ElfFileE廇ElfChnkXXh(BDn=f?mMFG** Q"@Q io&iozZgAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannelBF;nComputerWIN-3PIMCL4OH3LAB.SecurityfLUserID ! Ph!Q"@Q 1 J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational AG&At-Lj5S5>nD EventDataA3oData=Flags A)= SidLength A=Sid A3%=FileNameLength A3%=FileNameBuffer AC5=ProcessImageNameLength AC5=ProcessImageNameBuffer A!=Error hJ-N*4\Device\HarddiskVolume2\Windows\SysWOW64\kscrsvr.scro\Device\HarddiskVolume2\Users\Administrator\AppData\Local\Kingsoft\WPS Office\10.1.0.7566\office6\wpscenter.exe: **82 io& Ph!2 olJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational AGhJ-N*4\Device\HarddiskVolume2\Windows\SysWOW64\kscrsvr.scro\Device\HarddiskVolume2\Users\Administrator\AppData\Local\Kingsoft\WPS Office\10.1.0.7697\office6\wpscenter.exe:ro8**pDq2 io& Ph!Dq2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/s/f(uH#;t𕔖nA!=Flags A)= SidLength A=Sid A3%=FileNameLength A3%=FileNameBuffer AC5=ProcessImageNameLength AC5=ProcessImageNameBuffer DJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exep**Dq2 io& Ph-!Dq2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeivil**Dq2 io& Ph-!Dq2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe****Dq2 io& Ph-!Dq2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeebug**Dq2 io& Ph-!Dq2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exete**Dq2 io& Ph-!Dq2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeivil** Dq2 io& Ph-!Dq2 Mj| J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeL$WO** Dq2 io& Ph-!Dq2 Mj| J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeityP** Dq2 io& Ph-!Dq2 Mj| J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe ** Dq2 io& Ph-!Dq2 Mj| J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeSeAs** Dq2 io& Ph-!Dq2 Mj| J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.execros**Dq2 io& Ph-!Dq2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeI>;**Dq2 io& Ph-!Dq2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**Dq2 io& Ph-!Dq2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe!**Dq2 io& Ph-!Dq2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exentPr** 2 io& Ph/! 2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe3e** 2 io& Ph/! 2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeSeD** 2 io& Ph/! 2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exetia** 2 io& Ph/! 2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exerPr** 2 io& Ph/! 2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeOH3** 2 io& Ph/! 2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.execur** 2 io& Ph/! 2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe ** 2 io& Ph/! 2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe** 2 io& Ph/! 2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeMi** 2 io& Ph/! 2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe%Tx** 2 io& Ph/! 2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeo&** 2 io& Ph/! 2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe** 2 io& Ph/! 2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exenme** 2 io& Ph/! 2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe%18** 2 io& Ph/! 2 Mj| J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe **!42 io& Ph)!42 Mj|!J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exei **"42 io& Ph)!42 Mj|"J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeSe**#42 io& Ph)!42 Mj|#J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**$42 io& Ph)!42 Mj|$J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exebP**%42 io& Ph)!42 Mj|%J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeTx**&42 io& Ph)!42 Mj|&J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe$**'42 io& Ph)!42 Mj|'J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**(42 io& Ph)!42 Mj|(J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeMi**)42 io& Ph)!42 Mj|)J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeIm***42 io& Ph)!42 Mj|*J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**+[2 io& Ph)![2 Mj|+J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeiv**,[2 io& Ph)![2 Mj|,J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**-[2 io& Ph)![2 Mj|-J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exePr**.[2 io& Ph)![2 Mj|.J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeCL**/[2 io& Ph)![2 Mj|/J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe **0肅2 io& Ph9!肅2 Mj|0J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe **1肅2 io& Ph9!肅2 Mj|1J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**2肅2 io& Ph9!肅2 Mj|2J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeos**3肅2 io& Ph9!肅2 Mj|3J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeec**4肅2 io& Ph9!肅2 Mj|4J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**5肅2 io& Ph9!肅2 Mj|5J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**6肅2 io& Ph9!肅2 Mj|6J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeIm**7肅2 io& Ph9!肅2 Mj|7J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe&**8肅2 io& Ph9!肅2 Mj|8J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exedi**9肅2 io& Ph9!肅2 Mj|9J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exews**:肅2 io& Ph9!肅2 Mj|:J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe **;肅2 io& Ph9!肅2 Mj|;J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeOR**<肅2 io& Ph9!肅2 Mj|<J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeeg**=肅2 io& Ph9!