MZ�ÿÿ¸@¨º´ Í!¸LÍ!This program cannot be run in DOS mode. $É;=ß�ZSŒ�ZSŒ�ZSŒÓ¬ŒŒZSŒÓQ�ŒZSŒRich�ZSŒPEd†´V›Uð" ,(€Pe ` t$*(8.rdataà@@.rsrc0 &@@´V›U lPP´V›U$¼¼€€8.rdata8.rdata$voltmdP�.rdata$zzzdbg .rsrc$01(ðþ.rsrc$02 žŽh%ÀS –�_§q‡‡5GbŽðê¹ïUkI-´V›Uð€0€H€ €€˜€°€%È€à€ø€€(€?@€EX€Fp€Gˆ€H €L¸€RЀSè€~€€€0€¼H€½`€ûx€9�€x¨€¶À€·Ø€¸ð€¹€º €»8€¼P€½h€¾€€¿˜€À°€õÈ€öà€3ø€4€r(€@€X€p€� °ÀÐàð 0@P`p€� °ÀÐàð 0@P`p€� °ÀÐàø'¸ä°(´äd*Ää(,>äh.¤ä 0ÊäØ1Òä¬2€ä,3†ä´54äè9tä\=täÐ@äèDäGfähXähi¨äo€ä�užä0|<älƒ,䘄ÜätŒªä �8 äXšŽ äè¤äü³:ä8ņäÀ×äÐçnä@øðä0  ä@ŒäÌT ä %,äL&&ät-îäd2&äŒ:�ä@XäMUIÍþÍþ¸;1;5<K =5 >1=0@C65=K.>4@>1=K5 A2545=8O =54>ABC?=K.A?><>30B5;L=K5 40==K5:#@>25=L 2>7459AB28O>8A: 5:><5=40F8O!AK;:8B7K2K 0B53>@8O=0;87H81:0@54C?@5645=85 =D>@<0F8O5@5:;NG8BL A?>A>1 =02830F88"BG5B Defender Diagnostic Insights17>@!5B52K5 :><<C=8:0F88 0725@BK20=85 >4:;NG5=854@02>>E@0=5=85 1=>2;5=>@>1;5<K A ?@>872>48B5;L=>ABLN@>1;5<K A :>=D83C@0F859CFA!?@02:0SR 5B 40==KE 5 =0AB@>5=>%1 G. 654=52=> >A:@5A5=L5 >=545;L=8:B>@=8:!@540'5B25@3OB=8F0!C11>B08:>340"5ABK A5B52KE :><<C=8:0F89"5ABK @0725@BK20=8O MDE"5ABK ?>4:;NG5=8O MDE#"5ABK @01>B>A?>A>1=>AB8 DC=:F89 MDE:BC0;L=K5 B5ABK MDE"5ABK ?@>872>48B5;L=>AB8"5ABK :>=D83C@0F88*"5ABK CFA (:>=B@>;8@C5<K9 4>ABC? : D09;0<)PA'"5ABK ASR (A>:@0I5=8O =0?@02;5=89 0B0:) B:;NG5=> ;>:8@>20BLC48B 54>ABC?=>"!;C610 %1 >BACBAB2C5B 54>ABC?=>58725AB=>5 A>AB>O=85@>F5AA$09; K?>;=O5BAO AB0=>2;5=>@8>AB0=>2;5=>6840=85 70?CA:06840=85 >AB0=>2:86840=85 ?@>4>;65=8O6840=85 ?@8>AB0=>2:8 58725AB=>03@C7:0!8AB5<0 2B><0B8G5A:8 CG=>9 @568< B:;NG5=>1KG=K90AA82=K9 @568<0AA82=K9 @568< SxS 568< 1;>:8@>2:8 EDR 568< ?0AA82=>3> 0C48B0 5 70?CI5=>PA 57C;LB0BK 57C;LB0BKE06<8B5 =0 AAK;:C "=0;87", GB>1K ?@>A<>B@5BL A2545=8O > @57C;LB0B0E.PA!2545=8O > :><?LNB5@5!2545=8O > :><?LNB5@5VMNameVMSize VMLocationSubscriptionId ResourceGroupVmId5@A8O! '8A;> O45@'8A;> ;>38G5A:8E ?@>F5AA>@>2>B>:>2 =0 O4@>$878G5A:0O ?0<OBL 0A?>;>65=85 D09;0 ?>4:0G:8$"5:CI55 8A?>;L7>20=85 D09;0 ?>4:0G:8)07>2K9 @07<5@ 2K45;5==>3> D09;0 ?>4:0G:8"8:>2>5 ?>B@51;5=85 D09;0 ?>4:0G:8@8A>548=5=> : 4><5=C@8A>548=5=> : Azure ADPA>4:;NG5=> : @01>G59 >1;0AB8 CAB@>9AB20 Azure AD!>AB>O=85 @538AB@0F88@E8B5:BC@0 !@5<O 703@C7:8 A8AB5<K!8AB5<=K9 ?@>:A8-A5@25@ WinHTTP'#AB@>9AB2> 70@538AB@8@>20=> 2 AAD 8 MEMA#AB@>9AB2> =5 70@538AB@8@>20=> 8 =8:>340 =5 1K;> 70@538AB@8@>20=>%#AB@>9AB2> ?>4 C?@02;5=85< 035=B0 MDM #AB@>9AB2>< C?@02;O5B 035=B SCCM3@>1;5<0 A :>=D83C@0F859 Microsoft Endpoint Manager 1I89 A1>9@>1;5<0 A ?>4:;NG5=85<C#AB@>9AB2> 1K;> 70@538AB@8@>20=>, 8 B5?5@L 53> @538AB@0F8O >B<5=5=0%#AB@>9AB2> >68405B >B<5=K @538AB@0F88!1>9 =07=0G5=8O ?>;8B8:!1>9 >BG5B0 > ?>;8B8:0E*1I89 A1>9 ?@8A>548=5=8O : 381@84=>9 A@5455A>>B25BAB285 :;85=B0:H81:0 381@84=>3> @0725@BK20=8O  B>G:0 ?>4:;NG5=8O A;C61KH81:0 A5@B8D8:0B0"5?@028;L=0O =0AB@>9:0 AAD Connect H81:0 DNS@>1;5<0 A8=E@>=870F88 G0A>2MDE 8 ConfigMgrAå]B =A\-)® gem@Ä£ã_g ¬ =M º-)H úèaa ;å]B Zq èU_’Ë: ¤µ>èmgYC @<óãð0C5gHO‘8 ¡UôBê e _°@Á¸Yg­lO)[ (!å[e <óð¹’+ð)6G.!gÉ1S: OÃg e)ÿI ¢úac1m^ùÆÁó‘ÄpY¯_ (:ä_c <Mî’Ê)EDR!2545=8O > Sense 5@A8O Sense!>AB>O=85 A;C61K Sense >@30=870F88>4 CAB@>9AB20!GUID A>AB>O=8O 70I8BK >B A?CD8=30 !>AB>O=85 A;C61K DiagTrack (UTC)) 0725@=CB0 2>7<>6=>ABL 70I8BK >B A?CD8=305@A8O :>=D83C@0F88 Sense45=B8D8:0B>@ MachineAuthStartType A;C61K Sense/ 0A?>;>65=85 F5=B@0 >1@01>B:8 40==KE CAB@>9AB20>#AB@>9AB2> ?>4:;NG5=> ?>A@54AB2>< >?B8<878@>20==>3> A>548=5=8O:"8? 70?CA:0 ?><>I=8:0 ?> 2E>4C 2 CG5B=CN 70?8AL 09:@>A>DB!=B828@CA=0O ?@>3@0<<0 2 Defender-!2545=8O >1 0=B828@CA=>9 ?@>3@0<<5 2 Defender2!>AB>O=85 A;C61K 0=B828@CA=>9 ?@>3@0<<K 2 Defender25@A8O ?;0BD>@<K 0=B828@CA=>9 ?@>3@0<<K 2 DefenderD5@A8O <5E0=87<0 >1=0@C65=8O C3@>7 0=B828@CA=>9 ?@>3@0<<K 2 Defender45@A8O >1@01>BG8:0 0=B828@CA=>9 ?@>3@0<<K 2 Defender' 568< 0=B828@CA=>9 ?@>3@0<<K 2 Defender(0AB@>9:0 ?0@0<5B@>2 SSL 4;O Defender AV$>=D83C@0F8O ?@>:A8-A5@25@0 Defender,!>AB>O=85 A;C61K &5=B@0 157>?0A=>AB8 Windows3!>AB>O=85 A;C61K @01>B>A?>A>1=>AB8 Windows Security'!>AB>O=85 A;C61K ?@>25@:8 A5B8 Defender"!>AB>O=85 >A=>2=>9 A;C61K DefenderDefender 70I8I5= >B ?>445;:8&AB>G=8: 70I8BK >B ?>445;:8 2 Defender+A:;NG5=8O 87 70I8BK >B ?>445;:8 2 Defender 568< SmartLocker=B8H?8>=A:>5  2 Defender 568< 70I8BK A5B8 Defenderp@>25@LB5 :>=D83C@0F8N A5B8 8 C1548B5AL, GB> B@51C5<K5 URL-04@5A0 =5 701;>:8@>20=K. >?>;=8B5;L=K5 A2545=8O: %1 ServiceURLs†@>25@:0 ?>4:;NG5=8O : URL-04@5A0< >1;0G=>9 A;C61K Microsoft Defender 4;O :>=5G=>9 B>G:8 (CNC) CA?5H=> 7025@H5=0. %1 A @57C;LB0B0<8 %2 5 C40;>AL ?@>25@8BL ?>4:;NG5=85 : URL-04@5A0< >1;0G=>9 A;C61K Microsoft Defender 4;O :>=5G=>9 B>G:8. !1>9 B5AB0 4;O A;54CNI53> URL-04@5A0: %1 A @57C;LB0B>< %2­5 C40;>AL 2K?>;=8BL 2A5 B5AB>2K5 ?>4:;NG5=8O : URL-04@5A0< >1;0G=>9 A;C61K Microsoft Defender 4;O :>=5G=>9 B>G:8. !1>9 B5AB0 4;O A;54CNI53> URL-04@5A0: %1 A @57C;LB0B>< %2ˆ@>25@:0 ?>4:;NG5=8O : URL-04@5A0< >1;0G=>9 A;C61K Microsoft Defender 4;O :>=5G=>9 B>G:8 (Cyber) CA?5H=> 7025@H5=0. %1 A @57C;LB0B0<8 %2¨5 C40;>AL ?@>25@8BL ?>4:;NG5=85 : URL-04@5A0< >1;0G=>9 A;C61K Microsoft Defender 4;O :>=5G=>9 B>G:8 (Cyber). !1>9 B5AB0 4;O A;54CNI53> URL-04@5A0: %1 A @57C;LB0B>< %2µ5 C40;>AL 2K?>;=8BL 2A5 B5AB>2K5 ?>4:;NG5=8O : URL-04@5A0< >1;0G=>9 A;C61K Microsoft Defender 4;O :>=5G=>9 B>G:8 (Cyber). !1>9 B5AB0 4;O A;54CNI53> URL-04@5A0: %1 A @57C;LB0B>< %2‰@>25@:0 ?>4:;NG5=8O : URL-04@5A0< >1;0G=>9 A;C61K Microsoft Defender 4;O :>=5G=>9 B>G:8 (AutoIR) CA?5H=> 7025@H5=0. %1 A @57C;LB0B0<8 %2©5 C40;>AL ?@>25@8BL ?