MZ@ !L!This program cannot be run in DOS mode. $ss _________________Rich_PEdUPT"  XLS`4<9(pac``.textLN h.rdata` R@H.datap\@.pdata^@HINIT b .rsrc9:l@B.reloc(@BH; aau H;`au3ø H\$WH zHHu"uH҃HKHH\$0H _H%PHHXHpHxLp AWH H"I E3LMFiltAQDHOHHuBE3DǺHOHHuCE33HOHtE33HlOHt$8H|$@Lt$HH\$0H A_pLHHGfG8O؅uI7I>LI[IkVWAVH0H^HE3HICHHHMsICHu 7IHT LL$XA3<؅3SBE3HAFiltHHGNHGHHL$XC Lf<؅=#t=uGHOE33RNE3ɍUAFiltHFNHGHtMHL$XLH<؅t?HL$XHt NLt$XHOE33MLwfD7HH} HL$XHt sNLt$XtHOHtE33MLwfD7H\$PHl$`H0A^_^HH\$Ht$H|$AVH MHHMviHIE3AFiltAQ 6IG(K0HK8fSBfS@DHKHIW(HR6AGHC\AO9 PKPACTAGCXtKTAH PIPE3HW@E3EI@HHu-3EHHHGHGAD9vDHGHEIiDDBDHB|u BDAD;GrE33LcHEHELEHI?t V2LHAIDDƃEuǃHKHTHUHH(t D8}Ht(HHt D-ǃ!=uq@DAЃH P?HPPHPHSHH9PtI)HXOH OHOD?DuP\ODuP tH|@DDt$(t$ Ht,HHtE33_>LE33HJ>O@t!Dt$0H@AD$(D$ _H$H`A_A^A]A\_^]H\$WH HHH>HLJЈd>H\$0LJ3H _LI[UVWATAUAVAWH0HHIICE3MKE33ICEcEc-=t$pֹAFilt6>HHu HKHD$xLL$pDHHD$ <u{o D$DwHAEt^D{ DhHD)0fA;ufA;vHS(HL)8DM+0t fA;s‹CXH9D)uƃ$A3H1=H$H0A_A^A]A\_^]LI[WH@HqMIcHHD$ ICd$0ISIK;u HL$P;HGHt@(tHcǃH\$`3H@_H\$Hl$Ht$WAVAWH@*MH٨t"QTA\DIPT$0D$(T$ H>uHE3Ht E33;H L2<LHHCH9ZXH9OHHBLH vL;HHtE33A;LHHtE33#;LHHtE33;LHHtE33:LfDL9IHH|0HtFHOLwHt E33:HOHt E33:E33HLt:IMuHHuHE33Q:LE33HH\$`Hl$hHt$pH@A_A^_H%#:)@SH@H K):KKt7HP5L 5HZ<HD$0HV5HD$(HZ5HD$ H I3Ht3=:HIH JHt3":HJJH@[HIH%9H\$LL$ HT$UVWATAUAVAWH0H$3AI)LHDHl$ H(HAA ELRDIBHHHHt!MDf9(t HIuMtII+EMEHHMt"IDfA9(t IHuHtIH+EMBEHHMt"IDfA9(t IHuHtIH+EEHHI HHMlEI I=Ll$ E3AFiltAH=8LHD$(HM3Hg0IMpL|$xIL3MIDOH3f8MD$HIE3Mt+AIAAfD9 t HHuHtIH+ IHIHHQM$H ?HH<)3H+LMt)AIȋAf9)t HHuHtIH+ IHOHHHMD$H 6HHHHH+LMt$AIȋAf9)t HHuHuvHݺ IHHHHH HH+HiI HLI IL|$(Ll$ H$L(H$L8H\$pH0A_A^A]A\_^]IH+H\$M؋MtdMt_LT$(MtUHD$0DHJTHt<9t HRHuHu I!I!I!HBH 9IHBIBHIH\$H\$WH Hd$02IHt;Ht6LHLD$0H AQ0HD$0ۃx GHtHH\$8H _H\$LL$ LD$UVWATAUAVAWHH`H3LE@MDHMDHMDHMHMM`HWHNHE`IQ8HNAAFiltE35HHDG83H0-I(HACH9tKAILMHELEHt$(HD$ 7LmL}LeMu MuMt L+L{LcHSALEIHΈEjLuHNE3AV AFilt44HHEF 3HI^,AN K MVLUEDAIA>Ht3ARA HELMLEHt$(HD$ ULmL}LeLUMu MuMtMl>M|>Md>}@tAIұLUE@HEHELLUE;C [DC HK0LK(HL$ HNH H!{0H!{(!{ HEPMHHEXHM`E@'HK0HtE332Hc0E33H2HtE33H2H$H`A_A^A]A\_^]@USVWATAUAVAWHl$HH(BH3HE33EDnDMEDELLmDmDmHUHHuHEH]Huu9I\HM3L#HLAHH AL HL o2JGPHUEFDh+@8u+GT9GPtDFHUu=@8t%@8$uHUAuIM8tUA tOAuE3IHau7HELMLEE2IHHD$ Lm8]H]u EHH#H/L>3HMDBL}?)HHH#HE犇(EfELvtHEHMEt5t1HELMLEHHHD$ }H]u EHL#MFLm0 AEIHEyLEH1 Iv EfE~(HtH6D+F(D;sIvE~H ?3Iq0=?tO\MEHtsHt@Htxtf9Hu HtA;vÃd$XEAVD$PG\Ll$HH\$@D$8GTD$0GPDIND$(HEMHD$ @yLEH1 HuML/HLmL}IEt2Ht-HK0HtE33.Hc0E33H.3H]MLuD}DeEu,Ht'HK0HtE33.Hc0E33H.HOEEI".HMH3!HA_A^A]A\_^[]@USVWATAUAVAWHl$HH=H3HE3A3DMEDELHUHHuDHuHuHEHuD}HuuD}D|$`9I\HM3L#HLFHH =L HL .CPHUEFD@8u+CT9CPtDFHUuu@8t%@8$uHUAuGIM;E@8tIsCs=HD$`LMLEE2IHHD$ D}[@8}H}u D$`HH#EHEL&3HMDBLe$HHH#HEߊ(EfELvtHEHMEt7t3HD$`LMLEHHHD$ }H}u D$`HL#M, M=M.ELmׄyLEH|. M~ AFEf(EMtM?D+AG(D;sM~EfH ;3I!,=;tDMK\EIH<Ht$xtf9HuDhEEt D;vEDLM,{\"I+HKE3AFiltAQ0+LHI $eHIL$HHIL$HHIL$HHIL$ HH ID$(EgHIG(I+HDHt D;"sBDEHA+EAAGK\HIH K:3L *t2C\L|$@D$80D$0CTLMD$(CPH,D$ E33I*EDMAVIND$XD$PHEEHD$HC\H|$@D$8CTD$0CPD$(HEHD$ Lm׋:yLEH*3MM)MoD}LeLm}uH}uHuIuH&LHuIEt2Ht-HO0HtE333)Hg0E33H )3H}MbLuDeEu,Ht'HO0HtE33(Hg0E33H(EDMHKEI։D$ (HMH3 HA_A^A]A\_^[]3HHXHhHpLH WATAUAVAWHL$@H`H3MHDB0HHA@ C(H;r HH+HuM;H2{(MH+I;IGC tHsd$(d$ E3EA3HK(HHu H$XHHH#HL;uL L;$sI$8L AIH ~73M MuaHL '$8L$ Ht$@|$8D$0$0D$($(H\)MƉD$ LHL 'H$HL$ HI(H$$PMƉ$IE0Ht$x|$pHD$hAE(D$`AE D$XIEHD$PIEHD$HIEHD$@AED$8$8D$0$0D$($(D$ H$H$PL$E3L;tSL+HHtH{(HtI;IGC tHsD!t$(D!t$ E3EA3Hb&HH:3L$I[0Ik8Is@IA_A^A]A\_H\$UVWHl$HHI5H3HEM`H53MD$0fsHHHD$HfH~I LEpHD$XH HD$hDO HD$8HEPHD$@HEXHD$PHEhHD$`MtHHfA9<@uEAML!T$xHUxI‰|$|IEHD$pHtHHf9DHt*L+L+IHtAft fHHuHuHAHtfH\$AH(H 0Hu3R!H%0H(DL$ UHHpH0H3HEH j0HE(AHEHE0E3HEHE8HEHEHEHEHD$ HE HMH3vHp]H\$H|$UHHH/H3HEH/H3Lں MtHHfA93HrH%'%'AFiltH3HH'AƉ'HH΋HL$0C(L;r HL+HuI;IGHH{(I+H;HGC tHC'd$(d$ E3E3HH5E'HL$0HIL3 LH;tiHt$0H+HHtR{(HtH;HGC tHCd$(d$ E3E3H-HtCHӃD ,<w$CfrЋ$S;G‰$C;r?H+H7% t(D HCHcHD$0CfD$(CD$ 1$3HLH HtO%t(D HAHHD$0AfD$(AD$ Hw 8r1$HIuL%tDHEu*HHt 3sH&HHu!-#@-#H\$`Hl$hHt$pH@A_A^_LEK HXH6#H3HD$@H #IC HIC؃d$<ICAE3ICD$8HL$@H3HXDL$ UHHH"H3HEH #E3HE(HEHE0DMHEHE8AHEHE@E3HEE8HEEHEHEHD$ HE}HMH3HĀ]HHXHhHpWHPH3AHDB(HHI Hd$@Hd$HLD$ HD$ 0H\$(D$8@H|$0H\$`Hl$hHt$pHP_LI[IsWH03HIKfD$ ICIىD$*fD$.AHT$ LDH:H\$@Ht$HH0_LI[IkIs ISWAVAWH@3E3IfE{ICLD$:fD$>E{Mu H- HL$0bAFiltE3ɋӋ6HHu L3H HD$hHT$0HD$(LAIΉ\$ =t?=#t8HOHt/u4~t>'DHV MHGfDEs 0HHun3HDBHL$0HHD$xHT$0HD$(LAHD$ u{t {t>C 3HkH\$`Hl$hH@A^_^H\$Hl$Ht$WATAUAVAWH DQ3LEHAAAAt'A}fAAtrAt {fypID_DD;w.ruAAuA D;uA;w EA;DFEAAIAHEH;Do3ҍAADA;t;LDfA;s-Eu&LIIH;AfDLfE;rEAAA;DD;w>f;w9rD;uIAAu IA D;uIA#E;DDED:A/AA;u)DHIOH;„DHl$XHt$`H\$PH A_A^A]A\_H\$WH IAHtw1HHHt{tHDHtKAH\$0H _LɃraDAHL;wQsJIv A}<v3ÍAuAu+f3uArufA9AwwArf3H\$WH HH?HHH\$0H _V<ffH; 9uHfuH̹)H(MA8HI H(@SH AHLDLAtA@McPLHcL#IcJHCHHKAt HLL3IH [TffH+Ir"tf: u,HIuMIuMt: u HIuH3ÐIt7HH; u[HAH;D uLHAH;D u=HAH;D u.H IuIMItHH; uHIuIHHHH