MZ@ !L!This program cannot be run in DOS mode. $]ɫxxx41xxxxxxx=xXxxRichxPELK:D! ` @A@&`P0TX@.text `.data @.idataT@@.rsrc@@.reloc`@B5I@@@@@P @Ppp@0`@ (@ `!""#p#$% &(<Thp##$$@$ H<$0$&0..&(./(*/t/ .$&. .FH- X. / -$&d.0(Su0@345I`LLMpMMMNNNO0OPO@@ p`@````p@`` @Ppp@0`@P@ `!""#p#$% &( (@9@`Ы\NULLSampServerObjectTypeSampDomainObjectTypeSampGroupObjectTypeSampAliasObjectTypeSampUserObjectTypeSampUnknownObjectType<unknown>+]ADV}CH*HwpĈ4SFVCDOMAINSGroupsAliasesMembersUsersNames\SystemRoot\=F?e]h&ɚDY&MhServerDomainUpdatesPerComponentWellKnownAccountAppliedUpdatesAliasShellAdminObjectPropertiesUserTileUserPasswordHintUserDontShowInLogonUIUserShellAdminObjectPropertiesLastSuccessfulInterLogonTimeLastFailedInterLogonTimeFailedInterLogonCountFailedInterLogonCountAtLastSuccessfulLogonInternetUserNameInternetProviderNameInternetProviderGUIDInternetUIDInternetSIDInternetProviderAttributesCachedLogonInfomsDS-ManagedPasswordIdmsDS-ManagedPasswordPreviousIdForcePasswordResetAccountFlagsExSupplementalCredentialsResetDataBuiltInAccountNULL\REGISTRY\MACHINE\SAM\SAM\system32\config\SAM\system32\config%ssystem32\samsrv.dllsamsrv.dllHKLM\SAM\SAM\SYSTEM\REGISTRY\MACHINE\SYSTEM\REGISTRY\MACHINE\OFFLINESAM%s%s___(%s)___%sControlSet001\Control\ProductOptionsProductTypeWinNtLanmanNtServerNtProductSuitePersonalControlSet001\Control\MUI\UILanguagesLCIDType%s\SAM Y+/!4'6MD5RC4Domains\%sGroups\%08xAliases\%08xUsers\%08x%s\%08xLMPASSWORDNTPASSWORDNTPASSWORDHISTORYLMPASSWORDHISTORYMISCCREDDATAAESBlockLengthChainingModeCBCChainingMode}}14m8$9 |\LeT.51BAliases\Members\%sAliases\Members\%s\%08xBUILTINACCOUNT3z~"25>c̪hrM9lj n+$]"<~WʆhS-1-15-3-1024-1730716382-2949791265-2036182297-688374192-553408039-4133924312-4201181712-267922143%s%s00000000000000000000000000000000BuiltinDomains\AccountDomains\BuiltinDomainsyd6iLm\Aliases\Members\Users\NamesGroups\NamesAliases\NamesAliases\Members\Aliases\Names\\Aliases\\Groups\Names\\Groups\\Users\Names\\Users\SAM@T?S.VPersonalSkuShouldDisableAdminByDefaultNtProductTypeDomainServerRoleLanguageIdControlSet001\Control\LSA\OfflineSAM\DBOptionse}נ]0e_onecore\base\lstring\lunicode_string.cpp(Bytes % sizeof(WCHAR)) == 0String->Buffer = reinterpret_cast((*RtlAllocateStringRoutine)(Bytes))RtlAllocateLUnicodeStringNot-null check failed: DestinationRtlDuplicateUnicodeStringToLUnicodeString::RtlIsUnicodeStringValid(Source)RtlInitUnicodeStringFromLUnicodeString::RtlIsLUnicodeStringValid(Source)BUCL::Rtl::ConvertInteger(Source->Length, Length)BUCL::Rtl::ConvertInteger(Source->MaximumLength, MaximumLength)RtlInitLUnicodeStringFromNullTerminatedStringcch <= (((((SIZE_T)~((SIZE_T)0)) - (((SIZE_T)~((SIZE_T)0)) % sizeof(WCHAR))) / sizeof(WCHAR)) - 1)Valid flags check failed: FlagsNot-null check failed: String::RtlIsLUnicodeStringValid(String)RtlConcatenateLUnicodeStrings(SourceCount == 0) || (Sources != 0)::RtlIsLUnicodeStringValid(&Sources[i])BUCL::Rtl::AddInPlaceWithOverflowCheck(&MaximumLength, Sources[i].Length)RtlAppendLUnicodeStringToLUnicodeString::RtlIsLUnicodeStringValid(Destination)Not-null check failed: SourceRtlReallocateLUnicodeString__rv.UcsCharacter != (0xffffffff)onecore\base\lstring\path.cppRtlConvertWin32RegistryPathToNtRegistryPathUserNot-null check failed: PathInNot-null check failed: PathOutHKEY_CURRENT_USERHKCURtlFormatCurrentUserKeyPath(UserProfilePath.GetMutablePointer())PathOut->Length != 0RtlConvertWin32RegistryPathToNtRegistryPathWithSidRtlConvertNtFilePathToWin32FilePath\??\UNC\\\\??\HardDisk\\?\HardDisk\??\Volume\\?\Volume\??\\DosDevices\UNC\\DosDevices\\SystemRoot\Device\HarddiskVolume\\?\HarddiskVolume\Device\Mup\\?\UNCObjectLengthSHA256onecore\base\lstring\lblob.cppRtlReallocateLBlobNot-null check failed: Blob::RtlIsLBlobValid(Blob)Temp = (*RtlReallocateStringRoutine)(Bytes, Blob->Buffer)Temp = (PUCHAR)((*RtlAllocateStringRoutine)(Bytes))RtlCompareEncodedLBlobsNot-null check failed: ComparisonResultNot-null check failed: String1Not-null check failed: String2 *** Assertion failed: %s *** Source File: %s, line %ld HKCR\\Registry\Machine\SOFTWARE\Classes\\Registry\User\\Registry\Machine\HKCC\HKEY_CLASSES_ROOT\HKEY_LOCAL_MACHINE\HKEY_CURRENT_USER\HKLM\\Registry\Machine\System\CurrentControlSet\Hardware Profiles\Current\HKEY_USERS\HKCU\HKEY_CURRENT_CONFIG\HashDigestLength0123456789012345678901234567890123456789!@#$%^&*()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(*@&%MD4K:D'1%K:D 1%K:D$3'0p1@Ws%;XlQ_/<IT+34ʞF֢`ݣ¤>ڨ(3sD +ЫRSDS ]f'\ u,&offlinesam.pdbGCTL.rdata$brc.CRT$XCA.CRT$XCZ.CRT$XIA .CRT$XIAA$.CRT$XIZ(.gfids.rdata0.rdata$sxdata0.rdata$voltmd1@.rdata$zzzdbg3x.text$mn.xdata$x@.edata.data$brc.data.bss.idata$5.00cfg.idata$2.idata$3.idata$4.idata$6.rsrc$01.rsrc$02 ]f'\ u,& >VBF0K:DUuj@@]̋U}t]%D]̋UQQ3ʼnEEjjEEPQRj+u uM 3(s ̋UQQ3ʼnEUEVW3Etʍqff;u+ Mj YWQRjEPj hj+u uM(3_^r̋At=t2t'tttøøøXø0øø̋UQUE VFVFNI FF@$(P9tjY)Q H8Btzr=PVrr^Y]̋UVEt tV#^]̋VFFNH$9Ju;A9u4BNE8@txrVppj Y^jY)̋UQWGHutVj0^_̋U;r;M%]̋UA;vP;ȋM%k?]̋USVW{8tp֋}{8t0_^[]̋U 3ʼnEEjjEEEEPjEPjEPj hj+u uM03őUQVW}QW;xjkF$k } SMF\Sj@fGf@ЉWu )kN$}SF8FPR?t 3[_^̋USVu 3Wf9v 9^u QuxPvSu_^[]̋UQS] VWQ3E!;jXxNUkB$RDt Pj@E@uVWux;3W_^[̋UQQE VW3ɉEQjExnkO$GSL,MtT\(Sj@@Eu9kO$W}SD$PWrE M8EE[_^̋UVQj7xuu hj@^] ̋UVQjxEPu uj ^]̋US]WkG$; r Qj`BkG$k VuMG\EP[EPH;s+9O$sG PkW$]MOM+]tqE @EM;sZUw EE+t Eu)Eut"EGuD EGPPQqM kE E+M@ uMUE t D t&kO$VuGGPp _ )_$jϋ^_[̋UQQE VWQ Ej >xskO$OUtXSPj@E@؅u6kO$WuPSBpE ME[_^ ̋UQQE VWQ Ej xjkO$OT,UtRD(SPj@E@؅u3kO$WuD$PSoE ME[_^ ̋VWjDxj5x  _^̋V39q8t1Q( #A+ttt tuq q$ ;u^̋US]Vj#1xBkF$Wj@@u!kF$ FPWn ;3_^[]̋UWjxKGUu b8GVk$G ;tRPXn jϋ^_]̋Uy8u3]QVkq$u Ћq +/}u Ћ+Ћq +PVR^]̋UV3Wuu9uu9w(9w,t3SEPEPEPu@؅3B9w8EPuuu>M؍EP#yy;t;ukw$t}u uuu;t;u؅xiEPEP 8AtyrVqqj&Y_^[̋U3ʼnEE eSVW}ىE8@txrWppj'YWEPEPEPy(8@tuxroVWppj(Y!X8@txruWppuuy%8@txrVppj*YuM_^3[1?̋U E3S] VWM M9u.8@txrppj+Y99t+8@txr1ppj,Y }s8@txruppj-j8j@@u{j ZQMUQMQhOxYGPGPEUQMEQMQhȉUxuGPEj;3YEWj_^[̋U S] V3MWuu38@txrupp^MUMu>Mu+8@txrppj/Y UMEP9$y*8@txrWppj0Y`u uS2ult_^[3PPPjhjQjh@3PPPjhjQjh@̋QVW8@txrppj1Yjy#8@txrjppj2Yr_3^Y̋U SىU3ɉ]MEEEVWM} 8@txrSppj3YU]x73Qff;u+tj\Xf9Ku83fKj\Xu SuWu_^[S0tʋ˨ E\Pu0uX}U3ˉE-x8@txrWppj5YE3ҋM8EUHu.3hEˍEP5xauVu0u3EˍEPj8@xuppj4YVEEUPxI3Qff;u+tj\Xf9Kt u}u3UfK }}Z̋U(3ʼnESMVW39߉9TtOQxpWhhPxPk;Ht,ʍqff;u+At Bf9\t,u WuSoM_^3[8@p 6Pj@@؅u븋Ht~wv=v3fPQW֋NpQd^8@txrSppj6YS* ƅt3f̋U`3ʼnES]3ɉEVWp% 8@t7xrppj?Y8@txrppjAYuy8@t\xrVVppjBC8@t>xr8ppjC2y%8@txrVppj@YrEt3xtHt QExE8EPd0Wp9}t uuHu@M}M_^3[3̋U43ʼnESVW3ۍM]]w<8@txrppjDY89@u&@txrppjEY]M#DEPEE]E@E؉]]8@txrDQppjFY?jEPx8@t6xr0VppjG8@txrVppjHYMPDվD@MM_^3[22̋U\3ʼnESV3Wu؉}vuSy8@tKxrEWppjU븋uVSQy*8@txrWppjVY3tp֋]}t$_^[̋U$3ʼnEE SVE3W}؉EEEEEEhPpEPh?EP֋h EP}Sp$EPSEP֋y EPj@@؅u }Sp$EPjEP֋x\h$SYYu E?h0SYYu E"hDSYYu E Sx]tp֋M_^3[(̋U$3ʼnEE 3SVW}ىE܉EhPMMMMMMpEPh?EP֋hXEP}3Qp$EPQEP֋y EPj@@؅un}Sp$EP3PEP֋xH3f9t?htVYYt$΍Qff;Eu+34Nf9u ES ]tp֋M_^3[b'̋UL3ʼnEE S3ۉEVW}EhP]ĉ]]]؉]܉]]]Љ]ԉ]ȉ]pEPh?EP֋y28@xWppjWYi}p0EPEP֋y$8@8x.WppjX몡8@txruppjYYhEPhEP9]E4EP 8AtyrEĺ4qqjZY}tpփe}pEPh?E؋Pօy9 8AyPE4qqj[Y}Ep$EPEPEPEPօy# 8AtzyrtPE4qqj\랋}Ep$EPEPEPEP֋y& 8At&yr EW4qqj]GEu 8C;]; 8AtyrEĺ4qqj^YME* 8Atyrqqj_Y%u述]tp֋]tp֋M_^3[$̋U3ʼnESVW3L30@<8s`tURhdPHHt MQPx Eu u tVM_^3[e3@DHTLPX\`dh̋UVuju蔿E H8@txruVppjeYM^] ̋UVEt tV^]̋VDHL4`ϩdĩh蹩8@txr@VppU^8̋Utw QuQ t3f]̋UEUWQQPEPȅx+UEeVu+QQPE pȋEf^_̋UVWQQMEQMQU#xtSQ3҅xt _ʋڅxLuE}+pEutt#uEIBfuutEMf[_^̋UVWt'E +t<ft f9Nuu_ҁ3f^] ̋V3u)Vu f;wWf;_w9Fufuft ^̋UESVڋ3W} tQЅxtNE Nt_^[]̋UQQSV3MWt8t>uj^ftEujf0OEC^uЅut f91tM_^[ ̋UQQ3ʼnEVW3}9>u-WWREPHyjY)M3t WuPM3_^ ̋V Q3QQQQQVP4^yjY)̋VjjFP6DyjY)6<&^̋UVWujY)39>t 6X>QWjuWWVP8_^yjY)]̋UQQ3ʼnEEVW3uWVRPWWWRP1T_^yjY)M3̋U3ʼnEE SV3ۉ!W3 uuDžRVh,jdP,P$P8p Ph?$P։h@j@@ȅppxNE mEu;ut3;sEM83E!}W:u2_^[̋U3ʼnEE SىEMV3M01W}u9u"hEPEPWxcM EPEPWx#jjt xMEMEutաM_^3[ ̋UQQEeSV W]8<@txrppj YEPb]y0 8AyVqqj Y8@txrsHsHppj Y){HMSGCHXy!8@tAxr;Vp<pj 땡8@txrWWp<pjYE8SP_^[̋U3ʼnEE $SV WhDj@ 3@vs<fFfGfAfG<˅xuj*W|_^[̋US]3VWEEEPj`xA} Wj@@u$URURNQGPVEP苏x33M{Vx{_^[̋US]3VWEEEPj~xA} Wj@@u$URURNQGPVEPx33MO{Vz_^[̋US]3VWEEEPjN~xA} Wj@@u$URURNQGPVEPyx33MzVfz_^[̋UQeES]VWP#胃}xjj@@ȅuG8 j zWz_^[̋Ux3ʼnEESVW3ۉE!j\ESP1 EP 胙EMUEEuЃdUUVj@@؅u BEN{0EuȈCS\UMECXEPEPRQCPEP词EPEPuC uPEPEPEPuCuPEPeEPEPuC uPEP辌EPEPuC(uPEP虌xjEPEPuC@uPEPxxIEPEPuCHuPEPٌx(EPEPuCPuPEP踌xE3u&xuxuxuxuxuwuwuwSwM_^3[Y̋Ux3ʼnEEUSVWE3ɈMMMMMMMMMMQMQ%vj[G4UEEEPE^EPUMiEEPSz/u@EPjEP MqwEPj{zu@EPjEPM0we3E@ȉEyQEPQQMEPEPj zxqMvEf]E@f]ExEQEPQQMEP*x,EPj0zxM}vMAPWMdvˍE3҈@uˍEԈ@uˍE@uEĈ@uM_^3[%̋UQeESVWP~}x1}Ot A Qx W~WCu_^[̋UQES] VW3H};tWtGt7t't tPEP5EP*EPEPeEP EPxE}Wt_^[̋UQESVHWtztnt]HtMt tju QQH\eEP}]xE SC8}St.u B"u j&xu ju ju _^[̋U,3ʼnES3VWE܋؉E؉EE4]EEEs $2@  @EEPW4E؋MPlEPEPQz3E9EvRMQM4@]w4t VhE@E;ru+uhEPj@E@u0o8@ txruppjYSFVuW >CuPux"QMj1oxuMWSj=iW2cu*c_^[̋U(S3VWuE؉uE؉EE܉E]}|u x@EPmMEPU\uuM苉@63EEEEE  MUQMEQMQMQMQQ\8]u 8]u3MEPhh]E܋Puut=MEPh!}xeEPaxTuut?υt9EPu5x,EHRtDt{zEtGc>EPuxBEHt!t tt{#z33tcctXcu`u`u`u`_^[̋UE3S] UVWtEPEPEPQeExx}t_t[EPj@@uSuuP3 Et$Sh؋E@E;rE] 8 E8t33}V`u`_^[̋U(3ʼnESV3EWىuMUPuuuuu܉u@EPEPzp}p֋@EPEP?pxm}3SSp$EPS֋xJM}Mtp(SSQSp֋4t:u]tp֋]tpu^u^M_^3[*̋U03ʼnE3S]VEWuԉE؉EE܉EEE8@ txrSppjYEPUh]@EPEPny>4t :08@ txrSppjY{R}3ɉMQp$EPEPQ֋ýt28@ xWppjYYuj@@ȉM؅u }Qp$EPjj֋y8@ tWxrQWppj3ҿR9UtuԋM؋F49EtlB;r8@ txrppjY荁]tpu\u\u\M_^3[mHEtP}uQujp(֋y8@ yxoWppjS/O8@ @x6WSpp$̋U SV3WMEQMuQ]x9uv4MxF;urS[_^[̋U3ʼnES3VWP@jEEEEE4EPj^EPEPj7@EPEPky68@ xWMQppj Yr}p֋y8@ t]xrWWppj!A-hx?