肅2 Mj|=J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**>肅2 io& Ph9!肅2 Mj|>J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exege**?2 io& Ph'!2 Mj|?J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeSec**@2 io& Ph'!2 Mj|@J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeSY**A2 io& Ph'!2 Mj|AJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**B2 io& Ph'!2 Mj|BJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeft-**C2 io& Ph'!2 Mj|CJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exenat**D2 io& Ph'!2 Mj|DJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeo&**E2 io& Ph'!2 Mj|EJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe **F2 io& Ph'!2 Mj|FJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe--**G2 io& Ph'!2 Mj|GJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exege **H2 io& Ph'!2 Mj|HJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe$WO**I2 io& Ph'!2 Mj|IJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.execur**J2 io& Ph'!2 Mj|JJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exee **K2 io& Ph'!2 Mj|KJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeTHO**L2 io& Ph'!2 Mj|LJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe[9**Mх2 io& Ph'!х2 Mj|MJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeecu**N&2 io& Ph'!&2 Mj|NJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exee **O&2 io& Ph'!&2 Mj|OJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe****P&2 io& Ph'!&2 Mj|PJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exeSeD**Q&2 io& Ph'!&2 Mj|QJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exeNeg**R&2 io& Ph'!&2 Mj|RJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exeoad**S&2 io& Ph'!&2 Mj|SJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exeWI**T&2 io& Ph'!&2 Mj|TJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exeivi**U&2 io& Ph'!&2 Mj|UJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe>;**V&2 io& Ph'!&2 Mj|VJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe**W&2 io& Ph'!&2 Mj|WJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exeF**X&2 io& Ph'!&2 Mj|XJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/DJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exerost-Windows-Se io& PhleSYSTEMNT AUTHORITYL$WORKGROUPtyElfChnkYYvUn=f?mMFG&**H Y&2 io&iozZgAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannelBF;nComputerWIN-3PIMCL4OH3LAB.SecurityfLUserID ! Ph!&2 Mj|YJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/Gs/f(uH#;tnD EventDataA3oData=Flags A)= SidLength A=Sid A3%=FileNameLength A3%=FileNameBuffer AC5=ProcessImageNameLength AC5=ProcessImageNameBuffer DJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exeinH **Z&2 io& Ph'!&2 Mj|ZJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exendo**[&2 io& Ph'!&2 Mj|[J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe/f(**\&2 io& Ph'!&2 Mj|\J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exec.e**]@2 io& Ph'!@2 Mj|]J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll"\Device\HarddiskVolume3\tim_pc.exepc.**^@2 io& Ph'!@2 Mj|^J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll"\Device\HarddiskVolume3\tim_pc.exetim**_@2 io& Ph'!@2 Mj|_J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeme3**`@2 io& Ph'!@2 Mj|`J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeVol**a@2 io& Ph'!@2 Mj|aJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll"\Device\HarddiskVolume3\tim_pc.exedis**b@2 io& Ph'!@2 Mj|bJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeHar**c@2 io& Ph'!@2 Mj|cJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeice**d@2 io& Ph'!@2 Mj|dJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe\De**e@2 io& Ph'!@2 Mj|eJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll"\Device\HarddiskVolume3\tim_pc.exedll**f@2 io& Ph'!@2 Mj|fJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe1-0**g@2 io& Ph'!@2 Mj|gJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe-l1**h@2 io& Ph'!@2 Mj|hJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll"\Device\HarddiskVolume3\tim_pc.exesol**i@2 io& Ph'!@2 Mj|iJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe-co**j@2 io& Ph'!@2 Mj|jJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll"\Device\HarddiskVolume3\tim_pc.execor**k@2 io& Ph'!@2 Mj|kJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll"\Device\HarddiskVolume3\tim_pc.exewin**lnm2 io& Ph+!nm2 Mj|lJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exes**mnm2 io& Ph+!nm2 Mj|mJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exep**nnm2 io& Ph+!nm2 Mj|nJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe6**onm2 io& Ph+!nm2 Mj|oJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exes**pnm2 io& Ph+!nm2 Mj|pJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exes**qnm2 io& Ph+!nm2 Mj|qJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exen**rnm2 io& Ph+!nm2 Mj|rJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe2**snm2 io& Ph+!nm2 Mj|sJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exel**t2 io& Ph+!2 Mj|tJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exes**u2 io& Ph+!2 Mj|uJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exer**v2 io& Ph+!2 Mj|vJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exee**w2 io& Ph+!2 Mj|wJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exee**x2 io& Ph+!2 Mj|xJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**y2 io& Ph+!2 Mj|yJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**z2 io& Ph+!2 Mj|zJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**{2 io& Ph'!2 Mj|{J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**|2 io& Ph'!2 Mj||J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**}2 io& Ph'!2 Mj|}J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**~2 io& Ph'!2 Mj|~J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**2 io& Ph'!