MZ@ !L!This program cannot be run in DOS mode. $Y 2 Q Q Q o Q Q Q Q^ Q Rich PEL'=!  @A]H,T@ .text `PAGE `.data@.idata@@.didat@.rsrcH@@.reloc,R@BRTFH248 0$& 8!<> .0P 8: $&L!*, ,.! "!$&02#.0'02#.0'.0#.0'.0#PRP'.0#.0'.0#PR&.0#dfX&.0#RT%.0#Z\%&(("DF0%&(("<>$&(("@B$&(("68p$&(("FH($&((">@#&(("8:`#8:`#>@#L#8:`#02#8#24!.0#24!8:"24!<>"24!:<P"24!&((" *tv`((D-.(.`21 "<2////0(0P0HJ04$8u<PppPp0бв@`м0@@@  @P@ p@ ` dapi-ms-win-core-registry-l2-1-0.dllCRYPT32.dllAUTHZ.dllapi-ms-win-ntuser-sysparams-l1-1-0.dllapi-ms-win-appmodel-runtime-l1-1-0.dllapi-ms-win-appmodel-runtime-l1-1-1.dllWINTRUST.dllbcrypt.dllapi-ms-win-appmodel-runtime-internal-l1-1-7.dllext-ms-win-rtcore-ntuser-sysparams-l1-1-0ext-ms-win-security-capauthz-l1-1-0.dllext-ms-win-security-chambers-l1-1-0ext-ms-win-security-chambers-l1-1-0.dll\c@M]iOxT "ZYb@G@I@F@WXE@222A8A43-0122-432F-86BB-FECA40971E35APPX2.16.840.1.101.3.4.2.1$Kernel.Smartlocker.OriginClaim$Kernel.Smartlocker.Hash$Kernel.Purge.Smartlocker.ValidSMARTLOCKER://ORIGINCLAIMSystem\CurrentControlSet\Control\AppID\Configuration\SMARTLOCKERTrustedOriginDataIdNULLNULLExceptionReturnNtReturnHrLogNtLogHrFailFast%hs(%u)\%hs!%p: %hs!%p: (caller: %p) %hs(%d) tid(%x) %08X %ws Msg:[%ws] CallContext:[%hs] [%hs(%hs)] [%hs] kernelbase.dllRaiseFailFastException%wswilonecore\internal\sdk\inc\wil\opensource\wil\resource.hntdll.dllRtlDllShutdownInProgressRtlDisownModuleHeapAllocation_p0WilError_03appid-EnableV2srpapi.dllappidapi.dllAppIDGetMsiVersionInfoDLLEXEMSISCRIPT\SystemRoot\System32\AppLocker\.AppLockerSrpIsAllowedMANAGEDINSTALLERSRP\\.\SrpDeviceLocal\SM0:%d:%d:%hslߙUEĥX PN3Oږ{uId+GYrIe4rqK2WT|PZXHWƚlZJ<&KwI︊Ϝ]5vD8D lD^;FdlxX !APPID://FQBN-\%u.%u.%u.%02uAPPID://PATHAPPID://SHA256HASH\??\\??\UNC\\\>w=7Jfi\Registry\Machine\System\CurrentControlSet\Control\AppID\ConfigurationUsePublisherIdUseSystemIdentityOnlyAppxSignature.p7xAipGetAppxSignatureFilePackageIdFromFullNameAiAllocPublisherFromPackageFullNameGetStagedPackagePathByFullNameSizeTAddRtlStringCbPrintfW%s\%sAPPX%2.2xAPPID://SHA256FLATHASHAPPID://SHA1HASH"O8(3rn$.AiGetTrustedPublisherNameAipGetFileSignatureWTHelperProvDataFromStateDataWTHelperGetProvSignerFromChainWTHelperGetProvCertFromChainAipCertGetPublisherName1.3.6.1.5.5.7.3.31.3.6.1.5.5.7.3.8AipVerifyFileSignatureSystemAipIsLifetimeSigningCert1.3.6.1.4.1.311.10.3.13WinVerifyTrust(WTD_CHOICE_FILE)CryptCATAdminCalcHashFromFileHandleCryptCATAdminAcquireContextCryptCATAdminEnumCatalogFromHashCryptCATCatalogInfoFromContextWinVerifyTrust(WTD_CHOICE_CATALOG)""2.5.4.10AipCertGetNameString(szOID_ORGANIZATION_NAME)2.5.4.7AipCertGetNameString(szOID_LOCALITY_NAME)2.5.4.8AipCertGetNameString(szOID_STATE_OR_PROVINCE_NAME)2.5.4.6AipCertGetNameString(szOID_COUNTRY_NAME)AiEncodeAttributeStringAipCertGetNameString(CERT_NAME_RDN_TYPE)O=, L=, S=, C=CertGetEnhancedKeyUsagekŪDO•EuOn۹v8 bDummyNameNeutral\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\LastWriteTime\SystemRoot\System32\AppLocker\{........-....-....-....-............}.Policy\SystemRoot\System32\AppLocker\{%08x-%04hx-%04hx-%02x%02x-%02x%02x%02x%02x%02x%02x}.Policy\SystemRoot\System32\AppLocker\plugin.%I64i.PolicyPlugin.*.Policy\SystemRoot\System32\ApplockerPZXHWƚl n;<?pK"RtlQueryFeatureConfigurationRtlNotifyFeatureUsage%PROGRAMFILES%\Registry\Machine\Software\Microsoft\Windows\CurrentVersionProgramFilesDirProgramFilesDir (x86)%OSDRIVE%%WINDIR%%SYSTEM32%%WINDIR%\System32%WINDIR%\SysWOW64%REMOVABLE%%HOT%\\.\MountPointManagerQ,/m2FV \9YSHA256Microsoft Primitive Provider1.3.14.3.2.26HashDigestLengthObjectLengthCATADMINկH\v:.iOriginalFileNameProductName\VarFileInfo\Translation\StringFileInfo\%04x%04x\EDP://EvaluationFlagsEDP://ExemptEnterpriseIdsEDP://EnterpriseIdsEDP://PolicyFlagsPEDP://IntentEnterpriseId\??\AppidEDPPluginExeAllowExeExemptAppxAllowAppxExemptEnlightenedEnlightenedAllowedPermissive\REGISTRY\MACHINE\System\CurrentControlSet\Control\AppID\Configuration\EDPAppxDisallowedIsExemptedExeDisallowedIsExemptedDataContext\REGISTRY\MACHINE\System\CurrentControlSet\Control\AppID\Configuration\EDP\EdpLiveEnforcementEnforcementLevelUserOwnedPZXHWƚlPZXHWƚl$RHDEH ?ApPF pH Hp > H tHHHHH4 H:R(HXpFHZ4H |x!8<""(  artxAPPID://FQBNAPPID://FQBNPXH8WEKYB3D8BBWE\MICROSOFT.COMMSPHONE\* artxAPPID://FQBNAPPID://FQBNPxh8WEKYB3D8BBWE\2A4E62D8-8809-4787-89F8-69D0F01654FB\* artxAPPID://FQBNAPPID://FQBNP`P*\5B04B775-356B-4AA0-AAF8-6491FFEA5902\* artxAPPID://FQBNAPPID://FQBNP`P*\5B04B775-356B-4AA0-AAF8-6491FFEA5903\* artxAPPID://FQBNAPPID://FQBNP`P*\5B04B775-356B-4AA0-AAF8-6491FFEA5904\* artxAPPID://FQBNAPPID://FQBNP`P*\5B04B775-356B-4AA0-AAF8-6491FFEA5909\* artxAPPID://FQBNAPPID://FQBNP`P*\5B04B775-356B-4AA0-AAF8-6491FFEA5905\* artxAPPID://FQBNAPPID://FQBNP`P*\5B04B775-356B-4AA0-AAF8-6491FFEA590A\* artxAPPID://FQBNAPPID://FQBNP`P*\5B04B775-356B-4AA0-AAF8-6491FFEA5906\* artxAPPID://FQBNAPPID://FQBNPD4*\MICROSOFT.WINDOWSSTORE\* LartxAPPID://FQBNAPPID://FQBNPCN=MICROSOFT CORPORATION, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT.DESKTOPAPPINSTALLER\*07db5aac-cbb4-41c6-a34e-6d1d495b1900D:(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"8WEKYB3D8BBWE\MICROSOFT.COMMSPHONE\*",0}))))Microsoft.CommsPhone, from CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US07db5aac-cbb4-41c6-a34e-6d1d495b1901D:(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"8WEKYB3D8BBWE\2A4E62D8-8809-4787-89F8-69D0F01654FB\*",0}))))2a4e62d8-8809-4787-89f8-69d0f01654fb, from CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US07db5aac-cbb4-41c6-a34e-6d1d495b1902D:(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"*\5B04B775-356B-4AA0-AAF8-6491FFEA5902\*",0}))))5B04B775-356B-4AA0-AAF8-6491FFEA5902, from CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US07db5aac-cbb4-41c6-a34e-6d1d495b1903D:(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"*\5B04B775-356B-4AA0-AAF8-6491FFEA5903\*",0}))))5B04B775-356B-4AA0-AAF8-6491FFEA5903, from CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US07db5aac-cbb4-41c6-a34e-6d1d495b1904D:(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"*\5B04B775-356B-4AA0-AAF8-6491FFEA5904\*",0}))))5B04B775-356B-4AA0-AAF8-6491FFEA5904, from CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US07db5aac-cbb4-41c6-a34e-6d1d495b1905D:(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"*\5B04B775-356B-4AA0-AAF8-6491FFEA5909\*",0}))))5B04B775-356B-4AA0-AAF8-6491FFEA5909, from CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US07db5aac-cbb4-41c6-a34e-6d1d495b1906D:(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"*\5B04B775-356B-4AA0-AAF8-6491FFEA5905\*",0}))))5B04B775-356B-4AA0-AAF8-6491FFEA5905, from CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US07db5aac-cbb4-41c6-a34e-6d1d495b1907D:(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"*\5B04B775-356B-4AA0-AAF8-6491FFEA590A\*",0}))))5B04B775-356B-4AA0-AAF8-6491FFEA590A, from CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US07db5aac-cbb4-41c6-a34e-6d1d495b1908D:(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"*\5B04B775-356B-4AA0-AAF8-6491FFEA5906\*",0}))))5B04B775-356B-4AA0-AAF8-6491FFEA5906, from CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=USed59d942-4356-4ec7-8015-d1923476508bD:(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"*\MICROSOFT.WINDOWSSTORE\*",0}))))Microsoft.WindowsStore, from CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USf3eca261-b35c-4c40-b043-d671e122ee03D:(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"CN=MICROSOFT CORPORATION, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT.DESKTOPAPPINSTALLER\*",0}))))Microsoft.DesktopAppInstaller, from CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USApplocker Private\LowBox ACE(A;;FX;;;S-1-15-2-1)LowBox ACEApPF <8HfHtfVHfH.pH8f H!b f"HZ$"h>%H&%.'H(v'h)Hl+ *bJ,H-,B.HH0.`$1H2l1h3H^54^6686n6(6476(7H7^7`  8artxAPPID://FQBNAPPID://FQBNPO=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT WINDOWS OPERATING SYSTEM\FSQUIRT.EXE 8artxAPPID://FQBNAPPID://FQBNPO=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT WINDOWS OPERATING SYSTEM\NOTEPAD.EXE 8artxAPPID://FQBNAPPID://FQBNPO=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT WINDOWS OPERATING SYSTEM\MSPAINT.EXE DartxAPPID://FQBNAPPID://FQBNPO=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT WINDOWS OPERATING SYSTEM\SNIPPINGTOOL.EXE 8artxAPPID://FQBNAPPID://FQBNPO=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT WINDOWS OPERATING SYSTEM\JOURNAL.EXE 8artxAPPID://FQBNAPPID://FQBNPO=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT WINDOWS OPERATING SYSTEM\WORDPAD.EXE <artxAPPID://FQBNAPPID://FQBNPO=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT WINDOWS OPERATING SYSTEM\XPSRCHVW.EXE artxAPPID://FQBNAPPID://FQBNP~CN=WINDOWS CENTRAL BUILD ACCOUNT\INTERNET EXPLORER\IEXPLORE.EXE <artxAPPID://FQBNAPPID://FQBNPO=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT WINDOWS OPERATING SYSTEM\WMPLAYER.EXE 4artxAPPID://FQBNAPPID://FQBNPO=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT WINDOWS OPERATING SYSTEM\MSTSC.EXE artxAPPID://FQBNAPPID://FQBNPO=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\ADOBE FLASH PLAYER UTILITY\* 4artxAPPID://FQBNAPPID://FQBNPO=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT WINDOWS OPERATING SYSTEM\BASH.EXE <artxAPPID://FQBNAPPID://FQBNPO=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT WINDOWS OPERATING SYSTEM\PREVHOST.EXE 0artxAPPID://FQBNAPPID://FQBNPO=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT WINDOWS OPERATING SYSTEM\FTP.EXE @artxAPPID://PATH*15bc27d3-941b-424c-82e9-a32b1670cd2fD:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT WINDOWS OPERATING SYSTEM\FSQUIRT.EXE",0}))))FSQUIRT.EXE, in MICROSOFT WINDOWS OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=USa6e2b74a-89a2-43fc-bab7-da5be58846a0D:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT WINDOWS OPERATING SYSTEM\NOTEPAD.EXE",0}))))NOTEPAD.EXE, in MICROSOFT WINDOWS OPERATING SYSTEM, from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=USa6e2b74a-89a2-43fc-bab7-da5be58846a1D:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT WINDOWS OPERATING SYSTEM\MSPAINT.EXE",0}))))MSPAINT.EXE, in MICROSOFT WINDOWS OPERATING SYSTEM, from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=USa6e2b74a-89a2-43fc-bab7-da5be58846a2D:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT WINDOWS OPERATING SYSTEM\SNIPPINGTOOL.EXE",0}))))SNIPPINGTOOL.EXE, in MICROSOFT WINDOWS OPERATING SYSTEM, from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=USa6e2b74a-89a2-43fc-bab7-da5be58846a4D:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT WINDOWS OPERATING SYSTEM\JOURNAL.EXE",0}))))JOURNAL.EXE, in MICROSOFT WINDOWS OPERATING SYSTEM, from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=USa6e2b74a-89a2-43fc-bab7-da5be58846a5D:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT WINDOWS OPERATING SYSTEM\WORDPAD.EXE",0}))))WORDPAD.EXE, in MICROSOFT WINDOWS OPERATING SYSTEM, from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=USa6e2b74a-89a2-43fc-bab7-da5be58846a6D:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT WINDOWS OPERATING SYSTEM\XPSRCHVW.EXE",0}))))XPSRCHVW.EXE, in MICROSOFT WINDOWS OPERATING