>4:;NG5=85 : URL-04@5A0< >1;0G=>9 A;C61K Microsoft Defender 4;O :>=5G=>9 B>G:8 (AutoIR). !1>9 B5AB0 4;O A;54CNI53> URL-04@5A0: %1 A @57C;LB0B>< %2¶5 C40;>AL 2K?>;=8BL 2A5 B5AB>2K5 ?>4:;NG5=8O : URL-04@5A0< >1;0G=>9 A;C61K Microsoft Defender 4;O :>=5G=>9 B>G:8 (AutoIR). !1>9 B5AB0 4;O A;54CNI53> URL-04@5A0: %1 A @57C;LB0B>< %2�@>25@:0 ?>4:;NG5=8O : URL-04@5A0< >1;0G=>9 A;C61K Microsoft Defender 4;O :>=5G=>9 B>G:8 (SampleUpload) CA?5H=> 7025@H5=0. %1 A @57C;LB0B0<8 %2¯5 C40;>AL ?@>25@8BL ?>4:;NG5=85 : URL-04@5A0< >1;0G=>9 A;C61K Microsoft Defender 4;O :>=5G=>9 B>G:8 (SampleUpload). !1>9 B5AB0 4;O A;54CNI53> URL-04@5A0: %1 A @57C;LB0B>< %2¼5 C40;>AL 2K?>;=8BL 2A5 B5AB>2K5 ?>4:;NG5=8O : URL-04@5A0< >1;0G=>9 A;C61K Microsoft Defender 4;O :>=5G=>9 B>G:8 (SampleUpload). !1>9 B5AB0 4;O A;54CNI53> URL-04@5A0: %1 A @57C;LB0B>< %2Ž@>25@:0 ?>4:;NG5=8O : URL-04@5A0< >1;0G=>9 A;C61K Microsoft Defender 4;O :>=5G=>9 B>G:8 (MdeConfigMgr) CA?5H=> 7025@H5=0. %1 A @57C;LB0B>< %2PA¯5 C40;>AL ?@>25@8BL ?>4:;NG5=85 : URL-04@5A0< >1;0G=>9 A;C61K Microsoft Defender 4;O :>=5G=>9 B>G:8 (MdeConfigMgr). !1>9 B5AB0 4;O A;54CNI53> URL-04@5A0: %1 A @57C;LB0B>< %2¼5 C40;>AL 2K?>;=8BL 2A5 B5AB>2K5 ?>4:;NG5=8O : URL-04@5A0< >1;0G=>9 A;C61K Microsoft Defender 4;O :>=5G=>9 B>G:8 (MdeConfigMgr). !1>9 B5AB0 4;O A;54CNI53> URL-04@5A0: %1 A @57C;LB0B>< %2ˆ@>25@:0 ?>4:;NG5=8O : URL-04@5A0< >1;0G=>9 A;C61K Microsoft Defender 4;O :>=5G=>9 B>G:8 (OneDs) CA?5H=> 7025@H5=0. %1 A @57C;LB0B0<8 %2¨5 C40;>AL ?@>25@8BL ?>4:;NG5=85 : URL-04@5A0< >1;0G=>9 A;C61K Microsoft Defender 4;O :>=5G=>9 B>G:8 (OneDs). !1>9 B5AB0 4;O A;54CNI53> URL-04@5A0: %1 A @57C;LB0B>< %2µ5 C40;>AL 2K?>;=8BL 2A5 B5AB>2K5 ?>4:;NG5=8O : URL-04@5A0< >1;0G=>9 A;C61K Microsoft Defender 4;O :>=5G=>9 B>G:8 (OneDs). !1>9 B5AB0 4;O A;54CNI53> URL-04@5A0: %1 A @57C;LB0B>< %2W@>25@:0 A5@B8D8:0B0 4;O >1;0G=>9 A;C61K Defender 4;O :>=5G=>9 B>G:8 CA?5H=> 7025@H5=0.B7K2 A5@B8D8:0B0 =5 ?@>25@5=.R>4:;NG5=85 : >1;0:C <>65B 1KBL =0@CH5=> 2A;54AB285 A1>52 ?@8 >B7K25 A5@B8D8:0B>2.«#1548B5AL, GB> A;54CNI85 URL-04@5A0 =5 701;>:8@>20=K: %1 8 %2. ;O ?>;CG5=8O 4>?>;=8B5;L=>9 8=D>@<0F88, ?>60;C9AB0, >1@0B8B5AL : %3. >4@>1=K5 A2545=8O >1 >H81:5 A<. 2 %4.]@>25@:0 ?>4:;NG5=8O : >1;0G=>9 A;C615 0=B828@CA=>9 ?@>3@0<<K 2 Microsoft Defender 2K?>;=5=0.X!1>9 ?@>25@:8 ?>4:;NG5=8O : >1;0G=>9 A;C615 0=B828@CA=>9 ?@>3@0<<K 2 Microsoft Defender.mA;8 0=B828@CA=0O ?@>3@0<<0 2 Microsoft Defender O2;O5BAO 20H8< >A=>2=K< 0=B828@CA=K< @5H5=85< 8;8 2K @5H8;8 2:;NG8BL @568< 1;>:8@>2:8 EDR, ?@>25@LB5, =5 701;>:8@>20=K ;8 ?>4:;NG5=8O : >1;0G=K< URL-04@5A0< 0=B828@CA0. ;O ?>;CG5=8O 4>?>;=8B5;L=KE A2545=89 A<.: https://learn.microsoft.com/defender-endpoint/configure-network-connections-microsoft-defender-antivirusG"5:CI55 A5B52>5 ?>4:;NG5=85 =5 O2;O5BAO ?>4:;NG5=85< A >?;0B>9 B@0D8:0.6A?>;L7C5BAO A5B52>5 ?>4:;NG5=85 A >?;0B>9 B@0D8:0. %1÷ A5BOE A >?;0B>9 B@0D8:0 <>65B >3@0=8G820BLAO DC=:F8>=0;L=>ABL 2708<>459AB28O A Defender MAPS; =0?@8<5@, =5 >B?@02;ONBAO 70?@>AK =0 ?>;CG5=85 M:AB@5==KE A83=0BC@ (=5>1E>48<K5 4;O ?>;L7>20B5;LA:8E 8=48:0B>@>2 2 4>?>;=5=85 : M:AB@5==K< A83=0BC@0<).ApproachingDataLimit: %1OverDataLimit: %1 >C<8=3: %1NetworkCostType: %1’@>25@:0 ?>4:;NG5=8O : URL-04@5A0< >1;0G=>9 A;C61K Microsoft Defender 4;O :>=5G=>9 B>G:8 (:>=D83C@0F8O ECS) CA?5H=> 7025@H5=0. %1 A @57C;LB0B>< %2C@>25@:0 ?>4:;NG5=8O : >1;0G=>9 A;C615 Microsoft Defender 4;O :>=5G=>9 B>G:8 (:>=D83C@0F8O ECS) 25@=C;0 >H81:C HTTP 502 Bad Gateway. -B> 8725AB=0O ?5@8>48G5A:8 2>7=8:0NI0O ?@>1;5<0 A> A;C61>9 Azure Application Gateway; >=0 <>65B CAB@0=8BLAO A0<>AB>OB5;L=>. >2B>@8B5 ?@>25@:C, 5A;8 ?@>1;5<0 A>E@0=O5BAO. %1 A @57C;LB0B>< %2À5 C40;>AL 2K?>;=8BL 2A5 B5AB>2K5 ?>4:;NG5=8O : URL-04@5A0< >1;0G=>9 A;C61K Microsoft Defender 4;O :>=5G=>9 B>G:8 (:>=D83C@0F8O ECS). !1>9 B5AB0 4;O A;54CNI53> URL-04@5A0: %1 A @57C;LB0B>< %2’A;8 2K ?;0=8@C5B5 2:;NG8BL C?@02;5=85 :>=D83C@0F859 157>?0A=>AB8 MDE, >1@0B8B5AL : A;54CNI59 4>:C<5=B0F88 4;O >7=0:><;5=8O A> A?8A:>< B@51>20=89.>445@68205<K5 ?;0BD>@<Kz#AB@>9AB2> =5 8<55B <8=8<0;L=>3> C@>2=O 8A?@02;5=89 4;O ?>4:;NG5=8O : A;C615 C?@02;5=8O :>=D83C@0F859 157>?0A=>AB8 MDE: %1¦0 CAB@>9AB25 CAB0=>2;5=0 @>;L A;C61 8<5= Active Directory. >445@6:0 :>=B@>;;5@>2 4><5=0 A59G0A 4>ABC?=0 2 ?@5420@8B5;L=>9 25@A88 8 B@51C5B 4>?>;=8B5;L=>9 =0AB@>9:8.ƒA;8 2K ?;0=8@C5B5 2:;NG8BL C?@02;5=85 :>=D83C@0F859 157>?0A=>AB8 MDE 4;O :>=B@>;;5@>2 4><5=0, >1@0B8B5AL : A;54CNI59 4>:C<5=B0F88.HA?>;L7>20=85 C?@02;5=8O ?0@0<5B@0<8 157>?0A=>AB8 =0 :>=B@>;;5@0E 4><5=0›#AB@>9AB2> @01>B05B ?>4 C?@02;5=85< 32-@07@O4=>9 >?5@0F8>==>9 A8AB5<K, :>B>@0O =5 ?>445@68205BAO 4;O ?>4:;NG5=8O C?@02;5=8O :>=D83C@0F859 157>?0A=>AB8 MDE.`1@0B8B5 2=8<0=85, GB> A1>@:0 ! CAB@>9AB20 =5 ?>445@68205BAO MDE 8 =5 <>65B 1KBL ?>4:;NG5=0: %17!?8A>: ?>445@68205<KE 25@A89 Windows A<. 2 MB>9 AB0BL5.H%1 =0 MB>< CAB@>9AB25 @01>B05B =0 C@>2=5 70I8BK, >B;8G=>< >B >68405<>3>.�>?>;=8B5;L=K5 A2545=8O > 70I8B5 PPL 8 55 206=>AB8 A<. 2 MB>9 4>:C<5=B0F88. A;8 ?@>1;5<0 A>E@0=O5BAO, >1@0B8B5AL 2 A;C61C ?>445@6:8 09:@>A>DB.PPLŠ1@0B8B5 2=8<0=85, GB> CAB0=>2;5==K9 =0 MB>< CAB@>9AB25 2K?CA: A5@25@0 B>;L:> Hyper-V, =5 ?>445@68205BAO MDE 8 =5 <>65B 1KBL ?>4:;NG5=: %1o1@0B8B5AL : 4>:C<5=B0F88 ?> ?>445@68205<K< 25@A8O< MDE 4;O ?>;CG5=8O A?8A:0 ?>445@68205<KE A5@25@=KE 2K?CA:>2.>445@68205<K5 25@A88 Windows!;C610 MDE Sense-!;C610 0=B828@CA=>9 ?@>3@0<<K Windefend (MDE)"!;C610 57>?0A=>ABL Windows WscSvc!;C610 Windows SecurityHealth!;C610 70I8BK A5B8 MDE WdnisSvcA=>2=0O A;C610 MDE DefenderPA:;O ?