403Webshell
Server IP : 121.121.20.254  /  Your IP : 216.73.216.202
Web Server : Microsoft-IIS/10.0
System : Windows NT WEB-SERVER 10.0 build 20348 (Windows Server 2022) AMD64
User : IUSR ( 0)
PHP Version : 8.3.28
Disable Function : NONE
MySQL : ON  |  cURL : ON  |  WGET : OFF  |  Perl : OFF  |  Python : OFF  |  Sudo : OFF  |  Pkexec : OFF
Directory :  /Windows/System32/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /Windows/System32/microsoft-windows-system-events.dll
MZ����@���	�!�L�!This program cannot be run in DOS mode.

$��<߱�R���R���R�U�����R�U�P���R�Rich��R�PEd�i�u��" 	�


	k�	`A ��	&T.rdata�@@.rsrc�� � @@i�u�
TTTi�u�$��i�u���T.rdataT|.rdata$zzzdbg .rsrc$01!��.rsrc$02 t,f�K���x"��LuR��_m�Ҕ�i�u��(���@�X�p�����	�	�	��
	�0%��! 
WEVT_TEMPLATEMUI4VS_VERSION_INFO��
�|O
�|O?|StringFileInfoX040904B0LCompanyNameMicrosoft Corporation|*FileDescriptionMicrosoft-Windows-System-Events Resourcesn'FileVersion10.0.20348.5020 (WinBuild.160101.0800)h$InternalNamemicrosoft-windows-system-events.dll�.LegalCopyright� Microsoft Corporation. All rights reserved.p$OriginalFilenamemicrosoft-windows-system-events.dllj%ProductNameMicrosoft� Windows� Operating SystemDProductVersion10.0.20348.5020DVarFileInfo$Translation	�CRIM��,���/��G�!D?8�4�����O�צ���]�!�,�"{+B��/���X�O�p�sO�Q3�=T����c�#w[H���V]s]J�B?�Y�F�K��B�����@�7v��PY0J���~�W4�h�"S���K�����D��i�U�?�F�M<n(-�U�=bi!�{�s[�Ŋ�Su���?���EJFTzؤ��7C�<&�1�M�9�ST�F��)}��@�CH�3UHDI��:��E��4V�^�Q�����L���)j��0pi��jT��N�O��a�.�tw���;��@����a��.��`:�m�@ZD�ʙ5�PF��������� �f��I*�})S2H��C�y:��������wA��(:�RRq��7�u���HF����M<����D�zM�K��	��^S�.'���ĜeN�p�V�‰H��C����D�����/���v��z�5F��I�ct����C��1D�A�u�e�G���>����EO�C�E�lt����`{MK�f�/e��@�9ڊR�_�O��]�(a|p���B��J���;?&��q
'��2
RC�R۫A��Y@u^񿿁�E�|��چ4���56�wuC�$�E��7L$���P.�K��INo
��%���́���^�a�p��3�*�u�O�Ȯ	ϛ#��
*��~_H�Ot�(q����{�_0*&^җ`"0ʜ��*��O�F�Sd^G������J���M�<�`�|���]�hV��M��D�7)��9EM_45�cL㹀���Trl�\�o��[�ΰ�WEVTh��
�H�� CHAN0�\���PMicrosoft-Windows-Kernel-WDI/AnalyticLMicrosoft-Windows-Kernel-WDI/DebugXMicrosoft-Windows-Kernel-WDI/OperationalTTBL�
TEMP��p�iS�^(c`lg�ߜ���D�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
A��M�oData5K�NameDroppedEventCount
A��A�oData)K�NameActionCount
A��MZ�ComplexData'K�Name
SemActions
���� <Xh

���ProviderIDEventID(DroppedEventCountActionCountSemActionsProviderIDLevelReservedKeyword$EnablePropertyNTStatusTEMP,�	ڈ6MhY��F�㐍����D�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
�	�	ProviderIDEventIDTEMP���mx
[�GH kA����D�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
A��;�oData#K�NameNTStatus
Pl�ProviderIDEventIDNTStatusTEMP$
��kg��T�,�pt����VD�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
A��E�oData-K�Name
ScenarioCount
A��cZ�ComplexData=K�NameScenarioInflightItems
��
�
�
D`t�ProviderIDEventID ScenarioCount0ScenarioInflightItemsProviderIDEventIDReserved InflightCountTEMP,�ڈ6MhY��F�㐍����D�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
��ProviderIDEventIDTEMP�l�{�][�9�H�Nh��`D�	EventDataA��?�oData'K�Name
ProviderID
�ProviderIDTEMP����mx
[�GH kA����D�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
A��;�oData#K�NameNTStatus
� ProviderIDEventIDNTStatusTEMP�^�=y�T�[�L�g����D�	EventDataA��9�oData!K�NameSqmType
A��7�oDataK�NameSqmSid
,@SqmTypeSqmSidTEMPD�4H��5�Sp-	�#;��BD�	EventDataA��G�oData/K�NameSqmSessionGuid
A��5�oDataK�NameSqmID
A��9�oData!K�NameSqmType
A��W�oData?K�NameSqmDWORDDatapointValue
@Pd$SqmSessionGuidSqmIDSqmType4SqmDWORDDatapointValueTEMP``/�Z�>]�$�z�q!���D�	EventDataA��G�oData/K�NameSqmSessionGuid
A��5�oDataK�NameSqmID
A��9�oData!K�NameSqmType
A��O�oData7K�NameSqmStreamRowLength
A��QZ�ComplexData+K�NameSqmStreamRow
�$4Ht���$SqmSessionGuidSqmIDSqmType,SqmStreamRowLength SqmStreamRow SqmTypeEntry SqmDWORDEntry$SqmStringEntryPRVAPMicrosoft-Windows-Kernel-WDIOPCO<

0�0$0l

0�00h0�00\0�04LWDI_SEM_TASK_SCENARIO_OPCODE_STARTHWDI_SEM_TASK_SCENARIO_OPCODE_ENDPWDI_SEM_TASK_SCENARIO_OPCODE_TIMEOUTXWDI_SEM_TASK_SCENARIO_OPCODE_START_FAILEDTWDI_SEM_TASK_SCENARIO_OPCODE_END_FAILEDXWDI_SEM_TASK_SCENARIO_OPCODE_INFLIGHT_MAXLWDI_SEM_TASK_INIT_OPCODE_MISCONFIGPWDI_SEM_TASK_INIT_OPCODE_SCENARIO_MAXtWDI_SEM_TASK_INIT_OPCODE_SCENARIO_CONTEXT_PROVIDER_MAXdWDI_SEM_TASK_INIT_OPCODE_SCENARIO_END_EVENT_MAXPWDI_SEM_TASK_INIT_OPCODE_PROVIDER_MAXLEVL�P�P�P�win:Errorwin:Warning(win:InformationalTASK�		pT

p�0WDI_SEM_TASK_SCENARIO(WDI_SEM_TASK_INITKEYWt!�"�4contextdiagwin:SQMEVNT� 
	� �T��!�!	�!�`��!�"	�"��l��!�#	@#�����$
	@$��	x��%	@%��	���&
 &����8�'
 '����8�(
 (����8�)
 )����8�*
 *����8�+����8��!,����T��!-�������!������WEVTpd�	@"p"$$
�{|<|�|� �CHAN0\"�SystemMAPS��"�"�"VMAP4�#����VMAP$�#��VMAPL,#��	�
���
�dEx:LeapSecondDataParseFailure.FailureResultMapTEx:LeapSecondDataUpdate.UpdateReasonMap@Ex:SystemTimeChange.ReasonMapTTBL�WTEMP %��ۙ�}(V�X}�=����D�	EventDataA��9�oData!K�NameNewTime
A��9�oData!K�NameOldTime
(%<%NewTimeOldTimeTEMP�\&�xL��W�ְ�2_����D�	EventDataA��9�oData!K�NameNewTime
A��9�oData!K�NameOldTime
A��7�oDataK�NameReason
�&�&�"�&NewTimeOldTimeReasonTEMPll(���`�W�.��H�����dD�	EventDataA��9�oData!K�NameNewTime
A��9�oData!K�NameOldTime
A��7�oDataK�NameReason
A��A�oData)K�NameProcessName
A��=�oData%K�Name	ProcessID
�(�(�"�()()NewTimeOldTimeReasonProcessNameProcessIDTEMPP�))5�H7^A����d����D�	EventDataTEMP��*ݙ!=�YZ	�2:����D�	EventDataA��A�oData)K�NameFinalStatus
A��M�oData5K�NameExtraStringLength
A��A�oData)K�NameExtraString
++D+FinalStatus(ExtraStringLengthExtraStringTEMP��,ݙ!=�YZ	�2:����D�	EventDataA��A�oData)K�NameFinalStatus
A��M�oData5K�NameExtraStringLength
A��A�oData)K�NameExtraString
�,�,-FinalStatus(ExtraStringLengthExtraStringTEMP�/S"��F�Vַkܭy����D�	EventDataA��M�oData5K�NameExtraStringLength
A��A�oData)K�NameExtraString
A��3�oDataK�NameTmId
A��3�oDataK�NameRmId
A��7�oDataK�NameStatus
A��C�oData+K�NameInternalCode
�/�/�/�/�/0(ExtraStringLengthExtraStringTmIdRmIdStatus InternalCodeTEMP(�1�iC^s�Z<w��i����4D�	EventDataA��G�oData/K�NameHiveNameLength
A��;�oData#K�NameHiveName
A��C�oData+K�NameOriginalSize
A��9�oData!K�NameNewSize
�122<2$HiveNameLengthHiveName OriginalSizeNewSizeTEMP0�3�$3�]SW�=�v���8D�	EventDataA��G�oData/K�NameHiveNameLength
A��;�oData#K�NameHiveName
A��A�oData)K�NameKeysUpdated
A��?�oData'K�Name
DirtyPages
404H4d4$HiveNameLengthHiveNameKeysUpdatedDirtyPagesTEMP��6IS��Z%ZA��\��D�	EventDataA��C�oData+K�NameMajorVersion
A��C�oData+K�NameMinorVersion
A��C�oData+K�NameBuildVersion
A��?�oData'K�Name
QfeVersion
A��G�oData/K�NameServiceVersion
A��;�oData#K�NameBootMode
A��=�oData%K�Name	StartTime
T7t7�7�7�7�78 MajorVersion MinorVersion BuildVersionQfeVersion$ServiceVersionBootModeStartTimeTEMP��8zmU�b!A[Ф㸚�7��\D�	EventDataA��;�oData#K�NameStopTime
�8StopTimeTEMP�*$B�>���8U�
�؋����	D�	EventDataA��3�oDataK�NameMode
A��?�oData'K�Name
ObjectType
A��?�oData'K�Name
ObjectName
A��A�oData)K�NameProcessName
A��[�oDataCK�NameObjectCreatorProcessName
A��?�oData'K�Name
AccessMask
A��=�oData%K�Name	TokenType
A��O�oData7K�NameImpersonationLevel
A��=�oData%K�Name	SessionId
A��C�oData+K�NameLowBoxNumber
	A��K�oData3K�NameTokenGroupsCount
A��OZ�ComplexData)K�NameTokenGroups
�A��M�oData5K�NameTokenPackageCount
A��QZ�ComplexData+K�NameTokenPackage

�A��S�oData;K�NameTokenCapabilityCount
A��[Z�ComplexData5K�NameTokenCapabilities
�A��S�oData;K�NameTokenTrustLevelCount
A��WZ�ComplexData1K�NameTokenTrustLevel
�A��_�oDataGK�NameSecurityDescriptorRevision
A��]�oDataEK�NameSecurityDescriptorControl
A��Y�oDataAK�NameSecurityDescriptorOwner
A��Y�oDataAK�NameSecurityDescriptorGroup
A��C�oData+K�NameDaclRevision
A��C�oData+K�NameDaclAceCount
A��GZ�ComplexData!K�NameDaclAce
�A��C�oData+K�NameSaclRevision
A��C�oData+K�NameSaclAceCount
A��GZ�ComplexData!K�NameSaclAce
�lE|E�E�E�EF$F<FhF�F�F
�F�FG,G\G�G!�G�GHLH�H�H�H"�HI(I&HI\I�I�I�I�IJ$J8JPJlJxJ�J�J�JModeObjectTypeObjectNameProcessName8ObjectCreatorProcessNameAccessMaskTokenType,ImpersonationLevelSessionId LowBoxNumber(TokenGroupsCountTokenGroups(TokenPackageCount TokenPackage0TokenCapabilityCount(TokenCapabilities0TokenTrustLevelCount$TokenTrustLevel<SecurityDescriptorRevision8SecurityDescriptorControl4SecurityDescriptorOwner4SecurityDescriptorGroup DaclRevision DaclAceCountDaclAce SaclRevision SaclAceCountSaclAce$GroupAttributesGroupSidPackageSid0CapabilityAttributes CapabilitySid TrustLevelSidAceTypeAceFlagsAccessMaskSidAceTypeAceFlagsAccessMaskSidTEMP��O�(�J�S��1�Ol����D�	EventDataA��?�oData'K�Name
ActionName
A��A�oData)K�NameProcessName
A��A�oData)K�NameAccountName
A��E�oData-K�Name
AuthorityName
A��9�oData!K�NameTokenId
A��K�oData3K�NameAuthenticationId
A��=�oData%K�Name	TokenType
A��O�oData7K�NameImpersonationLevel
A��?�oData'K�Name
TokenFlags
A��Y�oDataAK�NameSidValuesReferenceCount
		A��G�oData/K�NameSidValuesCount
A��KZ�ComplexData%K�Name	SidValues
�A��e�oDataMK�NameSharedSidValuesReferenceCount
	A��S�oData;K�NameSharedSidValuesCount

A��WZ�ComplexData1K�NameSharedSidValues
�(QDQ`Q|Q�Q�Q�Q�QR		8RlR
�R		�R�R
S<SHSActionNameProcessNameAccountName AuthorityNameTokenId(AuthenticationIdTokenType,ImpersonationLevelTokenFlags4SidValuesReferenceCount$SidValuesCountSidValues@SharedSidValuesReferenceCount0SharedSidValuesCount$SharedSidValuesSidSidTEMP��Ta8vXZ-�.��U5��D�	EventDataA��Q�oData9K�NameTransitionStartTime
A��A�oData)K�NameCurrentTime
A��K�oData3K�NameSoftRestartCount
�T�TU,TransitionStartTimeCurrentTime(SoftRestartCountTEMP|�V� ��6�\��)������^D�	EventDataA��Q�oData9K�NameTransitionStartTime
A��A�oData)K�NameCurrentTime
A��K�oData3K�NameSoftRestartCount
A��K�oData3K�NameBugcheckRecovery

$WPWlW

�W,TransitionStartTimeCurrentTime(SoftRestartCount(BugcheckRecoveryTEMP@Z3�>ʬ�]qX?�o��PD�	EventDataA��E�oData-K�Name
MmPhase0Start

A��C�oData+K�NameMmPhase0Stop

A��A�oData)K�NamePhase1Start

A��M�oData5K�NameKsrExtensionStart

A��K�oData3K�NameKsrExtensionStop

A��S�oData;K�NameStartProcessorsStart

A��Q�oData9K�NameStartProcessorsStop



�Z

�Z

[

([

P[

x[

�[ MmPhase0Start MmPhase0StopPhase1Start(KsrExtensionStart(KsrExtensionStop0StartProcessorsStart,StartProcessorsStopTEMPH		_.]�7�<P���G����D�	EventDataA��E�oData-K�Name
MmPhase0Start

A��C�oData+K�NameMmPhase0Stop

A��A�oData)K�NamePhase1Start

A��M�oData5K�NameKsrExtensionStart

A��K�oData3K�NameKsrExtensionStop

A��S�oData;K�NameStartProcessorsStart

A��Q�oData9K�NameStartProcessorsStop

A��Q�oData9K�NameAutoLoggerInitStart

A��O�oData7K�NameAutoLoggerInitStop



�_

�_

�_

`

@`

h`

�`

�`

�` MmPhase0Start MmPhase0StopPhase1Start(KsrExtensionStart(KsrExtensionStop0StartProcessorsStart,StartProcessorsStop,AutoLoggerInitStart,AutoLoggerInitStopTEMP�

�e�����Sx1�?D����RD�	EventDataA��E�oData-K�Name
MmPhase0Start

A��C�oData+K�NameMmPhase0Stop

A��A�oData)K�NamePhase1Start

A��M�oData5K�NameKsrExtensionStart

A��K�oData3K�NameKsrExtensionStop

A��S�oData;K�NameStartProcessorsStart

A��Q�oData9K�NameStartProcessorsStop

A��Q�oData9K�NameAutoLoggerInitStart

A��O�oData7K�NameAutoLoggerInitStop

A��E�oData-K�Name
MmPhase1Start
	
A��C�oData+K�NameMmPhase1Stop

A��Y�oDataAK�NameHalPhase0StartCycleTime

A��W�oData?K�NameHalPhase0StopCycleTime



�f

�f

�f

g

,g

Tg

�g

�g

�g

h

(h

Hh

|h MmPhase0Start MmPhase0StopPhase1Start(KsrExtensionStart(KsrExtensionStop0StartProcessorsStart,StartProcessorsStop,AutoLoggerInitStart,AutoLoggerInitStop MmPhase1Start MmPhase1Stop4HalPhase0StartCycleTime4HalPhase0StopCycleTimeTEMP�tmc	�3�s]ѽ�6����D�	EventDataA��E�oData-K�Name
MmPhase0Start

A��C�oData+K�NameMmPhase0Stop

A��A�oData)K�NamePhase1Start

A��M�oData5K�NameKsrExtensionStart

A��K�oData3K�NameKsrExtensionStop

A��S�oData;K�NameStartProcessorsStart

A��Q�oData9K�NameStartProcessorsStop

A��Q�oData9K�NameAutoLoggerInitStart

A��O�oData7K�NameAutoLoggerInitStop

A��E�oData-K�Name
MmPhase1Start
	
A��C�oData+K�NameMmPhase1Stop

A��Y�oDataAK�NameHalPhase0StartCycleTime

A��W�oData?K�NameHalPhase0StopCycleTime

A��7�oDataK�NameMmMark

�

�n

�n

�n

�n

o

8o

ho

�o

�o

�o

p

,p

`p

�p MmPhase0Start MmPhase0StopPhase1Start(KsrExtensionStart(KsrExtensionStop0StartProcessorsStart,StartProcessorsStop,AutoLoggerInitStart,AutoLoggerInitStop MmPhase1Start MmPhase1Stop4HalPhase0StartCycleTime4HalPhase0StopCycleTimeMmMarkTEMP rpE�mm��R
f��<�����.D�	EventDataA��C�oData+K�NameUpdateReason
A��?�oData'K�Name
EnabledNew

