Hacked By AnonymousFox
| Current Path : C:/Windows/System32/ |
|
|
| Current File : C:/Windows/System32/RdpSaUacHelper.exe |
MZ @ !L!This program cannot be run in DOS mode.
$ u~&~&~&&~&Ė{'~&Ė}'~&Ėz'~&Ė'~&&<~&Ėw'~&Ė&~&Ė|'~&Rich~& PE L #~
@ N G P @
\ @ @ P T .text <> @ `.data @, P D @ .idata > F @ @.rsrc
V @ @.reloc @ ` @ B `P@ P@ L N @ L N @ L N @ 4P@ @ @ @@ u x@ (@ @@ @@ S@ r@
n @ @ D@ p @ D@ I@ p ! @ @ D D G G I I J M PM M e x t - m s - w i n - n t u s e r - w i n d o w s t a t i o n - l 1 - 1 - 0 e x t - m s - w i n - n t u s e r - w i n d o w s t a t i o n - l 1 - 1 - 1 e x t - m s - w i n - n t u s e r - w i n d o w s t a t i o n - l 1 - 1 - 2 ckǁ B%4 K$ h4Ny NULL CRdpSaComUtils::s_GetKnownFolderFilePath failed! EnumProcess failed! FindRdpSessionAgentProxyProcess failed! NotifyInitializationComplete failed! spProxy->GetSessionAgentProcessHandle failed! G l o b a l \ R d p S a E v e n t R e a d y - % s G l o b a l \ R d p S a E v e n t F a i l - % s m_InvitationManager.Initialize failed! % 8 . 8 x CRdpSaComUtils::s_CoCreateInSession failed! CoCreateInSession failed! FindInteractiveUserProcess failed! GenCryptoSecureKey failed! WaitForMultipleObjects failed! SignalNamedEvent failed! CoInitializeSecurity failed! CoInitializeEx failed! InitSecurity failed! HandleInteractiveUserProcess failed! XJ hSS o f t w a r e \ M i c r o s o f t \ T e r m i n a l S e r v i c e s \ S e s s i o n A g e n t \ H a n d l e s Advapi32.dll EventActivityIdControl R d p S a P r o x y . e x e ^!Hj& l.x7bQ+ 2 0 1 e f 9 9 a - 7 f a 0 - 4 4 4 c - 9 3 9 9 - 1 9 b a 8 4 f 1 2 a 1 a A p p I n f o n c a l r p c H 8 2 X H H H $ H ( A, 6 P!0 p 4 H 2 < F A 6 p H 2 H H p H 2 D p H 2 D H p H 2 D H p H 8 2 l H H H H
N $ ( , H 0 p 4 H \ 2 < H H $ ( H , H 0 H 4 8 Z H <
D `
H d H L AT 6 p X H 2 h ! h p H ( 2 $ r x H h P! p $ H 2 H p H < 2 l $
H H H H
N $ ( , H 0 P!4 p 8 H L 2 0 $ H H H H $ ( , 0 H 4 8 ~ < H @ P!D p H H , 2 $ H H H H P!$ p ( D LD* ] +H` %\%\
\[0 6>L [%\ \[ \ [ L [< \ < < <@ ) 4 K\HI %\[\[ ) 4 K\HI %\[\[ wN]ND.QSHGetKnownFolderPath PathCchCombine |$>U.Uc CreateBindCtx StringFromCLSID S e s s i o n : % d ! c l s i d : % s StringCchPrintf MkParseDisplayName pMoniker->BindToObject pClassFactory->CreateInstance OIɔ7=y~J F #~ + #~
