MZ@ !L!This program cannot be run in DOS mode. $t{Ú(Ú(Ú((()()()Ϛ()К(Ú(L()š()ښ((š()š(RichÚ(PEd0Y" rVp q`Apd\H8 .textpr `.rdata<>v@@.data@.pdata\@@.rsrc@@.relocH@BH(LƒfE3E33H(H\$Hl$VWAVH03IMHك9=x=R=0= =i=hG=N#=4=^=:==u=Q=/=~H\$XHHl$`H0A^_^H(YHHHuH 3H(H\$Hl$H|$ATAVAWH 3ML%DeH%0HxH;t+3H=xuAptH-EHtdH=1LLHH;r7H9tHHH HL;uL;tLHLHHHHE H3eH%0HxH;t@~3H=ut _H=GeL%FI;s#uH9t HHI;rcHH u HHH9 t(H |tHMƺI:H\$@Hl$HH|$PH A_A^A\H\$Ht$WH IHuLNjHH\$0Ht$8H _HHX L@PHHVWAVHPLމ\$ ;wջu9u 3ۉ\$ B;L MtBe;DƉZL$I~؉D$ 3ۉ\$ s$xL$pyL$I؉D$ 3ۉ\$ s$xL$p?L$IR؉D$ 3ۉ\$ s$xL$p;E33IR$xL$p\$ E33I$xL$p\$ HHt(E33I}$xL$p\$ turL$I؉D$ 3ۉ\$ s$xL$pHHt4=պt+L$I}؉D$ 3ۉ\$ s$x;w ֹH$HPA^_^ffH; uHfuHH\$WH H{tHHH\$0H _@SH H3zHzzHȺ H [H%yHL$HH ]{HHHD$HE3HT$PHL$H{HD$@H|$@tBHD$8HD$XHD$0HD$`HD$(HHD$ LL$@LD$HHT$P3S{#HzHHкHiHH^HH(H$H) HkH HHkH HHHkH ȸHHHkH ŷHLhHkH HLhH vOHĈ%2z%zLcAHqHo&H HqnLIֹH'H6LD$PI֋*HHqHnH Hq7nLIֹHHLD$PI֋HHYqH(nlH H:qmLIֹH"5HH/LD$PI֋0H'HqHmH .HpQmLIֹHbHѱLD$PI֋,HHpHBmH HplLIֹH,+HZuLD$PI֋7vHmHppHlUH HHQpklLIֹH6HLD$PI֋c;HH%pH\lH հHpkLIֹH6;HlLD$PI֋ 9HHoHkH bHokLIֹH8H^LD$PI֋=_HVHoHvk>H HokLIֹH@<H~HlA H mALlHD$ HljeH%`L3HH0H%ok@SH HHHLHAHKDIHDHH [HT$HL$WH@HD$ H\$`HHHvEHL$(zHsHL$(0ju3hHHL$(@H$HL$(@ H\$XH|$PHH_hH\$`H@_HT$UH HHH ]HL$SH@HD$ HHHL$(HrHL$(iu3gHHL$(?H,HL$(?H\$PH HH@HH@[H%)jH@[HT$UH HHH ]H\$Hl$Ht$H|$ AVH@HL5qAuIHLqIHEHIpHD$0HmqL$(AIHD$ rh3HtHL5HIH7HHtHXH hqHHH HHH bqHH8H7qHH uHH@X HX(HP0HXHXPHXXHtAx\$(H+qLpHD$ HhoAIg3HtIHH<3du9muaHbH\$PHl$XHt$`H|$hH@A^H\$Hl$Ht$H|$ AVH@HL5 pA2IHLpIHEHnHD$0HoL$(AIHD$ f3HtHL5HHHHtHXH pHH pHHH {HHX HX(HtA4\$(HoL!pHD$ HnAI;f3H HHHa3du9uHH\$PHl$XHt$`H|$hH@A^@SH HH@~<HK0u<HK l<HKc<HH [V<HH3D$XHD$XL$PHD$0LoHD$PHD$(DIHL$ HoH*eu 9D$Pv3HHH\$Hl$Ht$H|$ AVH@HL5mIHL pIAHEHlHD$0HmL$(HD$ d3Ht3u>Hu L5HFHHtl3EHgHtYHt3du95FuC:u2uhHoALNoHD$ H"lO1d3Bu6Ht3Hmt$(AHD$ L oHkcHéH\$PHl$XHt$`H|$hH@A^@UH$HHEH$HH3Hp3ۉ\$Pd]3DC`HMBH\$X3HD$`HD$hbLHMEf]`HmHMgcVHM`b=:EhHU`HL$p>9HUHM8HmHL$p:H\$(HE`HD$ ALmHU3OatHELPHL$p>?aHHL$pN:HL$p`?HmH