SYSTEM, from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=USa6e2b74a-89a2-43fc-bab7-da5be58846a7D:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"CN=WINDOWS CENTRAL BUILD ACCOUNT\INTERNET EXPLORER\IEXPLORE.EXE",0}))))IEXPLORE.EXE, in INTERNET EXPLORER, from CN=WINDOWS CENTRAL BUILD ACCOUNTa6e2b74a-89a2-43fc-bab7-da5be58846a8D:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT WINDOWS OPERATING SYSTEM\WMPLAYER.EXE",0}))))WMPLAYER.EXE, in MICROSOFT WINDOWS OPERATING SYSTEM, from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=USa6e2b74a-89a2-43fc-bab7-da5be58846a9D:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT WINDOWS OPERATING SYSTEM\MSTSC.EXE",0}))))MSTSC.EXE, in MICROSOFT WINDOWS OPERATING SYSTEM, from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=USa6e2b74a-89a2-43fc-bab7-da5be58846aaD:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\ADOBE FLASH PLAYER UTILITY\*",0}))))All files in ADOBE FLASH PLAYER UTILITY, from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=USa6e2b74a-89a2-43fc-bab7-da5be58846abD:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT WINDOWS OPERATING SYSTEM\BASH.EXE",0}))))BASH.EXE, in MICROSOFT WINDOWS OPERATING SYSTEM, from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=USa6e2b74a-89a2-43fc-bab7-da5be58846adD:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT WINDOWS OPERATING SYSTEM\PREVHOST.EXE",0}))))PREVHOST.EXE, in MICROSOFT WINDOWS OPERATING SYSTEM, from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=USc5eda911-57da-4638-8557-c261ba130391D:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT WINDOWS OPERATING SYSTEM\FTP.EXE",0}))))FTP.EXE, in MICROSOFT WINDOWS OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=USApplocker Private\LowBox ACE(A;;FX;;;S-1-15-2-1)LowBox ACEApplocker Private\LPAC ACE(A;;FX;;;S-1-15-2-2)LPAC ACEfd686d83-a829-4351-8ff4-27c7de5755d2D:(XA;;FX;;;S-1-1-0;(APPID://PATH Contains "*"))Allow AllApPF p  H N Ln H"f lHVHd&bH4>H|z|H\Zz8(HN6 P artxAPPID://FQBNAPPID://FQBNPCN=MICROSOFT WINDOWS, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\FILEMANAGER\* @artxAPPID://FQBNAPPID://FQBNPCN=MICROSOFT CORPORATION, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT.MICROSOFTEDGE\* XartxAPPID://FQBNAPPID://FQBNPCN=MICROSOFT WINDOWS, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT.WINDOWS.CONTENTDELIVERYMANAGER\* 4artxAPPID://FQBNAPPID://FQBNPCN=MICROSOFT WINDOWS, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\WINDOWS.CONTACTSUPPORT\* XartxAPPID://FQBNAPPID://FQBNPCN=MICROSOFT WINDOWS, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT.WINDOWS.ASSIGNEDACCESSLOCKAPP\* LartxAPPID://FQBNAPPID://FQBNPCN=MICROSOFT WINDOWS, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT.WINDOWS.PARENTALCONTROLS\* ,artxAPPID://FQBNAPPID://FQBNPCN=MICROSOFT WINDOWS, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT.MOCAMERA\* tartxAPPID://FQBNAPPID://FQBNP *\*\*07db5aac-cbb4-41c6-a34e-6d1d495b1901D:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"CN=MICROSOFT WINDOWS, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\FILEMANAGER\*",0}))))FileManager, from Microsoft Corporation07db5aac-cbb4-41c6-a34e-6d1d495b1902D:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"CN=MICROSOFT CORPORATION, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT.MICROSOFTEDGE\*",0}))))Microsoft.MicrosoftEdge, from Microsoft Corporation07db5aac-cbb4-41c6-a34e-6d1d495b1903D:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"CN=MICROSOFT WINDOWS, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT.WINDOWS.CONTENTDELIVERYMANAGER\*",0}))))Microsoft.Windows.ContentDeliveryManager, from Microsoft Corporation07db5aac-cbb4-41c6-a34e-6d1d495b1904D:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"CN=MICROSOFT WINDOWS, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\WINDOWS.CONTACTSUPPORT\*",0}))))Windows.ContactSupport, from Microsoft Corporation07db5aac-cbb4-41c6-a34e-6d1d495b1905D:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"CN=MICROSOFT WINDOWS, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT.WINDOWS.ASSIGNEDACCESSLOCKAPP\*",0}))))Microsoft.Windows.AssignedAccessLockApp, from Microsoft Corporation07db5aac-cbb4-41c6-a34e-6d1d495b1907D:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"CN=MICROSOFT WINDOWS, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT.WINDOWS.PARENTALCONTROLS\*",0}))))Microsoft.Windows.ParentalControls, from Microsoft Corporation07db5aac-cbb4-41c6-a34e-6d1d495b1900D:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"CN=MICROSOFT WINDOWS, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT.MOCAMERA\*",0}))))Microsoft.MoCamera, from Microsoft CorporationApplocker Private\LowBox ACE(A;;FX;;;S-1-15-2-1)LowBox ACEfd686d83-a829-4351-8ff4-27c7de5755d2D:(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({"*\*\*",0}))))(Default Rule) All signed packaged apps =F,"t핐c?"t%t u4(-Ft Ft 3Fft4 F tChRP(FRhQhPRh~$vPvL^_^[]̋Wt$uV7\VjPT^'g_̋USVu مu KWFPj\PXu2,'}tVuGVPp;s_^[]3 @@3 @@3 @@̋UE3@]̋UV5tujQjY)^]̋U3ʼnEMS] VuW3t(PVjut;;7t +#3tWhPWu2>QAu+ʍx\t H;wUPM_^3[̀=VXuj@Vjh^%̋UVh4xhTPtuu u^] ̸;W;jt^@tLt:t(tp:f4\RH >pt:zt({t~53#~;ctZtH>t6Ft$GtruUsca%Y| toOt`tQtItP#=uɅt91#= u~"Ɂ 3 +̋UjhdPVW3PEd0uhu֋PPuN9Md Y_^̋UjhԢdPVW3PEde0uhu֋PPu8~ Md Y_^̋Uu3QQj3p]̋UE St?