Hacked By AnonymousFox

Current Path : C:/ProgramData/Microsoft/Windows Defender/Platform/4.18.25050.5-0/
Upload File :
Current File : C:/ProgramData/Microsoft/Windows Defender/Platform/4.18.25050.5-0/MpEvMsg.dll

MZ@	!L!This program cannot be run in DOS mode.

$}/9N9N9N~8N9N8Nȃ8NRich9NPEde`" * 

0` 80%T.rdata@@.rsrc8  @@e`
llle`$e`GCTLT.rdataT.rdata$voltmdl.rdata$zzzdbg `.rsrc$01`!.rsrc$02 
`hSGba["0Z}cȴ/t>e`L00H`x				 %J`! }
WEVT_TEMPLATEMUI4VS_VERSION_INFOaa?|StringFileInfoX040904b0LCompanyNameMicrosoft CorporationTFileDescriptionEvent Resource Module8InternalNameMpEvMsg.dll.LegalCopyright Microsoft Corporation. All rights reserved.@OriginalFilenameMpEvMsg.dllj%ProductNameMicrosoft Windows Operating System8FileVersion4.18.25050.5 (bcf51ab773be21957c5713cae9cb3adf2fd75bf5)>
ProductVersion4.18.25050.5l&PrivateBuildGitEnlistment(ContainerAdministrator)DVarFileInfo$Translation	CRIMHN_߽,x$WEVT$tX
HTCHANdMicrosoft-Windows-Windows Defender/OperationalTMicrosoft-Windows-Windows Defender/WHCTTBLGTEMPH	UIKp]e/ND	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
AuoData]KName%Current security intelligence Version
AwoData_KName&Previous security intelligence Version
A7oDataKNameUnused
A9oData!KNameUnused2
A9oData!KNameUnused3
A7oDataKNameDomain
A3oDataKNameUser
A1oDataKNameSID
	AkoDataSKName Security intelligence Type Index
A_oDataGKNameSecurity intelligence Type
AMoData5KNameUpdate Type Index
AAoData)KNameUpdate Type

AWoData?KNameCurrent Engine Version
AYoDataAKNamePrevious Engine Version
(Hl	$	8	L	`	p	|		
(
D
x
 Product Name$Product VersionPCurrent security intelligence VersionTPrevious security intelligence VersionUnusedUnused2Unused3DomainUserSIDHSecurity intelligence Type Index<Security intelligence Type(Update Type IndexUpdate Type4Current Engine Version4Previous Engine VersionTEMP P}gR&D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
AuoData]KName%Current security intelligence Version
AwoData_KName&Previous security intelligence Version
AQoData9KNameUpdate Source Index
AEoData-KName
Update Source
A7oDataKNameUnused
A7oDataKNameDomain
A3oDataKNameUser
A1oDataKNameSID
	AkoDataSKName Security intelligence Type Index
A_oDataGKNameSecurity intelligence Type
AMoData5KNameUpdate Type Index
AAoData)KNameUpdate Type

AWoData?KNameCurrent Engine Version
AYoDataAKNamePrevious Engine Version
A?oData'KName
Error Code
AMoData5KNameError Description
AOoData7KNameUpdate State Index
ACoData+KNameUpdate State
AAoData)KNameSource Path
x`8t <d Product Name$Product VersionPCurrent security intelligence VersionTPrevious security intelligence Version,Update Source Index Update SourceUnusedDomainUserSIDHSecurity intelligence Type Index<Security intelligence Type(Update Type IndexUpdate Type4Current Engine Version4Previous Engine VersionError Code(Error Description,Update State Index Update StateSource PathTEMP]J^eVł?y4D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
AWoData?KNameCurrent Engine Version
AYoDataAKNamePrevious Engine Version
A7oDataKNameUnused
A9oData!KNameUnused2
A9oData!KNameUnused3
A7oDataKNameDomain
A3oDataKNameUser
A1oDataKNameSID
	A9oData!KNameUnused4
A9oData!KNameUnused5
AEoData-KName
Feature Index
ACoData+KNameFeature Name

0T(<Pp Product Name$Product Version4Current Engine Version4Previous Engine VersionUnusedUnused2Unused3DomainUserSIDUnused4Unused5 Feature Index Feature NameTEMP!!76W	ı#.YD	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
AWoData?KNameCurrent Engine Version
AYoDataAKNamePrevious Engine Version
A7oDataKNameUnused
A9oData!KNameUnused2
A9oData!KNameUnused3
A7oDataKNameDomain
A3oDataKNameUser
A1oDataKNameSID
	A?oData'KName
Error Code
AMoData5KNameError Description
AOoData7KNameUpdate State Index
ACoData+KNameUpdate State

"#<#p######$$,$T$$ Product Name$Product Version4Current Engine Version4Previous Engine VersionUnusedUnused2Unused3DomainUserSIDError Code(Error Description,Update State Index Update StateTEMPX

h(ԋfU'dPCD	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
AuoData]KName%Security intelligence Attempted Index
AioDataQKNameSecurity intelligence Attempted
A?oData'KName
Error Code
AMoData5KNameError Description
A7oDataKNameUnused
A9oData!KNameUnused2
AuoData]KName%Loading security intelligence version
AWoData?KNameLoading engine version
	0)P)t))*$*L*`*t** Product Name$Product VersionPSecurity intelligence Attempted IndexDSecurity intelligence AttemptedError Code(Error DescriptionUnusedUnused2PLoading security intelligence version4Loading engine versionTEMP4FK[݇|бm	D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
AuoData]KName%Current security intelligence Version
A7oDataKNameUnused
A9oData!KNameUnused2
A9oData!KNameUnused3
A9oData!KNameUnused4
A7oDataKNameDomain
A3oDataKNameUser
A1oDataKNameSID
	AkoDataSKName Security intelligence Type Index
A_oDataGKNameSecurity intelligence Type
A9oData!KNameUnused5
A9oData!KNameUnused6

AWoData?KNameCurrent Engine Version
A9oData!KNameUnused7
A9oData!KNameUnused8
A9oData!KNameUnused9
A;oData#KNameUnused10
A;oData#KNameUnused11
A;oData#KNameUnused12
A{oDatacKName(Cloud protection intelligence Type Index
AooDataWKName"Cloud protection intelligence Type
AKoData3KNamePersistence Path
AuoData]KName%Cloud protection intelligence Version
AoDatayKName3Cloud protection intelligence Compilation Timestamp
AcoDataKKNamePersistence Limit Type Index
AWoData?KNamePersistence Limit Type
AYoDataAKNamePersistence Limit Value
707T77777788$8l888899,9@9X9p999,:T::;P;; Product Name$Product VersionPCurrent security intelligence VersionUnusedUnused2Unused3Unused4DomainUserSIDHSecurity intelligence Type Index<Security intelligence TypeUnused5Unused64Current Engine VersionUnused7Unused8Unused9Unused10Unused11Unused12XCloud protection intelligence Type IndexLCloud protection intelligence Type(Persistence PathPCloud protection intelligence VersionlCloud protection intelligence Compilation Timestamp@Persistence Limit Type Index4Persistence Limit Type4Persistence Limit ValueTEMP@F-ا]5'T
D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
AuoData]KName%Current security intelligence Version
A7oDataKNameUnused
A9oData!KNameUnused2
A9oData!KNameUnused3
A9oData!KNameUnused4
A7oDataKNameDomain
A3oDataKNameUser
A1oDataKNameSID
	AkoDataSKName Security intelligence Type Index
A_oDataGKNameSecurity intelligence Type
A9oData!KNameUnused5
A9oData!KNameUnused6