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**2 io& Ph'!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**2 io& Ph'!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**2 io& Ph'!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**2 io& Ph'!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**2 io& Ph'!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**2 io& Ph'!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**2 io& Ph'!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**2 io& Ph'!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**2 io& Ph'!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**2 io& Ph'!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**↼2 io& Ph5!↼2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*O\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**↼2 io& Ph5!↼2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*O\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**↼2 io& Ph5!↼2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*O\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**↼2 io& Ph5!↼2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*O\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**↼2 io& Ph5!↼2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*O\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**↼2 io& Ph5!↼2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*O\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**↼2 io& Ph5!↼2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*O\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**↼2 io& Ph5!↼2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*O\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**↼2 io& Ph5!↼2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*O\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**↼2 io& Ph5!↼2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*O\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**↼2 io& Ph5!↼2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*O\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**↼2 io& Ph5!↼2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*O\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**↼2 io& Ph5!↼2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*O\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**↼2 io& Ph5!↼2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*O\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**↼2 io& Ph5!↼2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*O\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**Z2 io& Ph9!Z2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**Z2 io& Ph9!Z2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exece**Z2 io& Ph9!Z2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeis**Z2 io& Ph9!Z2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exee2**Z2 io& Ph9!Z2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exews**Z2 io& Ph9!Z2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeW6**Z2 io& Ph9!Z2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exems**Z2 io& Ph9!Z2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeor**Z2 io& Ph9!Z2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe-l**Z2 io& Ph9!Z2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exedl**Z2 io& Ph9!Z2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeic**Z2 io& Ph9!Z2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exedi**Z2 io& Ph9!Z2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeme**Z2 io& Ph9!Z2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exepc**j2 io& Ph9!j2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*Q\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe **B2 io& Ph7!B2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*P\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exeP**B2 io& Ph7!B2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*P\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe**B2 io& Ph7!B2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*P\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe**B2 io& Ph7!B2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*P\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe**B2 io& Ph7!B2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*P\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe**B2 io& Ph7!B2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*P\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe**B2 io& Ph7!B2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*P\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exeh**B2 io& Ph7!B2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*P\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe**B2 io& Ph7!B2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*P\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe **B2 io& Ph7!B2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*P\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exeT