! / 1634761589 0 5372 ` *,-/././///0h0h001D1D112,2,22333z3z334X4X445,5,556666667h7h778^8^889&9&99::::;;;v;v;;2>2>>???|?|??@b@b@@A@A@AAB*B*BBCCC|C|CCDNDNDDE8E8EEFFFFG G GGGGHjHjHHIPIPIIJ6J6JJKKKKLLLvLvLLMZMZMMNBNBNNO&O&OOPPP~P~PPQ^Q^QQRHRHRRS&S&SSTTTTTTUfUf__IMPORT_DESCRIPTOR_ntdll__NULL_IMPORT_DESCRIPTORntdll_NULL_THUNK_DATANtClose__imp_NtCloseNtCreateFile__imp_NtCreateFileNtDeviceIoControlFile__imp_NtDeviceIoControlFileNtNotifyChangeMultipleKeys__imp_NtNotifyChangeMultipleKeysNtOpenFile__imp_NtOpenFileNtQueryInformationProcess__imp_NtQueryInformationProcessNtQueryInformationThread__imp_NtQueryInformationThreadNtQueryMultipleValueKey__imp_NtQueryMultipleValueKeyNtQueryObject__imp_NtQueryObjectNtQuerySystemInformation__imp_NtQuerySystemInformationNtQuerySystemTime__imp_NtQuerySystemTimeNtQueryTimerResolution__imp_NtQueryTimerResolutionNtRenameKey__imp_NtRenameKeyNtSetInformationKey__imp_NtSetInformationKeyNtSetInformationThread__imp_NtSetInformationThreadNtWaitForSingleObject__imp_NtWaitForSingleObjectRtlAddGrowableFunctionTable__imp_RtlAddGrowableFunctionTableRtlAnsiStringToUnicodeString__imp_RtlAnsiStringToUnicodeStringRtlCharToInteger__imp_RtlCharToIntegerRtlConvertDeviceFamilyInfoToString__imp_RtlConvertDeviceFamilyInfoToStringRtlConvertSidToUnicodeString__imp_RtlConvertSidToUnicodeStringRtlCrc32__imp_RtlCrc32RtlCrc64__imp_RtlCrc64RtlDeleteGrowableFunctionTable__imp_RtlDeleteGrowableFunctionTableRtlDrainNonVolatileFlush__imp_RtlDrainNonVolatileFlushRtlEthernetAddressToStringA__imp_RtlEthernetAddressToStringARtlEthernetAddressToStringW__imp_RtlEthernetAddressToStringWRtlEthernetStringToAddressA__imp_RtlEthernetStringToAddressARtlEthernetStringToAddressW__imp_RtlEthernetStringToAddressWRtlExtendCorrelationVector__imp_RtlExtendCorrelationVectorRtlFillNonVolatileMemory__imp_RtlFillNonVolatileMemoryRtlFirstEntrySList__imp_RtlFirstEntrySListRtlFlushNonVolatileMemory__imp_RtlFlushNonVolatileMemoryRtlFlushNonVolatileMemoryRanges__imp_RtlFlushNonVolatileMemoryRangesRtlFreeAnsiString__imp_RtlFreeAnsiStringRtlFreeNonVolatileToken__imp_RtlFreeNonVolatileTokenRtlFreeOemString__imp_RtlFreeOemStringRtlFreeUnicodeString__imp_RtlFreeUnicodeStringRtlGetDeviceFamilyInfoEnum__imp_RtlGetDeviceFamilyInfoEnumRtlGetNonVolatileToken__imp_RtlGetNonVolatileTokenRtlGetProductInfo__imp_RtlGetProductInfoRtlGetReturnAddressHijackTarget__imp_RtlGetReturnAddressHijackTargetRtlGrowFunctionTable__imp_RtlGrowFunctionTableRtlIncrementCorrelationVector__imp_RtlIncrementCorrelationVectorRtlInitAnsiString__imp_RtlInitAnsiStringRtlInitAnsiStringEx__imp_RtlInitAnsiStringExRtlInitString__imp_RtlInitStringRtlInitStringEx__imp_RtlInitStringExRtlInitUnicodeString__imp_RtlInitUnicodeStringRtlInitializeCorrelationVector__imp_RtlInitializeCorrelationVectorRtlInitializeSListHead__imp_RtlInitializeSListHeadRtlInterlockedFlushSList__imp_RtlInterlockedFlushSListRtlInterlockedPopEntrySList__imp_RtlInterlockedPopEntrySListRtlInterlockedPushEntrySList__imp_RtlInterlockedPushEntrySListRtlInterlockedPushListSListEx__imp_RtlInterlockedPushListSListExRtlIpv4AddressToStringA__imp_RtlIpv4AddressToStringARtlIpv4AddressToStringExA__imp_RtlIpv4AddressToStringExARtlIpv4AddressToStringExW__imp_RtlIpv4AddressToStringExWRtlIpv4AddressToStringW__imp_RtlIpv4AddressToStringWRtlIpv4StringToAddressA__imp_RtlIpv4StringToAddressARtlIpv4StringToAddressExA__imp_RtlIpv4StringToAddressExARtlIpv4StringToAddressExW__imp_RtlIpv4StringToAddressExWRtlIpv4StringToAddressW__imp_RtlIpv4StringToAddressWRtlIpv6AddressToStringA__imp_RtlIpv6AddressToStringARtlIpv6AddressToStringExA__imp_RtlIpv6AddressToStringExARtlIpv6AddressToStringExW__imp_RtlIpv6AddressToStringExWRtlIpv6AddressToStringW__imp_RtlIpv6AddressToStringWRtlIpv6StringToAddressA__imp_RtlIpv6StringToAddressARtlIpv6StringToAddressExA__imp_RtlIpv6StringToAddressExARtlIpv6StringToAddressExW__imp_RtlIpv6StringToAddressExWRtlIpv6StringToAddressW__imp_RtlIpv6StringToAddressWRtlIsNameLegalDOS8Dot3__imp_RtlIsNameLegalDOS8Dot3RtlIsZeroMemory__imp_RtlIsZeroMemoryRtlLocalTimeToSystemTime__imp_RtlLocalTimeToSystemTimeRtlNormalizeSecurityDescriptor__imp_RtlNormalizeSecurityDescriptorRtlNtStatusToDosError__imp_RtlNtStatusToDosErrorRtlOsDeploymentState__imp_RtlOsDeploymentStateRtlQueryDepthSList__imp_RtlQueryDepthSListRtlRaiseCustomSystemEventTrigger__imp_RtlRaiseCustomSystemEventTriggerRtlSwitchedVVI__imp_RtlSwitchedVVIRtlTimeToSecondsSince1970__imp_RtlTimeToSecondsSince1970RtlUnicodeStringToAnsiString__imp_RtlUnicodeStringToAnsiStringRtlUnicodeStringToOemString__imp_RtlUnicodeStringToOemStringRtlUnicodeToMultiByteSize__imp_RtlUnicodeToMultiByteSizeRtlUniform__imp_RtlUniformRtlValidateCorrelationVector__imp_RtlValidateCorrelationVectorRtlWriteNonVolatileMemory__imp_RtlWriteNonVolatileMemory/ 1634761589 0 5382 ` Z*,-.///h00D11,223z33X44,55666h77^88&99::;v;;b<<D==2>>?|??b@@@AA*BBC|CCNDD8EEFF GGGjHHPII6JJKKLvLLZMMBNN&OOP~PP^QQHRR&SSTTTfU  