A��;�oData#K�NameCountNew
A��;�oData#K�NameCountOld
�"\r

|r�r�r UpdateReasonEnabledNewCountNewCountOldTEMP�dsDs;��^P�#�@ݕ3��fD�	EventDataA��E�oData-K�Name
FailureResult
�"xs FailureResultTEMP htU{x��]��ۡ�|�F���D�	EventDataA��9�oData!K�NameNewBias
A��9�oData!K�NameOldBias
�t�tNewBiasOldBiasTEMP		Dw�y��%�P���|����XD�	EventDataA��G�oData/K�NameVsmCleanupTime

A��7�oDataK�NameMark#0

A��7�oDataK�NameMark#1

A��7�oDataK�NameMark#2

A��7�oDataK�NameMark#3

A��7�oDataK�NameMark#4

A��7�oDataK�NameMark#5

A��7�oDataK�NameMark#6

A��7�oDataK�NameMark#7



�w

x

0x

Dx

Xx

lx

�x

�x

�x$VsmCleanupTimeMark#0Mark#1Mark#2Mark#3Mark#4Mark#5Mark#6Mark#7TEMP��z��5���X��4_+���D�	EventDataA��?�oData'K�Name
ExitReason
A��A�oData)K�NameCurrentBias
A��M�oData5K�NameCurrentTimeZoneID
A��[�oDataCK�NameTimeZoneInfoCacheUpdated
A��C�oData+K�NameFirstRefresh
�z{4{\{�{ExitReasonCurrentBias(CurrentTimeZoneID8TimeZoneInfoCacheUpdated FirstRefreshPRVAX�{Microsoft-Windows-Kernel-GeneralOPCO01$|win:InfoLEVL�Pl|P�|P�|win:Errorwin:Warning(win:InformationalTASK����~����$~����@~����`~�����~�����~�����~���� 	����L
����x�����SystemStartSystemStop SoftBootInfo,BootPerformanceData(SystemTimeChange0LeapSecondDataUpdate<LeapSecondDataParseFailure,TimeZoneBiasChange,VsmPerformanceData$ReorganizeHive<TimeZoneInformationRefreshKEYWD$� ����`�@�������������<KERNEL_GENERAL_KEYWORD_TIMELKERNEL_GENERAL_SECURITY_ACCESSCHECKLKERNEL_GENERAL_TOKEN_SID_MANAGEMENT$BootPerformanceEVNT8��0$|`|�L"��P%|`|D}�L"��&|`|D}�L"�@)|`|L"�@)|`|L"�@)|`|L"��)H|L"�`+H|L"�0-|`|L"���4|`|�|�L"
��
$8|`|�| �L" �����8H|$�
�(0|`|�}L"�P2|`|L"@�����J`|(����TS|`|},�L"��@U|`|}0�L"������W|`|(}4�������[|`|(}8������a|`|(}<�������h|`|(}@���p|`|`}D�L"��r|T||}H�L"��s|`|�}L�L"	������t|`|�}P���x|`|�}T�L"������������������WEVTdu�	��$�p�
�d������X�CHANt̆����XMicrosoft-Windows-Kernel-Process/AnalyticMAPSL4�BMAPP�� ProcessFlagsTTBL�bTEMP�,�
�q���=[�u�����T��|D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��I�oData1K�NameParentProcessID
A��=�oData%K�Name	SessionID
A��=�oData%K�Name	ImageName
����ĉ��ProcessIDCreateTime$ParentProcessIDSessionIDImageNameTEMP���a#�m6Z�&M�lk���D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��I�oData1K�NameParentProcessID
A��=�oData%K�Name	SessionID
A��5�oDataK�NameFlags
A��=�oData%K�Name	ImageName
|�����Ԍ4����ProcessIDCreateTime$ParentProcessIDSessionIDFlagsImageNameTEMP$

D�	�	�<RW�@�\:<����D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��I�oData1K�NameParentProcessID
A��=�oData%K�Name	SessionID
A��5�oDataK�NameFlags
A��=�oData%K�Name	ImageName
A��E�oData-K�Name
ImageChecksum
A��E�oData-K�Name
TimeDateStamp
A��I�oData1K�NamePackageFullName
A��S�oData;K�NamePackageRelativeAppId
	�$�@�d�4�|�����đ��ProcessIDCreateTime$ParentProcessIDSessionIDFlagsImageName ImageChecksum TimeDateStamp$PackageFullName0PackageRelativeAppIdTEMPX<��}�T#]�Q\c^r����D�	EventDataA��=�oData%K�Name	ProcessID
A��U�oData=K�NameProcessSequenceNumber

A��?�oData'K�Name
CreateTime
A��I�oData1K�NameParentProcessID
A��a�oDataIK�NameParentProcessSequenceNumber

A��=�oData%K�Name	SessionID
A��5�oDataK�NameFlags
A��]�oDataEK�NameProcessTokenElevationType
A��W�oData?K�NameProcessTokenIsElevated
A��G�oData/K�NameMandatoryLabel
	A��=�oData%K�Name	ImageName
A��E�oData-K�Name
ImageChecksum
A��E�oData-K�Name
TimeDateStamp
A��I�oData1K�NamePackageFullName

A��S�oData;K�NamePackageRelativeAppId
h�

����̘

�,�4�D�T���������<�`�ProcessID0ProcessSequenceNumberCreateTime$ParentProcessID<ParentProcessSequenceNumberSessionIDFlags8ProcessTokenElevationType4ProcessTokenIsElevated$MandatoryLabelImageName ImageChecksum TimeDateStamp$PackageFullName0PackageRelativeAppIdTEMP�		`�(�G���X�P�@;����D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��;�oData#K�NameExitTime
A��;�oData#K�NameExitCode
A��O�oData7K�NameTokenElevationType
A��A�oData)K�NameHandleCount
A��C�oData+K�NameCommitCharge

A��?�oData'K�Name
CommitPeak

A��=�oData%K�Name	ImageName
�,�H�`�x���

��

���ProcessIDCreateTimeExitTimeExitCode,TokenElevationTypeHandleCount CommitChargeCommitPeakImageNameTEMP��E��ZY�Aty����D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��;�oData#K�NameExitTime
A��;�oData#K�NameExitCode
A��O�oData7K�NameTokenElevationType
A��A�oData)K�NameHandleCount
A��C�oData+K�NameCommitCharge

A��?�oData'K�Name
CommitPeak

A��E�oData-K�Name
CPUCycleCount

A��O�oData7K�NameReadOperationCount
	A��Q�oData9K�NameWriteOperationCount
A��U�oData=K�NameReadTransferKiloBytes
A��W�oData?K�NameWriteTransferKiloBytes
A��G�oData/K�NameHardFaultCount

A��=�oData%K�Name	ImageName
�(�D�\�t���

��

ܥ

���D�p���Ԧ��ProcessIDCreateTimeExitTimeExitCode,TokenElevationTypeHandleCount CommitChargeCommitPeak CPUCycleCount,ReadOperationCount,WriteOperationCount0ReadTransferKiloBytes4WriteTransferKiloBytes$HardFaultCountImageNameTEMP�<��Uk ݂Z5g'��י����D�	EventDataA��=�oData%K�Name	ProcessID
A��U�oData=K�NameProcessSequenceNumber

A��?�oData'K�Name
CreateTime
A��;�oData#K�NameExitTime
A��;�oData#K�NameExitCode
A��O�oData7K�NameTokenElevationType
A��A�oData)K�NameHandleCount
A��C�oData+K�NameCommitCharge

A��?�oData'K�Name
CommitPeak

A��E�oData-K�Name
CPUCycleCount
	
A��O�oData7K�NameReadOperationCount
A��Q�oData9K�NameWriteOperationCount
A��U�oData=K�NameReadTransferKiloBytes
A��W�oData?K�NameWriteTransferKiloBytes

A��G�oData/K�NameHardFaultCount
A��=�oData%K�Name	ImageName
|�

��ĭ����<�

X�

x�

������<�p���ProcessID0ProcessSequenceNumberCreateTimeExitTimeExitCode,TokenElevationTypeHandleCount CommitChargeCommitPeak CPUCycleCount,ReadOperationCount,WriteOperationCount0ReadTransferKiloBytes4WriteTransferKiloBytes$HardFaultCountImageNameTEMPx		x��nUh�2X�l"�&�����D�	EventDataA��=�oData%K�Name	ProcessID
A��;�oData#K�NameThreadID
A��=�oData%K�Name	StackBase
A��?�oData'K�Name
StackLimit
A��E�oData-K�Name
UserStackBase
A��G�oData/K�NameUserStackLimit
A��=�oData%K�Name	StartAddr
A��G�oData/K�NameWin32StartAddr
A��9�oData!K�NameTebBase
,�D�\�t�����Գ��ProcessIDThreadIDStackBaseStackLimit UserStackBase$UserStackLimitStartAddr$Win32StartAddrTebBaseTEMP�

<�Q���]���1�T���D�	EventDataA��=�oData%K�Name	ProcessID
A��;�oData#K�NameThreadID
A��=�oData%K�Name	StackBase
A��?�oData'K�Name
StackLimit
A��E�oData-K�Name
UserStackBase
A��G�oData/K�NameUserStackLimit
A��=�oData%K�Name	StartAddr
A��G�oData/K�NameWin32StartAddr
A��9�oData!K�NameTebBase
A��E�oData-K�Name
SubProcessTag
	��4�L�h�����ĸ���ProcessIDThreadIDStackBaseStackLimit UserStackBase$UserStackLimitStartAddr$Win32StartAddrTebBase SubProcessTagTEMPhx���*my_\ǻ�.���&D�	EventDataA��=�oData%K�Name	ProcessID
A��;�oData#K�NameThreadID
A��=�oData%K�Name	StackBase
A��?�oData'K�Name
StackLimit
A��E�oData-K�Name
UserStackBase
A��G�oData/K�NameUserStackLimit
A��=�oData%K�Name	StartAddr
A��G�oData/K�NameWin32StartAddr
A��9�oData!K�NameTebBase
A��E�oData-K�Name
SubProcessTag
	A��=�oData%K�Name	CycleTime

T�l�������ؽ���8�L�
l�ProcessIDThreadIDStackBaseStackLimit UserStackBase$UserStackLimitStartAddr$Win32StartAddrTebBase SubProcessTagCycleTimeTEMP����|hGH}V�Ȋ`�j�%��
D�	EventDataA��=�oData%K�Name	ImageBase
A��=�oData%K�Name	ImageSize
A��=�oData%K�Name	ProcessID
A��E�oData-K�Name
ImageCheckSum
A��E�oData-K�Name
TimeDateStamp
A��A�oData)K�NameDefaultBase
A��=�oData%K�Name	ImageName
P�h���������ImageBaseImageSizeProcessID ImageCheckSum TimeDateStampDefaultBaseImageNameTEMP�L���|hGH}V�Ȋ`�j�%��
D�	EventDataA��=�oData%K�Name	ImageBase
A��=�oData%K�Name	ImageSize
A��=�oData%K�Name	ProcessID
A��E�oData-K�Name
ImageCheckSum
A��E�oData-K�Name
TimeDateStamp
A��A�oData)K�NameDefaultBase
A��=�oData%K�Name	ImageName
����� �@�`�|�ImageBaseImageSizeProcessID ImageCheckSum TimeDateStampDefaultBaseImageNameTEMP����UU�?��M���0D�	EventDataA��=�oData%K�Name	ProcessID
A��;�oData#K�NameThreadID
A��A�oData)K�NameOldPriority
A��A�oData)K�NameNewPriority
H�`�x���ProcessIDThreadIDOldPriorityNewPriorityTEMP�P�2�>!��xX�6�f��P��jD�	EventDataA��I�oData1K�NameFrozenProcessID
d�$FrozenProcessIDTEMPLl�Env�z��_�����%�����D�	EventDataA��I�oData1K�NameFrozenProcessID
A��?�oData'K�Name
CreateTime
����$FrozenProcessIDCreateTimeTEMP����7ά��Y���`�������D�	EventDataA��C�oData+K�NameContainer ID
A��7�oDataK�NameJob ID
A��?�oData'K�Name
StatusCode
,�L�`� Container IDJob IDStatusCodeTEMP���.�n]�y�]b�A��"�h���D�	EventDataA��7�oDataK�NameJob ID
A��M�oData5K�NameDiskIoAttribution
A��?�oData'K�Name
StatusCode
�����Job ID(DiskIoAttributionStatusCodeTEMP(�w묌
�U��	o	&���D�	EventDataA��7�oDataK�NameJob ID
A��E�oData-K�Name
IoRateControl
A��A�oData)K�NameControlType
A��;�oData#K�NameRateType
A��?�oData'K�Name
RateAmount
A��?�oData'K�Name
StatusCode
���������$�Job ID IoRateControlControlTypeRateTypeRateAmountStatusCodeTEMP����Z�ePSG�(/7�'���D�	EventDataA��7�oDataK�NameJob ID
A��E�oData-K�Name
IoRateControl
A��9�oData!K�NameMaxIops

A��C�oData+K�NameMaxBandwidth

A��G�oData/K�NameMaxTimePercent

A��I�oData1K�NameReservationIops

A��S�oData;K�NameReservationBandwidth

A��W�oData?K�NameReservationTimePercent

A��Y�oDataAK�NameCriticalReservationIops

A��c�oDataKK�NameCriticalReservationBandwidth
	
A��g�oDataOK�NameCriticalReservationTimePercent

A��C�oData+K�NameControlFlags
A��?�oData'K�Name
VolumeName
A��?�oData'K�Name
StatusCode

 �4�

T�

h�

��

��

��

�

4�

h�

�����(�Job ID IoRateControlMaxIops MaxBandwidth$MaxTimePercent$ReservationIops0ReservationBandwidth4ReservationTimePercent4CriticalReservationIops@CriticalReservationBandwidthDCriticalReservationTimePercent ControlFlagsVolumeNameStatusCodeTEMP�	���̶�:�S�S�[����D�	EventDataA��7�oDataK�NameJob ID
A��E�oData-K�Name
IoRateControl
A��9�oData!K�NameMaxIops

A��C�oData+K�NameMaxBandwidth

A��G�oData/K�NameMaxTimePercent

A��I�oData1K�NameReservationIops

A��S�oData;K�NameReservationBandwidth

A��W�oData?K�NameReservationTimePercent

A��Y�oDataAK�NameCriticalReservationIops

A��c�oDataKK�NameCriticalReservationBandwidth
	
A��g�oDataOK�NameCriticalReservationTimePercent

A��A�oData)K�NameSoftMaxIops

A��K�oData3K�NameSoftMaxBandwidth

A��O�oData7K�NameSoftMaxTimePercent


A��C�oData+K�NameControlFlags
A��?�oData'K�Name
VolumeName
A��?�oData'K�Name
StatusCode
P�d�

��

��

��

��

�

0�

d�

��

��

�

8�

`�������Job ID IoRateControlMaxIops MaxBandwidth$MaxTimePercent$ReservationIops0ReservationBandwidth4ReservationTimePercent4CriticalReservationIops@CriticalReservationBandwidthDCriticalReservationTimePercentSoftMaxIops(SoftMaxBandwidth,SoftMaxTimePercent ControlFlagsVolumeNameStatusCodeTEMP����_P‹5Z��<���L���D�	EventDataA��Y�oDataAK�NameOldWorkOnBehalfThreadID
A��Y�oDataAK�NameNewWorkOnBehalfThreadID
�P�4OldWorkOnBehalfThreadID4NewWorkOnBehalfThreadIDTEMP���F@mQ�)�Vنo���D�	EventDataA��C�oData+K�NameContainer ID
A��7�oDataK�NameJob ID
A��5�oDataK�NameState
����� Container IDJob IDStateTEMP�8��.���U�x`ߑ�ׂ���D�	EventDataA��C�oData+K�NameContainer ID
A��7�oDataK�NameJob ID
A��A�oData)K�NameMonitorName
t����� Container IDJob IDMonitorNameTEMP �h���[a�BZ����(D�	EventDataA��C�oData+K�NameContainer ID
A��7�oDataK�NameJob ID
A��7�oDataK�NameStatus
A��A�oData)K�NameMonitorName
p������� Container IDJob IDStatusMonitorNameTEMP8��!��03\���|��#���D�	EventDataA��A�oData)K�NameProcessName
A��=�oData%K�Name	ProcessID
����ProcessNameProcessIDPRVAX �Microsoft-Windows-Kernel-ProcessOPCOx1��2��2��win:Infowin:Startwin:StopLEVL@P��(win:InformationalTASK�����<�����\�����x������������������������������	����<�
����h�������
���������������������������8�����\������������� ProcessStartProcessStopThreadStartThreadStopImageLoadImageUnload0CpuBasePriorityChange(CpuPriorityChange,PagePriorityChange(IoPriorityChange ProcessFreezeJobStart JobTerminate$ProcessRundown,PsDiskIoAttribution$PsIoRateControl8ThreadWorkOnBehalfUpdate,JobServerSiloStart,ProcessInPrivateSetKEYWl������ ������@����������H����������������������@������� ������@���� �8WINEVENT_KEYWORD_PROCESS4WINEVENT_KEYWORD_THREAD4WINEVENT_KEYWORD_IMAGE@WINEVENT_KEYWORD_CPU_PRIORITYDWINEVENT_KEYWORD_OTHER_PRIORITYDWINEVENT_KEYWORD_PROCESS_FREEZE0WINEVENT_KEYWORD_JOBhWINEVENT_KEYWORD_ENABLE_PROCESS_TRACING_CALLBACKS4WINEVENT_KEYWORD_JOB_IODWINEVENT_KEYWORD_WORK_ON_BEHALF8WINEVENT_KEYWORD_JOB_SILOEVNTd)��|�|���(�������|���(�������|���(� �����8�|���(�$�����������D�(����������D�,����������D�0��� ����|���`�4��� ��$�|���`�8��� ��������|�<��� �������|�@���@����p�����D���@���p�����H��������p�����L��������p�����P���		�	���p����T���

