MZ @ !L!This program cannot be run in DOS mode.
$ yu=&=&=&ـ'?&4N& &=&E&ـ'?&ـ'1&ـ'<&ـ'8&ـ &<&ـ'7&ـ"&<&ـ'<&Rich=& PE L lU ! @ P@ P
!s @A L @ `.data @ P D @ .idata d ` F @ @.rsrc p R @ @.reloc V @ B PP 8a u P Q < < @ ( ( `) `* * + P+ + , P, , - `- - P/ P9 9 < < < P@ @ @ F lU &
lU
lU $
F D 8 8 . 0 1 1 &< 3H CH H H GI I I I I
J J p p T t, F a J K ETW0 + @ " AttemptDisallowedSubkeyAccess @ B AttemptedWowRedirection(Aggregate) Count qFlags FuncId @ > DisallowedOptions(Aggregate) Count qOptions FuncId + AttemptedWowRedirection Flags FuncId @ I BadAccessMask(Aggregate) Count qAllowedAccess
RequestedAccess
* AllowlistMatch RootKey RelativePath @ 6 AllowlistMismatch(Aggregate) Count qRootKey I BadAccessMask AllowedAccess
RequestedAccess
RootKey RelativePath - AllowlistMismatch RootKey RelativePath @ A AllowlistMatch(Aggregate) Count qRootKey RelativePath ' DisallowedOptions Options FuncId TlgAggregateSummary Provider NumFlushes
MaxEntriesStored
TotalEntriesFlushed
MaxEntriesFlushed MinEntriesFlushed NumBucketLimitReached NumAllocationFailures NumLargeEventFailures >3.O|zБ? Microsoft.Windows.Kernel.Registry.FromApp sPOωGv?pohX8 < Microsoft.Windows.TlgAggregateInternal sPOωGv RSDSȃ@3(gy@ reguwpapi.pdb GCTL .rdata$brc .CRT$XCA .CRT$XCZ .CRT$XIA .CRT$XIC .CRT$XIZ .CRT$XPA .CRT$XPZ .CRT$XTA .CRT$XTZ .gfids p h .rdata .rdata$sxdata .rdata$voltmd p .rdata$zETW0 .rdata$zETW1 # .rdata$zETW2 .rdata$zETW9 H .rdata$zzzdbg .rtc$IAA .rtc$IZZ .rtc$TAA .rtc$TZZ @ .text ` `. .text$mn K .xdata$x L .edata P P .data$brc PP 0 .data P .bss ` 8 .idata$5 8a .00cfg Nj^ u >^ 9 s > _ ^^[̋SVW2OwAxAu?Auy6Ay)u"Ax uB<wLjT-;r_^[̋U SVWM}qtYGwwquru9u e|9]s^ 9u |W9]vPM }ËuS[u};u;t+M믋1ދQ]ʋ}M U;u;Uu_^[ ̋U SVuWjFEPG}Pv uRv!ÃE;s?M +MM+9u$73w5 uMF;ur3_^[ ̋U ESډM3ɉщMMVWt/M<s1:r= v
P "< Vj ` P` E! uM2E UEtZ3ɋ}
Es
1WMxR7VE M Ua 1G A GA;Mrj"ZM=uȋEU MAEQ!Y A :siMjyX+*ډEË]EMRwV K U4
d
KGD
KmD
uME3jX_^[ ̅tVq ` Vj P` ^̋U SV5$P MWU3ۋU 3!]j]]}kME:s&} *wMCu]kM 3i E PE` M : UuS ? u.UEPQuMu c]}]tIU썾 3
tOM:;O t+G U MWMtq Wtu 33@@u }9 s] U HtAEjXM;v.P[E OT
p0>;urً]}u` t_^[ ̋UVWtPG!jZ;vj YGIBD G!;|wG Pj j Wu ua wu_^] ̋U SVW< u3t P` E$ 3]t,ˋQa UȋJuUGu) P` r r _^[̋UQSVW39 t; E< t9؋EF ;trߋӉ _^[̋UtPP 3ʼnE MSVW Cj ][ =(P h S(P M}Y p E䋁 E E܋ E؋ Eԍ EЋ EEE̍ EȍEEčEPE]PEPEPEPEPEPEPEPQQj
Y3}}uj
YMMC rM_^3[ ̋UQV tƆ < t ^]̋U} VWu<} u6} u0S W` t 5S
, uW` _^]$ ̋UVu(W t( u$u u uuuu u8a ׃} u
} uQ_^]$ ̋VuP3ҹ P SW3ۿ P Ή V9 qyΉ P )TS W` S uSP9 (P 5S S P t u1W` 3_[^ ̋UQ= P 9 SVWt P 3S S`
S S P t
Ћ
u8 e9=S u%DP
@P PQ=(P =@P =DP a S` t P &Ή= P _^[]̋U BEVuWE3jYыEBEP ~P FN V~F -p F = P 9 E
u=M EtuUVQ VPWWEP5 P 5P a _^ HH HH3̸P ̸P HHHH3̋UE t3t tt3@0p D uu Y} P Y] jh L ) j Y v E]e =P P tMp h h YYu)[ t h h } YYP 2ۈ]E= uC > t V Ytu ju68a P 3@]uE Y3Md
