Edit C:\Windows\apppatch\apppatch64\acspecfc.dll
MZ? ?? ? @ ? ? ? ?!?L?!This program cannot be run in DOS mode. $ ij?-- ?- ?- ??8~, ??:~, ??9~! ??<~< ?- ?? ??=~, ??/~> ??>~, ??;~, ?Rich- ? PE d? l?R ? " | " p ? ? ? ` ] p? ? ? ? ? ? @ d 8 @| ? ? p .text ? | `.data ? ? ? @ ?.pdata ? ? @ @.idata ? ? ? @ @.rsrc ? ? ? @ @.reloc @ ? ? @ B ????????H?$H?$H?$ATAVAWH? 3??L??? ?? ? H?$@H?$HH?$PH? A_A^A\????????H?$H?$WH? I??H??? L??H?H?$0H?$8H? _??????H? L??H?VWAVH?@ ?L?? ??$ ;??? ?u9? u 3?\$ ? ??;?? L? ? M?t<?? ;?D?? L?$p A???D$ ?3?\$ ??$h L?$` ?? L?$p ?I??????$ ?3?\$ ??$h L?$` ??= L?$p ?I?? ??$ ?3?\$ ??$h L?$` ;?? ?u~E3?3???" ?? ?$h L?$` ?$ E3?3??? ???? ?$h L?$` ?$ H?r? H?t$E3?3????? ?$h L?$` ?$ ?t?uxL?$p ?I??????$ ?3?\$ ??$h L?$` H?? H?t:?=? t1L?$p ?I????D$ ?3?\$ ??$h ?????;?? ?H?$x H?@ A^_^????????????????????0Hc??? ?f? ??? ?? ?=? ? ??? ?=k? ? ??? ?=T? ? ??? ?==? ? ??? ?=&? ? ??? ?=? ? ??? ?=? ? ??? ?=? ? ??? ?=? ? ??? ?=? ? ?? ??? ? H?0[??; ? uH?f???u??? ??~? ?? ????k? eH?%0 H??H;?? ?? 3?H?=? u?A? ?}? ?t? ?" ???H?-R? H?t`H?=>? L?L?H?H;?3H9 t??H? ??? #? H?? L;?L;???H?L?H??H??? H? ? H? ? ? ? E??0??H? ? ?$??3?"???H?%0 ?H??H;?? ?)? 3?H?=? u?? ?? ?t ? ? ?H?=? L?%? ?w? ?I;? ?u??H?t???I;???????H?? H? s ? ?4? ?u H?H? ? H9 '? t!H? ? ?1 ?tM?? I??? ?? ?3???? ?u???? ?????????? ` ? ????H?(? ?)? H?z? H?k? H?u? ?H? 3??(??????? H?3?? H??? ?? ? ??H? [H?%?? ????????H?$H?? H? ? ?? H?? H?$HE3??$PH?$H?? H?$@H?$@ tBH?$8 H?$XH?$0H?$`H?$(H?gy H?$ L?$@L?$HH?$P3?k? ?#H?? H? H?0z H?? H?H?? H?z H?? H?$? H?? ?_x ?Yx ?cx ? Hk? H? [x H? ? Hk?H? Cx H?x H?? Hk?H? (x H?? H?? Hk? H? ? H?h? Hk?H? ? H?hH? ???? H?? ???? ? ? ? ????H?$WH? ?H??? ?tH?? H?H?$0H? _? ? ?%? ????%? ???????????LcA<E3??L??E?H?I??t ? L;? ??;?A???(E;??3???????H?$WH? H?H?=???H?? ?t"H+??H?????H?t?$? ???3??$0H? _??????????H??Z f9t3?HcH<H?3?9PE u ? f9Q??????$ UH?H? H?@v H? H?2?-?+ H;?? H??N? H?H??? ?H1E?<? ?H1E? ? ?H?H1E?? H??H3EH3?? H?? ? ? H? H?????? H3E H3EH#??3?-?+ H;?D??? H?$HH?H?R{ H? ]?%? ????%? ????%? ????%? ???????H?(M?8H?I?? ? H?(??????? E?H?L?A??? L?tA?McP?L?c?#?c??H??HK?t ?????3??H? [?????????H?H?H?H? AVH? I?8H?M?H?L?I?H?I?????D?D?A?A?A? A#???DD??tL?M?H?H????D?H?$0H?$8H?$@H?$HA?H? A^??%f? ????%? ???????? ????? ??H? H?H? H???? H?? ?P?P=csm?H?? ?P????0??0 ?0H? ]??H? H?H? H???? H?? ?p?p=csm?H?? ?p????8??8 ?8H? ]??H? H?H?0 H???? H?? ?`?`=csm?H?? ?`????H??H ?HH? ]??H? H?H? H???? H?? ?? ?? =csm?H?? ?? ????$??$ ?$H? ]?UH? H?H? H???? H?? ?(?(=csm?H?? ?(????4??4 ?4H? ]??H? H?H? H???? H?? ?@?@=csm?H?? ?@????L??L ?LH? ]??H? H?H?( H???? H?? ?X?X=csm?H?? ?X????h??h ?hH? ]??H? H?H?8 H???? H?? ?x?x=csm?H?? ?x????? ? ?? ?? H? ]?UH? H??h w ?? ????H? ]??UH? H?H?3?8 ???H? ]????????????L????A?L A??8 I??? ? @ h + ?3???v ?? ? /p H? ? H? ? ? ????E3?3?3?3?? ? H? ? 3??t ?{? H? ? H? ? H?????^? H? ? ????H?? E3?3?3??z 3?? ? ?????H?iv E3?3?3??R 3?? Qv ???L?$@3??? ????L?$@3??? ????L?$@3?? ????L?$@3??j ????L?$@3??R ????L?$@3??** ????L?$@3??^7 ????L?$@3???< ????L?$@3???: ????L?$@3??@ ????H?eZ A? ? H?? A? L?qZ H?zZ ? H?$ ?? ?o????????eH?%` L?3??0H?%? ?????????????I?I?I?WH?