Rm`HD$XHD$HHEHD$@H\$8H\$0D$(D$ E3E3HT$p3`HL$XHt)`HT$PHL$Xy`HL$X`H\$XHL$`Ht `H\$`L$PZ`HMHpH3H$HĀ]HHp?8H38@SVWAVHHDŽ$HhH3H$IEHHL$pT$@DD$HH\$xHlRasHHL$`M7HUlHL$P;7HL$P @HlHL$P9H$HL$PT_HL"mHhHu9HlHD$ DOGO`HL$P=7HL$`27HlHD$ ALAIX`H^HkHL$`7LD$`A@HcHxHL$P6HL$`63HD$`HD$0H\$(HlHD$ AZLHlHgAI_HL$Px6HL$`m6W0H|$pt$@Dt$HH\$xH`LEƋHH@`H$H3HA^_^[H` 6HP6HT$UH@HHXlHD$ AgLkHgAI_H[H@]@SH HSjH"_uHHH@HH [H%_H [H\$Hl$Ht$H|$ AVH@HL5{gIHLkIAHEHefHD$0HMgL$(HD$ Q^3HtHL5u?HHHtHXH wkHHH HHH ykHH8HNkHH HH@X HX(HP0HXHXPHXXHtHg\$(AHD$ LjH~e]3HR?HSH;3du9uHH\$PHl$XHt$`H|$hH@A^H\$3HBAMI;DAWEGExDDHt-L+L+IHtA ftfHHuHu HAzAAHtfH\$H\$Hl$VWAVH@HL5keA,IHL1jIHEHYdHD$0H=eL$(AIHD$ B\3Ht;HuoL53m=HΡHtiHt;LD$hHi[Ht;A0|$(HCeLiHD$ HcAI[/H=HHu3du9=Iu=H>H\$`Hl$pH@A^_^H(H; tHH@xj\H(H(H; ͙MuXH!HtL= vC D;r1Mt,DIHL$PݠHL$X HL$P3H(@SH HHt(HhZuH2Ht H3H [H8E3HH GhYH E3Ht$HE3H|$0H5/H=$AQH|$(Ht$ YtaH\$@yYDúHpYD H }LH|$(HΟHt$ kYH\$@3Ht$HH|$0H833H\$Hl$VWAVH@HL5_bIHLgIAHEHeaHD$0H1bL$(HD$ 5Y3HtHL5Y:HHHtHXH3gHH 9gHHH HHH 3gHH8H HH@H -gHHhH BHHpX HX(HP0HXHXPHXXHP`HXxHHtHa\$(AHD$ LwfHS`=X8H :HH3#du9uHH\$hHl$pH@A^_^H\$WH0HgI؋H@Xt/)u*C#CCCTCXC\H\$@H0_H\$Hl$Ht$H|$ AVH@HL5?`AFIHLeIHEHU_HD$0H`L$(AIHD$ W3HtHL5:8H{HHtHXH `HH zeHHH HHX HX(HtAH\$(H_LeHD$ H^AIoV3H=8H&Ha3du9֛uʛH˛H\$PHl$XHt$`H|$hH@A^@SVWATAUAVAWHHDŽ$HH3H$IMDLH$$L$L$H$`HL$PH$hHT$XL$pLD$`L$xLL$h3ۉ\$pH$Ht>|$tD$|HTH$H$H$H$HLL$8LD$0HT$(HL$ LMAIH@+VD$3AH$\$xHD$xHD$ AL$AT$IUCHcH$T&MHcH$&2H$HD$ AE3H$ITHD$|HD$(H$HD$ L$E3HncH$Sus$ui$ u\AMHEcH$1L$IH$<u#HEcH$SDى\$p0\$p|$tD$D$L$L$H$LD$PLL$XLT$`L\$hH$HtSLD$PLL$XLT$`L\$htU>AUHL\$8LT$0LL$(LD$ LMIH@TH$)H$)H$z)H$l)AH$H3HA_A^A]A\_^[H:)H.)HT$UHPHHHP]H\$Hl$Ht$H|$ AVH@HL5}IHLaIHEHIZHD$0HZL$(AIHD$ Q3HtHL53HGHHtHXH aHH aHHH {HHX HX(HtA\$(HZLaHD$ HYAIKQ3H3HHa3du9uHH\$PHl$XHt$`H|$hH@A^H(HMH@HQ3ɃDH(H(HH@Q3ɃDH(H\$Hl$Ht$H|$ AVH@HL5KYAAIHLQ`IHEHXHD$0HYL$(AIHD$ "P3HtHL5F1HgHHtHXH `HHH HHH `HH8H_HH HH@X HX(HP0HXHXPHXXHtAF\$(HXLl_HD$ HWAIVO3H$1HH<3du9uHH\$PHl$XHt$`H|$hH@A^@WH@HD$ H\$XHHHD$PHHHL$($H ?S/HL$(9A|4LcH&SNu HHH ^H@OHH͓HHH@}OHH\$PHL$($HHD$PH3H@KOH\$XH@_H($HT$UH HHH ]H\$Hl$Ht$H|$ AVH@HL5VAEIHLI^IHEHVHD$0H}VL$(AIHD$ M3HtHL5.HHHtHXH ]HH ]HHH +HHX HX(HtAG\$(H`VL]HD$ HEUAIL3H.HzHa3du9uHH\$PHl$XHt$`H|$hH@A^H\$Ht$WH HHH@sMHt HH\$0Ht$8H _H\$Hl$Ht$ AVH@ADLdIHHKHH|$PLH|$pDAH|$ HL؅xfH3HD$097vVH-fdE3D$ LD$03HeKAHl$ L]dHSSKHD$0;7rH|$PH\$XHl$`Ht$hH@A^ø@H\$Hl$Ht$H|$ AVH@EHLdIHH@JLHHD$xLHD$(EHD$pHHD$ HIKHHHH cJuf;uCtHcA20HH dvJuAf;u;Ct2HcA8LcHD$ HRJcH\$PHt$`Hl$XH|$hH@A^H\$Hl$Ht$ AVHPILL]IHHILHH$LH|$`LH$IH|$@HHD$8H$HD$0$D$(H$HD$ I^J؅xJE3D$ LHc3#IH ]A]L7]HD$ HkQHH|$`H\$hHl$pHt$xHPA^ø@H\$Hl$Ht$ AVH0ALL`IHHsHHH|$@LH|$`DIH|$ HyI؅xJE3D$ LHb3>HHg`AL`HD$ HPHH|$@H\$HHl$PHt$XH0A^ø@Hl$Ht$ WAVAWHpILLZAHHGLHH$DHD$8LH$IH$HH$L$L$Ld$0H\$(HD$ I`HMUMHH XMG5HLL$P3HD!D$(H[HD$ ADHL$`BHL$hBH[HD$ ACHL$PH[HPwHT$UHPHHHP]@SHHDŽ$HHL$xHL$xyHWCHHL$xH+HyHWCHH+D$xHHHD$P3H\$X$3DC`H$H\$`3HD$hHD$pHL$PI"7HBWHL$PHT$P9ZHDHD$`HD$HH$HD$@H\$8H\$0D$(\$ E3E33@LbWHJHWHD$ A~K0BHL$`@H$ HL$`@$ L WHrJuHWHD$ AKA!D$(H.WHD$ AAHL$`e@HL$hZ@HIWHD$ AAHL$P,HL$x!H[Hx HPHT$UHPHHHP]H\$Hl$Ht$H|$ AVH@HL5IIHLZIAGHEHYIHD$0HIL$(HD$ @3Ht;HL5G~!HHHtH ZHxH3H Zx HHH HHH ZHx(H@H ~HbAHD$ LZHZ? H T~HMAHD$ L{ZHZ?H ~HAHD$ LFZH_Z?H }HAHD$ LZH*Z\?H }HNAHD$ LYHY'?tPHt;HH|$(AQHD$ LYHG?3H H|HL3du9=,u H!H\$PHl$XHt$`H|$hH@A^H\$Ht$UWATAVAWHHpIHuOHELMIE3HL}8LD|$ AHOH@(E3HfDeAk?HOfDeHELMHHOE3D|$ HH@(8?L|$8HE8HD$0L{OH\$(HOHL|$ E3I?HM8LML|$(HwOE3L|$ HH@ >f}}xHM8HH@>H=OL}8HELMHHNE3fDeHD|$ H@(m>L|$8HE8HD$0LNH\$(HNHL|$ E3I8>HM8LML|$(HNE3L|$ HH@ >f}}HM8HH@=HNL}8HELMHHME3fDeHD|$ H@(=L|$8HE8HD$0LMH\$(HMHL|$ E3Im=(HM8LML|$(HME3L|$ HH@ <=f}}HM8HH@=HML}8HELMHH1ME3fDeHD|$ H@(<L|$8HE8HD$0LMH\$(H.MHL|$ E3I<]HM8LML|$(HME3L|$ HH@ q<,f}!}H]MfDeHELMHHvLE3D|$ HH@(!