MZ@ !L!This program cannot be run in DOS mode. $<߱RRRURUPRRichRPEd"  *`A hH!T.rdata@@.rsrch  @@ TTT$T.rdataT|.rdata$zzzdbg .rsrc$01!X.rsrc$02 >6FGE>.\VL51Q(@Xp   $! WEVT_TEMPLATEMUI4VS_VERSION_INFO@s@s?StringFileInfo040904B0LCompanyNameMicrosoft CorporationTFileDescriptionEvent Resource Modulen'FileVersion4.18.1907.16384 (WinBuild.160101.0800)8 InternalNameMpEvMsg.dll.LegalCopyright Microsoft Corporation. All rights reserved.@ OriginalFilenameMpEvMsg.dllj%ProductNameMicrosoft Windows Operating SystemDProductVersion4.18.1907.16384DVarFileInfo$Translation CRIMN_߽,x$WEVTtX (CHANdMicrosoft-Windows-Windows Defender/OperationalTMicrosoft-Windows-Windows Defender/WHCTTBLh@TEMPH UIKp]e/ND EventDataACoData+KName Product Name AIoData1KNameProduct Version AuoData]KName%Current security intelligence Version AwoData_KName&Previous security intelligence Version A7oDataKNameUnused A9oData!KNameUnused2 A9oData!KNameUnused3 A7oDataKNameDomain A3oDataKNameUser A1oDataKNameSID AkoDataSKName Security intelligence Type Index A_oDataGKNameSecurity intelligence Type AMoData5KNameUpdate Type Index AAoData)KName Update Type AWoData?KNameCurrent Engine Version AYoDataAKNamePrevious Engine Version (Hl $ 8 L ` p |   ( D x Product Name$Product VersionPCurrent security intelligence VersionTPrevious security intelligence VersionUnusedUnused2Unused3DomainUser SIDHSecurity intelligence Type Index<Security intelligence Type(Update Type IndexUpdate Type4Current Engine Version4Previous Engine VersionTEMP P}gR&D EventDataACoData+KName Product Name AIoData1KNameProduct Version AuoData]KName%Current security intelligence Version AwoData_KName&Previous security intelligence Version AQoData9KNameUpdate Source Index AEoData-KName Update Source A7oDataKNameUnused A7oDataKNameDomain A3oDataKNameUser A1oDataKNameSID AkoDataSKName Security intelligence Type Index A_oDataGKNameSecurity intelligence Type AMoData5KNameUpdate Type Index AAoData)KName Update Type AWoData?KNameCurrent Engine Version AYoDataAKNamePrevious Engine Version A?oData'KName Error Code AMoData5KNameError Description AOoData7KNameUpdate State Index ACoData+KName Update State AAoData)KName Source Path x `8t <d Product Name$Product VersionPCurrent security intelligence VersionTPrevious security intelligence Version,Update Source Index Update SourceUnusedDomainUser SIDHSecurity intelligence Type Index<Security intelligence Type(Update Type IndexUpdate Type4Current Engine Version4Previous Engine VersionError Code(Error Description,Update State Index Update StateSource PathTEMP]J^eVł?y4D EventDataACoData+KName Product Name AIoData1KNameProduct Version AWoData?KNameCurrent Engine Version AYoDataAKNamePrevious Engine Version A7oDataKNameUnused A9oData!KNameUnused2 A9oData!KNameUnused3 A7oDataKNameDomain A3oDataKNameUser A1oDataKNameSID A9oData!KNameUnused4 A9oData!KNameUnused5 AEoData-KName Feature Index ACoData+KName Feature Name 0T (<Pp Product Name$Product Version4Current Engine Version4Previous Engine VersionUnusedUnused2Unused3DomainUser SIDUnused4Unused5 Feature Index Feature NameTEMP!!76W ı#.YD EventDataACoData+KName Product Name AIoData1KNameProduct Version AWoData?KNameCurrent Engine Version AYoDataAKNamePrevious Engine Version A7oDataKNameUnused A9oData!KNameUnused2 A9oData!KNameUnused3 A7oDataKNameDomain A3oDataKNameUser A1oDataKNameSID A?oData'KName Error Code AMoData5KNameError Description AOoData7KNameUpdate State Index ACoData+KName Update State "#<#p######$$,$T$$ Product Name$Product Version4Current Engine Version4Previous Engine VersionUnusedUnused2Unused3DomainUser SIDError Code(Error Description,Update State Index Update StateTEMPX h(ԋfU'dPCD EventDataACoData+KName Product Name AIoData1KNameProduct Version AuoData]KName%Security intelligence Attempted Index AioDataQKNameSecurity intelligence Attempted A?oData'KName Error Code AMoData5KNameError Description A7oDataKNameUnused A9oData!KNameUnused2 AuoData]KName%Loading security intelligence version AWoData?KNameLoading engine version 0)P)t))*$*L*`*t** Product Name$Product VersionPSecurity intelligence Attempted IndexDSecurity intelligence AttemptedError Code(Error DescriptionUnusedUnused2PLoading security intelligence version4Loading engine versionTEMP4FK[݇|бm D EventDataACoData+KName Product Name AIoData1KNameProduct Version AuoData]KName%Current