Hacked By AnonymousFox
MZ @ !L!This program cannot be run in DOS mode.
$ {yc?
?
?
6`
Z~=
Z~ /
? H
Z~ :
Z~3
Z~
>
Z~8
Z~>
Z~>
Rich?
PE L k !
> 0
@A 0 P/ T h .text < `.data @ .idata @ @.rsrc @ @.reloc 0 @ B 0 X ` ! ! ! o ! ! ! R ! " " " ! 7 ! d ! " 0" p D" P ! X" ' D" ! ! t" 0" { 0" ! " " 0" ! " " " n " a ! " " X" " " " ! " " ! ' # @' $# A' 4# ?' L# 5' l# ' # E' # M' # F' # 7' # ' # Q' $ 4' $ ' 4$ &' @$ H' T$ (' h$ 8' |$ O' $ B' $ D' $ C' $ G' $ :' $ I' $ 6' % =' % ;' 0% 9' H% L' \% 3' h% f % d % e % q % % ! % & & h ,& 8& j D& g X& k x& l & " m & ! ) " & ! & & ! ( t" n & o & * ' (' 4$ 0" L' " \' s l' t |' u ' v ' w '
' y ' ' " x ' z ' { ( D" | ( (( ! X" D( T( d( } t( ~ ( " ( i " p ( ( ( ( )
! ) ) 8) $ P) " " p) ) ) ) ) ) " ) r ) * (* p; 09 @9 P9 `9 = G I PJ J J L @L F `E D P j m ` | Ђ V V x Ђ ] p p `] ] ] Ђ j m ] ] ] `] ] ] ] ^ 0^ `] ] ] ] `^ p^ ^ ] ] D p p p V V $, D, / p g u t! \ 8 P \ 8 P @ @ @ , M @ @ ( T \ 8 P ( 4 ` @ l @ $ 8 P @ @ x T 0 < 4 @ ( @ x X @ D 4 \ @ \ x @ X D @ ` @ ( 0 @ $ d | < x ` @ 4 4 ` X @ $ @ @ 0 $ @ x @ P $ ` $ 4 $ t @ @ @ X @ \ @ h ` ` @ 4 $ @ D ` h @ @ @ 4 @ X $ @ $ d @ | h @ @ @ 7 p6 6 6 @7 P7 `7 `4 p6 6 6 7 @7 P7 `7 7 09 @9 P9 `9 : p; < < = = A `B B B B `E F 0F PF `F F G G I J PJ J L @L L 0O O O P P Q R 0S T `V pV V V ] `] ] ] ] ] ^ 0^ `^ p^ ^ i j m m s | 0~ Ђ P ` 0 @ p 0 @ P ` p 0 P ` p bad allocation F permission denied file exists no such device filename too long device or resource busy io error directory not empty invalid argument no space on device no such file or directory function not supported no lock available not enough memory resource unavailable try again cross device link operation canceled too many files open permission_denied address_in_use address_not_available address_family_not_supported connection_already_in_progress bad_file_descriptor connection_aborted connection_refused connection_reset destination_address_required bad_address host_unreachable operation_in_progress interrupted invalid_argument already_connected too_many_files_open message_size filename_too_long network_down network_reset network_unreachable no_buffer_space no_protocol_option not_connected not_a_socket operation_not_supported protocol_not_supported wrong_protocol_type timed_out operation_would_block address family not supported address in use address not available already connected argument list too long argument out of domain bad address bad file descriptor bad message broken pipe connection aborted connection already in progress connection refused connection reset destination address required executable format error file too large host unreachable identifier removed illegal byte sequence inappropriate io control operation invalid seek is a directory message size network down network reset network unreachable no buffer space no child process no link no message available no message no protocol option no stream resources no such device or address no such process not a directory not a socket not a stream not connected not supported operation in progress operation not