MZ@ !L!This program cannot be run in DOS mode. $%KKKKKK\OK\IK\XK\jKKJXK\JK\|K\JK\JKRichKKPEdXCR"  bp܂`]wT@"Ԕ8Up\@.textT   `.data@  @.pdata"@$@@.idata#p$@@@.rsrcd@@.reloch@B]ÐH\$Hl$H|$ATAVAWH 3ML*H\$@Hl$HH|$PH A_A^A\ÐH\$Ht$WH IHLNjHH\$0Ht$8H _̐HHX L@PHHVWAVH@Lމ\$ ;w u9u 3ۉ\$ B;L Mt<;DƉL$pAы؉D$ 3ۉ\$ s$hL$`wL$pI؉D$ 3ۉ\$ s$hL$`=L$pI[؉D$ 3ۉ\$ s$hL$`;u~E33I"$hL$`\$ E33I $hL$`\$ HHt$E33I$hL$`\$ tuxL$pI؉D$ 3ۉ\$ s$hL$`HWHt:=/t1L$pIЋ؉D$ 3ۉ\$ s$h;w H$xH@A^_^ÐHыH Lƒ"f"E3E33H [ÐH; uHfuHRHL$L\$M3LT$L+MBeL%M;sfAMEM;uL$L\$HÐLI[IsI{Ms UHH`IIH$ICHHICHLMICH@ LICISHDHE XHy)LMHD$@HLHD$8HHHD$0H AHD$(H\$ H;LMLHD$@H;HHD$8HhAHD$0H HD$(H\$ HLMLHD$@HHHD$8HAHD$0H HD$(H\$ HLMLHD$@HHHD$8HAHD$0H HD$(H\$ <HHD$@HaHD$8HHD$0H LMLHD$(HAH\$ HHD$@HLMHD$8H2LHD$0H HHD$(AH\$ HgLMHD$@HLHD$8HHHD$0H AHD$(H\$ gH`LMLHD$@HyHHD$8HAHD$0H HD$(H\$ H9LMLHD$@H.HHD$8H?AHD$0Hx HD$(H\$ HbLMLHD$@HHHD$8HAHD$0Ha HD$(H\$ HOHD$@HHD$8HLMHD$0H; LHD$(HAH\$ KHHD$@HTLMHD$8HXLHD$0H HHD$(AH\$ H LMHD$@HLHD$8HHHD$0H AHD$(H\$ HLMLHD$@HHHD$8HAHD$0H HD$(H\$ vHLMLHD$@HlHHD$8HeAHD$0H HD$(H\$ /HLMLHD$@H!HHD$8HAHD$0H HD$(H\$ HLMLHD$@HHHD$8H AHD$0H HD$(H\$ H%LMLHD$@HHHD$8Hx AHD$0H HD$(H\$ ZH6LMLHD$@H@HHD$8H) AHD$0Hb HD$(H\$ HLMLHD$@HHHD$8H AHD$0H; HD$(H\$ H!LMLHD$@HHHD$8H AHD$0H HD$(H\$ H~ILMLHD$@H_HD$8H? HD$0H HD$(H\$ HA> HULMHD$@HLHD$8H HHD$0H AHD$(H\$ HkLMLHD$@HHHD$8H AHD$0H HD$(H\$ H͇LMLHD$@H~HHD$8HO AHD$0H HD$(H\$ i HrLMLHD$@H3HHD$8H AHD$0H HD$(H\$ " HLMLHD$@HHHD$8H AHD$0H HD$(H\$ HHD$@HHD$8Hl HD$0Hx HD$(LMLHAH\$ H :LMHD$@HULHD$8H HHD$0HO AHD$(H\$ M HjELMLHD$@HHHD$8H AHD$0H- HD$(H\$  HjLMLHD$@HHHD$8Hu AHD$0H HD$(H\$ HHLMLHD$@HqHHD$8H& AHD$0HHD$(H\$ x HatLMLHD$@H&HHD$8HAHD$0HHD$(H\$ 1 HwHD$@H HD$8HHD$0HLMHD$(LHAH\$ HLMHD$@H LHD$8H<HHD$0HAHD$(H\$ EtAu:HAe HAiLHHD$ RHEL\$`I[IsI{ Ms(I̋_ DL eH%0HxH;tW3H= uA txH- Ht`H=k LLHH;r3H9tHHH P HA L;uL;tLHLHH0RH H  EH 3eH%0HxH;tV3H= u t  [H=L% I;suHHtHI;roHGH (/A u HH+ H9D t!H ;  tMƺI!   Bz̐AddProcessParametersFlagsConditionalApphelpCopyHKCUSettingsFromOtherUsersCorrectFilePathsCorrectShellExecuteHWNDCreateDummyProcessCreateWindowConstrainSizeDeprecatedServiceShimDisableExceptionChainValidationDisableWindowsDefenderDXGICompatEmulateCursorEmulateSortingServer2008FontMigrationForceKeyWOW6464KeyForceLoadMirrorDrvMitigationForceTerminateProcessGetTopWindowToShellWndInstallComponentInstallFontsIgnoreFreeConsoleIgnoreFreeLibraryMakeShortcutRunAsOverrideShellAppCompatFlagsPlaceholderFilesPromoteDAMRedirectDefaultAudioToCommunicationsRedirectHKCUKeysRedirectShortCutRelaunchElevatedScaleGetMonitorInfoSetEnvironmentVariableSetProtocolHandlerSystemMetricsLieTerminateExeVirtualizeHKCRLiteGeneral Purpose Shims initialized.NotifyFnAcGenralGeneral Purpose Shims uninitialized.`''0)HyH RHH(H PH(̐Hl$Ht$WH IIHt(HD$hHtv8tqLD$0T$pHl$8Ht$@H _HL$PHtNH|$XtFHT$XHu7HT$XH ?HHL$`LHHT$pHHD$hHl$8Ht$@H _ÐHHL$HT$LD$LL$ HhfD$ fL$0fT$@f\$PHH kAfoD$ foL$0foT$@fo\$PHL$pHT$xL$L$HhH8d$(L$HT$ HL ]H ]H8ÐH(!HH HHuH 3H(ÐH\$WH HGtHJHH\$0H _Ðl)H HHHD$8HuG]_HkHD$8HWHD$@LD$@HT$8HLHHT$8H9HT$@H%HH [ÐH(kHH(ÐHHXHp HPHHWAVAWH0MEHH3ۉX؉\$$A;}HAHH|$PD$ H\$`Ht$hH0A_A^_ÐHLH D@HPSVWAVH8MIcH`HHHHXω|$pxH+H\$`HAD$ H8A^_^[ÐH\$DD$HL$VWAVH@IALHω|$pxI+H\$`HH\$hH@A^_^ÐH H3JHJ4I HH [H%(I̐HL$HH -FHHD$HE3HT$PHL$HFHD$@H|$@tBHD$8HD$XHD$0HD$`HD$(HHD$ LL$@LD$HHT$P3CF#HJHHH9HH.HHH$H HkH HHkH HtHHkH H HHkH EHLhHkH HLhH SHĈÐ` !%C%CLcAB%:B%>B%:B%A%F%F%A%@H(MA8HIH(ÐH EHLAALtA@McPLHcL#IcJHCHHKAt AHLL3IH [1̐HHXHhHpHx AVH IY8HMHLCIHI\D[DUAAAA#AfDDEtLMHHDH\$0Hl$8Ht$@H|$HAH A^ÐHHXHhHpHx AVH MQ8HMAHIHHIILCD[DUAA#AfDDEtLMHH9@H\$0Hl$8Ht$@H|$HH A^Ð%"?%?%>%@H=HaHHÐÐAÐ3ÐUH HHHHUPEP=csmuHMP#E0E0E0H ]ÐUH HHHHUpEp=csmuHMpE8E8E8H ]ÐUH HH0HHU`E`=csmuHM`{EHEHEHH ]ÐUH HH HH=csmuHE$E$E$H ]ÐUH HHHHU(E(=csmuHM(E4E4E4H ]ÐUH HHHHU@E@=csmuHM@wELELELH ]ÐUH HH(HHUXEX=csmuHMX#EhEhEhH ]ÐUH HH8HHUxEx=csmuHMx DžH ]ÐUH Hꃽhw =H ]ÐUH HzH ]ÐH H} uLMpDE$HUXHMP,H ]ÐH H} uLMxDEpHUhHM`H ]ÐH HHM8HM(HE(HHM0HE08csmt E E <H ]ÐUH HH3Ɂ8H ]ÐH =hH 9Taj:L HcA&6A6I667@7+3LyHTHEx̐E3E333HH $3Ht >HH H0z>H̐LE33E33H̐LE33E3|3H̐3fHHHHHHHHHyHrHH<ÐeH%`L3HH0H%9LI[IkIsI{ AWH@3HIHL=IDK\LHEHzICL$(HKIC7u!Hu5L=-3RHUHt/du.9=u"1HHHu3Ku?u5HtA`HLCHAI\$(HD$ Q7HH\$PHl$XHt$`H|$hH@A_ÐNS_AddProcessParametersFlags::InitializeHooksMultiH\$WHHH3HD$xHeH<%`HL$HH"8HD$XHT$HHD$@ HL$8E3fD$:8y5HA:LHH\$(HD$ W6LD$0HL$87yHABHO D$0 AtL LxHQAGHLxAIHMHD$ 5HL$xH3H$HĀ_Ð[ProcessCommandLine] Failed to convert string "%s" to UNICODE. NS_AddProcessParametersFlags::ProcessCommandLine[ProcessCommandLine] Failed to convert string "%s" to a hex number. HXHH3HD$@HMLMtHHA<uML VT$(IIEd$,HD$ MtHA< uM҉L$8AMEʃd$<ILL$0LL$ 3 7HL$@H3=HXÐH HHaHHHL葬IHDוHH [ÐH HH讐HKH [預̐H\$Ht$WH 3ApHx3t`ApHa3GA`HN3t$H/3HtH H3t&DËH3؅u3H\$0Ht$8H _Ë̐H\$Hl$Ht$WAVAWH 3HcA{MLH;~DIt I%3IH+DA+u HEut HH;|Hl$HHt$PH\$@H A_A^_ÐLI[IkIsI{ AWH@3HIHL=GILAAHEHICL$(H!KIC$2u*HL=WHtHt~/du9ZuqNu`H;LHEHD$(HNAHD$ 1HHHj3Bu6HtHLIHA\$(HD$ 81HH\$PHl$XHt$`H|$hH@A_ÐNS_ConditionalApphelp::InitializeHooksMultiHWHH@HXHp HH3H$AHH&HD$(Hd$0HL$(MHHL$(耑HL$( 6HtqHH6HHuHL$(3Z3DBXHL$@>D$dH|$Ht$`3LL$ E3HL$@Ӆt|$ t 36HL$(赌3H$H3L$I[Is(I_ÐApphelp.dllSdbShowApphelpDialogHJ(GHT$UH HH~H ]ÐH0٨u+H%H HHu5Ht =ue3fdu\=tSItL PLYHH VL/H8HL$ A.H0[ÐNS_ConditionalApphelp::NotifyFnHLH L@HHSVWATAUAVAWHH@HL5Lt$pL%Ld$xL=L|$hHIHD$0I }3=w|$@$H$@$0H$PH蹨LH$H9$PHEHL$XOHT$0HL$H?LD$XHT$HH$gHL$HHL$XHHD$0H|$8L$HT$0H$ګHHL$0H 虥HcH\$0C+HLHH CHi-HDHD$HH|$PAH$HL$0肜HHL$H載H$FHT$HH$-IH$-y+HL$HHL$0H$9KHL$H}H\$0H 踤9C|LcHHH,HHL$0_t2A H$HL$0諛HIH$HbH+u $@QHRH+u $H1HBH+u $HH*Hy+u $0{HHL$0tpHS HL$X\t$@D$0LD$X$PI9$@t Dž9$HtA A!$H$@HL$Xgb@8=tRtL 9LHHWHD$ ALmH>*@=HL$0H$-BHL$0H$%3wLt$pLd$xL|$h$HL$Mt IJ0t/9|$@t)I$9xt IH+ =u IOH+ 8HtI觏AA>3HA_A^A]A\_^[Ð-d{}-t-Apphelp:-NOT-AND-OR-IgnoreCase-ARG:HJX鳅HJH駅HHJ0鏅HJH郅HtHhHT$UH0H=tUtL 2LH{HPHD$ ALfH4(HH H0]ÐH\$WH`HH3H$PI d$0I!33II'HHthHH'HHuZHLL$@LD$0HpD$ z'=w%HHT$@['tHH=W'HH;u3H$PH3EH$pH`_ÐHHPHHSH@H@LHL@tUHL$X9؅tEH |HL$(Hd$03HL$(EHL$(SDHL$(HL$(肃3H@[ÐHJ(kHT$UH HHH ]ÐH\$WH HHHH 9A}3LcH&3ɅH\$0H _ÐH\$WH H܂teH %`L3HI0O'HH\$0H _ÐH\$WH yHHu@Q x t2C C HcHH tH)HaHH3H\$0H _ÐSVWAVHHpHEHH@E3AE3HHD$ Luv'HMLt$XLt$PLt$HLt$@Lt$8HE8Lt$0E3HD$(HE@E33Du@Du8HD$ 4'DE8eH %`PHI0AM&HHt{AD9u@vZM8Lt$8Lt$0LMHLljMHHMLt$(Lt$ &uH~tHH=t;]@reH %`L3HI0%HMHt&HpA^_^[]ÐSoftware\Microsoft\Windows NT\CurrentVersion\ProfileListLI[IsWH0IcICHHAE3HIC%u]39_ ~F3HHL$PHLRuHc3HHHH;_ |HL$PHtn%H\$@Ht$HH0_ÐH\$HT$UVWHl$HHeHe/IHEHAE33HD$ $؅0H!t$@HMoHE/HD$8H!t$0E3E3HD$(!t$ $؅H!t$XH!t$PHM!u !u!u!u#!uHEHD$HHE#E3HD$@HEE3HD$8H!t$0HEHD$(HE 3HD$ R$؅E;[}#;PM<} E;s N;GʺDeH %`HI0"HHt3ҋHȉUHM?9UEeLM7E'HE'LHD$8HL$0HMHE}7HD$(Hd$ #u&E'DMHM/D$(HE?E3HHD$ u#=tUHM?E‰U;Uz39} vcHd$8EHd$0HMHd$(Hd$ LMLƋ׉E #uHU/HML=tE;} r HteH %`L3HI0!HM/Ht"HMHt"H$HĠ_^]ÐH La HMteH %`3HI0^!H#cH [ÐLI[IkIsI{ AWH@3HIHL=IL9AHEHHICL$(HKICu%HL=3vHHt~du9uqu`HLHHD$(HNAHD$ HJwH'Ho3Bu6HtHLFH_A\$(HD$ HH\$PHl$XHt$`H|$hH@A_ÐNS_CopyHKCUSettingsFromOtherUsers::InitializeHooksMultiHPHD$0H\$`d38mtWHZHD$ ALHK<KtH:HD$(LnHoVH\$8H\$@\$HHT$89\$D~7HL$8&D$D~H\$83HYHHuHL$8>HL$83H\$`HP_ÐNS_CopyHKCUSettingsFromOtherUsers::NotifyFnHJ8HL$SHHD$0HH,HL$HL LHHL$HҒHHL$8LD$8HT$HHL$X謚HL$8ayHHD$8Hd$@LD$XHT$8HL$X/t_HT$8ztH$H$HD$ AE3HxuHT$8HF띅uH$HL$8xHL$XHL$HxHĀ[^HJHxHJ8xHJXHJ8wxHT$UH0HHH0]ÐyHcLu*x&I ;};}IHcHHAH ÐHHXHhHp WH HcH@Bwy3;Y~gL@VHxTeH %`LD$@VHI0QHHt1LcGHHIeH %`LHI03H/_9_@Ƌ3H\$0Hl$8Ht$HH _ÐHHH3HuIIÐHHpHLH3HEHE3LMtHHE8uML UID]HEIEHEHEHnHEH[HEHE8Ht HD8uHMALEI3LMLMD]eHMH3虼Hp]ÐApiNameUnknownH HYL 7vDeH %`LHI03HH [ÐLI[IkIsI{ AVH0=AHLtVHILHAICBItH*LHdHD$(FD H$DI!aD nH DHHaL DHHHAIH΋`HH`Hl$HHt$PH|$XH\$@H0A^ÐNS_CorrectFilePaths::APIHook_CopyFileALI[IkIsWAVAWH0=MIMHLtVHLHqAICtHLAH"HD$(D EHDI_D ,HDHH_L$xLL$(HL$pLHL$ MHHHA(IH΋[_HHP_Hl$XHt$`H\$PH0A_A^_ÐNS_CorrectFilePaths::APIHook_CopyFileExALI[IkIsWAVAWH0=IMHLtVHLH!AICGtHLHHD$(D HDI_D HDHHg_L$xL0L$(HL$pLHL$ MHHHAXIH΋ ^HH^Hl$XHt$`H\$PH0A_A^_ÐNS_CorrectFilePaths::APIHook_CopyFileExWLI[IkIsI{ AVH0=AHLtVHiLHAICbhtHJLHHD$(fD HTDI5^D H;DHH^L DHHHAIH΋\HH\Hl$HHt$PH|$XH\$@H0A^ÐNS_CorrectFilePaths::APIHook_CopyFileWH\$Ht$WH0=tHHtZH;LHAHD$ 03tHLqHRHD$(4D uHRAH \LHHHAHHϋ[Ht$HH\$@H0_ÐNS_CorrectFilePaths::APIHook_CreateDirectoryALI[IkIsI{ AVH0=dIHLtYH*LHA1IC !tHLaHBHD$($D eHmDIZD GHTDHHZL LHHHAIH΋ZHHZHl$HHt$PH|$XH\$@H0A^ÐNS_CorrectFilePaths::APIHook_CreateDirectoryExALI[IkIsI{ AVH0=IHLtYHLHHADICktHLHHD$(D H9DIZD H DHHZL SLHHHAIH΋?YHH4YHl$HHt$PH|$XH\$@H0A^ÐNS_CorrectFilePaths::APIHook_CreateDirectoryExWH\$Ht$WH0=HHtZHLH A HD$ /tHLHHD$(D HAHhYL5HHHAHHϋ$XHt$HH\$@H0_ÐNS_CorrectFilePaths::APIHook_CreateDirectoryWLI[IkIsI{ AVH@=IADHtVHLHA[ICtHkLHHD$(D HDHbWH$LHL$0L$xLˉL$(L$pDʼnL$ AHHAHHHHVHl$XHt$`H|$hHH\$PH@A^ÐNS_CorrectFilePaths::APIHook_CreateFileALI[IkIsI{ AVH@=IADHtVHNLHAvIC GEtH/LHiHD$(KD HDHWH$LHL$0L$xLˉL$(L$pDʼnL$ AHHAxHHHUHl$XHt$`H|$hHH\$PH@A^NS_CorrectFilePaths::APIHook_CreateFileWLI[IkIsWAVAWHP=IMHHtYHL]HAIC 9tHLSH4HD$(LHHtD LH)AHTLHtE3H)HEATHH3Hl$0LHALt$(HD$  H$H$LHL$HH$MHL$@HD$8H$HD$0$HՉD$($IΉD$ HPHI΋SHHSL\$PI[ Ik(Is0IA_A^_ÐNS_CorrectFilePaths::APIHook_CreateProcessACreateProcessA ApplicationName:CreateProcessA CommandLine:CreateProcessA Application(%s) CommandLine(%s) LI[IkIsWAVAWHP=>IMHHtYHL]HFAICi tHLHHD$(LHHtD H)AHSLHtE3H)HEAySHH3Hl$0LHALt$(HD$  H$H$LHL$HH$MHL$@HD$8H$HD$0$HՉD$($IΉD$ HPHHI΋QHHQL\$PI[ Ik(Is0IA_A^_ÐNS_CorrectFilePaths::APIHook_CreateProcessWCreateProcessW ApplicationName:CreateProcessW CommandLine:CreateProcessW Application(%S) CommandLine(%S) H\$Ht$WH0=HtWHLHAHD$ 8tHLHHD$(D HCDHPHAHHHHϋ4PHt$HH\$@H0_ÐNS_CorrectFilePaths::APIHook_DeleteFileAH\$Ht$WH0=HtWHLHAHD$ @tHLHHD$(D H[DH|PHIHHHHϋCHt$HH\$@H0_NS_CorrectFilePaths::APIHook_GetFileAttributesWLI[IkIsWH0=AHHtYHLHAQIC@ҲtHLHHD$(D HE3HBL IDHHHA HHϋ5BHl$HHt$PH\$@H0_ÐNS_CorrectFilePaths::APIHook_GetLongPathNameALI[IkIsWH0=AHHtYHLHAeIC4űtHLHHD$(D HE3HpBL =DHHHA HHϋ)AHl$HHt$PH\$@H0_ÐNS_CorrectFilePaths::APIHook_GetLongPathNameWLI[IkIsI{ AVH0=IAHLtYHLHAICtHmLHHD$(H^HfL/DHILHAHHϋ@Hl$HHt$PH|$XH\$@H0A^ÐNS_CorrectFilePaths::APIHook_GetPrivateProfileIntALI[IkIsI{ AVH0=ȯIAHLtYHoLHAICetHMLHHD$(iHVHZgLDHILHAHHϋ>Hl$HHt$PH|$XH\$@H0A^ÐNS_CorrectFilePaths::APIHook_GetPrivateProfileIntWLI[IkIsI{ AVH0=IAHLtYHOLHAICEatH-LHgHD$(IHNHdLDHILHA(HHϋ=Hl$HHt$PH|$XH\$@H0A^ÐNS_CorrectFilePaths::APIHook_GetPrivateProfileSectionALI[IkIsWH0=IHtYH4LHAIC*DtHLkHLHD$(.HsHcL ԲLHHAHHϋ<Hl$HHt$PH\$@H0_ÐNS_CorrectFilePaths::APIHook_GetPrivateProfileSectionNamesALI[IkIsWH0=eIHtYHLH~AIC #tHLKH,HD$(HsHcL LHHAHHϋ;Hl$HHt$PH\$@H0_ÐNS_CorrectFilePaths::APIHook_GetPrivateProfileSectionNamesWLI[IkIsI{ AVH0=BIAHLtYHLHUAICxtHL"HHD$(H HbLDHILHAXHHϋt:Hl$HHt$PH|$XH\$@H0A^ÐNS_CorrectFilePaths::APIHook_GetPrivateProfileSectionWLI[IkIsI{ AVH0=IIHLtYHLH5A6ICX٩tHLHHD$(HL$hHE`L$`LeHD$(L$ LILHHAHT$hHϋC9Hl$HHt$PH|$XH\$@H0A^ÐNS_CorrectFilePaths::APIHook_GetPrivateProfileStringALI[IkIsI{ AVH0=IIHLtYHLH APIC,tH}LHHD$(HL$hH9`L$`L9HD$(L$ LILHHAHT$hHϋ8Hl$HHt$PH|$XH\$@H0A^ÐNS_CorrectFilePaths::APIHook_GetPrivateProfileStringWLI[IkIsI{ AVH0=AIHLtYHoLHAhICe{tHMLHHD$(iHL$`H)]L DLHIHHD$ AHHT$`Hϋ6Hl$HHt$PH|$XH\$@H0A^ÐNS_CorrectFilePaths::APIHook_GetPrivateProfileStructALI[IkIsI{ AVH0=AIHLtYHGLHAIC=RtH%L~H_HD$(AHL$`H!0^LDLHIHHD$ AxHT$`Hϋ5Hl$HHt$PH|$XH\$@H0A^ÐNS_CorrectFilePaths::APIHook_GetPrivateProfileStructWLMK ECISIKSVWATAVAWHhICMEHHـ=ktZHICAL?Hp8t HHD$(LBH# HHHHL$8HHL$HHT$HHL$8@MHL$8fULD AHH4HI;t\HYHtHMEHHH+H IH$4HL$HHHL$8zHMEHHHH $HhA_A^A\_^[ÐNS_CorrectFilePaths::APIHook_GetTempFileNameAHJ8HHJHGHT$UH0HLDHHHLH HVH0]ÐLMK ECISIKSVWATAUAVAWHPICMEHHE3D8-5tYHICALH;AMiD-˦t HHD$(LHHHHHL$8FHHL$8KLt$8D AHIo3HI;t\HEHtfD(HMEHHHx IH2HL$8hFMEHHHۧx $HPA_A^A]A\_^[NS_CorrectFilePaths::APIHook_GetTempFileNameWHJ8EHT$UH0HLDHHHLx HhH0]ÐLI[IkIsI{ AVH0=AAHLtYHLHYAT IC|ɠtHL&HHD$(|$huY@tSD DCHH0L$`Lr|$(L$ DIE3HHA8 HHHR0(D$`|$(D͉D$ H.DHI8 HH\$@Hl$HHt$PHH|$XH0A^ÐNS_CorrectFilePaths::APIHook_LoadImageALI[IkIsI{ AVH0=LHtVHLHA ICztHmLHHD$(D ʥHE3Hd/HH0t tD HDI1/LHHHA HH͋.IH.Hl$HHt$PH|$XH\$@H0A^ÐNS_CorrectFilePaths::APIHook_MoveFileALI[IkIsWAVAWH0=kELHtVH:LHA IC3&tHLtHUHD$(7D xHE3H.HHt tD EHzDI-L EHHHAh HH΋-IH-Hl$XHt$`H\$PH0A_A^_ÐNS_CorrectFilePaths::APIHook_MoveFileExALI[IkIsWAVAWH0=ELHtVHLHTA ICz՜tHL$HHD$(D (HmE3H-HHt tD H:DI-L PEHHHA HH΋<,IH1,Hl$XHt$`H\$PH0A_A^_ÐNS_CorrectFilePaths::APIHook_MoveFileExWLI[IkIsI{ AVH0=˛LHtVHLHA IC,tH}LHHD$(D ڡHE3Hh,HH8t tD HDI5,LHHHA8 HH͋*IH*Hl$HHt$PH|$XH\$@H0A^ÐNS_CorrectFilePaths::APIHook_MoveFileWLI[IkIsI{ ATAVAWH0=tMMLHtVHBLHA IC;,tH#L|H]HD$(?D HE3H*HHt tD MHDI)L$pLL$ MMHHHA HH΋)IH~)Hl$XHt$`H|$hH\$PH0A_A^A\ÐNS_CorrectFilePaths::APIHook_MoveFileWithProgressALI[IkIsI{ ATAVAWH0=MMLHtVHLH,A7 ICRtHLHHD$(D HmE3H)HH^t tD ͞H:DI[)L$pL$L$ MMHHHA HH΋ (IH'Hl$XHt$`H|$hH\$PH0A_A^A\ÐNS_CorrectFilePaths::APIHook_MoveFileWithProgressWLI[IkIsWH0=wAHHtVHNLHA ICG2tH/LHiHD$(KD HDH&'L DHHHA HHϋ&Hl$HHt$PH\$@H0_NS_CorrectFilePaths::APIHook_OpenFileLI[IkIsI{ AVH0=aIAHLtYH;LHA IC1tHLrHSHD$(5HE3E3H&HHtHH<uL$`LHL$ DHI HHϋ%Hl$HHt$PH|$XH\$@H0A^ÐNS_CorrectFilePaths::APIHook_RegSetValueALI[IkIsI{ AVH0=/AAHLtYH LHuA ICtHLBH#HD$(ulHL$`HE3E3$HHtHH<uL$hL$(HD$ HxADHIx HT$`Hϋ`$+D$hDDƉD$(HD$`HHD$ H.Ix H\$@Hl$HHt$PH|$XH0A^ÐNS_CorrectFilePaths::APIHook_RegSetValueExALI[IkIsWAVAWH0E3AAD8=HLtXHLHAOA IC#D=stHtLHHD$(urHL$pH;E3E3\$HHtHHfD9Ht EHHЋHHHl$HHt$PH|$XH\$@H0A^ÐNS_CorrectFilePaths::COMHook_IShellLinkW_SetIconLocationIShellLinkW::SetIconLocationLI[IkIsWH0=AqHHtVHLHgAICtptHޜL7HHD$(D ;wHDHλ@LHVHHHt HHЋHHpHl$HHt$PH\$@H0_ÐNS_CorrectFilePaths::COMHook_IShellLinkW_SetPathIShellLinkW::SetPathH(LH;teH %`3HI0۸H(ÐHHPHHWAVAWH@H@HXHp EEHHHHL$ HHHEE3HL$0LHt"HHHEH\$ HT$0ITHL$0Ht$hH|$`H\$ HtLHHdHH\$pHt$xH@A_A^_ÐHJ0oHT$UH HHH ]ÐHHHD$0HL$PDL$ ELHH Mu4HD$PHD$PHHÐHT$UH0HHH0]ÐHHXHhHpHx AVH EIHHHu3oHuHe|$PHt HpHLEHHAQ`HHuHHtLHH7H;teH %`L3HI0HH\$0Hl$8Ht$@H|$HH A^ÐH\$Ht$WH@IHHHtQHtLHHtYEƋHQIHVHuHL$HnHL$X3D=VAL-?A;HcHHt$PHHD$0|$(HHD$ AMH2~_Hf;uCf;uCf;uAA ąuOf;uCf;uCf;uAA ąu D=Of;uCf;uCf;uAA ąHrHW{f;uCf;uCf;uAA ąu D= OBf;,uCf;!uCf;uAA ąu D=Nf;uCf;uCf;uAA ąu D=Nf;uCf;uCf;uAA ąu D=?NHHVu3HHD$ A2MH#|PD%5T<HHaVu3HHD$ A7MH{ D%SHHVu3HHD$ A<MH{ĔD%SHHUu0HHD$ AAMHQ{~D%WSmH~HUu0HHD$ AFMH{;D%S*Hc SHH RHPD%RD%LAYD9=Rt7D9=Rt.HGHD$ ARMHzǓD=RHL$HZHL$X{3L\$pI[8Is@IA_A^A]A\_ÐArgv[%d] == (%S) NS_CorrectFilePaths::ParseCommandLine-a-b-u-Profiles-f-p-s+GetCommandLineCommand line routines will be shimmed +RegSetValueRegSetValue routines will be shimmed +Win9xPathWin9x Path corrections will be applied +LoadImageLoadImageA will be shimmed +RedirectRootAccess to the root will be redirected Because the root protection is enabled, Win9x Path corrections cannot be applied. HJXHJHHXHT$UH@HHqH@]ÐHHPHHVWAVHPH@HXLHOD3DBWHHD$ H;3H$HHL$@g\E3HvHL$@zxVHHL$0A\E3HvHL$0Ty%HL$0~HL$0HHd$8H$HL$0HL$@Lt$xHt$pH|$ H$HtHHXHMtMHHHH$HPA^_^ÐHJ@HJ0HT$UH HLMteH %`3HI0HHXH ]ÐHT$HL$SVWAVAWHPHD$(LHND3DBHHD$ H;3H$HHL$@dE3H%uHL$@HHL$0:E3HtHL$0yTHL$0HD$0HLcMeH %`MǍSHI0HH$HtMHT$0HnOHL$0+HL$@ L$H$H|$ H$HtHHHMtMHHHHPA_A^_^[ÐHJ@HJ0HT$UH HLMteH %`3HI0HHVH ]ÐH\$Hl$Ht$WH0H3IIHLu H)HLLHHKHH\$@Hl$HHt$PH0_H`H̐H HHt3Ku HKHCHGKHH [H̐H HHt3cKu HKHCHJHH [H`x̐H\$Hl$Ht$WH0H3IIHKu H5HLLHHJHH\$@Hl$HHt$PH0_H`̐HH <H3H$H$uSD@DHL$43MHT$03D$0Ht*HL$8Ht d$ HT$  ;D$ HD\$8HH$H3.HĐ[ÐLI[IkIsI{ AVH@3HIHL5WoILAHEHICL$(H1oKIC4uEHu#L5SCHXIHt7$H[H(CHuЉ3H+Idu9Iu IHdzH tHXHHH8H XPHH@H tHP0HHH HXXHHH tHHH =HXHH tX HHhH iHX(HHHHpHHP`HXxHHtH;nL\H=A\$(HD$ ۉHHH\$PHl$XHt$`H|$hH@A^ÐCorrectShellExecuteHWNDNS_CorrectShellExecuteHWND::InitializeHooksMultiH HH@HK0HK HKHH [̐LMK MCISIKSVWAVHHD$XIMHHHe>HD$`IcLHIKGd$PLD$PHZDH$PtA|$Pt:HL$`THaxHL$`3H$HL$`HH$HL$p H$L$H$H$H$8HD$HH$0HD$@H$(HD$8H$ HD$0$D$($D$ LMHHHFPHL$`HA^_^[HJ`wHJp;HT$UHPHH9HP]ÐLMK MCISIKSVWAVHHD$XIMHHH<HD$`IcLHIK|Gd$PLD$PHBH$5Ot9|$Pt2HL$`HvHL$`3H$H\$`H$HL$p^ H$L$H$H$H$8HD$HH$0HD$@H$(HD$8H$ HD$0$D$($D$ LMHHHvDPHHL$`HA^_^[HJ`HJpHT$UHPHH5HP]ÐLI[IkIsI{ AWH@3HIHL=iILAHEHICL$(HyiKIC|u*HL==HCHt~/du9rCuqfCkucHSCLHHD$(HiNAHD$ H=H=Hj3HBH 9tH"tHHH HHHH )tHXHH8H X HX(HP0HXHHH@XPHXXHtHhL[H<A\$(HD$ 2HcBH\$PHl$XHt$`H|$hH@A_CreateDummyProcessNS_CreateDummyProcess::InitializeHooksMultiH8HD$ uH;H T?K3H8ÐHT$UH HHH ]ÐHHXHpHx HUATAUAVAWHH`]h}`uXDuPEMLDDNjA\$@|$8Hst$0LHiADt$(HD$ ԂHU`HMPWHUhHMXJ]h}`uXDuP\$@|$8Hrt$0LkHliADt$(HD$ qM0EMIH@]h}`uXDuPL\$`I[8Is@I{HIA_A^A]A\]H`̐NS_CreateWindowConstrainSize::APIHook_CreateWindowExAHHXHpHx HUATAUAVAWHH`]h}`uXDuPEMLDDNjA \$@|$8Hqt$0LH[hADt$(HD$ `HU`HMPHUhHMX]h}`uXDuP\$@|$8Hzqt$0LgHgADt$(HD$ M0EMIH?]h}`uXDuPL\$`I[8Is@I{HIA_A^A]A\]H`H̐NS_CreateWindowConstrainSize::APIHook_CreateWindowExWE39t]AGtD9 }D! D9~ DA9t[LcHcIAHI;w =v29}E+9t9|AGtD9~ DAAÐLI[IkIsI{ AVH@3HIHL5cILMAHEHtfICL$(HucKICxuEHu#L57H|=Ht7$HH\7HuЉ3HO=du9<=u0=H oHydHXHHH X HHH oHHH8H HX(HP0HXHXPHH@HXXHtHbLJH{eA\$(HD$ ~H<H\$PHl$XHt$`H|$hH@A^ÐNS_CreateWindowConstrainSize::InitializeHooksMultiAE3A;uA;t w]AA;wJA;uA=w5LcHc¹LȸIH;wAAAA;AFDAÐH\$Ht$WH AA3^t׋QKEHt$8H\$0H _ÐHDH L@HPHHSVWATAUAVAWHH@EMHL=5tZHSaHD$ APLAHc|5A9tH0aHD$(LcHe`Lb3H\$xH$@HPHGHH$OH9<5t4H$H$}H uH$Hd$pHT$pHLt$pH$PHD$`H$HHD$XLt$PH$8HD$HH$0HD$@H$(HD$8$ D$0$D$($D$ EMHIH9PHHD$xMt IH$Q-H$@D$L$H$L$H\$xHH$PHD$`H$HHD$XH|$PH$8HD$HH$0HD$@H$(HD$8$ D$0$D$($D$ EMHIH8PHHHİA_A^A]A\_^[ÐNS_DeprecatedServiceShim::APIHook_CreateServiceAH@HT$UHpHHHp]ÐHDH L@HPHHSVWATAUAVAWHH@EMHL=2tZHW^HD$ ALEH`y2E6tH4^HD$(L`Hi]P_3H\$xH$@HPHGHH$9@2t4H$H$H uH$Hd$pHT$pHSLt$pH$PHD$`H$HHD$XLt$PH$8HD$HH$0HD$@H$(HD$8$ D$0$D$($D$ EMHIH6PHHHD$xMt IH$U-H$@D$L$H$L$H\$xHH$PHD$`H$HHD$XH|$PH$8HD$HH$0HD$@H$(HD$8$ D$0$D$($D$ EMHIH5PHHHHİA_A^A]A\_^[ÐNS_DeprecatedServiceShim::APIHook_CreateServiceWH@HT$UHpHHHp]ÐHHHWH0H@HXHp H3ۉ\$HH=$6%HG9XtHAHW+BuLwt H?Hu \$H Ht$@\$HHH\$PHt$XH0_ÐHT$UH HHH ]ÐHHHWH0H@HXHp H3ۉ\$HH=t5%HG9XtHAHW+Buvt H?Hu \$H Ht$@\$HHH\$PHt$XH0_HT$UH HHH ]ÐLI[IkIsI{ AVH@3HIHL5YILA?HEH\ICL$(HYKICuuEHu#L5-H3Ht7$HHh-HuЉ3HS3du9@3u43>H%3u2HD$(HYLH[MA@HD$ tH HdHXHHH pX HHH HHH8H PHX(HP0HXHXPHH@HXXHtHXLDHm[AD\$(HD$ StHd2H\$PHl$XHt$`H|$hH@A^ÐNS_DeprecatedServiceShim::InitializeHooksMultiCreateServiceACreateServiceWHHHWHH@HX3ۉ$H+HL$Ps?HD$P9XuHL$P^lHYHL$pLD$pHT$PH$oHL$p$H(HD$`H\$hL$HT$`H$HVYH$uL$HT$`H$H$Hm(HD$0H\$8HD$@H\$HeH %`DB HI0tHHt H.