JPG
A H:\Day2\100GOPRO\G0023221.JPG
A H:\Day2\100GOPRO\G0023222.JPG
A H:\Day2\100GOPRO\G0023223.JPG
A H:\Day2\100GOPRO\G0023224.JPG
A H:\Day2\100GOPRO\G0023225.JPG
A H:\Day2\100GOPRO\G0023226.JPG
A H:\Day2\100GOPRO\G0023227.JPG
A H:\Day2\100GOPRO\G0023228.JPG
A H:\Day2\100GOPRO\G0023229.JPG
A H:\Day2\100GOPRO\G0023230.JPG
A H:\Day2\100GOPRO\G0023231.JPG
A H:\Day2\100GOPRO\G0023232.JPG
A H:\Day2\100GOPRO\G0023233.JPG
A H:\Day2\100GOPRO\G0023234.JPG
A H:\Day2\100GOPRO\G0023235.JPG
A H:\Day2\100GOPRO\G0023236.JPG
A H:\Day2\100GOPRO\G0023237.JPG
A H:\Day2\100GOPRO\G0023238.JPG
A H:\Day2\100GOPRO\G0023239.JPG
A H:\Day2\100GOPRO\G0023240.JPG
A H:\Day2\100GOPRO\G0023241.JPG
A H:\Day2\100GOPRO\G0023242.JPG
A H:\Day2\100GOPRO\G0023243.JPG
A H:\Day2\100GOPRO\G0023244.JPG
A H:\Day2\100GOPRO\G0023245.JPG
A H:\Day2\100GOPRO\G0023246.JPG
A H:\Day2\100GOPRO\G0023247.JPG
A H:\Day2\100GOPRO\G0023248.JPG
A H:\Day2\100GOPRO\G0023249.JPG
A H:\Day2\100GOPRO\G0023250.JPG
A H:\Day2\100GOPRO\G0023251.JPG
A H:\Day2\100GOPRO\G0023252.JPG
A H:\Day2\100GOPRO\G0023253.JPG
A H:\Day2\100GOPRO\G0023254.JPG
A H:\Day2\100GOPRO\G0023255.JPG
A H:\Day2\100GOPRO\G0023256.JPG
A H:\Day2\100GOPRO\G0023257.JPG
A H:\Day2\100GOPRO\G0023258.JPG
A H:\Day2\100GOPRO\G0023259.JPG
A H:\Day2\100GOPRO\G0023260.JPG
A H:\Day2\100GOPRO\G0023261.JPG
A H:\Day2\100GOPRO\G0023262.JPG
A H:\Day2\100GOPRO\G0023263.JPG
A H:\Day2\100GOPRO\G0023264.JPG
A H:\Day2\100GOPRO\G0023265.JPG
A H:\Day2\100GOPRO\G0023266.JPG
A H:\Day2\100GOPRO\G0023267.JPG
A H:\Day2\100GOPRO\G0023268.JPG
A H:\Day2\100GOPRO\G0023269.JPG
A H:\Day2\100GOPRO\G0023270.JPG
A H:\Day2\100GOPRO\G0023271.JPG
A H:\Day2\100GOPRO\G0023272.JPG
A H:\Day2\100GOPRO\G0023273.JPG
A H:\Day2\100GOPRO\G0023274.JPG
A H:\Day2\100GOPRO\G0023275.JPG
A H:\Day2\100GOPRO\G0023276.JPG
A H:\Day2\100GOPRO\G0023277.JPG
A H:\Day2\100GOPRO\G0023278.JPG
A H:\Day2\100GOPRO\G0023279.JPG
A H:\Day2\100GOPRO\G0023280.JPG
A H:\Day2\100GOPRO\G0023281.JPG
A H:\Day2\100GOPRO\G0023282.JPG
A H:\Day2\100GOPRO\G0023283.JPG
A H:\Day2\100GOPRO\G0023284.JPG
A H:\Day2\100GOPRO\G0023285.JPG
A H:\Day2\100GOPRO\G0023286.JPG
A H:\Day2\100GOPRO\G0023287.JPG
A H:\Day2\100GOPRO\G0023288.JPG
A H:\Day2\100GOPRO\G0023289.JPG
A H:\Day2\100GOPRO\G0023290.JPG
A H:\Day2\100GOPRO\G0023291.JPG
A H:\Day2\100GOPRO\G0023292.JPG
A H:\Day2\100GOPRO\G0023293.JPG
A H:\Day2\100GOPRO\G0023294.JPG
A H:\Day2\100GOPRO\G0023295.JPG
A H:\Day2\100GOPRO\G0023296.JPG
A H:\Day2\100GOPRO\G0023297.JPG
A H:\Day2\100GOPRO\G0023298.JPG
A H:\Day2\100GOPRO\G0023299.JPG
A H:\Day2\100GOPRO\G0023300.JPG
A H:\Day2\100GOPRO\G0023301.JPG
A H:\Day2\100GOPRO\G0023302.JPG
A H:\Day2\100GOPRO\G0023303.JPG
A H:\Day2\100GOPRO\G0023304.JPG
A H:\Day2\100GOPRO\G0023305.JPG
A H:\Day2\100GOPRO\G0023306.JPG
A H:\Day2\100GOPRO\G0023307.JPG
A H:\Day2\100GOPRO\G0023308.JPG
A H:\Day2\100GOPRO\G0023309.JPG
A H:\Day2\100GOPRO\G0023310.JPG
A H:\Day2\100GOPRO\G0023311.JPG
A H:\Day2\100GOPRO\G0023312.JPG
A H:\Day2\100GOPRO\G0023313.JPG
A H:\Day2\100GOPRO\G0023314.JPG
A H:\Day2\100GOPRO\G0023315.JPG
A H:\Day2\100GOPRO\G0023316.JPG
A H:\Day2\100GOPRO\G0023317.JPG
A H:\Day2\100GOPRO\G0023318.JPG
A H:\Day2\100GOPRO\G0023319.JPG
A H:\Day2\100GOPRO\G0023320.JPG
A H:\Day2\100GOPRO\G0023321.JPG
A H:\Day2\100GOPRO\G0023322.JPG
A H:\Day2\100GOPRO\G0023323.JPG
A H:\Day2\100GOPRO\G0023324.JPG
A H:\Day2\100GOPRO\G0023325.JPG
A H:\Day2\100GOPRO\G0023326.JPG
A H:\Day2\100GOPRO\G0023327.JPG
A H:\Day2\100GOPRO\G0023328.JPG
A H:\Day2\100GOPRO\G0023329.JPG
A H:\Day2\100GOPRO\G0023330.JPG
A H:\Day2\100GOPRO\G0023331.JPG
A H:\Day2\100GOPRO\G0023332.JPG
A H:\Day2\100GOPRO\G0023333.JPG
A H:\Day2\100GOPRO\G0023334.JPG
A H:\Day2\100GOPRO\G0023335.JPG
A H:\Day2\100GOPRO\G0023336.JPG
A H:\Day2\100GOPRO\G0023337.JPG
A H:\Day2\100GOPRO\G0023338.JPG
A H:\Day2\100GOPRO\G0023339.JPG
A H:\Day2\100GOPRO\G0023340.JPG
A H:\Day2\100GOPRO\G0023341.JPG
A H:\Day2\100GOPRO\G0023342.JPG
A H:\Day2\100GOPRO\G0023343.JPG
A H:\Day2\100GOPRO\G0023344.JPG
A H:\Day2\100GOPRO\G0023345.JPG
A H:\Day2\100GOPRO\G0023346.JPG
A H:\Day2\100GOPRO\G0023347.JPG
A H:\Day2\100GOPRO\G0023348.JPG
A H:\Day2\100GOPRO\G0023349.JPG
A H:\Day2\100GOPRO\G0023350.JPG
A H:\Day2\100GOPRO\G0023351.JPG
A H:\Day2\100GOPRO\G0023352.JPG
A H:\Day2\100GOPRO\G0023353.JPG
A H:\Day2\100GOPRO\G0023354.JPG
A H:\Day2\100GOPRO\G0023355.JPG
A H:\Day2\100GOPRO\G0023356.JPG
A H:\Day2\100GOPRO\G0023357.JPG
A H:\Day2\100GOPRO\G0023358.JPG
A H:\Day2\100GOPRO\G0023359.JPG
A H:\Day2\100GOPRO\G0023360.JPG
A H:\Day2\100GOPRO\G0023361.JPG
A H:\Day2\100GOPRO\G0023362.JPG
A H:\Day2\100GOPRO\G0023363.JPG
A H:\Day2\100GOPRO\G0023364.JPG
A H:\Day2\100GOPRO\G0023365.JPG
A H:\Day2\100GOPRO\G0023366.JPG
A H:\Day2\100GOPRO\G0023367.JPG
A H:\Day2\100GOPRO\G0023368.JPG
A H:\Day2\100GOPRO\G0023369.JPG
A H:\Day2\100GOPRO\G0023370.JPG
A H:\Day2\100GOPRO\G0023371.JPG
A H:\Day2\100GOPRO\G0023372.JPG
A H:\Day2\100GOPRO\G0023373.JPG
A H:\Day2\100GOPRO\G0023374.JPG
A H:\Day2\100GOPRO\G0023375.JPG
A H:\Day2\100GOPRO\G0023376.JPG
A H:\Day2\100GOPRO\G0023377.JPG
A H:\Day2\100GOPRO\G0023378.JPG
A H:\Day2\100GOPRO\G0023379.JPG
A H:\Day2\100GOPRO\G0023380.JPG
A H:\Day2\100GOPRO\G0023381.JPG
A H:\Day2\100GOPRO\G0023382.JPG
A H:\Day2\100GOPRO\G0023383.JPG
A H:\Day2\100GOPRO\G0023384.JPG
A H:\Day2\100GOPRO\G0023385.JPG
A H:\Day2\100GOPRO\G0023386.JPG
A H:\Day2\100GOPRO\G0023387.JPG
A H:\Day2\100GOPRO\G0023388.JPG
A H:\Day2\100GOPRO\G0023389.JPG
A H:\Day2\100GOPRO\G0023390.JPG
A H:\Day2\100GOPRO\G0023391.JPG
A H:\Day2\100GOPRO\G0023392.JPG
A H:\Day2\100GOPRO\G0023393.JPG
A H:\Day2\100GOPRO\G0023394.JPG
A H:\Day2\100GOPRO\G0023395.JPG
A H:\Day2\100GOPRO\G0023396.JPG
A H:\Day2\100GOPRO\G0023397.JPG
A H:\Day2\100GOPRO\G0023398.JPG
A H:\Day2\100GOPRO\G0023399.JPG
A H:\Day2\100GOPRO\G0023400.JPG
A H:\Day2\100GOPRO\G0023401.JPG
A H:\Day2\100GOPRO\G0023402.JPG
A H:\Day2\100GOPRO\G0023403.JPG
A H:\Day2\100GOPRO\G0023404.JPG
A H:\Day2\100GOPRO\G0023405.JPG
A H:\Day2\100GOPRO\G0023406.JPG
A H:\Day2\100GOPRO\G0023407.JPG
A H:\Day2\100GOPRO\G0023408.JPG
A H:\Day2\100GOPRO\G0023409.JPG
A H:\Day2\100GOPRO\G0023410.JPG
A H:\Day2\100GOPRO\G0023411.JPG
A H:\Day2\100GOPRO\G0023412.JPG
A H:\Day2\100GOPRO\G0023413.JPG
A H:\Day2\100GOPRO\G0023414.JPG
A H:\Day2\100GOPRO\G0023415.JPG
A H:\Day2\100GOPRO\G0023416.JPG
A H:\Day2\100GOPRO\G0023417.JPG
A H:\Day2\100GOPRO\G0023418.JPG
A H:\Day2\100GOPRO\G0023419.JPG
A H:\Day2\100GOPRO\G0023420.JPG
A H:\Day2\100GOPRO\G0023421.JPG
A H:\Day2\100GOPRO\G0023422.JPG
A H:\Day2\100GOPRO\G0023423.JPG
A H:\Day2\100GOPRO\G0023424.JPG
A H:\Day2\100GOPRO\G0023425.JPG
A H:\Day2\100GOPRO\G0023426.JPG
A H:\Day2\100GOPRO\G0023427.JPG
A H:\Day2\100GOPRO\G0023428.JPG
A H:\Day2\100GOPRO\G0023429.JPG
A H:\Day2\100GOPRO\G0023430.JPG
A H:\Day2\100GOPRO\G0023431.JPG
A H:\Day2\100GOPRO\G0023432.JPG
A H:\Day2\100GOPRO\G0023433.JPG
A H:\Day2\100GOPRO\G0023434.JPG
A H:\Day2\100GOPRO\G0023435.JPG
A H:\Day2\100GOPRO\G0023436.JPG
A H:\Day2\100GOPRO\G0023437.JPG
A H:\Day2\100GOPRO\G0023438.JPG
A H:\Day2\100GOPRO\G0023439.JPG
A H:\Day2\100GOPRO\G0023440.JPG
A H:\Day2\100GOPRO\G0023441.JPG
A H:\Day2\100GOPRO\G0023442.JPG
A H:\Day2\100GOPRO\G0023443.JPG
A H:\Day2\100GOPRO\G0023444.JPG
A H:\Day2\100GOPRO\G0023445.JPG
A H:\Day2\100GOPRO\G0023446.JPG
A H:\Day2\100GOPRO\G0023447.JPG
A H:\Day2\100GOPRO\G0023448.JPG
A H:\Day2\100GOPRO\G0023449.JPG
A H:\Day2\100GOPRO\G0023450.JPG
A H:\Day2\100GOPRO\G0023451.JPG
A H:\Day2\100GOPRO\G0023452.JPG
A H:\Day2\100GOPRO\G0023453.JPG
A H:\Day2\100GOPRO\G0023454.JPG
A H:\Day2\100GOPRO\G0023455.JPG
A H:\Day2\100GOPRO\G0023456.JPG
A H:\Day2\100GOPRO\G0023457.JPG
A H:\Day2\100GOPRO\G0023458.JPG
A H:\Day2\100GOPRO\G0023459.JPG
A H:\Day2\100GOPRO\G0023460.JPG
A H:\Day2\100GOPRO\G0023461.JPG
A H:\Day2\100GOPRO\G0023462.JPG
A H:\Day2\100GOPRO\G0023463.JPG
A H:\Day2\100GOPRO\G0023464.JPG
A H:\Day2\100GOPRO\G0023465.JPG
A H:\Day2\100GOPRO\G0023466.JPG
A H:\Day2\100GOPRO\G0023467.JPG
A H:\Day2\100GOPRO\G0023468.JPG
A H:\Day2\100GOPRO\G0023469.JPG
A H:\Day2\100GOPRO\G0023470.JPG
A H:\Day2\100GOPRO\G0023471.JPG
A H:\Day2\100GOPRO\G0023472.JPG
A H:\Day2\100GOPRO\G0023473.JPG
A H:\Day2\100GOPRO\G0023474.JPG
A H:\Day2\100GOPRO\G0023475.JPG
A H:\Day2\100GOPRO\G0023476.JPG
A H:\Day2\100GOPRO\G0023477.JPG
A H:\Day2\100GOPRO\G0023478.JPG
A H:\Day2\100GOPRO\G0023479.JPG
A H:\Day2\100GOPRO\G0023480.JPG
A H:\Day2\100GOPRO\G0023481.JPG
A H:\Day2\100GOPRO\G0023482.JPG
A H:\Day2\100GOPRO\G0023483.JPG
A H:\Day2\100GOPRO\G0023484.JPG
A H:\Day2\100GOPRO\G0023485.JPG
A H:\Day2\100GOPRO\G0023486.JPG
A H:\Day2\100GOPRO\G0023487.JPG
A H:\Day2\100GOPRO\G0023488.JPG
A H:\Day2\100GOPRO\G0023489.JPG
A H:\Day2\100GOPRO\G0023490.JPG
A H:\Day2\100GOPRO\G0023491.JPG
A H:\Day2\100GOPRO\G0023492.JPG
A H:\Day2\100GOPRO\G0023493.JPG
A H:\Day2\100GOPRO\G0023494.JPG
A H:\Day2\100GOPRO\G0023495.JPG
A H:\Day2\100GOPRO\G0023496.JPG
A H:\Day2\100GOPRO\G0023497.JPG
A H:\Day2\100GOPRO\G0023498.JPG
A H:\Day2\100GOPRO\G0023499.JPG
A H:\Day2\100GOPRO\G0023500.JPG
A H:\Day2\100GOPRO\G0023501.JPG
A H:\Day2\100GOPRO\G0023502.JPG
A H:\Day2\100GOPRO\G0023503.JPG
A H:\Day2\100GOPRO\G0023504.JPG
A H:\Day2\100GOPRO\G0023505.JPG
A H:\Day2\100GOPRO\G0023506.JPG
A H:\Day2\100GOPRO\G0023507.JPG
A H:\Day2\100GOPRO\G0023508.JPG
A H:\Day2\100GOPRO\G0023509.JPG
A H:\Day2\100GOPRO\G0023510.JPG
A H:\Day2\100GOPRO\G0023511.JPG
A H:\Day2\100GOPRO\G0023512.JPG
A H:\Day2\100GOPRO\G0023513.JPG
A H:\Day2\100GOPRO\G0023514.JPG
A H:\Day2\100GOPRO\G0023515.JPG
A H:\Day2\100GOPRO\G0023516.JPG
A H:\Day2\100GOPRO\G0023517.JPG
A H:\Day2\100GOPRO\G0023518.JPG
A H:\Day2\100GOPRO\G0023519.JPG
A H:\Day2\100GOPRO\G0023520.JPG
A H:\Day2\100GOPRO\G0023521.JPG
A H:\Day2\100GOPRO\G0023522.JPG
A H:\Day2\100GOPRO\G0023523.JPG
A H:\Day2\100GOPRO\G0023524.JPG
A H:\Day2\100GOPRO\G0023525.JPG
A H:\Day2\100GOPRO\G0023526.JPG
A H:\Day2\100GOPRO\G0023527.JPG
A H:\Day2\100GOPRO\G0023528.JPG
A H:\Day2\100GOPRO\G0023529.JPG
A H:\Day2\100GOPRO\G0023530.JPG
A H:\Day2\100GOPRO\G0023531.JPG
A H:\Day2\100GOPRO\G0023532.JPG
A H:\Day2\100GOPRO\G0023533.JPG
A H:\Day2\100GOPRO\G0023534.JPG
A H:\Day2\100GOPRO\G0023535.JPG
A H:\Day2\100GOPRO\G0023536.JPG
A H:\Day2\100GOPRO\G0023537.JPG
A H:\Day2\100GOPRO\G0023538.JPG
A H:\Day2\100GOPRO\G0023539.JPG
A H:\Day2\100GOPRO\G0023540.JPG
A H:\Day2\100GOPRO\G0023541.JPG
A H:\Day2\100GOPRO\G0023542.JPG
A H:\Day2\100GOPRO\G0023543.JPG
A H:\Day2\100GOPRO\G0023544.JPG
A H:\Day2\100GOPRO\G0023545.JPG
A H:\Day2\100GOPRO\G0023546.JPG
A H:\Day2\100GOPRO\G0023547.JPG
A H:\Day2\100GOPRO\G0023548.JPG
A H:\Day2\100GOPRO\G0023549.JPG
A H:\Day2\100GOPRO\G0023550.JPG
A H:\Day2\100GOPRO\G0023551.JPG
A H:\Day2\100GOPRO\G0023552.JPG
A H:\Day2\100GOPRO\G0023553.JPG
A H:\Day2\100GOPRO\G0023554.JPG
A H:\Day2\100GOPRO\G0023555.JPG
A H:\Day2\100GOPRO\G0023556.JPG
A H:\Day2\100GOPRO\G0023557.JPG
A H:\Day2\100GOPRO\G0023558.JPG
A H:\Day2\100GOPRO\G0023559.JPG
A H:\Day2\100GOPRO\G0023560.JPG
A H:\Day2\100GOPRO\G0023561.JPG
A H:\Day2\100GOPRO\G0023562.JPG
A H:\Day2\100GOPRO\G0023563.JPG
A H:\Day2\100GOPRO\G0023564.JPG
A H:\Day2\100GOPRO\G0023565.JPG
A H:\Day2\100GOPRO\G0023566.JPG
A H:\Day2\100GOPRO\G0023567.JPG
A H:\Day2\100GOPRO\G0023568.JPG
A H:\Day2\100GOPRO\G0023569.JPG
A H:\Day2\100GOPRO\G0023570.JPG
A H:\Day2\100GOPRO\G0023571.JPG
A H:\Day2\100GOPRO\G0023572.JPG
A H:\Day2\100GOPRO\G0023573.JPG
A H:\Day2\100GOPRO\G0023574.JPG
A H:\Day2\100GOPRO\G0023575.JPG
A H:\Day2\100GOPRO\G0023576.JPG
A H:\Day2\100GOPRO\G0023577.JPG
A H:\Day2\100GOPRO\G0023578.JPG
A H:\Day2\100GOPRO\G0023579.JPG
A H:\Day2\100GOPRO\G0023580.JPG
A H:\Day2\100GOPRO\G0023581.JPG
A H:\Day2\100GOPRO\G0023582.JPG
A H:\Day2\100GOPRO\G0023583.JPG
A H:\Day2\100GOPRO\G0023584.JPG
A H:\Day2\100GOPRO\G0023585.JPG
A H:\Day2\100GOPRO\G0023586.JPG
A H:\Day2\100GOPRO\G0023587.JPG
A H:\Day2\100GOPRO\G0023588.JPG
A H:\Day2\100GOPRO\G0023589.JPG
A H:\Day2\100GOPRO\G0023590.JPG
A H:\Day2\100GOPRO\G0023591.JPG
A H:\Day2\100GOPRO\G0023592.JPG
A H:\Day2\100GOPRO\G0023593.JPG
A H:\Day2\100GOPRO\G0023594.JPG
A H:\Day2\100GOPRO\G0023595.JPG
A H:\Day2\100GOPRO\G0023596.JPG
A H:\Day2\100GOPRO\G0023597.JPG
A H:\Day2\100GOPRO\G0023598.JPG
A H:\Day2\100GOPRO\G0023599.JPG
A H:\Day2\100GOPRO\G0023600.JPG
A H:\Day2\100GOPRO\G0023601.JPG
A H:\Day2\100GOPRO\G0023602.JPG
A H:\Day2\100GOPRO\G0023603.JPG
A H:\Day2\100GOPRO\G0023604.JPG
A H:\Day2\100GOPRO\G0023605.JPG
A H:\Day2\100GOPRO\G0023606.JPG
A H:\Day2\100GOPRO\G0023607.JPG
A H:\Day2\100GOPRO\G0023608.JPG
A H:\Day2\100GOPRO\G0023609.JPG
A H:\Day2\100GOPRO\G0023610.JPG
A H:\Day2\100GOPRO\G0023611.JPG
A H:\Day2\100GOPRO\G0023612.JPG
A H:\Day2\100GOPRO\G0023613.JPG
A H:\Day2\100GOPRO\G0023614.JPG
A H:\Day2\100GOPRO\G0023615.JPG
A H:\Day2\100GOPRO\G0023616.JPG
A H:\Day2\100GOPRO\G0023617.JPG
A H:\Day2\100GOPRO\G0023618.JPG
A H:\Day2\100GOPRO\G0023619.JPG
A H:\Day2\100GOPRO\G0023620.JPG
A H:\Day2\100GOPRO\G0023621.JPG
A H:\Day2\100GOPRO\G0023622.JPG
A H:\Day2\100GOPRO\G0023623.JPG
A H:\Day2\100GOPRO\G0023624.JPG
A H:\Day2\100GOPRO\G0023625.JPG
A H:\Day2\100GOPRO\G0023626.JPG
A H:\Day2\100GOPRO\G0023627.JPG
A H:\Day2\100GOPRO\G0023628.JPG
A H:\Day2\100GOPRO\G0023629.JPG
A H:\Day2\100GOPRO\G0023630.JPG
A H:\Day2\100GOPRO\G0023631.JPG
A H:\Day2\100GOPRO\G0023632.JPG
A H:\Day2\100GOPRO\G0023633.JPG
A H:\Day2\100GOPRO\G0023634.JPG
A H:\Day2\100GOPRO\G0023635.JPG
A H:\Day2\100GOPRO\G0023636.JPG
A H:\Day2\100GOPRO\G0023637.JPG
A H:\Day2\100GOPRO\G0023638.JPG
A H:\Day2\100GOPRO\G0023639.JPG
A H:\Day2\100GOPRO\G0023640.JPG
A H:\Day2\100GOPRO\G0023641.JPG
A H:\Day2\100GOPRO\G0023642.JPG
A H:\Day2\100GOPRO\G0023643.JPG
A H:\Day2\100GOPRO\G0023644.JPG
A H:\Day2\100GOPRO\G0023645.JPG
A H:\Day2\100GOPRO\G0023646.JPG
A H:\Day2\100GOPRO\G0023647.JPG
A H:\Day2\100GOPRO\G0023648.JPG
A H:\Day2\100GOPRO\G0023649.JPG
A H:\Day2\100GOPRO\G0023650.JPG
A H:\Day2\100GOPRO\G0023651.JPG
A H:\Day2\100GOPRO\G0023652.JPG
A H:\Day2\100GOPRO\G0023653.JPG
A H:\Day2\100GOPRO\G0023654.JPG
A H:\Day2\100GOPRO\G0023655.JPG
A H:\Day2\100GOPRO\G0023656.JPG
A H:\Day2\100GOPRO\G0023657.JPG
A H:\Day2\100GOPRO\G0023658.JPG
A H:\Day2\100GOPRO\G0023659.JPG
A H:\Day2\100GOPRO\G0023660.JPG
A H:\Day2\100GOPRO\G0023661.JPG
A H:\Day2\100GOPRO\G0023662.JPG
A H:\Day2\100GOPRO\G0023663.JPG
A H:\Day2\100GOPRO\G0023664.JPG
A H:\Day2\100GOPRO\G0023665.JPG
A H:\Day2\100GOPRO\G0023666.JPG
A H:\Day2\100GOPRO\G0023667.JPG
A H:\Day2\100GOPRO\G0023668.JPG
A H:\Day2\100GOPRO\G0023669.JPG
A H:\Day2\100GOPRO\G0023670.JPG
A H:\Day2\100GOPRO\G0023671.JPG
A H:\Day2\100GOPRO\G0023672.JPG
A H:\Day2\100GOPRO\G0023673.JPG
A H:\Day2\100GOPRO\G0023674.JPG
A H:\Day2\100GOPRO\G0023675.JPG
A H:\Day2\100GOPRO\G0023676.JPG
A H:\Day2\100GOPRO\G0023677.JPG
A H:\Day2\100GOPRO\G0023678.JPG
A H:\Day2\100GOPRO\G0023679.JPG
A H:\Day2\100GOPRO\G0023680.JPG
A H:\Day2\100GOPRO\G0023681.JPG
A H:\Day2\100GOPRO\G0023682.JPG
A H:\Day2\100GOPRO\G0023683.JPG
A H:\Day2\100GOPRO\G0023684.JPG
A H:\Day2\100GOPRO\G0023685.JPG
A H:\Day2\100GOPRO\G0023686.JPG
A H:\Day2\100GOPRO\G0023687.JPG
A H:\Day2\100GOPRO\G0023688.JPG
A H:\Day2\100GOPRO\G0023689.JPG
A H:\Day2\100GOPRO\G0023690.JPG
A H:\Day2\100GOPRO\G0023691.JPG
A H:\Day2\100GOPRO\G0023692.JPG
A H:\Day2\100GOPRO\G0023693.JPG
A H:\Day2\100GOPRO\G0023694.JPG
A H:\Day2\100GOPRO\G0023695.JPG
A H:\Day2\100GOPRO\G0023696.JPG
A H:\Day2\100GOPRO\G0023697.JPG
A H:\Day2\100GOPRO\G0023698.JPG
A H:\Day2\100GOPRO\G0023699.JPG
A H:\Day2\100GOPRO\G0023700.JPG
A H:\Day2\100GOPRO\G0023701.JPG
A H:\Day2\100GOPRO\G0023702.JPG
A H:\Day2\100GOPRO\G0023703.JPG
A H:\Day2\100GOPRO\G0023704.JPG
A H:\Day2\100GOPRO\G0023705.JPG
A H:\Day2\100GOPRO\G0023706.JPG
A H:\Day2\100GOPRO\G0023707.JPG
A H:\Day2\100GOPRO\G0023708.JPG
A H:\Day2\100GOPRO\G0023709.JPG
A H:\Day2\100GOPRO\G0023710.JPG
A H:\Day2\100GOPRO\G0023711.JPG
A H:\Day2\100GOPRO\G0023712.JPG
A H:\Day2\100GOPRO\G0023713.JPG
A H:\Day2\100GOPRO\G0023714.JPG
A H:\Day2\100GOPRO\G0023715.JPG
A H:\Day2\100GOPRO\G0023716.JPG
A H:\Day2\100GOPRO\G0023717.JPG
A H:\Day2\100GOPRO\G0023718.JPG
A H:\Day2\100GOPRO\G0023719.JPG
A H:\Day2\100GOPRO\G0023720.JPG
A H:\Day2\100GOPRO\G0023721.JPG
A H:\Day2\100GOPRO\G0023722.JPG
A H:\Day2\100GOPRO\G0023723.JPG
A H:\Day2\100GOPRO\G0023724.JPG
A H:\Day2\100GOPRO\G0023725.JPG
A H:\Day2\100GOPRO\G0023726.JPG
A H:\Day2\100GOPRO\G0023727.JPG
A H:\Day2\100GOPRO\G0023728.JPG
A H:\Day2\100GOPRO\G0023729.JPG
A H:\Day2\100GOPRO\G0023730.JPG
A H:\Day2\100GOPRO\G0023731.JPG
A H:\Day2\100GOPRO\G0023732.JPG
A H:\Day2\100GOPRO\G0023733.JPG
A H:\Day2\100GOPRO\G0023734.JPG
A H:\Day2\100GOPRO\G0023735.JPG
A H:\Day2\100GOPRO\G0023736.JPG
A H:\Day2\100GOPRO\G0023737.JPG
A H:\Day2\100GOPRO\G0023738.JPG
A H:\Day2\100GOPRO\G0023739.JPG
A H:\Day2\100GOPRO\G0023740.JPG
A H:\Day2\100GOPRO\G0023741.JPG
A H:\Day2\100GOPRO\G0023742.JPG
A H:\Day2\100GOPRO\G0023743.JPG
A H:\Day2\100GOPRO\G0023744.JPG
A H:\Day2\100GOPRO\G0023745.JPG
A H:\Day2\100GOPRO\G0023746.JPG
A H:\Day2\100GOPRO\G0023747.JPG
A H:\Day2\100GOPRO\G0023748.JPG
A H:\Day2\100GOPRO\G0023749.JPG
A H:\Day2\100GOPRO\G0023750.JPG
A H:\Day2\100GOPRO\G0023751.JPG
A H:\Day2\100GOPRO\G0023752.JPG
A H:\Day2\100GOPRO\G0023753.JPG
A H:\Day2\100GOPRO\G0023754.JPG
A H:\Day2\100GOPRO\G0023755.JPG
A H:\Day2\100GOPRO\G0023756.JPG
A H:\Day2\100GOPRO\G0023757.JPG
A H:\Day2\100GOPRO\G0023758.JPG
A H:\Day2\100GOPRO\G0023759.JPG
A H:\Day2\100GOPRO\G0023760.JPG
A H:\Day2\100GOPRO\G0023761.JPG
A H:\Day2\100GOPRO\G0023762.JPG
A H:\Day2\100GOPRO\G0023763.JPG
A H:\Day2\100GOPRO\G0023764.JPG
A H:\Day2\100GOPRO\G0023765.JPG
A H:\Day2\100GOPRO\G0023766.JPG
A H:\Day2\100GOPRO\G0023767.JPG
A H:\Day2\100GOPRO\G0023768.JPG
A H:\Day2\100GOPRO\G0023769.JPG
A H:\Day2\100GOPRO\G0023770.JPG
A H:\Day2\100GOPRO\G0023771.JPG
A H:\Day2\100GOPRO\G0023772.JPG
A H:\Day2\100GOPRO\G0023773.JPG
A H:\Day2\100GOPRO\G0023774.JPG
A H:\Day2\100GOPRO\G0023775.JPG
A H:\Day2\100GOPRO\G0023776.JPG
A H:\Day2\100GOPRO\G0023777.JPG
A H:\Day2\100GOPRO\G0023778.JPG
A H:\Day2\100GOPRO\G0023779.JPG
A H:\Day2\100GOPRO\G0023780.JPG
A H:\Day2\100GOPRO\G0023781.JPG
A H:\Day2\100GOPRO\G0023782.JPG
A H:\Day2\100GOPRO\G0023783.JPG
A H:\Day2\100GOPRO\G0023784.JPG
A H:\Day2\100GOPRO\G0023785.JPG
A H:\Day2\100GOPRO\G0023786.JPG
A H:\Day2\100GOPRO\G0023787.JPG
A H:\Day2\100GOPRO\G0023788.JPG
A H:\Day2\100GOPRO\G0023789.JPG
A H:\Day2\100GOPRO\G0023790.JPG
A H:\Day2\100GOPRO\G0023791.JPG
A H:\Day2\100GOPRO\G0023792.JPG
A H:\Day2\100GOPRO\G0023793.JPG
A H:\Day2\100GOPRO\G0023794.JPG
A H:\Day2\100GOPRO\G0023795.JPG
A H:\Day2\100GOPRO\G0023796.JPG
A H:\Day2\100GOPRO\G0023797.JPG
A H:\Day2\100GOPRO\G0023798.JPG
A H:\Day2\100GOPRO\G0023799.JPG
A H:\Day2\100GOPRO\G0023800.JPG
A H:\Day2\100GOPRO\G0023801.JPG
A H:\Day2\100GOPRO\G0023802.JPG
A H:\Day2\100GOPRO\G0023803.JPG
A H:\Day2\100GOPRO\G0023804.JPG
A H:\Day2\100GOPRO\G0023805.JPG
A H:\Day2\100GOPRO\G0023806.JPG
A H:\Day2\100GOPRO\G0023807.JPG
A H:\Day2\100GOPRO\G0023808.JPG
A H:\Day2\100GOPRO\G0023809.JPG
A H:\Day2\100GOPRO\G0023810.JPG
A H:\Day2\100GOPRO\G0023811.JPG
A H:\Day2\100GOPRO\G0023812.JPG
A H:\Day2\100GOPRO\G0023813.JPG
A H:\Day2\100GOPRO\G0023814.JPG
A H:\Day2\100GOPRO\G0023815.JPG
A H:\Day2\100GOPRO\G0023816.JPG
A H:\Day2\100GOPRO\G0023817.JPG
A H:\Day2\100GOPRO\G0023818.JPG
A H:\Day2\100GOPRO\G0023819.JPG
A H:\Day2\100GOPRO\G0023820.JPG
A H:\Day2\100GOPRO\G0023821.JPG
A H:\Day2\100GOPRO\G0023822.JPG
A H:\Day2\100GOPRO\G0023823.JPG
A H:\Day2\100GOPRO\G0023824.JPG
A H:\Day2\100GOPRO\G0023825.JPG
A H:\Day2\100GOPRO\G0023826.JPG
A H:\Day2\100GOPRO\G0023827.JPG
A H:\Day2\100GOPRO\G0023828.JPG
A H:\Day2\100GOPRO\G0023829.JPG
A H:\Day2\100GOPRO\G0023830.JPG
A H:\Day2\100GOPRO\G0023831.JPG
A H:\Day2\100GOPRO\G0023832.JPG
A H:\Day2\100GOPRO\G0023833.JPG
A H:\Day2\100GOPRO\G0023834.JPG
A H:\Day2\100GOPRO\G0023835.JPG
A H:\Day2\100GOPRO\G0023836.JPG
A H:\Day2\100GOPRO\G0023837.JPG
A H:\Day2\100GOPRO\G0023838.JPG
A H:\Day2\100GOPRO\G0023839.JPG
A H:\Day2\100GOPRO\G0023840.JPG
A H:\Day2\100GOPRO\G0023841.JPG
A H:\Day2\100GOPRO\G0023842.JPG
A H:\Day2\100GOPRO\G0023843.JPG
A H:\Day2\100GOPRO\G0023844.JPG
A H:\Day2\100GOPRO\G0023845.JPG
A H:\Day2\100GOPRO\G0023846.JPG
A H:\Day2\100GOPRO\G0023847.JPG
A H:\Day2\100GOPRO\G0023848.JPG
A H:\Day2\100GOPRO\G0023849.JPG
A H:\Day2\100GOPRO\G0023850.JPG
A H:\Day2\100GOPRO\G0023851.JPG
A H:\Day2\100GOPRO\G0023852.JPG
A H:\Day2\100GOPRO\G0023853.JPG
A H:\Day2\100GOPRO\G0023854.JPG
A H:\Day2\100GOPRO\G0023855.JPG
A H:\Day2\100GOPRO\G0023856.JPG
A H:\Day2\100GOPRO\G0023857.JPG
A H:\Day2\100GOPRO\G0023858.JPG
A H:\Day2\100GOPRO\G0023859.JPG
A H:\Day2\100GOPRO\G0023860.JPG
A H:\Day2\100GOPRO\G0023861.JPG
A H:\Day2\100GOPRO\G0023862.JPG
A H:\Day2\100GOPRO\G0023863.JPG
A H:\Day2\100GOPRO\G0023864.JPG
A H:\Day2\100GOPRO\G0023865.JPG
A H:\Day2\100GOPRO\G0023866.JPG
A H:\Day2\100GOPRO\G0023867.JPG
A H:\Day2\100GOPRO\G0023868.JPG
A H:\Day2\100GOPRO\G0023869.JPG
A H:\Day2\100GOPRO\G0023870.JPG
A H:\Day2\100GOPRO\G0023871.JPG
A H:\Day2\100GOPRO\G0023872.JPG
A H:\Day2\100GOPRO\G0023873.JPG
A H:\Day2\100GOPRO\G0023874.JPG
A H:\Day2\100GOPRO\G0023875.JPG
A H:\Day2\100GOPRO\G0023876.JPG
A H:\Day2\100GOPRO\G0023877.JPG
A H:\Day2\100GOPRO\G0023878.JPG
A H:\Day2\100GOPRO\G0023879.JPG
A H:\Day2\100GOPRO\G0023880.JPG
A H:\Day2\100GOPRO\G0023881.JPG
A H:\Day2\100GOPRO\G0023882.JPG
A H:\Day2\100GOPRO\G0023883.JPG
A H:\Day2\100GOPRO\G0023884.JPG
A H:\Day2\100GOPRO\G0023885.JPG
A H:\Day2\100GOPRO\G0023886.JPG
A H:\Day2\100GOPRO\G0023887.JPG
A H:\Day2\100GOPRO\G0023888.JPG
A H:\Day2\100GOPRO\G0023889.JPG
A H:\Day2\100GOPRO\G0023890.JPG
A H:\Day2\100GOPRO\G0023891.JPG
A H:\Day2\100GOPRO\G0023892.JPG
A H:\Day2\100GOPRO\G0023893.JPG
A H:\Day2\100GOPRO\G0023894.JPG
A H:\Day2\100GOPRO\G0023895.JPG
A H:\Day2\100GOPRO\G0023896.JPG
A H:\Day2\100GOPRO\G0023897.JPG
A H:\Day2\100GOPRO\G0023898.JPG
A H:\Day2\100GOPRO\G0023899.JPG
A H:\Day2\100GOPRO\G0023900.JPG
A H:\Day2\100GOPRO\G0023901.JPG
A H:\Day2\100GOPRO\G0023902.JPG
A H:\Day2\100GOPRO\G0023903.JPG
A H:\Day2\100GOPRO\G0023904.JPG
A H:\Day2\100GOPRO\G0023905.JPG
A H:\Day2\100GOPRO\G0023906.JPG
A H:\Day2\100GOPRO\G0023907.JPG
A H:\Day2\100GOPRO\G0023908.JPG
A H:\Day2\100GOPRO\G0023909.JPG
A H:\Day2\100GOPRO\G0023910.JPG