permitted operation not supported operation would block owner dead protocol error protocol not supported read only file system resource deadlock would occur result out of range state not recoverable stream timeout text file busy timed out too many files open in system too many links too many symbolic link levels value too large wrong protocol type A P P I D uqiuuMrx- F# FF Fn t d l l . d l l k e r n e l b a s e . d l l Exception ReturnHr LogHr FailFast % h s ( % d ) \ % h s ! % p : % h s ! % p : ( c a l l e r : % p ) % h s ( % d ) t i d ( % x ) % 0 8 X % w s M s g : [ % w s ] C a l l C o n t e x t : [ % h s ] [ % h s ( % h s ) ]
[ % h s ]
RaiseFailFastException RtlNtStatusToDosErrorNoTeb %ws .҂bD=/$sX6=Ӈr FRJCW rinternal\sdk\inc\wil\resource.h false true generic unknown error iostream iostream stream error system N U L L NULL onecore\amcore\antimalware\source\amsi\com\amsiantimalware.cpp S o f t w a r e \ C l a s s e s \ C L S I D % s \ % s \ I n p r o c S e r v e r 3 2 DllGetClassObject S o f t w a r e \ M i c r o s o f t \ A M S I \ P r o v i d e r s S o f t w a r e \ M i c r o s o f t \ A M S I \ U a c P r o v i d e r s exeApplicationName exeCommandLine exeDllParam comServerBinary comRequestor invalid string position string too long M 4$U@ezJKG* x{0 )[y~yWwRdcdʲBԃ% kW* RIB' gʲBԃ%u&7 :#*^EG>ԁ;MTPws k ! (1 (% k
L1 L% k @ ' M H p Ϧ T ç ETW0 + @ 7 AmsiProvider Guid Duration
Context CurrentTotal @ : AmsiUacScan ProviderIndex Guid Duration
Hr Result @ 7 AmsiScan ProviderIndex Guid Duration
Hr Result zE : Microsoft.Antimalware.Scan.Interface sPOωGvRSDSog_MXV
h Amsi.pdb GCTL .rdata$brc 4 .rdata$r$brc @ .CRT$XCA D .CRT$XCL H .CRT$XCU ` .CRT$XCZ d .CRT$XIA h .CRT$XIAA l .CRT$XIZ p .gfids t! .giats ! 0 .rdata / P .rdata$sxdata 0 .rdata$zETW0 0 .rdata$zETW1 0 K .rdata$zETW2 '1 .rdata$zETW9 (1 8 .rdata$zzzdbg `4 .text p6 .text$di p7 m .text$mn ? .text$x 0 ` .text$yd .xdata$x ATL$__a ATL$__m ATL$__z .edata .data$brc X .data$r$brc .data .bss .idata$5 .00cfg .idata$2 .idata$3 .idata$4 &
.idata$6 .rsrc$01 .rsrc$02 Ujh d PSVW 3PEd E(teM } ] U t*u(tA MHMH Xx Mp t p$u$WSQuRu u Md
Y_^[]$ SQQUkl$ 3ʼnEV5 EW}h( vh h`4 P%0 %4 0 t
~*
PQj5, 5( ( M_3^e ][ËU'1 0 MEBEBVE3B E q Qu AA QqVAEVPA 5, 5( $ ^]
3V @ # t
$ #; u;u^ ̹x h / y
l $ j h0 h Mf Y `B B B B PF `F ̹p y
` ( hP e Yh e Yhp e Yh` e Y̋;u A;BuA;Bu A ;B u3@3j j jh < j h yi 3uQ E 3Ɂ8 Ëe uEi ËUQ=` tXl W=h ;s5VMt#QtRp Ma l ;r^hp %` _]ËUl W=h ;s$V7tv u ֡l ;r^_] UQSW_; td Vt8t_Ct%؋3s sS\ Yu_c g O(tQp ֍GP # ^_[]q3@A@̃AH̋A̋US]u@ ?VW3q(9>uVh|* jWhl* x Qr _^[] U E8 u _Vu u@ O& 3Wx@ E; S t9stdu&E;r} [? _u u^] {97u7EPE 397usWh\* s u } tWu0Q 뉋} ̋UQES3Vu EWttjWXHÊ#u WS WSE UFt Nt^~VF 3_^[] UQQV5 W8 ,Fe Pj j EMPjQVh: N 6u_^]Ë̋Ujh d PV 3PEd j EtV\ YƋMd
Y^] UQE S3VW+tE P @ X \ 8 L* @ ph x5, 5( , 5 ( , ;t6 F F tv v ^^ 6u= } u8 u3C_^[] ̡h Vp h ^̋UuU` u ] ̸2 ̋UEVh<* h@* Pq ^] ( uh* t ( ËUV3tvW xAt(W+U+э7t
tAu_uIz t ^] UE 3Ʌt=vW xMQuQM tE3f]ËUSVWuru 3VW x;wu
z 3fw_^[] UE Vu+t=wMQuQ t3f9u tQffu+4N^]ËU 3ʼnESًVu W= 3f t 8
tPSV 3f9 Dž* +t3t"tu.Dž* "Dž* Dž*
