MZ@ !L!This program cannot be run in DOS mode. $g҅҅҅҅҅҅҅Ӆ҅҅ ҅҅҅Rich҅PEd)\"  npP9o`A]xT0 #@8pd@.text܀ `.data @.pdata#$@@.idata%&@@.didat @.rsrc 0 @@.reloc@@BHHXHpHxL` AUAVAWH 3MLH\$@Ht$HH|$PLd$XH A_A^A]ÐH\$Ht$WH IH>LNjHH\$0Ht$8H _̐LD$T$HL$SVWAVAWH@Lމ\$ ;wʔu9Йu 3ۉ\$ B;L=MtJ;DƉIBL$IA׋؉D$ 3ۉ\$ s$xL$pL$I؉D$ 3ۉ\$ s$xL$pPL$I^؉D$ 3ۉ\$ s$xL$p;E33I!$xL$p\$ E33I$xL$p\$ L=qMt.I+E33IA$xL$p\$ tu}L$I؉D$ 3ۉ\$ s$xL$pL=Mt?= t6IL$IA׋؉D$ 3ۉ\$ s$x;H@A_A^_^[ÐHыH Lƒv*fm*E3E33H [ÐLI[IsI{Ms UHH`]Ðp$;5p`..//0`0003467@9`9p99`===?`EW_P`acdef@hijlPmorst u`vwxyz{|}@P@pЊP@ @М`P0@P`pp 0` Pp P@P Pp @p!#p%&&p(*++,,-000@10579;P> JJ LpM NpOSSTV@X [[p]`^`acfstuvxy}~~ @0P`pЮ00 `0pp0`@p`0``0 0` !!$`&*/4@8@;0>PA D`FH0K`MQVP[_d@ilpoЪ0PЯPpp0P`  Pp#P%`XX [`\cPdeepfpmmn0oH; uHfuHHL$L\$M3LT$L+MBeL%M;sfAMEM;uL$L\$HÐIIH&ICHHHICHjLMICH; LICISHDHE(H|+LMHD$@HLHD$8HHHD$0H AHD$(H\$ |H=LMLHD$@HHHD$8HAHD$0H HD$(H\$ 5HNLMLHD$@HOHHD$8HdAHD$0H HD$(H\$ HLMLHD$@HHHD$8HAHD$0H HD$(H\$ HHD$@HHD$8HЋHD$0H LMLHD$(HAH\$ `HyHD$@HuLMHD$8H}LHD$0H HHD$(AH\$ HrLMHD$@H&LHD$8H+HHD$0H AHD$(H\$ HkLMLHD$@H؏HHD$8HيAHD$0Hz HD$(H\$ HTLMLHD$@HHHD$8HAHD$0Hs HD$(H\$ DHLMLHD$@HBHHD$8H;AHD$0H\ HD$(H\$ H HD$@HHD$8HLMHD$0H6 LHD$(HAH\$ HOHD$@HLMHD$8HLHD$0H HHD$(AH\$ oH!LMHD$@HdLHD$8HQHHD$0H AHD$(H\$ (H1LMLHD$@HHHD$8HAHD$0H HD$(H\$ H:6LMLHD$@HˍHHD$8HAHD$0H HD$(H\$ H8LMLHD$@HHHD$8HaAHD$0H HD$(H\$ SH=LMLHD$@H5HHD$8HAHD$0H HD$(H\$ H?LMLHD$@HHHD$8HÇAHD$0Ht HD$(H\$ HGLMLHD$@HHHD$8HtAHD$0H] HD$(H\$ ~HYLMLHD$@HTHHD$8H%AHD$0H> HD$(H\$ 7H@LMLHD$@H HHD$8HֆAHD$0H HD$(H\$ HCLMLHD$@HHD$8HHD$0H HD$(H\$ HAHbnLMHD$@HvLHD$8H;HHD$0H AHD$(H\$ bH{{LMLHD$@H(HHD$8HAHD$0H HD$(H\$ HDLMLHD$@H݊HHD$8HAHD$0H HD$(H\$ HLMLHD$@HHHD$8HKAHD$0H HD$(H\$ HLMLHD$@HGHHD$8HAHD$0Hm HD$(H\$ F HOHD$@HHD$8HHD$0HK HD$(LMLHAH\$ HLMHD$@HLHD$8HaHHD$0HJ AHD$(H\$ HdLMLHD$@HfHHD$8HAHD$0H( HD$(H\$ q H~LMLHD$@HHHD$8HAHD$0H HD$(H\$ * HLMLHD$@HЈHHD$8HqAHD$0H HD$(H\$ H LMLHD$@HHHD$8H"AHD$0H HD$(H\$ HղHD$@HAHD$8H݂HD$0H LMHD$(LHAH\$ U HLMHD$@HLHD$8HHHD$0H AHD$(H\$  HLMLHD$@HHHD$8H5AHD$0Hv HD$(H\$ HLMLHD$@HYHHD$8HAHD$0HW HD$(H\$ HLMLHD$@HHHD$8HAHD$0H0 HD$(H\$ 9 EtAu:H8 Al Hq ApLD HM HD$ HEL\$`I[IsI{ Ms(I̋DڅeH%0HXH;t3HuAtL5MtiH5MLHI;rtHH>HH ŅHL;uL;tLLLHIH=H==yEH=a3eH%0DHXH;t3H'uAt dH L-)I;s(uH3Ht H#HI;rdHH 1Eu HHH9=t-H tHHMǺIy~̐AddProcessParametersFlagsConditionalApphelpCopyHKCUSettingsFromOtherUsersCorrectFilePathsCorrectShellExecuteHWNDCreateDummyProcessCreateWindowConstrainSizeDeprecatedServiceShimDisableExceptionChainValidationDisableWindowsDefenderDXGICompatEmulateCursorEmulateSortingServer2008FileVersionInfoLieFontMigrationForceKeyWOW6464KeyForceLoadMirrorDrvMitigationForceTerminateProcessGetTopWindowToShellWndInstallComponentInstallFontsIgnoreFreeConsoleIgnoreFreeLibraryMakeShortcutRunAsMarkRegistryValueOverrideShellAppCompatFlagsPlaceholderFilesPromoteDAMRedirectDefaultAudioToCommunicationsRedirectHKCUKeysRedirectShortCutRelaunchElevatedScaleGetMonitorInfoScrollWindowExFlagsSetEnvironmentVariableSetProtocolHandlerSystemMetricsLieTerminateExeVirtualizeHKCRLiteGeneral Purpose Shims initialized.NotifyFnAcGenralGeneral Purpose Shims uninitialized.`..`0H9wH H} H(H H(̐H\$Hl$VWAVH MIHt6HD$xH8H$HLD$@H֋eHL$`Ht[H\$hHtQHuDH {H.HL$pH$HH-LHֹIHD$xH\$HHl$PH A^_^ÐHyHL$HT$LD$LL$ HhfD$ fL$0fT$@f\$PHH AfoD$ foL$0foT$@fo\$PHL$pHT$xL$L$HhH86L'L D$(HT$ HH H8ÐH(HzHzHuH 3H(ÐH\$WH HtH^/HH\$0H _à0H\$WH HHDzHD$8HuHHaH]HzHD$8HyHD$@LD$@HT$8HHHT$8HyHT$@HypHH\$0H _ÐH(SHH(ÐHHXHp HPHHWAVAWH0MEHH3ۉX؉\$$A;}IHAHH|$PD$ H\$`Ht$hH0A_A^_ÐHLH D@HPSVWAVH8MIcH`HHHHxˉ\$pxH+H|$`IHHAD$ H8A^_^[ÐH\$DD$HL$VWAVH@IALHˉ\$pxI+H|$`HHH\$hH@A^_^ÐH H3H HH [H%̐HL$HH }mwHhnHD$HE3HT$PHL$H`HD$@H|$@tBHD$8HD$XHD$0HD$`HD$(H'mHD$ LL$@LD$HHT$P3#HmHHmHmHH~mHmHHlH$HIml l#lHkH lHHkH lHkHHkH kHYqHHkH kHLhHkH 0qHLhH SHĈÐ %r%%LcAT>>?;3LllaHlHul̐E3E333xlH Tl3Ht /H@lH 1lHHln̐L%lE33E3p3HlJ̐LkE33E3L3Hk&̐3flHmHmHmHmHmHmHmHmHmgHgHlH|lÐLI[IkIsI{ AWH@3HIHL=PoIDK\LHEHrICL$(HKoKICNu!Hu5L=h3HnHt/du.9nu"nHHhHu3Ku?u5HtA`H oLCHrAI\$(HD$ HbnH\$PHl$XHt$`H|$hH@A_ÐNS_AddProcessParametersFlags::InitializeHooksMultiH\$WHH^H3HD$xHgeH<%`HL$HHHD$XHT$HHD$@ HL$8E3fD$:sy5HA:LHqH\$(HD$ LD$0HL$8-yHABHO D$0 AjtL ?mLpHnAGHrLxAIHpHD$ 2HL$xH3H$HĀ_Ð[ProcessCommandLine] Failed to convert string "%s" to UNICODE. NS_AddProcessParametersFlags::ProcessCommandLine[ProcessCommandLine] Failed to convert string "%s" to a hex number. HXH\H3HD$@HMLMtHHA<uML qT$(IIEd$,HD$ MtHA< uM҉L$8AMEʃd$<ILL$0LL$ 3¯HL$@H3]HXÐH HaHaHHHLEIHDgHH [ÐH HH>HKH [0̐H\$Ht$WH 3ApHt`ApHɫGA`Ht$HHtH [gHt&DËHx؅u3H\$0Ht$8H _Ë̐H\$Hl$Ht$WAVAWH 3HcA{MLH;~DIt IIH+DA+u HEut HH;|Hl$HHt$PH\$@H A_A^_ÐLI[IkIsI{ AWH@3HIHL=iILAAHEHmICL$(HiKICu*HL=cH iHt~/du9huqh{u`HhLHlHD$(H!iNAHD$ HiHbHj3Bu6HtHiLIH*lA\$(HD$ HAhH\$PHl$XHt$`H|$hH@A_ÐNS_ConditionalApphelp::InitializeHooksMultiHVWAVHHD$8HXHXH3H$AHHZ^HD$(E3Lt$0HL$(HHL$("HL$(Ht|HH®HHuHL$(3e3DBXHL$@XhD$dH|$Ht$`HLL$ E3AHL$@ӅtD9t$ t 3gHL$(L3H$H3H$HİA^_^ÐApphelp.dllSdbShowApphelpDialogHJ(HT$UH HHH ]ÐH0g٨u+H%JcH gH\H$cutHt =gue3fdu\=sgtSctL fLiHRgH kL/HiHL$ AH0[ÐNS_ConditionalApphelp::NotifyFnHLH L@HHSVWATAUAVAWHH@HL5fLt$pL%!bLd$xL=fL|$hH_HD$0Ieuf3=ifw|$@$H$@$0H$PH}LH$H9$PHjHL$X_HT$0HL$HOLD$XHT$HH$+HL$HHL$XHZHD$0H|$8L$HT$0H$HHL$0H ]HcH\$0C+HLHH CHiHtZHD$HH|$PAH$HL$0"HHL$H\H$HT$HH$kIH$by+HL$HHL$0H$IKHL$H}H\$0H |9C|LcHHHHL$0_t2A H$HL$0KHIH$HbHIu $@QHRH)u $H1HBH u $HH*Hu $0{HHL$0tpHS HL$Xt$@D$0LD$X$PI9$@t Dž9$HtA A!$H$@HL$Xb@8=[tRb_tL 9bLReHsaHWbHD$ ALugH&e@=X[HL$0H$=BHL$0H$"%3wLt$pLd$xL|$h$HL$Mt IBt/9|$@t)I$9xt IH+ `u IOH+ `HtIG`AA>3HA_A^A]A\_^[Ð-d{}-t-Apphelp:-NOT-AND-OR-IgnoreCase-ARG:HJXSHJHGHHJ0/HJH#HHHT$UH0H=YtU[]tL 2`LKcHl_HP`HD$ ALneHcMYHH H0]ÐH\$WH`H$PH3H$PI d$0I!33II<HHthHU`HHHuZHLL$@LD$0H0`D$ =w%HHT$@˟tHH_ǟHH;u3H$PH3uH$pH`_ÐHHPHHSH@H@LHL@tUHL$XA؅tEH THL$(Hd$03HL$(HL$(DHL$(HL$("3H@[ÐHJ( HT$UH HHH ]ÐH\$WH HHHH 9A}3LcH3ɅH\$0H _ÐH\$WH H|teH %`L3HI0ϟHH\$0H _ÐH\$WH yHHu@Q t2C C HcHH tHYSHaHHa3H\$0H _ÐSVWAVHHpHEHH@E3AE3HHD$ LuHMLt$XLt$PLt$HLt$@Lt$8HE8Lt$0E3HD$(HE@E33Du@Du8HD$ DE8eH %`PHI0AMHHt{AD9u@vZM8Lt$8Lt$0LMHLljMHHMLt$(Lt$ ԟuH(tHH=t;]@reH %`L3HI0HMHt2HpA^_^[]ÐSoftware\Microsoft\Windows NT\CurrentVersion\ProfileListLI[IsWH0IcICHHAE3HICu]39_ ~F3HHL$PHLRuHc3HHHH;_ |HL$PHtH\$@Ht$HH0_ÐH\$HT$UVWHl$HHeHe/IHEHAE33HD$ ؅0H!t$@HMoHE/HD$8H!t$0E3E3HD$(!t$ ؅H!t$XH!t$PHM!u !u!u!u#!uHEHD$HHE#E3HD$@HEE3HD$8H!t$0HEHD$(HE 3HD$ "؅E;[}#;PM<} E;s N;GʺDeH %`HI0HHt3ҋHȉUHM?9UEeLM7E'HE'LHD$8HL$0HMHE}7HD$(Hd$ =u&E'DMHM/D$(HE?E3HHD$ =tUHM?E‰U;Uz39} vcHd$8EHd$0HMHd$(Hd$ LMLƋ׉EuHU/HML=tE;} r HteH %`L3HI0KHM/HtlHMHt]H$HĠ_^]ÐH La HMteH %`3HI0H#cH [ÐLI[IkIsI{ AWH@3HIHL=WIL9AHEHZICL$(HVKICu%HL=P3xHoVHt~du9WVuqKV$u`H8VLHZHD$(HVNAHD$ pHHOHo3Bu6HtHuVLFHYA\$(HD$ HUH\$PHl$XHt$`H|$hH@A_ÐNS_CopyHKCUSettingsFromOtherUsers::InitializeHooksMultiSWHHPHeHU3HU!](!]0HE8LM(E3HD$0HE03HD$(H!\$ uBzU0U(;U(w~eH %`DºHI0MHHtXM(LM(LHHHE83HD$0HE0HD$(HT$ HUt 9E8DeH %`L3HI0$HMHtHP_[]ÐHPHD$0H\$`d38NtWHRZHD$ ALHWK@MQtH2ZHD$(LWHGUbH\$8H\$@\$HHT$89\$D~7HL$8D$D~H\$83HAHHuHL$8HL$8H\$`HP_ÐNS_CopyHKCUSettingsFromOtherUsers::NotifyFnHJ8HL$SHHD$0HHLHL$HL LYHYHL$HVHHL$8uLD$8HT$HHL$XTHL$8H.IHD$8Hd$@LD$XHT$8HL$XGt_HT$8ztH$H$HD$ AE3HluHT$8H*띅uH$HL$8RHL$XHL$H<HĀ[^HJHHJ8 HJXHJ8HT$UH0HHH0]ÐyHcLu*x&I ;};}IHcHHAH ÐHHXHhHp WH HcH@Bwy3;Y~gL@VHxTeH %`LD$@VHI0HHt1LcGHHIeH %`LHI03vH/_9_@Ƌ3H\$0Hl$8Ht$HH _ÐHHH3HuIIÐHHpHXAH3HEHE3LMtHHE8uML VUID]HEIEHEHEHrHEH_HEHE8Ht HD8uHMALEI3LMLMD] HMH3襹Hp]ÐApiNameUnknownH HYL DreH %`LHI03HH [ÐH\$WH HHteH %`L3HI0HH\$0H _ÐeH%`L3HH0H%LI[IkIsWAVAWH0=HEHLtVHTLHdRAICLrHtHTL4RHOHD$(D NHYDI"hD wNHYDHHhH MHHHLEHHIH΋gHHgHl$XHt$`H\$PH0A_A^_ÐNS_CorrectFilePaths::APIHook_CopyFileALI[IkIsI{ ATAVAWH0=`GMMHLtVHbSLH QAICRJGtHCSLPH]NHD$(sD 8MHWDIfD MHWDHHfH oLH(HHL$xMωL$(HL$pMHL$ HHIH΋;fHH0fHl$XHt$`H|$hH\$PH0A_A^A\ÐNS_CorrectFilePaths::APIHook_CopyFileExALI[IkIsI{ ATAVAWH0=EMMHLtVHQLHOAICKIEtHQLlOHLHD$(D KHVDINfD KHlVDHH2fH JHXHHL$xMωL$(HL$pMHL$ HHIH΋dHHdHl$XHt$`H|$hH\$PH0A_A^A\ÐNS_CorrectFilePaths::APIHook_CopyFileExWLI[IkIsWAVAWH0=DEHLtVHPLH4NAICzGADtHkPLNHKHD$(D `JHTDIdD GJHTDHHdH IHHHEHHIH΋xcHHmcHl$XHt$`H\$PH0A_A^_ÐNS_CorrectFilePaths::APIHook_CopyFileWLI[IkIsWH0=7CHHtYHFOLHLAIC3FBtH$OLLH>JHD$(TD IHSAHbH iHHHHHHHHϋMbHl$HHt$PH\$@H0_ÐNS_CorrectFilePaths::APIHook_CreateDirectoryALI[IkIsWAVAWH0=BMHLtYHNLHKA1IC uEAtHMLKHIHD$(-D GHRDIaD GHRDHHcaH $GHHHMHHIH΋aHH`Hl$XHt$`H\$PH0A_A^_ÐNS_CorrectFilePaths::APIHook_CreateDirectoryExALI[IkIsWAVAWH0=@MHLtYHLLHyJADIC%D}@tHLLFJHGHD$(D FHQDI#aD FHQDHHaH EHHHYMHHIH΋_HH_Hl$XHt$`H\$PH0A_A^_ÐNS_CorrectFilePaths::APIHook_CreateDirectoryExWLI[IkIsWH0=v?HHtYHKLH0IA ICsB6?tHdKLHH~FHD$(D YEH>PAH_H DHHH.HHHHϋ^Hl$HHt$PH\$@H0_ÐNS_CorrectFilePaths::APIHook_CreateDirectoryWLI[IkIsWAVAWH@=O>IEDHtVHWJLHHA[ICGA>tH8JLGHREHD$(hD -DHZODH]H CHHHHH$LHL$0$EƉL$($A׉L$ HHHH:]Hl$hHt$pHH\$`H@A_A^_ÐNS_CorrectFilePaths::APIHook_CreateFileALI[IkIsWAVAWH@=<IEDHtVHILHFAvIC`@<tHHLFHDHD$(D BHNDHc]H 0BHxHHH$LHL$0$EƉL$($A׉L$ HHHH[Hl$hHt$pHH\$`H@A_A^_ÐNS_CorrectFilePaths::APIHook_CreateFileWLI[IkIsI{ ATAVAWHP=;MMHHtVHGLkH\EAIC ?;tHGL,EHBHD$(LHHtD }AH:DH[LHtH@E3DHZHHHHl$0LHDALt$(HD$ H {@HYHH$MHD$HH$MHD$@H$HHD$8H$IHD$0$D$($D$ HI΋ZHH ZL\$PI[ Ik(Is0I{8IA_A^A\ÐNS_CorrectFilePaths::APIHook_CreateProcessACreateProcessA ApplicationName:CreateProcessA CommandLine:CreateProcessA Application(%s) CommandLine(%s) LI[IkIsI{ ATAVAWHP=q9MMHHtVHRELkHBAICB<)9tH3ELBHM@HD$(cLHHtD ?H:DHYLHtH@E3DHYHHHHl$0LH]BALt$(HD$ H >HYHHH$MHD$HH$MHD$@H$HHD$8H$IHD$0$D$($D$ HI΋WHHWL\$PI[ Ik(Is0I{8IA_A^A\ÐNS_CorrectFilePaths::APIHook_CreateProcessWCreateProcessW ApplicationName:CreateProcessW CommandLine:CreateProcessW Application(%S) CommandLine(%S) H\$Ht$WH0=6HtWH CLH@AHD$ }a:6tHBL@H>HD$(D <H+HDHpVH 1<HHHHHHϋVHt$HH\$@H0_ÐNS_CorrectFilePaths::APIHook_DeleteFileAH\$Ht$WH0=5HtWH BLH?AHD$ |a95tHAL?H=HD$(D ;H;GDHdVH 