�
���p���$�X�������|���@�\�������|���@�`�����������@�d�����������@�h���

�
���|���\�l�����������x�p������p�����t�����8�p�����x�������p���|������|�|��������������|����������������8�|��������������@�|��������������D�|��������������8����������������@����������������D����������� �������p���������@�������p��������@������|��������@����������������@������|��������@����������������������p��� �������������������������(�(�8�8�H�H�H�H�X�X�����h�x�x�x�x�x�x�x�x���������������WEVT�F���
`,�,�4�47�9CHAN�8�����������\Microsoft-Windows-Kernel-Registry/Analytic`Microsoft-Windows-Kernel-Registry/PerformanceTTBLl/TEMP�4��zw�_Q
f��i�N���D�	EventDataA��?�oData'K�Name
BaseObject
A��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��A�oData)K�NameDisposition
A��;�oData#K�NameBaseName
A��C�oData+K�NameRelativeName
d���������BaseObjectKeyObjectStatusDispositionBaseName RelativeNameTEMP�����u�Y[`q��BsK���D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��9�oData!K�NameKeyName
LdxKeyObjectStatusKeyNameTEMPx�C���^ζUGr������D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
A��K�oData3K�NameCapturedDataSize
A��C�oData+K�NameCapturedData
Ldx����KeyObjectStatusInfoClassDataSizeKeyName(CapturedDataSize CapturedDataTEMP��U���yZ[A��u����D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��3�oDataK�NameType
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
A��=�oData%K�Name	ValueName
A��K�oData3K�NameCapturedDataSize
A��C�oData+K�NameCapturedData
A��K�oData3K�NamePreviousDataType
A��K�oData3K�NamePreviousDataSize
	A��[�oDataCK�NamePreviousDataCapturedSize
A��C�oData+K�NamePreviousData
�	�	�	�	

0
X
x
�
�

KeyObjectStatusTypeDataSizeKeyNameValueName(CapturedDataSize CapturedData(PreviousDataType(PreviousDataSize8PreviousDataCapturedSize PreviousDataTEMP�t5|��
U'VO��C���� D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��9�oData!K�NameKeyName
A��=�oData%K�Name	ValueName
���
KeyObjectStatusKeyNameValueNameTEMP���Y܄$[�F�@L����BD�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
A��=�oData%K�Name	ValueName
A��K�oData3K�NameCapturedDataSize
A��C�oData+K�NameCapturedData
4L`x����KeyObjectStatusInfoClassDataSizeKeyNameValueName(CapturedDataSize CapturedDataTEMP�t�f�C��V��`����%��:D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��5�oDataK�NameIndex
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
A��K�oData3K�NameCapturedDataSize
A��C�oData+K�NameCapturedData
,@Ph���KeyObjectStatusIndexInfoClassDataSizeKeyName(CapturedDataSize CapturedDataTEMPptB!��Q>�Ƅ����dD�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��?�oData'K�Name
EntryCount
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
�� 8KeyObjectStatusEntryCountDataSizeKeyNameTEMPx�C���^ζUGr������D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
A��K�oData3K�NameCapturedDataSize
A��C�oData+K�NameCapturedData
$8Ph|�KeyObjectStatusInfoClassDataSizeKeyName(CapturedDataSize CapturedDataTEMP<�Zv��NɋP�};�ɖ���D�	EventDataA��C�oData+K�NameHiveFilePath
A��;�oData#K�NameFileSize
�� HiveFilePathFileSizeTEMP\�%{�1�Uϫ+F�����D�	EventDataA��G�oData/K�NameTotalEntrySize
A��G�oData/K�NameBytesRecovered
8$TotalEntrySize$BytesRecoveredTEMP��9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
StatusCodeTEMPT/���mT6#W�|4����D�	EventDataA��C�oData+K�NameHiveFilePath
A��G�oData/K�NameHiveMountPoint
0P HiveFilePath$HiveMountPointTEMP� 9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
 StatusCodeTEMP�d!ݯ��I^vo��X���D�	EventDataA��C�oData+K�NameHiveFilePath
A��G�oData/K�NameHiveMountPoint
A��?�oData'K�Name
FlushFlags
�!�!�! HiveFilePath$HiveMountPointFlushFlagsTEMP��"i����T;�qW��w��fD�	EventDataA��E�oData-K�Name
BytesGathered
�" BytesGatheredTEMP�l#i����T;�qW��w��fD�	EventDataA��E�oData-K�Name
BytesGathered
�# BytesGatheredTEMPL�$˦i��=I_��Nm�;���D�	EventDataA��C�oData+K�NameWritesIssued
A��C�oData+K�NameBytesWritten
�$�$ WritesIssued BytesWrittenTEMPL�%˦i��=I_��Nm�;���D�	EventDataA��C�oData+K�NameWritesIssued
A��C�oData+K�NameBytesWritten
�%& WritesIssued BytesWrittenTEMP��&9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
�&StatusCodeTEMP$�'V��U�V6Q�D��Y7{���D�	EventDataA��?�oData'K�Name
SourceFile
A��5�oDataK�NameFlags
�'(SourceFileFlagsTEMP��(9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
�(StatusCodeTEMP$�)V��U�V6Q�D��Y7{���D�	EventDataA��?�oData'K�Name
SourceFile
A��5�oDataK�NameFlags
�)�)SourceFileFlagsTEMP��*9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
�*StatusCodeTEMP�h+��*K�tS
f�g<����fD�	EventDataA��E�oData-K�Name
SourceKeyPath
|+ SourceKeyPathTEMP�0,9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
D,StatusCodePRVAXt,Microsoft-Windows-Kernel-RegistryOPCO�!2P.2h.
�����.
�����.
����/
����`/�����/�����/����$0����`0�����0�����0���� 1
����X1�����1�����1����<2�����2 �����2!�����2"����3#���� 3$����83%����T3&����x3'�����3(�����3)�����3*����4+����84,����P4-����h4.�����4win:Startwin:StopHRegPerfOpHiveMountBaseFileMountedPRegPerfOpHiveFlushBecameActiveFlusherHRegPerfOpShutdownRundownComplete4RegPerfOpSaveFileCopiedHRegPerfOpHiveMountLogEntryAppliedHRegPerfOpHiveFlushGatheredLogData<RegPerfOpShutdownFlushStart4RegPerfOpSaveTreeCopiedPRegPerfOpHiveFlushGatheredPrimaryData<RegPerfOpShutdownFlushStop8RegPerfOpSaveFileWrittenDRegPerfOpHiveFlushWroteLogFileLRegPerfOpHiveFlushWrotePrimaryFileTRegPerfOpHiveFlushBoostedActiveFlusherPRegPerfOpHiveFlushStartWaitForActivePRegPerfOpHiveFlushFinishWaitForActiveCreateKeyOpenKeyDeleteKeyQueryKeySetValueKey$DeleteValueKey QueryValueKey EnumerateKey(EnumerateValueKey0QueryMultipleValueKey(SetInformationKeyFlushKeyCloseKey(QuerySecurityKey$SetSecurityKeyLEVL@P�4(win:InformationalTASKs�5s�5s$6sT6s�6s�6s�60RegPerfTaskHiveMount0RegPerfTaskHiveUnload0RegPerfTaskHiveFlush,RegPerfTaskShutdown,RegPerfTaskHiveLoad4RegPerfTaskHiveRestore,RegPerfTaskHiveSaveKEYW�����8���� 8����H8����l8 �����8@�����8������8����9���� 9����D9����d9�����9 �����9@�����9������9CloseKey(QuerySecurityKey$SetSecurityKey(EnumerateValueKey0QueryMultipleValueKey(SetInformationKeyFlushKeySetValueKey$DeleteValueKey QueryValueKey EnumerateKeyCreateKeyOpenKeyDeleteKeyQueryKeyEVNT�- �������-�4`B�! �������-�4dB�"@������-�4hB�#��������-�4lB�$������-�4pB�%����� �-�4tB�&�����
�-�4xB�'������-�4|B�	(������-�4�B�
) ������.�4�B�*@�����L.�4�B�+������ .�4�B�
,�����,.�4�B�-�����8.�4�B�.�����D.�4�B�@�����,�45(�
@������,�45(�@����-�45(�@����\�,�45(�@���� �,�45(�@����t�,�45(�@����8 �,�485(�
@�����,�485(�@����"-�485(�@�����"<-�485(�
@�����#`-�485(�@�����#l-�485(�@����x-�485(�@�����-�485(�@�����-�485(�@����8&�,�485(� @�����,�4T5(�!@�����,�4T5(�"@����$-�4T5(�#@����H-�4T5(�$@�����,�4T5(�%@�����&�,�4p5(�&@���� (�,�4p5(�'@�����(�,�4�5(�(@����*�,�4�5(�)@�����*�,�4�5(�*
@����-�4�5(�+@����0-�4�5(�,@����T-�4�5(�-@�����+�,�4�5(��7�7�7�7�7�7�7�7H7X7h7x77(787WEVT���	�BhC$E
8����� �d���CHANtC����XMicrosoft-Windows-Kernel-Acpi/DiagnosticMAPS��C�C�C�CVMAP$�D��VMAP$�D��VMAP$E��VMAPdTD
��	�
���
���	�,MapAcpiOverrideTypeHMapActiveCoolingDevicePowerState<MapAmlMethodInvocationState MapResetTypeTTBL�TEMPL�G}9/��`XuN�y����tD�	EventDataA��C�oData+K�NameResourceFlag
A��A�oData)K�NameGeneralFlag
A��K�oData3K�NameTypeSpecificFlag
A��A�oData)K�NameGranularity

A��?�oData'K�Name
AddressMin

A��?�oData'K�Name
AddressMax

A��O�oData7K�NameAddressTranslation

A��E�oData-K�Name
AddressLength

xH�H�H
�H
�H
I
0I
\I ResourceFlagGeneralFlag(TypeSpecificFlagGranularityAddressMinAddressMax,AddressTranslation AddressLengthTEMP\hJ�K���;T]��cAl쪙���D�	EventDataA��A�oData)K�NameGpeRegister
A��O�oData7K�NameUnexpectedEventMap
�J�JGpeRegister,UnexpectedEventMapTEMP�(O�m��_:����Rt���D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
	A��3�oDataK�Name_AC6
A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9

A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
hP�P�P�PQQ$Q4QDQTQdQtQ�Q�Q�Q�QDThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance_TMP_PSV_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRTTEMPH�T�~���\K�+I���S���D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��O�oData7K�NameActiveCoolingLevel
A��[�oDataCK�NameActiveCoolingDeviceIndex
A��Y�oDataAK�NameFanDeviceInstanceLength
A��M�oData5K�NameFanDeviceInstance
A��K�oData3K�NamePowerStateLength
A��?�oData'K�Name
PowerState
�U�UV4VlV�V�V�VDThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance,ActiveCoolingLevel8ActiveCoolingDeviceIndex4FanDeviceInstanceLength(FanDeviceInstance(PowerStateLengthPowerStateTEMP��Yn�V^�_V?��{Lv���D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��O�oData7K�NameActiveCoolingLevel
A��[�oDataCK�NameActiveCoolingDeviceIndex
A��Y�oDataAK�NameFanDeviceInstanceLength
A��M�oData5K�NameFanDeviceInstance
A��?�oData'K�Name
PowerState
lZ�Z�Z[L[�[�C�[DThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance,ActiveCoolingLevel8ActiveCoolingDeviceIndex4FanDeviceInstanceLength(FanDeviceInstancePowerStateTEMP�]��]}�[���q�M��D�	EventDataA��S�oData;K�NameDeviceInstanceLength
A��G�oData/K�NameDeviceInstance
A��?�oData'K�Name
PowerState
<]l]�C�]0DeviceInstanceLength$DeviceInstancePowerStateTEMP��^��۸�̫S����m`���D�	EventDataA��S�oData;K�NameDeviceInstanceLength
A��G�oData/K�NameDeviceInstance
A��;�oData#K�NameThrottle
 _P_t_0DeviceInstanceLength$DeviceInstanceThrottleTEMPXaA*7���U�
G9P����JD�	EventDataA��S�oData;K�NameDeviceInstanceLength
A��G�oData/K�NameDeviceInstance
A��?�oData'K�Name
PowerState
A��;�oData#K�NameThrottle
\a�a�C�a�a0DeviceInstanceLength$DeviceInstancePowerStateThrottleTEMP@Pc��j�焴Y�E��3rZ��6D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��A�oData)K�NameTemperature
�c�cdDThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstanceTemperatureTEMPt�e�]��S���X�;@��ZD�	EventDataA��Q�oData9K�NameAmlMethodNameLength
A��E�oData-K�Name
AmlMethodName
A��G�oData/K�NameAmlMethodState
A��G�oData/K�NameAmlElapsedTime

f0f�CPf

tf,AmlMethodNameLength AmlMethodName$AmlMethodState$AmlElapsedTimeTEMP��g��k�_�]�6����D�	EventDataA��Q�oData9K�NameAmlMethodNameLength
A��E�oData-K�Name
AmlMethodName
A��=�oData%K�Name	Frequency

h8h

Xh,AmlMethodNameLength AmlMethodNameFrequencyTEMP,, t���q"^�8�Iy,���zD�	EventDataA��]�oDataEK�NameThermalZoneBiosNameLength
A��Q�oData9K�NameThermalZoneBiosName
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_TC1
A��3�oDataK�Name_TC2
A��3�oDataK�Name_TSP
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
	A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
A��3�oDataK�Name_AC6

A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9
A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
A��3�oDataK�Name_NTT
A��=�oData%K�Name	_PSLCount
A��A�oData)K�Name_PSLEntries
�A��=�oData%K�Name	_TZDCount
A��A�oData)K�Name_TZDEntries
�A��=�oData%K�Name	_AL0Count
A��A�oData)K�Name_AL0Entries
�A��=�oData%K�Name	_AL1Count
A��A�oData)K�Name_AL1Entries
�A��=�oData%K�Name	_AL2Count
A��A�oData)K�Name_AL2Entries
�A��=�oData%K�Name	_AL3Count
A��A�oData)K�Name_AL3Entries
�A��=�oData%K�Name	_AL4Count
 A��A�oData)K�Name_AL4Entries
!�A��=�oData%K�Name	_AL5Count
"A��A�oData)K�Name_AL5Entries
#�A��=�oData%K�Name	_AL6Count
$A��A�oData)K�Name_AL6Entries
%�A��=�oData%K�Name	_AL7Count
&A��A�oData)K�Name_AL7Entries
'�A��=�oData%K�Name	_AL8Count
(A��A�oData)K�Name_AL8Entries
)�A��=�oData%K�Name	_AL9Count
*A��A�oData)K�Name_AL9Entries
+��w�w�wxx$x4xDxTxdxtx�x�x�x�x�x�x�x�xyy,yHy`y|y�y�y�y�y�yz0zLz dz�z"�z�z$�z�z&{{(4{P{*h{8ThermalZoneBiosNameLength,ThermalZoneBiosName_TMP_PSV_TC1_TC2_TSP_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRT_NTT_PSLCount_PSLEntries_TZDCount_TZDEntries_AL0Count_AL0Entries_AL1Count_AL1Entries_AL2Count_AL2Entries_AL3Count_AL3Entries_AL4Count_AL4Entries_AL5Count_AL5Entries_AL6Count_AL6Entries_AL7Count_AL7Entries_AL8Count_AL8Entries_AL9Count_AL9EntriesTEMP�--��~����kU�RQ��ow����D�	EventDataA��]�oDataEK�NameThermalZoneBiosNameLength
A��Q�oData9K�NameThermalZoneBiosName
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_TC1
A��3�oDataK�Name_TC2
A��3�oDataK�Name_TSP
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
	A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
A��3�oDataK�Name_AC6

A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9
A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
A��3�oDataK�Name_NTT
A��=�oData%K�Name	_PSLCount
A��A�oData)K�Name_PSLEntries
�A��=�oData%K�Name	_TZDCount
A��A�oData)K�Name_TZDEntries
�A��=�oData%K�Name	_AL0Count
A��A�oData)K�Name_AL0Entries
�A��=�oData%K�Name	_AL1Count
A��A�oData)K�Name_AL1Entries
�A��=�oData%K�Name	_AL2Count
A��A�oData)K�Name_AL2Entries
�A��=�oData%K�Name	_AL3Count
A��A�oData)K�Name_AL3Entries
�A��=�oData%K�Name	_AL4Count
 A��A�oData)K�Name_AL4Entries
!�A��=�oData%K�Name	_AL5Count
"A��A�oData)K�Name_AL5Entries
#�A��=�oData%K�Name	_AL6Count
$A��A�oData)K�Name_AL6Entries
%�A��=�oData%K�Name	_AL7Count
&A��A�oData)K�Name_AL7Entries
'�A��=�oData%K�Name	_AL8Count
(A��A�oData)K�Name_AL8Entries
)�A��=�oData%K�Name	_AL9Count
*A��A�oData)K�Name_AL9Entries
+�A��I�oData1K�NameMinimumThrottle
,�@�l�|���������̋܋�����,�<�L�\�l�|�������،��(�@�\�t�����č ܍��"�,�$D�`�&x���(��Ȏ*���8ThermalZoneBiosNameLength,ThermalZoneBiosName_TMP_PSV_TC1_TC2_TSP_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRT_NTT_PSLCount_PSLEntries_TZDCount_TZDEntries_AL0Count_AL0Entries_AL1Count_AL1Entries_AL2Count_AL2Entries_AL3Count_AL3Entries_AL4Count_AL4Entries_AL5Count_AL5Entries_AL6Count_AL6Entries_AL7Count_AL7Entries_AL8Count_AL8Entries_AL9Count_AL9Entries$MinimumThrottleTEMP�00����p`�~S�㔿�,�����D�	EventDataA��]�oDataEK�NameThermalZoneBiosNameLength
A��Q�oData9K�NameThermalZoneBiosName
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_TC1
A��3�oDataK�Name_TC2
A��3�oDataK�Name_TSP
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
	A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
A��3�oDataK�Name_AC6