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZNtCloseNtCreateFileNtDeviceIoControlFileNtNotifyChangeMultipleKeysNtOpenFileNtQueryInformationProcessNtQueryInformationThreadNtQueryMultipleValueKeyNtQueryObjectNtQuerySystemInformationNtQuerySystemTimeNtQueryTimerResolutionNtRenameKeyNtSetInformationKeyNtSetInformationThreadNtWaitForSingleObjectRtlAddGrowableFunctionTableRtlAnsiStringToUnicodeStringRtlCharToIntegerRtlConvertDeviceFamilyInfoToStringRtlConvertSidToUnicodeStringRtlCrc32RtlCrc64RtlDeleteGrowableFunctionTableRtlDrainNonVolatileFlushRtlEthernetAddressToStringARtlEthernetAddressToStringWRtlEthernetStringToAddressARtlEthernetStringToAddressWRtlExtendCorrelationVectorRtlFillNonVolatileMemoryRtlFirstEntrySListRtlFlushNonVolatileMemoryRtlFlushNonVolatileMemoryRangesRtlFreeAnsiStringRtlFreeNonVolatileTokenRtlFreeOemStringRtlFreeUnicodeStringRtlGetDeviceFamilyInfoEnumRtlGetNonVolatileTokenRtlGetProductInfoRtlGetReturnAddressHijackTargetRtlGrowFunctionTableRtlIncrementCorrelationVectorRtlInitAnsiStringRtlInitAnsiStringExRtlInitStringRtlInitStringExRtlInitUnicodeStringRtlInitializeCorrelationVectorRtlInitializeSListHeadRtlInterlockedFlushSListRtlInterlockedPopEntrySListRtlInterlockedPushEntrySListRtlInterlockedPushListSListExRtlIpv4AddressToStringARtlIpv4AddressToStringExARtlIpv4AddressToStringExWRtlIpv4AddressToStringWRtlIpv4StringToAddressARtlIpv4StringToAddressExARtlIpv4StringToAddressExWRtlIpv4StringToAddressWRtlIpv6AddressToStringARtlIpv6AddressToStringExARtlIpv6AddressToStringExWRtlIpv6AddressToStringWRtlIpv6StringToAddressARtlIpv6StringToAddressExARtlIpv6StringToAddressExWRtlIpv6StringToAddressWRtlIsNameLegalDOS8Dot3RtlIsZeroMemoryRtlLocalTimeToSystemTimeRtlNormalizeSecurityDescriptorRtlNtStatusToDosErrorRtlOsDeploymentStateRtlQueryDepthSListRtlRaiseCustomSystemEventTriggerRtlSwitchedVVIRtlTimeToSecondsSince1970RtlUnicodeStringToAnsiStringRtlUnicodeStringToOemStringRtlUnicodeToMultiByteSizeRtlUniformRtlValidateCorrelationVectorRtlWriteNonVolatileMemory__IMPORT_DESCRIPTOR_ntdll__NULL_IMPORT_DESCRIPTOR__imp_NtClose__imp_NtCreateFile__imp_NtDeviceIoControlFile__imp_NtNotifyChangeMultipleKeys__imp_NtOpenFile__imp_NtQueryInformationProcess__imp_NtQueryInformationThread__imp_NtQueryMultipleValueKey__imp_NtQueryObject__imp_NtQuerySystemInformation__imp_NtQuerySystemTime__imp_NtQueryTimerResolution__imp_NtRenameKey__imp_NtSetInformationKey__imp_NtSetInformationThread__imp_NtWaitForSingleObject__imp_RtlAddGrowableFunctionTable__imp_RtlAnsiStringToUnicodeString__imp_RtlCharToInteger__imp_RtlConvertDeviceFamilyInfoToString__imp_RtlConvertSidToUnicodeString__imp_RtlCrc32__imp_RtlCrc64__imp_RtlDeleteGrowableFunctionTable__imp_RtlDrainNonVolatileFlush__imp_RtlEthernetAddressToStringA__imp_RtlEthernetAddressToStringW__imp_RtlEthernetStringToAddressA__imp_RtlEthernetStringToAddressW__imp_RtlExtendCorrelationVector__imp_RtlFillNonVolatileMemory__imp_RtlFirstEntrySList__imp_RtlFlushNonVolatileMemory__imp_RtlFlushNonVolatileMemoryRanges