(HGH_H(HGH_ HL$HT$0H$,L$HT$@H$HuwH:HD$ ALhcH)YO rHL$@HL$0H$ >HL$`H$=HL$PHD$0HO9Xu HT$0HD$@HO9Xu ^* HT$@H0HH=}0HL$@CHL$08H$j=$HL$`H$A=HL$P$H$H_ÐOut of Memory when trying to allocate list.HJPHJpHf91t5LD$@HHt$@Ix1HD$@Hk~ D$(A=H>MI׹HD$ eLDHL$@HfeHL$@jHHu%=k~ D$(AFH@HOH6kHOHH#kHHHd$0HL$0օyAWD$(H=AI|$0uA^H8AIm3Ӆ=tH= t2MI׹=u HDIn:D$(AuH8aHAl HAiIMHD$ c8j~ AOD$(HWAIMIHD$ zcHhHH$PH3^H$H`A_A\_^]ÐNS_DisableWindowsDefender::APIHook_RegisterServiceCtrlHandlerExWProgramFilesGetEnvironmentVariable error: %x \Windows Defender\MpClient.dllLoadLibrary error: %x WDStatusWDEnableGetProcAddress error: %x WDStatus error: %x WD already disabled Calling application does not have sufficient permission or is flagged as a threat by Windows Defender signature database. Calling application identity is not verifiable through digital signing. Calling application request contradicts with the Windows Defender status set by group policy. Unspecified error: %x LI[IkIsI{ AWH@3HIHL=ODIL!AHEHGICL$(H)DKIC,`uGHu%L=#荷HHt$HQHHuΉ3Hdu9uuhH HXX HH HX(HHH HHHtHCLEHFA\$(HD$ \_HMH\$PHl$XHt$`H|$hH@A_ÐNS_DisableWindowsDefender::InitializeHooksMultiadvapi32.dllRegisterServiceCtrlHandlerExWH(uHHH LcHt8HRH!eHt#HeHH< uHiH(Ðdxgi.dllSetAppCompatStringPointerLI[IkIsI{ AWH@3HIHL=AIDKPL HEHICL$(HAKIC]u!Hu5L=3"HHt/du.9mu"a$HӵHpHu3aftuPH9Tt 9Tuuu5HtARHdALMH6AI\$(HD$  ]HH\$PHl$XHt$`H|$hH@A_ÐDXGICompatNS_DXGICompat::InitializeHooksMultiH\$WH HH H]HttHtH;u 3HHH;H\$0H _H`̐H\$WH HH 0H\HttHtH;u 3HHHH\$0H _H`H̐LI[IkIsI{ AVH@3HIHL5?IDK_LQHEH6ICL$(H?KIC[uEHu#L5qH>Ht7$H豳HFHuЉ3HAdA;u9uH H@HXHHH JX HHH HHH8H HX(HP0HXHXPHH@HXXHtH>LNH7\$(HD$ ZHdH\$PHl$XHt$`H|$hH@A^ÐEmulateCursorNS_EmulateCursor::InitializeHooksMultiLoadCursorALoadCursorWUVWATAUAVAWH(H H3H$L$$3H6KAMD\$PHD$X\$TMMDCUHT$`E3^DsAs \$PA LD$PHL$`Eκ X^JHyHHA8\=uDžy HA8 uqu uA >HcH]LH3]LHuH~"L$PDM3҉|$(HD$ ]ML-+J~,u$HcDMINL$P3҉t$(H\$ y] H\$XD$T~t~%u!Ws]U]MH37]ZHd$@Hd$8H IHL$0D$(HL$`DMAH\$ 8]]MH3\ W]3H$H3H(A_A^A]A\_^][ÐLHXH$ICH$ICHIIC؋$D$(H$IC\HXÐUVWHHeH3H$H$`AE3IEAUHT$PH\u HW3\3;Hd$@Hd$8HHHD$0$hHL$PD$(DLNjHl$ \H$H3H_^][ÐUVWAVHHH3H$H$`L$pAE3IEAUHT$P[u HWy[3@Hd$HHd$@HGHD$8$hLt$0D$(HL$PDLNjHl$ ZH$H3%HA^_^][ÐLHXH$ICH$ICHRGICH$IC؋$D$(H$ICuZHXÐLGH%RZSVWATAUAVAWHl$H(HlH3HEH3AMDH\$X|$PMDGUHT$`E3?ZL;As |$PA#LD$PHL$`A YKyHHA8<4uHcHYLH3YLHuHL$PDM3҉t$(HD$ yYDuHWpA sBH|$@HEH|$8HD$0HL$`D$(HD$XEMAHD$ Y-HcHYLH3YLHu$HYXM3HXcH|$@H|$8HSEH\$0HL$`EMA։t$(HD$ X)ZzH|$@H|$8H\$0HL$`EMA։|$(H|$ TXD$THcHTXLM3H#XHHtuH|$@LHDH|$8HD$0D$TD$(HL$ HL$`EMAW~5L$PH|$8H|$0D$(HD$XDMĺHD$ XWM3HWWMH3W~3W WW3HMH3H(A_A^A]A\_^[]ÐLHXH$ICH$ICHCIC؋$D$(H$ICVHXÐUVWHHH3H$H$`AE3IEAUHT$PVu HWV3;Hd$@Hd$8H CHD$0$hHL$PD$(DLNjHl$ `VH$H3H_^][ÐLI[IkIsI{ AVH@3HIHL5+5ILAHEHICL$(H5KICQuEHu#L5 gHHt7$H/HHuЉ3)Hdu9lu`H@H iHXHHH X HHH \HHH8H HX(HH@H OHP0HHhH 0HXHHHpH AXPHH HXXHH .HP`HH HXxHH HH BHHH HH(H HH0H HXH HH`H HHH HHHHHHH H8@HHHPHhpHxHHHHtH2LeH>A\$(HD$ NH] H\$PHl$XHt$`H|$hH@A^ÐEmulateSortingServer2008NS_EmulateSortingServer2008::InitializeHooksMultiCompareStringExCompareStringWCompareStringALCMapStringExLCMapStringWLCMapStringAFindNLSStringExFindNLSStringIsNLSDefinedStringHHXHhHpHx AVHp=H$AADu(Ht#HS HHRMu H; HX H$DDƋAH L\$pI[IkIs I{(IA^H`H̐H\$UHHpHH3HEe3HDB8HM =8HH HKHRLH HHQH<u H;syHHEHCHEHCHEHCHEHC HEHC(HEHC0HEC8ELA HEL+HMHHtAt HHuHuHH]H HHMH3H$Hp]ÐH\$H|$UHl$HHH3HEG3HHMDGX3҉} =HHg HKHRKLJ HIHHf9HEH#AiIC؉L$(H6,AIC9HuBHu L%I蜟HHtD?$HcHHuӉ3Hdu"9uH~u;_HD$(H+LwH`AjAHD$ G뇃$HX:H iHXHHH ~X HHH dHHH8H HX(HH@H WHP0HHhH HXHHHpH IXPHH HXXHH >HP`HH ,HXxHHHHHHHHHtH*LQH:ApAω\$(HD$ ZFH H\$`Hl$hHt$pH@A_A\_ÐFontMigrationNS_FontMigration::InitializeHooksMultiGetTextFaceAliasWCreateFontACreateFontWCreateFontIndirectACreateFontIndirectWH\$3HBAI;DAWEGEx>DHt*L+L+IHtAft fHHuHuHAzHtfH\$AÐAs A sA HH`HAs A sA HH`LI[IkIsI{ AVH@3HIHL5(IDKlL]HEH:ICL$(Hk(KICnDuEHu#L5=͛HHt7$H蕜HHuЉ3Hdu9uH 6H3HXHHH X HHH 6HHH8H HX(HP0HXHXPHH@HXXHtAoH'LZH;AI\$(HD$ xCHH\$PHl$XHt$`H|$hH@A^ÐForceKeyWOW6464KeyNS_ForceKeyWOW6464Key::InitializeHooksMultiH\$UVWHHH3H$pHHHL$$3AD3D$ H3HL$dHBtCLD$ E33fl$$EuѸH$pH3sH$HĀ_^]LD$$H̐LI[IkIsI{ AVH@3HIHL5&IL=AHEH ICL$(H%KICAu)HL53@HSHdu<97L r MtUL33H\$(\$ Fu6HtH%LH`A\$(HD$ 6AHH\$PHl$XHt$`H|$hH@A^HhHH13̐ForceLoadMirrorDrvMitigationNS_ForceLoadMirrorDrvMitigation::InitializeHooksMultiH\$Ht$UH$`HHgH3HHHb33Af`YHL$R3AD$@ft$P:HL˻LHpHHpHD$@LHHD$0H`AHD$(HHt$ ABuLHT$PH`D(Dt3HL$PE33 DHtHHEHt H3HH3@L$I[Is I]Ð%SMirrorCompatBinaryExtensionSOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlagsMirrorDrvLoadedNotifyLD$LL$ SUVWH(3HBHH=WGx5HZLL$hHHӋ>xHH;wuf,^f,^zHtf.H(_^][ÐH0=StYA'H!LgAIH$HD$ =tH!L$H!HD$("AHH0[H%A̐NS_ForceTerminateProcess::APIHook_ExitProcessLI[IkIsI{ AWH@3HIHL= IDK1LHEH$ICL$(H KIC<uGHu%L=i HHt$HϔH<HuΉ3Hdu9uugH +HXX HH ;/HX(HHH HHHHtA3H4 L=H>#AI҉\$(HD$ ;H\H\$PHl$XHt$`H|$hH@A_ÐNS_ForceTerminateProcess::InitializeHooksMultiH0=HtYA.HLjAIH"HD$ D;tHL"HHD$( Hu Z>HHHsH0[H`̐NS_GetTopWindowToShellWnd::APIHook_GetTopWindowLI[IkIsI{ AWH@3HIHL=wIDKBLHEH!ICL$(HSKICV:uGHu%L= 跑HHt$H{HHuΉ3H{du9hu\ugH `HXX HH HX(HHH @HHHtAFHLAH!AI\$(HD$ 9HH\$PHl$XHt$`H|$hH@A_ÐNS_GetTopWindowToShellWnd::InitializeHooksMultiGetTopWindowLI[IkIsI{ AWH@3HIHL=IDK3L5HEHICL$(HKIC8uGHu%L=MHHt$HӐH HuΉ3Hdu9uugH 'HXX HH HX(HHH HHHtA5H8LYH:AIЉ\$(HD$ 7H H\$PHl$XHt$`H|$hH@A_ÐIgnoreFreeConsoleNS_IgnoreFreeConsole::InitializeHooksMultiFreeConsoleLIKWH`ICI[IsHـ=tYH}ICA>LD*HAI 7mt H\HD$(LHxHdHD$HHd$PHHL$H,HEHD$8Hd$@HT$8HL$H3Ht$8;=}HHcHHNH+Ju H6ȅuHL$8*HL$H/HL$8 HL$HH\$pHHUPL\$`I[Is I_ÐHJH˒HJ8鿒HT$UH0HHtH&HD$(LkHSH&HD$ ATL(H?AI5HYH0]ÐLI[IkIsWAVAWH@3HIHL=0ILrAHEHIC؉L$(H KIC 5DsA;uBHu L=IlH!HtD7$H3HxHuӉ3Hdu9uD5A;uHA΅u=A;HD$(HLHAHD$ P4A;uhH #HXX HH HX(HHH HHHtHHLAHA\$(HD$ 3HH\$`Hl$hHt$pH@A_A^_NS_IgnoreFreeLibrary::InitializeHooksMultiFreeLibraryHhHD$0HHL$H2Hd$@L&HT$HHL$8ݲD$8[HD$@Hd$@d$8H<HL$8辱HL$Hߏ3HhHJHǏHT$UH0H=vtTGtL LoH HHD$ AnL*HCAI2 H|H0]ÐNS_IgnoreFreeLibrary::ParseCommandLineLI[IkIsI{ AWH@3HIHL=IL9A-HEHICL$(HKIC1u%HL=3DH'Ht~du9uqu`HLHHD$(H~NA/HD$ X1H誉HHo3Bu6HtH]LFHA1\$(HD$ 0H^H\$PHl$XHt$`H|$hH@A_ÐNS_InstallComponent::InitializeHooksMultiH0Hd$@HD$@HHAE3HHD$ 2HL$@3ۅHt2H0[ÐSOFTWARE\Microsoft\Net Framework Setup\NDP\v3.5VWATAUAVAWHHDŽ$dv3L=#H58-tHHHD$ DOgMH֋u/tHHD$(LH$D$D뉜$$3HH$3s3L3H$HHD$PH\$XHL$P9$tH蝌 HD菌HxHL$`~HL$`9YHd/HL$`HtH+HDED$9Ytj|hH1/Ht!HL$`H+HtHHL$P蛍HL$`9Yt+|)Hh.HtH+D$`HDED$Y;RE33H =!38HL$PHD$P9Xgf8+]H>H$H$HD$pH\$xH$H$H$H$H$H$DHL$PH$H$zH$HD$ L$LD$pH$H$HL$peHD$p9XuH(HL$p辊E33H z2u(HyHD$ AMHֹ,D`EMeH %`HI0-LHu(H?AHD$ MHֹc,EHH s1uHAIH$萈HtH${H$H$>HT$pH$,H$H uO0u$HHD$ AMHֹ+H$rD$H$]H$OH$AHL$p6H$(3DBhH$@YDŽ$@h3H$H$H$HL$PVH$HL$HH$@HL$@H\$8H\$0\$(\$ E3E3H39/uNHHD$ AMHֹ*HL$`wHL$PlH$.3TH$1/H$H$/utH$Htt/H$Hta/H2HD$ AMHֹ*HL$`ˆHL$PH$肠3$tC= E$H$.H$.HL$`eHL$PZH$D$D$D;u$/D;uu$/̋HİA_A^A]A\_^[%windir%\sysnative\fondue.exe /enable-feature:Netfx3 /caller-Name:AppCompat%windir%\system32\fondue.exe /enable-feature:Netfx3 /caller-Name:AppCompattermprocesshonorquietonerrorterminateprocess /hide-uxPATHCould not get path!Could not allocate memory!Could not set path!CreateProcess failed!GetExitCodeProcess failedHhHJP鏃HJ`郃HtHJpkH\HPHDH8HT$UHPHtHCHD$(L Hx  HDHD$ ALH &HHP]ÐH8HAH :T*u*AQH+LtAIH9 HD$ %H8Ð1[INSTALLCOMPONENT SetFODEnvironment] Cannot set the FOD environment variableNS_InstallComponent::SetFODEnvironmentH\$WH0=HtZHS LtH AHD$ $HmtH0 LY HjHD$(L HHP؅tHH\$@H0_NS_InstallFonts::APIHook_AddFontResourceAH\$Ht$WH0=I؋HtZHLH AHD$  $vtH^L HHD$(z H/LËHPx؅t@0uHHt$HH\$@H0_ÐNS_InstallFonts::APIHook_AddFontResourceExAH\$Ht$WH0=I؋HtZHLH AHD$ #~tHfL HHD$(H7LËH؅t@0uHEHt$HH\$@H0_ÐNS_InstallFonts::APIHook_AddFontResourceExWH\$WH0=HtZHLxH AHD$ 3"tHL HHD$(HUHPH؅tHqH\$@H0_ÐNS_InstallFonts::APIHook_AddFontResourceWH0HH3H$ I!HT$PH A2I^%ueLL$PLwH$,xC3HL$ DB0EHd$HLHT$ H$LD$ 0D$4$H$ H3H0[ÐElevation:Administrator!new:%sZOO8_U%.P$D)|E3HtAAWAÐLI[IkIsI{ AVH@3HIHL5ILAHEHICL$(HKICuEHu#L5SwH(Ht7$HxHpHuЉ3Hdu9uHdH %HXHHH FX HHH HHH8H HX(HH@H HP0HHhH HXHHHpH XPHH HXXHP`HXxHHHHHHtHLDHMA\$(HD$ HH\$PHl$XHt$`H|$hH@A^ÐNS_InstallFonts::InitializeHooksMultiAddFontResourceAAddFontResourceWAddFontResourceExAAddFontResourceExWHXHH3H$@HD$0LA33D$(HD$ "t HL$0H$@H3HXÐH\$WH0HeH %`HI0DBHHtH(H_HGG3HHd$HLL$Hix9HL$HHd$ E3HL3PHL$HHRy:HLA HALXHQHD$ HHPH\$@H0_ÐInstallFonts, Font failed to installNS_InstallFonts::InstallFontWInstallFonts, failed to cocreate font managerT18UpT1OH yHtHIx KH [ÐH 3MtMHhH+u HdH+BHt&H<H+u H8H+BHt I@IHPWH [ÐFT5HdEwFH LYueH %`3HI0NH [ÐLI[IkIsWH@=bAHHtYHLHeAICtHL2HHD$(LHsH˿@HDHHЋ3HD$0L )DBH NHD$ HL$0LD$hH:HHL$hE3HHP(xpHL$0.tbHL$hLHaHL$0HHL$hDHӅy+HLMH.AHD$ XHL$hHPHL$0HPH\$PHl$XHt$`H@_ÐNS_MakeShortcutRunAs::COMHook_IPersistFile_SaveFailed to save shortcut with RunAs marking.H\$Ht$WH0=THHtZHLHQAHD$ {tHLHHD$(LHzH˿@HtHHHˋ)tHH\$@Ht$HH0_ÐNS_MakeShortcutRunAs::COMHook_IShellLinkA_SetArgumentsH\$Ht$WH0=GHHtZHLHEAHD$ otHLHHD$(LHzH˿@HtHHHˋtHH\$@Ht$HH0_ÐNS_MakeShortcutRunAs::COMHook_IShellLinkA_SetDescriptionCOMHook_IShellLinkA_SetDescriptionLI[IkIsWH0=AHHtYHLHAIC,tH}LHHD$(LHsH˿@Ht!DHHHˋ tHCH\$@Hl$HHt$PH0_ÐNS_MakeShortcutRunAs::COMHook_IShellLinkA_SetIconLocationH\$Ht$WH0=HHtZHLHAHD$ tHhLHHD$(L HzH˿@HtHHHˋ tH1H\$@Ht$HH0_ÐNS_MakeShortcutRunAs::COMHook_IShellLinkA_SetPathH\$Ht$WH0=HHtZHLHAHD$ xtH`LHHD$(|LHzH˿@HtHHHˋ tH)H\$@Ht$HH0_ÐNS_MakeShortcutRunAs::COMHook_IShellLinkA_SetWorkingDirectoryCOMHook_IShellLinkA_SetWorkingDirectoryH\$Ht$WH0=HHtZHCLHARHD$ 8btH LqHZHD$(LD$XHT$(HL$Xt&HHIHL$(@lj$HL$(_HL$X$3ۋ$$uH PtH$HĀA^_^Ðfffffg8g `g@g d@d`dddd d@e@eheeeeef@fhf HJH]HJ8]HJXHJ(]HT$UH HHH ]ÐLI[IkIsI{ AWH@3HIHL=ILAAHEHICL$(HyKIC|uGHu%L=WHrHt$HXHַHuΉ3HAdu9.u"ueH H@kHXHH X HX(HHHtHLhHAA\$(HD$ HH\$PHl$XHt$`H|$hH@A_ÐOverrideShellAppCompatFlagsNS_OverrideShellAppCompatFlags::InitializeHooksMultiSHLWAPI.DLLH@HD$ Ht,Dt#HHL$(HL$((HL$([HHWH@[H̐HJ(w[H H.ttH=(HHH [H̐H@HD$ H\$PHH t,t#HHL$(HL$('HL$(ZHHHH\$PH@_H̐HJ(ZH\$WH HHgttHv'HGHHH\$0H _H̐H\$WH HHPH؃t3H2t #=tH׋t H\$0H _ÐH\$Ht$WH HIHt3Ht ! =-t HIt3 H\$0Ht$8H _ÐH\$Ht$WH H2IHt3Ht *! =t Ht3 H\$0Ht$8H _ÐH\$WH HöHPx؃t3Ht #=GtH׋wt H\$0H _ÐH@HD$ H\$PHHt, t#HHL$(oHL$(T%HL$(YXHHHH\$PH@_H8̐HJ(/XH@HD$ H\$PHt$XAHHt,| t#HHL$(HL$($HL$(WDHHHH\$PHt$XH@_H̐HJ(WH\$Ht$WH AHHGt tHV$H'DHHH\$0Ht$8H _H̐HWHPH@HXHhHpIIHHt, t#HHL$8HL$8#HL$8VLLHHHH\$`Hl$hHt$pHP_HXHJ8VH\$Hl$Ht$WH0IIHHCt tHR#LLHHHH\$@Hl$HHt$PH0_H̐H\$WH HHt tH"HóHHH\$0H _Hh̐HWHPH@HXHhHpIIHHt,* t#HHL$8HL$8z"HL$8ULLHHH4H\$`Hl$hHt$pHP_HHJ8GUH\$Hl$Ht$WH0IIHHt tH!LLHHHH\$@Hl$HHt$PH0_H(̐UVWATAUAVAW H+HקH3H$pL$L$HID3HL$r3AMfD$p賸$ $MωD$P$Ll$H|$@D$8$D$0$LƉD$(HAHLd$ P؅LL$`HT$pH. tsHL$`te_t\HL$` $ MωD$P$Ll$H|$@D$8$D$0$LƉD$(HSAHLd$ P؋H$pH3虙HĈA_A^A]A\_^][ÐH\$Hl$Ht$WH`= IIH 3DBHHHtdH$HH$HHH$$HL$PH$HL$HH$HL$@H$HL$8D$0HT$(H TH$HD$PH$HD$HH$HD$@H$HD$8$D$0H$HD$(H$HD$ HLLNjHL\$`I[IkIs I_ÐH\$Hl$Ht$WATAUAVAWH`$MMLH ($$H$H$D$PH$HD$H$MΈD$@H4D$8|$0MIHHl$(H\$ D[H{PLƋHHK8$L$H$D$PH$MHD$H$MLjD$@$|$8D$0HIHLl$(Hl$ E3DL9} rGv GۃIL9}K8 s{@u3#C8KD9=tB׃tt"t u.LCPLCh LC^LCDDK լcu-3DBHHtH0HxHH 7HHH|DH\$0Ht$8H _H8̐HWHPH@HXHhHpAIHH_t,t#HHL$8MHL$82HL$87NH't,t#HHL$8HL$8HL$8MDLHHHH\$`Hl$hHt$pHP_HHHJ8MHJ8MH\$Hl$Ht$WH0AIHHWttHfH:ttHIDLHHHH\$@Hl$HHt$PH0_Hx̐HHXHhHpHx AVH =ܪIILHtf ̪ZuU3DBHHHt8LHLLHL0HhAhx(HH>HQLLIHhH\$0Hl$8Ht$@H|$HH A^ÐH =Ht uH%HHH [H̐H\$Ht$WH =ʩIHHt> Ku-3DBHHtH0HxHH HHHdLH\$0Ht$8H _H̐H@3D$PH9խHD$XHAE3HHD$ u@HL$XHD$PL+HD$0HA@ HD$(3H\$ HL$XH]HHHDHE97u;(LL$`E3H3UtHH9D$`v H@[ÐSOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CustomPlaceholderMinFreeDiskHHXHhHpHx AVH03HHf;HIM׽HtE3DHЅHF;LHHHFHHvf;jLHHL$ HHuRh\f;+uBEf;Ctf;ku3f;Cu-f;ku'Hsnt:f;C u f;k uI6IH\$@Hl$HHt$PH|$XH0A^ÐH\$WH H _3Hug \u L_L .H GE33H HEH t 3H HH\$0H _ÐF+_C(ڦHH\$WH H HںOHtHSHLH3 3H\$0H _H%̐H\$WH H UHO >3ҋjL3HLH\$0H _ÐH\$Ht$WH H HںIHt HSLH ̤3H\$0Ht$8H _H%P̐LI[IkIsWH@3HIHHHELH~ICL$(HKAICu1HHsH8@HHt~.du9uqߣ uc(ḤL=HHD$(H*OAHD$ HVAHHj3HiH H#HH LJHHH HP0HHH HP`HH8H HHH@H HHHhH )HHHpH HXHH X HH HX(HH nHXHHH XPHH HXXHH HXxH(H H0H HHXH RHH`H HH -HHH HHHH HHHL H8@HHLPHhpHxLHHLHHHLHHLH(0H8L@HX`HhLpHHLHHLHHH WHH HH SHH }H H HHH iHPH HxH HH HH HH cHH mHLH PHH HHHLH HH HHHLH HH HH H(H L0H8H H@HHPHXL`H HhH HpHxHHH mHH HHHHL H GH(H H0H8@HHHPH 8HXH ~H`HhpHxHH HH HHHLH HH ,HHHHtHsLDHA1\$(HD$ HH\$PHl$XHt$`H@_ÐNS_PlaceholderFiles::InitializeHooksMultiNTDLL.DLLNtCreateFilekernel32.DLLntdll.dllNtQueryDirectoryFilekernel32.dllMoveFileTransactedAMoveFileTransactedWEncryptFileAEncryptFileWReplaceFileAReplaceFileWNtCreateThreadExQueueUserWorkItemNTDLL.dllTpAllocWorkTpReleaseWorkTrySubmitThreadpoolCallbackH(HH 3Ht HHPH(ÐH\$WHHH3H$pHHL$03A@ 36ub S+LD$0SE3Hω\$(H\$ &Ht"D$0t|$TuH D3H$pH3~H$HĀ_ÐH\$WHHHH3H$HHL$03APD ֚3bub ĚSWLD$0SE3Hω\$(H\$ BHt"D$0t|$TuH" p3H$H3誂H$HĐ_ÐH@HD$ HL$(EHT$(HL$(,<H@[HJ(<H\$Hl$Ht$ WH@HH3H$0HAIHT$ E3AH3[=sHHD$(LHHLHt;H H+ |u HKH+ wHtHH+u HCH+{HHuHHH\$@H0_I̐NS_RedirectDefaultAudioToCommunications::COMHook_IDirectSoundCapture_InitializeCOMHook_IDirectSoundCapture_InitializeUVWATAUAVAWHH-nH3HD$p=wL$L$L$L$IIHHtZHALZH˥AHD$ ͽ6z{wtHLHXHD$(:L_H@HGLH٠LHt5HH+uHOI+Ht!HH+Ӡu HGH+ΠHtՠD$`Ht5HH+uHCI+Ht!HH+|u HCH+wHt~$Ll$@Ld$8D$PD$0LD$PHT$`LHL|$(Lt$ AHL$pH3_HĈA_A^A]A\_^][ÐNS_RedirectDefaultAudioToCommunications::COMHook_IDirectSoundFullDuplex_InitializeCOMHook_IDirectSoundFullDuplex_InitializeH\$WH0=uHHtZH8LH£ArHD$ Ļ-xuutHLHOHD$(1LHH>LHt;H H+ ̞u HKH+ ǞHtHH+u HCH+HHuHĞHH\$@H0_I̐NS_RedirectDefaultAudioToCommunications::COMHook_IDirectSound_InitializeCOMHook_IDirectSound_InitializeLI[IkIsWAVAWH@3HIHL=`IDsLHEHCAIC؉L$(H6AIC9uEHu#L=qH wHt7$H`HqHuЉ3Hvdu9vuvH HHXHHH HHHH HP0HH8HH kHH@H HP`HHhH HHHpH HHH vHHH H HH HPHH 3HH X HH HX(H(H tHXHH0H XPHXH uHXXH`H wHXxHHHHHHHH8@HHHhpHxܷH -nHu LH-DHD$ H mHLrH DHD$ uH mH5LPHMHt$ CH mL%HMHt$ jH imHDMLHHD$ 7HtHWLHA&AΉ\$(HD$ HsH\$`Hl$hHt$pH@A_A^_ÐFGbDEST?9O5r!͉%It$ 0YyGAj#wzLB.lPYm'I! `~ ŕ4H f!͉%NS_RedirectDefaultAudioToCommunications::InitializeHooksMultiWINMM.DLLwaveOutOpenwaveInOpenDSOUND.DLLDirectSoundCreateDirectSoundCreate8DirectSoundCaptureCreateDirectSoundCaptureCreate8DirectSoundFullDuplexCreateGetDeviceIDDSOUND.DLLH H%HH\$WH 3H9y ~HcH @HHIH ;{ |Lc MteH %`3HI0H#ceH %`HI0L3͵HH\$0H _ÐH H"eH %`HI0L3HH [ÐH\$WH =sڋtxHpӋH\$0H _H`̐H\$WH HpIPH؅uHcH\$0H _ÐLI[WHPH$H$ICH$I{IC؋$D$($D$ HGp؅uHH\$`HP_ÐLI[WHPH$H$ICH$I{IC؋$D$($D$ Ho؅uH{H\$`HP_ÐH\$WH HoIPx؅uHCH\$0H _ÐHAVH@H@HXHpHx HL3H9=qtVHqHXHʷH;s0IHL$(HT$(H qLHL$(HHH\$PHt$XH|$hH@A^ÐHJ`HJ(HT$UH HHH ]ÐLISIKSVWATAUAVAWHICML3ۉ\$0$I[I[I[HfICI[IK,HHL$XHD$@HD$ DE3IHHkH\$@uxIUHtoHL$hf HFHL$hLD$hIHcu4D$0HD$@HD$ DE3IHHL$@HEHL$@HL$hi HD$8HD$ DE3Ld$XIHH\$8IUHHL$h H3HL$hILD$hIHu7DŽ$HD$8HD$ DE3IHEHL$8HEHL$8HL$h H9\$8t/HD$HHD$ DE3HHtH\$H H9\$@uHo;x }qHcHHLfA8\u"HL$@HtOIMHH'7HHfA9@uH v#HL$HHtHD$8HtIMH냋H qn;y }EHcL@LKLpMt*HD$8HD$ LL$@MEH$KLAH +n3HL$Ld$XHL$HHtHD$8Ht H HL$@Ht9$t IH9\$0t IHHL$X" HĀA_A^A]A\_^[ÐSoftware\ClassesAppData\Local\Microsoft\Windows\UsrClass.datNTUSER.DAT_ClassesHJXC HJh7 HJh+ HT$UH0HHwH0]ÐHHXLH HPUVWHhHHeHeIHEHAE33HD$ 9؅gH!t$@HMoHEHD$8H!t$0HiE3E3HD$(!t$ ؅$H!t$XH!t$PHM!u!u!u!u'!uHEHD$HHE'E3HD$@HEE3HD$8H!t$0HEHD$(HE3HD$ ؅E;}';M<} E;s ~;GʺDeH %`HI0FHHt3ɋHЉMHU79MEeLM/EHELHD$8HT$0HMHE}/HD$(Hd$ uP!E+HMHE+HD$(Hd$ E3E3H׭u2HELM7DEHMHD$(EH։D$ =tE؋MHU7M;MN39}vgHd$8EHd$0HMHd$(Hd$ LMLƋ׉EAuLMHUHML=tE;}r HteH %`L3HI0HMHtHMHtڬH$Hİ_^]ÐLI[IkIsWATAVH@3HIHL%IDsLJHEH'AgIC؉L$(HڍAICݩu'HL%HaI<HfHtD7du9fuqzfCucHgfLHHD$(HuAiAΉHD$ OHH`Hm3;+HfH͘H HH tHXHHH X HHH HX(HH8H HP0HH@H HXHHHhH XPHHpH HXXHH HP`HH HXxHH >HHHHHHHHHtHVLWH8ApAΉ\$(HD$ HdH\$`Hl$hHt$pH@A^A\_RedirectHKCUKeysNS_RedirectHKCUKeys::InitializeHooksMultiExitWindowsExHWH`H@HXHpHHHhH5\Ht$8Hd$@(E3HL$(7غ)HL$(HuH+D$(H~M~HDCA;|?+DHHT$HHL$(HHL$8HL$HHL$(v!Ht$8Hz`HHHL$(ۦHCHtHH{H\$HHT$8HL$PzH=euWW H tFG G HcHIHH HtH!H[HAHaHD$HHHHT$P2HL$PHL$I[IsI{ Ms(I]ÐProfileImagePathSoftware\Microsoft\Windows NT\CurrentVersion\ProfileListHHXHhHp WH HcH@Bw}3;Y~kL@VHxXeH %`LD$@VHI0HHt5HcOHLIHI*[eH %`LHI03jH/_9_@Ƌ3H\$0Hl$8Ht$HH _ÐHHXHhHHVWAVH03H!X9LD$PS HeH %`SDCHI0HH3L5kILD$h3NtHD$hH vHDD IHut+H!l$(H!l$ 7HL$PE3L3ureH %`L3HI0HHL$P>Hl$`H\$XH0A^_^ÐggH(HH HcB9A}3L3ɅH(ÐLAWHPICI[IsI{ =WuHMICIcIShuHL$(I3H]W;X }+HcHHHL$(TtHL$(3H,W;X HcHHHL$(HWHDAHT$8HL$(rHD$8xL=VL|$hIݜ3HV;{ }YHcHH3HHL$8u2HT$8Ht3HpHVH{HjV;{ |HT$8HqIfHL$8HL$(H\$`Ht$pH|$xHPA_ÐHJ(kHJ8_HJhsHT$UH HHH ]ÐH\$HT$HL$UVWATAUAVAWH0E3A@MEAH$HHL9{$9sDCI:K;tfAtHD$(LwHssZuIaD$P3|$0H 3EHL$XH!|$`HL$@H!|$HHL$hH!|$pH!|$8!$ȅt6HHD$ ALHKwO2HT$XIoHT$XHL$@AHL$@E3HT$@3t7Pt2=t+HHD$ AL6HvHL$XEHIHrKPD$0DL$HT$8IDj3ɉL$4$;HcHD$xHT$8HHL$@ HT$xHD$8HHL$hHL$@E3HT$@32t9Pt4=t-HHD$ ALQHuύ#HL$hEHIHJPD$0L$45$HL$8MHL$hQHL$@FHL$X; D$L$L$t$P|$0u!u!EIIHJPt3HĐA^A]A\_^Ð[CopyFileA] SHCreateDirectoryExW failed with error.[CopyFileA] Invalid Redirection Option.HJXoHJ@cHJhWHT$UH0HHtH_}HD$(LktHrqH`}HD$ ALH?t$HH0]ÐHLH L@HPHHVWATAUAVHH@MML=FtZHpHD$ AKL{HsE HtHoHD$(LsH/oqI^]D$83|$4H @HL$`H!|$hHL$PH!|$XHL$pH!|$xH!|$@!|$0ȅt6HHD$ ALH sOHT$`IkHT$`HL$PHL$PE3HT$P3֎t7Pt2=t+HHD$ ALEHrsHL$`$L$(H$HL$ MMHH$HGPxD$4DLD$0HT$@IeDd$0E3E;IcHT$@HHL$PIcHD$@HHL$pHL$PE3HT$P3ߍt9Pt4=t-H(HD$ AsLNHq|MHL$p$L$(H$HL$ L$L$HH$HFPxD$4AAHL$@IHL$pHL$PHL$`L$t$8|$4uKuK$D$(H$HD$ L$L$IH$HvEPxt3HĀA^A]A\_^Ð[CopyFileExA] SHCreateDirectoryExW failed with error.[CopyFileExA] Invalid Redirection Option.HJ`HJPHJpHT$UH0HLDtHxHD$(LoHnWmHxHD$ ALbHoHH0]ÐLMK MCISIKVWATAUAVHpICMML={AtYHkICALH(o HAoCtH^kHD$(LnHjzlIYD$83|$4H S<HL$`H!|$hHL$PH!|$XH!|$@!|$0ȅt6HHD$ AL_HxnO_HT$`IhHT$`HL$PnHL$PE3HT$P3Dt7Pt2=t+HHD$ ALHm$D$(H$HD$ MMHT$`H$HBD$4DLD$0HT$@IbDd$0E3E;IcHL$@HHL$P*HL$P8E3HT$P3ht9Pt4=t-H!HD$ ALH mO$D$(H$HD$ L$L$IcHD$@HH$HAD$4A3AHL$@EHL$PdHL$`YL$t$8|$4uNuN$D$(H$HD$ L$L$IH$HAt3HpA^A]A\_^Ð[CopyFileExW] SHCreateDirectoryExW failed with error.[CopyFileExW] Invalid Redirection Option.HJ`kHJP_HT$UH0H?tHgtHD$(LskHihHhtHD$ AL.HGk,HH0]ÐHD@HPHHVWATAUAVHH@ELL==tZH!gHD$ ALWHj<?tHfHD$(LjH3fhI^UD$83|$0H 7HL$hH!|$pHL$XH!|$`H!|$@!$ȅt6H^HD$ A*LHjOHT$hIcnHT$hHL$X HL$XE3HT$X3t7Pt2=t+HHD$ A L(Hi~EHT$hIHD>PHD$0DL$HT$@IF^3ɉL$4$;HcHD$HHL$@HHL$XHL$XE3HT$X3t9Pt4=t-HHD$ ALcHh$EHT$HHD$@HIHt=PHD$0L$4L$HL$@@HL$X:HL$h/ D$L$L$t$8|$0u!u!EIIH<PHt3HĀA^A]A\_^Ð[CopyFileW] SHCreateDirectoryExW failed with error.[CopyFileW] Invalid Redirection Option.HJh_HJXSHT$UH0H;tH[pHD$(LggHedH\pHD$ A1LʓH;g HH0]ÐLMK MCISIKSVWAVAWHpICMMHH=8tYHcICA L}Hf~8:tHbHD$(LfH!bd3ۉ\$PH3HD$`H!\$hLD$`HH8t uHL$`ZHH$HD$HH$HD$@H$HD$8H$HD$0$D$($D$ MMHH:x؉D$P,HHD$ A LfHe}HL$`I$L$L$H$H$\$PueH$HD$HH$HD$@H$HD$8H$HD$0$D$($D$ MMHHH9x؋HpA_A^_^[Ð[CreateProcessA] Invalid Redirection Option.HJ`oHT$UHPH8tHwmHD$(LdHbbHxmHD$ A LHWd<|HHP]ÐLMK MCISIKSVWAVAWHpICMMHH=!6tYH6`ICA6 LՓHc{5%8tH`HD$(LcHI_0a3ۉ\$PH1HD$`H!\$hLD$`HH6t mH$HD$HH$HD$@H$HD$8H$HD$0$D$($D$ MMHT$`HH7؉D$P,HHD$ AV LƒHbzHL$`y$L$L$H$H$\$PueH$HD$HH$HD$@H$HD$8H$HD$0$D$($D$ MMHHH6؋HpA_A^_^[Ð[CreateProcessW] Invalid Redirection Option.HJ`HT$UHPH(6tHjHD$(LaH_3_HjHD$ A\ L~HalyHHP]ÐHL$VWATAUAVAWHhHD$8H=m3tZHy]HD$ ALWH ay93g5tHV]HD$(L`H\r^HJD$3$H D.HL$PH!|$XHL$@H!|$HH!|$0!$ȅtpt2thHGHD$ ALHn`OUxHT$PHYHL$PqHH4$yDL$HT$0HSD$tGE3Ll$0E;}:IcITHL$@HL$@ HH4$AAHL$08HL$@cHL$PXH$D$$uAuHH/4t3C|HhA_A^A]A\_^Ð[DeleteFileA] Invalid Redirection Option.HJPHJ@HT$UH0HH3tHgHD$(L^H\S\HgHD$ A!LތH^vHH0]ÐHL$VWATAUAVAWHXHD$8H=0tZHZHD$ A3LH@^%vX02tHvZHD$(L^HY[HHD$3$H d+HL$@H!|$HH!|$0!$tdt2t\HHD$ A_LH]OuHT$@H?WtHL$@H72($bEL$HT$0H6RD$t0E3Ll$0E;}#IcILH1($AAHL$0]5HL$@H$D$$uAuHH1(t3yHXA_A^A]A\_^Ð[DeleteFileW] Invalid Redirection Option.HJ@#HT$UH0H0tH+eHD$(L7\H`ZYH,eHD$ AfLrH \sH H0]ÐLIKWHPICI[H=-tYHXICAxL@H[s-/tHWHD$(L{[HWXHCE\$hH (HL$8Hd$@xD~ktta3HT$8HStNHL$8NHH/X؉D$h,HoHD$ AL}HZrHL$8 H|$`\$huHH}/X؃t3wH\$pHP_Ð[GetFileAttributesA] Invalid Redirection Option.HJ8HT$UH0H.tHcHD$(L'ZHPXWHcHD$ ALHYqHH0]ÐHL@PHHSVWAVHXH@IDH=+tZHUHD$ ALHYpq+-tHUHD$(L]YHTVH%C3ۉ$H &HL$8H!\$@xM~tttj|H'O gHH0]ÐHD@HPHHVWAUAVAWHH@ALL= tZHKHD$ A L|HNf "tHJHD$(LzNHJKAA;uIIH#8I8D$83|$0H HL$`H!|$hHL$PH!|$XHL$pH!|$xH!|$@!$ȅt6HHD$ AaL/{HMOeHT$`IaFHT$`HL$PHL$PdE3HT$P3it7Pt2=t+HHD$ AWLzHLM1eHL$`gE3HIH!PD$0DL$HT$@I@D$3D$4A;HH$HT$@HHL$PH$HD$@HHL$pjHL$PxE3HT$P3ht9Pt4=t-HHD$ A;LyH`LEd#HL$pyE3HIH!PD$0D$46AHL$@x$HL$pHL$PHL$`L$L$t$8|$0u'u#D$IIH 8tIHk t3hHĀA_A^A]_^Ð[MoveFileExA] SHCreateDirectoryExW failed with error.