`I?I?H?O I???? H?I???t M????? L?I??????I?? ?? ? H?? L?$PH?$@H?hs L?H?$8H?? H?H?$0H?? ?H?$(H?$ ? H?6 L?$PL?H?$@H?s H?H?$8H?_s ?H?$0H?? H?$(H?$ ? H?k L?$PL?H?$@H?? H?H?$8H?s ?H?$0H?b H?$(H?$ ? H? L?$PL?H?$@H?? H?H?$8H?? ?H?$0H?C H?$(H?$ ?0 H??' H?$@H?Ar H?$8H?}r H?$0H?9 L?$PL?H?$(H??H?$ ? H??4 H?$@H?? L?$PH?$8H?)r L?H?$0H?? H?H?$(?H?$ ? H?': L?$PH?$@H?? L?H?$8H?? H?H?$0H?? ?H?$(H?$ ? H??7 L?$PL?H?$@H?Xq H?H?$8H?? ?H?$0H?? H?$(H?$ ? H??< L?$PL?H?$@H? q H?H?$8H?6q ?H?$0H?? H?$(H?$ ? ?t??:H?? A? ? H?+W A? L?? H?W ? H?$ ?? H?$PH?$pH?$xH?$? H?`_?? i s a b l e D i a l o g A P I ???D W m i g r a t i o n F C S O f f i c e M e t r i c s L i e ???S i e r r a W i r e l e s s H i d e C D R O M S q l 2 0 0 5 S q l 2 0 0 5 M M C S n a p i n ???S q l 2 0 0 5 S e t u p C o m p u t e r N a m e ???S q l 2 0 0 5 S p 1 E x t r a c t o r T e r m i n a t e Z T E F i l e A u t E x e ???H?$H?$WH? ?I?I?H???(H?$hH?tv?8 tqL?$0?T$pH?$8H?$@H? _??$PH?tNH?$X tFH?$X?i? ?u7H?$XH? ? ?#? H?$`L?H?? H??T$pH?H?$h? H?$8H?$@H? _?????$H?$H?$WH?@H?A?2 I?H??H?-? H?L?2 HE?? H?$0?$(H?wU A???$ ?x? ?? H?? H?-? ? ?> H?H? p H?t}? H?IU A?4 H?H?? L?? H?H???H?? H?3??? H?(?A??D$(H?U H?$ ?? ?:H??> H?bn H?????3??#?du?=oo t3??_o H?`o H?$PH?$XH?$`H?@_??DisableDialogAPI ????S_DisableDialogAPI::InitializeHooksMulti ???DialogBoxParamW ??????? H?H?@?F H?0?F H? ?F H??F H?H? [?F ?????H?H3??$XL?Z H?$0H?$PD?H?$(?$PH?$ H?W H? ??$X ?r? ?u9D$Pv ? H?H?3??H????D o n t S h i m D W ?????S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ W i n d o w s E r r o r R e p o r t i n g \ D e b u g ???H?$H?$H?$H?$ AVH?@H?I?H??L?5? L?M I?A? HE??) H?$0?$(H?yR ? H?$ ?y? 3??uCH?u!L?5? 3??; ? H?m H?u9? H??<< H?? H?u? 3?? ?du9 ? u?? ?? ?u@?uvH?? L?? H?? H?$(H?/R ?A? ? H?$ ?? 3?B?u6H?t? H?? L?S H?< A? ? ?$(H?$ ?? H?;l H?$PH?$XH?$`H?$hH?@A^?Wmigration ??NS_DWmigration::InitializeHooksMulti ????????????$???H?? H?????H?$? H?? H3??p 3?\$P?d? ????? ??3??`H?????H?$X3??$`H?$h?? L?H??1; ??`H?? H??? ?? ? H?`?p? ??= ?: ?? H?`H?$p?B ??????B ??H H?$p?D H?$(H?`H?$ A? L?SP H??3??? ?tH??????$p?G ??? H?H?$p?C H?$p?G H?AP H? ? ?? H?$XH?$HH???$@H?$8H?$0?$( ?$ E3?3??$p3?? H?$XH?t)???Y? H?$PH?$X?Y? H?$X?? H?$XH?$`H?t ?? H?$`?$P?"? ??? ??? H?p H3? ??H?$? H?? ]??- c ?\ d w w i n . e x e _ _ C O M P A T _ L A Y E R ?H?? ???H?p?A ???? ?A ????????????WAVH?? H?$? ???H?Xa H3??$? I?E??H?H?$x?$HD?$@H?$pH?? ?r? ?? H?H?$P?@ ??? H?$`?@ ??$`?G H?? H?$`?B H?$? H?$`?? H?L?? H?? H??u9H?? H?$ D?G??? ??$`?@ ??$P?@ ? ? H?? H?$ A? A??p? H??G? H?? H?$P?@ L?$PA???c??? ?xH?$`?? ??$P?? 3?H?$PH?$0H?$(H?e H?$ A? L?? H?? A??? ??$`?? ??$P?? ? ?)H?$x?$HD?$@H?$pL?E??H?H?Hg ?P??$? H3????H?? A^_^[????????{ 2 D 9 E 6 5 B 5 - E 6 F E - 4 2 3 9 - 9 F 3 3 - D 0 C 6 7 8 1 9 F 0 F 1 } ?g p m c . m s c ???????Error: CString error while applying FCS shim. GPMC.msc not found. ???PMC.msc found ?????rror: FCS could not convert lpProductBuf from "%s" to "%S". Converted string length is greater than the maximum buff size. ???P?= ???`?= ???$UH?@H?H?4 H?$ A? L?? H?? A??? ????H?@]??Error: CString error while applying FCS shim. ?????? H??J H??? ?u ? H? [??e H?H? [H?