MZ@ !L!This program cannot be run in DOS mode. $aM%#%#%#H '#H'6#H& #H"(#%"#H*<#Hܤ$#H!$#Rich%#PEdjV[" :D0?@ QC` (rp<Tl8pP@Q .text$8: `.rdata,P.>@@.dataXl@.pdata<n@@.rsrcpr@@.relocTz@BH(H vBH X7H(73H(H%$Ht$H D7H(3H8HoH3HD$(Hd$ LD$ H;Z`AHL$ HH[BHL$ H [HJvBHL$ H[H9vAHL$ HZH(vAH= vHvtH=vtH=utHu H%uH%uH%uH%uH q62HL$(H3-H8H8HuHtAH uHtHuBH%guHhuL YuE33H EZBH (6H813@SH uEHI@3ۅu7?ȁNȅy?؁N @3ۋH [H\$WH H=HHHIHAHw?C @tH~)HH\$0H _H\$UVWATAUAVAWHH@E3ALeEDePEDeXHEsHFsHt#H:sH HH !sHEHsHUP3>Dnur>zuL]PH>LÍVH>LHuHB΍~ kHUPH=u&>HBDAHMLe H]uM>HB6HtHUH_ L}W>Aąu>HBD΋ZHt=L3H>uLEXXyH>CADDuTAMDL$(ֹ L|$ =tMH}CM3D9eXuH$D3Mt3=M3Hu=Mt=M3H\=HEqHt#HAqH :qHL%(qIEH%qH q=:q+D9%!q+qtMuIH pHt=D9%:qtHqHt >H pi=L%pD%pD%qH Mq'=H$H@A_A^A]A\_^]HHXHpHxUAVAWHhHHjH3HE7L@C3ҹ;<AAHHu9 <A υNȅy;DE DžDNA@HC2HC3 H;tDHCE DžDNA H3D3 uH|DA HD3 3HMA3/FDDuN[fEfE~FfMEEDuDuDufMA(HUAH;:A υNȅy:DE DžDNA@DHDA ;u?:A υNȅy:DE DžDNA@HDA h:HE3A A+!uHGEA HCHw H :HM7H3P'L$I[ Is(I{0IA_A^]@SVAVAWHHd$pHF3& 3;H$A@AH$Hu WA;A~bH$HD$ L ND3H <;؅xHD3 EDHFE ,9D+x\$0H$H$HH H$HtH$HH@;H$HLD$xHH@(:D$0aH$HHT$pH@ :D$039t$puHE HE L;3ҹ[8LHuB58ȁNȅy8DADNEHBFS cHF3C `I7t1=tDADNHHHHG t$pHF3IFHwIs7DHHH$HT$xH@09D$0yH8I HIDHtHHH@c9DD$0H}J[DHKGH$HtHH@9H$8DHZKD$pHHA_A^^[MЋt3ҹ=EMI@SH Y u.HtHSH@(p8H 1jHt HHBW8H [̸A @SH 3I9u!J9BuJ9Bu J9B t):k΄eu3J9Bu(J9BuJ9B uIHH@7@H [@SH A HtFHH [H\$WH H!H_JHv"HHH i@ H3HHt HH@$7H2E3L +8H334HCHHuE3E3AQJ4HHt HH@6HHH\$0H _H\$Ht$ UWATAVAWHHPE33L!e0HHuNW43;H!9LM8H!}HU!}WH!}3AE0E3HM8LE0Dh3HM0HI:3LH43Dt|3EǺHv3HHt]HM0HI3DtHHU0HHR'H2HHt'AЈ+H2Ht H>33HM0Ht2Et HM82Ht2L3H 3L\$PI[@IsHIA_A^A\_]HSUVWAVH@3H!hL!hHuJW333H!*H$HD$0L$HD$xHHD$(E3H!l$ 32$9l$xH2LúH2HH\$xH1LúH1HHt>H$LHD$0L$HD$xIHD$(3H\$ v1uH>3Ht1L3H1Htv1L3H1H@A^_^][LD$LL$ SVWH 3HBH=HWGx5HZHHLL$X32xHH;wu@<3@<3zHtH _^[@SH H e3H H)F1HeHH dHFg1H0eHH dH FC1HdHH dHE1HdHH dHE0HdHt`H `dHE0HdHt@H @dHE0HDdHt H dHE0HW'3HMH3H$HPA_A^A]A\_^]@SUVWATAVAWH03LH\$xDcf;uKW'3HT$xzHHyL$H$HT$p\$pHA\D9d$pL$HHfA9NuHD$xHHtL?Hl$PH\$HHt$XH A_A^_H\$Hl$Ht$WH 3E33ҋH"tTH"LÍUH"HHt2DHHw"tf;+u"L3H"HEHl$8HH\$0Ht$@H _H\$Hl$Ht$WAVAWH E3HE8EtCt AGWIAAfD9z*vVB*HK0ș3LcIX1I3!HH7!H@#!ADEHs@k({ Ds$fD;{*sUD8=CVHC8EJ HC@AC(tQ:vuitK t`LC0AɃIC C*AD;r3H\$@Hl$HHt$PH A_A^_:vuHtHKt HCH#H;CtLC0AɃIC!H\$WH LT$`3M DHD$PMJDOEJ$EB(IBfA;z*@8=7UIB8AH IB@AB(t8:vuPtAJ tFMB0A˃HAA AB*ED;r~:vuHtIJt IBH#I;BtMB0A˃HAA!Az$Az(IzIzfA9z*v,AB*AIJ0A+3ALcI+H\$0H _@SUVWATAVAWHHMH3H$p3MMHLMuCWI98"THL$PD$Pt+L$TSw u |$XvH 7[HHut1H 7BHHtH#8HH{SHu fSNH 8HtHLHuHHLH7HHH9SHtԊS/SSu)HHiMMHDIH5LH TMuA^WKLt$8HHH\$0H\$(AHDM7HD$@Ld$@HHD$ MH\$HIF؋H$pH3" HĀA_A^A\_^][H\$WHHKH3H$pH=!R3@8=:RHL$PD$P9t+L$TQw