<L|$8HE8HD$0LdLH\$(HxLHL|$ E3I;HM8LML|$(H`LE3L|$ HH@ ;vf}k}aHLfDeHELMHHKE3D|$ HH@(k;L|$8HE8HD$0LKH\$(HKHL|$ E3I6;HM8LML|$(HKE3L|$ HH@ ;f}}H1LfDeHELMHH KE3D|$ HH@(:L|$8HE8HD$0LJH\$(H KHL|$ E3I:x?HM8LML|$(HJE3L|$ HH@ S:xf}u 9EDHM8HtHH@':L}8HKfDeHELMHHJE3D|$ HH@(9H HKHELME3fDeHJD|$ HA(H9L\$pI[0Is@IA_A^A\_]@SH Hً wt 7HH [̋ vt 3H%7H\$Ht$WH HHtj vt_h7HtTHHf<^uHøHHu6Ht1H8HHt LHHxHH8H|HH@8H\$0Ht$8H _@WH0HD$ H\$@Ht$HHHL:RH57HHt3HL$PHHHC8؋ ut3~6@H\$@Ht$HH0_HP@WH0HD$ H\$@Ht$HHHLjQH6HHt3HL$PHHH7؋ #ut35@H\$@Ht$HH0_HP@WH0HD$ H\$@Ht$HHHLQH5HHt3HL$PwHHH7؋ tt3>5@H\$@Ht$HH0_HP]H\$Hl$Ht$H|$ AVH@HL5[>IHLPIAHEH=HD$0H->L$(HD$ 153Ht7uEHu L5rHHrHtwGH8zHtaHtdu95zuGz|u9EH?ALOHD$ H=K43 HyH O3HH OHHH 5HHH OHpp Hp(A4H zrH[DKHD$ LOHO3tH KrHDKHD$ LOHO3MH rHDKHD$ LaOHjO3Ht7H<t$(AHD$ LNH;n3HxH\$PHl$XHt$`H|$hH@A^H(t&u<2qt 3ҋ23 qte2qH(Hx3H@H%3H\$Hl$Ht$H|$ AVH@HL5;A<IHLUNIHEH5;HD$0HY;L$(AIHD$ ^23HtHL5oHSwHHtHXH NHH NHHH HHX HX(HtA>\$(H<;LMHD$ Hy:AI13HH6oHa3du9vuvHvH\$PHl$XHt$`H|$hH@A^H\$Hl$Ht$WH0=EwIIHu.wYHJvLLHՋH@%2H\$@Hl$HHt$PH0_H\$Hl$Ht$H|$ AVH@HL59IHLLIAHEH19HD$0Hu9L$(HD$ y03Ht>uEHu L5mH-HmHtwHpuHtaHtdu9=KuuG?uu6H$;AL'LHD$ Hs8K/3tuhHtH +=HH )LHHH VHHHxx Hx(Ht>H8|$(AHD$ LKH7a/HtH\$PHl$XHt$`H|$hH@A^HXHBmH3H$@u73HL$ AHL$ D$ M.t$:u3H$@H3.HX@SHP3ҋHL$ DB0肸LL$pAHT$ 3,u?HL$pHt5LD$hP,u#LD$hHJM@x.HL$h,HP[H\$Hl$Ht$H|$ AVH@HL57ALIHL KIHEH6HD$0H6L$(AIHD$ -3Ht3u>Hu L5HkHH7kHtj3HrHtWHt3du95ruAru0ueH8DOMHD$ LPJH6O@-3Au5Ht3APt$(H6LJHD$ H5AI-HrH\$PHl$XHt$`H|$hH@A^H8q@tA*HhILIHD$ Hm5AI,=+HtCHT$@D$@Hg|$@H~H@f82u+3*Ht+H8LHxH>jH3HD$`H4ICICMKHHICICH3HHICICAHUHIC3IC *HL$`H3 HxH\$Ht$WHPMHLHDL HEH HHLHH<4LDHHLL$@HDH\$8HmHHL$0AH|$(HD$ +H\$`HHt$hHP_ɃgwEHcH/$hhHde fhE3E33Dgggg h̋Hыp@SH HHكx|@HHHAHgHHAHdHH [H\$Ht$WH HgHHHHAHm Hc~HtH LMH)Ht$8HH\$0H _H\$WH HHgH HH;t H H H{Ht(L3H7(HCH\$0H _H\$WH HHH HH;tHH9} HigH;ux}PLHdHzH@HHHCHH\$0H _@SH HLH4 HHH [@SH HLH HHH [H|$ AVH HcL~H|WHL$8p̅uHe3HHQH\$0Ht$@@}@;|;| ;LuH#&L3H&H\$0Ht+p3Ht$@fTx xH IH|$HH A^HVHL$8蹯HH\$WH LH3HEJE~AALcCBf\tf/u f\tf/uftbEtHAu fAz:utuu.L5.HttCHf\tf/tHJHLEH\$0H _H\$Hl$Ht$ WAVAWH0H)d3IcHHLHiHExD%LG3H%HHuHUHL$`wLHH9&@, Hw~Ql$(DLHl$ 33$~2IIDωl$(L3HD$ 3$IH;t$L3H$H\$PHl$XHt$hH0A_A^_H\$Ht$WH HIHcHكx;x~HHtH LMHP%HxH H; bt3fyH\$0Ht$8H _H\$Hl$Ht$ WH IcIHcHxeEx`;;rGt.