=w8VW}MQup3VPWhx ;wu >>z_^WtM[]̅u3@ÍQAu+ʍA̅ujXÍQffu+M̋UQS]VWjYEKHKUBX0t >u9z\s7MWjIX`UBX0HF##BPs]7u׍NQs7N Qs 7N$Qs$7N0Qs07NLQsLz7NDQsDj7NHQsH6N8Qs8J7NH̋Ujh=dP3PEd9t e1Md Y̋U E SVuW3ɉGFGO fF(fGGGEFPGFTGG NEIN$!NL؃$t9_(s-jYEtw$\VjPTEG$_(O$tBw(G }Pw$*u֋wL*u֋w%*+VjPU _^[̋UQQVW}Gwk,;t/S^$3\V3VPT3[,s؍C;uދ}[w\VjPT3!GG_^̋USVWj,_V^ uIjYЉVjXfF3fF;tf:;uVt`ۋ]t,Fk,;t~ 9zv;Ct8,B;u~F3N@3k,BfFFBRS_^[]jã5D3ۋt_]9^uU]#x 9^uEFvMF#t)Ej Y3ҋL99tIu'Ãt9YuFA̋UQS]2VW}u VSVt~:u3@@4u 4}@˥u yAu+ϋ+Ã~2\CJyAu++y;rWrVSD_^[̋UjhdP SVW3PEdE3ۈ]98t_Q tP9tLuMWMty0ExQ0֋M ؋E]@Eu׋E5tPu֋Md Y_^[̋UjhdP3PEduU M9@t:3A <A}"@qt u@ <Md Y ̋Vh(3VVh4ȅt6W=t@tQppj Y^_^̋V3950t5050 (, tRQ05(5,^4o> x : 3@ ̋U jXjfEUXQQfEE0^.3@ ̋Wtt%Vq؋N >>^t PZDt O_>_jjhhH, ̋U} SuH3 $0Vu4[} uU384tw=4V5W;t(F F tv v<^^ 6u=_^3@[] ̋U I3SVWEEEEPj>]EP}utjhjjjhSDu%0 0@0/EP Rt MtoVt<t tWL_^[̋U3ʼnEMESVU3ɉEWMMֈM߈MމMMĉMMMMMMMMMM9Nu h|vH3YCY jXjfEȍUXfEʍEPEȈ]PEEPEEx9]u]׀}Ft~tAUbt\uEP`vEP`F E̋F$zNEPEPUScuuEP`uEP`EuDtP랍UuEvP`vEP`FE̋F ủE؍ME3PFJMt E]މEME3PMJxlMt E]߉EMčEPu؍UVQM=x?MEЉEAEA E߈AEAEĉAEֈA3ɉMЈM߈MބsMt:MЅtq؋N :y:}tMk:}]MY:P~ }tu'3PPjPjSvD}u3}]~t vEP`M؃e#ÉE#ÉE#ÉEh#j#ˉEhHM|e؅thdSE̋NEًɃe#ȍEPQ>u؋xEЋPu̍U?x3t ?Sw=t@tWppj Y}tEtPLMЅt P>M8M8NjM_^3[y̋Vh|VHYYu^h|VHYYu^hVHYYu^hVHYYu^hVHYY%^̋U|3ĉ$xSVWjX]|$HjfD$|3XjYfD$z3jY$D$|jY$T$@T$ jD$$3T$8T$4T$(T$,Y|$tC;u>f{0u79Ct2h|sHYYu93D$ 9Ku9Ku C C$u9Ku 59Kt9K(t$9{ t{ u9{tjYD$,L$,PQD$0P$P$PtjCQhQ$\$s$Tu$h$TZ$xsD$LP`$PPD$TP`L$H`y6=8@+L$HQVppjY/D$\D$49x u3|$ u, tAtD$HPQqqID$\9|$(u+9x +jjhh ,9|$( D$\9x |$ QhQ$l#h$d8#Vh$d#;h$P`$`P$P`$O_y3=@$QVppj$39H t+@t%QQh5,5(d3Kt(D$$PD$PD$8P_|$tT$\|$(OT$\z AR$ T$$Py6=@VppjYjT$Y D$tA APqqjY$L$~hy+=t@gVppjZh$jPȺD$h3҃ ȉL$,9P T$dT$hT$lT$pT$@T$tT$$t 1$$t 0$L$0o_|$t t$L$\yt|$4tA$#t0$_^[31]|$D$0D$$D$tT$dD$L$ xT$D$BT$D$;rL$ E3L$$H\$|$׋YD$tP_^[]̋UQdSV3Wu950u>EP3h4VVhEPt6M03 !EWV55V50SV u0}t u_^[̋UE 3A< r< v< v<uE E jW83ɋ]̋U3ĉ$ESVWD$3Ej0D$ D$hVPt$DŽ$Ep ;DŽ$NDŽ$SDŽ$56DŽ$d+DŽ$GDŽ$YDŽ$rIDŽ$PZXDŽ$HDŽ$WDŽ$l葰 $j0VP~ t$ 3t$$|$Ht$(މt$,jYt$Wj\PTu>;u_^[̋UVWh3Vuu uVt P_^]̋Ujh dPSVW3PEdt e0SE V8EMd Y_^[hjGQ3j@;PhXhP hW}PWP.u PnQEP"y!WQMjbZ{WQMjkZn&ptFA3tEKMt VESy.WQMj蹣ـ=5tք EKP\uV3KVK V9ut%u0EuwMW8:SV\PTutVE@ Ԣ̋UjhdPV3PEdNJN+~t evMd Y^̋UjhdPV3PEd~tev6M>tE6Md Y^̋USVW}j@UZ'jY#؉]uBVQMQ3ɉMMuUQPQVMyVQMEEPue3MM_^[S̋UQMA(W}E;t;SVt$[N@Vj\PTuߋE;u^[_̋UV1jjV=t t =u3E0^]QMy̋!tPj\PT̋UUSV3ۋM Wj0~FFAF Y[SjW赡 fG3j Y_^[]̋USVMڋMWMQQMuE}EEPuuu u_^[̋UQSV3W;tE}t>f9t9u+މE;s E t+ &PWSVE t0E E t_^[̋UQSVڋW;t9}t2?t-+މE;rPWSVE t0E E t _^[̋UQjuuuu ub]̋UjhdPdПSVW3PEdًEe3ufFQ2~Džt Dž3A TA3ɋ3Džt53t։5thPP֋5tP֋5tPփ|=uP5t ؅u'5ty8uqPPP\5t"=uWPPfuPP=t5t փM^̋U]ŐUSVMڋMWMQEuQM}EE䥋Pu _^[̋U SVWu‰MQQhpEp؋ˉ],UuQE}QMEEPu L_^[̋Uh膜3ʼnES]EVuW}ShMShU SjPVjWQRSM_^3[訐̋Ujh)dP`3ʼnESVWPEd]e3Uf B3Azt Dž TA3ɋ3Džp53t։5thPP֋5tP֋5tPփ=uP5t ؅u'5ty8uqPPP\5t"=uWPPfuPNP=t5t ֋Md Y_^[M3,s̋Vx3^V==u^̋UVW΋f8tu%? t&эQu#+Q# _^]̋UVWt'E +t<ft f9Nuu_ҁ3f^] ̋U 3ʼnEEVu QDžQDžQDžQQjPhx M3^蒌̋UESV3Wt 0f9tHj^uSj]SVQjPWRj+u uP0_^[]̋U03ʼnEVWjZ3f}ffEԍEԉE؋FEEEPRWWh5,U5(}}}y) tAtPVq<qj YM_3^茋̋U3ʼnEESVW}E Qu 3u؉tu9]uE9]uE3}jY󫋍3,Dž04f‰^|?I73ҋHE$XjX`|LPΉT\dỦUԍEE\=s3҉9S>3@Ph\Vtmf~3@9FFff3fhlDžptF@x|EU3@PhTVtXjXf9F33@9FuFf@fEUEUFHEUMU83@PhLVjXf9F3@9FF@ff;ffFH2pPVJQr P蛍F PPPPRhAj2P  BAff;u+ffUf3҉M3MEMUEU3ҋ@;CPjRRu uxatntctRt ;Ft<M_^3[À  tAtPVq<qjYn̋U3ʼnES]VWÍ3jZjDž @P`f3ffF(0E8EH$,4Hu+vWj{XjYj}fE}XjLfEXfEfEE_EFEERPM3^}̋UQQSVWjDVSt<jV4Stt,Eff+fffGu _lȉMOuD}PwQ蓈 +PFHMPAPp NO3_^[̋UVu Wu 1S]EPu3NVSx;wu 3fs[_^]̋UVWhjh @xH%h3DjhT-lhPxr؅x 3_^]̃=Dt htjP%h%D{Bd0Qjpd0Qjp̋UVW3EWPu E}u}PWWWV=u WWVE_^̋U jeUXjfEXj*fEXj,fEXfEEPEEPEPEE BWEPEPU2W̋USVW3U}WMEQWPpzt"t V-ME @؅u|P+uESPWVptV5EPCEPVdt WE}PVztt 뢋E ЉUu|PvEH;q";rpREPutVfu|Eh, uht!VW_y0V PMA΋ÉMx E8Et u_^[̋USVWj8MYu؅u j83WSE  E=vȉMuuPvQ謃6uMj\XfPqV荃EKj\XWf!F!FEffC EC E QEQCK3jXfAS(FA3qYA K0Mf2fC*s,_^[̋UjjZREPREPREPREPQh!j+u uP8]̋UESV3Wt 0f9tHj^uSVQjPWRj+u uP(_^[] ̋UMVtэrBu+BjZjRQj h!j+u uP ^] ̋UQSVMW3uQhWVE8Nh FHFD3@M ^F@f1_^[̋Vt<t-W39~39~Ph!jAX+PEP G;rҋ=]tG tEPww =Extmu!VQN =x*t+Gt%Qw!wj Y^= Uzt } zJ}VU PQNPPPPv|Oyf=t(t G@tQw!wj Y=t2G@t !PwwjYf=tnG@t0PQPRwwjY=t0G@t*PQPRwwjYU}tzt ؅x5jZtMA Fh!IuM_^3[p̋U SV3Wf93u VSSOωU}~f;ZR؉]܋E%E"E\E*E?f;Etf;Etf;Et9}u f;Etf;EuAuыuK=v E+E؍ffFȉMNu!EN>~Uj%^Bf;t#f;Etf;Et}u f;Et f;EtfLf1Buj%ˀ 7‹U fFË]Ƀ7fȋEfHN^M]p3fE_^[̋USVÉMWE3f3!U!7!w}Ef9EAMj%ME%^f90uBuQ^k;s M+fAfG؉_u[U3BHf;Eu-E;V3fBӃ HNxUfGf;}r3fy}Ot F'g_^[þ ̋UQQSVWU3Ew؍Bf w w,0"Bf;Eww,7BjZf;ww,WËUFr _^[̋UE St>=w7VW}pE3PuVW<x ;wu >>_^ tM[]̋UQQVWE3P u}t"~ PLDj^uDu<4 P_xVVVPHu ,$VPTu 뿋HU]t V}uu`Vuu}tMtN_^̋USVپ  W]s DE3QQQPHEj Yj3EZU荽dU}쫍ujYjXE}EЍ}33ɫ3QFMVQuuث3}u쫫EЉEE}EH}E}UuEOI t~ P}uFG(x vD@x v9@@t-83҅t%p3ɋ#: ]uRAuMeEEEEeEhdPh(j8t)B;r΁QK EC _^[̋U3ʼnE3ɃA|S]VxpWPh(jDž DžptDž4DžDž8u6@t~ %~ VE3SPPVPu(0 ǺPhSSPXu0 ǺÍPSEP\RhjPo Dž jPSLBDžH(P3ɍE܉`djXH3@Ph(jLhlTX\Dž4Dž8te~ VtlPjEP\؅01440 Ǻ| ǺPZtjS<tj@M_^3[7b̋UH3ʼnEVEkŪEDEEO•t1j4EjPm E4EEuPEPj8M3^a̋U SV3M‰uWEދSWu VPQ,؅wxtl9uu uBj^sx%ff;uftfPf;QufuދtE8E@EsEMo jo^0tT_^[ ̋U,S3EVډEWEEEEEPh%QjZt)t!~ d\P^EPh%QjZt t~ TL뻍EPhL&QjZmt t~ D<끍EPh&QjZ3t#t~ 4,D}}u}u }3EЅu}Off;Eu+2 twQh'Q 3fuUEt:uȍQff;Eu+ʃ h'ru fEUtAu ȍAEff;Eu+M h'*u UEt=w7S]3WxEPuWSx;wu 3f{_[ tM3f^]̋UWtMwEVf8tu΋+#ȋ%? ^tQu+Q O _]̋UjQRj+u uP]̋UD3ʼnESVWjjEUPEPSy3=@Vp,(pj Ym}^M R}Ѕu ?uWy3=@Vp,(pj Y_?ApPFWO ;M;G E=w_k;g;_;3ۉE܉]9_ }܋}};}9My}l}܋E܋ @}};}M9MD}7}܋E܋@}};}9M}EE؃}9}؋}ЉEJOωM؀9hf9AYyO9YF9Y =y 3  (;A$(;A((;A(y A$;G Q(t=+x;}rnH;OwfJMȉM;ȋMrSE;GwKA$CU;rËEĉ8=@uppj ,(Y}=@Sppjˡ=tm@tgppjR=tQ@tKppj6=t5@t/ppj=t@tppj ,(Y  M_^3[,W̋U,3ʼnESVWjjEUPEԋPSy3=@Wp,(pjY{}M u uV y3=Z@PWp,(pjYx{7>ApLF~kF $F;FU;kFN;;FF;F;39^ v2FƋH;HrL;wHHH;Hr=;Nw8C$;^ rًN~vF3ҋH;Hr=;Nw8B;VrE܉0|=t]@tWSp,(pjYzA=t5@t/ppj=t@tppj,(Y } M_^3[T̋U43USVWPE̋؉EԋE؉EEEEEEPEE<(PMEP(E xzu E SEPEPxu_PEPVEPStzuGE Mɉut$t WEPVEPStu E83j^Mwp_^[̋USVWU3҉ERMUQRPUUpzMEVP3PupNQff;u+ MNEQff;u+ MU؅t|NAEff;Eu+MMPvR^N Qff;Eu+MPvS^E MEM FF A3Ej_(M _^[̋UESVWMj3ɉU[t f9tHӋυuEuUMt3f9Et~ ujRQjPSWjVuuj+u uP8_^[̋U4S3EMVWEEE@M؉EEEigj jEPEPhEPCuEPjG rɅxE_^[̋USVW3ۍEP]]]P9]t EPEG_UE,]yY4t::t2=@txVu(+ppj Yb_j Y31ЉWtG:GˋЉEy3w uQQ-j YE8t jY3tS}t u _^[̋UpSVW3MjY}U3EUUUE U}UEUUUEPUU܉UP9ut EPE̍MO؅LUM؅7MU؉]}9wiWG!uljUЉE9w d3ɋ}ȋ;}AukJe˃z v|3E}]ċ;}]uTE@Euu&3ҋ+;]u BuEU38EEH#AAqEE؃@E;B rEMԃ$AUЉM;O A}]wkȉE؉]uZu}EPEtPMt ֋PEP}t u _^[ ujSY Eh(Ptwe{u؉}FPFPF PF PF PF PF PFPFPFP6Eh)Pu؃8 3MEEEEEEEE؅E38MUI#H gGE@EХ}ԋu؃}ԉu;E/M3EuE 0%̋SVWمtstau_^[ŐU(ASVW}ljUMEt} u} t}]t- ;tLAtGuRq(+qj Y( ;tAtRq(+qj Y Ǻ0%;==tV=t-= ;Aqqjo;rAeqqjM;t^AtUq(+qjYT :;t"Atq(+qjY, } E tEk]3UZC fEfEftCljE܅t-;t)At Eغ(+PqqjY UCfEfEftCljEt$;t AtE(+PqqjYCfEfEft EE}CuMEuuPEPEP&;Aqqj;Aqqj=@=P=`tg=ptI=t+;AWq(+qjYn|;txAtoqqjZ;taAtXqqjC;tJAtAqqj,;t3At*qqj;tAtqqj(+Yu3uuWWW} u Uuu!