`H????H?$H?$H?$WH?@H?I?H??H?- J L?O H?A? HE??? H?$0?$(H?? ? H?$ ?? ?? H?? H?-Zc ? ?<3 H?H?fd H?? ? L? ? L?? L?L?0H?? H?L? ? H???L?8H?3??? H?(H?H?PH?XL? ???H?#I L?@?A? ?$(H?dI ? H?$ ?4| ?:H??"3 H?? H?????3??#?du?=? t3??? H?? H?$PH?$XH?$`H?@_???S_FCS::InitializeHooksMulti ??siEnumRelatedProductsW MsiQueryProductStateW ???H?8E3???A? ?H=??E?EG??x M??9 H?8??H?tfD?H?8??????H?$WH? H?? I???P?t/?)u*?# ? ?????T ?X ?\???H?$0H? _?????H?$H?$H?$WH?@H?A? I?H??H?-? H?L?2 HE?? H?$0?$(H?wG A???$ ?xz ?? H?? H?-? ? ?0 H?H?? H?t}? H?IG A? H?H?? L?? H?H????H?? H?3??? H?(?A??D$(H?G H?$ ?? ?:H??0 H?J` H?????3??#?du?=?a t3??/a H?0a H?$PH?$XH?$`H?@_??OfficeMetricsLie ????S_OfficeMetricsLie::InitializeHooksMulti ???SystemParametersInfoA ???H?(H?? ?PH3??D??(?????H?(H?u` ?P3??D??(?????H?$H?$H?$WH?@H?A? I?H??H?-? H?L?^ HE??; H?$0?$(H?{E A???$ ?|x ?? H?? H?-? ? ?. H?H?? H?? ? L? ) L?? L?L?0H?$ H?L? ) H????L?8H?3??? H?(H?H?PH?XL? ???H?? L?@?A? ?$(H?? A???$ ?? ?:H??. H? ^ H?????3??#?du?= _ t3??? H?? H?$PH?$XH?$`H?@_????ierraWirelessHideCDROM NS_SierraWirelessHideCDROM::InitializeHooksMulti ????ernel32.DLL ??etDriveTypeW ?GetDriveTypeA ???H?$H?$WH? H?6^ ?H??P?H?t ?H?? ? H?$0?H?$8H? _?????$H?$H?$ AVH?@A?D?L?? H????I?H??Sv H?? H?$PH?$pL?D?A?H?H?$ ????fH?3??$097vVH?-? L?$0H?vD E3?3?D$ ?? L?? H?? A? ? H?$ ?? H?$0??;7r???$PH?$XH?$`H?$hH?@A^?@ ??????OMHook_IEnumWbemClassObject_Next ???IEnumWbemClassObject::Next hooked ???S_Sql2005::COMHook_IEnumWbemClassObject_Next ???H?$H?$H?$H?$ AVH?0E?H?L? H????I?H??@ ??? L?H?? H?$hL?E?H?$(H?$`H?H?H?$ A????? H?? H?? H? ? H??? ?u f?;u? tH?? A?2 ?0H? H??? ?uAf?;u;? t2H?? A?8 L?? H?? ? H?$ ?t ????H?$@H?$HH?$X?H?$PH?0A^????OMHook_IWbemClassObject_Get ?? S P r o d u c t S u i t e ?Disabling WEB SKU in OSProductSuite ??NS_Sql2005::COMHook_IWbemClassObject_Get ???? u i t e M a s k ??Disabling WEB SKU in SuiteMask ??????$H?$H?$ AVH?PI?L?L?? H????I?H??? L?H?? H?$? H?$`H?$? H?$@H?$8H?$? H?$0?$? L??$(H?$? L?I?H?H?$ A????JH?? E3??3?D$ ?Ir H?r L?? H?? A? ? H?$ ?.r ?H?$`H?$hH?$pH?$xH?PA^?@ ???COMHook_IWbemLocator_ConnectServer ???WbemLocator::ConnectServer hooked IID_IWbemServices ??S_Sql2005::COMHook_IWbemLocator_ConnectServer ??????$H?$H?$ AVH?0A?L?L?? H????I?H??3q H?? H?$@H?$`L?D?I?H?H?$ ????JH??? E3??3?D$ ?? H?{ L?? H??= A? ? H?$ ?? ?H?$@H?$HH?$PH?$XH?0A^?@ ????OMHook_IWbemServices_CreateInstanceEnum ????WbemServices::CreateInstanceEnum hooked ????S_Sql2005::COMHook_IWbemServices_CreateInstanceEnum ?????$H?$ WATAWH?`I?H?L? H????A?L??? L?H?? H?$? H?$? H?$? H?$8H?$? L?$? L?$? D?L?L?$0H?I?H?$(H?$ A?????3 ??+ H? ?= H??? ?? H?3?L?$@H?.= E3??H?$(H?$ ?P ?? f?$@? H?$HH?[ ?=o ?? H?L?$@H??< E3??H?$(H?$ ?P ?? f?$@? H?$HH? = ?? ?uuI?L?$@H??< H?E3??$(H?$ ?P ?xOf?$@uG?$Hu@L?I?I?? ?u.I?? ?$H f?$@H?L?$@H??< E3?|$ ?P(H?? L?? H??: A?= ? H?$ ? n L?$? H?$? ???@ ?L?$`I?0I?8I?A_A\_?COMHook_IWbemServices_ExecMethod ???????? Y S T E M \ C u r r e n t C o n t r o l S e t \ S e r v i c e s \ I I S A d m i n ?IWbemServices::ExecMethod ???NS_Sql2005::COMHook_IWbemServices_ExecMethod ?????SH?? I?????H?ZR H?$P3??$XA??3??