[MoveFileExA] Invalid Redirection Option.HJ`˿HJP鿿HJp鳿HT$UH0H<tHSHD$(LJHHGHHSHD$ AhLxHJbHH0]ÐLECISIKVWAUAVAWHpICALL=wtYHFICALwH(J bDotH^FHD$(LIHEzGAA;uIIHhI4D$83|$0H 0HL$`H!|$hHL$PH!|$XH!|$@!$ȅt6HsHD$ ALvHRIO9aHT$`IBoHT$`HL$PHHL$PE3HT$P3et7Pt2=t+HHD$ ALmvHH`E3HT$`IHPHD$0DL$HT$@I=D$3D$4A;HH$HL$@HHL$PHL$P%E3HT$P3Udt9Pt4=t-HHD$ ALuH H_'E3H$HD$@HIHPHD$0D$4MAHL$@! HL$PvHL$`kL$L$t$8|$0u'u#D$IIH7htIH(t35dHpA_A^A]_^Ð[MoveFileExW] SHCreateDirectoryExW failed with error.[MoveFileExW] Invalid Redirection Option.HJ`郻HJPwHT$UH0HtHOHD$(LFHD DHOHD$ ALsH_FD^HH0]ÐLISIKVWAUAVAWHpICLL=DtYHKBICAL2sHE]:tH)BHD$(LEH^AECI0D$43$H HL$XH!|$`HL$HH!|$PH!|$8!$ȅt6HnHD$ AL|rH=EO$]HT$XI>uHT$XHL$H3HL$HE3HT$H3 at7Pt2=t+HHD$ ALrHD\E3HT$XIHlPH$DL$HT$8Ik9D$3D$0A;HH$HL$8HHL$HHL$H E3HT$H3=`t9Pt4=t-HHD$ AL4qHC[*E3H$HD$8HIHPH$D$0JAHL$8HL$H[HL$XPL$L$t$4$uuIIH!tIH (t3`HpA_A^A]_^[MoveFileW] SHCreateDirectoryExW failed with error.[MoveFileW] Invalid Redirection Option.HJXwHJHkHT$UH0HtHsKHD$(LBH@?HtKHD$ ALoHSB8ZHH0]ÐHLH L@HPHHVWAUAVAWHH@ILL=#tjH->HD$ ALoHAYtH >HD$(LAH?=&?L$H$$u#D$ LIIH0I1+D$`3|$0H HL$hH!|$pHL$PH!|$XHL$xH!$H!|$H!|$8ȅt6HHD$ APLnH@OXHT$hIs9HT$hHL$PеHL$PvE3HT$P3\t7Pt2=t+HHD$ AFL%nH^@CXHL$hyE3HIHPD$0DLD$8HT$HI3Dl$83D$@A;HHD$8HT$HHHL$P蠵HT$8HD$HHHL$x舵HL$PE3HT$P3[t9Pt4=t-HHD$ A*LEmH~?cW#HL$xE3HIHPD$0D$@HHL$x襚HHD$hH\$pHD$x9XuGH*HD$ AHLQH&=HL$h軚HL$x谚pHL$xHL$xt A\$tHL$hwHL$xl,HL$x HL$x L S>L#H#HL$xsHCDHL$xH$HD$ AE3HHk?tGHHD$ AdLPH%<HL$h蹙HL$x讙nH\$XH\$PH\$HH\$@H\$8H\$0HD$`HD$(H\$ E3E33H$>tGHHD$ AuLHPH$f<HL$h+HL$x D$`D$`E3APHH$HuHL$hHL$xۘD$`D$dH\$8H\$0H\$(H\$ LL$dLAH$@>uAƋD$`D$dHtHc$$LIeH %`HI0<IEHuGHHD$ AL/OHh#M;HL$hHL$xDD$`D$dL5H\$8H\$0H\$(H\$ LL$dLAH$`=AŋD$`D$dHtL*H$$y)Lt$ ALrNH":nLǺH$`y$Lt$ AL0NHi"N:DŽ$H$HD$(H$HD$ L$LH$H<tHHD$ AAH$HL$h託HL$hHL$hXHL$hBL :LHHL$h諯IHL$hΘHT$xHL$h还HD$hHLcM$9HL$PLHHL$@kH$HD$ HT$PHL$@ty&HL$Xh`HL$h]`HL$@R`HL$P1H|$0Ht$(HHD$ ALH<LHHL$@XkMHT$@HL$hvLHHL$@2kMHT$@HL$XvHD$XHD$ LL$hLHI\$xHL$X_HL$h_HL$@z_\$xL$I[ Is(IA_A^_Ð\Registry\Machine\SOFTWARE\Clients\%s\%s\Protocols\%s\DefaultIcon\Registry\Machine\SOFTWARE\Clients\%s\%s\Protocols\%s\shell\open\command\Registry\Machine\SOFTWARE\Classes\%s\DefaultIcon\Registry\Machine\SOFTWARE\Classes\%s\Shell\Registry\Machine\SOFTWARE\Classes\%s\Shell\open\Registry\Machine\SOFTWARE\Classes\%s\Shell\open\commandSetting %s as owner of %s protocol NS_SetProtocolHandler::PwnProtocolHJ@\HJh\HJX[HuHT$UH@HH]H@]ÐLSVWAVAWHICHЮH3H$MILHH$HBICIcHD$0IcLLH"HL$0fHD$HHD$ HT$@HL$0koyHL$01[HL$P&[HL$@LLHHL$0^fHD$HHD$ HT$@HL$0oyHL$0ZHL$PZXHL$@LLHHL$0fHD$HHD$ HT$@HL$0nyHL$0}ZHL$PrZHL$@QLLHHL$0eHD$HHD$ HT$@HL$0]nyHL$0#ZHL$PZHL$@LH=HL$0SeHD$HHD$ HT$@HL$0nyHL$0YHL$PYMHL$@LHVHL$0dHD$HHD$ HT$@HL$0myHL$0uYHL$PjYHL$@ILHHL$0dHD$HHD$ HT$@HL$0XmyHL$0YHL$PYHL$@LHHL$0NdHD$HHD$ HT$@HL$0myHL$0XHL$PXHHL$@LHHL$0cHD$HHD$ HT$@HL$0lyHL$0pXHL$PeXHL$@DLHHL$0cE3HT$0HL$PlHD$PLL+B+uHutHHL$PXE3HT$0HL$PnLLHHL$P5cHH"HoHL$PuLnLnHHHHL$xWHL$xyHgHtwH+D$xH~jDHT$hHL$xiHHL$xWHL$h"WH[HL$xYLLHHL$0ZbL HT$0HL$xmHL$xV!H0H$uLHH LLHiHL$0aHHL$PWLHT$0HL$PmLLH/HL$0aHHL$PXWLHT$0HL$PJmLLHHL$0aLHeHL$P{aMHT$0HL$P mMH/HL$0UaHHL$PVL=HT$0HL$PlLHHL$0aH3HL$PVE3HT$0HL$PlHL$P^LHT$0HL$P{lLHHL$0`IHL$PVVE3HT$0HL$PHlLHZHL$0`HHL$P#VE3HT$0HL$Pl3HD$zf$ fD$xD$zE3LD$x<E3E33ҹ)LHgHL$0`3HL$0aLE3APHL$0OmHL$0|THL$PqTH$H3莚HĐA_A^_^[Ð\Registry\Machine\SOFTWARE\Clients\%s\%s\Capabilities\Registry\Machine\SOFTWARE\Clients\%s\%s\Capabilities\Startmenu\Registry\Machine\SOFTWARE\Clients\%s\%s\Capabilities\URLAssociations\Registry\Machine\SOFTWARE\Classes\%s.Url.Mailto\Registry\Machine\SOFTWARE\Classes\%s.Url.Mailto\DefaultIcon\Registry\Machine\SOFTWARE\Classes\%s.Url.Mailto\shell\Registry\Machine\SOFTWARE\Classes\%s.Url.Mailto\shell\open\Registry\Machine\SOFTWARE\Classes\%s.Url.Mailto\shell\open\command\Registry\Machine\SOFTWARE\Clients\%sSOFTWARE\Clients\%s\%s\CapabilitiesMicrosoft OutlookMicrosoft Office Outlook\Registry\Machine\SOFTWARE\RegisteredApplicationsEudora\Eudora.exe\EuMAPI32.dllMozilla ThunderbirdApplicationDescription\Registry\Machine\SOFTWARE\Clients\%s\%s\Capabilities\StartMenu%s.Url.MailtoURL ProtocolURL:MailTo ProtocolSOFTWARE\Clients\%sHJP'MHJ0MHJxMHJhMHT$UH0HH~H0]ÐHHXHhHp WH HcH@Bwz3;Y~hnL@HˋNxSeH %`LD$@HI0 HHt1LcGHHI襰eH %`LHI03H/_9_@Ƌ3H\$0Hl$8Ht$HH _ÐHUHhHHEHXHpHxIHHHHMKHtHMoKL3HMP3H]]HgHMLHEHD$ HUHM_HMvHHMvLHEHD$ HUHM_HM>HWHM>LHEHD$ HUHMT_HMHHMLHEHD$ HUHM__HMHUHM9KHMHUHM} 3h LEk]HMHHf9AuHH*HMMLLH4HMUL|HUHM[aHHMGKHHM7KE3HUHM+aHpHMKHUHMrJHHMLE3HUHM`HHMJHHMJE3HUHM`HsHMJHHMJE3HUHM`HMPcHMvIHMlIL$I[IsI{ I]Ð\Registry\Machine\SOFTWARE\Classes\CLSID\{29F458BE-8866-11D5-A3DD-00B0D0F3BAA7}\Registry\Machine\SOFTWARE\Classes\CLSID\{29F458BE-8866-11D5-A3DD-00B0D0F3BAA7}\LocalServer32\Registry\Machine\SOFTWARE\Classes\CLSID\{29F458BE-8866-11D5-A3DD-00B0D0F3BAA7}\ProgID\Registry\Machine\SOFTWARE\Classes\CLSID\{29F458BE-8866-11D5-A3DD-00B0D0F3BAA7}\VersionIndependentProgID\mozMapi32.dllMozilla MAPI /MAPIStartUpMozillaMapi.1MozillaMapiHJ0EHJ@EHJ`w_LI[IkIsI{ AWH@3HIHL=IDKgL-HEHICL$(HkKICnu!Hu~L=ş3?HHt|du9uou^HΤDNhLHD$(HH8NHD$ H:@H?Hq3Au5HtAkHL@HAI\$(HD$ H?H\$PHl$XHt$`H|$hH@A_ÐNS_SetEnvironmentVariable::InitializeHooksMultiHPHD$0H\$`=StSHSHD$ DI.LCH,&HtH7HD$(LHlSHHH\$ht <|t H;|u HH\$h;HHL$8CHL$8LtEHL$8OHHu+H[HD$ AOLHjAI HL$8BH\$h;|THH\$`HP_ÐError Setting Environment VariableHJ8BHT$UH0HtHHD$(LHHHD$ AVLHAIYH?H0]ÐH(Lc}ExaHcH@HIЋu HPH(Ð{|"$& #{|"$& H\$WH HI؋PHD~)t$H}6HrHuʉ>3Hdu9=u~ zH NHH{HCHx{ HCHH HC8HHLeHFA3|$(HD$ $HHH\$PHl$XHt$`H|$hH@A_ÐSystemMetricsLieNS_SystemMetricsLie::InitializeHooksMultiGetSystemMetricsSystemParametersInfoASystemParametersInfoWH(H=tkH Hdcu!LH HMDu ^)H eH2! CDʉ 3H(ÐWINXPVISTAWIN7LI[IkIsI{ AWH@3HIHL=IDKDL-HEHICL$(H[KIC^u!Hu~L=32HŗHt|du9uou^HDNELHD$(HHXNHD$ H*3HHq3Au5HtAHH׾L@HAI\$(HD$ ~HH\$PHl$XHt$`H|$hH@A_ÐNS_TerminateExe::InitializeHooksMultiH8t H8tHLsHdHD$(莿A)H]LvAIHCHD$ H ;u 3;H))>[ApiName] Mitigation SuccessNS_TerminateExe::NotifyFn3,H LHMteH %`3HI0rH#H [ÐH\$WH 3HH9tH9YvHH HH;_rH\$0H _Ð*H 38ftH eW)H ”*HHt'H9vH sHH;s HtH SFH /H [5̐H\$WH HH/*HHH\$0HHH _ÐH H)HH [ÐHLHhICDŽ$3ICMCICD$(D$ E3LH$$HhÐHT$UHPHHHP]ÐLHhICD$PH$ICH$ICH$ICȋ$D$($D$ LH<D$PD$PHhÐHT$UHPHHHP]ÐLHhICD$PH$ICH$ICH$ICȋ$D$($D$ LHD$PD$PHhÐHT$UHPHHHP]ÐLHhICDŽ$3ICMCICD$(D$ E3LH$$HhÐHT$UHPHHHP]ÐH0HD$ HHD$PHd$XHT$XH LD$XH?3HL$X(\$P\$PH0[ÐHJX HT$UH HHH ]ÐH8HD$ D$PLHD$PD$PH8ÐHT$UH HHH ]ÐLHXICD$xEK3ICICICICICMDHD$xD$xHXÐHT$UH@HHH@]ÐLHXICD$@H$ICH$ICH$ICMKMDHD$@D$@HXHT$UH@HHH@]ÐLHXICD$@H$ICH$ICH$ICMKMDHGD$@D$@HXHT$UH@HHH@]ÐLHXICD$xEK3ICICICICICMDHD$xD$xHXÐHT$UH@HHH@]ÐHHHD$0D$hLD$ ALHD$hD$hHHÐHT$UH0HHH0]ÐHHHD$8D$0HD$pHD$ LHbD$0D$0HHÐHT$UH0HHH0]ÐHHHD$8D$0HD$pHD$ LH~D$0D$0HHÐHT$UH0HHH0]ÐHHHD$0D$hLD$ ALH!D$hD$hHHÐHT$UH0HHH0]ÐLHxICD$`H$ICH$ICH$ICH$ICH$ICH$ICH$ICH$ICMLHK D$`D$`HxHT$UH`HHH`]ÐLHxICD$`H$ICH$ICH$ICH$ICH$ICH$ICH$ICH$ICMLH!D$`D$`HxHT$UH`HHH`]ÐH\$Ht$WHPIHu AMHHA<9uHtj:teHd$@Hd$`HD$`HD$8Hd$0E3E3D$(d$ N؅uNHL$`DHE33҉|$(Ht$ HT$`#|$(LL$ E3A3WHt$pH\$hHP_ÐH\$Hl$Ht$ WHPIHu A3MHHfA9,Au4EHtff9*taHl$@HD$`E3HD$8Hl$0E3D$(Hl$`l$ ؅uNHL$`DHE33҉t$(H|$ HT$`##t$(LL$ E3A3WHl$pHt$xH\$hHP_ÐHHXHpWH0H`IL@HH{H;{riLeH %`HHI0@H;PHBMuLI* LIHuD$XH#HL$XD$X轌HH{LCH|$ I;sHL+HIHJHCHH|$ H \HH HtHHH|$ HH\$@Ht$HHH0_ÐHHXHpWH0H`IL@HH{H;{riLeH %`HHI0@H;PHBMuLI LIHuD$XHHL$XD$X詋HH{LCH|$ I;sHL+HIHJHCHH|$ H HHH HtHHH|$ HH\$@Ht$HHH0_ÐHHXHhHpHx ATAVAWH HAHHxHtLH H=}@HH ÇLH HHu{HL=H}H HHqLa I;s:HLp H;ps,LIIufAI;sHL+HL+H IH){HKH@rCHCHH;w7HHHeH %`LHI0LIHtHH{H\$0Hl$8Ht$@H|$HH A^ÐH\$WH LHHMteH %`3HI0˭H;H\$0H _ÐH\$UVWATAUAVAWH 3ILLC\Mt'fA9uHHHf9\uuHt f9DuuHHLxH;L;M7I@H;eH %`NE*HI0LHuD$hH"HL$hD$hjHx MtI$K?HH L{lH3Ht(Mt \fHH6HHLNlH3fI+IH AI^HI^I~1H\$`MuH A_A^A]A\_^]ÊD$hHuHL$pD$pj̐HHXHp WH0H``3?LD$HWHwc3ɃЉD$@ڰHHt\HHHsDH;x8DL$@HL$HHD$@WLHD$ xH 38 GHHL$HHtNH\$PHt$XH0_H\$Ht$WHPMHLHSM;LmHHH `LDHDHYLD$@H\$8HL$0LSHdAH|$(HD$ qH\$`HHt$hHP_Ð")("%S%s%s%s ShimLib::GetHookAPIsShimLibH(tmtbt:t`t\tQt)uaHc3E3ɍJhE3[LH%cH(Hc3E3ɍJfE37LH%wcH(ùedE3E33LH(ÐLD$SH LD$@0'HHtLD$@3HhiHH [ÐH IMtI LD$@蠍y3H [HtHD$@HeH %`LD$@HI0H [H%T̐H HH HtH^HHH [Ð Hu3HH€< u1H(3HtHHf9Qu{H(ÐH\$Ht$WH HHt>t9JLD$0HHtH\$0HHLhK9H3H\$8Ht$@H _ÐHHXHhHp WH 3HHt5t0OL@UtHHtLD$0HHgf,{H3H\$8Hl$@Ht$HH _ÐH\$Ht$WH@HHu3Hd$8Hd$0d$(Hd$ LA33ҫeH %`HI0HcL|HHtDHd$8Hd$0AL33ɉt$(HD$ ueH %`L3HI0*3HH\$PHt$XH@_ÐH\$Ht$WH0HHu3qd$(Hd$ L3A3UE3HcAPHHHt8AL33ɉt$(HD$ !ueH %`L3HI03HH\$@Ht$HH0_ÐH\$Hl$Ht$WATAUAVAWH E3HHfD9)LI3}Lct ^Et @fD9+tcfE9.f;uTIA>O$7A4t t ޤfE9,ufE9.t-HfD9+=3H\$PHl$XHt$`H A_A^A]A\_H̐H HH39H|@HHKHHJYHKHHHxHH [ÐH\$Ht$WH HYHaHHHHHc~HH LMHHt$8HH\$0H _ÐH\$WH HH HXHH;t H H  H{HtקL3HHcH\$0H _ÐH\$WH HHH HH;tEH9} HXH;ux}PLHHH@HHcHHH\$0H _ÐH AHHH [ÐH\$WH HHHLHϋoH\$0HH _ÐHL$SH@HD$8Hكd$0HbWHHaD$0IHHD$ DHL‹RHH@[ÐUH HE0t e0HMPMH ]ÐHHHWH@H@HXHhHp HH`HVHHaD$0HH-UHDHl$ LSHHH\$XHl$`Ht$hH@_ÐUH HE0t e0HMPH ]ÐH HHًPLEHH [ÐH\$WH HHH0LHϋH\$0HH _ÐH\$Hl$VWAVH HcL~D$HHHL$HD$HK_3u!HUHiHH\$@Hl$PH A^_^ÿ@;|;|;| ;L}H#LH3Htxflp pH I넊D$HHHL$HD$H^̐H\$Ht$H|$AVH IcIcHLEuHTHbH*HG ILHqMHHH\$0Ht$8H|$@H A^ÐHH\$WH LE3HIcHHEQ~fA|H\t fA|H/uAAf;\t f;/AuAfD9 tZtAu fAx:utuu(LAHtHf;\tf;/tHLHϋH\$0H _ÐH\$Hl$Ht$ WAVAWH0HSHaIcHLHHExLҢLG3HˢHHuD$`HHHL$`D$`\LHHB H ~Ud$(Hd$ DL33[~4IIDL33ɉl$(HD$ / 3IH;tL3HH\$PHl$XHt$hH0A_A^_ÐH\$Ht$WH HRHaAHHHEy H؅~HhHLcMHJH\$0Ht$8H _ÐH\$Hl$Ht$WH HIHcxH;x~H3HtH LHMHxH H; Qtf,yH\$0Hl$8Ht$@H _ÐH\$Hl$Ht$ WH IcIHcHxmExh;;rGt.HHLHeHHT$PLHMNH\$0Hl$@Ht$HH _ÊD$8HHL$8D$8Z̊D$8HHL$8D$8Z̐H\$Hl$Ht$WH0HcH3HrMH>8B;1+9B*HcBLH BMIHXHHcAf,ALD$ L‹RDHNH\$@Hl$HHt$PH0_ÐH\$WH HHH;~4HPH;t#SH/CHHS LcM H\$0H _ÐH\$Ht$H|$AVH HALxE~2~.D;OkI+ލSLcHcHQMIYH\$0Ht$8H|$@H A^ÐH(Hxtx| H(H}YH(ÐH@HD$ H\$PHE33H /؅tzHOHT$(Hd$0HL$(DHHt2;w.PHL$(HT$(HrHXHL$(3HL$(HL$(3H\$PH@_ÐHJ(H HEx#H D;A}IcH AHtH+HH [ÐHBxHcHJf:\tf:/tHHyÐH\$Hl$Ht$WH HHIcH;Z}$H<HHtHH;Z|HHl$8Ht$@;XMًH\$0H _ÐH HMcHJ @HuH+HH [ÐHHPL@LH H(L@ H(ÐHHXHhHpHx AVH LHIIIZH΍PH>LcOIAH=w+IYMHHL֗3Ʌx HH;wuf _ 3MtfHH\$0Hl$8Ht$@H|$HH A^ ̐H HћLH3H [H%̐H\$Ht$WH@HYHHtL3HiHgHd$8Hd$0Ld$(Hd$ A33HcCLH3=HGHt:Hd$8Hd$0LA33ɉt$(HD$ HGH\$XHt$`H@_ÊD$PHHL$PD$PU̐H\$Ht$WH HHHp>;P~1X;L\HCLcHV M:HHΉX HH\$0Ht$8H _ÐH@HD$ H\$PHE3E33H h؅t}HJHT$(Hd$0ËHL$(BE3LH1t1;s-HL$( HT$(H0HXHL$(3HL$(p HL$(3H\$PH@_HJ(H(LLyIIH(PIID@D+H( ̐LWH@ICI[IsHHIIC3I[IKJHHD$(xDH;;v#HL$(#HHD$(xDHt%;s!HL$(x HT$(H HX 3HL$(W HL$(H\$PHt$XH@_ÐHJ(gH\$Hl$Ht$WH H3H/HxDHH H΋Ћ;r }rHH\$0Hl$8@Ht$@H _ÐLWH@ICI[IsHH~HIC3I[IKHHD$(xDH;v#HL$(HHD$(xDHt%;s!HL$(HT$(HHX 3HL$(HL$((H\$PHt$XH@_ÐHJ( H\$WH 3H 33Nt)HˋH1H;s3HH\$0@H _ÐH\$Hl$Ht$WAVAWH LH 3W IrLcII>HA9w}*IGIHLcMHOMHcA+I ?Iy+I ILcMőIO?H yH'IqH\$@Hl$HHt$PH A_A^_.