Y_^[j jh L P 3iHP 3G}e \ E}=P uk; %P e 9 j u YY#uE" ƋMd
Y_^[Ë}u YËu j j hHL f } u9=P 3 e t
t]1]SWu u SWuu SWuuu"u SPuSVuPSVup tuHSWu3ut5SWuJ $MQ0h< uu u Ëe3uEƋMd
Y_^[̋UV5p u3@uu u8a ^] ̋U} u uu u ] ;
PP u ̋Ue Ee P` E3EE4` 1E@` 1EEPP` EM3E3E3̋
PP VWN@ ;tu&;uO@u
G ȉ
PP _
TP ^hP $` hP Y-H$H+HH̋UEVH<AQAk(;tM ;J r
BB ;r (;u3^]Ë̋VU t d P P;t3u2^ð^ t/ PJ Yt2U j Yo u2c uZ J E ̋U u} uuMPu8a Uu u YY]e t hP Y ~ j Y ̋U} uP 1 u2] u
j Y]̋U=P t]Vutub t&u"hP YuhP Yt+20
P
P
P
P
P
P P ^]j jhhL e MZ f9 u]< PE uL f9 u>E +PQgYYt'x$ |!E E 3Ɂ8 ËeE2Md
Y_^[̋U t} u 3P ]̋U=P t} uu u YY]̸S ̋U$ SjH` tM)j $ j P |xffftfpflfhEEDž @jPEj P E E @E E ` j XۍEEۉE ` EP` u uj
Y[̃%P ̋SV ;sW>t
8a ׃;r_^[̋SV ;sW>t
8a ׃;r_^[hF d5 D$l$l$+SVWPP 1E3PeuEEEEd ËMd
Y__^[]Q̋UVu6 uuu Vh@ hPP ^]̋Uj ` u` h 8` P<` ]̋U$ jH` tjY)Q
Q Q Q 5Q =Q fQ f
Q f Q fQ f%Q f-Q Q E Q EQ EQ Q Q P P P P jXk ǀP jXk
PP LjX
TP Lh ̋U%S $
`P j
H` e 3SVW3ɍ}S[wO3ɉW E܋}EntelE5ineIEE5GenuE3@S[]܉Es EKS uCE%?= t#=` t =p t=P t=` t=p u=S =S =S MjXM9E|03S[]܉sKMS ] t=S ]`P S `P S `P ty tq3ЉEUEMj^#;uW`P S `P t; S `P #;u E M#;u
`P @5S _^[33@39dP %a % a %` %` %` %` %` %` %` % a %` ̰3̋UQ=S |f} t } uT]E?t? u é t* u é u é u ø ËE̋D$L$ ȋL$ u D$ S؋D$d$؋D$[ %` %`
/ / :0 M0 +> > > ? ? FD YD lU DM L L (M - ( `* `- * + P+ , ( `) + - , P, RM eM yM M M M M M M N N /N MN bN
reguwpapi.dll RegCopyTreeFromApp RegCreateKeyFromApp RegDeleteKeyFromApp RegDeleteTreeFromApp RegDeleteValueFromApp RegEnumKeyFromApp RegEnumValueFromApp RegGetValueFromApp RegLoadAppKeyFromApp RegOpenKeyFromApp RegQueryInfoKeyFromApp RegQueryMultipleValuesFromApp RegQueryValueFromApp RegSetValueFromApp 4 N@D *f >f Zf g h ,i f e e f f e xf e f f f f ~g g g g g g "g Vg Fg 4g g h h fh g g i e .h h h h ,d Nd Zd vd d d Zk d d Pk c c d Ph hg h i Re ve `e @ c
d a c e ` c 0e a c e (a b >i ,` c hi P` b i 4` pc i ` b i $` b j ` b $j ` c Nj H` c xj X` c j a Lc j ` Tc j ` b
k ` xc *k ` *f >f Zf g h ,i f e e f f e xf e f f f f ~g g g g g g "g Vg Fg 4g g h h fh g g i e .h h h h ,d Nd Zd vd d d Zk d d Pk c c d Ph hg h i Re ve `e 8 _initterm 9 _initterm_e api-ms-win-crt-runtime-l1-1-0.dll _o___std_type_info_destroy_list _o__cexit _o__configure_narrow_argv _o__execute_onexit_table c_o__initialize_narrow_environment d_o__initialize_onexit_table _o__seh_filter_dll memset 2 _except_handler4_common api-ms-win-crt-private-l1-1-0.dll api-ms-win-crt-string-l1-1-0.dll NtQueryKey TNtSetInformationKey RtlNtStatusToDosError ntdll.dll DisableThreadLibraryCalls QueryPerformanceCounter
GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter 1 IsProcessorFeaturePresent GetCurrentProcess T TerminateProcess % RegQueryValueExW RegEnumValueW RegDeleteValueW RegGetValueW RegOpenKeyExW RegCopyTreeW . RegSetValueExW RegDeleteTreeW RegEnumKeyExW RegCreateKeyExW EventWriteTransfer ! RegQueryInfoKeyW RegDeleteKeyExW RegCloseKey RegLoadAppKeyW # RegQueryMultipleValuesW InitializeSRWLock HeapFree 1 TryAcquireSRWLockExclusive EventUnregister " WaitForThreadpoolTimerCallbacks EventSetInformation $ ReleaseSRWLockExclusive CloseThreadpoolTimer AcquireSRWLockExclusive SetThreadpoolTimer % ReleaseSRWLockShared CreateThreadpoolTimer HeapAlloc EventRegister AcquireSRWLockShared GetProcessHeap api-ms-win-core-libraryloader-l1-2-0.dll api-ms-win-core-profile-l1-1-0.dll api-ms-win-core-processthreads-l1-1-0.dll api-ms-win-core-sysinfo-l1-1-0.dll api-ms-win-core-interlocked-l1-1-0.dll api-ms-win-core-debug-l1-1-0.dll api-ms-win-core-errorhandling-l1-1-0.dll api-ms-win-core-processthreads-l1-1-1.dll api-ms-win-core-registry-l1-1-0.dll api-ms-win-eventing-provider-l1-1-0.dll api-ms-win-core-registry-l1-1-2.dll api-ms-win-core-synch-l1-1-0.dll api-ms-win-core-heap-l1-1-0.dll api-ms-win-core-threadpool-l1-2-0.dll memcmp memcpy 0 H `p 4 V S _ V E R S I O N _ I N F O
|O
|O? S t r i n g F i l e I n f o 0 4 0 9 0 4 B 0 L C o m p a n y N a m e M i c r o s o f t C o r p o r a t i o n J F i l e D e s c r i p t i o n U W P R e g i s t r y A P I h $ F i l e V e r s i o n 1 0 . 0 . 2 0 3 4 8 . 1 ( W i n B u i l d . 1 6 0 1 0 1 . 0 8 0 0 ) < I n t e r n a l N a m e r e g u w p a p i . d l l . L e g a l C o p y r i g h t M i c r o s o f t C o r p o r a t i o n . A l l r i g h t s r e s e r v e d . D O r i g i n a l F i l e n a m e r e g u w p a p i . d l l j % P r o d u c t N a m e M i c r o s o f t W i n d o w s O p e r a t i n g S y s t e m >
P r o d u c t V e r s i o n 1 0 . 0 . 2 0 3 4 8 . 1 D V a r F i l e I n f o $ T r a n s l a t i o n T <0@0H0P000000:::#;;;; <*C>o>t>>>>(?-?w??? 11 1C1v111113Y4g4444J55556*6Q6e6j66666)7.7V777/8e88@99D:::9;;;3<<>>?$????????? 0
00!0'0T03
3W4a4y44=6668777
8%8m9t9~999-:@:_:z:::::::::::: ;;; ;%;1;T;[;a;i;o;u;{;;;;;; << <"<]">[>e>s>>>?#?? @ "0<000000 1:1C1P1V1b1122 3Y333333333333 444"44444555666*6F6K6^666
770797D7K7f7t7z777777777777777777788 8/8?8H8`8j8s8 9%9-9i9s9|999999999 :$:C:S:_:k:w:::::::::;;;;;;<8 SO\MgT[k
Dz+,73Z7mJL}(| VC#{g6#O_zц<]겥~+ڍo>3=ja{BTxҞ㞼CI*
f g X\\00
avV 0
*H
01 0 UUS10U
Washington10URedmond1 0 U
Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100
111019184142Z
261019185142Z01 0 UUS10U
Washington10URedmond1 0 U
Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20110"0
*H
0