Dž* Q3h fPh vQh | ~ vHvD<Ctv v h* WS h+ WS~L tvLh$+ WS؍Pv Pv$h@+ WSZ3Ƀ 9N u9N(u 9N ht+ WP6 ~ tv h+ WP ~( tv(h+ WP~ tvvh+ WP)~ tvh+ WPh+ WP _M3^3[Z ] UESVW& f X8 t>^_^[] Vt!u6j X P\ & f ^ËUSVu مu KWFPj X PT u2,' } tVuGVP y;s_^[] ̋UE, 3@] U 3ʼnES]3VuW} tPVjp t1t +#7tSh PQl u2:QAu+ʍx\t H;wUP M_^3[ Y ] ̀= V uj@Vj hA ^%$ ̋UVh+ h* t Ph tuu u ^] ̋UV5 u h, NPh 5 t
u ^] UE V3t=vW x6S]MWQux3WPSd x;wu z _[
tM ^]Åu3@ÍQAu+ʍAÅujXÍQffu+M ËUQS]VWjY}K K@K4K<K0~K(tK jK`KVKDL}GPt
9u9wTsVj OPGPPA#ȋލ#G Ps OQs OQs O Qs O(Qs( ODQsD O<Qs< O@Qs@ O0Qs0 O4Qs4 _^[] UVW uN 4 3yPyTq~dƉ~h_^] ̋U Q_ 3ʼnEVqduZA PPh , h PkQAu+ʍAPP0H^#M3U ]̋UV# EtV\ Y^] ̋VNdN\^% j j M^ ̋UlMuhH EP%^ ̋UQS]VWSu V 4 jC YPPJPuCdPNd_^[] Ujh' d PQSVW 3PEd 3 E9H v._ t# Qp E@E;H rՃH P T tRQ, hG jjGPyT Md
Y_^[]̋UV6EtV\ Y^] ̋Ujh d PV 3PEd tQp Md
Y^]ËUj QRj+u u ] Uj jEPQRj+u u ] Uj jYQE PQEPQEPQEPj
h4, j+u u 8] Uj jE PjE PjEPjEPjh4, j+u u 8] Uj jEPjh4, j+u u ] Uj jEPjEPjh4, j+u u (] Uj jEPjEPjEPj h4, j+u u 0] Uj jYQE PQE PQEPQEPQEPjh4, j+u u @] ̋UV u = t@ t64, ppj
Yi! 3ɋ;uAu@/ 3ɋ;uAuEM3 E @ ^] ̋ = t@ tp4, pj Y3@ ̋ = t@ tp4, pj YjX ̋UQSVW ]}u = t@ tSWuVpp0 3ɉ + ttRt-t
@ jX9E E@ jX9E E@!jZ9U E@O3 E@EtKЍrff;u+4U 9usz thVuW Y 33ZE@ EuFЍrff;u+4U 9us 3z tVuWX 3YW _^[] ̋U = t @ tu uuuu ppf@ ] ̋UEV tV\ Y^] VW?AMSIu( t w Ot5Qp #?OMSIu"S_tj0 [W _^̋U SVW
u] tA tSVqq
3D$ 3ۍzff;u+BT$B= s j ؉\$u/ = t@ tp4, pjY t 3D$AMSI< W Cu/ = t@ tp4, pjYH WVPV D$ T, ` PhD, y0 = @ Wppj4, YyD$ KQh$, 3ɋ0QPN V y = tH@ tBWppj뱋E 3s ޡ = t @ tt$4, ppjYtKB t5A t/Rqq! tA tq4, qjY!W L$ tQr _^[] ̋U = t @ tu4, ppjY} tM] ̋UM t9Et28AMSIu*x t$x t 3VBp @uB3^W ] ̋UEVHE R1PQN V^] ̋USV ]u= t @ tu uSu VppE tZtV} tPtL>AMSIuDVt=Nt6EEEEj u EEUE ]1PQN V W ^[] ̋UU t4} t.Vqffuu+uu PRu^W ] ̋UQSVW u4, ;t @ tVppjY u$;t@ tppjYW Y j t$ u) ;t@ tppjYt 3h! hX OMSIL YYtQhG hT jjC PGM H CHP T jY! ut$ 3ۉ^u, = t@ tp4, pj Y fG! y( = tM@ tGWp4, pj Y1EΉ03 = t@ tQp4, pj Yy3t_^[] ̋U = t @ tu4, ppj Y,} tMH] ̋UQSVW } u= t@ tw WVpp >OMSI Nt}ty} ts]tld$ D$ PuW y( = t:@ t4Vp4, pj!Yj # D$ tSPq 3L$ W _^[] ̃! ËU S]3UfEVWu]^ȋE+M;s 6QSPW M t 3@;#lj;us t3fDww_^[] U S]E VWu]+Eu;sVSuW M t 3@;#lj;us tD> >_^[] SWu30VtWp tQp ։;^_[ËV1W;tV;t1;uF;u_^39u9Auy u
y Fu@ËUQQSVW ] u
@ # MtzWp ։;3azFGEtUot+Et0wSuV Ut#} tx ? u@
댸W _^[] 3 ̋UU@ t3" } MtuEVRQp$u ^] ̋U} VW= tpp _3^] 3
< @8 @3
4 @ @3
@ @ËUV5 tuj Q jY)^] Vx3^Á u ^W= tV ׅt ~
_^ËV5 t Q ^ËU EEE EEEES](EE0Vu8W3Ef; 3EE+ljU} MtFt8t
uAWT6xWjuuuu EE3~@ @FE t3f9u3F F~,E3҉F EF EF$EFEFEFHEFL3jYV(= t
= FDth uV = t V = t V 39F|} F 8 uJ= t ( u!= tV8 uNPPV ?= t= uh SV 3f9u
V S, = t5 t
_^[]4 ̋UPVW= t V jPEj PJ NH3@E EEE u PMFEȋF E ẺMj ދUd 6J 3ĉ$` } ES]V\$]W} \$u
= t2ۍt$VQt$pVQ$x VuQj u Vt$4t$<WPtKu0t 5 $h PD$ P ֍L$L$$l _^[35@ ] L$̋Uj j u uuuu u
] UVu ~ QQVju_ j j h, ^] USVW8 u!hjuPPh, r ~ QQVjuj j h, s_^[] USVًM WBQQVjuj j h, :_^[] Uu juj j h, ] Uu Qu ] UQQu Y] Uu Qu e] jY)ËUh 3
PuPPhd, w] 9 t1 ËUE8 u3]ÍP@u+]̋UEV tV\ Y^] UUA;Bu
;u2] ̋UEU H] ̋UQQVWu MuQp _^] ̋UE;Hu ;E u2] ̸, ̋Uu F Yu, MP E] ̸, ̋U} uMh, h u uE] ̸, ̋Uu E Yu, MP E] ̋UVu VeE YM1^t A A ] Uj jEPjEPj!h. j+u u (] Uj jEPjEPjEPQRj+u u 0] Uj jE PjEPjEPjEPjh. j+u u 8] UMVW3t эrff;u+U j