A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9
A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
A��3�oDataK�Name_NTT
A��=�oData%K�Name	_PSLCount
A��A�oData)K�Name_PSLEntries
�A��=�oData%K�Name	_TZDCount
A��A�oData)K�Name_TZDEntries
�A��=�oData%K�Name	_AL0Count
A��A�oData)K�Name_AL0Entries
�A��=�oData%K�Name	_AL1Count
A��A�oData)K�Name_AL1Entries
�A��=�oData%K�Name	_AL2Count
A��A�oData)K�Name_AL2Entries
�A��=�oData%K�Name	_AL3Count
A��A�oData)K�Name_AL3Entries
�A��=�oData%K�Name	_AL4Count
 A��A�oData)K�Name_AL4Entries
!�A��=�oData%K�Name	_AL5Count
"A��A�oData)K�Name_AL5Entries
#�A��=�oData%K�Name	_AL6Count
$A��A�oData)K�Name_AL6Entries
%�A��=�oData%K�Name	_AL7Count
&A��A�oData)K�Name_AL7Entries
'�A��=�oData%K�Name	_AL8Count
(A��A�oData)K�Name_AL8Entries
)�A��=�oData%K�Name	_AL9Count
*A��A�oData)K�Name_AL9Entries
+�A��I�oData1K�NameMinimumThrottle
,A��3�oDataK�Name_CR3
-A��3�oDataK�Name_TFP
.A��U�oData=K�NameOverThrottleThreshold
/����$�4�D�T�d�t���������ĠԠ����$�4�L�h�������С���8�P�l� ����"��Ԣ$��& �<�(T�p�*����ȣأ�8ThermalZoneBiosNameLength,ThermalZoneBiosName_TMP_PSV_TC1_TC2_TSP_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRT_NTT_PSLCount_PSLEntries_TZDCount_TZDEntries_AL0Count_AL0Entries_AL1Count_AL1Entries_AL2Count_AL2Entries_AL3Count_AL3Entries_AL4Count_AL4Entries_AL5Count_AL5Entries_AL6Count_AL6Entries_AL7Count_AL7Entries_AL8Count_AL8Entries_AL9Count_AL9Entries$MinimumThrottle_CR3_TFP0OverThrottleThresholdTEMP22�� ���;;Rwi��Q���6
D�	EventDataA��]�oDataEK�NameThermalZoneBiosNameLength
A��Q�oData9K�NameThermalZoneBiosName
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_TC1
A��3�oDataK�Name_TC2
A��3�oDataK�Name_TSP
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
	A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
A��3�oDataK�Name_AC6

A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9
A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
A��3�oDataK�Name_NTT
A��=�oData%K�Name	_PSLCount
A��A�oData)K�Name_PSLEntries
�A��=�oData%K�Name	_TZDCount
A��A�oData)K�Name_TZDEntries
�A��=�oData%K�Name	_AL0Count
A��A�oData)K�Name_AL0Entries
�A��=�oData%K�Name	_AL1Count
A��A�oData)K�Name_AL1Entries
�A��=�oData%K�Name	_AL2Count
A��A�oData)K�Name_AL2Entries
�A��=�oData%K�Name	_AL3Count
A��A�oData)K�Name_AL3Entries
�A��=�oData%K�Name	_AL4Count
 A��A�oData)K�Name_AL4Entries
!�A��=�oData%K�Name	_AL5Count
"A��A�oData)K�Name_AL5Entries
#�A��=�oData%K�Name	_AL6Count
$A��A�oData)K�Name_AL6Entries
%�A��=�oData%K�Name	_AL7Count
&A��A�oData)K�Name_AL7Entries
'�A��=�oData%K�Name	_AL8Count
(A��A�oData)K�Name_AL8Entries
)�A��=�oData%K�Name	_AL9Count
*A��A�oData)K�Name_AL9Entries
+�A��I�oData1K�NameMinimumThrottle
,A��3�oDataK�Name_CR3
-A��3�oDataK�Name_TFP
.A��U�oData=K�NameOverThrottleThreshold
/A��M�oData5K�NameDescriptionLength
0A��A�oData)K�NameDescription
1l���е���� �0�@�P�`�p�����������ж���$�<�X�p�������ط��(� @�\�"t���$��ĸ&ܸ��(�,�*D�`�������Թ0��8ThermalZoneBiosNameLength,ThermalZoneBiosName_TMP_PSV_TC1_TC2_TSP_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRT_NTT_PSLCount_PSLEntries_TZDCount_TZDEntries_AL0Count_AL0Entries_AL1Count_AL1Entries_AL2Count_AL2Entries_AL3Count_AL3Entries_AL4Count_AL4Entries_AL5Count_AL5Entries_AL6Count_AL6Entries_AL7Count_AL7Entries_AL8Count_AL8Entries_AL9Count_AL9Entries$MinimumThrottle_CR3_TFP0OverThrottleThreshold(DescriptionLengthDescriptionTEMP\33��bH׮�5S��E$�7"��p
D�	EventDataA��]�oDataEK�NameThermalZoneBiosNameLength
A��Q�oData9K�NameThermalZoneBiosName
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_TC1
A��3�oDataK�Name_TC2
A��3�oDataK�Name_TSP
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
	A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
A��3�oDataK�Name_AC6

A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9
A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
A��3�oDataK�Name_NTT
A��=�oData%K�Name	_PSLCount
A��A�oData)K�Name_PSLEntries
�A��=�oData%K�Name	_TZDCount
A��A�oData)K�Name_TZDEntries
�A��=�oData%K�Name	_AL0Count
A��A�oData)K�Name_AL0Entries
�A��=�oData%K�Name	_AL1Count
A��A�oData)K�Name_AL1Entries
�A��=�oData%K�Name	_AL2Count
A��A�oData)K�Name_AL2Entries
�A��=�oData%K�Name	_AL3Count
A��A�oData)K�Name_AL3Entries
�A��=�oData%K�Name	_AL4Count
 A��A�oData)K�Name_AL4Entries
!�A��=�oData%K�Name	_AL5Count
"A��A�oData)K�Name_AL5Entries
#�A��=�oData%K�Name	_AL6Count
$A��A�oData)K�Name_AL6Entries
%�A��=�oData%K�Name	_AL7Count
&A��A�oData)K�Name_AL7Entries
'�A��=�oData%K�Name	_AL8Count
(A��A�oData)K�Name_AL8Entries
)�A��=�oData%K�Name	_AL9Count
*A��A�oData)K�Name_AL9Entries
+�A��I�oData1K�NameMinimumThrottle
,A��3�oDataK�Name_CR3
-A��3�oDataK�Name_TFP
.A��U�oData=K�NameOverThrottleThreshold
/A��M�oData5K�NameDescriptionLength
0A��A�oData)K�NameDescription
1A��3�oDataK�Name_TZP
2�����,�<�L�\�l�|�������������������,�<�T�p������������$�@�X�t� ����"����$���&(�D�(\�x�*���������� �0H�d�8ThermalZoneBiosNameLength,ThermalZoneBiosName_TMP_PSV_TC1_TC2_TSP_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRT_NTT_PSLCount_PSLEntries_TZDCount_TZDEntries_AL0Count_AL0Entries_AL1Count_AL1Entries_AL2Count_AL2Entries_AL3Count_AL3Entries_AL4Count_AL4Entries_AL5Count_AL5Entries_AL6Count_AL6Entries_AL7Count_AL7Entries_AL8Count_AL8Entries_AL9Count_AL9Entries$MinimumThrottle_CR3_TFP0OverThrottleThreshold(DescriptionLengthDescription_TZPTEMP�0���N��2]���7y�L����D�	EventDataA��M�oData5K�NameFanBiosNameLength
A��A�oData)K�NameFanBiosName
A��C�oData+K�NameFstSupported

A��?�oData'K�Name
PowerState
A��9�oData!K�NameControl
����

���C���(FanBiosNameLengthFanBiosName FstSupportedPowerStateControlTEMP�X�v��'_�֓
3�>���D�	EventDataA��M�oData5K�NameFanBiosNameLength
A��A�oData)K�NameFanBiosName
A��?�oData'K�Name
PowerState
�����C��(FanBiosNameLengthFanBiosNamePowerStateTEMP� ����
�(�Z��Ӗ���z���D�	EventDataA��M�oData5K�NameFanBiosNameLength
A��A�oData)K�NameFanBiosName
A��9�oData!K�NameControl
\�����(FanBiosNameLengthFanBiosNameControlTEMP`���-F)徤^Y(K�P��C���D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��S�oData;K�NameDeviceInstanceLength
A��G�oData/K�NameDeviceInstance
A��?�oData'K�Name
PowerState
(�l������C��DThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance0DeviceInstanceLength$DeviceInstancePowerStateTEMPl,�7i�u�p]^H���)���D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��S�oData;K�NameDeviceInstanceLength
A��G�oData/K�NameDeviceInstance
A��E�oData-K�Name
ThrottleLimit
�����<�`�DThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance0DeviceInstanceLength$DeviceInstance ThrottleLimitTEMP`�ro�窯Q�Z�ٍ����PD�	EventDataA��S�oData;K�NameDeviceBiosNameLength
A��G�oData/K�NameDeviceBiosName
A��I�oData1K�NameDeviceResetType
A��7�oDataK�NameStatus
T����C����0DeviceBiosNameLength$DeviceBiosName$DeviceResetTypeStatusTEMP���]�	V�DW�gguF��lD�	EventDataA��K�oData3K�NameAcpiOverrideType
�C��(AcpiOverrideTypeTEMP|��!6�;xv0R��F��*����D�	EventDataA��5�oDataK�NameScope
A��7�oDataK�NameObject
A��7�oDataK�NameStatus
��$�ScopeObjectStatusPRVAPL�Microsoft-Windows-Kernel-AcpiOPCOLEVL�P��P��P��win:Errorwin:Warning(win:InformationalTASKDd������e������f������g�����h����L�i������j������k������l�����m����4�n����\�o������p������q������r������s����(�t����l�u������v������w�����x����$�y����<�,ResourceTranslation(GpeEventHandling4TemperatureNotification0TripPointNotification8ActiveCoolingDevicePower$AmlMethodTrace,DeviceActiveCooling0DevicePassiveCooling0DeviceCoolingRundown(TemperatureChange,ThermalZoneRundownFanRundown,FanPowerStateChange$FanStatusChange4ActiveCoolingConstraintDActiveCoolingConstraintRundown8PassiveCoolingConstraintDPassiveCoolingConstraintRundownDeviceReset AcpiOverrideAMLIError(FrequentAmlMethodKEYW@����������������� ����D�@����d��������$acpi:Diagnostic acpi:Thermal0ms:ReservedKeyword40 ms:Telemetryms:Measures$ms:CriticalDataEVNT�d��0E��,���Ce��|I��H���Cf���J��d���Cg���J������Ch���Q������Ch��W������Ci ��$d������Cj���[������C	k�	��]������C
l�
��_�����Cm������a��(���Cn�����ph��D���Cn������{��D���Cn����� ���D��Cn��������D��Cn��������D��C
o�����t���`��Cp�����(���|��Cq������������Cr������������Cs������������Ct���������� �Cu���������$�Cv ������$�(�Cw ������@�0�Cx������\�8�Cy���f��x�<�Cp�p���������p�����������������������������������p���p���p�p�WEVT(�����
|�������CHAN��	�������@�����ApplicationXMicrosoft-Windows-User-Loader/OperationalTMicrosoft-Windows-User-Loader/AnalyticTTBL�

TEMP�0��<z�#aSl3�z�R���\D�	EventDataA��;�oData#K�NameFileName
D�FileNameTEMP���T��̫�[��L?��ZD�	EventDataA��9�oData!K�NameDllName
�DllNameTEMP� �S�C�Rd���7!C%���D�	EventDataA��]�oDataEK�NameProcessFileNamePathLength
A��Q�oData9K�NameProcessFileNamePath
H���8ProcessFileNamePathLength,ProcessFileNamePathTEMP��
n��f�S��}�<���D�	EventDataA��E�oData-K�Name
FailureReason
A��E�oData-K�Name
ImportDllName
A��C�oData+K�NameExportModule
�8�X� FailureReason ImportDllName ExportModuleTEMP�����[�t_�(m4�>�A���]EventXML+�xmlnsUser-Loader��&.�
FailureReason
��&�
ImportDllName
��,1ProcessImagePath
����� FailureReason ImportDllName(ProcessImagePathTEMPL�԰R�7nU]=�	���A���]EventXML+�xmlnsUser-Loader��,1ProcessImagePath
��&��
CurDirDllPath
(�P�(ProcessImagePath CurDirDllPathTEMP�x�R ֿy�pTZ4,�X��A���]EventXML+�xmlnsUser-Loader��,1ProcessImagePath
��&��
CurDirDllPath
��$��FoundDllPath
�����(ProcessImagePath CurDirDllPath FoundDllPathTEMP�T�(/E��TRO�^�]L���D�	EventDataA��E�oData-K�Name
FailureReason
A��E�oData-K�Name
ImportDllName
A��K�oData3K�NameProcessImagePath
����� FailureReason ImportDllName(ProcessImagePathTEMP����<z�#aSl3�z�R���\D�	EventDataA��;�oData#K�NameFileName
��FileNameTEMP��ϙ���G\���{�ɼ>���D�	EventDataA��=�oData%K�Name	ProcessId
A��U�oData=K�NameSuspendProcessRequest
A��9�oData!K�NameDLLName
 �8�h�ProcessId0SuspendProcessRequestDLLNamePRVAP��Microsoft-Windows-User-LoaderOPCO01�win:InfoLEVL�U8PXPpP� win:Criticalwin:Errorwin:Warning(win:InformationalTASKKEYW4, x@��	P
�LUSER_LOADER_KEYWORD_DEPRECATED_DLLPUSER_LOADER_FATAL_CALLBACK_EXCEPTIONHUSER_LOADER_KEYWORD_LOAD_FAILURE@USER_LOADER_LAUNCH_16BIT_APPTUSER_LOADER_KEYWORD_COMPONENT_ON_DEMANDPUSER_LOADER_KEYWORD_LOAD_FATAL_ERROREVNTp ����,H��  ���,L��@ 
��,P��� ����,T�� ����,X�� ���� \�� ���� `�� 
���,��	 	����d��
	�
x��,��	�p�� ��	�$��������WEVTt��
8��T�CHAN������lMicrosoft-Windows-Kernel-BootDiagnostics/DiagnosticPRVAhLMicrosoft-Windows-Kernel-BootDiagnosticsOPCO02�win:StartLEVL@P�(win:InformationalTASKD�����8SystemBootKEYWD1p(win:ResponseTimeEVNTD�����������`WEVT�5����,�
�6(7�7�7�9�9CHAN|H����`Microsoft-Windows-Kernel-Prefetch/DiagnosticTTBL(.
TEMPh<
	{]�̝�S�V��..Ϫ��RD�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
�
�
�
�
,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeTEMP��
��0�nd^ᥦ�\�-y��6D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��E�oData-K�Name
PrefetchPhase
A��C�oData+K�NamePrefetchType
A��G�oData/K�NameIsTricklePhase
@`����,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType PrefetchPhase PrefetchType$IsTricklePhaseTEMP�|;�
/�T�'�6z�f���>D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��M�oData5K�NamePrefetchPhaseMask
A��C�oData+K�NamePrefetchType
A��G�oData/K�NameIsTricklePhase
4Tx���,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType(PrefetchPhaseMask PrefetchType$IsTricklePhaseTEMP		��Q�NoY���A����D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��E�oData-K�Name
PrefetchPhase
A��C�oData+K�NamePrefetchType
A��G�oData/K�NameIsTricklePhase
A��O�oData7K�NameNumPagesPrefetched

A��C�oData+K�NameNumReadLists
��4Tt�

��,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType PrefetchPhase PrefetchType$IsTricklePhase,NumPagesPrefetched NumReadListsTEMP		��|Xo�^{�k�1�l���D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��M�oData5K�NamePrefetchPhaseMask
A��C�oData+K�NamePrefetchType
A��G�oData/K�NameIsTricklePhase
A��O�oData7K�NameNumPagesPrefetched

A��C�oData+K�NameNumReadLists
��<\��

��,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType(PrefetchPhaseMask PrefetchType$IsTricklePhase,NumPagesPrefetched NumReadListsTEMP����<޲5�U�K���v����D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��E�oData-K�Name
PrefetchPhase
Lx���,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType PrefetchPhaseTEMP��!*�B�eh9[�������D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��M�oData5K�NamePrefetchPhaseMask
<"h"�"�"�",ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType(PrefetchPhaseMaskTEMPh|$	{]�̝�S�V��..Ϫ��RD�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
�$�$%<%,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeTEMP�('�.d�2ˮV��O��`���D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��=�oData%K�Name	EndReason
�'�'�'�'(,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeEndReasonTEMP��*������\Ic�ܑ(���0D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��A�oData)K�NameActionFlags
A��A�oData)K�NameTraceReason
A��G�oData/K�NamePrefetchReason
$+P+p+�+�+�+�+,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeActionFlagsTraceReason$PrefetchReasonTEMP�		/�Y�	U��Z����������D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��A�oData)K�NameActionFlags
A��A�oData)K�NameTraceReason
A��G�oData/K�NamePrefetchReason
A��A�oData)K�NameNumLaunches
A��W�oData?K�NameTimeSinceLastLaunchInS
�/�/0@0`0|0�0�0�0,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeActionFlagsTraceReason$PrefetchReasonNumLaunches4TimeSinceLastLaunchInSTEMP��2Z
G,�GQ��W93�����D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��G�oData/K�NameWorkItemsCount
D3p3�3�3�3,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType$WorkItemsCountTEMP��5ޞoد=�QI���������D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��=�oData%K�Name	NumPhases
(6T6t6�6�6,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeNumPhasesPRVAX�6Microsoft-Windows-Kernel-PrefetchOPCOx1X72p72�7win:Infowin:Startwin:StopLEVL@P�7(win:InformationalTASK������8�����8����9����9����49	����\9
����|9(PrefetchSections(PrefetchMetadataOpenVolumesEndTrace(ScenarioDecision GetReadListsAsyncWorkerKEYWD �����9(BasicInformationEVNT� �����@7�7�7P=8 �����@7�7�7T=8 �����L7�7�7X=8 �����L7�7�7\=8 �����@7�78`=8 ������@7�78d=8 �����L7�78h=8 ������L7�78l=8 ������"@7�7$8p=8 ������"L7�7$8t=8 �����\%47�7@8x=8 �����4(47�7\8|=8 �����,47�7\8�=8		 �����1@7�7x8�=8
	 ������L7�7x8�=8
 ������3@7�7�8�=8
 ������L7�7�8�=8