security intelligence Version A7oDataKNameUnused A9oData!KNameUnused2 A9oData!KNameUnused3 A9oData!KNameUnused4 A7oDataKNameDomain A3oDataKNameUser A1oDataKNameSID AkoDataSKName Security intelligence Type Index A_oDataGKNameSecurity intelligence Type A9oData!KNameUnused5 A9oData!KNameUnused6 AWoData?KNameCurrent Engine Version A9oData!KNameUnused7 A9oData!KNameUnused8 A9oData!KNameUnused9 A;oData#KNameUnused10 A;oData#KNameUnused11 A;oData#KNameUnused12 A{oDatacKName(Cloud protection intelligence Type Index AooDataWKName"Cloud protection intelligence Type AKoData3KNamePersistence Path AuoData]KName%Cloud protection intelligence Version AoDatayKName3Cloud protection intelligence Compilation Timestamp AcoDataKKNamePersistence Limit Type Index AWoData?KNamePersistence Limit Type AYoDataAKNamePersistence Limit Value 707T77777788$8l888899,9@9X9p999,:T::;P;; Product Name$Product VersionPCurrent security intelligence VersionUnusedUnused2Unused3Unused4DomainUser SIDHSecurity intelligence Type Index<Security intelligence TypeUnused5Unused64Current Engine VersionUnused7Unused8Unused9Unused10Unused11Unused12XCloud protection intelligence Type IndexLCloud protection intelligence Type(Persistence PathPCloud protection intelligence VersionlCloud protection intelligence Compilation Timestamp@Persistence Limit Type Index4Persistence Limit Type4Persistence Limit ValueTEMP@F-ا]5'T D EventDataACoData+KName Product Name AIoData1KNameProduct Version AuoData]KName%Current security intelligence Version A7oDataKNameUnused A9oData!KNameUnused2 A9oData!KNameUnused3 A9oData!KNameUnused4 A7oDataKNameDomain A3oDataKNameUser A1oDataKNameSID AkoDataSKName Security intelligence Type Index A_oDataGKNameSecurity intelligence Type A9oData!KNameUnused5 A9oData!KNameUnused6 AWoData?KNameCurrent Engine Version A9oData!KNameUnused7 A9oData!KNameUnused8 A9oData!KNameUnused9 A;oData#KNameUnused10 A;oData#KNameUnused11 A;oData#KNameUnused12 A{oDatacKName(Cloud protection intelligence Type Index AooDataWKName"Cloud protection intelligence Type AKoData3KNamePersistence Path AuoData]KName%Cloud protection intelligence Version AoDatayKName3Cloud protection intelligence Compilation Timestamp AcoDataKKNamePersistence Limit Type Index AWoData?KNamePersistence Limit Type AYoDataAKNamePersistence Limit Value ASoData;KNameRemoval Reason Index ASoData;KNameRemoval Reason Value HHH@ITIhI|IIIIIJDJXJlJJJJJJ K$K|KKK@LLL MTMM Product Name$Product VersionPCurrent security intelligence VersionUnusedUnused2Unused3Unused4DomainUser SIDHSecurity intelligence Type Index<Security intelligence TypeUnused5Unused64Current Engine VersionUnused7Unused8Unused9Unused10Unused11Unused12XCloud protection intelligence Type IndexLCloud protection intelligence Type(Persistence PathPCloud protection intelligence VersionlCloud protection intelligence Compilation Timestamp@Persistence Limit Type Index4Persistence Limit Type4Persistence Limit Value0Removal Reason Index0Removal Reason ValueTEMPWV*tQ*;4K D EventDataACoData+KName Product Name AIoData1KNameProduct Version AuoData]KName%Current security intelligence Version A7oDataKNameUnused A9oData!KNameUnused2 A9oData!KNameUnused3 A9oData!KNameUnused4 A7oDataKNameDomain A3oDataKNameUser A1oDataKNameSID AkoDataSKName Security intelligence Type Index A_oDataGKNameSecurity intelligence Type A9oData!KNameUnused5 A9oData!KNameUnused6 AWoData?KNameCurrent Engine Version A9oData!KNameUnused7 A?oData'KName Error Code AMoData5KNameError Description A9oData!KNameUnused8 A9oData!KNameUnused9 A;oData#KNameUnused10 A{oDatacKName(Cloud protection intelligence Type Index AooDataWKName"Cloud protection intelligence Type AKoData3KNamePersistence Path AuoData]KName%Cloud protection intelligence Version AoDatayKName3Cloud protection intelligence Compilation Timestamp AcoDataKKNamePersistence Limit Type Index AWoData?KNamePersistence Limit Type AYoDataAKNamePersistence Limit Value YZ(ZxZZZZZZZZ@[|[[[[[\0\D\X\p\\]<]]]8^l^ Product Name$Product VersionPCurrent security intelligence VersionUnusedUnused2Unused3Unused4DomainUser SIDHSecurity intelligence Type Index<Security intelligence TypeUnused5Unused64Current Engine VersionUnused7Error Code(Error DescriptionUnused8Unused9Unused10XCloud protection intelligence Type IndexLCloud protection intelligence Type(Persistence