A H:\Day2\100GOPRO\G0023911.JPG
A H:\Day2\100GOPRO\G0023912.JPG
A H:\Day2\100GOPRO\G0023913.JPG
A H:\Day2\100GOPRO\G0023914.JPG
A H:\Day2\100GOPRO\G0023915.JPG
A H:\Day2\100GOPRO\G0023916.JPG
A H:\Day2\100GOPRO\G0023917.JPG
A H:\Day2\100GOPRO\G0023918.JPG
A H:\Day2\100GOPRO\G0023919.JPG
A H:\Day2\100GOPRO\G0023920.JPG
A H:\Day2\100GOPRO\G0023921.JPG
A H:\Day2\100GOPRO\G0023922.JPG
A H:\Day2\100GOPRO\G0023923.JPG
A H:\Day2\100GOPRO\G0023924.JPG
A H:\Day2\100GOPRO\G0023925.JPG
A H:\Day2\100GOPRO\G0023926.JPG
A H:\Day2\100GOPRO\G0023927.JPG
A H:\Day2\100GOPRO\G0023928.JPG
A H:\Day2\100GOPRO\G0023929.JPG
A H:\Day2\100GOPRO\G0023930.JPG
A H:\Day2\100GOPRO\G0023931.JPG
A H:\Day2\100GOPRO\G0023932.JPG
A H:\Day2\100GOPRO\G0023933.JPG
A H:\Day2\100GOPRO\G0023934.JPG
A H:\Day2\100GOPRO\G0023935.JPG
A H:\Day2\100GOPRO\G0023936.JPG
A H:\Day2\100GOPRO\G0023937.JPG
A H:\Day2\100GOPRO\G0023938.JPG
A H:\Day2\100GOPRO\G0023939.JPG
A H:\Day2\100GOPRO\G0023940.JPG
A H:\Day2\100GOPRO\G0023941.JPG
A H:\Day2\100GOPRO\G0023942.JPG
A H:\Day2\100GOPRO\G0023943.JPG
A H:\Day2\100GOPRO\G0023944.JPG
A H:\Day2\100GOPRO\G0023945.JPG
A H:\Day2\100GOPRO\G0023946.JPG
A H:\Day2\100GOPRO\G0023947.JPG
A H:\Day2\100GOPRO\G0023948.JPG
A H:\Day2\100GOPRO\G0023949.JPG
A H:\Day2\100GOPRO\G0023950.JPG
A H:\Day2\100GOPRO\G0023951.JPG
A H:\Day2\100GOPRO\G0023952.JPG
A H:\Day2\100GOPRO\G0023953.JPG
A H:\Day2\100GOPRO\G0023954.JPG
A H:\Day2\100GOPRO\G0023955.JPG
A H:\Day2\100GOPRO\G0023956.JPG
A H:\Day2\100GOPRO\G0023957.JPG
A H:\Day2\100GOPRO\G0023958.JPG
A H:\Day2\100GOPRO\G0023959.JPG
A H:\Day2\100GOPRO\G0023960.JPG
A H:\Day2\100GOPRO\G0023961.JPG
A H:\Day2\100GOPRO\G0023962.JPG
A H:\Day2\100GOPRO\G0023963.JPG
A H:\Day2\100GOPRO\G0023964.JPG
A H:\Day2\100GOPRO\G0023965.JPG
A H:\Day2\100GOPRO\G0023966.JPG
A H:\Day2\100GOPRO\G0023967.JPG
A H:\Day2\100GOPRO\G0023968.JPG
A H:\Day2\100GOPRO\G0023969.JPG
A H:\Day2\100GOPRO\G0023970.JPG
A H:\Day2\100GOPRO\G0023971.JPG
A H:\Day2\100GOPRO\G0023972.JPG
A H:\Day2\100GOPRO\G0023973.JPG
A H:\Day2\100GOPRO\G0023974.JPG
A H:\Day2\100GOPRO\G0023975.JPG
A H:\Day2\100GOPRO\G0023976.JPG
A H:\Day2\100GOPRO\G0023977.JPG
A H:\Day2\100GOPRO\G0023978.JPG
A H:\Day2\100GOPRO\G0023979.JPG
A H:\Day2\100GOPRO\G0023980.JPG
A H:\Day2\100GOPRO\G0023981.JPG
A H:\Day2\100GOPRO\G0023982.JPG
A H:\Day2\100GOPRO\G0023983.JPG
A H:\Day2\100GOPRO\G0023984.JPG
A H:\Day2\100GOPRO\G0023985.JPG
A H:\Day2\100GOPRO\G0023986.JPG
A H:\Day2\100GOPRO\G0023987.JPG
A H:\Day2\100GOPRO\G0023988.JPG
A H:\Day2\100GOPRO\G0023989.JPG
A H:\Day2\100GOPRO\G0023990.JPG
A H:\Day2\100GOPRO\G0023991.JPG
A H:\Day2\100GOPRO\G0023992.JPG
A H:\Day2\100GOPRO\G0023993.JPG
A H:\Day2\100GOPRO\G0023994.JPG
A H:\Day2\100GOPRO\G0023995.JPG
A H:\Day2\100GOPRO\G0023996.JPG
A H:\Day2\100GOPRO\G0023997.JPG
A H:\Day2\100GOPRO\G0023998.JPG
A H:\Day2\100GOPRO\G0023999.JPG
A H:\Day2\100GOPRO\G0024000.JPG
A H:\Day2\100GOPRO\G0024001.JPG
A H:\Day2\100GOPRO\G0024002.JPG
A H:\Day2\100GOPRO\G0024003.JPG
A H:\Day2\100GOPRO\G0024004.JPG
A H:\Day2\100GOPRO\G0024005.JPG
A H:\Day2\100GOPRO\G0024006.JPG
A H:\Day2\100GOPRO\G0024007.JPG
A H:\Day2\100GOPRO\G0024008.JPG
A H:\Day2\100GOPRO\G0024009.JPG
A H:\Day2\100GOPRO\G0024010.JPG
A H:\Day2\100GOPRO\G0024011.JPG
A H:\Day2\100GOPRO\G0024012.JPG
A H:\Day2\100GOPRO\G0024013.JPG
A H:\Day2\100GOPRO\G0024014.JPG
A H:\Day2\100GOPRO\G0024015.JPG
A H:\Day2\100GOPRO\G0024016.JPG
A H:\Day2\100GOPRO\G0024017.JPG
A H:\Day2\100GOPRO\G0024018.JPG
A H:\Day2\100GOPRO\G0024019.JPG
A H:\Day2\100GOPRO\G0024020.JPG
A H:\Day2\100GOPRO\G0024021.JPG
A H:\Day2\100GOPRO\G0024022.JPG
A H:\Day2\100GOPRO\G0024023.JPG
A H:\Day2\100GOPRO\G0024024.JPG
A H:\Day2\100GOPRO\G0024025.JPG
A H:\Day2\100GOPRO\G0024026.JPG
A H:\Day2\100GOPRO\G0024027.JPG
A H:\Day2\100GOPRO\G0024028.JPG
A H:\Day2\100GOPRO\G0024029.JPG
A H:\Day2\100GOPRO\G0024030.JPG
A H:\Day2\100GOPRO\G0024031.JPG
A H:\Day2\100GOPRO\G0024032.JPG
A H:\Day2\100GOPRO\G0024033.JPG
A H:\Day2\100GOPRO\G0024034.JPG
A H:\Day2\100GOPRO\G0024035.JPG
A H:\Day2\100GOPRO\G0024036.JPG
A H:\Day2\100GOPRO\G0024037.JPG
A H:\Day2\100GOPRO\G0024038.JPG
A H:\Day2\100GOPRO\G0024039.JPG
A H:\Day2\100GOPRO\G0024040.JPG
A H:\Day2\100GOPRO\G0024041.JPG
A H:\Day2\100GOPRO\G0024042.JPG
A H:\Day2\100GOPRO\G0024043.JPG
A H:\Day2\100GOPRO\G0024044.JPG
A H:\Day2\100GOPRO\G0024045.JPG
A H:\Day2\100GOPRO\G0024046.JPG
A H:\Day2\100GOPRO\G0024047.JPG
A H:\Day2\100GOPRO\G0024048.JPG
A H:\Day2\100GOPRO\G0024049.JPG
A H:\Day2\100GOPRO\G0024050.JPG
A H:\Day2\100GOPRO\G0024051.JPG
A H:\Day2\100GOPRO\G0024052.JPG
A H:\Day2\100GOPRO\G0024053.JPG
A H:\Day2\100GOPRO\G0024054.JPG
A H:\Day2\100GOPRO\G0024055.JPG
A H:\Day2\100GOPRO\G0024056.JPG
A H:\Day2\100GOPRO\G0024057.JPG
A H:\Day2\100GOPRO\G0024058.JPG
A H:\Day2\100GOPRO\G0024059.JPG
A H:\Day2\100GOPRO\G0024060.JPG
A H:\Day2\100GOPRO\G0024061.JPG
A H:\Day2\100GOPRO\G0024062.JPG
A H:\Day2\100GOPRO\G0024063.JPG
A H:\Day2\100GOPRO\G0024064.JPG
A H:\Day2\100GOPRO\G0024065.JPG
A H:\Day2\100GOPRO\G0024066.JPG
A H:\Day2\100GOPRO\G0024067.JPG
A H:\Day2\100GOPRO\G0024068.JPG
A H:\Day2\100GOPRO\G0024069.JPG
A H:\Day2\100GOPRO\G0024070.JPG
A H:\Day2\100GOPRO\G0024071.JPG
A H:\Day2\100GOPRO\G0024072.JPG
A H:\Day2\100GOPRO\G0024073.JPG
A H:\Day2\100GOPRO\G0024074.JPG
A H:\Day2\100GOPRO\G0024075.JPG
A H:\Day2\100GOPRO\G0024076.JPG
A H:\Day2\100GOPRO\G0024077.JPG
A H:\Day2\100GOPRO\G0024078.JPG
A H:\Day2\100GOPRO\G0024079.JPG
A H:\Day2\100GOPRO\G0024080.JPG
A H:\Day2\100GOPRO\G0024081.JPG
A H:\Day2\100GOPRO\G0024082.JPG
A H:\Day2\100GOPRO\G0024083.JPG
A H:\Day2\100GOPRO\G0024084.JPG
A H:\Day2\100GOPRO\G0024085.JPG
A H:\Day2\100GOPRO\G0024086.JPG
A H:\Day2\100GOPRO\G0024087.JPG
A H:\Day2\100GOPRO\G0024088.JPG
A H:\Day2\100GOPRO\G0024089.JPG
A H:\Day2\100GOPRO\G0024090.JPG
A H:\Day2\100GOPRO\G0024091.JPG
A H:\Day2\100GOPRO\G0024092.JPG
A H:\Day2\100GOPRO\G0024093.JPG
A H:\Day2\100GOPRO\G0024094.JPG
A H:\Day2\100GOPRO\G0024095.JPG
A H:\Day2\100GOPRO\G0024096.JPG
A H:\Day2\100GOPRO\G0024097.JPG
A H:\Day2\100GOPRO\G0024098.JPG
A H:\Day2\100GOPRO\G0024099.JPG
A H:\Day2\100GOPRO\G0024100.JPG
A H:\Day2\100GOPRO\G0024101.JPG
A H:\Day2\100GOPRO\G0024102.JPG
A H:\Day2\100GOPRO\G0024103.JPG
A H:\Day2\100GOPRO\G0024104.JPG
A H:\Day2\100GOPRO\G0024105.JPG
A H:\Day2\100GOPRO\G0024106.JPG
A H:\Day2\100GOPRO\G0024107.JPG
A H:\Day2\100GOPRO\G0024108.JPG
A H:\Day2\100GOPRO\G0024109.JPG
A H:\Day2\100GOPRO\G0024110.JPG
A H:\Day2\100GOPRO\G0024111.JPG
A H:\Day2\100GOPRO\G0024112.JPG
A H:\Day2\100GOPRO\G0024113.JPG
A H:\Day2\100GOPRO\G0024114.JPG
A H:\Day2\100GOPRO\G0024115.JPG
A H:\Day2\100GOPRO\G0024116.JPG
A H:\Day2\100GOPRO\G0024117.JPG
A H:\Day2\100GOPRO\G0024118.JPG
A H:\Day2\100GOPRO\G0024119.JPG
A H:\Day2\100GOPRO\G0024120.JPG
A H:\Day2\100GOPRO\G0024121.JPG
A H:\Day2\100GOPRO\G0024122.JPG
A H:\Day2\100GOPRO\G0024123.JPG
A H:\Day2\100GOPRO\G0024124.JPG
A H:\Day2\100GOPRO\G0024125.JPG
A H:\Day2\100GOPRO\G0024126.JPG
A H:\Day2\100GOPRO\G0024127.JPG
A H:\Day2\100GOPRO\G0024128.JPG
A H:\Day2\100GOPRO\G0024129.JPG
A H:\Day2\100GOPRO\G0024130.JPG
A H:\Day2\100GOPRO\G0024131.JPG
A H:\Day2\100GOPRO\G0024132.JPG
A H:\Day2\100GOPRO\G0024133.JPG
A H:\Day2\100GOPRO\G0024134.JPG
A H:\Day2\100GOPRO\G0024135.JPG
A H:\Day2\100GOPRO\G0024136.JPG
A H:\Day2\100GOPRO\G0024137.JPG
A H:\Day2\100GOPRO\G0024138.JPG
A H:\Day2\100GOPRO\G0024139.JPG
A H:\Day2\100GOPRO\G0024140.JPG
A H:\Day2\100GOPRO\G0024141.JPG
A H:\Day2\100GOPRO\G0024142.JPG
A H:\Day2\100GOPRO\G0024143.JPG
A H:\Day2\100GOPRO\G0024144.JPG
A H:\Day2\100GOPRO\G0024145.JPG
A H:\Day2\100GOPRO\G0024146.JPG
A H:\Day2\100GOPRO\G0024147.JPG
A H:\Day2\100GOPRO\G0024148.JPG
A H:\Day2\100GOPRO\G0024149.JPG
A H:\Day2\100GOPRO\G0024150.JPG
A H:\Day2\100GOPRO\G0024151.JPG
A H:\Day2\100GOPRO\G0024152.JPG
A H:\Day2\100GOPRO\G0024153.JPG
A H:\Day2\100GOPRO\G0024154.JPG
A H:\Day2\100GOPRO\G0024155.JPG
A H:\Day2\100GOPRO\G0024156.JPG
A H:\Day2\100GOPRO\G0024157.JPG
A H:\Day2\100GOPRO\G0024158.JPG
A H:\Day2\100GOPRO\G0024159.JPG
A H:\Day2\100GOPRO\G0024160.JPG
A H:\Day2\100GOPRO\G0024161.JPG
A H:\Day2\100GOPRO\G0024162.JPG
A H:\Day2\100GOPRO\G0024163.JPG
A H:\Day2\100GOPRO\G0024164.JPG
A H:\Day2\100GOPRO\G0024165.JPG
A H:\Day2\100GOPRO\G0024166.JPG
A H:\Day2\100GOPRO\G0024167.JPG
A H:\Day2\100GOPRO\G0024168.JPG
A H:\Day2\100GOPRO\G0024169.JPG
A H:\Day2\100GOPRO\G0024170.JPG
A H:\Day2\100GOPRO\G0024171.JPG
A H:\Day2\100GOPRO\G0024172.JPG
A H:\Day2\100GOPRO\G0024173.JPG
A H:\Day2\100GOPRO\G0024174.JPG
A H:\Day2\100GOPRO\G0024175.JPG
A H:\Day2\100GOPRO\G0024176.JPG
A H:\Day2\100GOPRO\G0024177.JPG
A H:\Day2\100GOPRO\G0024178.JPG
A H:\Day2\100GOPRO\G0024179.JPG
A H:\Day2\100GOPRO\G0024180.JPG
A H:\Day2\100GOPRO\G0024181.JPG
A H:\Day2\100GOPRO\G0024182.JPG
A H:\Day2\100GOPRO\G0024183.JPG
A H:\Day2\100GOPRO\G0024184.JPG
A H:\Day2\100GOPRO\G0024185.JPG
A H:\Day2\100GOPRO\G0024186.JPG
A H:\Day2\100GOPRO\G0024187.JPG
A H:\Day2\100GOPRO\G0024188.JPG
A H:\Day2\100GOPRO\G0024189.JPG
A H:\Day2\100GOPRO\G0024190.JPG
A H:\Day2\100GOPRO\G0024191.JPG
A H:\Day2\100GOPRO\G0024192.JPG
A H:\Day2\100GOPRO\G0024193.JPG
A H:\Day2\100GOPRO\G0024194.JPG
A H:\Day2\100GOPRO\G0024195.JPG
A H:\Day2\100GOPRO\G0024196.JPG
A H:\Day2\100GOPRO\G0024197.JPG
A H:\Day2\100GOPRO\G0024198.JPG
A H:\Day2\100GOPRO\G0024199.JPG
A H:\Day2\100GOPRO\G0024200.JPG
A H:\Day2\100GOPRO\G0024201.JPG
A H:\Day2\100GOPRO\G0024202.JPG
A H:\Day2\100GOPRO\G0024203.JPG
A H:\Day2\100GOPRO\G0024204.JPG
A H:\Day2\100GOPRO\G0024205.JPG
A H:\Day2\100GOPRO\G0024206.JPG
A H:\Day2\100GOPRO\G0024207.JPG
A H:\Day2\100GOPRO\G0024208.JPG
A H:\Day2\100GOPRO\G0024209.JPG
A H:\Day2\100GOPRO\G0024210.JPG
A H:\Day2\100GOPRO\G0024211.JPG
A H:\Day2\100GOPRO\G0024212.JPG
A H:\Day2\100GOPRO\G0024213.JPG
A H:\Day2\100GOPRO\G0024214.JPG
A H:\Day2\100GOPRO\G0024215.JPG
A H:\Day2\100GOPRO\G0024216.JPG
A H:\Day2\100GOPRO\G0024217.JPG
A H:\Day2\100GOPRO\G0024218.JPG
A H:\Day2\100GOPRO\G0024219.JPG
A H:\Day2\100GOPRO\G0024220.JPG
A H:\Day2\100GOPRO\G0024221.JPG
A H:\Day2\100GOPRO\G0024222.JPG
A H:\Day2\100GOPRO\G0024223.JPG
A H:\Day2\100GOPRO\G0024224.JPG
A H:\Day2\100GOPRO\G0024225.JPG
A H:\Day2\100GOPRO\G0024226.JPG
A H:\Day2\100GOPRO\G0024227.JPG
A H:\Day2\100GOPRO\G0024228.JPG
A H:\Day2\100GOPRO\G0024229.JPG
A H:\Day2\100GOPRO\G0024230.JPG
A H:\Day2\100GOPRO\G0024231.JPG
A H:\Day2\100GOPRO\G0024232.JPG
A H:\Day2\100GOPRO\G0024233.JPG
A H:\Day2\100GOPRO\G0024234.JPG
A H:\Day2\100GOPRO\G0024235.JPG
A H:\Day2\100GOPRO\G0024236.JPG
A H:\Day2\100GOPRO\G0024237.JPG
A H:\Day2\100GOPRO\G0024238.JPG
A H:\Day2\100GOPRO\G0024239.JPG
A H:\Day2\100GOPRO\G0024240.JPG
A H:\Day2\100GOPRO\G0024241.JPG
A H:\Day2\100GOPRO\G0024242.JPG
A H:\Day2\100GOPRO\G0024243.JPG
A H:\Day2\100GOPRO\G0024244.JPG
A H:\Day2\100GOPRO\G0024245.JPG
A H:\Day2\100GOPRO\G0024246.JPG
A H:\Day2\100GOPRO\G0024247.JPG
A H:\Day2\100GOPRO\G0024248.JPG
A H:\Day2\100GOPRO\G0024249.JPG
A H:\Day2\100GOPRO\G0024250.JPG
A H:\Day2\100GOPRO\G0024251.JPG
A H:\Day2\100GOPRO\G0024252.JPG
A H:\Day2\100GOPRO\G0024253.JPG
A H:\Day2\100GOPRO\G0024254.JPG
A H:\Day2\100GOPRO\G0024255.JPG
A H:\Day2\100GOPRO\G0024256.JPG
A H:\Day2\100GOPRO\G0024257.JPG
A H:\Day2\100GOPRO\G0024258.JPG
A H:\Day2\100GOPRO\G0024259.JPG
A H:\Day2\100GOPRO\G0024260.JPG
A H:\Day2\100GOPRO\G0024261.JPG
A H:\Day2\100GOPRO\G0024262.JPG
A H:\Day2\100GOPRO\G0024263.JPG
A H:\Day2\100GOPRO\G0024264.JPG
A H:\Day2\100GOPRO\G0024265.JPG
A H:\Day2\100GOPRO\G0024266.JPG
A H:\Day2\100GOPRO\G0024267.JPG
A H:\Day2\100GOPRO\G0024268.JPG
A H:\Day2\100GOPRO\G0024269.JPG
A H:\Day2\100GOPRO\G0024270.JPG
A H:\Day2\100GOPRO\G0024271.JPG
A H:\Day2\100GOPRO\G0024272.JPG
A H:\Day2\100GOPRO\G0024273.JPG
A H:\Day2\100GOPRO\G0024274.JPG
A H:\Day2\100GOPRO\G0024275.JPG
A H:\Day2\100GOPRO\G0024276.JPG
A H:\Day2\100GOPRO\G0024277.JPG
A H:\Day2\100GOPRO\G0024278.JPG
A H:\Day2\100GOPRO\G0024279.JPG
A H:\Day2\100GOPRO\G0024280.JPG
A H:\Day2\100GOPRO\G0024281.JPG
A H:\Day2\100GOPRO\G0024282.JPG
A H:\Day2\100GOPRO\G0024283.JPG
A H:\Day2\100GOPRO\G0024284.JPG
A H:\Day2\100GOPRO\G0024285.JPG
A H:\Day2\100GOPRO\G0024286.JPG
A H:\Day2\100GOPRO\G0024287.JPG
A H:\Day2\100GOPRO\G0024288.JPG
A H:\Day2\100GOPRO\G0024289.JPG
A H:\Day2\100GOPRO\G0024290.JPG
A H:\Day2\100GOPRO\G0024291.JPG
A H:\Day2\100GOPRO\G0024292.JPG
A H:\Day2\100GOPRO\G0024293.JPG
A H:\Day2\100GOPRO\G0024294.JPG
A H:\Day2\100GOPRO\G0024295.JPG
A H:\Day2\100GOPRO\G0024296.JPG
A H:\Day2\100GOPRO\G0024297.JPG
A H:\Day2\100GOPRO\G0024298.JPG
A H:\Day2\100GOPRO\G0024299.JPG
A H:\Day2\100GOPRO\G0024300.JPG
A H:\Day2\100GOPRO\G0024301.JPG
A H:\Day2\100GOPRO\G0024302.JPG
A H:\Day2\100GOPRO\G0024303.JPG
A H:\Day2\100GOPRO\G0024304.JPG
A H:\Day2\100GOPRO\G0024305.JPG
A H:\Day2\100GOPRO\G0024306.JPG
A H:\Day2\100GOPRO\G0024307.JPG
A H:\Day2\100GOPRO\G0024308.JPG
A H:\Day2\100GOPRO\G0024309.JPG
A H:\Day2\100GOPRO\G0024310.JPG
A H:\Day2\100GOPRO\G0024311.JPG
A H:\Day2\100GOPRO\G0024312.JPG
A H:\Day2\100GOPRO\G0024313.JPG
A H:\Day2\100GOPRO\G0024314.JPG
A H:\Day2\100GOPRO\G0024315.JPG
A H:\Day2\100GOPRO\G0024316.JPG
A H:\Day2\100GOPRO\G0024317.JPG
A H:\Day2\100GOPRO\G0024318.JPG
A H:\Day2\100GOPRO\G0024319.JPG
A H:\Day2\100GOPRO\G0024320.JPG
A H:\Day2\100GOPRO\G0024321.JPG
A H:\Day2\100GOPRO\G0024322.JPG
A H:\Day2\100GOPRO\G0024323.JPG
A H:\Day2\100GOPRO\G0024324.JPG
A H:\Day2\100GOPRO\G0024325.JPG
A H:\Day2\100GOPRO\G0024326.JPG
A H:\Day2\100GOPRO\G0024327.JPG
A H:\Day2\100GOPRO\G0024328.JPG
A H:\Day2\100GOPRO\G0024329.JPG
A H:\Day2\100GOPRO\G0024330.JPG
A H:\Day2\100GOPRO\G0024331.JPG
A H:\Day2\100GOPRO\G0024332.JPG
A H:\Day2\100GOPRO\G0024333.JPG
A H:\Day2\100GOPRO\G0024334.JPG
A H:\Day2\100GOPRO\G0024335.JPG
A H:\Day2\100GOPRO\G0024336.JPG
A H:\Day2\100GOPRO\G0024337.JPG
A H:\Day2\100GOPRO\G0024338.JPG
A H:\Day2\100GOPRO\G0024339.JPG
A H:\Day2\100GOPRO\G0024340.JPG
A H:\Day2\100GOPRO\G0024341.JPG
A H:\Day2\100GOPRO\G0024342.JPG
A H:\Day2\100GOPRO\G0024343.JPG
A H:\Day2\100GOPRO\G0024344.JPG
A H:\Day2\100GOPRO\G0024345.JPG
A H:\Day2\100GOPRO\G0024346.JPG
A H:\Day2\100GOPRO\G0024347.JPG
A H:\Day2\100GOPRO\G0024348.JPG
A H:\Day2\100GOPRO\G0024349.JPG
A H:\Day2\100GOPRO\G0024350.JPG
A H:\Day2\100GOPRO\G0024351.JPG
A H:\Day2\100GOPRO\G0024352.JPG
A H:\Day2\100GOPRO\G0024353.JPG
A H:\Day2\100GOPRO\G0024354.JPG
A H:\Day2\100GOPRO\G0024355.JPG
A H:\Day2\100GOPRO\G0024356.JPG
A H:\Day2\100GOPRO\G0024357.JPG
A H:\Day2\100GOPRO\G0024358.JPG
A H:\Day2\100GOPRO\G0024359.JPG
A H:\Day2\100GOPRO\G0024360.JPG
A H:\Day2\100GOPRO\G0024361.JPG
A H:\Day2\100GOPRO\G0024362.JPG
A H:\Day2\100GOPRO\G0024363.JPG
A H:\Day2\100GOPRO\G0024364.JPG
A H:\Day2\100GOPRO\G0024365.JPG
A H:\Day2\100GOPRO\G0024366.JPG
A H:\Day2\100GOPRO\G0024367.JPG
A H:\Day2\100GOPRO\G0024368.JPG
A H:\Day2\100GOPRO\G0024369.JPG
A H:\Day2\100GOPRO\G0024370.JPG
A H:\Day2\100GOPRO\G0024371.JPG
A H:\Day2\100GOPRO\G0024372.JPG
A H:\Day2\100GOPRO\G0024373.JPG
A H:\Day2\100GOPRO\G0024374.JPG
A H:\Day2\100GOPRO\G0024375.JPG
A H:\Day2\100GOPRO\G0024376.JPG
A H:\Day2\100GOPRO\G0024377.JPG
A H:\Day2\100GOPRO\G0024378.JPG
A H:\Day2\100GOPRO\G0024379.JPG
A H:\Day2\100GOPRO\G0024380.JPG
A H:\Day2\100GOPRO\G0024381.JPG
A H:\Day2\100GOPRO\G0024382.JPG
A H:\Day2\100GOPRO\G0024383.JPG
A H:\Day2\100GOPRO\G0024384.JPG
A H:\Day2\100GOPRO\G0024385.JPG
A H:\Day2\100GOPRO\G0024386.JPG
A H:\Day2\100GOPRO\G0024387.JPG
A H:\Day2\100GOPRO\G0024388.JPG
A H:\Day2\100GOPRO\G0024389.JPG
A H:\Day2\100GOPRO\G0024390.JPG
A H:\Day2\100GOPRO\G0024391.JPG
A H:\Day2\100GOPRO\G0024392.JPG
A H:\Day2\100GOPRO\G0024393.JPG
A H:\Day2\100GOPRO\G0024394.JPG
A H:\Day2\100GOPRO\G0024395.JPG
A H:\Day2\100GOPRO\G0024396.JPG
A H:\Day2\100GOPRO\G0024397.JPG
A H:\Day2\100GOPRO\G0024398.JPG
A H:\Day2\100GOPRO\G0024399.JPG
A H:\Day2\100GOPRO\G0024400.JPG
A H:\Day2\100GOPRO\G0024401.JPG
A H:\Day2\100GOPRO\G0024402.JPG
A H:\Day2\100GOPRO\G0024403.JPG
A H:\Day2\100GOPRO\G0024404.JPG
A H:\Day2\100GOPRO\G0024405.JPG
A H:\Day2\100GOPRO\G0024406.JPG
A H:\Day2\100GOPRO\G0024407.JPG
A H:\Day2\100GOPRO\G0024408.JPG
A H:\Day2\100GOPRO\G0024409.JPG
A H:\Day2\100GOPRO\G0024410.JPG
A H:\Day2\100GOPRO\G0024411.JPG
A H:\Day2\100GOPRO\G0024412.JPG
A H:\Day2\100GOPRO\G0024413.JPG
A H:\Day2\100GOPRO\G0024414.JPG
A H:\Day2\100GOPRO\G0024415.JPG
A H:\Day2\100GOPRO\G0024416.JPG
A H:\Day2\100GOPRO\G0024417.JPG
A H:\Day2\100GOPRO\G0024418.JPG
A H:\Day2\100GOPRO\G0024419.JPG
A H:\Day2\100GOPRO\G0024420.JPG
A H:\Day2\100GOPRO\G0024421.JPG
A H:\Day2\100GOPRO\G0024422.JPG
A H:\Day2\100GOPRO\G0024423.JPG
A H:\Day2\100GOPRO\G0024424.JPG
A H:\Day2\100GOPRO\G0024425.JPG
A H:\Day2\100GOPRO\G0024426.JPG
A H:\Day2\100GOPRO\G0024427.JPG
A H:\Day2\100GOPRO\G0024428.JPG
A H:\Day2\100GOPRO\G0024429.JPG
A H:\Day2\100GOPRO\G0024430.JPG
A H:\Day2\100GOPRO\G0024431.JPG
A H:\Day2\100GOPRO\G0024432.JPG
A H:\Day2\100GOPRO\G0024433.JPG
A H:\Day2\100GOPRO\G0024434.JPG
A H:\Day2\100GOPRO\G0024435.JPG
A H:\Day2\100GOPRO\G0024436.JPG
A H:\Day2\100GOPRO\G0024437.JPG
A H:\Day2\100GOPRO\G0024438.JPG
A H:\Day2\100GOPRO\G0024439.JPG
A H:\Day2\100GOPRO\G0024440.JPG
A H:\Day2\100GOPRO\G0024441.JPG
A H:\Day2\100GOPRO\G0024442.JPG
A H:\Day2\100GOPRO\G0024443.JPG
A H:\Day2\100GOPRO\G0024444.JPG
A H:\Day2\100GOPRO\G0024445.JPG
A H:\Day2\100GOPRO\G0024446.JPG
A H:\Day2\100GOPRO\G0024447.JPG
A H:\Day2\100GOPRO\G0024448.JPG
A H:\Day2\100GOPRO\G0024449.JPG
A H:\Day2\100GOPRO\G0024450.JPG
A H:\Day2\100GOPRO\G0024451.JPG
A H:\Day2\100GOPRO\G0024452.JPG
A H:\Day2\100GOPRO\G0024453.JPG
A H:\Day2\100GOPRO\G0024454.JPG
A H:\Day2\100GOPRO\G0024455.JPG
A H:\Day2\100GOPRO\G0024456.JPG
A H:\Day2\100GOPRO\G0024457.JPG
A H:\Day2\100GOPRO\G0024458.JPG
A H:\Day2\100GOPRO\G0024459.JPG
A H:\Day2\100GOPRO\G0024460.JPG
A H:\Day2\100GOPRO\G0024461.JPG
A H:\Day2\100GOPRO\G0024462.JPG
A H:\Day2\100GOPRO\G0024463.JPG
A H:\Day2\100GOPRO\G0024464.JPG
A H:\Day2\100GOPRO\G0024465.JPG
A H:\Day2\100GOPRO\G0024466.JPG
A H:\Day2\100GOPRO\G0024467.JPG
A H:\Day2\100GOPRO\G0024468.JPG
A H:\Day2\100GOPRO\G0024469.JPG
A H:\Day2\100GOPRO\G0024470.JPG
A H:\Day2\100GOPRO\G0024471.JPG
A H:\Day2\100GOPRO\G0024472.JPG
A H:\Day2\100GOPRO\G0024473.JPG
A H:\Day2\100GOPRO\G0024474.JPG
A H:\Day2\100GOPRO\G0024475.JPG
A H:\Day2\100GOPRO\G0024476.JPG
A H:\Day2\100GOPRO\G0024477.JPG
A H:\Day2\100GOPRO\G0024478.JPG
A H:\Day2\100GOPRO\G0024479.JPG
A H:\Day2\100GOPRO\G0024480.JPG
A H:\Day2\100GOPRO\G0024481.JPG
A H:\Day2\100GOPRO\G0024482.JPG
A H:\Day2\100GOPRO\G0024483.JPG
A H:\Day2\100GOPRO\G0024484.JPG
A H:\Day2\100GOPRO\G0024485.JPG
A H:\Day2\100GOPRO\G0024486.JPG
A H:\Day2\100GOPRO\G0024487.JPG
A H:\Day2\100GOPRO\G0024488.JPG
A H:\Day2\100GOPRO\G0024489.JPG
A H:\Day2\100GOPRO\G0024490.JPG
A H:\Day2\100GOPRO\G0024491.JPG
A H:\Day2\100GOPRO\G0024492.JPG
A H:\Day2\100GOPRO\G0024493.JPG
A H:\Day2\100GOPRO\G0024494.JPG
A H:\Day2\100GOPRO\G0024495.JPG
A H:\Day2\100GOPRO\G0024496.JPG
A H:\Day2\100GOPRO\G0024497.JPG
A H:\Day2\100GOPRO\G0024498.JPG
A H:\Day2\100GOPRO\G0024499.JPG
A H:\Day2\100GOPRO\G0024500.JPG
A H:\Day2\100GOPRO\G0024501.JPG
A H:\Day2\100GOPRO\G0024502.JPG
A H:\Day2\100GOPRO\G0024503.JPG
A H:\Day2\100GOPRO\G0024504.JPG
A H:\Day2\100GOPRO\G0024505.JPG
A H:\Day2\100GOPRO\G0024506.JPG
A H:\Day2\100GOPRO\G0024507.JPG
A H:\Day2\100GOPRO\G0024508.JPG
A H:\Day2\100GOPRO\G0024509.JPG
A H:\Day2\100GOPRO\G0024510.JPG
A H:\Day2\100GOPRO\G0024511.JPG
A H:\Day2\100GOPRO\G0024512.JPG
A H:\Day2\100GOPRO\G0024513.JPG
A H:\Day2\100GOPRO\G0024514.JPG
A H:\Day2\100GOPRO\G0024515.JPG
A H:\Day2\100GOPRO\G0024516.JPG
A H:\Day2\100GOPRO\G0024517.JPG
A H:\Day2\100GOPRO\G0024518.JPG
A H:\Day2\100GOPRO\G0024519.JPG
A H:\Day2\100GOPRO\G0024520.JPG
A H:\Day2\100GOPRO\G0024521.JPG
A H:\Day2\100GOPRO\G0024522.JPG
A H:\Day2\100GOPRO\G0024523.JPG
A H:\Day2\100GOPRO\G0024524.JPG
A H:\Day2\100GOPRO\G0024525.JPG
A H:\Day2\100GOPRO\G0024526.JPG
A H:\Day2\100GOPRO\G0024527.JPG
A H:\Day2\100GOPRO\G0024528.JPG
A H:\Day2\100GOPRO\G0024529.JPG
A H:\Day2\100GOPRO\G0024530.JPG
A H:\Day2\100GOPRO\G0024531.JPG
A H:\Day2\100GOPRO\G0024532.JPG
A H:\Day2\100GOPRO\G0024533.JPG
A H:\Day2\100GOPRO\G0024534.JPG
A H:\Day2\100GOPRO\G0024535.JPG
A H:\Day2\100GOPRO\G0024536.JPG
A H:\Day2\100GOPRO\G0024537.JPG
A H:\Day2\100GOPRO\G0024538.JPG
A H:\Day2\100GOPRO\G0024539.JPG
A H:\Day2\100GOPRO\G0024540.JPG
A H:\Day2\100GOPRO\G0024541.JPG
A H:\Day2\100GOPRO\G0024542.JPG
A H:\Day2\100GOPRO\G0024543.JPG
A H:\Day2\100GOPRO\G0024544.JPG
A H:\Day2\100GOPRO\G0024545.JPG
A H:\Day2\100GOPRO\G0024546.JPG
A H:\Day2\100GOPRO\G0024547.JPG
A H:\Day2\100GOPRO\G0024548.JPG
A H:\Day2\100GOPRO\G0024549.JPG
A H:\Day2\100GOPRO\G0024550.JPG
A H:\Day2\100GOPRO\G0024551.JPG
A H:\Day2\100GOPRO\G0024552.JPG
A H:\Day2\100GOPRO\G0024553.JPG
A H:\Day2\100GOPRO\G0024554.JPG
A H:\Day2\100GOPRO\G0024555.JPG
A H:\Day2\100GOPRO\G0024556.JPG
A H:\Day2\100GOPRO\G0024557.JPG
A H:\Day2\100GOPRO\G0024558.JPG
A H:\Day2\100GOPRO\G0024559.JPG
A H:\Day2\100GOPRO\G0024560.JPG
A H:\Day2\100GOPRO\G0024561.JPG
A H:\Day2\100GOPRO\G0024562.JPG
A H:\Day2\100GOPRO\G0024563.JPG
A H:\Day2\100GOPRO\G0024564.JPG
A H:\Day2\100GOPRO\G0024565.JPG
A H:\Day2\100GOPRO\G0024566.JPG
A H:\Day2\100GOPRO\G0024567.JPG
A H:\Day2\100GOPRO\G0024568.JPG
A H:\Day2\100GOPRO\G0024569.JPG
A H:\Day2\100GOPRO\G0024570.JPG
A H:\Day2\100GOPRO\G0024571.JPG
A H:\Day2\100GOPRO\G0024572.JPG
A H:\Day2\100GOPRO\G0024573.JPG
A H:\Day2\100GOPRO\G0024574.JPG
A H:\Day2\100GOPRO\G0024575.JPG
A H:\Day2\100GOPRO\G0024576.JPG
A H:\Day2\100GOPRO\G0024577.JPG
A H:\Day2\100GOPRO\G0024578.JPG
A H:\Day2\100GOPRO\G0024579.JPG
A H:\Day2\100GOPRO\G0024580.JPG
A H:\Day2\100GOPRO\G0024581.JPG
A H:\Day2\100GOPRO\G0024582.JPG
A H:\Day2\100GOPRO\G0024583.JPG
A H:\Day2\100GOPRO\G0024584.JPG
A H:\Day2\100GOPRO\G0024585.JPG
A H:\Day2\100GOPRO\G0024586.JPG
A H:\Day2\100GOPRO\G0024587.JPG
A H:\Day2\100GOPRO\G0024588.JPG
A H:\Day2\100GOPRO\G0024589.JPG
A H:\Day2\100GOPRO\G0024590.JPG
A H:\Day2\100GOPRO\G0024591.JPG
A H:\Day2\100GOPRO\G0024592.JPG
A H:\Day2\100GOPRO\G0024593.JPG
A H:\Day2\100GOPRO\G0024594.JPG
A H:\Day2\100GOPRO\G0024595.JPG
A H:\Day2\100GOPRO\G0024596.JPG
A H:\Day2\100GOPRO\G0024597.JPG
A H:\Day2\100GOPRO\G0024598.JPG
A H:\Day2\100GOPRO\G0024599.JPG
A H:\Day2\100GOPRO\G0024600.JPG
ssmad
Regular Member
 