{8p֋y%8@ txrWppj"Y2]tp֋M_^3[̋USVuى]hEEPEPEPQ^x}]3W}9uv8WhuWu F;urE+EPSW ]};uR(QMjwex+]GMSuPj}__uoY^[̋U VWu3u}|uxx~4 uR@EP}xMEPMR}uXx5Wut$ uu4x uMWX_^̋UQVu jum@08@txruVppj#Yr^Y]̋UVEt tV3X^]̋V08@t xr@Vppj$Y@t9Z^m̋U SV3WMEQMuQQȉu_]xb}ƅt M9 t#@;rPj@@u.g'PSVM GWWV QM]S:WV4W_^[̋U SV3WMEQMuQQȉu(_}؅x1Mht%E9tF;rDIQQWQM\WV_^[̋UQVu juk@88@txruVppj Ys^Y]̋UVEt tV3V^]̋V88@t xr@Vppj Y@t9X^k̋UQES3V!EW3!EHt!tt dAqA0q4A$q(Vj@E@؅u5VuS Vj@@EtVSPM EE0S8Uj1U_^[̋U3ʼnEES V,L3W؉`XP`jPEPDž Dž$Dž(Dž@DžDDžHDž0Dž4DDž8ADž<fDždfDž\fDžT\SEPxj ^j0EPxj `PhP\ShPxj0hPx$P3PPPPPPPPjXPLP3PPPPPPPjjPPL] P ;ShpVj@@u SWVWl UЉuEEhEE0MPQj uPEЉUPEPjEPQEE MPQj@EPEEPEPjEPQCEEhME$EPQj@UPEЉUPEPjEPQ>(EEQEjE0PEE[PEEPjEEP}EDxw(EEEhEEE[PQj0MPEЉMPEEPjE}PEDUWQSQd0jpd0jpM_^3[V̋UP3ʼnEEM,EċE eeEESE3ۋEVuWE̋E E3jM]EP4_SVEP`ISVEP83j3^uE9Ev(}Ћ]4h EM@ME;r]Vj@@Eu juP<39uvJE̋}+ljE̋8uEEPX7ujuH}FẼ};urjuEjPT_uhuċhPj@E@EDjuP<ujjuċF% Pju@Fjju Pju@3EVujPdEuPVEPDuj@@؅EPSEPDxoE$<uQEPEPEPS0xOEPEHPuPx7uVlHPVxE$uUMJtr3uMuMSMM_^3[b(̋UQSVWډMjt 6bM& u_^̋UQQS]VW3uj _tˍQff;u+M׻Etȍqff;Eu+4M EEt%ȍAEff;Eu+MME }EMtyff;EuE+Prrj1Y_c8 BtzrVrrj2Yrb^[]u #8̋UVuWt_} tY}tS8BtzrVrrj3YJ=8~tTBt$zr=Prrj4Yb8 BtzrVrrj5Ya_^] u u8̋UQSVuWtw} tp]tiEtb# 8Bt#zru7Vrrj6Y`8E~t]Bt'zr!=Prrj7Ya8 BtzrVrrj8Y`_^[]# ?u?uPSj財x8̋UQSVuWtw} tp]tiEtb# 8Bt#zruu7Vrr8E~t]Bt'zr!Y^_^] ̋UQQVu3ɉL$W9M }E8Bt!zru Vrrj?YY8E~t4Bt'zr! :Prrj@Y^8 2PD$Pu ֘L$ x  t5;8BtzrVrrjAY]_^]̋UQSVuWt^}tW'8Btzru VrrjBY8~tWBt$zr9PrrjCY]8 BtzrVrrjDY\_^[] Wu 8̋UVuWtZ}tT8Btzru VrrjEYD8~tVBt$zrQ8PrrjFY\8 BtzrVrrjGY\_^] uu 8̋UQ8SVuWu oBtzrVrrjHY68~t,Btʀzrċ7PrrjIY=\8뤋x88BtzrWrrjJY9[_^[]̋USVW}tF]t?#8@txru u WppSu p֋ 8@txrVppjLYZ_^[] ̋UQSVW}3j[u 8XtxrWppjMY589wusXtxrppjNYY?lx%8Xt>xr8ppjOYY#8Xt8XrVppjPYY>78XtxrVppjQYY_^[]̋Uu43]̋UjjEPjEPjh j+u u(]̋U SVW3Eh߉85ut+8@txrVp pj Y%4hM؅h9=u;u58@t\xrV5 ppj Y3;8@txru ppj Y3M6 5h8@txrVp pj YD38M1t 8@txrSp pjYW_^[Ë}8̋U3ʼnES3Dž` VWdDž@( 3҉$ډ8(8,03D43DžPL T8y58@.x$Vppj YV tNtr8@txrVp pj6Y%^̋UEVW3t f98tHjZu$Wj}Wj}WRQjPVh j+u u8_^]̋U E3ɉESVuWj[t f9tHӋυu$E3UMtf9t~ u$PjEPERQjPjEPSWjVj h j+u uH_^[̋UVWujju up ֋y* 8AtyrVu uqqj Y_^] ̋U<3ĉD$8ESVىD$ EL$4W}3sD$ED$|$t$ L$87'xvCVVt$D$0D$D$4D$ D$L$$_^[3i]̋A̋UQVFHut V^̋V~@t vNt@N  ^̋UVWujju up _^] ̋U@3ʼnEEUSEċًM3"eVWu}諉UU諫3}ܫctU܋c{EeE̋EĉEEE@p$EPEPjEPEPu j֋xbEtVv uL"J]ejj@@tS^t M3 t0M*M_^3[^̋U03ʼnEU3SVW}UЫ3ۋMU]b~EEEE@]]p4EPEPEPu j֋x^EttJ4C]ejj@@tSNt M3t0փ}tupM)M_^3[G ̋U3ʼnEVu EWPEPEPV0xbEPEPEPVxKEPEPVx8EPEPVx%uuuuupj֋M_3^蒅̋U3ʼnESVW3}쫍UًM`x<{pF0Sw_^[̋VWW9quF90uWA_^jY)̋U Sك{tVWIf3}u_^[̋Uu XVu v 3=W}++tft fuu3_ҁf^]̋U3ʼnES3fDž VWj YÉ$4fDž(ƅ,Dž04Dž84ƅ<Dž@ DDžHƅLPTDžXƅ\Dž`dDžh,ƅlDžptDžxdƅ|E ]E`EE]EEE ]EEE]EEME EȘEME!EؔEME#E0EME$ExxkvFSSSSSS6vP$PLG rӅx>h(SSSSSSSSjPLxhh $%?M_^3[z̋U03ʼnEVWE43EԜEE,EdE`EEEEEx|Ѓ?t7d0jp'F r5DM_3^Bz̋U ESVW WUlPEPj@E@u,WVuVlEHPVxME03j@_^[̋UQQSVW3مt!>ES!8lE<sxRShEt,Pj@@u.uSW+~ WlEHPSxM>3j_^[̋U,3ʼnEE eE؋ESE܋ڋEVEEEEWEEhPEPEP:}x(uuEEu}uuPQWM_^3[xx̋U 3ʼnESVWfE3V],"Ӌ;u Af;Gt@E;u E@f;Gt rVl8tSVx8 t8tM_^3[w̋UQQESVuW3ɈEMMEE W|tWl8t1WlɈ5WWl8tEeEPUExD3ދuE 4Vu'E 4WuCr؋E8uEEu E 3VQE_^[̋U83ʼnEESډEV3]̋щUWtˉ0@uEPVVjR#uj@@EPuWjue]ЃEPsjU39vOU9QUu9t @ ;r;t`@k jY 8u?EM3QQjEEPQuEUx3EECCEԃ@E;Ed aWM_^3[eűSVW3 t[f8 uG;rb_^[Ã(vuf;vt3ɋ:3f9t̃^rA;rj.Xf;Dst3̋U3ʼnEESVWj^VEE 3j@}ME@ȉMuJ3fufuju쫫fEPyE @jY@uM]3ɉM}Q @ux$tU=mxUMmSM_^3[s̋UQSډMV3WNff;u+~v=?Pj@@uS׋Vx Vu3V_^[̋SVW3ft(Pj@@FufSVfFWV_^[̋V~tv&f^̋VFtNt @uFP^&f^̋UQQS‹W3E8tBVNff;u+4uVj@@VSPEUwM ^tE_[̋UQQS]VUW3E;Nff;u+Qff;u+ʍ~?Pj@@u'uuhx!WVb"x3V`_^[̋UQS‹V3EW!0u 9;Wj@@uPsxE03V_^[̋U(3ʼnES]VWjCE3EEEEUEM+Yf;Qj@fM@EtrEPj_WuxM+}ft'h!EPEEVuPu fuEPEPE3EC}tuM_^3[p ̋U3ʼnES3V]W9l|W9M<9 *hD hh8< hh!VhXVh@h!hh!hHh"hPM5hx*SEPhMhx WM_^3[n̋QVW=t2W5%W%t8@txrp pj.Y_^Y̋UQES3Vu EWttjWXHÊ#uWSWSEUFt NtF3^~V_^[̋U3ʼnEV58W,FePjjEMPjQVh@9N 6uЋM_3^ym̋V58W8;t*F F tv vff 6uމ=8_^̋UE S3V+uV\88@txrpL"pj Yh|QQ Y55| 8AtyrqL"qj Y3^@[] ̋UjjYQE PQEPQEPQEPQEPj h#j+u u@]̋U3ʼnEeeSVWMVlVlKjVEPtVlxEPuEPpM_^3[k̋UD3ʼnEEEȋE SEEVWE}3Uī3jMЋމu諉u̫EP4cV5EP`HV5EP8-j^u9]v}4h ECE;]rVj@@؅u juS<e}vHEȋu+ƉEȋ0uEEPX6ujSHE@;EЉEErjSjEPTi54h5(hPj@E@؅@juS<ujj5(F% PjS@Fjj54 PjS@jSjEPdE3!]PSEPDuj@@E̅MQPEPDxr}uOEPEPEPu0xQEPEHPuPx9uVlHPVxEUE̋M!]̉BEBE B S:u2u*u"M_^3[h̋SVWj _s6vuhWSGm _^[̋U3ʼnESVW}ډPThXjADž`!W\Džd?DžxDž|zEuEEEUhlDžptEEDEAuhl ShpVj@@؅u TSVSlWj1E?U(EEEXPEЉMPjMY(UEEEGPjxMPEЉMPjYE8DP(E١Eɡ EыU%UԉE؁0ExEEG PjxUPEЉMPjUUY(UE EEG0PjEMPEЉMPjYE_k( EExEEGPPjEUPEЉMPjM؉U܍UY(E ExE0EEG@PjEUPEЉMPjM؉M܉UUY(UEEG`PjhEPEEPjY^j(UEExEGpPjhMPEЉMPjYE(UEEEPjEE[PEEPjYE]ED(UEExEEPjEMPEЉMPjYE[E]EDHxX(EExEEPjEUPEЉMPjM؉U܍UYySM_^3[Hc̋U 3ʼnEVW3jPE45h5,h(Vj@@u jVW<xy5,hjWHx_5hjWHxES33f;Gs#EPPWPx$EHCf;_rjWjuTx3[WM_3^;b̋U$3ʼnESVUM 3WuM܉]]]]9=,r; 4;r+OtGbfĉEEt StckEu850h։EHeapEEuhHEEPh\"EPKhp"EP2UM0pEPh?EPM֋4u(}pEPh?EP֋3@ÅhHEPh\"EPhp"EPx}}pEPh?EP֋xV}SSp$EPS֋x5U}BSUSRSp(֋xM܋E]E E]tp֋E]tp֋Et8Heapu58P֋Ǎe_^[M3_̋U 3ʼnESVW3ۋMWuM]]]lu xEWlHPWx89,r= 4;r->LtcĉEEt StckEu850h։EHeapEEuEEPQQ2CpEPh?EPM֋4u(}pEPh?EP֋3@Åtp}SSp$EPS֋}USBSRSp(ΉU֋}SSSSp(֋tME]E]tp֋Et8Heapu58P֋Ǎe_^[M3]]̋U$3ʼnEeSVuWVUlu xeEPQ3ۋ֋ω]xUEPh]EtpMօ3ɉMQp$EPEPQ֋tEPj@E@ȉMu_Qp$EPEPj֋x=U3Mut 94tY@;rBUtuQup(j֋tpu|M_^3[[S̋UL3ʼnEE SVEȋEWE3u̺EЉEԉE؉E܉EEETE"E$E"E4E"E"9,r4 4;r$Ht_܅t Stcku150h֋؅Heapu̹HupEPh?QM։E̅hpj@@uu n3FPEF\FPFL FHFX## #F#F8F <F$F(jF,Xj F4FtCUĉEEt StckEu350h։E,HeapEu؊M 3]EH|8lu3HD8hhEPh(#EPučEPpEPh?EPM֋}܋p(3PPSP֋`hEPhH#EP8EPQQ!}؋pEPh?EP֋3;tu 3EFƁu}u1D&;u!Mԃtu DpDFM3} UԃMԍxẼ`}E؃D}ċPj@E@ȉMȅu ,U YAaAAAY]Ѓa(A eÉA$X}̃a4ÉA,Nj}ĉA0q@EÉA8qDA<3M7HtdVSMЃ PuPRM̃ PuPR EuPEPR} uujp(h֋]tp֋]܅tpuEt8Heapu58P֋Ǎe_^[M3SM̋UX3ʼnEEE3SM؋M EĉEȉẺEЉEVuEԋAE؋UEFW},E9,r= 4;r-:tVQĉEEЅt StckEu050h։EЅ0HeapE EME}| uDhEPh\#EPEPEP}pEPh?E̋P֋}ċp(3PPuP֋thEPhx#EPLEPQQM/4}pEPh?E̋P֋ uM3jZ;ut3EGU;u3u*DTG3uuDTG@jPj@E@؅u M$3!CCpjSh%jhHEPEPuu5jZF9MMUEMPh !EPh jSh$jhHEPEPuu5jZM\MTUEMPh !EPh bjSh&jhHEPEPuu5jZO} ufUEMPh!EPh xCUEjSh#jhHPEPuu5xMMMMM_^3[@̋U$3ʼnEESVWىUM 3҉MM$QuMQQPQˉUUUUt.} UEMPh!EPh jhQQEPEPuAMMUEMPh!EPh jhQQEPEPumMWMOUEMPh!EPh ]6jh.UEMPh!EPh -jhQQEPEPuUMMUEMPh!EPh j39EjPjhhjhEPEPu>eMOMGUEMPh!EPh U.E؋jj P3jPhjhEPEPuMMUEMPh7!EPh: jj hjhhjhEPEPuKxvM`MXUEMPh?!EPh< fxCjjjjhhjhEPEPuxMMMMM_^3[< ̋UQSVWىUShxWj@@t*SVWVlVlHPVxM_^[̋U3ʼnEeSVWESj@u@uoMgGGG 1qP@ p(SWjhM֋؅x$]pEPh?hP֋W^}tp֋M_^3[;̋U3ʼnEVTW3Lv<`dP9Tt 4DhhhPhP`PTLP`Py18@tuxroV`#Qppj YRPPWL@t2x08@txrp#pj YPt Py58@x}Wppj #YtdHPRy'8@5x+Wppj 묍,y*8@xWppjqh#@Pp (PS,Ph?@P֋y*8@xWppj9Tu7^y*8@Dx:Wppj(H;y*8@xWppjw 9^u18@txrp#pjY~ Py"8@txryWppj W0jSWT$ 8Atyrq#qjY$utSX (tp֋tp֍HM_^3[%68@txr #ppjYVPh!Ph ȅx<8@txrv#vppjY^Džh8@txrQv#vppBRWX8@txrp#pjYm=^(HPWv $6SvpPy58@%xWp#pjY$HVPSvQv(v 6p8@xWppj/̋U8SVW}3eeu૫EP$؅y58@xSp#pjYGEPEPEPEP3y= 8AtyrPq#qjYe3GEME}EEEEEEP؅y58@xSp#pjYj3j@]@!X uH uyS|]ƉExhK tCE}tEEtCEetCEEtCE}ujYE1E 8AtyrPq#qjYtSվ]}tpփ}tM_^[̋U$3ʼnES3VWE}E܉E૫EPy68xxVppj#Y 8xt xruuuuupp=Tt;MQP8x2x(Vppj!|`tIMQhdPHyk8xxVppj")HMQPy&8xxVppj#EPjuy8xtcxr]Vppj$EPjuy8xt0xr*Vppj%~ju܍EuP7 uu}t u8xtxrVp#pj&Y5M_^3[/̋UQQ3ʼnES] 3WCEPRuj Qx}VuFtm3ҍNff;u+F=wLuPj@@Cu03f p 6Af fCPEPs3  ^M_3[/̋UQQS] 3҉EVuMSWtVUSPx tUMVuy}_^[̋UQQSV‹WhE ]=t#wvSYYt ?3uuYj0j@@tW؋tJMSJx> C9tjY)HE303ht<_^[̋UQSVډMW3h;;tMp9Nt;uuJj0j@@tCt8EFF 9tjY)H3ht_^[̋UQQESVW hU]=t'wv SYYt ?3uj0j@@,؋t}MS 袹xqMS葹x`MS耹xOM Sox> C9tjY)HE303hta_^[ h33̋UQVHut EV^3AAA AAAA$A@A(@̋VWWF;t'39Nt 9Nt  9N t 9Bu>H9u7WJv@v 8v0v(v _^jY)̋UUVW3tʍqff;u+ Mj YWjEPjEPQRjh$j+u u0_^]̋USVu3Wt֍zff;u+Uj ZSjEPRVQh$j+u u(_^[]̋U(3ʼnESVu3WM3uEPEp$EPEPEPEPM֋xh}tZ}8@txruppjY}Mu$ A 8B4 8At%yr$qqjY 83 Cs|u 8At&yr uk qqjYR 8 8 8AtLyr#k $VqqjY 8AtyrVq$qjYnM_^3[(̋U(3ʼnEeSVu3WM3uEPEp$EPEPEPEPM֋xr}td} 8At#yruuqq 8U;r|; wtM܉ A 8B4 8At%yr$qqjY 83C<uAtYyrSk$qqjY/ 8At&yr ukqqjYG 8 8 8AtLyr#k$Vqqj Y 8AtyrVq$qj!YcM_^3[%̋U3ʼnESVW}EhX$3ۉMP]pEPh?EPօy+ 8Atbyr\Pq$qj"YF8@txrp$pj#Yuuy؅x u5؋}tp֋M_^3[%̋U3SVىFFt.E^ E$VMEh%E$K+t%SFuEbE%뿉^3^[̋USVWtL3FF%uEE%7;t֋:xAWsv( >3,EE% E$VME%_^[̋U3SVW!Fu. E$VME%EeE &3yEPM8y)EkED&WME%E$ +Nj;seEvFSrHP%; 3_^[̋U Vu ;wVEEAQMEx3^̋UQVu ;ueEPQQRx }u3^̋UMVu.EEl' E$VME( :tEE$[uEE'Q+x3^̅t#uQuf;wyufu2̅tuAu9wyu9u2̋UQQV3w+fҁEf0^̋U83ʼnEMESډEVu WM;rbEEPQы+xN}tFMЍ}إ3jZu̥}䫫+EEC3ɉEAE؉UPUEyx3M_^3[ ̋U<3ʼnEESVu EWt&u1EWEl)E<)ME) V6EuEXE)E"}E$3E)EE E)EMˋQQ}uEC re}؃e3EPy'WME)E<)EqE)vU؍MWy M$M~UčEVPk MP y}tMU9}tMC>u$E)ME<)EE$*3M_^3[H̋US]Vu Wt&u.EEl) E)VME<*auEE)3HVuSD@x>u lrEE$*3_^[̋U$3ʼnESڋVWt#u@DžDžl) VDž)Džp*uDžDž)뺍0ʋf|H\u j_t*ej^jXjYj8DXP\jX,04}}uUjZv>3_^̅tyu9u ;Aw2̅tytqw̋U$EES]VW uEE@-uEE`-y3 sϋMV;ыEtdӋEtEuu u׉EMEQPsYYËe3uuEEMd Y_^[ } w ̋UVu3;u sWu>t ׃;u r_^]; uL%l̋Uj u$h P|]̋U$ |5x=tff fpflf%hf-dEEE jXkǀjX jX jXk LjX Lh%%x̋UE3SVWH<AYt} p ;r H;r B(;r3_^[]̋Ujh hdPSVW1E3PEdeEhtTE-PhPt:@$ЃEMd Y_^[]ËE3Ɂ8ËeE3Md Y_^[]̋UMMZf9uA<8PEu f9Hu]3]̋UeeVWN@;tudEPE3EEx1E1E3EM3EEPE3E3E;t5uO@ȉ _^%dhd5D$l$l$+SVW1E3PeuEEEEdËMd Y__^[]Q̋Uuuu uhh ]%hQL$+#ȋ%;r Y$-QL$+ȃ YQL$+ȃ Y%%|%p%ܔ8(<k¥#7au K:Dbh̭0` `````p`p@@qή '=Ruү.BWjɰܰ offlinesam.dllSamOfflineAddMemberToAliasSamOfflineCloseHandleSamOfflineConnectSamOfflineConnectExternalSamOfflineConnectForInstallerSamOfflineCreateAliasInDomainSamOfflineCreateUserInDomainSamOfflineDeleteAliasSamOfflineDeleteUserSamOfflineEnumerateAliasesInDomainSamOfflineEnumerateDomainsInSamServerSamOfflineEnumerateUsersInDomain2SamOfflineFreeMemorySamOfflineGetMembersInAliasSamOfflineLookupDomainInSamServerSamOfflineLookupNamesInDomainSamOfflineOpenAliasSamOfflineOpenDomainSamOfflineOpenUserSamOfflineQueryInformationAliasSamOfflineQueryInformationUserSamOfflineRemoveMemberFromAliasSamOfflineRidToSidSamOfflineSetInformationAliasSamOfflineSetInformationUserOM0OMPONNpMN`LLM8&(TVh "|*, <> 8:  02H *,| TV  " (*$ (*P |  46 ,.