{HHLH$HLHT$PMH$H\$0Hl$@Ht$HH _HSHL$8ƬHSHL$8贬̅H\$WH0HcMHHzHt$@Hr9B;2HcJ+;(H JLMI+$HXH3HcAfALD$ DLHϋRHHt$@H\$HH0_H\$WH HHH;~4FH bH;t#SH?CHS HLcM#H\$0H _@WH@HD$ H\$PHE33H "؅t}H`HT$(HD$0HL$(DHH!t2;w.PHL$( HT$(HHXHL$(?3HL$(HL$($3H\$PH@_H( HT$LD$LL$ H(LD$@ H(H\$Hl$Ht$H|$ AVH LHIIIy"H΍PH>LcOIAH=w+IYMHLH "x HH;wu3f_ Mt3fHH\$0Hl$8Ht$@H|$HH A^@SH H L3HH [H% Ht$WH HHxHp;P~>H\$0X;LHCLcHV Mm!HHΉX7HH\$0Ht$8H _H\$WH H33X t)HˋbH; H;s3HH\$0@H _H\$WH Hz33t)HˋHgH;s3HH\$0@H _@SH HH^H HH;t* H H hH]HHCH [Hq^H;t,H\$WH HuHHHf"u8D$H^H\$@ftLf"tHHfu5A*Ht$@ft f tf tHHfuHD'fD?HD$PHD$(HL$ AL8&HT$@3DEt/AsH$DtuAAG=v3fD'f;tK$tAHHƄ$H$E38HH+\$@HAH$EsEuFHHtH8H"HFHf;t*f tf t Hf?uD'H^3fHHL$XHH+HB(HT$XfD'IMf H^IIM<$AtIAuI $L;t'IH+HY+؍CLcMIKI$X2D$uEuIVIN@3DHHfAuthentecFingerprintDisableDialogAPIDWmigrationFCSIntelGraphicsCPLNitroPDFPro9OfficeMetricsLieOneKeyRecoverySierraWirelessHideCDROMSmartAccessFindWindowSql2005Sql2005MMCSnapinSql2005SetupComputerNameSql2005Sp1ExtractorTerminateZTEFileAutExefdwReason(%d) pszCmdLine(%s)NS_AuthentecFingerprint::InitializeHooksMultiKERNEL32.DLLGetProcAddressLoadLibraryApdwHookCount(%d)Kernel32.dllCreateThreadpoolWaitNS_DisableDialogAPI::InitializeHooksMultiUSER32.DLLDialogBoxParamWDontShimDWSoftware\Microsoft\Windows\Windows Error Reporting\Debug-c\dwwin.exe .exe__COMPAT_LAYERNS_DWmigration::InitializeHooksMultiNotifyFn returned FALSE, fail load shim{ABABABAB-CDCD-EFEF-0000-ABABABABABAB}{2D9E65B5-E6FE-4239-9F33-D0C67819F0F1}gpmc.mscError: CString error while applying FCS shim. GPMC.msc not found. NS_FCS::APIHook_MsiEnumRelatedProductsWGPMC.msc foundError: FCS could not convert lpProductBuf from "%ls" to "%ls". Converted string length is greater than the maximum buff size.Error: CString error while applying FCS shim.NS_FCS::InitializeHooksMultiMSI.DLLMsiEnumRelatedProductsWMsiQueryProductStateWigfxcpl.cplNS_IntelGraphicsCPL::InitializeHooksMultiNitro