Edit C:\Windows\SysWOW64\RdpSaUacHelper.exe
MZ? ?? ? @ ? ? ? ?!?L?!This program cannot be run in DOS mode. $ Zk9? W? W? W?r? W??? W??? W??? W??? W? V? W??? W??? W??? W?ich W? PE L 3uR ? 4 $ ?; P @ ? <F @? ? ? p ? p 0 ? \ ` ? .text ?2 4 `.data ? P 8 @ ?.idata ? ` : @ @.rsrc p F @ @.reloc ? ? P @ B ?@ C9@ I@ }8@ ?=@ 3uR + ? ? 0P@ ?P@ h??4???? ? c???B?%4K$ NULL CRdpSaComUtils::s_GetKnownFolderFilePath failed! EnumProcess failed! FindRdpSessionAgentProxyProcess failed! spProxy->GetSessionAgentProcessHandle failed! G l o b a l \ R d p S a E v e n t R e a d y - % s G l o b a l \ R d p S a E v e n t F a i l - % s m_InvitationManager.Initialize failed! % 8 . 8 x CRdpSaComUtils::s_CoCreateInSession failed! CoCreateInSession failed! FindInteractiveUserProcess failed! GenCryptoSecureKey failed! WaitForMultipleObjects failed! SignalNamedEvent failed! CoInitializeEx failed! CoInitializeSecurity failed! HandleInteractiveUserProcess failed! ???J? h??S o f t w a r e \ M i c r o s o f t \ T e r m i n a l S e r v i c e s \ S e s s i o n A g e n t \ H a n d l e s ?@ ?@ Advapi32.dll EventActivityIdControl R d p S a P r o x y . e x e ?^?!H???&:??2????? 2 0 1 e f 9 9 a - 7 f a 0 - 4 4 4 c - 9 3 9 9 - 1 9 b a 8 4 f 1 2 a 1 a A p p I n f o n c a l r p c H 8 2 X ? H H H $ H ( A, 6 P!0 p 4 H 2 <