\HT$SH0HD$(EHڃd$ HSFHHbD$ LA8HH0[ÐUH HE t e HMHMH ]ÐH83MHH;P}DE3IH8ÐH HrH H [H%̐H0Hd$ HDHE+HH0[ÐHT$SH0HD$(EEHڃd$ HLEHHbD$ LEA6HH0[ÐUH HE t e HMHEH ]ÐH8HE3ۅAHEMDHEHBA;~ED+A;EOÅuE;uHIH8TDIH8ÐH\$H|$UHH3HHHM3HE‰EfEf}THELEHEHE0E3HD$0Hˉ|$(E0H}H|$ E@H}H}L$I[I{I]ÐLATAVAWHICI[IsI{ILE3fEc3ICD$ZfD$^IKD$h0Ld$pDŽ$@HD$PHD$xL$L$LD$hA|$HL$0̏UfDd$@3HD$BD$JfD$NHHHEHL$@#H$HD$(Dd$ E3DHT$@HL$0s=#D$eH %`WHI0HHD$`HH$HD$($L$ LDHT$@HL$0 ukC+;v [{ WILDC SHHet DGfG9$GADIJ{u I t$8H\$`eH %`L3HI0HL$05L$I[ Is(I{0IA_A^A\ÐHT$UH0HE8HH0]ÐHAVHH@HXHpHxIHHJE3fDt$@3HD$BD$JfD$NHHL$@^D$`0Lt$hD$x@HD$@HD$pL$L$LD$`HL$0؅uifDt$P3HD$RD$ZfD$^H|HHEHL$PHAED$(HL$ ENE3HT$PHL$0@HL$0L$I[IsI{ IA^HT$UH0HHH0]ÐH HH HM@HH;t! H H H;@HcHH [ÐH(H@H;t }H(ÐH\$WH HH3;uHHf9AuHHHcˉXHH\$0fHH _ÐH(L\x IH(ÐHHXLH L@HPUVWATAUAVAWH@LHMILj3LcHUIHcKD$ HA+GD$(Ft$,9G|~&ILcGIMHHOgIHcCL,CLl$0I;t$(H$Dl$ IH3LHt^HȋIcI+HH+A+HcKgH< J ;L$H$LI3IL$fAA+Ll$0HHf9 CuL$HCHI;`t$,l$$IqH$H@A_A^A]A\_^]ÐHT$SH@HD$8H3҉T$0Hq=HHSD$0EDHHDHE;} E+HDHH@[ÐUH HE0t e0HMXYH ]ÐHtЀ9tHHuHtH+3ÐH 3Hu3LD$0L$0HˋH [ÐHL$UVWATAUAVAWH`E3E3E3L!d$PD!$D!$D!$E3IIHHtEwHALHtHΉ$LHtHω$LH$tH$$sHD$P$$D$HL$@H$HD$8H HT$0Ll$(LL$ EIMAHt AHHt AHHt AHoH$tH$ATH`A_A^A]A\_^]ÐH HHD3ɋfEt6fA\u HuHHHDfEuHtf HH+HPH [ÐH\$WH HcHkH;x}H[H3f xHxH\$0H _ÐLI[UVWH`H4H3H$P3HHى*HT$@A3ɉl$0fAkgf9+HD$4H|$@LL$0HD$ HEE33HtkD$0HH;wYL$4HH;wL;rEM@HHt4HcD$0LL$0HLHD$4HHD$ =t D$0ȉH3H$PH3'H$H`_^]ÐHHXHhHpHx ATAUAVAWL\$HA1E3A+E~LE3E9Ht A;|-LI"ADcf;uAI̋&3eE;Mt A9+fAMIftuf tf uMt fEpI+AA\fD91f9 tf9 uIfD91E9Mt A91MIAAIAfD9)t"f9uOAu,tA"HAfD9 AuH AAE;MtA9+fE(Mąuft4u f t*f t$tE;MtA9+fAMISE;MA9+fE0ME9Mt A91M2AH\$(Hl$0Ht$8H|$@A_A^A]A\ÐHHHWH0H@HXHpIHHHS7HE3LAHB7HFLF DHHNHH\$HHt$PH0_ÐHJ@HCHJ@H3H(HIHtgH(ÐHHXHhHpHx AVH HYIEHHLD;@~3H3sHQHt3y 3H2IVDHLDH˅y"HD@D+GH ŋQ‰DD+)D7H\$0Hl$8Ht$@H|$HH A^ÐHWHPH@HXHhHpIHHHI3Htf+HkHtff9/taHHL$8~HHL$(p E3HL$(HT$8H˅x LD$(HL$(HL$8H\$`Hl$hHt$pHP_ÐHJ8sHJ(gLMK WH@ICI[HIC ICAE3H=H؅uHT$hHHL$hH\$PH@_ÐApplications\wordpad.exe\shell\open\commandHT$UH0HHMh)EhE0H$HM0=̐̐LMCISIKSVWAVAWH@ICLH3AsICICIsMK E33I$ȃv~W$WHL ?$H$HD$(Lt$ L$E33IIuJ$ȃwT$t JfA94NDH/$u,H!H\$p|$43Ht 3H!H@A_A^_^[ÐHT$UH0HHMxE0HHM0HLcIHH@HHBeH %`LHI0}HE Ht,D0HxHHD$ L m=EƺH6HH~HuE E HvHM ;9~HcHHVLEHM;|HMHMGL$I[(Is0IA^_]ÐHJXGHJHWHJ8KHBWAVH@HD$0H\$pHl$xHHHH?H3HuD$`D$`HHL$`<:Lc7IHH@HHBeH %`LHI0B|HD$`Ht,D0HpHHD$ L L\$pI[IsI_ÐAddEnvironmentValue: (%S) to (%S) ShimLib::EnvironmentValues::AddEnvironmentValueEnvironmentValuesHJHH\$Hl$HT$VWAVH HHP 3HL$HD@H\$Hf9;f;"u@"HHf;trftmHf;uH;t[HH+H2H L@L;t8ft H ;uI;t#I+IHLILHHAQ8eH %`M3HI0neH %`LHI03H\$@Hl$PH A^_^H%m̐H\$ UVWAVAWHPH^H3H$@HILHP HIHP(LHHHAP(HHHH HHH$0AHrL$0HH=LGM[HT$ AHq=w"HT$ IktHT$ MHeH %`L3HI0leH %`L3HI0lHteH %`L3HI0lH$@H33H$HPA_A^_^]ÐLWHPICI[IsAHHH| ICIcIKE3DH3nHL$8OLD$8Ax~ADL$ HHMHL$8ZH\$`Ht$hHP_ÐHJ8;HT$UH0HHH0]ÐLWH`ICI[IsAHHHICIcIIKsLHHL$(&LD$HHT$(H$$uQHT$HHL$8AHL$8ZLHHL$(LD$8HT$(HHL$8YuSH HD$8Hd$@HT$8HL$HLHyHL$(LD$8HT$(H}HL$8HL$HHL$(H\$pHt$xH`_Ð%%%s%%%%%s_NODL%%%%%s_NAME%%HJ(HJHHJ8wHJ8kHT$UH HHkH ]ÐH\$Ht$WH yHHu`Q tRG G HcHHtH HcH H HcHKHHIHVHK<3H\$0Ht$8H _ÐHWHHD$`HXHH3H$HD$pHD$ AE3AQ3k3|$@dHL$HHHD$PHd$XDLD$pHHL$PH\$PH\$(HHD$ ALLHgHd$0D$(D$ E3E3@HlHHD$HHL$P |$@H\$HHt>HQHD$ A_LH(fHkl؉D$(HHD$ AhLH[fWw4t[rOvQt tGAtB9eH%0Pt$)pt${ttovqvh3H$H3H$HĐ_Ð%s\CFP%08x.tmpFile(%S) ShimLib::CanWriteHereCanWriteHeresuccess Error(0x%08x) HJPHT$UH@HHYH@]ÐH HeH %`HI0DBofH3HtHHBBBHHHSH [ÐH\$Ht$WH AHHu3\HL DHHHAQ`HHeH %`LHI03HeeH %`LHI03eHH\$0Ht$8H _ÐH\$Hl$Ht$WH 3AHHHtbHP H9_,u 艼HJHWHHt90t3t.DHAHHteH %`L3HI0!eHHl$8Ht$@HH\$0H _ÐH\$Ht$WH HH3ؽHHtOHHHP(HHt#HeH %`LHI03HdeH %`L3HI0dHt$8HH\$0H _ÐH\$Ht$WH HHH3P HKHt HHH\$0Ht$8HH _ÐH\$WH HH3HHH\$0H _r̐H@HD$ HHL$(HL$(HL$(ߺHHL$(&H3H@[ÐHJ(HT$UH HHH ]ÐH0HD$ H3H_uAE3HL$0%HL$0DAD+AHT$hHL$0AEt5Dt$(HHD$ A LHfKHT$@H$/LD$hHHL$x蘩HHL$0趨HL$xCH$HL$0QuOHT$@H$өLD$hHH$9HHL$0WH$H$QuSHT$@H$耩LD$hHH$HHL$0H$莧H$耧HL$huHL$0HHD$PHL$@YHL$0NHL$XCHt$PHH$H3XH$0HA_A^A\_^%LocalAppData%Path type is incorrect (%d). ShimLib::CorrectPathChangesBase::RedirectRootWHJX闦HJ0鋦HJ@HJhgHXHLH@H4H(HJxHT$UH0HHH0]ÐH@HD$ H\$PHHHL$(p3;_ s&HcHHL LBHHL$(HL$(LHHL$(蓥H3H\$PH@_ÐHJ(wHT$UH HHH ]ÐHHXHhHp WH HcH@Bwy3;Y~gL@V H-xTeH %`LD$@VHI0IHHt1LcGHHI eH %`LHI03VIH/_9_@Ƌ3H\$0Hl$8Ht$HH _ÐHHXHhHpHx AVH E3f9\HAAu Hf?\tfD97HHbHHf.u)f9.AHf9.ttwf9\tfD91tHf9\tt0H;v(H H;v Hf;\uAHHuAfD91u H;tHLIfF94AuH1f9\tfD91uH;fDqLIfF9tAuHQNEH4GHhft=Hf\uHYf;.uCLIfF94AuHNEHFHHAHHf8.tfD1 Hf9\tHfD91fDqH\$0Hl$8H|$HHt$@H A^ÐHAE3f\ ftHf;u3f/tft Hf;uf9PIDÐHH\$Hl$Ht$WH 3Hf91n :FHHttHf9+uf\t Hf;tH;vf{.tDf8\u/f{\uHIIfB94@uNEHHEHXHEHHuH\$0Hl$8Ht$@H _ÐH\$Hl$Ht$WAVAWH 3Hu3[1HHtA\f8/ufDHf9(uHf9+tLf{:uH{?fD9 u9fD9Ku2HlHu"f{.ufD9Ktf{?ufD9Ku H{HHHfHHf9,KuEDL eH %`HI0UELHtIHLHH+f(H:x.LII&jxLIIjy!ueH %`L3HI0DeH %`L3HI0DIHH\$@Hl$HHt$PH A_A^_Ð..\LWHICI[IsHH3H$H3IC3ۉ\$@\$p3D@4IKHL$XH\$`H$$HPHD$HH\$P3HL$HuHL$HlD$p8HD$HHD$xHDŽ$D$tHL$pIHHD$XHu HL$HHD$`HD$0HD$( H$HD$ AE3H׹Hu HL$H՞($\$@HL$H趞 \$@H|$XHt H{HH$H3L$I[Is I_ÐHJHgHT$UH@H|FHH@]ÐH\$WH 3HHt#E33qFu G=t7!\$0HL$0t%D$0ȃwHtHg2HrEH\$8H _ÐLIKWHPICI[IHHKH3HOH;HGHOH,HG HO(HHG0HO8HHG@HOHIK= HHL$(/ HL$(AML#HL$8AHH#HVHL$(HL$8HH\$hHP_ÐHJ`לHJ`HǜHJ`H 鷜HJ`H0駜HJ`H@關HJ8鋜HJ(HL$SH0HD$ HHH3HKH HCHKHHC HK(HHC0HK8HHC@HKHH^HH0[ÐHJ@HJ@HHJ@H כHJ@H0ǛHJ@H@鷛LUVWATAUAVAWHICI[IHLADl$H3H|$P$H&ICI{@$@$DHt fHH#Mt AfHH#Hu3Hu.H/IIL$IjIL$ I]IL$HHt$0H\$(HHD$ ALH =HHeH %`U AHI0?HHD$PHLHމ|$@f>"u.|$HH^L f"tHLfu/D$@"Lf tf tHLfuLE>fA>HD$`HD$(HL$ ALI3Ct)sHL$PYCtu E=v(fE>f9;t@9|$Ht:HLƄ$HL$PUII+Hl$@fE>H\$PADl$@Eu tfA> t IfA9>uE>H^fA>HHL$hfE>IH+HAH\$hHtyf9>ttHf9"u7HVMH"<u#fB|~"uBL~ft <tHHf9LIH`xL6UIH`xEtfA.MIH`IL$@HeH %`L3HI0{;eH %`LD$P3HI0a;ID$I $HD$0HL$(HHD$ ALH9ID$ HD$(HHD$ ALH9$HL$hNH$HĀA_A^A]A\_^]Ð.exe[AppAndCommandLineT::Set] BEFORE App(%S) CL(%S) ShimLib::AppAndCommandLine::GetAppnameAndCommandlineCommon[AppAndCommandLineT::Set] AFTER App(%S) CL(%S) [AppAndCommandLineT::Set] CL without App(%S) HJh7H\$WH HY0HHxuAHxt8HAxt.HH`HHa!HyHW HEH yu HWH(HH\$0H _ÐþHWAVAWHpH@HXHpML3ۉX \$ HP 袲HHD$(HtH\$8H\$@\$H\$PHD$X$D$`HL$8L$H$HL$8DH$H$f9u{|$ EAHL$8 Ht$(|$ Hz=L\$pI[ Is(IA_A^_ÐHJ8HT$UH HHH ]ÐAVAWHH@HEH\$`Ht$pH|$xHLHHEE3L}HHfD99f9)HUHHu~upHHfD98tHHI$t|uu u tA뉊E(E(HmYHM( ̊E(E(HVYHM(̊E(E(H?YHM(HM|H\$`Ht$pH|$xH@A_A^]ÐHJ(WVWHH@HEH\$`HHHHHE3HuHUHHExf8-lpHmH3f9uE0E0HXHM0!HUHlƃFtASt7ft-stE0E0HHXHM0E3HUH'E3AAHUH@x!(tE0E0HWHM0HH@HHf90uE0E8HWHM8NHUHHMf;wuAf;lut(E0EHbWHMHHM@HM莐@E0E0H,WHM0H\$`H@_^]Ð)HJ0WH\$Hl$Ht$ WH HHHvHH3f>t!Het*AHH(HH\$8Hl$@Ht$HH _f>"tXHH;f?tf? t HtH+HH|D$0HXVHL$0D$0DHH賕]HVHHf8tnf8"uHHf9"uH H+HH=|D$0HUHL$0D$0DHXHL -3LMH'HOD$0HUHL$0D$0I""HWAVAWHPH@HXHpEL3ۈ\$pHH$HHHL$8.HL$8OEu HL$84A;~(IV HHL$(HL$(HL$(Eu3HL$8AHT$(+Bu1u4\$pHL$(3菘xHcHD$(HHHL$8HL$(gHL$8׍ \$pH$eH %`L3HI0@2L\$PI[(Is0IA_A^_ÐHJ8重HJ({HT$UH HHH ]ÐH\$Hl$Ht$WH 3HHEu'9Y(v`HW HH0tG;w(r@DO(Et5L_ HML+FA+u HEut A;rHl$8Ht$@H\$0H _ÐHf)wHHr f|t3øÐHf8 u HHÐHVWAVHHD$HHXHfH3H$pHH3Hu HKHu H~Hu HtHu>\$8H\$@HL$81HT$@H轌HL$80\$0HD$0HD$ A LD$P0xHT$XHsd=u]L$0=wL34LHt:H\$ DL$0LHw0xIVHI4\$0H$pH3 H$HĀA^_^Ð\REGISTRY\MACHINE\Software\Classes\REGISTRY\MACHINE\REGISTRY\USERHT$UH0He0H"H0]ÐH\$VWATAUAWH HH3H$H$H$H$H$0H$H$PL$L$(3H$@DH$DcD$f$3AH$H$H$H$H$D$xH$3DC0H$m\$tH$$3DClH$G\$pH$ $$`3DC$H$dII_H9uBL$}H$3H tH$3H$HFH$F $F$$F($F,$F0$F4$F8$N<$F@f$ sADŽ$`(H$`HNX.t $d$ $h$H$21uX1tL$L$H$HNupH$H$uUH$H$u:H$Iu$0.ODED$9\$ptp$uH$hu$H$1H$.H$H$T1u $E\$pH$HtH.H$H$@HtD$xmI9t I.IIOHt .I_T-:HB H&D$tD$t`pH$s0u0DŽ$E3E333.H$HuW/HD$xHD$`L|$XH$HD$@H$HD$8H$HD$0Dd$ L$L$H$D$p23D$H$H$H$0H$L$H$PL$(%9$tH$ +H$H;Ntz.H$L;tg.H$H;$tO.H$H;$t7.H$H3H$`H A_A]A\_^ÐUHpHH.Hp]ÐH\$T$HL$UVWHHpHe8He e3IHMDB$HHE8HYHD$(H 3H!|$ E3E3.؅HM8HU r.HM8v.WDO@U(-HHuXt3LM(LJ-u -THM e3҉EЉEHEDJ DBHD$0d$(Hd$ EH}-؅u HE He HH,H} t HM -H$Hp_^]Ð201ef99a-7fa0-444c-9399-19ba84f12a1ancalrpcH\$UVWATAUAVAWHH@HH3HEQE3LEEHAADmfEEH HfD9)AE"f9ufD9it fy:uEu fy:ELE3ByHMfEG,؅==HHfD9,OuEȋщM3H+HHuXOAuAF!fD)uJ~LEHM+؅u&UAFHALGU$I4$IAH*HMH3VH$H@A_A^A]A\_^]Ð :H\$UVWAVAWHH03HH ]0]8Ht f9)'L)h'E3E3LHE0AQIHD$ &E3HE8AQE3IHD$ &U0U8@)HHuXiDM0HE0LǺIHD$ y&t7E0\HQfLGE0DM8HILGHE8HD$ B&u )H>HH)H\$pH0A_A^_^]ÐH\$WH HI0H33'=tH\$0H _ÐH\$Ht$ T$UWAUAVAWHHpH]L(E33AE0E3HW0DAHD$ "&HUHM0AD݉]8HME3E33҉\$ %}HM%} u!Et3%Hb% HMn%HU8HuGHUHM0t$HME3E33D$ [%xA݉]8 HuA]8u]A;uHU8Hj]8Et$L\$pI[@IsHIA_A^A]_]ÐH\$Ht$H|$AVH :HHt D1&A+;v3 A +ЉHt$8H|$@H\$0H A^ÐH\$Hl$Ht$WHPHH3HD$@333DF'HHu 'HAH'HHu &uE33Hj'u&= uKHT$ HL't,|$$t!