>;CG5=8O 4>?>;=8B5;L=KE A2545=89 >1@0B8B5AL : AB0BL5.“1@0B8B5 2=8<0=85, GB> MB>B :><?LNB5@ @01>B05B A CAB0@52H59 25@A859 ?;0BD>@<K Defender. 5@A88 ?;0BD>@<K AB0@H5 N-2 1>;LH5 =5 1C4CB ?>445@6820BLAO.2;0BD>@<0 0=B82@54>=>A=>3>  2 Microsoft DefenderX1@0B8B5 2=8<0=85, GB> =0 MB>< :><?LNB5@5 8A?>;L7C5BAO CAB0@52H0O 25@A8O O4@0 0=B828@CA=>9 ?@>3@0<<K Defender. >A;5 2K?CA:0 =>2>9 25@A88 ?0:5B0 ?>445@6:0 42CE ?@54K4CI8E 25@A89 >3@0=8G8205BAO B>;L:> B5E=8G5A:>9 ?>445@6:>9. >;55 @0==85 25@A88 ?5@5G8A;5=K 2 MB>< @0745;5 8 ?@54>AB02;ONBAO 8A:;NG8B5;L=> 4;O B5E=8G5A:>9 ?>445@6:8 ?@8 >1=>2;5=88.$=B828@CA=>5 O4@> Microsoft DefenderÝ1@0B8B5 2=8<0=85, GB> =0 MB>< :><?LNB5@5 CAB0=>2;5=0 CAB0@52H0O 25@A8O <5E0=87<0 >1=0@C65=8O C3@>7. 5:><5=4C5BAO ?@8<5=8BL ?>A;54=NN 25@A8N <5E0=87<0 >1=0@C65=8O C3@>7 4;O >15A?5G5=8O >?B8<0;L=>9 70I8BK 8 A>2<5AB8<>AB8.61=>2;5=8O 0=B828@CA=>9 ?@>3@0<<K 2 Microsoft DefenderC01;N405BAO 2KA>:0O 703@C7:0 & Sense, 2K720==0O B@0D8:>< Sense NDRC>?@>1C9B5 ?@8<5=8BL 8A:;NG5=8O Sense EDR : A;54CNI8< ?@>F5AA0<: %1KA>:0O 703@C7:0 &^0 ?;0BD>@<5 MDE 70D8:A8@>20=> 2KA>:>5 ?>B@51;5=85 ?0<OB8 ?@8 8A?>;L7>20=88 B5:CI8E 25@A89 MDEKA>:>5 8A?>;L7>20=85 ?0<OB8!!1>8 ?@8 >1=>2;5=88 ?;0BD>@<K MDE#!1>8 ?@8 >1=>2;5=88 >1@01>BG8:0 MDEH81:8 >1=>2;5=8O A83=0BC@ MDE;!1>9 >1=>2;5=8O A83=0BC@ MDE, B0: :0: C65 70?CI5= M:75<?;O@j>648AL, ?>:0 2A5 M:75<?;O@K MpSigStub.exe 1C4CB 2KE>4><, ?@5645 G5< ?>2B>@8BL ?>?KB:C >1=>2;5=8O ?>4?8A8.K5 C40;>AL 8=8F80;878@>20BL A;C61C MDE Windefend, 8 >=0 7028A;0 =0 MB0?5 %1Ž5@5703@C78B5 :><?LNB5@ 8 >1=>28B5 ?;0BD>@<C Defender 4> ?>A;54=59 25@A88. A;8 ?@>1;5<0 A>E@0=8BAO, A>>1I8B5 >1 MB>< 2 :>@?>@0F8N 09:@>A>DB.K!;C615 Windefend MDE =5 C40;>AL 7025@H8BL @01>BC, 8 >=0 7028A;0 =0 MB0?5 %1i1=>28B5 ?;0BD>@<C Defender 4> ?>A;54=59 25@A88. A;8 ?@>1;5<0 A>E@0=8BAO, A>>1I8B5 >1 MB>< 2 09:@>A>DB.^A:;NG5=85 MDE AAK;05BAO =0 ?5@5<5==K5 A@54K (%1), :>B>@K5 =5 O2;ONBAO A8AB5<=K<8 ?5@5<5==K<8._@>A<>B@8B5 8A:;NG5=8O: "%1" GB>1K C1548BLAO, GB> >=8 AAK;0NBAO =0 ?@028;L=K5 ?5@5<5==K5 A@54K./5 C40;>AL ?>;CG8BL =0AB@>9:8 Windows Defender.ˆA;8 2K ?;0=8@C5B5 2=54@8BL C?@02;5=85 :>=D83C@0F859 CAB@>9AB2 MDE, >1@0B8B5AL : A;54CNI59 AB0BL5 4;O ?>;CG5=8O 4>?>;=8B5;L=KE A2545=89.:@>25@LB5, 70?CI5=0 8 4>ABC?=0 ;8 A;C610 Windows Defender.R0AB@>9:0 0=B828@CA=>9 ?@>3@0<<K 2 Microsoft Defender A ?><>ILN 3@C??>2>9 ?>;8B8:8"@51>20=8O : A>548=5=8NS0AB@>9:0 381@84=>3> ?@8A>548=5=8O : Azure Active Directory 4;O C?@02;O5<KE 4><5=>2>@B0; 157>?0A=>AB8 M365PAq#AB@0=5=85 =5?>;04>: ?>4:;NG5=8O, A2O70==KE A C?@02;5=85< 157>?0A=>ABLN 4;O Microsoft Defender 4;O :>=5G=>9 B>G:8;NG ?>;8B8: MDE ?> C<>;G0=8N%;NG A;C61K 40BG8:>2 MDE ?> C<>;G0=8N%CBL : :0B0;>3C :MH0 MDE ?> C<>;G0=8N(CBL : :0B0;>3C MDE Cyber ?> C<>;G0=8N CBL : :0B0;>3C MDE ?> C<>;G0=8N,CBL : :0B0;>3C ProgramData MDE ?> C<>;G0=8N+CBL : 2@5<5==><C :0B0;>3C MDE ?> C<>;G0=8N,CBL : :0B0;>3C B@0AA8@>2:8 MDE ?> C<>;G0=8N¥#40;8B5 :;NG8 @55AB@0, A2O70==K5 A AntiSpoofing, GB>1K 70AB028BL CAB@>9AB2> A35=5@8@>20BL =>2K9 70:@KBK9 :;NG 8 2K?>;=8BL ?>2B>@=CN @538AB@0F8N. K?>;=8B5 :><0=4C %1Œ5B 459AB289 4;O 2K?>;=5=8O.  ?5@8>4, =0G02H89AO A> 2@5<5=8 A>1KB8O Cyberthrottling, 40==K5 :815@157>?0A=>AB8 =5 ?>ABC?0;8 =0 ?>@B0; MDATP.�>?KB:0 ?>4:;NG5=8O MB>3> CAB@>9AB20 G5@57 Microsoft Monitoring Agent (MMA) 7025@H8;0AL A1>5<, B0: :0: MB>B <5B>4 ?>4:;NG5=8O =5 ?>445@68205BAO.‚1@0B8B5AL : =0H59 251-4>:C<5=B0F88, GB>1K >?@545;8BL, :0:>9 <5B>4 ?>4:;NG5=8O ?>4E>48B 4;O >?5@0F8>==>9 A8AB5<K MB>3> CAB@>9AB20./>445@68205<0O :>=D83C@0F8O 4;O ?>4:;NG5=8O MDEA-B>B :><?LNB5@ A2O70= A >?@545;5==K< 845=B8D8:0B>@>< :;85=B0 AAD.¶@>25@LB5, A>2?0405B ;8 845=B8D8:0B>@ :;85=B0 AAD MB>3> :;85=B0 MDE A 845=B8D8:0B>@>< :;85=B0 SCP 2KH5. 'B>1K C7=0BL 845=B8D8:0B>@ :;85=B0 MDE, >1@0B8B5AL : ?>@B0;C 157>?0A=>AB8 M365N#AB@>9AB2> ?>445@68205B 70I8BC >B A?CD8=30 8 =0E>48BAO 2 AB018;L=>< A>AB>O=88.BSharedSignatureRoot =0AB@>5= 8 4>ABC?5= 4;O CG5B=>9 70?8A8 SYSTEM.)>=D83C@0F8O SharedSignatureRoot 2 =>@<5.A=0G5=85 @55AB@0 SharedSignatureRoot =5 =0AB@>5=> 8;8 =54>ABC?=>.Y-B> 8=D>@<0F8O. @>25@LB5, >68405BAO ;8 :>=D83C@0F8O SharedSignatureRoot 4;O 20H59 A@54K.,0AB@>9:0 @0A?8A0=8O >1=>2;5=8O A83=0BC@: %15SignatureScheduleDay: %1, SignatureUpdateInterval: %2]@>25@LB5 ?0@0<5B@K @0A?8A0=8O >1=>2;5=8O ?>4?8A59 2 A>>B25BAB288 A B@51>20=8O<8 20H59 A@54K.K0AB@>9:0 ?;0=>2>9 ?@>25@:8 4;O 0=B828@CA=>9 ?@>3@0<<K 2 Microsoft Defender.SignatureDefinitionUpdateFileSharesSources: %1^@8 =5>1E>48<>AB8 ?@>25@LB5 8AB>G=8:8 8 =0AB@>9:8 D09;>2 A83=0BC@ A CG5B>< >A>15==>AB59 A@54K.SignatureFallbackOrder: %1V@8 =5>1E>48<>AB8 ?5@5A<>B@8B5 =0AB@>9:8 ?>@O4:0 @575@2=>3> 2K1>@0 A83=0BC@ 4;O A@54K.ï1@0B8B5 2=8<0=85: =0 MB>< :><?LNB5@5 459AB2C5B ?>;8B8:0, @07@5H0NI0O 4>102;5=85 B>;L:> 4>25@5==KE 8740B5;59 =0 >A=>25 4><5=0. -B> <>65B ?><5H0BL @01>B5 40BG8:0 MDE, :>B>@><C B@51C5BAO CAB0=>28BL A5@B8D8:0BK 2 E@0=8;8I5 =0456=KE 8740B5;59.ß>?>;=8B5;L=K5 A2545=8O A<. 2 AB0BL5. 'B>1K 871560BL =5?@542845==KE ?@>1;5<, C40;8B5 A2O70==CN :>=D83C@0F8N 3@C??>2>9 ?>;8B8:8: D;038 ;>:0;L=>9 ?@>25@:8 ?>4;8==>AB8 = %1, D;038 ?@>25@:8 ?>4;8==>AB8 3@C??>2>9 ?>;8B8:8 = %2.TrustedPublishersPA]5 C40;>AL ?@>G8B0BL B>G:C ?>4:;NG5=8O A;C61K (SCP) 87 @0745;0 :>=D83C@0F88 Active Directory.I">G:0 ?>4:;NG5=8O A;C61K (SCP) A>45@68B =5?>445@68205<CN :>=D83C@0F8N: %1F">G:0 ?>4:;NG5=8O A;C61K (SCP) A>45@68B =5?>445@68205<CN :>=D83C@0F8N.y5 C405BAO ?@8A>548=8BL CAB@>9AB2> : Azure AD, B0: :0: 70?8AL SCP =0AB@>5=0 =0 ?