`I?????H?$`3??$hH?$pH?$P?3 ??7 H?Q H?$P?. H?$P9Z?D??$`H?$HH?$? H?$@H?$8H?$0?$( ?$ E3?3?3?Pm L?1 H? 9 ?? H?? H?$ A? ??l ??H?$`?? H?$ H?$`?? ?$ L?? H??8 ?u H?? H?$ A? ??? ?!?$(H? H?$ A? ? ?? H?$`? m H?$h?m ? H?8 H?$ A? ? ?jk ??$P?+ ? H?? [??????s y s t e m 3 2 \ i n e t s r v \ a p p c m d . e x e s e t c o n f i g " D e f a u l t W e b S i t e / R e p o r t S e r v e r " / s e c t i o n : h a n d l e r s / a c c e s s P o l i c y : R e a d , S c r i p t ?????[LoadPerfCounterTextStringsW] Createprocess on appcmd.exe successful ??S_Sql2005::GrantReportServerPermissions ????LoadPerfCounterTextStringsW] appcmd.exe exited successfully ??????LoadPerfCounterTextStringsW] appcmd.exe exit with a failed dwReturnCode 0x%x ?[LoadPerfCounterTextStringsW] appcmd.exe failed H?P?( ???$UH?PH?H????H?P]???????? H?$? ????H?H?$x?( ??$x?? ? H? ?i H?? H?$xH+????? ?? ? H?? ?? H?? H+D$xH???? ?? H?? H?$P3??$X?$? 3??`H?$? ???H?$`3??$hH?$pH?$P?/ ??7 H?? H?$P?) H?$P9Z?D??$`H?$HH?$? H?$@H?$8H?$0?$( ?$ E3?3?3?? L?? H?k4 ?? H?D H?$ A? ??xg ??H?$`?Rh H?$ H?$`?Oi ?$ L?I H?4 ?u H?O H?$ A? ??#g ?!?$(H?n H?$ A? ? ? g H?$`?mh H?$h?bh ? H?? H?$ A? ? ?? ??$P?& ??$x?& ? H? [?Q 1 8 8 7 6 9 r s c t r . i n i ??????S y s t e m 3 2 \ i i s r e s e t . e x e ??[LoadPerfCounterTextStringsW] Createprocess on IISReset.exe successfull NS_Sql2005::IISReset ??LoadPerfCounterTextStringsW] IISReset.exe exited successfully ?LoadPerfCounterTextStringsW] IISReset.exe exit with a failed dwReturnCode 0x%x [LoadPerfCounterTextStringsW] IISReset.exe fail H?x?$ ???P?$ ???$UH?PH?H?J??H?P]?????$H?$H?$WH?@H?I?H??H?-?1 L?; H?A? HE??1 H?$0?$(H??1 ? H?$ ?? ?? H?? H?-? ? ? H?H?? H?? ? H?? 3??H?? H?H?Y??H?3??? H?(H? ? ??c H? ? H????L?? H?? A? H?$ ?? ??/ H? ? H?d??L?U2 H?? A? H?$ ?? ?? H? ? H????L? 2 H?? A? H?$ ?? ?? H? QI H????L??1 H?\ A? H?$ ?Sc ?? H? I H???L??1 H?' A? H?$ ? c ?t_?L?? H??/ ?$(H?0 A? ? H?$ ?? ?:H?? H?8I H????3??#?du?= J t3?? J H?J H?$PH?$XH?$`H?@_?NS_Sql2005::InitializeHooksMulti ????OADPERF.DLL ??oadPerfCounterTextStringsW ??W B E M P R O X . D L L ?????s?? ? K.$?E: ?? ? K.$????H?$H?$UWATAVAWH?H?`I?E3?H?J H??? H?L?L????/ A? E3??A?L?8D?$ fD??P(H?[ H???L????/ E3??fD???$ ?P(L?$8H?8L?v/ H?$0H?* E3??H?$(L?$ ????$ H?8L???a/ H?E3??$(L?$ ?P ?? f??? ??? H?8H??PH?? L?????H??. E3??L?8fD???$ ?P(L?$8H?8L??. H?$0H?{ E3??H?$(L?$ ???? H?8L????. H?E3??$(L?$ ?P ?? f??? ???6 H?8H??PH?A L?????H?'. E3??L?8fD???$ ?P(L?$8H?8L?. H?$0H?? E3??H?$(L?$ ???? H?8L???. H?E3??$(L?$ ?P ?? f??? ??? H?8H??PH?? L?????H?x- E3??L?8fD???$ ?P(L?$8H?8L?i- H?$0H? E3??H?$(L?$ ???? H?8L???T- H?E3??$(L?$ ?P ?? f??? ??? H?E L????, H???E3??fD???$ ?P(L?$8H?8H?$0L??, H?| E3??H?$(L?$ ???? H?8L????, H?E3??$(L?$ ?P ?? f??? ???7 H?? L???9, H???E3??fD???$ ?P(L?$8H?8H?$0L?", H?? E3??H?$(L?$ ???? H?8L???, H?E3??$(L?$ ?P ?? f??? ??? H?C L????+ H???E3??fD???$ ?P(L?$8H?8H?$0L??+ H?: E3??H?$(L?$ ???8H?8L???u+ H?E3??$(L?$ ?P ?xf??u ? 9E?D??8H?t H??PL?8L?H?? L????* E3??fD?????$ A?R(L?H?+ L????* E3??fD?????$ A?R(L?$`I?0I?