P #~ M /
" Jk ރb Terminal-Services-TestCode RSDSmq~:;;bI RdpSaUacHelper.pdb GCTL .rdata$brc .CRT$XCA $ .CRT$XCAA ( .CRT$XCU , .CRT$XCZ 0 .CRT$XIA 4 .CRT$XIAA 8 .CRT$XIY < .CRT$XIZ @ 8 .gfids x .giats 0 .rdata .rdata$sxdata 0 .rdata$zETW2 .rdata$zzzdbg p .text$di - .text$mn M .text$yd M .xdata$x P 0 .data$brc 0P .data @P , .bss .idata$5 .00cfg .idata$2 .idata$3 .idata$4 .idata$6 .rsrc$01 ` .rsrc$02 hM@ ' Y̋ËUj jEPjEPQh@ j+u u @ (] USVuWtOGu+Gj_u @ j jEPWVjEPSRj+u u @ 0_^[] ̋UQES3Vu EWttjWXHÊ#u@ WS@ WSE @ UFt Nt^~VF 3_^[] U4 4P@ 3ʼnEESVW3ۋE h SP+ PPSS@ u[@ P@ = P@ t(@ t"xr VQ YP P@ ppj
YD~ @
P@ 9m 3ft
W@
P@ 3 ;CP ;CD hT@ s<@ YY sD3Sh@ l@ uJ
P@ P@ A y @ PQ% YP P@ ppj YKyDž PPSW@ u8
P@ P@ tMA tGyrA@ PQ YP P@ ppj P@ YY
P@ @ ;3۾ P@ t(A t"yr VQE YP P@ ppj
YktW@ tS@ M_^3[R# ] 8븋U 4P@ 3ʼnESVW3h WP( T@ ؍PSX@ u[@ P@ = P@ t(@ t"xr VQf YP P@ ppjY~ @ PQ yJ P@ = P@ @ x Vh@ P P@ @ ppjY@~PPyD P@ = P@ t0@ t*xr$Vh<@ P P@ @ ppjYtW@ M_^3[! ]ËUS3UىEVMEE:yM P@ = P@ n @ d xZ VhP@ P P@ ppj@ Y=1 Sp @ y? P@ = P@ @ x Vhx@ P P@ ppj뛋MQSp @ yB P@ = P@ @ x Vh@ 1 P P@ ppj?jj h@ EPuuu\@ uT@ P@ = P@ t(@ t"xr VQ YP P@ ppjY~ x@ E Me } t u@ } t u@ ^[] U 4P@ 3ʼnESVWh 3xWPi% I @ S4@ xj@P yM P@ = P@ U @ K xA Vh8@ P P@ @ ppjY4 xPWj`@ u[@ P@ = P@ t(@ t"xr VQ YP P@ ppjY~ @ Wd@ @ P@ = P@ t(@ t"xr VQ YP P@ ppjYE~ x@@ 9 P@ W = P@ t(@ t"xr VQ YP P@ ppjYtW@ M_^3[ ]ËUQSVWh@ 3ۍEjSSP]@ u8@ P@ = P@ tp@ tjxrdVQK YP P@ ppjFWj@u @ uR@ P@ = P@ t(@ t"xr VQ YP P@ ppjY)~ x@ 9]t
Su @ _^[]ËU\4P@ 3ʼnESVWM}jU33YUЋډỦUUUUĉUT@ EPVX@ u[@ P@ = P@ t(@ t"xr WQD YP P@ ppjYj~ @ V3Vh@ l@ ؉]ԅu:@
P@ P@ tA tyrWQ YP P@ ppj učEh`@ jPD yM P@ = P@ @ x Wh8@ s P P@ ppj @ YZ EPh@ h $@ t^tY P@ = P@ t5@ t/xr) PQ YP P@ ppj Y+] EPQQM yB P@ = P@ @ x Whl@ P P@ ppj "VVjVVjju@ yB P@ = P@ c @ Y xO Wh@ ? P P@ ppj EЋPQMyM P@ = P@ @ x Wh@ P P@ @ ppj!Y8 VjHVjVjh@ Eu[@ P@ = P@ t(@ t"xr WQ YP P@ ppj"Y~ Y @ O jHVVjP@ Eȅu[@ P@ = P@ t(@ t"xr WQ YP P@ ppj#YD~ @ pEyM P@ = P@ @ x Wh@ P P@ @ ppj$Yi j@V@ uJ P@ = P@ E @ ; x1 WQN YP P@ ppj%Yt ESPq@ yM P@ = P@ H @ > x4 Wh@