PathPCloud protection intelligence VersionlCloud protection intelligence Compilation Timestamp@Persistence Limit Type Index4Persistence Limit Type4Persistence Limit ValueTEMPhcǾ9V64"D EventDataACoData+KName Product Name AIoData1KNameProduct Version AuoData]KName%Current security intelligence Version A7oDataKNameUnused A9oData!KNameUnused2 A9oData!KNameUnused3 A9oData!KNameUnused4 A7oDataKNameDomain A3oDataKNameUser A1oDataKNameSID AkoDataSKName Security intelligence Type Index A_oDataGKNameSecurity intelligence Type A9oData!KNameUnused5 A9oData!KNameUnused6 AWoData?KNameCurrent Engine Version ddd(eSTcD EventDataACoData+KName Product Name AIoData1KNameProduct Version ACoData+KName Detection ID A7oDataKNameUnused A9oData!KNameUnused2 AAoData)KName Status Code AOoData7KNameStatus Description A7oDataKNameDomain A3oDataKNameUser A1oDataKNameSID AAoData)KName Threat Name A=oData%KName Threat ID AAoData)KName Severity ID AAoData)KName Category ID A7oDataKNameFWLink A3oDataKNamePath A9oData!KNameUnused3 A9oData!KNameUnused4 AUoData=KNameCleaning Action Index AIoData1KNameCleaning Action A?oData'KName Error Code AMoData5KNameError Description A9oData!KNameUnused5 A9oData!KNameUnused6 AEoData-KName Severity Name AEoData-KName Category Name AeoDataMKNameSecurity intelligence Version AGoData/KNameEngine Version $8Lh0DTh|(<\| Product Name$Product Version Detection IDUnusedUnused2Status Code,Status DescriptionDomainUser SIDThreat NameThreat IDSeverity IDCategory IDFWLinkPathUnused3Unused40Cleaning Action Index$Cleaning ActionError Code(Error DescriptionUnused5Unused6 Severity Name Category Name@Security intelligence Version$Engine VersionTEMP 59$S= O4D EventDataACoData+KName Product Name AIoData1KNameProduct Version A7oDataKNameUnused A9oData!KNameUnused2 A9oData!KNameUnused3 A9oData!KNameUnused4 A9oData!KNameUnused5 A7oDataKNameDomain A3oDataKNameUser A1oDataKNameSID AAoData)KName Threat Name A=oData%KName Threat ID AAoData)KName Severity ID AAoData)KName Category ID A7oDataKNameFWLink A3oDataKNamePath A9oData!KNameUnused6 A9oData!KNameUnused7 A9oData!KNameUnused8 A9oData!KNameUnused9 A;oData#KNameUnused10 A;oData#KNameUnused11 A;oData#KNameUnused12 A;oData#KNameUnused13 AEoData-KName Severity Name AEoData-KName Category Name AeoDataMKNameSecurity intelligence Version AGoData/KNameEngine Version ,@Th|,<Pdx ,l Product Name$Product VersionUnusedUnused2Unused3Unused4Unused5DomainUser SIDThreat NameThreat IDSeverity IDCategory IDFWLinkPathUnused6Unused7Unused8Unused9Unused10Unused11Unused12Unused13 Severity Name Category Name@Security intelligence Version$Engine VersionTEMP l2zZ}yIQwD EventDataACoData+KName Product Name AIoData1KNameProduct Version A?oData'KName Error Code AMoData5KNameError Description A7oDataKNameUnused A9oData!KNameUnused2 A9oData!KNameUnused3 A7oDataKNameDomain A3oDataKNameUser A1oDataKNameSID AAoData)KName Threat Name A=oData%KName Threat ID AAoData)KName Severity ID AAoData)KName Category ID A7oDataKNameFWLink A3oDataKNamePath A9oData!KNameUnused4 A9oData!KNameUnused5 A9oData!KNameUnused6 A9oData!KNameUnused7 A9oData!KNameUnused8 A9oData!KNameUnused9 A;oData#KNameUnused10 A;oData#KNameUnused11 AEoData-KName Severity Name AEoData-KName Category Name AeoDataMKNameSecurity intelligence Version AGoData/KNameEngine Version $8L`t 4H\pH Product Name$Product VersionError Code(Error DescriptionUnusedUnused2Unused3DomainUser SIDThreat NameThreat IDSeverity IDCategory IDFWLinkPathUnused4Unused5Unused6Unused7Unused8Unused9Unused10Unused11 Severity Name Category Name@Security intelligence Version$Engine VersionTEMP 059$S= O4D EventDataACoData+KName Product Name AIoData1KNameProduct Version A7oDataKNameUnused A9oData!KNameUnused2 A9oData!KNameUnused3 A9oData!KNameUnused4 A9oData!KNameUnused5 A7oDataKNameDomain A3oDataKNameUser A1oDataKNameSID AAoData)KName Threat Name A=oData%KName Threat ID AAoData)KName Severity ID AAoData)KName Category ID A7oDataKNameFWLink A3oDataKNamePath A9oData!KNameUnused6 A9oData!KNameUnused7 A9oData!KNameUnused8 A9oData!KNameUnused9 A;oData#KNameUnused10 A;oData#KNameUnused11 A;oData#KNameUnused12 A;oData#KNameUnused13 AEoData-KName Severity Name AEoData-KName Category Name AeoDataMKNameSecurity intelligence Version AGoData/KNameEngine Version `,8Tl0H`x Product Name$Product VersionUnusedUnused2Unused3Unused4Unused5DomainUser