u |$XvH 5uHHut1H 6\HHtH=6HHQHu QNH'6HHJHuH HJH 6HbHSQHtԊ0QIQ!Qu+HfJL QLhJHqH 5QHd$HHEJHT$8H5Hd$0HL$@Hd$(AHL$ LH HPHD$@aH$pH3A H$HĀ_H\$WH 3@8=}PtnHLPHtb@8=HPuHWPH@H { @{(H{f9{*v#C*HK0ș3LcIH;H=OH\$0H _H\$Ht$WH03IH\$@HHu KW3|Ht)HD$@AE3HD$ (uPHL$@HuDHL$@Ht(H\$(E3E3H\$ HHL$@@Ht3,H\$HHt$PH0_LD$USWHH@HeHڃe0e8E HuW3Ht)HEAE3HD$ Zu HMHuHMHE E3HD$(LM8HE0H 1HD$ 'u } tx e0Ht HM5UE0H@_[]H\$Hl$Ht$WAVAWH0E3HHAHHHLIfF9H;HMvHEHEXH1ETH1EXHH1EHHMH3EH3HM HE E HH H3E H3EH#H3-+H;HDH=H\$HHH=H ]%%@SH HHdDHD$8HuHZ|]\H8DHD$8H$DHD$@LD$@HT$8HIHHT$8HDHT$@HCHH [H(cHH(@SH H3HHȺ H [H%HL$HH }=7Hh>HD$HE3HT$PHL$H HD$@H|$@tBHD$8HD$XHD$0HD$`HD$(H'=HD$ LL$@LD$HHT$P3#H=HH=H=HH~=H=HH<H$HI=< <#<HkH <HHkH <H;HHkH ;Hq;HHkH U;HLhHkH H;HLhH SHĈ%% % % H\$WH HH5tHHHtHH\$0H _%j %V H(MA8HIH(@SEHALALtA@McPLHcL#IcJHCHHKAt AHLL3I[% %P ff@UH0HH3Ƀ8H0]@UH HHHыOH ]HT$UH HHePHH ]@UH HH3Ɂ8H ]@UH HH ]H i?H%Z H(H8Ht H(3HG?HH?HI?HJ?H(H=?t!H ?HtH?Q H%>H(@`@@@ @@@@`@@@ @@?@?@@h@`T@hT@T@5uyyyyynyVyHy8yyyxxxxxx{{{{vvzvlv`vPvHv8v*vvvuy zz8zNzdz~zzzzzzz{({D{V{n{|{{{x"x|vT|J|wwwwwtwhw^wFw:w&www wvvv|vv||&|2|@|vxr|Hx\x`|wwwC@F@=@@0@`@p@0<@@@0`p` @/ 1`2`4@60<=0???@CCpGGGG"q,qXq _~_I\AuditShowDesktopEventFailed to get the current user name; dwRet = 0x%XCould not allocate memory for current user nameFailed to get the build-in administrator SID; dwRet = 0x%XFailed to get the build-in administrator name from SID; dwRet = 0x%XFailed to check whether this is audit mode; dwRet = 0x%XCurrent user name is [%s], while built-in administrator name is [%s]; will not show desktopThis is not audit mode; will not show desktopShellDesktopSwitchEventFailed to open the shell desktop switch event; hr = 0x%XWaiting for the shell desktop switch eventFailed to wait for the shell desktop switch event; hr = 0x%XThe shell desktop switch event was signaledThe wait for start screen expired; still proceedingSending 'Win+D' to show the desktopSendInput failed to send 'Win+D', hr = 0x%X; %d retries left...Failed to enable calls to SetForegroundWindow, hr = 0x%XSendInput succeeded in sending 'Win+D'Failed to show the desktopGetAppVisibilityInterface: CoCreateInstance succeeded in creating IAppVisibility instanceGetAppVisibilityInterface: CoCreateInstance failed, hr = 0x%X; %d retries left...WaitForStartScreen: Waiting for the start screen to come upWaitForStartScreen: Start screen is up nowWaitForStartScreen: Start screen not up yet; will wait via IAppVisibilityEventsWaitForStartScreen: Failed to open the app visibility event; hr = 0x%XWaitForStartScreen: Waiting for the app visibility eventWaitForStartScreen: App visibility event was signaled; start screen must be upWaitForStartScreen: Timed out while waiting for the app visibility eventWaitForStartScreen: Failed to wait for app visibility event; hr = 0x%xWaitForStartScreen: Failed to get IsLauncherVisible property from IAppVisible interface; hr = 0x%xWaitForStartScreen: Failed to unadvise receiving notification from IAppVisibility; hr = 0x%xWaitForStartScreen: Failed when advising to receive notification from IAppVisibility; hr = 0x%xWaitForStartScreen: Failed to instantiate IAppVisibilityEvents; hr = 0x%xWaitForStartScreen: Failed to get IAppVisible interface; hr = 0x%xWaitForStartScreen: Failed to CoInitializeEx; hr = 0x%xF-F"DDm'Ck΄e}IƼ8WdsSetupLogInitWdsGenericSetupLogInitWdsSetupLogDestroyWdsSetupLogMessageAWdsSetupLogMessageWConstructPartialMsgVAConstructPartialMsgVWCurrentIP%windir%\Panther\UnattendGCwdscore.dll<unknown>[%S] %SUnattendLogWVonecore\base\ntsetup\lib\unattendlog\src\unattendlog.cppDAuditBootSystem\Setup\StatusSystem\Setup\Status\AuditBootVolatile\\?\UNCCreatePath: Unable to create [%s]; GLE = 0x%xCreatePath: Unable to create parent directory for [%s]; GLE = 0x%x\\ntdll.dlladvapi32.dllapi-ms-win-eventing-provider-l1-1-0.dllEventWriteEventRegisterEventUnregisterڹ_>Ob<u%s%s%sEtwEventRegisterEtwEventUnregisterEtwEventEnabledEtwEventWrite9j Cu&}jV[%HlHZjV[ DplpZRSDSP\zG7N AuditShD.pdbGCTL.text$di4.text$mnF .text$mn$00F.text$xdG.text$ydP@.rdata$brc@Q .idata$5`T.00cfgpT.CRT$XCAxT.CRT$XCAAT .CRT$XCUT.CRT$XCZT.CRT$XIAT.CRT$XIAAT.CRT$XIYT.CRT$XIZTx.cfguard@U.rdataHlp.rdata$zzzdbgnp.xdata(rx.idata$2r.idata$3r .idata$4u.idata$6`.data$brc` .data.bss<.pdata.rsrc$01.rsrc$0220  4 2p 4r p`P- t d4PE  `0BFRP d4 p P  r p`P02 p ` 0BB, P p ` P 0Epd 4 Rpbp0d42 p4Bp ` P 0% 4 p`PEHR p`P0dT42p d T 4 2p d T 42p$ 0 p`P0Ep 42 0pEpd 4 R prp0P d T 4 RpbE(b t d 4RBu=>F> bHE@U@q@F8???FFF  2PHE@U "BL@@@  4 2pBMAA GA  4 2P20BB>CFG2P  0ru@QPsvQtw Su x@Tt AuditShD.exe to switch from immersive shell to classic shell in Audit mode. 4VS_VERSION_INFO 98 98?StringFileInfo040904B0LCompanyNameMicrosoft Corporationl"FileDescriptionAudit Mode Desktop Switch Utilityx,FileVersion10.0.14393.2515 (rs1_release_1.180830-1044): InternalNameAuditShD.exe.LegalCopyright Microsoft Corporation. All rights reserved.B OriginalFilenameAuditShD.exej%ProductNameMicrosoft Windows Operating SystemDProductVersion10.0.14393.2515DVarFileInfo$Translation P@ (08@HPX`hȠ`hx@HPX