1;HHHHHHϋUHt$HH\$@H0_ÐNS_CorrectFilePaths::APIHook_DeleteFileWLI[IkIsWH0=4HHtYHALH>A* IC{\84tH@L}>H;HD$(H]FH}XH 6:HHHHHHHHTHl$HHt$PHH\$@H0_ÐNS_CorrectFilePaths::APIHook_FindFirstFileALI[IkIsWAVAWH0=3AMDHtYH?LH=AN ICzB73tH?Lc=H:HD$(HcEHcWH 9HhHHL$xD͉L$(HL$pMHL$ HAHHHRHl$XHt$`HH\$PH0A_A^_ÐNS_CorrectFilePaths::APIHook_FindFirstFileExALI[IkIsWAVAWH0=2AMDHtYH>LHV<Ah ICy6R2tH>L#<H9HD$(H;DHoXH 7HHHaL$xD͉L$(HL$pMHL$ HAHHHQHl$XHt$`HH\$PH0A_A^_ÐNS_CorrectFilePaths::APIHook_FindFirstFileExWLI[IkIsWH0=^1HHtYHv=LH ;A: ICcx41tHT=L:Hn8HD$(HBH9WH 6H8HH+HHHHHPHl$HHt$PHH\$@H0_ÐNS_CorrectFilePaths::APIHook_FindFirstFileWLI[IkIsWH0=K0HHtVHa<LH :A~ ICQw3 0tHB<L9H\7HD$(rD 76HBDHOH 5HHHHHHHϋnOHl$HHt$PH\$@H0_ÐNS_CorrectFilePaths::APIHook_GetBinaryTypeALI[IkIsWH0=*/HHtVHA;LH8A IC1v2.tH";L8H<6HD$(RD 5H@DHOH j4HHH}HHHHϋNNHl$HHt$PH\$@H0_ÐNS_CorrectFilePaths::APIHook_GetBinaryTypeWH0=A.tZH::LH7AHD$ &u1.tH:L7H15HD$(GH3Hu6Hl3HhH|E3EAHT;H|MH3H0[ÐNS_CorrectFilePaths::APIHook_GetCommandLineAH0=R-tZHJ9LH6AHD$ 6t0-tH'9L6HA4HD$(WH2Hu6H|2HH|E3EAHT:HMH2H0[ÐNS_CorrectFilePaths::APIHook_GetCommandLineWH\$Ht$WH0=j,HtZHN8LH5AOHD$ :s/,,tH+8L5HE3HD$([D 2HE8E3HKH s1H(HHzHHHϋZKHt$HH\$@H0_ÐNS_CorrectFilePaths::APIHook_GetFileAttributesALI[IkIsI{ AVH0=L+IDHtYH.7LH4AICr. +tH 7L4H&2HD$(Hl$XHt$`H\$PH0A_A^_ÐNS_CorrectFilePaths::APIHook_GetPrivateProfileSectionWLI[IkIsWAVAWH0=HIILLtYH<*LH'A6IC)e!tH*L'H4%HD$(JHL$xH>,qdH j#HHHlL$pH|$(L$ LLIIHT$xHϋ9=Hl$XHt$`H\$PH0A_A^_ÐNS_CorrectFilePaths::APIHook_GetPrivateProfileStringALI[IkIsWAVAWH0=IILLtYH(LH&APICcR tH(Ls&H#HD$( HL$xH+dH *"HHHkL$pH|$(L$ LLIIHT$xHϋ;Hl$XHt$`H\$PH0A_A^_ÐNS_CorrectFilePaths::APIHook_GetPrivateProfileStringWLI[IkIsWAVAWH0=AILLtYH'LHf%AhICbtH'L3%H"HD$(HL$pH)aH HHHHojDLIIH|$ HT$pHϋ:Hl$XHt$`H\$PH0A_A^_ÐNS_CorrectFilePaths::APIHook_GetPrivateProfileStructALI[IkIsWAVAWH0=AILLtYH&LH6$AICyaOtHj&L$H!HD$(HL$pH(]bH HxHH?iDLIIH|$ HT$pHϋ9Hl$XHt$`H\$PH0A_A^_ÐNS_CorrectFilePaths::APIHook_GetPrivateProfileStructWLMK ECISIKSVWATAUAVAWH`ICMELH38\tWHI%ICALXH"K8`,t H*%HD$(L"H? ZHMHHL$8ZIHL$HLHT$HHL$8 HL$82LD AH%Hc8HI;t\H_HtHHHH HgMEIHӋIH7HL$HFHL$8;'HHH HBgMEIHӋ$H`A_A^A]A\_^[ÐNS_CorrectFilePaths::APIHook_GetTempFileNameAHJ8鷓HJH髓HT$SUH8HHHH HfLDHHӉHHH8][ÐLMK ECISIKSVWATAUAVAWHPICMELH38tWH"ICAL0H K];t H"HD$(L^ HHMHHL$8IHL$8輖L|$8D AHS#I7HI;t\H]HtfHHHx HCeMEIHӋIH5HL$8'H|Hx HeMEIHӋ$HPA_A^A]A\_^[ÐNS_CorrectFilePaths::APIHook_GetTempFileNameWHJ8HT$SUH8HHHx HwdLDHHӉHZH8][ÐLI[IkIsWAVAWH0=EAHLtVH LHqAT IC[ \tH LAHHD$(t$xuc@t]D H'DH!4H H8 HHgcL$pt$(L$ EE3IHHHH34HH8 H&cD$pEDHIωt$(D$ HHl$XHt$`HH\$PH0A_A^_ÐNS_CorrectFilePaths::APIHook_LoadImageALI[IkIsI{ AVH0=4LHtVHLLHA ICLLIIHHϋZHl$XHt$`H\$PH0A_A^_ÐNS_CorrectFilePaths::APIHook_WritePrivateProfileStringWLI[IkIsWAVAWH0= AILLtYHLHAIC 5rtHLHHD$(*HL$pHQ4H JHhHH<DLIIH|$ HT$pHϋ! Hl$XHt$`H\$PH0A_A^_ÐNS_CorrectFilePaths::APIHook_WritePrivateProfileStructALI[IkIsWAVAWH0=AILLtYHLHAIC3BtHLcHHD$(HL$pH4H HHH;DLIIH|$ HT$pHϋ Hl$XHt$`H\$PH0A_A^_ÐNS_CorrectFilePaths::APIHook_WritePrivateProfileStructWLI[IkIsWH0=HtVHLHlA? IC2XtHL<HHD$(ӠD H}DH* H H HHp:HHHϋ Hl$HHt$PH\$@H0_ÐNS_CorrectFilePaths::APIHook__lcreatlcreatLI[IkIsWH0=zHtVHLHLA/ IC19tHLHHD$(賟D xHyDH H H HHP9HHHϋ Hl$HHt$PH\$@H0_ÐNS_CorrectFilePaths::APIHook__lopenlopenLI[IkIsWAVAWH0=EHLtVHLH4AICz0CtHkLHHD$(蛞D `HDH˿@ LHOIH/HHtH"8EHIՋHH~H\$PHl$XHt$`H0A_A^_ÐNS_CorrectFilePaths::COMHook_IPersistFile_SaveIPersistFile_SaveLI[IkIsI{ AVH0==HLtVH<LHA IC,/tHLH7HD$(MHE3DH˿@LHUIH.HHtH6HIՋHH7H\$@Hl$HHt$PH|$XH0A^ÐNS_CorrectFilePaths::COMHook_IShellLinkA_SetArgumentsLI[IkIsWAVAWH0=EHLtVHLHALIC-StHLtHHD$( D HDH˿@]LHOIHC-HHtH5EHIՋHHH\$PHl$XHt$`H0A_A^_ÐNS_CorrectFilePaths::COMHook_IShellLinkA_SetIconLocationIShellLinkA::SetIconLocationLI[IkIsI{ AVH0=HLtVHLH6AyIC|,GtHmLHHD$(蝚D bHDH˿@LxHQIH+HHtH$4HIՋHHH\$@Hl$HHt$PH|$XH0A^ÐNS_CorrectFilePaths::COMHook_IShellLinkA_SetPathIShellLinkA::SetPathLI[IkIsI{ AVH0=,HLtVH,LHA6IC+tH LH'HD$(=HvE3DH˿@LHUIHy*HHtH2HIՋHH'H\$@Hl$HHt$PH|$XH0A^ÐNS_CorrectFilePaths::COMHook_IShellLinkW_SetArgumentsLI[IkIsWAVAWH0=EHLtVHLHAbIC)CtHLdHHD$(D HDH˿@ALHOIH3)HHtH1EHIՋHHH\$PHl$XHt$`H0A_A^_ÐNS_CorrectFilePaths::COMHook_IShellLinkW_SetIconLocationIShellLinkW::SetIconLocationLI[IkIsI{ AVH0=xHLtVH|LH&AICl(6tH]LHwHD$(荖D RHDH˿@LHQIH'HHtH0HIՋHHsH\$@Hl$HHt$PH|$XH0A^ÐNS_CorrectFilePaths::COMHook_IShellLinkW_SetPathIShellLinkW::SetPathH(LH;teH %`3HI0(H(ÐHHPHHWAVAWH@H@HXHp EEHHHHL$ HHHlzEE3HL$0LHt"HXHHEH\$ HT$0ITHL$0[Ht$hH|$`H\$ HtLHHlHH\$pHt$xH@A_A^_ÐHJ0o[HT$UH HHH ]ÐHHHD$0HL$PDL$ ELHH U4HD$PHD$PHHÐHT$UH0HHH0]ÐH\$Hl$Ht$WAVAWH EIHLHu3zHuHp|$`Ht H迻HIHY`H-EHIHHuHHtLHH5H;teH %`L3HI0&HH\$@Hl$HHt$PH A_A^_ÐH\$Ht$WH@IHHHtQHtLHHV%tHxHH 9LHHH9ypLHHLHHLH(0H8L@HX`HhLpHHLHHLHHH NHH HH JHH HH FHH (H H JHHH HPH NHxH HH RHH 4HH VHH xHLH SHH HH H(L0H <H8H H@HHPHXL`H %HhH HpHxHLH HH HHHLH HH HHHLH HH HHHL H H(H H0H8@HHLPH HXH H`HhpHxLH HH HHH9 LH HH хHHHLH hHH ʉHHHLH AHH H H(0H8L@H HHH HPHX`HhLpH HxH uHHHLH HH HHHLH HH 'HHHLH HH @HH H(L0H wH8H yH@HHPHXL`H PHhH HpHxHLH )HH kHHHLH HH 4HHHLH HH HHHL H H(H VH0H8@HHLPH HXH H`HhpHxLH ~HH HHHLH _HH HHHLH 8HH HHHLH IHH sH H(0H8L@H *HHH HPHX`HhH BLpHxH HHHLH HH HHHLH HH 7HHHL H ~H H H H H( L0 H H8 H H@ HH P HX L` H pHh H 2Hp Hx H L H QH H ;H H H L H 2H H 4H H H L H H H =H H  H L H H( H &H0 H8 @ HH H LP HX H /H` Hh p Hx L H vH H XH H H L H OH H H H H L H 0H H :H H H L H H H cH H( 0 H8 L@ H HH H HHL$02E3H?HL$0]>yTHL$0DHD$0HLcMeH %`MǍSHI0vHH$HtMHT$0HFHL$02HL$@2L$H$H|$ H$HtHH,HMtMHHRHHPA_A^_^[ÐHJ@g2HJ0[2HT$UH HLMteH %`3HI0HHVH ]ÐHHXHhHpHx AVH0H3IIL`u HHH6HXHHLLIHHH\$@Hl$HHt$PH|$XH0A^H̐H\$WH HHt3u HOHGHHHOHHH\$0H _H̐H\$WH HHt3胕u HOHGHWHXxHHHH\$0H _H̐HHXHhHpHx AVH0H3IILu HLHHHXHLLIHHH\$@Hl$HHt$PH|$XH0A^H̐HHԪH3H$HuSD@DHL$43CHT$03D$0Hot*HL$8Ht d$ HT$ Y;D$ HD\$8HH$H3^#HĐ[ÐLI[IkIsI{ AVH@3HIHL5 ILAHEHICL$(HKICuEHu#L5)HpHt7$H_*HhHuЉ3HCdu90u$HH ݿHXHHH8H XPHH@H пHP0HHH HXXHHH ¿HHH HXHH X HHhH !HX(HHHHpHHP`HXxHHtH#L\H=A\$(HD$ H4H\$PHl$XHt$`H|$hH@A^ÐCorrectShellExecuteHWNDNS_CorrectShellExecuteHWND::InitializeHooksMultiH HH@>-HK05-HK ,-HK#-HH [-̐LMK MCISIKSVWAVAWHHD$XMMHHHHD$`3I[LHIK蹑\$PLD$PHHH$諚t@9\$Pt:HL$`s=H HL$`0H$HL$`8HH$HL$p L$L$H$H$H{HXH&H$8HD$HH$0HD$@H$(HD$8H$ HD$0$D$($D$ MMHHӋHL$`+HA_A^_^[ÐHJ`+HJp+HT$UHPHH*HP]ÐLMK MCISIKSVWAVAWHHD$XMMHHHcHD$`3I[LHIKA\$PLD$PHH$t89\$Pt2HL$`;HpHL$`.H$H|$`H$HL$pE L$L$H$H$HӳHXHH~H$8HD$HH$0HD$@H$(HD$8H$ HD$0$D$($D$ MMHHӋHL$`)HA_A^_^[ÐHJ`)HJpHT$UHPHH*HP]ÐLI[IkIsI{ AWH@3HIHL=PILAHEHICL$(HIKICLu*HL=#HHt~/du9ruqfkucHSLHHD$(HNAHD$ H)$H*Hj3HH ѿHHHH oHHHH HXHH8H X HX(HP0HXHHH@XPHXXHtHbL[H<A\$(HD$ HcH\$PHl$XHt$`H|$hH@A_CreateDummyProcessNS_CreateDummyProcess::InitializeHooksMultiH8HD$ uHH $K(3H8ÐHT$UH HHH ]ÐH\$HT$L$UVWATAUAVAWHH`}xupDuhD}`EMDDAA|$@t$8HDt$0LH|AD|$(HD$ HUpHM`gHUxHMhZ}xupDuhD}`|$@t$8HDt$0LqHAD|$(HD$ BHHXHNHUHM@EMʼn}xupDuhD}`HH$H`A_A^A]A\_^]H̐NS_CreateWindowConstrainSize::APIHook_CreateWindowExAH\$HT$L$UVWATAUAVAWHH`}xupDuhD}`EMDDAA|$@t$8H$Dt$0LHAD|$(HD$ $HUpHM`HUxHMh}xupDuhD}`|$@t$8H Dt$0LqHAD|$(HD$ HHXHHHUHM@EMʼn}xupDuhD}`HH$H`A_A^A]A\_^]H̐NS_CreateWindowConstrainSize::APIHook_CreateWindowExWE39t]AGtD9 }D! D9~ DA9t[LcHcIAHI;w =v29}E+9t9|AGtD9~ DAAÐLI[IkIsI{ AVH@3HIHL50ILIAHEHICL$(H)KIC,uEHu#L5H`Ht7$HoHhHuЉ3H3du9 uH $H]HXHHH nX HHH HHH8H HX(HP0HXHXPHH@HXXHtHLFHA\$(HD$ 5HH\$PHl$XHt$`H|$hH@A^ÐNS_CreateWindowConstrainSize::InitializeHooksMultiAE3A;uA;t w]AA;wJA;uA=w5LcHc¹LȸIH;wAAAA;AFDAÐH\$Ht$WH AA3^t׋QKEHt$8H\$0H _ÐHDH L@HPHHSVWATAUAVAWHH@EMHL=ڤtZHHD$ APLeH~tHHD$(LPHY3H\$xH$@HcHZHH$>9Ht4H$H$YHMuH$ Hd$pHT$pHkHHXHH$PHD$`H$HHD$XLt$pLt$PH$8HD$HH$0HD$@H$(HD$8$ D$0$D$($D$ EMHIHHD$xLt$pMt I8H$"-H$@D$L$H$L$H\$xHH*HXHH$PHD$`H$HHD$XH|$PH$8HD$HH$0HD$@H$(HD$8$ D$0$D$($D$ EMHIHHHİA_A^A]A\_^[ÐNS_DeprecatedServiceShim::APIHook_CreateServiceAHHT$UHpHHHp]ÐHDH L@HPHHSVWATAUAVAWHH@EMHL=tZHHD$ ALeH^sդtHdHD$(L0HyV3H\$xH$@HcHZHH$9(t4H$H$9H-uH$ Hd$pHT$pHHHXHHH$PHD$`H$HHD$XLt$pLt$PH$8HD$HH$0HD$@H$(HD$8$ D$0$D$($D$ EMHIHHD$xLt$pMt IH$-H$@D$L$H$L$H\$xHH HXHHH$PHD$`H$HHD$XH|$PH$8HD$HH$0HD$@H$(HD$8$ D$0$D$($D$ EMHIHHHİA_A^A]A\_^[ÐNS_DeprecatedServiceShim::APIHook_CreateServiceWHHT$UHpHHHp]ÐHHHWH0H@HXHp H3ۉ\$HH=̤HWH9Xt H^t H?Hu \$H Ht$@\$HHTH\$PHt$XH0_ÐHT$UH HHH ]ÐH(H HA+BuPH(ÐHHHWH0H@HXHp H3ۉ\$HH=HWH9Xt Ht H?Hu \$H Ht$@\$HHH\$PHt$XH0_ÐHT$UH HHH ]ÐLI[IkIsI{ AVH@3HIHL5ILA?HEHICL$(HKICuEHu#L5KgHHt7$H/H HuЉ3Hdu9Сuġ>Hu2HD$(HoLH1MA@HD$ ;H HHXHHH X HHH HHH8H HX(HP0HXHXPHH@HXXHtHLDHAD\$(HD$ HH\$PHl$XHt$`H|$hH@A^ÐNS_DeprecatedServiceShim::InitializeHooksMultiCreateServiceACreateServiceWHHHWHH@HX3ۉ$H}HL$Ps5HD$P9XuHL$PlHqHL$pgLD$pHT$PH$#8HL$pHHD$`H\$hL$HT$`H$9HH$L$HT$`H$7H$DHHD$0H\$8HD$@H\$HeH %`DB HI0HHt HNHGH_H?HGH_ HL$HT$0H$P8L$HT$@H$68HuwH:HD$ ALHiOHL$@uHL$0jH$ 4HL$`QH$3HL$P8HD$0HO9Xug HT$0{HD$@HO9Xu H HT$@VHHH=HL$@HL$0H$j3$HL$`H$A3HL$P$H$H_ÐOut of Memory when trying to allocate list.HJP3HJp'H2HJ`HH2HJ0HJ@HT$UH0H=tU/tL LH@_1H$HD$ A"LHcxHH0]ÐH\$WH03HHt18t*Hd$@LD$@H x$HD$@HHH؀?uHHH\$HH0_ANH,LuAIHʠHD$ 3̐[ScAStrArraySize] Invalid length of the a service name passed to CreateServiceNS_DeprecatedServiceShim::ScAStrArraySizeH\$Ht$WH03HHt>f91t5LD$@HHt$@Ix1HD$@HtHLH7HD$(MCH ^HtHj\Hu!ALD$@HAQD$@@fH8ÐNS_DisableExceptionChainValidation::NotifyFnExecute=0H\$ UVWATAWH`HH3H$P=eIHHL%L=EtMA,HMAIIHD$  rtHHMHD$(.BHHXHLHHHHHT$@H ZDau>~ D$(A=HJMI׹HD$ \LPHL$@HHL$@OHHu%~ D$(AFHLH[HH[HHHHHd$0HHL$0օyAWD$(H@AI|$0uA^H;AIvH3Ӆ=tH= t2MI׹=u HDIn:D$(AuH2aHyAl HAiIMHD$ 8~ AOD$(HQAIMIHD$ H{HH$PH3hH$H`A_A\_^]ÐNS_DisableWindowsDefender::APIHook_RegisterServiceCtrlHandlerExWProgramFilesGetEnvironmentVariable error: %x \Windows Defender\MpClient.dllLoadLibrary error: %x WDStatusWDEnableGetProcAddress error: %x WDStatus error: %x WD already disabled Calling application does not have sufficient permission or is flagged as a threat by Windows Defender signature database. Calling application identity is not verifiable through