Posts: 41
Joined: May 25th, 2013, 12:10 pm

Re: External WD HD infected with Win32:Kryptik.LQL

Unread postby ssmad » May 27th, 2013, 8:56 am

A H:\Day2\100GOPRO\G0024601.JPG
A H:\Day2\100GOPRO\G0024602.JPG
A H:\Day2\100GOPRO\G0024603.JPG
A H:\Day2\100GOPRO\G0024604.JPG
A H:\Day2\100GOPRO\G0024605.JPG
A H:\Day2\100GOPRO\G0024606.JPG
A H:\Day2\100GOPRO\G0024607.JPG
A H:\Day2\100GOPRO\G0024608.JPG
A H:\Day2\100GOPRO\G0024609.JPG
A H:\Day2\100GOPRO\G0024610.JPG
A H:\Day2\100GOPRO\G0024611.JPG
A H:\Day2\100GOPRO\G0024612.JPG
A H:\Day2\100GOPRO\G0024613.JPG
A H:\Day2\100GOPRO\G0024614.JPG
A H:\Day2\100GOPRO\G0024615.JPG
A H:\Day2\100GOPRO\G0024616.JPG
A H:\Day2\100GOPRO\G0024617.JPG
A H:\Day2\100GOPRO\G0024618.JPG
A H:\Day2\100GOPRO\G0024619.JPG
A H:\Day2\100GOPRO\G0024620.JPG
A H:\Day2\100GOPRO\G0024621.JPG
A H:\Day2\100GOPRO\G0024622.JPG
A H:\Day2\100GOPRO\G0024623.JPG
A H:\Day2\100GOPRO\G0024624.JPG
A H:\Day2\100GOPRO\G0024625.JPG
A H:\Day2\100GOPRO\G0024626.JPG
A H:\Day2\100GOPRO\G0024627.JPG
A H:\Day2\100GOPRO\G0024628.JPG
A H:\Day2\100GOPRO\G0024629.JPG
A H:\Day2\100GOPRO\G0024630.JPG
A H:\Day2\100GOPRO\G0024631.JPG
A H:\Day2\100GOPRO\G0024632.JPG
A H:\Day2\100GOPRO\G0024633.JPG
A H:\Day2\100GOPRO\G0024634.JPG
A H:\Day2\100GOPRO\G0024635.JPG
A H:\Day2\100GOPRO\G0024636.JPG
A H:\Day2\100GOPRO\G0024637.JPG
A H:\Day2\100GOPRO\G0024638.JPG
A H:\Day2\100GOPRO\G0024639.JPG
A H:\Day2\100GOPRO\G0024640.JPG
A H:\Day2\100GOPRO\G0024641.JPG
A H:\Day2\100GOPRO\G0024642.JPG
A H:\Day2\100GOPRO\G0024643.JPG
A H:\Day2\100GOPRO\G0024644.JPG
A H:\Day2\100GOPRO\G0024645.JPG
A H:\Day2\100GOPRO\G0024646.JPG
A H:\Day2\100GOPRO\G0024647.JPG
A H:\Day2\100GOPRO\G0024648.JPG
A H:\Day2\100GOPRO\G0024649.JPG
A H:\Day2\100GOPRO\G0024650.JPG
A H:\Day2\100GOPRO\G0024651.JPG
A H:\Day2\100GOPRO\G0024652.JPG
A H:\Day2\100GOPRO\G0024653.JPG
A H:\Day2\100GOPRO\G0024654.JPG
A H:\Day2\100GOPRO\G0024655.JPG
A H:\Day2\100GOPRO\G0024656.JPG
A H:\Day2\100GOPRO\G0024657.JPG
A H:\Day2\100GOPRO\G0024658.JPG
A H:\Day2\100GOPRO\G0024659.JPG
A H:\Day2\100GOPRO\G0024660.JPG
A H:\Day2\100GOPRO\G0024661.JPG
A H:\Day2\100GOPRO\G0024662.JPG
A H:\Day2\100GOPRO\G0024663.JPG
A H:\Day2\100GOPRO\G0024664.JPG
A H:\Day2\100GOPRO\G0024665.JPG
A H:\Day2\100GOPRO\G0024666.JPG
A H:\Day2\100GOPRO\G0024667.JPG
A H:\Day2\100GOPRO\G0024668.JPG
A H:\Day2\100GOPRO\G0024669.JPG
A H:\Day2\100GOPRO\G0024670.JPG
A H:\Day2\100GOPRO\G0024671.JPG
A H:\Day2\100GOPRO\G0024672.JPG
A H:\Day2\100GOPRO\G0024673.JPG
A H:\Day2\100GOPRO\G0024674.JPG
A H:\Day2\100GOPRO\G0024675.JPG
A H:\Day2\100GOPRO\G0024676.JPG
A H:\Day2\100GOPRO\G0024677.JPG
A H:\Day2\100GOPRO\G0024678.JPG
A H:\Day2\100GOPRO\G0024679.JPG
A H:\Day2\100GOPRO\G0024680.JPG
A H:\Day2\100GOPRO\G0024681.JPG
A H:\Day2\100GOPRO\G0024682.JPG
A H:\Day2\100GOPRO\G0024683.JPG
A H:\Day2\100GOPRO\G0024684.JPG
A H:\Day2\100GOPRO\G0024685.JPG
A H:\Day2\100GOPRO\G0034686.JPG
A H:\Day2\100GOPRO\G0034687.JPG
A H:\Day2\100GOPRO\G0034688.JPG
A H:\Day2\100GOPRO\G0034689.JPG
A H:\Day2\100GOPRO\G0034690.JPG
A H:\Day2\100GOPRO\G0034691.JPG
A H:\Day2\100GOPRO\G0034692.JPG
A H:\Day2\100GOPRO\G0034693.JPG
A H:\Day2\100GOPRO\G0034694.JPG
A H:\Day2\100GOPRO\GOPR0009.MP4
A H:\Day2\100GOPRO\GOPR0010.JPG
A H:\Day2\100GOPRO\GOPR0040.JPG
A H:\Day2\100GOPRO\GOPR4695.MP4
A H:\Day2\100GOPRO\GOPR4696.MP4
A H:\Day2\100GOPRO\GOPR4697.MP4
A H:\Day2\100GOPRO\GOPR4698.MP4
A H:\Day2\100GOPRO\GOPR4699.MP4
A H:\Day2\100GOPRO\GOPR4700.MP4
A H:\Day2\100GOPRO\GOPR4701.MP4
A H:\Day2\100GOPRO\GOPR4702.MP4
A H:\Day2\100GOPRO\GOPR4703.MP4
A H:\Day2\100GOPRO\GOPR4704.MP4
A H:\Day2\5D II\IMG_0679.CR2
A H:\Day2\5D II\IMG_0680.CR2
A H:\Day2\5D II\IMG_0681.CR2
A H:\Day2\5D II\IMG_0682.CR2
A H:\Day2\5D II\IMG_0683.CR2
A H:\Day2\5D II\IMG_0684.CR2
A H:\Day2\5D II\IMG_0685.CR2
A H:\Day2\5D II\IMG_0686.CR2
A H:\Day2\5D II\IMG_0687.CR2
A H:\Day2\5D II\IMG_0688.CR2
A H:\Day2\5D II\IMG_0689.CR2
A H:\Day2\5D II\IMG_0690.CR2
A H:\Day2\5D II\IMG_0691.CR2
A H:\Day2\5D II\IMG_0692.CR2
A H:\Day2\5D II\IMG_0693.CR2
A H:\Day2\5D II\IMG_0694.CR2
A H:\Day2\5D II\IMG_0695.CR2
A H:\Day2\5D II\IMG_0696.CR2
A H:\Day2\5D II\IMG_0697.CR2
A H:\Day2\5D II\IMG_0698.CR2
A H:\Day2\5D II\IMG_0699.CR2
A H:\Day2\5D II\IMG_0700.CR2
A H:\Day2\5D II\IMG_0703.CR2
A H:\Day2\5D II\IMG_0705.CR2
A H:\Day2\5D II\IMG_0707.CR2
A H:\Day2\5D II\IMG_0708.CR2
A H:\Day2\5D II\IMG_0709.CR2
A H:\Day2\5D II\IMG_0710.CR2
A H:\Day2\5D II\IMG_0711.CR2
A H:\Day2\5D II\IMG_0712.CR2
A H:\Day2\5D II\IMG_0713.CR2
A H:\Day2\5D II\IMG_0714.CR2
A H:\Day2\5D II\IMG_0715.CR2
A H:\Day2\5D II\IMG_0716.CR2
A H:\Day2\5D II\IMG_0717.CR2
A H:\Day2\5D II\IMG_0718.CR2
A H:\Day2\5D II\IMG_0719.CR2
A H:\Day2\5D II\IMG_0720.CR2
A H:\Day2\5D II\IMG_0721.CR2
A H:\Day2\5D II\IMG_0722.CR2
A H:\Day2\5D II\IMG_0723.CR2
A H:\Day2\5D II\IMG_0724.CR2
A H:\Day2\5D II\IMG_0725.CR2
A H:\Day2\5D II\IMG_0726.CR2
A H:\Day2\5D II\IMG_0727.CR2
A H:\Day2\5D II\IMG_0731.CR2
A H:\Day2\5D II\IMG_0732.CR2
A H:\Day2\5D II\IMG_0739.CR2
A H:\Day2\5D II\IMG_0740.CR2
A H:\Day2\5D II\IMG_0741.CR2
A H:\Day2\5D II\IMG_0742.CR2
A H:\Day2\5D II\IMG_0743.CR2
A H:\Day2\5D II\IMG_0744.CR2
A H:\Day2\5D II\IMG_0745.CR2
A H:\Day2\5D II\IMG_0746.CR2
A H:\Day2\5D II\IMG_0747.CR2
A H:\Day2\5D II\IMG_0748.CR2
A H:\Day2\5D II\IMG_0749.CR2
A H:\Day2\5D II\IMG_0750.CR2
A H:\Day2\5D II\IMG_0751.CR2
A H:\Day2\5D II\IMG_0752.CR2
A H:\Day2\5D II\IMG_0753.CR2
A H:\Day2\5D II\IMG_0754.CR2
A H:\Day2\5D II\IMG_0755.CR2
A H:\Day2\5D II\IMG_0756.CR2
A H:\Day2\5D II\IMG_0757.CR2
A H:\Day2\5D II\IMG_0758.CR2
A H:\Day2\5D II\IMG_0759.CR2
A H:\Day2\5D II\IMG_0760.CR2
A H:\Day2\5D II\IMG_0761.CR2
A H:\Day2\5D II\IMG_0762.CR2
A H:\Day2\5D II\IMG_0763.CR2
A H:\Day2\5D II\IMG_0764.CR2
A H:\Day2\5D II\IMG_0765.CR2
A H:\Day2\5D II\IMG_0766.CR2
A H:\Day2\5D II\IMG_0767.CR2
A H:\Day2\5D II\IMG_0768.CR2
A H:\Day2\5D II\IMG_0769.CR2
A H:\Day2\5D II\IMG_0770.CR2
A H:\Day2\5D II\IMG_0771.CR2
A H:\Day2\5D II\IMG_0772.CR2
A H:\Day2\5D II\IMG_0773.CR2
A H:\Day2\5D II\IMG_0774.CR2
A H:\Day2\5D II\IMG_0775.CR2
A H:\Day2\5D II\IMG_0776.CR2
A H:\Day2\5D II\IMG_0781.CR2
A H:\Day2\5D II\IMG_0782.CR2
A H:\Day2\5D II\IMG_0783.CR2
A H:\Day2\5D II\IMG_0784.CR2
A H:\Day2\5D II\IMG_0785.CR2
A H:\Day2\5D II\IMG_0786.CR2
A H:\Day2\5D II\IMG_0787.CR2
A H:\Day2\5D II\IMG_0788.CR2
A H:\Day2\5D II\IMG_0789.CR2
A H:\Day2\5D II\IMG_0790.CR2
A H:\Day2\5D II\IMG_0791.CR2
A H:\Day2\5D II\IMG_0792.CR2
A H:\Day2\5D II\IMG_0793.CR2
A H:\Day2\5D II\IMG_0794.CR2
A H:\Day2\5D II\IMG_0795.CR2
A H:\Day2\5D II\IMG_0796.CR2
A H:\Day2\5D II\IMG_0797.CR2
A H:\Day2\5D II\IMG_0798.CR2
A H:\Day2\5D II\IMG_0799.CR2
A H:\Day2\5D II\IMG_0800.CR2
A H:\Day2\5D II\IMG_0801.CR2
A H:\Day2\5D II\IMG_0802.CR2
A H:\Day2\5D II\IMG_0803.CR2
A H:\Day2\5D II\IMG_0804.CR2
A H:\Day2\5D II\IMG_0805.CR2
A H:\Day2\5D II\IMG_0806.CR2
A H:\Day2\5D II\IMG_0807.CR2
A H:\Day2\5D II\IMG_0808.CR2
A H:\Day2\5D II\IMG_0809.CR2
A H:\Day2\5D II\IMG_0810.CR2
A H:\Day2\5D II\IMG_0811.CR2
A H:\Day2\5D II\IMG_0818.CR2
A H:\Day2\5D II\IMG_0819.CR2
A H:\Day2\5D II\IMG_0820.CR2
A H:\Day2\5D II\IMG_0821.CR2
A H:\Day2\5D II\IMG_0822.CR2
A H:\Day2\5D II\IMG_0823.CR2
A H:\Day2\5D II\IMG_0824.CR2
A H:\Day2\5D II\IMG_0825.CR2
A H:\Day2\5D II\IMG_0826.CR2
A H:\Day2\5D II\IMG_0827.CR2
A H:\Day2\5D II\IMG_0828.CR2
A H:\Day2\5D II\IMG_0829.CR2
A H:\Day2\5D II\IMG_0846.CR2
A H:\Day2\5D II\IMG_0847.CR2
A H:\Day2\5D II\IMG_0848.CR2
A H:\Day2\5D II\IMG_0849.CR2
A H:\Day2\5D II\IMG_0850.CR2
A H:\Day2\5D II\IMG_0851.CR2
A H:\Day2\5D II\IMG_0853.CR2
A H:\Day2\5D II\IMG_0854.CR2
A H:\Day2\5D II\IMG_0855.CR2
A H:\Day2\5D II\IMG_0856.CR2
A H:\Day2\5D II\IMG_0857.CR2
A H:\Day2\5D II\IMG_0858.CR2
A H:\Day2\5D II\IMG_0859.CR2
A H:\Day2\5D II\IMG_0860.CR2
A H:\Day2\5D II\IMG_0861.CR2
A H:\Day2\5D II\IMG_0862.CR2
A H:\Day2\5D II\IMG_0863.CR2
A H:\Day2\5D II\IMG_0864.CR2
A H:\Day2\5D II\IMG_0865.CR2
A H:\Day2\5D II\IMG_0866.CR2
A H:\Day2\5D II\IMG_0867.CR2
A H:\Day2\5D II\IMG_0868.CR2
A H:\Day2\5D II\IMG_0869.CR2
A H:\Day2\5D II\IMG_0870.CR2
A H:\Day2\5D II\IMG_0871.CR2
A H:\Day2\5D II\IMG_0872.CR2
A H:\Day2\5D II\IMG_0873.CR2
A H:\Day2\5D II\IMG_0874.CR2
A H:\Day2\5D II\IMG_0875.CR2
A H:\Day2\5D II\IMG_0876.CR2
A H:\Day2\5D II\IMG_0877.CR2
A H:\Day2\5D II\IMG_0878.CR2
A H:\Day2\5D II\IMG_0879.CR2
A H:\Day2\5D II\IMG_0880.CR2
A H:\Day2\5D II\IMG_0881.CR2
A H:\Day2\5D II\IMG_0882.CR2
A H:\Day2\5D II\IMG_0883.CR2
A H:\Day2\5D II\IMG_0884.CR2
A H:\Day2\5D II\IMG_0885.CR2
A H:\Day2\5D II\IMG_0886.CR2
A H:\Day2\5D II\IMG_0887.CR2
A H:\Day2\5D II\IMG_0888.CR2
A H:\Day2\5D II\IMG_0889.CR2
A H:\Day2\5D II\IMG_0890.CR2
A H:\Day2\5D II\IMG_0891.CR2
A H:\Day2\5D II\IMG_0892.CR2
A H:\Day2\5D II\IMG_0893.CR2
A H:\Day2\5D II\IMG_0894.CR2
A H:\Day2\5D II\IMG_0895.CR2
A H:\Day2\5D II\IMG_0896.CR2
A H:\Day2\5D II\IMG_0897.CR2
A H:\Day2\5D II\IMG_0898.CR2
A H:\Day2\5D II\IMG_0899.CR2
A H:\Day2\5D II\IMG_0900.CR2
A H:\Day2\5D II\IMG_0901.CR2
A H:\Day2\5D II\MVI_0665.MOV
A H:\Day2\5D II\MVI_0665.THM
A H:\Day2\5D II\MVI_0666.MOV
A H:\Day2\5D II\MVI_0666.THM
A H:\Day2\5D II\MVI_0667.MOV
A H:\Day2\5D II\MVI_0667.THM
A H:\Day2\5D II\MVI_0668.MOV
A H:\Day2\5D II\MVI_0668.THM
A H:\Day2\5D II\MVI_0669.MOV
A H:\Day2\5D II\MVI_0669.THM
A H:\Day2\5D II\MVI_0670.MOV
A H:\Day2\5D II\MVI_0670.THM
A H:\Day2\5D II\MVI_0671.MOV
A H:\Day2\5D II\MVI_0671.THM
A H:\Day2\5D II\MVI_0672.MOV
A H:\Day2\5D II\MVI_0672.THM
A H:\Day2\5D II\MVI_0673.MOV
A H:\Day2\5D II\MVI_0673.THM
A H:\Day2\5D II\MVI_0674.MOV
A H:\Day2\5D II\MVI_0674.THM
A H:\Day2\5D II\MVI_0675.MOV
A H:\Day2\5D II\MVI_0675.THM
A H:\Day2\5D II\MVI_0676.MOV
A H:\Day2\5D II\MVI_0676.THM
A H:\Day2\5D II\MVI_0728.MOV
A H:\Day2\5D II\MVI_0728.THM
A H:\Day2\5D II\MVI_0729.MOV
A H:\Day2\5D II\MVI_0729.THM
A H:\Day2\5D II\MVI_0730.MOV
A H:\Day2\5D II\MVI_0730.THM
A H:\Day2\5D II\MVI_0733.MOV
A H:\Day2\5D II\MVI_0733.THM
A H:\Day2\5D II\MVI_0734.MOV
A H:\Day2\5D II\MVI_0734.THM
A H:\Day2\5D II\MVI_0735.MOV
A H:\Day2\5D II\MVI_0735.THM
A H:\Day2\5D II\MVI_0736.MOV
A H:\Day2\5D II\MVI_0736.THM
A H:\Day2\5D II\MVI_0737.MOV
A H:\Day2\5D II\MVI_0737.THM
A H:\Day2\5D II\MVI_0738.MOV
A H:\Day2\5D II\MVI_0738.THM
A H:\Day2\5D II\MVI_0777.MOV
A H:\Day2\5D II\MVI_0777.THM
A H:\Day2\5D II\MVI_0778.MOV
A H:\Day2\5D II\MVI_0778.THM
A H:\Day2\5D II\MVI_0779.MOV
A H:\Day2\5D II\MVI_0779.THM
A H:\Day2\5D II\MVI_0780.MOV
A H:\Day2\5D II\MVI_0780.THM
A H:\Day2\5D II\MVI_0812.MOV
A H:\Day2\5D II\MVI_0812.THM
A H:\Day2\5D II\MVI_0813.MOV
A H:\Day2\5D II\MVI_0813.THM
A H:\Day2\5D II\MVI_0814.MOV
A H:\Day2\5D II\MVI_0814.THM
A H:\Day2\5D II\MVI_0815.MOV
A H:\Day2\5D II\MVI_0815.THM
A H:\Day2\5D II\MVI_0816.MOV
A H:\Day2\5D II\MVI_0816.THM
A H:\Day2\5D II\MVI_0817.MOV
A H:\Day2\5D II\MVI_0817.THM
A H:\Day2\5D II\MVI_0830.MOV
A H:\Day2\5D II\MVI_0830.THM
A H:\Day2\5D II\MVI_0831.MOV
A H:\Day2\5D II\MVI_0831.THM
A H:\Day2\5D II\MVI_0832.MOV
A H:\Day2\5D II\MVI_0832.THM
A H:\Day2\5D II\MVI_0833.MOV
A H:\Day2\5D II\MVI_0833.THM
A H:\Day2\5D II\MVI_0834.MOV
A H:\Day2\5D II\MVI_0834.THM
A H:\Day2\5D II\MVI_0835.MOV
A H:\Day2\5D II\MVI_0835.THM
A H:\Day2\5D II\MVI_0836.MOV
A H:\Day2\5D II\MVI_0836.THM
A H:\Day2\5D II\MVI_0837.MOV
A H:\Day2\5D II\MVI_0837.THM
A H:\Day2\5D II\MVI_0838.MOV
A H:\Day2\5D II\MVI_0838.THM
A H:\Day2\5D II\MVI_0839.MOV
A H:\Day2\5D II\MVI_0839.THM
A H:\Day2\5D II\MVI_0840.MOV
A H:\Day2\5D II\MVI_0840.THM
A H:\Day2\5D II\MVI_0841.MOV
A H:\Day2\5D II\MVI_0841.THM
A H:\Day2\5D II\MVI_0842.MOV
A H:\Day2\5D II\MVI_0842.THM
A H:\Day2\5D II\MVI_0843.MOV
A H:\Day2\5D II\MVI_0843.THM
A H:\Day2\5D II\MVI_0844.MOV
A H:\Day2\5D II\MVI_0844.THM
A H:\Day2\5D II\MVI_0845.MOV
A H:\Day2\5D II\MVI_0845.THM
A H:\Day2\5D II\MVI_0852.MOV
A H:\Day2\5D II\MVI_0852.THM
A H:\Day2\5D II\MVI_0902.MOV
A H:\Day2\5D II\MVI_0902.THM
A H:\Day2\5D II\MVI_0903.MOV
A H:\Day2\5D II\MVI_0903.THM
A H:\Day2\5D II\MVI_0904.MOV
A H:\Day2\5D II\MVI_0904.THM
A H:\Day2\5D II\MVI_0905.MOV
A H:\Day2\5D II\MVI_0905.THM
A H:\Day2\5D II\MVI_0906.MOV
A H:\Day2\5D II\MVI_0906.THM
A H:\Day2\5D II\MVI_0907.MOV
A H:\Day2\5D II\MVI_0907.THM
A H:\Day2\5D II\MVI_0908.MOV
A H:\Day2\5D II\MVI_0908.THM
A H:\Day2\5D II\MVI_0909.MOV
A H:\Day2\5D II\MVI_0909.THM
A H:\Day2\5D II\MVI_0910.MOV
A H:\Day2\5D II\MVI_0910.THM
A H:\Day2\5D II\MVI_0911.MOV
A H:\Day2\5D II\MVI_0911.THM
A H:\Day2\5D II\MVI_0912.MOV
A H:\Day2\5D II\MVI_0912.THM
A H:\Day2\5D II\MVI_0913.MOV
A H:\Day2\5D II\MVI_0913.THM
A H:\Day2\5D II\MVI_0914.MOV
A H:\Day2\5D II\MVI_0914.THM
A H:\Day2\60D\IMG_5233.CR2
A H:\Day2\60D\IMG_5234.CR2
A H:\Day2\60D\IMG_5235.CR2
A H:\Day2\60D\IMG_5237.CR2
A H:\Day2\60D\IMG_5238.CR2
A H:\Day2\60D\IMG_5239.CR2
A H:\Day2\60D\IMG_5240.CR2
A H:\Day2\60D\IMG_5241.CR2
A H:\Day2\60D\IMG_5242.CR2
A H:\Day2\60D\IMG_5243.CR2
A H:\Day2\60D\IMG_5244.CR2
A H:\Day2\60D\IMG_5245.CR2
A H:\Day2\60D\IMG_5246.CR2
A H:\Day2\60D\IMG_5253.CR2
A H:\Day2\60D\IMG_5254.CR2
A H:\Day2\60D\IMG_5266.CR2
A H:\Day2\60D\IMG_5267.CR2
A H:\Day2\60D\IMG_5268.CR2
A H:\Day2\60D\IMG_5269.CR2
A H:\Day2\60D\IMG_5270.CR2
A H:\Day2\60D\IMG_5271.CR2
A H:\Day2\60D\IMG_5272.CR2
A H:\Day2\60D\IMG_5273.CR2
A H:\Day2\60D\IMG_5274.CR2
A H:\Day2\60D\IMG_5275.CR2
A H:\Day2\60D\IMG_5276.CR2
A H:\Day2\60D\IMG_5277.CR2
A H:\Day2\60D\IMG_5278.CR2
A H:\Day2\60D\IMG_5279.CR2
A H:\Day2\60D\IMG_5280.CR2
A H:\Day2\60D\IMG_5281.CR2
A H:\Day2\60D\IMG_5282.CR2
A H:\Day2\60D\MVI_5236.MOV
A H:\Day2\60D\MVI_5247.MOV
A H:\Day2\60D\MVI_5248.MOV
A H:\Day2\60D\MVI_5249.MOV
A H:\Day2\60D\MVI_5250.MOV
A H:\Day2\60D\MVI_5251.MOV
A H:\Day2\60D\MVI_5252.MOV
A H:\Day2\60D\MVI_5255.MOV
A H:\Day2\60D\MVI_5256.MOV
A H:\Day2\60D\MVI_5257.MOV
A H:\Day2\60D\MVI_5258.MOV
A H:\Day2\60D\MVI_5259.MOV
A H:\Day2\60D\MVI_5260.MOV
A H:\Day2\60D\MVI_5261.MOV
A H:\Day2\60D\MVI_5262.MOV
A H:\Day2\60D\MVI_5263.MOV
A H:\Day2\60D\MVI_5264.MOV
A H:\Day2\60D\MVI_5265.MOV
A H:\Day3\101GOPRO\GOPR4717.MP4
A H:\Day3\101GOPRO\GOPR4718.MP4
A H:\Day3\101GOPRO\GP014718.MP4
A H:\Day3\5D II\IMG_0915.CR2
A H:\Day3\5D II\IMG_0916.CR2
A H:\Day3\5D II\IMG_0917.CR2
A H:\Day3\5D II\IMG_0918.CR2
A H:\Day3\5D II\IMG_0919.CR2
A H:\Day3\5D II\IMG_0920.CR2
A H:\Day3\5D II\IMG_0921.CR2
A H:\Day3\5D II\IMG_0922.CR2
A H:\Day3\5D II\IMG_0923.CR2
A H:\Day3\5D II\IMG_0924.CR2
A H:\Day3\5D II\IMG_0925.CR2
A H:\Day3\5D II\IMG_0926.CR2
A H:\Day3\5D II\IMG_0927.CR2
A H:\Day3\5D II\IMG_0928.CR2
A H:\Day3\5D II\IMG_0929.CR2
A H:\Day3\5D II\IMG_0930.CR2
A H:\Day3\5D II\IMG_0931.CR2
A H:\Day3\5D II\IMG_0932.CR2
A H:\Day3\5D II\IMG_0933.CR2
A H:\Day3\5D II\IMG_0934.CR2
A H:\Day3\5D II\IMG_0935.CR2
A H:\Day3\5D II\IMG_0936.CR2
A H:\Day3\5D II\IMG_0937.CR2
A H:\Day3\5D II\IMG_0938.CR2
A H:\Day3\5D II\IMG_0939.CR2
A H:\Day3\5D II\IMG_0940.CR2
A H:\Day3\5D II\IMG_0941.CR2
A H:\Day3\5D II\IMG_0942.CR2
A H:\Day3\5D II\IMG_0943.CR2
A H:\Day3\5D II\IMG_0944.CR2
A H:\Day3\5D II\IMG_0945.CR2
A H:\Day3\5D II\IMG_0946.CR2
A H:\Day3\5D II\IMG_0947.CR2
A H:\Day3\5D II\IMG_0948.CR2
A H:\Day3\5D II\IMG_0949.CR2
A H:\Day3\5D II\IMG_0950.CR2
A H:\Day3\5D II\IMG_0951.CR2
A H:\Day3\5D II\IMG_0952.CR2
A H:\Day3\5D II\IMG_0953.CR2
A H:\Day3\5D II\IMG_0954.CR2
A H:\Day3\5D II\IMG_0955.CR2
A H:\Day3\5D II\IMG_0956.CR2
A H:\Day3\5D II\IMG_0957.CR2
A H:\Day3\5D II\IMG_0958.CR2
A H:\Day3\5D II\IMG_0959.CR2
A H:\Day3\5D II\IMG_0960.CR2
A H:\Day3\5D II\IMG_0961.CR2
A H:\Day3\5D II\IMG_0962.CR2
A H:\Day3\5D II\IMG_0963.CR2
A H:\Day3\5D II\IMG_0964.CR2
A H:\Day3\5D II\IMG_0965.CR2
A H:\Day3\5D II\IMG_0966.CR2
A H:\Day3\5D II\IMG_0967.CR2
A H:\Day3\5D II\IMG_0968.CR2
A H:\Day3\5D II\IMG_0969.CR2
A H:\Day3\5D II\IMG_0970.CR2
A H:\Day3\5D II\IMG_0971.CR2
A H:\Day3\5D II\IMG_0972.CR2
A H:\Day3\5D II\IMG_0973.CR2
A H:\Day3\5D II\IMG_0974.CR2
A H:\Day3\5D II\IMG_0975.CR2
A H:\Day3\5D II\IMG_0976.CR2
A H:\Day3\5D II\IMG_0977.CR2
A H:\Day3\5D II\IMG_0978.CR2
A H:\Day3\5D II\IMG_0979.CR2
A H:\Day3\5D II\IMG_0980.CR2
A H:\Day3\5D II\IMG_0981.CR2
A H:\Day3\5D II\IMG_0982.CR2
A H:\Day3\5D II\IMG_0983.CR2
A H:\Day3\5D II\IMG_0984.CR2
A H:\Day3\5D II\IMG_0985.CR2
A H:\Day3\5D II\IMG_0986.CR2
A H:\Day3\5D II\IMG_0987.CR2
A H:\Day3\5D II\IMG_0988.CR2
A H:\Day3\5D II\IMG_0989.CR2
A H:\Day3\5D II\IMG_0990.CR2
A H:\Day3\5D II\IMG_0991.CR2
A H:\Day3\5D II\IMG_0992.CR2
A H:\Day3\5D II\IMG_0993.CR2
A H:\Day3\5D II\IMG_0994.CR2
A H:\Day3\5D II\IMG_0995.CR2
A H:\Day3\5D II\IMG_0996.CR2
A H:\Day3\5D II\IMG_0997.CR2
A H:\Day3\5D II\IMG_0998.CR2
A H:\Day3\5D II\IMG_0999.CR2
A H:\Day3\5D II\IMG_1000.CR2
A H:\Day3\5D II\IMG_1001.CR2
A H:\Day3\5D II\IMG_1002.CR2
A H:\Day3\5D II\IMG_1003.CR2
A H:\Day3\5D II\IMG_1004.CR2
A H:\Day3\5D II\IMG_1005.CR2
A H:\Day3\5D II\IMG_1006.CR2
A H:\Day3\5D II\IMG_1007.CR2
A H:\Day3\5D II\IMG_1008.CR2
A H:\Day3\5D II\IMG_1009.CR2
A H:\Day3\5D II\IMG_1010.CR2
A H:\Day3\5D II\IMG_1011.CR2
A H:\Day3\5D II\IMG_1012.CR2
A H:\Day3\5D II\IMG_1013.CR2
A H:\Day3\5D II\IMG_1014.CR2
A H:\Day3\5D II\IMG_1015.CR2
A H:\Day3\5D II\IMG_1016.CR2
A H:\Day3\5D II\IMG_1017.CR2
A H:\Day3\5D II\IMG_1018.CR2
A H:\Day3\5D II\IMG_1019.CR2
A H:\Day3\5D II\IMG_1020.CR2
A H:\Day3\5D II\IMG_1021.CR2
A H:\Day3\5D II\IMG_1022.CR2
A H:\Day3\5D II\IMG_1023.CR2
A H:\Day3\5D II\IMG_1024.CR2
A H:\Day3\5D II\IMG_1025.CR2
A H:\Day3\5D II\IMG_1026.CR2
A H:\Day3\5D II\IMG_1027.CR2
A H:\Day3\5D II\IMG_1028.CR2
A H:\Day3\5D II\IMG_1029.CR2
A H:\Day3\5D II\IMG_1030.CR2
A H:\Day3\5D II\IMG_1031.CR2
A H:\Day3\5D II\IMG_1032.CR2
A H:\Day3\5D II\IMG_1033.CR2
A H:\Day3\5D II\IMG_1034.CR2
A H:\Day3\5D II\IMG_1035.CR2
A H:\Day3\5D II\IMG_1036.CR2
A H:\Day3\5D II\IMG_1037.CR2
A H:\Day3\5D II\IMG_1038.CR2
A H:\Day3\5D II\IMG_1039.CR2
A H:\Day3\5D II\IMG_1040.CR2
A H:\Day3\5D II\IMG_1041.CR2
A H:\Day3\5D II\IMG_1042.CR2
A H:\Day3\5D II\IMG_1043.CR2
A H:\Day3\5D II\IMG_1044.CR2
A H:\Day3\5D II\IMG_1045.CR2
A H:\Day3\5D II\IMG_1046.CR2
A H:\Day3\5D II\IMG_1047.CR2
A H:\Day3\5D II\IMG_1048.CR2
A H:\Day3\5D II\IMG_1049.CR2
A H:\Day3\5D II\IMG_1050.CR2
A H:\Day3\5D II\IMG_1051.CR2
A H:\Day3\5D II\IMG_1052.CR2
A H:\Day3\5D II\IMG_1053.CR2
A H:\Day3\5D II\IMG_1054.CR2
A H:\Day3\5D II\IMG_1055.CR2
A H:\Day3\5D II\IMG_1056.CR2
A H:\Day3\5D II\IMG_1057.CR2
A H:\Day3\5D II\IMG_1058.CR2
A H:\Day3\5D II\IMG_1059.CR2
A H:\Day3\5D II\IMG_1060.CR2
A H:\Day3\5D II\IMG_1061.CR2
A H:\Day3\5D II\IMG_1062.CR2
A H:\Day3\5D II\IMG_1063.CR2
A H:\Day3\5D II\IMG_1064.CR2
A H:\Day3\5D II\IMG_1065.CR2
A H:\Day3\5D II\IMG_1066.CR2
A H:\Day3\5D II\IMG_1067.CR2
A H:\Day3\5D II\IMG_1068.CR2
A H:\Day3\5D II\IMG_1069.CR2
A H:\Day3\5D II\IMG_1070.CR2
A H:\Day3\5D II\IMG_1071.CR2
A H:\Day3\5D II\IMG_1072.CR2
A H:\Day3\5D II\IMG_1073.CR2
A H:\Day3\5D II\IMG_1074.CR2
A H:\Day3\5D II\IMG_1075.CR2
A H:\Day3\5D II\IMG_1076.CR2
A H:\Day3\5D II\IMG_1077.CR2
A H:\Day3\5D II\IMG_1078.CR2
A H:\Day3\5D II\IMG_1079.CR2
A H:\Day3\5D II\IMG_1080.CR2
A H:\Day3\5D II\IMG_1081.CR2
A H:\Day3\5D II\IMG_1082.CR2
A H:\Day3\5D II\IMG_1083.CR2
A H:\Day3\5D II\IMG_1084.CR2
A H:\Day3\5D II\IMG_1085.CR2
A H:\Day3\5D II\IMG_1086.CR2
A H:\Day3\5D II\IMG_1087.CR2
A H:\Day3\5D II\IMG_1088.CR2
A H:\Day3\5D II\IMG_1089.CR2
A H:\Day3\5D II\IMG_1090.CR2
A H:\Day3\5D II\IMG_1091.CR2
A H:\Day3\5D II\IMG_1092.CR2
A H:\Day3\5D II\IMG_1093.CR2
A H:\Day3\5D II\IMG_1094.CR2
A H:\Day3\5D II\IMG_1095.CR2
A H:\Day3\5D II\IMG_1096.CR2
A H:\Day3\5D II\IMG_1097.CR2
A H:\Day3\5D II\IMG_1098.CR2
A H:\Day3\5D II\IMG_1099.CR2
A H:\Day3\5D II\IMG_1100.CR2
A H:\Day3\5D II\IMG_1101.CR2
A H:\Day3\5D II\IMG_1102.CR2
A H:\Day3\5D II\IMG_1103.CR2