AWoData?KNameCurrent Engine Version
A9oData!KNameUnused7
A9oData!KNameUnused8
A9oData!KNameUnused9
A;oData#KNameUnused10
A;oData#KNameUnused11
A;oData#KNameUnused12
A{oDatacKName(Cloud protection intelligence Type Index
AooDataWKName"Cloud protection intelligence Type
AKoData3KNamePersistence Path
AuoData]KName%Cloud protection intelligence Version
AoDatayKName3Cloud protection intelligence Compilation Timestamp
AcoDataKKNamePersistence Limit Type Index
AWoData?KNamePersistence Limit Type
AYoDataAKNamePersistence Limit Value
ASoData;KNameRemoval Reason Index
ASoData;KNameRemoval Reason Value
HHH@ITIhI|IIIIIJDJXJlJJJJJJK$K|KKK@LLL MTMM Product Name$Product VersionPCurrent security intelligence VersionUnusedUnused2Unused3Unused4DomainUserSIDHSecurity intelligence Type Index<Security intelligence TypeUnused5Unused64Current Engine VersionUnused7Unused8Unused9Unused10Unused11Unused12XCloud protection intelligence Type IndexLCloud protection intelligence Type(Persistence PathPCloud protection intelligence VersionlCloud protection intelligence Compilation Timestamp@Persistence Limit Type Index4Persistence Limit Type4Persistence Limit Value0Removal Reason Index0Removal Reason ValueTEMPWV*tQ*;4K	D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
AuoData]KName%Current security intelligence Version
A7oDataKNameUnused
A9oData!KNameUnused2
A9oData!KNameUnused3
A9oData!KNameUnused4
A7oDataKNameDomain
A3oDataKNameUser
A1oDataKNameSID
	AkoDataSKName Security intelligence Type Index
A_oDataGKNameSecurity intelligence Type
A9oData!KNameUnused5
A9oData!KNameUnused6

AWoData?KNameCurrent Engine Version
A9oData!KNameUnused7
A?oData'KName
Error Code
AMoData5KNameError Description
A9oData!KNameUnused8
A9oData!KNameUnused9
A;oData#KNameUnused10
A{oDatacKName(Cloud protection intelligence Type Index
AooDataWKName"Cloud protection intelligence Type
AKoData3KNamePersistence Path
AuoData]KName%Cloud protection intelligence Version
AoDatayKName3Cloud protection intelligence Compilation Timestamp
AcoDataKKNamePersistence Limit Type Index
AWoData?KNamePersistence Limit Type
AYoDataAKNamePersistence Limit Value
YZ(ZxZZZZZZZZ@[|[[[[[\0\D\X\p\\]<]]]8^l^ Product Name$Product VersionPCurrent security intelligence VersionUnusedUnused2Unused3Unused4DomainUserSIDHSecurity intelligence Type Index<Security intelligence TypeUnused5Unused64Current Engine VersionUnused7Error Code(Error DescriptionUnused8Unused9Unused10XCloud protection intelligence Type IndexLCloud protection intelligence Type(Persistence PathPCloud protection intelligence VersionlCloud protection intelligence Compilation Timestamp@Persistence Limit Type Index4Persistence Limit Type4Persistence Limit ValueTEMPhcǾ9V64"D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
AuoData]KName%Current security intelligence Version
A7oDataKNameUnused
A9oData!KNameUnused2
A9oData!KNameUnused3
A9oData!KNameUnused4
A7oDataKNameDomain
A3oDataKNameUser
A1oDataKNameSID
	AkoDataSKName Security intelligence Type Index
A_oDataGKNameSecurity intelligence Type
A9oData!KNameUnused5
A9oData!KNameUnused6

AWoData?KNameCurrent Engine Version
ddd(e<ePedexeeeee,f@fTf Product Name$Product VersionPCurrent security intelligence VersionUnusedUnused2Unused3Unused4DomainUserSIDHSecurity intelligence Type Index<Security intelligence TypeUnused5Unused64Current Engine VersionTEMPTpg<+p!Y4pN^D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
gg Product Name$Product VersionTEMPiOUW'D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A7oDataKNameUnused
A?oData'KName
Error Code
AMoData5KNameError Description
j jDjXjtj Product Name$Product VersionUnusedError Code(Error DescriptionTEMPTk<+p!Y4pN^D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
kk Product Name$Product VersionTEMPXpm]6[]&ڲLD	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A7oDataKNameUnused
ASoData;KNameNew Platform Version
mmnn Product Name$Product VersionUnused0New Platform VersionTEMPXo]6[]&ڲLD	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A7oDataKNameUnused
ASoData;KNameNew Platform Version
p8p\ppp Product Name$Product VersionUnused0New Platform VersionTEMPTq<+p!Y4pN^D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
qq Product Name$Product VersionTEMPTr<+p!Y4pN^D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
s$s Product Name$Product VersionTEMPuOUW'D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A7oDataKNameUnused
A?oData'KName
Error Code
AMoData5KNameError Description
luuuuu Product Name$Product VersionUnusedError Code(Error DescriptionTEMP wj\cY{t&&ZD	EventDataACoData+KNameProduct Name
A7oDataKNameUnused
A9oData!KNameUnused2
\w|ww Product NameUnusedUnused2TEMPxj\cY{t&&ZD	EventDataACoData+KNameProduct Name
A7oDataKNameUnused
A9oData!KNameUnused2
xy,y Product NameUnusedUnused2TEMPXzj\cY{t&&ZD	EventDataACoData+KNameProduct Name
A7oDataKNameUnused
A9oData!KNameUnused2
zzz Product NameUnusedUnused2TEMP(D|nT:rP[/4D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A;oData#KNameFilename
A7oDataKNameSha256
|||| Product Name$Product VersionFilenameSha256TEMP$ʝ'qVCxITwTD	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A;oData#KNameFilename
A7oDataKNameSha256
AuoData]KName%Current security intelligence Version
AWoData?KNameCurrent Engine Version
A?oData'KName
Error Code
8\t؀ Product Name$Product VersionFilenameSha256PCurrent security intelligence Version4Current Engine VersionError CodeTEMPT<+p!Y4pN^D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
8X Product Name$Product VersionTEMPDo!C]	kBD	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A?oData'KName
Error Code
AAoData)KNameHttp Status
Dd Product Name$Product VersionError CodeHttp StatusTEMP`ЉyR:D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A9oData!KNameScan ID
AIoData1KNameScan Type Index
A=oData%KName	Scan Type
AUoData=KNameScan Parameters Index
AIoData1KNameScan Parameters
A7oDataKNameDomain
A3oDataKNameUser
A1oDataKNameSID
	AGoData/KNameScan Resources
AOoData7KNameScan Trigger Index
ACoData+KNameScan Trigger
AMoData5KNameScan Only If Idle