 ������47�7�8�=8�9�9�9�9�9�9�9�9�9�9�9�9�9�9�9�9�9�9WEVT ��=L>
�>�>�>$?l?x?CHANd>�HMicrosoft-Windows-UAC/OperationalTTBL\TEMPP�>)5�H7^A����d����D�	EventDataPRVA@�>Microsoft-Windows-UACOPCOLEVL0P?win:ErrorTASKH����L? CreateProcessKEYWEVNT@��X>?0?�=WEVTH�@�@
�A0B<BlB�B�BCHAN�$@�hMicrosoft-Windows-Security-Adminless/OperationalTTBLDTEMP8tA�/c���UX�q��r�Y���D�	EventDataA��A�oData)K�NameFailureTime
A��=�oData%K�Name	StackHash
�A�AFailureTimeStackHashPRVA`�AMicrosoft-Windows-Security-AdminlessOPCOLEVL0PTBwin:ErrorTASKH�����B AccessFailureKEYWEVNT@���@HBxB@WEVT�	PC�C
8E�E�E�E<FHFCHAN�lC�Microsoft-Windows-Security-LessPrivilegedAppContainer/OperationalTTBLDTEMP8�D�/c���UX�q��r�Y���D�	EventDataA��A�oData)K�NameFailureTime
A��=�oData%K�Name	StackHash
E EFailureTimeStackHashPRVA�LEMicrosoft-Windows-Security-LessPrivilegedAppContainerOPCOLEVL0P�Ewin:ErrorTASKH����F AccessFailureKEYWEVNT@�
D�EF\CWEVT���F8G
�G4HdH�H�HICHAN`�F����DMicrosoft-Windows-COM/AnalyticTTBL�TEMP��G�w�Nm\"l):��N��VD�	EventDataA��5�oDataK�NameCLSID
�GCLSIDPRVA@HMicrosoft-Windows-COMOPCO01LHwin:InfoLEVL@P|H(win:InformationalTASKKEYWL�H0COM_CLASSNOTREG_ERROREVNTD��DG@HpH@I�F�HWEVT���I�I
�NDOPO�O�O�OCHAN8�I	�ApplicationTTBLTEMPH�J���̧��Vv�@�gA����8Path��xmlnsDhttp://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0��&Q
AttemptedPath
K AttemptedPathTEMP�lL���Ew��\�C_�_�3A����PathAndGuid��xmlnsDhttp://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0��&Q
AttemptedPath
��"��SrpRuleGuid
�L�L AttemptedPathSrpRuleGuidTEMPDN7z7�--Wj�Mi(JRA��@%�PathGuidAndRule��xmlnsDhttp://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0��&Q
AttemptedPath
��"��SrpRuleGuid
����RulePath
�N�N�N AttemptedPathSrpRuleGuidRulePathPRVAp�NMicrosoft-Windows-SoftwareRestrictionPoliciesOPCOLEVLhPtOP�Owin:Warning(win:InformationalTASKKEYWEVNT02	�2	 KhO�Ia	�a	�I\O�Ib	�b	�L\O�Ic	�c	�I\O�Id	�d	 K\O�Ir	�r	 K\O�IWEVTp�PQ�R
�a�a�b�cd dCHANP�Q��Q� R�dR�HMicrosoft-Windows-MUI/Operational<Microsoft-Windows-MUI/AdminDMicrosoft-Windows-MUI/Analytic<Microsoft-Windows-MUI/DebugTTBL�TEMP�8S$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
LSStatusTEMP��S�<z�#aSl3�z�R���\D�	EventDataA��;�oData#K�NameFileName
TFileNameTEMP�0U;o��s\fj������D�	EventDataA��;�oData#K�NameFileName
A��3�oDataK�NameType
A��C�oData+K�NameFunctionName
lU�U�UFileNameType FunctionNameTEMP�DV�<z�#aSl3�z�R���\D�	EventDataA��;�oData#K�NameFileName
XVFileNameTEMP$�W�*z�8�WM
sWR�	���2D�	EventDataA��5�oDataK�NameFlags
A��A�oData)K�NameNewLanguage
A��C�oData+K�NamePrevLanguage
A��C�oData+K�NameExtendedFlag
(X8XTXtXFlagsNewLanguage PrevLanguage ExtendedFlagTEMP��Y �ُ_�<�vw����D�	EventDataA��;�oData#K�NameFileName
A��C�oData+K�NameFunctionName
A��A�oData)K�NameReturnValue
�YZ,ZFileName FunctionNameReturnValueTEMP��Z)�Y�?��T0��U�����^D�	EventDataA��=�oData%K�Name	Parameter
�ZParameterTEMPPX[)5�H7^A����d����D�	EventDataTEMPP�[)5�H7^A����d����D�	EventDataTEMP�0\4�=��|NP5��pk7��TD�	EventDataA��3�oDataK�NameName
D\NameTEMP�|]�f��dY��x(������D�	EventDataA��E�oData-K�Name
NewCacheIndex
A��G�oData/K�NameLiveCacheIndex
A��7�oDataK�NameConfig
�]�]�] NewCacheIndex$LiveCacheIndexConfigTEMP��^?~�v|�Uj��]�4���^D�	EventDataA��=�oData%K�Name	ErrorCode
�^ErrorCodeTEMP(`aM?��iV����"D�	EventDataA��;�oData#K�NameFileName
A��;�oData#K�NameAffinity
A��;�oData#K�NameSequence
A��;�oData#K�NamePriority
x`�`�`�`FileNameAffinitySequencePriorityTEMP�ha�<z�#aSl3�z�R���\D�	EventDataA��;�oData#K�NameFileName
|aFileNamePRVA@�aMicrosoft-Windows-MUIOPCO :4b:Pb  :tb!!:�b"":�b##:�b$$:�bInitialize$InvokeCallback DisableCache$UpdateManifestBuildCacheEntryExitLEVL�P$cP<cPXcwin:Errorwin:Warning(win:InformationalTASK�z�cz�c0NotifyLanguageChange RescacheBuildKEYWEVNTP�����R�ac�c\Q�@��`S�ac�clQ�@��T�ac�clQ�@���U�ac�clQ�@���U�ac�clQ����[�ac�c\Q����[�ac�c\Q� ���[�ac�c\Q����[�ac�c\Q�!@��[bc�clQ�!���[bc�c\Q�"���^bc�c\Q�"���[bc�c\Q����[�ac�c\Q����pV�ac�c\Q�����X�ac�c\Q����HZ�ac�c\Q�!���^bc�c�Q�" ���[bc�c|Q�" ���[bc�c|Q�"���T\bc�c\Q�# ���[bc�c|Q�$ ���[(bc�c|Q�# ���[bc�c|Q�$ ���[(bc�c|Q�!���`bc�c�Q����X[�ac�c\Q�" ��[bc�c|QWEVT,�i�j
Tp�p(q�q�stCHAN��i����Hj����\Microsoft-Windows-Kernel-AppCompat/GeneraldMicrosoft-Windows-Kernel-AppCompat/PerformanceTTBL�TEMP�Plc��snGa_�!(�y���bD�	EventDataA��S�oData;K�NameExecutablePathLength
A��G�oData/K�NameExecutablePath
A��O�oData7K�NameRegistryPathLength
A��C�oData+K�NameRegistryPath
�l�l�l m0ExecutablePathLength$ExecutablePath,RegistryPathLength RegistryPathTEMP��m9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
�mStatusCodeTEMPP�oj��F<U�Z����8���JD�	EventDataA��E�oData-K�Name
KeyNameLength
A��9�oData!K�NameKeyName
A��Q�oData9K�NameParentKeyNameLength
A��E�oData-K�Name
ParentKeyName
�o�op4p KeyNameLengthKeyName,ParentKeyNameLength ParentKeyNamePRVA\hpMicrosoft-Windows-Kernel-AppCompatOPCOx1�p2�p2qwin:Infowin:Startwin:StopLEVLdPLqPdqwin:Error(win:InformationalTASK,����xr�����r�����r�����r����s����4s����`s�����s$CompatCacheInit(CompatCacheQuery$CompatCdbQuery$CompatMapQuirks(CompatCacheUpdate,CompatUserModeQuery$CompatSdbQuery4CompatCacheQueryProcessKEYWH�����s,RegWrpAccessDeniedEVNTt�6�j�p@qpw�i@�����p@q�q�i@����@m�p@q�q�i@�����p@qr�i@����@m�p@qr�i@�����p@q�q�i@����@m�p@q�q�i@�����p@q�q�i	@����@m�p@q�q�i
@�����p@q�q�i@����@m�p@q�q�i@�����p@q$r�i
@����@m�p@q$r�i@�����p@q@r�i@����@m�p@q@r�i@�����p@q\r�i@����@m�p@q\r�i��	n4q�i�sWEVT,-�w
� �,�l�4�@�TTBL$TEMPy\��S�CL�93���� D�	EventDataA��Y�oDataAK�NamecchAppPathIncludingNull
A��_�oDataGK�NameApplicationImageHeaderHash
A��9�oData!K�NameAppPath
Xy�y�y4cchAppPathIncludingNull<ApplicationImageHeaderHashAppPathTEMP|�z}�풚T�Xh���������D�	EventDataA��A�oData)K�NameFeatureGuid
A��_�oDataGK�NameApplicationImageHeaderHash
{{FeatureGuid<ApplicationImageHeaderHashTEMP4�|��H�^�m#��!���:D�	EventDataA��A�oData)K�NameFeatureGuid
A��C�oData+K�NameCallerIdType
A��C�oData+K�NamecchImagePath
A��=�oData%K�Name	ImagePath
}4}T}t}FeatureGuid CallerIdType cchImagePathImagePathTEMP�Lx�a8p�RX1��z�`���D�	EventDataA��i�oDataQK�NamecchParentImagePathIncludingNull
A��A�oData)K�NameFeatureGuid
A��c�oDataKK�NameParentProcessImageHeaderHash
A��I�oData1K�NameParentImagePath
���<�DcchParentImagePathIncludingNullFeatureGuid@ParentProcessImageHeaderHash$ParentImagePathTEMP		t�U��[W_���y��x���D�	EventDataA��5�oDataK�NameFlags
A��[�oDataCK�NamecchIdStringIncludingNull
A��Y�oDataAK�NamecchDllPathIncludingNull
A��;�oData#K�NameCategory
A��I�oData1K�NameManifestVersion
A��E�oData-K�Name
DllHeaderHash
A��_�oDataGK�NameApplicationImageHeaderHash
A��;�oData#K�NameIdString
A��9�oData!K�NameDllPath
(�8�p�������<�T�Flags8cchIdStringIncludingNull4cchDllPathIncludingNullCategory$ManifestVersion DllHeaderHash<ApplicationImageHeaderHashIdStringDllPathTEMPx��]ng��P\��\堟����D�	EventDataA��5�oDataK�NameFlags
A��[�oDataCK�NamecchIdStringIncludingNull
A��;�oData#K�NameCategory
A��I�oData1K�NameManifestVersion
A��_�oDataGK�NameApplicationImageHeaderHash
A��;�oData#K�NameIdString
��P�h���ȈFlags8cchIdStringIncludingNullCategory$ManifestVersion<ApplicationImageHeaderHashIdStringPRVA@�Microsoft-Windows-AITOPCOLEVL@PD�(win:InformationalTASK�����<�����X�����������������̊�����������AitFeature,AitParentAitFeatureAitAppInfo,AitSystemUsageByDll,AitSystemUsageByExe AitProcessEndKitFeatureKEYWEVNT`�����y8�x������}8��������w8�������`�8�̉����h�8������8������X{8� �WEVTx0�
�t�����̎؎TTBL�TEMP�����{��U+0"�����vD�	EventDataA��U�oData=K�NameAeLookupServieTrigger
��0AeLookupServieTriggerPRVA���Microsoft-Windows-ApplicationExperience-LookupServiceTriggerOPCOLEVL@P��(win:InformationalTASKKEYWEVNT@�������WEVT�.h�̐
����������CHANd�����������h�����hMicrosoft-Windows-Kernel-ApphelpCache/Operational\Microsoft-Windows-Kernel-ApphelpCache/DebugdMicrosoft-Windows-Kernel-ApphelpCache/AnalyticTTBL�TEMP�|�_�Yn5�]�S�#����pD�	EventDataA��O�oData7K�NameOperationalMessage
��,OperationalMessageTEMP�T�nШ)�\�����{���bD�	EventDataA��A�oData)K�NameInfoMessage
h�InfoMessageTEMP��$&��_��XB�8'�;���dD�	EventDataA��C�oData+K�NameDebugMessage
0� DebugMessageTEMPTДG'L46߬U��|�8����LD�	EventDataA��9�oData!K�NameMatches

A��A�oData)K�NameCheckerName
A��E�oData-K�Name
AttributeName
A��W�oData?K�NameAttributeExpectedValue


 �4�P�p�MatchesCheckerName AttributeName4AttributeExpectedValueTEMPT$��B���S%�N���*���LD�	EventDataA��9�oData!K�NameMatches

A��A�oData)K�NameCheckerName
A��E�oData-K�Name
AttributeName
A��W�oData?K�NameAttributeExpectedValue


t�����ėMatchesCheckerName AttributeName4AttributeExpectedValueTEMPTx�N�T3��*T}�O�(�U���LD�	EventDataA��9�oData!K�NameMatches

A��A�oData)K�NameCheckerName
A��E�oData-K�Name
AttributeName
A��W�oData?K�NameAttributeExpectedValue


șܙ���MatchesCheckerName AttributeName4AttributeExpectedValueTEMPT̛^T����Q
1����M���LD�	EventDataA��9�oData!K�NameMatches

A��A�oData)K�NameCheckerName
A��E�oData-K�Name
AttributeName
A��W�oData?K�NameAttributeExpectedValue



�0�L�

l�MatchesCheckerName AttributeName4AttributeExpectedValuePRVAp��Microsoft-Windows-ApplicationExperience-CacheOPCOLEVLdP@�PX�win:Error(win:InformationalTASKKEYWEVNT`�3ؐ4�t� 4��4���@5��(���@4P�4���@4��4���@4��4���	@4L�4���WEVT�
/@�
�h�t�����ȫTTBL�
TEMPxh�No��X�Z-YT��i����D�	EventDataA��K�oData3K�NameSwitchBranchGuid
A��W�oData?K�NameSwitchBranchNameLength
A��K�oData3K�NameSwitchBranchName
A��e�oDataMK�NameSwitchBranchDescriptionLength
A��Y�oDataAK�NameSwitchBranchDescription
̡�(�P���(SwitchBranchGuid4SwitchBranchNameLength(SwitchBranchName@SwitchBranchDescriptionLength4SwitchBranchDescriptionTEMP���O���P�.��>$��D�	EventDataA��S�oData;K�NameSwitchBranchImplGuid
A��_�oDataGK�NameSwitchBranchImplNameLength
A��S�oData;K�NameSwitchBranchImplName
A��m�oDataUK�Name!SwitchBranchImplDescriptionLength
A��a�oDataIK�NameSwitchBranchImplDescription
l���إ�P�0SwitchBranchImplGuid<SwitchBranchImplNameLength0SwitchBranchImplNameHSwitchBranchImplDescriptionLength<SwitchBranchImplDescriptionTEMPt��=�t�\U�����ZD�	EventDataA��M�oData5K�NameTargetContextGuid
A��M�oData5K�NameTargetContextType
A��K�oData3K�NameModuleNameLength
A��?�oData'K�Name
ModuleName
l������(TargetContextGuid(TargetContextType(ModuleNameLengthModuleNameTEMP���mUl���S��G4�1���tD�	EventDataA��S�oData;K�NameContextUpdateCounter



��0ContextUpdateCounterPRVA|�Microsoft-Windows-ApplicationExperience-SwitchBackOPCOLEVL@P��(win:InformationalTASK����0�����H�����`�������AeSbCallAeSbImpl(AeSbContextUpdate0AeSbContextReadRetryKEYWEVNT�����L���������Ģ��ܪ������������������WEVT`'��\�
��(������h�CHANt�����XMicrosoft-Windows-Kernel-Network/AnalyticTTBLtTEMP(

�l\FX_TR4Ԅ/"\��zD�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��;�oData#K�Namestartime
A��9�oData!K�Nameendtime
A��7�oDataK�Nameseqnum
A��7�oDataK�Nameconnid
	������,�<�T�h�|�PIDsizedaddrsaddrdportsportstartimeendtimeseqnumconnidTEMPP��ؕ�`�]O QjYDz����D�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��7�oDataK�Nameseqnum
A��7�oDataK�Nameconnid
\�h�x���������̴PIDsizedaddrsaddrdportsportseqnumconnidTEMP(̸A�r���S����K������D�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��1�oDataK�Namemss
A��9�oData!K�Namesackopt
A��5�oDataK�Nametsopt
A��5�oDataK�Namewsopt
	A��7�oDataK�Namercvwin
A��A�oData)K�Namercvwinscale
A��A�oData)K�Namesndwinscale
A��7�oDataK�Nameseqnum

A��7�oDataK�Nameconnid
����$�4�D�T�`�t�������ĺ��PIDsizedaddrsaddrdportsportmsssackopttsoptwsoptrcvwinrcvwinscalesndwinscaleseqnumconnidTEMP(ܻ(n�n3��^���2�P���D�	EventDataA��5�oDataK�NameProto
A��A�oData)K�NameFailureCode
��ProtoFailureCodeTEMP(