@8A>548=5=85 CAB@>9AB20 : Enterprise DRS.T">G:0 ?>4:;NG5=8O A;C61K (SCP) =5 =0AB@>5=0 2 @0745;5 :>=D83C@0F88 Active Directory.e5 C40;>AL ?>4:;NG8BLAO : :>=B@>;;5@C 4><5=0 4;O ?>;CG5=8O A2545=89 > B>G:5 ?>4:;NG5=8O A;C61K (SCP).‚1=0@C65=> =5A>>B25BAB285 <564C 845=B8D8:0B>@>< :;85=B0 AAD MB>3> :;85=B0 MDE 8 845=B8D8:0B>@>< :;85=B0 2 70?8A8 SCP MB>3> 4><5=0.¿#1548B5AL, GB> 845=B8D8:0B>@ :;85=B0 AAD 87 20H53> :;85=B0 MDE A>2?0405B A 845=B8D8:0B>@>< :;85=B0 SCP, C:070==K< 2KH5. 'B>1K ?@>A<>B@5BL 845=B8D8:0B>@ :;85=B0 MDE, >1@0B8B5AL : 4>:C<5=B0F88.w#?@02;5=85 MB8< CAB@>9AB2>< >ACI5AB2;O5BAO 035=B>< SCCM; @5H5=85 ?> C?@02;5=8N 157>?0A=>ABLN MDE C?@02;OBL 8< =5 1C45B.©Configuration Manager ?@87=0= 548=AB25==K< F5=B@>< C?@02;5=8O 157>?0A=>ABLN. Defender 4;O :>=5G=>9 B>G:8 =5 1C45B C?@02;OBL ?0@0<5B@0<8 157>?0A=>AB8 =0 CAB@>9AB20E, :>B>@K5 C65 =0E>4OBAO ?>4 C?@02;5=85< Configuration Manager. 'B>1K 87<5=8BL MB> ?>2545=85, CAB0=>28B5 ?5@5:;NG0B5;L "#?@02;5=85 ?0@0<5B@0<8 157>?0A=>AB8 A ?><>ILN Configuration Manager" 2 ?>;>65=85 "B:;". >?>;=8B5;L=K5 A2545=8O A<. 2 A;54CNI59 4>:C<5=B0F88.R#AB@>9AB2> ?>445@68205B 70I8BC >B A?CD8=30, => =0E>48BAO 2 =5AB018;L=>< A>AB>O=88.w7=0:><LB5AL A @5:><5=40F8O<8 2 A;54CNI59 AB0BL5. A;8 ?@>1;5<0 A>E@0=O5BAO, >1@0B8B5AL 2 A;C61C ?>445@6:8 09:@>A>DB.6Microsoft Defender 4;O :>=5G=>9 B>G:8  CVE-2022-232787Microsoft Defender 4;O :>=5G=>9 B>G:8  =0;8B8:0 C3@>7"BACBAB2CNB ?CB8 ?> C<>;G0=8N: %1.£#1548B5AL, GB> C:070==K5 >BACBAB2CNI85 ?CB8 ACI5AB2CNB 8 =5 ?5@58<5=>20=K. >7<>6=>, 20< ?>B@51C5BAO A>740BL >BACBAB2CNI85 ?0?:8 2 :>=B5:AB5 ;>:0;L=>3> :><?LNB5@0.X5 C40;>AL ?>4:;NG8BL MB> CAB@>9AB2> A ?><>ILN Microsoft Endpoint Configuration Manager.•-B0 ?@>1;5<0 <>65B 2>7=8:=CBL, 5A;8 @0745; @55AB@0 %1 >BACBAB2C5B 2 %2. 'B>1K A>740BL >BACBAB2CNI89 @0745; @55AB@0, <>6=> 8A?>;L7>20BL A;54CNI55: %3K#AB@>9AB2> >B?@02;O5B 40==K5 =0 ?@>A@>G5==K9 845=B8D8:0B>@ >@30=870F88: %1.Z5>1E>48<> >B:;NG8BL CAB@>9AB2> >B MB>9 >@30=870F88, 0 70B5< ?>4:;NG8BL 53> : B5:CI59 >@30=870F88. 1@0B8B5AL 2 A;C61C ?>445@6:8 09:@>A>DB, 5A;8 C 20A =5B 4>ABC?0 : AF5=0@8N >B:;NG5=8O A C:070==K< 845=B8D8:0B>@>< >@30=870F88. @8<5G0=85. 'B>1K ?@>A<>B@5BL B5:CI89 OrgID, ?5@5948B5 =0 ?>@B0; MDE 8 I5;:=8B5 8<O ?>;L7>20B5;O 2 ?@02>< 25@E=5< C3;C.&5=B@ 157>?0A=>AB8“1@0B8B5 2=8<0=85, GB> 2 6C@=0;5 OpsMgr =0 CAB@>9AB25 70D8:A8@>20=0 >H81:0 "03@C7:0 70:@KB>3> :;NG0 4;O A5@B8D8:0B0 ?@>25@:8 ?>4;8==>AB8 :;85=B0".}#40;8B5 8 ?5@5CAB0=>28B5 MMA (Microsoft Monitoring Agent) =0 MB>< CAB@>9AB25 8 2K?>;=8B5 ?@>25@:C, 5A;8 ?@>1;5<0 A>E@0=O5BAO.=5AB=>5 2@5<O =0 CAB@>9AB25 =5 A>>B25BAB2C5B 2@5<5=8 2 Azure.Ž@>25@LB5 B>G=>ABL CAB0=>2:8 A8AB5<=>3> 2@5<5=8 8 ?@028;L=>ABL 2K1>@0 G0A>2>3> ?>OA0. A;8 MB> CAB@>9AB2> ?>4:;NG5=> : 4><5=C, ?@>25@LB5, 70?CI5=0 ;8 A;C610 "Windows Time" 8 A8=E@>=878@>20=> ;8 CAB@>9AB2> A 2@5<5=5< 4><5=0. ;O ?>;CG5=8O 4>?>;=8B5;L=KE A2545=89 > =0AB@>9:5 8 C?@02;5=88 A8=E@>=870F859 2@5<5=8, >1@0B8B5AL : A>>B25BAB2CNI59 AB0BL5, GB>1K ?@>25@8BL B>G=>ABL <5AB=>3> 2@5<5=8 2 BIOS. WindowsTime^#AB@>9AB2> @01>B05B ?>4 C?@02;5=85< 1>;55 AB0@>9 25@A88 System Center Endpoint Protection: %1.À!;54C5B >1=>28BLAO 4> ?>A;54=59 4>ABC?=>9 25@A88, GB>1K >15A?5G8BL A>2<5AB8<>ABL 8 2>7<>6=>ABL @538AB@0F88 >1=0@C65=89 2@54>=>A=KE ?@>3@0<< =0 ?>@B0;5 157>?0A=>AB8 Defender 4;O :>=5G=>9 B>G:8.B@>87>H;0 >H81:0 2 ?@>F5AA5 C?@02;5=8O :>=D83C@0F859 157>?0A=>AB8.#AB@>9AB2> ?>4:;NG5=> : Microsoft Defender 4;O :>=5G=>9 B>G:8. 4=0:> 2 ?>B>:5 C?@02;5=8O :>=D83C@0F859 157>?0A=>AB8 ?@>87>H;0 >H81:0. -B> <>65B 1KBL A2O70=> A B5<, GB> CAB@>9AB2> =5 A>>B25BAB2C5B ?@5420@8B5;L=K< B@51>20=8O< 4;O :0=0;0 C?@02;5=8O Microsoft Defender 4;O :>=5G=>9 B>G:8.D@5420@8B5;L=K5 B@51>20=8O 4;O Microsoft Defender 4;O :>=5G=KE B>G5:B@>87>H;0 >H81:0 2 ?@>F5AA5 C?@02;5=8O :>=D83C@0F859 157>?0A=>AB8.PAÝ#AB@>9AB2> CA?5H=> ?>4:;NG5=> : Microsoft Defender 4;O :>=5G=>9 B>G:8. 4=0:> Microsoft Endpoint Manager =5 =0AB@>5= G5@57 F5=B@ 4<8=8AB@0B>@ 4;O 2:;NG5=8O :>=D83C@0F88 157>?0A=>AB8 Microsoft Defender 4;O :>=5G=>9 B>G:8.,0AB@>9:0 :;85=B0 Microsoft Endpoint Manager!>7=8:;0 ?@>1;5<0 A ?>4:;NG5=85<.#AB@>9AB2> ?>4:;NG5=> : Microsoft Defender 4;O :>=5G=>9 B>G:8. 4=0:> 2 ?>B>:5 C?@02;5=8O :>=D83C@0F859 157>?0A=>AB8 ?@>87>H;0 >H81:0, :>B>@0O <>65B 1KBL 2K720=0 ?@>1;5<>9 A ?>4:;NG5=85<. @>25@LB5, GB> CAB@>9AB2> <>65B 2708<>459AB2>20BL A :>=5G=K<8 B>G:0<8 MDE.B>=5G=K5 B>G:8 Azure Active Directory 8 Microsoft Endpoint Manager+1I89 A1>9 ?@8A>548=5=8O : 381@84=>9 A@545.2#AB@>9AB2> ?>4:;NG5=> : Microsoft Defender 4;O :>=5G=>9 B>G:8. 4=0:> 2 ?>B>:5 C?@02;5=8O :>=D83C@0F859 157>?0A=>AB8 ?@>87>H;0 >H81:0, 8 >?5@0F8>==>9 A8AB5<5 =5 C40;>AL 2K?>;=8BL 381@84=>5 ?@8A>548=5=85. ;O CAB@0=5=8O =5?>;04>: 381@84=>3> ?@8A>548=5=8O =0 C@>2=5 >?5@0F8>==>9 A8AB5<K >1@0B8B5AL : AAK;:0<.X#AB@0=5=85 =5?>;04>: A 381@84=K<8 CAB@>9AB20<8, ?@8A>548=5==K<8 : Azure Active Directory5A>>B25BAB285 :;85=B0.´#AB@>9AB2> ?>4:;NG5=> : Microsoft Defender 4;O :>=5G=>9 B>G:8. 4=0:> 2 ?>B>:5 C?@02;5=8O :>=D83C@0F859 157>?0A=>AB8 ?@>87>H;0 >H81:0, B0: :0: 845=B8D8:0B>@ :;85=B0 Microsoft Defender 4;O :>=5G=>9 B>G:8 =5 A>2?0405B A 845=B8D8:0B>@>< :;85=B0 Azure Active Directory. #1548B5AL, GB> 845=B8D8:0B>@ :;85=B0 Azure Active Directory 87 20H53> :;85=B0 Defender 4;O :>=5G=>9 B>G:8 A>2?0405B A 845=B8D8:0B>@>< :;85=B0 2 70?8A8 SCP 20H53> 4><5=0.;H81:0 381@84=>3> @0725@BK20=8O  B>G:0 ?>4:;NG5=8O A;C61K.�#AB@>9AB2> ?>4:;NG5=> : Microsoft Defender 4;O :>=5G=>9 B>G:8. 