<>4$&t .0@>@(N@D  @ (0@HP@X#"/\[]:|<>+=;?,* 66$<Xf|nRfT.fL*vDr:$$8tP`@6,J&>HVzhL0 rbB.v\@,vX> |bJ*zdbzЫ0`h DV,t&J(@R0pxD t`4^ 8L$$$TNhp4d66$<Xf|nRfT.fL*vDr:$$8tP`@6,J&>HVzhL0 rbB.v\@,vX> |bJ*zdbz%_purecall_vsnwprintf_wcsicmpt_XcptFilter_amsg_exitfreemalloc_inittermmsvcrt.dlls_except_handler4_commonNtOpenKeyhRtlInitUnicodeStringNtClose;RtlCopySid%NtCreateKeyzRtlInitializeRXactNtLoadKeyRtlDosPathNameToRelativeNtPathName_U_WithStatusnNtFlushKeyNtUnloadKey2RtlFreeHeapRtlEqualSidNtQuerySystemTimeRtlValidSidRtlSubAuthoritySid/RtlConvertSidToUnicodeStringRtlFreeUnicodeStringRtlSubAuthorityCountSidRtlLengthSidRtlSetSaclSecurityDescriptorRtlSetOwnerSecurityDescriptor~RtlInitializeSidRtlMapGenericMaskRtlSetDaclSecurityDescriptorRtlGetAceRtlAllocateAndInitializeSidRtlAddAccessAllowedAceRtlAbsoluteToSelfRelativeSDRtlAddAuditAccessAceARtlCreateAclRtlSetGroupSecurityDescriptorTRtlCreateSecurityDescriptorRtlGetDaclSecurityDescriptorRtlCompareUnicodeStringNtOpenProcessToken]NtDuplicateTokenNtQuerySystemInformationZNtSetInformationThreadNtQueryInformationTokenNtOpenThreadTokenNtQueryKeyQNtDeleteKeyURtlpNtEnumerateSubKey5RtlGetSaclSecurityDescriptor.RtlGetOwnerSecurityDescriptorgNtSetSecurityObjectTNtDeleteValueKeyRtlGetGroupSecurityDescriptorsNtSetValueKey NtQueryValueKeyNtAdjustPrivilegesTokenRtlAppendUnicodeStringToStringORtlIdentifierAuthoritySid>RtlCopyUnicodeStringRtlLengthRequiredSid RtlUpcaseUnicodeStringToOemStringRtlIntegerToUnicodeStringRtlAppendUnicodeToStringRtlFindMessageRtlFormatCurrentUserKeyPathHRtlRaiseStatusRtlAllocateHeapMRtlReAllocateHeap#DbgPrintExRtlUpcaseUnicodeCharTRtlImageNtHeaderntdll.dll"UuidToStringWRpcStringFreeWUuidCreateRPCRT4.dllBCryptEncryptBCryptDestroyKey!BCryptGetPropertyBCryptDecrypt'BCryptOpenAlgorithmProviderBCryptFinishHashBCryptCloseAlgorithmProvider BCryptDestroyHash#BCryptHashData5BCryptSetPropertyBCryptCreateHashBCryptGenerateSymmetricKeybcrypt.dll LsaOfflineOpenPolicy LsaOfflineOpenPolicyForInstaller LsaOfflineOpenPolicyExternalLsaOfflineCloseLsaOfflineSyskeyRequestLsaOfflineFreeMemoryLsaOfflineQueryInformationPolicyofflinelsa.dllSystemFunction036CRYPTBASE.dllLocalAlloc LocalFreeTraceMessage-GetLengthSid"GetFileAttributesWFIsValidSidCompareStringEx:GetTokenInformationInitializeSRWLock GetCurrentProcess#DuplicateTokenExOpenProcessToken OpenProcessGetLastErrorReleaseSRWLockExclusiveAcquireSRWLockExclusiveCloseHandle8WTSGetActiveConsoleSessionIdConvertStringSidToSidWLookupPrivilegeValueWUnregisterTraceGuidsRegisterTraceGuidsWGetTraceEnableLevelGetTraceEnableFlagsGetTraceLoggerHandleDisableThreadLibraryCallsFreeLibraryLoadLibraryExW SleepUnhandledExceptionFilterSetUnhandledExceptionFilter*TerminateProcessQueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount VirtualProtectVirtualAllocGetSystemInfo&SetThreadStackGuarantee VirtualQueryCryptReleaseContextCryptGetHashParamCryptDestroyHashCryptHashDataCryptCreateHashCryptAcquireContextAapi-ms-win-core-heap-obsolete-l1-1-0.dllapi-ms-win-eventing-classicprovider-l1-1-0.dllapi-ms-win-security-base-l1-1-0.dllapi-ms-win-core-file-l1-1-0.dllapi-ms-win-core-string-l1-1-0.dllapi-ms-win-core-synch-l1-1-0.dllapi-ms-win-core-processthreads-l1-1-0.dllapi-ms-win-core-processthreads-l1-1-1.dllapi-ms-win-core-errorhandling-l1-1-0.dllapi-ms-win-core-handle-l1-1-0.dllapi-ms-win-core-kernel32-legacy-l1-1-0.dllapi-ms-win-security-sddl-l1-1-0.dllapi-ms-win-security-lsalookup-l2-1-0.dllapi-ms-win-core-libraryloader-l1-1-0.dllapi-ms-win-core-synch-l1-2-0.dllapi-ms-win-core-profile-l1-1-0.dllapi-ms-win-core-sysinfo-l1-1-0.dllapi-ms-win-core-memory-l1-1-0.dllapi-ms-win-security-cryptoapi-l1-1-0.dllSystemFunction001SystemFunction003memcmpmemcpymemmovememset( @Xp   .0 WEVT_TEMPLATE4VS_VERSION_INFO {|O {|O?StringFileInfo040904B0LCompanyNameMicrosoft Corporation8FileDescriptionWindowsn'FileVersion10.0.20348.5499 (WinBuild.160101.0800)>InternalNameofflinesam.dll.LegalCopyright Microsoft Corporation. All rights reserved.FOriginalFilenameofflinesam.dllj%ProductNameMicrosoft Windows Operating SystemDProductVersion10.0.20348.5499DVarFileInfo$Translation  ' * + - = t!"! %!%!!'!-!!/!@!(00700:00@;@ @O@@Y@@aA An AABBB)B0B9B4@BIBHPB[B^BfBPPp  $Administrator Guest $Domain Admins $Domain Users None (Administrators ,Server Operators Power Users Users Guests ,Account Operators (Print Operators ,Backup Operators Replicator $Domain Guests 8$AccountNameConflict%1 krbtgt ,Domain Computers 0Domain Controllers $Schema Admins (Cert Publishers ,Enterprise Admins 0RAS and IAS Servers @Group Policy Creator Owners PPre-Windows 2000 Compatible Access Everyone 4Remote Desktop Users (Administrators (Anonymous Logon HNetwork Configuration Operators HIncoming Forest Trust Builders <Performance Monitor Users 4Performance Log Users PWindows Authorization Access Group (Network Service DEnterprise Domain Controllers HTerminal Server License Servers 0Trusted Installers 4Distributed COM Users IIS_IUSRS 8Cryptographic Operators $INTERNET USER XAllowed RODC Password Replication Group XDenied RODC Password Replication Group DRead-only Domain Controllers XEnterprise Read-only Domain Controllers ,Event Log Readers HCertificate Service DCOM Access <RDS Remote Access Servers 4RDS Endpoint Servers 8RDS Management Servers 8Hyper-V Administrators DCloneable Domain Controllers PAccess Control Assistance Operators 8Remote Management Users (DefaultAccount DSystem Managed Accounts Group 0WDAGUtilityAccount $Device Owners xBuilt-in account for administering the computer/domain |Built-in account for guest access to the computer/domain XDesignated administrators of the domain ,All domain users (Ordinary users Administrators have complete and unrestricted access to the computer/domain TMembers can administer domain servers Power Users are included for backwards compatibility and possess limited administrative powers Users are prevented from making accidental or intentional system-wide changes and can run most applications Guests have the same access as members of the Users group by default, except for the Guest account which is further restricted tMembers can administer domain user and group accounts Members can administer printers installed on domain controllers Backup Operators can override security restrictions for the sole purpose of backing up or restoring files TSupports file replication in a domain ,All domain guests XKey Distribution Center Service Account lAll workstations and servers joined to the domain TAll domain controllers in the domain XDesignated administrators of the schema Members of this group are permitted to publish certificates to the directory `Designated administrators of the enterprise Servers in this group can access remote access properties of users Members in this group can modify group policy for the domain A backward compatibility group which allows read access on all users and groups in the domain Members in this group are granted the right to logon remotely Administrators have complete and unrestricted access to the computer Members in this group can have some administrative privileges to manage configuration of networking features Members of this group can create incoming, one-way trusts to this forest Members of this group can access performance counter data locally and remotely \Members of this group may schedule logging of performance counters, enable trace providers, and collect event traces both locally and via remote access to this computer Members of this group have access to the computed tokenGroupsGlobalAndUniversal attribute on User objects `Members of this group can update user accounts in Active Directory with information about license issuance, for the purpose of tracking and reporting TS Per User CAL usage Members in this group are granted the right to install software Members are allowed to launch, activate and use Distributed COM objects on this machine. tBuilt-in group used by Internet Information Services. Members are authorized to perform cryptographic operations. Members in this group can have their passwords replicated to all read-only domain controllers in the domain Members in this group cannot have their passwords replicated to any read-only domain controllers in the domain Members of this group are Read-Only Domain Controllers in the domain Members of this group can read event logs from local machine Members of this group are Read-Only Domain Controllers in the enterprise Members of this group are allowed to connect to Certification Authorities in the enterprise Servers in this group enable users of RemoteApp programs and personal virtual desktops access to these resources. In Internet-facing deployments, these servers are typically deployed in an edge network. This group needs to be populated on servers running RD Connection Broker. RD Gateway servers and RD Web Access servers used in the deployment need to be in this group. tServers in this group run virtual machines and host sessions where users RemoteApp programs and personal virtual desktops run. This group needs to be populated on servers running RD Connection Broker. RD Session Host servers and RD Virtualization Host servers used in the deployment need to be in this group. DServers in this group can perform routine administrative actions on servers running Remote Desktop Services. This group needs to be populated on all servers in a Remote Desktop Services deployment. The servers running the RDS Central Management service must be included in this group. Members of this group have complete and unrestricted access to all features of Hyper-V. Members of this group that are domain controllers may be cloned. Members of this group can remotely query authorization attributes and permissions for resources on this computer. Members of this group can access WMI resources over management protocols (such as WS-Management via the Windows Remote Management service). This applies only to WMI namespaces that grant access to the user. (Protected Users `Members of this group are afforded additional protections against authentication security threats. See http://go.microsoft.com/fwlink/?LinkId=298939 for more information. TA user account managed by the system. lMembers of this group are managed by the system. HStorage Replica Administrators Members of this group have complete and unrestricted access to all features of Storage Replica. Key Admins Members of this group can perform administrative actions on key objects within the domain. 