__imp_RtlFreeAnsiString__imp_RtlFreeNonVolatileToken__imp_RtlFreeOemString__imp_RtlFreeUnicodeString__imp_RtlGetDeviceFamilyInfoEnum__imp_RtlGetNonVolatileToken__imp_RtlGetProductInfo__imp_RtlGetReturnAddressHijackTarget__imp_RtlGrowFunctionTable__imp_RtlIncrementCorrelationVector__imp_RtlInitAnsiString__imp_RtlInitAnsiStringEx__imp_RtlInitString__imp_RtlInitStringEx__imp_RtlInitUnicodeString__imp_RtlInitializeCorrelationVector__imp_RtlInitializeSListHead__imp_RtlInterlockedFlushSList__imp_RtlInterlockedPopEntrySList__imp_RtlInterlockedPushEntrySList__imp_RtlInterlockedPushListSListEx__imp_RtlIpv4AddressToStringA__imp_RtlIpv4AddressToStringExA__imp_RtlIpv4AddressToStringExW__imp_RtlIpv4AddressToStringW__imp_RtlIpv4StringToAddressA__imp_RtlIpv4StringToAddressExA__imp_RtlIpv4StringToAddressExW__imp_RtlIpv4StringToAddressW__imp_RtlIpv6AddressToStringA__imp_RtlIpv6AddressToStringExA__imp_RtlIpv6AddressToStringExW__imp_RtlIpv6AddressToStringW__imp_RtlIpv6StringToAddressA__imp_RtlIpv6StringToAddressExA__imp_RtlIpv6StringToAddressExW__imp_RtlIpv6StringToAddressW__imp_RtlIsNameLegalDOS8Dot3__imp_RtlIsZeroMemory__imp_RtlLocalTimeToSystemTime__imp_RtlNormalizeSecurityDescriptor__imp_RtlNtStatusToDosError__imp_RtlOsDeploymentState__imp_RtlQueryDepthSList__imp_RtlRaiseCustomSystemEventTrigger__imp_RtlSwitchedVVI__imp_RtlTimeToSecondsSince1970__imp_RtlUnicodeStringToAnsiString__imp_RtlUnicodeStringToOemString__imp_RtlUnicodeToMultiByteSize__imp_RtlUniform__imp_RtlValidateCorrelationVector__imp_RtlWriteNonVolatileMemoryntdll_NULL_THUNK_DATAntdll.dll/ 1634761589 0 485 ` du{pa.debug$S?@B.idata$2@0.idata$6 @  ntdll.dll'uMicrosoft (R) LINK ntdll.dll@comp.idu.idata$2@h.idata$6.idata$4@h.idata$5@h7N__IMPORT_DESCRIPTOR_ntdll__NULL_IMPORT_DESCRIPTORntdll_NULL_THUNK_DATA ntdll.dll/ 1634761589 0 248 ` du{pa.debug$S?d@B.idata$3@0 ntdll.dll'uMicrosoft (R) LINK@comp.idu__NULL_IMPORT_DESCRIPTORntdll.dll/ 1634761589 0 282 ` du{pa.debug$S?@B.idata$5@@.idata$4@@ ntdll.dll'uMicrosoft (R) LINK@comp.iduntdll_NULL_THUNK_DATAntdll.dll/ 1634761589 0 38 ` du{paNtClosentdll.dllntdll.dll/ 1634761589 0 43 ` du{paNtCreateFilentdll.dll ntdll.dll/ 1634761589 0 52 ` du{pa NtDeviceIoControlFilentdll.dllntdll.dll/ 1634761589 0 57 ` du{pa%NtNotifyChangeMultipleKeysntdll.dll ntdll.dll/ 1634761589 0 41 ` du{paNtOpenFilentdll.dll ntdll.dll/ 1634761589 0 56 ` du{pa$NtQueryInformationProcessntdll.dllntdll.dll/ 1634761589 0 55 ` du{pa#NtQueryInformationThreadntdll.dll ntdll.dll/ 1634761589 0 54 ` du{pa"NtQueryMultipleValueKeyntdll.dllntdll.dll/ 1634761589 0 44 ` du{paNtQueryObjectntdll.dllntdll.dll/ 1634761589 0 55 ` du{pa# NtQuerySystemInformationntdll.dll ntdll.dll/ 1634761589 0 48 ` du{pa NtQuerySystemTimentdll.dllntdll.dll/ 1634761589 0 53 ` du{pa! NtQueryTimerResolutionntdll.dll ntdll.dll/ 1634761589 0 42 ` du{pa NtRenameKeyntdll.dllntdll.dll/ 1634761589 0 50 ` du{pa NtSetInformationKeyntdll.dllntdll.dll/ 1634761589 0 53 ` du{pa!NtSetInformationThreadntdll.dll ntdll.dll/ 1634761589 0 52 ` du{pa NtWaitForSingleObjectntdll.dllntdll.dll/ 1634761589 0 58 ` du{pa&RtlAddGrowableFunctionTablentdll.dllntdll.dll/ 1634761589 0 59 ` du{pa'RtlAnsiStringToUnicodeStringntdll.dll ntdll.dll/ 1634761589 0 47 ` du{paRtlCharToIntegerntdll.dll ntdll.dll/ 1634761589 0 65 ` du{pa-RtlConvertDeviceFamilyInfoToStringntdll.dll ntdll.dll/ 1634761589 0 59 ` du{pa'RtlConvertSidToUnicodeStringntdll.dll ntdll.dll/ 1634761589 0 39 ` du{paRtlCrc32ntdll.dll ntdll.dll/ 1634761589 0 39 ` du{paRtlCrc64ntdll.dll ntdll.dll/ 1634761589 0 61 ` du{pa)RtlDeleteGrowableFunctionTablentdll.dll ntdll.dll/ 1634761589 0 55 ` du{pa#RtlDrainNonVolatileFlushntdll.dll ntdll.dll/ 1634761589 0 58 ` du{pa&RtlEthernetAddressToStringAntdll.dllntdll.dll/ 1634761589 0 58 ` du{pa&RtlEthernetAddressToStringWntdll.dllntdll.dll/ 1634761589 0 58 ` du{pa&RtlEthernetStringToAddressAntdll.dllntdll.dll/ 1634761589 0 58 ` du{pa&RtlEthernetStringToAddressWntdll.dllntdll.dll/ 1634761589 0 57 ` du{pa%RtlExtendCorrelationVectorntdll.dll ntdll.dll/ 1634761589 0 55 ` du{pa#RtlFillNonVolatileMemoryntdll.dll ntdll.dll/ 1634761589 0 49 ` du{paRtlFirstEntrySListntdll.dll ntdll.dll/ 1634761589 0 56 ` du{pa$ RtlFlushNonVolatileMemoryntdll.dllntdll.dll/ 1634761589 0 62 ` du{pa*!RtlFlushNonVolatileMemoryRangesntdll.dllntdll.dll/ 1634761589 0 48 ` du{pa"RtlFreeAnsiStringntdll.dllntdll.dll/ 1634761589 0 54 ` du{pa"#RtlFreeNonVolatileTokenntdll.dllntdll.dll/ 1634761589 0 47 ` du{pa$RtlFreeOemStringntdll.dll ntdll.dll/ 1634761589 0 51 ` du{pa%RtlFreeUnicodeStringntdll.dll ntdll.dll/ 1634761589 0 57 ` du{pa%&RtlGetDeviceFamilyInfoEnumntdll.dll ntdll.dll/ 1634761589 0 53 ` du{pa!'RtlGetNonVolatileTokenntdll.dll ntdll.dll/ 1634761589 0 48 ` du{pa(RtlGetProductInfontdll.dllntdll.dll/ 1634761589 0 62 ` du{pa*)RtlGetReturnAddressHijackTargetntdll.dllntdll.dll/ 1634761589 0 51 ` du{pa*RtlGrowFunctionTablentdll.dll ntdll.dll/ 1634761589 0 60 ` du{pa(+RtlIncrementCorrelationVectorntdll.dllntdll.dll/ 1634761589 0 48 ` du{pa,RtlInitAnsiStringntdll.dllntdll.dll/ 1634761589 0 50 ` du{pa-RtlInitAnsiStringExntdll.dllntdll.dll/ 1634761589 0 44 ` du{pa.RtlInitStringntdll.dllntdll.dll/ 1634761589 0 46 ` du{pa/RtlInitStringExntdll.dllntdll.dll/ 1634761589 0 51 ` du{pa0RtlInitUnicodeStringntdll.dll