衽_^[̋U3ʼnEVhjPTu uhP*hP xPV%?M3^H̋UDSVWjT[jfEXfEEh!@EȍEjPEM3ɉ]PhEMPMME*EME@MЉM]tumۉ]HjhTjj SWEPjjju}Gv3QfLGGQP8 Eڅuu08u^V LE;]| ;EvE]]t !uMu&Ӂtˁtׁu빾b}t u_^[̋U3ʼnESډMV3{vdWjX}hEPQu0t x){t#SEPuu0t _M^3[@F̋U SVW3Uu}ޅt ދMt X؅tBEPuSVVWuG0zt0t #u }럾y tE_^[̋U SVW3U}u߅t ߋMt ؅tBSEPujVuG0zt0t #u u럿y tjE_^[̋UQREEPjj Qu&0zu#0t  3̋ttktWtCt/td1wi҃΁–3E 3E333҃Bø̋USVuWщ]j3UY!T$T3Kttt uj jjj^]33 G;Ct ϋ];];tt u3@3VQMVQMix3GE@s[]BEÃ?Et?;u3]ʁF Mƒ ];tă~]u M ^~N _^[ uSSS̋U S‰M3ۉEV1W} ]g΃;t3vE؉WGÁ ȋ%Pw;s]3҉_B]G3с?3ʋU ;toփg7_^[̋U S‰M3ۉEV1W} ]g΃;t6v} 3}WGÁ ȋPw;s]3҉_B]G3с?3ʋU ;tqփg7_^[̋U@3ʼnEES] VWQPEĉM܋ PjY}= u܅tEP5jVh!tt փ!S.M39E_3^[_@ ̋UQVW} ʃMuu Q2t+5t!j3ɍEQQPWQ5h!_^ ̋U$SV3WF<t<t3BjY3}QRV MMЋE3#UɃ  Ћu F@ 3}  tnvtg^t_yu9yu39tMMuыPEU#èjX 3t yt3@ǃ ؃Ãu׋_^[̋U$S]V5W3D$L$|$\$ t֋D$D$T$T$D$ zu #|$|$T$tu 3 3u 3%3΋ ;t؋D$ ËT$u!tt$BPt$$Ӆu D$ 3% 3U _^[]̋UQQS] VWuu S؋}tWSQMtu WS_^[ ̋UVW=t u)j j^t3Euʋ ;t_^]̋U 3ʼnE3USV39EW}E3=u1uhxh8+P=thEPEPuuׅu7M3F$?CEC C#ƉC =uM3F#ΉKM_^3[P<̋UQQe}MfUtfMV5u8uhxhX+P5u9EP^̋Uu uQ]̋UQQtuPjY̋U4VjYjZjXjfEXj"fMfMYj$fEXj0jhfUET,Eh,fUE|,fMfEEܔ,fMfEEԸ,F h8hP!PEP`j UMxwE辐֋E칈jXfxIj ֍Mx9jU؍Mx(=tjUЍMxx ^̋U VWh=t33uyt =tgEP`EP`eEPEPUxiEP`jUMx<LJ(rx h_^ËM蹽4u,̃=8V5;t8SWދ6Gt OpCtOaZ;u_[3Ɖ58(r 5t; t 5^̋UeSVWjEWPt jY購u ]t9UEy 蜼O9Mtt 腼g}=t@tWu4-ppj YHM^F AFtaFGFtg9HtjY)Np5E_^[̋U@3ʼnEESډEVWC}ȉufE襻E܅u SEPU؋yMt6;t2GfEZE܅tWEPM̍UTxE39xЋ M }}}EA}E9}th,EP`9}th,EP`|uLt+ʁv+fMfM膺E܅LQtPA +PCPDEPAM̍U؃ TGS=GOt EЋAEUxHUЋ O t5E+ʁv*MԾ;Ot˹M_^3[P5+MfMfM芹E܅tLO QwP@MЃ +PCPG EP@M̍U؃ ^yMRM;Ot>k?X̋U4SVW33fEuus OA:u`Hf;rLfEfE譸ȉMu APEwP? 0xj\Zf9uf;uGC\EEj!EEE؍EjPEЉuPhEE@PuuxM3VVVS=3}t uuEEE؍EPjEuPE@uuE;Gu 3ufEEPEPu#uEEM=wEt}EfEUȉMEPEPu>ME3ɉECM}t uMt ;Ot _^[̋QV53W x6;u_^Y̋U SVW3G5ÉE;V O<fFf+F fGfEfENȉMtwFPvQ=N G+PGPFEPc=Ot OOEGEG3@OEE6S4_^[̋U,ES3ۉU!]!XVW} Mt!_t!jjXPEEPEPQMtE܉MtEEt \E9؅Yj uESPuEt;v MtjEE @EtE ôMuuPu@ME;Esu8EME럸EtXfjYfMffAYMAUj\ZfC3PAP}; 73!G+UEJt #EUEfBЋEPHjQRu@UEJ;su0f;sf{\t "EEt}M\Et_MQuPju tƅxCE9 ,f+ ffOȉOtPEpQE: EtyC]Kt ۲ctOt Dzg]t t豲#_^[̋UP3ʼnEESVWjE3hSEE܉EGtIOG-ȉOtGP5Q]9E !0׋reEԃeej jPEEPhEE@P]y4=$@VSp4-pj Y衠]EjP3ɍEQQh -PQQQu y3}u }eE܃ejPj EPh-EPjjjuxM(sj(YMӰ؅uESj Ph-EP3PPPux$CtHtt HtuE 萰}t uyOt qgM_^3[+̋USVW3ۋShjSjSh-DEu0ȉEݯȉMu ~ffPvAP6 Et 路E蔯؅1uESuuh0mP3PPPuEtCPW`j\YM`tbGf9H`Gf9HE?f;Mtf;MuoMf9Hufj\Yf9Hu]fxVuVfx ouOfx luHfxuuAfxmu:fxeu3fx{u,j-Yf9H&u#f9H0uf9H:uf9HDufx^}u 3!Gf,fW胮ȉOuPCPQ5 tMeuL_^[̋VWf;s3)эJ;vFP\tfujVW_^̋Ut 6&Nt f^̋U3ʼnEESVEE WE3EPVh-0u0+Eĉ}PWE}P}Љ}ԉ}؉}E(tjPpWP1 xuԍE쉅t΍EDžpPWPp]PEDž|-E}֋MI؅uruԍESPpPօu0tB7Ct+ w&u9rPsu0C #荩M_^3[%̋U3EEEEEPE E@Pu ŰUQQSVWEE0P3h]utҨEPVWjXPuuttuwOA=wjuef9\O uUu tf9\OuCfG] jYf+fGfCHȉKu CPG PQs/ $*}t u_^[̋UQQVWEE0P3hunxf}tΧ讧tFEPWVjuutDžx~u~u E N $}}t u_^̋UQQeEVPh\ExjEPjjhdu }t u^̋USVu ډuEW}}t(VWuuuu uӋ؉]uEU VWuuu؉E3xntf9tY3f9uNl3F:PVVE3PX؉]x#}tN6EEF3Gr 33ۋtNG^r]_^[hLho,ًEE EMu33>~9y}WWPPhjh.$B\5; y(A0A4A8A<PP@.ШAPPht.hP]Kff;u+ljz 3f 4pP\xQVQ+Ѝ APPu3P׋xt׉GOGumffGPw\* G3fHn3@j^E3@Ëe苵EƋMd Y_^[̋UQVWjZ3;|If;rAS;w9EPSOnx$MG ;wA;vƍ 83[_^̋U3SVWjZf9FAf;j\YjXf9t@؅fj\}Zf;t fuƋuEЋ+tCCPEP`lju+fEfEEjPEP(t؋E;rjZ_^[jXj\YMN3jQ[ff;uF+M ft7~fuf;r)3@f;u+;rȃE  2EE NE 3n̋SVWff'FDXP(YtF3ɁfLXfuԍ?33f%f;s\FHP(Yt fGff;rft5fËff;tN+P PQ\' ?+f_^[̋UQ3EtEP,ЋE Mt x!̋UVW3t f99tuM%? t t+19_^]̋USVUMWt]Ë} % lj}uà uà t}!EPEH;r3}MtAEd0QjpEugujP%E3A f3fHMH HM XpMt)]}ыSSMȃMu}EM _^[ ̋U$SV3ډuEuuuuuu }WVU3?xhMEP3+xTMEPEPUx UEMPuurw7t(UX]f;؋]rE;rF;rۉ 3_^[̋UQQS]VWUffMWjR8M 3SfEQfqA_^[̋U0SVWMj$Xj&fE3XfEjEE/E؍EQPEEPh@EMPM܉MMx3ɍEQQWSuPQQQu}t u_^[̋U83ʼnESVWj3MY}ȋd3UUU9EPt-jjjpjWWEPjujl jRdxfjZEEE3ɍEMPRQEȉMPhuMЉME UfExuN3uQM}t uMtQ}t utM_^3[ËE䙉WFPvGP V h"zjEPjjh`Mt MN#F̋SVWNPu8ÙWFPvGPtV h"j$_^[̋UT3ʼnESVWj^Mȍ}3΍}dڃjUЉUԉŨE_Pt-jVjpWjjEPjujlVRdEEE3ɍẺMPWQEMPhuԉMME }fExkEȍMؙE؋ẺUܙh"EEjUEE ZEN"tx-jEPjjhxEЃt E#EЃ}t uEЃtP}t uM_^3[+̋U0SىU3ɉ]ME܉EظEԉE VuWEMMMCMMNujXUEMuUu V7EP3U:}mt'uEu UP:EMmEUMttu"ȊEM}t &fnt0^]ҋU^]t VtDV:tuF3ɃӉFAEP}}tKFMF}t1jh8utjh8u2ҊMU8PCEURPjYU}WuEPujYU}4u>C$3ɋt2;uu)C$AueEPCp}3}Mxtut:uE3u Pt7MEԉ}E؉E M}tP9|KE eEE8v=u؋}jVut E 03@G;rڋu}]E8u Fui9t f}tE%=u F@F}t3}tM$_^[ ̋UB$SVW3ۉUD;uKB$FuB @ut*Mt#Q3tMtQ3APY OR$4ˋ;2Au$}]]MSIE]PqlzE &VEPEHqltNEPj VSx8E9X(v)@,h4|u EC;X(r EEPƎkSSSSSEPEPqxQEt8Eh4|EuF;rtE4dC;]rudE3_^[̋UQeEVPAp}3^3̀ @̋SW33fftIVj ^3Cfu3jr0+ыOftQYfj ^fu^G3j0YffCG3_f X[̋U,3ʼnESYEA E3VW}U܋QUԫB2Ef;I:u (VjWZM fGGG3fEE3j fEXfEEPWhxWˍUEPWh WˍUxEPWxgh WxUMUFEPWx5h Wx#MUEPWxE܉8M_^3[w̋U,S3҉EUUUVWtt{QEhjuUܥERPjEPEUॉUU؅x.j3ɍEQjPQQQEPju؅x }u𥥥M _^[̋Vt%~tvjf>t 6&^̋U3ʼnEE 3S]WE}3U諉U쫫+t<t'tEEH'EEEĨE$ETUtkVRREPEPWjEPS$x}s2E$M ttuM3WjS^ M_3[̋U5ܩu 5 5ܩuh(]hXTYu@à 3̋U} SVWdH3ۣLd]PʉU33G;thU3u}=Pt jAY\XEth5Tu;r:MtUX T;uE9Mt͋‰MEP3TYXGLP9]33G9} d3ۉ]LPU;thU3u}9Pj[t jV5h h=PgYYt3Xhh8 YP}Yu3=\t&h\jYtu5\Su_^[ ̋U} u+],̋Ucsm9Eu u PYY]3]j,hاE3uE w} u=uu9E t =`tNE} u uu u׉EMEQPCYYËe3uu}Euu uEMEQPYYËe3uu}Euu uGEMEQPYYËe3uu} }EVVuGMEQPwYYËe3uEVVuGMEQPHYYËe3u=`t4EVVuMEQP YYËe3uE t Euu uEMEQPYYËe3uu=`tG=t>Euu u׉EMEQPsYYËe3uuEEMd Y_^[ } w ̋UVu3;u sWu>t ׃;u r_^]; uh%%,%l̋Uj8u4h P]̋U$ 5=ff fff%f-EEE jXkǀjX jX jXk LjX Lh̋U죨 5=ff fff%f-EE jXkǀh]̋UV EtVY^]%\jhX eXEuu5dYTjQYeXETEEPEPuD u܋M XM TEƋMd Y_^[ËujY̋UuJYH]̋Uuuu uhh]%$%T̋UE3SVWH<AYt} p ;r H;r B(;r3_^[]̋Ujhxh dPSVW1E3PEdeEhtTE-PhPt:@$ЃEMd Y_^[]ËE3Ɂ8ËeE3Md Y_^[]̋UMMZf9uA<8PEu