@?I?A_A^A\_]??? o f t w a r e \ m i c r o s o f t \ i n e t s t p \ c o m p o n e n t s ??A S P N E T ?S t d R e g P r o v ?M e t a b a s e ???W M I C o m p a t i b i l i t y ???W i n d o w s A u t h e n t i c a t i o n ??S t a t i c C o n t e n t ??D e f a u l t D o c u m e n t H t t p R e d i r e c t ???????S y s t e m \ C u r r e n t C o n t r o l S e t \ S e r v i c e s \ I I S A D M I N ?????? H?? UA ??t ? ?? H?H? [????? .A ??t3??%`\ ????????H?$H?$WH? H?H?tx? ? ??tm? \ H?tbH??H???<^ u??? H?H?uDH?t?H??O\ H?H?t.L?H?H?????xH?H?$0H?$8H? _???!\ H?BA H?H?$0H?$8H? _H?`???????0H?$ ???H?$@H?$HH?H?L?V H?????? H?H?t,H?$P?????H???? @ ??t3?9[ ???@ ?H?$@H?$HH?0_?OMHook_ISqlManager_GetProvider H?P?????????0H?$ ???H?$@H?$HH?H?L?Z H?????? H?H?t,H?$P?????H???? Z? ??t3?? ???@ ?H?$@H?$HH?0_???OMHook_ISqlManager_GetSnapinDescription ???P?????????0H?$ ???H?$@H?$HH?H?L?V H?????!X H?H?t,H?$P?????H???? ?> ??t3?? ???@ ?H?$@H?$HH?0_?OMHook_ISqlManager_GetSnapinVersion ???P????????$H?$H?$WH?@H?I?H??H?-q$ L?C H?A? HE?? H?$0?$(H?G$ ? H?$ ?GW ?uIH?u%H?-?= ? ? H??> H?t ? ?7H?? H?i= H?u?3? 3?? ?du?=E> u?9> ??: ?uI?? H?&> 3??? H?$(H??# H?Z ?A? ? H?$ ?? 3?" ?? H??= 3?? l H?H? r 3??H? ???H?H?H? f ? H?(?)V H? < H???D?L?` H?i H?$ ? V ?????H? ?; H?<??D?L?- H?6 H?$ ?? ????H? ?; H?q??D?L?? H? H?$ ?? ????H?t? H??" L?[ H?< A? ? ?$(H?$ ?rU H??< H?$PH?$XH?$`H?@_????ql2005MMCSnapin ????S_Sql2005MMCSnapin::InitializeHooksMulti ???OLEAUT32.DLL ??ysAllocString ? q l M a n a g e r . D L L ?? EQ?? ?? ?;VVB_??<*C(?????H?(?t0??G?VV ? ; ??t3??QV ? H?(?3??(? ?: ??t?V ??: ????? H?(????H?u; 3??`?????$H?$H?$WH?@H?A?< I?H??H?-? H?L?2 HE?? H?$0?$(H?? A???$ ?? ?? H?? H?-?9 ? ? H?H??: H?t}? H?? A?> H?H?? L?? H?H?+???H?? H?3??? H?(?A??D$(H?^ H?$ ?3S ?:H??! H?r9 H?????3??#?du?=?: t3??/: H?0: H?$PH?$XH?$`H?@_??Sql2005Sp1Extractor ??NS_Sql2005Sp1Extractor::InitializeHooksMulti ??ernel32 ????reateDirectoryA ?????$H?$H?$WH? ?=: I?I?H??u??9 ? H?z9 L?L?H??H?$0H?$8H?$@H? _H?`?????$H?$H?$WH?@H?I?H??H?-? L?? H?A? HE??g H?$0?$(H?? ? H?$ ?? ?uIH?u%H?-?7 ? ? H??8 H?t ? ?7H?? H??7 H?u?3? 3?? ?du?=?8 u??8 ?? ?uF?? H?n8 3??? H?$(? H?O H?? ?A? H?$ ?? 3?v?ujH?,8 H? ? H?H? ? H?H? X??H?3??? H?(H?t? ?$(H?? L?^ H?7 A? ? H?$ ?yP H??7 H?$PH?$XH?$`H?@_???Sql2005SetupComputerName ????S_Sql2005SetupComputerName::InitializeHooksMulti ???MsiGetPropertyW ????H?X H??/ H3??$@ ?uMH?$ 3?? ???H?$ ?$ ?]Q ?t$??$: u3??$@ H3?}??H?X ? H?$@ H3?`??H?X ???????P3???$ D?0???L?$pH?$ A? 3?0Q ?u?H?$pH?t5L?$h??,Q ?u#L?$hH?$ ?M??8Q H?$h?? H?P[????C o m p u t e r N a m e ???H?$H?$H?$H?$ AVH?@H?A? I?H??L?5u I?L?4 HE??I H?$0?$(H?Q A???$ ?RN 3??uCH?u!L?5?4 3?? ? H?_5 H?u9? H?? H?^4 H?u? 3?? ?du9 )5 u? 5 ?? ?u>?usH? 5 D?ML?? H?$(H? H?? ?? H?$ ?? 3?A?u5H?t? A? H?? L?@ H?Y A??\$(H?$ ?nM H??4 H?$PH?$XH?$`H?$hH?@A^???S_TerminateZTEFileAutExe::InitializeHooksMulti ????H?8??? ?%4 t? A?* H?y L?? A???? H?$ ?? ?? H?tCH?$@H??$@ ?0 ?$@H?~H?f?82u?BN 3?zN ??t?.N ? H?8???ApiName] Mitigation Success ??S_TerminateZTEFileAutExe::NotifyFn ????L?H?xH?, H3??$`H?? M???l I???? A? I???? 3????S I?? I?? I?? I?? I??? H?$`H3????H?x?????> (ShimLib) Mitigation Success ??piName Unknown ????H?$H?