digital signing. Calling application request contradicts with the Windows Defender status set by group policy. Unspecified error: %x LI[IkIsI{ AWH@3HIHL=IL!AHEHICL$(HyKIC|uGHu%L=ˆHHt$HHHuΉ3HQdu9>u2uhH >HXX HH HX(HHH vHHHtH LEHސA\$(HD$ H͋H\$PHl$XHt$`H|$hH@A_ÐNS_DisableWindowsDefender::InitializeHooksMultiRegisterServiceCtrlHandlerExWH\$Ht$WH OuBHcH<H eHtHHkHHHt0H5 HHÀ<uHHKHH\$0Ht$8H _Ðdxgi.dllSetAppCompatStringPointerLI[IkIsI{ AWH@3HIHL=IDKPL HEHICL$(HKICu!Hu5L=E3~HHt/du.9݉u"щ$H/HHu3aftuPH9t 9̊uQu5HtARHLMH6AI\$(HD$ KH\H\$PHl$XHt$`H|$hH@A_ÐDXGICompatNS_DXGICompat::InitializeHooksMultiH\$Ht$WH HH HFHt.t*Ht"H;uHHXH3HHXHHHHH\$0Ht$8H _H̐H\$Ht$WH HH HHt.t*Ht"H;uHHXHH$3HHXHHHHHH\$0Ht$8H _H̐LI[IkIsI{ AVH@3HIHL5`IDK_LUHEH:ICL$(H[KIC^uEHu#L5HBHt7$HHrHuЉ3HAdA;u9uH HHXHHH X HHH HHH8H ^HX(HP0HXHXPHH@HXXHtHLRH;\$(HD$ gHhH\$PHl$XHt$`H|$hH@A^ÐEmulateCursorNS_EmulateCursor::InitializeHooksMultiLoadCursorALoadCursorWUVWATAUAVAWH(H}wH3H$L$$3HAMD\$PHD$X\$TMMDCUHT$`E3DsAs \$PA LD$PHL$`Eκ JHyHHA8\=uDžy HA8 uqu uA >HcHBLH3<LHuH~"L$PDM3҉|$(HD$ ML-ߔ~,u$HcDMINL$P3҉t$(H\$  H\$XD$T~t~%u!WMH3ZHd$@Hd$8H jHL$0D$(HL$`DMAH\$ PMH32 WK3H$H3H(A_A^A]A\_^][ÐLHXH$ICH$ICHʓIC؋$D$(H$IC HXÐUVWHHtH3H$H$`AE3IEAUHT$Pu HWk3;Hd$@Hd$8H,HD$0$hHL$PD$(DLNjHl$ dH$H3dH_^][ÐUVWAVHH3tH3H$H$`L$pAE3IEAUHT$Pu HW3@Hd$HHd$@HrHD$8$hLt$0D$(HL$PDLNjHl$ %H$H3HA^_^][ÐLHXH$ICH$ICHICH$IC؋$D$(H$ICHXÐLH%SVWATAUAVAWHl$H(HrH3HEH3AMDH\$X|$PMDGUHT$`E3sL;As |$PA#LD$PHL$`A %KyHHA8<4uHcHLH3LHuHL$PDM3҉t$(HD$ DuHWpA sBH|$@HH|$8HD$0HL$`D$(HD$XEMAHD$ L-HcHRLH3LLHu$HK-M3HcH|$@H|$8HH\$0HL$`EMA։t$(HD$ ezH|$@H|$8H\$0HL$`EMA։|$(H|$ D$THcHLM3HWHHtuH|$@LHPH|$8HD$0D$TD$(HL$ HL$`EMA~5L$PH|$8H|$0D$(HD$XDMĺHD$ M3HMH3~3 W3HMH3 H(A_A^A]A\_^[]ÐLHXH$ICH$ICHJIC؋$D$(H$IC!HXÐUVWHHeoH3H$H$`AE3IEAUHT$Pu HW3;Hd$@Hd$8HHD$0$hHL$PD$(DLNjHl$ |H$H3H_^][ÐLI[IkIsI{ AVH@3HIHL5}ILAHEHICL$(H}KICuEHu#L5v 'H|Ht7$HHvHuЉ3)HS|du9@|u4|HtH mHXHHH ~X HHH `HHH8H HX(HH@H SHP0HHhH HXHHHpH EXPHH HXXHH 2HP`HH HXxHH HH *HHH HH(H HH0H HXH HH`H HHH HHHHHHH H8@HHHPHhpHxHHHHtH{LiHBA\$(HD$ @H1zH\$PHl$XHt$`H|$hH@A^ÐEmulateSortingServer2008NS_EmulateSortingServer2008::InitializeHooksMultiCompareStringExCompareStringWCompareStringALCMapStringExLCMapStringWLCMapStringAFindNLSStringExFindNLSStringIsNLSDefinedStringHLH D@PHHSVWATAUAVAWH`H@MADL=ttZHHD$ ALH}swtHHD$(L}Hz(3ۉ\$0H=yIHL$P HoHD$@H!\$HHT$@HL$PHWHL$@t H?HutLؖHWH t7HHtTHH tDHH tHt,HHtDA;ECHIt\$0HL$@HL$P#L$$D$L$\$0u$H]wHXHMDAIӋ؋H`A_A^A]A\_^[ÐHJP;HJ@/HT$UH0HutH׆HD$(L3|H yG'H؆HD$ A3L֕H|̸H!H0]ÐLISIKVWAVH`ICI[ HL=qtYHk}ICALH{XwqttHI}HD$(Le{H^xy&3ۉ$H=awIHL$H| HTmHD$8H!\$@HT$8HL$HkHWHL$8t H?Hu>LvHWH rռHt!HH nr؉$Ht&HL$8HL$HzH$L$$uH=uHXxHhHIӋ؋H$H`A^_^ÐHJHHJ8HT$UH0HlstHHD$(LzHv+%HHD$ AL:HyH1H0]ÐLISIKVWAVH`ICI[ HL=otYHK{ICAL Hsy8VortH){HD$(LEyH>vY$3ۉ$H=AuIHL$H|H4kHD$8H!\$@HT$8HL$HKHWHL$8t H?Hu>LVHWH cpHt!HH Npx؉$Ht&HL$8eHL$HZH$L$$u!HsHHEHIӋ؋H$H`A^_^HJHHJ8HT$UH0HLqtHHD$(LwHt #HHD$ ALbHwH1H0]ÐHLH D@PHHSVWATAUAVAWH`H@MADL=WmtZHyHD$ AJLIHBw#miptHxHD$(LwH t("3ۉ\$0H=sIHL$PNHiHD$@H!\$HHT$@HL$PHWHL$@mt H?HutL(HWH 5nHHtTHH nGDHH nLHt,H6HtDA;ECHI\$0HL$@HL$P#L$$D$L$\$0u$HpHXHHغMDAIӋ؋H`A_A^A]A\_^[ÐHJPHJ@HT$UH0HntH'HD$(LuH\r H(HD$ AuL^HWuH!H0]ÐLI[IkIsI{ AWH@3HIHL=pILAHEHtICL$(HpKICuEHu#L=iH`oHt/$HHiHuЉ3oH3odu9 ouou H ou;*HD$(HpL2H#tNAHD$ ݰ낃H3H <HXHHH X HHH 7HHH8H )HX(HH@H 2HP0HHhH HXHHHpH ,XPHH HXXHP`HXxHHHHHHtHJoLCH4sA\$(HD$ HmH\$PHl$XHt$`H|$hH@A_NS_FileVersionInfoLie::InitializeHooksMultiVERSION.DLLGetFileVersionInfoAGetFileVersionInfoWGetFileVersionInfoSizeAGetFileVersionInfoSizeWHAWHH@HXHpHxH9gHL$P_HD$Px3L=C eH %`DB HI0)HHt"H cHHH`H cHHH` 3Hu;HHD$ ALϋHqKWHL$PL3HcHKI G1HKIE HamHHWm2HmHL$pLD$pHT$PH$CHL$pHcHD$`Hd$hL$HT$`H$0HYmH$L$HT$`H$H$cHbHD$0Hd$8HD$@Hd$HL$HT$0H$L$HT$@H$HD$0xHD$@xeH %`DB HI0PHHt"H bHHH`H bHHH` 3HuxHHD$ ALHoK~HL$@sHL$0hH$ HL$`OH$HL$P63HKHT$0HKHT$@{HTkHHJkHL$@HL$0H$HL$`H$rHL$P3L$I[IsI{ IA_Ð[ParseCommandLine] Out of Memory when trying to allocate list.(@`8Ph0H`x8Pp0Ph 8Ph0Ppؾ0Hh8Xx8XpP{h{{0Hh(H`0H` {8PhHJPHJpHHJ`HHHJ0HJ@HT$UH0H=_tU ctL eLiHe;HfHD$ AL΃HiTo_HH0]ÐH\$Hl$Ht$WAVAWHp=`H$AADDu(Ht#H?eHHRBu H'eHx HcHXHH߭H$DDAAHL\$pI[ Ik(Is0IA_A^_H̐H\$H|$UHHpHUH3HE3HHMDC83҉]=2_HH|dHOHR~H _dHHQH8u H;sxHHEHGHEHGHEHGHEHG HEHG(HEHG0HEG8ELA HEL+HMHHtAt HHuHuHɈH}HNbHHHHMH3L\$pI[I{ I]ÐH\$H|$UHl$HHSH3HEG3HHMDCX3҉]=]HH'cHOHRL cHIHHf9Au H;snHHMHEHGHEHGHEHGHEHG HEHG(HEHG0HEHG8HEHG@HE'HGHHE/HGPHE7GXE?M@(aH}HaHH:HHMGH3L$I[I{ I]ÐH\$Hl$Ht$WAVAWHp=\H$AADDu(Ht#HaHHRڢu HaHx(HT`HXxHH$DDAAHL\$pI[ Ik(Is0IA_A^_H̐HHXHhHpHx AVH H_HIHXHcHLƋHӃ=[uaE3tZHtUH"aHHP(HHfD94BuH;v4Hu'H`HHLCHC(HfD94xuHHl$8Ht$@H|$HH\$0H A^ÐH(VE3L|ZMAEQfA9tAI0HcHrHu`HcH@HIH^` ZHAEA;ʉ ZAAH(ÐLI[IkIsWATAWH@3HIHL%_ID{L>HEH#AiIC؉L$(Hv_AICyuBHu L%XIH1^HtD?$HHxXHuӉ3H^du"9]u]H]u;_HD$(H^LwH`AjAHD$ Ÿ뇃$H~H iHXHHH jX HHH dHHH8H NHX(HH@H WHP0HHhH HXHHHpH IXPHH HXXHH >HP`HH HXxHHHHHHHHHtH]LQH:ApAω\$(HD$ Hk\H\$`Hl$hHt$pH@A_A\_ÐFontMigrationNS_FontMigration::InitializeHooksMultiGetTextFaceAliasWCreateFontACreateFontWCreateFontIndirectACreateFontIndirectWH\$3HBAI;DAWEGEx>DHt*L+L+IHtAft fHHuHuHAzHtfH\$AÐHHXHhHpHx AVH0AAHLAs A s HZHXHH%DDHIHH\$@Hl$HHt$PH|$XH0A^H̐HHXHhHpHx AVH0AAHLAs A s HZZHXHDDHIHH\$@Hl$HHt$PH|$XH0A^H̐LI[IkIsI{ AVH@3HIHL5ZIDKlL]HEH:ICL$(HZKICuEHu#L5 TiHYHt7$H1HSHuЉ3HeYdu9RYuFYH vzHgHXHHH X HHH bzHHH8H HX(HP0HXHXPHH@HXXHtAoHQZLZH;AI\$(HD$ HXH\$PHl$XHt$`H|$hH@A^ÐForceKeyWOW6464KeyNS_ForceKeyWOW6464Key::InitializeHooksMultiH\$UVWHH"JH3H$pHHHL$$3AD3D$ H3HL$dHotCLD$ E33fl$$uѸH$pH3H$HĀ_^]LD$$H̐LI[IkIsI{ AVH@3HIHL5`XIL9AHEHICL$(HYXKIC\u)HL5oQ3HVHdu<9VL >QVMtUL33H\$(\$ ՝u6HtHXLH\A\$(HD$ HcVH\$PHl$XHt$`H|$hH@A^HHPH13̐ForceLoadMirrorDrvMitigationNS_ForceLoadMirrorDrvMitigation::InitializeHooksMultiH\$Ht$UH$`HHGH3HHHb33Af`HL$R3AD$@ft$PbHL˻LHpHHpHD$@LHHD$0H`AHD$(HHt$ əuXHT$PH`Dt?HL$PE33Ht*HHߜHHtHH3HH3tL$I[Is I]Ð%SMirrorCompatBinaryExtensionSOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlagsMirrorDrvLoadedNotifyLD$LL$ SUVWH(3HBHH=WGx5HZLL$hHHӋxHH;wuf,^f,^zHtf.H(_^][ÐH0=OtYA'HZLcAIHHXHD$ ^QNtHYLXHUHD$(HH0[H%NS_ForceTerminateProcess::APIHook_ExitProcessLI[IkIsI{ AWH@3HIHL=SIDK1LHEHrWICL$(H SKICuGHu%L=LHQHt$HOHKHuΉ3HcQdu9PQuDQugH _HXX HH rHX(HHH HHHHtA3HRLAHVAI҉\$(HD$ ?HPH\$PHl$XHt$`H|$hH@A_ÐNS_ForceTerminateProcess::InitializeHooksMultiH\$WH0=LHtYA.HWLAIH VHD$  OLtHWLUHRHD$(HuH OHYH HOHXHbHHH\$@H0_H̐NS_GetTopWindowToShellWnd::APIHook_GetTopWindowLI[IkIsI{ AWH@3HIHL=PIDKBL-HEH UICL$(HPKICuGHu%L=I HOHt$HHhIHuΉ3HNdu9NuNugH PHXX HH oHX(HHH HHHtAFHPLQH2TAI\$(HD$ HPNH\$PHl$XHt$`H|$hH@A_ÐGetTopWindowNS_GetTopWindowToShellWnd::InitializeHooksMultiLI[IkIsI{ AWH@3HIHL=NIDK3L5HEHICL$(HNKICuGHu%L=GkH4MHt$H/HGHuΉ3HMdu9LuLugH [HXX HH HX(HHH hHHHtA5HxNLYH:AIЉ\$(HD$ HLH\$PHl$XHt$`H|$hH@A_ÐIgnoreFreeConsoleNS_IgnoreFreeConsole::InitializeHooksMultiFreeConsoleLIKWH`ICI[H=eHtYHUSICA>LmHQAIC3HJt H4SHD$(LQHINdH\CHD$HHd$PHHL$HH=CHD$8Hd$@HT$8HL$HS3;+M}HL$`^HL$`9YHHL$`HtH+HDED$9Ytj|hHHt!HL$`H+HtHHL$P HL$`9Yt+|)HhBHtH+D$`HDED$Y;RE33H d8HL$PHD$P9Xgf8+]H>:H$H$HD$pH\$xH$H$H$H$H$H$DHL$PgH$H$H$HD$ L$LD$pH$H$HL$pHD$p9XuHBHL$p.E33H zu(HyHD$ AMHֹD`EMeH %`HI0FLHu(H?AHD$ MHֹEHH SuHAIH$HCH$H$H$论HT$pH$蜺H$H uu$HHD$ AMHֹH$D$H$ͷH$迷H$豷HL$p覷H$蘷3DBhH$@ADŽ$@h3H$H$H$HL$PH$HL$HH$@HL$@H\$8H\$0\$(\$ E3E3H3цuNHHD$ AMHֹHL$`HL$PܶH$~3TH$ɆH$H$utH$Ht H$HtH2HD$ AMHֹFHL$`;HL$P0H$҈3$tC= E$H$~H$pHL$`յHL$PʵH$lD$D$D;u$D;uu$̋HİA_A^A]A\_^[%windir%\sysnative\fondue.exe /enable-feature:Netfx3 /caller-Name:AppCompat%windir%\system32\fondue.exe /enable-feature:Netfx3 /caller-Name:AppCompattermprocesshonorquietonerrorterminateprocess /hide-uxPATHCould not get path!Could not allocate memory!Could not set path!CreateProcess failed!GetExitCodeProcess failedH鸅HJPHJ`HHJp۲H̲HH鴲H騲HT$UHPH:tHSKHD$(L@H=HTKHD$ AL\H@H}HHP]ÐH8HAH \u*AQH+LtAIHq@HD$ |H8Ð1[INSTALLCOMPONENT SetFODEnvironment] Cannot set the FOD environment variableNS_InstallComponent::SetFODEnvironmentH\$WH0=K6HtZH3ALH?AHD$ |8 6tHAL?H*<HD$(@Ha9HXHHӋ؅tHH\$@H0_ÐNS_InstallFonts::APIHook_AddFontResourceALI[IkIsWH0=_5IHtYHD@LH>AIC1{75tH"@L>H<;HD$(RHs8HXxHLŋHӋ؅t@0uHHl$HHt$PH\$@H0_ÐNS_InstallFonts::APIHook_AddFontResourceExALI[IkIsWH0=^4IHtYHD?LH=AIC1z64tH"?L=H<:HD$(RHs7HH LŋHӋ؅t@0uHmHl$HHt$PH\$@H0_ÐNS_InstallFonts::APIHook_AddFontResourceExWH\$WH0=Z3HtZHC>LH<AHD$ /y53tH >L<H:9HD$(PHq6HXHH HӋ؅tHyH\$@H0_ÐNS_InstallFonts::APIHook_AddFontResourceWH0H@(H3H$ I!HT$PH A2I|ueLL$PLwH$,yxC3HL$ DB0Hd$HLHT$ H$LD$ 0D$4|H$ H3螠H0[ÐElevation:Administrator!new:%sZOO8_U%.P$D)|E3HtAAWAÐLI[IkIsI{ AVH@3HIHL55ILAHEH:ICL$(H5KICvuEHu#L5.WH04Ht7$HH.HuЉ3H4du93u3HTUH %HXHHH X HHH HHH8H HX(HH@H HP0HHhH HXHHHpH XPHH tHXXHP`HXxHHHHHHtH4LDH-9A\$(HD$ uH2H\$PHl$XHt$`H|$hH@A^ÐNS_InstallFonts::InitializeHooksMultiAddFontResourceAAddFontResourceWAddFontResourceExAAddFontResourceExWHXH~$H3H$@HD$0LA33D$(HD$ yt HL$0*H$@H3:HXÐH\$Ht$H|$ AVH0HeH %`HI0DBuLHtHI^IAFAFE3MHd$HLL$HSxWH|$HHHXH{Hd$ E3M3HH|$HHHZH{HӅy:HA HALH7HD$ esIHXHu{IH\$@Ht$PH|$XH0A^Ð~p9~}9xInstallFonts, Font failed to installNS_InstallFonts::InstallFontWInstallFonts, failed to cocreate font managerH yHtHIux KH [ÐH\$Ht$WH 3HMt\HH+u H|H+BHt&HTH+u HPH+BHt I8@IHHXHyHWH\$0Ht$8H _ÐFT5HdEwFH LYueH %`3HI0rH [ÐH\$Hl$VWAVH@=$+EHHtZH6LH4AHD$ pZ-*tH5L4H0HD$(LK:HtHϾ@fpHHHHxEHHӋ*3HD$0L ^.DBH .HD$ tH|$0HHH\xLD$xH`.HӅH|$xHHX(H.xE3HHӅxyHL$0EtkHL$xLu9HoHL$0HcHwHL$xEHӅy+HLkHT3AHD$ oH|$xHHXHwHH|$0HHXHwwHH\$`Hl$hH@A^_^ÐNS_MakeShortcutRunAs::COMHook_IPersistFile_SaveFailed to save shortcut with RunAs marking.LI[IkIsWH0=(HHtYH3LHP2AICn*{(tHt3L2H.HD$(L6HvH˿@mHHt'HGvHHHˋtHH\$@Hl$HHt$PH0_ÐNS_MakeShortcutRunAs::COMHook_IShellLinkA_SetArgumentsLI[IkIsWH0='HHtYHv2LH01AICcm)Z'tHT2L0Hn-HD$(LHvH˿@lHHt'H'uHHHˋtHH\$@Hl$HHt$PH0_ÐNS_MakeShortcutRunAs::COMHook_IShellLinkA_SetDescriptionCOMHook_IShellLinkA_SetDescriptionLI[IkIsI{ AVH0=C&ALHtYH1LH/AIC lt(&tH0L/H,HD$(,L4HnH˿@kHHt*HsDIHHˋ^ tH.H\$@Hl$HHt$PH|$XH0A^ÐNS_MakeShortcutRunAs::COMHook_IShellLinkA_SetIconLocationLI[IkIsWH0=%HHtYH/LH.AICjL'$tH/L}.H*HD$(L3HvH˿@XjHHt'HrHHHˋ9 tH H\$@Hl$HHt$PH0_ÐNS_MakeShortcutRunAs::COMHook_IShellLinkA_SetPathLI[IkIsWH0=#HHtYH.LH-AICi,&#tH.L]-H)HD$(LHvH˿@8iHHt'HqHHHˋ tHH\$@Hl$HHt$PH0_ÐNS_MakeShortcutRunAs::COMHook_IShellLinkA_SetWorkingDirectoryCOMHook_IShellLinkA_SetWorkingDirectoryLI[IkIsWH0="HHtYH-LH@,ARICsh$f"tHd-L ,H~(HD$(L1HvH˿@gHHt'H7pHHHˋU tHH\$@Hl$HHt$PH0_ÐNS_MakeShortcutRunAs::COMHook_IShellLinkW_SetArgumentsLI[IkIsWH0=!HHtYHf,LH +AlICSg#E!tHD,L*H^'HD$(tLHvH˿@fHHt'HoHHHˋ5 tHq H\$@Hl$HHt$PH0_ÐNS_MakeShortcutRunAs::COMHook_IShellLinkW_SetDescriptionCOMHook_IShellLinkW_SetDescriptionLI[IkIsI{ AVH0=. ALHtYH+LH)AICed"tH*L)H&HD$(L.HnH˿@peHHt*HmDIHHˋtH H\$@Hl$HHt$PH|$XH0A^ÐNS_MakeShortcutRunAs::COMHook_IShellLinkW_SetIconLocationLI[IkIsWH0=HHtYH)LH(A7ICdDŽ$HL$8謊HL$XQ1H$$uHteH %`L3HI0V3HH$HĀA^_^ÐNot enough memory.