HHH;LH+IOsXMItDH HIHAuItf HIȈAuIffffffHrpكtL+BoAIMII vIo oL H fAfIIuOffffffffffffft IȈHufHr D @HuHo oL ffIH@oD oL fAfIuIIs $MIyIIOsOMItHD HIHuItfD HIȈuIffffffHwtHtL+HoD@HMII vIoD oL H fAf IuTffffffffffffftHɊ IȈufHwH D @uHoD oL fAfIH@oD o fAf uIIs $MI~HIr,IIIGs`MIIITIuItDATIufffffffffffffffffffffكtL+HHMIMIItIJ IILOAHHQHQHQHQ HQ(HQ0HQ8H@IuIt ATIu\Registry\Machine\System\CurrentControlSet\Control\ComputerName\ActiveComputerName\Registry\Machine\System\CurrentControlSet\Control\ComputerName\ComputerNameComputerNameParametersCaptureModeRefCountPersistentRefCount6.1.0000NDISCAP{EA24CD6C-D17A-4348-9190-09F0D5BE83DD}Microsoft NDIS CaptureNULL*** EtwEnableCallback called (IsEnabled=%d) 6 ΘfVF4 ƗxP<0Zږ̖dZJ>0HЕPUUPT$DdDV   n.)G F#>x      ExternalSyntheticEmulatedInternal(c@cXcpcp`aRSDSD\GM@ndiscap.pdb 45, p`P  4 2p 0 td42 T 4 R p ` td42 T 4 2p`t d T 42 4 pS td4  t dT42 4 2 p`P 4 p`P  4 2p 4R p `P  4 rp dT 4 rpr0 4Rp`P4  4 2p! !4!p`P'  p`0PS'  p`0PS# #d"#T!#4 #p" 4&"p`PSPSbPSpB PS`#t4 PSpd 4 r p dT4 Rp td4P dT4rp20 dT 4 rp S@ dT 4 pd 4R p dT4 rp T 4 r p ` d T 4 2p  4 2p202-+] fqa0bldlFdHddd(e(4ePe"he$ec"ed""e"#e#h$eh$L&eL&&f& *f **8f**Df*-Tf-1pf27f7:f:<f<H=fH=>f>#>g$>> g>2? g4??8f??4g?P@@gP@ATgABpgCDgDGgGIgJ5J4g8JJgJLgLM h MM gM2N h4NN8hNOLhOPhhPRhRSeSShST4gTlThTGUhUXhXYhSdH\$ UVWAVAWHl$H`HHL5kHL$`IHfHL$p L=HL$PI3AFiltf57Nf,H=HHHu FkpH HLHA3HHּHLH1A*HLHi蜾ubHH,3HL$@HD$BD$JfD$Nft$@HAHT$@E3DL$(HHD$ &HHt lHHHtSHM3DH)~H D$pL$PHEHEEMD$`HEHTHE(EHEHHEH-HEHHEHHE H}HE8HiHEHJHEHHEHhHE@HHGhH5HHHt)HUL HHD$0Lt$(L|$ cH|L mLEH؅t, tH#Dˉt$(D$ 蟬rH$H`A_A^_^]HHtH2-+H;t HHù)NDISCAPMicrosoft NDIS Capture{EA24CD6C-D17A-4348-9190-09F0D5BE83DD}6.1.0000j`pv`6 ΘfVF4 ƗxP<0Zږ̖dZJ>0HЕRtlInitUnicodeStringExAllocatePoolWithTagKRtlCopyUnicodeStringKeInitializeSpinLockkEtwRegisteroEtwWritenEtwUnregisterHZwCloseSKeAcquireSpinLockRaiseToDpcKeReleaseSpinLockExFreePoolWithTagL memcpy_sjEtwProviderEnabled3KfRaiseIrqlKeLowerIrql|MmIsAddressValidMmMapLockedPagesSpecifyCache8RtlCompareMemoryTDbgPrintZwOpenKeyZwQueryValueKeyZwSetValueKeyntoskrnl.exeNdisFRegisterFilterDriverNdisFDeregisterFilterDriverNdisFNetPnPEventNdisAllocateMemoryWithTagPriorityNdisFGetOptionalSwitchHandlersNdisFreeMemoryNdisInitializeEventNdisFOidRequestNdisWaitEventNdisSetEventNdisFreeCloneOidRequestNdisFOidRequestCompleteNdisAllocateCloneOidRequestNdisFSetAttributesNdisEnumerateFilterModulesNdisOpenConfigurationEx?NdisCloseConfigurationNdisFIndicateStatusNdisFSendNetBufferListsNdisFIndicateReceiveNetBufferListsNDIS.SYS8xPh 