$WH?PM?H?L?? H????D?L? p E?H?H?? LD?? \ H?? L?$@HD??$8H?$0H?? L?H ? A? H?$(H?$ ?? H?$`H?H?$hH?P_??") ?(" ?%S%s%s%s ???ShimLib::GetHookAPIs ??himLib ???????wHL?B??Hc?? f A?? f I??d ?/??? ?%??? ???? ????e ? ? ? ?e ????L?$SH? L?$@?0 ?' H?H?tL?$@3???4??H?H? [????M?tI? H?H?H?t3?M?tI? eH? %` L?? H?0H?%? ???????H?u3?H??H??< u? ??????? H?H?tV??tQ?L?$0? H?$@????H?H?t$H?$8H?$0H?L?H??????H?$8?9 H?H?$@H? ^?3?? ^??????$SH?0H?$ ???H?H??- H?3??H??- H?H?H??- H? H?(H??- H?0H?8H??- H?@H?HH?? ??H?0[??@? ???@H?? ???@H? ? ???@H?0? ???@H?@? ?????I?UVWATAUAVAWH?pI?????I?I?L??$? E3?A?H??, I?????$? M?? fE98? H?I?? H?$0L?$(H?H H?$ A? L?n H?? A?? G eH? %` A?A? H?0?? H?H?$? H?? H?H?E?f?>"u8D?$? H?H?$@?f?tLf?"tH?H??f?u?5A? ?*H?$@?f?t f? tf? tH?H??f?u?H?D?'fD??H?$PH?$(H?$ A? L?| H?$@3?'G D?E?t/A? sH?$? ?? ??t?uA?A??= v3fD?'f?; tK?$? tAH?H??$? H?$? E3??8???H?H+\$@H?A??$? ? ?E?sE?uFH?H?tH?? H??? H? FH?f?; t*?f? tf? t H?f?? u?D?'?H?3??H?H?$X? H?H+??B? (H?$XfD?'I?? M? H?^I?? I?? M?<$A??VE ?tI?A??DE ?u?? $L;?'I?H+????+?CLc???? E I?$???$? 2?E?uI?I?@? ? 3??H??H???<F u??Lc???eH? %` ? H?0?E H?H?u 3??? L?? I?H?????x??t D?'3??L?I?H??3 ?x??? I?H?? ?x??tfD?'L?I?H?? I?@H?? eH? %` L?3??0?vD eH? %` L?$? 3??0?YD I?I?H?$0H?$(H?1 H?$ A? L?? H? ? ?uC I? H?$(H?5 H?$ A? L?? H?? ? ?AC ?'H?? ? I?I?? I? I??? A?H?$X? ?H?$? H?pA_A^A]A\_^]? ???[AppAndCommandLineT::Set] BEFORE App(%S) CL(%S) ????himLib::AppAndCommandLine::GetAppnameAndCommandline ??ommon ?" ??[AppAndCommandLineT::Set] AFTER App(%S) CL(%S) ????AppAndCommandLineT::Set] CL without App(%S) ?H?X? ??????0E3???? ?H=??E?L?DG??xDH?E?H?tfD9 t&H?H????E?x"K? KI+???$ H?0[??t??L+???H?0[?????3??E?H?t????L+??t-E? fE?t"fD? H?H??????A? ?fD?A???u H?A? ?fD?A??????????? H?H??? |?@??H? H?H?H? [??L& H? H?H?? H?H? [??????$H?$WH? H?& H?H? H?H?H?? Hc?? ?H?? H? L?M???? H?$8H?H?$0H? _????H?$WH? H?H? H??% H??;??? H? H? ? H?H?t ?? L?3???uA H? H?$0H? _?????$WH? H?H?H? H?H;?TH??9 } H?% H;??? } ???H?? H?H?$0H? _??? H??@??H? H?H?H?$0H? _??????? H?H?L?? H???" H?H? [???????? H?H?L??, H???" H?H? [?????H?$ AVH? Hc???? ~?$8H?? H?$8?$8????? H?1$ 3??H?H?$HH? A^??$0H?$@?@}? ? ? ;?? ;? ? ?;?L????? u H#??? L?H?3??? H?$0H?t*?H?$@? 3?? f?x???$HI?H? A^??$8H?? H?$8?$8????????? H?$WH? L? H?3?cA??E?~C?A??\tf?/u? ??? f?\tf?/u? f?tbE?tHA?u fA?:u?t?u?u.L?G ? H?? ??t?H?f?\t??/t??? L?H??? H?$0H? _? ??????????H?$H?$WH? H?I?Hc?x?H?;x?? ?H????H?tH? L?H?M?$= H???? H; 4" t3??yH?$0H?$8H? _??????$H?$H?$ WH? Ic??Hc???xnE?xi?;;?G?t.???H?H??H???< H?H?$PL?H???< H?$0H?$@H?$HH? _??$8H?? H?$8?$8?????$8H?? H?$8?$8????????? H?$WH?0Hc??H?$@??H???H?G??;?@HcJ?+?;?6H? JL?I?M??; H?H?$@X??3?cA??AH?$HH?0_??$ L????H????H?? H?$@H?$HH?0_?????$WH? H?H?H??;~4? H?? H;?#?H?????H???? Lc??K; H?$0H? _???????@H?$ ???H?$PH?E3?3?? ?< ??t}H?& H?$(H?$0 ?H?$(? D?H?H???; ?t2;?.??H?$(?8 H?$(H????H????$(?????3??$(? ??$(???3??$PH?@_??H?(????????? H???; L?H?3?? [H?%u; ????????$WH? H?H???H??;P?>H?$0??;?L????H??Lc?? M??9 H?H???; H?H?$0H?$8H? _??????$WH? H?? 3?3?T: ??t)?????????H??7: H?;???3?? H?H?$0??? _????????????$WH? H??> 3?3?T: ??t)????????H??7: H?;???3?? H?H?$0??? _??????? H?H? H?? H??;?