4Enterprise Key Admins Members of this group can perform administrative actions on key objects within the forest. A user account managed and used by the system for Windows Defender Application Guard scenarios. xMembers of this group can change system-wide settings. SAM failed to write changes to the database. This is most likely due to a memory or disk-space shortage. The SAM database will be restored to an earlier state. Recent changes will be lost. Check the disk-space available and maximum pagefile size setting. SAM failed to restore the database to an earlier state. SAM has shutdown. You must reboot the machine to re-enable SAM. SAM failed to start the TCP/IP or SPX/IPX listening thread There are two or more objects that have the same SID attribute in the SAM database. The Distinguished Name of the account is %1. All duplicate accounts have been deleted. Check the event log for additional duplicates. xThe SAM database was unable to lockout the account of %1 due to a resource error, such as a hard disk write failure (the specific error code is in the error data) . Accounts are locked after a certain number of bad passwords are provided so please consider resetting the password of the account mentioned above. The SAM database attempted to delete the file %1 as it contains account information that is no longer used. The error is in the record data. Please have an administrator delete this file. The SAM database attempted to clear the directory %1 in order to remove files that were once used by the Directory Service. The error is in record data. Please have an admin delete these files. x%1 is now the primary domain controller for the domain. The account %1 cannot be converted to be a domain controller account as its object class attribute in the directory is not computer or is not derived from computer. If this is caused by an attempt to install a pre Windows 2000 domain controller in a Windows 2000 domain or later, then you should pre-create the account for the domain controller with the correct object class. The attempt to check whether group caching has been enabled in the Security Accounts Manager has failed, most likely due to lack of resources. This task has been rescheduled to run in one minute. The group caching option in the Security Accounts Manager has now been properly updated. Group caching is enabled. The group caching option in the Security Accounts Manager has now been properly updated. Group caching is disabled. The %1 package failed to update additional credentials for user %2. The error code is in the data of the event log message. 4There are two or more well known objects that have the same SID attribute in the SAM database. The Distinguished Name of the duplicate account is %1. The newest account will be kept, all older duplicate accounts have been deleted. Check the event log for additional duplicates. lThere are two or more objects that have the same account name attribute in the SAM database. The system has automatically renamed object %1 to a system assigned account name %2. An error occurred while creating new default accounts for this domain. This maybe due to a transient error condition. The task will retry periodically until success and will log this message again in a week if the problem persists. The account %1 could not be upgraded since there is an account with an equivalent name. An error occurred upgrading user %1. This account will have to be added manually upon reboot. An error occurred trying to read a user object from the old database. An error occurred upgrading alias %1. This account will have to be added manually upon reboot. An error occurred trying to read an alias object from the old database. An error occurred upgrading group %1. This account will have to be added manually upon reboot. An error occurred trying to read a group object from the old database. An error occurred trying to add account %1 to alias %2. This account will have to be added manually upon reboot. The account with the sid %1 could not be added to group %2. An error occurred trying to add account %1 to group %2. This account will have to be added manually upon reboot. The account with the rid %1 could not be added to group %2. <A fatal error occurred trying to transfer the SAM account database into the directory service. A possible reason is the SAM account database is corrupt. The account krbtgt was renamed to %1 to allow the Kerberos security package to install. An error occurred trying to upgrade a SAM user's User_Parameters attribute. The following Notification Package DLL might be the possible offender: %1. Check the record data of this event for the NT error code. @An error occured trying to set User Parameters attribute for this user This operation is failed. Check the record data of this event for the NT error code. An error occured trying to upgrade the following SAM User Object - %1. We will try to continue upgrading this user. But it might contain inconsistent data. Check the record data of this event for the NT error code. LAn error occurred when trying to add the account %1 to the group %2. The problem, "%3", occurred when trying to open the group. Please add the account manually. hAn error occurred when trying to add the account %1 to the group %2. The problem, "%3", occurred when trying to add the account to the group. Please add the account manually. The error "%2" occurred when trying to create the well known account %1. Please contact PSS to recover. 4During the installation of the Directory Service, this server's machine account was deleted hence preventing this Domain Controller from starting up. LThe Security Account Database detected that the well known account %1 does not exist. The account has been recreated. Please reset the password for the account. The Security Account Database detected that the well known group or local group %1 does not exist. The group has been recreated. Domain operation mode has been changed to Native Mode. The change cannot be reversed. Active Directory Domain Services failed to add a security principal to well known security principals container. Please have an administrator add this security principal if needed. Security principal name: %1 Active Directory Domain Services failed to add all of the new security principals to well known security principals container. Please have an administrator add these security principals if needed. Active Directory Domain Services failed to rename a security principal in well known security principals container. Please have an administrator rename this security principal if needed. Security principal name: %1 Active Directory Domain Services failed to rename some of the security principals in well known security principals container. Please have an administrator rename these security principals if needed. An error occurred when trying to remove the account %1 from the group %2. The problem, "%3", occurred when trying to remove the account from the group. Please remove the member manually. $The account-identifier allocator was unable to assign a new identifier. The identifier pool for this domain controller may have been depleted. If this problem persists, restart the domain controller and view the initialization status of the allocator in the event log. An initial account-identifier pool has not yet been allocated to this domain controller. A possible reason for this is that the domain controller has been unable to contact the master domain controller, possibly due to connectivity or network problems. Account creation will fail on this domain controller until the pool is obtained. <The maximum domain account identifier value has been reached. No further account-identifier pools can be allocated to domain controllers in this domain. tThe maximum account identifier allocated to this domain controller has been assigned. The domain controller has failed to obtain a new identifier pool. A possible reason for this is that the domain controller has been unable to contact the master domain controller. Account creation on this controller will fail until a new pool has been allocated. There may be network or connectivity problems in the domain, or the master domain controller may be offline or missing from the domain. Verify that the master domain controller is running and connected to the domain. The computed account identifier is invalid because it is out of the range of the current account-identifier pool belonging to this domain controller. The computed RID value is %1. Try invalidating the account identifier pool owned by this domain controller. This will make the domain controller acquire a fresh account identifier pool. The domain controller is starting a request for a new account-identifier pool. The request for a new account-identifier pool has completed successfully. The account-identifier-manager object