ntdll.dll/ 1634761589 0 61 ` du{pa)1RtlInitializeCorrelationVectorntdll.dll ntdll.dll/ 1634761589 0 53 ` du{pa!2RtlInitializeSListHeadntdll.dll ntdll.dll/ 1634761589 0 55 ` du{pa#3RtlInterlockedFlushSListntdll.dll ntdll.dll/ 1634761589 0 58 ` du{pa&4RtlInterlockedPopEntrySListntdll.dllntdll.dll/ 1634761589 0 59 ` du{pa'5RtlInterlockedPushEntrySListntdll.dll ntdll.dll/ 1634761589 0 60 ` du{pa(6RtlInterlockedPushListSListExntdll.dllntdll.dll/ 1634761589 0 54 ` du{pa"7RtlIpv4AddressToStringAntdll.dllntdll.dll/ 1634761589 0 56 ` du{pa$8RtlIpv4AddressToStringExAntdll.dllntdll.dll/ 1634761589 0 56 ` du{pa$9RtlIpv4AddressToStringExWntdll.dllntdll.dll/ 1634761589 0 54 ` du{pa":RtlIpv4AddressToStringWntdll.dllntdll.dll/ 1634761589 0 54 ` du{pa";RtlIpv4StringToAddressAntdll.dllntdll.dll/ 1634761589 0 56 ` du{pa$<RtlIpv4StringToAddressExAntdll.dllntdll.dll/ 1634761589 0 56 ` du{pa$=RtlIpv4StringToAddressExWntdll.dllntdll.dll/ 1634761589 0 54 ` du{pa">RtlIpv4StringToAddressWntdll.dllntdll.dll/ 1634761589 0 54 ` du{pa"?RtlIpv6AddressToStringAntdll.dllntdll.dll/ 1634761589 0 56 ` du{pa$@RtlIpv6AddressToStringExAntdll.dllntdll.dll/ 1634761589 0 56 ` du{pa$ARtlIpv6AddressToStringExWntdll.dllntdll.dll/ 1634761589 0 54 ` du{pa"BRtlIpv6AddressToStringWntdll.dllntdll.dll/ 1634761589 0 54 ` du{pa"CRtlIpv6StringToAddressAntdll.dllntdll.dll/ 1634761589 0 56 ` du{pa$DRtlIpv6StringToAddressExAntdll.dllntdll.dll/ 1634761589 0 56 ` du{pa$ERtlIpv6StringToAddressExWntdll.dllntdll.dll/ 1634761589 0 54 ` du{pa"FRtlIpv6StringToAddressWntdll.dllntdll.dll/ 1634761589 0 53 ` du{pa!GRtlIsNameLegalDOS8Dot3ntdll.dll ntdll.dll/ 1634761589 0 46 ` du{paHRtlIsZeroMemoryntdll.dllntdll.dll/ 1634761589 0 55 ` du{pa#IRtlLocalTimeToSystemTimentdll.dll ntdll.dll/ 1634761589 0 61 ` du{pa)JRtlNormalizeSecurityDescriptorntdll.dll ntdll.dll/ 1634761589 0 52 ` du{pa KRtlNtStatusToDosErrorntdll.dllntdll.dll/ 1634761589 0 51 ` du{paLRtlOsDeploymentStatentdll.dll ntdll.dll/ 1634761589 0 49 ` du{paMRtlQueryDepthSListntdll.dll ntdll.dll/ 1634761589 0 63 ` du{pa+NRtlRaiseCustomSystemEventTriggerntdll.dll ntdll.dll/ 1634761589 0 45 ` du{paORtlSwitchedVVIntdll.dll ntdll.dll/ 1634761589 0 56 ` du{pa$PRtlTimeToSecondsSince1970ntdll.dllntdll.dll/ 1634761589 0 59 ` du{pa'QRtlUnicodeStringToAnsiStringntdll.dll ntdll.dll/ 1634761589 0 58 ` du{pa&RRtlUnicodeStringToOemStringntdll.dllntdll.dll/ 1634761589 0 56 ` du{pa$SRtlUnicodeToMultiByteSizentdll.dllntdll.dll/ 1634761589 0 41 ` du{paTRtlUniformntdll.dll ntdll.dll/ 1634761589 0 59 ` du{pa'URtlValidateCorrelationVectorntdll.dll ntdll.dll/ 1634761589 0 56 ` du{pa$VRtlWriteNonVolatileMemoryntdll.dll