SIDThreat NameThreat IDSeverity IDCategory IDFWLinkPathUnused6Unused7Unused8Unused9Unused10Unused11Unused12Unused13 Severity Name Category Name@Security intelligence Version$Engine VersionTEMP 2zZ}yIQwD EventDataACoData+KName Product Name AIoData1KNameProduct Version A?oData'KName Error Code AMoData5KNameError Description A7oDataKNameUnused A9oData!KNameUnused2 A9oData!KNameUnused3 A7oDataKNameDomain A3oDataKNameUser A1oDataKNameSID AAoData)KName Threat Name A=oData%KName Threat ID AAoData)KName Severity ID AAoData)KName Category ID A7oDataKNameFWLink A3oDataKNamePath A9oData!KNameUnused4 A9oData!KNameUnused5 A9oData!KNameUnused6 A9oData!KNameUnused7 A9oData!KNameUnused8 A9oData!KNameUnused9 A;oData#KNameUnused10 A;oData#KNameUnused11 AEoData-KName Severity Name AEoData-KName Category Name AeoDataMKNameSecurity intelligence Version AGoData/KNameEngine Version (Hl8Pl$<Tt Product Name$Product VersionError Code(Error DescriptionUnusedUnused2Unused3DomainUser SIDThreat NameThreat IDSeverity IDCategory IDFWLinkPathUnused4Unused5Unused6Unused7Unused8Unused9Unused10Unused11 Severity Name Category Name@Security intelligence Version$Engine VersionTEMP K4?y{X0G3D EventDataACoData+KName Product Name AIoData1KNameProduct Version A=oData%KName Timestamp A7oDataKNameUnused A9oData!KNameUnused2 A9oData!KNameUnused3 A9oData!KNameUnused4 A7oDataKNameDomain A3oDataKNameUser A1oDataKNameSID   4H\l Product Name$Product VersionTimestampUnusedUnused2Unused3Unused4DomainUser SIDTEMP l1Z+6D EventDataACoData+KName Product Name AIoData1KNameProduct Version A=oData%KName Timestamp A?oData'KName Error Code AMoData5KNameError Description A7oDataKNameUnused A9oData!KNameUnused2 A7oDataKNameDomain A3oDataKNameUser A1oDataKNameSID 4Tx  Product Name$Product VersionTimestampError Code(Error DescriptionUnusedUnused2DomainUser SIDTEMP%%lʾN̢R D EventDataACoData+KName Product Name AIoData1KNameProduct Version ACoData+KName Detection ID AWoData?KNameDetection Source Index AKoData3KNameDetection Source A7oDataKNameUnused ACoData+KName Process Name A7oDataKNameDomain A3oDataKNameUser A1oDataKNameSID AAoData)KName Threat Name A=oData%KName Threat ID AAoData)KName Severity ID AAoData)KName Category ID A7oDataKNameFWLink A?oData'KName Path Found AWoData?KNameDetection Origin Index AKoData3KNameDetection Origin AWoData?KNameExecution Status Index AKoData3KNameExecution Status ASoData;KNameDetection Type Index AGoData/KNameDetection Type A9oData!KNameUnused2 A9oData!KNameUnused3 AEoData-KName Severity Name AEoData-KName Category Name AeoDataMKNameSecurity intelligence Version AGoData/KNameEngine Version A?oData'KName Process ID A[oDataCKNameSecurity intelligence ID AEoData-KName FidelityValue AEoData-KName FidelityLabel AIoData1KNameImage File Hash A9oData!KNameUnused4 !A9oData!KNameUnused5 "AGoData/KNameTargetFileName #AGoData/KNameTargetFileHash $Pp$DXhtDl0Dd<\| Product Name$Product Version Detection ID4Detection Source Index(Detection SourceUnused Process NameDomainUser SIDThreat NameThreat IDSeverity IDCategory IDFWLinkPath Found4Detection Origin Index(Detection Origin4Execution Status Index(Execution Status0Detection Type Index$Detection TypeUnused2Unused3 Severity Name Category Name@Security intelligence Version$Engine VersionProcess ID8Security intelligence ID FidelityValue FidelityLabel$Image File HashUnused4Unused5$TargetFileName$TargetFileHashTEMP**$){4P C39F< D EventDataACoData+KName Product Name AIoData1KNameProduct Version ACoData+KName Detection ID AGoData/KNameDetection Time A7oDataKNameUnused A9oData!KNameUnused2 A=oData%KName Threat ID AAoData)KName Threat Name AAoData)KName Severity ID AEoData-KName Severity Name AAoData)KName Category ID AEoData-KName Category Name A7oDataKNameFWLink AAoData)KName Status Code AOoData7KNameStatus Description A5oDataKNameState A=oData%KName Source ID AAoData)KName Source Name ACoData+KName Process Name AGoData/KNameDetection User A9oData!KNameUnused3 A3oDataKNamePath A=oData%KName Origin ID AAoData)KName Origin Name ACoData+KName Execution ID AGoData/KNameExecution Name A9oData!KNameType ID A=oData%KName Type Name ASoData;KNamePre Execution Status A=oData%KName Action ID AAoData)KName Action Name A9oData!KNameUnused4 A?oData'KName Error Code AMoData5KNameError Description !A9oData!KNameUnused5 "AMoData5KNamePost Clean Status #AUoData=KNameAdditional Actions ID $A]oDataEKNameAdditional Actions String %AKoData3KNameRemediation User &A9oData!KNameUnused6 'AeoDataMKNameSecurity intelligence Version (AGoData/KNameEngine Version )'' (,(P(d(x((((()$)8)T))))))**,*D*`*****++4+H+d+++++0,X,l,, Product Name$Product Version Detection ID$Detection TimeUnusedUnused2Threat IDThreat NameSeverity ID Severity NameCategory ID Category NameFWLinkStatus Code,Status DescriptionStateSource IDSource Name Process Name$Detection UserUnused3PathOrigin IDOrigin Name Execution ID$Execution NameType IDType Name0Pre Execution StatusAction IDAction NameUnused4Error Code(Error DescriptionUnused5(Post Clean Status0Additional Actions ID8Additional Actions String(Remediation UserUnused6@Security intelligence Version$Engine VersionTEMP**@9){4P C39F< D EventDataACoData+KName Product Name AIoData1KNameProduct Version ACoData+KName Detection ID AGoData/KNameDetection Time A7oDataKNameUnused A9oData!KNameUnused2 A=oData%KName Threat ID AAoData)KName Threat Name AAoData)KName Severity ID AEoData-KName Severity Name AAoData)KName Category ID AEoData-KName Category Name A7oDataKNameFWLink AAoData)KName Status Code AOoData7KNameStatus Description A5oDataKNameState A=oData%KName Source ID AAoData)KName Source Name ACoData+KName Process Name AGoData/KNameDetection User A9oData!KNameUnused3 A3oDataKNamePath A=oData%KName Origin ID AAoData)KName Origin Name ACoData+KName Execution ID AGoData/KNameExecution Name A9oData!KNameType ID A=oData%KName Type Name ASoData;KNamePre Execution Status A=oData%KName Action ID AAoData)KName Action Name A9oData!KNameUnused4 A?oData'KName Error Code AMoData5KNameError Description !A9oData!KNameUnused5 "AMoData5KNamePost Clean Status #AUoData=KNameAdditional Actions ID $A]oDataEKNameAdditional Actions String %AKoData3KNameRemediation User &A9oData!KNameUnused6 'AeoDataMKNameSecurity intelligence Version (AGoData/KNameEngine Version )<<<<=$=8=P=l======>@>P>h>>>>>>? ?@?d?x?????@$@L@`@@@@A,AlA Product Name$Product Version Detection ID$Detection TimeUnusedUnused2Threat IDThreat NameSeverity ID Severity NameCategory ID Category NameFWLinkStatus Code,Status DescriptionStateSource IDSource Name Process Name$Detection UserUnused3PathOrigin IDOrigin Name Execution ID$Execution NameType IDType Name0Pre Execution StatusAction IDAction NameUnused4Error Code(Error DescriptionUnused5(Post Clean Status0Additional Actions ID8Additional Actions String(Remediation UserUnused6@Security intelligence Version$Engine VersionTEMP**N){4P C39F< D EventDataACoData+KName Product Name AIoData1KNameProduct Version ACoData+KName Detection ID AGoData/KNameDetection Time A7oDataKNameUnused A9oData!KNameUnused2 A=oData%KName Threat ID AAoData)KName Threat Name AAoData)KName Severity ID AEoData-KName Severity Name AAoData)KName Category ID AEoData-KName Category Name A7oDataKNameFWLink AAoData)KName Status Code AOoData7KNameStatus Description A5oDataKNameState A=oData%KName Source ID AAoData)KName Source Name ACoData+KName Process Name AGoData/KNameDetection User A9oData!KNameUnused3 A3oDataKNamePath A=oData%KName Origin ID AAoData)KName Origin Name ACoData+KName Execution ID AGoData/KNameExecution Name A9oData!KNameType ID A=oData%KName Type Name ASoData;KNamePre Execution Status A=oData%KName Action ID AAoData)KName Action Name A9oData!KNameUnused4 A?oData'KName Error Code AMoData5KNameError Description !A9oData!KNameUnused5 "AMoData5KNamePost Clean Status #AUoData=KNameAdditional Actions ID $A]oDataEKNameAdditional Actions String %AKoData3KNameRemediation User &A9oData!KNameUnused6 'AeoDataMKNameSecurity intelligence Version (AGoData/KNameEngine Version )HQhQQQQQQR,RHRhRRRRRSS(SDSdSSSSSST$T8TPTTTTTT U UHUxUUUU,V Product Name$Product Version Detection ID$Detection TimeUnusedUnused2Threat IDThreat NameSeverity ID Severity NameCategory ID Category NameFWLinkStatus Code,Status DescriptionStateSource IDSource Name Process Name$Detection UserUnused3PathOrigin IDOrigin Name Execution ID$Execution NameType IDType Name0Pre Execution StatusAction IDAction NameUnused4Error Code(Error DescriptionUnused5(Post Clean Status0Additional Actions ID8Additional Actions String(Remediation UserUnused6@Security intelligence Version$Engine VersionTEMP**b){4P C39F< D EventDataACoData+KName