$?? H? H? ???H?? H? H?H? [?????? H;? ???*???????H?$WH? ?H??????uH?H??H???<X u??Hc?3?X??H?$0f?HH? _?????H?t?? ?f?9 t H?H???3?H?t?+???????? H????H??? ~H????H?3??H???? [?????H?$H?$ AVH?` H?R H3??$P 3??H??H?$@A? 3?D$0f?$H ??8 f?; H?$4H?$@L?$0H?$ HE?3?3??? ?tn?$0????H?H;?\?$4H?H;?O?;?H? ?p8 H?H?t5HcD$0L?$0H?L???$4H?H?$ ? ?t?$0???H??3??$P H3?y??L?$` I? I?(I?A^????H?$ VAVL?$8A?1E3??+L?A? E?3H?t ?|0L?I?H?$A??" ?f;? ?A??H????-?3??$0A^^??M?t A9+0fA? I??H?f?t,?u?? tf? u??tfE??3??$H?$0A^^??H?$ L?$(A? A?fD91? ?f? tf? uH??fD91? A?M?tA91? M?I?? A?fD99u H???D99t??9"u'?u!?tf?"H?uH?? ?A?A?????t A????tA9+? fE?8I??u??f?t2?u f? t(f? t"?tA?M?t A9+\fA? I?H?????A?M?????A9+:fE?0I????A?M?tA91 M?2? H?$ L?$(H?$H?$0A^^?3????????pplication Specific Shims initialized. NotifyFn ????cSpecfc ????pplication Specific Shims uninitialized. ???????? ? ? ? ? ??? ? FCS ??Sql2005 TerminateZTEFileAutExe fdwReason(%d) pszCmdLine(%s) ??SER32.DLL ???dwHookCount(%d) ????. e x e ???NotifyFn returned FALSE, fail load shim ???{ A B A B A B A B - C D C D - E F E F - 0 0 0 0 - A B A B A B A B A B A B } ?NS_FCS::APIHook_MsiEnumRelatedProductsW MSI.DLL s S u b K e y N a m e s V a l u e N a m e ?G e t D W O R D V a l u e ??u V a l u e ?s t a r t ????s?? ? K.$?y1?? ?V??? ? 2@? (? ???? ?? ? ? ?? ? l?R @ , 4 < ? ? I U NULL.dll GetHookAPIs NotifyShims ?? l?R % ? ? l?R6? ? ? UGP??SDS?t?:? O??Z?$ AcSpecfc.pdb ?? t T 4 2??? d 4 2 p 4/ ( ?p` ? 9 9 Y s d s ? ? ? ? ? ? ? ? h + 7 ? 7 X r r ? ? d ? ? ? ? R0 B 20 4 2p 4 2p? - ` ? ` 4 2P t d T 4 2? 2P! ? d T 4 ?p d T 2 p d T 4 rp ? t d T 4 r?2 !4r p P L ? r + _ ?p`0L X? ? rP? X? b d T 4 r?! t ?9 ?9 ? ! ?9 ?9 ? t d T 4 R? d T 4 ??! t = Q= $? ! = Q= $? d T 4 R?! t ?> ?> \? ! ?> ?> \? d T ?? ? p!% %? 4 @ [@ ? ! @ [@ ? 0 ? H? ?P? H? 0 ? ? ?P? ? d 4 ???? p P d 4 Rp? ? d 4 Rp? ? d 4 Rp? ? d T 4 2p + ? @ ?0 ? ? ` d 4 ? p 20 2`! t 0g Pg ? ! 4 Pg bg ? ! Pg bg ? ! 0g Pg ? R0? h? " "4 ???? ? p `P? ? t 2?! d 4 q tq \? ! d q tq \? ! d q tq \? 4 2p d T 4 2p 4 Rp! d 0t Ht ? ! d 0t Ht ? ! 0t Ht ? 4 rp? 8? d 2p! 4 0v Ov ? ! 0v Ov ? % dQ 4P L ? ? P T ?`! 4 ? ? t? ! ? ? t? ! 4 ? ? t? ! ? t 4 ? ? t? ! ? t 4 ? ? t? "? ? 0? ? ????X. d. p. ?+ ????t, ?, ?, ?- ????"? ?? ? ? ? ???? ?1 ?1 ???? ?. ?????. ?. / m/ x/ ?/ ?/ ?/ ?/ /0 :0 K0 ????t0 2 @2 4? (? 2 X "? p? ? ? x ???? G ???? C ????/C BC ? ? ???? G ? (? G h "? ? h? (? ? ???? ? ? ???? 0G ????GG UG ? NI YI dI ????K |? (? K h "? ? ? ????? TV ????? ? ????"? ? ? ????? W ????FW PW ????"? H? P? ????`X ? ????X X ????"? ? ? ????h $h 4h Dh Th ? ????? ? ? ? h h ????"? ? ? H ????n hh ????? m ????"? `? h? ????? 8u ????xu ? ????? ? ???? 2?-?+ ???? ? ? ???? ? ???????????????????????????????????????????????????????????????????????????????????? ? .?AVCStringError@CString@ShimLib@@ } ? } ? } ? } ? } ? } ? } ? } ? } ? } ? ???? p ? p ? ? ? ? ? ? 0 ? ? , ? ` ? ? ? ? ? ? T ? p ? ? m ? ? ? ? ? ? ? ? L ? L ? ? b ? d ? ? ? ? g ? h ? ? ? ? b ? d ? ? ? ? ? ? ? 7 ? 8 ? 9? ? ? 9? ? @ 9? @ h 9? h ?! 9? ?! % ,? ?& @' @? @' ?( P? ?( 4) ? 4) ?) d? 8* ?+ l? ?+ . ? ?. ?0 ? 2 M2 ? ?2 ?2 ? ?2 <4 P? ?4 ?4 ? ?4 @5 ? @5 ?6 P? ?6 7 ? 