A_oDataGKNameLow CPU Priority for Scans
AIoData1KNameThread Priority
0Thԋ(Lx Product Name$Product VersionScan ID$Scan Type IndexScan Type0Scan Parameters Index$Scan ParametersDomainUserSID$Scan Resources,Scan Trigger Index Scan Trigger(Scan Only If Idle<Low CPU Priority for Scans$Thread PriorityTEMP

0?#Sa}.1:D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A9oData!KNameScan ID
AIoData1KNameScan Type Index
A=oData%KName	Scan Type
AUoData=KNameScan Parameters Index
AIoData1KNameScan Parameters
A7oDataKNameDomain
A3oDataKNameUser
A1oDataKNameSID
	AIoData1KNameScan Time Hours
AMoData5KNameScan Time Minutes
AMoData5KNameScan Time Seconds
4TxȒ0@Lp Product Name$Product VersionScan ID$Scan Type IndexScan Type0Scan Parameters Index$Scan ParametersDomainUserSID$Scan Time Hours(Scan Time Minutes(Scan Time SecondsTEMPt!2TD	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A9oData!KNameScan ID
AIoData1KNameScan Type Index
A=oData%KName	Scan Type
AUoData=KNameScan Parameters Index
AIoData1KNameScan Parameters
A7oDataKNameDomain
A3oDataKNameUser
A1oDataKNameSID
	AMoData5KNameStop Reason Index
AAoData)KNameStop Reason
d(L`p| Product Name$Product VersionScan ID$Scan Type IndexScan Type0Scan Parameters Index$Scan ParametersDomainUserSID(Stop Reason IndexStop ReasonTEMP

؜VYZ{	RϸD	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A9oData!KNameScan ID
AIoData1KNameScan Type Index
A=oData%KName	Scan Type
AUoData=KNameScan Parameters Index
AIoData1KNameScan Parameters
A7oDataKNameDomain
A3oDataKNameUser
A1oDataKNameSID
	4d Product Name$Product VersionScan ID$Scan Type IndexScan Type0Scan Parameters Index$Scan ParametersDomainUserSIDTEMP

СVYZ{	RϸD	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A9oData!KNameScan ID
AIoData1KNameScan Type Index
A=oData%KName	Scan Type
AUoData=KNameScan Parameters Index
AIoData1KNameScan Parameters
A7oDataKNameDomain
A3oDataKNameUser
A1oDataKNameSID
	ܢ,\ Product Name$Product VersionScan ID$Scan Type IndexScan Type0Scan Parameters Index$Scan ParametersDomainUserSIDTEMPd@qU#mߖ$~D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A9oData!KNameScan ID
AIoData1KNameScan Type Index
A=oData%KName	Scan Type
AUoData=KNameScan Parameters Index
AIoData1KNameScan Parameters
A7oDataKNameDomain
A3oDataKNameUser
A1oDataKNameSID
	A?oData'KName
Error Code
AMoData5KNameError Description
TtШ<P`l Product Name$Product VersionScan ID$Scan Type IndexScan Type0Scan Parameters Index$Scan ParametersDomainUserSIDError Code(Error DescriptionTEMP\D(}<AxXxhg`D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
ACoData+KNameDetection ID
AWoData?KNameDetection Source Index
AKoData3KNameDetection Source
A7oDataKNameUnused
ACoData+KNameProcess Name
A7oDataKNameDomain
A3oDataKNameUser
A1oDataKNameSID
	AAoData)KNameThreat Name
A=oData%KName	Threat ID
AAoData)KNameSeverity ID
AAoData)KNameCategory ID

A7oDataKNameFWLink
A?oData'KName
Path Found
AWoData?KNameDetection Origin Index
AKoData3KNameDetection Origin
AWoData?KNameExecution Status Index
AKoData3KNameExecution Status
ASoData;KNameDetection Type Index
AGoData/KNameDetection Type
A9oData!KNameUnused2
A9oData!KNameUnused3
AEoData-KName
Severity Name
AEoData-KName
Category Name
AeoDataMKNameSecurity intelligence Version
AGoData/KNameEngine Version
tش4Hh|̵4hĶ@Th Product Name$Product Version Detection ID4Detection Source Index(Detection SourceUnused Process NameDomainUserSIDThreat NameThreat IDSeverity IDCategory IDFWLinkPath Found4Detection Origin Index(Detection Origin4Execution Status Index(Execution Status0Detection Type Index$Detection TypeUnused2Unused3 Severity Name Category Name@Security intelligence Version$Engine VersionTEMPD
~G@XJt[LD	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
ACoData+KNameDetection ID
A7oDataKNameUnused
A9oData!KNameUnused2
AAoData)KNameStatus Code
AOoData7KNameStatus Description
A7oDataKNameDomain
A3oDataKNameUser
A1oDataKNameSID
	AAoData)KNameThreat Name
A=oData%KName	Threat ID
AAoData)KNameSeverity ID
AAoData)KNameCategory ID

A7oDataKNameFWLink
A3oDataKNamePath
A9oData!KNameUnused3
A9oData!KNameUnused4
AUoData=KNameCleaning Action Index
AIoData1KNameCleaning Action
A9oData!KNameUnused5
A9oData!KNameUnused6
A9oData!KNameUnused7
A9oData!KNameUnused8
AEoData-KName
Severity Name
AEoData-KName
Category Name
AeoDataMKNameSecurity intelligence Version
AGoData/KNameEngine Version
Ll 4DPl8\p, Product Name$Product Version Detection IDUnusedUnused2Status Code,Status DescriptionDomainUserSIDThreat NameThreat IDSeverity IDCategory IDFWLinkPathUnused3Unused40Cleaning Action Index$Cleaning ActionUnused5Unused6Unused7Unused8 Severity Name Category Name@Security intelligence Version$Engine VersionTEMP|
|Fֹ>STcD	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
ACoData+KNameDetection ID
A7oDataKNameUnused
A9oData!KNameUnused2
AAoData)KNameStatus Code
AOoData7KNameStatus Description
A7oDataKNameDomain
A3oDataKNameUser
A1oDataKNameSID
	AAoData)KNameThreat Name
A=oData%KName	Threat ID
AAoData)KNameSeverity ID
AAoData)KNameCategory ID

A7oDataKNameFWLink
A3oDataKNamePath
A9oData!KNameUnused3
A9oData!KNameUnused4
AUoData=KNameCleaning Action Index
AIoData1KNameCleaning Action
A?oData'KName
Error Code
AMoData5KNameError Description
A9oData!KNameUnused5
A9oData!KNameUnused6
AEoData-KName
Severity Name
AEoData-KName
Category Name
AeoDataMKNameSecurity intelligence Version
AGoData/KNameEngine Version
$8T0@Th(Hh Product Name$Product Version Detection IDUnusedUnused2Status Code,Status DescriptionDomainUserSIDThreat NameThreat IDSeverity IDCategory IDFWLinkPathUnused3Unused40Cleaning Action Index$Cleaning ActionError Code(Error DescriptionUnused5Unused6 Severity Name Category Name@Security intelligence Version$Engine VersionTEMP59$S=
O4D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A7oDataKNameUnused
A9oData!KNameUnused2
A9oData!KNameUnused3
A9oData!KNameUnused4
A9oData!KNameUnused5
A7oDataKNameDomain
A3oDataKNameUser
A1oDataKNameSID
	AAoData)KNameThreat Name
A=oData%KName	Threat ID
AAoData)KNameSeverity ID
AAoData)KNameCategory ID

