MZ@ !L!This program cannot be run in DOS mode. $X3Ў`Ў`Ў``8Ў`qaЎ`qaЎ`Џ`qЎ`qaЎ`qaЎ`qaЎ`qq`Ў`qaЎ`RichЎ`PELIW! 2'P @A@=0a,N`!P8`,?@.text=12 `.dataP6@.idata ` 8@@.didatpB@.rsrcD@@.relocJ@BPhPP,a5$$$$'@*, -./ /0/9:;;RespecializeSetupTypeSYSTEM\SetupSession0ViewerWindowProcHookwls0wndh.dllDisableS0ViewerSYSTEM\CurrentControlSet\Control\WinInitDefaultWinlogonWinSta0WINSTA.dllLte2AGl)9n?Y_|F3:SR IW'\\IW ,Software\Microsoft\Windows\CurrentVersion\Policies\SystemShutdownSessionTimeoutNULLū;8RSDS_`'Nl=UC$wininitext.pdbUGP.rdata$brc.CRT$XCA.CRT$XCZ.CRT$XIA.CRT$XIAA.CRT$XIZD.cfguard.rdata.rdata$sxdata.rdata$zz\$.rdata$zzzdbg`.text$lp01wininitext.dll!35_hybridboot$f .text$mnF/ .text$zy9.text$zz=\.xdata$x? .didat$24? .didat$3T?.didat$4h?.didat$6?.didat$7@=.edataP.data$dk00$brcP .dataP@.bssPS.bss$00XS@.bss$01S.bss$zz`,.idata$5,a.00cfg0a.idata$2Hb.idata$3\b,.idata$4cl.idata$6p.didat$5`.rsrc$01`.rsrc$02UQS] 3VWEfE$UulSE(`SE,dSE0tSE4SE8SE<\SE@xSEDQuMSEHhSELpSEPVu |SETSEufMWfl`Ph`W `9=TSu 9=PSur_^[]P̃=Su.2PSxTSSP=P̋UQUEft PP}u3]ø̋UQUEpE]̋U SVWEEPhjhh`hEPWEPjSu`tP=Pxu`_^[]̋USEEPjjhh`u8EEEPEEPEPjhhu`u`}ubVjjhL|`tKWh,Vx`t0S`t%jVWj8`XS3IS`Vt`_^3[]̋Ujh=h,dP$SVWP1E3PEd}EEEE ]Edup `jhjh`P<`֋u1uPhPPPh `VhVVVh `M >P=Ps uE guu}E ucE؉uP`3uuFE؉uP`3uu&VVEP7$`P=PEƋMd Y_^[]̋Ujh=h,dPP1E3ʼnESVWPEdDžx3|ƅd3eimqfuwEEfEEPWWWWWWWhjEP ajdPajjXEPajjuWjEPaWEPjdP a}dPxPV0`-E,EtPaNjMd Y_^[M3E ]̋UQSVWjjڋl`Pd`}Ehjl`Pd`G GWG ; R BG|SA'AWG R BG|SAA WG R BGSA'AWG R BGSAA WG R BGlSAAWG R BGlSAA WG R BGSAfAWG R BGSA A WG R BGxSAAWG R BGxSd0AA kUGQΉB_^[]̋Ujh=h,dPSVWP1E3PEd‹3}}PH 'EVEPS0`Q;ENjMd Y_^[]̋Ujh>h,dP(SVWP1E3PEd3}}lSEEESEE@EWM؅ESEPV0`wENjMd Y_^[]̋Ujh8>h,dPlP1E3ʼnESVWPEdEEE|SEEEESEEEElSEEEESEE EExSEEEd0dUMoEWEPV0`u<EƋMd Y_^[M3]̋UEVPEPEPV`z}tEtPjl`Ph`EVjl`Ph`^]̋UjhX>h,dP,E3uE wP} u=Puu9E t =HStNE} u Puu u,a׉EMEQPDYYËe3uu}Euu uEMEQPYYËe3uu}Euu uEMEQPYYËe3uu} }EVVuMEQPxYYËe3uEVVuHMEQPIYYËe3u=HSt4EVVu,aMEQP YYËe3uE t Euu uEMEQPYYËe3uu=HStG=Pt>Euu u,a׉EMEQPtYYËe3uuE E } w P̋UQP3ʼnEVu3;u sWu>t ,a׃;u r_M3^ ]; Pu%`%`̋UE3SVWH<AYt} p ;r H;r B(;r3_^[]̋Ujh>h,dPSVWP1E3PEdeEhtTE-PhPt:@$ЃEMd Y_^[]ËE3Ɂ8ËeE3Md Y_^[]̋UEMZf9t3]ËH<39PEu f9Q]̋UeePVWN@;t t У PjEP`E3EE`1E`1E`3EM3EEP`E3EM3;t5PuO@ Pщ P_^]3@ %`h,d5D$l$l$+SVWP1E3ʼnEPeuEEEEdËM3f̋Uuuu uh@*hP]̋UjT`uP`h `P`]̋U$Q QQ Q5Q=Qf0Qf $QfQfPf%Pf-P(QEQE QE,QhP Q$PP P(PjXkǀ,PjX P,PjX P,PjXk PLjX PLh]h,d5D$l$l$+SVWP1E3PeuEEEEdËMd Y__^[]Q%`̸ pQRPh?ZY̸p̸p̸p%`f,f @]xSpp AsyiPq<q 1 N PP~AtyjPq<q OP=Pt"@txrVp< p ]@~xtSVpp b PPaAWyMPq<q N 2\` PPtAtyr QPqq dW`P=Pt!