|HJH/HJXӨHJ8HT$UH0HH8HD$ AmLHAITH7H0]ÐCString exception in ConstructMultiStringLI[IkIsI{ AWH@3HIHL=0IL9AHEHICL$(H)KIC,Tu%HL= 3訃HHt~du9uqsu`H`LHjHD$(HNAHD$ SHH Ho3Bu6HtHLFHA\$(HD$ ESH H\$PHl$XHt$`H|$hH@A_ÐNS_MarkRegistryValue::InitializeHooksMultiH8unta ^=TtU3tL L[HDcH (L1H:HL$ A|RH8ÐNS_MarkRegistryValue::NotifyFnHHHAWHpH@HXHpHx 3ۋ$HHL$@pHD$@9XuHL$@H v Ht He eH %`DBHI0)SHt HHXXHH. HuHL$@臆H6H$(L$(HT$@H$趧H$(DHHD$`H\$hAL$HT$`H$蛨HTH$H$H$H$H$H$HD$0H\$8HD$PH\$XHD$pH\$xHoH$82L$8HT$`H$H$8yH$脧L$HT$0H$ѧL$H$H$謧yL$HT$PH$芧WL$H$H$e2HD$0xfH$mHL$p貄HL$P规HL$0蜄H$HL$`胄H$%HL$@jfHHL$0kHL$0t;HDŽ$AH$`KHH$肄H$`RHPHDŽ$AH$PHL$0HH$.H$P踃H Ht$PHxu D$HHXuDŽ$HH5H$HNulf>0tfH$HL$p&HL$PHL$0H$HL$`H$虡HL$@ނDŽ$$H$H$9H$SHL$p蘂HL$P荂HL$0肂H$BH$HL$pWHL$PLHL$0AH$HL$`(H$ʠHL$@ H$謠HL$pHL$PHL$0ہH$]HL$`H$dHL$@詁H$FHL$p苁HL$P老HL$0uH$HL$`\H$HL$@CBH9X AO$HL$`!H$ßHL$@$uH HtL$pI[Is I{(IA_ÐHKLM\HKCU\REG_SZREG_MULTI_SZREG_DWORDHJ@[H(LHHJ`7HHJ0HJPHJpH8H霞H`HPHT$UH0HH8HD$ ALNHO JHH0]ÐCString exception in ParseCommandLineNS_MarkRegistryValue::ParseCommandLineHHXHhHp WH HcH@Bw}3;Y~kL@VPH xXeH %`LD$@VHI0QKHHt5HcOHLHIjeH %`LHI03KH/_9_@Ƌ3H\$0Hl$8Ht$HH _ÐH\$Ht$WH0H39Z HcH HH PuH;Z |HLHAHD$ HCHcHHHyH0|3DtHT3H 3E3AwKN|3HtGHT3H 3Hd$@HD$@AE3HD$ vKuHT3HL$@rKHL$@KHPHzH\$HHt$PH0_ÐReverting all the registry changes...NS_MarkRegistryValue::WriteRegEntriesLI[ UVWAVAWHPIc3ICA![ICLyIICHH ICI![E3E3D$(!\$ 3A[lJt0HOIHH\$8HD$0HAH$3$H!\$(H!\$ LwE3E3IGD Jt/I肈IHwH\$8HD$0HA(GHu Hw@<(uHw0FE&(u HO0H$HHtz$DO(IH$E3\$(Ht$ ItLI؇IH͇H\$8HD$0HALHl$(HD$ $FH$HtH(uHteH %`L3HI0^GH$HPA_A^_^]RegCreateKeyEx failed with error code %d, key=%s, value=%sNS_MarkRegistryValue::WriteRegEntryRegQueryValueExW failed with error code %d, key=%s, value=%sRegSetValueExW failed with error code %d, key=%s, value=%sHĉHVWAVHH@HXHc3߉$H 0EȅtHHL5%A\#H6 HL$HHXHL$8֗LD$HHT$8HL$X赚HL$8FyHL$H;yHHD$(H|$0L5u=LD$XHT$(HL$X蓛t%HHIHL$(:D߅É$HL$(xHL$X}3$$uHHXHKӅtH$HĀA^_^Ð(8Ph @(Hh @ Hp Hp HJHvHJ8vHJX_HJ(vHT$UH HHH ]ÐLI[IkIsI{ AWH@3HIHL= ILAAHEHICL$(HKICAuGHu%L=pH2Ht$H]qHHuΉ3Hdu9uueH H@kHXHH X HX(HHHtHLhHAA\$(HD$ O@HH\$PHl$XHt$`H|$hH@A_ÐOverrideShellAppCompatFlagsNS_OverrideShellAppCompatFlags::InitializeHooksMultiSHLWAPI.DLL!H@HD$ H\$PH!t,t#HHL$(HL$(,HL$(dtHHHmGHHH\$PH@_H̐HJ(/tH\$WH H!tAtH,HHHGHHH\$0H _H̐H@HD$ H\$PHt$XHH t,t#HHL$(HL$(+HL$(lsHHHuFHHHH\$PHt$XH@_H̐HJ(/sH\$Ht$WH HH t9tH+HHHEHHHH\$0Ht$8H _H̐H\$WH HHHXHHEHӋ؃t3Ht #=tH׋(!t H\$0H _ÐH\$Hl$Ht$WH H=HIHHELƋHӋ؅t3Ht !=btH t6 Hl$8Ht$@H\$0H _ÐH\$Hl$Ht$WH HHIHH}DLƋHӋ؅t3H5t O!=tH!t6 Hl$8Ht$@H\$0H _ÐH\$WH HHHXxHCHӋ؃t3Ht #=8tH׋| t H\$0H _ÐH@HD$ H\$PHt$XHHht,t#HHL$(袎HL$(G(HL$(pH=H8H%CHHHH\$PHt$XH@_H̐HJ(oHWH@H@HXHhHpAHHt,t#HHL$(HL$('HL$(voHHHBDHHHH\$PHl$XHt$`H@_H̐HJ(/oH\$Hl$Ht$WH AHHt1tH 'H HHADHHHH\$0Hl$8Ht$@H _H̐HAVHPH@HXHhHpHx IILHt, t#HHL$8ČHL$8i&HL$8>nH_HXHGALLIHHH\$`Hl$hHt$pH|$xHPA^H̐HJ8mHHXHhHpHx AVH0IILHt tH%HHH@LLIHHH\$@Hl$HHt$PH|$XH0A^H̐H\$Ht$WH HH&ti tHA%HBHhH*@HHHH\$0Ht$8H _H̐HAVHPH@HXHhHpHx IILHt, t#HHL$8HL$8$HL$8~lHHH?LLIHHH\$`Hl$hHt$pH|$xHPA^H̐HJ8/lHHXHhHpHx AVH0IILHt) tH$HH(H>LLIHHH\$@Hl$HHt$PH|$XH0A^H̐UVWATAUAVAWY_H+H'H3H$pL$L$HID3HL$r3AMfD$p~HPHXH;>$ $D$P$Ll$H|$@D$8$D$0$MωD$(LAHLd$ Ӌ؅LL$`HT$pH tHL$`tq thHL$`"HHXH=$ MωD$P$Ll$H|$@D$8$D$0$LƉD$(AHLd$ Ӌ؋H$pH3]HĈA_A^A]A\_^][ÐH\$Hl$Ht$WAVAWH`=aIIDL K::3DBH9HHt{H$HH$HHH HH<H$H$HL$PHD$HH$HD$@H$HD$8$D$0H|$(HT kH3HH<H$HD$PH$HD$HH$HD$@H$HD$8$D$0H$HD$(H$LLAIHD$ L\$`I[ Ik(Is0IA_A^_ÐH\$Hl$Ht$WATAUAVAWH`$MMLH 8HEHH-;$$L$H$D$PH$MMHD$H$IՈD$@D$8l$0HLt$(H|$ DgH\LƋI|HODHHH:$L$H$D$PH$HD$H$MψD$@$|$8D$0MIHLt$(Hl$ E3DL9e 7Gv GۃIL9eK8 s{@u#C8KD9%/tB׃tt"t u.LCPLCh LC^LCDDKHH8H HXHH@H X HHhH NHX(HHpH HP0HH HXHHH XPHH jHXXHH HP`HH fHXxHH H(H @HH0H HHXH 6HH`H HH HHH HHHHLHHL H8@HHLPHhpHxLHHLHHLHHLH(0H8L@HX`HhLpHHLHHHHH HH ?H HHH HH -HH H H HHH HPH HxH HH QHH SHH mHH HHH ZHH HHHLH HH -HHHLH HH HH H(H L0H8H HH@HHPHXL`H HhH HpHxHLH pHH HHHL H QH(H sH0H8@HHHPH BHXH H`HhpHxHH HH uHHHLH HH HHHHtH=L>HA9\$(HD$ HH\$PHl$XHt$`H@_ÐNS_PlaceholderFiles::InitializeHooksMultiNTDLL.DLLNtCreateFilekernelbase.DLLntdll.dllNtQueryDirectoryFilekernel32.dllkernelbase.dllMoveFileTransactedAMoveFileTransactedWEncryptFileAEncryptFileWReplaceFileAReplaceFileWNtCreateThreadExQueueUserWorkItemNTDLL.dllTpAllocWorkTpReleaseWorkTrySubmitThreadpoolCallbackH\$WH H93HtHHHXH&HH\$0H _ÐH\$WHHH3H$pHHL$03A@lf 3:#ub S/#LD$0SE3Hω\$(H\$ *#Ht"D$0t|$TuH" ,3"H$pH3EH$HĀ_ÐH\$WHHH3H$HHL$03APe 3f"ub S["LD$0SE3Hω\$(H\$ F"Ht"D$0t|$TuH&" X3"H$H3EH$HĐ_ÐH@HD$ HL$(oHT$(HL$(PH@[HJ(PH\$Hl$Ht$ WH@HzH3H$0HAIHT$ E3AH3S!=sHtHHHH3HHH\$@Ht$HH0_H̐NS_RedirectDefaultAudioToCommunications::COMHook_IDirectSound8_InitializeCOMHook_IDirectSound8_InitializeH\$Ht$WH0='HHtZHLHAHD$ @tHȾLHHD$(gLHzHQHHtFH H+ u HKH+ Ht*HH+÷u HCH+HtHhHHZHHHH\$@Ht$HH0_H̐NS_RedirectDefaultAudioToCommunications::COMHook_IDirectSoundCapture_InitializeCOMHook_IDirectSoundCapture_InitializeUVWATAUAVAWHH-H3HD$x=H$L$L$L$HD$PMIHHtZHLeHAHD$ qtHLHHD$()fLjH;HLHHHt5HH+uHOI+Ht!HH+u HGH+HtD$hHt5HH+uHCI+Ht!HH+u HCH+HtHD$X:HD$PLD$XHD$@$Ll$8D$0HT$hMHLd$(L|$ HL$xH3HĈA_A^A]A\_^][ÐNS_RedirectDefaultAudioToCommunications::COMHook_IDirectSoundFullDuplex_InitializeCOMHook_IDirectSoundFullDuplex_InitializeH\$Ht$WH0=9HHtZHLHArHD$ PtHغLHHD$(dLHzHaHHtFH H+ ϳu HKH+ ʳHt*HH+óu HCH+HtHxHHjHHHH\$@Ht$HH0_H̐NS_RedirectDefaultAudioToCommunications::COMHook_IDirectSound_InitializeCOMHook_IDirectSound_InitializeLI[IkIsWAVAWH@3HIHL=AIDsLHEHSAIC؉L$(H6AIC9uEHu#L=#HHt7$H|$HͫHuЉ3Hdu9ݰuѰH HHXHHH HHHH HP0HH8HH HH@H HP`HHhH }HHHpH HHH HHH H HH LHPHH 3HH X HH HX(H(H THXHH0H XPHXH aHXXH`H wHXxHHHHHHHH8@HHHhpHxH Hu LH=DHD$ H ȧH1LHDHD$ uH H5LHMHt$ CH dLHMHt$ jH 9HDMLHHD$ 7HtHWLH A&AΉ\$(HD$ HH\$`Hl$hHt$pH@A_A^_Ð!͉%FGbDEST?9O5r!͉%It$ 0YyGAj#wzLB.lPYm'I! `~ ŕ4H fNS_RedirectDefaultAudioToCommunications::InitializeHooksMultiWINMM.DLLwaveOutOpenwaveInOpenDSOUND.DLLDirectSoundCreateDirectSoundCreate8DirectSoundCaptureCreateDirectSoundCaptureCreate8DirectSoundFullDuplexCreateGetDeviceIDDSOUND.DLLH H%H#H\$WH 3H9y ~HcH @HHIH #;{ |Lc MteH %`3HI0H#ceH %`HI0L3HH\$0H _ÐH HUeH %`HI0L3HH [ÐH\$Ht$WH =tHHXH ׋HH\$0Ht$8H _H̐H\$Ht$H|$AVH HHMHXHHHMHHӋ؅uIYHt$8H|$@H\$0H A^ÐH\$Hl$Ht$WAVAWHPH)LIHAHH5H$L$HD$@H$L|$8HD$0$LωD$($DHIΉD$ Ӌ؅uIL\$PI[ Ik(Is0IA_A^_ÐH\$Hl$Ht$WAVAWHPHiLIHAHHuH$L$HD$@H$L|$8HD$0$LωD$($DHIΉD$ Ӌ؅uIL\$PI[ Ik(Is0IA_A^_ÐH\$Ht$H|$AVH HHMHXxHHMHHӋ؅uIiHt$8H|$@H\$0H A^ÐHAVH@H@HXHpHx HL3H9=tVHHXHH;s0IHL$(HT$(H LHL$(HHH\$PHt$XH|$hH@A^ÐHJ`HJ(HT$UH HHH ]ÐLMCISIKSVWATAUAVAWHICIL3|$0$I{I{I{HICI{IK0 HHL$X!HD$@HD$ DE3IIIH|$@uxHVHtoHL$hbHZHL$h#LD$hIIou4D$0HD$@HD$ DE3IIoHL$@HEHL$@HL$hmHD$8HD$ DE3Ll$XII4H|$8HVHHL$hHGHL$hM"LD$hIIu7DŽ$HD$8HD$ DE3IIHL$8HEHL$8HL$hH9|$8t/HD$HHD$ DE3HHttH|$H H9|$@uH,;X }qHcHHLfA8\u"HL$@HtOILHH;7HHfA9<@uH v#HL$HHtHD$8HtILH냋H ;q }YHcH@HHL`Mt>H\IHD$8HD$ LL$@H$L@H$HAH ;3IL$Ll$XHL$HHtHD$8Ht HHL$@Ht9$t II9|$0t IIHL$XHĀA_A^A]A\_^[ÐSoftware\ClassesAppData\Local\Microsoft\Windows\UsrClass.datNTUSER.DAT_ClassesHJX3HJh'HJhHT$UH0HHwH0]ÐHHXLH HPUVWHhH3IHEHUHUHAE3HD$ ؅uHHHHMo3HT$@HEE3HD$8HT$0D$(T$ E3HӋ؅$H!t$XH!t$PHM!u!u!u!u'!uHEHD$HHE'E3HD$@HEE3HD$8H!t$0HEHD$(HE3HD$ ؅E;}';M<} E;s ~;GʺDeH %`HI0HHt3ɋHЉMHU79MEeLM/EHELHD$8HT$0HMHE}/HD$(Hd$ uP!E+HMHE+HD$(Hd$ E3E3Hu2HELM7DEHMHD$(EH։D$ =tE؋MHU7M;MN39}vgHd$8EHd$0HMHd$(Hd$ LMLƋ׉EsuLMHUHMLs=tE;}r HteH %`L3HI0HMHtHMHtH$Hİ_^]ÐLI[IkIsWATAVH@3HIHL%IDsLNHEH+AgIC؉L$(HAICu'HL%<IH]HtD7du9Buq6/ucH#LHHD$(H!AiAΉHD$ HiHHm3;+HHAH jHH xHXHHH X HHH kHX(HH8H HP0HH@H ]HXHHHhH XPHHpH PHXXHH HP`HH <HXxHH HHHHHHHHHtHL[H<ApAΉ\$(HD$ HH\$`Hl$hHt$pH@A^A\_ÐRedirectHKCUKeysNS_RedirectHKCUKeys::InitializeHooksMultiExitWindowsExHWH`H@HXHpHHHDH5HHt$8Hd$@(E3HL$(غ)HL$(9HuH+D$(H~M~HDCA;|?+DHHT$HHL$('HHL$8HL$HvHL$(~2Ht$8HHHHL$(H{HtHMHH{H\$HHT$8HL$PMH=uWW H tFG G HcHIHH HtH!HHAHaHD$HHHHT$P HL$PH3HL$8HL$(|H\$pHt$xH`_ÐHJ(_HJ8SHJHGHJHKHT$UH HHH ]ÐH\$Ht$WH 3c9ܝH vHtH mHt[H dHtJH [Ht9H RHt >H DHHHHH;A49ڜ-H  eH %`HI0DGtHtH @HXHHeH %`HI0DH8Ht HHXXHeH %`LƋHI0HSHt HHXXHeH %`LƋHI0HHt HHXXHeH %`LƋHI0HݛHt HHXXHH ԛHHtRH9tIH9t@H9t7Ht?HH)ttHVHtHH JHt8H AHt'H 8HtH /Ht DD$43$H WHL$XH!t$`HL$HH!t$PHL$hH!t$pH!t$8!$ȅt6HHD$ ALHeNաHT$XI'MHT$XHL$HHL$HE3HT$H3t7Pt2=t+HHD$ AwLHeWHL$XHH +^HYHVE3HIӋ$ DL$HT$8IuG3ɉL$0$;HcHT$8HHL$HHD$8HHL$hHL$HE3HT$H3%t9Pt4=t-H.HD$ A[LHdj5HL$hHH <]HYHgE3HIӋ$L$0-$HL$8+HL$h HL$HHL$XL$L$Dt$4$u,Au(H\HHѧIIӋ!EtH\HHIӅt3HĀA_A^A]^[Ð[MoveFileA] SHCreateDirectoryExW failed with error.[MoveFileA] Invalid Redirection Option.HJXHJHHJhHT$UH0H8[tHlHD$(LbH^ HlHD$ ALHb|HH0]ÐHD@HPHHSVATAVAWHH@ALL=aXtZHcHD$ A LH(b-X_ZtHbHD$(LaH^ u*HZH8HҥAIII#:DD$83t$0H RHL$`H!t$hHL$PH!t$XHL$pH!t$xH!t$@!$ȅt6HHD$ AaLH;aNHT$`IdHHT$`HL$PQHL$PE3HT$P3Ot7Pt2=t+HHD$ AWL&H`HL$`HH hYHYHE3HIӋD$0DL$HT$@IB3ɉL$4$;HcHT$@HHL$PHD$@HHL$pHL$P E3HT$P3et9Pt4=t-H.HD$ A;L<H_2HL$pHH |XHYHE3HIӋD$0L$40$HL$@\&HL$pMHL$PBHL$`7L$L$Dt$8t$0u4Au0HWH8HD$IIӋ!EtHWHHIӅt3.HĀA_A^A\^[Ð[MoveFileExA] SHCreateDirectoryExW failed with error.