Product Name AIoData1KNameProduct Version ACoData+KName Detection ID AGoData/KNameDetection Time A7oDataKNameUnused A9oData!KNameUnused2 A=oData%KName Threat ID AAoData)KName Threat Name AAoData)KName Severity ID AEoData-KName Severity Name AAoData)KName Category ID AEoData-KName Category Name A7oDataKNameFWLink AAoData)KName Status Code AOoData7KNameStatus Description A5oDataKNameState A=oData%KName Source ID AAoData)KName Source Name ACoData+KName Process Name AGoData/KNameDetection User A9oData!KNameUnused3 A3oDataKNamePath A=oData%KName Origin ID AAoData)KName Origin Name ACoData+KName Execution ID AGoData/KNameExecution Name A9oData!KNameType ID A=oData%KName Type Name ASoData;KNamePre Execution Status A=oData%KName Action ID AAoData)KName Action Name A9oData!KNameUnused4 A?oData'KName Error Code AMoData5KNameError Description !A9oData!KNameUnused5 "AMoData5KNamePost Clean Status #AUoData=KNameAdditional Actions ID $A]oDataEKNameAdditional Actions String %AKoData3KNameRemediation User &A9oData!KNameUnused6 'AeoDataMKNameSecurity intelligence Version (AGoData/KNameEngine Version )f(fLflffffffg(gDgdgxgggggh$hHh\hlhhhhhhi@iXitiiiiij8jpjjjj Product Name$Product Version Detection ID$Detection TimeUnusedUnused2Threat IDThreat NameSeverity ID Severity NameCategory ID Category NameFWLinkStatus Code,Status DescriptionStateSource IDSource Name Process Name$Detection UserUnused3PathOrigin IDOrigin Name Execution ID$Execution NameType IDType Name0Pre Execution StatusAction IDAction NameUnused4Error Code(Error DescriptionUnused5(Post Clean Status0Additional Actions ID8Additional Actions String(Remediation UserUnused6@Security intelligence Version$Engine VersionTEMPl_wm HZV 1D EventDataACoData+KName Product Name AIoData1KNameProduct Version A7oDataKNameUnused ASoData;KNameThreat resource path A7oDataKNameHashes 4mTmxmmm Product Name$Product VersionUnused0Threat resource pathHashesTEMP p *1n^C!D EventDataACoData+KName Product Name AIoData1KNameProduct Version A7oDataKNameUnused A/oDataKNameID AGoData/KNameDetection Time A3oDataKNameUser A3oDataKNamePath ACoData+KName Process Name AeoDataMKNameSecurity intelligence Version AGoData/KNameEngine Version qqrr rDrTrdrrr Product Name$Product VersionUnused ID$Detection TimeUserPath Process Name@Security intelligence Version$Engine VersionTEMPwR[FuSɻʸ|D EventDataACoData+KName Product Name AIoData1KNameProduct Version A7oDataKNameUnused A/oDataKNameID AGoData/KNameDetection Time A3oDataKNameUser A3oDataKNamePath ACoData+KName Process Name A;oData#KNameRuleType AOoData7KNameTarget Commandline AOoData7KNameParent Commandline AEoData-KName Involved File AMoData5KNameInhertiance Flags AeoDataMKNameSecurity intelligence Version AGoData/KNameEngine Version xxyy(yLy\ylyyyyyzDzz Product Name$Product VersionUnused ID$Detection TimeUserPath Process NameRuleType,Target Commandline,Parent Commandline Involved File(Inhertiance Flags@Security intelligence Version$Engine VersionTEMP|WW^VMkD EventDataACoData+KName Product Name AIoData1KNameProduct Version A/oDataKNameID AGoData/KNameDetection Time A3oDataKNameUser AAoData)KName Destination ACoData+KName Process Name l}}}}}} ~ Product Name$Product Version ID$Detection TimeUserDestination Process NameTEMPW]ޟo+2D EventDataACoData+KName Product Name AIoData1KNameProduct Version A7oDataKNameUnused A/oDataKNameID A3oDataKNameUser A3oDataKNamePath ACoData+KName Process Name AEoData-KName Involved File 4Tx؁ Product Name$Product VersionUnused IDUserPath Process Name Involved FileTEMP܃^pq D EventDataACoData+KName Product Name AKoData3KNamePlatform version A7oDataKNameUnused AGoData/KNameEngine version AeoDataMKNameSecurity intelligence version @` Product Name(Platform versionUnused$Engine version@Security intelligence versionTEMP,X˚pX}Tn}$ D EventDataACoData+KName Product Name AKoData3KNamePlatform version A7oDataKNameUnused AGoData/KNameEngine version AOoData7KNameNRI engine version AkoDataSKName AV security intelligence version AkoDataSKName AS security intelligence version AmoDataUKName!NRI security intelligence version A=oData%KName RTP state A;oData#KNameOA state A?oData'KName IOAV state A;oData#KNameBM state AmoDataUKName!Last AV security intelligence age AmoDataUKName!Last AS security intelligence age AQoData9KNameLast quick scan age AOoData7KNameLast