Zu, WRQjEPj
h. j+u u (_^] Uj jEPjEPQRj+u u (] UM VtэrBu+BjZu, j RQjEPjEPjEPj.h. j+u u 8^] Uj jEPjEPj h. j+u u (] Uj jE PjEPjEPjEPQh. j+u u 8] Uj jEPjEPjEPQh. j+u u 0] Uj jEPQh. j+u u ] UMVtэrBu+BjZu, j RQj)h. j+u u ^] UUVWt~Fu+Fj^u, j jEPVRQh. j+u u (_^] UQQe Ee P EU]ËUQQSVW h j3SSV< uQjqMZuX~WSSh 6H uQjrSu u7D uQjsSEE Puj7@ uQju3_^[] V~ t
v8 f > t
j 6L & ^ UQSVW Wj 3Su h ~ y( = t@ tVppj
Y SSSSSSE]PSSSS7 ~ y = t@ tVppj 몋E3h! @_ jZG QA GYYu, = t@ tp. pj Y 3_^[] UQQSVW3WWWFWEEPvv 6 ~
FVf9|B
;tA tRv qqOFF 'reFf8{u\fxJ}uUf9xLuOu3fHJFP ~ y" ;t@ tVppjYk 3_^[] V~ tv f Y> t 6 & ^hH M ,= E3h ى - 2Ʉt1k@ 3ҋ;uIBukP h PW yG L:rh SPe? h,- h\- h P$yO VQM
VSP ? Dž PPPh SPh tPQM> VSP> h PPS uk cj Yf;tj"Yf;u*ʍqff;u+tj"Xf;DJu3fDJSSRd u, QM t h
s*k
@ P h t h- Sh uQM 3ۉ]PhD, W y -0SPN V y WQMoMtQr 9 j 9 ى]c {j^3C !EC$hG hT jjP6 3d h l jp Cdt ǃx Y! u 9 ËUjh d PV 3PEd h l tRQ, hG jjF$P3 Fx t P@ Md
Y^]3 UVWh PVhm h/ 0 yPQMg BDj jjw7 p d PQFdPF$P# =up #_^]ËUQW3E9d v2SV_$ t# Qp E@E;d r^[d _]̋U 3ʼnEM ES]VW}3]`|Llu
W 4 !7t!0 = t@ tQp. pj Yx 3!ujdYTd pB s$dh hQ`0PN V l+ωxӉXT t\ = QQ Ett3dMMEXEȍxE؋|j[U PP]UUE UĉUE UԉxU܉]UEU]UE0 PjQQ\Xtx xt |h9}Cup
t`A ]tZRxPtdVqqj Y49 t(B ]t"tQM7tdQrrj ]? }T0 = t@ tRQMVQppj Y]|Ed@Ed;d p;d s2L3lt,D$L$t Qp ld ƅp v
p7p` = t@ t7VppOƋM_^3[- ] ̋UQS]W39d v2C$EV uu Pq EGE;d r^_[] ̋UQU$u' = tW@ tQppj". Y<z t = t'@ t!ppj#M(Bt B x Y]$ h 3 ]39p u3 3 P PN jjS V yv VQMk 3 P N PjjS V y 믋3 PPN jjS V y
x3P'PN jWS V z ty
: }u *; PVO j S W y SQMTd Q( E( u F Q'Q8jjPO W z ty SQM E((( P V ( u 5 Q( 0jPN V y' SQM> 1 t ;t s3 }3 !jYx ;vЉ R P Ẽ P WDžD ,3ɍE 0<ELd(l t |EljE EEjZEE,Pj
h. l 4h 8@HPTX\`hpxMUMMUMMMME MMUĉM yPQM { 3 SQMtW ( t ( tP I. ̋ = t@ tp. pj$Yt$ UQVP #
PVhs h. 0 yPQM : = t@ tp. pj%YH PQFHPFPY ^Y]ËU 3ʼnEEt SVuW} PpdxX u
W E t& = t @ td. ppj&YH e slxڋdPq ։t+lj|Ӊ\= h` QQ]px 3ɉ||MEHMƉME\EċtEEEԋjZhhUE MME MЉM؉U܉MEMUMET0 PjQQͿ\`| |h]pxttH = t @ tR|QSppj(YxlC;H l]uW
t!A tRP7tHSqqj'YXt DLtQp tM_^3[$ ] j, "+ ډ]̉MȋEMuEԉMЅ* } WP| YY
; = t@ tSuppj*Y 3~~rƋU3f3E }fEf9:tʍAEff;u+MQRM< SQE؉}Pq WjM ŰM@~r6] A = t@ tSuppj+YjŰM@3Uԍ] yAy ^MЋ]̡ = t@ t Qpp3~~r3fM@~r6A y y1:) h8 H j) ًu3WjjT P u, = t@ tp. pj,Y?3
tWA tq. qj-Y
t0A t*, 9~<u, Pv vvqq
jZ3 f}ff0,f HDf4E3BDžT jdtZUFL3F \FlF<PX`hpx|}}9~ uu tA tq. qj/Yh4. Ph vL<hH. Ph vLF Bh4. PWWLhH. PWWLNjhX. RQPL~ = t@ tp. pj0Yhd. Ph vLXht. 4Ph vL3F B
L
PDŽ
T
Xqhd. PWWLht. 4PWWLLQPDŽT XLPRh / T P yPQM #' = t@ tp. pj1Y3ۍ4WCS WS WS WS WS $ ̋UMU uuY H ] UQS]VW}9{s{N;vjt[9QPΉEx tH{rFr΅t?PFSAP4' F MNr3fH_^[] j j ËUVuf F YPu ^] UQSVW ËO Mt8 uS, V@ ' ǃg _^[]j p # Mu
@ 3 j(uEE$ Ytc {j3YC \ 3 ~ Ëu]MtAEKC$x3C uuu S0 tQC " VW
V;t1;u_F^Ãy t QA ËVFF x t P@ V\ Y^ j " UEu
@ e e h ]" YEEEt@` p t uI@ ~E= p }3 Ë]}MtZO请x 3G0xOx3ۅuuuW0 tjp L! jϦ ! UEu
@ e e h }! Y]Et/RE= p ֿ 3 Ë}]MtcKJK豶xC x3KuuuS0 tjp M h. " h. \" ̋U} VW} t$~r S t?PSV
# S\ Y[~3F f~_^] UVuw.9qs qV u!qyr 3f^] e̋U} VW} t!~rS t WSV" S\ Y[~F 7 _^] USW tV8 S V@ ^E_[] ̋UuMP u ] ̋UVuWN7u tQ^_^] ̋UMId] ̋UEVu@u P1 ^] ̋UEV@Pq ^] ̋UEV@Pq ^] ̋UUu@ AM W3:tM
VQp ^RQM0 I_] j ]s