[MoveFileExA] Invalid Redirection Option.HJ`3HJP'HJpHT$UH0HlVtHgHD$(L^HY+HgHD$ AhLBH]HtH0]ÐHD@HPHHSVATAVAWHH@ALL=StZHA^HD$ ALHX]-\SUtH^HD$(L*]H3YNu*HUHhHAIIIW6DD$83t$0H NHL$hH!t$pHL$XH!t$`H!t$@!$ȅt6HHD$ AL Hu\NLHT$hIDHT$hHL$XHL$X1E3HT$X3t7Pt2=t+HHD$ ALH[ΗHTHXHHڟE3HT$hIӋD$0DL$HT$@I&?3HL$4$;HcHD$HHL$@HHL$XKHL$XYE3HT$X3t2Pt-=t&H\$ ALH([7HSHXHHE3HT$HHD$@HIӋD$0HL$4@$HL$@!HL$XHL$hL$L$Dt$8t$0u4Au0HHSHhHpD$IIӋ!EtHSH(H@IӅt3HĀA_A^A\^[Ð[MoveFileExW] SHCreateDirectoryExW failed with error.[MoveFileExW] Invalid Redirection Option.HJhHJXHT$UH0HQtH'cHD$(LsYH\UH(cHD$ ALޖHGYHH0]ÐLISIKSVATAVAWHpICLL= OtYHYICALHXN QtHYHD$(LXHTI2DD$43$H IHL$`H!t$hHL$PH!t$XH!t$8!$ȅt6HHD$ AL[HXNHT$`IQ@HT$`HL$P2HL$PE3HT$P30t7Pt2=t+HHD$ ALߔHWuHVPHXHHE3HT$`IӋ$DL$HT$8I:3H}L$0$;HcHD$@HL$8HHL$PHL$PE3HT$P3Ut2Pt-=t&H\$ AL HV:HOHXHHE3HT$@HD$8HIӋ$HL$0=$HL$8KHL$P<HL$`1L$L$Dt$4$u,Au(HNHHIIӋ!EtHNH(HIӅt3-HpA_A^A\^[Ð[MoveFileW] SHCreateDirectoryExW failed with error.[MoveFileW] Invalid Redirection Option.HJ`7HJP+HT$UH0HMtH^HD$(LUHQCH^HD$ AL2HTȐHH0]ÐHLH L@HPHHSVATAVAWHH@IMLL=JtZHZUHD$ AL8HqTFtJLtH7UHD$(LCTHLPg$u2HLHHD$ LMIII_,DD$X3t$0H EHL$`H!t$hHL$HH!t$PHL$pH!t$xH!t$@!t$4ȅt6HHD$ APLAHzSNQHT$`I:HT$`HL$HHL$H6E3HT$H3t7Pt2=t+H'HD$ AFLŐHRӎHL$`9HH KHYHҖE3HIӋD$0DLD$4HT$@I43ɉL$8D$4;HcHT$@HHL$HWHD$@HHL$pDHL$HRE3HT$H3t9Pt4=t-HCHD$ A*LHR2HL$pSHH JHYHE3HIӋD$0L$83D$4HL$@HL$pHL$HHL$`L$L$Dt$Xt$0uGAuCH7JHH_$D$ L$L$IIӋ!EtHIHHIӅt3cHĐA_A^A\^[Ð[MoveFileWithProgressA] SHCreateDirectoryExW failed with error.[MoveFileWithProgressA] Invalid Redirection Option.HJ`SHJHGHJp;HT$UH0HHtHYHD$(L/PHLSHYHD$ AWLʍHP؋HTH0]ÐHLH L@HPHHSVATAVAWHH@IMLL=EtZHjPHD$ AuLHOVEGtHGPHD$(LSOH\Kw$u2HGHH&D$ LMIIIs(DD$X3t$0H @HL$`H!t$hHL$HH!t$PH!t$@!t$4ȅt6HHD$ ALHNNkHT$`I6HT$`HL$H調HL$HPE3HT$H3t7Pt2=t+HHD$ ALHNHFHXHHE3HT$`IӋD$0DLD$4HT$@IH13HL$8D$4;HcHD$pHL$@HHL$HpHL$H~E3HT$H3֍t2Pt-=t&H\$ ALLHMM"7HFHXHH,E3HT$pHD$@HIӋD$0HL$8CD$4HL$@HL$HýHL$`踽L$L$Dt$Xt$0uGAuCHpEHH$D$ L$L$IIӋ!EtH-EH(HUIӅt3HĀA_A^A\^[Ð[MoveFileWithProgressW] SHCreateDirectoryExW failed with error.[MoveFileWithProgressW] Invalid Redirection Option.HJ`铼HJH釼HT$UH0HCtH/UHD$(L{KHdGH0UHD$ ALNHOK$HgH0]ÐT$HL$SVATAUAVAWHxHD$@DH=AtZHKHD$ AU LHHJ@CtHKHD$(LJHFH #DD$03ۉ$H ;HL$XH!\$`HL$HH!\$PH!\$8!$ȅ!t2t}HHD$ A LH.JKHT$XHW1HL$XQLH BHHAIӋ؉$DL$HT$8H ,D$tbE3E;}ZIcHD$8HHL$HoHL$HH$H >BHHfAH$Ӌ؉$AAHL$8"HL$HHL$XD$H$Dt$0$u.Au-HAHHAHӋ؅t3'HxA_A^A]A\^[Ð[SetFileAttributesA] Invalid Redirection Option.HJX[HJHOHT$UH0H@tHQHD$(LCHH,DgHQHD$ A L~HHHH0]ÐT$HL$SWATAUAVAWHhHD$@L==tZHHHD$ A L9HGw=?tHhHHD$(LtGH}CI DD$03ۉ$H y8HL$HH!\$PH!\$8!$tvt2tnHXHD$ A LHFKւHT$HI4/H?HHHŊHL$HӋ؉${EL$HT$8I*D$tIE3E;}:IcHC?HHHk$HD$8H Ӌ؉$A$AHL$8 HL$H L$D|$0$$u-Au,H>HHHIӋ؅t3-HhA_A^A]A\_[Ð[SetFileAttributesW] Invalid Redirection Option.HJHcHT$UH0H=tH OHD$(LWEH@A{H OHD$ A L„H+EHH0]ÐHD@HPHHSVWATAWHH@LL38:tWHEHD$ At L҄HDK:<tHtEHD$(LDH@Ld$8H\$HID$@@|$0Mu8IHY@H>HT$HIӅxHL$HD$@HD$HHD$8LIHIHHD$x3Hu.HHD$ A LHCKnH4HD$hHT$pHD$XHT$`HT$P$΅t8HHD$ A LH]C2HT$hHL$8+HT$hHL$XoHL$XE3HT$X3mt7Pt2=t+HHD$ A LHB~HɆD$HT$hIӋD$0DL$HT$PHL$8&3ɉL$8$;HcH$HL$PHHL$X7HL$XEE3HT$X3t9Pt4=t-HFHD$ A L4H B}-HD$H$HD$PHIӋD$0L$8@$HL$PHL$X芲HL$hL$L$t$@|$0H\$x@u#uHfD$IIӋHL$HiHĐA_A\_^[Ð[IPersistFile, Save] Can't find the Function Pointer to the Original Com API[IPersistFile, Save] SHCreateDirectoryExW failed with error.[IPersistFile, Save] Invalid Redirection Option.HJhCHJX7HT$UH0H8tHIHD$(L'@H<KHIHD$ A L"H?{HLH0]ÐLWH`ICI[IsIH3ۉ\$xHu*HICAXLzH?Ok{PHHL$HHHL$8LHT$8HL$H؉D$xHL$8+HL$H \$xL\$`I[Is I_Ð[CheckAndGetRedirectionPath] Command Line passed is NULLHJH黯HJ8鯯HT$UH0H7tHWHHD$(L>H:HXHHD$ AgLyHw>LzH'H0]ÐHVWAVHHD$HHX H)H3H$IH3ۉ\$0LHHL$P7HT$PHL$8#HH>HL$8tuHIHL$8_H$HD$ E3E3AQ3~x0H$H蔬HtHL$8eHL$P H$HD$ E3E3EqA3}xXH$HD$ E3E3AV3}x5HHL L$H$H!ADމ\$0HL$8̭HL$Pq\$0H$H3hH$HA^_^Ðexplorer.exeexplorerHJPHJ8;HT$UH0H4tHEHD$(L/<H8SHEHD$ AIL2wH<wHH0]ÐLWHICI[IsHV'H3H$3ۉ\$@\$p3DC4IK6HL$XH$$H,HD$HH\$P3HL$Hu:H-HD$ A L{HD;KwHL$HD$p8HD$HHD$xH$D$tHL$p}HHD$XHuHL$HHD$`HD$0HD$( H$HD$ AE3H׹}u HL$Hu)$ȃFމ\$@HL$HU \$@H|$XHt Hj}H$H3L$I[IsI_Ð[CheckManifestRunLevel] Can not get the Module File NameHJH˪HT$UH@H$2tHsCHD$(L9H5HtCHD$ A, LyH9huHH@]ÐH\$WH HHH<L AILcH+HHcI IduËH\$0H _ÐH\$Ht$WH H9HtJ3Hc~)HLMteH %`3HI0*vHH;|eH %`L3HI0 vH\$0Ht$8H _ÐVWATAUAVAWHHDŽ$H$H3H$ML$MHL$L$H$pH$3H$D\$`\$d$DŽ$DH$$Hu.HMHD$ A=LsH7KsHHL$x9H(HD$hH\$pHD$x9XuGH&HD$ AHLTsH7bsHL$hWHL$xLpHL$xHL$xt A$tHL$hHL$x,HL$x輶HL$x覵L sLp1H2HL$xHyDHL$x艰H$HD$ AE3HHwutGHHD$ AdLRrH6`rHL$hUHL$xJnH\$XH\$PH\$HH\$@H\$8H\$0HD$`HD$(H\$ E3E33H$ttGHHD$ AuLqH5qHL$hǦHL$x輦D$`D$`E3APtHH$HuHL$h肦HL$xwD$`D$dH\$8H\$0H\$(H\$ LL$dLAH$,tuAƋD$`D$dH tHc$$LIeH %`HI0erIEHuGHHD$ ALpH4pHL$h讥HL$x裥DD$`D$dL5H\$8H\$0H\$(H\$ LL$dLAH$LsAŋD$`D$dH%tL&H$Py)Lt$ ALoH'4onLǺH$Yy$Lt$ ALoH3oDŽ$H$HD$(H$HD$ L$LH$HrtHHD$ AAH$HL$hDHL$h趭HL$hHL$hޱL pL-H/HL$hGIHL$hjHT$xHL$h[HD$hHLcM$9t\$@HL$0HL$0\$@H$`H3詈Hp[.lnk[IsRedirectionRequired] FileName passed in is emptyHJ0铔HT$UH0HtH;-HD$(L#HpH<-HD$ ALZ^H[#0_H)H0]ÐSVWHHH3H!]@!]0!](Hu0HALH#HD$ ^THU@%fuHAHU@HE8LM0HD$0HE(E3HD$(H!\$ 30funeztHAueH %`DE0HI0M_eH %`DE(HI0MH_HHHtfHU@HE8LM0HD$0HE(LHD$(3H|$ eu-H!LH!AHD$ ] 9E8DeH %`L3HI0_HteH %`L3HI0^HM@HttdHH_^[]Ð[IsUserSid] Uninitialized wszRegKeyNameNS_RedirectShortCut::IsUserSid[IsUserSid] Unable to convert String Sid[IsUserSid] LookupAccountSidW failed.[IsUserSid] LookupAccountSidW failed to get UserName and DomainName.H HHكx|Gf8\uAfx\u:fx?u3fx\u,H0E3`uHfx :ufx \u3H [ÐabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZH\$WH0=tWHo LHA= HD$ ^[xtHO L`HiHD$(;H >E33aa=uNCtrH@)H >3_uXH~LWHKAS HD$ Z-HL,HAZ HD$ Z3ۋH\$@H0_NS_RedirectShortCut::NotifyFn[REDRIECTSHORTCUT NOTIFY_FUNCTION] Can not set the Manifest environment variable[REDRIECTSHORTCUT NOTIFY_FUNCTION] Not loading the RedirectShortCut shim as this is a manifest installLAVHPICI[IsI{ AIL3ۉ\$`Hu*H`YICAZLYH`K7Y8HHL$8蘬DLIHL$8؉D$`HL$8\$`H\$hHt$pH|$xHPA^ÐHJ8ۍHT$UH0H4tH&HD$(LHH&HD$ AiLXHxXHoH0]ÐHVWAVHHD$HHX HH3H$pMHH3ۉ\$0Hu.H$XHD$ ALRXH#OWuH> HD$8H\$@AumHD$`HD$ E3E333T\yH#ceH %`HI0L3>H%$H\$0Ht$8H _ÐLI[IkIsI{ AWH@3HIHL=IL!A0HEH8ICL$(HKIC<uGHu%L=+lH"Ht$HlHHuΉ3Hdu9uuhH fHXX HH 5HX(HHH HHHtH,LEHfA2\$(HD$ ;HmH\$PHl$XHt$`H|$hH@A_ÐNS_SetProtocolHandler::InitializeHooksMultiHHHWHH@HpH53$eH %`WDGHI0<Ht H!8!x!x !xHH3HSH$jHHL$x\L$HT$xH$5HL$xoH$oHHD$ Hd$(L$HT$ H$yeH %`DB(HI0;HHt1HHHgHHGHgHHG Hg(3HtHqHD$@Hd$HHD$0Hd$8HTH$gL$HT$ HL$PCH$nLD$PHHL$PGHWLD$PHL$P,tlHW LD$PHL$PtUH5~u#V HtF F HcHHLH<HL$@NwH$HD$ HT$PHL$@y&HL$XkHL$hkHL$@kmHL$Pm8LHHL$@vH$HD$ HT$PHL$@y&HL$X_kHL$hTkHL$@IkHL$P8LHHL$@vH$HD$ HT$PHL$@4y&HL$XjHL$hjHL$@jHL$P7LHHL$@vH$HD$ HT$PHL$@~y&HL$XjHL$hjHL$@j>HL$P>7LHHL$@uH$HD$ HT$PHL$@j~y&HL$X0jHL$h%jHL$@jHL$P6H|$0Ht$(HHD$ ALH_4LHHL$@ uMHT$@HL$h貀LHHL$@tMHT$@HL$X茀HD$XHD$ LL$hLHI\$xHL$XXiHL$hMiHL$@Bi\$xL$I[ Is(IA_A^_\Registry\Machine\SOFTWARE\Clients\%s\%s\Protocols\%s\DefaultIcon\Registry\Machine\SOFTWARE\Clients\%s\%s\Protocols\%s\shell\open\command\Registry\Machine\SOFTWARE\Classes\%s\DefaultIcon\Registry\Machine\SOFTWARE\Classes\%s\Shell\Registry\Machine\SOFTWARE\Classes\%s\Shell\open\Registry\Machine\SOFTWARE\Classes\%s\Shell\open\commandSetting %s as owner of %s protocol NS_SetProtocolHandler::PwnProtocolHJ@eHJheHJXeHd8HT$UH@HHaH@]ÐLSVWAVAWHICH(H3H$MILHH$HICIcHD$0IcLLH4HL$0pHD$HHD$ HT$@HL$03yyHL$0dHL$PdHL$@1LLHHL$0&pHD$HHD$ HT$@HL$0xyHL$0dHL$PdXHL$@S1LLHHL$0oHD$HHD$ HT$@HL$0xyHL$0EdHL$P:dHL$@0LLHHL$0roHD$HHD$ HT$@HL$0%xyHL$0cHL$PcHL$@0LH5HL$0oHD$HHD$ HT$@HL$0wyHL$0cHL$PcMHL$@H0LHNHL$0nHD$HHD$ HT$@HL$0wwyHL$0=cHL$P2cHL$@/LHwHL$0mnHD$HHD$ HT$@HL$0 wyHL$0bHL$PbHL$@/LHHL$0nHD$HHD$ HT$@HL$0vyHL$0bHL$PbHHL$@C/LHHL$0mHD$HHD$ HT$@HL$0rvyHL$08bHL$P-bHL$@.LHHL$0hmE3HT$0HL$PvHD$PLL+B+uHutHHL$PbE3HT$0HL$PxLLHHL$PlHHbuHgHL$PuLvxLlxHH-uHHL$x`HL$xyH-HtwH+D$xH~jDHT$hHL$xKsHHL$x]aHL$h`HSHL$xqcLLHl0HL$0"lL0HT$0HL$xwHL$x`!H(HdtuLHH LLHaHL$0kHHL$PZaL HT$0HL$PHwLLH'HL$0kHHL$P aLHT$0HL$PwLLHHL$0WkLH]HL$PCkMHT$0HL$PvMH/HL$0kHHL$P`L5HT$0HL$PvLHHL$0jH+HL$Pq`E3HT$0HL$PcvHL$PhLHT$0HL$PCvLHHL$0jIHL$P`E3HT$0HL$PvLHRHL$0XjHHL$P_E3HT$0HL$Pu3HD$zf$ fD$xD$zE3LD$x.E3E33ҹ .LH_HL$0i3HL$0kLE3AP-HL$0wHL$0D^HL$P9^H$H3QHĐA_A^_^[Ð\Registry\Machine\SOFTWARE\Clients\%s\%s\Capabilities\Registry\Machine\SOFTWARE\Clients\%s\%s\Capabilities\Startmenu\Registry\Machine\SOFTWARE\Clients\%s\%s\Capabilities\URLAssociations\Registry\Machine\SOFTWARE\Classes\%s.Url.Mailto\Registry\Machine\SOFTWARE\Classes\%s.Url.Mailto\DefaultIcon\Registry\Machine\SOFTWARE\Classes\%s.Url.Mailto\shell\Registry\Machine\SOFTWARE\Classes\%s.Url.Mailto\shell\open\Registry\Machine\SOFTWARE\Classes\%s.Url.Mailto\shell\open\command\Registry\Machine\SOFTWARE\Clients\%sSOFTWARE\Clients\%s\%s\CapabilitiesMicrosoft OutlookMicrosoft Office Outlook\Registry\Machine\SOFTWARE\RegisteredApplicationsEudora\Eudora.exe\EuMAPI32.dllMozilla ThunderbirdApplicationDescription\Registry\Machine\SOFTWARE\Clients\%s\%s\Capabilities\StartMenu%s.Url.MailtoURL ProtocolURL:MailTo ProtocolSOFTWARE\Clients\%sHJPVHJ0VHJxVHJhVHT$UH0HHH0]ÐHHXHhHp WH HcH@Bwz3;Y~hnL@Hˋ螏xSeH %`LD$@HI0"HHt1LcGHHIieH %`LHI03"H/_9_@Ƌ3H\$0Hl$8Ht$HH _ÐHUHhHHEHXHpHxIHHH HMHUHHM7UL3HM3H]]HgHM~VHEHD$ HUHMiHM&"HHMFVHEHD$ HUHM\iHM!HWHMVHEHD$ HUHM$iHM!HHMUHEHD$ HUHMh_HM~!HUHM UHM_HM} 3r LE;gHMHHf9AuHH*HMVLLH#HM_L,$HUHM+kHHMUHHMUE3HUHMjHpHMTHUHMBTHHMbVE3HUHMjHHMTHHMTE3HUHMjHsHMzTHHMjTE3HUHM^jHM&HMFSHMHHHtD>$H?HHuʉ>3Hdu9=u~ zH ~HH{HCH{ HCHH HC8HH{(HC@H HK0HChHH{H{PH{XHK`HCpH{xHHt>HLeHFA3|$(HD$ $HHH\$PHl$XHt$`H|$hH@A_ÐSystemMetricsLieNS_SystemMetricsLie::InitializeHooksMultiGetSystemMetricsSystemParametersInfoASystemParametersInfoWH(H=tkH Hd Vu!