f9Hu]3]̋UeeVWN@;tudEPE3EE1E1E3EM3EEPE3E3E;t5uO@ȉ _^%4h d5D$l$l$+SVW1E3PeuEEEEdËMd Y__^[]Q%L%%@%t̸QRPh  ZY̸(QRPh,ZY̸QRPhLZY̸QRPhlZY̸̸̸ ̸pQRPhYZY̸QRPh8ZY̸8QRPh̩ZY̸, ̸$̸x}̸tm̸̸QRPhZY̸̸̸̸̸̸̸09̸D̸H̸T̸P̸X̸\̸L̸≮@~̸̸̸̸l̸ ̸dQRPh 4ZYUQ uÃt)EEPh BxE3ɄA 2̸QRPh,ZY%UQ uÃt)EEPhxE3ɄA 2̸QRPhLPZY̸%X̋Md Y__^[]Q̋M3Pd5D$ +d$ SVW(3PuEEdPd5D$ +d$ SVW(3PEuEEdh d5D$l$l$+SVW1E3ʼnEPeuEEEEdËM3QL$+#ȋ%;r Y$-%P%%x%̐T$B 3)J3+̐T$B J3̐T$B J3ĥ̐T$B J3̐T$B J3̐T$B J3pĥ|̐T$B J3MY̍`2̐T$B 3J3 ̐T$B J3p̐T$B J3̐T$B J3Ц̐T$B J3̍1<-̐T$B 3@J36B̐T$B J3x̐T$B J3ĥ̐T$B J3Ц̐T$B 3̐T$B 3J3wje tW̹XU""" ""Ȧ"" 0OZ"2xCxhXlޔ$8Sgו(<K^ @t@ܨ<,-!P$ l $08Ī,@(HPdHPPĬ|flP>Įҭ|:Xt:Z\8L$^rЯRegCreateKeyWCryptSIPLoad AuthzFreeResourceManager GetSystemMetricsAuthzFreeContextAuthzInitializeResourceManagerAuthzInitializeContextFromToken*PackageIdFromFullName#GetStagedPackagePathByFullNameWinVerifyTrustKCertGetNameStringWGCertGetEnhancedKeyUsage(PackageFamilyNameFromId+PackageNameAndPublisherIdFromFamilyName AuthzGetInformationFromContext'BCryptOpenAlgorithmProviderBCryptCloseAlgorithmProvider!BCryptGetPropertyBCryptCreateHash#BCryptHashDataBCryptFinishHash BCryptDestroyHashCryptSIPRetrieveSubjectGuidForCatalogFilemWTHelperProvDataFromStateDatahWTHelperGetProvSignerFromChainfWTHelperGetProvCertFromChainCryptCATAdminCalcHashFromFileHandleCryptCATAdminAcquireContext CryptCATAdminEnumCatalogFromHashCryptCATCatalogInfoFromContext CryptCATAdminReleaseCatalogContextCryptCATAdminReleaseContext$AuthziAccessCheckEx7AuthziModifySecurityAttributes8AuthziQuerySecurityAttributes'PackageFamilyNameFromFullName"GetStagedPackageOriginLPublisherFromPackageFullNameQueryApplicationCapabilities QueryExecutableProperties ReleaseExecutableProperties'=αD @@0`@ вP бٱ 9Vkϲ0D[póճ srpapi.dllAiEvaluatePluginAppIDDecodeAttributeStringAppIDEncodeAttributeStringAppIDFreeAttributeStringSrpCloseThreadNetworkContextSrpCloseTrackInstallSrpCreateThreadNetworkContextSrpDisablePermissiveModeFileEncryptionSrpDoesPolicyAllowAppExecutionSrpEnablePermissiveModeFileEncryptionSrpGetAllowedEnterprisesSrpGetAppxFqbnFromPackageFullNameSrpGetEnterpriseIdsSrpGetEnterprisePolicySrpHostingInitializeSrpHostingTerminateSrpInheritEnterpriseContextSrpInheritOriginClaimSrpIsAllowedSrpIsTokenServiceSrpOpenTrackInstallSrpRestoreEnterpriseContextSrpSetTokenEnterpriseId̋U@SU3ۋщ]VWU쾐z$ˉ]EԔEh0]$;Uu AuBB E]6EP`EPEPU~E3ɋf;hWEYYWEP`Eu=EHCZMEIQSPEHQpueEWP|YYu6EX*B2pZ.6Hj<4r ^F4&lpzbV@0@Xjz :P^r|0Lhz`F,DZt.F\R,>h0LLd$ T@xj\@pD(2|<^*VT( : jvL>X*B2pZ.6Hj<4r ^F4&lpzbV@0@Xjz :P^r|0Lhz`F,DZt.F\_stricmp__CxxFrameHandler3memcpy_s_vsnwprintf??1exception@@UAE@XZ??3@YAXPAX@Z_vsnprintf_s ??0exception@@QAE@XZ ??0exception@@QAE@ABV0@@Z_wcsicmp_vsnprintf,_wcstoi64p_errnoiswspacet_XcptFilter_amsg_exitfreemalloc_inittermmsvcrt.dll:?terminate@@YAXXZ??1type_info@@UAE@XZk_lock_unlock__dllonexit_onexits_except_handler4_common GetCurrentProcess3OpenProcessTokenGetCurrentThreadIdGetLastErrorCloseHandle%RegQueryValueExWLocalAlloc LocalFree FormatMessageWHeapAllocGetProcessHeapHeapFreeGetModuleHandleExWGetModuleFileNameADebugBreakGetModuleHandleWGetProcAddressIsDebuggerPresentOutputDebugStringW&ReleaseSemaphore#ReleaseMutex7WaitForSingleObjectEx6WaitForSingleObject!OpenSemaphoreWDisableThreadLibraryCallsCreateFileWLoadLibraryExW FreeLibrary GetCurrentProcessIdDeviceIoControl CreateMutexExW CreateSemaphoreExWQueryPerformanceCounterIsWow64ProcessWow64DisableWow64FsRedirection Wow64RevertWow64FsRedirectionRtlFreeUnicodeString4GetFinalPathNameByHandleW-SleepUnhandledExceptionFilterSetUnhandledExceptionFilterTTerminateProcessGetSystemTimeAsFileTimeGetTickCountapi-ms-win-core-processthreads-l1-1-0.dllapi-ms-win-core-errorhandling-l1-1-0.dllapi-ms-win-core-handle-l1-1-0.dllapi-ms-win-core-registry-l1-1-0.dllapi-ms-win-core-heap-l2-1-0.dllapi-ms-win-core-localization-l1-2-0.dllapi-ms-win-core-heap-l1-1-0.dllapi-ms-win-core-libraryloader-l1-2-0.dllapi-ms-win-core-debug-l1-1-0.dllapi-ms-win-core-synch-l1-1-0.dllapi-ms-win-core-file-l1-1-0.dllapi-ms-win-core-io-l1-1-0.dllapi-ms-win-core-profile-l1-1-0.dllapi-ms-win-core-wow64-l1-1-0.dllntdll.dllapi-ms-win-core-synch-l1-2-0.dllapi-ms-win-core-sysinfo-l1-1-0.dllRtlSetThreadSubProcessTaghRtlInitUnicodeStringRtlNtStatusToDosErrorNtQueryEaFileNtQuerySecurityAttributesTokenTEtwTraceMessageHEtwGetTraceLoggerHandleGEtwGetTraceEnableLevelFEtwGetTraceEnableFlagsOEtwRegisterTraceGuidsWVEtwUnregisterTraceGuidsRtlSetLastWin32Error;EtwEventRegister=EtwEventUnregister}RtlRunOnceExecuteOnce>EtwEventWriteRtlNtStatusToDosErrorNoTeb]NtDuplicateTokenNtAccessCheckEEtwEventWriteTransfer9EtwEventEnabledRtlLengthSidRtlEqualUnicodeStringRtlGUIDFromStringRtlPrefixUnicodeStringRtlAllocateHeapRtlFreeHeapNtReadFileNtWaitForSingleObjectRtlUpcaseUnicodeStringNtQueryInformationFileNtQueryLicenseValueNtOpenFileLNtDelayExecutionNtCloseZRtlCreateUnicodeStringNtQueryDirectoryFile}RtlInitializeSRWLock,RtlGetNtSystemRootRtlAcquireSRWLockExclusive_RtlReleaseSRWLockExclusive>RtlCopyUnicodeStringNtOpenSymbolicLinkObjectNtQuerySymbolicLinkObject NtQueryVolumeInformationFileNtQueryObjectWNtDeviceIoControlFileNtOpenKey NtQueryValueKeysNtSetValueKeyLdrResSearchResourceRtlCompareUnicodeStringIsDeveloperModeEnabledKERNELBASE.dllApiSetQueryApiSetPresenceapi-ms-win-core-apiquery-l1-1-0.dllwcsnlenwcsstrRtlCompareMemoryResolveDelayLoadedAPIDelayLoadFailureHookapi-ms-win-core-rtlsupport-l1-2-0.dllapi-ms-win-core-delayload-l1-1-1.dllapi-ms-win-core-delayload-l1-1-0.dllNtOpenProcessTokenZNtSetInformationThread\NtDuplicateObjectNtOpenThreadTokenwNtGetCachedSigningLevelCNtSetCachedSigningLevelRtlEqualSidRtlAppendUnicodeStringToStringRtlAppendUnicodeToString7NtCreateSectionNtUnmapViewOfSectionNtMapViewOfSectionLdrResReleasei_CxxThrowExceptionmemcmpmemcpymemmovememsetp[@:0!qA1Qaџ͝`P|ў^֠(@Xp   X WEVT_TEMPLATEMUI4VS_VERSION_INFO |O |O?StringFileInfo040904B0LCompanyNameMicrosoft CorporationB FileDescriptionSRP APIs Dlln'FileVersion10.0.20348.5386 (WinBuild.160101.0800)6 InternalNamesrpapi.dll.LegalCopyright Microsoft Corporation. All rights reserved.