A7oDataKNameFWLink
A3oDataKNamePath
A9oData!KNameUnused6
A9oData!KNameUnused7
A9oData!KNameUnused8
A9oData!KNameUnused9
A;oData#KNameUnused10
A;oData#KNameUnused11
A;oData#KNameUnused12
A;oData#KNameUnused13
AEoData-KName
Severity Name
AEoData-KName
Category Name
AeoDataMKNameSecurity intelligence Version
AGoData/KNameEngine Version
,@Th|(<PdxX Product Name$Product VersionUnusedUnused2Unused3Unused4Unused5DomainUserSIDThreat NameThreat IDSeverity IDCategory IDFWLinkPathUnused6Unused7Unused8Unused9Unused10Unused11Unused12Unused13 Severity Name Category Name@Security intelligence Version$Engine VersionTEMPX2zZ}yIQwD	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A?oData'KName
Error Code
AMoData5KNameError Description
A7oDataKNameUnused
A9oData!KNameUnused2
A9oData!KNameUnused3
A7oDataKNameDomain
A3oDataKNameUser
A1oDataKNameSID
	AAoData)KNameThreat Name
A=oData%KName	Threat ID
AAoData)KNameSeverity ID
AAoData)KNameCategory ID

A7oDataKNameFWLink
A3oDataKNamePath
A9oData!KNameUnused4
A9oData!KNameUnused5
A9oData!KNameUnused6
A9oData!KNameUnused7
A9oData!KNameUnused8
A9oData!KNameUnused9
A;oData#KNameUnused10
A;oData#KNameUnused11
AEoData-KName
Severity Name
AEoData-KName
Category Name
AeoDataMKNameSecurity intelligence Version
AGoData/KNameEngine Version
$8L`p| 4H\p4 Product Name$Product VersionError Code(Error DescriptionUnusedUnused2Unused3DomainUserSIDThreat NameThreat IDSeverity IDCategory IDFWLinkPathUnused4Unused5Unused6Unused7Unused8Unused9Unused10Unused11 Severity Name Category Name@Security intelligence Version$Engine VersionTEMP59$S=
O4D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A7oDataKNameUnused
A9oData!KNameUnused2
A9oData!KNameUnused3
A9oData!KNameUnused4
A9oData!KNameUnused5
A7oDataKNameDomain
A3oDataKNameUser
A1oDataKNameSID
	AAoData)KNameThreat Name
A=oData%KName	Threat ID
AAoData)KNameSeverity ID
AAoData)KNameCategory ID

A7oDataKNameFWLink
A3oDataKNamePath
A9oData!KNameUnused6
A9oData!KNameUnused7
A9oData!KNameUnused8
A9oData!KNameUnused9
A;oData#KNameUnused10
A;oData#KNameUnused11
A;oData#KNameUnused12
A;oData#KNameUnused13
AEoData-KName
Severity Name
AEoData-KName
Category Name
AeoDataMKNameSecurity intelligence Version
AGoData/KNameEngine Version
Ll$@Xt4Ld Product Name$Product VersionUnusedUnused2Unused3Unused4Unused5DomainUserSIDThreat NameThreat IDSeverity IDCategory IDFWLinkPathUnused6Unused7Unused8Unused9Unused10Unused11Unused12Unused13 Severity Name Category Name@Security intelligence Version$Engine VersionTEMP2zZ}yIQwD	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A?oData'KName
Error Code
AMoData5KNameError Description
A7oDataKNameUnused
A9oData!KNameUnused2
A9oData!KNameUnused3
A7oDataKNameDomain
A3oDataKNameUser
A1oDataKNameSID
	AAoData)KNameThreat Name
A=oData%KName	Threat ID
AAoData)KNameSeverity ID
AAoData)KNameCategory ID

A7oDataKNameFWLink
A3oDataKNamePath
A9oData!KNameUnused4
A9oData!KNameUnused5
A9oData!KNameUnused6
A9oData!KNameUnused7
A9oData!KNameUnused8
A9oData!KNameUnused9
A;oData#KNameUnused10
A;oData#KNameUnused11
AEoData-KName
Severity Name
AEoData-KName
Category Name
AeoDataMKNameSecurity intelligence Version
AGoData/KNameEngine Version
4Xt$<Xt(@` Product Name$Product VersionError Code(Error DescriptionUnusedUnused2Unused3DomainUserSIDThreat NameThreat IDSeverity IDCategory IDFWLinkPathUnused4Unused5Unused6Unused7Unused8Unused9Unused10Unused11 Severity Name Category Name@Security intelligence Version$Engine VersionTEMP

K4?y{X0G3D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A=oData%KName	Timestamp
A7oDataKNameUnused
A9oData!KNameUnused2
A9oData!KNameUnused3
A9oData!KNameUnused4
A7oDataKNameDomain
A3oDataKNameUser
A1oDataKNameSID
						
 
4
H
X
 Product Name$Product VersionTimestampUnusedUnused2Unused3Unused4DomainUserSIDTEMP

X
1Z+6D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A=oData%KName	Timestamp
A?oData'KName
Error Code
AMoData5KNameError Description
A7oDataKNameUnused
A9oData!KNameUnused2
A7oDataKNameDomain
A3oDataKNameUser
A1oDataKNameSID
	 @d| Product Name$Product VersionTimestampError Code(Error DescriptionUnusedUnused2DomainUserSIDTEMP%%XʾN̢RD	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
ACoData+KNameDetection ID
AWoData?KNameDetection Source Index
AKoData3KNameDetection Source
A7oDataKNameUnused
ACoData+KNameProcess Name
A7oDataKNameDomain
A3oDataKNameUser
A1oDataKNameSID
	AAoData)KNameThreat Name
A=oData%KName	Threat ID
AAoData)KNameSeverity ID
AAoData)KNameCategory ID