full scan age AwoData_KName&AV security intelligence creation time AwoData_KName&AS security intelligence creation time A_oDataGKNameLast quick scan start time A[oDataCKNameLast quick scan end time AWoData?KNameLast quick scan source A]oDataEKNameLast full scan start time AYoDataAKNameLast full scan end time AUoData=KNameLast full scan source AGoData/KNameProduct status Ll̐@Б4|Ēpē8lؔ Product Name(Platform versionUnused$Engine version,NRI engine versionHAV security intelligence versionHAS security intelligence versionHNRI security intelligence versionRTP stateOA stateIOAV stateBM stateHLast AV security intelligence ageHLast AS security intelligence age,Last quick scan age,Last full scan ageTAV security intelligence creation timeTAS security intelligence creation time<Last quick scan start time8Last quick scan end time4Last quick scan source8Last full scan start time4Last full scan end time0Last full scan source$Product statusTEMP**){4P C39F< D EventDataACoData+KName Product Name AIoData1KNameProduct Version ACoData+KName Detection ID AGoData/KNameDetection Time A7oDataKNameUnused A9oData!KNameUnused2 A=oData%KName Threat ID AAoData)KName Threat Name AAoData)KName Severity ID AEoData-KName Severity Name AAoData)KName Category ID AEoData-KName Category Name A7oDataKNameFWLink AAoData)KName Status Code AOoData7KNameStatus Description A5oDataKNameState A=oData%KName Source ID AAoData)KName Source Name ACoData+KName Process Name AGoData/KNameDetection User A9oData!KNameUnused3 A3oDataKNamePath A=oData%KName Origin ID AAoData)KName Origin Name ACoData+KName Execution ID AGoData/KNameExecution Name A9oData!KNameType ID A=oData%KName Type Name ASoData;KNamePre Execution Status A=oData%KName Action ID AAoData)KName Action Name A9oData!KNameUnused4 A?oData'KName Error Code AMoData5KNameError Description !A9oData!KNameUnused5 "AMoData5KNamePost Clean Status #AUoData=KNameAdditional Actions ID $A]oDataEKNameAdditional Actions String %AKoData3KNameRemediation User &A9oData!KNameUnused6 'AeoDataMKNameSecurity intelligence Version (AGoData/KNameEngine Version )(Hlȥ @TpĦ$8H`|ԧ4PdLtȩ Product Name$Product Version Detection ID$Detection TimeUnusedUnused2Threat IDThreat NameSeverity ID Severity NameCategory ID Category NameFWLinkStatus Code,Status DescriptionStateSource IDSource Name Process Name$Detection UserUnused3PathOrigin IDOrigin Name Execution ID$Execution NameType IDType Name0Pre Execution StatusAction IDAction NameUnused4Error Code(Error DescriptionUnused5(Post Clean Status0Additional Actions ID8Additional Actions String(Remediation UserUnused6@Security intelligence Version$Engine VersionTEMP<UJ!WU:ZKD EventDataACoData+KName Product Name AIoData1KNameProduct Version ACoData+KName Feature Name A7oDataKNameReason A?oData'KName Error Code AMoData5KNameError Description A?oData'KName Feature ID Ȭ ,@\ Product Name$Product Version Feature NameReasonError Code(Error DescriptionFeature IDTEMP|ԯU.WFi].3<<_]D EventDataACoData+KName Product Name AIoData1KNameProduct Version ACoData+KName Feature Name A7oDataKNameReason A7oDataKNameUnused A9oData!KNameUnused2 A?oData'KName Feature ID `İذ Product Name$Product Version Feature NameReasonUnusedUnused2Feature IDTEMPT<+p!Y4pN^D EventDataACoData+KName Product Name AIoData1KNameProduct Version ,L Product Name$Product VersionTEMPTX<+p!Y4pN^D EventDataACoData+KName Product Name AIoData1KNameProduct Version  Product Name$Product VersionTEMP0ȵW(.T;D EventDataACoData+KName Product Name AIoData1KNameProduct Version ACoData+KName Feature Name AEoData-KName Configuration A7oDataKNameUnused A?oData'KName Feature ID @`Ķض Product Name$Product Version Feature Name ConfigurationUnusedFeature IDTEMP4dDYd_jrl<D EventDataACoData+KName Product Name AIoData1KNameProduct Version A=oData%KName Old Value A=oData%KName New Value Ը Product Name$Product VersionOld ValueNew ValueTEMP\@:m; VJ@D EventDataACoData+KName Product Name AIoData1KNameProduct Version A;oData#KNameResource AOoData7KNameFailure Type Index ACoData+KName Failure Type AGoData/KNameException Code ػ@` Product Name$Product VersionResource,Failure Type Index Failure Type$Exception CodeTEMPTl<+p!Y4pN^D EventDataACoData+KName Product Name AIoData1KNameProduct Version  Product Name$Product VersionTEMPT<+p!Y4pN^D EventDataACoData+KName Product Name AIoData1KNameProduct