P P@ @ ppj&Y; S@ e ]u3+j j jj p@ 3) j j jVuPu\@ Grut@ uԍE3SSjPuЉ]uV\@ jEPj EPh@ h (@ tX P@ = P@ t5@ t/xr) PQ
YP P@ ppj)Y' h0u SEPjx@ t t@ @ ~ 3yM P@ = P@ t @ j x` Wh@ k P P@ ppj*@ Y7 Mte Qp@ uԍEPh@ h $@ tQtL P@ = P@ @
x PQ YP P@ ppj+} uW1 tL P@ = P@ @ x PQ{ YP P@ ppj,uM3yB P@ = P@ 1 @ ' x Wh@ ( P P@ ppj-EPj(V,@ uN@ P@ = P@ t(@ t"xr WQ
YP P@ ppj.Y 3VVVVju0@ u8@ P@ = P@ t@ txrWQz
YP P@ ppj/u@ juЉu|@ uG@ P@ = P@ m@ cxYWQ
YP P@ ppj08 P@ = P@ t(@ t"xr WQ YP P@ ppj1Y ] S@ @ P@ = P@ t`@ tZxrTWQ YP P@ ppj(6@ P@ = P@ t(@ t"xr WQO YP P@ ppj'Yu~ x@ EȅtPt@ u@ ]ԃ} t u@ } t u@ 3DtP@ FrtS@ y M3BEMte Qp@ M_^3[ ]ËU,SVW3}ث3juމuuEP4@ u[@ P@ = P@ t(@ t"xr VQ2 YP P@ ppj2YX~ @ EPj@ P,@ u8@ P@ = P@ t@ txrVQ YP P@ ppj3댍EPVVju8@ @ z uj@@ uJ P@ = P@ @ x VQF YP P@ ppj5Yl uVSE EPuSju8@ u[@ P@ = P@ t(@ t"xr VQ YP P@ ppj6Y~ 4 @ * EPVVju8@ @ z uj@@ uF
P@ P@ A y VQB YP P@ ppj8 uVWG EPuWju8@ uG@ P@ = P@ &@ xVQ YP P@ ppj9V3EP<@ uG@ P@ = P@ @ xVQ YP P@ ppj:V7EP@@ uG@ P@ = P@ v@ lxbVQ' YP P@ ppj;AjjEPD@ uG@ P@ = P@ @ x VQ YP P@ ppj<VEPjEPH@ uG@ P@ = P@ @ xVQr YP P@ ppj=Vh VjjVVjEP@ P@ = P@ @ x Vh0@ P P@ @ ppj>Y\n P@ = P@ t]@ tWxrQVQ YP P@ ppj73 P@ = P@ t(@ t"xr VQ YP P@ ppj4YtS@ tW@ } t u@ _^[]ËU SV3WC3҈ S@ 3S@ S@ S@ S@ S@ fS@ S@ S@ @ 5 P@ FPRRD$ L$ PSQVT$0h!@ N @ 6j Zu
|@ |@ tRQȁ@ %|@ %|@ @ {@ h|@ 3VVh{@ ́@ u |@ VV@ {@ @ SV{@ {@ @ {@ p@ |@ |@ @ |@ @ |@ @ |@ @ u: P@ = P@ t.@ t(xr"@ PQ YP P@ ppj?Y jV@ yO5 P@ P@ F ~ WhP@ P P@ @ ppj@Y y7 P@ = P@ @ txryWhh@ S P P@ ppjAS@ tf81uދMgy< P@ = P@ t0@ t*xr$Wh@ P P@ ppjB@ YN܁@ 5 P@ P@ t. F F tv v@ f f 6u P@ P@ =(|@ t(5$P@ 5 P@ L@ 3 P@ $P@ P@ (|@ _^[] UE V3t=vW x7S]3WxEPuWS@ x;wu
z 3f{_[ tM3f^]ËU4P@ 3ʼnEVW3E }𫫫EPh,@ j @ t-h<@ u@ tEPj@ u@ ME3_^ ]jhM@ e e = |@ u+EPq uUM |@
tEPȀ@ e e 5 |@ / E EP̀@ ËeE܉EEt5= t= t= t= u}wE u뙸% ËU$4P@ 3ʼnESV3jVVuT@ u
@ Wjh@ SX@ u
@ nVVWP@ u@ uJ EPWd@ t.}t$}th 4@ E@E܃
vu 3@ W\@ S\@ _M^3[M ]ËU(SVWjY3}3E]PSSSh@ h@ ]@ EPuԀ@ EP@ uqjDXPj@E@ uj^WEPWSjH@ u
@ ;jXE؉EEPSSj
jSuE ]}Ā@ u EM]W@ 9]t
EPȀ@ _^[] UQEP3@i
@ Ph@ Ѐ@ EE] ̋Uuj@@ ] %@ UQV3ɍEPQQh< @ M@ y3 P@ = P@ t@ tyxrsVhL @ \P P@ ppj
MhT@ uh u @ y< P@ = P@ t0@ t*xr$Vhd @
P P@ ppj t @ Y]u@ ^] U 4P@ 3ʼnES]VW3h WP PWԁ@ yB P@ = P@ & @ x Wh @ MP P@ ppj