J;t;uBEuL= p օtjp փe = r EB Ujh d PSVW 3PEd Yt A = p Md
Y_^[]̋UuM0 u ] j ]KEuL= r օtjp փe = p E: Ujh d PSVW 3PEd C = p Md
Y_^[]j L u}v})3E Nj^u;v+;w<e GP ȉE)EE@ePE E[ Ë}MuM] t ~rօtPRQ# j jE~^r3f^ Mj jj j ̋UVW}t@~r;r0~rFA;v ~ru +WVW KS] QSt7Fr΅tPWQa F ^r3f X[_^] US]VS t ~ru +؋SV GW} j W t2Fr΅tWSQ F ~r8 _^[] ̋UVmEtV\ Y^] v̋UVEEtV\ Y^] UE3Ʌt=wP Yȅt] @ ̋UE S]VW{; +9}s};u( 9Nry~Nr3Pf<JQ PQWtE{rFr΅t?PE CPQ F ~r3f x_^[] >̋UUt+yr;ryVr1A^;v2] UVuwJ9qs qVw 0} tsA;sPjmu!qyr ^] ̋UE S]VW{;ry+9}s};uP} E Pj Kj W^t?{rFr΅tE WPQ F ~r8 _^[]
̋UV EtV\ Y^] UVM W~;wf ~r3f>t:Fr+t?PJPR F ~r3f x_^] j 7 u}v}*3E Nj^u;vjX+;w<j_e GPMF )EME@ePE- Eo Ëu}E] Et~r΅t SQP j j^E~^r Mj j4j j ̋UQVMW~;roU +;w~Nr EtAFSr +ى})MtuPSv F ~[r8 _^] ̋UE9AryAr ] ̋U39Et
u Yt] jT
}3һ<* Uùf9tu+ CP tSh<* CPV 3f37e E t
{ QMyh EudE `3xHLh- QHEy. = @ SppjY6 x 3ҹ \ | }3EEPH; y> = @ p. pjYչ} c|. PM\t@t+Ɖhlt6 = t @ tQju. ppjYGx xd|> 9t >u`xA = t%@ t Qlhjupp>\ = vQQttEE E3ɍhMEtjEЍXZMME MDžt MԉU؉M܉XEMUME0 PjQQ|E >1 = t@ tQp. pjY1|轷u( = t>@ t8Sp. pjY" = t@ tjQpp3ۍH+H h ç x EudE `3xHLh- QHEy. = @ SppjY x 3ҹ \9 | }3EEPHl;= y> = @ p. pjY蘶 &|Ph / jj EP tt+Ɖhlt6 = t @ tQju. ppjYx= | y-
tA tPu. qqjY빋xd|> 9t>u`xA = t%@ t Qlhjupp>\ = v{QQjtpEE E3ɍhMEtjZEЍXMME M̉tMԉU؉M܉XEMUME0 PjQQh|E ~>1 = t@ tQp. pjY趴|Bu( = t>@ t8Sp. pjY" = t@ tjQppu3ۍH
j
3}}E1Ph. Q y% = @ Vppj;EU}RPq y# = tc@ t]VppjYeLMU}c x} u4 = t @ tVu. ppjYx MMtQr ËU SVW3V]Sh EuI8 ~ ہ = @ SVp0/ pj
Y` SjMQj=P y1 = tp@ tjSVp0/ pj YS t(B t"MPQVrr0/ j YEȀr$<0u uL _^[]h Yu@Ã 3ËU} SVW d H3ۣ d ]PʉU33G;t h U3u}= t
j Y\ Eth5 u;r:Mt U
;uE9Mt͋MEP 3 Y G 9] 3 3G9} d 3ۉ] PU;t h U3u}9 j[t j 5hl hd = A YYt3Xh` h@ T Y } Yu3= t&h Ytu5 Su _^[] ̋U} uU ] Ucsm9Eu
u P YY]3]j,h E 3uE w } u= uu9 E t = tNE } u
uu u E M EQPIYYËe3uu} E uu uE M EQPYYËe3uu} E uu uZE M EQPYYËe3uu} } E VVuM EQP}YYËe3uE VVu]M EQPNYYËe3u= t4E VVu M EQPYYËe3uE t E uu uE M EQPYYËe3uu= tG= t>E uu u E M EQPyYYËe3uuE E } w
ËUVu3;u s Wu>t
׃;u r_^]%\ % Uuuu uhp h 1 ];
u j h e ] Ë}Njuue }x+uM U3@EE }] uEu uWSV jh - e mxFu+u uM UEEE EE8csmt E E eE jhȭ e Euu5 YTj Ye E䡰 EEPEPu u܋M
M
E Ëuj YËUuZYH]% ̋UV EtVY^] Uj 4 uD h P ]ËU$
5 = f f
f f f% f- E E E X jXk ǀ jX
jX
jXk
LjX
Lh ]j ue Y
e ËE % % jh@ f 3uuuu] };u}M U}Fu3@EE b ] }uEu uVSW% % ̋UE3SVWH<AYt} p ;r H;r
B(;r3_^[]̋Ujh` h@ d PSVW 1E3PEd eE h z tTE- Ph Pt:@$ ЃEMd
Y_^[]ËE 3Ɂ8 ËeE3Md
Y_^[]̋UMMZ f9u A<8PE u f9Hu ]3]ËUe e VWN@ ;tudEP E3EE 1E 1E 3EM3EEP E3E3E;t5 uO@ȉ
_ ^]% h@ d5 D$l$l$+SVW 1E3PeuEEEEd ËMd
Y__^[]Q% % % %l Md
Y__^[]QËM3Pd5 D$ +d$ SVW( 3PuEEd Pd5 D$ +d$ SVW( 3PEuEEd Pd5 D$ +d$ SVW( 3PeuEEd ËU
u Ytu Yt] ̋UQVuu ^] UQVjEE! P ^]̋UQVuu ^] UQEVuEEPY ^] oe̋UV GEtVY^] ̋UV EtVY^] U Mh| EP ̋U Mu0hЮ EP ̋U Muh EP ̋U=| x tM9t
x u3]Ë@]ËU=$ tM9t
x u3]Ë@]%t U] %p %h %` % % %T %X QL$+#ȋ% ;r
Y $- % T$B J3n .T$B J3S T$B J38 郢T$B 3J3Ш MT$B J3 2(' T$B 3J3( VMT$B J3sJ3id )t i4^T$B 3J3
T$B J3ܩ u\ YËM܃qT$B J34 ~u\ YËMT$B J3 PT$B J3u 5T$B J3Z0 T$B J3? E eM酵ËT$B J3 H H |KT$B D3J3t H|
T$B D3J3 OMݟT$B J3lܬ ,T$B J3Q j .h b襏V 7 7 " " B " u " L " " ' 2 = " $ @ ~ " X x @ " Ǧ @ ހ " ( " T t @ @ > " ( 8 @ Ƌ @ O " l ; " o z " ̬ " / C r ̙ % 9 k К . X ޛ @ " + > @ X P X P , X 0F x 4 l F t X 8 k Z