creation completed. If the record data for this event has the value zero, the manager object was created. Otherwise, the record data will contain the NT error code indicating the failure. The failure to create the object may be due to low system resources, insufficient memory, or disk space. The request for a new account-identifier pool failed. The operation will be retried until the request succeeds. The error is %n " %1 " The domain controller is booting to directory services restore mode. 8A pool size for account-identifiers (RIDs) that was configured by an Administrator is greater than the supported maximum. The maximum value of %1 will be used when the domain controller is the RID master. %nSee http://go.microsoft.com/fwlink/?LinkId=225963 for more information. A pool of account-identifiers (RIDs) has been invalidated. This may occur in the following expected cases:%n1. A domain controller is restored from backup. %n2. A domain controller running on a virtual machine is restored from snapshot. %n3. An administrator has manually invalidated the pool. %nSee http://go.microsoft.com/fwlink/?LinkId=226247 for more information. The global maximum for account-identifiers (RIDs) has been increased to %1. %n See http://go.microsoft.com/fwlink/?LinkId=233329 for more information including important operating system interoperability requirements. Action required! An account-identifier (RID) pool was allocated to this domain controller. The pool value indicates this domain has consumed a considerable portion of the total available account-identifiers. %n%nA protection mechanism will be activated when the domain reaches the following threshold of total available account-identifiers remaining: %1. The protection mechanism prevents the allocation of account-identifier (RID) pools needed to allow existing DCs to create additional users, computers and groups, or promote new DCs into the domain. The mechanism will remain active until the Administrator manually re-enables account-identifier allocation on the RID master domain controller. %n%nSee http://go.microsoft.com/fwlink/?LinkId=228610 for more information. h Action required! This domain has consumed a considerable portion of the total available account-identifiers (RIDs). A protection mechanism has been activated because the total available account-identifiers remaining is approximately: %1. %n%nThe protection mechanism prevents the allocation of account-identifier (RID) pools needed to allow existing DCs to create additional users, computers and groups, or promote new DCs into the domain. The mechanism will remain active until the Administrator manually re-enables account-identifier (RID) allocation on the RID master domain controller. %n%nIt is extremely important that certain diagnostics be performed prior to re-enabling account creation to ensure this domain is not consuming account-identifiers at an abnormally high rate. Any issues identified should be resolved prior to re-enabling account creation. %n%nFailure to diagnose and fix any underlying issue causing an abnormally high rate of account-identifier consumption can lead to account-identifier (RID) pool exhaustion in the domain after which account creation will be permanently disabled in this domain. %n%nSee http://go.microsoft.com/fwlink/?LinkId=228610 for more information. This event is a periodic update on the remaining total quantity of available account-identifiers (RIDs). The number of remaining account-identifiers is approximately: %1. %n%nAccount-identifiers are used as accounts are created, when they are exhausted no new accounts may be created in the domain. %n%nSee http://go.microsoft.com/fwlink/?LinkId=228745 for more information. Security Enabled Local Group Changed to Security Enabled Universal Group. Security Enabled Local Group Changed to Security Disabled Local Group. Security Enabled Local Group Changed to Security Disabled Universal Group. Security Enabled Global Group Changed to Security Enabled Universal Group. Security Enabled Global Group Changed to Security Disabled Global Group. Security Enabled Global Group Changed to Security Disabled Universal Group. Security Enabled Universal Group Changed to Security Enabled Local Group. Security Enabled Universal Group Changed to Security Enabled Global Group. Security Enabled Universal Group Changed to Security Disabled Local Group. Security Enabled Universal Group Changed to Security Disabled Global Group. Security Enabled Universal Group Changed to Security Disabled Universal Group. Security Disabled Local Group Changed to Security Enabled Local Group. Security Disabled Local Group Changed to Security Enabled Universal Group. Security Disabled Local Group Changed to Security Disabled Universal Group. Security Disabled Global Group Changed to Security Enabled Global Group. Security Disabled Global Group Changed to Security Enabled Universal Group. Security Disabled Global Group Changed to Security Disabled Universal Group. Security Disabled Universal Group Changed to Security Enabled Universal Group. Security Disabled Universal Group Changed to Security Enabled Global Group. Security Disabled Universal Group Changed to Security Enabled Universal Group. Security Disabled Universal Group Changed to Security Disabled Local Group. Security Disabled Universal Group Changed to Security Disabled Global Group. TMember Account Name Is Not Available. ,Account Enabled. ,Account Disabled. Certain Bit(s) in User Account Control Field Has Been Changed. 4Account Name Changed. (Password Policy $Logoff Policy (Oem Information 8Replication Information 0Domain Server Role 0Domain Server State (Lockout Policy (Modified Count Domain Mode Basic Application Group Changed to Ldap Query Application Group. Ldap Query Application Group Changed to Basic Application Group. pFailed to secure the machine account %1. Have an administrator remove the builtin\account operators full control Access Control Entry from the security descriptor on this object. Failed to secure the machine account %1. This operation will be retried. Have an administrator verify the builtin\account operators full control Access Control Entry was removed from the security descriptor on this object. <Secured the machine account %1. The builtin\account operators full control Access Control Entry was removed from the security descriptor on this object. The certificate that is used for authentication does not have an issuance policy descriptor corresponding to OID %1 in the Active Directory database. This certificate will not be associated with a corresponding security identifier (SID), and the user may be denied access to some resources if you have resources whose access is restricted based on this issuance policy. The error is %2. The certificate issuance policy that is represented by OID %2 does not have a link to a security identifier (SID), or this link cannot be read. The link is represented by the attribute msDS-OIDToGroupLink on the msPKI-Enterprise-Oid object that represents the issuance policy. This certificate will not be associated with a corresponding SID, and the user may be denied access to some resources if you have resources whose access is restricted based on this issuance policy. Multiple certificate issuance policy descriptors were found in the Active Directory database. The attribute msPKI-Cert-Template-OID of these descriptors contains string %1. This attribute should be able to uniquely identify an issuance policy descriptor; you should resolve this conflict. The issuance policies that are affected will not be associated with security identifiers (SIDs), and users who are authenticating using certificates that are issued by the corresponding policy may be denied access to some resources. tThe certificate issuance policy descriptor %2 is linked through its attribute msDS-OIDToGroupLink to a group that is not a security group, has members, or is not universal. The error is %6.%nAn issuance policy should be linked to a security identifier (SID) of a group that is security enabled, does not have members, and is universal. Users who are authenticating using certificates that are issued according to this policy may be denied access to some resources. The distinguished name (also known as DN) of the group that does not meet these requirements is %3. The requested modification for group %1 could not be performed. This is because this group is linked through msDS-OIDToGroupLinkBl to a certificate issuance policy descriptor. Such groups should be security enabled, they should not have any members, and they should be universal.%nThe requested operation was %4.%nThe error is %5. dThe certificate issuance policy descriptor %1 cannot be linked to group %2. Issuance policies can be linked through the attribute msDS-OIDToGroupLink only to universal, security-enabled groups that have an empty membership. You should ensure that this group meets these requirements.%nThe error is %5. The following invalid claims issued to user %1 have been dropped: %2. Claims issued to user %1 could not be validated and have been dropped. Error: %2. Claims issued to user %1 could not be validated and have been dropped. Error: %2. The password notification DLL %1 failed to load with error %4. Please verify that the notification DLL path defined in the registry, %2%3, refers to a correct and absolute path (<drive>:\<path>\<filename>.