4=0:> 70?8AL B>G:8 A>548=5=8O A;C61K (SCP) =0AB@>5=0 =5:>@@5:B=>, 8 CAB@>9AB2> =5 C40;>AL ?@8A>548=8BL : Azure AD. -B> <>65B 1KBL >1CA;>2;5=> B5<, GB> SCP =0AB@>5=0 4;O ?@8A>548=5=8O : Enterprise DRS. @>25@LB5, C:07K205B ;8 70?8AL SCP =0 AAD 8 =0AB@>5=0 ;8 SCP 2 A>>B25BAB288 A @5:><5=40F8O<8. >?>;=8B5;L=K5 A2545=8O A<. ?> AAK;:0<."0AB@>9:0 B>G:8 ?>4:;NG5=8O A;C61KH81:0 A5@B8D8:0B0."#AB@>9AB2> ?>4:;NG5=> : Microsoft Defender 4;O :>=5G=>9 B>G:8. 4=0:> 2 ?>B>:5 C?@02;5=8O :>=D83C@0F859 157>?0A=>AB8 ?@>87>H;0 >H81:0 87-70 ?@>1;5<K A A5@B8D8:0B>< CAB@>9AB20. !5@B8D8:0B CAB@>9AB20 ?@8=04;568B 4@C3><C :;85=BC. @>25@LB5, GB> ?@8 A>740=88 ?@>D8;59 A>1;N40NBAO @5:><5=40F88.@>D8;8 4>25@5==KE A5@B8D8:0B>2PA#5?@028;L=0O =0AB@>9:0 AAD Connect.5#AB@>9AB2> ?>4:;NG5=> : Microsoft Defender 4;O :>=5G=>9 B>G:8. 4=0:> 2 ?>B>:5 C?@02;5=8O :>=D83C@0F859 157>?0A=>AB8 ?@>87>H;0 >H81:0 87-70 =5?@028;L=>9 =0AB@>9:8 AAD Connect. 'B>1K >?@545;8BL ?@8G8=C, ?@5?OBAB2CNICN @538AB@0F88 CAB@>9AB20 2 AAD, @0AA<>B@8B5 2>7<>6=>ABL 70?CA:0 A@54AB2 CAB@0=5=8O =5?>;04>:.3!@54AB2> CAB@0=5=8O =5?>;04>: @538AB@0F88 CAB@>9AB2I!?5F80;L=K5 8=AB@C:F88 ?> CAB@0=5=8N =5?>;04>: 4;O Windows Server 2012 R2 H81:0 DNS.ª#AB@>9AB2> ?>4:;NG5=> : Microsoft Defender 4;O :>=5G=>9 B>G:8. 4=0:> 2 ?>B>:5 C?@02;5=8O :>=D83C@0F859 157>?0A=>AB8 ?@>87>H;0 >H81:0 87-70 >H81:8 DNS. @>25@LB5 ?>4:;NG5=85 : =B5@=5BC 8 ?0@0<5B@K DNS =0 CAB@>9AB25. 54>?CAB8<K5 ?0@0<5B@K DNS <>3CB 1KBL =0 AB>@>=5 @01>G59 AB0=F88. ;O :>@@5:B=>9 @01>BK Active Directory =5>1E>48<> 8A?>;L7>20BL DNS 4><5=0 (0 =5 04@5A <0@H@CB870B>@0). >?>;=8B5;L=K5 A2545=8O A<. ?> AAK;:0<.@>1;5<0 A8=E@>=870F88 G0A>2.â#AB@>9AB2> ?>4:;NG5=> : Microsoft Defender 4;O :>=5G=>9 B>G:8. 4=0:> 2 ?>B>:5 C?@02;5=8O :>=D83C@0F859 157>?0A=>AB8 ?@>87>H;0 >H81:0. @>25@LB5 ?@028;L=>ABL CAB0=>2:8 8 A8=E@>=870F88 G0A>2 =0 CAB@>9AB25, 345 2>7=8:05B >H81:0.!1>9 A:0G820=8O ?>;8B8:.Ñ#AB@>9AB2> ?>4:;NG5=> : Microsoft Defender 4;O :>=5G=>9 B>G:8. 4=0:> =5 C40;>AL A:0G0BL ?>;8B8:8 157>?0A=>AB8 :>=5G=>9 B>G:8 87 MEM. @>25@LB5, GB> CAB@>9AB2> <>65B 2708<>459AB2>20BL A :>=5G=K<8 B>G:0<8 MDE.!1>9 >B<5=K @538AB@0F88.Ý#AB@>9AB2> A59G0A 70@538AB@8@>20=>, => 53> @538AB@0F8N =C6=> >B<5=8BL. 4=0:> ?@>F5AA >B<5=K @538AB@0F88 7025@H8;AO A1>5< 87-70 2@5<5==>9 >H81:8. @>25@LB5, GB> CAB@>9AB2> <>65B 2708<>459AB2>20BL A :>=5G=K<8 B>G:0<8 MDE.!1>9 =07=0G5=8O ?>;8B8:.©#AB@>9AB2> ?>4:;NG5=> : Microsoft Defender 4;O :>=5G=>9 B>G:8 8 A<>3;> A:0G0BL ?>;8B8:8 157>?0A=>AB8 :>=5G=>9 B>G:8 87 MEM. 4=0:> ?@8 =07=0G5=88 ?>;8B8: ?@>87>H5; A1>9.!1>9 >BG5B0 > ?>;8B8:0E.¸#AB@>9AB2> ?>4:;NG5=> : Microsoft Defender 4;O :>=5G=>9 B>G:8 8 A<>3;> A:0G0BL ?>;8B8:8 157>?0A=>AB8 :>=5G=>9 B>G:8 87 MEM. 4=0:> ?@8 >B?@02:5 >BG5B0 > ?>;8B8:0E 2 MEM ?@>87>H5; A1>9.PAf-B> CAB@>9AB2> =5;L7O ?>4:;NG8BL 2 B5:CI5< A>AB>O=88, B0: :0: 53> ImageState 2 "%1" O2;O5BAO =5?>;=K<.É-B0 ?@>1;5<0 <>65B 2>7=8:=CBL, 5A;8 >1@07 ! 2K?>;=8; =5A:>;L:> ?>A;54>20B5;L=KE ?>?KB>: Sysprep 8 4;O @55AB@0 7040=> 7=0G5=85 '%1'. A;8 ?@>1;5<0 A>E@0=O5BAO, >1@0B8B5AL 2 A;C61C ?>445@6:8 09:@>A>DB.0!2545=8O > A>AB>O=88 ?@>3@0<<K CAB0=>2:8 WindowsA=0G5=85 ImagePath 2 @55AB@5 <>3;> 1KBL ?>445;0=> 4> ?>4:;NG5=8O.v@>A<>B@8B5 MBC >H81:C 8 ?@>25@LB5 ImagePath (2 ?@545;0E %1), GB>1K C1548BLAO, GB> >= C:07K205B =0 4>?CAB8<K9 ?CBL %2.91=0@C65=K A>1KB8O Sense Cyberdata A >3@0=8G5=85< G0AB>BKMDE 8 ConfigMgr+#AB@>9AB2> C?@02;O5BAO A ?><>ILN Configuration Manager 8 Microsoft Defender 4;O :>=5G=>9 B>G:8. #?@02;5=85 ?>;8B8:0<8 G5@57 >10 :0=0;0 <>65B ?@825AB8 : :>=D;8:B0< 8 =565;0B5;L=K< @57C;LB0B0<. 'B>1K MB>3> 871560BL, ?>;8B8:8 157>?0A=>AB8 :>=5G=KE B>G5: A;54C5B 87>;8@>20BL =0 >4=>< C@>2=5 C?@02;5=8O.C!>2<5AB=>5 8A?>;L7>20=85 A Microsoft Endpoint Configuration Manager!>AB>O=85 @538AB@0F88 87<5=5=> #AB@>9AB2> C?@02;O5BAO A ?><>ILN Configuration Manager 8 Microsoft Defender 4;O :>=5G=>9 B>G:8. 538AB@0F8O CAB@>9AB20 2 @5H5=88 C?@02;5=8O :>=D83C@0F859 157>?0A=>AB8 1K;0 >B<5=5=0, B0: :0: 87<5=8;0AL >1;0ABL ?@8<5=5=8O 8;8 4;O CAB@>9AB20 1K; C40;5= B53 MDE-Management.³!8AB5<=0O ?5@5<5==0O A@54K %%TEMP%% (8 %%TMP%%) =5 >?@545;5=0. -B> <>65B ?@825AB8 : A1>O< 2 @01>B5 Windows Defender 8 4@C38E A8AB5<=KE :><?>=5=B>2, 8A?>;L7CNI8E 2@5<5==K9 :0B0;>3.»?@545;8B5 ?5@5<5==K5 A@54K TEMP 8 TMP. =0G5=85 ?> C<>;G0=8N 4;O A8AB5<=KE CG5B=KE 70?8A59: %%SystemRoot%%\TEMP. #1548B5AL, GB> MB>B ?CBL ACI5AB2C5B, 8 GB> 7040=K =5>1E>48<K5 @07@5H5=8O.ƒ0B0;>3 %%TEMP%% =54>ABC?5=. -B> <>65B ?@825AB8 : A1>O< 2 :><?>=5=B0E 0I8B=8:0 Windows, :>B>@K< B@51C5BAO 70?8AL 2@5<5==KE D09;>2.i#1548B5AL, GB> :0B0;>3 %%TEMP%% ACI5AB2C5B, 0 B5:CI0O CG5B=0O 70?8AL 8<55B @07@5H5=8O =0 GB5=85 8 70?8AL.Ö;O :0B0;>30 %%TEMP%% 7040= ?CBL, >B;8G=K9 >B ?CB8 ?> C<>;G0=8N. @8 8A?>;L7>20=88 =5AB0=40@B=>3> ?CB8 : TEMP <>3CB 2>7=8:=CBL ?@>1;5<K 2 @01>B5 :><?>=5=B>2, @0AAG8B0==KE =0 8A?>;L7>20=85 @0A?>;>65=8O ?> C<>;G0=8N.PAã@>25@LB5, O2;O5BAO ;8 8A?>;L7>20=85 =5AB0=40@B=>3> ?CB8 %%TEMP%% ?@54=0<5@5==K<. A;8 MB> =5>6840==>, A1@>ALB5 A8AB5<=K5 ?5@5<5==K5 A@54K TEMP 8 TMP 4> 7=0G5=89 ?> C<>;G0=8N (%%SystemRoot%%\TEMP 4;O A8AB5<=KE CG5B=KE 70?8A59).f1@0B8B5 2=8<0=85, GB> =0 CAB@>9AB25 5ABL =5A:>;L:> @01>G8E >1;0AB59 MMA (Microsoft Monitoring Agent).,A;8 CAB@>9AB2> ?>4:;NG5=> : Defender 4;O :>=5G=>9 B>G:8 G5@57 8=B53@0F8N ASC (B0:65 8725AB=>3> :0: Azure Defender 4;O A5@25@>2), @5:><5=4C5BAO C40;8BL @01>GCN >1;0ABL MDE, GB>1K 871560BL ?@>1;5< A :815@>B?@02:>9. >?>;=8B5;L=K5 A2545=8O >1 8=B53@0F88 ASC A Defender 4;O :>=5G=>9 B>G:8 A<. 2 AB0BL5. MDE 2 Azure‚5 C40;>AL ?>4:;NG8BL MB>B :><?LNB5@ 87-70 >BACBAB28O @07@5H5=89 4;O @0745;0 @55AB@0 HKLM_System_CurrentControlSet_Services_Sense.ô-B> <>65B ?@>87>9B8 87-70 2<5H0B5;LAB20 AB>@>==8E ?@>4C:B>2 157>?0A=>AB8 8;8 5A;8 C CG5B=>9 70?8A8 SYSTEM =5B @07@5H5=89 =0 ?>;=K9 4>ABC? : HKLM_System_CurrentControlSet_Services_Sense. 0945=K A;54CNI85 @07@5H5=8O 4;O CG5B=>9 70?8A8 SYSTEM: %1W1@0B8B5 2=8<0=85, GB> =0 MB>< A5@25@5 =5 CAB0=>2;5= A>2@5<5==K9 C=8D8F8@>20==K9 035=B.×48=K9 035=B 4;O A5@25@>2 ?@54K4CI8E 25@A89 =5 CAB0=>2;5= =0 MB>< CAB@>9AB25. 5:><5=4C5BAO CAB0=>28BL =>2K9 035=B 4;O >?B8<0;L=>9 ?@>872>48B5;L=>AB8 8 2>7<>6=>AB59 70I8BK. >?>;=8B5;L=K5 A2545=8O A<. 2 4>:C<5=B0F88K>4:;NG5=85 A5@25@>2 Windows : A;C615 Microsoft Defender 4;O :>=5G=>9 B>G:8F@>87>H5; A1>9 =07=0G5=8O ?>;8B8: 87-70 A;54CNI8E ?5@5<5==KE A@54K: %1÷#AB@>9AB2> ?>4:;NG5=> : Microsoft Defender 4;O :>=5G=>9 B>G:8 8 A<>3;> A:0G0BL ?>;8B8:8 157>?0A=>AB8 :>=5G=>9 B>G:8 87 MEM. 4=0:> ?@8 =07=0G5=88 ?>;8B8: ?@>87>H5; A1>9. #40;8B5 2A5 =5ACI5AB2CNI85 ?CB8 87 C:070==KE 2KH5 ?5@5<5==KE A@54K A8AB5<K.70AB@>9:0 ?5@5<5==KE A@54K 2 ?0=5;8 C?@02;5=8O A8AB5<>9{@>87>H5; A1>9 =07=0G5=8O ?>;8B8:, B0: :0: =0 CAB@>9AB25 2:;NG5=> ?;0=8@>20=85 48=0<8G5A:>3> @0A?@545;5=8O @5AC@A>2 (DFSS).$#AB@>9AB2> ?>4:;NG5=> : Microsoft Defender 4;O :>=5G=>9 B>G:8 8 A<>3;> A:0G0BL ?>;8B8:8 157>?0A=>AB8 :>=5G=>9 B>G:8 87 MEM. 4=0:> ?@8 =07=0G5=88 ?>;8B8: ?@>87>H5; A1>9 87-70 >3@0=8G5=8O API, :>B>@>5 <>65B 2>7=8:0BL ?@8 2:;NG5=88 DFSS. 1@0B8B5AL 2 A;C61C ?>445@6:8 09:@>A>DB 70 ?><>ILN.O#AB@>9AB2> =5 >1=>2;5=>, 8 =0 =5< =5 @0725@=CB0 2>7<>6=>ABL 70I8BK >B A?CD8=30.— 0725@=8B5 @0725@=C;8 @5:><5=4C5<>5 >1=>2;5=85 4;O A8AB5<K 157>?0A=>AB8, GB>1K 70I8B8BL CAB@>9AB2> >B A?CD8=30. >?>;=8B5;L=K5 A2545=8O A<. ?> AAK;:0<.6Microsoft Defender 4;O :>=5G=>9 B>G:8  CVE-2022-232787Microsoft Defender 4;O :>=5G=>9 B>G:8  =0;8B8:0 C3@>7Z#AB@>9AB2> @01>B05B =0 CAB0@52H59 25@A88 40BG8:0 EDR Microsoft Defender 4;O :>=5G=>9 B>G:8D1=>28B5 40BG8:, GB>1K >15A?5G8BL >?B8<0;L=CN 70I8BC 8 AB018;L=>ABL.@1=>2;5=85 Microsoft Defender 4;O :>=5G=>9 B>G:8 4;O 40BG8:0 EDR|5 C40;>AL ?>4:;NG8BL MB>B :><?LNB5@, B0: :0: MsSense.exe ?@>87>H5; A1>9 =0 MB0?5 8=8F80;870F88 TelLib.dll. H81:0 A1>O: %1-B> <>65B ?@>87>9B8, 5A;8 C CG5B=>9 70?8A8 SYSTEM =5B @07@5H5=89 =0 70?8AL ?> >68405<><C ?CB8 (ProgramData\Microsoft\Advanced Threat Protection 2 0I8B=8:5 Windows\Cyber). @>25@LB5 A?8A:8 ACL 2 ?CB8 8 ?@8 =5>1E>48<>AB8 A1@>ALB5 @07@5H5=8O 87 @>48B5;LA:>9 ?0?:8.Q#AB@>9AB2> ?>445@68205B 70I8BC >B A?CD8=30, => ?>:0 =5 70@538AB@8@>20=> 2 >1;0:5.Œ#1548B5AL, GB> ?>4:;NG5=85 : URL-04@5A0< CNC EDRCloud =5 701;>:8@>20=>. A;8 ?@>1;5<0 A>E@0=O5BAO, >1@0B8B5AL 2 A;C61C ?>445@6:8 09:@>A>DB.>>=D83C@0F8O 8;8 7028A8<>ABL ?@5?OBAB2C5B 70?CA:C 0I8BK A5B8.Y@>A<>B@8B5 MB> A>>1I5=85 >1 >H81:5, GB>1K ?>=OBL 1;>:8@CNICN ?@>1;5<C 8 CAB@0=8BL 55: %1h>445@68205<K5 H8D@K TLS =5 2:;NG5=K =0 MB>< :><?LNB5@5. -B> <>65B ?>2;8OBL =0 ?>4:;NG5=85 : >1;0:C MDE.¿@>25@LB5 =0AB@>5==K5 H8D@K (2 HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002), GB>1K C1548BLAO 2 =0;8G88 <8=8<0;L=> =5>1E>48<KE H8D@0E 4;O ?>4:;NG5=8O : >1;0:C MDE.!"@51>20=8O : =01>@0< H8D@>2 8 TLSj;85=BA:89 ?@>B>:>; TLS 1.2 =5 2:;NG5= =0 MB>< :><?LNB5@5. -B> <>65B ?>2;8OBL =0 ?>4:;NG5=85 : >1;0:C MDE.„@>25@LB5, GB> :;85=B TLS 1.2 2:;NG5= (2 HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client).Z(8D@K ECDH =5 2:;NG5=K =0 MB>< :><?LNB5@5. -B> <>65B ?>2;8OBL =0 ?>4:;NG5=85 : >1;0:C MDE.š@>25@LB5, GB> 0;3>@8B< ECDH KeyExchangeAlgorithm 2:;NG5= (2 HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\ECDH).!1>9 107>2>3> B5AB0 URL-04@5A0¤><?>=5=B NetworkProtection >B:;NG5= 8;8 =5 ?@>H5; ?@>25@:C ?@>25@:0 URL-04@5A0. -B> <>65B C:07K20BL =0 =0;8G85 A5B52>3> ?5@5=0?@028B5;O (=0?@8<5@, Cisco Umbrella).>=B@>;8@C5<K9 4>ABC? : ?0?:0<K5 C40;>AL 703@C78BL <>4C;L mde_cfa_evaluation  4803=>AB8:0 CFA =54>ABC?=00@>25@LB5 CAB0=>2:C MdeDiag 8 @538AB@0F8N <>4C;OL 6C@=0;0E =5 >1=0@C65=> A@010BK20=89 CFA (:>=B@>;8@C5<>3> 4>ABC?0 : D09;0<)559AB28O =5 B@51CNBAO  CFA @01>B05B 2 HB0B=>< @568<5F@>0=0;878@>20=K ?>4>7@8B5;L=K5 D09;K =0 ?@54<5B A>AB>O=8O 4>25@8O: %1l7CG8B5 D09; CfaTrustChecks.txt 2 4803=>AB8G5A:>< 2K2>45 4;O ?>;CG5=8O ?>4@>1=KE @57C;LB0B>2 0=0;870 4>25@8OJ%1 =5 ?>;L7C5BAO 4>25@85< CFA, B0: :0: >1@07 ?@>F5AA0 =5 ?@87=0= =0456=K<.{>102LB5 MB>B D09; 2 A?8A>: @07@5H5==KE ?@8;>65=89 8;8 A>7409B5 8A:;NG5=85 2 0=B828@CA=>9 ?@>3@0<<5, 5A;8 2K 5<C 4>25@O5B5.T%1 =5 ?>;L7C5BAO 4>25@85< CFA, B0: :0: 53> @>48B5;LA:89 M;5<5=B =5 ?@87=0= =0456=K<.T%1 =5 ?>;L7C5BAO 4>25@85< CFA, B0: :0: 53> @>48B5;LA:8< M;5<5=B>< O2;O5BAO AF5=0@89.J%1 =5 O2;O5BAO 4>25@5==K< 4;O CFA, B0: :0: 703@C78; =54>25@5==K9 D09;: %2.\%1 =5 O2;O5BAO 4>25@5==K< 4;O CFA, B0: :0: 2 =53> 2=54@5= :>4 87 =54>25@5==>3> ?@>F5AA0: %2.N>102LB5 MB>B D09; 2 8A:;NG5=8O 0=B828@CA=>9 ?@>3@0<<K, 5A;8 2K 5<C 4>25@O5B5.m>102LB5 8A:;NG5=85 4;O MB>3> ?@>F5AA0 2 0=B828@CA=CN ?@>3@0<<C, 5A;8 2K 5<C 4>25@O5B5 (8A:;NG5=85 ?@>F5AA0). @>F5AA: %1 !>1KB8O CFA: - 59AB285: %1, ?@8G8=0: %2!>1KB8O 70@065=8O:" - TaintType: %1, TaintReason: %2 C:>2>4AB2>: %1(2E>645=89: %1)ˆASR %1 GUID '%2' (8AB>G=8:: %3) A>45@68B =0G0;L=K5 8;8 :>=5G=K5 ?@>15;K 8;8 7=0:8 B01C;OF88, 87-70 :>B>@KE =5 C405BAO ?@8<5=8BL ?@028;>.g#40;8B5 =0G0;L=K5 8 :>=5G=K5 ?@>15;K 87 GUID ?@028;0 ASR 2 :>=D83C@0F88 3@C??>2>9 ?>;8B8:8 8;8 @55AB@0.˜GUID ASR %1 '%2' (8AB>G=8:: %3) A>45@68B D83C@=K5 A:>1:8. GUID 4>;6=K 1KBL C:070=K 157 D83C@=KE A:>1>: (=0?@8<5@, 56a863a9-875e-4185-98a7-b882c64b5ce5).Z#40;8B5 D83C@=K5 A:>1:8 87 GUID ?@028;0 ASR 2 :>=D83C@0F88 3@C??>2>9 ?>;8B8:8 8;8 @55AB@0.“A:;NG5=85 ASR '%1' (8AB>G=8:: %2) A>45@68B =0G0;L=K5 8;8 :>=5G=K5 ?@>15;K 8;8 7=0:8 B01C;OF88, :>B>@K5 <>3CB ?@5?OBAB2>20BL A>2?045=8N 8A:;NG5=8O.j#40;8B5 =0G0;L=K5 8 :>=5G=K5 ?@>15;K 87 ?CB8 8A:;NG5=8O ASR 2 :>=D83C@0F88 3@C??>2>9 ?>;8B8:8 8;8 @55AB@0.¥GUID ASR %1 '%2' (8AB>G=8:: %3) =5 O2;O5BAO 4>?CAB8<K< GUID. 68405<K9 D>@<0B: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx (=0?@8<5@, 56a863a9-875e-4185-98a7-b882c64b5ce5).PAˆA?@02LB5 GUID ?@028;0 ASR 2 :>=D83C@0F88 3@C??>2>9 ?>;8B8:8 8;8 @55AB@0, GB>1K 8A?>;L7>20BL 4>?CAB8<K9 D>@<0B GUID 157 ;8H=8E A8<2>;>2.A:;NG5=85 ASR '%1' (8AB>G=8:: %2) A>45@68B A53<5=B @>48B5;LA:>3> :0B0;>30 (".."). >A;5 @07@5H5=8O ".." MDD5:B82=K9 8A:;NG05<K9 ?CBL <>65B 1KBL =0<=>3> H8@5, G5< ?@54?>;0305B ;8B5@0;L=0O 70?8AL, =570<5B=> @0AH8@OO 8A:;NG5=85 70 ?@545;K ?@54?>;0305<>9 >1;0AB8.Û0<5=8B5 70?8AL 8A:;NG5=8O ASR =0 ?>;=>ABLN @07@5H5==K9 01A>;NB=K9 ?CBL, :>B>@K9 =5 A>45@68B A53<5=B>2 "..". >A;54=85 25@A88 Microsoft Defender >B:;>=ONB =5:0=>=8G5A:85 70?8A8 8A:;NG5=89 2> 2@5<O 703@C7:8 :>=D83C@0F88.PA''B> B0:>5 Defender Diagnostic Insights? Defender Diagnostic Insights  8=AB@C<5=B A0<>4803=>AB8:8, :>B>@K9 A>18@05B 8 0=0;878@C5B 4803=>AB8G5A:85 40==K5 8 D>@<8@C5B >BG5B 4;O CAB@0=5=8O ?@>1;5< A ?@>872>48B5;L=>ABLN 28@BC0;L=KE <0H8= Windows 2 Azure. >:C<5=B0F8O Windows ?> Defender Diagnostic Insights  %1.(! G53> <=5 =0G0BL ?@>25@:C MB>3> >BG5B0?/0G=8B5 A 2:;04:8 "17>@". 7=0:><LB5AL A @5:><5=40F8O<8 8 AAK;:0<8, GB>1K >7=0:><8BLAO A @57C;LB0B0<8. #7=09B5 > B><, :0: >=8 <>3CB ?>2;8OBL =0 ?@>872>48B5;L=>ABL, 0 B0:65 > @5:><5=40F8OE 4;O :>=D83C@0F89, >?B8<878@>20==KE 4;O ?>2KH5=8O ?@>872>48B5;L=>AB8. >?>;=8B5;L=K5 A2545=8O > ?@>25@:5 >BG5B0 %1.30:85 40==K5 A>18@05B Defender Diagnostic Insights?EDefender Diagnostic Insights A>18@05B A2545=8O > :>=D83C@0F88 28@BC0;L=>9 <0H8=K Windows, 48A:>2 8;8 ?C;>2 E@0=5=8O, AG5BG8:0E ?@>872>48B5;L=>AB8, ?@>F5AA0E A 2KA>:8< ?>B@51;5=85< @5AC@A>2, 6C@=0;0E 8 @07;8G=KE B@0AA8@>2:0E. >4@>1=K5 A2545=8O > B><, :0:85 40==K5 A>18@05B Defender Diagnostic Insights, 4>ABC?=K ?> AAK;:5 %1.PAP€P€P€P€¬H81:0 ?@8 2K?>;=5=88 <>4C;O CG5B=>9 70?8A8 ?>;L7>20B5;O A >3@0=8G5==K<8 ?@020<8. Ð@>87>H;0 >H81:0 ?@8 703@C7:5 <>4C;O CG5B=>9 70?8A8 ?>;L7>20B5;O A >3@0=8G5==K<8 ?@020<8 87 D09;0. Ä <>4C;5 CG5B=>9 70?8A8 ?>;L7>20B5;O A >3@0=8G5==K<8 ?@020<8 ?@>87>H;0 A8=B0:A8G5A:0O >H81:0. ¨@>87>H;0 >H81:0 ?0<OB8 2 CG5B=>9 70?8A8 ?>;L7>20B5;O A >3@0=8G5==K<8 ?@020<8. ¤@>87>H;0 >1I0O >H81:0 2 CG5B=>9 70?8A8 ?>;L7>20B5;O A >3@0=8G5==K<8 ?@020<8. ¨@>87>H;0 >H81:0 ?0=8:8 2 CG5B=>9 70?8A8 ?>;L7>20B5;O A >3@0=8G5==K<8 ?@020<8. ÀK?>;=5=85 CG5B=>9 70?8A8 ?>;L7>20B5;O A >3@0=8G5==K<8 ?@020<8 ?@5@20=> A83=0;>< >AB0=>2:8. €5 C40;>AL 48=0<8G5A:8 =0AB@>8BL A=8<:8 :CG8 4;O ?@>F5AA0. X4VS_VERSION_INFO½ïþ Öe Öe?¶StringFileInfo’041904B0LCompanyNameMicrosoft Corporation¢=FileDescription1@01>BG8: 4803=>AB8:8 Microsoft Defender 4;O :>=5G=>9 B>G:8BInternalNamedefenderdiag.dll®ELegalCopyright© >@?>@0F8O 09:@>A>DB (Microsoft Corporation). A5 ?@020 70I8I5=K.ROriginalFilenamedefenderdiag.dll.muir)ProductName?5@0F8>==0O A8AB5<0 Microsoft® Windows®�8FileVersion4.18.26070.9 (797b3603749206dfffe67a1cc891531b0a2cf438)> ProductVersion4.18.26070.9DVarFileInfo$Translation°PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD(0‚( *†H†÷  ‚'ø0‚'ô10  `†He0\ +‚7 N0L0 +‚70  ¢€010  `†He Qgèó6§"ç ~h«5EÎ.âî8ŸæÔs™¡3°=J ‚ 0‚a0‚I 3$]¢‘qà •ª$0  *†H†÷  0S1 0 UUS10U Microsoft Corporation1$0"UWindows Production PCA 20230 260430183934Z 270429183934Z0p1 0 UUS10U Washington10URedmond10U Microsoft Corporation10UMicrosoft Windows0‚¢0  *†H†÷ ‚�0‚Š‚�‘4�bI‹¤pª%õx·3 mÿ¢­Ë�~ƒ§¼83`‚;P#tίe¤�Cþ #3å²&Á˜ ¯jçášè1zçõ•QÉ í,-åKMŽÁï_¼É¨$Ð8õ /åÛÈ?ˆÙvE¼¸Å^WxqÖeþ¸nQ¶vŽ’Ï—3�Iù~dÙÀBžoã¢KÚ>w/¶õçøLFþìæíìð "UÀ HP…Ò LRý.Âk'ümAѶËt·Õ« !N _Gã×ÿaE3ˆX‡2þr¤ª0É{:s¤ÿáV1!Üîiëa‚FÁ4›j8.�.šwk!‡G'à㉠¨X½ùnÌ�ž£«d%š&_'Ö9ïñö¿4Ë‘k[Åý;™Š?Ý9ÞÎÄ“ÙúˆÃx°…¿¹+vEÀÔ->ÔLþTÙ¨CÔ_ îþn#‰¹oÒ]y”¸Og”êáV½×gHG+?£òatØí„Ê®,1×^r-ˆ¼«‘°¦Ð15ôºtå�£‚�0‚‹0Uÿ€0U%0 +‚7 +0U+N°£îÜNÁ"Þêø‘»“è!˜ 0EU>0<¤:0810U Microsoft Corporation10U 500446+5079150U#0€†í ®?Z Ò=!UŸ1S"ø0ZUS0Q0O M K†Ihttp://www.microsoft.com/pkiops/crl/Windows%20Production%20PCA%202023.crl0g+[0Y0W+0†Khttp://www.microsoft.com/pkiops/certs/Windows%20Production%20PCA%202023.crt0 Uÿ00  *†H†÷  ‚°4Z ¾Ïÿ ß 1ÝŽ ú ÙË«5FÑðV£5­Ù;DÅ�-%ŒÛšði²Òø‚ÇÝú õà¹�âM¥ûÙr²'4¯Æ”¨­!I皸a08.Ëwq±ñ Ì”`Щç!É™O¤š·�¶{þõ‡þ±yÅìeNu÷ äjàŽÒ‚¶ºÌ”¨Xfæ­C ƒË¼çSÕ.” TÏQG¬å¾ýñ¦R«—|d5$ç²æÊÏk—¬ÏO÷½ëŠJ“ÑL3˜áê$À|žªÃ!&OÌ…X=½‹H\Ü\ þê¡{ÈPíΞ“ežÝ;¶Ï³b¯è'iN�àÔÛ²cå×ûß -fëŽxðï9™Çbã+‡V#)¥!Ëœ–yó‡ƒ^\ì);õÌW툊kLf3¹×úñšžS71¬§è ár­Póã`FVÒsaˆ†ê /C)Ò¨:Î/Њ$n¢Ehý1¢wÇo‚mGPžð�¸6Äh˜¦~ï¢!R¯‘ªÃ&À­òaÅùrÀÑ!4ý¯È BsˆwürÀ¦_ïewÕõ|­8äbPä§OÎB›_šLÐÁ;™þ¨Špöì5°zá»ÝÕÆÎ™/2Á)ìt°a‚è#Z¿\ãÔ� êlÔ(‹CRæ|ê3³!^ ÐBÍ$�̦»ÿV H©,Õ F�ÒD?”0‚±0‚™ 3…½V KøÈ!0  *†H†÷  0�ˆ1 0 UUS10U Washington10URedmond10U Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100 230613183415Z 350613184415Z0S1 0 UUS10U Microsoft Corporation1$0"UWindows Production PCA 20230‚"0  *†H†÷ ‚0‚ ‚Õ.å ]nqKÛÚHëÞòb!ŒNF›á-i©Y 3ŠÀ©'xû‚»v}†¬ Ç/gÛÀW†ó·ì@äSp©ƒ¼××’rKÒ³>’Ñeê)üVÑÆƒªo¯‚®[„Ÿyé¼2Ÿ•áñá—þŒ’æ‚ió]U`—Ë°Í´Ž¦ªâ¡˜�g†¢··xLôm%5¶„˜ƒuG<¦>#Í…Ò¥_x BÊf.‹¡Þ•FoÓà)˜ûçݹÜ<-©}ƒˆ Î­úÛÝ=p2è��y¥�Q¡ºô¾¨UAo•ìäCøĵ¤€��Z¬U~¾f*>™íP‰I!#è•x(Liišnjk¡I¾ŸsWLê�ß3uoÒøÄ¿ÀªÍX°-*e+ÆH$� „½y€¢\å˜ ÎÏn%ú8™÷€!°±¼_>™Ô¶ RH­0Æ¥>f»–~4ÜQb®o³=¦„�ª5?QI^©}ÖÒîæÚPøuéÙOÙlzp0H}q€À·RQ#¸èOÀ3 «J/­xw_ì W’Ÿ;Q5x?”EŠ‚pd„íû½§"H¬äi—'ư ü”<™œN¢¿›d"ôάk¥æóË¡¯¥<$Îìqº®Çès½Ñ…[*:Î4 Gª ìgÃc˜%,ðÁCXt�üEåñ‘�ìpŠ‚äŸîö‹ô»£‚F0‚B0Uÿ†0 +‚70U†í ®?Z Ò=!UŸ1S"ø0 +‚7  SubCA0Uÿ0ÿ0U#0€ÕöVË�è¢\bhÑ=”�[×ΚÄ0VUO0M0K I G†Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0†>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0  *†H†÷  ‚‘0Bhß„Ý<˜oÈÿ³NrûœU˜åê|q¸çã5ÑÚr5˜²¸ówy^œHwœ•4½èA׫ò`’ 6Þ(×™ÏVäoàBRmûMv¸Æs%œ·¡ÍëDÁÙÝ �Д�(·Ã8-nöÁôE"}¨ÀK€“|§üÃlBæ£sûy‹¯½èŠ[÷µøQùçî…`riAjÑð/7ÍX ,!ê¦Nvw¤Z™¹Êù†* YÛºÓT“¶ éüJqîƾ·aÙÜ€‰rÍ?TƒAGµ�ÇÞ–éÉBÓésQ½’ÇW[4¡ŸY¶eɃÑ`™ ¼zÀ+�Áýt¬›ŒÔ8¦+[ge‘Ç< €WIñ§ 2i‚K ‹à Mñ�Ky¾ƒWÈ{ÔœGH“�²‹°†$¯ór9öêÔ{¨.ÉY´k®¸ó©…ÑÃ!ÐÜBtÂ�¶5çϼ߳�.Ïôò:¿Ý’aú¼5ʡ߸ήzå-ë{]vªZåÎàÃ\aLøltÂÍ÷ovµ s ¹°|jll8¨¹ÌU×ÿ¡pkJŸ»{þŒ×DqÛ‹`QÅÕúJzzùQ‰D²=ÌãEï_c E–oM0vÛáÝ�”UÎʃžƒUFœ„—Ù ˜—]’ýªk%Xa ¢ ÏÛýJbê^g|X\�©#ÍÉokPy/×p1‚`0‚\0j0S1 0 UUS10U Microsoft Corporation1$0"UWindows Production PCA 20233$]¢‘qà •ª$0  `†He �®0 *†H†÷  1  +‚70 +‚7 10  +‚70/ *†H†÷  1" ¬“ͤq3‡æ±� ¬‚_èKã´JŒÖÇ%¶=«¸0B +‚7 1402 €Microsoft¡€http://www.microsoft.com0  *†H†÷ ‚€¦w¤š/%˜§zõ"vÙßÅשÄ�?Í«Òh4²˜¥UÄ%)îæNާd7ƒ½¢†ÍIi!Î5ÝHlÛ¶©«Ì�—¨5eq£oÏôµ[Š,×Ε×Cg¯^Ò—7bOJØ Î ¨!ùNÕ*¦Í”(Ì­ØÁÌ¥Q²áèônP§Ÿ|³AUyI©œcp8£P�f÷©ÏþË<ÅŒ(Z+ ìobµ~–™¸ U2Ûi¯ÿ¹x‹3逼Ǹì�¿\wÃ"âR?—ÙÎómΠÌÛlÜ¡‚–0‚’ +‚71‚‚0‚~ *†H†÷  ‚o0‚k10  `†He0‚R *†H†÷   ‚A‚=0‚9 +„Y 010  `†He êÓ÷€Y„A¶–y ¨A¾/å¨9õS¿Ú”Û�sÝ{j_ÂRvÈ20260721210200.632Z0€ô �Ѥ�Î0�Ë1 0 UUS10U Washington10URedmond10U Microsoft Corporation1%0#U Microsoft America Operations1'0%U nShield TSS ESN:8603-05E0-D9471%0#UMicrosoft Time-Stamp Service ‚ì0‚ 0‚ 3%€Ç7ÆÍªwI%0  *†H†÷  0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100 260219194001Z 270517194001Z0�Ë1 0 UUS10U Washington10URedmond10U Microsoft Corporation1%0#U Microsoft America Operations1'0%U nShield TSS ESN:8603-05E0-D9471%0#UMicrosoft Time-Stamp Service0‚"0  *†H†÷ ‚0‚ ‚¦ñÑâÀã¥\ú/¾j¬"SzªI³ä‹ZeÒw”ªŸ.�z�’Á`BÁZ•’? ×i]ü¢d¶Qév ¥ÅÍêH—³‚ ¾ ´K$$"D 7 ÇõŒÊîõh °²1zW‡´ î¶…SxxÒÕ¿Ÿ‘FÙ'*L«P ÓéšAÚº!Éœ-Ë÷Ç|0�‰N³ADƒ‘,V¶[ì³\þwtmpéøtÎYk¢ñêW^/?ν _%‹””óVšÚщëòlz8³ô“ñ"W(ö %Ì9I°hèœöQ©ûè1"f Z9<€&Zï³-g¿¬j¨Ê PŠd'là à£KH+–å6D@dÇ,ä  oxù€ »ïÏ‘ ò@úá˜rÇŠ“ütÓ>…^0'.¥«AtuûúXjíÅÁí-XŒ†øµ³‘ÿdÓϺ—Ù‡"Þ©üQÂô(¦¤�' öF.š›ÀÉõUËðAÃKzŽš>< ¾å#|,éiî�¸ìPµ W ßOl¥öÀä£ÿ€]_Ò9ïkÄ(AË÷³q+�o‹§¨g¿Ž0øšŸˆ 6Dm‚Ð{®�NŠŠNQrgõŽD;rTs\¸Ïfû“2ÕQ.¼l­€÷»¬•9Ö݆ë}¬ÚÉ ’Ju¤…£™ßx`nå|~çØÑDG?p\ߘ$ŠE¢²rXË£‚I0‚E0U±8ÒªNã_peKµŸÉñÚw0U#0€Ÿ§]^b]ƒôåÒe§S5ér0_UX0V0T R P†Nhttp://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l+`0^0\+0†Phttp://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0 Uÿ00U%ÿ 0 +0Uÿ€0  *†H†÷  ‚�÷6ÉL¨–ï¿%Jåáä|q‹ÈiIZ’!2esò¢ÓxîGëÜ“:·¶ž_~K/·ˆtHº‡°2ËÖxZÖ¹úë[�áš°’ +| BÓ>¦,Øî &“ÈMÌP¥gkÄ™yZDŽt¹¹Á\“‹+?¶9ïB6Üa²>  ¦i„ÕáJÇ 2" yÌuy,­û5õ8blo ˆwLVühtÕ²&÷ý„fœú…$Ò î†àÞÈGšß�J<—}/Rvƒ`Ç)ZÀ¿A±ÙI¥!YvFÔãœ2� öö4°Ä¨UöŽZ®¿5RK G¶mJNWB�úGBÉ·ųڗb�w5Â= +gMý%�ý6F%R<ü>¶­uó‡>Þí"Tlð�ÁšÅGõïâtë¦CžzšlÐ[1d¶Z�Ýxû¥WôûŠ‘È ‰ÒËcB:8’&Tõ‘�>OGpçé§PTÀI Π¸õ­”ÅV­N(ꔆÎõéAw½‹2¦C™¯äØ”{›xŽ¥®�‰e—‚¬mî̶;ôȈÒVÿž0äö@Å"g¥‚s¸´ —¥÷ˆºÏ�šo3âÕ~|{‚=¾H�J•–ÐfS,дÚjò.0‚q0‚Y 3Åçkž›I™0  *†H†÷  0�ˆ1 0 UUS10U Washington10URedmond10U Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100 210930182225Z 300930183225Z0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100‚"0  *†H†÷ ‚0‚ ‚äá¦Lç´r! y¢Ë×$y½Õ‚ÓýîœÒ©lNuÈÊ5WölJàâ½¹>`3ÿ\OÇf÷•SqZâ~JZþ¸6g…F# µ�Ïw2Àè`}jRƒD·¦ŽFkóÅvõ†PÜÁDÈq\Q17  8n�íר&S|9azĪýri¯«¬ö6¾5&dÚ˜;º{3­€[~Œ�Rþ¶èb%ÜjÏ]ôþŽSÏÖì…VMïݼ�¤ã‘�²9,Qœépi Ê6-pŽ1È5(½ã´‡$ÃàÉ�~µT�ÜúU˜mh;šF½í¤®z)7¬ËëƒEçFnÊ2ÕÀ†0\O,âb²Í¹â�ˆä–¬J»¾q©[g`Þø’‘=ý Ïs}AšFuÍÄ_4݉Öý¥ }~üÙžEß¶r/Û}_€ºÛª~6ì6Lö+n¨Qè¿£Ñs¦M7t”4‚ðò·Gí§è™|?LÛ¯^ÂóÕØs=CNÁ39L޼Bh.ê„QFâѽjZasÊg¢^×(vâ3r×§ ðÂú ×co É6d‹[ ¦ƒ!]_0t‘””عPù ‰aó65„GÛÜÑý²ÔÅkö\RQ]Û%º¯PzlÅrï�ùRÄ…“À<Û7Ç?x«E¶õ‡^Ú�žriÆ®{··>jâ.­£‚Ý0‚Ù0 +‚70# +‚7*§RþdÄš¾‚‘http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0  *†H†÷  ‚�U}ü*­á,g1$[ážrKü©oê\¶>NGdx±“—=13µ9×Âq6?Údl|Ðu9m»1äÂ�ûlÑ¡”"îéfg:SMݘº¶xØ6.œ©‚V°¾‰èiຠî{ßjo¾)ËnØ?HuÙÞm‚ õm#TäxSu$W¹ÝŸóŽ=Æóhßeö¤Vª÷•¶(U'Ð$½@ ¿¶]='à@–8¬÷ù)‰Ã¼°T…B³ü ž‹‰çð j�Â�BRuŠ6ÂÃas.,k{n?, x鑲©[ßI£t ¼ì‘€Ò=æJ>f;O»†ú2Ù–ô�ö‘öÎÆtýöLro«u0Å4°zØPþ XÝ@<ÇTm�ctH,±NG-Áq¿dù$¾smÊŽ ½³WITdÙs×[DŽZ‘k Ÿ¤(Üg($º8Kšnû!TkjEG©ñ·®Èè‰^O�ÒÐLvµWT ±iD~|¡alsþ »ìAf=iýËÁAI~~“¾Ëø;ä·¿´Î>¥1Q„¼¿Á‚¢{‰�pþçµÐ(‰ �6ÚºLù›ÿ é4ø$5g+à ¸æŒ™Öá"êð'B=%”ætt[jÑž>í~ 13}¼Ëé{¿8pDÑ�ñÈ«:Š:bÙpcSM�î‚m¥Áqj´U3X³¡pfò¡‚O0‚70�ù¡�Ѥ�Î0�Ë1 0 UUS10U Washington10URedmond10U Microsoft Corporation1%0#U Microsoft America Operations1'0%U nShield TSS ESN:8603-05E0-D9471%0#UMicrosoft Time-Stamp Service¢# 0+SoæÊ8ð#å‡<9pnIl^ �ƒ0�€¤~0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100  *†H†÷  î @Ï0"20260721190239Z20260722190239Z0v0< +„Y 1.0,0 î @Ï0 @ÿ00 î ’O06 +„Y 1(0&0  +„Y   0¡ ¡ 0† 0  *†H†÷  ‚•Jc'윋/h‰¯d‰e"9�b^yѳ¹°ÃËJÇÏNœˆº…«k–™%¶†?é Hšes2ÃÂ12Poq拨ÁÔ·ÐýÑRü•ÊÁ„÷WÏl]䈘!Ù¡Xï<Å#"óæBÇ-)A¶ù:§ú×NlK’¸I†HòÏ{:H'5Y/SDE“/!¬ÛfÁÑK#wuvú0hxºÈ²òDX {ú÷0ìÙñC#n›é­ µ|~#¥%têç™ÜîóÃ¥™‰TT?ºì$y‡ŸØw*+cžóE< ‚kî.N¯½Ò,Û—kW³¸-U5TðiÓ½´4ø…ØL\1‚ 0‚ 0�“0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103%€Ç7ÆÍªwI%0  `†He ‚J0 *†H†÷  1  *†H†÷  0/ *†H†÷  1" rÜî>h÷’ÅBmÏó¤°¬SfDÚ;#CYó>n^0ñ0�ú *†H†÷  /1�ê0�ç0�ä0�½ V îˆz8Ýò÷`¦_å@˜Â¸ÖYút%1j3Ò¡0�˜0�€¤~0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103%€Ç7ÆÍªwI%0" ScÙàž+#�çrgÝ\ËÀ¨éÒá{s¯œÔ•Õ¡¶50  *†H†÷  ‚lK"ÍX‹§fèMi½¯ ¡¹ ™©øAѬv,±­2'9Ïâ*HloiûsV†à”òŸ â¼ »µŽì:»ÒJŠ'òÛJ –dÖ°Ç ­¹ãGU&«¬íŒ¬¼m>l2Sì„ ÌëH�îZð4p¨âC¹E8NÖ”˜öªòŸ’êÀïóÒ1%v†à”ž(•Ä!õ¸]'¥²Å÷u·š M)­Cn¿ 6rdÑò`6¡ë  î®h®ç"¥Är¸°±ôì,@ž`ÿàƒò(åå4mEÇã§yCÁ¼‡Œ›�0š)®àHWòz·.¬u³%ZÚl{œD 8»wáí(C‰cR/¢¯±>Ü!5G­±zòMFTKäRxŽ“œ¡´Çëãƒ+î=ñý”SSðI¥î 0HÁd÷&¨QMh©K2^+@Ž®OÆx®g~¢™D—‰ Pr>ëèß–âIÍÑ!r‰ ·5²wѳÈ e˜…þœ­•kóÊ…–à€|&ÔAèèÞ©G ÏI¡þèªeD‡á{žú¸¢ÈÚœ©wVÅ¡!Ò¦å�+³Šï£íYIQ°16lô"Úƒ{—-¹ÞâNDd®TpÀ13ÄòÀÑÎo„3› hwd�O3*éóý73<_ÓvÖJ•Â(QH³ªû=°3ñç¨_y™è/Â.ã!