AHORITYL$WORKGROUPtyElfChnk  axn=f?mMFG&**X B2 io&iozZgAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannelBF;nComputerWIN-3PIMCL4OH3LAB.SecurityfLUserID ! Ph!B2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/Gs/f(uH#;tnD EventDataA3oData=Flags A)= SidLength A=Sid A3%=FileNameLength A3%=FileNameBuffer AC5=ProcessImageNameLength AC5=ProcessImageNameBuffer DJ-N*P\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exeX **B2 io& Ph7!B2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*P\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe**B2 io& Ph7!B2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*P\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe**B2 io& Ph7!B2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*P\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe**B2 io& Ph7!B2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*P\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe**2 io& Ph+!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**2 io& Ph+!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**2 io& Ph+!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**2 io& Ph+!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**2 io& Ph+!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**2 io& Ph+!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**2 io& Ph+!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**2 io& Ph+!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**2 io& Ph+!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**2 io& Ph+!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**2 io& Ph+!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**2 io& Ph+!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**2 io& Ph+!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**2 io& Ph+!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**2 io& Ph+!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**-2 io& Ph1!-2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*M\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**-2 io& Ph1!-2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*M\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**-2 io& Ph1!-2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*M\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeP**-2 io& Ph1!-2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*M\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeh**-2 io& Ph1!-2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*M\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**-2 io& Ph1!-2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*M\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**-2 io& Ph1!-2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*M\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**-2 io& Ph1!-2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*M\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe **-2 io& Ph1!-2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*M\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**-2 io& Ph1!-2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*M\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**-2 io& Ph1!-2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*M\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exex**-2 io& Ph1!-2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*M\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**-2 io& Ph1!-2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*M\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**-2 io& Ph1!-2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*M\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeJ-**-2 io& Ph1!-2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*M\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe***'T2 io& PhC!'T2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*V\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeW**'T2 io& PhC!'T2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*V\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeF**'T2 io& PhC!'T2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*V\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exez**'T2 io& PhC!'T2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*V\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**'T2 io& PhC!'T2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*V\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeW**'T2 io& PhC!'T2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*V\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeF**'T2 io& PhC!'T2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*V\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exez**'T2 io& PhC!'T2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*V\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exet**'T2 io& PhC!'T2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*V\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**'T2 io& PhC!'T2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*V\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**'T2 io& PhC!'T2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*V\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**'T2 io& PhC!'T2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*V\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exee**'T2 io& PhC!'T2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*V\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exes**<{2 io& PhC!