PDF Creator (Pro 9)NS_NitroPDFPro9::InitializeHooksMultiwinspool.drvEnumFormsWOpenPrinterWClosePrinterNS_OfficeMetricsLie::InitializeHooksMultiSystemParametersInfoA\REGISTRY\MACHINE\BCD00000000\Objects%s\DescriptionType%s\Elements\%xElementWindows RollbackNS_OneKeyRecovery::InitializeHooksMultiADVAPI32.DLLRegEnumKeyExWNS_SierraWirelessHideCDROM::InitializeHooksMultiKernel32.DLLGetDriveTypeWGetDriveTypeALogonUI Logon WindowNS_SmartAccessFindWindow::InitializeHooksMultiuser32.DLLFindWindowWsoftware\microsoft\inetstp\componentssSubKeyNameASPNETsValueNameGetDWORDValueStdRegProvuValueMetabaseWMICompatibilityWindowsAuthenticationStaticContentDefaultDocumentHttpRedirectSystem\CurrentControlSet\Services\IISADMINstartCOMHook_IWbemServices_ExecMethodSYSTEM\CurrentControlSet\Services\IISAdminIWbemServices::ExecMethodNS_Sql2005::COMHook_IWbemServices_ExecMethodCOMHook_IWbemLocator_ConnectServerIWbemLocator::ConnectServer hooked IID_IWbemServicesNS_Sql2005::COMHook_IWbemLocator_ConnectServerQ188769rsctr.iniSystem32\iisreset.exe[LoadPerfCounterTextStringsW] Createprocess on IISReset.exe successfullNS_Sql2005::IISReset[LoadPerfCounterTextStringsW] IISReset.exe exited successfully[LoadPerfCounterTextStringsW] IISReset.exe exit with a failed dwReturnCode 0x%x[LoadPerfCounterTextStringsW] IISReset.exe failsystem32\inetsrv\appcmd.exe set config "Default Web Site/ReportServer" /section:handlers /accessPolicy:Read,Script[LoadPerfCounterTextStringsW] Createprocess on appcmd.exe successfulNS_Sql2005::GrantReportServerPermissions[LoadPerfCounterTextStringsW] appcmd.exe exited successfully[LoadPerfCounterTextStringsW] appcmd.exe exit with a failed dwReturnCode 0x%x[LoadPerfCounterTextStringsW] appcmd.exe failedCOMHook_IWbemServices_CreateInstanceEnumIWbemServices::CreateInstanceEnum hookedNS_Sql2005::COMHook_IWbemServices_CreateInstanceEnumCOMHook_IEnumWbemClassObject_NextIEnumWbemClassObject::Next