Pht@ @ yB P@ = P@ @ x Wh @ P P@ ppj Vh @ h P\yB P@ = P@ d @ Z xP Wh @ P P@ ppj ' PPP@ yB P@ = P@ @ x Wh @ "P P@ ppj
Qh8 @ j 0PN @ V y; P@ = P@ @ xrzWh @ P P@ ppjTSh@ j 0PN @ V y< P@ = P@ t0@ t*xr$Wh @ _P P@ ppj( @ YtQp@ tQp@ tQp@ փ t @ M_^3[, ] jXP@ P@
4|@
8|@ YYx@
S@ @
|S@ =0P@ u hJ@ t@ Y 3̡S@ h\P@ 5S@ \P@ hPP@ hLP@ hHP@ @ TP@ jXhM@ 3ۉ]EP @ ]d p,|@ 3
t;u3Fh 4@ 3F950|@ u
j Y:9 0|@ u,50|@ h<@ h0@ M YYtE 0 5DP@ 950|@ uh,@ h @ YY0|@ u 3,|@ =<|@ t#h<|@ YtSjS5<|@ @ ֡l@ tMj ^Uf;wOftuFftf;w MEtEj
XPQSh @ }@P@ =XP@ uOP@ "u 3ЉUM됋M EQPI YYËeEܣ@P@ =XP@ uP@ =DP@ u |@ @P@ E
ËUVu3;u s Wu>t
@ ׃;u r_^]øMZ f9 @ uU
< @ @ PE uC @ f;t f;u( @ v 39 @ Ãt @ v
39 @ 3p ;
4P@ u jhM@ e 8|@ Euu5@ @ YTji Ye 8|@ E4|@ EEPEPuP u܋M
8|@ M
4|@ E Ëuj YËUuZYH]ËUj @ u @ h @ P$@ ]ËU$ `Q@
\Q@ XQ@ TQ@ 5PQ@ =LQ@ fxQ@ f
lQ@ f HQ@ fDQ@ f%@Q@ f-<Q@ pQ@ E dQ@ EhQ@ EtQ@ P@ hQ@ lP@ `P@ dP@ pP@ jXk ǀtP@ jX
4P@ tP@ jX
8P@ tP@ jXk
4P@ LjX
8P@ Lh @ ]̋UE 8csmu+xu%@= t=!t="t= @u@ 3] hI@ @ 3%@ j h N@ 3ɋEtKtFMMZ f9u2P<x+ s#EPE # 3@Ëe3ɉME Uj @ t PtH\jXf;t
u3@]ËE]%@ 3̋UE3SVWH<AYt} p ;r H;r
B(;r3_^[]̋Ujh N@ h M@ d PSVW4P@ 1E3PEd eE h @ z tTE- @ Ph @ Pt:@$ ЃEMd
Y_^[]ËE 3Ɂ8 ËeE3Md
Y_^[]̋UMMZ f9u A<8PE u f9Hu ]3]ËUe e 4P@ VWN@ ;tudEP<@ E3EET@ 1E @ 1E@@ 3EM3EEP,@ E3E3E;t54P@ uO@ȉ
4P@ _8P@ ^]h h @ YY%p@ h M@ d5 D$l$l$+SVW4P@ 1E3PeuEEEEd ËMd
Y__^[]Q̋Uuuu uhG@ h4P@ % ] %@ %@ %@ %@ %@ ̀=|@ t5|@ 5|@ ȁ@ >@ +>@ F@ F@ =H@ QJ@ UJ@ K@ K@ P@ @ N@D ƅ ܅
" 4 J ` r Ԇ ؎ ʇ
$ J Z l ʈ z h Z J : : L ^ ʊ | * ؋ & Ƌ T : j ʌ ܌ z r j Ή F 8 ( ܉ 4 ĉ X Z l B . PM@ < T l l ~ ԁ ` ȁ L X p ̄ < 4 ^ Ą ܍ , Ԅ < $ P N H r d x ( ƅ ܅
" 4 J ` r Ԇ ؎ ʇ
$ J Z l ʈ z h Z J : : L ^ ʊ | * ؋ & Ƌ T : j ʌ ܌ z r j Ή F 8 ( ܉ 4 ĉ X Z l B . (TraceMessage sGetTraceLoggerHandle rGetTraceEnableLevel qGetTraceEnableFlags RegisterTraceGuidsW 5UnregisterTraceGuids CryptAcquireContextW CryptGenRandom CryptReleaseContext nRegDeleteKeyValueW RegSetKeyValueW OpenProcessToken AdjustTokenPrivileges InitializeSecurityDescriptor pGetTokenInformation SetSecurityDescriptorOwner SetSecurityDescriptorGroup InitializeAcl SetSecurityDescriptorDacl ADVAPI32.dll aGetLastError FreeLibrary GetProcAddress vGetModuleHandleExA CloseHandle