Version  Product Name$Product VersionTEMPT<+p!Y4pN^D EventDataACoData+KName Product Name AIoData1KNameProduct Version <\ Product Name$Product VersionTEMPTh<+p!Y4pN^D EventDataACoData+KName Product Name AIoData1KNameProduct Version  Product Name$Product VersionTEMPhh@hV]*@%C`D EventDataA?oData'KName hc_stateid |hc_stateidTEMP Lcr(5%X;٠~D EventDataACoData+KName Product Name AIoData1KNameProduct Version A7oDataKNameUnused A/oDataKNameID A5oDataKNameState A=oData%KName Timestamp A7oDataKNameAction A9oData!KNameProcess A7oDataKNameSource A7oDataKNameTarget A3oDataKNameUser AMoData5KNameSignature Version AGoData/KNameEngine Version Pp,<d Product Name$Product VersionUnused IDStateTimestampActionProcessSourceTargetUser(Signature Version$Engine VersionTEMP4/8tUő:D EventDataACoData+KName Product Name AIoData1KNameProduct Version ACoData+KName Changed Type A5oDataKNameValue Hh Product Name$Product Version Changed TypeValueTEMPFpSiCV#v/MoD EventDataACoData+KName Product Name AIoData1KNameProduct Version A7oDataKNameUnused AGoData/KNamePolicy Version AGoData/KNamePolicy Rule Id AMoData5KNameEnforcement Level ACoData+KName Audit Reason AIoData1KNameEvent Timestamp AAoData)KName Action Type A9oData!KNameProcess A7oDataKNameSource A7oDataKNameTarget A?oData'KName Session Id A;oData#KNameUser Sid AMoData5KNameSignature Version AGoData/KNameEngine Version  4X|,@\t Product Name$Product VersionUnused$Policy Version$Policy Rule Id(Enforcement Level Audit Reason$Event TimestampAction TypeProcessSourceTargetSession IdUser Sid(Signature Version$Engine VersionPRVA\Microsoft-Windows-Windows DefenderOPCOLEVLPXPpPwin:Errorwin:Warning(win:InformationalTASKKEYWEVNT Ee@e~L<L܊@ԏL̔Lę4ğ@ Ld4L4lL4Lx4,@\\@]],L^^AL__PV4``kLaar@bbrLccm@ddmLeezLffz@ggm@hhmLii,~LkkLllLmmLnnL~~LL,@dL 4L4$4f@g4j@*L;LM4^LkLDm4p@q4SO\MgT[k Dz+,73Z7mJL}(| VC#{g6#O_zц<]겥~+ڍo>3=ja{BTxҞ㞼CI* f g X\\00 avV0  *H  01 0 UUS10U Washington10URedmond10U Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100 111019184142Z 261019185142Z01 0 UUS10U Washington10URedmond10U Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20110"0  *H 0  . i!i33T ҋ8-|byJ?5 pk6u1ݍp7tF([`#,GgQ'rɹ;S5|'# oFnhttp://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0  *H  |qQyn9>\` QfG=*hwLb{Ǻz4KbzJ7-W|=ܸZij:ni!7ށugӓW^)9-Es[zFX^gl5?$5 uVx,Јߺ~,c#!xlX6+̤-@EΊ\k>p* j_Gc 26*pZBYqKW~!<ŹE ŕ]b֠c uw}=EWo3wbY~10001 0 UUS10U Washington10URedmond10U Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20113,EEHD0  `He0 *H  1  +70 +7 10  +70/ *H  1" K(R[NnW8׋}İc[GeŚ0< +7 1. ,60UsvxkDKMJ0TZ83vZPSZleqBhY3/D+LlcqzogryHDY=0Z +7 1L0J$"Microsoft Windows" http://www.microsoft.com/windows0  *H `,+SX< VT,lu y!6J.-󥪹d; ]? '΋{u=.{EW]#1& L;R@s/\GAۙHXdQvb <c^@-ucuˤ wB㭼q?&ڌx!~j Xymf 22o_͆ѶAoeA Sl3G`a(3z}ȉz!ū~qF0 +710 *H 010  `He0U *H  D@0< +Y 010  `He җ؋+0wn~_4PSxtń`ؑ520210508012516.622Z0Ԥ01 0 UUS10U Washington10URedmond10U Microsoft Corporation1)0'U  Microsoft Operations Puerto Rico1&0$U Thales TSS ESN:F77F-E356-5BAE1%0#UMicrosoft Time-Stamp ServiceD00ݠ3^)_^0  *H  0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100 210114190219Z 220411190219Z01 0 UUS10U Washington10URedmond10U Microsoft Corporation1)0'U  Microsoft Operations Puerto Rico1&0$U Thales TSS ESN:F77F-E356-5BAE1%0#UMicrosoft Time-Stamp Service0"0  *H 0 #zvzX쬷6y_˃L+~jnO %^aƔ\;,lm2@VPqz#5+\]g:X!AG]b𥝕e4z@b(.جu$_XKƶU7xh DR;PC J8|fu IMҔQpgB+2*~<.Q000Ur| KTTx+0U#0c:\1C{|F3hZmU0VUO0M0KIGEhttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z+N0L0J+0>http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0 U00U% 0 +0  *H  !Y$ʑyX*'UHtȽSƯKdO﮲?@Z. ¦xfNf=Ojn{-t)7=&ܶxsg x(h$YG83L6h=9<( ]r~Z3j&gҟ'#&4\[˽nl-u,N?Zaåk(##!?}] Yi.ImGJÊf0q0Y a *0  *H  01 0 UUS10U Washington10URedmond10U Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100 100701213655Z 250701214655Z0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100"0  *H 0  w: iktTե |hK,_av>f+[S'1A |a0Y0D`TC M8Bݓs0W&E GͿ$`2X`FXG2tag_TϓLĦ]an(aF'$gr!KdPb]w=WuBM@Q>gfD~Knʱz* 1N5xhttp://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0U 00 +7.00=+1http://www.microsoft.com/PKI/docs/CPS/default.htm0@+042 Legal_Policy_Statement. 0  *H  Q ?q=!o1Wm0fjxǨ%kTW+QDS`v@@A\\^5$VKtBȯ7}Z?yJR8/ye٩kzoK0D$"<Y)p2J'U/3b_W@ΙfjbJ &9Jqc{!mÜ<}jxm8ؔƥ B"8 %d~cY%z.9Wvqa˚Gͧ};q ]t"aڰPo1:eGxHr~akow˧ 9؂r*T9[ Uzs;-3.)/T'!ȬN(ۖBAM*f0ӻt2Kc{/!YD>'nu_m- MXy h,H 릡k~