A H:\Day3\5D II\IMG_1104.CR2
A H:\Day3\5D II\IMG_1105.CR2
A H:\Day3\5D II\IMG_1106.CR2
A H:\Day3\5D II\IMG_1107.CR2
A H:\Day3\5D II\IMG_1108.CR2
A H:\Day3\5D II\IMG_1109.CR2
A H:\Day3\5D II\IMG_1110.CR2
A H:\Day3\5D II\IMG_1112.CR2
A H:\Day3\5D II\IMG_1113.CR2
A H:\Day3\5D II\IMG_1114.CR2
A H:\Day3\5D II\IMG_1115.CR2
A H:\Day3\5D II\IMG_1116.CR2
A H:\Day3\5D II\IMG_1117.CR2
A H:\Day3\5D II\IMG_1118.CR2
A H:\Day3\5D II\IMG_1119.CR2
A H:\Day3\5D II\IMG_1120.CR2
A H:\Day3\5D II\IMG_1121.CR2
A H:\Day3\5D II\IMG_1122.CR2
A H:\Day3\5D II\IMG_1123.CR2
A H:\Day3\5D II\IMG_1124.CR2
A H:\Day3\5D II\IMG_1125.CR2
A H:\Day3\5D II\IMG_1126.CR2
A H:\Day3\5D II\IMG_1127.CR2
A H:\Day3\5D II\IMG_1128.CR2
A H:\Day3\5D II\IMG_1129.CR2
A H:\Day3\5D II\IMG_1130.CR2
A H:\Day3\5D II\IMG_1131.CR2
A H:\Day3\5D II\IMG_1132.CR2
A H:\Day3\5D II\IMG_1133.CR2
A H:\Day3\5D II\IMG_1134.CR2
A H:\Day3\5D II\IMG_1135.CR2
A H:\Day3\5D II\IMG_1136.CR2
A H:\Day3\5D II\IMG_1137.CR2
A H:\Day3\5D II\IMG_1138.CR2
A H:\Day3\5D II\IMG_1139.CR2
A H:\Day3\5D II\IMG_1140.CR2
A H:\Day3\5D II\IMG_1141.CR2
A H:\Day3\5D II\IMG_1142.CR2
A H:\Day3\5D II\IMG_1143.CR2
A H:\Day3\5D II\IMG_1144.CR2
A H:\Day3\5D II\IMG_1145.CR2
A H:\Day3\5D II\IMG_1146.CR2
A H:\Day3\5D II\IMG_1147.CR2
A H:\Day3\5D II\IMG_1148.CR2
A H:\Day3\5D II\IMG_1149.CR2
A H:\Day3\5D II\IMG_1151.CR2
A H:\Day3\5D II\IMG_1152.CR2
A H:\Day3\5D II\IMG_1153.CR2
A H:\Day3\5D II\IMG_1154.CR2
A H:\Day3\5D II\IMG_1155.CR2
A H:\Day3\5D II\IMG_1156.CR2
A H:\Day3\5D II\IMG_1157.CR2
A H:\Day3\5D II\IMG_1158.CR2
A H:\Day3\5D II\IMG_1159.CR2
A H:\Day3\5D II\IMG_1160.CR2
A H:\Day3\5D II\IMG_1161.CR2
A H:\Day3\5D II\IMG_1162.CR2
A H:\Day3\5D II\IMG_1163.CR2
A H:\Day3\5D II\IMG_1164.CR2
A H:\Day3\5D II\IMG_1165.CR2
A H:\Day3\5D II\IMG_1166.CR2
A H:\Day3\5D II\IMG_1167.CR2
A H:\Day3\5D II\IMG_1168.CR2
A H:\Day3\5D II\IMG_1169.CR2
A H:\Day3\5D II\IMG_1170.CR2
A H:\Day3\5D II\IMG_1171.CR2
A H:\Day3\5D II\IMG_1172.CR2
A H:\Day3\5D II\IMG_1173.CR2
A H:\Day3\5D II\IMG_1174.CR2
A H:\Day3\5D II\IMG_1175.CR2
A H:\Day3\5D II\IMG_1176.CR2
A H:\Day3\5D II\IMG_1177.CR2
A H:\Day3\5D II\IMG_1178.CR2
A H:\Day3\5D II\IMG_1179.CR2
A H:\Day3\5D II\IMG_1180.CR2
A H:\Day3\5D II\IMG_1181.CR2
A H:\Day3\5D II\IMG_1182.CR2
A H:\Day3\5D II\IMG_1183.CR2
A H:\Day3\5D II\IMG_1184.CR2
A H:\Day3\5D II\IMG_1185.CR2
A H:\Day3\5D II\IMG_1186.CR2
A H:\Day3\5D II\IMG_1187.CR2
A H:\Day3\5D II\IMG_1188.CR2
A H:\Day3\5D II\IMG_1189.CR2
A H:\Day3\5D II\IMG_1190.CR2
A H:\Day3\5D II\IMG_1191.CR2
A H:\Day3\5D II\IMG_1192.CR2
A H:\Day3\5D II\IMG_1193.CR2
A H:\Day3\5D II\IMG_1194.CR2
A H:\Day3\5D II\IMG_1195.CR2
A H:\Day3\5D II\IMG_1196.CR2
A H:\Day3\5D II\IMG_1197.CR2
A H:\Day3\5D II\IMG_1198.CR2
A H:\Day3\5D II\IMG_1199.CR2
A H:\Day3\5D II\IMG_1200.CR2
A H:\Day3\5D II\IMG_1201.CR2
A H:\Day3\5D II\IMG_1202.CR2
A H:\Day3\5D II\IMG_1203.CR2
A H:\Day3\5D II\IMG_1204.CR2
A H:\Day3\5D II\IMG_1205.CR2
A H:\Day3\5D II\IMG_1206.CR2
A H:\Day3\5D II\IMG_1207.CR2
A H:\Day3\5D II\IMG_1208.CR2
A H:\Day3\5D II\IMG_1209.CR2
A H:\Day3\5D II\IMG_1210.CR2
A H:\Day3\5D II\IMG_1211.CR2
A H:\Day3\5D II\IMG_1212.CR2
A H:\Day3\5D II\IMG_1213.CR2
A H:\Day3\5D II\IMG_1214.CR2
A H:\Day3\5D II\IMG_1215.CR2
A H:\Day3\5D II\IMG_1216.CR2
A H:\Day3\5D II\IMG_1217.CR2
A H:\Day3\5D II\IMG_1218.CR2
A H:\Day3\5D II\IMG_1219.CR2
A H:\Day3\5D II\IMG_1220.CR2
A H:\Day3\5D II\IMG_1221.CR2
A H:\Day3\5D II\IMG_1222.CR2
A H:\Day3\5D II\IMG_1223.CR2
A H:\Day3\5D II\IMG_1224.CR2
A H:\Day3\5D II\IMG_1225.CR2
A H:\Day3\5D II\IMG_1226.CR2
A H:\Day3\5D II\IMG_1227.CR2
A H:\Day3\5D II\IMG_1228.CR2
A H:\Day3\5D II\IMG_1229.CR2
A H:\Day3\5D II\IMG_1230.CR2
A H:\Day3\5D II\IMG_1231.CR2
A H:\Day3\5D II\IMG_1232.CR2
A H:\Day3\5D II\IMG_1233.CR2
A H:\Day3\5D II\IMG_1234.CR2
A H:\Day3\5D II\IMG_1235.CR2
A H:\Day3\5D II\IMG_1236.CR2
A H:\Day3\5D II\IMG_1237.CR2
A H:\Day3\5D II\IMG_1238.CR2
A H:\Day3\5D II\IMG_1239.CR2
A H:\Day3\5D II\IMG_1240.CR2
A H:\Day3\5D II\IMG_1241.CR2
A H:\Day3\5D II\IMG_1242.CR2
A H:\Day3\5D II\IMG_1243.CR2
A H:\Day3\5D II\IMG_1244.CR2
A H:\Day3\5D II\IMG_1245.CR2
A H:\Day3\5D II\IMG_1246.CR2
A H:\Day3\5D II\IMG_1247.CR2
A H:\Day3\5D II\IMG_1248.CR2
A H:\Day3\5D II\IMG_1249.CR2
A H:\Day3\5D II\IMG_1250.CR2
A H:\Day3\5D II\IMG_1251.CR2
A H:\Day3\5D II\IMG_1252.CR2
A H:\Day3\5D II\IMG_1253.CR2
A H:\Day3\5D II\IMG_1255.CR2
A H:\Day3\5D II\IMG_1256.CR2
A H:\Day3\5D II\IMG_1257.CR2
A H:\Day3\5D II\IMG_1258.CR2
A H:\Day3\5D II\IMG_1259.CR2
A H:\Day3\5D II\IMG_1260.CR2
A H:\Day3\5D II\IMG_1261.CR2
A H:\Day3\5D II\IMG_1262.CR2
A H:\Day3\5D II\IMG_1263.CR2
A H:\Day3\5D II\IMG_1264.CR2
A H:\Day3\5D II\IMG_1265.CR2
A H:\Day3\5D II\IMG_1266.CR2
A H:\Day3\5D II\IMG_1267.CR2
A H:\Day3\5D II\IMG_1268.CR2
A H:\Day3\5D II\IMG_1269.CR2
A H:\Day3\5D II\IMG_1270.CR2
A H:\Day3\5D II\IMG_1271.CR2
A H:\Day3\5D II\IMG_1272.CR2
A H:\Day3\5D II\IMG_1273.CR2
A H:\Day3\5D II\IMG_1274.CR2
A H:\Day3\5D II\IMG_1275.CR2
A H:\Day3\5D II\IMG_1276.CR2
A H:\Day3\5D II\IMG_1277.CR2
A H:\Day3\5D II\IMG_1278.CR2
A H:\Day3\5D II\IMG_1279.CR2
A H:\Day3\5D II\IMG_1280.CR2
A H:\Day3\5D II\IMG_1281.CR2
A H:\Day3\5D II\IMG_1282.CR2
A H:\Day3\5D II\IMG_1283.CR2
A H:\Day3\5D II\IMG_1284.CR2
A H:\Day3\5D II\IMG_1285.CR2
A H:\Day3\5D II\IMG_1286.CR2
A H:\Day3\5D II\IMG_1287.CR2
A H:\Day3\5D II\IMG_1288.CR2
A H:\Day3\5D II\IMG_1289.CR2
A H:\Day3\5D II\IMG_1290.CR2
A H:\Day3\5D II\IMG_1291.CR2
A H:\Day3\5D II\IMG_1292.CR2
A H:\Day3\5D II\IMG_1293.CR2
A H:\Day3\5D II\IMG_1294.CR2
A H:\Day3\5D II\IMG_1295.CR2
A H:\Day3\5D II\IMG_1296.CR2
A H:\Day3\5D II\IMG_1297.CR2
A H:\Day3\5D II\IMG_1298.CR2
A H:\Day3\5D II\IMG_1299.CR2
A H:\Day3\5D II\IMG_1301.CR2
A H:\Day3\5D II\IMG_1302.CR2
A H:\Day3\5D II\IMG_1303.CR2
A H:\Day3\5D II\IMG_1306.CR2
A H:\Day3\5D II\IMG_1307.CR2
A H:\Day3\5D II\IMG_1308.CR2
A H:\Day3\5D II\IMG_1309.CR2
A H:\Day3\5D II\IMG_1310.CR2
A H:\Day3\5D II\IMG_1311.CR2
A H:\Day3\5D II\IMG_1312.CR2
A H:\Day3\5D II\IMG_1313.CR2
A H:\Day3\5D II\IMG_1314.CR2
A H:\Day3\5D II\IMG_1315.CR2
A H:\Day3\5D II\IMG_1316.CR2
A H:\Day3\5D II\IMG_1317.CR2
A H:\Day3\5D II\IMG_1318.CR2
A H:\Day3\5D II\IMG_1319.CR2
A H:\Day3\5D II\IMG_1320.CR2
A H:\Day3\5D II\IMG_1321.CR2
A H:\Day3\5D II\IMG_1322.CR2
A H:\Day3\5D II\IMG_1323.CR2
A H:\Day3\5D II\IMG_1324.CR2
A H:\Day3\5D II\IMG_1325.CR2
A H:\Day3\5D II\IMG_1326.CR2
A H:\Day3\5D II\IMG_1327.CR2
A H:\Day3\5D II\IMG_1328.CR2
A H:\Day3\5D II\IMG_1329.CR2
A H:\Day3\5D II\IMG_1330.CR2
A H:\Day3\5D II\IMG_1331.CR2
A H:\Day3\5D II\IMG_1332.CR2
A H:\Day3\5D II\IMG_1333.CR2
A H:\Day3\5D II\IMG_1334.CR2
A H:\Day3\5D II\IMG_1335.CR2
A H:\Day3\5D II\IMG_1336.CR2
A H:\Day3\5D II\IMG_1337.CR2
A H:\Day3\5D II\IMG_1338.CR2
A H:\Day3\5D II\IMG_1339.CR2
A H:\Day3\5D II\IMG_1340.CR2
A H:\Day3\5D II\IMG_1341.CR2
A H:\Day3\5D II\IMG_1342.CR2
A H:\Day3\5D II\IMG_1343.CR2
A H:\Day3\5D II\IMG_1344.CR2
A H:\Day3\5D II\IMG_1345.CR2
A H:\Day3\5D II\IMG_1346.CR2
A H:\Day3\5D II\IMG_1347.CR2
A H:\Day3\5D II\IMG_1348.CR2
A H:\Day3\5D II\IMG_1349.CR2
A H:\Day3\5D II\IMG_1350.CR2
A H:\Day3\5D II\IMG_1351.CR2
A H:\Day3\5D II\IMG_1352.CR2
A H:\Day3\5D II\IMG_1353.CR2
A H:\Day3\5D II\IMG_1354.CR2
A H:\Day3\5D II\IMG_1355.CR2
A H:\Day3\5D II\IMG_1356.CR2
A H:\Day3\5D II\IMG_1357.CR2
A H:\Day3\5D II\IMG_1358.CR2
A H:\Day3\5D II\IMG_1359.CR2
A H:\Day3\5D II\IMG_1360.CR2
A H:\Day3\5D II\IMG_1361.CR2
A H:\Day3\5D II\IMG_1362.CR2
A H:\Day3\5D II\IMG_1363.CR2
A H:\Day3\5D II\IMG_1364.CR2
A H:\Day3\5D II\IMG_1365.CR2
A H:\Day3\5D II\IMG_1366.CR2
A H:\Day3\5D II\IMG_1367.CR2
A H:\Day3\5D II\IMG_1368.CR2
A H:\Day3\5D II\IMG_1369.CR2
A H:\Day3\5D II\IMG_1370.CR2
A H:\Day3\5D II\IMG_1371.CR2
A H:\Day3\5D II\IMG_1372.CR2
A H:\Day3\5D II\IMG_1373.CR2
A H:\Day3\5D II\IMG_1374.CR2
A H:\Day3\5D II\IMG_1375.CR2
A H:\Day3\5D II\IMG_1376.CR2
A H:\Day3\5D II\IMG_1377.CR2
A H:\Day3\5D II\IMG_1378.CR2
A H:\Day3\5D II\IMG_1379.CR2
A H:\Day3\5D II\IMG_1380.CR2
A H:\Day3\5D II\IMG_1381.CR2
A H:\Day3\5D II\IMG_1382.CR2
A H:\Day3\5D II\IMG_1383.CR2
A H:\Day3\5D II\IMG_1384.CR2
A H:\Day3\5D II\IMG_1388.CR2
A H:\Day3\5D II\IMG_1389.CR2
A H:\Day3\5D II\IMG_1390.CR2
A H:\Day3\5D II\IMG_1391.CR2
A H:\Day3\5D II\IMG_1392.CR2
A H:\Day3\5D II\IMG_1393.CR2
A H:\Day3\5D II\IMG_1394.CR2
A H:\Day3\5D II\IMG_1395.CR2
A H:\Day3\5D II\IMG_1396.CR2
A H:\Day3\5D II\IMG_1397.CR2
A H:\Day3\5D II\IMG_1398.CR2
A H:\Day3\5D II\IMG_1399.CR2
A H:\Day3\5D II\IMG_1400.CR2
A H:\Day3\5D II\IMG_1401.CR2
A H:\Day3\5D II\IMG_1402.CR2
A H:\Day3\5D II\IMG_1403.CR2
A H:\Day3\5D II\IMG_1404.CR2
A H:\Day3\5D II\IMG_1405.CR2
A H:\Day3\5D II\IMG_1406.CR2
A H:\Day3\5D II\IMG_1407.CR2
A H:\Day3\5D II\IMG_1408.CR2
A H:\Day3\5D II\IMG_1409.CR2
A H:\Day3\5D II\IMG_1410.CR2
A H:\Day3\5D II\IMG_1411.CR2
A H:\Day3\5D II\IMG_1412.CR2
A H:\Day3\5D II\IMG_1413.CR2
A H:\Day3\5D II\IMG_1414.CR2
A H:\Day3\5D II\IMG_1415.CR2
A H:\Day3\5D II\IMG_1416.CR2
A H:\Day3\5D II\IMG_1417.CR2
A H:\Day3\5D II\IMG_1418.CR2
A H:\Day3\5D II\IMG_1419.CR2
A H:\Day3\5D II\IMG_1420.CR2
A H:\Day3\5D II\IMG_1421.CR2
A H:\Day3\5D II\IMG_1422.CR2
A H:\Day3\5D II\IMG_1423.CR2
A H:\Day3\5D II\IMG_1424.CR2
A H:\Day3\5D II\IMG_1425.CR2
A H:\Day3\5D II\IMG_1428.CR2
A H:\Day3\5D II\IMG_1429.CR2
A H:\Day3\5D II\IMG_1430.CR2
A H:\Day3\5D II\IMG_1431.CR2
A H:\Day3\5D II\IMG_1432.CR2
A H:\Day3\5D II\IMG_1434.CR2
A H:\Day3\5D II\IMG_1435.CR2
A H:\Day3\5D II\IMG_1436.CR2
A H:\Day3\5D II\IMG_1437.CR2
A H:\Day3\5D II\IMG_1438.CR2
A H:\Day3\5D II\IMG_1439.CR2
A H:\Day3\5D II\IMG_1440.CR2
A H:\Day3\5D II\IMG_1441.CR2
A H:\Day3\5D II\IMG_1444.CR2
A H:\Day3\5D II\IMG_1445.CR2
A H:\Day3\5D II\IMG_1446.CR2
A H:\Day3\5D II\IMG_1447.CR2
A H:\Day3\5D II\IMG_1449.CR2
A H:\Day3\5D II\IMG_1450.CR2
A H:\Day3\5D II\IMG_1451.CR2
A H:\Day3\5D II\IMG_1452.CR2
A H:\Day3\5D II\IMG_1453.CR2
A H:\Day3\5D II\IMG_1454.CR2
A H:\Day3\5D II\IMG_1455.CR2
A H:\Day3\5D II\IMG_1456.CR2
A H:\Day3\5D II\IMG_1457.CR2
A H:\Day3\5D II\IMG_1458.CR2
A H:\Day3\5D II\IMG_1459.CR2
A H:\Day3\5D II\IMG_1460.CR2
A H:\Day3\5D II\IMG_1461.CR2
A H:\Day3\5D II\IMG_1462.CR2
A H:\Day3\5D II\IMG_1463.CR2
A H:\Day3\5D II\IMG_1464.CR2
A H:\Day3\5D II\IMG_1465.CR2
A H:\Day3\5D II\IMG_1466.CR2
A H:\Day3\5D II\IMG_1467.CR2
A H:\Day3\5D II\IMG_1468.CR2
A H:\Day3\5D II\IMG_1469.CR2
A H:\Day3\5D II\IMG_1470.CR2
A H:\Day3\5D II\IMG_1471.CR2
A H:\Day3\5D II\IMG_1472.CR2
A H:\Day3\5D II\IMG_1473.CR2
A H:\Day3\5D II\IMG_1474.CR2
A H:\Day3\5D II\IMG_1477.CR2
A H:\Day3\5D II\IMG_1478.CR2
A H:\Day3\5D II\IMG_1479.CR2
A H:\Day3\5D II\IMG_1481.CR2
A H:\Day3\5D II\IMG_1482.CR2
A H:\Day3\5D II\IMG_1483.CR2
A H:\Day3\5D II\IMG_1484.CR2
A H:\Day3\5D II\IMG_1485.CR2
A H:\Day3\5D II\IMG_1486.CR2
A H:\Day3\5D II\IMG_1487.CR2
A H:\Day3\5D II\IMG_1488.CR2
A H:\Day3\5D II\IMG_1489.CR2
A H:\Day3\5D II\IMG_1490.CR2
A H:\Day3\5D II\IMG_1491.CR2
A H:\Day3\5D II\IMG_1492.CR2
A H:\Day3\5D II\IMG_1493.CR2
A H:\Day3\5D II\IMG_1494.CR2
A H:\Day3\5D II\IMG_1495.CR2
A H:\Day3\5D II\IMG_1496.CR2
A H:\Day3\5D II\IMG_1497.CR2
A H:\Day3\5D II\IMG_1498.CR2
A H:\Day3\5D II\IMG_1499.CR2
A H:\Day3\5D II\IMG_1500.CR2
A H:\Day3\5D II\IMG_1501.CR2
A H:\Day3\5D II\IMG_1502.CR2
A H:\Day3\5D II\IMG_1503.CR2
A H:\Day3\5D II\IMG_1504.CR2
A H:\Day3\5D II\IMG_1505.CR2
A H:\Day3\5D II\IMG_1506.CR2
A H:\Day3\5D II\IMG_1507.CR2
A H:\Day3\5D II\IMG_1508.CR2
A H:\Day3\5D II\IMG_1509.CR2
A H:\Day3\5D II\IMG_1513.CR2
A H:\Day3\5D II\IMG_1514.CR2
A H:\Day3\5D II\IMG_1515.CR2
A H:\Day3\5D II\IMG_1516.CR2
A H:\Day3\5D II\IMG_1517.CR2
A H:\Day3\5D II\IMG_1518.CR2
A H:\Day3\5D II\IMG_1519.CR2
A H:\Day3\5D II\IMG_1520.CR2
A H:\Day3\5D II\IMG_1521.CR2
A H:\Day3\5D II\IMG_1522.CR2
A H:\Day3\5D II\IMG_1523.CR2
A H:\Day3\5D II\IMG_1524.CR2
A H:\Day3\5D II\IMG_1525.CR2
A H:\Day3\5D II\IMG_1526.CR2
A H:\Day3\5D II\IMG_1527.CR2
A H:\Day3\5D II\IMG_1528.CR2
A H:\Day3\5D II\IMG_1529.CR2
A H:\Day3\5D II\IMG_1530.CR2
A H:\Day3\5D II\IMG_1531.CR2
A H:\Day3\5D II\IMG_1532.CR2
A H:\Day3\5D II\IMG_1533.CR2
A H:\Day3\5D II\IMG_1534.CR2
A H:\Day3\5D II\IMG_1535.CR2
A H:\Day3\5D II\IMG_1536.CR2
A H:\Day3\5D II\IMG_1537.CR2
A H:\Day3\5D II\IMG_1538.CR2
A H:\Day3\5D II\IMG_1539.CR2
A H:\Day3\5D II\IMG_1540.CR2
A H:\Day3\5D II\IMG_1541.CR2
A H:\Day3\5D II\IMG_1542.CR2
A H:\Day3\5D II\IMG_1543.CR2
A H:\Day3\5D II\IMG_1544.CR2
A H:\Day3\5D II\IMG_1545.CR2
A H:\Day3\5D II\IMG_1546.CR2
A H:\Day3\5D II\IMG_1547.CR2
A H:\Day3\5D II\IMG_1548.CR2
A H:\Day3\5D II\IMG_1549.CR2
A H:\Day3\5D II\IMG_1550.CR2
A H:\Day3\5D II\IMG_1551.CR2
A H:\Day3\5D II\IMG_1552.CR2
A H:\Day3\5D II\IMG_1553.CR2
A H:\Day3\5D II\IMG_1554.CR2
A H:\Day3\5D II\IMG_1555.CR2
A H:\Day3\5D II\IMG_1556.CR2
A H:\Day3\5D II\IMG_1557.CR2
A H:\Day3\5D II\IMG_1558.CR2
A H:\Day3\5D II\IMG_1559.CR2
A H:\Day3\5D II\IMG_1560.CR2
A H:\Day3\5D II\IMG_1561.CR2
A H:\Day3\5D II\IMG_1562.CR2
A H:\Day3\5D II\IMG_1563.CR2
A H:\Day3\5D II\IMG_1564.CR2
A H:\Day3\5D II\IMG_1565.CR2
A H:\Day3\5D II\IMG_1566.CR2
A H:\Day3\5D II\IMG_1567.CR2
A H:\Day3\5D II\IMG_1568.CR2
A H:\Day3\5D II\IMG_1569.CR2
A H:\Day3\5D II\IMG_1574.CR2
A H:\Day3\5D II\IMG_1575.CR2
A H:\Day3\5D II\IMG_1576.CR2
A H:\Day3\5D II\IMG_1579.CR2
A H:\Day3\5D II\IMG_1580.CR2
A H:\Day3\5D II\IMG_1581.CR2
A H:\Day3\5D II\IMG_1582.CR2
A H:\Day3\5D II\IMG_1583.CR2
A H:\Day3\5D II\IMG_1584.CR2
A H:\Day3\5D II\IMG_1585.CR2
A H:\Day3\5D II\IMG_1586.CR2
A H:\Day3\5D II\IMG_1587.CR2
A H:\Day3\5D II\IMG_1588.CR2
A H:\Day3\5D II\IMG_1589.CR2
A H:\Day3\5D II\IMG_1590.CR2
A H:\Day3\5D II\IMG_1591.CR2
A H:\Day3\5D II\IMG_1592.CR2
A H:\Day3\5D II\IMG_1593.CR2
A H:\Day3\5D II\IMG_1594.CR2
A H:\Day3\5D II\IMG_1595.CR2
A H:\Day3\5D II\IMG_1596.CR2
A H:\Day3\5D II\IMG_1597.CR2
A H:\Day3\5D II\IMG_1598.CR2
A H:\Day3\5D II\IMG_1599.CR2
A H:\Day3\5D II\IMG_1600.CR2
A H:\Day3\5D II\IMG_1601.CR2
A H:\Day3\5D II\IMG_1602.CR2
A H:\Day3\5D II\IMG_1603.CR2
A H:\Day3\5D II\IMG_1604.CR2
A H:\Day3\5D II\IMG_1605.CR2
A H:\Day3\5D II\IMG_1606.CR2
A H:\Day3\5D II\IMG_1607.CR2
A H:\Day3\5D II\IMG_1608.CR2
A H:\Day3\5D II\IMG_1609.CR2
A H:\Day3\5D II\IMG_1610.CR2
A H:\Day3\5D II\IMG_1611.CR2
A H:\Day3\5D II\IMG_1612.CR2
A H:\Day3\5D II\IMG_1613.CR2
A H:\Day3\5D II\IMG_1614.CR2
A H:\Day3\5D II\IMG_1615.CR2
A H:\Day3\5D II\IMG_1616.CR2
A H:\Day3\5D II\IMG_1617.CR2
A H:\Day3\5D II\IMG_1618.CR2
A H:\Day3\5D II\IMG_1619.CR2
A H:\Day3\5D II\IMG_1620.CR2
A H:\Day3\5D II\IMG_1621.CR2
A H:\Day3\5D II\IMG_1622.CR2
A H:\Day3\5D II\IMG_1623.CR2
A H:\Day3\5D II\IMG_1624.CR2
A H:\Day3\5D II\IMG_1625.CR2
A H:\Day3\5D II\IMG_1626.CR2
A H:\Day3\5D II\IMG_1627.CR2
A H:\Day3\5D II\IMG_1628.CR2
A H:\Day3\5D II\IMG_1629.CR2
A H:\Day3\5D II\IMG_1630.CR2
A H:\Day3\5D II\IMG_1631.CR2
A H:\Day3\5D II\IMG_1632.CR2
A H:\Day3\5D II\IMG_1633.CR2
A H:\Day3\5D II\IMG_1634.CR2
A H:\Day3\5D II\IMG_1635.CR2
A H:\Day3\5D II\IMG_1636.CR2
A H:\Day3\5D II\IMG_1637.CR2
A H:\Day3\5D II\IMG_1638.CR2
A H:\Day3\5D II\IMG_1639.CR2
A H:\Day3\5D II\IMG_1640.CR2
A H:\Day3\5D II\IMG_1641.CR2
A H:\Day3\5D II\IMG_1642.CR2
A H:\Day3\5D II\IMG_1643.CR2
A H:\Day3\5D II\IMG_1644.CR2
A H:\Day3\5D II\IMG_1645.CR2
A H:\Day3\5D II\IMG_1646.CR2
A H:\Day3\5D II\IMG_1647.CR2
A H:\Day3\5D II\IMG_1648.CR2
A H:\Day3\5D II\IMG_1649.CR2
A H:\Day3\5D II\IMG_1650.CR2
A H:\Day3\5D II\IMG_1651.CR2
A H:\Day3\5D II\IMG_1652.CR2
A H:\Day3\5D II\IMG_1653.CR2
A H:\Day3\5D II\IMG_1654.CR2
A H:\Day3\5D II\IMG_1655.CR2
A H:\Day3\5D II\IMG_1656.CR2
A H:\Day3\5D II\IMG_1657.CR2
A H:\Day3\5D II\IMG_1658.CR2
A H:\Day3\5D II\IMG_1659.CR2
A H:\Day3\5D II\IMG_1660.CR2
A H:\Day3\5D II\IMG_1661.CR2
A H:\Day3\5D II\IMG_1662.CR2
A H:\Day3\5D II\IMG_1663.CR2
A H:\Day3\5D II\IMG_1664.CR2
A H:\Day3\5D II\IMG_1665.CR2
A H:\Day3\5D II\IMG_1666.CR2
A H:\Day3\5D II\IMG_1667.CR2
A H:\Day3\5D II\IMG_1668.CR2
A H:\Day3\5D II\IMG_1669.CR2
A H:\Day3\5D II\IMG_1670.CR2
A H:\Day3\5D II\IMG_1671.CR2
A H:\Day3\5D II\IMG_1672.CR2
A H:\Day3\5D II\IMG_1673.CR2
A H:\Day3\5D II\IMG_1674.CR2
A H:\Day3\5D II\IMG_1675.CR2
A H:\Day3\5D II\IMG_1676.CR2
A H:\Day3\5D II\IMG_1677.CR2
A H:\Day3\5D II\IMG_1678.CR2
A H:\Day3\5D II\IMG_1679.CR2
A H:\Day3\5D II\IMG_1680.CR2
A H:\Day3\5D II\IMG_1681.CR2
A H:\Day3\5D II\IMG_1682.CR2
A H:\Day3\5D II\IMG_1683.CR2
A H:\Day3\5D II\IMG_1684.CR2
A H:\Day3\5D II\IMG_1685.CR2
A H:\Day3\5D II\IMG_1686.CR2
A H:\Day3\5D II\IMG_1687.CR2
A H:\Day3\5D II\IMG_1688.CR2
A H:\Day3\5D II\IMG_1689.CR2
A H:\Day3\5D II\IMG_1690.CR2
A H:\Day3\5D II\IMG_1691.CR2
A H:\Day3\5D II\IMG_1692.CR2
A H:\Day3\5D II\IMG_1693.CR2
A H:\Day3\5D II\IMG_1694.CR2
A H:\Day3\5D II\IMG_1695.CR2
A H:\Day3\5D II\IMG_1696.CR2
A H:\Day3\5D II\IMG_1697.CR2
A H:\Day3\5D II\IMG_1698.CR2
A H:\Day3\5D II\IMG_1699.CR2
A H:\Day3\5D II\IMG_1700.CR2
A H:\Day3\5D II\IMG_1701.CR2
A H:\Day3\5D II\IMG_1702.CR2
A H:\Day3\5D II\IMG_1703.CR2
A H:\Day3\5D II\IMG_1704.CR2
A H:\Day3\5D II\IMG_1705.CR2
A H:\Day3\5D II\IMG_1706.CR2
A H:\Day3\5D II\MVI_1150.MOV
A H:\Day3\5D II\MVI_1150.THM
A H:\Day3\5D II\MVI_1254.MOV
A H:\Day3\5D II\MVI_1254.THM
A H:\Day3\5D II\MVI_1300.MOV
A H:\Day3\5D II\MVI_1300.THM
A H:\Day3\5D II\MVI_1304.MOV
A H:\Day3\5D II\MVI_1304.THM
A H:\Day3\5D II\MVI_1305.MOV
A H:\Day3\5D II\MVI_1305.THM
A H:\Day3\5D II\MVI_1385.MOV
A H:\Day3\5D II\MVI_1385.THM
A H:\Day3\5D II\MVI_1386.MOV
A H:\Day3\5D II\MVI_1386.THM
A H:\Day3\5D II\MVI_1387.MOV
A H:\Day3\5D II\MVI_1387.THM
A H:\Day3\5D II\MVI_1426.MOV
A H:\Day3\5D II\MVI_1426.THM
A H:\Day3\5D II\MVI_1427.MOV
A H:\Day3\5D II\MVI_1427.THM
A H:\Day3\5D II\MVI_1433.MOV
A H:\Day3\5D II\MVI_1433.THM
A H:\Day3\5D II\MVI_1442.MOV
A H:\Day3\5D II\MVI_1442.THM
A H:\Day3\5D II\MVI_1443.MOV
A H:\Day3\5D II\MVI_1443.THM
A H:\Day3\5D II\MVI_1448.MOV
A H:\Day3\5D II\MVI_1448.THM
A H:\Day3\5D II\MVI_1475.MOV
A H:\Day3\5D II\MVI_1475.THM
A H:\Day3\5D II\MVI_1476.MOV
A H:\Day3\5D II\MVI_1476.THM
A H:\Day3\5D II\MVI_1480.MOV
A H:\Day3\5D II\MVI_1480.THM
A H:\Day3\5D II\MVI_1510.MOV
A H:\Day3\5D II\MVI_1510.THM
A H:\Day3\5D II\MVI_1511.MOV
A H:\Day3\5D II\MVI_1511.THM
A H:\Day3\5D II\MVI_1512.MOV
A H:\Day3\5D II\MVI_1512.THM
A H:\Day3\5D II\MVI_1570.MOV
A H:\Day3\5D II\MVI_1570.THM
A H:\Day3\5D II\MVI_1571.MOV
A H:\Day3\5D II\MVI_1571.THM
A H:\Day3\5D II\MVI_1572.MOV
A H:\Day3\5D II\MVI_1572.THM
A H:\Day3\5D II\MVI_1573.MOV
A H:\Day3\5D II\MVI_1573.THM
A H:\Day3\5D II\MVI_1577.MOV
A H:\Day3\5D II\MVI_1577.THM
A H:\Day3\5D II\MVI_1578.MOV
A H:\Day3\5D II\MVI_1578.THM
A H:\Day3\60D\IMG_5283.CR2
A H:\Day3\60D\IMG_5284.CR2
A H:\Day3\60D\IMG_5285.CR2
A H:\Day3\60D\IMG_5286.CR2
A H:\Day3\60D\IMG_5287.CR2
A H:\Day3\60D\IMG_5288.CR2
A H:\Day3\60D\IMG_5289.CR2
A H:\Day3\60D\IMG_5290.CR2
A H:\Day3\60D\IMG_5291.CR2
A H:\Day3\60D\IMG_5292.CR2
A H:\Day3\60D\IMG_5293.CR2
A H:\Day3\60D\IMG_5294.CR2
A H:\Day3\60D\IMG_5295.CR2
A H:\Day3\60D\IMG_5296.CR2
A H:\Day3\60D\IMG_5297.CR2
A H:\Day3\60D\IMG_5298.CR2
A H:\Day3\60D\IMG_5299.CR2
A H:\Day3\60D\IMG_5300.CR2
A H:\Day3\60D\IMG_5301.CR2
A H:\Day3\60D\IMG_5302.CR2
A H:\Day3\60D\IMG_5303.CR2
A H:\Day3\60D\IMG_5304.CR2
A H:\Day3\60D\IMG_5305.CR2
A H:\Day3\60D\IMG_5306.CR2
A H:\Day3\60D\IMG_5307.CR2
A H:\Day3\60D\IMG_5308.CR2
A H:\Day3\60D\IMG_5309.CR2
A H:\Day3\60D\IMG_5310.CR2
A H:\Day3\60D\IMG_5311.CR2
A H:\Day3\60D\IMG_5312.CR2
A H:\Day3\60D\IMG_5313.CR2
A H:\Day3\60D\IMG_5314.CR2
A H:\Day3\60D\IMG_5315.CR2
A H:\Day3\60D\IMG_5316.CR2
A H:\Day3\60D\IMG_5317.CR2
A H:\Day3\60D\IMG_5318.CR2
A H:\Day3\60D\IMG_5319.CR2
A H:\Day3\60D\IMG_5320.CR2
A H:\Day3\60D\IMG_5321.CR2
A H:\Day3\60D\IMG_5322.CR2
A H:\Day3\60D\IMG_5323.CR2
ssmad
Regular Member
 