A7oDataKNameFWLink
A?oData'KName
Path Found
AWoData?KNameDetection Origin Index
AKoData3KNameDetection Origin
AWoData?KNameExecution Status Index
AKoData3KNameExecution Status
ASoData;KNameDetection Type Index
AGoData/KNameDetection Type
A9oData!KNameUnused2
A9oData!KNameUnused3
AEoData-KName
Severity Name
AEoData-KName
Category Name
AeoDataMKNameSecurity intelligence Version
AGoData/KNameEngine Version
A?oData'KName
Process ID
A[oDataCKNameSecurity intelligence ID
AEoData-KName
FidelityValue
AEoData-KName
FidelityLabel
AIoData1KNameImage File Hash
 A9oData!KNameUnused4
!A9oData!KNameUnused5
"AGoData/KNameTargetFileName
#AGoData/KNameTargetFileHash
$<\0DT`|0X  0 P p    (!H!h!!!!! Product Name$Product Version Detection ID4Detection Source Index(Detection SourceUnused Process NameDomainUserSIDThreat NameThreat IDSeverity IDCategory IDFWLinkPath Found4Detection Origin Index(Detection Origin4Execution Status Index(Execution Status0Detection Type Index$Detection TypeUnused2Unused3 Severity Name Category Name@Security intelligence Version$Engine VersionProcess ID8Security intelligence ID FidelityValue FidelityLabel$Image File HashUnused4Unused5$TargetFileName$TargetFileHashTEMP**l.){4P
C39F<D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
ACoData+KNameDetection ID
AGoData/KNameDetection Time
A7oDataKNameUnused
A9oData!KNameUnused2
A=oData%KName	Threat ID
AAoData)KNameThreat Name
AAoData)KNameSeverity ID
AEoData-KName
Severity Name
	AAoData)KNameCategory ID
AEoData-KName
Category Name
A7oDataKNameFWLink
AAoData)KNameStatus Code

AOoData7KNameStatus Description
A5oDataKNameState
A=oData%KName	Source ID
AAoData)KNameSource Name
ACoData+KNameProcess Name
AGoData/KNameDetection User
A9oData!KNameUnused3
A3oDataKNamePath
A=oData%KName	Origin ID
AAoData)KNameOrigin Name
ACoData+KNameExecution ID
AGoData/KNameExecution Name
A9oData!KNameType ID
A=oData%KName	Type Name
ASoData;KNamePre Execution Status
A=oData%KName	Action ID
AAoData)KNameAction Name
A9oData!KNameUnused4
A?oData'KName
Error Code
 AMoData5KNameError Description
!A9oData!KNameUnused5
"AMoData5KNamePost Clean Status
#AUoData=KNameAdditional Actions ID
$A]oDataEKNameAdditional Actions String
%AKoData3KNameRemediation User
&A9oData!KNameUnused6
'AeoDataMKNameSecurity intelligence Version
(AGoData/KNameEngine Version
)1112<2P2d2|222223$3@3l3|333334404L4l444445 545P5x55556D6X66 Product Name$Product Version Detection ID$Detection TimeUnusedUnused2Threat IDThreat NameSeverity ID Severity NameCategory ID Category NameFWLinkStatus Code,Status DescriptionStateSource IDSource Name Process Name$Detection UserUnused3PathOrigin IDOrigin Name Execution ID$Execution NameType IDType Name0Pre Execution StatusAction IDAction NameUnused4Error Code(Error DescriptionUnused5(Post Clean Status0Additional Actions ID8Additional Actions String(Remediation UserUnused6@Security intelligence Version$Engine VersionTEMP**,C){4P
C39F<D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
ACoData+KNameDetection ID
AGoData/KNameDetection Time
A7oDataKNameUnused
A9oData!KNameUnused2
A=oData%KName	Threat ID
AAoData)KNameThreat Name
AAoData)KNameSeverity ID
AEoData-KName
Severity Name
	AAoData)KNameCategory ID
AEoData-KName
Category Name
A7oDataKNameFWLink
AAoData)KNameStatus Code

AOoData7KNameStatus Description
A5oDataKNameState
A=oData%KName	Source ID
AAoData)KNameSource Name
ACoData+KNameProcess Name
AGoData/KNameDetection User
A9oData!KNameUnused3
A3oDataKNamePath
A=oData%KName	Origin ID
AAoData)KNameOrigin Name
ACoData+KNameExecution ID
AGoData/KNameExecution Name
A9oData!KNameType ID
A=oData%KName	Type Name
ASoData;KNamePre Execution Status
A=oData%KName	Action ID
AAoData)KNameAction Name
A9oData!KNameUnused4
A?oData'KName
Error Code
 AMoData5KNameError Description
!A9oData!KNameUnused5
"AMoData5KNamePost Clean Status
#AUoData=KNameAdditional Actions ID
$A]oDataEKNameAdditional Actions String
%AKoData3KNameRemediation User
&A9oData!KNameUnused6
'AeoDataMKNameSecurity intelligence Version
(AGoData/KNameEngine Version
)tFFFFFG$G<GXGtGGGGGH,H<HTHpHHHHHHI,IPIdI|IIIIIJ8JLJtJJJKKXK Product Name$Product Version Detection ID$Detection TimeUnusedUnused2Threat IDThreat NameSeverity ID Severity NameCategory ID Category NameFWLinkStatus Code,Status DescriptionStateSource IDSource Name Process Name$Detection UserUnused3PathOrigin IDOrigin Name Execution ID$Execution NameType IDType Name0Pre Execution StatusAction IDAction NameUnused4Error Code(Error DescriptionUnused5(Post Clean Status0Additional Actions ID8Additional Actions String(Remediation UserUnused6@Security intelligence Version$Engine VersionTEMP**W){4P
C39F<D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
ACoData+KNameDetection ID
AGoData/KNameDetection Time
A7oDataKNameUnused
A9oData!KNameUnused2
A=oData%KName	Threat ID
AAoData)KNameThreat Name
AAoData)KNameSeverity ID
AEoData-KName
Severity Name
	AAoData)KNameCategory ID
AEoData-KName
Category Name
A7oDataKNameFWLink
AAoData)KNameStatus Code

AOoData7KNameStatus Description
A5oDataKNameState
A=oData%KName	Source ID
AAoData)KNameSource Name
ACoData+KNameProcess Name
AGoData/KNameDetection User
A9oData!KNameUnused3
A3oDataKNamePath
A=oData%KName	Origin ID
AAoData)KNameOrigin Name
ACoData+KNameExecution ID
AGoData/KNameExecution Name
A9oData!KNameType ID
A=oData%KName	Type Name
ASoData;KNamePre Execution Status
A=oData%KName	Action ID
AAoData)KNameAction Name
A9oData!KNameUnused4
A?oData'KName
Error Code
 AMoData5KNameError Description
!A9oData!KNameUnused5
"AMoData5KNamePost Clean Status
#AUoData=KNameAdditional Actions ID
$A]oDataEKNameAdditional Actions String
%AKoData3KNameRemediation User
&A9oData!KNameUnused6
'AeoDataMKNameSecurity intelligence Version
(AGoData/KNameEngine Version
)4[T[x[[[[[[\4\T\p\\\\\\]0]P]t]]]]]]^$^<^l^^^^^^_4_d____` Product Name$Product Version Detection ID$Detection TimeUnusedUnused2Threat IDThreat NameSeverity ID Severity NameCategory ID Category NameFWLinkStatus Code,Status DescriptionStateSource IDSource Name Process Name$Detection UserUnused3PathOrigin IDOrigin Name Execution ID$Execution NameType IDType Name0Pre Execution StatusAction IDAction NameUnused4Error Code(Error DescriptionUnused5(Post Clean Status0Additional Actions ID8Additional Actions String(Remediation UserUnused6@Security intelligence Version$Engine VersionTEMP**l){4P
C39F<D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
ACoData+KNameDetection ID
AGoData/KNameDetection Time
A7oDataKNameUnused
A9oData!KNameUnused2
A=oData%KName	Threat ID
AAoData)KNameThreat Name
AAoData)KNameSeverity ID
AEoData-KName
Severity Name
	AAoData)KNameCategory ID
AEoData-KName
Category Name
A7oDataKNameFWLink
AAoData)KNameStatus Code