OpenProcess GQueryFullProcessImageNameW GetCurrentProcessId /ProcessIdToSessionId +DuplicateHandle OpenEventW SetEvent CreateFileMappingW MapViewOfFile CreateEventW UnmapViewOfFile WaitForMultipleObjects WaitForSingleObject GetCurrentProcess LocalAlloc LocalFree MHeapSetInformation GetCommandLineW KERNEL32.dll
_wcsicmp _vsnwprintf o _XcptFilter __p__commode _amsg_exit __wgetmainargs __set_app_type exit s_exit $_cexit __p__fmode __setusermatherr _initterm _wcmdln `_lock _unlock __dllonexit _onexit msvcrt.dll 5 ?terminate@@YAXXZ 7_controlfp j_except_handler4_common CoSetProxyBlanket _ CoInitializeSecurity ^ CoInitializeEx CoUninitialize ole32.dll = EtwEventUnregister ; EtwEventRegister ntdll.dll OLEAUT32.dll oRpcBindingFromStringBindingW RpcStringBindingComposeW 0 I_RpcExceptionFilter ~RpcBindingSetAuthInfoExW
RpcStringFreeW mRpcBindingFree NdrClientCall2 RPCRT4.dll 4 WinStationGetAllProcesses - WinStationFreeGAPMemory WINSTA.dll - Sleep GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter M TerminateProcess GetModuleHandleW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount OpenServiceW StartServiceW # CreateWellKnownSid OpenSCManagerW CloseServiceHandle
QueryServiceStatus PathCchCombine A CoTaskMemFree Q StringFromCLSID api-ms-win-core-synch-l1-2-0.dll api-ms-win-core-processthreads-l1-1-0.dll api-ms-win-core-errorhandling-l1-1-0.dll api-ms-win-core-libraryloader-l1-2-0.dll api-ms-win-core-profile-l1-1-0.dll api-ms-win-core-sysinfo-l1-1-0.dll api-ms-win-service-management-l1-1-0.dll api-ms-win-security-base-l1-1-0.dll api-ms-win-service-winsvc-l1-1-0.dll api-ms-win-core-path-l1-1-0.dll api-ms-win-core-com-l1-1-0.dll #EventUnregister CreateBindCtx
MkParseDisplayName aSHGetKnownFolderPath SHELL32.dll
memset 8 P h 8 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!-- Copyright (c) Microsoft Corporation -->
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3">
<assemblyIdentity
version="5.1.0.0"
processorArchitecture="x86"
name="Microsoft.Windows.TerminalServices.RdpSa"
type="win32"
/>
<description>RDP Uac Helper Session Agent</description>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel
level="asInvoker"
uiAccess="false"
/>