|$$t%ƃ v\$, 3n&H&H&HL$@H3H\$`Hl$hHt$pHP_ÐAppInfoLHH$3ICH$ICL$hIcH$ICH$ICH$IC$D$@D$8HMKMCLH AE3ICe&HĈÐHL$SVWH Hd$XE3HApLL$XIH =|uLD$XHm ؅xoHt$XLD$PHT$@Hh؅xD|$@t' D$PɃHL$XHT$@؅x|$@tAvHt H H _^[ÐVWH0"AIHAHD$`AQLD$XHD$XHD$ xD|$Xt7|$Xu6'AHD$`LD$hAQHHD$ x |$htH0_^[ÐLI[WH03HICDKMCSICEKHx 9\$PÉH\$@H0_ÐT$SH HT$8I6Ѕx+L$83҃rtt t !H [ÐFF!Ru{HkKEñ/F FmGMڏ+\mGMڏ+\mGMڏ+\mGMڏ+\>PlaceholderFilesScaleGetMonitorInfofdwReason(%d) pszCmdLine(%s)NotifyFn returned FALSE, fail load shimpdwHookCount(%d)[ApiName] Hook Entered(ShimLib) Hook EnteredGetFileAttributesAGetFileAttributesWGetFileAttributesExAGetFileAttributesExWGetBinaryTypeAGetBinaryTypeWMoveFileAMoveFileWMoveFileExAMoveFileExWMoveFileWithProgressAMoveFileWithProgressWOpenFileUSER32.DLLH xV1\\//>>>AddProcessParametersFlagsConditionalApphelpCopyHKCUSettingsFromOtherUsersCorrectFilePathsCreateWindowConstrainSizeDeprecatedServiceShimDisableExceptionChainValidationDisableWindowsDefenderForceTerminateProcessGetTopWindowToShellWndInstallComponentInstallFontsIgnoreFreeLibraryMakeShortcutRunAsPromoteDAMRedirectDefaultAudioToCommunicationsRedirectShortCutRelaunchElevatedSetEnvironmentVariableSetProtocolHandlerTerminateExe(ShimLib) Mitigation SuccessMitigation SuccessNULL (ShimLib) [ParseCommandLine] Illegal command line[ParseCommandLine] Illegal command lineNS_ConditionalApphelp::ParseCommandline %20-cNS_CorrectFilePaths::DebugSpewSetFileAttributesASetFileAttributesWGetTempFileNameAGetTempFileNameWGetLongPathNameAGetLongPathNameWWinExecShellExecuteAShellExecuteWShellExecuteExAShellExecuteExWGetCommandLineWGetCommandLineAGetPrivateProfileIntAGetPrivateProfileIntWGetPrivateProfileSectionAGetPrivateProfileSectionWGetPrivateProfileSectionNamesAGetPrivateProfileSectionNamesWGetPrivateProfileStringAGetPrivateProfileStringWGetPrivateProfileStructAGetPrivateProfileStructWWritePrivateProfileSectionAWritePrivateProfileSectionWWritePrivateProfileStringAWritePrivateProfileStringWWritePrivateProfileStructAWritePrivateProfileStructWIShellLinkA::SetArgumentsCOMHook_IShellLinkA_SetArgumentsCOMHook_IShellLinkW_SetArgumentsCOMHook_IShellLinkA_SetIconLocationCOMHook_IShellLinkW_SetIconLocationCOMHook_IShellLinkA_SetPathCOMHook_IShellLinkW_SetPathCOMHook_IPersistFile_SaveCopyFileACopyFileWCopyFileExACopyFileExWCreateDirectoryACreateDirectoryWCreateDirectoryExACreateDirectoryExWCreateFileACreateFileWDeleteFileADeleteFileW*.*.FindFirstFileAFindFirstFileWFindFirstFileExAFindFirstFileExWRemoveDirectoryARemoveDirectoryWSetCurrentDirectoryASetCurrentDirectoryWRegSetValueARegSetValueWRegSetValueExARegSetValueExWLoadImageAKERNEL32.DLLCreateProcessACreateProcessWSHELL32.DLLADVAPI32.DLLSHELL32.DLLcmd.exe /d /cWindow size/position invalid: (x,y)-(cx,cy): (%08lx,%08lx) - (%08lx, %08lx)Window size/position constrained: (x,y)-(cx,cy): (%08lx,%08lx) - (%08lx, %08lx)CreateWindowExACreateWindowExWNS_DeprecatedServiceShim::getUpdatedDependencies(ShimLib) Mitigation Failure[ApiName] Mitigation FailureNS_DeprecatedServiceShim::ParseCommandLine ja-JPMeiryo UIMeiryo UIMS UI GothicMS UI Gothicko-KR ѹ@ tzh-CNMicrosoft YaHei UIMicrosoft YaHei UI[SOzh-TWMicrosoft JhengHei UIMicrosoft JhengHei UIsөe0}fԚGDI32.DLLRegOpenKeyExWRegOpenKeyExAExitProcessNS_IgnoreFreeLibrary::APIHook_FreeLibrary;complus_fodNS_InstallComponent::NotifyFnCould not query IShellLinkDataList while marking shotcut.STRIPFOLDERBITWIN95SHLEXECSTAROFFICE5PRINTERNOVALIDATEFSIDSFORCELIBRARYPARSEWIN95BINDTOOBJECTIGNOREENUMRESETNOTHREADUSECHECKSANSIDISPLAYNAMESFILEOPENBOGUSCTRLIDFORCELFNIDLISTAPPISOFFICERETURNALLATTRIBSNODEFVIEWMSGPUMPRETURNNONURLSASURLSIGNOREDEFAULTTOKENCOINITIALIZE_COMPAREIDSNONECONTEXTMENUDOCOBJECTWIN95DEFVIEWMYCOMPUTERFIRSTOLDREGITEMGDNSTATICJUMPLISTSIZELOADCOLUMNHANDLERANSI;SeRestorePrivilegeSeBackupPrivilege__APPCOMPAT_MANIFESTRegCreateKeyARegCreateKeyWRegCreateKeyExARegCreateKeyExW_Classes\.bau_Classes\.htm_Classes\.sda_Classes\.sdc_Classes\.sdd_Classes\.sdg_Classes\.sdp_Classes\.sds_Classes\.sdv_Classes\.sdw_Classes\.sgl_Classes\.smf_Classes\.sob_Classes\.soc_Classes\.sod_Classes\.soe_Classes\.sog_Classes\.soh_Classes\.stc_Classes\.std_Classes\.sti_Classes\.stw_Classes\.sxc_Classes\.sxd_Classes\.sxg_Classes\.sxi_Classes\.sxm_Classes\.sxw_Classes\.thm_Classes\.vor_Classes\.xba_Classes\.xcs_Classes\.xcu_Classes\.xdl_Classes\Applications\StarOffice 7_Classes\CLSID\{30A2652A-DDF7-45e7-ACA6-3EAB26FC8A4E}_Classes\CLSID\{41662FC2-0D57-4aff-AB27-AD2E12E7C273}_Classes\CLSID\{67F2A879-82D5-4A6D-8CC5-FFB3C114B69D}_Classes\CLSID\{7B342DC4-139A-4a46-8A93-DB0827CCEE9C}_Classes\CLSID\{82154420-0FBF-11d4-8313-005004526AB4}_Classes\CLSID\{D0484DE6-AAEE-468a-991F-8D4B0737B57A}_Classes\CLSID\{E5A0B632-DFBA-4549-9346-E414DA06E6F8}_Classes\com.sun.star.ServiceManager_Classes\com.sun.star.ServiceManager.1_Classes\htmlfile_Classes\Interface\{9337694C-B27D-4384-95A4-9D8E0EABC9E5}_Classes\Interface\{BF5D10F3-8A10-4A0B-B150-2B6AA2D7E118}_Classes\MIME\Database\Content Type\application/vnd.stardivision.impress-packed_Classes\MIME\Database\Content Type\application/vnd.stardivision.math_Classes\MIME\Database\Content Type\application/vnd.stardivision.writer_Classes\MIME\Database\Content Type\application/vnd.stardivision.writer-global_Classes\MIME\Database\Content Type\application/vnd.sun.xml.math_Classes\MIME\Database\Content Type\application/vnd.sun.xml.writer.global_Classes\MIME\Database\Content Type\application/x-starcalc_Classes\MIME\Database\Content Type\application/x-starchart_Classes\MIME\Database\Content Type\application/x-stardraw_Classes\MIME\Database\Content Type\application/x-starimpress_Classes\MIME\Database\Content Type\application/x-starmath_Classes\MIME\Database\Content Type\application/x-starwriter_Classes\soffice.StarCalcDocument_Classes\soffice.StarCalcDocument.5_Classes\soffice.StarCalcDocument.6_Classes\soffice.StarCalcTemplate.6_Classes\soffice.StarChartDocument_Classes\soffice.StarChartDocument.5_Classes\soffice.StarConfigFile.6_Classes\soffice.StarDrawDocument_Classes\soffice.StarDrawDocument.5_Classes\soffice.StarDrawDocument.6_Classes\soffice.StarDrawTemplate.6_Classes\soffice.StarImpressDocument_Classes\soffice.StarImpressDocument.5_Classes\soffice.StarImpressDocument.6_Classes\soffice.StarImpressTemplate.6_Classes\soffice.StarMathDocument_Classes\soffice.StarMathDocument.5_Classes\soffice.StarMathDocument.6_Classes\soffice.StarOfficeTemplate.5_Classes\soffice.StarWriterDocument_Classes\soffice.StarWriterDocument.5_Classes\soffice.StarWriterDocument.6_Classes\soffice.StarWriterGlobalDocument_Classes\soffice.StarWriterGlobalDocument.5_Classes\soffice.StarWriterGlobalDocument.6_Classes\soffice.StarWriterTemplate.6_Classes\soffice6.bak_Classes\so_activex.SOActiveX_Classes\so_activex.SOActiveX.1_Classes\TypeLib\{61FA3F13-8061-4796-B055-3697ED28CB38}\Environment\Software\Sun Microsystems\Software\Microsoft\Windows\CurrentVersion\Uninstall\StarOffice 7\Software\LotusCREATEDIRSTAROFFICE7LOTUS\\[IsRedirectionRequired] FileName passed in is NULLNS_RedirectShortCut::IsRedirectionRequiredNS_RedirectShortCut::CheckAndGetRedirectionPath[SwitchStartMenuRedirection] FileName passed in is NULLNS_RedirectShortCut::SwitchStartMenuRedirectionNS_RedirectShortCut::GetRedirectedPath[SwitchDesktopOrQuickStartMenu] FileName passed in is NULLNS_RedirectShortCut::SwitchDesktopOrQuickStartMenuNS_RedirectShortCut::APIHook_CopyFileANS_RedirectShortCut::APIHook_CopyFileWNS_RedirectShortCut::APIHook_CopyFileExANS_RedirectShortCut::APIHook_CopyFileExWNS_RedirectShortCut::APIHook_MoveFileANS_RedirectShortCut::APIHook_MoveFileWNS_RedirectShortCut::APIHook_MoveFileExANS_RedirectShortCut::APIHook_MoveFileExWNS_RedirectShortCut::APIHook_MoveFileWithProgressANS_RedirectShortCut::APIHook_MoveFileWithProgressWNS_RedirectShortCut::APIHook_DeleteFileANS_RedirectShortCut::APIHook_DeleteFileWNS_RedirectShortCut::APIHook_GetFileAttributesANS_RedirectShortCut::APIHook_GetFileAttributesWNS_RedirectShortCut::APIHook_GetFileAttributesExANS_RedirectShortCut::APIHook_GetFileAttributesExWNS_RedirectShortCut::APIHook_SetFileAttributesANS_RedirectShortCut::APIHook_SetFileAttributesWNS_RedirectShortCut::APIHook_CreateProcessANS_RedirectShortCut::APIHook_CreateProcessWNS_RedirectShortCut::COMHook_IPersistFile_SaveNS_RedirectShortCut::CheckManifestRunLevel\Registry\Machine\SOFTWARE\Clients\%s\%sDLLPath\Registry\Machine\SOFTWARE\Classes\%sNS_SetEnvironmentVariable::NotifyFn%WinDir%%SystemDrive%%UserStartMenu%%AllStartMenu%%UserDesktop%%AllDesktop%%UserFavorites%CorrectPathChangesBase1X$ <  $||  "Hp2 $   H H( 0 8 @HHHPaX8P!`phH 2G  a8pH02 H H p(H2D pH2D HpH2D HpHx2l$ HHH H( 0 8T @ H P XH`P!hppH20$ HHH  (H0 8 @ H P X `Hh pd x~HP!pHX2 $ HHH  ( 0 8H@P!HpP@ 0r   (f!@rH@@r@  Hr @r@ p(h r8 8  ( 0 8 @ HPXP`h(`@`X b[` LD*]+H`%\%\ \[86>L@\[%\\[ \[L[ \!)h%\\[!)h%\\[58!d0`2(]+H`2(b3qq7I6x]+H``'1XCR8$,4X8AMNULL.dllGetHookAPIsNotifyShimsP  pcacli.dllPcaMonitorProcessXCR%XCR6u   UGPuRSDScYg!gF@@*AAcGenral.pdb t T 42d42 p4/(p`0/ 919Ys<2s22@3+737Xr3r<4420 td4PBdT2 pb  4 2p200/)#*4d 4 Rp0/**4bp`00/*+5 4 rp`0/O+h+D5h+    4 2p0/-.5.  