�{i^�Ӻ.\���F����zD�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��;�oData#K�Namestartime
A��9�oData!K�Nameendtime
A��7�oDataK�Nameseqnum
A��7�oDataK�Nameconnid
	����ĿԿ����0�D�PIDsizedaddrsaddrdportsportstartimeendtimeseqnumconnidTEMPP��5[� 7�WIh�C4����D�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��7�oDataK�Nameseqnum
A��7�oDataK�Nameconnid
$�0�@�P�`�p�����PIDsizedaddrsaddrdportsportseqnumconnidTEMP(������OQ�s��W����D�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��1�oDataK�Namemss
A��9�oData!K�Namesackopt
A��5�oDataK�Nametsopt
A��5�oDataK�Namewsopt
	A��7�oDataK�Namercvwin
A��A�oData)K�Namercvwinscale
A��A�oData)K�Namesndwinscale
A��7�oDataK�Nameseqnum

A��7�oDataK�Nameconnid
������������(�<�L�\�p�������PIDsizedaddrsaddrdportsportmsssackopttsoptwsoptrcvwinrcvwinscalesndwinscaleseqnumconnidPRVAX��Microsoft-Windows-Kernel-NetworkOPCO�
������<�
�|�������L�������*��+�L�1��<KERNEL_NETWORK_OPCODE_SEND<KERNEL_NETWORK_OPCODE_RECV@KERNEL_NETWORK_OPCODE_CONNECTHKERNEL_NETWORK_OPCODE_DISCONNECTHKERNEL_NETWORK_OPCODE_RETRANSMIT@KERNEL_NETWORK_OPCODE_ACCEPTDKERNEL_NETWORK_OPCODE_RECONNECT<KERNEL_NETWORK_OPCODE_FAIL@KERNEL_NETWORK_OPCODE_TCPCOPY@KERNEL_NETWORK_OPCODE_SENDUDP@KERNEL_NETWORK_OPCODE_RECVUDP@KERNEL_NETWORK_OPCODE_FAILUDPLEVL@P��(win:InformationalTASK�
����P�������8KERNEL_NETWORK_TASK_TCPIP8KERNEL_NETWORK_TASK_UDPIPKEYW������� ����(�<KERNEL_NETWORK_KEYWORD_IPV4<KERNEL_NETWORK_KEYWORD_IPV6EVNT�


�h�4�������
���@�������
��L�������

���X�������
���d�������
��p�������
���|�������
0����������
�	����������

 �
0�4�������
 �X�@�������
 ���L�������
 �X�X�������
 �X�d�������
 ���p������� 
 �X�|�������"
 �X���������**�
������4����++�������4����110������4����:* �X�����4����;+ �X�����4����������������������������������������������������WEVT�XH���
D�����������CHANpd�����TMicrosoft-Windows-Kernel-Disk/AnalyticTTBL�TEMP,\��ѵ�ggZ�� *B��bD�	EventDataA��?�oData'K�Name
DiskNumber
A��;�oData#K�NameIrpFlags
A��C�oData+K�NameTransferSize
A��;�oData#K�NameReserved
A��?�oData'K�Name
ByteOffset

A��?�oData'K�Name
FileObject
A��I�oData1K�NameIORequestPacket
A��Q�oData9K�NameHighResResponseTime

���0�P�

h�����

��DiskNumberIrpFlags TransferSizeReservedByteOffsetFileObject$IORequestPacket,HighResResponseTimeTEMPTp�(u��&,&V�O��2���JD�	EventDataA��?�oData'K�Name
DiskNumber
A��;�oData#K�NameIrpFlags
A��Q�oData9K�NameHighResResponseTime

A��I�oData1K�NameIORequestPacket
����

�� �DiskNumberIrpFlags,HighResResponseTime$IORequestPacketPRVAPX�Microsoft-Windows-Kernel-DiskOPCOLEVL@P��(win:InformationalTASKKEYWEVNT�
�Y����T��Z����T��[����T�WEVT�Q�	����p�
<��T#x%CHAN���x��\Microsoft-Windows-Kernel-EventTracing/AdmindMicrosoft-Windows-Kernel-EventTracing/AnalyticMAPS���VMAPdP�
��������	�
� StopReasonMapTTBL�<TEMP��
�9G�U�d��A�v��0D�	EventDataA��A�oData)K�NameSessionName
A��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��A�oData)K�NameLoggingMode
0�L�d�|�SessionNameFileNameErrorCodeLoggingModeTEMP�H�i[%�_�[Vw'�֦Z���|D�	EventDataA��A�oData)K�NameSessionName
A��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��A�oData)K�NameLoggingMode
A��E�oData-K�Name
FailureReason
�����������SessionNameFileNameErrorCodeLoggingMode FailureReasonTEMP����A\�X+�P2�Z;f���xD�	EventDataA��A�oData)K�NameSessionName
A��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��A�oData)K�NameLoggingMode
A��A�oData)K�NameMaxFileSize

D�`�x���

��SessionNameFileNameErrorCodeLoggingModeMaxFileSizeTEMP������d��TY��|������D�	EventDataA��A�oData)K�NameSessionName
A��=�oData%K�Name	ErrorCode
A��A�oData)K�NameLoggingMode
(�D�\�SessionNameErrorCodeLoggingModeTEMPDX��X�f��Z�pI�n���D�	EventDataA��C�oData+K�NameProviderName
A��A�oData)K�NameSessionName
���� ProviderNameSessionNameTEMP�T� ����Y�{?C����dD�	EventDataA��C�oData+K�NameProviderName
h� ProviderNameTEMP,���#�|��VS��?����8D�	EventDataA��A�oData)K�NameSessionGuid
A��?�oData'K�Name
LoggerMode
A��A�oData)K�NameSessionName
A��A�oData)K�NameLogFileName
D�`�|���SessionGuidLoggerModeSessionNameLogFileNameTEMP�T�� �!@�T�TQ�/�Z��jD�	EventDataA��I�oData1K�NameLoggerSlotsUsed



h�$LoggerSlotsUsedTEMP\

��?����a
]�>��;��Q��D�	EventDataA��A�oData)K�NameSessionGuid
A��?�oData'K�Name
LoggerMode
A��A�oData)K�NameSessionName
A��A�oData)K�NameLogFileName
A��G�oData/K�NameMinimumBuffers
A��G�oData/K�NameMaximumBuffers
A��?�oData'K�Name
BufferSize
A��K�oData3K�NamePeakBuffersCount
A��Q�oData9K�NameCurrentBuffersCount
A��G�oData/K�NameFlushThreshold
	���������0�T�p�����SessionGuidLoggerModeSessionNameLogFileName$MinimumBuffers$MaximumBuffersBufferSize(PeakBuffersCount,CurrentBuffersCount$FlushThresholdTEMPPX��$���[�㟿�Q��:D�	EventDataA��A�oData)K�NameSessionGuid
A��?�oData'K�Name
LoggerMode
A��A�oData)K�NameSessionName
A��A�oData)K�NameLogFileName
A��G�oData/K�NameMinimumBuffers
A��G�oData/K�NameMaximumBuffers
A��?�oData'K�Name
BufferSize
A��K�oData3K�NamePeakBuffersCount
A��Q�oData9K�NameCurrentBuffersCount
A��G�oData/K�NameFlushThreshold
	A��?�oData'K�Name
EventsLost
A��A�oData)K�NameBuffersLost
A��Q�oData9K�NameRealTimeBuffersLost
A��;�oData#K�NameLoggerId

p��������(�D�l������� �SessionGuidLoggerModeSessionNameLogFileName$MinimumBuffers$MaximumBuffersBufferSize(PeakBuffersCount,CurrentBuffersCount$FlushThresholdEventsLostBuffersLost,RealTimeBuffersLostLoggerIdTEMP�p�
.��tX�W���G
��D�	EventDataA��A�oData)K�NameSessionName
A��I�oData1K�NameSecurityDescOld
A��I�oData1K�NameSecurityDescNew
����SessionName$SecurityDescOld$SecurityDescNewTEMPt�˥����Y�P_��y���.D�	EventDataA��?�oData'K�Name
ProviderId
A��?�oData'K�Name
StatusCode
A��9�oData!K�NameEventId
A��A�oData)K�NameSessionName
�����ProviderIdStatusCodeEventIdSessionNameTEMP$���G��.�TZ;7T���>��2D�	EventDataA��?�oData'K�Name
ProviderId
A��?�oData'K�Name
StatusCode
A��=�oData%K�Name	EventName
A��A�oData)K�NameSessionName
��#�4�ProviderIdStatusCodeEventNameSessionNameTEMP4��y$h��W6�a�+gQ(��<D�	EventDataA��A�oData)K�NameMessageGuid
A��E�oData-K�Name
MessageNumber
A��?�oData'K�Name
StatusCode
A��A�oData)K�NameSessionName
,LhMessageGuid MessageNumberStatusCodeSessionNameTEMP��!��n^a�KӾr����D�	EventDataA��7�oDataK�NameHookId
A��?�oData'K�Name
StatusCode
A��A�oData)K�NameSessionName
��HookIdStatusCodeSessionNameTEMP<49�'H�*bR�J�����D�	EventDataA��C�oData+K�NameProviderName
A��A�oData)K�NameSessionName
A��I�oData1K�NameMatchAnyKeyword

A��I�oData1K�NameMatchAllKeyword

A��G�oData/K�NameEnableProperty
A��5�oDataK�NameLevel
��
�
0T ProviderNameSessionName$MatchAnyKeyword$MatchAllKeyword$EnablePropertyLevelTEMP��茴��\��i������D�	EventDataA��;�oData#K�NameFileName
A��?�oData'K�Name
BufferSize
A��K�oData3K�NameBuffersPersisted
A��G�oData/K�NameBuffersWritten
A��7�oDataK�NameStatus
|����FileNameBufferSize(BuffersPersisted$BuffersWrittenStatusTEMP$�`�Z�S��.�ۊ���D�	EventDataA��;�oData#K�NameFileName
A��?�oData'K�Name
BufferSize
A��K�oData3K�NameBuffersPersisted
A��G�oData/K�NameBuffersWritten
A��7�oDataK�NameStatus
A��A�oData)K�NameBuffersLost
����FileNameBufferSize(BuffersPersisted$BuffersWrittenStatusBuffersLostTEMP\ 
w�,V�
tZ�$@6�������D�	EventDataA��C�oData+K�NameProviderGuid
A��M�oData5K�NameProviderGroupGuid
H
h
 ProviderGuid(ProviderGroupGuidTEMP<l�o���U}2jYn��:���D�	EventDataA��C�oData+K�NameProviderGuid
A��=�oData%K�Name	ErrorCode
�� ProviderGuidErrorCodeTEMP�C��6R�SСC��Qa����D�	EventDataA��C�oData+K�NameProviderGUID
A��=�oData%K�Name	GroupGUID
A��5�oDataK�NameFlags
A��?�oData'K�Name
EnableMask
A��I�oData1K�NameGroupEnableMask
A��=�oData%K�Name	ProcessId
8Xp��� ProviderGUIDGroupGUIDFlagsEnableMask$GroupEnableMaskProcessIdTEMPp׺��}YEA��C����D�	EventDataA��3�oDataK�NameGUID
A��5�oDataK�NameIndex
A��;�oData#K�NameLoggerId
A��I�oData1K�NameMatchAnyKeyword

A��I�oData1K�NameMatchAllKeyword

A��5�oDataK�NameLevel
A��G�oData/K�NameEnableProperty
���
�
�$GUIDIndexLoggerId$MatchAnyKeyword$MatchAllKeywordLevel$EnablePropertyTEMP�p1��WPZ“���لb���D�	EventDataA��3�oDataK�NameGUID
A��A�oData)K�NameFilterFlags
A��O�oData7K�NameLastEnableLoggerId
���GUIDFilterFlags,LastEnableLoggerIdTEMPh_�If�TP�������.D�	EventDataA��C�oData+K�NameProviderGuid
A��A�oData)K�NameSessionName
A��=�oData%K�Name	ProcessId
A��7�oDataK�NameStatus
��� ProviderGuidSessionNameProcessIdStatusTEMP�_�If�TP�������.D�	EventDataA��C�oData+K�NameProviderGuid
A��A�oData)K�NameSessionName
A��=�oData%K�Name	ProcessId
A��7�oDataK�NameStatus
��( ProviderGuidSessionNameProcessIdStatusPRVA`PMicrosoft-Windows-Kernel-EventTracingOPCOx1h2�2�
������@�d��������<�lU�V�win:Infowin:Startwin:Stop4ETW_OPCODE_WRITE_BUFFER4ETW_OPCODE_FILE_SWITCH(ETW_OPCODE_START$ETW_OPCODE_STOP(ETW_OPCODE_FLUSH,ETW_OPCODE_REGISTER0ETW_OPCODE_UNREGISTER(ETW_OPCODE_ENABLE,ETW_OPCODE_DISABLE0ETW_OPCODE_CONFIGUREHETW_OPCODE_USER_MODE_STACK_TRACE0ETW_OPCODE_SET_TRAITS0ETW_OPCODE_GROUP_JOINLEVL�PPPhP�[�win:Errorwin:Warning(win:Informationalwin:VerboseTASK��$!�L!�t!��!��!��!�("����T"	T�"
\�"]�"^#(ETW_TASK_LOGGING(ETW_TASK_SESSION(ETW_TASK_PROVIDER,ETW_TASK_GUID_ENTRY0ETW_TASK_GROUP_ENTRY0ETW_TASK_STACK_TRACE,ETW_TASK_LOST_EVENT,SavePersistedLogger0ETW_TASK_ENABLE_INFO4ETW_TASK_LOST_TLG_EVENT4ETW_TASK_LOST_WPP_EVENT<ETW_TASK_LOST_SYSTEM_EVENTKEYW ��# �$@�<$�����p$�����$�����$����%����L%,ETW_KEYWORD_SESSION0ETW_KEYWORD_PROVIDER4ETW_KEYWORD_LOST_EVENT8ETW_KEYWORD_SOFT_RESTART8ETW_KEYWORD_CAPTURE_STATE8ETW_KEYWORD_REGISTRATION4ETW_KEYWORD_ENABLEMENT(ETW_KEYWORD_GROUPEVNT	+
��|�� ��-��
�����,��-����|�� ��-����|�� ��-������� ��-��
��4��,��-����|�� ��-�� @���D �-�	 @���D �-�
@����D��-�
@����D��-�@����D��-�@����D��-�@����D��-�@���8D��-�
@����D��-� @�x� D �-� @�( D �-� @�x�,D �-�@���8D��-��D8` @������ | �-�������D�.�������D�.������8� .�����d�8� .�����	�8� .���d� � .�����	� � .�� ����H�D(  .	����H�DD (.	 ������D� 0. ������D 8. 
�R�
P  @.�� 
@S4\D L.� @��D X.�
@����,�� � `. 0� � �, d.��!@����P�� � l."@������ !p.#@������� �t.�( @�( D x.�) @�x�,D �.�`#`#`#`#`#`#`#p#�#p#�#`#`#`#`#`#`#`#p#�#p#�#p#�#`#�#`#`#�#�#�#�#�#�#p#�#�#�#p#�#p#�#p#�#�#p#�#�#p#�#�#`#p#�#�#`#p#�#p#�#WEVT�V�	�.�/0:
D)�)p2�2�P0SCHAN�/�0/�����/����SystemTMicrosoft-Windows-Kernel-Boot/AnalyticXMicrosoft-Windows-Kernel-Boot/OperationalMAPST
�080�8�8(7�0VMAP|T9
��������d	�e
�f�g�h
�BMAP|:
������ �@��	�
��� 
�VMAP,9���� � � �0�0�0�0�0�0�0�P�@�@�@�@�@ �@!�@"� @#� @$� @%� @&� @'� @(� @)� @*� @+�	 @,�
 @-� @.� @/�
 @0� @1� @2� @3� @4� @5� @6� @7� @8� @9� @:� @;� @<� @=� @>� @?� @@� @A�0@B�0@C�0@D�0@E�0@F�0@G�0@H�0@I�	0@J�
0@K�0@L�0@M�
0@N�0@O�0@P�0@Q�0@R�0@S�0@T�0@U�0@V�0@W�0@X�0@Y�0@Z�0@[�0@\�0@]�0@^�0@_�0@`� 0@a�!0@b�"0@c�#0@d�$0@e�%0@f�&0@g�'0@h�(0@i�)0@j�*0@k�+0@l�,0@m�-0@n�.0@o�/0@p�00@q�10@r�20@s�30@t�40@u�50@v�60@w�70@x�80@y�90@z�:0@{�;0@|�<0@}�=0@~�>0@�?0@��@0@��A0@��B0@��C0@��D0@��E0@��Y0@��@@��@@��@@��@@��@@��@@��@@��P@��P@��P@��P@��P@��P@��P@��P@��P@��	P@��
P@��P@��P@��
P@��P@��P@��`@��`@��`@��`@��`@��`@��`@��`@��	`@��
`@��`@��`@��
`@��`@��`@��`@��`@��`@��`@��`@��`@��`@��`@��`@��`@��`@��`@��`@��`@��`@��`@�� `@��!`@��"`@��#`@��$`@��%`@��&`@��'`@��(`@��)`@��*`@��+`@��,`@��-`@��.`@��/`@��0`@��1`@��2`@��VMAP��9������������������	��
������
������������������������������VMAPt,9������������������	��
����VMAP4�9��������VMAP<�9��������,BootDiagMessageMap(DebuggerStatusMap4EnableDisableReasonMap,SbatUpdateStatusMap<SecureBootBcdMitigationMap TxtStatusMap VsmPolicyMapTTBL��TEMP`<��Ǎ��Y<��������D�	EventDataA��9�oData!K�NameSqmType
A��G�oData/K�NameSqmSessionGuid
A��5�oDataK�NameSqmID
A��O�oData7K�NameSqmStreamRowLength
A��QZ�ComplexData+K�NameSqmStreamRow
��<�<�<�<=8=X=x=SqmType$SqmSessionGuidSqmID,SqmStreamRowLength SqmStreamRow SqmTypeEntry SqmDWORDEntry$SqmStringEntryTEMP��>*�d�Ÿ[�|5�NR����D�	EventDataA��5�oDataK�NameWidth
A��7�oDataK�NameHeight
A��C�oData+K�NameBitsPerPixel
�>�>?WidthHeight BitsPerPixelTEMP��?A�g���[k#l�'t���`D�	EventDataA��?�oData'K�Name
BytesPerMs
�?BytesPerMsTEMPTA�
1�BW[�n��Ts��,D�	EventDataA��;�oData#K�NameDeviceID
A��;�oData#K�NameFileName
A��=�oData%K�Name	BytesRead