> OriginalFilenamesrpapi.dllj%ProductNameMicrosoft Windows Operating SystemDProductVersion10.0.20348.5386DVarFileInfo$Translation CRIMh<NJ"4sL'*иy@?{]` M]iOxT "WEVT    l x  CHANhLMicrosoft-Windows-AppID/OperationalTTBL TEMPGLOqTnbtAD҂FilePathAndStatusDataxmlnsDhttp://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0(' FilePathLength 'FilePath Status  $FilePathLength$FilePathBufferStatusTEMP??RAMZ"FilePathPublisherNameAndStatusDataxmlnsDhttp://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0(' FilePathLength 'FilePath 2MxPublisherNameLength &Ǭ PublisherName Status |$FilePathLength$FilePathBuffer,PublisherNameLength,PublisherNameBufferStatusTEMP8@EOX١UT:_A| StatusDataxmlnsDhttp://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0Status TStatusTEMPP X)cMTl<~\wAܟFunctionCallErrorDataxmlnsDhttp://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0>CallingFunctionNameLength 2'BCallingFunctionName 8hFunctionCallNameLength ,FunctionCallName Status   H |  8CallingFunctionNameLength,CallingFunctionName4FunctionCallNameLength(FunctionCallNameStatusPRVAD Microsoft-Windows-AppIDOPCOLEVLdP, PD win:Error(win:InformationalTASKKEYWEVNT 0 0   0  0 h WEVT X  <HPRVA`l Microsoft-Windows-AppIDServiceTriggerOPCODl ,AppIdTriggerOpcodeLEVL@P(win:InformationalTASKKEYWHd,AppIdTriggerKeywordEVNTDl TWEVTr ,\ t utu(vHwXwCHAN08TMicrosoft-Windows-AppLocker/EXE and DLL\Microsoft-Windows-AppLocker/MSI and ScriptlMicrosoft-Windows-AppLocker/Packaged app-ExecutionlMicrosoft-Windows-AppLocker/Packaged app-DeploymentLMicrosoft-Windows-AppLocker/VerboseMAPSxxBMAPVMAP,DVMAP,tVMAP, ,WldpAppSettingType0wldpCanExecuteResult0wldpCanExecuteSubject0wldpExecutionOptionsTTBLbTEMP%Z%WJ4јARuleAndFileDataxmlnsDhttp://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0,CPolicyNameLength  PolicyName wRuleId (RuleNameLength gRuleName (-RuleSddlLength uGRuleSddl  TargetUser *TargetProcessId (' FilePathLength 'FilePath (pHFileHashLength jFileHash  = FqbnLength Fqbn & TargetLogonId 0|FullFilePathLength $N FullFilePath 0X$@d   4`(PolicyNameLength(PolicyNameBufferRuleId$RuleNameLength$RuleNameBuffer$RuleSddlLength$RuleSddlBufferTargetUser$TargetProcessId$FilePathLength$FilePathBuffer$FileHashLengthFileHashFqbnLengthFqbn TargetLogonId,FullFilePathLength,FullFilePathBufferTEMP `^^tClpARuleAndFileDataxmlnsDhttp://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0,CPolicyNameLength  PolicyName wRuleId (RuleNameLength gRuleName (-RuleSddlLength uGRuleSddl  TargetUser *TargetProcessId & U PackageLength XPackage  = FqbnLength Fqbn <`   (PolicyNameLength(PolicyNameBufferRuleId$RuleNameLength$RuleNameBuffer$RuleSddlLength$RuleSddlBufferTargetUser$TargetProcessId PackageLength PackageBufferFqbnLengthFqbnTEMP8@!R!Rw(+TA| StatusDataxmlnsDhttp://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0Status T!StatusTEMP".j*,["UA+V FilePathDataxmlnsDhttp://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0(' FilePathLength 'FilePath ""$FilePathLength$FilePathBufferTEMP| %!(S%(PD EventDataAGoData/KNameFilePathLength A;oData#KNameFilePath A;oData#KNameSha1Hash A?oData'KName Sha256Hash A7oDataKNameResult A1oDataKNameUSN  AIoData1KNameSha1CatalogHash AMoData5KNameSha256CatalogHash AEoData-KName UserWriteable  &&& &' $'0' T' |'$FilePathLengthFilePathSha1HashSha256HashResult USN$Sha1CatalogHash(Sha256CatalogHash UserWriteableTEMP <+T]B6Rhe!clD EventDataAGoData/KNameFilePathLength A;oData#KNameFilePath A;oData#KNameSha1Hash A?oData'KName Sha256Hash A7oDataKNameResult A1oDataKNameUSN  AIoData1KNameSha1CatalogHash AMoData5KNameSha256CatalogHash AEoData-KName UserWriteable  AioDataQKNameDetachedSignatureFilePathLength A]oDataEKNameDetachedSignatureFilePath ,<,T, l,, ,, , ,- X-$FilePathLengthFilePathSha1HashSha256HashResult USN$Sha1CatalogHash(Sha256CatalogHash UserWriteableDDetachedSignatureFilePathLength8DetachedSignatureFilePathTEMPt d4[P)t#]jWzD EventDataAGoData/KNameFilePathLength A;oData#KNameFilePath A;oData#KNameSha1Hash A?oData'KName Sha256Hash A7oDataKNameResult A1oDataKNameUSN  AIoData1KNameSha1CatalogHash AMoData5KNameSha256CatalogHash AEoData-KName UserWriteable  AioDataQKNameDetachedSignatureFilePathLength A]oDataEKNameDetachedSignatureFilePath AWoData?KNameOriginalFileNameLength AKoData3KNameOriginalFilename AOoData7KNameInternalNameLength ACoData+KName InternalName AUoData=KNameFileDescriptionLength AIoData1KNameFileDescription AMoData5KNameProductNameLength AAoData)KName ProductName AMoData5KNameFileVersionLength AAoData)KName FileVersion 6,6D6 \6x6 66 6 67 H77 77 8(8X8|8888$FilePathLengthFilePathSha1HashSha256HashResult USN$Sha1CatalogHash(Sha256CatalogHash UserWriteableDDetachedSignatureFilePathLength8DetachedSignatureFilePath4OriginalFileNameLength(OriginalFilename,InternalNameLength InternalName0FileDescriptionLength$FileDescription(ProductNameLengthProductName(FileVersionLengthFileVersionTEMP HA/xyZ3SjD EventDataAGoData/KNameFilePathLength A;oData#KNameFilePath A;oData#KNameSha1Hash A?oData'KName Sha256Hash A7oDataKNameResult A1oDataKNameUSN  AIoData1KNameSha1CatalogHash AMoData5KNameSha256CatalogHash AEoData-KName UserWriteable  AioDataQKNameDetachedSignatureFilePathLength A]oDataEKNameDetachedSignatureFilePath AWoData?KNameOriginalFileNameLength