7 <7 ? <7 ?8 P? <9 ?9 ? ?9 ?9 ? ?9 T: ? T: r: ? ?: *< ? = Q= $? Q= ?= 8? ?= > L? ?> ?> \? ?> X? p? X? v? ? @ [@ ? [@ $B ? $B ?B ? C ? ? G 0G ? 0G oI ? K (K ? (K ? P? 0N ? ? LU tU ? ? TV ? TV ? 0? W |W H? ? 8X `? pX ? P? x[ ? ? ? =] P? ? ^ x? ^ ? P? 0` ? ? ? 9a ? `a ? l? c ? ? ? ? ? ? ne ? ? ? ? 0g Pg ? Pg bg ? bg ? ? ? ? ? ? ? ? ? h ,? hh $m <? (n ? ? o ho ? ho ? ? ? <p ? <p ? ? ? ? ? ? q ? q tq \? tq ? h? ? ?q ?? ?q r ? r ? ? s |s ? |s 0t ? 0t Ht ? Ht ? ? ? ? ? ? ? ? ? 8u ? 8u ? ? v 0v ? 0v Ov ? Ov ? ,? ? ? @? ? w ? w tw ? tw ? ? ? 'x ? `x ? ? ? ? P? ? ? t? ? z ?? z z ? z iz ? iz ? ? ? ? ? ? $? 8? H? V? h? x? ? ? ? ? ? ? ? ? ? ? "? .? 8? @? J? X? f? x? ? ? ? ? ? ? ? ? (? B? R? l? ? ? ? ? ? ? ? "? :? P? ^? j? |? ? ? ? ? ? ? ? ? ? ? ? .? <? R? b? r? ?? ? ? ? ? ? ? ? ? ? 8? `? |? ? ? X? ? ? H? ? ? 8? ? ? ,? H? ? $? `? msi.dll ole32.dll ADVAPI32.dll KERNEL32.dll api-ms-win-core-registry-l1-1-0.dll ntdll.dll msvcrt.dll apphelp.dll ? $? 8? H? V? h? x? ? ? ? ? ? ? ? ? ? ? "? .? 8? @? J? X? f? x? ? ? ? ? ? ? ? ? (? B? R? l? ? ? ? ? ? ? ? "? :? P? ^? j? |? ? ? ? ? ? ? ? ? ? ? ? .? <? R? b? r? ?? ? ? ? ? # SE_COM_AddServer % SE_COM_HookObject & SE_COM_Lookup : SE_ShimDPF " SE_COM_AddHook 0 SE_GetShimId L _CxxThrowException \ __CxxFrameHandler3 ?memcpy ? _amsg_exit ?_wcsicmp wcsspn yiswspace ?memmove wcsstr ??1type_info@@UEAA@XZ X __C_specific_handler ~_initterm ?malloc Mfree ?memset V _XcptFilter ?RtlFreeHeap ?RtlAllocateHeap iRtlVirtualUnwind ]RtlLookupFunctionEntry ?RtlCaptureContext RegGetValueW ?WaitForSingleObject ?SearchPathW ?GetSystemDirectoryW ?GetCommandLineW ? CreateProcessW ?SetEnvironmentVariableW ?GetTickCount ?GetSystemTimeAsFileTime GetCurrentThreadId 0QueryPerformanceCounter nTerminateProcess GetCurrentProcess PSetUnhandledExceptionFilter ?UnhandledExceptionFilter _Sleep [ExpandEnvironmentStringsW GetWindowsDirectoryW iGetModuleFileNameW CloseHandle <HeapFree ?GetProcessHeap 8HeapAlloc <GetFileAttributesW ?LocalAlloc GetCurrentProcessId ?LocalFree GetVersionExW ?TlsFree ?TlsAlloc ?TlsGetValue ?TlsSetValue nFindClose yFindFirstFileW WExitProcess 3GetExitCodeProcess ?LsaOpenPolicy ?LsaFreeMemory #EventWrite ?LsaQueryInformationPolicy ~ CoTaskMemAlloc CoTaskMemFree ? 0 ? H `? p p4 V S _ V E R S I O N _ I N F O ?? @?% @?%? ? S t r i n g F i l e I n f o ? 0 4 0 9 0 4 B 0 L C o m p a n y N a m e M i c r o s o f t C o r p o r a t i o n \ F i l e D e s c r i p t i o n W i n d o w s C o m p a t i b i l i t y D L L r ) F i l e V e r s i o n 6 . 3 . 9 6 0 0 . 1 6 4 1 2 ( w i n b l u e _ g d r . 1 3 0 9 2 5 - 1 9 5 8 ) I n t e r n a l N a m e ? . L e g a l C o p y r i g h t ? M i c r o s o f t C o r p o r a t i o n . A l l r i g h t s r e s e r v e d . ( O r i g i n a l F i l e n a m e j % P r o d u c t N a m e M i c r o s o f t ? W i n d o w s ? O p e r a t i n g S y s t e m B P r o d u c t V e r s i o n 6 . 3 . 9 6 0 0 . 1 6 4 1 2 D V a r F i l e I n f o $ T r a n s l a t i o n ? H???? p ??? ? ?(???????????
Ms-Dos/Windows
Unix
Write backup
jsp File Browser version 1.2 by
www.vonloesch.de