. i !i33T ҋ8-|byJ?5 pk6u1ݍp7tF([`#,GgQ'rɹ ;S5|' # oFnhttp://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
*H
|qQyn9>\` QfG=*hwLb{Ǻz4KbzJ7-W| =ܸZij:ni!7ށugӓW^)9-Es[zFX^gl5?$5
uVx,Јߺ~,c#!xlX6+̤-@EΊ\k>p*
j_Gc
26 *pZBYqKW~!< ŹE ŕ]b֠c uw}=EWo3wb Y~10001 0 UUS10U
Washington10URedmond1 0 U
Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20113 ,EEHD 0
`He 0 *H
1
+70
+7 10
+70/ *H
1" a#ΆHBE=McRQe0<
+7
1. ,ttYtZiBX1xl81F7SvE5N0By962I2A5f/Pgf1y2/31Dw=0Z
+7 1L0J$" M i c r o s o f t W i n d o w s" http://www.microsoft.com/windows0
*H
nb_&x#rVJyG[vwH e9 lg4jxgYL/'Nv&qaZiFm0
+710 *H
010
`He 0U *H
D@0<
+Y
010
`He Sek$ #[WwOJ`\L20210508002945.609Z0Ԥ01 0 UUS10U
Washington10URedmond1 0 U
Microsoft Corporation1)0'U Microsoft Operations Puerto Rico1&0$U Thales TSS ESN:7880-E390-80141%0#U Microsoft Time-Stamp ServiceD00ݠ3 \98 \0
*H
0|1 0 UUS10U
Washington10URedmond1 0 U
Microsoft Corporation1&0$U Microsoft Time-Stamp PCA 20100
210114190217Z
220411190217Z01 0 UUS10U
Washington10URedmond1 0 U
Microsoft Corporation1)0'U Microsoft Operations Puerto Rico1&0$U Thales TSS ESN:7880-E390-80141%0#U Microsoft Time-Stamp Service0"0
*H
0
*+>* b@h\ L ڷL82|mOlgs f%e 9>w:.q :/KF 9In `ڀdxIWkJMS`-1ILj Vji/ρS(vN:Lc2߈5a0- k!Xm@cȧy)G6֓#'Y po{S1> |BRPן@~S6 00 U _9(r{-c>0 U #0c:\1C{|F3hZmU0VU O0M0KIGEhttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z+N0L0J+0>http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0 U 0 0U % 0
+0
*H
xyL~ s #2zO B7uEBfVLuKp:j6,W+ӓ44r6|5N+[m6@u⋍塟Zжh$Q;NhmR !c }vzew A"cI@yu|B1yX``>FLP`
.){e5G Zl>[\ &PV.63C F 3oCdqI0q0Y
a * 0
*H
01 0 UUS10U
Washington10URedmond1 0 U
Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100
100701213655Z
250701214655Z0|1 0 UUS10U
Washington10URedmond1 0 U
Microsoft Corporation1&0$U Microsoft Time-Stamp PCA 20100"0
*H
0
w: iktTե
|hK,_av>f+[S'1 A |a0Y0D`TC M8Bݓs0W&E
GͿ$`2X`FXG2 tag_TϓLĦ]an(aF' $gr!KdPb]w =WuBM@Q>gfD~Knʱz*
1N5x http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0U 00 +7.00=+1http://www.microsoft.com/PKI/docs/CPS/default.htm0@+04 2 L e g a l _ P o l i c y _ S t a t e m e n t . 0
*H
Q
?q=!o1Wm0fjxǨ%kTW+QDS`v@@A\\^5$VKtBȯ7}Z? yJR 8/ye٩kz oK0D$"<Y)p2J'U/3b_W@ΙfjbJ &9Jqc{!mÜ<}jxm 8ؔƥ
B"8 %d~cY%z.9Wvqa˚Gͧ};q ]t"aڰP o 1:eGxHr~akow˧ 9r *T9[
Uzs;-3.)/T'!ȬN(ۖBAM*f0ӻt2Kc{/!YD58&1
0 00|1 0 UUS10U
Washington10URedmond1 0 U
Microsoft Corporation1&0$U Microsoft Time-Stamp PCA 20103 \98 \0
`He J0 *H
1
*H
0/ *H
1" ջU*1P!W{~cq.G0 *H
/1000 O-dW Ol 0I̤ +P=. Fo\ 00~0|1 0 UUS10U
Washington10URedmond1 0 U
Microsoft Corporation1&0$U Microsoft Time-Stamp PCA 20103 \98 \0" 4BŔ!%6ӓp .o :K0
*H
/'Kz R2jfK]:c%jֶi.|+&s e]r@WԜ)C~0_S8MG2&M="wW\ιM>.w!Zh8 w3h3V ;q) {Mx>
@lBeLc2@Nto\lGz<}Ǜ©-5_'pb='7sQx1E2U g Md$|+s