<{2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*V\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exen**<{2 io& PhC!<{2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*V\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exes**V2 io& Ph;!V2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exes**V2 io& Ph;!V2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exes**V2 io& Ph;!V2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exes**V2 io& Ph;!V2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exes**V2 io& Ph;!V2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exes**V2 io& Ph;!V2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exes**V2 io& Ph;!V2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exes**V2 io& Ph;!V2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exes**V2 io& Ph;!V2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exes**V2 io& Ph;!V2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exes**V2 io& Ph;!V2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exes**V2 io& Ph;!V2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exes**V2 io& Ph;!V2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exes**V2 io& Ph;!V2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exes**V2 io& Ph;!V2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exes**jɉ2 io& Ph;!jɉ2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll"\Device\HarddiskVolume3\tim_pc.exes**jɉ2 io& Ph;!jɉ2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll"\Device\HarddiskVolume3\tim_pc.exes**jɉ2 io& Ph;!jɉ2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll"\Device\HarddiskVolume3\tim_pc.exes**jɉ2 io& Ph;!jɉ2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll"\Device\HarddiskVolume3\tim_pc.exes**jɉ2 io& Ph;!jɉ2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll"\Device\HarddiskVolume3\tim_pc.exes**jɉ2 io& Ph;!jɉ2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll"\Device\HarddiskVolume3\tim_pc.exes**jɉ2 io& Ph;!jɉ2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll"\Device\HarddiskVolume3\tim_pc.exes**jɉ2 io& Ph;!jɉ2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll"\Device\HarddiskVolume3\tim_pc.exes**jɉ2 io& Ph;!jɉ2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll"\Device\HarddiskVolume3\tim_pc.exes**jɉ2 io& Ph;!jɉ2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll"\Device\HarddiskVolume3\tim_pc.exes**jɉ2 io& Ph;!jɉ2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll"\Device\HarddiskVolume3\tim_pc.exes**jɉ2 io& Ph;!jɉ2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll"\Device\HarddiskVolume3\tim_pc.exes**jɉ2 io& Ph;!jɉ2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll"\Device\HarddiskVolume3\tim_pc.exes**jɉ2 io& Ph;!jɉ2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll"\Device\HarddiskVolume3\tim_pc.exes**jɉ2 io& Ph;!jɉ2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*R\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll"\Device\HarddiskVolume3\tim_pc.exes**2 io& Ph-!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe\Win**2 io& Ph-!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeume2**2 io& Ph-!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exekVol**2 io& Ph-!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeddis**2 io& Ph-!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe\Har**2 io& Ph-!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exevice**2 io& Ph-!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeP\De** 2 io& Ph-!2 Mj| J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe*Device\Hardd io& Ph-localization-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exeT AHORITYL$WORKGROUPtyElfChnk b b4Z>WZ^n=f?mMFG&**P 2 io&iozZgAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannelBF;nComputerWIN-3PIMCL4OH3LAB.SecurityfLUserID ! Ph !2 Mj| J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/Gs/f(uH#;tnD EventDataA3oData=Flags A)= SidLength A=Sid A3%=FileNameLength A3%=FileNameBuffer AC5=ProcessImageNameLength AC5=ProcessImageNameBuffer DJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe.exP ** 2 io& Ph-!2 Mj| J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exem_pc** 2 io& Ph-!2 Mj| J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe3\ti** 2 io& Ph-!2 Mj| J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exelume**2 io& Ph-!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeskVo**2 io& Ph-!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeVolu**2 io& Ph-!2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeme3\**>2 io& Ph3!>2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*N\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe_**>2 io& Ph3!>2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*N\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exee**>2 io& Ph3!>2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*N\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**>2 io& Ph3!>2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*N\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**>2 io& Ph3!>2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*N\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**>2 io& Ph3!>2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*N\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**>2 io& Ph3!