A��C�oData+K�NameBytesWritten

�A�A

�A

�ADeviceIDFileNameBytesRead BytesWrittenTEMP�C�چ�ЛV���k+�[b���D�	EventDataA��;�oData#K�NameDeviceID
A��;�oData#K�NameFileName
A��7�oDataK�NameStatus
XCpC�CDeviceIDFileNameStatusTEMP��Dj���_��������D�	EventDataA��I�oData1K�NameApplicationGuid
A��=�oData%K�Name	BytesRead

A��C�oData+K�NameBytesWritten

E

(E

@E$ApplicationGuidBytesRead BytesWrittenTEMP�F�f��
�Rۓ����F���,D�	EventDataA��=�oData%K�Name	ImageName
A��?�oData'K�Name
ImageFlags
A��7�oDataK�NameReason
A��C�oData+K�NameErrorIgnored
G(GDGXGImageNameImageFlagsReason ErrorIgnoredTEMP�H�4�~MQ9�TsK,^.��bD�	EventDataA��A�oData)K�NameBootmgrTime



$HBootmgrTimeTEMP��H��H�Q��b����^D�	EventDataA��=�oData%K�Name	ImageName
�HImageNameTEMP��IR��6Am�Z�������bD�	EventDataA��A�oData)K�NameDriveNumber
�IDriveNumberTEMPXxL�@a�]�0gډ�����zD�	EventDataA��A�oData)K�NameFwStartPage

A��A�oData)K�NameFwPageCount

A��C�oData+K�NameFwMemoryType
A��O�oData7K�NameFwMemoryAttributes
A��A�oData)K�NameBlStartPage

A��A�oData)K�NameBlPageCount

A��C�oData+K�NameBlMemoryType
A��O�oData7K�NameBlMemoryAttributes

M
4MPMpM
�M
�M�M�MFwStartPageFwPageCount FwMemoryType,FwMemoryAttributesBlStartPageBlPageCount BlMemoryType,BlMemoryAttributesTEMP��N�"�jfg$\���L�����hD�	EventDataA��G�oData/K�NamePreBootMgrTime



�N$PreBootMgrTimeTEMP�P�&6�ؕ]�nZ�H����D�	EventDataA��K�oData3K�NameUefiVariableName
A��3�oDataK�NameSize
A��7�oDataK�NameStatus
HPpP�P(UefiVariableNameSizeStatusTEMP@tQ7":���Q:��b��M���D�	EventDataA��I�oData1K�NameApplicationGuid
A��9�oData!K�NameElement
�Q�Q$ApplicationGuidElementTEMP�`R$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
tRStatusTEMP�S$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
(SStatusTEMPL TI��Q�H�\�p�Ԧ����D�	EventDataA��E�oData-K�Name
FailureStatus

A��C�oData+K�NameFailureMsgId


HT
hT FailureStatus FailureMsgIdTEMPDhU�UaJ˅W�����������D�	EventDataA��E�oData-K�Name
FailureStatus
A��?�oData'K�Name
FailureMsg
�U�U FailureStatusFailureMsgTEMPPV)5�H7^A����d����D�	EventDataTEMP��V�H�tjI�Q��Bn�a���`D�	EventDataA��?�oData'K�Name
EntryCount
�VEntryCountTEMP�tW���X��4`����`D�	EventDataA��?�oData'K�Name
ToolsCount
�WToolsCountTEMP\�X�;���W�Q[\4�����D�	EventDataA��K�oData3K�NameLastShutdownGood

A��C�oData+K�NameLastBootGood



�X

�X(LastShutdownGood LastBootGoodTEMP`�Zg����+�[d��f���ND�	EventDataA��K�oData3K�NameLastShutdownGood

A��C�oData+K�NameLastBootGood

A��?�oData'K�Name
LastBootId
A��K�oData3K�NameBootStatusPolicy


�Z

�Z[8[(LastShutdownGood LastBootGoodLastBootId(BootStatusPolicyTEMP��[
r�y��Wyþ���T��hD�	EventDataA��G�oData/K�NameOptionSelected
\$OptionSelectedTEMPP�\)5�H7^A����d����D�	EventDataTEMPP�\)5�H7^A����d����D�	EventDataTEMPP$])5�H7^A����d����D�	EventDataTEMP��]S�/y^�����q0��hD�	EventDataA��G�oData/K�NameBootMenuPolicy
�]$BootMenuPolicyTEMPPH^)5�H7^A����d����D�	EventDataTEMP��^w��-g0�^���"	���\D�	EventDataA��;�oData#K�NameBootType
�^BootTypeTEMP4�_��	;H�^Fߟ�U�����D�	EventDataA��;�oData#K�NameBootType
A��A�oData)K�NameLoadOptions
``BootTypeLoadOptionsTEMP,0bv5Y�0�EX��5f0�q����D�	EventDataA��E�oData-K�Name
ResetEndStart

A��K�oData3K�NameLoadOSImageStart

A��M�oData5K�NameStartOSImageStart

A��U�oData=K�NameExitBootServicesEntry

A��S�oData;K�NameExitBootServicesExit



�b

�b

�b

c

4c ResetEndStart(LoadOSImageStart(StartOSImageStart0ExitBootServicesEntry0ExitBootServicesExitTEMP��c$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
dStatusTEMP��d��{��b(]�O]9�����xD�	EventDataA��W�oData?K�NameBitlockerUserInputTime



�d4BitlockerUserInputTimeTEMPH�e�m�[ MkV,Bc�t���D�	EventDataA��=�oData%K�Name	ImageName
A��I�oData1K�NameImageLoadStatus
f0fImageName$ImageLoadStatusTEMPX@g�bIU�2Z"��M���D�	EventDataA��A�oData)K�NamePeImageName
A��M�oData5K�NamePeImageLoadStatus
hg�gPeImageName(PeImageLoadStatusTEMP�Th�QI��-R�d�(P��rD�	EventDataA��Q�oData9K�NameUpdateCapsuleStatus
hh,UpdateCapsuleStatusTEMP��iJ�M�9��T2�`0cX���D�	EventDataA��A�oData)K�NameDeviceFlags
A��=�oData%K�Name	PcrBitmap
A��U�oData=K�NameUpdateSupportedStatus
j$j<jDeviceFlagsPcrBitmap0UpdateSupportedStatusTEMPHPk�m�[ MkV,Bc�t���D�	EventDataA��=�oData%K�Name	ImageName
A��I�oData1K�NameImageLoadStatus
xk�kImageName$ImageLoadStatusTEMPH�l�m�[ MkV,Bc�t���D�	EventDataA��=�oData%K�Name	ImageName
A��I�oData1K�NameImageLoadStatus
�l�lImageName$ImageLoadStatusTEMPD�m�#|�'$\-]���H���D�	EventDataA��=�oData%K�Name	ImageName
A��G�oData/K�NameSiPolicyStatus
nnImageName$SiPolicyStatusTEMPD o�T&��{Z�pu�t�����D�	EventDataA��;�oData#K�NameHiveName
A��G�oData/K�NameHiveLoadStatus
Ho`oHiveName$HiveLoadStatusTEMP�p$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
$pStatusTEMP��p$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
�pStatusTEMP��qX���S#…�H9����D�	EventDataA��3�oDataK�NamePath
A��?�oData'K�Name
FailedPath
A��7�oDataK�NameStatus
4rDr`rPathFailedPathStatusTEMPxxsdC��6lZ'H_�?Z�����D�	EventDataA��3�oDataK�NamePath
A��7�oDataK�NameImport
A��7�oDataK�NameStatus
�s�s�sPathImportStatusTEMP��u�Njzp�P�N?�����tD�	EventDataA��K�oData3K�NameCachedCopyStatus
A��Q�oData9K�NameIdkGenerationStatus
A��I�oData1K�NameMeasuringStatus
A��Y�oDataAK�NameSealingAndCachingStatus
�uv8v\v(CachedCopyStatus,IdkGenerationStatus$MeasuringStatus4SealingAndCachingStatusTEMPD�z*--�c�
_-tn��y���D�	EventDataA��K�oData3K�NameCachedCopyStatus
A��]�oDataEK�NameUnsealingCachedCopyStatus
A��_�oDataGK�NameKeyGenerationAndSaveStatus
A��E�oData-K�Name
SealingStatus
A��?�oData'K�Name
TpmPcrMask
A��e�oDataMK�NameProtectorAssistedUnsealStatus
A��e�oDataMK�NameProtectorAssistedResealStatus
A��]�oDataEK�NameProtectorSealUpdateStatus
A��O�oData7K�NameTpmCounterOpStatus
A��W�oData?K�NameTpmCounterCreateStatus
	A��S�oData;K�NameBackupSealedBlobUsed

�{�{|P|p|�|�|}D}p}

�}(CachedCopyStatus8UnsealingCachedCopyStatus<KeyGenerationAndSaveStatus SealingStatusTpmPcrMask@ProtectorAssistedUnsealStatus@ProtectorAssistedResealStatus8ProtectorSealUpdateStatus,TpmCounterOpStatus4TpmCounterCreateStatus0BackupSealedBlobUsedTEMPT�/�kb.�R$+��\T����D�	EventDataA��K�oData3K�NameCachedCopyStatus
A��Y�oDataAK�NamePrimaryBlobUnsealStatus
A��W�oData?K�NameBackupBlobUnsealStatus
A��c�oDataKK�NamePca2023ProtectorUnsealStatus
A��e�oDataMK�NameBackupBlobValidityCheckStatus
A��S�oData;K�NameBackupBlobStillValid

A��q�oDataYK�Name#Pca2023ProtectorValidityCheckStatus
A��_�oDataGK�NamePca2023ProtectorStillValid

A��Y�oDataAK�NamePrimaryBlobResealStatus
A��W�oData?K�NameBackupBlobResealStatus
	A��c�oDataKK�NamePca2023ProtectorResealStatus
A��_�oDataGK�NameKeyGenerationAndSaveStatus
A��E�oData-K�Name
SealingStatus
A��?�oData'K�Name
TpmPcrMask

A��O�oData7K�NameTpmCounterOpStatus
A��W�oData?K�NameTpmCounterCreateStatus
A��S�oData;K�NameBackupSealedBlobUsed

A��{�oDatacK�Name(Pca2023ProtectorCleanupPostUpgradeStatus
X������(�

h���

� �T���Ȉ�$�@�l�

��Љ(CachedCopyStatus4PrimaryBlobUnsealStatus4BackupBlobUnsealStatus@Pca2023ProtectorUnsealStatus@BackupBlobValidityCheckStatus0BackupBlobStillValidLPca2023ProtectorValidityCheckStatus<Pca2023ProtectorStillValid4PrimaryBlobResealStatus4BackupBlobResealStatus@Pca2023ProtectorResealStatus<KeyGenerationAndSaveStatus SealingStatusTpmPcrMask,TpmCounterOpStatus4TpmCounterCreateStatus0BackupSealedBlobUsedXPca2023ProtectorCleanupPostUpgradeStatusTEMP4,,�D����wQ|��o�����D�	EventDataA��K�oData3K�NameCachedCopyStatus
A��Y�oDataAK�NamePrimaryBlobUnsealStatus
A��W�oData?K�NameBackupBlobUnsealStatus
A��c�oDataKK�NamePca2023ProtectorUnsealStatus
A��e�oDataMK�NameBackupBlobValidityCheckStatus
A��S�oData;K�NameBackupBlobStillValid

A��q�oDataYK�Name#Pca2023ProtectorValidityCheckStatus
A��_�oDataGK�NamePca2023ProtectorStillValid

A��Y�oDataAK�NamePrimaryBlobResealStatus
A��W�oData?K�NameBackupBlobResealStatus
	A��c�oDataKK�NamePca2023ProtectorResealStatus
A��_�oDataGK�NameKeyGenerationAndSaveStatus
A��E�oData-K�Name
SealingStatus
A��?�oData'K�Name
TpmPcrMask

A��O�oData7K�NameTpmCounterOpStatus
A��W�oData?K�NameTpmCounterCreateStatus
A��S�oData;K�NameBackupSealedBlobUsed

A��{�oDatacK�Name(Pca2023ProtectorCleanupPostUpgradeStatus
A��G�oData/K�NameNeedToRollLkey
A��U�oData=K�NameCreationStateVerified
A��K�oData3K�NameV2ProtectorsUsed
A��[�oDataCK�NameLegacyUefiVarQueryStatus
A��_�oDataGK�NameLegacyUefiVarCleanupStatus
A��k�oDataSK�Name VbsRollbackDataProtectionEnabled
A��k�oDataSK�Name VbsRollbackDataProtectionOptedIn
A��}�oDataeK�Name)VbsRollbackDataProtectionTpmCounterStatus
A��K�oData3K�NameFirstWriteToDisk
A��G�oData/K�NameWritePkgToUefi
A��S�oData;K�NameLatchedProtectorUsed
A��M�oData5K�NameLatchTheUnlatched
A��Q�oData9K�NameUnsupportedRollback
A��Y�oDataAK�NameUpgradedVbsPolicyExists
A��]�oDataEK�NameTpmCounterIncrementStatus
 A��Q�oData9K�NameActivePolicyVersion
!
A��S�oData;K�NameLatchedPolicyVersion
"
A��W�oData?K�NameUnlatchedPolicyVersion
#
A��k�oDataSK�Name LatchedPrimaryBlobResealStatusV2
$A��i�oDataQK�NameLatchedBackupBlobResealStatusV2
%A��u�oData]K�Name%LatchedPca2023ProtectorResealStatusV2
&A����oDatauK�Name1LatchedPca2023ProtectorCleanupPostUpgradeStatusV2
'A��o�oDataWK�Name"UnlatchedPrimaryBlobResealStatusV2
(A��m�oDataUK�Name!UnlatchedBackupBlobResealStatusV2
)A��y�oDataaK�Name'UnlatchedPca2023ProtectorResealStatusV2
*A����oDatayK�Name3UnlatchedPca2023ProtectorCleanupPostUpgradeStatusV2
+P�x���� �

`���

ܠ�L��������8�d�

��Ȣ
 �
D�
t���ԣ
�
X���
��
 �
D�
t�
��
ȥ��

4�

`�

��Ħ�P����T����(CachedCopyStatus4PrimaryBlobUnsealStatus4BackupBlobUnsealStatus@Pca2023ProtectorUnsealStatus@BackupBlobValidityCheckStatus0BackupBlobStillValidLPca2023ProtectorValidityCheckStatus<Pca2023ProtectorStillValid4PrimaryBlobResealStatus4BackupBlobResealStatus@Pca2023ProtectorResealStatus<KeyGenerationAndSaveStatus SealingStatusTpmPcrMask,TpmCounterOpStatus4TpmCounterCreateStatus0BackupSealedBlobUsedXPca2023ProtectorCleanupPostUpgradeStatus$NeedToRollLkey0CreationStateVerified(V2ProtectorsUsed8LegacyUefiVarQueryStatus<LegacyUefiVarCleanupStatusHVbsRollbackDataProtectionEnabledHVbsRollbackDataProtectionOptedInXVbsRollbackDataProtectionTpmCounterStatus(FirstWriteToDisk$WritePkgToUefi0LatchedProtectorUsed(LatchTheUnlatched,UnsupportedRollback4UpgradedVbsPolicyExists8TpmCounterIncrementStatus,ActivePolicyVersion0LatchedPolicyVersion4UnlatchedPolicyVersionHLatchedPrimaryBlobResealStatusV2DLatchedBackupBlobResealStatusV2PLatchedPca2023ProtectorResealStatusV2hLatchedPca2023ProtectorCleanupPostUpgradeStatusV2LUnlatchedPrimaryBlobResealStatusV2HUnlatchedBackupBlobResealStatusV2TUnlatchedPca2023ProtectorResealStatusV2lUnlatchedPca2023ProtectorCleanupPostUpgradeStatusV2TEMP
�x�oV�jYc.t{�qY��VD�	EventDataA��K�oData3K�NameCachedCopyStatus
A��Y�oDataAK�NamePrimaryBlobUnsealStatus
A��W�oData?K�NameBackupBlobUnsealStatus
A��c�oDataKK�NamePca2023ProtectorUnsealStatus
A��g�oDataOK�NameLostOemPkProtectorUnsealStatus
A��e�oDataMK�NameBackupBlobValidityCheckStatus
A��S�oData;K�NameBackupBlobStillValid

A��q�oDataYK�Name#Pca2023ProtectorValidityCheckStatus
A��_�oDataGK�NamePca2023ProtectorStillValid

A��Y�oDataAK�NamePrimaryBlobResealStatus
	A��W�oData?K�NameBackupBlobResealStatus
A��c�oDataKK�NamePca2023ProtectorResealStatus
A��_�oDataGK�NameKeyGenerationAndSaveStatus
A��E�oData-K�Name
SealingStatus

A��?�oData'K�Name
TpmPcrMask
A��O�oData7K�NameTpmCounterOpStatus
A��W�oData?K�NameTpmCounterCreateStatus
A��S�oData;K�NameBackupSealedBlobUsed

A��{�oDatacK�Name(Pca2023ProtectorCleanupPostUpgradeStatus
d������4�x�

���

4�p���ش�T�t�����

� �(CachedCopyStatus4PrimaryBlobUnsealStatus4BackupBlobUnsealStatus@Pca2023ProtectorUnsealStatusDLostOemPkProtectorUnsealStatus@BackupBlobValidityCheckStatus0BackupBlobStillValidLPca2023ProtectorValidityCheckStatus<Pca2023ProtectorStillValid4PrimaryBlobResealStatus4BackupBlobResealStatus@Pca2023ProtectorResealStatus<KeyGenerationAndSaveStatus SealingStatusTpmPcrMask,TpmCounterOpStatus4TpmCounterCreateStatus0BackupSealedBlobUsedXPca2023ProtectorCleanupPostUpgradeStatusTEMP�  ����4��Q�m�]j�x��"
D�	EventDataA��7�oDataK�NameStatus
A��?�oData'K�Name
OsDeviceId
A��?�oData'K�Name
SystemRoot
A��A�oData)K�NamePcrSealMask
A��M�oData5K�NameLatchTheUnlatched
A��k�oDataSK�Name UpgradedAntirollbackPolicyExists
A��K�oData3K�NameEncryptionStatus
A��Y�oDataAK�NameKeyPkgIdTpmCounterValue