}LH HMUu Z)H H2U ?Dʉ /H(ÐWINXPVISTAWIN7LI[IkIsI{ AWH@3HIHL=`IDKLL-HEH:ICL$(H[KIC^ u!Hu~L=3;HHt|du9uou^HDNMLHD$(HHNHD$  HF<H7Hq3Au5HtAPHL@HQAI\$(HD$ ~ HH\$PHl$XHt$`H|$hH@A_ÐNS_TerminateExe::InitializeHooksMultiH8tHLHHD$(HyA)H{LAIHHD$  3t35t)H #:xu 3" ̸H8Ð>[ApiName] Mitigation SuccessNS_TerminateExe::NotifyFn3.H LHMteH %`3HI0j H#H [ÐH\$WH 3HH9tH9YvHH HH;_rH\$0H _Ð7,H 38FtH E7aH ,H~Ht'H9zvH sHH;es HTH 3FH H [5̐H\$WH HH+HHH\$0HHH _ÐH Hb+HH [ÐHLHhICDŽ$3ICMCICD$(D$ E3LHz$$HhÐHT$UHPHHHP]ÐLHhICD$PH$ICH$ICH$ICȋ$D$($D$ LHD$PD$PHhÐHT$UHPHHHP]ÐLHhICD$PH$ICH$ICH$ICȋ$D$($D$ LH$D$PD$PHhÐHT$UHPHHHP]ÐLHhICDŽ$3ICMCICD$(D$ E3LH$$HhÐHT$UHPHHHP]ÐH0HD$ HHD$PHd$XHT$XH LD$XH3HL$X!*\$P\$PH0[ÐHJXHT$UH HHH ]ÐH8HD$ D$PLHpD$PD$PH8ÐHT$UH HHH ]ÐLHXICD$xEK3ICICICICICMDHD$xD$xHXÐHT$UH@HHH@]ÐLHXICD$@H$ICH$ICH$ICMKMDH_D$@D$@HXHT$UH@HHH@]ÐLHXICD$@H$ICH$ICH$ICMKMDHD$@D$@HXHT$UH@HHH@]ÐLHXICD$xEK3ICICICICICMDHD$xD$xHXÐHT$UH@HHH@]ÐHHHD$0D$hLD$ ALH D$hD$hHHÐHT$UH0HHH0]ÐHHHD$8D$0HD$pHD$ LHV D$0D$0HHÐHT$UH0HHH0]ÐHHHD$8D$0HD$pHD$ LHv D$0D$0HHÐHT$UH0HHH0]ÐHHHD$0D$hLD$ ALH D$hD$hHHÐHT$UH0HHH0]ÐLHxICD$`H$ICH$ICH$ICH$ICH$ICH$ICH$ICH$ICMLH_!D$`D$`HxHT$UH`HHH`]ÐLHxICD$`H$ICH$ICH$ICH$ICH$ICH$ICH$ICH$ICMLH"D$`D$`HxHT$UH`HHH`]ÐH\$Ht$WHPIHu AMHHA<9uHtj:teHd$@Hd$`HD$`HD$8Hd$0E3E3D$(d$ ؅uNHL$`DHE33҉|$(Ht$ HT$`O#|$(LL$ E3A3WHt$pH\$hHP_ÐH\$Hl$Ht$ WHPIHu A3MHHfA9,Au4EHtff9*taHl$@HD$`E3HD$8Hl$0E3D$(Hl$`l$ ؅uNHL$`DHE33҉t$(H|$ HT$`G#t$(LL$ E3A3WHl$pHt$xH\$hHP_ÐHHXHpWH0H`IL@HH{H;{riLeH %`HHI0@H;PHBMuLI LI?HuD$XH HL$XD$XDHH{LCH|$ I;sHL+HIHJHCHH|$ H HH HtHHH|$ HH\$@Ht$HHH0_ÐHHXHpWH0H`IL@H4H{H;{riLeH %`HHI0@H;PHBMuLI LI+HuD$XH HL$XD$XCHH{LCH|$ I;sHL+HIHJHCHH|$ H HH HtHHH|$ HH\$@Ht$HHH0_ÐHHXHhHpHx ATAVAWH HAHHxHtLH OH=@HH WLH HHu{H<L==H}H HHqLa I;s:HLp H;ps,LII0ufAfK HHH\$8Hl$@Ht$HH _̐Software\Classes\HHHWH`H@HXIHH`H`HPI0HT$pH#H$HD$@H$HD$8H$HD$0$D$($D$ LL$pLD$PHD3HL$p23HL$P%H\$xH`_HJPHJpHLH HHUVWATAUAVAWHHpHEHXMLE2HH]H]E@H={D85ltGHyLEIDHiEt!MHUHMHU@HMH]H԰HHlHHt$@LmxLl$8HEpHD$0EhD$(E`D$ LMXE3II׋EtFuBIMHKHH]HAHUE|HtE@HHMWHMMH$HpA_A^A]A\_^]ÐHJXHJPHJhcHHHUWATAUAVHH`HEHXHpILHHH=HIӋ=̮0'L-LmL%ILEII}Lm0LHUHM0HeHUHM0HeHHhHHEHD$ DOE3HUHӃu3"uHHHIHMӐ3HMu*LeIAHU0aIHM0|HMrL\$`I[8Is@IA^A]A\_]ÐHJ8HHJ0gHJP{HHHVWAWHPH@HXHhIAH38t|8 utL= LxIHHD$pLD$pHY t#HT$pHHt;8rGI;sHL+HL+H I(H){HKH@rCHCHH;w7HHHeH %`LHI0LI;HtHH{H\$0Hl$8Ht$@H|$HH A^ÐH\$WH LHHMteH %`3HI0WH;H\$0H _ÐH\$UVWATAUAVAWH 3ILLC\Mt'fA9uHHHf9\uuHt f9DuuHHLxH;L;M7I@H;eH %`NE*HI0LHuD$hHHL$hD$h!Hx MtI$K?HH L#H3Ht(Mt \fHH6HHLr#H3fI+IH AI^HI^I~1H\$`MuH A_A^A]A\_^]ÊD$hHHL$pD$p+!̐HHXHp WH0H``3LD$HWHw3ɃЉD$@HHt\HHHsDHx8DL$@HL$HHD$@WLHD$ xH 38 GHHL$HHt"H\$PHt$XH0_H\$Ht$WHPMHLH[;LmHHH `LDHDHYLD$@H\$8HL$0LSHAH|$(HD$ H\$`HHt$hHP_Ð")("%S%s%s%s ShimLib::GetHookAPIsH(tmtbt:t`t\tQt)uaH3E3ɍJhE3cH%H(H3E3ɍJfE3?H%ߒH(ùedE3E33H(ÐH\$Ht$WH0HD$HeH %`DHI06HHt]HoHL$ <LD$HHL$ Hy H33HteH %`L3HI0H&H\$@Ht$PH0_ÐTrustedInstallerH\$WHHH3H$3HL$D3DG4D$@8H$A3H=H$HL$@D$@8HD$`D$DHD$HHHu.HALH[OAHHD$ OHD$xH|$0L YE3H3HD$(HD$ tED$xfTfu2+HXLHA;HD$ Ht HH$H3sH$Hİ_ÐAUTOELEVATECHECK: error getting path or path too long.ShimLib::IsExeAutoElevateEnabledFromSelfAUTOELEVATECHECK: Error opening activation context, presuming unmanifested.autoElevateHhHjH3H$Pd$0Hd$8HL$8tHA tHT$@A3tP=tIHT$8LD$@HL$0et\D$(HLH(A HD$ +HALHHD$ H|$8teH %`LD$83HI0;D$0H$PH3wHhÐFailed to get trusted installer SidShimLib::IsSystemExeFromSelfISSYSTEMCHECK: error getting path or path too long.Failed to determine if EXE is system or non-system: %08lxSVWATAVAWH$@HHH3HHMLE3A0D!HM_HHMHHfD9$AuHtf|E\tLHMHLHMHHEHfD9$XuHMLIuAu3HT$@E3E3ILd$8IHD$@HD$Hu 3HD$@LMLD$XHL$8Dd$(HD$hD$X0Ld$`D$p@Ld$xLeD$ HL$8E3HD$0AQE3HD$ =#ubeH %`DD$0HI0HHt]DL$0HL$8HD$0SLHD$ DxLD$4HT$PH5y  HL$PIAL9d$Ht HL$@ HL$8HtHteH %`L3HI0HH3WHA_A^A\_^[]ÐWinSxS\LD$SH LD$@0'HHtLD$@3HHH [ÐH IMtI LD$@4>y3H [HtHD$@HeH %`LD$@HI0H [H%H̐H HH HtHJHHH [Ð Hu3HH€<u1H(3HtHHf9Qu{H(ÐH\$Ht$WH HHt>t9JLD$0HHtH\$0HHLK9H3H\$8Ht$@H _ÐHHXHhHp WH 3HHt5t0OL@UtHHtLD$0HH4f,{H3H\$8Hl$@Ht$HH _ÐH\$Ht$WH@HHu3Hd$8Hd$0d$(Hd$ LA33BeH %`HI0HcLdHHtDHd$8Hd$0AL33ɉt$(HD$ ueH %`L3HI03HH\$PHt$XH@_ÐH\$Ht$WH0HHu3qd$(Hd$ L3A3E3HcAPHHHt8AL33ɉt$(HD$ queH %`L3HI0m3HH\$@Ht$HH0_ÐH\$Hl$Ht$WATAUAVAWH E3HHfD9)LI3}LCt >%t  fD9+tcfE9.f;uTIA>O$7A4t t fE9,ufE9.t-HfD9+=3H\$PHl$XHt$`H A_A^A]A\_H̐H HH39H|@HHKHHHKHHHHH [ÐH\$Ht$WH HHaHHHHHHc~HH LMHHt$8HH\$0H _ÐH\$WH HH H)HH;t H H  H{HtL3HHcH\$0H _ÐH\$WH HHH HH;tEH9} HH;ux}PLHHH@HHcHHH\$0H _ÐH AHHH [ÐH\$WH HHHLHϋoH\$0HH _ÐHL$SH@HD$8Hكd$0H~HHaD$0IHHD$ DHL‹RHH@[ÐUH HE0t e0HMPMH ]ÐHHHWH@H@HXHhHp HH`H_~HHaD$0HH-HDHl$ LSHHH\$XHl$`Ht$hH@_ÐUH HE0t e0HMPH ]ÐH HHًPLEHH [ÐH\$WH HHHTLHϋH\$0HH _ÐH\$Hl$VWAVH HcL~D$HHHL$HD$H3u!H5}HiHH\$@Hl$PH A^_^ÿ@;|;|;| ;L}H#LH3Htxflp pH I넊D$HHHL$HD$H̐H\$Ht$H|$AVH IcIcHLEuHc|HbH*HG ILHqMHHH\$0Ht$8H|$@H A^ÐHH\$WH LE3HIcHHEQ~fA|H\t fA|H/uAAf;\t f;/AuAfD9 tZtAu fAx:utuu(LτAHtHf;\tf;/tHLHϋH\$0H _ÐH\$Hl$Ht$ WAVAWH0H){HaIcHLHHExLLG3HHHuD$`H HL$`D$`R LHH HD~Ud$(Hd$ DL33~4IIDL33ɉl$(HD$ w 3I%H;tfL3HHH\$PHl$XHt$hH0A_A^_ÐH\$Ht$WH HzHaAHHHEy H؅~HhHLcMH"H\$0Ht$8H _ÐH\$Hl$Ht$WH HIHcxH;x~H3HtH LHMHxH H; Yytf,yH\$0Hl$8Ht$@H _ÐH\$Hl$Ht$ WH IcIHcHxmExh;;rGt.HHLH=HHT$PLHM&H\$0Hl$@Ht$HH _ÊD$8HHL$8D$8 ̊D$8HHL$8D$8 ̐H\$Hl$Ht$WH0HcH3HrMH>8B;1+9B*HcBLH BMI|HXHHcAf,ALD$ L‹RDHNH\$@Hl$HHt$PH0_ÐH\$WH HHH;~4HwH;t#SH/CHHS LcMH\$0H _ÐH\$Ht$H|$AVH HALxE~2~.D;OkI+ލSLcHcHQM~IYH\$0Ht$8H|$@H A^ÐH(Hxtx| H(HH(ÐH@HD$ H\$PHE33H W؅tzHvHT$(Hd$0HL$(DHH$t2;w.PHL$(HT$(HrHXHL$(3HL$(HL$(3H\$PH@_ÐHJ(H HEx#H D;A}IcH AlHtH+HH [ÐHBxHcHJf:\tf:/tHHyÐH\$Hl$Ht$WH HHIcH;Z}$H<HHtHH;Z|HHl$8Ht$@;XMًH\$0H _ÐH HMcHJ @HuH+HH [ÐHHPL@LH H(L@ H(ÐHHXHhHpHx AVH LHIII:H΍PH>LcOIAH=w+IYMHHL3Ʌx HH;wuf _ 3MtfHH\$0Hl$8Ht$@H|$HH A^ ̐H HLH3H [H%̐H\$Ht$WH@HYHHtL3HHgHd$8Hd$0Ld$(Hd$ A33lHcLH3HGHt:Hd$8Hd$0LA33ɉt$(HD$ &HGH\$XHt$`H@_ÊD$PHWHL$PD$P̐H\$Ht$WH HHHp>;P~1X;L\HCLcHV MHHΉX HH\$0Ht$8H _ÐH@HD$ H\$PHE3E33H ؅t}HcrHT$(Hd$0ËHL$(BE3LHYt1;s-HL$( HT$(H0HXHL$(3HL$(p HL$(3H\$PH@_HJ(H(LLyIIH(PIID@D+H( ̐LWH@ICI[IsHHjqIC3I[IKJHHD$(xDHc;v#HL$(#HHD$(xDH<t%;s!HL$(x HT$(H HX 3HL$(W HL$(H\$PHt$XH@_ÐHJ(gH\$Hl$Ht$WH H3HSHxDHHYH΋Ћ;r }rHH\$0Hl$8@Ht$@H _ÐLWH@ICI[IsHHpIC3I[IKHHD$(xDH;v#HL$(HHD$(xDHt%;s!HL$(HT$(HHX 3HL$(HL$((H\$PHt$XH@_ÐHJ( H\$WH 3H 33vt)HˋHYH;s3HH\$0@H _ÐH\$Hl$Ht$WAVAWH LH 3{ IrLcII>HA9w}*IGIHLcM͹HOMHcA+I ?Iy+I ILcMIO?H yH'IqH\$@Hl$HHt$PH A_A^_.\HT$SH0HD$(EHڃd$ HmHHbD$ LA8HH0[ÐUH HE t e HMHMH ]ÐH83MHH;P}DE3IH8ÐH HrH H [H%Ӹ̐H0Hd$ HDHE+HH0[ÐHT$SH0HD$(EEHڃd$ HlHHbD$ LEA6HH0[ÐUH HE t e HMHEH ]ÐH8HE3ۅAHEMDHEHBA;~ED+A;EOÅuE;uHIH8TDIH8ÐH\$H|$UHH3HHHM3HE‰EfEf}4HELEHEHE0E3HD$0Hˉ|$(E0H}H|$ E@H}H}L$I[I{I]ÐLATAVAWHICI[IsI{ILE3fEc3ICD$ZfD$^IKD$h0Ld$pDŽ$@HD$PHD$xL$L$LD$hA|$HL$0UfDd$@3HD$BD$JfD$NHŃHHEHL$@H$HD$(Dd$ E3DHT$@HL$0=#D$eH %`WHI0HHD$`HH$HD$($L$ LDHT$@HL$0!ukC+;v [{ WILDC SHH=t DGfG9$GADIJ{u I t$8H\$`eH %`L3HI0HL$0L$I[ Is(I{0IA_A^A\ÐHT$UH0HE8HH0]ÐHAVHH@HXHpHxIHHJE3fDt$@3HD$BD$JfD$NHHL$@>D$`0Lt$hD$x@HD$@HD$pL$L$LD$`HL$0؅uifDt$P3HD$RD$ZfD$^HHHEHL$PŴHAED$(HL$ ENE3HT$PHL$0XHL$0ôL$I[IsI{ IA^HT$UH0HHH0]ÐH HH HgHH;t! H H HgHcHH [ÐH(HgH;t }H(ÐH\$WH HH3;uHHf9AuHHHcˉXHH\$0fHH _ÐH(L\x IH(ÐHHXLH L@HPUVWATAUAVAWH@LHMIH3LcHyIHcKD$ HAGA+D$$t$,F9G|~&ILcGIMHaHOXIHcCL,CLl$0I;Hcl$ H$Dl$$IHHA3LHt`HAHmI+H+A+HcJxH< H LH$LḬ3IL$fA+DDl$$Ll$0HHf9 CuL$HCHI;Ot$,l$(IqH$H@A_A^A]A\_^]ÐHT$SH@HD$8H3҉T$0HdHHSD$0EDHHDHE;} E+H HH@[ÐUH HE0t e0HMX5H ]ÐHtЀ9tHHuHtH+3ÐH 3Hu3LD$0 L$0HˋH [ÐHL$UVWATAUAVAWH`E3E3E3L!d$PD!$D!$D!$E3IIHHtEwHALHtHΉ$LHtHω$vLH$tH$$OHD$P$$D$HL$@H$HD$8H HT$0Ll$(LL$ EIMAHt AHkHt AH[Ht AHKH$tH$A0H`A_A^A]A\_^]ÐH HHD3ɋfEt6fA\u HuHHHDfEuHtf HH+HPH [ÐH\$WH HcHGH;x}H7H3f xHxH\$0H _ÐLI[UVWH`HD\H3H$P3HHى*HT$@A3ɉl$0fAkf9+HD$4H|$@LL$0HD$ HEE33HtkD$0HH;wYL$4HH;wL;rEM@вHHt4HcD$0LL$0HLHD$4HHD$ =t D$0ȉH3H$PH3rH$H`_^]ÐHHXHhHpHx ATAUAVAWL\$HA1E3A+E~LE3E9Ht A;|-LI"ADcf;uAI̋&3eE;Mt A9+fAMIftuf tf uMt fEpI+AA\fD91f9 tf9 uIfD91E9Mt A91MIAAIAfD9)t"f9uOAu,tA"HAfD9 AuH AAE;MtA9+fE(Mąuft4u f t*f t$tE;MtA9+fAMISE;MA9+fE0ME9Mt A91M2AH\$(Hl$0Ht$8H|$@A_A^A]A\ÐHHHWH0H@HXHpIHHH^HE3LAH^HFLF DHHNHH\$HHt$PH0_ÐHJ@HHJ@HH(HIHt6H(ÐLWH@ICI[H3ۋD$PH^ICI![LD$PHT$(H0tHL$(H\$XH@_ÐHJ(HHXHhHpHx AVH HYIEHHLD;@~3HP3sHQH3y 3H.2IVDH1LDH˅y"HD@D+H ŋQ‰DD+D7H\$0Hl$8Ht$@H|$HH A^ÐHWHPH@HXHhHpIHHHI3Ht+HkHtff9/taHHL$8HHL$( E3HL$(mHT$8H˅x@ LD$(HL$(HL$8H\$`Hl$hHt$pHP_ÐHJ8HJ(LMK WH@ICI[HIC ICAE3HEHp؅uHT$hHHL$hH\$PH@_ÐApplications\wordpad.exe\shell\open\commandHT$UH0HHMhEhE0H\HM0̐̐LMCISIKSVWAVAWH@ICLH3AsICICIsMK E33ID$ȃv~W$WHvL ?$H$HD$(Lt$ L$E33I٧uJ$ȃwT$t JfA94NDH$u,H1!H\$p|$43Hgt 3HH@A_A^_^[ÐHT$UH0HHMx E0HHM0HT$UH0HE4HH0]ÐHUWAVHHpHEHXHpHHM^HBYHE3H]HMLcCIHKH@HHBeH %`LSHI0#HE Ht*D0HxHHD$ L xEƍSHHH~HuE E HHM 9~HcHHVLEHM;|HM*HML\$pI[(Is0IA^_]ÐHJHHJ8HWAVH@HD$0H\$pHl$xHHHH H3HuD$`D$`HHL$`TLc7IHH@HHBeH %`LHI0ʣHD$`Ht,D0HpH:HD$ L EƺHrHHwHuD$`D$hHHL$h9~ HHcHHOHHv;|HH\$pHl$xH@A^_^H%̐HJ`sHHHWH0H@HXHpIHHVHHaHVHAHaVHHNJHH\$HHt$PH0_ÐHJ@+HJ@HH\$Ht$WH HqH:a3HHHt HUeH %`LHI03=9{~HcHHKL;{|HKH\$0Ht$8H _̐H HHH [̐H HHZHH [M̐H0HAH HA/H HA#H H AH HKA.Hu HfAH` HA5HK HA6H6 HAH! HAH HAH HA-H HA!H H&AH HAAH HLAH HOA"Hy HZA Hd HuAHO HA H: A'HH% HAH HAH HAH HA(H HA&H HA+H HAH HAH} HA Hh H)A HS H4AH> H?A%H) HJAH HUA$H H0[ÐCSIDL_APPDATACSIDL_COMMON_ADMINTOOLSCSIDL_COMMON_APPDATACSIDL_COMMON_DESKTOPDIRECTORYCSIDL_COMMON_DOCUMENTSCSIDL_COMMON_FAVORITESCSIDL_COMMON_MUSICCSIDL_COMMON_PICTURESCSIDL_COMMON_PROGRAMSCSIDL_COMMON_STARTMENUCSIDL_COMMON_STARTUPCSIDL_COMMON_TEMPLATESCSIDL_COOKIESCSIDL_DESKTOPDIRECTORYCSIDL_FAVORITESCSIDL_FONTSCSIDL_HISTORYCSIDL_INTERNET_CACHECSIDL_LOCAL_APPDATACSIDL_MYMUSICCSIDL_MYPICTURESCSIDL_NETHOODCSIDL_PERSONALCSIDL_PRINTHOODCSIDL_PROFILECSIDL_PROGRAM_FILESCSIDL_PROGRAM_FILES_COMMONCSIDL_PROGRAMSCSIDL_RECENTCSIDL_SENDTOCSIDL_STARTMENUCSIDL_STARTUPCSIDL_SYSTEMCSIDL_TEMPLATESCSIDL_WINDOWSHtaH\$Ht$WH :Ht;HHHHZHHHٟHHeH %`LHI03 H\$0Ht$8H _ÐHLI[IkVWAVH03HLf9:ISHLHOAIC'HT$XHvHHtFL$X~&HIHYPHHIHHueH %`L3HI0<H\$PHl$`H0A^_^ÐAddCommandLine(%S) ShimLib::CorrectPathChangesBase::AddCommandLineWHWHpH@HXHpIHH LHHL$HHT$HH\t@HD$XHD$0HD$HHD$(HEHD$ AwL[HٕHL$HbL\$pI[IsI_ÐAddEnvironmentValue: (%S) to (%S) ShimLib::EnvironmentValues::AddEnvironmentValueEnvironmentValuesHJHH\$Hl$HT$VWAVH HLHX H&I3HL$H@0H\$Hf9;f;"u@"HHf;t}ftxHf;uH;tfHH+HH@ HL;tCft H ;uI;t.I+IHIHY8HHwLHIeH %`L3HI0eH %`LHI03H\$@Hl$PH A^_^H%y̐H\$ UVWAVAWHPHCH3H$@HHIHX LHқHHHX(HIHHHY(LHHHHMHH HHH$0AHH$0IH=HGLHT$ AI=w"HT$ I6tHT$ LHjeH %`L3HI02eH %`M3HI0HteH %`L3HI0H$@H3=H$HPA_A^_^]ÐLWHPICI[IsAHHHGICIcIKiE3DH3HL$8LD$8Ax~ADL$ HHMHL$8H\$`Ht$hHP_ÐHJ8HT$UH0HHH0]ÐLWH`ICI[IsAHHHFICIcIIKLHHL$(LD$HHT$(H$uQHT$HHL$8[AHL$8LHHL$(RLD$8HT$(HHL$8uSHFHD$8Hd$@HT$8HL$H/LH}HL$(LD$8HT$(H)HL$8~HL$HsHL$(hH\$pHt$xH`_Ð%%%s%%%%%s_NODL%%%%%s_NAME%%HJ(HJHHJ8HJ8HT$UH HHgH ]ÐH\$Ht$WH yHHu`Q "tRG G HcHHtH DHcH H DHcHKHHHVHK3H\$0Ht$8H _ÐHWHHD$`HXH>H3H$HD$pHD$ AE3AQ3g3|$@dHL$HHDHD$PHd$XDLD$pHHL$PH\$PH\$(HHD$ ALLHZHd$0D$(D$ E3E3@HHHD$HHL$P |$@H\$HHt>HMHD$ A_LH$Hh؉D$(HHD$ AhLHWw4t[rOvQt tGAtB9eH%0Pt$)pt${ttovqvh3H$H3H$HĐ_Ð%s\CFP%08x.tmpFile(%S) ShimLib::CanWriteHereCanWriteHeresuccess Error(0x%08x) HJPHT$UH@HH]H@]ÐH HeH %`HI0DBH3HtHHBBBHHHSH [ÐH\$Hl$Ht$WH AHHu3gHQHHY`HHDHHHH\eH %`LHI03HeH %`LHI03HH\$0Hl$8Ht$@H _ÐH\$Hl$Ht$WH 3AHHHtrHHX H<HӃ,Hu 衻HJHWHHt90t3t.DH=HHteH %`L3HI0-HHl$8Ht$@HH\$0H _ÐH\$Ht$H|$AVH LH3HHt[IHX(HvHIHHt#HeH %`LHI03HeH %`L3HI0{H\$0Ht$8HH|$@H A^ÐH\$Hl$Ht$WH HHHHX 3HԑHHOHt H"HH\$0Hl$8HHt$@H _ÐH\$WH HH7HHH\$0H _"̐H@HD$ HHL$(輽HL$(HL$(诹HHL$( H3H@[ÐHJ(HT$UH HHH ]ÐH0HD$ H3Hu"u.