>2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*N\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**>2 io& Ph3!>2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*N\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**>2 io& Ph3!>2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*N\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**>2 io& Ph3!>2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*N\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**>2 io& Ph3!>2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*N\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**>2 io& Ph3!>2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*N\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**>2 io& Ph3!>2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*N\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**>2 io& Ph3!>2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*N\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**>2 io& Ph3!>2 Mj|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*N\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe** e2 io& Ph+!e2 Mj| J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**!e2 io& Ph+!e2 Mj|!J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**"e2 io& Ph+!e2 Mj|"J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**#e2 io& Ph+!e2 Mj|#J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**$e2 io& Ph+!e2 Mj|$J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**%e2 io& Ph+!e2 Mj|%J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**&e2 io& Ph+!e2 Mj|&J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**'e2 io& Ph+!e2 Mj|'J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**(e2 io& Ph+!e2 Mj|(J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**)e2 io& Ph+!e2 Mj|)J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe***e2 io& Ph+!e2 Mj|*J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exex**+e2 io& Ph+!e2 Mj|+J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exep**,e2 io& Ph+!e2 Mj|,J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exet**-e2 io& Ph+!e2 Mj|-J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exed**.e2 io& Ph+!e2 Mj|.J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe"**/ی2 io& Ph)!ی2 Mj|/J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exent**0ی2 io& Ph)!ی2 Mj|0J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exees**1ی2 io& Ph)!ی2 Mj|1J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exein**2ی2 io& Ph)!ی2 Mj|2J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeW6**3ی2 io& Ph)!ی2 Mj|3J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exein**4ی2 io& Ph)!ی2 Mj|4J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeis**5ی2 io& Ph)!ی2 Mj|5J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeDe**6ی2 io& Ph)!ی2 Mj|6J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**7ی2 io& Ph)!ی2 Mj|7J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**8ی2 io& Ph)!ی2 Mj|8J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**9ی2 io& Ph)!ی2 Mj|9J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeat**:ی2 io& Ph)!ی2 Mj|:J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeiz**;2 io& Ph)!2 Mj|;J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe-F**<2 io& Ph)!2 Mj|<J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe-W**=2 io& Ph)!2 Mj|=J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeic**> ۊ2 io& Ph)! ۊ2 Mj|>J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe*N**? ۊ2 io& Ph)! ۊ2 Mj|?J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exeiz**@ ۊ2 io& Ph)! ۊ2 Mj|@J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exeeV**A ۊ2 io& Ph)! ۊ2 Mj|AJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe-U**B ۊ2 io& Ph)! ۊ2 Mj|BJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe-W**C ۊ2 io& Ph)! ۊ2 Mj|CJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exeic**D ۊ2 io& Ph)! ۊ2 Mj|DJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exeJ-**E ۊ2 io& Ph)! ۊ2 Mj|EJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe**F ۊ2 io& Ph)! ۊ2 Mj|FJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe**G ۊ2 io& Ph)! ۊ2 Mj|GJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe **H ۊ2 io& Ph)! ۊ2 Mj|HJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe**I ۊ2 io& Ph)! ۊ2 Mj|IJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exeh**J ۊ2 io& Ph)! ۊ2 Mj|JJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe**K ۊ2 io& Ph)! ۊ2 Mj|KJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe**L ۊ2 io& Ph)! ۊ2 Mj|LJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe**M#2 io& Ph-!#2 Mj|MJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**N#2 io& Ph-!#2 Mj|NJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**O#2 io& Ph-!#2 Mj|OJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeio&**P#2 io& Ph-!#2 Mj|PJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**Q#2 io& Ph-!#2 Mj|QJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exejɉ**R#2 io& Ph-!#2 Mj|RJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**S#2 io& Ph-!#2 Mj|SJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe****T#2 io& Ph-!#2 Mj|TJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exexes**U#2 io& Ph-!#2 Mj|UJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exepc.e**V#2 io& Ph-!#2 Mj|VJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exetim_**W#2 io& Ph-!