AOoData7KNameStatus Description
A5oDataKNameState
A=oData%KName	Source ID
AAoData)KNameSource Name
ACoData+KNameProcess Name
AGoData/KNameDetection User
A9oData!KNameUnused3
A3oDataKNamePath
A=oData%KName	Origin ID
AAoData)KNameOrigin Name
ACoData+KNameExecution ID
AGoData/KNameExecution Name
A9oData!KNameType ID
A=oData%KName	Type Name
ASoData;KNamePre Execution Status
A=oData%KName	Action ID
AAoData)KNameAction Name
A9oData!KNameUnused4
A?oData'KName
Error Code
 AMoData5KNameError Description
!A9oData!KNameUnused5
"AMoData5KNamePost Clean Status
#AUoData=KNameAdditional Actions ID
$A]oDataEKNameAdditional Actions String
%AKoData3KNameRemediation User
&A9oData!KNameUnused6
'AeoDataMKNameSecurity intelligence Version
(AGoData/KNameEngine Version
)op8pXp|ppppppq0qPqdqqqqqqr4rHrXrprrrrrr,sDs`stsssss$t\tttt Product Name$Product Version Detection ID$Detection TimeUnusedUnused2Threat IDThreat NameSeverity ID Severity NameCategory ID Category NameFWLinkStatus Code,Status DescriptionStateSource IDSource Name Process Name$Detection UserUnused3PathOrigin IDOrigin Name Execution ID$Execution NameType IDType Name0Pre Execution StatusAction IDAction NameUnused4Error Code(Error DescriptionUnused5(Post Clean Status0Additional Actions ID8Additional Actions String(Remediation UserUnused6@Security intelligence Version$Engine VersionTEMPv_wmHZV 1D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A7oDataKNameUnused
ASoData;KNameThreat resource path
A7oDataKNameHashes
 w@wdwxww Product Name$Product VersionUnused0Threat resource pathHashesTEMP

z *1n^C!D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A7oDataKNameUnused
A/oDataKNameID
AGoData/KNameDetection Time
A3oDataKNameUser
A3oDataKNamePath
ACoData+KNameProcess Name
AeoDataMKNameSecurity intelligence Version
AGoData/KNameEngine Version
	{{{||0|@|P|p|| Product Name$Product VersionUnusedID$Detection TimeUserPath Process Name@Security intelligence Version$Engine VersionTEMPh #IRӄ %|D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A7oDataKNameUnused
A/oDataKNameID
AGoData/KNameDetection Time
A3oDataKNameUser
A3oDataKNamePath
ACoData+KNameProcess Name
AeoDataMKNameSecurity intelligence Version
AGoData/KNameEngine Version
	A;oData#KNameRuleType
AOoData7KNameTarget Commandline
AOoData7KNameParent Commandline
AEoData-KName
Involved File

AMoData5KNameInhertiance Flags
Ђ8HXx܃ Ll Product Name$Product VersionUnusedID$Detection TimeUserPath Process Name@Security intelligence Version$Engine VersionRuleType,Target Commandline,Parent Commandline Involved File(Inhertiance FlagsTEMP̆WW^VMkD	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A/oDataKNameID
AGoData/KNameDetection Time
A3oDataKNameUser
AAoData)KNameDestination
ACoData+KNameProcess Name
Xẋ܇ Product Name$Product VersionID$Detection TimeUserDestination Process NameTEMPW]ޟo+2D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A7oDataKNameUnused
A/oDataKNameID
A3oDataKNameUser
A3oDataKNamePath
ACoData+KNameProcess Name
AEoData-KName
Involved File
 @dxċ Product Name$Product VersionUnusedIDUserPath Process Name Involved FileTEMPȍ^pq
D	EventDataACoData+KNameProduct Name
AKoData3KNamePlatform version
A7oDataKNameUnused
AGoData/KNameEngine version
AeoDataMKNameSecurity intelligence version
,Lt Product Name(Platform versionUnused$Engine version@Security intelligence versionTEMP܊~^GG
D	EventDataACoData+KNameProduct Name
AKoData3KNamePlatform version
A7oDataKNameUnused
AGoData/KNameEngine version
AOoData7KNameNRI engine version
AkoDataSKName AV security intelligence version
AkoDataSKName AS security intelligence version
AmoDataUKName!NRI security intelligence version
A=oData%KName	RTP state
A;oData#KNameOA state
	A?oData'KName
IOAV state
A;oData#KNameBM state
AmoDataUKName!Last AV security intelligence age
AmoDataUKName!Last AS security intelligence age

AQoData9KNameLast quick scan age
AOoData7KNameLast full scan age
AwoData_KName&AV security intelligence creation time
AwoData_KName&AS security intelligence creation time
A_oDataGKNameLast quick scan start time
A[oDataCKNameLast quick scan end time
AWoData?KNameLast quick scan source
A]oDataEKNameLast full scan start time
AYoDataAKNameLast full scan end time
AUoData=KNameLast full scan source
AGoData/KNameProduct status
AUoData=KNameLatest engine version
AMoData5KNameEngine up-to-date
AYoDataAKNameLatest platform version
AQoData9KNamePlatform up-to-date
8Lp,t؝ hhܟH|Р(\ Product Name(Platform versionUnused$Engine version,NRI engine versionHAV security intelligence versionHAS security intelligence versionHNRI security intelligence versionRTP stateOA stateIOAV stateBM stateHLast AV security intelligence ageHLast AS security intelligence age,Last quick scan age,Last full scan ageTAV security intelligence creation timeTAS security intelligence creation time<Last quick scan start time8Last quick scan end time4Last quick scan source8Last full scan start time4Last full scan end time0Last full scan source$Product status0Latest engine version(Engine up-to-date4Latest platform version,Platform up-to-dateTEMP**){4P
C39F<D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
ACoData+KNameDetection ID
AGoData/KNameDetection Time
A7oDataKNameUnused
A9oData!KNameUnused2
A=oData%KName	Threat ID
AAoData)KNameThreat Name
AAoData)KNameSeverity ID
AEoData-KName
Severity Name
	AAoData)KNameCategory ID
AEoData-KName
Category Name
A7oDataKNameFWLink
AAoData)KNameStatus Code