د @ O L O P P Q 0S R 0O < < = = c t ð ϰ (
Amsi.dll AmsiCloseSession AmsiInitialize AmsiOpenSession AmsiScanBuffer AmsiScanString AmsiUacInitialize AmsiUacScan AmsiUacUninitialize AmsiUninitialize DllCanUnloadNow DllGetClassObject DllRegisterServer DllUnregisterServer 0 T, i 0~ | `V `V pV .?AVlogic_error@std@@ .?AVlength_error@std@@ .?AVout_of_range@std@@ .?AU?$CAtlValidateModuleConfiguration@$00VCAmsiModule@@@ATL@@ .?AU_ATL_MODULE70@ATL@@ .?AVCAtlModule@ATL@@ .?AV?$CAtlDllModuleT@VCAmsiModule@@@ATL@@ .?AVCAmsiModule@@ .?AV?$CAtlModuleT@VCAmsiModule@@@ATL@@ .?AVbad_alloc@std@@ .?AUIUnknown@@ .?AVResultException@wil@@ .?AVCAmsiBufferStream@@ .?AVexception@@ .?AVCAmsiUacAntimalware@@ .?AUIAmsiStream@@ .?AUIClassFactory@@ .?AUIAntimalware@@ .?AV?$CComAggObject@VCAmsiAntimalware@@@ATL@@ .?AVerror_category@std@@ .?AV_System_error_category@std@@ .?AV_Generic_error_category@std@@ .?AV?$CComObject@VCAmsiAntimalware@@@ATL@@ .?AV?$CComObjectNoLock@VCComClassFactory@ATL@@@ATL@@ .?AV_Iostream_error_category@std@@ .?AV?$CComObjectRootEx@VCComMultiThreadModelNoCS@ATL@@@ATL@@ .?AV?$CComCoClass@VCAmsiAntimalware@@$1?CLSID_Antimalware@@3U_GUID@@B@ATL@@ .?AVCAmsiAntimalware@@ .?AVCComClassFactory@ATL@@ .?AVCComObjectRootBase@ATL@@ .?AV?$CComObjectRootEx@VCComMultiThreadModel@ATL@@@ATL@@ .?AV?$CComContainedObject@VCAmsiAntimalware@@@ATL@@ N@D
p H >
" < L & Z p \ 0 L t ` 0 ^ | H > \ * : t ` j , < D j N \ J . 7 v T p H x 4 d T 4 , | > $ ` P 8 X H : d L
p H >
" < L & Z p \ 0 L t ` 0 ^ | H > \ * : t ` j , < D j N \ J . ??3@YAXPAX@Z y __CxxFrameHandler3 ) ??_V@YAXPAX@Z _vsnwprintf
memcpy_s ??1exception@@UAE@XZ ??0exception@@QAE@XZ ??0exception@@QAE@ABV0@@Z _vsnprintf_s free malloc o _XcptFilter _amsg_exit _initterm msvcrt.dll j_except_handler4_common 5 ?terminate@@YAXXZ `_lock _unlock __dllonexit _onexit ??1type_info@@UAE@XZ EnterCriticalSection CoCreateInstance EventUnregister LeaveCriticalSection UnregisterTraceGuids InitializeCriticalSection RegisterTraceGuidsW GetTraceEnableLevel GetTraceEnableFlags GetTraceLoggerHandle EventSetInformation RaiseException EventRegister DeleteCriticalSection GetModuleFileNameA HeapFree @ CoTaskMemAlloc GetModuleHandleExW A CoTaskMemFree GetCurrentThreadId FormatMessageW TraceMessage HeapAlloc GetProcAddress GetProcessHeap GetModuleHandleW DebugBreak GetLastError - Sleep UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess M TerminateProcess QueryPerformanceCounter
GetCurrentProcessId GetSystemTimeAsFileTime GetTickCount api-ms-win-core-synch-l1-1-0.dll api-ms-win-core-com-l1-1-0.dll api-ms-win-eventing-provider-l1-1-0.dll api-ms-win-eventing-classicprovider-l1-1-0.dll api-ms-win-core-errorhandling-l1-1-0.dll api-ms-win-core-libraryloader-l1-2-0.dll api-ms-win-core-heap-l1-1-0.dll api-ms-win-core-processthreads-l1-1-0.dll api-ms-win-core-localization-l1-2-0.dll api-ms-win-core-debug-l1-1-0.dll api-ms-win-core-synch-l1-2-0.dll api-ms-win-core-profile-l1-1-0.dll api-ms-win-core-sysinfo-l1-1-0.dll }wcsnlen rand _purecall "_callnewh ??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z 7 ?what@exception@@UBEPBDXZ d _CxxThrowException memcpy memmove CryptReleaseContext Q StringFromCLSID UuidFromStringW