4 2P t dT422P2P!C t d T 4 r 4 p/x/@ d T 42p-d4 p(0  2P/R0) !p`0/  RP/ 4N Lp/Pr 0/   2P/ p`0Pd 4R p4 p ` P4 p/ 0/  RP/d T42p P/` t d T 4R d T 4 Rpd 4R p t d T 4 r dT4pd T 4Rp( p`0/̺  RP/̺*"p`0/  RP/ t d T 4 R( p`0/4  RP/4$ $d 4 p/ܼ  RP/ܼ$ $d 4 p/  RP/( p`0/\  RP/\$$d 4r p/  2P/ /  RP/d 4 r p4 p `/  2P/ p ` 0/   2P/ $ $d 4 p/  rP/4 p `/  2P/ p ` 0/  2P/ 0/(p`0/t  P/t(p`0/  P/ b/  2P/" "t"d"4"P- %p`0/D  P/D- %p`0/  P/d 4 Rp/  2P/d 4 Rp/$  2P/$4!p/  RP/  4 Rpd 4 R p4 p`/L  RP/L4 p`/   RP/ % 4UL p`P/P& % p`P0/ #p`P0/ "p`P0/' % p`0P/ tdT4 4 P/`%t4 P/ dT 4 rp4!4vpp`P/p+d4 P/Bp ` P 0d4 p/  RP/ dT 4 rp /  RP/ 6 p`0/L  P/L  4 Rp f0/ K/@d T 4 rpd T 4 rp/04P(0<R 0/00/  RP/4 p`/\  2P/\r0/D4 rp/4 rp/d 4 rp/dT 4 p/ddT 4 p/,  p`P0/pdT4p dT4pd 4 rp/dT 4 p/<r0 43 0p/p 4U Rp/r0/) dMTL4JHp/0  4 Rp 0/  RP/d T 4Rprp`0P/#  p`P0/x#  p`P0/p  4 pt d 4 r/<  2P/<%p ` 0/  RP/4p`P dT 4 rpd4p/  2P/  p0Pd4p/  2P/3 ""t"d"4"P/T 4 Rp`td4 /  2P/ 4Rp`P  4 p/|  2P/|&p`/t  RP/t*"p`/L  RP/L'p`/$  RP/$&p`/  RP/&p`0/  P/&p`0/L  P/L p`/  RP/ p`/  RP/4 p/\  RP/\p`0/  RP/p`0/  RP/4 p/T  RP/T" p `/  RP/&p`/  RP/#p`/  RP/ p `/l  RP/l*"p`/,  RP/,*"p`/  RP/  p `/  RP/  p `/  RP/%p`0/,  RP/,d4p/  RP/-4p`(0  RP/-d4 p(0  rP/1  p`0(0|  P/|0/4  RP/4$ N0(0c  RP/  p`0Ptd4 /$  RP/$-4WPp`(0s  RP/4 p/  RP/.dS4R Np(0dc  RP/dd4 p/<  RP/<+tY4XV P/t/4.*P/ p`P0/Pdp/L  2P/L d!4 p/  rP/+ p`0(0  RP/# #td4P/4 p/  RP//  P//$  P/$/  P//$  P/$R0/  2P/ b/<  2P/</  rP//<  rP/</  rP//<  rP/< /  RP/ /<  RP/< /  RP/ /<  RP/</  P//<  P/<d4  pdT4 p t d T 42%  p`0P/  200/4d T42p4 p/|+ +t'd#4 P/' 't#d4 P/TT4 p`/T4 p`/Dd4p/t d424Rp/  2P/4 rp/l+ +t'd#4 P/  dT4 p/,  dT4 p/ 4 2 p`Pd 4 R pd 4  pd42 p d T 4 2p r0/  d T 4 rp/,T 42 p `td4242p d T 4 RpdT42pd T42pd T 4Rp4 rp/lBd 4 r p4 rp/d 4 rp/ d 4 rp/d  R0/  R0/ t4 P$ $t d4 /,   RP/,  td4 /   RP/ " "4"rp`P r0/<  p`P#4RL p `P/P tdT4d 4 Rp/| dT 4 p/ 4 rp/4   RP/4 "rp`0/   RP/   RP/ !!d4pP/ T4 rp`/4d 4 Rp/|42 pt d 4Rd4p/T 42p`% 4 p`P/@d 4 p/  RP/d4p/  2P/*4T Rp(0  rP/r0/,  2P/,R0/  2P/3 !tUdT4S P(0Ds  RP/Dt 4 r /  2P/! !td4 /t  rP/t3 !4f` p`(0   RP/ 4 rp/  2P/dT42p-d4 p(0T  rP/T  4 2p4 p/D R0/! !4 p`P/d4 p/  2P/$ $td4 rP/d4 rp`P/d4 p/  2P/-4p`(0s  RP/& 4 p`0sGGHGP4p`P% 4r p`P/04R p`P d4pP#dT 4 p/@    2p`0Rp`0  4 Rp  20"l,8@???@@a@l@p@`'@8" dGpG|G|G|GGGGGABBBBC CCCCDDD(D-DD DF&F4F6FAFOFGG *H `'GH"4|L I$I]IoIIII`'I8"̹Թ04SRRR" L0xTTTTTDS]SoSSSSHTST^TiTT`'TH"d 0 LÄ,9hx`',H" ̻0 |7Ն,9h `',H"\t@ܞp8ȼ`'H"t $0L*ס`'H"Ľ4 0(4΢2=H@MgH`'@H"ܾ@|!@`'H",tD(%al`'8"ĿԿ0Թ`'H"Dt(̾;IWhr*5@Kؾ`'ؾ8"4d($0<$~HU~`'H8"$L@,?p|`'(X" <(P(3`'8"L (XdGUp}``'p8"X@`'h"DdX0@-L`'Lh" 0`'8"l  `'"| 4 `'" ,c`'8"L|\ 8`'88" $,t x D_} 1 <GU`ny~  + ? 8`'H"t 08VaQ`'H"4 L0 p/:<,9`',H"| 0L:X:8u99999: ::":7:q::`'d:H"$0P=<<<7=B=\=i==8`'\=H" t |IIIIIIIIIx@?AXAiAABBBBB)D DDDDDDEEEEKFVFaFuFFFFFGI IJ `'Ih"$ cbcoc"d|@hhh`ggghhTh_h"40jiiiij j-jjH`' jH"   o,o8o8o8oDo(lllllll'm2m=mPo0`'Po8"lt q@qrq}q" `rq*r5r" txttt"DL xut:uEu"0tvu0v;v"0wDwww"$ }p}}}"dt0P\~~~ " ܐ"  L0lx )>Ie`'H"0/3-7"d `lĽ-<Fx`'x8" <PSc`'H"t  vWju`'8"l ht$L]y)4?`'8"T .;Jpish`'8"L  x:Wcny``'8"$ -8`'H"t H<HT@9DOZ`m`'`H"L lH%`'H" | ,P@1`'H"$XP8`'h"tXx(`'h" <8LXdq`'dH"48udo aH`'H"0tq`'H",D0D 1P]`'PH",0|`q@`'H"|0`'H"$ L@E `'H" $HL X d ` ) : D N I T _ j p }  `'p H"D H  X`'H" @ `'H"T |T`l0(2?+6ALx`'xH", LpM`'H"\ @!!`   $!/!:!!!E"p`'!H"@$`"###$$$ %`'$H"T t))%G&X&b&K(V(a()))`')H" 40++*c*q*****+)+}+`'+H"dHt--++++Y,d,o,t,,,----x`'-H"Th/.[.l.....//A/L/N/a/l//0Y0h`'/X" (:::81122%2[2f2q2v22222]3h3s3x3334404;4F4K45555X7c7n7p77777::K; `':x"\t0BSSS|TTT(`'|TH"d|0|UT/U=UPU[UUUU`'UH" $__(_\]]]^" t8iDiPiPiPi\ihitii iitffffg#gBgggg h hhhh hhhhh ii `'i8"\* qq q,qiiij jjjjjjjjk%k0k;k@kkkkkkkkkl lIlTl_ljlollllllmmmm8qp`'8qX"\0`Xqqqqqqqr?rJrUrZrrrrrrr ssJsUs`sesssssstttOtZtetjtttttuuu=vxxx p`' H"XXdp9JY"$|<0 Љމ1<`'H"P՘`'h"L|\Xdp`'ph"X`'h"L|\P6et`'th" Ӛ(`'8"dt  5DP`'P8"Hp(`'X"dtH1<`'<X"H`w(`'X"dtH#0`'0X"0Pe(`'H"dt8ڝ`'H"86D(`'DH"dt0dy`'H"hמIT(`'Tx"dtht`'x"ܧç"\dPxبG"XT`Ī.;"`pī"| Hzέ'DV`j" @دĮ&Ze"l|@CV"`<4V"D$ ټX`'8"08["8dp|=$.8"Td`m"`HT'"8\r"T\8d" P*7" ^ly"D L  "    @l"  (h"  (l"T  d ]  `'H"   8$MSP( `'PH"d l 8Lb"   `"   ;Iy"\  l 8 `'H" T   8G_ 4AH|  `'H`'4H"  0`D"\d0{" 0aq"@"D\0<]m`'H"l  )9F*5`'8"` ld o  `' X"Tl      `' 8" @R0`'8"lXAR`'H"L  +do ``' 8"@" !!!!"`'"X" 4 &&&&&&&&& &".#@#q#|#########Z$$ $ $ $%$%2%@%a%w%%%%%%%%' `''H", '$';'I''''@`''8"|h. -------..A.L.N.`.k....0`'.X"l  @0L0\0l0|000p////////0&010"$L  1,1<1L1\100000 11"X7p116"< 0p988879B9|9P`'|98" :99:"(<:;<<<", L ??<>}>>>? ?.???J??`'?8",H@@BBBB@`'BHT(2-+%] fu?x?@ x@0GԟI\J\JJX0KKKLHLMHMtNNkOOQXpRR,RSpTTT U8UpUpU%WDWUXHXaYHYZZ[H[\H8]^HH^_H_\``iaHaqbHbcXcg`ghthiij jjjQkXkkX(l~m̠Popopopx@qqqqq^rprr`r$s`$ssTstTtxt`xtttvu,uuTutvDvvvDw`Dww`wPxPxy|y${${p}p}}ԡ~~T~PpЀ@ЀT\`(``XTXYD80Pԑ`ԑȒȒDH̗ ` @MȢ(`0ΠĢXڥH@&HfHH444}H-wp`00l`l`00Ľ`Ľ^<xXh  xأ$T$_ ttH8\xKxGĤ@@`C@0@S@PXPuh((Edԥtt$4PLF\tM_` `  Цp   *  @ 080Hxd_t``!!`"`"a$ȧ$%%()*** ++8+4-H-.h./x/l0l00`081T81(8:h;̨h;EADxAA`fxtf2iliiim8qXqXqxĪ @@̓x a(L8``Qxj8x$XPP`$$\`\s8HoXphxst ȫ OثPpp<<`(`8H.X0PhPxADdȬdجTTtt0(0$8$$H$88LLd\dۧxبujTĭpحĮկ8$ܱTܱԲ\ԲLTL8$D49TPl88aܮHh@`ppL,X<88  tt8dLdHHHl\l T ``  S`\xXddX```(̯(HدHT88`hh8N,`HH@X@XhHhTX8l@@ `\ėhXX@@f lXLXL̰$$PPp p88`8`8`F0LHX88XX`Xdld``8@ı-14`,`<X0t<T<``` $||94IJ<ز<G(@lTlz P $ l$ | |  T   < T<  T  ` | :@X`Xx8x L   """8"&H''l$''|'''((L*@*p+p+ -ė -...Դ.p/p/?001p167n8`8n94|99P9:`:<<0><>????g@@DBĵBCCHHH(H.J0JL@ LLMhLMM`MO|OxOxOPPLQLQRRR̶RSضSOSHZn~Ђ *8BLVlă΃ڃ(2<FP^jz̄ ,>Rrԅ*4L`zȆچ&:ThxЇއ"2JXjXv҈ :Pbr҉8Hdr̊0HZn΋"2D`|Ȍ، *:N`t΍܍,BNf~Ԏ4NlΏ܏$<RjԐ.>N^tȑܑ ,<Rh|’ޒ $@`vXzHzpzRrԅ*4L`zȆچ&:ThxЇއ"2JXjXv҈ :Pbr҉8Hdr̊0HZn΋"2D`|Ȍ، *:N`t΍܍,BNf~Ԏ4NlΏ܏$<RjԐ.>N^tȑܑ ,<Rh|’ޒ $@`v"SE_COM_AddHook#SE_COM_AddServer&SE_COM_LookupSdbGetStringTagPtr`SdbFindNextTagYSdbFindFirstTagSdbOpenLocalDatabaseSdbResolveDatabaseSdbGetPDBFromGUIDSdbInitDatabase:SE_ShimDPF0SE_GetShimId|__dllonexitstrcmpmemsetmemcpy\__CxxFrameHandler3L_CxxThrowException_wcsicmp_wcsnicmp wcsncmp_stricmpstrrchrwcsrchrstrstrwcscat_s!atoij_vsnwprintfmemmovewcsspnsiswctypetowlowertowupperwcschrwcspbrk_wcsuprwcsstra_vscwprintfyiswspace_wsplitpath_sV_XcptFilter_amsg_exitMfreemalloc~_inittermX__C_specific_handler??1type_info@@UEAA@XZ_lockB_unlock0?terminate@@YAXXZ_onexitwcscmpRtlFreeHeapRtlAllocateHeapRtlInitAnsiStringRtlAnsiStringToUnicodeString=RtlUnicodeStringToIntegerRtlInitUnicodeStringRtlGUIDFromStringNtSetInformationProcess2RtlIsDosDeviceName_UNtOpenThreadTokenNtOpenProcessTokenRtlImageNtHeaderNtCloseFRtlLengthRequiredSid RtlInitializeSidNtQueryInformationTokenRtlSubAuthoritySidRtlReAllocateHeapRtlFreeUnicodeString}NtOpenKeyNtQueryValueKeyNtCreateKey3NtSetValueKeyRtlFormatCurrentUserKeyPathNtQueryObjectRtlCaptureContext]RtlLookupFunctionEntryiRtlVirtualUnwindRegOpenKeyExWRegCreateKeyExWRegQueryInfoKeyWRegEnumValueW(RegSetValueExW RegEnumKeyExWRegCloseKey!RegQueryValueExWRegLoadKeyW'RegSetValueExA*RegUnLoadKeyWRegGetValueWAdjustTokenPrivilegesEventWriteGetUserNameExWSHStrDupWSHQueryValueExWSHGetValueWGetUserObjectInformationWIsWindowFGetGUIThreadInfo%LoadCursorWSendMessageWGetProcessWindowStationGetSystemMetricsGetWindowThreadProcessIdEnumDisplayDevicesWGetShellWindowIsCharAlphaWRegisterSuspendResumeNotificationSetRectSetCursoruPostQuitMessageGetThreadDesktopDispatchMessageWwGetMonitorInfoWEnableWindowGTranslateMessageAllowSetForegroundWindowpPeekMessageWXMsgWaitForMultipleObjectsGCoGetObjectCoCreateInstanceTCoInitializeExCoUninitializeCoTaskMemFreeStringFromGUID2SHGetSpecialFolderPathWSHGetFolderPathWSHGetKnownFolderPathSHCreateItemFromParsingNameSHCreateDirectoryExWSHChangeNotifySHGetFolderPathEx&GetUserProfileDirectoryWGetAllUsersProfileDirectoryWCreateProcessAGetCommandLineAzIsWow64ProcessSetEnvironmentVariableWGetCurrentProcessnTerminateProcessCreateThreadLoadLibraryExW[ExpandEnvironmentStringsWGetUserDefaultUILanguagekIsNLSDefinedStringFindNLSStringExWaitForSingleObject?HeapReAllocLCMapStringEx<HeapFreeMultiByteToWideCharGetProcessHeap8HeapAllocYGetLocaleInfoExSetLastErrorLCIDToLocaleNameCompareStringExmGetModuleHandleWFreeLibrary0GetEnvironmentVariableW3GetExitCodeProcessCloseHandleTlsGetValueTlsSetValuetFindFirstFileExWnFindClosesFindFirstFileExAGGetFinalPathNameByHandleW!GetDiskFreeSpaceExWTlsAlloc)EnterCriticalSectionLeaveCriticalSectionQInitializeCriticalSectionAndSpinCountDeleteCriticalSectionWideCharToMultiByteLoadLibraryWCreateEventWGetTickCountGetSystemTimeAsFileTimeGetCurrentThreadId0QueryPerformanceCounterPSetUnhandledExceptionFilterUnhandledExceptionFilter_SleepResolveDelayLoadedAPIDelayLoadFailureHookSearchPathWCreateFileWlstrcmpiWPGetFullPathNameWcGetLongPathNameWGetShortPathNameWGetWindowsDirectoryWGetSystemDirectoryW GetCurrentDirectoryWSetEnvironmentVariableALocalAllocGetCurrentProcessId<GetFileAttributesW7GetFileAttributesAVGetLastErrorGetCommandLineWLocalFreelstrlenWWExitProcessGetProcAddressCreateActCtxW%QueryActCtxWReleaseActCtxiGetModuleFileNameWVirtualProtecttCheckElevationEnabledResumeThreadConvertStringSidToSidWOpenProcessTokenLookupPrivilegeValueWeCloseServiceHandleOpenSCManagerWOpenServiceWStartServiceWLQueryServiceStatusCreateWellKnownSidLookupAccountSidW+WNetGetConnectionW.I_RpcExceptionFilterNdr64AsyncClientCallgRpcAsyncInitializeHandlemRpcBindingFree~RpcBindingSetAuthInfoExWeRpcAsyncCompleteCallRpcStringBindingComposeWoRpcBindingFromStringBindingWdRpcAsyncCancelCall RpcStringFreeW0 H`pp4VS_VERSION_INFO@%@%?StringFileInfo040904B0LCompanyNameMicrosoft Corporation\FileDescriptionWindows Compatibility DLLr)FileVersion6.3.9600.16412 (winblue_gdr.130925-1958) InternalName.LegalCopyright Microsoft Corporation. All rights reserved.(OriginalFilenamej%ProductNameMicrosoft Windows Operating SystemBProductVersion6.3.9600.16412DVarFileInfo$Translation   (@8@<ȢТآ (08@HPX`P8@HPX``<Э 0@P`pЮhȫЫث (08@HPX`hpxȬЬج (08@HPX`hpxȭЭح (08@HPX`hP8PxTȪЪت@hxЮ 0`pЯ8 0@P`hpxPȢТآ h `ȧЧا (08@HPX`hpx(08@HX`hpxȩЩة 08@PX