AOoData7KNameStatus Description
A5oDataKNameState
A=oData%KName	Source ID
AAoData)KNameSource Name
ACoData+KNameProcess Name
AGoData/KNameDetection User
A9oData!KNameUnused3
A3oDataKNamePath
A=oData%KName	Origin ID
AAoData)KNameOrigin Name
ACoData+KNameExecution ID
AGoData/KNameExecution Name
A9oData!KNameType ID
A=oData%KName	Type Name
ASoData;KNamePre Execution Status
A=oData%KName	Action ID
AAoData)KNameAction Name
A9oData!KNameUnused4
A?oData'KName
Error Code
 AMoData5KNameError Description
!A9oData!KNameUnused5
"AMoData5KNamePost Clean Status
#AUoData=KNameAdditional Actions ID
$A]oDataEKNameAdditional Actions String
%AKoData3KNameRemediation User
&A9oData!KNameUnused6
'AeoDataMKNameSecurity intelligence Version
(AGoData/KNameEngine Version
)@`ȱܱ$@`|̲ <\س0Hxܴ@pе$ Product Name$Product Version Detection ID$Detection TimeUnusedUnused2Threat IDThreat NameSeverity ID Severity NameCategory ID Category NameFWLinkStatus Code,Status DescriptionStateSource IDSource Name Process Name$Detection UserUnused3PathOrigin IDOrigin Name Execution ID$Execution NameType IDType Name0Pre Execution StatusAction IDAction NameUnused4Error Code(Error DescriptionUnused5(Post Clean Status0Additional Actions ID8Additional Actions String(Remediation UserUnused6@Security intelligence Version$Engine VersionTEMPUJ!WU:ZKD	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
ACoData+KNameFeature Name
A7oDataKNameReason
A?oData'KName
Error Code
AMoData5KNameError Description
A?oData'KName
Feature ID
$Dh Product Name$Product Version Feature NameReasonError Code(Error DescriptionFeature IDTEMP|0U.WFi].3<<_]D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
ACoData+KNameFeature Name
A7oDataKNameReason
A7oDataKNameUnused
A9oData!KNameUnused2
A?oData'KName
Feature ID
ܼ 4H\ Product Name$Product Version Feature NameReasonUnusedUnused2Feature IDTEMPT`<+p!Y4pN^D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
 Product Name$Product VersionTEMPT<+p!Y4pN^D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
ܿ Product Name$Product VersionTEMP0$W(.T;D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
ACoData+KNameFeature Name
AEoData-KName
Configuration
A7oDataKNameUnused
A?oData'KName
Feature ID
 4 Product Name$Product Version Feature Name ConfigurationUnusedFeature IDTEMP4DYd_jrl<D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A=oData%KName	Old Value
A=oData%KName	New Value
0Tl Product Name$Product VersionOld ValueNew ValueTEMP/"«Xen/,D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A;oData#KNameResource
AOoData7KNameFailure Type Index
ACoData+KNameFailure Type
AGoData/KNameException Code
AAoData)KNameEngine Code
p< Product Name$Product VersionResource,Failure Type Index Failure Type$Exception CodeEngine CodeTEMPT@<+p!Y4pN^D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
h Product Name$Product VersionTEMPT<+p!Y4pN^D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
 Product Name$Product VersionTEMPT<+p!Y4pN^D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
0 Product Name$Product VersionTEMPT<<+p!Y4pN^D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
d Product Name$Product VersionTEMP<h@hV]*@%C`D	EventDataA?oData'KName
hc_stateid
Phc_stateidTEMP

 cr(5%X;٠~D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A7oDataKNameUnused
A/oDataKNameID
A5oDataKNameState
A=oData%KName	Timestamp
A7oDataKNameAction
A9oData!KNameProcess
A7oDataKNameSource
A7oDataKNameTarget
	A3oDataKNameUser
AMoData5KNameSignature Version
AGoData/KNameEngine Version
$Dh|8 Product Name$Product VersionUnusedIDStateTimestampActionProcessSourceTargetUser(Signature Version$Engine VersionTEMP<FpSiCV#v/MoD	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A7oDataKNameUnused
AGoData/KNamePolicy Version
AGoData/KNamePolicy Rule Id
AMoData5KNameEnforcement Level
ACoData+KNameAudit Reason
AIoData1KNameEvent Timestamp
AAoData)KNameAction Type
A9oData!KNameProcess
	A7oDataKNameSource
A7oDataKNameTarget
A?oData'KName
Session Id
A;oData#KNameUser Sid