|$HH^L f"tHLfu/D$@"Lf tf tHLfuLE>fA>HD$`HD$(HL$ ALI3~ht)sHL$Phtu E=v(fE>f9;t@9|$Ht:HLƄ$HL$PUII+Hl$@fE>H\$PADl$@Eu tfA> t IfA9>uE>H^fA>HHL$hSfE>IH+HAH\$hHtyf9>ttHf9"u7HVMH6au#fB|~"uBL~ft atHHf9LIHUIxLeIH?IxEtfA.MIH$IIL$@HGeH %`L3HI0`eH %`LD$P3HI0`ID$I $HD$0HL$(HHD$ ALH^ID$ HD$(HHD$ ALH^$HL$h蒓H$HĀA_A^A]A\_^]Ð.exe[AppAndCommandLineT::Set] BEFORE App(%S) CL(%S) ShimLib::AppAndCommandLine::GetAppnameAndCommandlineCommon[AppAndCommandLineT::Set] AFTER App(%S) CL(%S) [AppAndCommandLineT::Set] CL without App(%S) HJhwH\$WH HY0HHxuAHxt8HAxt.HH蠒HPH "H蹔HW H腔H yu HWHhHH\$0H _ÐWHWAVAWHpH@HXHpML3ۉX \$ HP HHD$(HtH\$8H\$@\$H\$PHD$X$D$`HL$8AL$H$HL$8DH$H$f9u{|$ EAHL$8菻 Ht$(|$ HcL\$pI[ Is(IA_A^_ÐHJ8HT$UH HHH ]ÐAVAWHH@HEH\$`Ht$pH|$xHLHHEE3L}HHfD99f9)HUHHu~upHHfD98tHHI$t|uu u tA뉊E(E(HhHM(輡̊E(E(HnhHM(襡̊E(E(HWhHM(莡HM輏H\$`Ht$pH|$xH@A_A^]ÐHJ(闏VWHH@HEH\$`HHHHHE3HuHUHHExf8-lpHeH3f9uE0E0HgHM0ѠHUHlƃFtASt7ft-stE0E0H`gHM0藠E3HUHE3AAHUH@x!(tE0E0HfHM03HH@HHf90uE0E8HfHM8HUHHMf;wuAf;lut(E0EHzfHM豟HHM@HM΍@E0E0HDfHM0{H\$`H@_^]Ð)HJ0闍H\$Hl$Ht$ WH HHH趖HH3f>t!H]t*AHHhHH\$8Hl$@Ht$HH _f>"tXHH;f?tf? t HtH+HH|D$0HpeHL$0D$0袞DHH]HVHHf8tnf8"uHHf9"uH H+HH=|D$0HeHL$0D$0DDH蘒HL MXL]H'H菥D$0HdHL$0D$0""HWAVAWHPH@HXHpEL3ۈ\$p{HH$HHHL$8fHL$8菚Eu HL$8tA;~(IV HHL$(,HL$(UHL$(Eu*:HT$(HL$8Squ:\$pHL$(_9ؕxHcHD$(HHHL$8VHL$(+jHL$8 \$pH$eH %`L3HI0cWL\$PI[(Is0IA_A^_ÐHJ8ϊHJ(ÊHT$UH HHH ]ÐH\$Hl$Ht$WH 3HHEu'9Y(v`HW HHUtG;w(r@DO(Et5L_ HML+FA+u HEut A;rHl$8Ht$@H\$0H _ÐHf)wHHr f|t3øÐHf8 u HHÐHVWAVHHD$HHXH>H3H$pHH3Hu HCHu HvHu HtHu>\$8H\$@HL$8zVHT$@HHL$8-V\$0HD$0HD$ A LD$P4VxHT$XH軉d=u]L$0=wL3bZLHt:H\$ DL$0LHUxIVH_IYZ\$0H$pH3{H$HĀA^_^Ð\REGISTRY\MACHINE\Software\Classes\REGISTRY\MACHINE\REGISTRY\USERHT$UH0He0H*H0]ÐH\$VWATAUAWH H H3H$H$H$H$H$0H$H$PL$L$(3H$@DH$DcD$f$3AH$脚H$H$H$H$D$xH$3DC0H$A\$tH$$3DClH$\$pH$ $$`3DC$H$dII_H94uBL$}H$3H tH$XH$HFH$F $F$$F($F,$F0$F4$F8$N<$F@f$ sADŽ$`(H$`HNXETt $d$ $h$H$VuWL$L$H$HNupH$H$uUH$H$u:H$Iu$gVSODED$9\$ptp$uH$ku$H$WH$=TH$H$Vu $E\$pH$HtHuTH$H$@HtD$xmI9t IDTIIOHt 2TI_T-:HB H&D$tD$tcpH$NVu0DŽ$E3E333-TH$HuUHD$xHD$`L|$XH$HD$@H$HD$8H$HD$0Dd$ L$L$H$D$p23D$H$H$H$0H$L$H$PL$(%9$tH$ 1QH$H;Nt-TH$L;tTH$H;$tTH$H;$tSH$H3uH$`H A_A]A\_^UHpHHTHp]ÐH\$T$HL$UVWHHpHe8He e3IHMDB$HE8HeHD$(H 3H!|$ E3E3T؅HM8HU SHM8TWDO@U(RHHuXt3LM(LJ|Su RTHM e3҉EЉEHEDJ DBHD$0d$(Hd$ EH}tS؅u HE He HHyRH} t HM PSH$Hp_^]Ð201ef99a-7fa0-444c-9399-19ba84f12a1ancalrpcH\$UVWATAUAVAWHH@HrH3HEQE3LEEHAADmfEEH HfD9)AE"f9ufD9it fy:uEu fy:ELE3ByHMfEQ؅==HHfD9,OuEȋщM3HPHHuXOAuAF!fD)uJ~LEHMqQ؅u&UAFHALGUJI4$IAHPHMH36rH$H@A_A^A]A\_^]Ð :H\$UVWAVAWHH03HH ]0]8Ht f9LL0OLE3E3LHE0AQIHD$ LE3HE8AQE3IHD$ LU0U8@OHHuXiDM0HE0LǺIHD$ Lt7E0\HQfLGE0DM8HILGHE8HD$ ZLu @OH>HHEOH\$pH0A_A^_^]ÐH\$WH HI0H33!M=tH\$0H _ÐH\$Ht$ T$UWAUAVAWHHpH]ME33AE0E3HW0DAHD$ ZKHUHM0AD݉]8HME3E33҉\$ kK}HMK} u!Et3JHJ HMJHU8HuGHUHM0t$HME3E33D$ JxA݉]8 HuA]8u]A;uHU8Hr]8Et6JL\$pI[@IsHIA_A^A]_]ÐH\$Ht$H|$AVH :HHt D1FLA+;v3 A +ЉHt$8H|$@H\$0H A^ÐH\$Hl$Ht$WHPHH3HD$@333DFMMHHu LHAH*MHHu LuE33HMuhL= uKHT$ HLt,|$$t!|$$tKƃ v\$, 3LHLHLHL$@H3mH\$`Hl$hHt$pHP_ÐAppInfoLHH$3ICH$ICL$hIcH$ICH$ICH$IC$D$@D$8HtMKMCLH "NE3ICULHĈÐHL$SVWH Hd$XE3HApLL$XIHE=|uLD$XHE؅xoHt$XLD$PHT$@Hh؅xD|$@t' D$PɃHL$XHT$@؅x|$@tAvHt HDEH _^[ÐVWH0"AIHAHD$`AQLD$XHD$XHD$  ExD|$Xt7|$Xu6'AHD$`LD$hAQHHD$ Dx |$htH0_^[ÐLI[WH03HICDKMCSICEKDx 9\$PÉH\$@H0_ÐT$SH HT$8I6Ѕx+L$83҃rtt t !H [ÐFF!Ru{HkKEñ/F FmGMڏ+\mGMڏ+\mGMڏ+\mGMڏ+\\>MarkRegistryValueTerminateExe(ShimLib) Mitigation SuccessfdwReason(%d) pszCmdLine(%s)NotifyFn returned FALSE, fail load shimpdwHookCount(%d)(ShimLib) [ParseCommandLine] Illegal command line[ParseCommandLine] Illegal command lineUSER32.DLL;,NS_MarkRegistryValue::ConstructMultiStringShimLib\//>>>6m_cpmpfe`\`XX [PdeЪ[ ` LD*]+H` %\%\ \[86>L@\[%\\[ \[L[ \!)h%\\[!)h%\\[AddProcessParametersFlagsConditionalApphelpCopyHKCUSettingsFromOtherUsersCorrectFilePathsCreateWindowConstrainSizeDeprecatedServiceShimDisableExceptionChainValidationDisableWindowsDefenderFileVersionInfoLieForceTerminateProcessGetTopWindowToShellWndInstallComponentInstallFontsIgnoreFreeLibraryMakeShortcutRunAsPlaceholderFilesPromoteDAMRedirectDefaultAudioToCommunicationsRedirectShortCutRelaunchElevatedScaleGetMonitorInfoSetEnvironmentVariableSetProtocolHandlerMitigation SuccessNULL NS_ConditionalApphelp::ParseCommandline %20[ApiName] Hook Entered(ShimLib) Hook Entered-cNS_CorrectFilePaths::DebugSpewGetFileAttributesAGetFileAttributesWSetFileAttributesASetFileAttributesWGetFileAttributesExAGetFileAttributesExWGetTempFileNameAGetTempFileNameWGetLongPathNameAGetLongPathNameWWinExecShellExecuteAShellExecuteWShellExecuteExAShellExecuteExWGetCommandLineWGetCommandLineAGetPrivateProfileIntAGetPrivateProfileIntWGetPrivateProfileSectionAGetPrivateProfileSectionWGetPrivateProfileSectionNamesAGetPrivateProfileSectionNamesWGetPrivateProfileStringAGetPrivateProfileStringWGetPrivateProfileStructAGetPrivateProfileStructWWritePrivateProfileSectionAWritePrivateProfileSectionWWritePrivateProfileStringAWritePrivateProfileStringWWritePrivateProfileStructAWritePrivateProfileStructWIShellLinkA::SetArgumentsCOMHook_IShellLinkA_SetArgumentsCOMHook_IShellLinkW_SetArgumentsCOMHook_IShellLinkA_SetIconLocationCOMHook_IShellLinkW_SetIconLocationCOMHook_IShellLinkA_SetPathCOMHook_IShellLinkW_SetPathCOMHook_IPersistFile_SaveCopyFileACopyFileWCopyFileExACopyFileExWCreateDirectoryACreateDirectoryWCreateDirectoryExACreateDirectoryExWCreateFileACreateFileWDeleteFileADeleteFileW*.*.FindFirstFileAFindFirstFileWFindFirstFileExAFindFirstFileExWGetBinaryTypeAGetBinaryTypeWMoveFileAMoveFileWMoveFileExAMoveFileExWMoveFileWithProgressAMoveFileWithProgressWRemoveDirectoryARemoveDirectoryWSetCurrentDirectoryASetCurrentDirectoryWOpenFileRegSetValueARegSetValueWRegSetValueExARegSetValueExWLoadImageAKERNEL32.DLLCreateProcessACreateProcessWSHELL32.DLLADVAPI32.DLLSHELL32.DLLcmd.exe /d /cWindow size/position invalid: (x,y)-(cx,cy): (%08lx,%08lx) - (%08lx, %08lx)Window size/position constrained: (x,y)-(cx,cy): (%08lx,%08lx) - (%08lx, %08lx)CreateWindowExACreateWindowExWNS_DeprecatedServiceShim::getUpdatedDependencies(ShimLib) Mitigation Failure[ApiName] Mitigation FailureNS_DeprecatedServiceShim::ParseCommandLineadvapi32.dll dplay.dlld3dim.dlld3dim700.dlld3dpmesh.dlld3dramp.dlld3drampf.dlld3dref.dlld3drg16f.dlld3drg24f.dlld3drg24x.dlld3dhalf.dlld3drg32f.dlld3drg32x.dlld3drg55x.dlld3drg56x.dlld3drg8f.dlld3drg8x.dlld3drgbf.dlld3drgbxf.dlld3drm.dlld3drm16f.dlld3drm24f.dlld3drm32f.dlld3drm8f.dlld3dxof.dllddrawex.dlldevnode1.dlldevnode2.dlldinput.dlldmband.dlldmcompos.dlldmime.dlldmloader.dlldmstyle.dlldmsynth.dlldmusic.dlldmusic16.dlldmusic32.dlldplayx.dlldpmodemx.dlldpserial.dlldpwsock.dlldpwsockx.dlldsetup.dlldsetup16.dlldsetup32.dlldsetup6e.dlldsetup6j.dlldsetupe.dlldsetupj.dlldsound.dlldsound3d.dlldx7vb.dlldxmigr.dllgcdef.dllgchand.dllmsvcrt.dllpid.dllvjoyd.vxddinput.vxdjoyhid.vxdmtrr.vxdddraw.vxdIDR_dplayIDR_d3dimIDR_d3dim700IDR_d3dpmeshIDR_d3drampIDR_d3drampfIDR_d3drefIDR_d3drg16fIDR_d3drg24fIDR_d3drg24xIDR_d3dhalfIDR_d3drg32fIDR_d3drg32xIDR_d3drg55xIDR_d3drg56xIDR_d3drg8fIDR_d3drg8xIDR_d3drgbfIDR_d3drgbxfIDR_d3drmIDR_d3drm16fIDR_d3drm24fIDR_d3drm32fIDR_d3drm8fIDR_d3dxofIDR_ddhelpIDR_ddrawIDR_ddraw16IDR_ddrawexIDR_devnode1IDR_devnode2IDR_dinputIDR_dmbandIDR_dmcomposIDR_dmimeIDR_dmloaderIDR_dmstyleIDR_dmsynthIDR_dmusicIDR_dmusic16IDR_dmusic32IDR_dplayxIDR_dpmodemxIDR_dpserialIDR_dpwsockIDR_dpwsockxIDR_dsetupIDR_dsetup16IDR_dsetup32IDR_dsetup6eIDR_dsetup6jIDR_dsetupeIDR_dsetupjIDR_dsoundIDR_dsound3dIDR_dx7vbIDR_dxmigrIDR_gcdefIDR_gchandIDR_msvcrtIDR_pidIDR_vjoydvxdIDR_dinputvxdIDR_dsoundvxdIDR_joyhidvxdIDR_mtrrvxdIDR_ddrawvxdNS_FileVersionInfoLie::APIHook_GetFileVersionInfoSizeAFILESNS_FileVersionInfoLie::APIHook_GetFileVersionInfoSizeWNS_FileVersionInfoLie::APIHook_GetFileVersionInfoANS_FileVersionInfoLie::APIHook_GetFileVersionInfoWNS_FileVersionInfoLie::ParseCommandLineja-JPMeiryo UIMeiryo UIMS UI GothicMS UI Gothicko-KR ѹ@ tzh-CNMicrosoft YaHei UIMicrosoft YaHei UI[SOzh-TWMicrosoft JhengHei UIMicrosoft JhengHei UIsөe0}fԚGDI32.DLLRegOpenKeyExWRegOpenKeyExAExitProcessNS_IgnoreFreeLibrary::APIHook_FreeLibrarycomplus_fodNS_InstallComponent::NotifyFnCould not query IShellLinkDataList while marking