#2 Mj|WJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeme3\**X#2 io& Ph-!#2 Mj|XJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeVolu**Y#2 io& Ph-!#2 Mj|YJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exedisk**Z#2 io& Ph-!#2 Mj|ZJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeHard**[#2 io& Ph-!#2 Mj|[J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeddis**\:2 io& Ph/!:2 Mj|\J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exedis**]:2 io& Ph/!:2 Mj|]J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exedis**^:2 io& Ph/!:2 Mj|^J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exedis**_:2 io& Ph/!:2 Mj|_J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exedis**`:2 io& Ph/!:2 Mj|`J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exedis**a:2 io& Ph/!:2 Mj|aJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exedis**b:2 io& Ph/!:2 Mj|bJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exedisolume3\tim_p io& Ph Ph-localization-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exeT AHORITYL$WORKGROUPtyElfChnkccilL?-rn=f?mMFGI**P c:2 io&iozZgAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannelBF;nComputerWIN-3PIMCL4OH3LAB.SecurityfLUserID ! Ph !:2 Mj|cJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/Gs/f(uH#;tnD EventDataA3oData=Flags A)= SidLength A=Sid A3%=FileNameLength A3%=FileNameBuffer AC5=ProcessImageNameLength AC5=ProcessImageNameBuffer DJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeexP **d:2 io& Ph/!:2 Mj|dJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe_pc**e:2 io& Ph/!:2 Mj|eJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe\ti**f:2 io& Ph/!:2 Mj|fJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeume**g:2 io& Ph/!:2 Mj|gJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exekVo**h:2 io& Ph/!:2 Mj|hJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeolu**i:2 io& Ph/!:2 Mj|iJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exee3\**j:2 io& Ph/!:2 Mj|jJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exee_**ka2 io& Ph'!a2 Mj|kJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exec.e**la2 io& Ph'!a2 Mj|lJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeim_**ma2 io& Ph'!a2 Mj|mJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exee3\**na2 io& Ph'!a2 Mj|nJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeolu**oa2 io& Ph'!a2 Mj|oJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeisk**pa2 io& Ph'!a2 Mj|pJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeard**qa2 io& Ph'!a2 Mj|qJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exece\**ra2 io& Ph'!a2 Mj|rJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeDev**sa2 io& Ph'!a2 Mj|sJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exell"**ta2 io& Ph'!a2 Mj|tJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe-0.**ua2 io& Ph'!a2 Mj|uJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exel1-**va2 io& Ph'!a2 Mj|vJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeort**wa2 io& Ph'!a2 Mj|wJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exesup**xa2 io& Ph'!a2 Mj|xJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe-rt**ya2 io& Ph'!a2 Mj|yJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*H\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.execor**z2O2 io& Phk!2O2 $)<)zJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational AI&At-Lj5S5>nA!=Flags A)= SidLength A=Sid A3%=FileNameLength A3%=FileNameBuffer AC5=ProcessImageNameLength AC5=ProcessImageNameBuffer A!=Error hJ-N*4\Device\HarddiskVolume2\Windows\SysWOW64\kscrsvr.scri\Device\HarddiskVolume2\Users\Administrator\AppData\Local\Kingsoft\WPS Office\11.1.0.8214\office6\wps.exe:**0{xkB io& Ph!xkB V ({J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational AIhJ-N*4\Device\HarddiskVolume2\Windows\SysWOW64\kscrsvr.scri\Device\HarddiskVolume2\Users\Administrator\AppData\Local\Kingsoft\WPS Office\11.1.0.8500\office6\wps.exe:i-ms0**0|M io& Ph!M V61|J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational AIhJ-N*4\Device\HarddiskVolume2\Windows\SysWOW64\kscrsvr.scri\Device\HarddiskVolume2\Users\Administrator\AppData\Local\Kingsoft\WPS Office\11.1.0.8527\office6\wps.exe:tim_0**0}Mo io& Ph!Mo jz\:t4}J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational AIhJ-N*4\Device\HarddiskVolume2\Windows\SysWOW64\kscrsvr.scri\Device\HarddiskVolume2\Users\Administrator\AppData\Local\Kingsoft\WPS Office\11.1.0.8567\office6\wps.exe:0**0~sUf io& Ph!sUf jztw~J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational AIhJ-N*4\Device\HarddiskVolume2\Windows\SysWOW64\kscrsvr.scri\Device\HarddiskVolume2\Users\Administrator\AppData\Local\Kingsoft\WPS Office\11.1.0.8642\office6\wps.exe:Mic0**0W  io& Ph!W  jz0J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational AIhJ-N*4\Device\HarddiskVolume2\Windows\SysWOW64\kscrsvr.scri\Device\HarddiskVolume2\Users\Administrator\AppData\Local\Kingsoft\WPS Office\11.1.0.8661\office6\wps.exe:ft-W0**0Oub+ io& Ph!Oub+  "!J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational AIhJ-N*4\Device\HarddiskVolume2\Windows\SysWOW64\kscrsvr.scri\Device\HarddiskVolume2\Users\Administrator\AppData\Local\Kingsoft\WPS Office\11.1.0.8806\office6\wps.exe:0**0St}1 io& Ph!St}1 ,LJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational AIhJ-N*4\Device\HarddiskVolume2\Windows\SysWOW64\kscrsvr.scri\Device\HarddiskVolume2\Users\Administrator\AppData\Local\Kingsoft\WPS