</requestedPrivileges>
</security>
</trustInfo>
<application xmlns="urn:schemas-microsoft-com:asm.v3">
<windowsSettings>
<disableWindowFiltering xmlns="http://schemas.microsoft.com/SMI/2011/WindowsSettings">true</disableWindowFiltering>
</windowsSettings>
</application>
<asmv3:application>
<asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">
<dpiAware>true</dpiAware>
</asmv3:windowsSettings>
</asmv3:application>
</assembly>
4 V S _ V E R S I O N _ I N F O
cE
cE? S t r i n g F i l e I n f o 0 4 0 9 0 4 B 0 L C o m p a n y N a m e M i c r o s o f t C o r p o r a t i o n b F i l e D e s c r i p t i o n R D P S e s s i o n A g e n t U A C H e l p e r h $ F i l e V e r s i o n 1 0 . 0 . 1 7 7 6 3 . 1 ( W i n B u i l d . 1 6 0 1 0 1 . 0 8 0 0 ) F I n t e r n a l N a m e R d p S a U a c H e l p e r . e x e . L e g a l C o p y r i g h t M i c r o s o f t C o r p o r a t i o n . A l l r i g h t s r e s e r v e d . N O r i g i n a l F i l e n a m e R d p S a U a c H e l p e r . e x e j % P r o d u c t N a m e M i c r o s o f t W i n d o w s O p e r a t i n g S y s t e m >
P r o d u c t V e r s i o n 1 0 . 0 . 1 7 7 6 3 . 1 D V a r F i l e I n f o $ T r a n s l a t i o n 4 00 00 0\0`0h0p00000001 1$1(14181 d q00000B1N1Y1112 22-2`222222223&3V3`3f3z333334 4;4l4444444*5/5O5Z5_5555555-626R6]6j66666666677B7L7S7X7t7777868;8[8f8k88888889 99,9W9a9}999999 :: :':,:H:{:::::::;C;R;Z;`;|;;;;;;;;<< <F<<<<<<<< = =2=7=W=b=g=======> >>->o>t>>>>>>>>"?/?4?T?_?d?~????? 0 0 00!0J0|00000001 1)191>1s1111112"2<2F2M2R2n2222222223 313K3U3q3333333333.474I4X4i4z4444445R5Y5c5j5o5555555686B6I6N6j666666 767@7G7L7t7777777777$8?8I8P8U8}88888889939>9C9X9b9~9999999::::!:&:,:2:8:<:B:b:k:z:::::::::::::::::::::; ;
;;; ;#;,;1;E;S;j;v;|;;;;;;;;<(<-<A<L<Y<e<k<q<<<<<<<<<<<<=Q=p=x======== >>&>>>>>>>>>>?0?9?@?y?~??????? @ 0(070Z0`0f000000000011 121=1J1Y1r1111112 2'2,2L2W2v22222222 3(3G3[3i3n3333333333404J4a44444444444444455 555 5&5:5M5o5z555555555555566!6m6w6}666666667-757;7H7b7m7w777777777 8%8i8r8}888888888888888888 999 9'919A9Q9W9b9h9t999999 ::w::; ;/;M;a;g;<4<C<L<U<j<<<<<<<<2=7=U=[=a=g=m==========>>4>8> P 0 0 1
Hacked By AnonymousFox1.0, Coded By AnonymousFox