9 ( 8 H X h:%`T  WEVT_TEMPLATEMUI4VS_VERSION_INFOD%D%?StringFileInfo000004B0LCompanyNameMicrosoft Corporation,FileDescriptionMicrosoft NDIS Packet Capture Filter Driverp(FileVersion6.3.9600.17415 (winblue_r4.141028-1500)8 InternalNameNDISCAP.SYS.LegalCopyright Microsoft Corporation. All rights reserved.@ OriginalFilenameNDISCAP.SYSj%ProductNameMicrosoft Windows Operating SystemBProductVersion6.3.9600.17415DVarFileInfo$Translation 110000PP@PPTpp(< X $Response Time Info Start Stop $Loading State (Unloading State Error Information Verbose Driver Load $Driver Unoad Layer Load $Layer Unload Rules @Packet Fragment (%3 bytes) @Packet Metadata (%3 bytes) PVMSwitch Packet Fragment (%9 bytes) 8Capture Rules Count=%1 Driver Loaded (FriendlyName=%1 UniqueName=%2 ServiceName=%3) Driver Unloaded (FriendlyName=%1 UniqueName=%2 ServiceName=%3) Attached to miniport interface %1 above layer interface %2 with media type %3 (context=%4) Detached from miniport interface %1 above layer interface %2 with media type %3 (context=%4) |Capture Rule: Id=%1 Directive=%2 ValueLength=%3 Value=%4 lDriver load failed with status=%1 at location %2 FilterAttach failed with status=%1 at location %2 (context=%3) Received Invalid Capture Rule: Id=%1 Directive=%2 ValueLength=%3 Value=%4 Entering state '%2' from state '%1' (location=%3, context=%4) Entering state '%2' from state '%1' (location=%3, context=%4) @Rx Packet Processing Start DRx Packet Processing Complete Start State End State $FrameControl MultiLayer (InterfaceIndex EtherType 0Source MAC Address 8Destination MAC Address (Any MAC Address 0Source IPv4 Address <Destination IPv4 Address ,Any IPv4 Address 0Source IPv6 Address <Destination IPv6 Address ,Any IPv6 Address IP Protocol 4Packet Truncate Bytes ,Custom MAC Offset ,Custom IP Offset OFF LTE GTE EQU MASK LIST RANGE NEQ NMASK NLIST NRANGE CRIM8%n.)G F#>x$WEVT% PX!CHANdMicrosoft-Windows-NDIS-PacketCapture/DiagnosticMAPSX$VMAP400VMAP VMAPl` ЃЄЅІ DirectiveMapRuleIdMap ut:OpcodeMapTTBL TEMP@87/^qC9O@D EventDataAIoData1KNameMiniportIfIndex ACoData+KName LowerIfIndex ACoData+KName FragmentSize A;oData#KNameFragment $MiniportIfIndex LowerIfIndex FragmentSizeFragmentTEMP4 :!!F/D9D EventDataAIoData1KNameMiniportIfIndex