Posts: 41
Joined: May 25th, 2013, 12:10 pm

Re: External WD HD infected with Win32:Kryptik.LQL

Unread postby ssmad » May 27th, 2013, 8:57 am

A H:\Day2\100GOPRO\G0024601.JPG
A H:\Day2\100GOPRO\G0024602.JPG
A H:\Day2\100GOPRO\G0024603.JPG
A H:\Day2\100GOPRO\G0024604.JPG
A H:\Day2\100GOPRO\G0024605.JPG
A H:\Day2\100GOPRO\G0024606.JPG
A H:\Day2\100GOPRO\G0024607.JPG
A H:\Day2\100GOPRO\G0024608.JPG
A H:\Day2\100GOPRO\G0024609.JPG
A H:\Day2\100GOPRO\G0024610.JPG
A H:\Day2\100GOPRO\G0024611.JPG
A H:\Day2\100GOPRO\G0024612.JPG
A H:\Day2\100GOPRO\G0024613.JPG
A H:\Day2\100GOPRO\G0024614.JPG
A H:\Day2\100GOPRO\G0024615.JPG
A H:\Day2\100GOPRO\G0024616.JPG
A H:\Day2\100GOPRO\G0024617.JPG
A H:\Day2\100GOPRO\G0024618.JPG
A H:\Day2\100GOPRO\G0024619.JPG
A H:\Day2\100GOPRO\G0024620.JPG
A H:\Day2\100GOPRO\G0024621.JPG
A H:\Day2\100GOPRO\G0024622.JPG
A H:\Day2\100GOPRO\G0024623.JPG
A H:\Day2\100GOPRO\G0024624.JPG
A H:\Day2\100GOPRO\G0024625.JPG
A H:\Day2\100GOPRO\G0024626.JPG
A H:\Day2\100GOPRO\G0024627.JPG
A H:\Day2\100GOPRO\G0024628.JPG
A H:\Day2\100GOPRO\G0024629.JPG
A H:\Day2\100GOPRO\G0024630.JPG
A H:\Day2\100GOPRO\G0024631.JPG
A H:\Day2\100GOPRO\G0024632.JPG
A H:\Day2\100GOPRO\G0024633.JPG
A H:\Day2\100GOPRO\G0024634.JPG
A H:\Day2\100GOPRO\G0024635.JPG
A H:\Day2\100GOPRO\G0024636.JPG
A H:\Day2\100GOPRO\G0024637.JPG
A H:\Day2\100GOPRO\G0024638.JPG
A H:\Day2\100GOPRO\G0024639.JPG
A H:\Day2\100GOPRO\G0024640.JPG
A H:\Day2\100GOPRO\G0024641.JPG
A H:\Day2\100GOPRO\G0024642.JPG
A H:\Day2\100GOPRO\G0024643.JPG
A H:\Day2\100GOPRO\G0024644.JPG
A H:\Day2\100GOPRO\G0024645.JPG
A H:\Day2\100GOPRO\G0024646.JPG
A H:\Day2\100GOPRO\G0024647.JPG
A H:\Day2\100GOPRO\G0024648.JPG
A H:\Day2\100GOPRO\G0024649.JPG
A H:\Day2\100GOPRO\G0024650.JPG
A H:\Day2\100GOPRO\G0024651.JPG
A H:\Day2\100GOPRO\G0024652.JPG
A H:\Day2\100GOPRO\G0024653.JPG
A H:\Day2\100GOPRO\G0024654.JPG
A H:\Day2\100GOPRO\G0024655.JPG
A H:\Day2\100GOPRO\G0024656.JPG
A H:\Day2\100GOPRO\G0024657.JPG
A H:\Day2\100GOPRO\G0024658.JPG
A H:\Day2\100GOPRO\G0024659.JPG
A H:\Day2\100GOPRO\G0024660.JPG
A H:\Day2\100GOPRO\G0024661.JPG
A H:\Day2\100GOPRO\G0024662.JPG
A H:\Day2\100GOPRO\G0024663.JPG
A H:\Day2\100GOPRO\G0024664.JPG
A H:\Day2\100GOPRO\G0024665.JPG
A H:\Day2\100GOPRO\G0024666.JPG
A H:\Day2\100GOPRO\G0024667.JPG
A H:\Day2\100GOPRO\G0024668.JPG
A H:\Day2\100GOPRO\G0024669.JPG
A H:\Day2\100GOPRO\G0024670.JPG
A H:\Day2\100GOPRO\G0024671.JPG
A H:\Day2\100GOPRO\G0024672.JPG
A H:\Day2\100GOPRO\G0024673.JPG
A H:\Day2\100GOPRO\G0024674.JPG
A H:\Day2\100GOPRO\G0024675.JPG
A H:\Day2\100GOPRO\G0024676.JPG
A H:\Day2\100GOPRO\G0024677.JPG
A H:\Day2\100GOPRO\G0024678.JPG
A H:\Day2\100GOPRO\G0024679.JPG
A H:\Day2\100GOPRO\G0024680.JPG
A H:\Day2\100GOPRO\G0024681.JPG
A H:\Day2\100GOPRO\G0024682.JPG
A H:\Day2\100GOPRO\G0024683.JPG
A H:\Day2\100GOPRO\G0024684.JPG
A H:\Day2\100GOPRO\G0024685.JPG
A H:\Day2\100GOPRO\G0034686.JPG
A H:\Day2\100GOPRO\G0034687.JPG
A H:\Day2\100GOPRO\G0034688.JPG
A H:\Day2\100GOPRO\G0034689.JPG
A H:\Day2\100GOPRO\G0034690.JPG
A H:\Day2\100GOPRO\G0034691.JPG
A H:\Day2\100GOPRO\G0034692.JPG
A H:\Day2\100GOPRO\G0034693.JPG
A H:\Day2\100GOPRO\G0034694.JPG
A H:\Day2\100GOPRO\GOPR0009.MP4
A H:\Day2\100GOPRO\GOPR0010.JPG
A H:\Day2\100GOPRO\GOPR0040.JPG
A H:\Day2\100GOPRO\GOPR4695.MP4
A H:\Day2\100GOPRO\GOPR4696.MP4
A H:\Day2\100GOPRO\GOPR4697.MP4
A H:\Day2\100GOPRO\GOPR4698.MP4
A H:\Day2\100GOPRO\GOPR4699.MP4
A H:\Day2\100GOPRO\GOPR4700.MP4
A H:\Day2\100GOPRO\GOPR4701.MP4
A H:\Day2\100GOPRO\GOPR4702.MP4
A H:\Day2\100GOPRO\GOPR4703.MP4
A H:\Day2\100GOPRO\GOPR4704.MP4
A H:\Day2\5D II\IMG_0679.CR2
A H:\Day2\5D II\IMG_0680.CR2
A H:\Day2\5D II\IMG_0681.CR2
A H:\Day2\5D II\IMG_0682.CR2
A H:\Day2\5D II\IMG_0683.CR2
A H:\Day2\5D II\IMG_0684.CR2
A H:\Day2\5D II\IMG_0685.CR2
A H:\Day2\5D II\IMG_0686.CR2
A H:\Day2\5D II\IMG_0687.CR2
A H:\Day2\5D II\IMG_0688.CR2
A H:\Day2\5D II\IMG_0689.CR2
A H:\Day2\5D II\IMG_0690.CR2
A H:\Day2\5D II\IMG_0691.CR2
A H:\Day2\5D II\IMG_0692.CR2
A H:\Day2\5D II\IMG_0693.CR2
A H:\Day2\5D II\IMG_0694.CR2
A H:\Day2\5D II\IMG_0695.CR2
A H:\Day2\5D II\IMG_0696.CR2
A H:\Day2\5D II\IMG_0697.CR2
A H:\Day2\5D II\IMG_0698.CR2
A H:\Day2\5D II\IMG_0699.CR2
A H:\Day2\5D II\IMG_0700.CR2
A H:\Day2\5D II\IMG_0703.CR2
A H:\Day2\5D II\IMG_0705.CR2
A H:\Day2\5D II\IMG_0707.CR2
A H:\Day2\5D II\IMG_0708.CR2
A H:\Day2\5D II\IMG_0709.CR2
A H:\Day2\5D II\IMG_0710.CR2
A H:\Day2\5D II\IMG_0711.CR2
A H:\Day2\5D II\IMG_0712.CR2
A H:\Day2\5D II\IMG_0713.CR2
A H:\Day2\5D II\IMG_0714.CR2
A H:\Day2\5D II\IMG_0715.CR2
A H:\Day2\5D II\IMG_0716.CR2
A H:\Day2\5D II\IMG_0717.CR2
A H:\Day2\5D II\IMG_0718.CR2
A H:\Day2\5D II\IMG_0719.CR2
A H:\Day2\5D II\IMG_0720.CR2
A H:\Day2\5D II\IMG_0721.CR2
A H:\Day2\5D II\IMG_0722.CR2
A H:\Day2\5D II\IMG_0723.CR2
A H:\Day2\5D II\IMG_0724.CR2
A H:\Day2\5D II\IMG_0725.CR2
A H:\Day2\5D II\IMG_0726.CR2
A H:\Day2\5D II\IMG_0727.CR2
A H:\Day2\5D II\IMG_0731.CR2
A H:\Day2\5D II\IMG_0732.CR2
A H:\Day2\5D II\IMG_0739.CR2
A H:\Day2\5D II\IMG_0740.CR2
A H:\Day2\5D II\IMG_0741.CR2
A H:\Day2\5D II\IMG_0742.CR2
A H:\Day2\5D II\IMG_0743.CR2
A H:\Day2\5D II\IMG_0744.CR2
A H:\Day2\5D II\IMG_0745.CR2
A H:\Day2\5D II\IMG_0746.CR2
A H:\Day2\5D II\IMG_0747.CR2
A H:\Day2\5D II\IMG_0748.CR2
A H:\Day2\5D II\IMG_0749.CR2
A H:\Day2\5D II\IMG_0750.CR2
A H:\Day2\5D II\IMG_0751.CR2
A H:\Day2\5D II\IMG_0752.CR2
A H:\Day2\5D II\IMG_0753.CR2
A H:\Day2\5D II\IMG_0754.CR2
A H:\Day2\5D II\IMG_0755.CR2
A H:\Day2\5D II\IMG_0756.CR2
A H:\Day2\5D II\IMG_0757.CR2
A H:\Day2\5D II\IMG_0758.CR2
A H:\Day2\5D II\IMG_0759.CR2
A H:\Day2\5D II\IMG_0760.CR2
A H:\Day2\5D II\IMG_0761.CR2
A H:\Day2\5D II\IMG_0762.CR2
A H:\Day2\5D II\IMG_0763.CR2
A H:\Day2\5D II\IMG_0764.CR2
A H:\Day2\5D II\IMG_0765.CR2
A H:\Day2\5D II\IMG_0766.CR2
A H:\Day2\5D II\IMG_0767.CR2
A H:\Day2\5D II\IMG_0768.CR2
A H:\Day2\5D II\IMG_0769.CR2
A H:\Day2\5D II\IMG_0770.CR2
A H:\Day2\5D II\IMG_0771.CR2
A H:\Day2\5D II\IMG_0772.CR2
A H:\Day2\5D II\IMG_0773.CR2
A H:\Day2\5D II\IMG_0774.CR2
A H:\Day2\5D II\IMG_0775.CR2
A H:\Day2\5D II\IMG_0776.CR2
A H:\Day2\5D II\IMG_0781.CR2
A H:\Day2\5D II\IMG_0782.CR2
A H:\Day2\5D II\IMG_0783.CR2
A H:\Day2\5D II\IMG_0784.CR2
A H:\Day2\5D II\IMG_0785.CR2
A H:\Day2\5D II\IMG_0786.CR2
A H:\Day2\5D II\IMG_0787.CR2
A H:\Day2\5D II\IMG_0788.CR2
A H:\Day2\5D II\IMG_0789.CR2
A H:\Day2\5D II\IMG_0790.CR2
A H:\Day2\5D II\IMG_0791.CR2
A H:\Day2\5D II\IMG_0792.CR2
A H:\Day2\5D II\IMG_0793.CR2
A H:\Day2\5D II\IMG_0794.CR2
A H:\Day2\5D II\IMG_0795.CR2
A H:\Day2\5D II\IMG_0796.CR2
A H:\Day2\5D II\IMG_0797.CR2
A H:\Day2\5D II\IMG_0798.CR2
A H:\Day2\5D II\IMG_0799.CR2
A H:\Day2\5D II\IMG_0800.CR2
A H:\Day2\5D II\IMG_0801.CR2
A H:\Day2\5D II\IMG_0802.CR2
A H:\Day2\5D II\IMG_0803.CR2
A H:\Day2\5D II\IMG_0804.CR2
A H:\Day2\5D II\IMG_0805.CR2
A H:\Day2\5D II\IMG_0806.CR2
A H:\Day2\5D II\IMG_0807.CR2
A H:\Day2\5D II\IMG_0808.CR2
A H:\Day2\5D II\IMG_0809.CR2
A H:\Day2\5D II\IMG_0810.CR2
A H:\Day2\5D II\IMG_0811.CR2
A H:\Day2\5D II\IMG_0818.CR2
A H:\Day2\5D II\IMG_0819.CR2
A H:\Day2\5D II\IMG_0820.CR2
A H:\Day2\5D II\IMG_0821.CR2
A H:\Day2\5D II\IMG_0822.CR2
A H:\Day2\5D II\IMG_0823.CR2
A H:\Day2\5D II\IMG_0824.CR2
A H:\Day2\5D II\IMG_0825.CR2
A H:\Day2\5D II\IMG_0826.CR2
A H:\Day2\5D II\IMG_0827.CR2
A H:\Day2\5D II\IMG_0828.CR2
A H:\Day2\5D II\IMG_0829.CR2
A H:\Day2\5D II\IMG_0846.CR2
A H:\Day2\5D II\IMG_0847.CR2
A H:\Day2\5D II\IMG_0848.CR2
A H:\Day2\5D II\IMG_0849.CR2
A H:\Day2\5D II\IMG_0850.CR2
A H:\Day2\5D II\IMG_0851.CR2
A H:\Day2\5D II\IMG_0853.CR2
A H:\Day2\5D II\IMG_0854.CR2
A H:\Day2\5D II\IMG_0855.CR2
A H:\Day2\5D II\IMG_0856.CR2
A H:\Day2\5D II\IMG_0857.CR2
A H:\Day2\5D II\IMG_0858.CR2
A H:\Day2\5D II\IMG_0859.CR2
A H:\Day2\5D II\IMG_0860.CR2
A H:\Day2\5D II\IMG_0861.CR2
A H:\Day2\5D II\IMG_0862.CR2
A H:\Day2\5D II\IMG_0863.CR2
A H:\Day2\5D II\IMG_0864.CR2
A H:\Day2\5D II\IMG_0865.CR2
A H:\Day2\5D II\IMG_0866.CR2
A H:\Day2\5D II\IMG_0867.CR2
A H:\Day2\5D II\IMG_0868.CR2
A H:\Day2\5D II\IMG_0869.CR2
A H:\Day2\5D II\IMG_0870.CR2
A H:\Day2\5D II\IMG_0871.CR2
A H:\Day2\5D II\IMG_0872.CR2
A H:\Day2\5D II\IMG_0873.CR2
A H:\Day2\5D II\IMG_0874.CR2
A H:\Day2\5D II\IMG_0875.CR2
A H:\Day2\5D II\IMG_0876.CR2
A H:\Day2\5D II\IMG_0877.CR2
A H:\Day2\5D II\IMG_0878.CR2
A H:\Day2\5D II\IMG_0879.CR2
A H:\Day2\5D II\IMG_0880.CR2
A H:\Day2\5D II\IMG_0881.CR2
A H:\Day2\5D II\IMG_0882.CR2
A H:\Day2\5D II\IMG_0883.CR2
A H:\Day2\5D II\IMG_0884.CR2
A H:\Day2\5D II\IMG_0885.CR2
A H:\Day2\5D II\IMG_0886.CR2
A H:\Day2\5D II\IMG_0887.CR2
A H:\Day2\5D II\IMG_0888.CR2
A H:\Day2\5D II\IMG_0889.CR2
A H:\Day2\5D II\IMG_0890.CR2
A H:\Day2\5D II\IMG_0891.CR2
A H:\Day2\5D II\IMG_0892.CR2
A H:\Day2\5D II\IMG_0893.CR2
A H:\Day2\5D II\IMG_0894.CR2
A H:\Day2\5D II\IMG_0895.CR2
A H:\Day2\5D II\IMG_0896.CR2
A H:\Day2\5D II\IMG_0897.CR2
A H:\Day2\5D II\IMG_0898.CR2
A H:\Day2\5D II\IMG_0899.CR2
A H:\Day2\5D II\IMG_0900.CR2
A H:\Day2\5D II\IMG_0901.CR2
A H:\Day2\5D II\MVI_0665.MOV
A H:\Day2\5D II\MVI_0665.THM
A H:\Day2\5D II\MVI_0666.MOV
A H:\Day2\5D II\MVI_0666.THM
A H:\Day2\5D II\MVI_0667.MOV
A H:\Day2\5D II\MVI_0667.THM
A H:\Day2\5D II\MVI_0668.MOV
A H:\Day2\5D II\MVI_0668.THM
A H:\Day2\5D II\MVI_0669.MOV
A H:\Day2\5D II\MVI_0669.THM
A H:\Day2\5D II\MVI_0670.MOV
A H:\Day2\5D II\MVI_0670.THM
A H:\Day2\5D II\MVI_0671.MOV
A H:\Day2\5D II\MVI_0671.THM
A H:\Day2\5D II\MVI_0672.MOV
A H:\Day2\5D II\MVI_0672.THM
A H:\Day2\5D II\MVI_0673.MOV
A H:\Day2\5D II\MVI_0673.THM
A H:\Day2\5D II\MVI_0674.MOV
A H:\Day2\5D II\MVI_0674.THM
A H:\Day2\5D II\MVI_0675.MOV
A H:\Day2\5D II\MVI_0675.THM
A H:\Day2\5D II\MVI_0676.MOV
A H:\Day2\5D II\MVI_0676.THM
A H:\Day2\5D II\MVI_0728.MOV
A H:\Day2\5D II\MVI_0728.THM
A H:\Day2\5D II\MVI_0729.MOV
A H:\Day2\5D II\MVI_0729.THM
A H:\Day2\5D II\MVI_0730.MOV
A H:\Day2\5D II\MVI_0730.THM
A H:\Day2\5D II\MVI_0733.MOV
A H:\Day2\5D II\MVI_0733.THM
A H:\Day2\5D II\MVI_0734.MOV
A H:\Day2\5D II\MVI_0734.THM
A H:\Day2\5D II\MVI_0735.MOV
A H:\Day2\5D II\MVI_0735.THM
A H:\Day2\5D II\MVI_0736.MOV
A H:\Day2\5D II\MVI_0736.THM
A H:\Day2\5D II\MVI_0737.MOV
A H:\Day2\5D II\MVI_0737.THM
A H:\Day2\5D II\MVI_0738.MOV
A H:\Day2\5D II\MVI_0738.THM
A H:\Day2\5D II\MVI_0777.MOV
A H:\Day2\5D II\MVI_0777.THM
A H:\Day2\5D II\MVI_0778.MOV
A H:\Day2\5D II\MVI_0778.THM
A H:\Day2\5D II\MVI_0779.MOV
A H:\Day2\5D II\MVI_0779.THM
A H:\Day2\5D II\MVI_0780.MOV
A H:\Day2\5D II\MVI_0780.THM
A H:\Day2\5D II\MVI_0812.MOV
A H:\Day2\5D II\MVI_0812.THM
A H:\Day2\5D II\MVI_0813.MOV
A H:\Day2\5D II\MVI_0813.THM
A H:\Day2\5D II\MVI_0814.MOV
A H:\Day2\5D II\MVI_0814.THM
A H:\Day2\5D II\MVI_0815.MOV
A H:\Day2\5D II\MVI_0815.THM
A H:\Day2\5D II\MVI_0816.MOV
A H:\Day2\5D II\MVI_0816.THM
A H:\Day2\5D II\MVI_0817.MOV
A H:\Day2\5D II\MVI_0817.THM
A H:\Day2\5D II\MVI_0830.MOV
A H:\Day2\5D II\MVI_0830.THM
A H:\Day2\5D II\MVI_0831.MOV
A H:\Day2\5D II\MVI_0831.THM
A H:\Day2\5D II\MVI_0832.MOV
A H:\Day2\5D II\MVI_0832.THM
A H:\Day2\5D II\MVI_0833.MOV
A H:\Day2\5D II\MVI_0833.THM
A H:\Day2\5D II\MVI_0834.MOV
A H:\Day2\5D II\MVI_0834.THM
A H:\Day2\5D II\MVI_0835.MOV
A H:\Day2\5D II\MVI_0835.THM
A H:\Day2\5D II\MVI_0836.MOV
A H:\Day2\5D II\MVI_0836.THM
A H:\Day2\5D II\MVI_0837.MOV
A H:\Day2\5D II\MVI_0837.THM
A H:\Day2\5D II\MVI_0838.MOV
A H:\Day2\5D II\MVI_0838.THM
A H:\Day2\5D II\MVI_0839.MOV
A H:\Day2\5D II\MVI_0839.THM
A H:\Day2\5D II\MVI_0840.MOV
A H:\Day2\5D II\MVI_0840.THM
A H:\Day2\5D II\MVI_0841.MOV
A H:\Day2\5D II\MVI_0841.THM
A H:\Day2\5D II\MVI_0842.MOV
A H:\Day2\5D II\MVI_0842.THM
A H:\Day2\5D II\MVI_0843.MOV
A H:\Day2\5D II\MVI_0843.THM
A H:\Day2\5D II\MVI_0844.MOV
A H:\Day2\5D II\MVI_0844.THM
A H:\Day2\5D II\MVI_0845.MOV
A H:\Day2\5D II\MVI_0845.THM
A H:\Day2\5D II\MVI_0852.MOV
A H:\Day2\5D II\MVI_0852.THM
A H:\Day2\5D II\MVI_0902.MOV
A H:\Day2\5D II\MVI_0902.THM
A H:\Day2\5D II\MVI_0903.MOV
A H:\Day2\5D II\MVI_0903.THM
A H:\Day2\5D II\MVI_0904.MOV
A H:\Day2\5D II\MVI_0904.THM
A H:\Day2\5D II\MVI_0905.MOV
A H:\Day2\5D II\MVI_0905.THM
A H:\Day2\5D II\MVI_0906.MOV
A H:\Day2\5D II\MVI_0906.THM
A H:\Day2\5D II\MVI_0907.MOV
A H:\Day2\5D II\MVI_0907.THM
A H:\Day2\5D II\MVI_0908.MOV
A H:\Day2\5D II\MVI_0908.THM
A H:\Day2\5D II\MVI_0909.MOV
A H:\Day2\5D II\MVI_0909.THM
A H:\Day2\5D II\MVI_0910.MOV
A H:\Day2\5D II\MVI_0910.THM
A H:\Day2\5D II\MVI_0911.MOV
A H:\Day2\5D II\MVI_0911.THM
A H:\Day2\5D II\MVI_0912.MOV
A H:\Day2\5D II\MVI_0912.THM
A H:\Day2\5D II\MVI_0913.MOV
A H:\Day2\5D II\MVI_0913.THM
A H:\Day2\5D II\MVI_0914.MOV
A H:\Day2\5D II\MVI_0914.THM
A H:\Day2\60D\IMG_5233.CR2
A H:\Day2\60D\IMG_5234.CR2
A H:\Day2\60D\IMG_5235.CR2
A H:\Day2\60D\IMG_5237.CR2
A H:\Day2\60D\IMG_5238.CR2
A H:\Day2\60D\IMG_5239.CR2
A H:\Day2\60D\IMG_5240.CR2
A H:\Day2\60D\IMG_5241.CR2
A H:\Day2\60D\IMG_5242.CR2
A H:\Day2\60D\IMG_5243.CR2
A H:\Day2\60D\IMG_5244.CR2
A H:\Day2\60D\IMG_5245.CR2
A H:\Day2\60D\IMG_5246.CR2
A H:\Day2\60D\IMG_5253.CR2
A H:\Day2\60D\IMG_5254.CR2
A H:\Day2\60D\IMG_5266.CR2
A H:\Day2\60D\IMG_5267.CR2
A H:\Day2\60D\IMG_5268.CR2
A H:\Day2\60D\IMG_5269.CR2
A H:\Day2\60D\IMG_5270.CR2
A H:\Day2\60D\IMG_5271.CR2
A H:\Day2\60D\IMG_5272.CR2
A H:\Day2\60D\IMG_5273.CR2
A H:\Day2\60D\IMG_5274.CR2
A H:\Day2\60D\IMG_5275.CR2
A H:\Day2\60D\IMG_5276.CR2
A H:\Day2\60D\IMG_5277.CR2
A H:\Day2\60D\IMG_5278.CR2
A H:\Day2\60D\IMG_5279.CR2
A H:\Day2\60D\IMG_5280.CR2
A H:\Day2\60D\IMG_5281.CR2
A H:\Day2\60D\IMG_5282.CR2
A H:\Day2\60D\MVI_5236.MOV
A H:\Day2\60D\MVI_5247.MOV
A H:\Day2\60D\MVI_5248.MOV
A H:\Day2\60D\MVI_5249.MOV
A H:\Day2\60D\MVI_5250.MOV
A H:\Day2\60D\MVI_5251.MOV
A H:\Day2\60D\MVI_5252.MOV
A H:\Day2\60D\MVI_5255.MOV
A H:\Day2\60D\MVI_5256.MOV
A H:\Day2\60D\MVI_5257.MOV
A H:\Day2\60D\MVI_5258.MOV
A H:\Day2\60D\MVI_5259.MOV
A H:\Day2\60D\MVI_5260.MOV
A H:\Day2\60D\MVI_5261.MOV
A H:\Day2\60D\MVI_5262.MOV
A H:\Day2\60D\MVI_5263.MOV
A H:\Day2\60D\MVI_5264.MOV
A H:\Day2\60D\MVI_5265.MOV
A H:\Day3\101GOPRO\GOPR4717.MP4
A H:\Day3\101GOPRO\GOPR4718.MP4
A H:\Day3\101GOPRO\GP014718.MP4
A H:\Day3\5D II\IMG_0915.CR2
A H:\Day3\5D II\IMG_0916.CR2
A H:\Day3\5D II\IMG_0917.CR2
A H:\Day3\5D II\IMG_0918.CR2
A H:\Day3\5D II\IMG_0919.CR2
A H:\Day3\5D II\IMG_0920.CR2
A H:\Day3\5D II\IMG_0921.CR2
A H:\Day3\5D II\IMG_0922.CR2
A H:\Day3\5D II\IMG_0923.CR2
A H:\Day3\5D II\IMG_0924.CR2
A H:\Day3\5D II\IMG_0925.CR2
A H:\Day3\5D II\IMG_0926.CR2
A H:\Day3\5D II\IMG_0927.CR2
A H:\Day3\5D II\IMG_0928.CR2
A H:\Day3\5D II\IMG_0929.CR2
A H:\Day3\5D II\IMG_0930.CR2
A H:\Day3\5D II\IMG_0931.CR2
A H:\Day3\5D II\IMG_0932.CR2
A H:\Day3\5D II\IMG_0933.CR2
A H:\Day3\5D II\IMG_0934.CR2
A H:\Day3\5D II\IMG_0935.CR2
A H:\Day3\5D II\IMG_0936.CR2
A H:\Day3\5D II\IMG_0937.CR2
A H:\Day3\5D II\IMG_0938.CR2
A H:\Day3\5D II\IMG_0939.CR2
A H:\Day3\5D II\IMG_0940.CR2
A H:\Day3\5D II\IMG_0941.CR2
A H:\Day3\5D II\IMG_0942.CR2
A H:\Day3\5D II\IMG_0943.CR2
A H:\Day3\5D II\IMG_0944.CR2
A H:\Day3\5D II\IMG_0945.CR2
A H:\Day3\5D II\IMG_0946.CR2
A H:\Day3\5D II\IMG_0947.CR2
A H:\Day3\5D II\IMG_0948.CR2
A H:\Day3\5D II\IMG_0949.CR2
A H:\Day3\5D II\IMG_0950.CR2
A H:\Day3\5D II\IMG_0951.CR2
A H:\Day3\5D II\IMG_0952.CR2
A H:\Day3\5D II\IMG_0953.CR2
A H:\Day3\5D II\IMG_0954.CR2
A H:\Day3\5D II\IMG_0955.CR2
A H:\Day3\5D II\IMG_0956.CR2
A H:\Day3\5D II\IMG_0957.CR2
A H:\Day3\5D II\IMG_0958.CR2
A H:\Day3\5D II\IMG_0959.CR2
A H:\Day3\5D II\IMG_0960.CR2
A H:\Day3\5D II\IMG_0961.CR2
A H:\Day3\5D II\IMG_0962.CR2
A H:\Day3\5D II\IMG_0963.CR2
A H:\Day3\5D II\IMG_0964.CR2
A H:\Day3\5D II\IMG_0965.CR2
A H:\Day3\5D II\IMG_0966.CR2
A H:\Day3\5D II\IMG_0967.CR2
A H:\Day3\5D II\IMG_0968.CR2
A H:\Day3\5D II\IMG_0969.CR2
A H:\Day3\5D II\IMG_0970.CR2
A H:\Day3\5D II\IMG_0971.CR2
A H:\Day3\5D II\IMG_0972.CR2
A H:\Day3\5D II\IMG_0973.CR2
A H:\Day3\5D II\IMG_0974.CR2
A H:\Day3\5D II\IMG_0975.CR2
A H:\Day3\5D II\IMG_0976.CR2
A H:\Day3\5D II\IMG_0977.CR2
A H:\Day3\5D II\IMG_0978.CR2
A H:\Day3\5D II\IMG_0979.CR2
A H:\Day3\5D II\IMG_0980.CR2
A H:\Day3\5D II\IMG_0981.CR2
A H:\Day3\5D II\IMG_0982.CR2
A H:\Day3\5D II\IMG_0983.CR2
A H:\Day3\5D II\IMG_0984.CR2
A H:\Day3\5D II\IMG_0985.CR2
A H:\Day3\5D II\IMG_0986.CR2
A H:\Day3\5D II\IMG_0987.CR2
A H:\Day3\5D II\IMG_0988.CR2
A H:\Day3\5D II\IMG_0989.CR2
A H:\Day3\5D II\IMG_0990.CR2
A H:\Day3\5D II\IMG_0991.CR2
A H:\Day3\5D II\IMG_0992.CR2
A H:\Day3\5D II\IMG_0993.CR2
A H:\Day3\5D II\IMG_0994.CR2
A H:\Day3\5D II\IMG_0995.CR2
A H:\Day3\5D II\IMG_0996.CR2
A H:\Day3\5D II\IMG_0997.CR2
A H:\Day3\5D II\IMG_0998.CR2
A H:\Day3\5D II\IMG_0999.CR2
A H:\Day3\5D II\IMG_1000.CR2
A H:\Day3\5D II\IMG_1001.CR2
A H:\Day3\5D II\IMG_1002.CR2
A H:\Day3\5D II\IMG_1003.CR2
A H:\Day3\5D II\IMG_1004.CR2
A H:\Day3\5D II\IMG_1005.CR2
A H:\Day3\5D II\IMG_1006.CR2
A H:\Day3\5D II\IMG_1007.CR2
A H:\Day3\5D II\IMG_1008.CR2
A H:\Day3\5D II\IMG_1009.CR2
A H:\Day3\5D II\IMG_1010.CR2
A H:\Day3\5D II\IMG_1011.CR2
A H:\Day3\5D II\IMG_1012.CR2
A H:\Day3\5D II\IMG_1013.CR2
A H:\Day3\5D II\IMG_1014.CR2
A H:\Day3\5D II\IMG_1015.CR2
A H:\Day3\5D II\IMG_1016.CR2
A H:\Day3\5D II\IMG_1017.CR2
A H:\Day3\5D II\IMG_1018.CR2
A H:\Day3\5D II\IMG_1019.CR2
A H:\Day3\5D II\IMG_1020.CR2
A H:\Day3\5D II\IMG_1021.CR2
A H:\Day3\5D II\IMG_1022.CR2
A H:\Day3\5D II\IMG_1023.CR2
A H:\Day3\5D II\IMG_1024.CR2
A H:\Day3\5D II\IMG_1025.CR2
A H:\Day3\5D II\IMG_1026.CR2
A H:\Day3\5D II\IMG_1027.CR2
A H:\Day3\5D II\IMG_1028.CR2
A H:\Day3\5D II\IMG_1029.CR2
A H:\Day3\5D II\IMG_1030.CR2
A H:\Day3\5D II\IMG_1031.CR2
A H:\Day3\5D II\IMG_1032.CR2
A H:\Day3\5D II\IMG_1033.CR2
A H:\Day3\5D II\IMG_1034.CR2
A H:\Day3\5D II\IMG_1035.CR2
A H:\Day3\5D II\IMG_1036.CR2
A H:\Day3\5D II\IMG_1037.CR2
A H:\Day3\5D II\IMG_1038.CR2
A H:\Day3\5D II\IMG_1039.CR2
A H:\Day3\5D II\IMG_1040.CR2
A H:\Day3\5D II\IMG_1041.CR2
A H:\Day3\5D II\IMG_1042.CR2
A H:\Day3\5D II\IMG_1043.CR2
A H:\Day3\5D II\IMG_1044.CR2
A H:\Day3\5D II\IMG_1045.CR2
A H:\Day3\5D II\IMG_1046.CR2
A H:\Day3\5D II\IMG_1047.CR2
A H:\Day3\5D II\IMG_1048.CR2
A H:\Day3\5D II\IMG_1049.CR2
A H:\Day3\5D II\IMG_1050.CR2
A H:\Day3\5D II\IMG_1051.CR2
A H:\Day3\5D II\IMG_1052.CR2
A H:\Day3\5D II\IMG_1053.CR2
A H:\Day3\5D II\IMG_1054.CR2
A H:\Day3\5D II\IMG_1055.CR2
A H:\Day3\5D II\IMG_1056.CR2
A H:\Day3\5D II\IMG_1057.CR2
A H:\Day3\5D II\IMG_1058.CR2
A H:\Day3\5D II\IMG_1059.CR2
A H:\Day3\5D II\IMG_1060.CR2
A H:\Day3\5D II\IMG_1061.CR2
A H:\Day3\5D II\IMG_1062.CR2
A H:\Day3\5D II\IMG_1063.CR2
A H:\Day3\5D II\IMG_1064.CR2
A H:\Day3\5D II\IMG_1065.CR2
A H:\Day3\5D II\IMG_1066.CR2
A H:\Day3\5D II\IMG_1067.CR2
A H:\Day3\5D II\IMG_1068.CR2
A H:\Day3\5D II\IMG_1069.CR2
A H:\Day3\5D II\IMG_1070.CR2
A H:\Day3\5D II\IMG_1071.CR2
A H:\Day3\5D II\IMG_1072.CR2
A H:\Day3\5D II\IMG_1073.CR2
A H:\Day3\5D II\IMG_1074.CR2
A H:\Day3\5D II\IMG_1075.CR2
A H:\Day3\5D II\IMG_1076.CR2
A H:\Day3\5D II\IMG_1077.CR2
A H:\Day3\5D II\IMG_1078.CR2
A H:\Day3\5D II\IMG_1079.CR2
A H:\Day3\5D II\IMG_1080.CR2
A H:\Day3\5D II\IMG_1081.CR2
A H:\Day3\5D II\IMG_1082.CR2
A H:\Day3\5D II\IMG_1083.CR2
A H:\Day3\5D II\IMG_1084.CR2
A H:\Day3\5D II\IMG_1085.CR2
A H:\Day3\5D II\IMG_1086.CR2
A H:\Day3\5D II\IMG_1087.CR2
A H:\Day3\5D II\IMG_1088.CR2
A H:\Day3\5D II\IMG_1089.CR2
A H:\Day3\5D II\IMG_1090.CR2
A H:\Day3\5D II\IMG_1091.CR2
A H:\Day3\5D II\IMG_1092.CR2
A H:\Day3\5D II\IMG_1093.CR2
A H:\Day3\5D II\IMG_1094.CR2
A H:\Day3\5D II\IMG_1095.CR2
A H:\Day3\5D II\IMG_1096.CR2
A H:\Day3\5D II\IMG_1097.CR2
A H:\Day3\5D II\IMG_1098.CR2
A H:\Day3\5D II\IMG_1099.CR2
A H:\Day3\5D II\IMG_1100.CR2
A H:\Day3\5D II\IMG_1101.CR2
A H:\Day3\5D II\IMG_1102.CR2
A H:\Day3\5D II\IMG_1103.CR2