<ext>) and not a relative or invalid path. If the DLL path is correct, please validate that any supporting files are located in the same directory, and that the system account has read access to both the DLL path and any supporting files. Contact the provider of the notification DLL for additional support. Further details can be found on the web at http://go.microsoft.com/fwlink/?LinkId=245898. tSAM was configured to not listen on the TCP protocol. `Legacy password validation mode has been enabled on this machine. If an Exchange ActiveSync policy is configured it will not be enforced for password validation requests. lRemote calls to the SAM database are being restricted using the default security descriptor: %1.%nFor more information please see http://go.microsoft.com/fwlink/?LinkId=787651. Remote calls to the SAM database are being restricted using the configured registry security descriptor: %1.%nFor more information please see http://go.microsoft.com/fwlink/?LinkId=787651. The registry security descriptor is malformed: %1.%nRemote calls to the SAM database are being restricted using the default security descriptor: %2.%nFor more information please see http://go.microsoft.com/fwlink/?LinkId=787651. XA remote call to the SAM database has been denied.%nClient SID: %1%nNetwork address: %2%nFor more information please see http://go.microsoft.com/fwlink/?LinkId=787651. Audit only mode is now enabled for remote calls to the SAM database. SAM will log an event for clients who would have been denied access in normal mode. %nFor more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 4Audit only mode is now disabled for remote calls to the SAM database.%nFor more information please see http://go.microsoft.com/fwlink/?LinkId=787651. Audit only mode is currently enabled for remote calls to the SAM database.%nThe following client would have been normally denied access:%nClient SID: %1 from network address: %2. %nFor more information please see http://go.microsoft.com/fwlink/?LinkId=787651. h%2 remote calls to the SAM database have been denied in the past %1 seconds throttling window.%nFor more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 4An error occurred while configuring one or more well-known accounts for this domain. This may be due to a transient error condition. The task will retry periodically until successful. For more information please see https://go.microsoft.com/fwlink/?linkid=832473.%nStatus: %1 The domain is configured with the following minimum password length-related settings.%n%nMinimumPasswordLength: %1%n%nRelaxMinimumPasswordLengthLimits: %2%n%nMinimumPasswordLengthAudit: %3%n%nFor more information see https://go.microsoft.com/fwlink/?LinkId=2097191.%n XThe following account has been configured with a password whose length is shorter than the current MinimumPasswordLengthAudit setting.%n%nAccountName: %1%n%nMinimumPasswordLength: %2%n%nMinimumPasswordLengthAudit: %3%n%nFor more information see https://go.microsoft.com/fwlink/?LinkId=2097191.%n <The domain is incorrectly configured with a MinimumPasswordLength setting that is greater than 14 while RelaxMinimumPasswordLengthLimits is either undefined or disabled.%n%nNOTE: until this is corrected, the domain will enforce a smaller MinimumPasswordLength setting of 14.%n%nCurrently configured MinimumPasswordLength value: %1%n%nFor more information see https://go.microsoft.com/fwlink/?LinkId=2097191.%n The security account manager has detected the use of a ROCA-vulnerable Windows Hello for Business key during authentication by the following account. The policy is currently configured for audit so the authentication was allowed to proceed.%n%nAccount DN: %1%n%nAccount SID: %2%n%nKeyHash: %3%n%nFor more information see https://go.microsoft.com/fwlink/?linkid=2116430.%n TThe security account manager has detected and blocked the use of a ROCA-vulnerable Windows Hello for Business key during authentication by the following account.%n%nAccount DN: %1%n%nAccount SID: %2%n%nKeyHash: %3%n%nFor more information see https://go.microsoft.com/fwlink/?linkid=2116430.%n The security account manager is now logging verbose events for remote clients that call legacy password change or set RPC methods. This setting may cause large number of messages and should only be used for a short period time to diagnose problems.%n%nFor more information please see https://go.microsoft.com/fwlink/?linkid=2150956.%n The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.%n%nFor more information please see https://go.microsoft.com/fwlink/?linkid=2150956.%n The security account manager detected %1 legacy password change or set RPC method calls in the past %2 minutes.%n%nFor more information please see https://go.microsoft.com/fwlink/?linkid=2150956.%n <The security account manager detected the use of a legacy password change or set RPC method from a network client.%nConsider upgrading the client operating system or application to use the latest and more secure version of this method.%n%nDetails:%n%nRPC Method: %1%nClient Network Address: %4%nClient SID: %3%nUsername: %2%n%nFor more information please see https://go.microsoft.com/fwlink/?linkid=2150956.%n The security account manager has detected one or more duplicated names for a local account. This inconsistency was remediated by keeping one account name and deleting the remaining names.%n%nRID=%1(%2)%n%nRetained account name: %3%n%nDeleted account name(s): %4%n%nFor more information see https://go.microsoft.com/fwlink/?linkid=2134956.%n The security account manager has detected one or more duplicated names for a local account. This inconsistency may cause application failures and\or system instability. No changes were made since the policy is in detect-only mode.%n%nDetails:%n%nRID=%1(%2)%n%nDuplicate account names: %3%n%nIf the policy had been set to repair mode, the following account name would have been retained and all others deleted:%n%nAccount name to retain: %4%n%nFor more information see https://go.microsoft.com/fwlink/?linkid=2134956.%n The security account manager blocked a non-administrator from creating an Active Directory account in this domain with mismatched objectClass and userAccountControl account type flags.%n%nDetails:%n%nAccount name: %1%nAccount objectClass: %2%nuserAccountControl: %3%nCaller address: %4%nCaller SID: %5%n%nFor more information see https://go.microsoft.com/fwlink/?linkid=2173873.%n The security account manager blocked a non-administrator from creating or renaming a computer account using an invalid sAMAccountName. sAMAccountName on computer accounts must end with a single trailing $ sign.%n%nAttempted sAMAccountName: %1%nRecommended sAMAccountName: %1$%n%nFor more information see https://go.microsoft.com/fwlink/?linkid=2173873.%n The security account manager is now configuring the local password and lockout policies in accordance with regional policy.%n The security account manager successfully initialized the Local Administrator Password Solution (LAPS) extension dll.%n The security account manager failed to initialize the Local Administrator Password Solution (LAPS) extension dll.%n%nStatus:%1%n The security account manager is using the specified security descriptor for validation of computer account re-use attempts during domain join.%n%nSDDL Value: %1.%n%nThis allow list is configured through group policy in Active Directory.%nFor more information please see http://go.microsoft.com/fwlink/?LinkId=2202145.%n The security descriptor that contains the computer account re-use allow list being used to validate client requests during domain join is malformed.%n%nSDDL Value: %1.%n%nThis allow list is configured through group policy in Active Directory.To correct this problem an administrator will need to update the policy and set this value to a valid security descriptor or disable the policy.%nFor more information please see http://go.microsoft.com/fwlink/?LinkId=2202145.%n The security account manager found a computer account that appears to be orphaned and does not have an existing owner.%n%nComputer Account: %1%nComputer Account Owner: %2%n%nFor more information please see http://go.microsoft.com/fwlink/?LinkId=2202145.%n TThe security account manager rejected a client request to re-use a computer account during domain join.%nThe computer account and the client identity did not meet the required security validation checks.%n%nClient Account: %3%nComputer Account: %1%nComputer Account Owner: %2%n%nCheck the record data of this event for the NT Error code.%nFor more information please see http://go.microsoft.com/fwlink/?LinkId=2202145.%n Error Warning Information \Microsoft-Windows-Directory-Services-SAM System CRIM, O 'JIP^Oح8ꏽIUIKcWEVTH p| CHAN0SystemTTBLPgTEMPp!