SetLastError ExpandEnvironmentStringsForUserW CryptGetHashParam RegGetValueW RegOpenKeyExW CryptDestroyHash CryptHashData CryptCreateHash RegEnumKeyExW EventProviderEnabled $ ReleaseSRWLockExclusive OutputDebugStringW AcquireSRWLockExclusive % ReleaseSRWLockShared AcquireSRWLockShared EventWriteTransfer ! RegQueryInfoKeyW CryptAcquireContextW RegCloseKey EventWrite LoadLibraryExW GetSystemTimePreciseAsFileTime IsDebuggerPresent 0 OpenProcess CloseHandle api-ms-win-security-cryptoapi-l1-1-0.dll RPCRT4.dll USERENV.dll api-ms-win-core-registry-l1-1-0.dll api-ms-win-core-sysinfo-l1-2-0.dll api-ms-win-core-processthreads-l1-1-1.dll api-ms-win-core-handle-l1-1-0.dll NtQueryInformationProcess ntdll.dll
memset ( @ X p
8
W E V T _ T E M P L A T E 4 V S _ V E R S I O N _ I N F O
cE
cE? S t r i n g F i l e I n f o 0 4 0 9 0 4 B 0 L C o m p a n y N a m e M i c r o s o f t C o r p o r a t i o n ` F i l e D e s c r i p t i o n A n t i - M a l w a r e S c a n I n t e r f a c e n ' F i l e V e r s i o n 1 0 . 0 . 1 7 7 6 3 . 1 6 9 7 ( W i n B u i l d . 1 6 0 1 0 1 . 0 8 0 0 ) 2 I n t e r n a l N a m e a m s i . d l l . L e g a l C o p y r i g h t M i c r o s o f t C o r p o r a t i o n . A l l r i g h t s r e s e r v e d . : O r i g i n a l F i l e n a m e a m s i . d l l j % P r o d u c t N a m e M i c r o s o f t W i n d o w s O p e r a t i n g S y s t e m D P r o d u c t V e r s i o n 1 0 . 0 . 1 7 7 6 3 . 1 6 9 7 D V a r F i l e I n f o $ T r a n s l a t i o n P P@ ` M M I n f o r m a t i o n
T M i c r o s o f t - A n t i m a l w a r e - S c a n - I n t e r f a c e
D M i c r o s o f t - A n t i m a l w a r e - U a c S c a n
( A m s i S c a n B u f f e r
U a c S c a n
CRIM
kW* RIB' g8 y~yWwRdcd WEVT
@ L CHAN8 A M S I / D e b u g TTBL TEMP
; u`aiP [ D E v e n t D a t a A9 o D a t a ! K N a m e s e s s i o n
A? o D a t a ' K N a m e
s c a n S t a t u s
A? o D a t a ' K N a m e
s c a n R e s u l t
A9 o D a t a ! K N a m e a p p n a m e
AA o D a t a ) K N a m e c o n t e n t n a m e
AA o D a t a ) K N a m e c o n t e n t s i z e
AC o D a t a + K N a m e o r i g i n a l s i z e
A9 o D a t a ! K N a m e c o n t e n t
A3 o D a t a K N a m e h a s h
AI o D a t a 1 K N a m e c o n t e n t F i l t e r e d
, L `
p s e s s i o n s c a n S t a t u s s c a n R e s u l t a p p n a m e c o n t e n t n a m e c o n t e n t s i z e o r i g i n a l s i z e c o n t e n t h a s h $ c o n t e n t F i l t e r e d PRVA` M i c r o s o f t - A n t i m a l w a r e - S c a n - I n t e r f a c e OPCO LEVL@ P ( w i n : I n f o r m a t i o n a l TASK KEYW0 h E v e n t 1 EVNTD M M X WEVT8 H
,
8
x
CHAN4 0 U a c / D e b u g TTBL TEMP
/NUţ ( D E v e n t D a t a AO o D a t a 7 K N a m e r e q u e s t o r P r o c e s s I d
AG o D a t a / K N a m e u a c R e q u e s t T y p e
AE o D a t a - K N a m e
u a c T r u s t S t a t e
AO o D a t a 7 K N a m e a u t o E l e v a t e R e q u e s t