shotcut.NONECONTEXTMENUDOCOBJECTWIN95DEFVIEWMYCOMPUTERFIRSTOLDREGITEMGDNSTATICJUMPLISTSIZELOADCOLUMNHANDLERANSISTRIPFOLDERBITWIN95SHLEXECSTAROFFICE5PRINTERNOVALIDATEFSIDSFORCELIBRARYPARSEWIN95BINDTOOBJECTIGNOREENUMRESETNOTHREADUSECHECKSANSIDISPLAYNAMESFILEOPENBOGUSCTRLIDFORCELFNIDLISTAPPISOFFICERETURNALLATTRIBSNODEFVIEWMSGPUMPRETURNNONURLSASURLSIGNOREDEFAULTTOKENCOINITIALIZE_COMPAREIDS;SeRestorePrivilegeSeBackupPrivilege__APPCOMPAT_MANIFESTRegCreateKeyARegCreateKeyWRegCreateKeyExARegCreateKeyExW_Classes\.bau_Classes\.htm_Classes\.sda_Classes\.sdc_Classes\.sdd_Classes\.sdg_Classes\.sdp_Classes\.sds_Classes\.sdv_Classes\.sdw_Classes\.sgl_Classes\.smf_Classes\.sob_Classes\.soc_Classes\.sod_Classes\.soe_Classes\.sog_Classes\.soh_Classes\.stc_Classes\.std_Classes\.sti_Classes\.stw_Classes\.sxc_Classes\.sxd_Classes\.sxg_Classes\.sxi_Classes\.sxm_Classes\.sxw_Classes\.thm_Classes\.vor_Classes\.xba_Classes\.xcs_Classes\.xcu_Classes\.xdl_Classes\Applications\StarOffice 7_Classes\CLSID\{30A2652A-DDF7-45e7-ACA6-3EAB26FC8A4E}_Classes\CLSID\{41662FC2-0D57-4aff-AB27-AD2E12E7C273}_Classes\CLSID\{67F2A879-82D5-4A6D-8CC5-FFB3C114B69D}_Classes\CLSID\{7B342DC4-139A-4a46-8A93-DB0827CCEE9C}_Classes\CLSID\{82154420-0FBF-11d4-8313-005004526AB4}_Classes\CLSID\{D0484DE6-AAEE-468a-991F-8D4B0737B57A}_Classes\CLSID\{E5A0B632-DFBA-4549-9346-E414DA06E6F8}_Classes\com.sun.star.ServiceManager_Classes\com.sun.star.ServiceManager.1_Classes\htmlfile_Classes\Interface\{9337694C-B27D-4384-95A4-9D8E0EABC9E5}_Classes\Interface\{BF5D10F3-8A10-4A0B-B150-2B6AA2D7E118}_Classes\MIME\Database\Content Type\application/vnd.stardivision.impress-packed_Classes\MIME\Database\Content Type\application/vnd.stardivision.math_Classes\MIME\Database\Content Type\application/vnd.stardivision.writer_Classes\MIME\Database\Content Type\application/vnd.stardivision.writer-global_Classes\MIME\Database\Content Type\application/vnd.sun.xml.math_Classes\MIME\Database\Content Type\application/vnd.sun.xml.writer.global_Classes\MIME\Database\Content Type\application/x-starcalc_Classes\MIME\Database\Content Type\application/x-starchart_Classes\MIME\Database\Content Type\application/x-stardraw_Classes\MIME\Database\Content Type\application/x-starimpress_Classes\MIME\Database\Content Type\application/x-starmath_Classes\MIME\Database\Content Type\application/x-starwriter_Classes\soffice.StarCalcDocument_Classes\soffice.StarCalcDocument.5_Classes\soffice.StarCalcDocument.6_Classes\soffice.StarCalcTemplate.6_Classes\soffice.StarChartDocument_Classes\soffice.StarChartDocument.5_Classes\soffice.StarConfigFile.6_Classes\soffice.StarDrawDocument_Classes\soffice.StarDrawDocument.5_Classes\soffice.StarDrawDocument.6_Classes\soffice.StarDrawTemplate.6_Classes\soffice.StarImpressDocument_Classes\soffice.StarImpressDocument.5_Classes\soffice.StarImpressDocument.6_Classes\soffice.StarImpressTemplate.6_Classes\soffice.StarMathDocument_Classes\soffice.StarMathDocument.5_Classes\soffice.StarMathDocument.6_Classes\soffice.StarOfficeTemplate.5_Classes\soffice.StarWriterDocument_Classes\soffice.StarWriterDocument.5_Classes\soffice.StarWriterDocument.6_Classes\soffice.StarWriterGlobalDocument_Classes\soffice.StarWriterGlobalDocument.5_Classes\soffice.StarWriterGlobalDocument.6_Classes\soffice.StarWriterTemplate.6_Classes\soffice6.bak_Classes\so_activex.SOActiveX_Classes\so_activex.SOActiveX.1_Classes\TypeLib\{61FA3F13-8061-4796-B055-3697ED28CB38}\Environment\Software\Sun Microsystems\Software\Microsoft\Windows\CurrentVersion\Uninstall\StarOffice 7\Software\LotusCREATEDIRSTAROFFICE7LOTUS\\[IsRedirectionRequired] FileName passed in is NULLNS_RedirectShortCut::IsRedirectionRequiredNS_RedirectShortCut::CheckAndGetRedirectionPath[SwitchStartMenuRedirection] FileName passed in is NULLNS_RedirectShortCut::SwitchStartMenuRedirectionNS_RedirectShortCut::GetRedirectedPath[SwitchDesktopOrQuickStartMenu] FileName passed in is NULLNS_RedirectShortCut::SwitchDesktopOrQuickStartMenuNS_RedirectShortCut::APIHook_CopyFileANS_RedirectShortCut::APIHook_CopyFileWNS_RedirectShortCut::APIHook_CopyFileExANS_RedirectShortCut::APIHook_CopyFileExWNS_RedirectShortCut::APIHook_MoveFileANS_RedirectShortCut::APIHook_MoveFileWNS_RedirectShortCut::APIHook_MoveFileExANS_RedirectShortCut::APIHook_MoveFileExWNS_RedirectShortCut::APIHook_MoveFileWithProgressANS_RedirectShortCut::APIHook_MoveFileWithProgressWNS_RedirectShortCut::APIHook_DeleteFileANS_RedirectShortCut::APIHook_DeleteFileWNS_RedirectShortCut::APIHook_GetFileAttributesANS_RedirectShortCut::APIHook_GetFileAttributesWNS_RedirectShortCut::APIHook_GetFileAttributesExANS_RedirectShortCut::APIHook_GetFileAttributesExWNS_RedirectShortCut::APIHook_SetFileAttributesANS_RedirectShortCut::APIHook_SetFileAttributesWNS_RedirectShortCut::APIHook_CreateProcessANS_RedirectShortCut::APIHook_CreateProcessWNS_RedirectShortCut::COMHook_IPersistFile_SaveNS_RedirectShortCut::CheckManifestRunLevel\Registry\Machine\SOFTWARE\Clients\%s\%sDLLPath\Registry\Machine\SOFTWARE\Classes\%sNS_SetEnvironmentVariable::NotifyFn%WinDir%%SystemDrive%%UserStartMenu%%AllStartMenu%%UserDesktop%%AllDesktop%%UserFavorites%CorrectPathChangesBase"!d @@ 0r  (@r@r@  Hr @r@ p(h r   ( 0 8` @HPXP`h58!0P]+H`3qq7I6]+H`Hp2 $   H H( 0 8 @HHHPaX8P!`phH 2G  a8pH02 H H p(H2D pH2D HpH2D HpHx2l$ HHH H( 0 8T @ H P XH`P!hppH20$ HHH  (H0 8 @ H P X `Hh pd x~HP!pHX2 $ HHH  ( 0 8H@P!HpPf@6)\@,4<IUNULL.dllGetHookAPIsNotifyShims pcacli.dllPcaMonitorProcess)\%$$)\6u UGPuRSDS4$N1AcGenral.pdb  t d 42d42 p(p`06 F9Ff9<:: :<R@;Rs;;D<20 td4PBT 4 2 p `b  4 2p  4 2p6!1f1h<d 4 Rp611<bp`06S22< 4 rp`622<2    4 2p6M554=5  4 2P t dT422P2P! `$ t d T 4 r 4 p@7x@7@ d T 42p-4p`7t#  2P$7t#R0) !p`0$7$  RP$7$ 4N Lp@7Pr 0$7%  2P$7%p`0Pd 4R p4 p ` P  p0P4 p$7,& 0$7t&  RP$7t&d T42p P@7` d T 4 Rp t d T 4 Rd T 4Rp dT 4 rp tdT4d 4R p t d T 4R*"p`0$7T'  bP0$7T'*"p`0$7(  bP0$7(( p`0$7(  bP0$7($ $d 4 p$7d)  bP0$7d)$ $d 4 p$7$*  bP0$7$*( p`0$7*  bP0$7*$$d 4r p$7+  2P$7+ $7$,  RP$7$,d 4 r p4 p `$7,  2P$7, p ` 0$7-  2P$7-$ $d 4 p$7.  rP$7.4 p `$7|/  2P$7|/ p ` 0$7<0  2P$7<0 0@7 t d T 4 r*!p`0$70  P$70*!p`0$71  P$71 b$7L2  2P$7L2 4 p`P- %p`0$72  P$72- %p`0$7|3  P$7|3d 4 Rp$7,4  2P$7,4d 4 Rp$74  2P$744!p$7,5  RP$7,5  4 Rpd 4 R p4 p`$76  RP$764 p`$77  RP$77% 4UL p`P@7P& % p`P0@7 #p`P0@7 "p`P0@7' % p`0P@7)!p`0$7T8  RP$7T84 p `$79  RP$794 p `$79  RP$79)!p`0$7:  RP$7: t"d!4 $7T;  RP$7T; dT4p t4 P@7`%t4 P@7 dT 4 rp4!4vpp`P@7p+d4 P@7Bp ` P 0  4 Rp4 p$7<  RP$7< $7=  RP$7= 6 p`0$7l>  P$7l> f0@7 K@7@t d 4RT 4 r p `d T 4 rp$7@4#t4P7\@R 4  p@700$7@  RP$7@d 4 R p4p`$7|A  RP$7|A$ $t3 d241. $7TB  RP$7TB4 p `P4 p`$7E  2P$7E4 rp$7Fd 4 rp$7FdT42pd 4 rp$7,Gd T 4 rp$7tG! !tdT 4 $7G! !tdT 4 $7H,  p`P0@7p dT4p dT4pd T 4 rp$7LH! !tdT 4 $7Hr0d T 4 rp 43 0p@7p 4U Rp@7r0$7H) dMTL4JHp@70  4 Rp 0$7(@X"<((T(0ȓǒI|ԓ(@ԓX"(<)(@,GU׬8FP)@8X")) )0~$(6\*@(X"L** l*0̲p>LZɱԱز *@زX" +d+$+@ ų?Jx+@X"+++(HU,@8"L,|,\,05D,@DH",l-,( sWbmx%N-@8"-\.-(Xdp|dp.@8".T/.@DUq{,$/:Ch/@X"/0 /(4Bh(5^(0@(8"d00 0(ts~.0@8"$1|1D1XP 1@h"1$21XhtHXL82@h"t222 2@8"2T3 3DP GUZ!/Ph3@P"34 3d p->guzA O p 4@p "T44d4     4@ 8"454 T    5@ 8" T565 ,,8DPP\ h<NXchz '   s ~t  6@tH"6l7 700A7@H"7,8 70hy9D-@8@H"|88 88 7705555666$71779@$7H"<99 \90(949708E8V8888@9M999@@9H"9l: :0H;T;9P:e:v::::`;m;;:@`;H":,; :8==;~<<<E=P=[===5>@;@=H" |;<;8IDIPIPI\IhItItII I0APAbAA BZBrBBBBB C C CCCDD!D ND YDdDvDDDDDI J <@IH"== 4=0cca=bObnbbbbbbbb-cc=@ cH"=D>>0feeeeff)ffX>@fH" >? >"@TAA0( 4AhA@4H"A,B A0$$0p#?<It@B@<H"|BERBH(4@ L X X d p?Q[fkʞϞ|  ʟ  àΠܠ & 7 z  +6AOZhsx  ĢϢ )7BG U`kv ƣѣܣ%0>I|E@|H"EtF F pǫ٫ &nyF@8"FF װ" GG ϱڱ"TG\G h*"GG ŵе"GG0X",H4H0pȸ"tH|H ؿ@"HH0 EP"I$I \ <J"dI J I0Pi{OZe g J@H"\JlJ0p"JKJ /CUdn0K@8"lKK KP  , 24 8 L@8 H"8T@=h"tTT T8@@0>>>>@%@0@@@=AT@@H"4UULU8CPAAABCCCDU@CH"U4VU0E DDDGEREEEMFHV@EH"VVV0DH`FFGGGPH]HHV@PHH",WWDW0JHlI}II JJJKW@JH"W,XW0L0KKKFLQLLLAM@X@LH"|XY X@PQ\QhQ`MNNN(NkIkllel]@lH"^\^^@nl m1m:nEnnnQop^@nH"^_ ^ttpoppprrr t-tt0_@ tH"l__ _0uutttuu&u1uuuv_@uH",``L`Hx xvQvbvrvvvvvzwwwx%xyx`@xH" aa$ah|zxxx6yAyFyyyyyyyyyzzza@zX"adc($b0<H{.||||||} }3}>}I}N}}}~ ~~~~~~~~~#.`m߅xc@`x"c dc0`܌!/?Jly͍ d@lH"\dTetdH=KŎʎ"\gl7BDO͐!he@H"eee0l)BMxٗf@xH"LffdfH4[lǘ̘8CHʙ@Mg@@H"Xo@H"$pTp4pPhp@h"pppX0Gp@h"$qTq4qX ,hq@,h"qqqPPjq@h"$rlrHT"xxP@"x yX$0l "\yty`@g"y yHe.K]gq"dztz@.bm"zz@(4Wj"${,{` T t  "l{{|{   " P {@P 8"{{0 p   "4|L|8 "||`P\!/" }}`p\r"l}t}8&&&"}}8''6'"}} /. /L/Z/g/"D~L~ 33H3333"~~ 44@44"~~ <6p556",4(777"lt(888":;;,<9<@<@,<H"<lL8T<}<<=@=H"Ā8@@@"  $G4GFFFG"T\ GhGGG" lIxIHIIAILI"4 8IIIXJeJH@XJH" 8JK/KKKKKLLL0@KH@LH"l0HMTM`M,LWLhLLLM'M"0NtMN7N",< O(ONNNO"@[Y'ZxZ"̄0^]^!^p^{^^(@^H"d  @`L`X`d`^^^^:_q______p`@p`8"D\`c0aaa(b3bc@cX"܆$ `ggg%g;t@;;t;;t;C<tD<e<th<<t<<|<<|<1=|4=R=t=T>T>>>>>>?#??@A@n@Yԓ@0@@ I@@@XМX`NX@P@X0@P`/pItitD8`ݯt(ppز  b  t0`Bu@@޻@ @P+tpKt@@~ !@L (A8DdHd,,X XhddWxNh\h$](ttP(P@x@x$$8TP$Plgp  [=TPhP Ppp) ,p  L  \ 0 t0 T LT      Ttv`@0@p@p!"##h#'%p%&h&&h& (Tp(*h*++++,,,-000000@1@124T05 7 $77 7%90 @99H 9H;X `;;p ;= =P> P>@0AD I J  JJ J L  LpM pM N  NN\NpOLpOQ8 |RSP SSSTTzUTUVX VWT@XY| Z [  [[([3]p]"^ `^_`Saac  cc cHeef ff f=hphh(8io rs sgspst tutuvtvw w{x0 yzT|{{L {}d }~$~~h~$x ^t~t߄ t@tntt0tP.tH `ߑv  % 4   $|x|ؘ$ؘpxp <0 -dp@ |¥`  ܦܦ`xp pѬ Ю Ю# 0x 0h x  ` `xg  0 V pphp@ 0`` ` @ @տ \ pp``x\~ <``xhx ,lxl@@ 4 \Tp4d4((Ppt  v,x@$@p\p0Tttt`qt`2@R@06 &wpx0$0h(<<(TpQ 8 X X ` ` ,@@dhdW(T.L4h 0 0 !$%<&`&`&)\***.///3(34@4G7P7@8h@8:x:@;@;u==0>0>@@PAPAcCC D DE$E`F<`F HLPHHdHjJtJ0K0KLL`M`MPtQQQU@VVVSZZP[(P[^8(__P_wc`dd|d>hh@i@iklllnnpopo8s  tt(tKu8uvPvw`xxx=zz{{T{xT{{h{`݋x܌Xlp4,4<ܓ=$Е kLxhx@@L-`$ipЦ(HPp@dӭ0\PPЯЯJT$hPhPܴ  09\\- D,p@pxp\\QjL$p0p$pxD$D|x|$P0`0p+,PP-<``   |0|@P ` npp),PP d0d@P`t$$$lW>`>l$@8%TDhtlhlLD T } p     6 P p p   OpD$D<\<x8Pz`TLT p8h( (  $  $ !L!!!"""X"p#p#$$$$$P%hP%%x%,&x,&P&$P&&x&& & 't''''t''$'$(x$()8))()X*LX*x+Xx++h+h, h,-p--- .x ..(..L.~///$0x0 x00$0001\11$1223h3334L444p5 p5:6L66x677778t8@8p@8p8$p88(8889t9|9p|9:(:+<8,<T<\T<=l====$=>L>h>xh>>L>@@@@!AtTAA$ACCdC$dCCxCDDFF"GHGhGLhGG0GH\HkIDII`XJJtJKKLL,L,LEMtMNNOccccPd$Pde ee epf(pff ffxgSg lgg gg g h0  hl@ Dmpmd pmmhmnLnvn 0oSst {{ {} }} }   !Ȃ!ȂD\l(!l