^tTtsusJAxD EventData;KNameSAMMSG_COMMIT_FAILED!Binary __binLengthErrorCodeTEMP |U+S[\b!.rAzD EventData=KNameSAMMSG_REFRESH_FAILED!Binary __binLengthErrorCodeTEMP (2h_pv4m>:A|D EventData?KNameSAMMSG_RPC_INIT_FAILED!Binary __binLengthLogStatusTEMP<lFzgQdVUAD EventData;KNameSAMMSG_DUPLICATE_SIDA[oDataCKNameAccountDistinguishedName 8AccountDistinguishedNameTEMP5!TAD EventDataGKNameSAMMSG_LOCKOUT_NOT_UPDATEDA;oData#KNameUserName !Binary XpUserName__binLengthErrorCodeTEMPw'%vZL'AD EventDataSKName SAMMSG_DATABASE_FILE_NOT_DELETEDA;oData#KNameFilePath !Binary FilePath__binLengthWinErrorTEMPD ƔG/AGSVHqAD EventDataQKNameSAMMSG_DATABASE_DIR_NOT_DELETEDAEoData-KName DirectoryPath !Binary    DirectoryPath__binLengthWinErrorTEMP ƶk[dcmybAD EventData?KNameSAMMSG_PROMOTED_TO_PDCACoData+KName ComputerName  ComputerNameTEMP  K%3 S%,ЕAD EventDataOKNameSAMMSG_DC_NEEDS_TO_BE_COMPUTERACoData+KName ComputerName  ComputerNameTEMP ^SKZiآ"AD EventDataOKNameSAMMSG_SITE_INFO_UPDATE_FAILED!Binary   __binLengthErrorCodeTEMP ;.i\ډAyD EventData[KName$SAMMSG_SITE_INFO_UPDATE_SUCCEEDED_ONTEMP"5|Zٲ /A{D EventData]KName%SAMMSG_SITE_INFO_UPDATE_SUCCEEDED_OFFTEMPM/ldWIkA(D EventDataYKName#SAMMSG_CREDENTIAL_UPDATE_PKG_FAILEDAIoData1KNameSecurityPackage A;oData#KNameUserName !Binary ,Ph$SecurityPackageUserName__binLengthErrorCodeTEMP`:CGM^XJ6;AD EventData_KName&SAMMSG_DUPLICATE_SID_WELLKNOWN_ACCOUNTA[oDataCKNameAccountDistinguishedName 8AccountDistinguishedNameTEMP pg[y6[x! A?D EventData[KName$SAMMSG_RENAME_DUPLICATE_ACCOUNT_NAMEA[oDataCKNameAccountDistinguishedName A]oDataEKNameSystemAssignedAccountName 8AccountDistinguishedName8SystemAssignedAccountNameTEMP%(JU Y匈dA~D EventDataAKNameSAMMSG_PDC_TASK_FAILURE!Binary __binLengthErrorCodeTEMP.z\x jTAD EventDataCKNameSAMMSG_DUPLICATE_ACCOUNTAAoData)KName AccountName !Binary PlAccountName__binLengthErrorCodeTEMP}lPDAD EventDataCKNameSAMMSG_USER_NOT_UPGRADEDA;oData#KNameUserName !Binary UserName__binLengthErrorCodeTEMP tm\"iwOAD EventDataSKName SAMMSG_UNKNOWN_USER_NOT_UPGRADED!Binary  (__binLengthErrorCodeTEMP<2`/OZwlDuGAD EventDataEKNameSAMMSG_ALIAS_NOT_UPGRADEDA=oData%KName GroupName !Binary xGroupName__binLengthErrorCodeTEMP$ h95^Q@Ū~AD EventDataUKName!SAMMSG_UNKNOWN_ALIAS_NOT_UPGRADED!Binary __binLengthErrorCodeTEMP7ҳ ^8N AD EventDataEKNameSAMMSG_GROUP_NOT_UPGRADEDA=oData%KName GroupName !Binary  8TGroupName__binLengthErrorCodeTEMP$4NhS[5AD EventDataUKName!SAMMSG_UNKNOWN_GROUP_NOT_UPGRADED!Binary \x__binLengthErrorCodeTEMP0C]@oZ q]R/A(D EventDataEKNameSAMMSG_ERROR_ALIAS_MEMBERA[oDataCKNameAccountDistinguishedName A=oData%KName GroupName !Binary < t   8AccountDistinguishedNameGroupName__binLengthErrorCodeTEMPH0"IYurZV -A:D EventDataUKName!SAMMSG_ERROR_ALIAS_MEMBER_UNKNOWNA?oData'KName AccountSID A[oDataCKNameAccountDistinguishedName !Binary """"AccountSID8AccountDistinguishedName__binLengthErrorCodeTEMP0d$V[L3\mF3WA(D EventDataEKNameSAMMSG_ERROR_GROUP_MEMBERA[oDataCKNameAccountDistinguishedName A=oData%KName GroupName !Binary $$% %8AccountDistinguishedNameGroupName__binLengthErrorCodeTEMP&6+8 ZnAD EventDataUKName!SAMMSG_ERROR_GROUP_MEMBER_UNKNOWNA?oData'KName AccountRID A=oData%KName GroupName !Binary && '('AccountRIDGroupName__binLengthErrorCodeTEMP'.1GNUV" AD EventDataGKNameSAMMSG_FATAL_UPGRADE_ERROR!Binary  (<(__binLengthErrorCodeTEMPd)f5QQX9AD EventDataOKNameSAMMSG_ERROR_UPGRADE_USERPARMSAIoData1KNameSecurityPackage !Binary )))$SecurityPackage__binLengthErrorCodeTEMP*,U:h?eAD EventDataGKNameSAMMSG_ERROR_SET_USERPARMS!Binary **__binLengthErrorCodeTEMP,O:2YИpPҺAD EventData[KName$SAMMSG_ACCEPTABLE_ERROR_UPGRADE_USERA;oData#KNameUserName !Binary X,p,,UserName__binLengthErrorCodeTEMPL.r^KNXR,VAԕnArD EventData_KName&SAMMSG_MEMBERSHIP_SETUP_ERROR_NO_GROUPAAoData)KName AccountName A=oData%KName GroupName ACoData+KName ErrorMessage !Binary .../ /AccountNameGroupName ErrorMessage__binLengthErrorCodeTEMP0!807VHA`D EventDataMKNameSAMMSG_MEMBERSHIP_SETUP_ERRORAAoData)KName AccountName A=oData%KName GroupName ACoData+KName ErrorMessage !Binary 01L1d111AccountNameGroupName ErrorMessage__binLengthErrorCodeTEMP2EdžnUqo IUAD EventDataAKNameSAMMSG_USER_SETUP_ERRORAAoData)KName AccountName ACoData+KName ErrorMessage !Binary L3h333AccountName ErrorMessage__binLengthErrorCodeTEMP|4e-SgFYAD EventDataOKNameSAMMSG_MACHINE_ACCOUNT_MISSING!Binary 44__binLengthErrorCodeTEMP5OfQH[q AD EventDataYKName#SAMMSG_WELL_KNOWN_ACCOUNT_RECREATEDA;oData#KNameUserName !Binary  686T6UserName__binLengthErrorCodeTEMPx7w&\6we]AD EventDataUKName!SAMMSG_WELL_KNOWN_GROUP_RECREATEDA=oData%KName GroupName !Binary 777GroupName__binLengthErrorCodeTEMP8Ѿlh\J iAiD EventDataKKNameSAMMSG_CHANGE_TO_NATIVE_MODETEMP9a=Tm#AD EventDataaKName'SAMMSG_FAILED_TO_ADD_SECURITY_PRINCIPALAAoData)KName AccountName !Binary 9:0:AccountName__binLengthErrorCodeTEMP8$;fxTNZ[?AD EventDatakKName,SAMMSG_FAILED_TO_ADD_ALL_SECURITY_PRINCIPALS!Binary L;h;__binLengthErrorCodeTEMP<H뫰TLivAD EventDatagKName*SAMMSG_FAILED_TO_RENAME_SECURITY_PRINCIPALAAoData)KName AccountName !Binary <<=AccountName__binLengthErrorCodeTEMP@>uQԠAP93htvAD EventDataqKName/SAMMSG_FAILED_TO_RENAME_ALL_SECURITY_PRINCIPALS!Binary 8>T>__binLengthErrorCodeTEMP@HWZ6AnD EventData]KName%SAMMSG_MEMBERSHIP_REMOVAL_SETUP_ERRORAAoData)KName AccountName A=oData%KName GroupName AAoData)KName ErrorString !Binary t@@@@@AccountNameGroupNameErrorString__binLengthBinaryDataTEMPAF0][F/ r'AD EventDataEKNameSAMMSG_GET_NEXT_RID_ERROR!Binary AA__binLengthErrorCodeTEMPB<-U\e0A~D EventDataAKNameSAMMSG_NO_RIDS_ASSIGNED!Binary BC__binLengthErrorCodeTEMP CT}?Sh ǐAzD EventData=KNameSAMMSG_MAX_DOMAIN_RID!Binary CD__binLengthErrorCodeTEMPD7%jq$^kdSRArD EventData5KNameSAMMSG_MAX_DC_RID!Binary DE__binLengthErrorCodeTEMP,FPP]&^ uAD EventData7KNameSAMMSG_INVALID_RIDAKoData3KNameComputedRIDValue !Binary hFFF(ComputedRIDValue__binLengthErrorCodeTEMPhG?ũY ^ԄAmD EventDataOKNameSAMMSG_REQUESTING_NEW_RID_POOLTEMP$0H=)^hRg'AD EventDataUKName!SAMMSG_RID_REQUEST_STATUS_SUCCESS!Binary XHtH__binLengthErrorCodeTEMPHI @%AYl6!1ޫAD EventDataIKNameSAMMSG_RID_MANAGER_CREATION!Binary pII__binLengthErrorCodeTEMP(J[a^$`PCxf-6AD EventDataUKName!SAMMSG_RID_REQUEST_STATUS_FAILUREACoData+KName ErrorMessage J ErrorMessageTEMPhK TmPAgD EventDataIKNameSAMMSG_BOOT_TO_RESTORE_MODETEMPHL9 Q`isJWAD EventDataMKNameSAMMSG_INVALID_RID_BLOCK_SIZEA9oData!KNameMaximum \LMaximumTEMP Md9WRrECAD EventData]KName%SAMMSG_RID_ARTIFICIAL_CEILING_WARNINGAMoData5KNameCeilingTriggerRid @O(CeilingTriggerRidTEMPDpPc_)/KAD EventDataaKName'SAMMSG_RID_ARTIFICIAL_CEILING_ACTIVATEDAMoData5KNameCeilingTriggerRid P(CeilingTriggerRidTEMP$QTwۢP̋AD EventDataOKNameSAMMSG_RID_CONSUMPTION_WARNINGAEoData-KName RemainingRids Q RemainingRidsTEMPRV1)|^TvY7d\AD EventData[KName$SAMMSG_FAILED_MACHINE_ACCOUNT_SECUREACoData+KName ComputerName !Binary $SDS`S ComputerName__binLengthErrorCodeTEMPT*ClA^UFAD EventDatagKName*SAMMSG_FAILED_MACHINE_ACCOUNT_SECURE_RETRYACoData+KName ComputerName !Binary TTU ComputerName__binLengthErrorCodeTEMP4Vۉd/TONkAD EventDataMKNameSAMMSG_MACHINE_ACCOUNT_SECUREACoData+KName ComputerName !Binary pVVV ComputerName__binLengthErrorCodeTEMPXWWJ/mAD EventData;KNameSAMMSG_OID_NOT_FOUNDA1oDataKNameOID A=oData%KName ErrorCode WX OIDErrorCodeTEMPY-V[q#IACD EventData]KName%SAMMSG_NO_OID_TO_GROUP_LINK_ATTRIBUTEA1oDataKNameOID AEoData-KName OID Object DN A=oData%KName ErrorCode YYY OID OID Object DNErrorCodeTEMPZZrGNWr:/AD EventDataIKNameSAMMSG_DUPLICATE_OID_OBJECTA1oDataKNameOID Z OIDTEMPDD].h{\y/ȹAD EventDataSKName SAMMSG_INVALID_OID_TO_GROUP_LINKA1oDataKNameOID AEoData-KName OID Object DN A;oData#KNameGroup DN A?oData'KName Group GUID A=oData%KName Group SID A=oData%KName ErrorCode ]]]^^4^ OID OID Object DNGroup DNGroup GUIDGroup SIDErrorCodeTEMPT`z2@]}eAD EventDataaKName'SAMMSG_MAPPED_GROUP_MODIFICATION_FAILEDA;oData#KNameGroup DN A?oData'KName Group GUID A=oData%KName Group SID A=oData%KName Operation A=oData%KName ErrorCode ```aaGroup DNGroup GUIDGroup SIDOperationErrorCodeTEMP0cdB]rzAD EventDataQKNameSAMMSG_CANNOT_LINK_OID_TO_GROUPA;oData#KNameOID Name A?oData'KName Group Name A?oData'KName Group GUID A=oData%KName Group SID A=oData%KName ErrorCode cccccOID NameGroup NameGroup GUIDGroup SIDErrorCodeTEMPmG5V"`5I8KAAD EventDatasKName0SAMMSG_RESTRICT_REMOTE_SAM_REGISTRY_SD_MALFORMEDASoData;KNameMalformed SD String: AOoData7KNameDefault SD String: qDq0Malformed SD String:,Default SD String:TEMPrX8eQ8̩UAD EventDataQKNameSAMMSG_REMOTE_SAM_ACCESS_DENIEDAAoData)KName Client SID: AYoDataAKNameClient Network Address: rsClient SID:4Client Network Address:TEMPsr"]ݫa:AyD EventData[KName$SAMMSG_REMOTE_SAM_AUDIT_MODE_ENABLEDTEMPtf7 {Ynjj'A{D EventData]KName%SAMMSG_REMOTE_SAM_AUDIT_MODE_DISABLEDTEMPvr^t UVcAED EventDataKName6SAMMSG_REMOTE_SAM_AUDIT_MODE_ENABLED_ACCESS_NOT_DENIEDAAoData)KName Client SID: AYoDataAKNameClient Network Address: 8vTvClient SID:4Client Network Address:TEMPwcgu_iu.6RA?D EventDatakKName,SAMMSG_REMOTE_SAM_SUPPRESSED_MESSAGE_COUNTERAKoData3KNameThrottle window: A]oDataEKNameSuppressed Message Count: $xLx(Throttle window:8Suppressed Message Count:TEMPty+׊؏\:A#1TAD EventData_KName&SAMMSG_WELLKNOWN_ACCOUNT_UPDATE_FAILEDA7oDataKNameStatus yStatusTEMP|{s*[QPr^AD EventDataYKName#SAMMSG_MINPWDLEN_SETTINGS_IN_EFFECTAUoData=KNameMinimumPasswordLength AkoDataSKName RelaxMinimumPasswordLengthLimits A_oDataGKNameMinimumPasswordLengthAudit {{0|0MinimumPasswordLengthHRelaxMinimumPasswordLengthLimits<MinimumPasswordLengthAuditTEMP@~^BR>TSR$(uAD EventDatawKName2SAMMSG_ACCOUNT_PASSWORD_LENGTH_NOT_AUDIT_COMPLIANTAAoData)KName AccountName AUoData=KNameMinimumPasswordLength A_oDataGKNameMinimumPasswordLengthAudit |~~~AccountName0MinimumPasswordLength<MinimumPasswordLengthAuditTEMPĤe]WX,3n87AD EventDataUKName!SAMMSG_MINPWDLEN_INVALID_SETTINGSAUoData=KNameMinimumPasswordLength 0MinimumPasswordLengthTEMP7xX*Q?A/D EventDataGKNameSAMMSG_WHFB_KEY_ROCA_AUDITA=oData%KName AccountDN A?oData'KName AccountSID A9oData!KNameKeyHash  AccountDNAccountSIDKeyHashTEMPgUe+Ƌ}A/D EventDataGKNameSAMMSG_WHFB_KEY_ROCA_BLOCKA=oData%KName AccountDN A?oData'KName AccountSID