A H:\Day3\5D II\IMG_1104.CR2
A H:\Day3\5D II\IMG_1105.CR2
A H:\Day3\5D II\IMG_1106.CR2
A H:\Day3\5D II\IMG_1107.CR2
A H:\Day3\5D II\IMG_1108.CR2
A H:\Day3\5D II\IMG_1109.CR2
A H:\Day3\5D II\IMG_1110.CR2
A H:\Day3\5D II\IMG_1112.CR2
A H:\Day3\5D II\IMG_1113.CR2
A H:\Day3\5D II\IMG_1114.CR2
A H:\Day3\5D II\IMG_1115.CR2
A H:\Day3\5D II\IMG_1116.CR2
A H:\Day3\5D II\IMG_1117.CR2
A H:\Day3\5D II\IMG_1118.CR2
A H:\Day3\5D II\IMG_1119.CR2
A H:\Day3\5D II\IMG_1120.CR2
A H:\Day3\5D II\IMG_1121.CR2
A H:\Day3\5D II\IMG_1122.CR2
A H:\Day3\5D II\IMG_1123.CR2
A H:\Day3\5D II\IMG_1124.CR2
A H:\Day3\5D II\IMG_1125.CR2
A H:\Day3\5D II\IMG_1126.CR2
A H:\Day3\5D II\IMG_1127.CR2
A H:\Day3\5D II\IMG_1128.CR2
A H:\Day3\5D II\IMG_1129.CR2
A H:\Day3\5D II\IMG_1130.CR2
A H:\Day3\5D II\IMG_1131.CR2
A H:\Day3\5D II\IMG_1132.CR2
A H:\Day3\5D II\IMG_1133.CR2
A H:\Day3\5D II\IMG_1134.CR2
A H:\Day3\5D II\IMG_1135.CR2
A H:\Day3\5D II\IMG_1136.CR2
A H:\Day3\5D II\IMG_1137.CR2
A H:\Day3\5D II\IMG_1138.CR2
A H:\Day3\5D II\IMG_1139.CR2
A H:\Day3\5D II\IMG_1140.CR2
A H:\Day3\5D II\IMG_1141.CR2
A H:\Day3\5D II\IMG_1142.CR2
A H:\Day3\5D II\IMG_1143.CR2
A H:\Day3\5D II\IMG_1144.CR2
A H:\Day3\5D II\IMG_1145.CR2
A H:\Day3\5D II\IMG_1146.CR2
A H:\Day3\5D II\IMG_1147.CR2
A H:\Day3\5D II\IMG_1148.CR2
A H:\Day3\5D II\IMG_1149.CR2
A H:\Day3\5D II\IMG_1151.CR2
A H:\Day3\5D II\IMG_1152.CR2
A H:\Day3\5D II\IMG_1153.CR2
A H:\Day3\5D II\IMG_1154.CR2
A H:\Day3\5D II\IMG_1155.CR2
A H:\Day3\5D II\IMG_1156.CR2
A H:\Day3\5D II\IMG_1157.CR2
A H:\Day3\5D II\IMG_1158.CR2
A H:\Day3\5D II\IMG_1159.CR2
A H:\Day3\5D II\IMG_1160.CR2
A H:\Day3\5D II\IMG_1161.CR2
A H:\Day3\5D II\IMG_1162.CR2
A H:\Day3\5D II\IMG_1163.CR2
A H:\Day3\5D II\IMG_1164.CR2
A H:\Day3\5D II\IMG_1165.CR2
A H:\Day3\5D II\IMG_1166.CR2
A H:\Day3\5D II\IMG_1167.CR2
A H:\Day3\5D II\IMG_1168.CR2
A H:\Day3\5D II\IMG_1169.CR2
A H:\Day3\5D II\IMG_1170.CR2
A H:\Day3\5D II\IMG_1171.CR2
A H:\Day3\5D II\IMG_1172.CR2
A H:\Day3\5D II\IMG_1173.CR2
A H:\Day3\5D II\IMG_1174.CR2
A H:\Day3\5D II\IMG_1175.CR2
A H:\Day3\5D II\IMG_1176.CR2
A H:\Day3\5D II\IMG_1177.CR2
A H:\Day3\5D II\IMG_1178.CR2
A H:\Day3\5D II\IMG_1179.CR2
A H:\Day3\5D II\IMG_1180.CR2
A H:\Day3\5D II\IMG_1181.CR2
A H:\Day3\5D II\IMG_1182.CR2
A H:\Day3\5D II\IMG_1183.CR2
A H:\Day3\5D II\IMG_1184.CR2
A H:\Day3\5D II\IMG_1185.CR2
A H:\Day3\5D II\IMG_1186.CR2
A H:\Day3\5D II\IMG_1187.CR2
A H:\Day3\5D II\IMG_1188.CR2
A H:\Day3\5D II\IMG_1189.CR2
A H:\Day3\5D II\IMG_1190.CR2
A H:\Day3\5D II\IMG_1191.CR2
A H:\Day3\5D II\IMG_1192.CR2
A H:\Day3\5D II\IMG_1193.CR2
A H:\Day3\5D II\IMG_1194.CR2
A H:\Day3\5D II\IMG_1195.CR2
A H:\Day3\5D II\IMG_1196.CR2
A H:\Day3\5D II\IMG_1197.CR2
A H:\Day3\5D II\IMG_1198.CR2
A H:\Day3\5D II\IMG_1199.CR2
A H:\Day3\5D II\IMG_1200.CR2
A H:\Day3\5D II\IMG_1201.CR2
A H:\Day3\5D II\IMG_1202.CR2
A H:\Day3\5D II\IMG_1203.CR2
A H:\Day3\5D II\IMG_1204.CR2
A H:\Day3\5D II\IMG_1205.CR2
A H:\Day3\5D II\IMG_1206.CR2
A H:\Day3\5D II\IMG_1207.CR2
A H:\Day3\5D II\IMG_1208.CR2
A H:\Day3\5D II\IMG_1209.CR2
A H:\Day3\5D II\IMG_1210.CR2
A H:\Day3\5D II\IMG_1211.CR2
A H:\Day3\5D II\IMG_1212.CR2
A H:\Day3\5D II\IMG_1213.CR2
A H:\Day3\5D II\IMG_1214.CR2
A H:\Day3\5D II\IMG_1215.CR2
A H:\Day3\5D II\IMG_1216.CR2
A H:\Day3\5D II\IMG_1217.CR2
A H:\Day3\5D II\IMG_1218.CR2
A H:\Day3\5D II\IMG_1219.CR2
A H:\Day3\5D II\IMG_1220.CR2
A H:\Day3\5D II\IMG_1221.CR2
A H:\Day3\5D II\IMG_1222.CR2
A H:\Day3\5D II\IMG_1223.CR2
A H:\Day3\5D II\IMG_1224.CR2
A H:\Day3\5D II\IMG_1225.CR2
A H:\Day3\5D II\IMG_1226.CR2
A H:\Day3\5D II\IMG_1227.CR2
A H:\Day3\5D II\IMG_1228.CR2
A H:\Day3\5D II\IMG_1229.CR2
A H:\Day3\5D II\IMG_1230.CR2
A H:\Day3\5D II\IMG_1231.CR2
A H:\Day3\5D II\IMG_1232.CR2
A H:\Day3\5D II\IMG_1233.CR2
A H:\Day3\5D II\IMG_1234.CR2
A H:\Day3\5D II\IMG_1235.CR2
A H:\Day3\5D II\IMG_1236.CR2
A H:\Day3\5D II\IMG_1237.CR2
A H:\Day3\5D II\IMG_1238.CR2
A H:\Day3\5D II\IMG_1239.CR2
A H:\Day3\5D II\IMG_1240.CR2
A H:\Day3\5D II\IMG_1241.CR2
A H:\Day3\5D II\IMG_1242.CR2
A H:\Day3\5D II\IMG_1243.CR2
A H:\Day3\5D II\IMG_1244.CR2
A H:\Day3\5D II\IMG_1245.CR2
A H:\Day3\5D II\IMG_1246.CR2
A H:\Day3\5D II\IMG_1247.CR2
A H:\Day3\5D II\IMG_1248.CR2
A H:\Day3\5D II\IMG_1249.CR2
A H:\Day3\5D II\IMG_1250.CR2
A H:\Day3\5D II\IMG_1251.CR2
A H:\Day3\5D II\IMG_1252.CR2
A H:\Day3\5D II\IMG_1253.CR2
A H:\Day3\5D II\IMG_1255.CR2
A H:\Day3\5D II\IMG_1256.CR2
A H:\Day3\5D II\IMG_1257.CR2
A H:\Day3\5D II\IMG_1258.CR2
A H:\Day3\5D II\IMG_1259.CR2
A H:\Day3\5D II\IMG_1260.CR2
A H:\Day3\5D II\IMG_1261.CR2
A H:\Day3\5D II\IMG_1262.CR2
A H:\Day3\5D II\IMG_1263.CR2
A H:\Day3\5D II\IMG_1264.CR2
A H:\Day3\5D II\IMG_1265.CR2
A H:\Day3\5D II\IMG_1266.CR2
A H:\Day3\5D II\IMG_1267.CR2
A H:\Day3\5D II\IMG_1268.CR2
A H:\Day3\5D II\IMG_1269.CR2
A H:\Day3\5D II\IMG_1270.CR2
A H:\Day3\5D II\IMG_1271.CR2
A H:\Day3\5D II\IMG_1272.CR2
A H:\Day3\5D II\IMG_1273.CR2
A H:\Day3\5D II\IMG_1274.CR2
A H:\Day3\5D II\IMG_1275.CR2
A H:\Day3\5D II\IMG_1276.CR2
A H:\Day3\5D II\IMG_1277.CR2
A H:\Day3\5D II\IMG_1278.CR2
A H:\Day3\5D II\IMG_1279.CR2
A H:\Day3\5D II\IMG_1280.CR2
A H:\Day3\5D II\IMG_1281.CR2
A H:\Day3\5D II\IMG_1282.CR2
A H:\Day3\5D II\IMG_1283.CR2
A H:\Day3\5D II\IMG_1284.CR2
A H:\Day3\5D II\IMG_1285.CR2
A H:\Day3\5D II\IMG_1286.CR2
A H:\Day3\5D II\IMG_1287.CR2
A H:\Day3\5D II\IMG_1288.CR2
A H:\Day3\5D II\IMG_1289.CR2
A H:\Day3\5D II\IMG_1290.CR2
A H:\Day3\5D II\IMG_1291.CR2
A H:\Day3\5D II\IMG_1292.CR2
A H:\Day3\5D II\IMG_1293.CR2
A H:\Day3\5D II\IMG_1294.CR2
A H:\Day3\5D II\IMG_1295.CR2
A H:\Day3\5D II\IMG_1296.CR2
A H:\Day3\5D II\IMG_1297.CR2
A H:\Day3\5D II\IMG_1298.CR2
A H:\Day3\5D II\IMG_1299.CR2
A H:\Day3\5D II\IMG_1301.CR2
A H:\Day3\5D II\IMG_1302.CR2
A H:\Day3\5D II\IMG_1303.CR2
A H:\Day3\5D II\IMG_1306.CR2
A H:\Day3\5D II\IMG_1307.CR2
A H:\Day3\5D II\IMG_1308.CR2
A H:\Day3\5D II\IMG_1309.CR2
A H:\Day3\5D II\IMG_1310.CR2
A H:\Day3\5D II\IMG_1311.CR2
A H:\Day3\5D II\IMG_1312.CR2
A H:\Day3\5D II\IMG_1313.CR2
A H:\Day3\5D II\IMG_1314.CR2
A H:\Day3\5D II\IMG_1315.CR2
A H:\Day3\5D II\IMG_1316.CR2
A H:\Day3\5D II\IMG_1317.CR2
A H:\Day3\5D II\IMG_1318.CR2
A H:\Day3\5D II\IMG_1319.CR2
A H:\Day3\5D II\IMG_1320.CR2
A H:\Day3\5D II\IMG_1321.CR2
A H:\Day3\5D II\IMG_1322.CR2
A H:\Day3\5D II\IMG_1323.CR2
A H:\Day3\5D II\IMG_1324.CR2
A H:\Day3\5D II\IMG_1325.CR2
A H:\Day3\5D II\IMG_1326.CR2
A H:\Day3\5D II\IMG_1327.CR2
A H:\Day3\5D II\IMG_1328.CR2
A H:\Day3\5D II\IMG_1329.CR2
A H:\Day3\5D II\IMG_1330.CR2
A H:\Day3\5D II\IMG_1331.CR2
A H:\Day3\5D II\IMG_1332.CR2
A H:\Day3\5D II\IMG_1333.CR2
A H:\Day3\5D II\IMG_1334.CR2
A H:\Day3\5D II\IMG_1335.CR2
A H:\Day3\5D II\IMG_1336.CR2
A H:\Day3\5D II\IMG_1337.CR2
A H:\Day3\5D II\IMG_1338.CR2
A H:\Day3\5D II\IMG_1339.CR2
A H:\Day3\5D II\IMG_1340.CR2
A H:\Day3\5D II\IMG_1341.CR2
A H:\Day3\5D II\IMG_1342.CR2
A H:\Day3\5D II\IMG_1343.CR2
A H:\Day3\5D II\IMG_1344.CR2
A H:\Day3\5D II\IMG_1345.CR2
A H:\Day3\5D II\IMG_1346.CR2
A H:\Day3\5D II\IMG_1347.CR2
A H:\Day3\5D II\IMG_1348.CR2
A H:\Day3\5D II\IMG_1349.CR2
A H:\Day3\5D II\IMG_1350.CR2
A H:\Day3\5D II\IMG_1351.CR2
A H:\Day3\5D II\IMG_1352.CR2
A H:\Day3\5D II\IMG_1353.CR2
A H:\Day3\5D II\IMG_1354.CR2
A H:\Day3\5D II\IMG_1355.CR2
A H:\Day3\5D II\IMG_1356.CR2
A H:\Day3\5D II\IMG_1357.CR2
A H:\Day3\5D II\IMG_1358.CR2
A H:\Day3\5D II\IMG_1359.CR2
A H:\Day3\5D II\IMG_1360.CR2
A H:\Day3\5D II\IMG_1361.CR2
A H:\Day3\5D II\IMG_1362.CR2
A H:\Day3\5D II\IMG_1363.CR2
A H:\Day3\5D II\IMG_1364.CR2
A H:\Day3\5D II\IMG_1365.CR2
A H:\Day3\5D II\IMG_1366.CR2
A H:\Day3\5D II\IMG_1367.CR2
A H:\Day3\5D II\IMG_1368.CR2
A H:\Day3\5D II\IMG_1369.CR2
A H:\Day3\5D II\IMG_1370.CR2
A H:\Day3\5D II\IMG_1371.CR2
A H:\Day3\5D II\IMG_1372.CR2
A H:\Day3\5D II\IMG_1373.CR2
A H:\Day3\5D II\IMG_1374.CR2
A H:\Day3\5D II\IMG_1375.CR2
A H:\Day3\5D II\IMG_1376.CR2
A H:\Day3\5D II\IMG_1377.CR2
A H:\Day3\5D II\IMG_1378.CR2
A H:\Day3\5D II\IMG_1379.CR2
A H:\Day3\5D II\IMG_1380.CR2
A H:\Day3\5D II\IMG_1381.CR2
A H:\Day3\5D II\IMG_1382.CR2
A H:\Day3\5D II\IMG_1383.CR2
A H:\Day3\5D II\IMG_1384.CR2
A H:\Day3\5D II\IMG_1388.CR2
A H:\Day3\5D II\IMG_1389.CR2
A H:\Day3\5D II\IMG_1390.CR2
A H:\Day3\5D II\IMG_1391.CR2
A H:\Day3\5D II\IMG_1392.CR2
A H:\Day3\5D II\IMG_1393.CR2
A H:\Day3\5D II\IMG_1394.CR2
A H:\Day3\5D II\IMG_1395.CR2
A H:\Day3\5D II\IMG_1396.CR2
A H:\Day3\5D II\IMG_1397.CR2
A H:\Day3\5D II\IMG_1398.CR2
A H:\Day3\5D II\IMG_1399.CR2
A H:\Day3\5D II\IMG_1400.CR2
A H:\Day3\5D II\IMG_1401.CR2
A H:\Day3\5D II\IMG_1402.CR2
A H:\Day3\5D II\IMG_1403.CR2
A H:\Day3\5D II\IMG_1404.CR2
A H:\Day3\5D II\IMG_1405.CR2
A H:\Day3\5D II\IMG_1406.CR2
A H:\Day3\5D II\IMG_1407.CR2
A H:\Day3\5D II\IMG_1408.CR2
A H:\Day3\5D II\IMG_1409.CR2
A H:\Day3\5D II\IMG_1410.CR2
A H:\Day3\5D II\IMG_1411.CR2
A H:\Day3\5D II\IMG_1412.CR2
A H:\Day3\5D II\IMG_1413.CR2
A H:\Day3\5D II\IMG_1414.CR2
A H:\Day3\5D II\IMG_1415.CR2
A H:\Day3\5D II\IMG_1416.CR2
A H:\Day3\5D II\IMG_1417.CR2
A H:\Day3\5D II\IMG_1418.CR2
A H:\Day3\5D II\IMG_1419.CR2
A H:\Day3\5D II\IMG_1420.CR2
A H:\Day3\5D II\IMG_1421.CR2
A H:\Day3\5D II\IMG_1422.CR2
A H:\Day3\5D II\IMG_1423.CR2
A H:\Day3\5D II\IMG_1424.CR2
A H:\Day3\5D II\IMG_1425.CR2
A H:\Day3\5D II\IMG_1428.CR2
A H:\Day3\5D II\IMG_1429.CR2
A H:\Day3\5D II\IMG_1430.CR2
A H:\Day3\5D II\IMG_1431.CR2
A H:\Day3\5D II\IMG_1432.CR2
A H:\Day3\5D II\IMG_1434.CR2
A H:\Day3\5D II\IMG_1435.CR2
A H:\Day3\5D II\IMG_1436.CR2
A H:\Day3\5D II\IMG_1437.CR2
A H:\Day3\5D II\IMG_1438.CR2
A H:\Day3\5D II\IMG_1439.CR2
A H:\Day3\5D II\IMG_1440.CR2
A H:\Day3\5D II\IMG_1441.CR2
A H:\Day3\5D II\IMG_1444.CR2
A H:\Day3\5D II\IMG_1445.CR2
A H:\Day3\5D II\IMG_1446.CR2
A H:\Day3\5D II\IMG_1447.CR2
A H:\Day3\5D II\IMG_1449.CR2
A H:\Day3\5D II\IMG_1450.CR2
A H:\Day3\5D II\IMG_1451.CR2
A H:\Day3\5D II\IMG_1452.CR2
A H:\Day3\5D II\IMG_1453.CR2
A H:\Day3\5D II\IMG_1454.CR2
A H:\Day3\5D II\IMG_1455.CR2
A H:\Day3\5D II\IMG_1456.CR2
A H:\Day3\5D II\IMG_1457.CR2
A H:\Day3\5D II\IMG_1458.CR2
A H:\Day3\5D II\IMG_1459.CR2
A H:\Day3\5D II\IMG_1460.CR2
A H:\Day3\5D II\IMG_1461.CR2
A H:\Day3\5D II\IMG_1462.CR2
A H:\Day3\5D II\IMG_1463.CR2
A H:\Day3\5D II\IMG_1464.CR2
A H:\Day3\5D II\IMG_1465.CR2
A H:\Day3\5D II\IMG_1466.CR2
A H:\Day3\5D II\IMG_1467.CR2
A H:\Day3\5D II\IMG_1468.CR2
A H:\Day3\5D II\IMG_1469.CR2
A H:\Day3\5D II\IMG_1470.CR2
A H:\Day3\5D II\IMG_1471.CR2
A H:\Day3\5D II\IMG_1472.CR2
A H:\Day3\5D II\IMG_1473.CR2
A H:\Day3\5D II\IMG_1474.CR2
A H:\Day3\5D II\IMG_1477.CR2
A H:\Day3\5D II\IMG_1478.CR2
A H:\Day3\5D II\IMG_1479.CR2
A H:\Day3\5D II\IMG_1481.CR2
A H:\Day3\5D II\IMG_1482.CR2
A H:\Day3\5D II\IMG_1483.CR2
A H:\Day3\5D II\IMG_1484.CR2
A H:\Day3\5D II\IMG_1485.CR2
A H:\Day3\5D II\IMG_1486.CR2
A H:\Day3\5D II\IMG_1487.CR2
A H:\Day3\5D II\IMG_1488.CR2
A H:\Day3\5D II\IMG_1489.CR2
A H:\Day3\5D II\IMG_1490.CR2
A H:\Day3\5D II\IMG_1491.CR2
A H:\Day3\5D II\IMG_1492.CR2
A H:\Day3\5D II\IMG_1493.CR2
A H:\Day3\5D II\IMG_1494.CR2
A H:\Day3\5D II\IMG_1495.CR2
A H:\Day3\5D II\IMG_1496.CR2
A H:\Day3\5D II\IMG_1497.CR2
A H:\Day3\5D II\IMG_1498.CR2
A H:\Day3\5D II\IMG_1499.CR2
A H:\Day3\5D II\IMG_1500.CR2
A H:\Day3\5D II\IMG_1501.CR2
A H:\Day3\5D II\IMG_1502.CR2
A H:\Day3\5D II\IMG_1503.CR2
A H:\Day3\5D II\IMG_1504.CR2
A H:\Day3\5D II\IMG_1505.CR2
A H:\Day3\5D II\IMG_1506.CR2
A H:\Day3\5D II\IMG_1507.CR2
A H:\Day3\5D II\IMG_1508.CR2
A H:\Day3\5D II\IMG_1509.CR2
A H:\Day3\5D II\IMG_1513.CR2
A H:\Day3\5D II\IMG_1514.CR2
A H:\Day3\5D II\IMG_1515.CR2
A H:\Day3\5D II\IMG_1516.CR2
A H:\Day3\5D II\IMG_1517.CR2
A H:\Day3\5D II\IMG_1518.CR2
A H:\Day3\5D II\IMG_1519.CR2
A H:\Day3\5D II\IMG_1520.CR2
A H:\Day3\5D II\IMG_1521.CR2
A H:\Day3\5D II\IMG_1522.CR2
A H:\Day3\5D II\IMG_1523.CR2
A H:\Day3\5D II\IMG_1524.CR2
A H:\Day3\5D II\IMG_1525.CR2
A H:\Day3\5D II\IMG_1526.CR2
A H:\Day3\5D II\IMG_1527.CR2
A H:\Day3\5D II\IMG_1528.CR2
A H:\Day3\5D II\IMG_1529.CR2
A H:\Day3\5D II\IMG_1530.CR2
A H:\Day3\5D II\IMG_1531.CR2
A H:\Day3\5D II\IMG_1532.CR2
A H:\Day3\5D II\IMG_1533.CR2
A H:\Day3\5D II\IMG_1534.CR2
A H:\Day3\5D II\IMG_1535.CR2
A H:\Day3\5D II\IMG_1536.CR2
A H:\Day3\5D II\IMG_1537.CR2
A H:\Day3\5D II\IMG_1538.CR2
A H:\Day3\5D II\IMG_1539.CR2
A H:\Day3\5D II\IMG_1540.CR2
A H:\Day3\5D II\IMG_1541.CR2
A H:\Day3\5D II\IMG_1542.CR2
A H:\Day3\5D II\IMG_1543.CR2
A H:\Day3\5D II\IMG_1544.CR2
A H:\Day3\5D II\IMG_1545.CR2
A H:\Day3\5D II\IMG_1546.CR2
A H:\Day3\5D II\IMG_1547.CR2
A H:\Day3\5D II\IMG_1548.CR2
A H:\Day3\5D II\IMG_1549.CR2
A H:\Day3\5D II\IMG_1550.CR2
A H:\Day3\5D II\IMG_1551.CR2
A H:\Day3\5D II\IMG_1552.CR2
A H:\Day3\5D II\IMG_1553.CR2
A H:\Day3\5D II\IMG_1554.CR2
A H:\Day3\5D II\IMG_1555.CR2
A H:\Day3\5D II\IMG_1556.CR2
A H:\Day3\5D II\IMG_1557.CR2
A H:\Day3\5D II\IMG_1558.CR2
A H:\Day3\5D II\IMG_1559.CR2
A H:\Day3\5D II\IMG_1560.CR2
A H:\Day3\5D II\IMG_1561.CR2
A H:\Day3\5D II\IMG_1562.CR2
A H:\Day3\5D II\IMG_1563.CR2
A H:\Day3\5D II\IMG_1564.CR2
A H:\Day3\5D II\IMG_1565.CR2
A H:\Day3\5D II\IMG_1566.CR2
A H:\Day3\5D II\IMG_1567.CR2
A H:\Day3\5D II\IMG_1568.CR2
A H:\Day3\5D II\IMG_1569.CR2
A H:\Day3\5D II\IMG_1574.CR2
A H:\Day3\5D II\IMG_1575.CR2
A H:\Day3\5D II\IMG_1576.CR2
A H:\Day3\5D II\IMG_1579.CR2
A H:\Day3\5D II\IMG_1580.CR2
A H:\Day3\5D II\IMG_1581.CR2
A H:\Day3\5D II\IMG_1582.CR2
A H:\Day3\5D II\IMG_1583.CR2
A H:\Day3\5D II\IMG_1584.CR2
A H:\Day3\5D II\IMG_1585.CR2
A H:\Day3\5D II\IMG_1586.CR2
A H:\Day3\5D II\IMG_1587.CR2
A H:\Day3\5D II\IMG_1588.CR2
A H:\Day3\5D II\IMG_1589.CR2
A H:\Day3\5D II\IMG_1590.CR2
A H:\Day3\5D II\IMG_1591.CR2
A H:\Day3\5D II\IMG_1592.CR2
A H:\Day3\5D II\IMG_1593.CR2
A H:\Day3\5D II\IMG_1594.CR2
A H:\Day3\5D II\IMG_1595.CR2
A H:\Day3\5D II\IMG_1596.CR2
A H:\Day3\5D II\IMG_1597.CR2
A H:\Day3\5D II\IMG_1598.CR2
A H:\Day3\5D II\IMG_1599.CR2
A H:\Day3\5D II\IMG_1600.CR2
A H:\Day3\5D II\IMG_1601.CR2
A H:\Day3\5D II\IMG_1602.CR2
A H:\Day3\5D II\IMG_1603.CR2
A H:\Day3\5D II\IMG_1604.CR2
A H:\Day3\5D II\IMG_1605.CR2
A H:\Day3\5D II\IMG_1606.CR2
A H:\Day3\5D II\IMG_1607.CR2
A H:\Day3\5D II\IMG_1608.CR2
A H:\Day3\5D II\IMG_1609.CR2
A H:\Day3\5D II\IMG_1610.CR2
A H:\Day3\5D II\IMG_1611.CR2
A H:\Day3\5D II\IMG_1612.CR2
A H:\Day3\5D II\IMG_1613.CR2
A H:\Day3\5D II\IMG_1614.CR2
A H:\Day3\5D II\IMG_1615.CR2
A H:\Day3\5D II\IMG_1616.CR2
A H:\Day3\5D II\IMG_1617.CR2
A H:\Day3\5D II\IMG_1618.CR2
A H:\Day3\5D II\IMG_1619.CR2
A H:\Day3\5D II\IMG_1620.CR2
A H:\Day3\5D II\IMG_1621.CR2
A H:\Day3\5D II\IMG_1622.CR2
A H:\Day3\5D II\IMG_1623.CR2
A H:\Day3\5D II\IMG_1624.CR2
A H:\Day3\5D II\IMG_1625.CR2
A H:\Day3\5D II\IMG_1626.CR2
A H:\Day3\5D II\IMG_1627.CR2
A H:\Day3\5D II\IMG_1628.CR2
A H:\Day3\5D II\IMG_1629.CR2
A H:\Day3\5D II\IMG_1630.CR2
A H:\Day3\5D II\IMG_1631.CR2
A H:\Day3\5D II\IMG_1632.CR2
A H:\Day3\5D II\IMG_1633.CR2
A H:\Day3\5D II\IMG_1634.CR2
A H:\Day3\5D II\IMG_1635.CR2
A H:\Day3\5D II\IMG_1636.CR2
A H:\Day3\5D II\IMG_1637.CR2
A H:\Day3\5D II\IMG_1638.CR2
A H:\Day3\5D II\IMG_1639.CR2
A H:\Day3\5D II\IMG_1640.CR2
A H:\Day3\5D II\IMG_1641.CR2
A H:\Day3\5D II\IMG_1642.CR2
A H:\Day3\5D II\IMG_1643.CR2
A H:\Day3\5D II\IMG_1644.CR2
A H:\Day3\5D II\IMG_1645.CR2
A H:\Day3\5D II\IMG_1646.CR2
A H:\Day3\5D II\IMG_1647.CR2
A H:\Day3\5D II\IMG_1648.CR2
A H:\Day3\5D II\IMG_1649.CR2
A H:\Day3\5D II\IMG_1650.CR2
A H:\Day3\5D II\IMG_1651.CR2
A H:\Day3\5D II\IMG_1652.CR2
A H:\Day3\5D II\IMG_1653.CR2
A H:\Day3\5D II\IMG_1654.CR2
A H:\Day3\5D II\IMG_1655.CR2
A H:\Day3\5D II\IMG_1656.CR2
A H:\Day3\5D II\IMG_1657.CR2
A H:\Day3\5D II\IMG_1658.CR2
A H:\Day3\5D II\IMG_1659.CR2
A H:\Day3\5D II\IMG_1660.CR2
A H:\Day3\5D II\IMG_1661.CR2
A H:\Day3\5D II\IMG_1662.CR2
A H:\Day3\5D II\IMG_1663.CR2
A H:\Day3\5D II\IMG_1664.CR2
A H:\Day3\5D II\IMG_1665.CR2
A H:\Day3\5D II\IMG_1666.CR2
A H:\Day3\5D II\IMG_1667.CR2
A H:\Day3\5D II\IMG_1668.CR2
A H:\Day3\5D II\IMG_1669.CR2
A H:\Day3\5D II\IMG_1670.CR2
A H:\Day3\5D II\IMG_1671.CR2
A H:\Day3\5D II\IMG_1672.CR2
A H:\Day3\5D II\IMG_1673.CR2
A H:\Day3\5D II\IMG_1674.CR2
A H:\Day3\5D II\IMG_1675.CR2
A H:\Day3\5D II\IMG_1676.CR2
A H:\Day3\5D II\IMG_1677.CR2
A H:\Day3\5D II\IMG_1678.CR2
A H:\Day3\5D II\IMG_1679.CR2
A H:\Day3\5D II\IMG_1680.CR2
A H:\Day3\5D II\IMG_1681.CR2
A H:\Day3\5D II\IMG_1682.CR2
A H:\Day3\5D II\IMG_1683.CR2
A H:\Day3\5D II\IMG_1684.CR2
A H:\Day3\5D II\IMG_1685.CR2
A H:\Day3\5D II\IMG_1686.CR2
A H:\Day3\5D II\IMG_1687.CR2
A H:\Day3\5D II\IMG_1688.CR2
A H:\Day3\5D II\IMG_1689.CR2
A H:\Day3\5D II\IMG_1690.CR2
A H:\Day3\5D II\IMG_1691.CR2
A H:\Day3\5D II\IMG_1692.CR2
A H:\Day3\5D II\IMG_1693.CR2
A H:\Day3\5D II\IMG_1694.CR2
A H:\Day3\5D II\IMG_1695.CR2
A H:\Day3\5D II\IMG_1696.CR2
A H:\Day3\5D II\IMG_1697.CR2
A H:\Day3\5D II\IMG_1698.CR2
A H:\Day3\5D II\IMG_1699.CR2
A H:\Day3\5D II\IMG_1700.CR2
A H:\Day3\5D II\IMG_1701.CR2
A H:\Day3\5D II\IMG_1702.CR2
A H:\Day3\5D II\IMG_1703.CR2
A H:\Day3\5D II\IMG_1704.CR2
A H:\Day3\5D II\IMG_1705.CR2
A H:\Day3\5D II\IMG_1706.CR2
A H:\Day3\5D II\MVI_1150.MOV
A H:\Day3\5D II\MVI_1150.THM
A H:\Day3\5D II\MVI_1254.MOV
A H:\Day3\5D II\MVI_1254.THM
A H:\Day3\5D II\MVI_1300.MOV
A H:\Day3\5D II\MVI_1300.THM
A H:\Day3\5D II\MVI_1304.MOV
A H:\Day3\5D II\MVI_1304.THM
A H:\Day3\5D II\MVI_1305.MOV
A H:\Day3\5D II\MVI_1305.THM
A H:\Day3\5D II\MVI_1385.MOV
A H:\Day3\5D II\MVI_1385.THM
A H:\Day3\5D II\MVI_1386.MOV
A H:\Day3\5D II\MVI_1386.THM
A H:\Day3\5D II\MVI_1387.MOV
A H:\Day3\5D II\MVI_1387.THM
A H:\Day3\5D II\MVI_1426.MOV
A H:\Day3\5D II\MVI_1426.THM
A H:\Day3\5D II\MVI_1427.MOV
A H:\Day3\5D II\MVI_1427.THM
A H:\Day3\5D II\MVI_1433.MOV
A H:\Day3\5D II\MVI_1433.THM
A H:\Day3\5D II\MVI_1442.MOV
A H:\Day3\5D II\MVI_1442.THM
A H:\Day3\5D II\MVI_1443.MOV
A H:\Day3\5D II\MVI_1443.THM
A H:\Day3\5D II\MVI_1448.MOV
A H:\Day3\5D II\MVI_1448.THM
A H:\Day3\5D II\MVI_1475.MOV
A H:\Day3\5D II\MVI_1475.THM
A H:\Day3\5D II\MVI_1476.MOV
A H:\Day3\5D II\MVI_1476.THM
A H:\Day3\5D II\MVI_1480.MOV
A H:\Day3\5D II\MVI_1480.THM
A H:\Day3\5D II\MVI_1510.MOV
A H:\Day3\5D II\MVI_1510.THM
A H:\Day3\5D II\MVI_1511.MOV
A H:\Day3\5D II\MVI_1511.THM
A H:\Day3\5D II\MVI_1512.MOV
A H:\Day3\5D II\MVI_1512.THM
A H:\Day3\5D II\MVI_1570.MOV
A H:\Day3\5D II\MVI_1570.THM
A H:\Day3\5D II\MVI_1571.MOV
A H:\Day3\5D II\MVI_1571.THM
A H:\Day3\5D II\MVI_1572.MOV
A H:\Day3\5D II\MVI_1572.THM
A H:\Day3\5D II\MVI_1573.MOV
A H:\Day3\5D II\MVI_1573.THM
A H:\Day3\5D II\MVI_1577.MOV
A H:\Day3\5D II\MVI_1577.THM
A H:\Day3\5D II\MVI_1578.MOV
A H:\Day3\5D II\MVI_1578.THM
A H:\Day3\60D\IMG_5283.CR2
A H:\Day3\60D\IMG_5284.CR2
A H:\Day3\60D\IMG_5285.CR2
A H:\Day3\60D\IMG_5286.CR2
A H:\Day3\60D\IMG_5287.CR2
A H:\Day3\60D\IMG_5288.CR2
A H:\Day3\60D\IMG_5289.CR2
A H:\Day3\60D\IMG_5290.CR2
A H:\Day3\60D\IMG_5291.CR2
A H:\Day3\60D\IMG_5292.CR2
A H:\Day3\60D\IMG_5293.CR2
A H:\Day3\60D\IMG_5294.CR2
A H:\Day3\60D\IMG_5295.CR2
A H:\Day3\60D\IMG_5296.CR2
A H:\Day3\60D\IMG_5297.CR2
A H:\Day3\60D\IMG_5298.CR2
A H:\Day3\60D\IMG_5299.CR2
A H:\Day3\60D\IMG_5300.CR2
A H:\Day3\60D\IMG_5301.CR2
A H:\Day3\60D\IMG_5302.CR2
A H:\Day3\60D\IMG_5303.CR2
A H:\Day3\60D\IMG_5304.CR2
A H:\Day3\60D\IMG_5305.CR2
A H:\Day3\60D\IMG_5306.CR2
A H:\Day3\60D\IMG_5307.CR2
A H:\Day3\60D\IMG_5308.CR2
A H:\Day3\60D\IMG_5309.CR2
A H:\Day3\60D\IMG_5310.CR2
A H:\Day3\60D\IMG_5311.CR2
A H:\Day3\60D\IMG_5312.CR2
A H:\Day3\60D\IMG_5313.CR2
A H:\Day3\60D\IMG_5314.CR2
A H:\Day3\60D\IMG_5315.CR2
A H:\Day3\60D\IMG_5316.CR2
A H:\Day3\60D\IMG_5317.CR2
A H:\Day3\60D\IMG_5318.CR2
A H:\Day3\60D\IMG_5319.CR2
A H:\Day3\60D\IMG_5320.CR2
A H:\Day3\60D\IMG_5321.CR2
A H:\Day3\60D\IMG_5322.CR2
A H:\Day3\60D\IMG_5323.CR2
ssmad
Regular Member
 