Office\11.1.0.8808\office6\wps.exe:dows0**0[Ԧ$; io& Ph![Ԧ$; CJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational AIhJ-N*4\Device\HarddiskVolume2\Windows\SysWOW64\kscrsvr.scri\Device\HarddiskVolume2\Users\Administrator\AppData\Local\Kingsoft\WPS Office\11.1.0.8894\office6\wps.exe:Hard0**0H io& Ph!H +@J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational AIhJ-N*4\Device\HarddiskVolume2\Windows\SysWOW64\kscrsvr.scri\Device\HarddiskVolume2\Users\Administrator\AppData\Local\Kingsoft\WPS Office\11.1.0.8952\office6\wps.exe:0**0tu?V io& Ph!tu?V J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational AIhJ-N*4\Device\HarddiskVolume2\Windows\SysWOW64\kscrsvr.scri\Device\HarddiskVolume2\Users\Administrator\AppData\Local\Kingsoft\WPS Office\11.1.0.8976\office6\wps.exe:0J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*J\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe"**/ی2 io& Ph)!ی2 Mj|/J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exent**0ی2 io& Ph)!ی2 Mj|0J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exees**1ی2 io& Ph)!ی2 Mj|1J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exein**2ی2 io& Ph)!ی2 Mj|2J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeW6**3ی2 io& Ph)!ی2 Mj|3J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exein**4ی2 io& Ph)!ی2 Mj|4J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeis**5ی2 io& Ph)!ی2 Mj|5J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeDe**6ی2 io& Ph)!ی2 Mj|6J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**7ی2 io& Ph)!ی2 Mj|7J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**8ی2 io& Ph)!ی2 Mj|8J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**9ی2 io& Ph)!ی2 Mj|9J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeat**:ی2 io& Ph)!ی2 Mj|:J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeiz**;2 io& Ph)!2 Mj|;J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe-F**<2 io& Ph)!2 Mj|<J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe-W**=2 io& Ph)!2 Mj|=J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeic**> ۊ2 io& Ph)! ۊ2 Mj|>J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe*N**? ۊ2 io& Ph)! ۊ2 Mj|?J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exeiz**@ ۊ2 io& Ph)! ۊ2 Mj|@J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exeeV**A ۊ2 io& Ph)! ۊ2 Mj|AJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe-U**B ۊ2 io& Ph)! ۊ2 Mj|BJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe-W**C ۊ2 io& Ph)! ۊ2 Mj|CJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exeic**D ۊ2 io& Ph)! ۊ2 Mj|DJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exeJ-**E ۊ2 io& Ph)! ۊ2 Mj|EJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe**F ۊ2 io& Ph)! ۊ2 Mj|FJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe**G ۊ2 io& Ph)! ۊ2 Mj|GJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe **H ۊ2 io& Ph)! ۊ2 Mj|HJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe**I ۊ2 io& Ph)! ۊ2 Mj|IJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exeh**J ۊ2 io& Ph)! ۊ2 Mj|JJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe**K ۊ2 io& Ph)! ۊ2 Mj|KJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe**L ۊ2 io& Ph)! ۊ2 Mj|LJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*I\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exe**M#2 io& Ph-!#2 Mj|MJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**N#2 io& Ph-!#2 Mj|NJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**O#2 io& Ph-!#2 Mj|OJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeio&**P#2 io& Ph-!#2 Mj|PJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**Q#2 io& Ph-!#2 Mj|QJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exejɉ**R#2 io& Ph-!#2 Mj|RJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe**S#2 io& Ph-!#2 Mj|SJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exe****T#2 io& Ph-!#2 Mj|TJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exexes**U#2 io& Ph-!#2 Mj|UJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exepc.e**V#2 io& Ph-!#2 Mj|VJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exetim_**W#2 io& Ph-!#2 Mj|WJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeme3\**X#2 io& Ph-!#2 Mj|XJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeVolu**Y#2 io& Ph-!#2 Mj|YJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exedisk**Z#2 io& Ph-!#2 Mj|ZJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeHard**[#2 io& Ph-!#2 Mj|[J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*K\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exeddis**\:2 io& Ph/!:2 Mj|\J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exedis**]:2 io& Ph/!:2 Mj|]J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exedis**^:2 io& Ph/!:2 Mj|^J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exedis**_:2 io& Ph/!:2 Mj|_J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exedis**`:2 io& Ph/!:2 Mj|`J-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exedis**a:2 io& Ph/!:2 Mj|aJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exedis**b:2 io& Ph/!:2 Mj|bJ-N*Microsoft-Windows-UAC-FileVirtualization+*NIDvW^Microsoft-Windows-UAC-FileVirtualization/Operational s/GDJ-N*L\Device\HarddiskVolume2\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll"\Device\HarddiskVolume3\tim_pc.exedisolume3\tim_p io& Ph Ph-localization-l1-2-0.dll"\Device\HarddiskVolume3\tim_pc.exeT AHORITYL$WORKGROUPty