@txrpp Wux\`uP=Pt@txrVpp <u/P=P@x Vpp P=P@xVpp[ \`uP=P@xVpp v\`uP=P[@QxGVpp 1@xypp _P=P@xVppi \`P=Pt@txr QVpp E C@EkdP`E\`P=Pt@txr Vpp E܃ @EkdP`Eu@x ppn]}ԋuE tP(`E t P(`P,`\`|P=P@xWpp|Ml}WG R BGpSAAls\`}P=P@xWpp`\`}P=P@xWppj}\`}P=P@xWpp\`}P=P@xWpp}UpSEEE\`uP=P@xVppq\`uP=PO@Ex;Vpp%uN PPAyPq,qBi PPAyqq, +EsP=P>@4x*pp, PPt$Atyrqq, E܋}؋uP=Pt@txrpp, áP=Pt@txrQpp, *똿}؋ PP Ayqq,ESP=Pt"@txrQpp,M]E܋}؋utMbWaPX`WVa PPt$AtyrVqHq 8_^@ xpH p3@xpH p̋U$P3ʼnE} S]t3(EE Pjj pVuu3^M3[] `;EtaWhjSEd`tCEPhWjujptEt tuNWjSh`}tN_{r̋U0P3ʼnEVDžPhjhhDžDž`u8PPPjh `u i`AhjP DžP`t } t tP`M3^h]̡XStP`XS̋U}Vupt} taEuPjpMMtHt)EPh`pt1=uE9EtEumMQPpE#^]%p̋V6jl`Ph`^̋UjjEPQRj+u u$a ] ̋UjQRj+u u$a]̋UjjEPQhj+u u$a ] ̋UjjEPj hj+u u$a ] ̋UQjjEEPjEPj hj+u u$a(]̃=TSu =PSu3ø̋UUtVqffu+^A <jPRjEPj h<j+u u`(]̋UPSjjETSEEPjEPjh<j+u u`(]̋U5Xu 5D`5XuhH`]3T<455tX6<8)''(-(\(p((((()#)U)i)))K+^+4SpT?????h?WinStationGetTermSrvCountersValueWinStationSystemShutdownWaitWinStationSystemShutdownStartedWinStationQueryInformationW`Wn@(@D@`@9$ -:;;}@@@@@@AWININITEXT.dllGetLoggedOnUserCountPrimaryTerminalAndHookWorkerStartLoadingFontsWorkerUIStartupWorkerUnregisterSession0ViewerWindowHookDllWaitForWinstationShutdownWinStationSystemShutdownStartedWorkerPN@D*ih*hJhZhrhhhhhhh igh|ididepe`e(dcNeFd4dbdd:e&ed|dcTddtddddTicccccciggggxgfgXg8g"ggffff -,cc`be`bed`ce`bet` cf`b4f`bXf`bfP`Lcg`dbi`\bDi`$ci`biD`*ih*hJhZhrhhhhhhh igh|ididepe`e(dcNeFd4dbdd:e&ed|dcTddtddddTicccccciggggxgfgXg8g"ggffffo_XcptFilter_amsg_exitfreemalloc_inittermmsvcrt.dllj_except_handler4_common#RegQueryValueExWHeapFreeRegOpenKeyExWGetVersionExWHeapAllocGetProcAddress FreeLibraryRegCloseKeyLoadLibraryExW-SleepQueryPerformanceCounter GetCurrentProcessIdGetCurrentThreadIdGetSystemTimeAsFileTimeGetTickCountUnhandledExceptionFilterSetUnhandledExceptionFilter GetCurrentProcessMTerminateProcessGetProcessHeapGetLastError SetLastErrorapi-ms-win-core-registry-l1-1-0.dllapi-ms-win-core-heap-l1-2-0.dllapi-ms-win-core-sysinfo-l1-2-1.dllapi-ms-win-core-libraryloader-l1-2-0.dllapi-ms-win-core-synch-l1-2-0.dllapi-ms-win-core-profile-l1-1-0.dllapi-ms-win-core-processthreads-l1-1-2.dllapi-ms-win-core-errorhandling-l1-1-1.dllREtwTraceMessageRtlAllocateAndInitializeSidRtlNtStatusToDosErrorRtlCreateSecurityDescriptor