AO o D a t a 7 K N a m e e x e A p p l i c a t i o n N a m e
AG o D a t a / K N a m e e x e C o m m a n d L i n e
AA o D a t a ) K N a m e e x e D l l P a r a m
AI o D a t a 1 K N a m e c o m S e r v e r B i n a r y
AC o D a t a + K N a m e c o m R e q u e s t o r
A; o D a t a # K N a m e c o m C l s i d
x
@ d , r e q u e s t o r P r o c e s s I d $ u a c R e q u e s t T y p e u a c T r u s t S t a t e , a u t o E l e v a t e R e q u e s t , e x e A p p l i c a t i o n N a m e $ e x e C o m m a n d L i n e e x e D l l P a r a m $ c o m S e r v e r B i n a r y c o m R e q u e s t o r c o m C l s i d PRVAP M i c r o s o f t - A n t i m a l w a r e - U a c S c a n OPCO LEVL@ PP
( w i n : I n f o r m a t i o n a l TASK KEYW0
U a c S c a n EVNTD T D
000 0000$0,040<0D0L0T0\0d0l0t0|000000000000000001 11 1$1,141<1D1L1T1\1d1l1t1|111111111111111112 22 2$2,242<2D2L2T2\2d2l2|222222222222222223 33 3$3,343<3D3L3T3\3d3l3t3|333333333333333334 44 4$4,444<4D4L4T4\4d4l4t4|444444444444444444 555 5555 5 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|555555555555555555555555555555555 666 6666 6 6$606P666666 7777 7074787<7@7D7H7P7h7l7777777777 888 8 8$84888P8T8\8t8x8|888888888 999,90949<9P9T9\9t999999999999999: :$:(:@:P:T:X:`:x::::::::::: ;; ; ;$;(;,;0;4;<;@;D;H;L;P;T;\;`;d;h;l;p;;;;;;;;;;;;<< <0<4<8<<<P<T<d<t<<<<<<<<<<<<<<<<== =0=4=L=\=`=d=h=l=t=x=|==================>$>(>,>@>D>\>`>x>>>>>>>>>>?? ?$?<?D?H?L?P?T?X?\?h? 0 h4w44"5.5:5C5H5R5Y5`5y55555555"6(6.6;6Q6[6q6w6{66666666666666666 77 7)727A7Q7a77778
8848B8O8U8[8k8r88888999999I:Z:c:p::::: ;&;I;R;x;;;;;;;<<
<<"<2<8<><D<I<O<U<[<u<<<<<<<*=/===I=R=X=]=+>>>>> ?)?5?A?M?w?????? @ 0)0A0\0v0000-141V11111b2i2u2222222222233T3/5;5p556J6t66666767k7p77778.8R8~8888889 9F9T99999999#:(:8:S:X:h:::< <N<W<|<<<<<<=N=]=b=r========>
>+>@>O>]>b>>>>>>>?6?;?K?? P 0&000 1"1*1J1z11111121262F2j2o22222222=3H33333_44 56556666777!7+747B7T77777v888889 99 9+9K9S9_9l9|9999999999:!::: ;;;;;;5<Y<<< ='===>!>?>a>>>>>>$?Q?_????? ` 070E0g0u000000 1<1G1U111111222T2|222223)3.3K3r3w33333N4f44444445.595?5[5556T66666677)7.747I7N7U777778/848u8888881969<9b99 :X:]:n:::;;< <P<V<<<=b=g===>>.>3>k>>?C?y??? p D0002111{23C3X3i3333333333/44444556 6c6i6667 7#777'8,888888888 99 9)9D9Q:a:q::::;0;5;E;U;z;;;I<[<w<|<<=>>3>>>> ?3?D?K?Y?????? 70N0c0000061M1`1k1132_2h2o22 363f33334%4<4J4W4r4444445 5-5D5R5_5z555555V6868v::j;<<<< =A=v====> >7>[>>>>??B????? ` 0 000B0G0~00000W1\1t1111112 2.222253^3c3t333333344$4)4\4i4n444445(5<5A5[5{5555555 6'6,616X6h6m6666666 7!7)70767<7j77777777777
88 8i888888: :::::";6;<;R;W;r;;;<#<T<m<{<<<<<<<"=:=[=d=o=v==================> >>>#>3>C>I>T>Z>f>v>>>>>>>>A?G??????? 0000001 1&11191V1111112M22222303B3j33344!4G4M4r4444444445 595l5556g6666666727f7778 888b8f8r8v88888889$909P9X9`9l9999999999 :0:<:D:d:l:::::::: ; ;,;8;@;;;;;;;<$<4<D<P<p<|<<<<<<<= =(=,=4=8=@=D=L=P=X=\=d=h=p=t=|=======> >(>X>t>x>>>>>>>>>>>>>>>??? ?$?(?0?D?L?T?\?p?x????? h 0080<0@0D0P0T0X0d0h0l00000000@1`1111 2 242X2x222223@3d333304`444 5@5h55 1
Hacked By AnonymousFox1.0, Coded By AnonymousFox