Posts: 41
Joined: May 25th, 2013, 12:10 pm

Re: External WD HD infected with Win32:Kryptik.LQL

Unread postby ssmad » May 27th, 2013, 9:00 am

A H:\Day4 Ishkashim\100CANON\MVI_5324.MOV
A H:\Day4 Ishkashim\100CANON\MVI_5325.MOV
A H:\Day4 Ishkashim\100CANON\MVI_5326.MOV
A H:\Day4 Ishkashim\100CANON\MVI_5327.MOV
A H:\Day4 Ishkashim\100CANON\MVI_5328.MOV
A H:\Day4 Ishkashim\100CANON\MVI_5329.MOV
A H:\Day4 Ishkashim\100CANON\MVI_5330.MOV
A H:\Day4 Ishkashim\100CANON\MVI_5331.MOV
A H:\Day4 Ishkashim\100CANON\MVI_5332.MOV
A H:\Day4 Ishkashim\100CANON\MVI_5333.MOV
A H:\Day4 Ishkashim\100CANON\MVI_5334.MOV
A H:\Day4 Ishkashim\100CANON\MVI_5335.MOV
A H:\Day4 Ishkashim\100CANON\MVI_5336.MOV
A H:\Day4 Ishkashim\100CANON\MVI_5337.MOV
A H:\Day4 Ishkashim\100CANON\MVI_5338.MOV
A H:\Day4 Ishkashim\100CANON\MVI_5339.MOV
A H:\Day4 Ishkashim\100CANON\MVI_5340.MOV
A H:\Day4 Ishkashim\100EOS5D\IMG_1714.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1715.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1716.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1717.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1718.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1719.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1720.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1721.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1722.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1723.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1724.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1725.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1726.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1727.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1728.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1729.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1730.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1731.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1732.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1733.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1734.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1735.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1736.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1737.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1738.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1743.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1744.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1745.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1746.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1747.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1748.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1749.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1750.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1751.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1752.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1756.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1757.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1758.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1759.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1760.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1761.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1762.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1763.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1764.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1765.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1766.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1767.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1768.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1769.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1770.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1771.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1772.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1773.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1774.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1775.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1776.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1777.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1778.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1779.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1780.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1781.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1782.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1783.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1784.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1785.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1786.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1787.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1788.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1789.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1790.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1791.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1792.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1794.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1819.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1820.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1821.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1822.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1823.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1824.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1825.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1826.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1827.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1828.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1829.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1830.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1831.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1832.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1833.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1834.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1835.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1836.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1837.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1838.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1839.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1840.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1841.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1842.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1843.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1844.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1845.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1846.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1847.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1848.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1849.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1850.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1852.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1853.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1854.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1855.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1856.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1857.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1858.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1859.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1860.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1861.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1862.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1863.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1864.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1865.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1866.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1869.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1870.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1871.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1872.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1873.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1874.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1875.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1876.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1877.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1878.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1879.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1880.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1881.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1882.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1884.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1885.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1886.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1887.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1888.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1889.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1890.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1891.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1892.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1893.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1894.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1895.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1896.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1897.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1898.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1899.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1900.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1901.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1902.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1903.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1904.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1905.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1906.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1907.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1908.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1909.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1910.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1911.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1912.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1913.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1914.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1915.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1916.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1917.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1918.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1919.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1920.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1921.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1922.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1923.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1924.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1925.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1926.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1927.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1928.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1929.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1930.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1931.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1932.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1933.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1934.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1935.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1936.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1937.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1938.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1939.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1940.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1941.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1942.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1943.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1945.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1946.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1947.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1948.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1949.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1950.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1951.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1952.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1953.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1954.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1955.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1956.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1957.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1959.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1960.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1961.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1962.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1963.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1964.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1965.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1966.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1967.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1968.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1969.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1970.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1971.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1972.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1973.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1974.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1975.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1976.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1977.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1978.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1979.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1980.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1981.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1982.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1983.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1984.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1985.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1986.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1987.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1988.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1989.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1990.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1991.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1992.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1993.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1994.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1995.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1996.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1997.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1998.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_1999.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_2000.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_2001.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_2002.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_2003.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_2004.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_2005.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_2006.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_2007.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_2008.CR2
A H:\Day4 Ishkashim\100EOS5D\IMG_2009.CR2
A H:\Day4 Ishkashim\100EOS5D\MVI_1712.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1712.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1713.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1713.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1739.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1739.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1740.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1740.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1741.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1741.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1742.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1742.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1753.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1753.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1755.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1755.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1795.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1795.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1796.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1796.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1797.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1797.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1798.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1798.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1799.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1799.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1800.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1800.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1801.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1801.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1802.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1802.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1803.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1803.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1804.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1804.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1805.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1805.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1806.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1806.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1807.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1807.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1808.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1808.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1809.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1809.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1810.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1810.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1811.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1811.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1812.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1812.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1813.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1813.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1814.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1814.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1815.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1815.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1816.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1816.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1817.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1817.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1818.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1818.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1851.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1851.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1867.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1867.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1868.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1868.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1883.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1883.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1944.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1944.THM
A H:\Day4 Ishkashim\100EOS5D\MVI_1958.MOV
A H:\Day4 Ishkashim\100EOS5D\MVI_1958.THM
A H:\Day5\100CANON\IMG_5353.CR2
A H:\Day5\100CANON\IMG_5357.CR2
A H:\Day5\100CANON\IMG_5358.CR2
A H:\Day5\100CANON\IMG_5359.CR2
A H:\Day5\100CANON\IMG_5360.CR2
A H:\Day5\100CANON\IMG_5361.CR2
A H:\Day5\100CANON\IMG_5362.CR2
A H:\Day5\100CANON\IMG_5363.CR2
A H:\Day5\100CANON\IMG_5394.CR2
A H:\Day5\100CANON\IMG_5395.CR2
A H:\Day5\100CANON\IMG_5396.CR2
A H:\Day5\100CANON\MVI_5341.MOV
A H:\Day5\100CANON\MVI_5342.MOV
A H:\Day5\100CANON\MVI_5343.MOV
A H:\Day5\100CANON\MVI_5344.MOV
A H:\Day5\100CANON\MVI_5345.MOV
A H:\Day5\100CANON\MVI_5346.MOV
A H:\Day5\100CANON\MVI_5347.MOV
A H:\Day5\100CANON\MVI_5348.MOV
A H:\Day5\100CANON\MVI_5349.MOV
A H:\Day5\100CANON\MVI_5350.MOV
A H:\Day5\100CANON\MVI_5351.MOV
A H:\Day5\100CANON\MVI_5352.MOV
A H:\Day5\100CANON\MVI_5354.MOV
A H:\Day5\100CANON\MVI_5355.MOV
A H:\Day5\100CANON\MVI_5356.MOV
A H:\Day5\100CANON\MVI_5364.MOV
A H:\Day5\100CANON\MVI_5365.MOV
A H:\Day5\100CANON\MVI_5366.MOV
A H:\Day5\100CANON\MVI_5367.MOV
A H:\Day5\100CANON\MVI_5368.MOV
A H:\Day5\100CANON\MVI_5369.MOV
A H:\Day5\100CANON\MVI_5370.MOV
A H:\Day5\100CANON\MVI_5371.MOV
A H:\Day5\100CANON\MVI_5372.MOV
A H:\Day5\100CANON\MVI_5373.MOV
A H:\Day5\100CANON\MVI_5374.MOV
A H:\Day5\100CANON\MVI_5375.MOV
A H:\Day5\100CANON\MVI_5376.MOV
A H:\Day5\100CANON\MVI_5377.MOV
A H:\Day5\100CANON\MVI_5378.MOV
A H:\Day5\100CANON\MVI_5379.MOV
A H:\Day5\100CANON\MVI_5380.MOV
A H:\Day5\100CANON\MVI_5381.MOV
A H:\Day5\100CANON\MVI_5382.MOV
A H:\Day5\100CANON\MVI_5383.MOV
A H:\Day5\100CANON\MVI_5384.MOV
A H:\Day5\100CANON\MVI_5385.MOV
A H:\Day5\100CANON\MVI_5386.MOV
A H:\Day5\100CANON\MVI_5387.MOV
A H:\Day5\100CANON\MVI_5388.MOV
A H:\Day5\100CANON\MVI_5389.MOV
A H:\Day5\100CANON\MVI_5390.MOV
A H:\Day5\100CANON\MVI_5391.MOV
A H:\Day5\100CANON\MVI_5392.MOV
A H:\Day5\100CANON\MVI_5393.MOV
A H:\Day5\100CANON\MVI_5397.MOV
A H:\Day5\100CANON\MVI_5398.MOV
A H:\Day5\100CANON\MVI_5399.MOV
A H:\Day5\100EOS5D\100CANON\IMG_2503.CR2
A H:\Day5\100EOS5D\100CANON\IMG_2504.CR2
A H:\Day5\100EOS5D\100CANON\IMG_2505.CR2
A H:\Day5\100EOS5D\100CANON\IMG_2506.CR2
A H:\Day5\100EOS5D\100CANON\IMG_2507.CR2
A H:\Day5\100EOS5D\100CANON\IMG_2508.CR2
A H:\Day5\100EOS5D\100CANON\IMG_2509.CR2
A H:\Day5\100EOS5D\100CANON\IMG_2510.CR2
A H:\Day5\100EOS5D\100CANON\IMG_2511.CR2
A H:\Day5\100EOS5D\100CANON\IMG_2512.CR2
A H:\Day5\100EOS5D\100CANON\IMG_2513.CR2
A H:\Day5\100EOS5D\100CANON\IMG_2514.CR2
A H:\Day5\100EOS5D\100CANON\IMG_2515.CR2
A H:\Day5\100EOS5D\100CANON\IMG_2516.CR2
A H:\Day5\100EOS5D\100CANON\IMG_2517.CR2
A H:\Day5\100EOS5D\100CANON\IMG_5353.CR2
A H:\Day5\100EOS5D\100CANON\IMG_5357.CR2
A H:\Day5\100EOS5D\100CANON\IMG_5358.CR2
A H:\Day5\100EOS5D\100CANON\IMG_5359.CR2
A H:\Day5\100EOS5D\100CANON\IMG_5360.CR2
A H:\Day5\100EOS5D\100CANON\IMG_5361.CR2
A H:\Day5\100EOS5D\100CANON\IMG_5362.CR2
A H:\Day5\100EOS5D\100CANON\IMG_5363.CR2
A H:\Day5\100EOS5D\100CANON\IMG_5394.CR2
A H:\Day5\100EOS5D\100CANON\IMG_5395.CR2
A H:\Day5\100EOS5D\100CANON\IMG_5396.CR2
A H:\Day5\100EOS5D\100CANON\MVI_5341.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5342.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5343.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5344.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5345.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5346.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5347.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5348.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5349.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5350.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5351.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5352.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5354.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5355.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5356.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5364.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5365.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5366.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5367.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5368.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5369.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5370.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5371.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5372.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5373.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5374.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5375.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5376.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5377.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5378.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5379.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5380.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5381.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5382.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5383.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5384.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5385.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5386.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5387.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5388.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5389.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5390.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5391.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5392.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5393.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5397.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5398.MOV
A H:\Day5\100EOS5D\100CANON\MVI_5399.MOV
A SH H:\Day5\100EOS5D\100CANON\Thumbs.db
A H:\Day5\100EOS5D\IMG_2010.CR2
A H:\Day5\100EOS5D\IMG_2011.CR2
A H:\Day5\100EOS5D\IMG_2012.CR2
A H:\Day5\100EOS5D\IMG_2013.CR2
A H:\Day5\100EOS5D\IMG_2017.CR2
A H:\Day5\100EOS5D\IMG_2018.CR2
A H:\Day5\100EOS5D\IMG_2019.CR2
A H:\Day5\100EOS5D\IMG_2020.CR2
A H:\Day5\100EOS5D\IMG_2021.CR2
A H:\Day5\100EOS5D\IMG_2024.CR2
A H:\Day5\100EOS5D\IMG_2025.CR2
A H:\Day5\100EOS5D\IMG_2026.CR2
A H:\Day5\100EOS5D\IMG_2027.CR2
A H:\Day5\100EOS5D\IMG_2028.CR2
A H:\Day5\100EOS5D\IMG_2029.CR2
A H:\Day5\100EOS5D\IMG_2030.CR2
A H:\Day5\100EOS5D\IMG_2031.CR2
A H:\Day5\100EOS5D\IMG_2032.CR2
A H:\Day5\100EOS5D\IMG_2033.CR2
A H:\Day5\100EOS5D\IMG_2034.CR2
A H:\Day5\100EOS5D\IMG_2035.CR2
A H:\Day5\100EOS5D\IMG_2036.CR2
A H:\Day5\100EOS5D\IMG_2037.CR2
A H:\Day5\100EOS5D\IMG_2038.CR2
A H:\Day5\100EOS5D\IMG_2039.CR2
A H:\Day5\100EOS5D\IMG_2040.CR2
A H:\Day5\100EOS5D\IMG_2041.CR2
A H:\Day5\100EOS5D\IMG_2042.CR2
A H:\Day5\100EOS5D\IMG_2043.CR2
A H:\Day5\100EOS5D\IMG_2044.CR2
A H:\Day5\100EOS5D\IMG_2047.CR2
A H:\Day5\100EOS5D\IMG_2048.CR2
A H:\Day5\100EOS5D\IMG_2049.CR2
A H:\Day5\100EOS5D\IMG_2050.CR2
A H:\Day5\100EOS5D\IMG_2062.CR2
A H:\Day5\100EOS5D\IMG_2063.CR2
A H:\Day5\100EOS5D\IMG_2064.CR2
A H:\Day5\100EOS5D\IMG_2065.CR2
A H:\Day5\100EOS5D\IMG_2066.CR2
A H:\Day5\100EOS5D\IMG_2067.CR2
A H:\Day5\100EOS5D\IMG_2068.CR2
A H:\Day5\100EOS5D\IMG_2071.CR2
A H:\Day5\100EOS5D\IMG_2072.CR2
A H:\Day5\100EOS5D\IMG_2073.CR2
A H:\Day5\100EOS5D\IMG_2074.CR2
A H:\Day5\100EOS5D\IMG_2075.CR2
A H:\Day5\100EOS5D\IMG_2076.CR2
A H:\Day5\100EOS5D\IMG_2077.CR2
A H:\Day5\100EOS5D\IMG_2078.CR2
A H:\Day5\100EOS5D\IMG_2079.CR2
A H:\Day5\100EOS5D\IMG_2080.CR2
A H:\Day5\100EOS5D\IMG_2081.CR2
A H:\Day5\100EOS5D\IMG_2082.CR2
A H:\Day5\100EOS5D\IMG_2083.CR2
A H:\Day5\100EOS5D\IMG_2084.CR2
A H:\Day5\100EOS5D\IMG_2085.CR2
A H:\Day5\100EOS5D\IMG_2091.CR2
A H:\Day5\100EOS5D\IMG_2092.CR2
A H:\Day5\100EOS5D\IMG_2093.CR2
A H:\Day5\100EOS5D\IMG_2094.CR2
A H:\Day5\100EOS5D\IMG_2095.CR2
A H:\Day5\100EOS5D\IMG_2096.CR2
A H:\Day5\100EOS5D\IMG_2097.CR2
A H:\Day5\100EOS5D\IMG_2098.CR2
A H:\Day5\100EOS5D\IMG_2099.CR2
A H:\Day5\100EOS5D\IMG_2100.CR2
A H:\Day5\100EOS5D\IMG_2101.CR2
A H:\Day5\100EOS5D\IMG_2102.CR2
A H:\Day5\100EOS5D\IMG_2103.CR2
A H:\Day5\100EOS5D\IMG_2104.CR2
A H:\Day5\100EOS5D\IMG_2105.CR2
A H:\Day5\100EOS5D\IMG_2106.CR2
A H:\Day5\100EOS5D\IMG_2107.CR2
A H:\Day5\100EOS5D\IMG_2108.CR2
A H:\Day5\100EOS5D\IMG_2109.CR2
A H:\Day5\100EOS5D\IMG_2110.CR2
A H:\Day5\100EOS5D\IMG_2111.CR2
A H:\Day5\100EOS5D\IMG_2112.CR2
A H:\Day5\100EOS5D\IMG_2113.CR2
A H:\Day5\100EOS5D\IMG_2114.CR2
A H:\Day5\100EOS5D\IMG_2115.CR2
A H:\Day5\100EOS5D\IMG_2116.CR2
A H:\Day5\100EOS5D\IMG_2117.CR2
A H:\Day5\100EOS5D\IMG_2118.CR2
A H:\Day5\100EOS5D\IMG_2119.CR2
A H:\Day5\100EOS5D\IMG_2120.CR2
A H:\Day5\100EOS5D\IMG_2121.CR2
A H:\Day5\100EOS5D\IMG_2122.CR2
A H:\Day5\100EOS5D\IMG_2123.CR2
A H:\Day5\100EOS5D\IMG_2124.CR2
A H:\Day5\100EOS5D\IMG_2125.CR2
A H:\Day5\100EOS5D\IMG_2126.CR2
A H:\Day5\100EOS5D\IMG_2127.CR2
A H:\Day5\100EOS5D\IMG_2128.CR2
A H:\Day5\100EOS5D\IMG_2129.CR2
A H:\Day5\100EOS5D\IMG_2130.CR2
A H:\Day5\100EOS5D\IMG_2131.CR2
A H:\Day5\100EOS5D\IMG_2132.CR2
A H:\Day5\100EOS5D\IMG_2133.CR2
A H:\Day5\100EOS5D\IMG_2134.CR2
A H:\Day5\100EOS5D\IMG_2135.CR2
A H:\Day5\100EOS5D\IMG_2136.CR2
A H:\Day5\100EOS5D\IMG_2137.CR2
A H:\Day5\100EOS5D\IMG_2138.CR2
A H:\Day5\100EOS5D\IMG_2139.CR2
A H:\Day5\100EOS5D\IMG_2140.CR2
A H:\Day5\100EOS5D\IMG_2141.CR2
A H:\Day5\100EOS5D\IMG_2142.CR2
A H:\Day5\100EOS5D\IMG_2143.CR2
A H:\Day5\100EOS5D\IMG_2144.CR2
A H:\Day5\100EOS5D\IMG_2145.CR2
A H:\Day5\100EOS5D\IMG_2146.CR2
A H:\Day5\100EOS5D\IMG_2147.CR2
A H:\Day5\100EOS5D\IMG_2148.CR2
A H:\Day5\100EOS5D\IMG_2149.CR2
A H:\Day5\100EOS5D\IMG_2150.CR2
A H:\Day5\100EOS5D\IMG_2151.CR2
A H:\Day5\100EOS5D\IMG_2152.CR2
A H:\Day5\100EOS5D\IMG_2153.CR2
A H:\Day5\100EOS5D\IMG_2154.CR2
A H:\Day5\100EOS5D\IMG_2155.CR2
A H:\Day5\100EOS5D\IMG_2156.CR2
A H:\Day5\100EOS5D\IMG_2157.CR2
A H:\Day5\100EOS5D\IMG_2158.CR2
A H:\Day5\100EOS5D\IMG_2159.CR2
A H:\Day5\100EOS5D\IMG_2160.CR2
A H:\Day5\100EOS5D\IMG_2161.CR2
A H:\Day5\100EOS5D\IMG_2162.CR2
A H:\Day5\100EOS5D\IMG_2163.CR2
A H:\Day5\100EOS5D\IMG_2164.CR2
A H:\Day5\100EOS5D\IMG_2165.CR2
A H:\Day5\100EOS5D\IMG_2166.CR2
A H:\Day5\100EOS5D\IMG_2167.CR2
A H:\Day5\100EOS5D\IMG_2168.CR2
A H:\Day5\100EOS5D\IMG_2169.CR2
A H:\Day5\100EOS5D\IMG_2170.CR2
A H:\Day5\100EOS5D\IMG_2171.CR2
A H:\Day5\100EOS5D\IMG_2172.CR2
A H:\Day5\100EOS5D\IMG_2173.CR2
A H:\Day5\100EOS5D\IMG_2174.CR2
A H:\Day5\100EOS5D\IMG_2175.CR2
A H:\Day5\100EOS5D\IMG_2176.CR2
A H:\Day5\100EOS5D\IMG_2177.CR2
A H:\Day5\100EOS5D\IMG_2178.CR2
A H:\Day5\100EOS5D\IMG_2179.CR2
A H:\Day5\100EOS5D\IMG_2180.CR2
A H:\Day5\100EOS5D\IMG_2181.CR2
A H:\Day5\100EOS5D\IMG_2182.CR2
A H:\Day5\100EOS5D\IMG_2183.CR2
A H:\Day5\100EOS5D\IMG_2184.CR2
A H:\Day5\100EOS5D\IMG_2185.CR2
A H:\Day5\100EOS5D\IMG_2186.CR2
A H:\Day5\100EOS5D\IMG_2187.CR2
A H:\Day5\100EOS5D\IMG_2188.CR2
A H:\Day5\100EOS5D\IMG_2189.CR2
A H:\Day5\100EOS5D\IMG_2190.CR2
A H:\Day5\100EOS5D\IMG_2191.CR2
A H:\Day5\100EOS5D\IMG_2192.CR2
A H:\Day5\100EOS5D\IMG_2193.CR2
A H:\Day5\100EOS5D\IMG_2194.CR2
A H:\Day5\100EOS5D\IMG_2195.CR2
A H:\Day5\100EOS5D\IMG_2196.CR2
A H:\Day5\100EOS5D\IMG_2197.CR2
A H:\Day5\100EOS5D\IMG_2198.CR2
A H:\Day5\100EOS5D\IMG_2199.CR2
A H:\Day5\100EOS5D\IMG_2200.CR2
A H:\Day5\100EOS5D\IMG_2201.CR2
A H:\Day5\100EOS5D\IMG_2202.CR2
A H:\Day5\100EOS5D\IMG_2203.CR2
A H:\Day5\100EOS5D\IMG_2204.CR2
A H:\Day5\100EOS5D\IMG_2205.CR2
A H:\Day5\100EOS5D\IMG_2206.CR2
A H:\Day5\100EOS5D\IMG_2207.CR2
A H:\Day5\100EOS5D\IMG_2208.CR2
A H:\Day5\100EOS5D\IMG_2209.CR2
A H:\Day5\100EOS5D\IMG_2210.CR2
A H:\Day5\100EOS5D\IMG_2211.CR2
A H:\Day5\100EOS5D\IMG_2212.CR2
A H:\Day5\100EOS5D\IMG_2215.CR2
A H:\Day5\100EOS5D\IMG_2216.CR2
A H:\Day5\100EOS5D\IMG_2217.CR2
A H:\Day5\100EOS5D\IMG_2218.CR2
A H:\Day5\100EOS5D\IMG_2219.CR2
A H:\Day5\100EOS5D\IMG_2220.CR2
A H:\Day5\100EOS5D\IMG_2221.CR2
A H:\Day5\100EOS5D\IMG_2222.CR2
A H:\Day5\100EOS5D\IMG_2223.CR2
A H:\Day5\100EOS5D\IMG_2224.CR2
A H:\Day5\100EOS5D\IMG_2225.CR2
A H:\Day5\100EOS5D\IMG_2226.CR2
A H:\Day5\100EOS5D\IMG_2227.CR2
A H:\Day5\100EOS5D\IMG_2228.CR2
A H:\Day5\100EOS5D\IMG_2229.CR2
A H:\Day5\100EOS5D\IMG_2230.CR2
A H:\Day5\100EOS5D\IMG_2231.CR2
A H:\Day5\100EOS5D\IMG_2232.CR2
A H:\Day5\100EOS5D\IMG_2233.CR2
A H:\Day5\100EOS5D\IMG_2234.CR2
A H:\Day5\100EOS5D\IMG_2235.CR2
A H:\Day5\100EOS5D\IMG_2236.CR2
A H:\Day5\100EOS5D\IMG_2237.CR2
A H:\Day5\100EOS5D\IMG_2238.CR2
A H:\Day5\100EOS5D\IMG_2239.CR2
A H:\Day5\100EOS5D\IMG_2240.CR2
A H:\Day5\100EOS5D\IMG_2241.CR2
A H:\Day5\100EOS5D\IMG_2242.CR2
A H:\Day5\100EOS5D\IMG_2243.CR2
A H:\Day5\100EOS5D\IMG_2244.CR2
A H:\Day5\100EOS5D\IMG_2245.CR2
A H:\Day5\100EOS5D\IMG_2246.CR2
A H:\Day5\100EOS5D\IMG_2247.CR2
A H:\Day5\100EOS5D\IMG_2248.CR2
A H:\Day5\100EOS5D\IMG_2249.CR2
A H:\Day5\100EOS5D\IMG_2250.CR2
A H:\Day5\100EOS5D\IMG_2251.CR2
A H:\Day5\100EOS5D\IMG_2252.CR2
A H:\Day5\100EOS5D\IMG_2253.CR2
A H:\Day5\100EOS5D\IMG_2254.CR2
A H:\Day5\100EOS5D\IMG_2255.CR2
A H:\Day5\100EOS5D\IMG_2256.CR2
A H:\Day5\100EOS5D\IMG_2257.CR2
A H:\Day5\100EOS5D\IMG_2258.CR2
A H:\Day5\100EOS5D\IMG_2259.CR2
A H:\Day5\100EOS5D\IMG_2260.CR2
A H:\Day5\100EOS5D\IMG_2261.CR2
A H:\Day5\100EOS5D\IMG_2262.CR2
A H:\Day5\100EOS5D\IMG_2263.CR2
A H:\Day5\100EOS5D\IMG_2264.CR2
A H:\Day5\100EOS5D\IMG_2265.CR2
A H:\Day5\100EOS5D\IMG_2266.CR2
A H:\Day5\100EOS5D\IMG_2267.CR2
A H:\Day5\100EOS5D\IMG_2268.CR2
A H:\Day5\100EOS5D\IMG_2269.CR2
A H:\Day5\100EOS5D\IMG_2279.CR2
A H:\Day5\100EOS5D\IMG_2280.CR2
A H:\Day5\100EOS5D\IMG_2281.CR2
A H:\Day5\100EOS5D\IMG_2290.CR2
A H:\Day5\100EOS5D\IMG_2291.CR2
A H:\Day5\100EOS5D\IMG_2292.CR2
A H:\Day5\100EOS5D\IMG_2293.CR2
A H:\Day5\100EOS5D\IMG_2294.CR2
A H:\Day5\100EOS5D\IMG_2295.CR2
A H:\Day5\100EOS5D\IMG_2296.CR2
A H:\Day5\100EOS5D\IMG_2297.CR2
A H:\Day5\100EOS5D\IMG_2298.CR2
A H:\Day5\100EOS5D\IMG_2299.CR2
A H:\Day5\100EOS5D\IMG_2300.CR2
A H:\Day5\100EOS5D\IMG_2301.CR2
A H:\Day5\100EOS5D\IMG_2302.CR2
A H:\Day5\100EOS5D\IMG_2303.CR2
A H:\Day5\100EOS5D\IMG_2304.CR2
A H:\Day5\100EOS5D\IMG_2305.CR2
A H:\Day5\100EOS5D\IMG_2306.CR2
A H:\Day5\100EOS5D\IMG_2307.CR2
A H:\Day5\100EOS5D\IMG_2308.CR2
A H:\Day5\100EOS5D\IMG_2309.CR2
A H:\Day5\100EOS5D\IMG_2310.CR2
A H:\Day5\100EOS5D\IMG_2311.CR2
A H:\Day5\100EOS5D\IMG_2312.CR2
A H:\Day5\100EOS5D\IMG_2313.CR2
A H:\Day5\100EOS5D\IMG_2314.CR2
A H:\Day5\100EOS5D\IMG_2315.CR2
A H:\Day5\100EOS5D\IMG_2316.CR2
A H:\Day5\100EOS5D\IMG_2317.CR2
A H:\Day5\100EOS5D\IMG_2318.CR2
A H:\Day5\100EOS5D\IMG_2319.CR2
A H:\Day5\100EOS5D\IMG_2320.CR2
A H:\Day5\100EOS5D\IMG_2321.CR2
A H:\Day5\100EOS5D\IMG_2322.CR2
A H:\Day5\100EOS5D\IMG_2323.CR2
A H:\Day5\100EOS5D\IMG_2324.CR2
A H:\Day5\100EOS5D\IMG_2325.CR2
A H:\Day5\100EOS5D\IMG_2326.CR2
A H:\Day5\100EOS5D\IMG_2327.CR2
A H:\Day5\100EOS5D\IMG_2328.CR2
A H:\Day5\100EOS5D\IMG_2329.CR2
A H:\Day5\100EOS5D\IMG_2330.CR2
A H:\Day5\100EOS5D\IMG_2331.CR2
A H:\Day5\100EOS5D\IMG_2332.CR2
A H:\Day5\100EOS5D\IMG_2333.CR2
A H:\Day5\100EOS5D\IMG_2334.CR2
A H:\Day5\100EOS5D\IMG_2335.CR2
A H:\Day5\100EOS5D\IMG_2336.CR2
A H:\Day5\100EOS5D\IMG_2337.CR2
A H:\Day5\100EOS5D\IMG_2338.CR2
A H:\Day5\100EOS5D\IMG_2339.CR2
A H:\Day5\100EOS5D\IMG_2340.CR2
A H:\Day5\100EOS5D\IMG_2341.CR2
A H:\Day5\100EOS5D\IMG_2342.CR2
A H:\Day5\100EOS5D\IMG_2343.CR2
A H:\Day5\100EOS5D\IMG_2344.CR2
A H:\Day5\100EOS5D\IMG_2345.CR2
A H:\Day5\100EOS5D\IMG_2346.CR2
A H:\Day5\100EOS5D\IMG_2347.CR2
A H:\Day5\100EOS5D\IMG_2348.CR2
A H:\Day5\100EOS5D\IMG_2349.CR2
A H:\Day5\100EOS5D\IMG_2350.CR2
A H:\Day5\100EOS5D\IMG_2351.CR2
A H:\Day5\100EOS5D\IMG_2352.CR2
A H:\Day5\100EOS5D\IMG_2353.CR2
A H:\Day5\100EOS5D\IMG_2354.CR2
A H:\Day5\100EOS5D\IMG_2355.CR2
A H:\Day5\100EOS5D\IMG_2356.CR2
A H:\Day5\100EOS5D\IMG_2357.CR2
A H:\Day5\100EOS5D\IMG_2358.CR2
A H:\Day5\100EOS5D\IMG_2359.CR2
A H:\Day5\100EOS5D\IMG_2360.CR2
A H:\Day5\100EOS5D\IMG_2361.CR2
A H:\Day5\100EOS5D\IMG_2362.CR2
A H:\Day5\100EOS5D\IMG_2363.CR2
A H:\Day5\100EOS5D\IMG_2364.CR2
A H:\Day5\100EOS5D\IMG_2365.CR2
A H:\Day5\100EOS5D\IMG_2366.CR2
A H:\Day5\100EOS5D\IMG_2367.CR2
A H:\Day5\100EOS5D\IMG_2368.CR2
A H:\Day5\100EOS5D\IMG_2369.CR2
A H:\Day5\100EOS5D\IMG_2375.CR2
A H:\Day5\100EOS5D\IMG_2376.CR2
A H:\Day5\100EOS5D\IMG_2377.CR2
A H:\Day5\100EOS5D\IMG_2378.CR2
A H:\Day5\100EOS5D\IMG_2379.CR2
A H:\Day5\100EOS5D\IMG_2380.CR2
A H:\Day5\100EOS5D\IMG_2381.CR2
A H:\Day5\100EOS5D\IMG_2382.CR2
A H:\Day5\100EOS5D\IMG_2383.CR2
A H:\Day5\100EOS5D\IMG_2384.CR2
A H:\Day5\100EOS5D\IMG_2385.CR2
A H:\Day5\100EOS5D\IMG_2386.CR2
A H:\Day5\100EOS5D\IMG_2387.CR2
A H:\Day5\100EOS5D\IMG_2388.CR2
A H:\Day5\100EOS5D\IMG_2389.CR2
A H:\Day5\100EOS5D\IMG_2390.CR2
A H:\Day5\100EOS5D\IMG_2391.CR2
A H:\Day5\100EOS5D\IMG_2392.CR2
A H:\Day5\100EOS5D\IMG_2393.CR2
A H:\Day5\100EOS5D\IMG_2394.CR2
A H:\Day5\100EOS5D\IMG_2395.CR2
A H:\Day5\100EOS5D\IMG_2396.CR2
A H:\Day5\100EOS5D\IMG_2397.CR2
A H:\Day5\100EOS5D\IMG_2398.CR2
A H:\Day5\100EOS5D\IMG_2399.CR2
A H:\Day5\100EOS5D\IMG_2400.CR2
A H:\Day5\100EOS5D\IMG_2401.CR2
A H:\Day5\100EOS5D\IMG_2402.CR2
A H:\Day5\100EOS5D\IMG_2403.CR2
A H:\Day5\100EOS5D\IMG_2404.CR2
A H:\Day5\100EOS5D\IMG_2405.CR2
A H:\Day5\100EOS5D\IMG_2406.CR2
A H:\Day5\100EOS5D\IMG_2407.CR2
A H:\Day5\100EOS5D\IMG_2408.CR2
A H:\Day5\100EOS5D\IMG_2409.CR2
A H:\Day5\100EOS5D\IMG_2410.CR2
A H:\Day5\100EOS5D\IMG_2411.CR2
A H:\Day5\100EOS5D\IMG_2412.CR2
A H:\Day5\100EOS5D\IMG_2413.CR2
A H:\Day5\100EOS5D\IMG_2414.CR2
A H:\Day5\100EOS5D\IMG_2415.CR2
A H:\Day5\100EOS5D\IMG_2416.CR2
A H:\Day5\100EOS5D\IMG_2417.CR2
A H:\Day5\100EOS5D\IMG_2418.CR2
A H:\Day5\100EOS5D\IMG_2419.CR2
A H:\Day5\100EOS5D\IMG_2420.CR2
A H:\Day5\100EOS5D\IMG_2421.CR2
A H:\Day5\100EOS5D\IMG_2422.CR2
A H:\Day5\100EOS5D\IMG_2423.CR2
A H:\Day5\100EOS5D\IMG_2424.CR2
A H:\Day5\100EOS5D\IMG_2425.CR2
A H:\Day5\100EOS5D\IMG_2426.CR2
A H:\Day5\100EOS5D\IMG_2427.CR2
A H:\Day5\100EOS5D\IMG_2428.CR2
A H:\Day5\100EOS5D\IMG_2433.CR2
A H:\Day5\100EOS5D\IMG_2434.CR2
A H:\Day5\100EOS5D\IMG_2435.CR2
A H:\Day5\100EOS5D\IMG_2436.CR2
A H:\Day5\100EOS5D\IMG_2437.CR2
A H:\Day5\100EOS5D\IMG_2438.CR2
A H:\Day5\100EOS5D\IMG_2439.CR2
A H:\Day5\100EOS5D\IMG_2440.CR2
A H:\Day5\100EOS5D\IMG_2441.CR2
A H:\Day5\100EOS5D\IMG_2442.CR2
A H:\Day5\100EOS5D\IMG_2443.CR2
A H:\Day5\100EOS5D\IMG_2444.CR2
A H:\Day5\100EOS5D\IMG_2445.CR2
A H:\Day5\100EOS5D\IMG_2446.CR2
A H:\Day5\100EOS5D\IMG_2447.CR2
A H:\Day5\100EOS5D\IMG_2448.CR2
A H:\Day5\100EOS5D\IMG_2449.CR2
A H:\Day5\100EOS5D\IMG_2451.CR2
A H:\Day5\100EOS5D\IMG_2455.CR2
A H:\Day5\100EOS5D\IMG_2456.CR2
A H:\Day5\100EOS5D\IMG_2457.CR2
A H:\Day5\100EOS5D\IMG_2458.CR2
A H:\Day5\100EOS5D\IMG_2459.CR2
A H:\Day5\100EOS5D\IMG_2460.CR2
A H:\Day5\100EOS5D\IMG_2461.CR2
A H:\Day5\100EOS5D\IMG_2462.CR2
A H:\Day5\100EOS5D\IMG_2463.CR2
A H:\Day5\100EOS5D\IMG_2464.CR2
A H:\Day5\100EOS5D\IMG_2465.CR2
A H:\Day5\100EOS5D\IMG_2466.CR2
A H:\Day5\100EOS5D\IMG_2467.CR2
A H:\Day5\100EOS5D\IMG_2468.CR2
A H:\Day5\100EOS5D\IMG_2469.CR2
A H:\Day5\100EOS5D\IMG_2470.CR2
A H:\Day5\100EOS5D\IMG_2471.CR2
A H:\Day5\100EOS5D\IMG_2472.CR2
A H:\Day5\100EOS5D\IMG_2473.CR2
A H:\Day5\100EOS5D\IMG_2474.CR2
A H:\Day5\100EOS5D\IMG_2475.CR2
A H:\Day5\100EOS5D\IMG_2476.CR2
A H:\Day5\100EOS5D\IMG_2477.CR2
A H:\Day5\100EOS5D\IMG_2478.CR2
A H:\Day5\100EOS5D\IMG_2479.CR2
A H:\Day5\100EOS5D\IMG_2480.CR2
A H:\Day5\100EOS5D\IMG_2481.CR2
A H:\Day5\100EOS5D\IMG_2482.CR2
A H:\Day5\100EOS5D\IMG_2483.CR2
A H:\Day5\100EOS5D\IMG_2484.CR2
A H:\Day5\100EOS5D\IMG_2485.CR2
A H:\Day5\100EOS5D\IMG_2486.CR2
A H:\Day5\100EOS5D\IMG_2487.CR2
A H:\Day5\100EOS5D\IMG_2488.CR2
A H:\Day5\100EOS5D\IMG_2489.CR2
A H:\Day5\100EOS5D\IMG_2490.CR2
A H:\Day5\100EOS5D\IMG_2491.CR2
A H:\Day5\100EOS5D\IMG_2492.CR2
A H:\Day5\100EOS5D\IMG_2493.CR2
A H:\Day5\100EOS5D\IMG_2494.CR2
A H:\Day5\100EOS5D\IMG_2495.CR2
A H:\Day5\100EOS5D\IMG_2496.CR2
A H:\Day5\100EOS5D\IMG_2497.CR2
A H:\Day5\100EOS5D\IMG_2498.CR2
A H:\Day5\100EOS5D\IMG_2499.CR2
A H:\Day5\100EOS5D\IMG_2500.CR2
A H:\Day5\100EOS5D\IMG_2501.CR2
A H:\Day5\100EOS5D\IMG_2502.CR2
A H:\Day5\100EOS5D\IMG_2503.CR2
A H:\Day5\100EOS5D\IMG_2504.CR2
A H:\Day5\100EOS5D\IMG_2505.CR2
A H:\Day5\100EOS5D\IMG_2506.CR2
A H:\Day5\100EOS5D\IMG_2507.CR2
A H:\Day5\100EOS5D\IMG_2508.CR2
A H:\Day5\100EOS5D\IMG_2509.CR2
A H:\Day5\100EOS5D\IMG_2510.CR2
A H:\Day5\100EOS5D\IMG_2511.CR2
A H:\Day5\100EOS5D\IMG_2512.CR2
A H:\Day5\100EOS5D\IMG_2513.CR2
A H:\Day5\100EOS5D\IMG_2514.CR2
A H:\Day5\100EOS5D\IMG_2515.CR2
A H:\Day5\100EOS5D\IMG_2516.CR2
A H:\Day5\100EOS5D\IMG_2517.CR2
A H:\Day5\100EOS5D\IMG_2518.CR2
A H:\Day5\100EOS5D\IMG_2519.CR2
A H:\Day5\100EOS5D\IMG_2520.CR2
A H:\Day5\100EOS5D\IMG_2521.CR2
A H:\Day5\100EOS5D\IMG_2522.CR2
A H:\Day5\100EOS5D\IMG_2523.CR2
A H:\Day5\100EOS5D\IMG_2524.CR2
A H:\Day5\100EOS5D\IMG_2525.CR2
A H:\Day5\100EOS5D\IMG_2526.CR2
A H:\Day5\100EOS5D\IMG_2527.CR2
A H:\Day5\100EOS5D\IMG_2528.CR2
A H:\Day5\100EOS5D\IMG_2529.CR2
A H:\Day5\100EOS5D\IMG_2530.CR2
A H:\Day5\100EOS5D\IMG_2531.CR2
A H:\Day5\100EOS5D\IMG_2532.CR2
A H:\Day5\100EOS5D\IMG_2533.CR2