RtlCreateAclRtlAddMandatoryAce0RtlSetSaclSecurityDescriptorRtlFreeSid/TpSimpleTryPostRtlAddAceRtlSetDaclSecurityDescriptorRtlGetDaclSecurityDescriptorwRtlLengthSidRtlCopySidntdll.dllGSetWindowsHookExWsUnhookWindowsHookEx-SetThreadDesktopUpdatePerUserSystemParametersZSwitchDesktopRegisterLogonProcessxCreateWindowStationWSetProcessWindowStationcCreateDesktopWASetWindowStationUserNCloseDesktopRCloseWindowStation3SetUserObjectSecurity>LoadLocalFontsUSER32.dll=WTSGetServiceSessionIdKERNELBASE.dllTraceMessageResolveDelayLoadedAPIDelayLoadFailureHookapi-ms-win-eventing-classicprovider-l1-1-0.dllapi-ms-win-core-delayload-l1-1-1.dll memset/ /0/.0 H`4VS_VERSION_INFO 98 98?StringFileInfo040904B0LCompanyNameMicrosoft CorporationdFileDescriptionWinInit Utility Extension DLLn'FileVersion10.0.14393.0 (rs1_release.160715-1616)6 InternalNameWinInitExt.LegalCopyright Microsoft Corporation. All rights reserved.FOriginalFilenameWinInitExt.DLLj%ProductNameMicrosoft Windows Operating System> ProductVersion10.0.14393.0DVarFileInfo$Translation 00D0H0P0X00666666666777"7E7L7S7Y7a777777777718n8}8888889*939<9L9R9^9e9r99999999A:W:]:n:::::::4;T;s;;;;;;^8>\>>>>??/?r????? P060x0}00000 1%1n11112282=2O222222+3W3^3u33333364=4O4V44444444445 575E5J5i5}555555556 66?6S6g666666666666S7q7}777789v99999:B:X:d:::::;;;;<<>">->3>?>O>X>m>>>>>?!?1?B???????0P0V0\0000000001#1(1a1f1111112%2*2y222222 333#3W33333344j44444445(5-5c5m5r5555566$6b6h6666666 7!7'7@7]7b7{777777788!8\8c8p8x8~88889A9k99999:9:Y:e:::::;>;[;;;;;;<90>P>p>>>>>>>>>>>>>>>>>> ??P 0` ,1p000 0`!0!Q *H !B0!>10  `He0\ +7N0L0 +70 010  `He Y%H2C}hN½0Hu 003 |0  *H  01 0 UUS10U Washington10URedmond10U Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20110 150818171528Z 161118171528Z0p1 0 UUS10U Washington10URedmond10U Microsoft Corporation10UMicrosoft Windows0"0  *H 0 >_h~ELj\\A@ŽyBOm $7_6 {FF񪻫n}$WD=OclGQ0{n̡t+1ޘB"v9{4.ZY,“mQkTS!AS1i1) 9w|CҭE‹e wIǺQQ9g( $ TϩKt*|eqX7Wn298a?7ѲGVwI0{0U%0+ +7 0UI DP/oMT0QUJ0HF0D1 0 U MOPR1301U*31612+85cef474-af76-4076-90ff-a35e1e23d7de0U#0)9ėx͐O|US0TUM0K0IGEChttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a+U0S0Q+0Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0 U00  *H  `t:, u'G+?4ϝPheSFޭl&!Oe;0%̀T܍ cTYy#5~-OdI)Y \vjL5'߽PnӐ} _2#s{BP$-@B{p|/gc[ډuVmnaƛR'V65n7+arQoe`iܽ4TP(3&,9҄ "QܝDu׷00 avV0  *H  01 0 UUS10U Washington10URedmond10U Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100 111019184142Z 261019185142Z01 0 UUS10U Washington10URedmond10U Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20110"0  *H 0  . i!i33T ҋ8-|byJ?5 pk6u1ݍp7tF([`#,GgQ'rɹ;S5|'# oFnhttp://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0  *H  |qQyn9>\` QfG=*hwLb{Ǻz4KbzJ7-W|=ܸZij:ni!7ށugӓW^)9-Es[zFX^gl5?