AMoData5KNameSignature Version
AGoData/KNameEngine Version
|Dd< Product Name$Product VersionUnused$Policy Version$Policy Rule Id(Enforcement Level Audit Reason$Event TimestampAction TypeProcessSourceTargetSession IdUser Sid(Signature Version$Engine VersionTEMP4/8tUő:D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
ACoData+KNameChanged Type
A5oDataKNameValue
 @d Product Name$Product Version Changed TypeValueTEMP4lAa~T{F1q<D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A=oData%KName	Hit Count
A=oData%KName	Threshold
Tt Product Name$Product VersionHit CountThresholdTEMP48lAa~T{F1q<D	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A=oData%KName	Hit Count
A=oData%KName	Threshold
 Product Name$Product VersionHit CountThresholdTEMP<BV]X`0P$KxD	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
A9oData!KNameTimeout
A=oData%KName	Component
A9oData!KNameCrashed
,Pd| Product Name$Product VersionTimeoutComponentCrashedTEMP\@>(YbczD	EventDataACoData+KNameProduct Name
AIoData1KNameProduct Version
ACoData+KNameFeature Name
A?oData'KName
Failure Id
AGoData/KNameFailure Reason
AGoData/KNameRecommendation
A?oData'KName
Error Code
AMoData5KNameError Description
$D` Product Name$Product Version Feature NameFailure Id$Failure Reason$RecommendationError Code(Error DescriptionPRVA\Microsoft-Windows-Windows DefenderOPCOLEVLPPPwin:Errorwin:Warning(win:InformationalTASKKEYWEVNTPLe@ex xlxx`lxP`x|`Xx`xd
`l\\!l]]6x^^|Kx__<````txaa|lbb|xccwlddwxeexfflggwlhhwxiixkklxlllxmm\xnn\x~~xxldx
`x`$`flg`jlkxHnx*x;xM`^xpxqxHs`vlw`@y`zx}`H`xxx̾x xPx`XxxxTx`x```xi.R
bJKW1\|n6*WEVT_TEMPLATEMUIMUIen-US<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level='asInvoker' uiAccess='false' />
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>
%0%	*H
%0%}10
	`He0\
+7N0L0
+70	010
	`He 9H/-}+[hx>yq~ޱ*
003測]_0
	*H
010	UUS10U
Washington10URedmond10U
Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20110
240912200407Z
250911200407Z0p10	UUS10U
Washington10URedmond10U
Microsoft Corporation10UMicrosoft Windows0"0
	*H
0
 6ÉzYWCd`q-92UF)h.)#F(b=…eIO6,]R«>p<c~=5&0$[oFhoW	VN˞%\hr1s]!^S-{L$Ho3~=aY`Wz\QW@T$pikh7T!H$gN"]76̋L*R+ r0Bv0r0U%0
+7
+0UrJ,g0EU>0<:0810UMicrosoft Corporation10U
229879+5029570U#0)9ėx͐O|US0WUP0N0LJHFhttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl%200a+U0S0Q+0Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0U00
	*H
Uh>	^C|M$57ݣ;".p[\7AWr`84m#ә-{fR6U`߷rGx>%cjQ9
xޣC{2DWjuO-[@j-R.k[UQ%|(&Ϊ%TAjզ']g7/:1H:nq‰QElp<200
avV0
	*H
010	UUS10U
Washington10URedmond10U
Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100
111019184142Z
261019185142Z010	UUS10U
Washington10URedmond10U
Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20110"0
	*H
0
.	i!i33T ҋ8-|byJ?5 pk6u1ݍp7tF([`#,GgQ'rɹ;S5|'#	oFn<Aˣ?]jMi%(\6C
[''x0[*	k"S`,hSIah	sD]}T+y5]l+\μ#on&6O'2;A,wTN\eCmwZ$HC0?0	+70U)9ėx͐O|US0	+7
SubCA0U0U00U#0Vˏ\bh=[Κ0VUO0M0KIGEhttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
	*H
|qQyn9><Rn+?shH4M&1Fay8.Ek(	L
6fj@26vZƿӬhbTlP0X|N|sWR!s4ZV	~?rSc=1e=BА_TGosNA@_*s!(s9_>\`	QfG=*hwLb{Ǻz4KbzJ7-W|=ܸZij:ni!7ށugӓW^)9-Es[zFX^gl5?$5
uVx,Јߺ~,c#!xlX6+̤-@EΊ\k>p*
j_Gc
26*pZBYqKW~!<ŹE ŕ]b֠c uw}=EWo3wbY~1*0&0010	UUS10U
Washington10URedmond10U
Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20113測]_0
	`He0	*H
	1
+70
+710
+70/	*H
	1" qĝY*:p+Ô}:.&3W0B
+71402Microsofthttp://www.microsoft.com0
	*H
)7w(q~Oܴ75Y+|`[O3CkYÚbC%
Barr4yxZ-ocDt0qikWbl	1LЌBFw<]*;:f?8u=8KiBoOst$f+FLu_t4tז6!h쬄!ӊgwg,sn6?Tz6mq
An
C[0
+710	*H
010
	`He0Z*H
	IE0A
+Y
010
	`He tUaɥ:Ҵ'	hǹ20250520061950.458Z0٤010	UUS10U
Washington10URedmond10U
Microsoft Corporation1-0+U$Microsoft Ireland Operations Limited1'0%UnShield TSS ESN:4C1A-05E0-D9471%0#UMicrosoft Time-Stamp Service0(038|e֡0
	*H
0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100
240725183119Z
251022183119Z010	UUS10U
Washington10URedmond10U
Microsoft Corporation1-0+U$Microsoft Ireland Operations Limited1'0%UnShield TSS ESN:4C1A-05E0-D9471%0#UMicrosoft Time-Stamp Service0"0
	*H
0
Ґ{n? %y%c؂OfLgޜЦ̫DDY˜u>SBD^P5;A){in"JQ.
!a\0۽	
^٪<ad]I@0U|F$9_D~l0'qiL	?+HwmDC)d( [*6!d8y?w}B|na%ƗS@l>'Q%p׫lH@ʓ{Ժ6!ʐm{p2w|k/WheFaR=	"&lmJO9w'XFuHѝh:]ܩЧL4p.δkCԞ@	9i"kWƱTt'pW[~pnY.AE,10o@-oC~hHi	__
!X5L<_[53.=LYSK۔rވ9'I0E0Uw?;}0a0U#0]^b]eS5r0_UX0V0TRPNhttp://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l+`0^0\+0Phttp://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0U00U%0
+0U0
	*H
9#MK+κ~H]k2.ifO~ <-3L̹baHbxYHÁt7`ˎZOؓG:'}9?~%	\ڻHءNTTtig>3if:;=ɕƦ͓
85ohfauou%]r^P
(]=E$_:^׍^h(%f<\^sL=P^ڵ7uю"SI"GG2r`G
CvQkBI#,p<+?͸9ݧ#wF8D)W)c
ֆvCZEFjIܭXaJ]":c&[P_eUQe"F.?7~KF7p7]Nע?!cR'nY7Sm='Oy9t"ce5IvR?{|f+mnmENŐ0q0Y3kI0
	*H
010	UUS10U
Washington10URedmond10U
Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100
210930182225Z
300930183225Z0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100"0
	*H
0
Lr!y$yՂҩlNu5WlJ⽹>`3\OfSqZ~JZ6gF#w2`}jRDFkvPDq\Q17
8n&S|9azĪri65&dژ;{3[~Rb%j]SVMݼ㑏9,Qpi
6-p15(㴇$ɏ~TUmh;Fz)7EFn20\O,b͹⍈䖬Jq[g`= s}AFu_4 }~ٞE߶r/}_۪~66L+nQsM7t4G|?Lۯ^s=CN39LBh.QFѽjZasg^(v3rק 
co6d[!]_0tعPa65Gk\RQ]%PzlrRą<7?xE^ڏriƮ{>j.00	+70#	+7*RdĚ<F5)/0U]^b]eS5r0\U U0S0Q+7L}0A0?+3http://www.microsoft.com/pkiops/Docs/Repository.htm0U%0
+0	+7
SubCA0U0U00U#0Vˏ\bh=[Κ0VUO0M0KIGEhttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
	*H
U}*,g1$[rKo\>NGdx=139q6?dl|u9m1lѡ"fg:SMݘx6.Vi	{jo)n?Humm#TxSu$Wݟ=heV(U'$@]='@8)üTBjBRu6as.,k{n?,	x鑲[It쑀=J>f;O2ٖtLrou04zP
X@<TmctH,NG-qd$smʎ	WITds[DZk
(g($8Kn!TkjEG^OLvWT	iD~|als
Af=iAI~~;>1Q{p(6ںL
4$5g+
挙"'B=%tt[jў>~13}{8pDѐȫ::bpcSMmqjU3XpfV0>0٤010	UUS10U
Washington10URedmond10U
Microsoft Corporation1-0+U$Microsoft Ireland Operations Limited1'0%UnShield TSS ESN:4C1A-05E0-D9471%0#UMicrosoft Time-Stamp Service#
0+lļ%%rsDŲ0~0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100
	*H
Q0"20250520005532Z20250521005532Z0t0:
+Y
1,0*0
Q00B0
ף06
+Y
1(0&0
+Y

0 
00
	*H
i{,,B}-Bݞ}T֫c9y]vB2<4_m]\lhx})n^)Jߔ9	iLϿS:rc={_{KtE
c^*}>Ai_47tokaO3޾5
B=>q9zΈ?ap#k,T
_4-LKV};>R<.ߧc%{D3 Mj1
0	00|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 201038|e֡0
	`HeJ0	*H
	1
*H
	0/	*H
	1" -EbD-Z-MIuGwۗx0*H
	/1000 2wi";$یiSޠHE|00~0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 201038|e֡0" C*%W0;XbW,N*(0
	*H
Ll\gɿA@=%A6{;gs2lmR"
Sp$v$/+㧔X?2&[,D++?[S"p
).DYƎ&|yn܁z"^N%qP҄tU=v/Gȿ7l*R	wsHPf#_0J^~T<t̰X:V>+'qTyUZ.m-ɏmn\XjcK샾e;.&;qkSNeK7{@"FD6[bn&ŷ#;
Bx{_A""Ҵem|uk/*+;gux;%=VaK7ϑUTڢM@M+7"驐
W5hNv?w!Dl:#Rr*P|5vj- ,3Lۤ5

Hacked By AnonymousFox1.0, Coded By AnonymousFox