A9oData!KNameKeyHash ԃAccountDNAccountSIDKeyHashTEMPЄpPV!aXeQҬ9FA}D EventData_KName&SAMMSG_AUDIT_LEGACY_PWD_RPC_METHODS_ONTEMP&t [Al'fAD EventDataaKName'SAMMSG_AUDIT_LEGACY_PWD_RPC_METHODS_OFFTEMPp-NZÀW#,A7D EventDataiKName+SAMMSG_AUDIT_LEGACY_PWD_RPC_METHODS_SUMMARYAWoData?KNameNumber of RPC methods: AKoData3KNameThrottle Window: L4Number of RPC methods:(Throttle Window:TEMPx.1EI\4 +uAD EventDataiKName+SAMMSG_AUDIT_LEGACY_PWD_RPC_METHODS_VERBOSEAAoData)KName RPC Method: AOoData7KNameUser Account Name: AAoData)KName Client SID: AYoDataAKNameClient Network Address: ȉ,RPC Method:,User Account Name:Client SID:4Client Network Address:TEMPPwWVVGQAD EventDataaKName'SAMMSG_DUPLICATE_LOCAL_ACCOUNT_REPAIREDAEoData-KName AccountRidHex A?oData'KName AccountRid AKoData3KNameSavedAccountName AQoData9KNameDeletedAccountNames ܌ AccountRidHexAccountRid(SavedAccountName,DeletedAccountNamesTEMP,RZT>>hJAD EventDataaKName'SAMMSG_DUPLICATE_LOCAL_ACCOUNT_DETECTEDAEoData-KName AccountRidHex A?oData'KName AccountRid AWoData?KNameDuplicatedAccountNames AQoData9KNameRetainedAccountName | AccountRidHexAccountRid4DuplicatedAccountNames,RetainedAccountNameTEMPϛ0PgN A1D EventDataKName:SAMMSG_MISMATCHED_ACCOUNT_TYPE_AND_OBJCLASS_CREATE_BLOCKEDACoData+KName Account name AQoData9KNameAccount objectClass AOoData7KNameuserAccountcontrol AGoData/KNameCaller address A?oData'KName Caller SID 0\ Account name,Account objectClass,userAccountcontrol$Caller addressCaller SIDTEMPXo [3W26AD EventData}KName5SAMMSG_COMPUTER_SAMACCOUNTNAME_WITHOUT_DOLLAR_BLOCKEDAGoData/KNameSamAccountName Д$SamAccountNameTEMP>O:ȆTg$#AgD EventDataIKNameSAMMSG_CAM_POLICY_IN_EFFECTTEMP(lFiZx]3AaD EventDataCKNameSAMMSG_LAPS_INIT_SUCCESSTEMPQ.~Ȝ]+?DAD EventData=KNameSAMMSG_LAPS_INIT_FAILA7oDataKNameStatus  StatusTEMPT4=*3jUc|]=+AD EventDataiKName+SAMMSG_COMPUTER_ACCOUNT_REUSE_ALLOW_LIST_SDAQoData9KNameRegistry SD String: H,Registry SD String:TEMPd6!RaQ(L>AD EventDatawKName2SAMMSG_COMPUTER_ACCOUNT_REUSE_ALLOW_LIST_MALFORMEDAQoData9KNameRegistry SD String: ,Registry SD String:TEMPDHQF?VA5D EventDataSKName SAMMSG_COMPUTER_ACCOUNT_ORPHANEDAUoData=KNameComputer Account SID: AaoDataIKNameComputer Account Owner SID: l0Computer Account SID:<Computer Account Owner SID:TEMP0̝*,W"]ehceAD EventData]KName%SAMMSG_COMPUTER_ACCOUNT_REUSE_BLOCKEDAUoData=KNameComputer Account SID: AaoDataIKNameComputer Account Owner SID: A[oDataCKNameClient User Account SID: !Binary 0`Ԟ0Computer Account SID:<Computer Account Owner SID:8Client User Account SID:__binLengthErrorCodePRVAhMicrosoft-Windows-Directory-Services-SAMOPCOLEVLPPğPwin:Errorwin:Warning(win:InformationalTASKKEYWEVNT`g0000000000 00004 0 0 0 0 0 0 0 0 0 0 00000000@@@@@@ @@@@@@@@@l@@@@ @ @# @ @8% @ @@'@@T(@@)@@ +@@,@@8/@@1@@3@@4@@l6@@8@@8@@H:@@;@@,=@@l>AA@AABAA CAA,DAA0EAAFAAhG A AH A AI A AJ A AhKAApLAA MAA(NAAhOAAP'B'BQ(B(BxS)B)B,U0B0BV1B1BX2B2BZ3B3B[4B4BL^5B5B4a6B6Bd7B7Be8B8Bg9B9Bh@B@BpkABABlBBBBlCBCB(nDBDBtoEBEBpqFBFB4sGBGBsHBHBtIBIBvPBPBxQBQByRBRBl|SBSBTBTBLUBUB4VBVBWBWBЄXBXBYBYBtZBZB`[B[B0^B^B_B_B`B`BaBaBbBbB(cBcB dBdBteBeBؙfBfB؛WEVTȳ h8xTTBLTEMPh)_>@A_D EventDataAKNameSAMUTIL_DATABASE_CHANGEPRVAx|Microsoft-Windows-Directory-Services-SAM-UtilityOPCOXj@Opcode_SamDatabaseChangeEventLEVL@PP(win:InformationalTASKKEYW`DKeyword_SamDatabaseChangeEventEVNTDjԳD(000 00000 0$0(0,0004080<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|000000000000000000011,1@1D1L1P1X1\1d1h1p1t1|11111111111111122 2,282D2P222222 303444W4z4444555$5*50565V5\556 676L66707N7z777788888899Q9p9z9(:W::::R;^;;;<K>W>e>m>t>|>>8?G???@ 0N0^0c0p0v000F1L1h111111 222M2R2X2c2k2p2w2|22222222222222222222233 33 3(3-33393>3D3I3O3U3_3d3i3o3u3{33333333333333333333333344 4444$4*40464O4445"5[5|555:66C7U77@9W999 :!:U:n::::);<`>??P0001&1A1p111<2n22213i33344{444444&525A5G5M5~556W6g667(889N9]9k9999J:c::::::@;I;w;;;;;;;<+<9)>X>>>>> ?3?I?r???`0F0w000001,1x11112@2]2{2222233"333D3X3m3334E4g44565J5[5l5555555 66;6S6e6z66666 77,7A7h7777777$8988888959Q9n999:1:H:O:f:{::::::;;!;V;;;J>8?M????p0F0Q0n00001p1112.2Q2\2x222223303T3i333334.4>4Z4444455o555696e6p66666 77-8T88888i999999!:N:Y:u::: ;";g;v;{;;;<77>>>T>[>q>x>>>> ?$?7?A?]?????0A0^0000001'1;1N1X1]1g11111112L2Z222223!353a3y3334$44455g5555K6666=7V7i7777L8`888889999:X:<5=T=t======>>>4>U>u>>?,?U?t?j0011T22P3e3344505o55555 686W66747_7~77&88 969U999:;M;;(>>>? ?'?X?g?|?????G0L0S0X0_0d00111111N222222(3l3w333G4b444s5555 66S6h6667789999::!:f:p:::::::;D;I;R;t;;;6<~<<<= =8=]=r=x====.>^>>>>*?o???P0D01v111!282|23Q3j333 44Z4b444566I7U88g99!::J<<>>>=0E1\122233333!4&4=444444445&585A5R5`55555555W66667D7w888C9y99999999&:::H:e::::: ;u;;;;;<&>:>q>>>>?%?9?V?t???#0.0G0X0j00%1q11!252`23344444'5?5y55 6N6e666667*7I7777899B9Q999999-:::: ;;;;;; <<===== >>>>???0$050[00000012&2{223'3M33333404_4o444444545P5l5w555555T66)7_77777778A8O8r888889%9R9[9m9{9999999:E:Y:x::::;B;;,>:>W>z>>> ??[?s???0030[00000-11111>2V2222203K3[33334&4W4445>5c5q55555"6R666667Q77777 8P88888 9P99999$:<:::::5;M;;;;;&+>@>>>>>>>??+??????????800-03090D0L0a0f0{000000000101H1Z1l1111!2,2T2`22223&3333424L4d4~44455&5J5k5u55555556'6H6U6666787=7Q7r77777777818I8h88888899)939:9W9{999999999: :$:S:w::::::1;<;l;z;;;;;;;"<;5>q>>>>>>?=?b?????,0000L1112`2|2223"3@3|3333334L444445J555556*6V666667<778899'9l9999 :t:::::;;;;>>> ???  0I0001i1111112V222353y344!555)6k667977X8a8|8888889!9S9999999::;9;Z;{;;;;;;;<&=o=======>$>E>T>>>>>+?G?N????0D0$00070@0w0001/1L1w1122233434P4Z44z55536}66666!767A7H7N777777777777777777788 8888#8)8/84898?8D8I8O8T8Y8_8d8}88888888888 99r9~999999:$:*:D:X:::::::::::::::;;;);t;;;;;;;;;<_/>:>T>u>>>>H?@80 0>0E0^0f0n000001 1.161>1u11111112-252=2E22222233&3p33333333[4r44444444444545f555556"6'616@6J666666667&7G7l77777888P8\8i8q8889D9t9999::F:a:::;,;m;;;;;< <<<"<(<0.>w>>>>>>?4?f?????PH0P0000000131Z1x1222 33>3M3V334444565A5|5555>6F6666666797^7q7{777789999:%:P:::::5;?;D;N;f;;;;;;;<<<<<<]=`000001(1I1b11111\2o22283K3334'4444 5l5555H6\66678w99J:::::::;,;s;y;;;;;Al>>>>?6?E???p(00S0}00001#1>1p111122.232J2[2223t3333'4G4f4 5"5N5|5555"616y666667,777u7~777777:8 99 9&959E9U9999999999:&:?:E:Q:f:y:::::::::Z;c;h;;;;;;;;;;;;;;;;;;>S>k>>>>>>>>??#?:?A?U?m????? 0'080A0I0Q0]0f0z0000000 1!1.1E1L1`1x111111 2242r22222C3|33333344&4R4444R5m5+6;6V6f6m666666 7778$8=88v99999: :5:::::;";0;x;;;;;;;;9>F>[>>?????000G1Y1`1n111111202M2Y2c2q2303W3o3|3334A4V4`4p4z4~44444D555566.6E6N6]6y666667J7b77777777777%8[8l888889 99!9&9/9H9k9~9999:h:t::q;/ WM95s q9Vޏ%y{0L%3e_12E8;Mx ;HB/y9-yU}lTWt,\  r'DiYѠۆ8 p<:NbC8http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0  *H  |qQyn9>\` QfG=*hwLb{Ǻz4KbzJ7-W|=ܸZij:ni!7ށugӓW^)9-Es[zFX^gl5?$5 uVx,Јߺ~,c#!xlX6+̤-@EΊ\k>p* j_Gc 26*pZBYqKW~!<ŹE ŕ]b֠c uw}=EWo3wbY~10001 0 UUS10U Washington10URedmond10U Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20113W2-.0  `He0 *H  1  +70 +7 10  +70/ *H  1" 3 '=²?)r (x}1 #!K0P +7 1B @30D113C1711E6C152D7EF190409CD5AB776CD75DD4C543EACA6B9EDCD94DA3AA0Z +7 1L0J$"Microsoft Windows" http://www.microsoft.com/windows0  *H 4WzR/\X}Cq"9sH7EG2DxqN4ŭײx]Jf6]!~ ®꘏?s-C}.}|&"|Jѓ*Ȑ7 , |t5n}m82)шY [D>uHn/*DF,7h#lp7":r7D 5OlQ'M lZ1/Uȱffi.I0 +710 *H 010  `He0Z *H  IE0A +Y 010  `He tj_+_9&\0EG.e9Ϟjc+5a20260808175604.625Z0٤01 0 UUS10U Washington10URedmond10U Microsoft Corporation1-0+U $Microsoft Ireland Operations Limited1'0%U nShield TSS ESN:4C1A-05E0-D9471%0#UMicrosoft Time-Stamp Service0(03%ْ0  *H  0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100 250814184825Z 261113184825Z01 0 UUS10U Washington10URedmond10U Microsoft Corporation1-0+U $Microsoft Ireland Operations Limited1'0%U nShield TSS ESN:4C1A-05E0-D9471%0#UMicrosoft Time-Stamp Service0"0  *H 0 &ĹȾ>\AY8\2< g9q驻Zk2# Wќ{)8$e$2 >!m$wƂx~d%7U`d!C5om#j}Z:76i>\{(GyHI X$= 9ĊUB`Q)#yЁ"MQkq bAaU@Yŋ߫'lwΤzQb=h+O:R$¥3 >,^\i!Iս;f"F9Yk ѨzRE7b)rDTABefY_~޶ l6?ANM7׎/͇f?l%0&)N.3RT؇c[F{@\7MBtctG?>)0GUJ2# # II0E0U$.\:cG,_0U#0]^b]eS5r0_UX0V0TRPNhttp://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l+`0^0\+0Phttp://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0 U00U% 0 +0U0  *H  Hц<xb*= Zqp J?k&90?.'+ƪ+2~1 *(0Ⱦkw&{Zm=oi~`0INj`gNz1Z/5cȏF<_"6"8Ur38 ( @hf,EI_ې>VPwhM.8FeCiO߬&[ "yPϤxl0dlzZږ" /bF4«Xo%a B o$@P0q0Y3kI0  *H  01 0 UUS10U Washington10URedmond10U Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100 210930182225Z 300930183225Z0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100"0  *H 0 Lr! y$yՂҩlNu5WlJ⽹>`3\OfSqZ~JZ6gF# w2`}jRDFkvPDq\Q17 8n&S|9azĪri65&dژ;{3[~Rb%j]SVMݼ㑏9,Qpi 6-p15(㴇$ɏ~TUmh;Fz)7EFn20\O,b͹⍈䖬Jq[g`= s}AFu_4 }~ٞE߶r/}_۪~66L+nQsM7t4G|?Lۯ^s=CN39LBh.QFѽjZasg^(v3rק  co 6d[!]_0tعP a65Gk\RQ]%PzlrRą<7?xE^ڏriƮ{>j.00 +70# +7*RdĚhttp://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0  *H  U}*,g1$[rKo\>NGdx=139q6?dl|u9m1lѡ"fg:SMݘx6.Vi {jo)n?Hum m#TxSu$Wݟ=heV(U'$@]='@8)üTB  jBRu6as.,k{n?, x鑲[It 쑀=J>f;O2ٖtLrou04zP X@1Q{p( 6ںL 4$5g+ 挙"'B=%tt[jў>~13}{8pDѐȫ::bpcSMmqjU3XpfV0>0٤01 0 UUS10U Washington10URedmond10U Microsoft Corporation1-0+U $Microsoft Ireland Operations Limited1'0%U nShield TSS ESN:4C1A-05E0-D9471%0#UMicrosoft Time-Stamp Service# 0+kFu^e)/)kǖ]ncfȸ4>PXvMYcqql9cegGIѽ2Yl!$%#zü6SKĦR: =pؿkBS"]™@e)0vpHo%nʦf'g?ԲPLO]jjE:eٳEKn+~SqL?RpSb1 0 00|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103%ْ0  `HeJ0 *H  1  *H  0/ *H  1" 4ݻD5I9f;XN""z߱$N;0 *H  /1000 ܉ȴhD1+UJtshsׅj00~0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103%ْ0" 3Q$s. 1KJCf [<Gā0  *H  &O\ ;ױK2>(qMT&V<֌ia~bB \X# ;F\X?Pﺄhj:xw[Sf$J{K\fDБk]r$s}ҨB vS ;=P->V x\Lei j5yI#+6%qtZ&1%;6̫el8|QqK'htɘhL$i2Ab/8:aLRȲ^'R"LeBr{>,/E9ւ~0yg$VMrӱY=ISZ'\~ܔd|0Q:OW"tӒ`+ BsұOm$)ꄧxwJ#2UzT2jϤ+C` 65Afe+xXt&xIvQ+u<3