ACoData+KName LowerIfIndex ACoData+KName SourcePortId AGoData/KNameSourcePortName AEoData-KName SourceNicName AEoData-KName SourceNicType AKoData3KNameDestinationCount AOZ ComplexData)KName Destination ACoData+KName FragmentSize A;oData#KNameFragment AAoData)KName OOBDataSize A9oData!KNameOOBData  < \ |      $ D \  x     $MiniportIfIndex LowerIfIndex SourcePortId$SourcePortName SourceNicName SourceNicType(DestinationCountDestination FragmentSizeFragmentOOBDataSizeOOBData(DestinationPortId,DestinationPortName,DestinationNicName,DestinationNicTypeTEMP@ MT2Vֈ*k'@D EventDataAIoData1KNameMiniportIfIndex ACoData+KName LowerIfIndex ACoData+KName MetadataSize A;oData#KNameMetadata   @`$MiniportIfIndex LowerIfIndex MetadataSizeMetadataTEMPT`Y#o% @-D EventDataAIoData1KNameMiniportIfIndex ACoData+KName LowerIfIndex $MiniportIfIndex LowerIfIndexTEMPB{x׸D EventDataA7oDataKNameRuleId A=oData%KName Directive A7oDataKNameLength A5oDataKNameValue Xh|RuleIdDirectiveLengthValueTEMPL50& 6w!\`D EventDataA?oData'KName RulesCount `RulesCountTEMP$z54MEKp2D EventDataACoData+KName FriendlyName A?oData'KName UniqueName AAoData)KName ServiceName A9oData!KNameVersion 4Tp FriendlyNameUniqueNameServiceNameVersionTEMPT Sr& JD EventDataAIoData1KNameMiniportIfIndex ACoData+KName LowerIfIndex A=oData%KName MediaType AKoData3KNameReferenceContext p$MiniportIfIndex LowerIfIndexMediaType(ReferenceContextTEMPI\hxt D EventDataA=oData%KName ErrorCode A;oData#KNameLocation A9oData!KNameContext D\tErrorCodeLocationContextTEMPElr  ,D EventDataAEoData-KName PreviousState A=oData%KName NextState A;oData#KNameLocation A9oData!KNameContext $8$Xp PreviousStateNextStateLocationContextOPCO0000,0<win:Infowin:Startwin:StopLoadUnloadLEVLPPPwin:Error(win:Informationalwin:VerboseTASKptppppDriverLoad DriverUnloadLayerLoadLayerUnloadRulesKEYWdp@8Pl @( P h     !10! Ethernet802.3WirelessWANTunnel Native802.11VMSwitch$PacketTruncatedPacketStartPacketEndut:SendPath$ut:ReceivePath(ut:L3ConnectPath(ut:L2ConnectPath ut:ClosePath(ut:Authentication(ut:Configurationut:Globalut:Dropped ut:PiiPresentut:Packetut:Address,ut:StdTemplateHint,ut:StateTransition(win:ResponseTimeEVNTh$8 h$h$hX$|t$|t$t$t$hX$\$\ %\X%  t %  t % t% t % t(% t0%  @ PPP`P`P`P`Microsoft NDIS Capture+Microsoft NDIS Packet Capture Filter Driver}+SNwh&I\zS*  WEVT_TEMPLATEMUI MUI en-US`` p@HP