A H:\Day5\100EOS5D\IMG_2534.CR2
A H:\Day5\100EOS5D\IMG_2535.CR2
A H:\Day5\100EOS5D\IMG_2536.CR2
A H:\Day5\100EOS5D\IMG_2537.CR2
A H:\Day5\100EOS5D\IMG_2538.CR2
A H:\Day5\100EOS5D\IMG_2539.CR2
A H:\Day5\100EOS5D\IMG_2540.CR2
A H:\Day5\100EOS5D\IMG_2541.CR2
A H:\Day5\100EOS5D\IMG_2542.CR2
A H:\Day5\100EOS5D\IMG_2543.CR2
A H:\Day5\100EOS5D\IMG_2544.CR2
A H:\Day5\100EOS5D\IMG_2545.CR2
A H:\Day5\100EOS5D\IMG_2546.CR2
A H:\Day5\100EOS5D\IMG_2547.CR2
A H:\Day5\100EOS5D\IMG_2548.CR2
A H:\Day5\100EOS5D\IMG_2549.CR2
A H:\Day5\100EOS5D\IMG_2550.CR2
A H:\Day5\100EOS5D\IMG_2551.CR2
A H:\Day5\100EOS5D\IMG_2552.CR2
A H:\Day5\100EOS5D\IMG_2553.CR2
A H:\Day5\100EOS5D\IMG_2554.CR2
A H:\Day5\100EOS5D\IMG_2555.CR2
A H:\Day5\100EOS5D\IMG_2556.CR2
A H:\Day5\100EOS5D\IMG_2557.CR2
A H:\Day5\100EOS5D\IMG_2558.CR2
A H:\Day5\100EOS5D\IMG_2597.CR2
A H:\Day5\100EOS5D\IMG_2598.CR2
A H:\Day5\100EOS5D\IMG_2599.CR2
A H:\Day5\100EOS5D\IMG_2600.CR2
A H:\Day5\100EOS5D\IMG_2601.CR2
A H:\Day5\100EOS5D\IMG_2602.CR2
A H:\Day5\100EOS5D\IMG_2603.CR2
A H:\Day5\100EOS5D\IMG_2604.CR2
A H:\Day5\100EOS5D\IMG_2605.CR2
A H:\Day5\100EOS5D\IMG_2606.CR2
A H:\Day5\100EOS5D\IMG_2607.CR2
A H:\Day5\100EOS5D\IMG_2608.CR2
A H:\Day5\100EOS5D\IMG_2609.CR2
A H:\Day5\100EOS5D\IMG_2610.CR2
A H:\Day5\100EOS5D\IMG_2611.CR2
A H:\Day5\100EOS5D\IMG_2612.CR2
A H:\Day5\100EOS5D\IMG_2613.CR2
A H:\Day5\100EOS5D\IMG_2614.CR2
A H:\Day5\100EOS5D\IMG_2615.CR2
A H:\Day5\100EOS5D\IMG_2616.CR2
A H:\Day5\100EOS5D\IMG_2617.CR2
A H:\Day5\100EOS5D\IMG_2618.CR2
A H:\Day5\100EOS5D\IMG_2619.CR2
A H:\Day5\100EOS5D\IMG_2620.CR2
A H:\Day5\100EOS5D\IMG_2621.CR2
A H:\Day5\100EOS5D\IMG_2622.CR2
A H:\Day5\100EOS5D\IMG_2623.CR2
A H:\Day5\100EOS5D\IMG_2624.CR2
A H:\Day5\100EOS5D\IMG_2625.CR2
A H:\Day5\100EOS5D\IMG_2626.CR2
A H:\Day5\100EOS5D\IMG_2627.CR2
A H:\Day5\100EOS5D\IMG_2628.CR2
A H:\Day5\100EOS5D\IMG_2629.CR2
A H:\Day5\100EOS5D\IMG_2630.CR2
A H:\Day5\100EOS5D\IMG_2631.CR2
A H:\Day5\100EOS5D\IMG_2632.CR2
A H:\Day5\100EOS5D\IMG_2633.CR2
A H:\Day5\100EOS5D\IMG_2634.CR2
A H:\Day5\100EOS5D\IMG_2635.CR2
A H:\Day5\100EOS5D\IMG_2636.CR2
A H:\Day5\100EOS5D\IMG_2637.CR2
A H:\Day5\100EOS5D\IMG_2638.CR2
A H:\Day5\100EOS5D\IMG_2639.CR2
A H:\Day5\100EOS5D\IMG_2640.CR2
A H:\Day5\100EOS5D\IMG_2641.CR2
A H:\Day5\100EOS5D\IMG_2642.CR2
A H:\Day5\100EOS5D\IMG_2643.CR2
A H:\Day5\100EOS5D\IMG_2644.CR2
A H:\Day5\100EOS5D\IMG_2645.CR2
A H:\Day5\100EOS5D\IMG_2646.CR2
A H:\Day5\100EOS5D\IMG_2647.CR2
A H:\Day5\100EOS5D\IMG_2648.CR2
A H:\Day5\100EOS5D\IMG_2649.CR2
A H:\Day5\100EOS5D\IMG_2650.CR2
A H:\Day5\100EOS5D\IMG_2651.CR2
A H:\Day5\100EOS5D\IMG_2652.CR2
A H:\Day5\100EOS5D\IMG_2653.CR2
A H:\Day5\100EOS5D\IMG_2654.CR2
A H:\Day5\100EOS5D\IMG_2655.CR2
A H:\Day5\100EOS5D\IMG_2656.CR2
A H:\Day5\100EOS5D\IMG_2657.CR2
A H:\Day5\100EOS5D\IMG_2658.CR2
A H:\Day5\100EOS5D\IMG_2659.CR2
A H:\Day5\100EOS5D\IMG_2660.CR2
A H:\Day5\100EOS5D\IMG_2661.CR2
A H:\Day5\100EOS5D\IMG_2662.CR2
A H:\Day5\100EOS5D\MVI_2014.MOV
A H:\Day5\100EOS5D\MVI_2014.THM
A H:\Day5\100EOS5D\MVI_2015.MOV
A H:\Day5\100EOS5D\MVI_2015.THM
A H:\Day5\100EOS5D\MVI_2016.MOV
A H:\Day5\100EOS5D\MVI_2016.THM
A H:\Day5\100EOS5D\MVI_2022.MOV
A H:\Day5\100EOS5D\MVI_2022.THM
A H:\Day5\100EOS5D\MVI_2023.MOV
A H:\Day5\100EOS5D\MVI_2023.THM
A H:\Day5\100EOS5D\MVI_2045.MOV
A H:\Day5\100EOS5D\MVI_2045.THM
A H:\Day5\100EOS5D\MVI_2046.MOV
A H:\Day5\100EOS5D\MVI_2046.THM
A H:\Day5\100EOS5D\MVI_2051.MOV
A H:\Day5\100EOS5D\MVI_2051.THM
A H:\Day5\100EOS5D\MVI_2052.MOV
A H:\Day5\100EOS5D\MVI_2052.THM
A H:\Day5\100EOS5D\MVI_2053.MOV
A H:\Day5\100EOS5D\MVI_2053.THM
A H:\Day5\100EOS5D\MVI_2054.MOV
A H:\Day5\100EOS5D\MVI_2054.THM
A H:\Day5\100EOS5D\MVI_2055.MOV
A H:\Day5\100EOS5D\MVI_2055.THM
A H:\Day5\100EOS5D\MVI_2056.MOV
A H:\Day5\100EOS5D\MVI_2056.THM
A H:\Day5\100EOS5D\MVI_2057.MOV
A H:\Day5\100EOS5D\MVI_2057.THM
A H:\Day5\100EOS5D\MVI_2058.MOV
A H:\Day5\100EOS5D\MVI_2058.THM
A H:\Day5\100EOS5D\MVI_2059.MOV
A H:\Day5\100EOS5D\MVI_2059.THM
A H:\Day5\100EOS5D\MVI_2060.MOV
A H:\Day5\100EOS5D\MVI_2060.THM
A H:\Day5\100EOS5D\MVI_2061.MOV
A H:\Day5\100EOS5D\MVI_2061.THM
A H:\Day5\100EOS5D\MVI_2069.MOV
A H:\Day5\100EOS5D\MVI_2069.THM
A H:\Day5\100EOS5D\MVI_2070.MOV
A H:\Day5\100EOS5D\MVI_2070.THM
A H:\Day5\100EOS5D\MVI_2213.MOV
A H:\Day5\100EOS5D\MVI_2213.THM
A H:\Day5\100EOS5D\MVI_2214.MOV
A H:\Day5\100EOS5D\MVI_2214.THM
A H:\Day5\100EOS5D\MVI_2270.MOV
A H:\Day5\100EOS5D\MVI_2270.THM
A H:\Day5\100EOS5D\MVI_2271.MOV
A H:\Day5\100EOS5D\MVI_2271.THM
A H:\Day5\100EOS5D\MVI_2272.MOV
A H:\Day5\100EOS5D\MVI_2272.THM
A H:\Day5\100EOS5D\MVI_2273.MOV
A H:\Day5\100EOS5D\MVI_2273.THM
A H:\Day5\100EOS5D\MVI_2274.MOV
A H:\Day5\100EOS5D\MVI_2274.THM
A H:\Day5\100EOS5D\MVI_2275.MOV
A H:\Day5\100EOS5D\MVI_2275.THM
A H:\Day5\100EOS5D\MVI_2276.MOV
A H:\Day5\100EOS5D\MVI_2276.THM
A H:\Day5\100EOS5D\MVI_2277.MOV
A H:\Day5\100EOS5D\MVI_2277.THM
A H:\Day5\100EOS5D\MVI_2278.MOV
A H:\Day5\100EOS5D\MVI_2278.THM
A H:\Day5\100EOS5D\MVI_2282.MOV
A H:\Day5\100EOS5D\MVI_2282.THM
A H:\Day5\100EOS5D\MVI_2283.MOV
A H:\Day5\100EOS5D\MVI_2283.THM
A H:\Day5\100EOS5D\MVI_2284.MOV
A H:\Day5\100EOS5D\MVI_2284.THM
A H:\Day5\100EOS5D\MVI_2285.MOV
A H:\Day5\100EOS5D\MVI_2285.THM
A H:\Day5\100EOS5D\MVI_2286.MOV
A H:\Day5\100EOS5D\MVI_2286.THM
A H:\Day5\100EOS5D\MVI_2287.MOV
A H:\Day5\100EOS5D\MVI_2287.THM
A H:\Day5\100EOS5D\MVI_2288.MOV
A H:\Day5\100EOS5D\MVI_2288.THM
A H:\Day5\100EOS5D\MVI_2289.MOV
A H:\Day5\100EOS5D\MVI_2289.THM
A H:\Day5\100EOS5D\MVI_2370.MOV
A H:\Day5\100EOS5D\MVI_2370.THM
A H:\Day5\100EOS5D\MVI_2371.MOV
A H:\Day5\100EOS5D\MVI_2371.THM
A H:\Day5\100EOS5D\MVI_2372.MOV
A H:\Day5\100EOS5D\MVI_2372.THM
A H:\Day5\100EOS5D\MVI_2373.MOV
A H:\Day5\100EOS5D\MVI_2373.THM
A H:\Day5\100EOS5D\MVI_2374.MOV
A H:\Day5\100EOS5D\MVI_2374.THM
A H:\Day5\100EOS5D\MVI_2429.MOV
A H:\Day5\100EOS5D\MVI_2429.THM
A H:\Day5\100EOS5D\MVI_2430.MOV
A H:\Day5\100EOS5D\MVI_2430.THM
A H:\Day5\100EOS5D\MVI_2431.MOV
A H:\Day5\100EOS5D\MVI_2431.THM
A H:\Day5\100EOS5D\MVI_2432.MOV
A H:\Day5\100EOS5D\MVI_2432.THM
A H:\Day5\100EOS5D\MVI_2450.MOV
A H:\Day5\100EOS5D\MVI_2450.THM
A H:\Day5\100EOS5D\MVI_2452.MOV
A H:\Day5\100EOS5D\MVI_2452.THM
A H:\Day5\100EOS5D\MVI_2453.MOV
A H:\Day5\100EOS5D\MVI_2453.THM
A H:\Day5\100EOS5D\MVI_2454.MOV
A H:\Day5\100EOS5D\MVI_2454.THM
A H:\Day5\100EOS5D\MVI_2559.MOV
A H:\Day5\100EOS5D\MVI_2559.THM
A H:\Day5\100EOS5D\MVI_2560.MOV
A H:\Day5\100EOS5D\MVI_2560.THM
A H:\Day5\100EOS5D\MVI_2561.MOV
A H:\Day5\100EOS5D\MVI_2561.THM
A H:\Day5\100EOS5D\MVI_2562.MOV
A H:\Day5\100EOS5D\MVI_2562.THM
A H:\Day5\100EOS5D\MVI_2563.MOV
A H:\Day5\100EOS5D\MVI_2563.THM
A H:\Day5\100EOS5D\MVI_2564.MOV
A H:\Day5\100EOS5D\MVI_2564.THM
A H:\Day5\100EOS5D\MVI_2565.MOV
A H:\Day5\100EOS5D\MVI_2565.THM
A H:\Day5\100EOS5D\MVI_2566.MOV
A H:\Day5\100EOS5D\MVI_2566.THM
A H:\Day5\100EOS5D\MVI_2567.MOV
A H:\Day5\100EOS5D\MVI_2567.THM
A H:\Day5\100EOS5D\MVI_2568.MOV
A H:\Day5\100EOS5D\MVI_2568.THM
A H:\Day5\100EOS5D\MVI_2569.MOV
A H:\Day5\100EOS5D\MVI_2569.THM
A H:\Day5\100EOS5D\MVI_2570.MOV
A H:\Day5\100EOS5D\MVI_2570.THM
A H:\Day5\100EOS5D\MVI_2571.MOV
A H:\Day5\100EOS5D\MVI_2571.THM
A H:\Day5\100EOS5D\MVI_2572.MOV
A H:\Day5\100EOS5D\MVI_2572.THM
A H:\Day5\100EOS5D\MVI_2573.MOV
A H:\Day5\100EOS5D\MVI_2573.THM
A H:\Day5\100EOS5D\MVI_2574.MOV
A H:\Day5\100EOS5D\MVI_2574.THM
A H:\Day5\100EOS5D\MVI_2575.MOV
A H:\Day5\100EOS5D\MVI_2575.THM
A H:\Day5\100EOS5D\MVI_2576.MOV
A H:\Day5\100EOS5D\MVI_2576.THM
A H:\Day5\100EOS5D\MVI_2577.MOV
A H:\Day5\100EOS5D\MVI_2577.THM
A H:\Day5\100EOS5D\MVI_2578.MOV
A H:\Day5\100EOS5D\MVI_2578.THM
A H:\Day5\100EOS5D\MVI_2579.MOV
A H:\Day5\100EOS5D\MVI_2579.THM
A H:\Day5\100EOS5D\MVI_2580.MOV
A H:\Day5\100EOS5D\MVI_2580.THM
A H:\Day5\100EOS5D\MVI_2581.MOV
A H:\Day5\100EOS5D\MVI_2581.THM
A H:\Day5\100EOS5D\MVI_2582.MOV
A H:\Day5\100EOS5D\MVI_2582.THM
A H:\Day5\100EOS5D\MVI_2583.MOV
A H:\Day5\100EOS5D\MVI_2583.THM
A H:\Day5\100EOS5D\MVI_2584.MOV
A H:\Day5\100EOS5D\MVI_2584.THM
A H:\Day5\100EOS5D\MVI_2585.MOV
A H:\Day5\100EOS5D\MVI_2585.THM
A H:\Day5\100EOS5D\MVI_2586.MOV
A H:\Day5\100EOS5D\MVI_2586.THM
A H:\Day5\100EOS5D\MVI_2587.MOV
A H:\Day5\100EOS5D\MVI_2587.THM
A H:\Day5\100EOS5D\MVI_2588.MOV
A H:\Day5\100EOS5D\MVI_2588.THM
A H:\Day5\100EOS5D\MVI_2589.MOV
A H:\Day5\100EOS5D\MVI_2589.THM
A H:\Day5\100EOS5D\MVI_2590.MOV
A H:\Day5\100EOS5D\MVI_2590.THM
A H:\Day5\100EOS5D\MVI_2591.MOV
A H:\Day5\100EOS5D\MVI_2591.THM
A H:\Day5\100EOS5D\MVI_2592.MOV
A H:\Day5\100EOS5D\MVI_2592.THM
A H:\Day5\100EOS5D\MVI_2593.MOV
A H:\Day5\100EOS5D\MVI_2593.THM
A H:\Day5\100EOS5D\MVI_2594.MOV
A H:\Day5\100EOS5D\MVI_2594.THM
A H:\Day5\100EOS5D\MVI_2595.MOV
A H:\Day5\100EOS5D\MVI_2595.THM
A H:\Day5\100EOS5D\MVI_2596.MOV
A H:\Day5\100EOS5D\MVI_2596.THM
A H:\Day5\101GOPRO\G0010003.JPG
A H:\Day5\101GOPRO\G0010004.JPG
A H:\Day5\101GOPRO\G0010005.JPG
A H:\Day5\101GOPRO\G0010006.JPG
A H:\Day5\101GOPRO\G0020007.JPG
A H:\Day5\101GOPRO\G0020008.JPG
A H:\Day5\101GOPRO\G0020009.JPG
A H:\Day5\101GOPRO\G0020010.JPG
A H:\Day5\101GOPRO\G0020011.JPG
A H:\Day5\101GOPRO\G0020012.JPG
A H:\Day5\101GOPRO\G0020013.JPG
A H:\Day5\101GOPRO\G0020014.JPG
A H:\Day5\101GOPRO\G0020015.JPG
A H:\Day5\101GOPRO\G0020016.JPG
A H:\Day5\101GOPRO\G0020017.JPG
A H:\Day5\101GOPRO\G0020018.JPG
A H:\Day5\101GOPRO\G0020019.JPG
A H:\Day5\101GOPRO\G0020020.JPG
A H:\Day5\101GOPRO\G0020021.JPG
A H:\Day5\101GOPRO\G0020022.JPG
A H:\Day5\101GOPRO\G0020023.JPG
A H:\Day5\101GOPRO\G0020024.JPG
A H:\Day5\101GOPRO\G0020025.JPG
A H:\Day5\101GOPRO\G0020026.JPG
A H:\Day5\101GOPRO\G0020027.JPG
A H:\Day5\101GOPRO\G0020028.JPG
A H:\Day5\101GOPRO\G0020029.JPG
A H:\Day5\101GOPRO\G0020030.JPG
A H:\Day5\101GOPRO\G0020031.JPG
A H:\Day5\101GOPRO\G0020032.JPG
A H:\Day5\101GOPRO\G0020033.JPG
A H:\Day5\101GOPRO\G0020034.JPG
A H:\Day5\101GOPRO\G0020035.JPG
A H:\Day5\101GOPRO\G0020036.JPG
A H:\Day5\101GOPRO\G0020037.JPG
A H:\Day5\101GOPRO\G0020038.JPG
A H:\Day5\101GOPRO\G0020039.JPG
A H:\Day5\101GOPRO\G0020040.JPG
A H:\Day5\101GOPRO\G0020041.JPG
A H:\Day5\101GOPRO\G0020042.JPG
A H:\Day5\101GOPRO\G0020043.JPG
A H:\Day5\101GOPRO\G0020044.JPG
A H:\Day5\101GOPRO\G0020045.JPG
A H:\Day5\101GOPRO\G0020046.JPG
A H:\Day5\101GOPRO\G0020047.JPG
A H:\Day5\101GOPRO\G0020048.JPG
A H:\Day5\101GOPRO\G0020049.JPG
A H:\Day5\101GOPRO\G0020050.JPG
A H:\Day5\101GOPRO\G0020051.JPG
A H:\Day5\101GOPRO\G0020052.JPG
A H:\Day5\101GOPRO\G0020053.JPG
A H:\Day5\101GOPRO\G0020054.JPG
A H:\Day5\101GOPRO\G0020055.JPG
A H:\Day5\101GOPRO\G0020056.JPG
A H:\Day5\101GOPRO\G0020057.JPG
A H:\Day5\101GOPRO\G0020058.JPG
A H:\Day5\101GOPRO\G0020059.JPG
A H:\Day5\101GOPRO\G0020060.JPG
A H:\Day5\101GOPRO\G0020061.JPG
A H:\Day5\101GOPRO\G0020062.JPG
A H:\Day5\101GOPRO\G0020063.JPG
A H:\Day5\101GOPRO\G0020064.JPG
A H:\Day5\101GOPRO\G0020065.JPG
A H:\Day5\101GOPRO\G0020066.JPG
A H:\Day5\101GOPRO\G0020067.JPG
A H:\Day5\101GOPRO\G0020068.JPG
A H:\Day5\101GOPRO\G0020069.JPG
A H:\Day5\101GOPRO\G0020070.JPG
A H:\Day5\101GOPRO\G0020071.JPG
A H:\Day5\101GOPRO\G0020072.JPG
A H:\Day5\101GOPRO\G0020073.JPG
A H:\Day5\101GOPRO\G0020074.JPG
A H:\Day5\101GOPRO\G0020075.JPG
A H:\Day5\101GOPRO\G0020076.JPG
A H:\Day5\101GOPRO\G0020077.JPG
A H:\Day5\101GOPRO\G0020078.JPG
A H:\Day5\101GOPRO\G0020079.JPG
A H:\Day5\101GOPRO\G0020080.JPG
A H:\Day5\101GOPRO\G0020081.JPG
A H:\Day5\101GOPRO\G0020082.JPG
A H:\Day5\101GOPRO\G0020083.JPG
A H:\Day5\101GOPRO\G0020084.JPG
A H:\Day5\101GOPRO\G0020085.JPG
A H:\Day5\101GOPRO\G0020086.JPG
A H:\Day5\101GOPRO\G0020087.JPG
A H:\Day5\101GOPRO\G0020088.JPG
A H:\Day5\101GOPRO\G0020089.JPG
A H:\Day5\101GOPRO\G0020090.JPG
A H:\Day5\101GOPRO\G0020091.JPG
A H:\Day5\101GOPRO\G0020092.JPG
A H:\Day5\101GOPRO\G0020093.JPG
A H:\Day5\101GOPRO\G0020094.JPG
A H:\Day5\101GOPRO\G0020095.JPG
A H:\Day5\101GOPRO\G0020096.JPG
A H:\Day5\101GOPRO\G0020097.JPG
A H:\Day5\101GOPRO\G0020098.JPG
A H:\Day5\101GOPRO\G0020099.JPG
A H:\Day5\101GOPRO\G0020100.JPG
A H:\Day5\101GOPRO\G0020101.JPG
A H:\Day5\101GOPRO\G0020102.JPG
A H:\Day5\101GOPRO\G0020103.JPG
A H:\Day5\101GOPRO\G0020104.JPG
A H:\Day5\101GOPRO\G0020105.JPG
A H:\Day5\101GOPRO\G0020106.JPG
A H:\Day5\101GOPRO\G0020107.JPG
A H:\Day5\101GOPRO\G0020108.JPG
A H:\Day5\101GOPRO\G0020109.JPG
A H:\Day5\101GOPRO\G0020110.JPG
A H:\Day5\101GOPRO\G0020111.JPG
A H:\Day5\101GOPRO\G0020112.JPG
A H:\Day5\101GOPRO\G0020113.JPG
A H:\Day5\101GOPRO\G0020114.JPG
A H:\Day5\101GOPRO\G0020115.JPG
A H:\Day5\101GOPRO\G0020116.JPG
A H:\Day5\101GOPRO\G0020117.JPG
A H:\Day5\101GOPRO\G0020118.JPG
A H:\Day5\101GOPRO\G0020119.JPG
A H:\Day5\101GOPRO\G0020120.JPG
A H:\Day5\101GOPRO\G0020121.JPG
A H:\Day5\101GOPRO\G0020122.JPG
A H:\Day5\101GOPRO\G0020123.JPG
A H:\Day5\101GOPRO\G0020124.JPG
A H:\Day5\101GOPRO\G0020125.JPG
A H:\Day5\101GOPRO\G0020126.JPG
A H:\Day5\101GOPRO\G0020127.JPG
A H:\Day5\101GOPRO\G0020128.JPG
A H:\Day5\101GOPRO\G0020129.JPG
A H:\Day5\101GOPRO\G0020130.JPG
A H:\Day5\101GOPRO\G0020131.JPG
A H:\Day5\101GOPRO\G0020132.JPG
A H:\Day5\101GOPRO\G0020133.JPG
A H:\Day5\101GOPRO\G0020134.JPG
A H:\Day5\101GOPRO\G0020135.JPG
A H:\Day5\101GOPRO\G0020136.JPG
A H:\Day5\101GOPRO\G0020137.JPG
A H:\Day5\101GOPRO\G0020138.JPG
A H:\Day5\101GOPRO\G0020139.JPG
A H:\Day5\101GOPRO\G0020140.JPG
A H:\Day5\101GOPRO\G0020141.JPG
A H:\Day5\101GOPRO\G0020142.JPG
A H:\Day5\101GOPRO\G0020143.JPG
A H:\Day5\101GOPRO\G0020144.JPG
A H:\Day5\101GOPRO\G0020145.JPG
A H:\Day5\101GOPRO\G0020146.JPG
A H:\Day5\101GOPRO\G0020147.JPG
A H:\Day5\101GOPRO\G0020148.JPG
A H:\Day5\101GOPRO\G0020149.JPG
A H:\Day5\101GOPRO\G0020150.JPG
A H:\Day5\101GOPRO\G0020151.JPG
A H:\Day5\101GOPRO\G0020152.JPG
A H:\Day5\101GOPRO\G0020153.JPG
A H:\Day5\101GOPRO\G0020154.JPG
A H:\Day5\101GOPRO\G0020155.JPG
A H:\Day5\101GOPRO\G0020156.JPG
A H:\Day5\101GOPRO\G0020157.JPG
A H:\Day5\101GOPRO\G0020158.JPG
A H:\Day5\101GOPRO\G0020159.JPG
A H:\Day5\101GOPRO\G0020160.JPG
A H:\Day5\101GOPRO\G0020161.JPG
A H:\Day5\101GOPRO\G0020162.JPG
A H:\Day5\101GOPRO\G0020163.JPG
A H:\Day5\101GOPRO\G0020164.JPG
A H:\Day5\101GOPRO\G0020165.JPG
A H:\Day5\101GOPRO\G0020166.JPG
A H:\Day5\101GOPRO\G0020167.JPG
A H:\Day5\101GOPRO\G0020168.JPG
A H:\Day5\101GOPRO\G0020169.JPG
A H:\Day5\101GOPRO\G0020170.JPG
A H:\Day5\101GOPRO\G0020171.JPG
A H:\Day5\101GOPRO\G0020172.JPG
A H:\Day5\101GOPRO\G0020173.JPG
A H:\Day5\101GOPRO\G0020174.JPG
A H:\Day5\101GOPRO\G0020175.JPG
A H:\Day5\101GOPRO\G0020176.JPG
A H:\Day5\101GOPRO\G0020177.JPG
A H:\Day5\101GOPRO\G0020178.JPG
A H:\Day5\101GOPRO\G0020179.JPG
A H:\Day5\101GOPRO\G0020180.JPG
A H:\Day5\101GOPRO\G0020181.JPG
A H:\Day5\101GOPRO\G0020182.JPG
A H:\Day5\101GOPRO\G0020183.JPG
A H:\Day5\101GOPRO\G0020184.JPG
A H:\Day5\101GOPRO\G0020185.JPG
A H:\Day5\101GOPRO\G0020186.JPG
A H:\Day5\101GOPRO\G0020187.JPG
A H:\Day5\101GOPRO\G0020188.JPG
A H:\Day5\101GOPRO\G0020189.JPG
A H:\Day5\101GOPRO\G0020190.JPG
A H:\Day5\101GOPRO\G0020191.JPG
A H:\Day5\101GOPRO\G0020192.JPG
A H:\Day5\101GOPRO\G0020193.JPG
A H:\Day5\101GOPRO\G0020194.JPG
A H:\Day5\101GOPRO\G0020195.JPG
A H:\Day5\101GOPRO\G0020196.JPG
A H:\Day5\101GOPRO\G0020197.JPG
A H:\Day5\101GOPRO\G0020198.JPG
A H:\Day5\101GOPRO\G0020199.JPG
A H:\Day5\101GOPRO\G0020200.JPG
A H:\Day5\101GOPRO\G0020201.JPG
A H:\Day5\101GOPRO\G0020202.JPG
A H:\Day5\101GOPRO\G0020203.JPG
A H:\Day5\101GOPRO\G0020204.JPG
A H:\Day5\101GOPRO\G0020205.JPG
A H:\Day5\101GOPRO\G0020206.JPG
A H:\Day5\101GOPRO\G0020207.JPG
A H:\Day5\101GOPRO\G0020208.JPG
A H:\Day5\101GOPRO\G0020209.JPG
A H:\Day5\101GOPRO\G0020210.JPG
A H:\Day5\101GOPRO\G0020211.JPG
A H:\Day5\101GOPRO\G0020212.JPG
A H:\Day5\101GOPRO\G0020213.JPG
A H:\Day5\101GOPRO\G0020214.JPG
A H:\Day5\101GOPRO\G0020215.JPG
A H:\Day5\101GOPRO\G0020216.JPG
A H:\Day5\101GOPRO\G0020217.JPG
A H:\Day5\101GOPRO\G0020218.JPG
A H:\Day5\101GOPRO\G0020219.JPG
A H:\Day5\101GOPRO\G0020220.JPG
A H:\Day5\101GOPRO\G0020221.JPG
A H:\Day5\101GOPRO\G0020222.JPG
A H:\Day5\101GOPRO\G0020223.JPG
A H:\Day5\101GOPRO\G0020224.JPG
A H:\Day5\101GOPRO\G0020225.JPG
A H:\Day5\101GOPRO\G0020226.JPG
A H:\Day5\101GOPRO\G0020227.JPG
A H:\Day5\101GOPRO\G0020228.JPG
A H:\Day5\101GOPRO\G0020229.JPG
A H:\Day5\101GOPRO\G0020230.JPG
A H:\Day5\101GOPRO\G0020231.JPG
A H:\Day5\101GOPRO\G0020232.JPG
A H:\Day5\101GOPRO\G0020233.JPG
A H:\Day5\101GOPRO\G0020234.JPG
A H:\Day5\101GOPRO\G0020235.JPG
A H:\Day5\101GOPRO\G0020236.JPG
A H:\Day5\101GOPRO\G0020237.JPG
A H:\Day5\101GOPRO\G0020238.JPG
A H:\Day5\101GOPRO\G0020239.JPG
A H:\Day5\101GOPRO\G0020240.JPG
A H:\Day5\101GOPRO\G0020241.JPG
A H:\Day5\101GOPRO\G0020242.JPG
A H:\Day5\101GOPRO\G0020243.JPG
A H:\Day5\101GOPRO\G0020244.JPG
A H:\Day5\101GOPRO\G0020245.JPG
A H:\Day5\101GOPRO\G0020246.JPG
A H:\Day5\101GOPRO\G0020247.JPG
A H:\Day5\101GOPRO\G0020248.JPG
A H:\Day5\101GOPRO\G0020249.JPG
A H:\Day5\101GOPRO\G0020250.JPG
A H:\Day5\101GOPRO\G0020251.JPG
A H:\Day5\101GOPRO\G0020252.JPG
A H:\Day5\101GOPRO\G0020253.JPG
A H:\Day5\101GOPRO\G0020254.JPG
A H:\Day5\101GOPRO\G0020255.JPG
A H:\Day5\101GOPRO\G0020256.JPG
A H:\Day5\101GOPRO\G0020257.JPG
A H:\Day5\101GOPRO\G0020258.JPG
A H:\Day5\101GOPRO\G0020259.JPG
A H:\Day5\101GOPRO\G0020260.JPG
A H:\Day5\101GOPRO\G0020261.JPG
A H:\Day5\101GOPRO\G0020262.JPG
A H:\Day5\101GOPRO\G0020263.JPG
A H:\Day5\101GOPRO\G0020264.JPG
A H:\Day5\101GOPRO\G0020265.JPG
A H:\Day5\101GOPRO\G0020266.JPG
A H:\Day5\101GOPRO\G0020267.JPG
A H:\Day5\101GOPRO\G0020268.JPG
A H:\Day5\101GOPRO\G0020269.JPG
A H:\Day5\101GOPRO\G0020270.JPG
A H:\Day5\101GOPRO\G0020271.JPG
A H:\Day5\101GOPRO\G0020272.JPG
A H:\Day5\101GOPRO\G0020273.JPG
A H:\Day5\101GOPRO\G0020274.JPG
A H:\Day5\101GOPRO\G0020275.JPG
A H:\Day5\101GOPRO\G0020276.JPG
A H:\Day5\101GOPRO\G0020277.JPG
A H:\Day5\101GOPRO\G0020278.JPG
A H:\Day5\101GOPRO\G0020279.JPG
A H:\Day5\101GOPRO\G0020280.JPG
A H:\Day5\101GOPRO\G0020281.JPG
A H:\Day5\101GOPRO\G0020282.JPG
A H:\Day5\101GOPRO\G0020283.JPG
A H:\Day5\101GOPRO\G0020284.JPG
A H:\Day5\101GOPRO\G0020285.JPG
A H:\Day5\101GOPRO\G0020286.JPG
A H:\Day5\101GOPRO\G0020287.JPG
A H:\Day5\101GOPRO\G0020288.JPG
A H:\Day5\101GOPRO\G0020289.JPG
A H:\Day5\101GOPRO\G0020290.JPG
A H:\Day5\101GOPRO\G0020291.JPG
A H:\Day5\101GOPRO\G0020292.JPG
A H:\Day5\101GOPRO\G0020293.JPG
A H:\Day5\101GOPRO\G0020294.JPG
A H:\Day5\101GOPRO\G0020295.JPG
A H:\Day5\101GOPRO\G0020296.JPG
A H:\Day5\101GOPRO\G0020297.JPG
A H:\Day5\101GOPRO\G0020298.JPG
A H:\Day5\101GOPRO\G0020299.JPG
A H:\Day5\101GOPRO\G0020300.JPG
A H:\Day5\101GOPRO\G0020301.JPG
A H:\Day5\101GOPRO\G0020302.JPG
A H:\Day5\101GOPRO\G0020303.JPG
A H:\Day5\101GOPRO\G0020304.JPG
A H:\Day5\101GOPRO\G0020305.JPG
A H:\Day5\101GOPRO\G0020306.JPG
A H:\Day5\101GOPRO\G0020307.JPG
A H:\Day5\101GOPRO\G0020308.JPG
A H:\Day5\101GOPRO\G0020309.JPG
A H:\Day5\101GOPRO\G0020310.JPG
A H:\Day5\101GOPRO\G0020311.JPG
A H:\Day5\101GOPRO\G0020312.JPG
A H:\Day5\101GOPRO\G0020313.JPG
A H:\Day5\101GOPRO\G0020314.JPG
A H:\Day5\101GOPRO\G0020315.JPG
A H:\Day5\101GOPRO\G0020316.JPG
A H:\Day5\101GOPRO\G0020317.JPG
A H:\Day5\101GOPRO\G0020318.JPG
A H:\Day5\101GOPRO\G0020319.JPG
A H:\Day5\101GOPRO\G0020320.JPG
A H:\Day5\101GOPRO\G0020321.JPG
A H:\Day5\101GOPRO\G0020322.JPG
A H:\Day5\101GOPRO\G0020323.JPG
A H:\Day5\101GOPRO\G0020324.JPG
A H:\Day5\101GOPRO\G0020325.JPG
A H:\Day5\101GOPRO\G0020326.JPG
A H:\Day5\101GOPRO\G0020327.JPG
A H:\Day5\101GOPRO\G0020328.JPG
A H:\Day5\101GOPRO\G0020329.JPG
A H:\Day5\101GOPRO\G0020330.JPG
A H:\Day5\101GOPRO\G0020331.JPG
A H:\Day5\101GOPRO\G0020332.JPG
A H:\Day5\101GOPRO\G0020333.JPG
A H:\Day5\101GOPRO\G0020334.JPG
A H:\Day5\101GOPRO\G0020335.JPG
A H:\Day5\101GOPRO\G0020336.JPG
A H:\Day5\101GOPRO\G0020337.JPG
A H:\Day5\101GOPRO\G0020338.JPG
A H:\Day5\101GOPRO\G0020339.JPG
A H:\Day5\101GOPRO\G0020340.JPG
A H:\Day5\101GOPRO\G0020341.JPG
A H:\Day5\101GOPRO\G0020342.JPG
A H:\Day5\101GOPRO\G0020343.JPG
A H:\Day5\101GOPRO\G0020344.JPG
A H:\Day5\101GOPRO\G0020345.JPG
A H:\Day5\101GOPRO\G0020346.JPG
A H:\Day5\101GOPRO\G0020347.JPG
A H:\Day5\101GOPRO\G0020348.JPG
A H:\Day5\101GOPRO\G0020349.JPG
A H:\Day5\101GOPRO\G0020350.JPG
A H:\Day5\101GOPRO\G0020351.JPG
A H:\Day5\101GOPRO\G0020352.JPG
A H:\Day5\101GOPRO\G0020353.JPG
A H:\Day5\101GOPRO\G0020354.JPG
A H:\Day5\101GOPRO\G0020355.JPG
A H:\Day5\101GOPRO\G0020356.JPG
A H:\Day5\101GOPRO\G0020357.JPG
A H:\Day5\101GOPRO\G0020358.JPG
A H:\Day5\101GOPRO\G0020359.JPG
A H:\Day5\101GOPRO\G0020360.JPG
A H:\Day5\101GOPRO\G0020361.JPG
A H:\Day5\101GOPRO\G0020362.JPG
A H:\Day5\101GOPRO\G0020363.JPG
A H:\Day5\101GOPRO\G0020364.JPG
A H:\Day5\101GOPRO\G0020365.JPG
A H:\Day5\101GOPRO\G0020366.JPG
A H:\Day5\101GOPRO\G0020367.JPG
A H:\Day5\101GOPRO\G0020368.JPG
A H:\Day5\101GOPRO\G0020369.JPG
A H:\Day5\101GOPRO\G0020370.JPG
A H:\Day5\101GOPRO\G0020371.JPG
A H:\Day5\101GOPRO\G0020372.JPG
A H:\Day5\101GOPRO\G0020373.JPG
A H:\Day5\101GOPRO\G0020374.JPG
A H:\Day5\101GOPRO\G0020375.JPG
A H:\Day5\101GOPRO\G0020376.JPG
A H:\Day5\101GOPRO\G0020377.JPG
A H:\Day5\101GOPRO\G0020378.JPG
A H:\Day5\101GOPRO\G0020379.JPG
A H:\Day5\101GOPRO\G0020380.JPG
A H:\Day5\101GOPRO\G0020381.JPG
A H:\Day5\101GOPRO\G0020382.JPG
A H:\Day5\101GOPRO\G0020383.JPG
A H:\Day5\101GOPRO\G0020384.JPG
A H:\Day5\101GOPRO\G0020385.JPG
A H:\Day5\101GOPRO\G0020386.JPG
A H:\Day5\101GOPRO\G0020387.JPG
A H:\Day5\101GOPRO\G0020388.JPG
A H:\Day5\101GOPRO\G0020389.JPG
A H:\Day5\101GOPRO\G0020390.JPG
A H:\Day5\101GOPRO\G0020391.JPG
A H:\Day5\101GOPRO\G0020392.JPG
A H:\Day5\101GOPRO\G0020393.JPG
A H:\Day5\101GOPRO\G0020394.JPG
A H:\Day5\101GOPRO\G0020395.JPG
A H:\Day5\101GOPRO\G0020396.JPG
A H:\Day5\101GOPRO\G0020397.JPG
A H:\Day5\101GOPRO\G0020398.JPG
A H:\Day5\101GOPRO\G0020399.JPG
A H:\Day5\101GOPRO\G0020400.JPG
A H:\Day5\101GOPRO\G0020401.JPG
A H:\Day5\101GOPRO\G0020402.JPG
A H:\Day5\101GOPRO\G0020403.JPG
A H:\Day5\101GOPRO\G0020404.JPG
A H:\Day5\101GOPRO\G0020405.JPG
A H:\Day5\101GOPRO\G0020406.JPG
A H:\Day5\101GOPRO\G0020407.JPG
A H:\Day5\101GOPRO\G0020408.JPG
A H:\Day5\101GOPRO\G0020409.JPG
A H:\Day5\101GOPRO\G0020410.JPG
A H:\Day5\101GOPRO\G0020411.JPG
A H:\Day5\101GOPRO\G0020412.JPG
A H:\Day5\101GOPRO\G0020413.JPG
A H:\Day5\101GOPRO\G0020414.JPG
A H:\Day5\101GOPRO\G0020415.JPG
A H:\Day5\101GOPRO\G0020416.JPG
A H:\Day5\101GOPRO\G0020417.JPG
A H:\Day5\101GOPRO\G0020418.JPG
A H:\Day5\101GOPRO\G0020419.JPG
A H:\Day5\101GOPRO\G0020420.JPG
A H:\Day5\101GOPRO\G0020421.JPG
A H:\Day5\101GOPRO\G0020422.JPG
A H:\Day5\101GOPRO\G0020423.JPG
A H:\Day5\101GOPRO\G0020424.JPG
A H:\Day5\101GOPRO\G0020425.JPG
A H:\Day5\101GOPRO\G0020426.JPG
A H:\Day5\101GOPRO\G0020427.JPG
A H:\Day5\101GOPRO\G0020428.JPG
A H:\Day5\101GOPRO\G0020429.JPG
A H:\Day5\101GOPRO\G0020430.JPG
A H:\Day5\101GOPRO\G0020431.JPG
A H:\Day5\101GOPRO\G0020432.JPG
A H:\Day5\101GOPRO\G0020433.JPG
A H:\Day5\101GOPRO\G0020434.JPG
A H:\Day5\101GOPRO\G0020435.JPG
A H:\Day5\101GOPRO\G0020436.JPG
A H:\Day5\101GOPRO\G0020437.JPG
A H:\Day5\101GOPRO\G0020438.JPG
A H:\Day5\101GOPRO\G0020439.JPG
A H:\Day5\101GOPRO\G0020440.JPG
A H:\Day5\101GOPRO\G0020441.JPG
A H:\Day5\101GOPRO\G0020442.JPG
A H:\Day5\101GOPRO\G0020443.JPG
A H:\Day5\101GOPRO\G0020444.JPG
A H:\Day5\101GOPRO\G0020445.JPG
A H:\Day5\101GOPRO\G0020446.JPG
A H:\Day5\101GOPRO\G0020447.JPG
A H:\Day5\101GOPRO\G0020448.JPG
A H:\Day5\101GOPRO\G0020449.JPG
A H:\Day5\101GOPRO\G0020450.JPG
A H:\Day5\101GOPRO\G0020451.JPG
A H:\Day5\101GOPRO\G0020452.JPG
A H:\Day5\101GOPRO\G0020453.JPG
A H:\Day5\101GOPRO\G0020454.JPG
A H:\Day5\101GOPRO\G0020455.JPG
A H:\Day5\101GOPRO\G0020456.JPG
A H:\Day5\101GOPRO\G0020457.JPG
A H:\Day5\101GOPRO\G0020458.JPG
A H:\Day5\101GOPRO\G0020459.JPG
A H:\Day5\101GOPRO\G0020460.JPG
A H:\Day5\101GOPRO\G0020461.JPG
A H:\Day5\101GOPRO\G0020462.JPG
A H:\Day5\101GOPRO\G0020463.JPG
A H:\Day5\101GOPRO\G0020464.JPG
A H:\Day5\101GOPRO\G0020465.JPG
A H:\Day5\101GOPRO\G0020466.JPG
A H:\Day5\101GOPRO\G0020467.JPG
A H:\Day5\101GOPRO\G0020468.JPG
A H:\Day5\101GOPRO\G0020469.JPG
A H:\Day5\101GOPRO\G0020470.JPG
A H:\Day5\101GOPRO\G0020471.JPG
A H:\Day5\101GOPRO\G0020472.JPG
A H:\Day5\101GOPRO\G0020473.JPG
A H:\Day5\101GOPRO\G0020474.JPG
A H:\Day5\101GOPRO\G0020475.JPG
A H:\Day5\101GOPRO\G0020476.JPG
A H:\Day5\101GOPRO\G0020477.JPG
A H:\Day5\101GOPRO\G0020478.JPG
A H:\Day5\101GOPRO\G0020479.JPG
A H:\Day5\101GOPRO\G0020480.JPG
A H:\Day5\101GOPRO\G0020481.JPG
A H:\Day5\101GOPRO\G0020482.JPG
A H:\Day5\101GOPRO\G0020483.JPG
A H:\Day5\101GOPRO\G0020484.JPG
A H:\Day5\101GOPRO\G0020485.JPG
A H:\Day5\101GOPRO\G0020486.JPG
A H:\Day5\101GOPRO\G0020487.JPG
A H:\Day5\101GOPRO\G0020488.JPG
A H:\Day5\101GOPRO\G0020489.JPG
A H:\Day5\101GOPRO\G0020490.JPG
A H:\Day5\101GOPRO\G0020491.JPG
A H:\Day5\101GOPRO\G0020492.JPG
A H:\Day5\101GOPRO\G0020493.JPG
A H:\Day5\101GOPRO\G0020494.JPG
A H:\Day5\101GOPRO\G0020495.JPG
A H:\Day5\101GOPRO\G0020496.JPG
A H:\Day5\101GOPRO\G0020497.JPG
A H:\Day5\101GOPRO\G0020498.JPG
A H:\Day5\101GOPRO\G0020499.JPG
A H:\Day5\101GOPRO\G0020500.JPG
A H:\Day5\101GOPRO\G0020501.JPG
A H:\Day5\101GOPRO\G0020502.JPG
A H:\Day5\101GOPRO\G0020503.JPG
A H:\Day5\101GOPRO\G0020504.JPG
A H:\Day5\101GOPRO\G0020505.JPG
A H:\Day5\101GOPRO\G0020506.JPG
A H:\Day5\101GOPRO\G0020507.JPG
A H:\Day5\101GOPRO\G0020508.JPG
A H:\Day5\101GOPRO\G0020509.JPG
A H:\Day5\101GOPRO\G0020510.JPG
A H:\Day5\101GOPRO\G0020511.JPG
A H:\Day5\101GOPRO\G0020512.JPG
A H:\Day5\101GOPRO\G0020513.JPG
A H:\Day5\101GOPRO\G0020514.JPG
A H:\Day5\101GOPRO\G0020515.JPG
A H:\Day5\101GOPRO\G0020516.JPG
A H:\Day5\101GOPRO\G0020517.JPG
A H:\Day5\101GOPRO\G0020518.JPG
A H:\Day5\101GOPRO\G0020519.JPG
A H:\Day5\101GOPRO\G0020520.JPG
A H:\Day5\101GOPRO\G0020521.JPG
A H:\Day5\101GOPRO\G0020522.JPG
A H:\Day5\101GOPRO\G0020523.JPG
A H:\Day5\101GOPRO\G0020524.JPG
A H:\Day5\101GOPRO\G0020525.JPG
A H:\Day5\101GOPRO\G0020526.JPG
A H:\Day5\101GOPRO\G0020527.JPG
A H:\Day5\101GOPRO\G0020528.JPG
A H:\Day5\101GOPRO\G0020529.JPG
A H:\Day5\101GOPRO\G0020530.JPG
A H:\Day5\101GOPRO\G0020531.JPG
A H:\Day5\101GOPRO\G0020532.JPG
A H:\Day5\101GOPRO\G0020533.JPG
A H:\Day5\101GOPRO\G0020534.JPG
A H:\Day5\101GOPRO\G0020535.JPG
A H:\Day5\101GOPRO\G0020536.JPG
A H:\Day5\101GOPRO\G0020537.JPG
A H:\Day5\101GOPRO\G0020538.JPG
A H:\Day5\101GOPRO\G0020539.JPG
A H:\Day5\101GOPRO\G0020540.JPG
A H:\Day5\101GOPRO\G0020541.JPG
A H:\Day5\101GOPRO\G0020542.JPG
A H:\Day5\101GOPRO\G0020543.JPG
A H:\Day5\101GOPRO\G0020544.JPG
A H:\Day5\101GOPRO\G0020545.JPG
A H:\Day5\101GOPRO\G0020546.JPG
A H:\Day5\101GOPRO\G0020547.JPG
A H:\Day5\101GOPRO\G0020548.JPG
A H:\Day5\101GOPRO\G0020549.JPG
A H:\Day5\101GOPRO\G0020550.JPG
A H:\Day5\101GOPRO\G0020551.JPG
A H:\Day5\101GOPRO\G0020552.JPG
A H:\Day5\101GOPRO\G0020553.JPG
A H:\Day5\101GOPRO\G0020554.JPG
A H:\Day5\101GOPRO\G0020555.JPG
A H:\Day5\101GOPRO\G0020556.JPG
A H:\Day5\101GOPRO\G0020557.JPG
A H:\Day5\101GOPRO\G0020558.JPG
A H:\Day5\101GOPRO\G0020559.JPG
A H:\Day5\101GOPRO\G0020560.JPG
A H:\Day5\101GOPRO\G0020561.JPG
A H:\Day5\101GOPRO\G0020562.JPG
A H:\Day5\101GOPRO\G0020563.JPG
A H:\Day5\101GOPRO\G0020564.JPG
A H:\Day5\101GOPRO\G0020565.JPG
A H:\Day5\101GOPRO\G0020566.JPG
A H:\Day5\101GOPRO\G0020567.JPG
A H:\Day5\101GOPRO\G0020568.JPG
A H:\Day5\101GOPRO\G0020569.JPG
A H:\Day5\101GOPRO\G0020570.JPG
A H:\Day5\101GOPRO\G0020571.JPG
A H:\Day5\101GOPRO\G0020572.JPG
A H:\Day5\101GOPRO\G0020573.JPG
A H:\Day5\101GOPRO\G0020574.JPG
A H:\Day5\101GOPRO\G0020575.JPG
A H:\Day5\101GOPRO\G0020576.JPG
A H:\Day5\101GOPRO\G0020577.JPG
A H:\Day5\101GOPRO\G0020578.JPG
A H:\Day5\101GOPRO\G0020579.JPG
A H:\Day5\101GOPRO\G0020580.JPG
A H:\Day5\101GOPRO\G0020581.JPG
A H:\Day5\101GOPRO\G0020582.JPG
A H:\Day5\101GOPRO\G0020583.JPG
A H:\Day5\101GOPRO\G0020584.JPG
A H:\Day5\101GOPRO\G0020585.JPG
A H:\Day5\101GOPRO\G0020586.JPG
A H:\Day5\101GOPRO\G0020587.JPG
A H:\Day5\101GOPRO\G0020588.JPG
A H:\Day5\101GOPRO\G0020589.JPG
A H:\Day5\101GOPRO\G0020590.JPG
A H:\Day5\101GOPRO\G0020591.JPG
A H:\Day5\101GOPRO\G0020592.JPG
A H:\Day5\101GOPRO\G0020593.JPG
A H:\Day5\101GOPRO\G0020594.JPG
A H:\Day5\101GOPRO\G0020595.JPG
A H:\Day5\101GOPRO\G0020596.JPG
A H:\Day5\101GOPRO\G0020597.JPG
A H:\Day5\101GOPRO\G0020598.JPG
A H:\Day5\101GOPRO\G0020599.JPG
A H:\Day5\101GOPRO\G0020600.JPG
A H:\Day5\101GOPRO\G0020601.JPG
A H:\Day5\101GOPRO\G0020602.JPG
A H:\Day5\101GOPRO\G0020603.JPG
A H:\Day5\101GOPRO\G0020604.JPG
A H:\Day5\101GOPRO\G0020605.JPG
A H:\Day5\101GOPRO\G0020606.JPG
A H:\Day5\101GOPRO\G0020607.JPG
A H:\Day5\101GOPRO\G0020608.JPG
A H:\Day5\101GOPRO\G0020609.JPG
A H:\Day5\101GOPRO\G0020610.JPG
A H:\Day5\101GOPRO\G0020611.JPG
A H:\Day5\101GOPRO\G0020612.JPG
A H:\Day5\101GOPRO\G0020613.JPG
A H:\Day5\101GOPRO\G0020614.JPG
A H:\Day5\101GOPRO\G0020615.JPG
A H:\Day5\101GOPRO\G0020616.JPG
A H:\Day5\101GOPRO\G0020617.JPG
A H:\Day5\101GOPRO\G0020618.JPG
A H:\Day5\101GOPRO\G0020619.JPG
A H:\Day5\101GOPRO\G0020620.JPG
A H:\Day5\101GOPRO\G0020621.JPG
A H:\Day5\101GOPRO\G0020622.JPG
A H:\Day5\101GOPRO\G0020623.JPG
A H:\Day5\101GOPRO\G0020624.JPG
A H:\Day5\101GOPRO\G0020625.JPG
A H:\Day5\101GOPRO\G0020626.JPG
A H:\Day5\101GOPRO\G0020627.JPG
A H:\Day5\101GOPRO\G0020628.JPG
A H:\Day5\101GOPRO\G0020629.JPG
A H:\Day5\101GOPRO\G0020630.JPG
A H:\Day5\101GOPRO\G0020631.JPG
A H:\Day5\101GOPRO\G0020632.JPG
A H:\Day5\101GOPRO\G0020633.JPG
A H:\Day5\101GOPRO\G0020634.JPG
A H:\Day5\101GOPRO\G0020635.JPG
A H:\Day5\101GOPRO\G0020636.JPG
A H:\Day5\101GOPRO\G0020637.JPG
A H:\Day5\101GOPRO\G0020638.JPG
A H:\Day5\101GOPRO\G0020639.JPG
A H:\Day5\101GOPRO\G0020640.JPG
A H:\Day5\101GOPRO\G0020641.JPG
A H:\Day5\101GOPRO\G0020642.JPG
A H:\Day5\101GOPRO\G0020643.JPG
A H:\Day5\101GOPRO\G0020644.JPG
A H:\Day5\101GOPRO\G0020645.JPG
A H:\Day5\101GOPRO\G0020646.JPG
A H:\Day5\101GOPRO\G0020647.JPG
A H:\Day5\101GOPRO\G0020648.JPG
A H:\Day5\101GOPRO\G0020649.JPG
A H:\Day5\101GOPRO\G0020650.JPG
A H:\Day5\101GOPRO\G0020651.JPG
A H:\Day5\101GOPRO\G0020652.JPG
A H:\Day5\101GOPRO\G0020653.JPG
A H:\Day5\101GOPRO\G0020654.JPG
A H:\Day5\101GOPRO\G0020655.JPG
A H:\Day5\101GOPRO\G0020656.JPG
A H:\Day5\101GOPRO\G0020657.JPG
A H:\Day5\101GOPRO\G0020658.JPG
A H:\Day5\101GOPRO\G0020659.JPG
A H:\Day5\101GOPRO\G0020660.JPG
A H:\Day5\101GOPRO\G0020661.JPG
A H:\Day5\101GOPRO\G0020662.JPG
A H:\Day5\101GOPRO\G0020663.JPG
A H:\Day5\101GOPRO\G0020664.JPG
A H:\Day5\101GOPRO\G0020665.JPG
A H:\Day5\101GOPRO\G0020666.JPG
A H:\Day5\101GOPRO\G0020667.JPG
A H:\Day5\101GOPRO\G0020668.JPG
A H:\Day5\101GOPRO\G0020669.JPG
A H:\Day5\101GOPRO\G0020670.JPG
A H:\Day5\101GOPRO\G0020671.JPG
A H:\Day5\101GOPRO\G0020672.JPG
A H:\Day5\101GOPRO\G0020673.JPG
A H:\Day5\101GOPRO\G0020674.JPG
A H:\Day5\101GOPRO\G0020675.JPG
A H:\Day5\101GOPRO\G0020676.JPG
A H:\Day5\101GOPRO\G0020677.JPG
A H:\Day5\101GOPRO\G0020678.JPG
A H:\Day5\101GOPRO\G0020679.JPG
A H:\Day5\101GOPRO\G0020680.JPG
A H:\Day5\101GOPRO\G0020681.JPG
A H:\Day5\101GOPRO\G0020682.JPG
A H:\Day5\101GOPRO\G0020683.JPG
A H:\Day5\101GOPRO\G0020684.JPG
A H:\Day5\101GOPRO\G0020685.JPG
A H:\Day5\101GOPRO\G0020686.JPG
A H:\Day5\101GOPRO\G0020687.JPG
A H:\Day5\101GOPRO\G0020688.JPG
A H:\Day5\101GOPRO\G0020689.JPG
A H:\Day5\101GOPRO\G0020690.JPG
A H:\Day5\101GOPRO\G0020691.JPG
A H:\Day5\101GOPRO\G0020692.JPG
A H:\Day5\101GOPRO\G0020693.JPG
A H:\Day5\101GOPRO\G0020694.JPG
A H:\Day5\101GOPRO\G0020695.JPG
A H:\Day5\101GOPRO\G0020696.JPG
A H:\Day5\101GOPRO\G0020697.JPG
A H:\Day5\101GOPRO\G0020698.JPG
A H:\Day5\101GOPRO\G0020699.JPG
A H:\Day5\101GOPRO\G0020700.JPG
A H:\Day5\101GOPRO\G0020701.JPG
A H:\Day5\101GOPRO\G0020702.JPG
A H:\Day5\101GOPRO\G0020703.JPG
A H:\Day5\101GOPRO\G0020704.JPG
A H:\Day5\101GOPRO\G0020705.JPG
A H:\Day5\101GOPRO\G0020706.JPG
A H:\Day5\101GOPRO\G0020707.JPG
A H:\Day5\101GOPRO\G0020708.JPG
A H:\Day5\101GOPRO\G0020709.JPG
A H:\Day5\101GOPRO\G0020710.JPG
A H:\Day5\101GOPRO\G0020711.JPG
A H:\Day5\101GOPRO\G0020712.JPG
A H:\Day5\101GOPRO\G0020713.JPG
A H:\Day5\101GOPRO\G0020714.JPG
A H:\Day5\101GOPRO\G0020715.JPG
A H:\Day5\101GOPRO\G0020716.JPG
A H:\Day5\101GOPRO\G0020717.JPG
A H:\Day5\101GOPRO\G0020718.JPG
A H:\Day5\101GOPRO\G0020719.JPG
A H:\Day5\101GOPRO\G0020720.JPG
A H:\Day5\101GOPRO\G0020721.JPG
A H:\Day5\101GOPRO\G0020722.JPG
A H:\Day5\101GOPRO\G0020723.JPG
A H:\Day5\101GOPRO\G0020724.JPG
A H:\Day5\101GOPRO\G0020725.JPG
A H:\Day5\101GOPRO\G0020726.JPG
A H:\Day5\101GOPRO\G0020727.JPG
A H:\Day5\101GOPRO\G0020728.JPG
A H:\Day5\101GOPRO\G0020729.JPG
A H:\Day5\101GOPRO\G0020730.JPG
A H:\Day5\101GOPRO\G0020731.JPG
A H:\Day5\101GOPRO\G0020732.JPG
A H:\Day5\101GOPRO\G0020733.JPG
A H:\Day5\101GOPRO\G0020734.JPG
A H:\Day5\101GOPRO\G0020735.JPG
A H:\Day5\101GOPRO\G0020736.JPG
A H:\Day5\101GOPRO\G0020737.JPG
A H:\Day5\101GOPRO\G0020738.JPG
A H:\Day5\101GOPRO\G0020739.JPG
A H:\Day5\101GOPRO\G0020740.JPG
A H:\Day5\101GOPRO\G0020741.JPG
A H:\Day5\101GOPRO\G0020742.JPG
A H:\Day5\101GOPRO\G0020743.JPG
A H:\Day5\101GOPRO\G0020744.JPG
A H:\Day5\101GOPRO\G0020745.JPG
A H:\Day5\101GOPRO\G0020746.JPG
A H:\Day5\101GOPRO\G0020747.JPG
A H:\Day5\101GOPRO\G0020748.JPG
A H:\Day5\101GOPRO\G0020749.JPG
A H:\Day5\101GOPRO\G0020750.JPG
A H:\Day5\101GOPRO\G0020751.JPG
A H:\Day5\101GOPRO\G0020752.JPG
A H:\Day5\101GOPRO\G0020753.JPG
A H:\Day5\101GOPRO\G0020754.JPG
A H:\Day5\101GOPRO\G0020755.JPG
A H:\Day5\101GOPRO\G0020756.JPG
A H:\Day5\101GOPRO\G0020757.JPG
A H:\Day5\101GOPRO\G0020758.JPG
A H:\Day5\101GOPRO\G0020759.JPG
A H:\Day5\101GOPRO\G0020760.JPG
A H:\Day5\101GOPRO\G0020761.JPG
A H:\Day5\101GOPRO\G0020762.JPG
A H:\Day5\101GOPRO\G0020763.JPG
A H:\Day5\101GOPRO\G0020764.JPG
A H:\Day5\101GOPRO\G0020765.JPG
A H:\Day5\101GOPRO\G0020766.JPG
A H:\Day5\101GOPRO\G0020767.JPG
A H:\Day5\101GOPRO\G0020768.JPG
A H:\Day5\101GOPRO\G0020769.JPG
A H:\Day5\101GOPRO\G0020770.JPG
A H:\Day5\101GOPRO\G0020771.JPG
A H:\Day5\101GOPRO\G0020772.JPG
A H:\Day5\101GOPRO\G0020773.JPG
A H:\Day5\101GOPRO\G0020774.JPG
A H:\Day5\101GOPRO\G0020775.JPG
A H:\Day5\101GOPRO\G0020776.JPG
A H:\Day5\101GOPRO\G0020777.JPG
A H:\Day5\101GOPRO\G0020778.JPG
A H:\Day5\101GOPRO\G0020779.JPG
A H:\Day5\101GOPRO\G0020780.JPG
A H:\Day5\101GOPRO\G0020781.JPG
A H:\Day5\101GOPRO\G0020782.JPG
A H:\Day5\101GOPRO\G0020783.JPG
A H:\Day5\101GOPRO\G0020784.JPG
A H:\Day5\101GOPRO\G0020785.JPG
A H:\Day5\101GOPRO\G0020786.JPG
A H:\Day5\101GOPRO\G0020787.JPG
A H:\Day5\101GOPRO\G0020788.JPG
A H:\Day5\101GOPRO\G0020789.JPG
A H:\Day5\101GOPRO\G0020790.JPG
A H:\Day5\101GOPRO\G0020791.JPG
A H:\Day5\101GOPRO\G0020792.JPG
A H:\Day5\101GOPRO\G0020793.JPG
A H:\Day5\101GOPRO\G0020794.JPG
A H:\Day5\101GOPRO\G0020795.JPG
A H:\Day5\101GOPRO\G0020796.JPG
A H:\Day5\101GOPRO\G0020797.JPG
A H:\Day5\101GOPRO\G0020798.JPG
A H:\Day5\101GOPRO\G0020799.JPG
A H:\Day5\101GOPRO\G0020800.JPG
A H:\Day5\101GOPRO\G0020801.JPG
A H:\Day5\101GOPRO\G0020802.JPG
A H:\Day5\101GOPRO\G0020803.JPG
A H:\Day5\101GOPRO\G0020804.JPG
A H:\Day5\101GOPRO\G0020805.JPG
A H:\Day5\101GOPRO\G0020806.JPG
A H:\Day5\101GOPRO\G0020807.JPG
A H:\Day5\101GOPRO\G0020808.JPG
A H:\Day5\101GOPRO\G0020809.JPG
A H:\Day5\101GOPRO\G0020810.JPG
A H:\Day5\101GOPRO\G0020811.JPG
A H:\Day5\101GOPRO\G0020812.JPG
A H:\Day5\101GOPRO\G0020813.JPG
A H:\Day5\101GOPRO\G0020814.JPG
A H:\Day5\101GOPRO\G0020815.JPG
A H:\Day5\101GOPRO\G0020816.JPG
A H:\Day5\101GOPRO\G0020817.JPG
A H:\Day5\101GOPRO\G0020818.JPG
A H:\Day5\101GOPRO\G0020819.JPG
A H:\Day5\101GOPRO\G0020820.JPG
A H:\Day5\101GOPRO\G0020821.JPG
A H:\Day5\101GOPRO\G0020822.JPG
A H:\Day5\101GOPRO\G0020823.JPG
A H:\Day5\101GOPRO\G0020824.JPG
A H:\Day5\101GOPRO\G0020825.JPG
A H:\Day5\101GOPRO\G0020826.JPG
A H:\Day5\101GOPRO\G0020827.JPG
A H:\Day5\101GOPRO\G0020828.JPG
A H:\Day5\101GOPRO\G0020829.JPG
A H:\Day5\101GOPRO\G0020830.JPG
A H:\Day5\101GOPRO\G0020831.JPG
A H:\Day5\101GOPRO\G0020832.JPG
A H:\Day5\101GOPRO\G0020833.JPG
A H:\Day5\101GOPRO\G0020834.JPG
A H:\Day5\101GOPRO\G0020835.JPG
A H:\Day5\101GOPRO\G0020836.JPG
A H:\Day5\101GOPRO\G0020837.JPG
A H:\Day5\101GOPRO\G0020838.JPG
A H:\Day5\101GOPRO\G0020839.JPG
A H:\Day5\101GOPRO\G0020840.JPG
A H:\Day5\101GOPRO\G0020841.JPG
A H:\Day5\101GOPRO\G0020842.JPG
A H:\Day5\101GOPRO\G0020843.JPG
A H:\Day5\101GOPRO\G0020844.JPG
A H:\Day5\101GOPRO\G0020845.JPG
A H:\Day5\101GOPRO\G0020846.JPG
A H:\Day5\101GOPRO\G0020847.JPG
A H:\Day5\101GOPRO\G0020848.JPG
A H:\Day5\101GOPRO\G0020849.JPG
A H:\Day5\101GOPRO\G0020850.JPG
A H:\Day5\101GOPRO\G0020851.JPG
A H:\Day5\101GOPRO\G0020852.JPG
A H:\Day5\101GOPRO\G0020853.JPG
A H:\Day5\101GOPRO\G0020854.JPG
A H:\Day5\101GOPRO\G0020855.JPG
A H:\Day5\101GOPRO\G0020856.JPG
A H:\Day5\101GOPRO\G0020857.JPG
A H:\Day5\101GOPRO\G0020858.JPG
A H:\Day5\101GOPRO\G0020859.JPG
A H:\Day5\101GOPRO\G0020860.JPG
A H:\Day5\101GOPRO\G0020861.JPG
A H:\Day5\101GOPRO\G0020862.JPG
A H:\Day5\101GOPRO\G0020863.JPG
A H:\Day5\101GOPRO\G0020864.JPG
A H:\Day5\101GOPRO\G0020865.JPG
A H:\Day5\101GOPRO\G0020866.JPG
A H:\Day5\101GOPRO\G0020867.JPG
A H:\Day5\101GOPRO\G0020868.JPG
A H:\Day5\101GOPRO\G0020869.JPG
A H:\Day5\101GOPRO\G0020870.JPG
A H:\Day5\101GOPRO\G0020871.JPG
A H:\Day5\101GOPRO\G0020872.JPG
A H:\Day5\101GOPRO\G0020873.JPG
A H:\Day5\101GOPRO\G0020874.JPG
A H:\Day5\101GOPRO\G0020875.JPG
A H:\Day5\101GOPRO\G0020876.JPG
A H:\Day5\101GOPRO\G0020877.JPG
A H:\Day5\101GOPRO\G0020878.JPG
A H:\Day5\101GOPRO\G0020879.JPG
A H:\Day5\101GOPRO\G0020880.JPG
A H:\Day5\101GOPRO\G0020881.JPG
A H:\Day5\101GOPRO\G0020882.JPG
A H:\Day5\101GOPRO\G0020883.JPG
A H:\Day5\101GOPRO\G0020884.JPG
A H:\Day5\101GOPRO\G0020885.JPG
A H:\Day5\101GOPRO\G0020886.JPG
A H:\Day5\101GOPRO\G0020887.JPG
A H:\Day5\101GOPRO\G0020888.JPG
A H:\Day5\101GOPRO\G0020889.JPG
A H:\Day5\101GOPRO\G0020890.JPG
A H:\Day5\101GOPRO\G0020891.JPG
A H:\Day5\101GOPRO\G0020892.JPG
A H:\Day5\101GOPRO\G0020893.JPG
A H:\Day5\101GOPRO\G0020894.JPG
A H:\Day5\101GOPRO\G0020895.JPG
A H:\Day5\101GOPRO\G0020896.JPG
A H:\Day5\101GOPRO\G0020897.JPG
A H:\Day5\101GOPRO\G0020898.JPG
A H:\Day5\101GOPRO\G0020899.JPG
A H:\Day5\101GOPRO\G0020900.JPG
A H:\Day5\101GOPRO\G0020901.JPG
A H:\Day5\101GOPRO\G0020902.JPG
A H:\Day5\101GOPRO\G0020903.JPG
A H:\Day5\101GOPRO\G0020904.JPG
A H:\Day5\101GOPRO\G0020905.JPG
A H:\Day5\101GOPRO\G0020906.JPG
A H:\Day5\101GOPRO\G0020907.JPG
A H:\Day5\101GOPRO\G0020908.JPG
A H:\Day5\101GOPRO\G0020909.JPG
A H:\Day5\101GOPRO\G0020910.JPG
A H:\Day5\101GOPRO\G0020911.JPG
A H:\Day5\101GOPRO\G0020912.JPG
A H:\Day5\101GOPRO\G0020913.JPG
A H:\Day5\101GOPRO\G0020914.JPG
A H:\Day5\101GOPRO\G0020915.JPG
A H:\Day5\101GOPRO\G0020916.JPG
A H:\Day5\101GOPRO\G0020917.JPG
A H:\Day5\101GOPRO\G0020918.JPG
A H:\Day5\101GOPRO\G0020919.JPG
A H:\Day5\101GOPRO\G0020920.JPG
A H:\Day5\101GOPRO\G0020921.JPG
A H:\Day5\101GOPRO\G0020922.JPG
A H:\Day5\101GOPRO\G0020923.JPG
A H:\Day5\101GOPRO\G0020924.JPG
A H:\Day5\101GOPRO\G0020925.JPG
A H:\Day5\101GOPRO\G0020926.JPG
A H:\Day5\101GOPRO\G0020927.JPG
A H:\Day5\101GOPRO\G0020928.JPG
A H:\Day5\101GOPRO\G0020929.JPG
A H:\Day5\101GOPRO\G0020930.JPG
A H:\Day5\101GOPRO\G0020931.JPG
A H:\Day5\101GOPRO\G0020932.JPG
A H:\Day5\101GOPRO\G0020933.JPG
A H:\Day5\101GOPRO\G0020934.JPG
A H:\Day5\101GOPRO\G0020935.JPG
A H:\Day5\101GOPRO\G0020936.JPG
A H:\Day5\101GOPRO\G0020937.JPG
A H:\Day5\101GOPRO\G0020938.JPG
A H:\Day5\101GOPRO\G0020939.JPG
A H:\Day5\101GOPRO\G0020940.JPG
A H:\Day5\101GOPRO\G0020941.JPG
A H:\Day5\101GOPRO\G0020942.JPG
A H:\Day5\101GOPRO\G0020943.JPG
A H:\Day5\101GOPRO\G0020944.JPG
A H:\Day5\101GOPRO\G0020945.JPG
A H:\Day5\101GOPRO\G0020946.JPG
A H:\Day5\101GOPRO\G0020947.JPG
A H:\Day5\101GOPRO\G0020948.JPG
A H:\Day5\101GOPRO\G0020949.JPG
A H:\Day5\101GOPRO\G0020950.JPG
A H:\Day5\101GOPRO\G0020951.JPG
A H:\Day5\101GOPRO\G0020952.JPG
A H:\Day5\101GOPRO\G0020953.JPG
A H:\Day5\101GOPRO\G0020954.JPG
A H:\Day5\101GOPRO\G0020955.JPG
A H:\Day5\101GOPRO\G0020956.JPG
A H:\Day5\101GOPRO\G0020957.JPG
A H:\Day5\101GOPRO\G0020958.JPG
A H:\Day5\101GOPRO\G0020959.JPG
A H:\Day5\101GOPRO\G0020960.JPG
A H:\Day5\101GOPRO\G0020961.JPG
A H:\Day5\101GOPRO\G0020962.JPG
A H:\Day5\101GOPRO\G0020963.JPG
A H:\Day5\101GOPRO\G0020964.JPG
A H:\Day5\101GOPRO\G0020965.JPG
A H:\Day5\101GOPRO\G0020966.JPG
A H:\Day5\101GOPRO\G0020967.JPG
A H:\Day5\101GOPRO\G0020968.JPG
A H:\Day5\101GOPRO\G0020969.JPG
A H:\Day5\101GOPRO\G0020970.JPG
A H:\Day5\101GOPRO\G0020971.JPG
A H:\Day5\101GOPRO\G0020972.JPG
A H:\Day5\101GOPRO\G0020973.JPG
A H:\Day5\101GOPRO\G0020974.JPG
A H:\Day5\101GOPRO\G0020975.JPG
A H:\Day5\101GOPRO\G0020976.JPG
A H:\Day5\101GOPRO\G0020977.JPG
A H:\Day5\101GOPRO\G0020978.JPG
A H:\Day5\101GOPRO\G0020979.JPG
A H:\Day5\101GOPRO\G0020980.JPG
A H:\Day5\101GOPRO\G0020981.JPG
A H:\Day5\101GOPRO\G0020982.JPG
A H:\Day5\101GOPRO\G0020983.JPG
A H:\Day5\101GOPRO\G0020984.JPG
A H:\Day5\101GOPRO\G0020985.JPG
A H:\Day5\101GOPRO\G0020986.JPG
A H:\Day5\101GOPRO\G0020987.JPG
A H:\Day5\101GOPRO\G0020988.JPG
A H:\Day5\101GOPRO\G0020989.JPG
A H:\Day5\101GOPRO\G0020990.JPG
A H:\Day5\101GOPRO\G0020991.JPG
A H:\Day5\101GOPRO\G0020992.JPG
A H:\Day5\101GOPRO\G0020993.JPG
A H:\Day5\101GOPRO\G0020994.JPG
A H:\Day5\101GOPRO\G0020995.JPG
A H:\Day5\101GOPRO\G0020996.JPG
A H:\Day5\101GOPRO\G0020997.JPG
A H:\Day5\101GOPRO\G0020998.JPG
A H:\Day5\101GOPRO\G0020999.JPG
A H:\Day5\101GOPRO\G0021000.JPG
ssmad
Regular Member
 
Posts: 41
Joined: May 25th, 2013, 12:10 pm
Advertisement
Register to Remove

PreviousNext

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 21 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware