MZ�ÿÿ¸@¨º´ Í!¸LÍ!This program cannot be run in DOS mode. $É;=ß�ZSŒ�ZSŒ�ZSŒÓ¬ŒŒZSŒÓQ�ŒZSŒRich�ZSŒPEd†X=ð" ,2€P²u` ì/4(8.rdataà@@.rsrc0 0@@X= lPPX=$¼¼€€8.rdata8.rdata$voltmdP�.rdata$zzzdbg .rsrc$01(€.rsrc$02 {¾ÜU¯MøZÖßg-Àªø¼ã‚šÈɘý°±¨X=ð€0€H€ €€˜€°€%È€à€ø€€(€?@€EX€Fp€Gˆ€H €L¸€RЀSè€~€€€0€¼H€½`€ûx€9�€x¨€¶À€·Ø€¸ð€¹€º €»8€¼P€½h€¾€€¿˜€À°€õÈ€öà€3ø€4€r(€@€X€p€� °ÀÐàð 0@P`p€� °ÀÐàð 0@P`p€� °ÀÐàø'¸ä°(Âät*øäl,’ä/ÐäÐ0Ðä 2àä€3„ä4ªä°6Vä;®ä¸>þä¸B´älF ä Iþä [‚ä�k‚äq^ätwŽä~ìäð„Pä@†:ä|ެä(’H äp�Î ä@¨&äh·>ä¨È¾ähܨäî:äLÿhä´Ò äˆ!@äÈ( äØ1,ä3nät:LäÀ?–äXHpäÈK$äMUIÍþÍþ¸SÈêùE "ò黯ša±ÄÖ¶§Ôn�þ¤®¸„ˆ˜ ¨ MUI bg-BGBC:5 A0 >B:@8B8 ?@>1;5<8.!O<0 =0;8G=0 ?>4@>1=0 8=D>@<0F8O.>44J@60I8 40==8:82> =0 2J7459AB2850<8@0=5 @5?>@J:0 @5?@0B:81@0B=0 2@J7:0 0B53>@8O=0;87@5H:0@54C?@5645=85 =D>@<0B825=@52:;NG20=5 =0 =02830F8OB0PA+BG5B 70 4803=>AB8G=8 ?@>7@5=8O =0 Defender 1I ?@53;54@56>28 :><C=8:0F88 =54@O20=5$:;NG20=5 =0 ?>B@518B5;8 2 A8AB5<0B04@025:BC0;=>@>1;5<8 A ?@>872>48B5;=>ABB0@>1;5<8 A :>=D83C@0F8OB0CFA><>IASRO<05 5 :>=D83C@8@0=>%1 G0A0 A5:8 45=545;O >=545;=8:B>@=8:!@O40 '5B2J@BJ:5BJ:!J1>B08:>30"5AB>25 70 <@56>28 :><C=8:0F88"5AB>25 70 @07?>;030=5 =0 MDE'"5AB>25 70 2:;NG20=5 =0 MDE 2 A8AB5<0B0*"5AB>25 70 AJAB>O=85B> =0 DC=:F88B5 =0 MDE:BC0;=8 B5AB>25 =0 MDE"5AB>25 70 ?@>872>48B5;=>AB"5AB>25 =0 :>=D83C@0F8OB0,"5AB>25 70 CFA (:>=B@>;8@0= 4>ABJ? 4> ?0?:8)PA1"5AB>25 ASR (=0<0;O20=5 =0 ?>2J@E=>ABB0 =0 0B0:0) 570:B828@0=0 ;>:8@0=5@>25@:0 5 5 =0;8G=0%1 CA;C30B0 =5 5 =0;8G=0 5 5 =0;8G=>58725AB=> AJAB>O=85@>F5A$09; ?@>F5A =0 87?J;=5=85!?@O=>0 ?0C700G0;> =0 87G0:20=5!?8@0=5 =0 87G0:20=5B>@>4J;6020=5 =0 87G0:20=5B>0C70 2 87G0:20=5 58725AB=>035@!8AB5<0 2B><0B8G=0 JG=> 01@0=5=>>@<0;=> 0A825= @568<0A825= @568< SxS 568< =0 1;>:8@0=5 =0 EDR0A825= @568< =0 ?@>25@:05 A5 87?J;=O20 0:;NG5=8O 0:;NG5=8OL)@0:=5B5 2J@EC 2@J7:0B0 "=0;87", 70 40 2848B5 ?>4@>1=>AB8 70 :>=AB0B0F88B5.=D>@<0F8O 70 <0H8=0B0=D>@<0F8O 70 <0H8=0B0VMNameVMSize VMLocation =0 01>=0<5=B @C?0 @5AC@A8VmId OSVersion @>9 O4@0@>9 ;>38G5A:8 ?@>F5A>@8 8H:8 =0 O4@>$878G5A:0 ?0<5B5AB>?>;>65=85 =0 PageFile,"5:CI> 87?>;720=5 =0 D09; 70 28@BC0;=0 ?0<5B507>2 @07<5@ =0 @07?@545;5=8O D09; 70 28@BC0;=0 ?0<5B,8:>2> 87?>;720=5 =0 D09; 70 28@BC0;=0 ?0<5B!2J@70= A 4><59=@8AJ548=5= :J< Azure ADPA!2J@70= A @01>B=> <OAB> =0 CAB@>9AB2> 2 Azure AD!JAB>O=85 =0 70?8A20=5"@E8B5:BC@0 =0 >?5@0F8>==0 A8AB5<0@5<5 70 70@5640=5 =0 A8AB5<0B0"1I>A8AB5<5= WinHTTP ?@>:A8 AJ@2J@(#AB@>9AB2>B> 5 70?8A0=> 2 Azure AD 8 MEM7#AB@>9AB2>B> =5 5 70?8A0=> 8 =8:>30 =5 5 18;> 70?8A20=>)#AB@>9AB2>B> A5 C?@02;O20 >B 035=B =0 MDM*#AB@>9AB2>B> A5 C?@02;O20 >B 035=B =0 SCCM6@>1;5< A :>=D83C@0F8OB0 =0 Microsoft Endpoint Manager 1I0 3@5H:0@>1;5< AJA A2J@720=5B>)#AB@>9AB2>B> 5 70?8A0=> 8 A530 5 >B?8A0=>#AB@>9AB2>B> >G0:20 >B?8A20=5 5CA?5H=> ?@8A2>O20=5 =0 ?@028;0PA5CA?5H5= >BG5B 70 ?@028;0'1I0 3@5H:0 ?@8 E81@84=> ?@8AJ548=O20=55AJ>B25BAB285 =0 :;85=B0.%81@84=0 3@5H:0  B>G:0 70 A2J@720=5 =0 CA;C30@5H:0 2 A5@B8D8:0B&5?@028;=0 :>=D83C@0F8O =0 AAD Connect @5H:0 2 DNS(@>1;5< AJA A8=E@>=870F8OB0 =0 G0A>2=8:0MDE 8 ConfigMgr>A;545= >?8B 70 @538AB@8@0=5#A?5H=0 ?>A;54=0 @538AB@0F8O&>A;54=> CA?5H=> :0G20=5 =0 B5;5<5B@8O/@56>20 70I8B0 supportedUris (?>A;54=0 ?@><O=0)5@56>20 70I8B0 customSupportedUris (?>A;54=0 ?@><O=0)PAEDR=D>@<0F8O 70 Sense5@A8O =0 Sense!JAB>O=85 =0 CA;C30B0 Sense =0 >@30=870F8OB0 =0 CAB@>9AB2>.GUID =0 AJAB>O=85B> 70 70I8B0 A@5IC ?>4?@02O=5%!JAB>O=85 =0 CA;C30B0 DiagTrack (UTC)N 07?>;>65=0 5 2J7<>6=>ABB0 70 70I8B0 A@5IC =5?@02><5@=0 A<O=0 =0 A0<>;8G=>ABB0!5@A8O =0 :>=D83C@0F8OB0 =0 Sense =0 MachineAuthStartType =0 CA;C30B0 Sense25AB>?>;>65=85 =0 F5=BJ@0 70 40==8 =0 CAB@>9AB2>B>5#AB@>9AB2>B> 5 @538AB@8@0=> G@57 >?@>AB5=0 A2J@70=>AB7!B0@B>2 B8? =0 0A8AB5=B 70 2;870=5 2 0:0C=B 2 MicrosoftPA Defender AV=D>@<0F8O 70 Defender AV!!JAB>O=85 =0 CA;C30B0 Defender AV!5@A8O =0 ?;0BD>@<0B0 Defender AVW5@A8O =0 Defender ?@>3@0<0 A@5IC 7;>=0<5@5= A>DBC5@ 70 0=0;8B8G=0 8=D>@<0F8O 70 70I8B0+5@A8O =0 0=B828@CA=8O 42830B5; =0 DefenderAV @568< =0 Defender&>=D83C@0F8O =0 Defender AV SSLOptionsD>=D83C@0F8O =0 ?@>:A8 70 Defender ?@>3@0<0 A@5IC 7;>=0<5@5= A>DBC5@-!B0BCA =0 CA;C30B0 &5=BJ@ 70 70I8B0 2 Windows7!JAB>O=85 =0 CA;C30B0 70 87?@02=>AB =0 0I8B0 2 Windows2!B0BCA =0 CA;C30B0 70 <@56>20 ?@>25@:0 =0 Defender&!B0BCA =0 >A=>2=0B0 CA;C30 =0 Defender)Defender 5 70I8B5= >B 7;>=0<5@5=0 ?@><O=057B>G=8: =0 70I8B0 >B 7;>=0<5@5=0 ?@><O=0 =0 Defender77:;NG5=8O 70 70I8B0 >B 7;>=0<5@5=0 ?@><O=0 =0 DefenderSmartLocker Mode =B8H?8>=A:8 A>DBC5@ =0 Defender# 568< =0 <@56>20 70I8B0 =0 Defender@53;5409B5 <@56>20B0 A8 :>=D83C@0F8O 8 A5 C25@5B5, G5 =5>1E>48<8B5 URL 04@5A8 =5 A0 1;>:8@0=8. 0 ?>25G5 8=D>@<0F8O 286B5: %1URL 04@5A8 =0 CA;C38Š"5AB20=5B> =0 2@J7:0B0 :J< URL 04@5A8B5 =0 CA;C30B0 2 >1;0:0 =0 Microsoft Defender 70 :@09=0 B>G:0 (CnC) 702J@H8 CA?5H=>. %1 A @57C;B0B %2®"5AB20=5B> =0 2@J7:0B0 A URL 04@5A8B5 =0 CA;C30B0 2 >1;0:0 =0 Microsoft Defender 70 :@09=0 B>G:0 (CnC) 5 =5CA?5H=>. "5ABJB 5 =5CA?5H5= 70 A;54=8O URL 04@5A: %1 A @57C;B0B %2°A8G:8 B5AB>28 2@J7:8 :J< URL 04@5A8B5 =0 CA;C30B0 2 >1;0:0 =0 Microsoft Defender 70 :@09=0 B>G:0 (CnC) A0 =5CA?5H=8. "5ABJB 5 =5CA?5H5= 70 A;54=8O URL 04@5A: %1 A @57C;B0B %2Š"5AB20=5B> =0 2@J7:0B0 A URL 04@5A8B5 =0 CA;C30B0 2 >1;0:0 =0 Microsoft Defender 70 :@09=0 B>G:0 (Cyber) 702J@H8 CA?5H=>. %1 A @57C;B0B %2°"5AB20=5B> =0 2@J7:0B0 A URL 04@5A8B5 =0 CA;C30B0 2 >1;0:0 =0 Microsoft Defender 70 :@09=0 B>G:0 (Cyber) 5 =5CA?5H=>. "5ABJB 5 =5CA?5H5= 70 A;54=8O URL 04@5A: %1 A @57C;B0B %2»A8G:8 B5AB>28 2@J7:8 :J< URL 04@5A8B5 =0 CA;C30B0 2 >1;0:0 =0 Microsoft Defender 70 :@09=0 B>G:0 (:815@A83C@=>AB) A0 =5CA?5H=8. "5ABJB 5 =5CA?5H5= 70 A;54=8O URL 04@5A: %1 A @57C;B0B %2‹"5AB20=5B> =0 2@J7:0B0 A URL 04@5A8B5 =0 CA;C30B0 2 >1;0:0 =0 Microsoft Defender 70 :@09=0 B>G:0 (AutoIR) 702J@H8 CA?5H=>. %1 A @57C;B0B %2­5CA?5H=> B5AB20=5 =0 2@J7:0B0 A URL 04@5A8B5 =0 CA;C30B0 2 >1;0:0 =0 Microsoft Defender 70 :@09=0 B>G:0 (AutoIR). "5ABJB 5 =5CA?5H5= 70 A;54=8O URL 04@5A: %1 A @57C;B0B %2³A8G:8 B5AB>28 2@J7:8 :J< URL 04@5A8B5 =0 CA;C30B0 2 >1;0:0 =0 Microsoft Defender 70 :@09=0 B>G:0 (AutoIR) A0 =5CA?5H=8. "5ABJB 5 =5CA?5H5= 70 A;54=8O URL 04@5A: %1 A @57C;B0B %2“"5AB20=5B> =0 2@J7:0B0 :J< URL 04@5A8B5 =0 CA;C30B0 2 >1;0:0 =0 Microsoft Defender 70 :@09=0 B>G:0 (SampleUpload) 702J@H8 CA?5H=>. %1 A @57C;B0B %2·"5AB20=5B> =0 2@J7:0B0 A URL 04@5A8B5 =0 CA;C30B0 2 >1;0:0 =0 Microsoft Defender 70 :@09=0 B>G:0 (SampleUpload) 5 =5CA?5H=>. "5ABJB 5 =5CA?5H5= 70 A;54=8O URL 04@5A: %1 A @57C;B0B %2¹A8G:8 B5AB>28 2@J7:8 :J< URL 04@5A8B5 =0 CA;C30B0 2 >1;0:0 =0 Microsoft Defender 70 :@09=0 B>G:0 (SampleUpload) A0 =5CA?5H=8. "5ABJB 5 =5CA?5H5= 70 A;54=8O URL 04@5A: %1 A @57C;B0B %2‘"5AB20=5B> =0 2@J7:0B0 A URL 04@5A8B5 =0 CA;C30B0 2 >1;0:0 =0 Microsoft Defender 70 :@09=0 B>G:0 (MdeConfigMgr) 702J@H8 CA?5H=>. %1 A @57C;B0B %2PA·"5AB20=5B> =0 2@J7:0B0 A URL 04@5A8B5 =0 CA;C30B0 2 >1;0:0 =0 Microsoft Defender 70 :@09=0 B>G:0 (MdeConfigMgr) 5 =5CA?5H=>. "5ABJB 5 =5CA?5H5= 70 A;54=8O URL 04@5A: %1 A @57C;B0B %2¹A8G:8 B5AB>28 2@J7:8 :J< URL 04@5A8B5 =0 CA;C30B0 2 >1;0:0 =0 Microsoft Defender 70 :@09=0 B>G:0 (MdeConfigMgr) A0 =5CA?5H=8. "5ABJB 5 =5CA?5H5= 70 A;54=8O URL 04@5A: %1 A @57C;B0B %2Œ"5AB20=5B> =0 2@J7:0B0 :J< URL 04@5A8B5 =0 CA;C30B0 2 >1;0:0 =0 Microsoft Defender 70 :@09=0 B>G:0 (OneDs) 702J@H8 CA?5H=>. %1 A @57C;B0B %2°"5AB20=5B> =0 2@J7:0B0 A URL 04@5A8B5 =0 CA;C30B0 2 >1;0:0 =0 Microsoft Defender 70 :@09=0 B>G:0 (OneDs) 5 =5CA?5H=>. "5ABJB 5 =5CA?5H5= 70 A;54=8O URL 04@5A: %1 A @57C;B0B %2²A8G:8 B5AB>28 2@J7:8 :J< URL 04@5A8B5 =0 CA;C30B0 2 >1;0:0 =0 Microsoft Defender 70 :@09=0 B>G:0 (OneDs) A0 =5CA?5H=8. "5ABJB 5 =5CA?5H5= 70 A;54=8O URL 04@5A: %1 A @57C;B0B %2X@>25@:0B0 =0 A5@B8D8:0B0 70 CA;C30B0 Defender 70 :@09=0 B>G:0 2 >1;0:0 702J@H8 CA?5H=>.3@>25@:0 =0 >B<O=0B0 =0 A5@B8D8:0B0 =5 5 872J@H5=0.Q!2J@720=5B> A >1;0:0 <>65 40 1J45 =0@CH5=> ?>@048 =5CA?5H=> >B<O=0 =0 A5@B8D8:0B.Ž#25@5B5 A5, G5 A;54=8B5 URL 04@5A8 =5 A0 1;>:8@0=8: %1 8 %2. 0 ?>25G5 8=D>@<0F8O 286B5 %3. 0 ?>4@>1=0 8=D>@<0F8O 70 3@5H:0B0 ?@53;5409B5 %4.["5AB20=5B> =0 2@J7:0B0 A >1;0G=0B0 CA;C30 =0 Microsoft Defender Antivirus ?@8:;NG8 CA?5H=>.X"5AB20=5B> =0 2@J7:0B0 A >1;0G=0B0 CA;C30 =0 Microsoft Defender Antivirus =5 15 CA?5H=>.O:> Microsoft Defender Antivirus 5 20H5B> >A=>2=> 0=B828@CA=> @5H5=85 8;8 AB5 871@0;8 40 0:B828@0B5 @568<0 =0 1;>:8@0=5 =0 EDR, <>;O, C25@5B5 A5, G5 2@J7:8B5 :J< AV >1;0G=8B5 URL 04@5A8 =5 A0 1;>:8@0=8. 0 ?>25G5 8=D>@<0F8O 286B5: https://learn.microsoft.com/defender-endpoint/configure-network-connections-microsoft-defender-antivirus4"5:CI0B0 <@56>20 2@J7:0 =5 5 A 87<5@5=> ?>B@51;5=85.4"5:CI0B0 <@56>20 2@J7:0 5 A 87<5@5=> ?>B@51;5=85. %1ã@568B5 A 87<5@5=> ?>B@51;5=85 <>30B 40 >3@0=8G0B DC=:F8>=0;=>ABB0 2 :><C=8:0F8OB0 =0 Defender MAPS, =0?@8<5@ =5 A5 87?@0I0B 70O2:8 70 A?5H=8 ?>4?8A8 (=5>1E>48<8 70 ?5@A>=0;878@0=8 8=48:0B>@8 2 4>?J;=5=85 :J< A?5H=8B5 ?>4?8A8).01;86020 ;8<8B =0 40==8: %1PAOverDataLimit: %1 >C<8=3: %1NetworkCostType: %1š"5AB20=5B> =0 2@J7:0B0 :J< URL 04@5A8B5 =0 CA;C30B0 2 >1;0:0 =0 Microsoft Defender 70 :@09=0 B>G:0 (:>=D83C@0F8O =0 ECS) 702J@H8 CA?5H=>. %1 A @57C;B0B %2("5AB>20B0 2@J7:0 A CA;C30B0 2 >1;0:0 =0 Microsoft Defender 70 :@09=0 B>G:0 (:>=D83C@0F8O =0 ECS) 2J@=0 HTTP 502 =5?@028;5= H;N7. ">20 5 8725AB5= ?5@8>48G5= ?@>1;5< A H;N70 70 ?@8;>65=8O =0 Azure 8 <>65 40 A5 @07@5H8 A0<>AB>OB5;=>. ?8B09B5 >B=>2> ?@>25@:0B0, 0:> B>20 ?@>4J;6020. %1 A @57C;B0B %2ÀA8G:8 B5AB>28 2@J7:8 :J< URL 04@5A8B5 =0 CA;C30B0 2 >1;0:0 =0 Microsoft Defender 70 :@09=0 B>G:0 (:>=D83C@0F8O =0 ECS) A0 =5CA?5H=8. "5ABJB 5 =5CA?5H5= 70 A;54=8O URL 04@5A: %1 A @57C;B0B %2PA„:> 2J7=0<5@O20B5 40 @07@5H8B5 C?@02;5=85B> =0 :>=D83C@0F8OB0 70 70I8B0 =0 MDE, 286B5 A;54=0B0 4>:C<5=B0F8O 70 A?8AJ:0 A 878A:20=8O.>44J@60=8 ?;0BD>@<8p#AB@>9AB2>B> =O<0 <8=8<0;=>B> =82> =0 :>@5:F8O 70 2=54@O20=5 =0 C?@02;5=85B> =0 :>=D83C@0F8OB0 =0 MDE 70I8B0: %1¶#AB@>9AB2>B> 8<0 8=AB0;8@0=0 @>;O =0 CA;C38 70 8<5=0 =0 Active Directory. >44@J6:0B0 70 4><59=>28 :>=B@>;5@8 2 <><5=B0 5 2 ?@5420@8B5;5= ?@53;54 8 878A:20 4>?J;=8B5;=0 :>=D83C@0F8O.‹:> 2J7=0<5@O20B5 40 0:B828@0B5 C?@02;5=85B> =0 :>=D83C@0F8OB0 70 70I8B0 =0 MDE 70 4><59=>28 :>=B@>;5@8, <>;O, 286B5 A;54=0B0 4>:C<5=B0F8O.K7?>;720=5 =0 C?@02;5=85B> =0 =0AB@>9:8B5 70 70I8B0 =0 4><59=>28 :>=B@>;5@8‹#AB@>9AB2>B> @01>B8 A 32-18B>20 >?5@0F8>==0 A8AB5<0, :>OB> =5 A5 ?>44J@60 70 2=54@O20=5 =0 C?@02;5=85B> =0 :>=D83C@0F8OB0 70 70I8B0 =0 MDE.PAq1J@=5B5 2=8<0=85, G5 :><?8;0F8OB0 =0 ! =0 CAB@>9AB2>B> =5 A5 ?>44J@60 >B MDE 8 =5 <>65 40 1J45 @538AB@8@0=0: %1>86B5 B078 AB0B8O 70 A?8AJ: =0 ?>44J@60=8B5 25@A88 =0 Windows.C%1 =0 B>20 CAB@>9AB2> =5 A5 87?J;=O20 =0 >G0:20=>B> =82> =0 70I8B0.—0 ?>25G5 8=D>@<0F8O >B=>A=> PPL 70I8B0B0 8 70I> 5 :@8B8G=0, 286B5 B078 4>:C<5=B0F8O. !2J@65B5 A5 A ?>44@J6:0B0 =0 Microsoft, 0:> ?@>1;5<JB ?@>4J;6020.PPL‘<09B5 ?@54284, G5 8740=85B> =0 AJ@2J@0 A0<> 70 Hyper-V, 8=AB0;8@0=> =0 B>20 CAB@>9AB2>, =5 A5 ?>44J@60 >B MDE 8 =5 <>65 40 1J45 @538AB@8@0=>: %1Y>;O, 286B5 ?>44J@60=0B0 4>:C<5=B0F8O =0 MDE 70 A?8AJ: A ?>44J@60=8B5 8740=8O =0 AJ@2J@0.>44J@60=8 25@A88 =0 Windows#A;C30 MDE Sense#A;C30 MDE AV Windefend#A;C30  0I8B0 2 Windows Windows SecurityHealth Service&#A;C30 MDE Network Protection WdnisSvc!A=>2=0 CA;C30 =0 Defender =0 MDEPA$0 ?>25G5 8=D>@<0F8O 286B5 AB0B8OB0.•<09B5 ?@54284, G5 B078 <0H8=0 @01>B8 A >AB0@O;0 25@A8O =0 ?;0BD>@<0B0 Defender. 5@A88B5 =0 ?;0BD>@<0B0, ?>-AB0@8 >B N-2, 25G5 =O<0 40 A5 ?>44J@60B.'Microsoft Defender AntiMalware PlatformF<09B5 ?@54284, G5 B078 <0H8=0 A5 87?J;=O20 A >AB0@O;0 25@A8O =0 O4@>B> =0 Defender Antivirus. >44@J6:0B0 70 ?@548H=8B5 425 25@A88 A;54 874020=5B> =0 =>20 25@A8O =0 ?0:5B0 A5 A25640 A0<> 4> B5E=8G5A:0 ?>44@J6:0. 5@A88, ?>-AB0@8 >B BOE, A0 871@>5=8 2 B>78 @0745; 8 A5 ?@54>AB02OB A0<> 70 B5E=8G5A:0 ?>44@J6:0 ?@8 =043@0640=5.#Microsoft Defender Antivirus engineä<09B5 ?@54284, G5 B078 <0H8=0 @01>B8 A >AB0@O;0 25@A8O =0 0=0;8B8G=0B0 8=D>@<0F8O 70 70I8B0. @5?>@JG8B5;=> 5 40 ?@8;>68B5 =09-=>20B0 25@A8O =0 0=0;8B8G=0B0 8=D>@<0F8O 70 70I8B0, 70 40 >A83C@8B5 >?B8<0;=0 70I8B0 8 AJ2<5AB8<>AB.9:BC0;870F88 =0 0=B828@CA=0B0 ?@>3@0<0 Microsoft DefenderP=48:0B>@  =01;N4020 A5 28A>:0 C?>B@510 =0 ?@>F5A>@0 ?>@048 B@0D8: =0 Sense NDRH?8B09B5 40 ?@8;>68B5 87:;NG5=8OB0 =0 Sense EDR :J< A;54=8B5 ?@>F5A8: %18A>:> 87?>;720=5 =0 ?@>F5A>@0N;0BD>@<0B0 MDE 5 87?8B0;0 28A>:0 C?>B@510 =0 ?0<5BB0 A B5:CI8B5 25@A88 =0 MDE8A>:> 87?>;720=5 =0 ?0<5BB0)5CA?5H=8 0:BC0;870F88 =0 ?;0BD>@<0B0 MDE'5CA?5H=8 0:BC0;870F88 =0 MDE 42830B5;O*5CA?5H=8 0:BC0;870F88 =0 ?>4?8A8B5 =0 MDEQ:BC0;870F8OB0 =0 ?>4?8A8B5 =0 MDE =5 CA?O20, BJ9 :0B> 25G5 8<0 @01>B5I 5:75<?;O@y7G0:20=5 =0 2A8G:8 ?@>F5A8 :75<?;O@8B5 =0 MpSigStub.exe A0 87:;NG5=8, ?@548 40 >?8B0B5 >B=>2> 40 0:BC0;878@0B5 ?>4?8A0.P#A;C30B0 Windefend =0 MDE =5 CA?O 40 A5 8=8F80;878@0 CA?5H=> 8 >AB0=0 =0 5B0? %1{ 5AB0@B8@09B5 <0H8=0B0 8 0:BC0;878@09B5 4> =09-=>20B0 ?;0BD>@<0 Defender 8 0:> ?@>1;5<JB ?@>4J;6020, AJ>1I5B5 =0 Microsoft.K#A;C30B0 Windefend =0 MDE =5 CA?O 40 A5 87:;NG8 CA?5H=> 8 >AB0=0 =0 5B0? %1b:BC0;878@09B5 4> =09-=>20B0 ?;0BD>@<0 Defender 8 0:> ?@>1;5<JB ?@>4J;6020, AJ>1I5B5 =0 Microsoft.]7:;NG5=85B> =0 MDE ?@5?@0I0 :J< ?@><5=;828 =0 A@540B0 (%1), :>8B> =5 A0 A8AB5<=8 ?@><5=;828.l>;O, ?@53;5409B5 87:;NG5=8OB0 A8: '%1' 70 40 A5 C25@8B5, G5 ?@5?@0I0B :J< ?@028;=8B5 ?@><5=;828 =0 A@540B0.PA>5CA?5H=> 872;8G0=5 =0 ?@54?>G8B0=8OB0 =0 Defender 70 Windows.}:> AB5 2J7=0<5@O20;8 40 2=54@8B5 C?@02;5=85 =0 :>=D83C@0F8OB0 =0 MDE CAB@>9AB2>, 286B5 A;54=0B0 AB0B8O 70 ?>25G5 8=D>@<0F8O.C@>25@5B5 40;8 CA;C30B0 Windows Defender A5 87?J;=O20 8 5 4>ABJ?=0.@>=D83C@8@09B5 Microsoft Defender Antivirus G@57 3@C?>28 ?@028;078A:20=8O 70 A2J@70=>ABX>=D83C@8@09B5 E81@84=> ?@8AJ548=O20=5 :J< Azure Active Directory 70 C?@02;O20=8 4><59=8>@B0; 70 70I8B0 =0 M365rBAB@0=O20=5 =0 ?@>1;5<8 A 2=54@O20=5B>, A2J@70=8 A C?@02;5=85B> =0 70I8B0B0 70 Microsoft Defender 70 :@09=0 B>G:0&;NG 70 ?@028;0 =0 MDE ?> ?>4@0718@0=50;NG 70 A5=7>@=0B0 CA;C30 =0 MDE ?> ?>4@0718@0=5.JB 4> :5H 48@5:B>@8OB0 =0 MDE ?> ?>4@0718@0=5-JB ?> ?>4@0718@0=5 =0 48@5:B>@8OB0 MDE Cyber*JB 4> 48@5:B>@8OB0 =0 MDE ?> ?>4@0718@0=56JB 4> 48@5:B>@8OB0 ProgramData =0 MDE ?> ?>4@0718@0=53JB 4> 2@5<5==0B0 48@5:B>@8O =0 MDE ?> ?>4@0718@0=5:JB 4> 48@5:B>@8OB0 70 ?@>A;54O20=5 =0 MDE ?> ?>4@0718@0=5Ò7B@89B5 :;NG>25B5 >B A8AB5<=8O @538ABJ@, A2J@70=8 A DC=:F8OB0 A@5IC =5?@02><5@=0 A<O=0 =0 A0<>;8G=>ABB0, 70 40 =0:0@0B5 CAB@>9AB2>B> 40 35=5@8@0 =>2 ;8G5= :;NG 8 40 A5 @538AB@8@0 >B=>2>. 7?J;=5B5 :><0=40B0 %1„O<0 :0:2> 40 A5 =0?@028. > 2@5<5 =0 2@5<5B>, 70?>G20I> >B Cyberthrottling, 8=48:0B>@JB 70 AJ18B85 =5 5 ?>B5:J; 2 ?>@B0;0 =0 MDATP. ">20 CAB@>9AB2> A5 >?8B0 40 A5 @538AB@8@0 G@57 035=B0 =0 035=B0 70 =01;N45=85 =0 Microsoft (MMA), => =5CA?5H=>, BJ9 :0B> =5 ?>44J@60 2=54@O20=5 G@57 B>78 <5B>4.ƒ86B5 =0H0B0 >=;09= 4>:C<5=B0F8O, 70 40 @0715@5B5 :0:J2 <5B>4 70 2=54@O20=5 5 ?>4E>4OI 70 >?5@0F8>==0B0 A8AB5<0 =0 B>20 CAB@>9AB2>.,>44J@60=0 :>=D83C@0F8O 70 2=54@O20=5 =0 MDE?0H8=0B0 5 A2J@70=0 A :>=:@5B5= 845=B8D8:0B>@ =0 :;85=B =0 AAD.À#25@5B5 A5, G5  =0 :;85=B0 =0 AAD >B 20H8O :;85=B =0 MDE AJ2?040 A  =0 :;85=B0 =0 SCP, ?>A>G5= ?>-3>@5. 0 40 2848B5 845=B8D8:0F8OB0 =0 20H8O :;85=B =0 MDE, 286B5 ?>@B0;0 70 70I8B0 =0 M365M#AB@>9AB2>B> ?>44J@60 ?@54>B2@0BO20=5 =0 ?>4?@02O=5 8 5 2 AB018;=> AJAB>O=85.@SharedSignatureRoot 5 :>=D83C@8@0= 8 4>ABJ?5= 70 0:0C=B0 SYSTEM.8>=D83C@0F8OB0 =0 SharedSignatureRoot 873;5640 =>@<0;=0.T!B>9=>ABB0 SharedSignatureRoot 2 A8AB5<=8O @538ABJ@ =5 5 :>=D83C@8@0=0 8;8 4>ABJ?=0.i">20 5 A 8=D>@<0B82=0 F5;  ?@>25@5B5 40;8 :>=D83C@0F8OB0 SharedSignatureRoot 5 >G0:20=0 70 20H0B0 A@540.5>=D83C@0F8O =0 3@0D8:0 70 0:BC0;870F8O =0 ?>4?8A: %15SignatureScheduleDay: %1, SignatureUpdateInterval: %2d@53;5409B5 =0AB@>9:8B5 =0 3@0D8:0 70 0:BC0;878@0=5 =0 ?>4?8A0 A8, :0:B> 5 =5>1E>48<> 70 A@540B0 28.C>=D83C@8@09B5 ?;0=8@0=8 A:0=8@0=8O 70 Microsoft Defender Antivirus.SignatureDefinitionUpdateFileSharesSources: %1l@53;5409B5 =0AB@>9:8B5 70 87B>G=8F8 70 A?>45;O=8O =0 D09;>25 A ?>4?8A8, :0:B> 5 =5>1E>48<> 70 20H0B0 A@540.SignatureFallbackOrder: %1U@53;5409B5 =0AB@>9:8B5 70 @575@25= @54 =0 ?>4?8A8B5, 0:> 5 =5>1E>48<> 70 A@540B0 28.â<09B5 ?@54284, G5 B078 <0H8=0 8<0 ?>;8B8:0, :>OB> ?>72>;O20 4>102O=5 A0<> =0 8740B5;8, 4>25@5=8 =0 1070 4><59=. ">20 <>65 40 ?>?@5G8 =0 A5=7>@0 =0 MDE, :>9B> B@O120 40 8=AB0;8@0 A5@B8D8:0B8 2 E@0=8;8I5B> =0 4>25@5=8 8740B5;8.È0 ?>25G5 8=D>@<0F8O 286B5 AB0B8OB0. 0 40 87153=5B5 =5>G0:20=8 ?@>1;5<8, ?@5<0E=5B5 A2J@70=0B0 :>=D83C@0F8O =0 3@C?>28 ?@028;0: D;03>25 =0 ;>:0;=8O Authenticode= %1, D;03>25 =0 GP Authenticode = %2.04564=8 8740B5;8PAi5 <>65 40 A5 ?@>G5B5 B>G:0B0 70 A2J@720=5 =0 CA;C30B0 (SCP) >B :>=D83C@0F8>==8O 4O; =0 Active Directory.L">G:0B0 =0 A2J@720=5 =0 CA;C30B0 (SCP) AJ4J@60 =5?>44J@60=0 :>=D83C@0F8O: %1I">G:0B0 70 A2J@720=5 =0 CA;C30B0 (SCP) AJ4J@60 =5?>44J@60=0 :>=D83C@0F8O.ˆ#AB@>9AB2>B> =5 <>65 40 A5 ?@8AJ548=8 :J< Azure AD, BJ9 :0B> 70?8AJB SCP 5 :>=D83C@8@0= 40 ?@8AJ548=O20 CAB@>9AB2>B> :J< Enterprise DRS.e">G:0B0 70 A2J@720=5 =0 CA;C30B0 (SCP) =5 5 :>=D83C@8@0=0 2 :>=D83C@0F8>==8O 4O; =0 Active Directory.y5 <>65 40 A5 >AJI5AB28 2@J7:0 A 4><59=>2 :>=B@>;5@ 70 872;8G0=5 =0 8=D>@<0F8O 70 B>G:0B0 =0 A2J@720=5 =0 CA;C30B0 (SCP).r<0 =5AJ>B25BAB285 <564C  =0 :;85=B0 =0 AAD >B 20H8O :;85=B =0 MDE 8  =0 :;85=B0 2 SCP 70?8A0 =0 20H8O 4><59=.¶#25@5B5 A5, G5  =0 :;85=B0 =0 AAD >B 20H8O :;85=B =0 MDE AJ2?040 A  =0 :;85=B0 =0 SCP, ?>A>G5= ?>-3>@5. 0 40 2848B5 845=B8D8:0F8OB0 =0 20H8O :;85=B =0 MDE, 286B5 4>:C<5=B0F8OB0.p#AB@>9AB2>B> A5 C?@02;O20 >B 035=B =0 SCCM 8 =O<0 40 A5 C?@02;O20 >B @5H5=85B> 70 C?@02;5=85 =0 70I8B0B0 =0 MDE.©Configuration Manager 5 ?@87=0B 70 548=AB25= >@30= 70 C?@02;5=85 =0 70I8B0B0. Defender 70 :@09=0 B>G:0 =O<0 40 C?@02;O20 =0AB@>9:8B5 70 70I8B0 =0 CAB@>9AB20, :>8B> 25G5 A5 C?@02;O20B >B Configuration Manager. :> 65;05B5 40 ?@><5=8B5 B>20 ?>2545=85, B@O120 40 704045B5 ?@52:;NG20B5;O  #?@02;5=85 =0 =0AB@>9:8B5 70 70I8B0 A ?><>IB0 =0 Configuration Manager =0  7:;. . 0 4>?J;=8B5;=0 8=D>@<0F8O 286B5 A;54=0B0 4>:C<5=B0F8O.R#AB@>9AB2>B> ?>44J@60 ?@54>B2@0BO20=5 =0 ?>4?@02O=5, => =5 5 2 AB018;=> AJAB>O=85.f86B5 C:070=8OB0 2 A;54=0B0 AB0B8O. !2J@65B5 A5 A ?>44@J6:0B0 =0 Microsoft, 0:> ?@>1;5<JB ?@>4J;6020.3Microsoft Defender 70 :@09=0 B>G:0  CVE-2022-232788Microsoft Defender 70 :@09=0 B>G:0  0=0;87 =0 70?;0E8B5#8?A20B ?JB8I0 ?> ?>4@0718@0=5: %1.˜>;O, C25@5B5 A5, G5 ?>A>G5=8B5 ;8?A20I8 ?JB8I0 AJI5AB2C20B 8 =5 A0 ?@58<5=C20=8. >65 40 A5 =0;>68 40 AJ74045B5 ;8?A20I8B5 ?0?:8 AJA A8AB5<5= :>=B5:AB.PAW">20 CAB@>9AB2> =5 CA?O 40 A5 @538AB@8@0 G@57 Microsoft Endpoint Configuration Manager.£">78 ?@>1;5< <>65 40 2J7=8:=5, 0:> %1 =0 :;NG0 >B A8AB5<=8O @538ABJ@ ;8?A20 >B: %2. 0 40 AJ74045B5 ;8?A20I8O :;NG >B A8AB5<=8O @538ABJ@, <>65B5 40 87?>;720B5: %37#AB@>9AB2>B> 4>:;0420 =0 87B5:J;  =0 >@30=870F8O: %1.U"@O120 40 87:;NG8B5 CAB@>9AB2>B> >B B078 >@30=870F8O 8 A;54 B>20 40 3> @538AB@8@0B5 2 B5:CI0B0 A8 >@30=870F8O. !2J@65B5 A5 A ?>44@J6:0B0 =0 Microsoft, 0:> =O<0B5 4>ABJ? 4> A:@8?B0 70 45@538AB@8@0=5 AJA A?><5=0B8O OrgID. 015;56:0: 0 40 2848B5 B5:CI8O OrgID, >B845B5 2 ?>@B0;0 =0 MDE 8 I@0:=5B5 2J@EC ?>B@518B5;A:>B> 8<5 2 3>@=8O 45A5= J3J;.&5=BJ@ 70 70I8B0–1J@=5B5 2=8<0=85, G5 CAB@>9AB2>B> 8<0 3@5H:0  0@5640=5 =0 ;8G=8O :;NG 70 A5@B8D8:0B0 70 C4>AB>25@O20=5 =0 :;85=B0 2 @538AB@0F8>==8O D09; =0 OpsMgr.…58=AB0;8@09B5 8 8=AB0;8@09B5 >B=>2> MMA (035=B 70 =01;N45=85 =0 Microsoft) =0 B>20 CAB@>9AB2> 8 ?@>25@5B5 40;8 ?@>1;5<JB ?@>4J;6020.95AB=>B> 2@5<5 =0 CAB@>9AB2>B> =5 AJ2?040 A G0A0 2 Azure.”@>25@5B5 40;8 <5AB=>B> A8AB5<=> 2@5<5 5 B>G=> 8 40;8 5 704045=0 ?@028;=0B0 G0A>20 7>=0. :> B>20 CAB@>9AB2> 5 ?@8AJ548=5=> :J< 4><59=, C25@5B5 A5, G5 CA;C30B0 "@5<5 =0 Windows" A5 87?J;=O20 8 CAB@>9AB2>B> 5 A8=E@>=878@0=> A 2@5<5B> =0 20H8O 4><59=. 0 ?>25G5 8=D>@<0F8O :0: 40 :>=D83C@8@0B5 8 :>=B@>;8@0B5 A8=E@>=870F8OB0 =0 2@5<5B>, 286B5 AB0B8OB0, 70 40 A5 C25@8B5, G5 <5AB=>B> 2@5<5 2 BIOS 5 B>G=>. WindowsTimeO#AB@>9AB2>B> @01>B8 A ?>-AB0@0 25@A8O =0 System Center Endpoint Protection: %1.Â"@O120 40 =04AB@>8B5 4> =09-=>20B0 =0;8G=0 25@A8O, 70 40 >A83C@8B5 AJ2<5AB8<>AB 8 40 ?>72>;8B5 >B:@820=5B> =0 7;>=0<5@5= A>DBC5@ 40 A5 @538AB@8@0 2 ?>@B0;0 70 70I8B0 =0 Defender 70 :@09=0 B>G:0.EJ7=8:=0 3@5H:0 2 ?>B>:0 70 C?@02;5=85 =0 :>=D83C@0F8OB0 =0 70I8B0B0.-#AB@>9AB2>B> 5 CA?5H=> @538AB@8@0=> 2 Microsoft Defender 70 :@09=0 B>G:0. J7=8:=0 >10G5 3@5H:0 2 ?>B>:0 70 C?@02;5=85 =0 :>=D83C@0F8OB0 =0 70I8B0B0. @8G8=0B0 <>65 40 1J45 2 B>20, G5 CAB@>9AB2>B> =5 >B3>20@O =0 ?@5420@8B5;=8B5 878A:20=8O 70 :0=0;0 70 C?@02;5=85 =0 Microsoft Defender 70 :@09=0 B>G:0.>@5420@8B5;=8 878A:20=8O 70 Microsoft Defender 70 :@09=0 B>G:0EJ7=8:=0 3@5H:0 2 ?>B>:0 70 C?@02;5=85 =0 :>=D83C@0F8OB0 =0 70I8B0B0.PAõ#AB@>9AB2>B> 5 CA?5H=> @538AB@8@0=> 2 Microsoft Defender 70 :@09=0 B>G:0. 8A?5G5@JB =0 :@09=8 B>G:8 =0 Microsoft >10G5 =5 5 :>=D83C@8@0= G@57 F5=BJ@0 70 4<8=8AB@0F8O 40 @07@5H020 :>=D83C@8@0=5 =0 70I8B0B0 =0 Microsoft Defender 70 :@09=0 B>G:0.4>=D83C@0F8O =0 :;85=B =0 Microsoft Endpoint Manager!J7=8:=0 ?@>1;5< AJA A2J@720=5B>.#AB@>9AB2>B> 5 CA?5H=> @538AB@8@0=> 2 Microsoft Defender 70 :@09=0 B>G:0. J7=8:=0 >10G5 3@5H:0 2 ?>B>:0 70 C?@02;5=85 =0 :>=D83C@0F8OB0 =0 70I8B0B0, :>OB> <>65 40 A5 4J;68 =0 ?@>1;5< AJA A2J@720=5B>. #25@5B5 A5, G5 CAB@>9AB2>B> <>65 40 :><C=8:8@0 A :@09=8 B>G:8 =0 MDE.C@09=8 B>G:8 =0 Azure Active Directory 8 Microsoft Endpoint Manager(1I0 3@5H:0 ?@8 E81@84=> ?@8AJ548=O20=5.H#AB@>9AB2>B> 5 CA?5H=> @538AB@8@0=> 2 Microsoft Defender 70 :@09=0 B>G:0. J7=8:=0 >10G5 3@5H:0 2 ?>B>:0 70 C?@02;5=85 =0 :>=D83C@0F8OB0 =0 70I8B0B0, B0:0 G5 >?5@0F8>==0B0 A8AB5<0 =5 CA?O 40 872J@H8 E81@84=> ?@8AJ548=O20=5. 86B5 2@J7:8B5 70 >BAB@0=O20=5 =0 =587?@02=>AB8 ?@8 E81@84=> ?@8AJ548=O20=5 =0 =82> >?5@0F8>==0 A8AB5<0.^BAB@0=O20=5 =0 =587?@02=>AB8 ?@8 E81@84=8 CAB@>9AB20, ?@8AJ548=5=8 :J< Azure Active Directory5AJ>B25BAB285 =0 :;85=B0.Æ#AB@>9AB2>B> 5 CA?5H=> @538AB@8@0=> 2 Microsoft Defender 70 :@09=0 B>G:0. J7=8:=0 >10G5 3@5H:0 2 ?>B>:0 70 C?@02;5=85 =0 :>=D83C@0F8OB0 =0 70I8B0B0, BJ9 :0B> 20H8OB  =0 :;85=B =0 Microsoft Defender 70 :@09=0 B>G:0 =5 AJ2?040 A 20H8O  =0 :;85=B =0 Azure Active Directory. #25@5B5 A5, G5 845=B8D8:0B>@JB =0 :;85=B0 =0 Azure Active Directory >B 20H8O :;85=B =0 Defender 70 :@09=0 B>G:0 AJ2?040 A 845=B8D8:0B>@0 =0 :;85=B0 2 SCP 70?8A0 =0 20H8O 4><59=./%81@84=0 3@5H:0  B>G:0 70 A2J@720=5 =0 CA;C30.µ#AB@>9AB2>B> 5 CA?5H=> @538AB@8@0=> 2 Microsoft Defender 70 :@09=0 B>G:0. J?@5:8 B>20, 70?8AJB =0 B>G:0 70 A2J@720=5 =0 CA;C30 (SCP) =5 5 :>=D83C@8@0= ?@028;=> 8 CAB@>9AB2>B> =5 <>60 40 A5 ?@8AJ548=8 :J< Azure AD. ">20 <>65 40 A5 4J;68 =0 B>20, G5 SCP 5 :>=D83C@8@0= 40 A5 ?@8AJ548=O20 :J< Enterprise DRS. #25@5B5 A5, G5 70?8AJB SCP A>G8 :J< AAD 8 G5 SCP 5 :>=D83C@8@0= A?>@54 =09-4>1@8B5 ?@0:B8:8. 0 ?>25G5 8=D>@<0F8O 286B5 2@J7:8B5.->=D83C@8@0=5 =0 B>G:0 70 A2J@720=5 =0 CA;C30@5H:0 2 A5@B8D8:0B.A#AB@>9AB2>B> 5 CA?5H=> @538AB@8@0=> 2 Microsoft Defender 70 :@09=0 B>G:0. J7=8:=0 >10G5 3@5H:0 2 ?>B>:0 70 C?@02;5=85 =0 :>=D83C@0F8OB0 70 70I8B0 ?>@048 3@5H:0 2 A5@B8D8:0B0 =0 CAB@>9AB2>B>. !5@B8D8:0BJB =0 CAB@>9AB2>B> ?@8=04;568 =0 4@C3 :;85=B. #25@5B5 A5, G5 A5 A;5420B =09-4>1@8B5 ?@0:B8:8 ?@8 AJ74020=5 =0 ?@>D8;8.04564=8 ?@>D8;8 =0 A5@B8D8:0B8PA'5?@028;=0 :>=D83C@0F8O =0 AAD Connect.R#AB@>9AB2>B> 5 CA?5H=> @538AB@8@0=> 2 Microsoft Defender 70 :@09=0 B>G:0. J7=8:=0 >10G5 3@5H:0 2 ?>B>:0 70 C?@02;5=85 =0 :>=D83C@0F8OB0 =0 70I8B0B0 ?>@048 =5?@028;=0 :>=D83C@0F8O 2 AAD Connect. 0 40 >?@545;8B5 :0:2> ?@5G8 =0 CAB@>9AB2>B> 40 A5 @538AB@8@0 2 AAD, >1<8A;5B5 87?J;=5=85B> =0 8=AB@C<5=B8B5 70 >BAB@0=O20=5 =0 =587?@02=>AB8.D=AB@C<5=B 70 >BAB@0=O20=5 =0 ?@>1;5<8 ?@8 @538AB@0F8O =0 CAB@>9AB2>T!?5F80;878@0=8 8=AB@C:F88 70 >BAB@0=O20=5 =0 =587?@02=>AB8 70 Windows Server 2012 R2 @5H:0 2 DNS.Î#AB@>9AB2>B> 5 CA?5H=> @538AB@8@0=> 2 Microsoft Defender 70 :@09=0 B>G:0. J7=8:=0 >10G5 3@5H:0 2 ?>B>:0 70 C?@02;5=85 =0 :>=D83C@0F8OB0 =0 70I8B0B0 ?>@048 3@5H:0 2 DNS. @>25@5B5 8=B5@=5B 2@J7:0B0 8/8;8 =0AB@>9:8B5 =0 DNS =0 CAB@>9AB2>B>. 520;84=8B5 =0AB@>9:8 =0 DNS <>65 40 A0 >B AB@0=0 =0 @01>B=0B0 AB0=F8O. 0 ?@028;=> DC=:F8>=8@0=5 Active Directory 878A:20 40 87?>;720B5 DNS =0 4><59=0 (0 =5 04@5A0 =0 <0@H@CB870B>@0). 0 ?>25G5 8=D>@<0F8O 286B5 2@J7:8B5.)@>1;5< AJA A8=E@>=870F8OB0 =0 G0A>2=8:0.#AB@>9AB2>B> 5 CA?5H=> @538AB@8@0=> 2 Microsoft Defender 70 :@09=0 B>G:0. J7=8:=0 >10G5 3@5H:0 2 ?>B>:0 70 C?@02;5=85 =0 :>=D83C@0F8OB0 =0 70I8B0B0. @>25@5B5 40;8 G0A>2=8:JB 5 =0AB@>5= ?@028;=> 8 5 A8=E@>=878@0= =0 CAB@>9AB2>B>, :J45B> 2J7=8:20 3@5H:0B0.!5CA?5H=> 87B53;O=5 =0 ?@028;0B0.ä#AB@>9AB2>B> 5 CA?5H=> @538AB@8@0=> 2 Microsoft Defender 70 :@09=0 B>G:0. #AB@>9AB2>B> >10G5 =5 CA?O 40 87B53;8 ?@028;0B0 70 70I8B0 =0 :@09=8B5 B>G:8 >B MEM. #25@5B5 A5, G5 CAB@>9AB2>B> <>65 40 :><C=8:8@0 A :@09=8 B>G:8 =0 MDE.5CA?5H=> >B?8A20=5.Ê#AB@>9AB2>B> 2 <><5=B0 5 70?8A0=>, => B@O120 40 1J45 ?@5<0E=0B>. @>F5AJB =0 >B?8A20=5 >10G5 15H5 =5CA?5H5= ?>@048 2@5<5==0 3@5H:0. @>25@5B5 40;8 CAB@>9AB2>B> <>65 40 :><C=8:8@0 A :@09=8 B>G:8 =0 MDE.!5CA?5H=> ?@8A2>O20=5 =0 ?@028;0.Ä#AB@>9AB2>B> 5 CA?5H=> @538AB@8@0=> 2 Microsoft Defender 70 :@09=0 B>G:0 8 CA?O 40 87B53;8 ?@028;0B0 70 70I8B0 =0 :@09=0 B>G:0 >B MEM. J7=8:=0 >10G5 3@5H:0 ?> 2@5<5 =0 ?@8A2>O20=5B> =0 ?@028;0B0.5CA?5H5= >BG5B 70 ?@028;0.Ì#AB@>9AB2>B> 5 CA?5H=> @538AB@8@0=> 2 Microsoft Defender 70 :@09=0 B>G:0 8 CA?O 40 87B53;8 ?@028;0B0 70 70I8B0 =0 :@09=0 B>G:0 >B MEM. J7=8:=0 >10G5 ?@>1;5< ?> 2@5<5 =0 4>:;0420=5B> =0 ?@028;0B0 :J< MEM.q">20 CAB@>9AB2> =5 <>65 40 1J45 @538AB@8@0=> 2 B5:CI>B> AJAB>O=85, BJ9 :0B> =53>2>B> ImageState 2 '%1' 5 =5?J;=>.ï">78 ?@>1;5< <>65 40 2J7=8:=5, 0:> >1@07JB =0 >?5@0F8>==0B0 A8AB5<0 5 872J@H8; =O:>;:> ?>A;54>20B5;=8 >?8B0 70 87?J;=5=85 =0 sysprep 8 A8AB5<=8OB @538ABJ@ 5 704045= =0 '%1'. !2J@65B5 A5 A ?>44@J6:0B0 =0 Microsoft, 0:> ?@>1;5<JB ?@>4J;6020.3=D>@<0F8O 70 AJAB>O=85B> =0 =0AB@>9:0B0 =0 WindowsY!B>9=>ABB0 ImagePath 2 A8AB5<=8O @538ABJ@ <>65 40 5 18;0 ?>4?@025=0 ?@548 @538AB@8@0=5B>.q@53;5409B5 B078 3@5H:0 8 ?@>25@5B5 ImagePath (2 @0<:8B5 =0 %1), 70 40 A5 C25@8B5, G5 A>G8 :J< 20;845= ?JB =0 %2.6B:@8B8 A0 >3@0=8G5=8 AJ18B8O 70 :815@40==8B5 =0 SenseMDE 8 ConfigMgrA#AB@>9AB2>B> A5 C?@02;O20 A ?><>IB0 =0 Configuration Manager 8 Microsoft Defender 70 :@09=0 B>G:0. #?@02;5=85B> =0 ?@028;0B0 ?@57 420B0 :0=0;0 <>65 40 4>2545 4> :>=D;8:B8 8 =565;0=8 @57C;B0B8. 0 40 87153=5B5 B>20, ?@028;0B0 70 70I8B0 =0 :@09=8B5 B>G:8 B@O120 40 1J40B 87>;8@0=8 2 54=0-548=AB25=0 ?;>A:>AB =0 C?@02;5=85.A!J2<5AB=> AJI5AB2C20=5 A Microsoft Endpoint Configuration Manager !B0BCAJB =0 70?8A20=5 5 ?@><5=5=#AB@>9AB2>B> A5 C?@02;O20 A ?><>IB0 =0 Configuration Manager 8 Microsoft Defender 70 :@09=0 B>G:0. #AB@>9AB2>B> 5 >B?8A0=> >B @5H5=85B> 70 C?@02;5=85 =0 :>=D83C@0F8OB0 =0 70I8B0B0 8;8 70I>B> >1E20BJB =0 87?J;=5=85 5 ?@><5=5=, 8;8 5B8:5BJB MDE-Management 5 ?@5<0E=0B >B CAB@>9AB2>B>.Ê@><5=;820B0 =0 A8AB5<=0B0 A@540 %%TEMP%% (8 %%TMP%%) =5 5 45D8=8@0=0. ">20 <>65 40 4>2545 4> A@82>25 2 @01>B0B0 =0 Windows Defender 8 4@C38 A8AB5<=8 :><?>=5=B8, :>8B> @07G8B0B =0 2@5<5==0B0 48@5:B>@8O.º5D8=8@09B5 ?@><5=;828B5 =0 A8AB5<=0B0 A@540 TEMP 8 TMP. !B>9=>ABB0 ?> ?>4@0718@0=5 5 %%SystemRoot%%\TEMP 70 A8AB5<=8 0:0C=B8. #25@5B5 A5, G5 ?JBOB AJI5AB2C20 8 8<0 ?>4E>4OI8 @07@5H5=8O.’8@5:B>@8OB0 %%TEMP%% =5 5 4>ABJ?=0. ">20 <>65 40 ?@548728:0 >B:078 2 :><?>=5=B8B5 =0 Windows Defender, :>8B> B@O120 40 70?8A20B 2@5<5==8 D09;>25.e@>25@5B5 40;8 48@5:B>@8OB0 %%TEMP%% AJI5AB2C20 8 B5:CI8OB 0:0C=B 8<0 @07@5H5=8O 70 G5B5=5/70?8A20=5.´8@5:B>@8OB0 %%TEMP%% 5 =0AB@>5=0 =0 ?JB, :>9B> =5 5 ?> ?>4@0718@0=5. 5AB0=40@B=8OB ?JB TEMP <>65 40 ?@8G8=8 ?@>1;5<8 A :><?>=5=B8, :>8B> ?@85<0B <5AB>?>;>65=85B> ?> ?>4@0718@0=5.PAÂ@53;5409B5 40;8 ?5@A>=0;878@0=8OB ?JB %%TEMP%% 5 C<8H;5=. :> =5 5, 2J@=5B5 ?@><5=;828B5 =0 A8AB5<=0B0 A@540 TEMP 8 TMP :J< AB>9=>ABB0 ?> ?>4@0718@0=5 (%%SystemRoot%%\TEMP 70 A8AB5<=8 0:0C=B8).i1J@=5B5 2=8<0=85, G5 CAB@>9AB2>B> 8<0 =O:>;:> @01>B=8 >1;0AB8 70 MMA (035=B 70 =01;N45=85 =0 Microsoft).W:> CAB@>9AB2>B> 5 @538AB@8@0=> 2 Defender 70 :@09=0 B>G:0 G@57 8=B53@0F8O =0 ASC (8725AB5= >I5 :0B> Azure Defender 70 AJ@2J@8), B>3020 A5 ?@5?>@JG20 40 ?@5<0E=5B5 @01>B=0B0 >1;0AB =0 MDE, 70 40 87153=5B5 ?@>1;5<8 A :0G20=5B> 2 :815@?@>AB@0=AB2>B>. 0 ?>25G5 8=D>@<0F8O >B=>A=> 8=B53@8@0=5B> =0 ASC A Defender 70 :@09=0 B>G:0, 286B5 AB0B8OB0. MDE 2 Azure“ 538AB@8@0=5B> =0 B078 <0H8=0 5 =5CA?5H=> ?>@048 ;8?A0 =0 @07@5H5=8O 70 HKLM_System_CurrentControlSet_Services_Sense =0 :;NG >B A8AB5<=8O @538ABJ@.å">20 <>65 40 A5 A;CG8 ?>@048 =0<5A0 >B ?@>4C:B8 70 70I8B0 =0 B@5B8 ;8F0 8;8 0:> ;8?A20B @07@5H5=8O 70 ?J;5= :>=B@>; 70 0:0C=B0 SYSTEM 70 HKLM_System_CurrentControlSet_Services_Sense. 0<5@5=8B5 @07@5H5=8O 70 0:0C=B0 SYSTEM A0: %1K<09B5 ?@54284, G5 =0 B>78 AJ@2J@ =5 5 8=AB0;8@0= <>45@5= C=8D8F8@0= 035=B.ß#=8D8F8@0=8OB 035=B 70 AJ@2J@8 >B ?>-=8A:> =82> =5 5 8=AB0;8@0= =0 B>20 CAB@>9AB2>. @5?>@JG20 A5 8=AB0;8@0=5B> =0 =>28O 035=B 70 >?B8<0;=0 ?@>872>48B5;=>AB 8 2J7<>6=>AB8 70 70I8B0. 0 ?>25G5 8=D>@<0F8O 286B5 4>:C<5=B0F8OB0J:;NG20=5 =0 Windows AJ@2J@8 2 CA;C30B0 Microsoft Defender 70 :@09=0 B>G:0VJ7=8:=0 3@5H:0 ?@8 ?@8A2>O20=5B> =0 ?@028;0 ?>@048 A;54=8B5 ?@><5=;828 =0 A@540B0: %12#AB@>9AB2>B> 5 CA?5H=> @538AB@8@0=> 2 Microsoft Defender 70 :@09=0 B>G:0 8 CA?O 40 87B53;8 ?@028;0B0 70 70I8B0 =0 :@09=0 B>G:0 >B MEM. J7=8:=0 >10G5 3@5H:0 ?> 2@5<5 =0 ?@8A2>O20=5B> =0 ?@028;0B0. @5<0E=5B5 2A8G:8 =5AJI5AB2CI8 ?JB(8I0) >B ?>A>G5=8B5 ?>-3>@5 ?@><5=;828 =0 A@540B0 70 @01>B0 =0 A8AB5<0B0.A04020=5 =0 ?@><5=;828 =0 A@540B0 2 >=B@>;=8O ?0=5; =0 A8AB5<0B0xJ7=8:=0 3@5H:0 ?@8 ?@8A2>O20=5B> =0 ?@028;0, BJ9 :0B> =0 CAB@>9AB2>B> 5 0:B828@0= Dynamic Fair Share Scheduling (DFSS).P#AB@>9AB2>B> 5 CA?5H=> @538AB@8@0=> 2 Microsoft Defender 70 :@09=0 B>G:0 8 CA?O 40 87B53;8 ?@028;0B0 70 70I8B0 =0 :@09=0 B>G:0 >B MEM. J7=8:=0 >10G5 3@5H:0 ?> 2@5<5 =0 ?@8A2>O20=5B> =0 ?@028;0B0 ?>@048 >3@0=8G5=85 =0 API, :>5B> <>65 40 2J7=8:=5, :>30B> DFSS 5 @07@5H5=. !2J@65B5 A5 A >B45;0 70 ?>44@J6:0 =0 Microsoft 70 AJ459AB285.o#AB@>9AB2>B> =5 5 0:BC0;878@0=> 8 =O<0 2=54@5=0 2J7<>6=>AB 70 70I8B0 A@5IC =5?@02><5@=0 A<O=0 =0 A0<>;8G=>ABB0.«#25@5B5 A5, G5 @07?>;030B5 ?@5?>@JG0=0B0 0:BC0;870F8O =0 70I8B0B0, 70 40 70I8B8B5 CAB@>9AB2>B> >B =5?@02><5@=0 A<O=0 =0 A0<>;8G=>ABB0. 0 ?>25G5 8=D>@<0F8O 286B5 2@J7:8B5.3Microsoft Defender 70 :@09=0 B>G:0  CVE-2022-232788Microsoft Defender 70 :@09=0 B>G:0  0=0;87 =0 70?;0E8B5Y#AB@>9AB2>B> @01>B8 AJA AB0@0 25@A8O =0 EDR A5=7>@0 =0 Microsoft Defender 70 :@09=0 B>G:0L>;O, 0:BC0;878@09B5 A5=7>@0, 70 40 >A83C@8B5 >?B8<0;=0 70I8B0 8 AB018;=>AB.@:BC0;870F8O =0 Microsoft Defender 70 :@09=0 B>G:0 70 A5=7>@ EDR’"078 <0H8=0 =5 CA?O 40 A5 @538AB@8@0, BJ9 :0B> MsSense.exe A5 A@8=0 ?> 2@5<5 =0 D070B0 =0 8=8F80;870F8O 70 TelLib.dll. @5H:0B0 >B A@820 15H5: %1ú">20 <>65 40 A5 A;CG8, 0:> 0:0C=BJB SYSTEM =O<0 @07@5H5=8O 70 70?8A20=5 2 >G0:20=8O ?JB (ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Cyber). @>25@5B5 ACL 2 ?JBO 8 =C;8@09B5 @07@5H5=8OB0 >B @>48B5;A:0B0 ?0?:0, 0:> 5 =5>1E>48<>.l#AB@>9AB2>B> 8<0 2J7<>6=>AB 70 70I8B0 A@5IC ?>4<O=0 =0 A0<>;8G=>ABB0, => 2A5 >I5 =5 5 @538AB@8@0=> 2 >1;0:0.‹#25@5B5 A5, G5 A2J@720=5B> A URL 04@5A8B5 =0 EDRCloud CnC =5 5 1;>:8@0=>. !2J@65B5 A5 A ?>44@J6:0B0 =0 Microsoft, 0:> ?@>1;5<JB ?@>4J;6020.K>=D83C@0F8O 8;8 7028A8<>AB 2J7?@5?OBAB20 AB0@B8@0=5B> =0 <@56>20B0 70I8B0.b@53;5409B5 B>20 AJ>1I5=85 70 3@5H:0, 70 40 @0715@5B5 ?@>1;5<0 A 1;>:8@0=5B> 8 40 3> @07@5H8B5: %1g>44J@60=8B5 TLS H8D@8 =5 A0 @07@5H5=8 =0 B078 <0H8=0. ">20 <>65 40 70A53=5 A2J@720=5B> :J< MDE >1;0:0.Ì>;O, ?@>25@5B5 :>=D83C@8@0=8B5 H8D@8 (2 HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002), 70 40 A5 C25@8B5, G5 AJ4J@60B <8=8<0;=> =5>1E>48<8B5 H8D@8 70 A2J@720=5 A >1;0:0 =0 MDE.*><?;5:B8 70 H8D@>20=5 8 878A:20=8O 70 TLSl@>B>:>;JB =0 :;85=B0 TLS 1.2 =5 5 @07@5H5= =0 B078 <0H8=0. ">20 <>65 40 70A53=5 A2J@720=5B> :J< MDE >1;0:0.�>;O, ?>B2J@45B5, G5 :;85=BJB TLS 1.2 5 0:B828@0= (2 HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client).PA]ECDH H8D@8B5 =5 A0 @07@5H5=8 =0 B078 <0H8=0. ">20 <>65 40 70A53=5 A2J@720=5B> :J< MDE >1;0:0.›>;O, ?>B2J@45B5, G5 ECDH KeyExchangeAlgorithm 5 0:B828@0= (2 HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\ECDH).(A=>2=8OB B5AB 70 URL 04@5A0 5 =5CA?5H5=©><?>=5=BJB NetworkProtection 5 701@0=5= 8;8 =5 5 ?@5<8=0; ?@>25@:0B0 =0 URL 04@5A0. ">20 <>65 40 >7=0G020 =0;8G85 =0 <@56>2 ?@5=0A>G20I 5;5<5=B (=0?@.: Cisco Umbrella).ƒTcuÃS\ Y>e cV¸I Ú; ¢=µÂº ’û¹< ûF´ å KÄɸY8 Séð�SM¢eøY Î[ êc¢Bë (%1). /¯SQÂgõYU _°Â= ±_ ÇÊ_Âó Úm23êB<à ÆY>6ý ÄSã’’ïA c'Sòo[ eR7 <¿ å< %MUg, [ô C.!B�Ì3\¡YôgçBÊÌ; ]Qéa çõH; e)¸;U ªU òOVÊD¬c¹I! ’YO< >õ ±:%¸Uc ?ð 4Àñ¸e MeMY<í?M g=è Yêá! ´5UÄ�ÀàBÊÌ®. h?ì?aB0@@ e= 3Q´ïO¢ÄôU, ¿U ‘ê¢ø;’-ûWQ �B [Q îc ®Ã @MÀ#èW îFg5U@BU/@‘QE¹Q] c‘ª’’ï  ÿD Ä'�U ë½î¢ë, B=éI Y-UqI g=è B.![e.DÅð3aa ’û:Uê ÁQU+g-½Qa/I5âÄW½éU +9 �AUÌ[>’Ä ê’Kð3 ’QS ÈÀÁø�DÄ>=B@>;8@0= 4>ABJ? 4> ?0?:0T5CA?5H=> 70@5640=5 =0 <>4C;0 mde_cfa_evaluation  4803=>AB8:0B0 =0 CFA =5 5 =0;8G=0<@>25@5B5 8=AB0;8@0=5B> =0 MdeDiag 8 @538AB@0F8OB0 =0 <>4C;0W @538AB@0F8>==8B5 D09;>25 =5 A0 >B:@8B8 70A8G0=8O =0 CFA (:>=B@>;8@0= 4>ABJ? 4> ?0?:8)15 A5 878A:20 459AB285  CFA DC=:F8>=8@0 =>@<0;=>>=0;878@0=8 A0 %1 ?>4>7@8B5;=8 D09;0 70 AJAB>O=85B> =0 4>25@85b@53;5409B5 CfaTrustChecks.txt 2 4803=>AB8G=8O 87E>4 70 ?>4@>1=8 @57C;B0B8 >B 0=0;870 =0 4>25@85B>OCFA =5 AG8B0 %1 70 4>25@5=, 70I>B> >1@07JB =0 ?@>F5A0 =5 5 8725AB5= :0B> 4>1J@.€>1025B5 3> :J< A?8AJ:0 A @07@5H5=8 ?@8;>65=8O 8;8 4>1025B5 0=B828@CA=> 87:;NG5=85 70 B>78 D09;, 0:> A5 4>25@O20B5 =0 B>78 D09;.O%1 =5 A5 AG8B0 70 4>25@5= >B CFA, 70I>B> @>48B5;OB <C =5 5 8725AB5= :0B> 4>1J@.F%1 =5 A5 AG8B0 70 =045645= >B CFA, BJ9 :0B> =53>28OB @>48B5; 5 A:@8?B.G%1 =5 A5 AG8B0 70 =045645= >B CFA, BJ9 :0B> 70@548 =5=045645= D09;: %2.Q%1 =5 A5 ?>;720 A 4>25@85 >B CFA, BJ9 :0B> 5 8=65:B8@0= >B =5=045645= ?@>F5A: %2.M>1025B5 0=B828@CA=> 87:;NG5=85 70 B>78 D09;, 0:> A5 4>25@O20B5 =0 B>78 D09;.\>1025B5 0=B828@CA=> 87:;NG5=85 70 B>78 ?@>F5A, 0:> <C 8<0B5 4>25@85 (87:;NG5=85 =0 ?@>F5A). @>F5A: %1 CFA AJ18B8O: - 59AB285: %1, ?@8G8=0: %2!J18B8O 70 70@07O20=5:" - TaintType: %1, TaintReason: %2 #:070=8O: %1(%1 ?>2B>@5=8O)}ASR %1 GUID '%2' (87B>G=8:: %3) 8<0 2>45I8 8;8 :@09=8 8=B5@20;8/@0745;8, :>8B> <>30B 40 ?>?@5G0B =0 ?@8;030=5B> =0 ?@028;>B>.Š@5<0E20=5 =0 =0G0;=8B5 8 :@09=8B5 15;8 ?>;5B0 >B GUID =0 ASR ?@028;>B> 2J2 20H8B5 3@C?>28 ?@028;0 8;8 :>=D83C@0F8O =0 A8AB5<=8O @538ABJ@.‹ASR %1 GUID '%2' (87B>G=8:: %3) AJ4J@60 D83C@=8 A:>18. GUID B@O120 40 A5 704020B 157 A:>18 (=0?@8<5@ 56a863a9-875e-4185-98a7-b882c64b5ce5).v@5<0E=5B5 D83C@=8B5 A:>18 >B GUID =0 ASR ?@028;>B> 2J2 20H8B5 3@C?>28 ?@028;0 8;8 :>=D83C@0F8O =0 A8AB5<=8O @538ABJ@.‡ASR '%1' 70 87:;NG20=5 (87B>G=8:: %2) 8<0 2>45I8 8;8 :@09=8 8=B5@20;8/@0745;8, :>8B> <>30B 40 ?>?@5G0B =0 AJ2?045=85B> =0 87:;NG5=85B>.‹@5<0E20=5 =0 =0G0;=8B5 8 :@09=8B5 15;8 ?>;5B0 >B ?JBO 70 ASR 87:;NG20=5 2J2 20H8B5 3@C?>28 ?@028;0 8;8 :>=D83C@0F8O =0 A8AB5<=8O @538ABJ@.�ASR %1 GUID '%2' (87B>G=8:: %3) =5 5 20;845= GUID. G0:20= D>@<0B: xxxxxxxx-xxxx-xxxx-xxxx-xxxx (=0?@. 56a863a9-875e-4185-98a7-b882c64b5ce5).PA¤>@838@09B5 GUID =0 ASR ?@028;>B> 2J2 20H8B5 3@C?>28 ?@028;0 8;8 :>=D83C@0F8O =0 A8AB5<=8O @538ABJ@, 70 40 87?>;720B5 20;845= D>@<0B =0 GUID 157 4>?J;=8B5;=8 7=0F8.ASR 87:;NG5=85B> '%1' (87B>G=8:: %2) AJ4J@60 A53<5=B >B @>48B5;A:0 48@5:B>@8O ('..'). !;54 @07@5H020=5 =0 '..' 5D5:B82=8OB 87:;NG5= ?JB <>65 40 5 <=>3> ?>-H8@>:, >B:>;:>B> ?@54?>;030 1C:20;=8OB 70?8A, :0B> =57015;O70=> @07H8@O20 87:;NG5=85B> 872J= ?@542845=8O <C >1E20B.ä0<5AB20=5 =0 70?8A0 70 ASR 87:;NG20=5 A =0?J;=> @07@5H5= 01A>;NB5= ?JB, :>9B> =5 AJ4J@60 ".." A53<5=B8. >A;54=8B5 25@A88 =0 Microsoft Defender >BE2J@;OB 70?8A8 70 =5:0=>=8G=> 87:;NG20=5 ?> 2@5<5 =0 70@5640=5 =0 :>=D83C@0F8OB0.90:2> ?@54AB02;O20B 4803=>AB8G=8B5 ?@>7@5=8O =0 Defender?=803=>AB8G=8B5 ?@>7@5=8O =0 Defender A0 8=AB@C<5=B 70 A0<>?><>I ?@8 4803=>AB8:0, :>9B> AJ18@0 8 0=0;878@0 4803=>AB8G=8 40==8 8 ?@54>AB02O >BG5B, :>9B> ?><030 70 >BAB@0=O20=5 =0 ?@>1;5<8 A ?@>872>48B5;=>ABB0 =0 28@BC0;=8 <0H8=8 A Windows 2 Azure. >:C<5=B0F8OB0 70 Windows =0 4803=>AB8G=8B5 ?@>7@5=8O =0 Defender 5 %1.)B:J45 40 70?>G=0 ?@53;540 =0 B>78 >BG5B? 0?>G=5B5 A @0745;0 "1I ?@53;54". @53;5409B5 ?@5?>@J:8B5 8 2@J7:8B5 70 :>=AB0B0F88B5. 0CG5B5 :0: B5 <>30B 40 ?>2;8OOB =0 ?@>872>48B5;=>ABB0, :0:B> 8 70 =09-4>1@8B5 ?@0:B8:8 70 >?B8<878@0=8 70 ?@>872>48B5;=>AB :>=D83C@0F88. 0CG5B5 ?>25G5 70 ?@53;540 =0 >BG5B0 %1.C0:J2 B8? 40==8 A5 AJ18@0B >B 4803=>AB8G=8B5 ?@>7@5=8O =0 Defender?O803=>AB8G=8B5 ?@>7@5=8O =0 Defender AJ18@0B 8=D>@<0F8O 70 :>=D83C@0F8OB0 =0 Windows VM, 48A:>25B5 8;8 3@C?8B5 70 AJE@0=5=85, ?>:070B5;8 70 ?@>872>48B5;=>AB, ?>B@518B5;8B5 =0 3>;5<8 @5AC@A8, @538AB@0F8>==8 D09;>25 8 @07;8G=8 ?@>A;54O20=8O. >4@>1=>AB8 70 2840 8=D>@<0F8O, :>OB> A5 AJ18@0 >B 4803=>AB8G=8B5 ?@>7@5=8O =0 Defender, A0 %1.PAP€P€P€P€ÌpJ7=8:=0;0 5 3@5H:0 ?@8 AB0@B8@0=5B> =0 LUA <>4C;0. xJ7=8:=0 3@5H:0 ?@8 70@5640=5B> =0 <>4C;0 =0 LUA D09;0. dJ7=8:=0;0 5 A8=B0:B8G=0 3@5H:0 2 LUA <>4C;0. TJ7=8:=0;0 5 3@5H:0 2 ?0<5BB0 =0 LUA. HJ7=8:=0;0 5 >1I0 3@5H:0 2 LUA. P0ABJ?8;0 5 ?0=8G5A:0 3@5H:0 2 LUA. x7?J;=5=85B> =0 LUA 5 ?@5:JA=0B> >B A83=0; 70 A?8@0=5. ¤5CA?5H=> 48=0<8G=> :>=D83C@8@0=5 =0 <><5=B0;=8 A=8<:8 =0 :C?G8=0 70 ?@>F5A0. $4VS_VERSION_INFO½ïþàeàe?‚StringFileInfo^040204B0LCompanyNameMicrosoft Corporation <FileDescription803=>AB8G5= 42830B5; =0 Microsoft Defender 70 :@09=0 B>G:0BInternalNamedefenderdiag.dll„0LegalCopyright© Microsoft Corporation. A8G:8 ?@020 70?075=8.ROriginalFilenamedefenderdiag.dll.muip(ProductName?5@0F8>==0 A8AB5<0 Microsoft® Windows®�8FileVersion4.18.26080.4 (ccacee407da609d5c2c557d13db39624e32a0227)> ProductVersion4.18.26080.4DVarFileInfo$Translation°PADDINGXXPADDINGPADD(0‚( *†H†÷  ‚'ö0‚'ò10  `†He0\ +‚7 N0L0 +‚70  ¢€010  `†He Þ}ÛÃHhÝ«çGu´¥µì'x÷þѳBÓ`z¹ÐÕ ‚ 0‚a0‚I 3$]¢‘qà •ª$0  *†H†÷  0S1 0 UUS10U Microsoft Corporation1$0"UWindows Production PCA 20230 260430183934Z 270429183934Z0p1 0 UUS10U Washington10URedmond10U Microsoft Corporation10UMicrosoft Windows0‚¢0  *†H†÷ ‚�0‚Š‚�‘4�bI‹¤pª%õx·3 mÿ¢­Ë�~ƒ§¼83`‚;P#tίe¤�Cþ #3å²&Á˜ ¯jçášè1zçõ•QÉ í,-åKMŽÁï_¼É¨$Ð8õ /åÛÈ?ˆÙvE¼¸Å^WxqÖeþ¸nQ¶vŽ’Ï—3�Iù~dÙÀBžoã¢KÚ>w/¶õçøLFþìæíìð "UÀ HP…Ò LRý.Âk'ümAѶËt·Õ« !N _Gã×ÿaE3ˆX‡2þr¤ª0É{:s¤ÿáV1!Üîiëa‚FÁ4›j8.�.šwk!‡G'à㉠¨X½ùnÌ�ž£«d%š&_'Ö9ïñö¿4Ë‘k[Åý;™Š?Ý9ÞÎÄ“ÙúˆÃx°…¿¹+vEÀÔ->ÔLþTÙ¨CÔ_ îþn#‰¹oÒ]y”¸Og”êáV½×gHG+?£òatØí„Ê®,1×^r-ˆ¼«‘°¦Ð15ôºtå�£‚�0‚‹0Uÿ€0U%0 +‚7 +0U+N°£îÜNÁ"Þêø‘»“è!˜ 0EU>0<¤:0810U Microsoft Corporation10U 500446+5079150U#0€†í ®?Z Ò=!UŸ1S"ø0ZUS0Q0O M K†Ihttp://www.microsoft.com/pkiops/crl/Windows%20Production%20PCA%202023.crl0g+[0Y0W+0†Khttp://www.microsoft.com/pkiops/certs/Windows%20Production%20PCA%202023.crt0 Uÿ00  *†H†÷  ‚°4Z ¾Ïÿ ß 1ÝŽ ú ÙË«5FÑðV£5­Ù;DÅ�-%ŒÛšði²Òø‚ÇÝú õà¹�âM¥ûÙr²'4¯Æ”¨­!I皸a08.Ëwq±ñ Ì”`Щç!É™O¤š·�¶{þõ‡þ±yÅìeNu÷ äjàŽÒ‚¶ºÌ”¨Xfæ­C ƒË¼çSÕ.” TÏQG¬å¾ýñ¦R«—|d5$ç²æÊÏk—¬ÏO÷½ëŠJ“ÑL3˜áê$À|žªÃ!&OÌ…X=½‹H\Ü\ þê¡{ÈPíΞ“ežÝ;¶Ï³b¯è'iN�àÔÛ²cå×ûß -fëŽxðï9™Çbã+‡V#)¥!Ëœ–yó‡ƒ^\ì);õÌW툊kLf3¹×úñšžS71¬§è ár­Póã`FVÒsaˆ†ê /C)Ò¨:Î/Њ$n¢Ehý1¢wÇo‚mGPžð�¸6Äh˜¦~ï¢!R¯‘ªÃ&À­òaÅùrÀÑ!4ý¯È BsˆwürÀ¦_ïewÕõ|­8äbPä§OÎB›_šLÐÁ;™þ¨Špöì5°zá»ÝÕÆÎ™/2Á)ìt°a‚è#Z¿\ãÔ� êlÔ(‹CRæ|ê3³!^ ÐBÍ$�̦»ÿV H©,Õ F�ÒD?”0‚±0‚™ 3…½V KøÈ!0  *†H†÷  0�ˆ1 0 UUS10U Washington10URedmond10U Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100 230613183415Z 350613184415Z0S1 0 UUS10U Microsoft Corporation1$0"UWindows Production PCA 20230‚"0  *†H†÷ ‚0‚ ‚Õ.å ]nqKÛÚHëÞòb!ŒNF›á-i©Y 3ŠÀ©'xû‚»v}†¬ Ç/gÛÀW†ó·ì@äSp©ƒ¼××’rKÒ³>’Ñeê)üVÑÆƒªo¯‚®[„Ÿyé¼2Ÿ•áñá—þŒ’æ‚ió]U`—Ë°Í´Ž¦ªâ¡˜�g†¢··xLôm%5¶„˜ƒuG<¦>#Í…Ò¥_x BÊf.‹¡Þ•FoÓà)˜ûçݹÜ<-©}ƒˆ Î­úÛÝ=p2è��y¥�Q¡ºô¾¨UAo•ìäCøĵ¤€��Z¬U~¾f*>™íP‰I!#è•x(Liišnjk¡I¾ŸsWLê�ß3uoÒøÄ¿ÀªÍX°-*e+ÆH$� „½y€¢\å˜ ÎÏn%ú8™÷€!°±¼_>™Ô¶ RH­0Æ¥>f»–~4ÜQb®o³=¦„�ª5?QI^©}ÖÒîæÚPøuéÙOÙlzp0H}q€À·RQ#¸èOÀ3 «J/­xw_ì W’Ÿ;Q5x?”EŠ‚pd„íû½§"H¬äi—'ư ü”<™œN¢¿›d"ôάk¥æóË¡¯¥<$Îìqº®Çès½Ñ…[*:Î4 Gª ìgÃc˜%,ðÁCXt�üEåñ‘�ìpŠ‚äŸîö‹ô»£‚F0‚B0Uÿ†0 +‚70U†í ®?Z Ò=!UŸ1S"ø0 +‚7  SubCA0Uÿ0ÿ0U#0€ÕöVË�è¢\bhÑ=”�[×ΚÄ0VUO0M0K I G†Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0†>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0  *†H†÷  ‚‘0Bhß„Ý<˜oÈÿ³NrûœU˜åê|q¸çã5ÑÚr5˜²¸ówy^œHwœ•4½èA׫ò`’ 6Þ(×™ÏVäoàBRmûMv¸Æs%œ·¡ÍëDÁÙÝ �Д�(·Ã8-nöÁôE"}¨ÀK€“|§üÃlBæ£sûy‹¯½èŠ[÷µøQùçî…`riAjÑð/7ÍX ,!ê¦Nvw¤Z™¹Êù†* YÛºÓT“¶ éüJqîƾ·aÙÜ€‰rÍ?TƒAGµ�ÇÞ–éÉBÓésQ½’ÇW[4¡ŸY¶eɃÑ`™ ¼zÀ+�Áýt¬›ŒÔ8¦+[ge‘Ç< €WIñ§ 2i‚K ‹à Mñ�Ky¾ƒWÈ{ÔœGH“�²‹°†$¯ór9öêÔ{¨.ÉY´k®¸ó©…ÑÃ!ÐÜBtÂ�¶5çϼ߳�.Ïôò:¿Ý’aú¼5ʡ߸ήzå-ë{]vªZåÎàÃ\aLøltÂÍ÷ovµ s ¹°|jll8¨¹ÌU×ÿ¡pkJŸ»{þŒ×DqÛ‹`QÅÕúJzzùQ‰D²=ÌãEï_c E–oM0vÛáÝ�”UÎʃžƒUFœ„—Ù ˜—]’ýªk%Xa ¢ ÏÛýJbê^g|X\�©#ÍÉokPy/×p1‚^0‚Z0j0S1 0 UUS10U Microsoft Corporation1$0"UWindows Production PCA 20233$]¢‘qà •ª$0  `†He �®0 *†H†÷  1  +‚70 +‚7 10  +‚70/ *†H†÷  1" -ZÃ-%|/¿k+@¢�¼ä½O^Íi‰~C¶90B +‚7 1402 €Microsoft¡€http://www.microsoft.com0  *†H†÷ ‚€aeQü’M�R]AàKüêÀ_ÎGt Űâ¨mb¿f°*Z ¸”ÙÝä À›&]ÑJÚ¸SR†K/”&Q~ËÉܺ*0^Û§ÿ…æs�ŸÓ™¸”j,žA�(©‰]­„tÒ=­ÔÍ+åܽô½÷_TMõ©'´þ^7êGdÒ�õÆ(Á¹�ÝŒù©8ÊtÑ­+¶®NQ1:^RööOÓÅ7 �8ðZã8ÍaçJb—Ç ` ¥QË||K¿·`yõ¨nÝÜâyBÑ«E´gÊ…KÉAÈ�Žê³TÒC°Ið5ÊqíYNŒyÙÁ޾; ÐÆ˜ÉjÂN²ˆD°xI[m£‡wݤ:FXºL<ý&d|VANà T˜Ðãy;CÆ!wÛµñ€à‹GWµR,B�#”Å3wdJ�9²–_Ûé`�7«Ãù“ˆV–gM¯Ë²?K‘&» H­~ �™gžÝÓÊß“îéë;u •+c76-R®ñò{%.âD‘�K§¡‚”0‚� +‚71‚€0‚| *†H†÷  ‚m0‚i10  `†He0‚R *†H†÷   ‚A‚=0‚9 +„Y 010  `†He ˆêÿc æ°PUg¸â�'4u1{ƒ~¹�)Êä²2fÐój… ›#Õ20260903180438.134Z0€ô �Ѥ�Î0�Ë1 0 UUS10U Washington10URedmond10U Microsoft Corporation1%0#U Microsoft America Operations1'0%U nShield TSS ESN:7F00-05E0-D9471%0#UMicrosoft Time-Stamp Service ‚ê0‚ 0‚ 3£¬¤n9o|I0  *†H†÷  0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100 260219193949Z 270517193949Z0�Ë1 0 UUS10U Washington10URedmond10U Microsoft Corporation1%0#U Microsoft America Operations1'0%U nShield TSS ESN:7F00-05E0-D9471%0#UMicrosoft Time-Stamp Service0‚"0  *†H†÷ ‚0‚ ‚¥Ñ8íl<,G±^ñ§:¢^l×8mN§vj\…K§Ñ¹šdŒÛsy$ CÓªÎsà\¡~ï«×¼à¬Ù[ ¿Z0�‰‡!*Н'œ‚ûô aY<ìè“0Îé/ø¿/ãLƧzá¸XŠ(,ÓXä-tWø=$߯HNÒÈÓ’ã]æXùHŸuR¡neøÌ§Û{îkbEE]��ò�Ój�á�—æÏoA޼çíMeŸâi.YÛÓF™š<¦[À\ZÜ‹âì¡0¾ÒI9¢9õ—Sè>ÈÙt Ú ¿ µaÄ‹Ál¹3ÞIÔª™ã+¼¶„š&ÓU4¸½ðÓço«ˆç.¢5_oW&ðµ?”4ã:�kµOˆ’fß+|!YàÿãäÊ*OBN5ƹÒ;xLb=Ñ(¡] Äb©6Ý-%�Ô‘Jn�4SŒ®õÜ2‘÷ñÈŒy Ÿ;LïYõ1ìæR› AÌ=÷àñ.] ë�”fžVëTŸ]½o]³‡êóvŒmÀ]O(%5ÅuJš™*+P€’Âïüس¶€‡Á„GDÜ3Á5^ÿR�NùªÞ�ë8ˇÓhZjüÁ†<9Õ�Œ©÷“NvÃé&sEÐ_¢UtÆdƒ1¾�b”(]èsFÕ‰ýS­*ð²Kw,+3{­+V'Ò[>�´çô—ì­-£‚I0‚E0Uæ šê fb\.<ùž‚d0U#0€Ÿ§]^b]ƒôåÒe§S5ér0_UX0V0T R P†Nhttp://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l+`0^0\+0†Phttp://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0 Uÿ00U%ÿ 0 +0Uÿ€0  *†H†÷  ‚¤¡�y6rU¾p)èÑ¢y9ׯ¶LX¤§2×Ëè´€ã`¹O6èHÔ|&zSý…}è«tÚoÜI353 çO‚„HÙþòš IkÇ\@,í&Noq쪥CY3×±áv5ÈÙ•8 –4kî2£j$ž×û.6)1f•XèßbÝÐõ}+ü«<([Ì4}Î0?L'-G‡(ÕjTÕ”K°}n_GŸ$ö©5·S×dwÑâS8„³‘�ûn•þ‹×:-´t˜Œ×xXZüµ4Ò@†BŽ”°u8Û§w§ß„÷Tpu¬»Å~•jCë�ê ²î™šÂ7(}\wÄÉ<‹B`›PÄ´òÁÍô±�Õ-¬ _y÷Š‹>§�E-I|ƒ®(-Û}‰Ççx$à`B†ª�Ñ£qËq¯ï’xá+*à:Óp¢ÉmG³‚ŒžñºÂ,Ÿ²èð(:WFD˜O0} ØY$èð¡^ÔŠ>®‘�Iµá§5u1Z‘y‚„)nw‚ �íè”d'í:2þŒ7|(µ|B>û%ø®N#È‘¿ÆYÆ¡‘\_ì²ÐïÍ‘8ñߘøvw÷/„}E*^Àî@Ê‹j%!f¼ÏÁ¹„qØ´jÅWŠUv“b[4íË,÷Cçi\ð±òk‘­Mþ­™®ßZš0°Ûè!¡¾6�ñ0‚q0‚Y 3Åçkž›I™0  *†H†÷  0�ˆ1 0 UUS10U Washington10URedmond10U Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100 210930182225Z 300930183225Z0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100‚"0  *†H†÷ ‚0‚ ‚äá¦Lç´r! y¢Ë×$y½Õ‚ÓýîœÒ©lNuÈÊ5WölJàâ½¹>`3ÿ\OÇf÷•SqZâ~JZþ¸6g…F# µ�Ïw2Àè`}jRƒD·¦ŽFkóÅvõ†PÜÁDÈq\Q17  8n�íר&S|9azĪýri¯«¬ö6¾5&dÚ˜;º{3­€[~Œ�Rþ¶èb%ÜjÏ]ôþŽSÏÖì…VMïݼ�¤ã‘�²9,Qœépi Ê6-pŽ1È5(½ã´‡$ÃàÉ�~µT�ÜúU˜mh;šF½í¤®z)7¬ËëƒEçFnÊ2ÕÀ†0\O,âb²Í¹â�ˆä–¬J»¾q©[g`Þø’‘=ý Ïs}AšFuÍÄ_4݉Öý¥ }~üÙžEß¶r/Û}_€ºÛª~6ì6Lö+n¨Qè¿£Ñs¦M7t”4‚ðò·Gí§è™|?LÛ¯^ÂóÕØs=CNÁ39L޼Bh.ê„QFâѽjZasÊg¢^×(vâ3r×§ ðÂú ×co É6d‹[ ¦ƒ!]_0t‘””عPù ‰aó65„GÛÜÑý²ÔÅkö\RQ]Û%º¯PzlÅrï�ùRÄ…“À<Û7Ç?x«E¶õ‡^Ú�žriÆ®{··>jâ.­£‚Ý0‚Ù0 +‚70# +‚7*§RþdÄš¾‚‘http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0  *†H†÷  ‚�U}ü*­á,g1$[ážrKü©oê\¶>NGdx±“—=13µ9×Âq6?Údl|Ðu9m»1äÂ�ûlÑ¡”"îéfg:SMݘº¶xØ6.œ©‚V°¾‰èiຠî{ßjo¾)ËnØ?HuÙÞm‚ õm#TäxSu$W¹ÝŸóŽ=Æóhßeö¤Vª÷•¶(U'Ð$½@ ¿¶]='à@–8¬÷ù)‰Ã¼°T…B³ü ž‹‰çð j�Â�BRuŠ6ÂÃas.,k{n?, x鑲©[ßI£t ¼ì‘€Ò=æJ>f;O»†ú2Ù–ô�ö‘öÎÆtýöLro«u0Å4°zØPþ XÝ@<ÇTm�ctH,±NG-Áq¿dù$¾smÊŽ ½³WITdÙs×[DŽZ‘k Ÿ¤(Üg($º8Kšnû!TkjEG©ñ·®Èè‰^O�ÒÐLvµWT ±iD~|¡alsþ »ìAf=iýËÁAI~~“¾Ëø;ä·¿´Î>¥1Q„¼¿Á‚¢{‰�pþçµÐ(‰ �6ÚºLù›ÿ é4ø$5g+à ¸æŒ™Öá"êð'B=%”ætt[jÑž>í~ 13}¼Ëé{¿8pDÑ�ñÈ«:Š:bÙpcSM�î‚m¥Áqj´U3X³¡pfò¡‚M0‚50�ù¡�Ѥ�Î0�Ë1 0 UUS10U Washington10URedmond10U Microsoft Corporation1%0#U Microsoft America Operations1'0%U nShield TSS ESN:7F00-05E0-D9471%0#UMicrosoft Time-Stamp Service¢# 0+ƒýd(2áRî=è‹j›­ÿ �ƒ0�€¤~0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100  *†H†÷  îC÷½0"20260903134221Z20260904134221Z0t0: +„Y 1,0*0 îC÷½0 0(0 îEI=06 +„Y 1(0&0  +„Y   0¡ ¡ 0† 0  *†H†÷  ‚å2Ø=ܧ;q”ÛW‘ã_åw{¦&ý §Ø®Û«MÍ"¿X�¯Ä? }nHbn°ƒZãÅĆÛ^ºß¬fsõw„NšòÔLãÖnÄLMj°*�û&èÑ=–Ùs=^DÏíÉ´æ4ŒJ—±]ù$)ð5g$òÉ‚rjÍ9Àw�Qx¥«‰–ÜØ83¸.$šÊkD ß3†ë±–m5ùîÄ&šíû’�Q'?Ÿ0GI;¼Õ 5þ鯲ËLvœó¹ÿ‘.²@8M4ùçp&Ož'‡¥ó(_¾f¡èÉÉÚÇðült÷íc»ð®7»Çn2³žB½?¢Tëèèàå�Ŷ™ü1‚ 0‚ 0�“0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103£¬¤n9o|I0  `†He ‚J0 *†H†÷  1  *†H†÷  0/ *†H†÷  1" 6–Ja* :èClrÖ¡åLƒ7“ãæ±�Ó0�ú *†H†÷  /1�ê0�ç0�ä0�½ /�]jóöŒ€Ï¾«ã„uÉÛÑ‹2# öó‚0�˜0�€¤~0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103£¬¤n9o|I0" Þüž›2lÍ:ù4ò?Çx\µÓ�;í ÷30Hþ¤0  *†H†÷  ‚ µgaíW¹L;‰%‚z‹…ØA ð©ÈT½ý!ýs Ð¸Öcœ,§4í=q”ߺØht»Åq½ÉÚë¬ãª–’ šiÒ½6ý uÎ9\ÛÅàÁx@½ûé´_ ¾”�W>õ`¸()È–º&biÒîüÙ}yœéeÀÊ�eMDú_‹ê�éFü»èïZÄ&"U†¼ & çzÖ–ÓžÚœeÎiß}i.LŒ ˜�>2¤y¥šî«,û‹³«k›4ñ¯-¹í˳ 4a½ º£5€[±¥I…boÂÔ•ë!:+Ÿ4øˆ‹‹–ºoä‡"yæ.|cã3“<³™<3 \@»M“±m®Ø"ªS�÷(¾“À+F´ ~—iŸU(­v¸9ë°`]T ~)Ñi63Ôs­¥ÝÜÿ� þÖ{ˆ•l°\<Œ~&½ozÄM�Z"aü+å뜵hS˜8ÿBù9WÄ”cäÀŸŸhŸþM‘ ¨s~UeÞaD5ž‰"l¼¡vQpà«G!BwÆò4â(¤­A¾Š’¡»:þ †+Ååúarô{}FÁYÓ3ªNS‡À�³:ã*ÁÑ[ü°;^:=õ3o}#Ä»èŠHG\/�ØYÅ ÿà N¢”Dé�¦À´õw;«¢i¤:æ’`sßöEÁ.˱_|#¯ƒmÇÇó@Á