AKoData3KNameOriginalFilename AOoData7KNameInternalNameLength ACoData+KName InternalName AUoData=KNameFileDescriptionLength AIoData1KNameFileDescription AMoData5KNameProductNameLength AAoData)KName ProductName AMoData5KNameFileVersionLength AAoData)KName FileVersion AKoData3KNamePolicyNameLength A?oData'KName PolicyName AGoData/KNamePolicyIDLength A;oData#KNamePolicyID A?oData'KName PolicyGUID PCtCC CC CC D ,DLD DD D$E PEpEEEEF0FLFtFFFF$FilePathLengthFilePathSha1HashSha256HashResult USN$Sha1CatalogHash(Sha256CatalogHash UserWriteableDDetachedSignatureFilePathLength8DetachedSignatureFilePath4OriginalFileNameLength(OriginalFilename,InternalNameLength InternalName0FileDescriptionLength$FileDescription(ProductNameLengthProductName(FileVersionLengthFileVersion(PolicyNameLengthPolicyName$PolicyIDLengthPolicyIDPolicyGUIDTEMP LRWjkMD EventDataAIoData1KNameImageNameLength A=oData%KName ImageName AQoData9KNameParentProcessLength AEoData-KName ParentProcess A?oData'KName StatusCode AIoData1KNameAppLockerReason A7oDataKNameBucket A1oDataKNameUSN  AGoData/KNameNtfsFileIdSize A?oData'KName NtfsFileId AMoData5KNameOriginDataPresent A=oData%KName SessionId ACoData+KName SubSessionId A7oDataKNameOrigin A3oDataKNameType A?oData'KName Generation AAoData)KName SmartScreen ACoData+KName RevocationID A?oData'KName DataLength A3oDataKNameData PNtNNNNNO ,O8O\O xOOOOOOP4PTPpP$ImageNameLengthImageName,ParentProcessLength ParentProcessStatusCode$AppLockerReasonBucket USN$NtfsFileIdSizeNtfsFileId(OriginDataPresentSessionId SubSessionIdOriginTypeGenerationSmartScreen RevocationIDDataLengthDataTEMPXUFrnQ(N<.D EventDataAGoData/KNameFileNameLength A;oData#KNameFileName ASoData;KNameCurrentProcessLength AGoData/KNameCurrentProcess AQoData9KNameParentProcessLength AEoData-KName ParentProcess A1oDataKNameUSN  AGoData/KNameNtfsFileIdSize A?oData'KName NtfsFileId AMoData5KNameOriginDataPresent A=oData%KName SessionId A7oDataKNameOrigin A3oDataKNameType A?oData'KName Generation AAoData)KName SmartScreen A?oData'KName DataLength A3oDataKNameData V W$WTWxWW WWW X8XPXdXtXXXX$FileNameLengthFileName0CurrentProcessLength$CurrentProcess,ParentProcessLength ParentProcess USN$NtfsFileIdSizeNtfsFileId(OriginDataPresentSessionIdOriginTypeGenerationSmartScreenDataLengthDataTEMP\cf^8*vPwD EventDataAIoData1KNameImageNameLength A=oData%KName ImageName A?oData'KName StatusCode A7oDataKNameBucket AMoData5KNameOriginDataPresent  A=oData%KName SessionId ACoData+KName SubSessionId A7oDataKNameOrigin A3oDataKNameType A?oData'KName Generation AAoData)KName SmartScreen ACoData+KName RevocationID A?oData'KName DataLength A3oDataKNameData ^,^D^`^ t^^^^^^_0_P_ l_$ImageNameLengthImageNameStatusCodeBucket(OriginDataPresentSessionId SubSessionIdOriginTypeGenerationSmartScreen RevocationIDDataLengthDataTEMP$L`ǎG`W-QWD EventDataA?oData'KName IsApproved A5oDataKNameCLSID  t``IsApprovedCLSIDTEMP dH7TNh\N>D EventDataAQoData9KNameTotalSignatureCount A=oData%KName Signature AQoData9KNamePublisherNameLength AEoData-KName PublisherName AKoData3KNameIssuerNameLength A?oData'KName IssuerName ASoData;KNamePublisherTBSHashSize AKoData3KNamePublisherTBSHash AMoData5KNameIssuerTBSHashSize AEoData-KName IssuerTBSHash de eLeleeeef0f,TotalSignatureCountSignature,PublisherNameLength PublisherName(IssuerNameLengthIssuerName0PublisherTBSHashSize(PublisherTBSHash(IssuerTBSHashSize IssuerTBSHashTEMP` irZ;&20D EventDataAYoDataAKNamePackageFamilyNameLength AMoData5KNamePackageFamilyName AGoData/KNamePackageVersion  AKoData3KNamePolicyNameLength A?oData'KName PolicyName AGoData/KNamePolicyIDLength A;oData#KNamePolicyID AEoData-KName PolicyVersion  A?oData'KName PolicyGuid A7oDataKNameStatus `jj jjk$kHk `kkk4PackageFamilyNameLength(PackageFamilyName$PackageVersion(PolicyNameLengthPolicyName$PolicyIDLengthPolicyID PolicyVersionPolicyGuidStatusTEMP<mT!/R_>!>J>S>_>l>|>>>>>>>>>>&?5?=?J?00000$101E1111111222H2U2g2p2|2222222233C3u3314I4S4q44444)5G5e55666X7c777o8z88K9999:E:k:{::::::: ;;8;A;G;\;c;w;;;;;;;;;;;;;.<<<<<<<<<<<<<<<=!=(=.=H=Z======;>X>>>>>G?T?????01Z1c1r1y111112W2^2i2p2w222222222222-3334&444d4444445<5A5G5o55555555@6F6L6R6|6666"7(7I7o7t78(8C8I888899298999999N:*;t;;;;x<<<<<=)=1=E=k=p===>>>>>0D0S0]0k0w00000001/1=3p3~333 4>4R44`566)616Y6667T777 8s8999 :/:?:F:t:::::::M;T;;;;;;+>>S>`>>>??.0p0w0{11;2T222313K3a333333333344,464E4_44444=55*6@66667,7B7a7i7|777777777788.8[8a8j8v889 ::\:e:::::::;;;J;;;t====>9?C?I?f??/0U0112S3Z333@4G4456616W668_8i8o88888,9R9\9e9o9v990:m:::::::::::;!;:;n;~;;;; >?+?3?????? |"0-0;01s22222|333334+4<4M4444 5505E5K555O6S777#838:=>>,>5>:>S>\>a>k>t>y>>>>> ? ?9????0'0U0q0y0000?1111112!23282R2\2n2s222E33333440454A4F4_4v44425f556=6B6V666666666\7776888889!9E9J999::5:?:S:X:}::;;;;;>$>>>>>>>>??2?7?N?S?h??????@?0D0]0;1@1Q1c1h1111222=2T222344Z444 55]5d5s5555>6M6666798G8f8u8888 :::#:7:<:Q:d:i:{::+;<;S;d;o;x;;; <|>>>>"?8???P0&050X0b0000u11111 2234445566#6666788888L9999999999 ::::::::::;g;r;y;;;;;;;;;;;;;;;;<<#<*<1>>>F>>>> ??&?C???`0%0/09001z22313a333 454=4y441555i6A7[77888888^9i9n999#:g:::: ;;;<=Q=====o>>>> ?? ??????pP020V0\0f000 1@1L11]23{333 44$4l44@555U66699::g\>c>>>>>>>>>>???0&0>0|000000001D1M1S1[1a1w1|11111122*2G2P2V2w222222223 33#3(343E3M3`3l3t3333!484M4q55566p66666677%7,7D7J7P7V7\7b7i7p7w7~777777777777777888"828;8R8X8^8d8j8p8w8~88888888888888889B9O9]9n9v999992:7:M:Y:::::;;;; <<<0>1>A>Q>a>q>>>>>>>>>??"?2?B?R?b?r?????????0040N0_0l00000000 1Z1111S2_2k2w2222 3.3Q3t33334@444445J5c5r555556l6x66666667747D7l7t777777777788888 8(8,84888@8D8L8P8p88888888888888D050@0j0001H2222 343P3333F4K4`4g4q4445575>5g5(0 00,0D0\0t0000000000 2\000 00000$0(0,00080<0@0D0H0L0P0T0X0\0d0l0p0t0x000000000000000