hooked NS_Sql2005::COMHook_IEnumWbemClassObject_NextCOMHook_IWbemClassObject_GetOSProductSuiteDisabling WEB SKU in OSProductSuiteNS_Sql2005::COMHook_IWbemClassObject_GetSuiteMaskDisabling WEB SKU in SuiteMaskNS_Sql2005::InitializeHooksMultiLOADPERF.DLLLoadPerfCounterTextStringsWWBEMPROX.DLLsMK.$Gy1WV~2@LJsMK.$E:K.$COMHook_ISqlManager_GetSnapinDescriptionCOMHook_ISqlManager_GetProviderCOMHook_ISqlManager_GetSnapinVersionNS_Sql2005MMCSnapin::InitializeHooksMultiOLEAUT32.DLLSysAllocStringSqlManager.DLL EQO ;VVB_C<*C(NS_Sql2005Sp1Extractor::InitializeHooksMultikernel32CreateDirectoryAComputerNameNS_Sql2005SetupComputerName::InitializeHooksMultiMsiGetPropertyW(ShimLib) Mitigation SuccessApiNameUnknown[ApiName] Mitigation SuccessNS_TerminateZTEFileAutExe::NotifyFnNS_TerminateZTEFileAutExe::InitializeHooksMulti")("%S%s%s%s ShimLib::GetHookAPIsShimLib [AppAndCommandLineT::Set] BEFORE App(%S) CL(%S) ShimLib::AppAndCommandLine::GetAppnameAndCommandlineCommon"[AppAndCommandLineT::Set] AFTER App(%S) CL(%S) [AppAndCommandLineT::Set] CL without App(%S) RSDSsRCdM?k AcSpecfc.pdbUGP.text$lp00acspecfc.dll!20_pri7 .text$mn.text$mn$00.text$np .text$x.text$zy'X.text$zz.rdata$brc.idata$5Г.00cfg.CRT$XCA.CRT$XCZ.CRT$XIA.CRT$XIAA.CRT$XIZ.cfguard.rdataP.rdata$zz .rdata$zzzdbg( .xdata`.xdata$xpd.edata.idata$2.idata$3.idata$4.idata$68.data$r$brc8.data$zz$brc .datax.data$dk00X(.data$zz.bss0@.bss$dk00p.bss$pr00\.bss$zz\.pdata`.rsrc$01`x.rsrc$02B!@(T 4 R p `!P@ t T 4241*p` CCc}}n9IjIj-2P  4 2p20    4 2p  4 2P4 r pR)8p((((  2PR r0R4)80)F)))  2PR2!4rpPؗr 11%1.l///04+ _p`0L3X34d3X@11112(2<2222222.3q33  rPRT4 r p `b!  td D8q8!4q88!q88!D8q8!td D8q8!D8q8T4 r p `  4 Rp1 ` p`0(@*@6@h<l=|=#>?????6@  PR( t d T 4 rB4 rpRPDD8CCCcDnDD  2PRPd T 4 r!t FF!FFd T 4 R!tJ>J@!J>J@ 0RxNNh8MKM^MNNN  PRx  0ROQ[QTgQhO'O5OO.Q9QDQgQ  PRdT4 !t H,I!H,IdT p!4J=K!J=K d4 p Pd 4RpRȘ]\\\d 4RpR[@[[[d 4RpRc\[&\7\+`@d T 4Rp0``bd 4  p t dT42  d 2p!4dqqX!dqqX4 Rp!dnn!nnd T42pd42 p  t 2!  