$5 uVx,Јߺ~,c#!xlX6+̤-@EΊ\k>p* j_Gc 26*pZBYqKW~!<ŹE ŕ]b֠c uw}=EWo3wbY~10001 0 UUS10U Washington10URedmond10U Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20113 |0  `He0 *H  1  +70 +7 10  +70/ *H  1" =&7Op=OEh9が0Z +7 1L0J$"Microsoft Windows" http://www.microsoft.com/windows0  *H =pwo5"9a!9Fyu#t H7gB]<~Z%OۅatD 3yc܇|`HV VQE i`[a(\0K'Y7|6_>{?"*k^ kvYc1"mc䖛kW.C+UbH122j>z%W $P _}TOĂxH!*۽cs[52M0I +71905 *H &0"10  `He0= *H  ,(0$ +Y 010  `He 鑬hqǹ;/ QV#g=>Wi~20160716015439.259Z001 0 UUS10U Washington10URedmond10U Microsoft Corporation1 0 U MOPR1'0%U nCipher DSE ESN:B1B7-F67F-FEC21%0#UMicrosoft Time-Stamp Service0q0Y a *0  *H  01 0 UUS10U Washington10URedmond10U Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100 100701213655Z 250701214655Z0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100"0  *H 0  w: iktTե |hK,_av>f+[S'1A |a0Y0D`TC M8Bݓs0W&E GͿ$`2X`FXG2tag_TϓLĦ]an(aF'$gr!KdPb]w=WuBM@Q>gfD~Knʱz* 1N5xhttp://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0U 00 +7.00=+1http://www.microsoft.com/PKI/docs/CPS/default.htm0@+042 Legal_Policy_Statement. 0  *H  Q ?q=!o1Wm0fjxǨ%kTW+QDS`v@@A\\^5$VKtBȯ7}Z?yJR8/ye٩kzoK0D$"<Y)p2J'U/3b_W@ΙfjbJ &9Jqc{!mÜ<}jxm8ؔƥ B"8 %d~cY%z.9Wvqa˚Gͧ};q ]t"aڰPo1:eGxHr~akow˧ 9؂r*T9[ Uzs;-3.)/T'!ȬN(ۖBAM*f0ӻt2Kc{/!YDhttp://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0 U00U% 0 +0  *H  \̆ʬbnw'Xoy=ҪSWtDn!tC$}`!U_ȉU¸xC+f:pi`x=mA1ɵ1oJRI(֪tx7hw_T5ݾOiѼTm9f)`%j~qյԋv/!h@"!@__u, =E2J(Fx -2o5y0a0㡁01 0 UUS10U Washington10URedmond10U Microsoft Corporation1 0 U MOPR1'0%U nCipher DSE ESN:B1B7-F67F-FEC21%0#UMicrosoft Time-Stamp Service% 0 +UT ʻn%7^Ņ6KP)001 0 UUS10U Washington10URedmond10U Microsoft Corporation1 0 U MOPR1'0%U nCipher NTS ESN:4DE9-0C5E-3E091+0)U"Microsoft Time Source Master Clock0  *H 3C0"20160715165635Z20160716165635Z0w0= +Y 1/0-0 3C0 p00 406 +Y 1(0&0  +Y  0` 0 0  *H z4,LK1x~c+urNkbJy3W@ f$@ym~}ްQ~Vbq*Tj)^i:Hۧau-:9.]c# 9X? .s/$>;N;K#nGw2N/mi²Ǻ+l$vFQ5*FZ{G;D <E$sĆ:_ˠD5O+$+JR}xvgCoWHV=4딛1000|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103\t=0  `He20 *H  1  *H  0/ *H  1" p9ӼF=* ]gg0 *H   1000UT ʻn%7^Ņ6KP)00~0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103\t=0~yoKI`sE"1 TJ0  *H  $J[5>Ϣy{ع .;=z'ku핿RTMuoE{ZZNp΋$fPC5ƖN̝`5zN`p[L]ed#*i97 T]勏Xh* Z]_hGK:  NnIj/Z-ˌ0)8ס'92")i>GX6:7Pu EuԽQ&6aelNZr2