d4jjܽ!djjܽ!jjܽ!djjܽB42p4 rpR@Mpoop)p6p d T 4 Rp2`!ttt!4tt!tt!tt  20  t4" "4 p `PRhzu,v|z R0RuuuuuuBuQu`uou~uu p`0R0R}Hz}H |||}%}R}_}z}}}  RPR  RPR4 rpR{H{{{{{  RPRT`!4~~8!~~8!4~~8!  t#kh!#kh!~~8!t4~~8%dQ4PL `P0 t dT42 02$YggAcSpecfc.dllGetHookAPIsNotifyShimsH08 ph В:X0Fjx\rXB(~fP:. ,bRvBH ^tn$.8Fv~`R$ )SE_GetShimId3SE_ShimDPFSE_COM_LookupSE_COM_HookObjectSE_COM_AddServerSE_COM_AddHookapphelp.dll_wcsicmp_wcsnicmpi_vsnwprintfmemmovewcsstrwcsspn`_vscwprintfxiswspaceU_XcptFilter_amsg_exitLfreemalloc}_inittermW__C_specific_handlermsvcrt.dll??1type_info@@UEAA@XZRtlAllocateHeapRtlFreeHeapNtQueryKeyRtlCaptureContextRtlLookupFunctionEntryRtlVirtualUnwindntdll.dllRegGetValueWRegOpenKeyExW#RegQueryValueExWRegCloseKeyapi-ms-win-core-registry-l1-1-0.dllvGetModuleHandleWGetProcAddressGetCommandLineWGetSystemDirectoryWSearchPathWSetEnvironmentVariableWCreateProcessWWaitForSingleObject<GetExitCodeProcessCloseHandle_ExitProcessFindFirstFileWvFindCloseuGetModuleHandleExWDHeapAllocGetProcessHeapTlsSetValueTlsGetValueTlsAllocTlsFreeGetVersionExWLocalFreeGetCurrentProcessIdHHeapFreeMultiByteToWideCharrGetModuleFileNameW%GetWindowsDirectoryWcExpandEnvironmentStringsWLocalAllocEGetFileAttributesWxSleepUnhandledExceptionFilteriSetUnhandledExceptionFilterGetCurrentProcessTerminateProcessAQueryPerformanceCounterGetCurrentThreadIdGetSystemTimeAsFileTimeGetTickCountKERNEL32.dllLsaOpenPolicyLsaQueryInformationPolicyLsaFreeMemory#EventWriteADVAPI32.dllCoTaskMemAllocCoTaskMemFreeole32.dllmsi.dllOpenPrinterWUEnumFormsWWINSPOOL.DRVK_CxxThrowException[__CxxFrameHandler3memcpymemset.?AVCStringError@CString@ShimLib@@t2-+] f@(P@$l,edp̽|.0@p4x@1HP4t`}lw(n(n((j(j(-(-((( 0 'T (](@p())!)0))))h)a+Th+,T,-@-v-Զ|-.T. 1x@1L3d33ȷ33@35T5 6ܶ6=7طP7z7l77l8>8@D8q8q8888 89 9 90 99@99X9:h:.;|4;<T<@6@Q@DX@ATAAlB"Bl(BCTCDtDDD,FT@FF̽FFFpGpGG0GHTH,I,II̻IIJ>J@>JJTJJhJ=K=KMM2M8MNxNOOOQ gQQQTTT6Z,