A��]�oDataEK�NameEncryptedLKeyArrayPkgSize
A��W�oData?K�NameEncryptedLKeyPkgPdGuid
	A��]�oDataEK�NameUnlatchedUnsealPolicySize
A��[�oDataCK�NameUnlatchedProtectorExists
A��Y�oDataAK�NameLatchedUnsealPolicySize
A��W�oData?K�NameLatchedProtectorExists

A��c�oDataKK�NameLatchedUnsealPolicy->Version
A��o�oDataWK�Name"LatchedUnsealPolicy->VarDataOffset
A��o�oDataWK�Name"LatchedUnsealPolicy->StructureSize
A��o�oDataWK�Name"LatchedUnsealPolicy->PolicyVersion

A��u�oData]K�Name%LatchedUnsealPolicy->PolicyHashLength
A��i�oDataQK�NameLatchedUnsealPolicy->WinloadSVN
A��m�oDataUK�Name!LatchedUnsealPolicy->WinresumeSVN
A��i�oDataQK�NameLatchedUnsealPolicy->BootmgrSVN
A��g�oDataOK�NameLatchedUnsealPolicy->LKeyPkgId

A��g�oDataOK�NameUnlatchedUnsealPolicy->Version
A��s�oData[K�Name$UnlatchedUnsealPolicy->VarDataOffset
A��s�oData[K�Name$UnlatchedUnsealPolicy->StructureSize
A��s�oData[K�Name$UnlatchedUnsealPolicy->PolicyVersion

A��y�oDataaK�Name'UnlatchedUnsealPolicy->PolicyHashLength
A��m�oDataUK�Name!UnlatchedUnsealPolicy->WinloadSVN
A��q�oDataYK�Name#UnlatchedUnsealPolicy->WinresumeSVN
A��m�oDataUK�Name!UnlatchedUnsealPolicy->BootmgrSVN
A��k�oDataSK�Name UnlatchedUnsealPolicy->LKeyPkgId

P�d�����
��
��(�

P�������
(�`�
�����T�

����<�����

�P�����

4����� �l�

��StatusOsDeviceIdSystemRootPcrSealMask(LatchTheUnlatchedHUpgradedAntirollbackPolicyExists(EncryptionStatus4KeyPkgIdTpmCounterValue8EncryptedLKeyArrayPkgSize4EncryptedLKeyPkgPdGuid8UnlatchedUnsealPolicySize8UnlatchedProtectorExists4LatchedUnsealPolicySize4LatchedProtectorExists@LatchedUnsealPolicy->VersionLLatchedUnsealPolicy->VarDataOffsetLLatchedUnsealPolicy->StructureSizeLLatchedUnsealPolicy->PolicyVersionPLatchedUnsealPolicy->PolicyHashLengthDLatchedUnsealPolicy->WinloadSVNHLatchedUnsealPolicy->WinresumeSVNDLatchedUnsealPolicy->BootmgrSVNDLatchedUnsealPolicy->LKeyPkgIdDUnlatchedUnsealPolicy->VersionPUnlatchedUnsealPolicy->VarDataOffsetPUnlatchedUnsealPolicy->StructureSizePUnlatchedUnsealPolicy->PolicyVersionTUnlatchedUnsealPolicy->PolicyHashLengthHUnlatchedUnsealPolicy->WinloadSVNLUnlatchedUnsealPolicy->WinresumeSVNHUnlatchedUnsealPolicy->BootmgrSVNHUnlatchedUnsealPolicy->LKeyPkgIdTEMP�/==��\��1�X��ט��G
���D�	EventDataA��7�oDataK�NameStatus
A��?�oData'K�Name
OsDeviceId
A��?�oData'K�Name
SystemRoot
A��G�oData/K�NameVsmLKeyRelPath
A��_�oDataGK�NameLatchedUnsealPolicyRelPath
A��c�oDataKK�NameUnlatchedUnsealPolicyRelPath
A��q�oDataYK�Name#LatchedPrimaryProtectorVariableName
A��u�oData]K�Name%LatchedSecondaryProtectorVariableName
A��u�oData]K�Name%UnlatchedPrimaryProtectorVariableName
A��y�oDataaK�Name'UnlatchedSecondaryProtectorVariableName
	A��]�oDataEK�NameLatchedProtectorUsedLocal
A��W�oData?K�NameLatchTheUnlatchedLocal
A��[�oDataCK�NameUnsupportedRollbackLocal
A��u�oData]K�Name%UpgradedAntirollbackPolicyExistsLocal

A��i�oDataQK�NamePkgWasCorruptOrUnavailableLocal
A��_�oDataGK�NameCreationStateVerifiedLocal
A��w�oData_K�Name&PrimaryProtectorTargetPcrSealMaskLocal
A��W�oData?K�NameLatchedProtectorExists
A��[�oDataCK�NameUnlatchedProtectorExists
A��Y�oDataAK�NameKeyPkgIdTpmCounterValue

A��Q�oData9K�NameActivePolicyVersion

A��U�oData=K�NameUseUnlatchedProtector
A��c�oDataKK�NameNeedToResealPrimaryProtector
A��g�oDataOK�NameNeedToResealSecondaryProtector
A��c�oDataKK�NameNeedToResealPca2023Protector
A��q�oDataYK�Name#pSubStatus->PrimaryBlobUnsealStatus
A��o�oDataWK�Name"pSubStatus->BackupBlobUnsealStatus
A��{�oDatacK�Name(pSubStatus->Pca2023ProtectorUnsealStatus
A��}�oDataeK�Name)pSubStatus->BackupBlobValidityCheckStatus
A��k�oDataSK�Name pSubStatus->BackupBlobStillValid

A����oDataqK�Name/pSubStatus->Pca2023ProtectorValidityCheckStatus
A��w�oData_K�Name&pSubStatus->Pca2023ProtectorStillValid

A��q�oDataYK�Name#pSubStatus->PrimaryBlobResealStatus
 A��o�oDataWK�Name"pSubStatus->BackupBlobResealStatus
!A��{�oDatacK�Name(pSubStatus->Pca2023ProtectorResealStatus
"A��c�oDataKK�NamepSubStatus->V2ProtectorsUsed
#A��s�oData[K�Name$pSubStatus->LegacyUefiVarQueryStatus
$A��w�oData_K�Name&pSubStatus->LegacyUefiVarCleanupStatus
%A��i�oDataQK�NamepSubStatus->ActivePolicyVersion
&
A��k�oDataSK�Name pSubStatus->LatchedPolicyVersion
'
A��o�oDataWK�Name"pSubStatus->UnlatchedPolicyVersion
(
A��[�oDataCK�NameLatchedUnsealPolicyValid
)A��c�oDataKK�NameLatchedUnsealPolicy->Version
*A��o�oDataWK�Name"LatchedUnsealPolicy->VarDataOffset
+A��o�oDataWK�Name"LatchedUnsealPolicy->StructureSize
,A��o�oDataWK�Name"LatchedUnsealPolicy->PolicyVersion
-
A��u�oData]K�Name%LatchedUnsealPolicy->PolicyHashLength
.A��i�oDataQK�NameLatchedUnsealPolicy->WinloadSVN
/A��m�oDataUK�Name!LatchedUnsealPolicy->WinresumeSVN
0A��i�oDataQK�NameLatchedUnsealPolicy->BootmgrSVN
1A��g�oDataOK�NameLatchedUnsealPolicy->LKeyPkgId
2
A��_�oDataGK�NameUnlatchedUnsealPolicyValid
3A��g�oDataOK�NameUnlatchedUnsealPolicy->Version
4A��s�oData[K�Name$UnlatchedUnsealPolicy->VarDataOffset
5A��s�oData[K�Name$UnlatchedUnsealPolicy->StructureSize
6A��s�oData[K�Name$UnlatchedUnsealPolicy->PolicyVersion
7
A��y�oDataaK�Name'UnlatchedUnsealPolicy->PolicyHashLength
8A��m�oDataUK�Name!UnlatchedUnsealPolicy->WinloadSVN
9A��q�oDataYK�Name#UnlatchedUnsealPolicy->WinresumeSVN
:A��m�oDataUK�Name!UnlatchedUnsealPolicy->BootmgrSVN
;A��k�oDataSK�Name UnlatchedUnsealPolicy->LKeyPkgId
<
���������<�|����h�
��
��
(�
`�
��
��0�
��
��

��

$�
P�
��
��
�D�����4�

����

8����$�
|����

`�

��

�
8�p�����

H����(�p�

��
��4�x��

�h����P�

��StatusOsDeviceIdSystemRoot$VsmLKeyRelPath<LatchedUnsealPolicyRelPath@UnlatchedUnsealPolicyRelPathLLatchedPrimaryProtectorVariableNamePLatchedSecondaryProtectorVariableNamePUnlatchedPrimaryProtectorVariableNameTUnlatchedSecondaryProtectorVariableName8LatchedProtectorUsedLocal4LatchTheUnlatchedLocal8UnsupportedRollbackLocalPUpgradedAntirollbackPolicyExistsLocalDPkgWasCorruptOrUnavailableLocal<CreationStateVerifiedLocalTPrimaryProtectorTargetPcrSealMaskLocal4LatchedProtectorExists8UnlatchedProtectorExists4KeyPkgIdTpmCounterValue,ActivePolicyVersion0UseUnlatchedProtector@NeedToResealPrimaryProtectorDNeedToResealSecondaryProtector@NeedToResealPca2023ProtectorLpSubStatus->PrimaryBlobUnsealStatusLpSubStatus->BackupBlobUnsealStatusXpSubStatus->Pca2023ProtectorUnsealStatusXpSubStatus->BackupBlobValidityCheckStatusHpSubStatus->BackupBlobStillValiddpSubStatus->Pca2023ProtectorValidityCheckStatusTpSubStatus->Pca2023ProtectorStillValidLpSubStatus->PrimaryBlobResealStatusLpSubStatus->BackupBlobResealStatusXpSubStatus->Pca2023ProtectorResealStatus@pSubStatus->V2ProtectorsUsedPpSubStatus->LegacyUefiVarQueryStatusTpSubStatus->LegacyUefiVarCleanupStatusDpSubStatus->ActivePolicyVersionHpSubStatus->LatchedPolicyVersionLpSubStatus->UnlatchedPolicyVersion8LatchedUnsealPolicyValid@LatchedUnsealPolicy->VersionLLatchedUnsealPolicy->VarDataOffsetLLatchedUnsealPolicy->StructureSizeLLatchedUnsealPolicy->PolicyVersionPLatchedUnsealPolicy->PolicyHashLengthDLatchedUnsealPolicy->WinloadSVNHLatchedUnsealPolicy->WinresumeSVNDLatchedUnsealPolicy->BootmgrSVNDLatchedUnsealPolicy->LKeyPkgId<UnlatchedUnsealPolicyValidDUnlatchedUnsealPolicy->VersionPUnlatchedUnsealPolicy->VarDataOffsetPUnlatchedUnsealPolicy->StructureSizePUnlatchedUnsealPolicy->PolicyVersionTUnlatchedUnsealPolicy->PolicyHashLengthHUnlatchedUnsealPolicy->WinloadSVNLUnlatchedUnsealPolicy->WinresumeSVNHUnlatchedUnsealPolicy->BootmgrSVNHUnlatchedUnsealPolicy->LKeyPkgIdTEMP$$$�϶؍�<^�!dT�+2���D�	EventDataA��7�oDataK�NameStatus
A��U�oData=K�NamePrimarySealedBlobName
A��g�oDataOK�NameSecondaryProtectorVariableName
A��[�oDataCK�NameBlobFromUefiVariableSize
A��Q�oData9K�NameUefiContentIsSealed
A��K�oData3K�NameUnsealedBlobSize
A��I�oData1K�NamePcr7SealingUsed
A��Q�oData9K�NamePkgTpmSealMaskLocal
A��Y�oDataAK�NamePkgTpmCreationMaskLocal
A��O�oData7K�NameNeedToResealKeyPkg
	A��O�oData7K�NameNeedToResealBackup
A��c�oDataKK�NameNeedToResealPca2023Protector
A��M�oData5K�NamePlaintextBlobSize
A��Y�oDataAK�NamePlaintextIsLegacyFormat

A��M�oData5K�NameUefiBlobIsCorrupt
A��;�oData#K�NameNewKeyID
A��_�oDataGK�NameVerifiedMicrosoftAuthority
A��U�oData=K�NameContainsAuthorityData
A��_�oDataGK�NameBootmgrAuthorityEventCount
A��=�oData%K�Name	Authority
A��q�oDataYK�Name#pSubStatus->PrimaryBlobUnsealStatus
A��o�oDataWK�Name"pSubStatus->BackupBlobUnsealStatus
A��{�oDatacK�Name(pSubStatus->Pca2023ProtectorUnsealStatus
A��}�oDataeK�Name)pSubStatus->BackupBlobValidityCheckStatus
A��k�oDataSK�Name pSubStatus->BackupBlobStillValid

A����oDataqK�Name/pSubStatus->Pca2023ProtectorValidityCheckStatus
A��w�oData_K�Name&pSubStatus->Pca2023ProtectorStillValid

A��q�oDataYK�Name#pSubStatus->PrimaryBlobResealStatus
A��o�oDataWK�Name"pSubStatus->BackupBlobResealStatus
A��{�oDatacK�Name(pSubStatus->Pca2023ProtectorResealStatus
A��c�oDataKK�NamepSubStatus->V2ProtectorsUsed
A��s�oData[K�Name$pSubStatus->LegacyUefiVarQueryStatus
A��w�oData_K�Name&pSubStatus->LegacyUefiVarCleanupStatus
 A��i�oDataQK�NamepSubStatus->ActivePolicyVersion
!
A��k�oDataSK�Name pSubStatus->LatchedPolicyVersion
"
A��o�oDataWK�Name"pSubStatus->UnlatchedPolicyVersion
#
���
Dp
���

H
t�
�
8
P
���\�

X�

X��
H��

,

p

�Status0PrimarySealedBlobNameDSecondaryProtectorVariableName8BlobFromUefiVariableSize,UefiContentIsSealed(UnsealedBlobSize$Pcr7SealingUsed,PkgTpmSealMaskLocal4PkgTpmCreationMaskLocal,NeedToResealKeyPkg,NeedToResealBackup@NeedToResealPca2023Protector(PlaintextBlobSize4PlaintextIsLegacyFormat(UefiBlobIsCorruptNewKeyID<VerifiedMicrosoftAuthority0ContainsAuthorityData<BootmgrAuthorityEventCountAuthorityLpSubStatus->PrimaryBlobUnsealStatusLpSubStatus->BackupBlobUnsealStatusXpSubStatus->Pca2023ProtectorUnsealStatusXpSubStatus->BackupBlobValidityCheckStatusHpSubStatus->BackupBlobStillValiddpSubStatus->Pca2023ProtectorValidityCheckStatusTpSubStatus->Pca2023ProtectorStillValidLpSubStatus->PrimaryBlobResealStatusLpSubStatus->BackupBlobResealStatusXpSubStatus->Pca2023ProtectorResealStatus@pSubStatus->V2ProtectorsUsedPpSubStatus->LegacyUefiVarQueryStatusTpSubStatus->LegacyUefiVarCleanupStatusDpSubStatus->ActivePolicyVersionHpSubStatus->LatchedPolicyVersionLpSubStatus->UnlatchedPolicyVersionTEMP�((�)�~�a�T�P�\c����D�	EventDataA��7�oDataK�NameStatus
A��g�oDataOK�NameSecondaryProtectorVariableName
A��c�oDataKK�NameNeedToResealPrimaryProtector
A��g�oDataOK�NameNeedToResealSecondaryProtector
A��c�oDataKK�NameNeedToResealPca2023Protector
A��e�oDataMK�NameSealedBackupEncryptionKeySize
A��g�oDataOK�NameSealedPca2023EncryptionKeySize
A��M�oData5K�NameUefiBlobIsCorrupt
A��I�oData1K�NamePcr7SealingUsed
A��_�oDataGK�NameCreationStateVerifiedLocal
	A��_�oDataGK�NameVerifiedMicrosoftAuthority
A��U�oData=K�NameContainsAuthorityData
A��_�oDataGK�NameBootmgrAuthorityEventCount
A��w�oData_K�Name&PrimaryProtectorTargetPcrSealMaskLocal

A��=�oData%K�Name	Authority
A��q�oDataYK�Name#pSubStatus->PrimaryBlobUnsealStatus
A��o�oDataWK�Name"pSubStatus->BackupBlobUnsealStatus
A��{�oDatacK�Name(pSubStatus->Pca2023ProtectorUnsealStatus
A��}�oDataeK�Name)pSubStatus->BackupBlobValidityCheckStatus
A��k�oDataSK�Name pSubStatus->BackupBlobStillValid

A����oDataqK�Name/pSubStatus->Pca2023ProtectorValidityCheckStatus
A��w�oData_K�Name&pSubStatus->Pca2023ProtectorStillValid

A��q�oDataYK�Name#pSubStatus->PrimaryBlobResealStatus
A��o�oDataWK�Name"pSubStatus->BackupBlobResealStatus
A��{�oDatacK�Name(pSubStatus->Pca2023ProtectorResealStatus
A��c�oDataKK�NamepSubStatus->V2ProtectorsUsed
A��s�oData[K�Name$pSubStatus->LegacyUefiVarQueryStatus
A��w�oData_K�Name&pSubStatus->LegacyUefiVarCleanupStatus
A��i�oDataQK�NamepSubStatus->ActivePolicyVersion

A��k�oDataSK�Name pSubStatus->LatchedPolicyVersion

A��o�oDataWK�Name"pSubStatus->UnlatchedPolicyVersion

A��g�oDataOK�NameValidatedUnsealPolicy->Version
A��s�oData[K�Name$ValidatedUnsealPolicy->VarDataOffset
 A��s�oData[K�Name$ValidatedUnsealPolicy->StructureSize
!A��s�oData[K�Name$ValidatedUnsealPolicy->PolicyVersion
"
A��y�oDataaK�Name'ValidatedUnsealPolicy->PolicyHashLength
#A��m�oDataUK�Name!ValidatedUnsealPolicy->WinloadSVN
$A��q�oDataYK�Name#ValidatedUnsealPolicy->WinresumeSVN
%A��m�oDataUK�Name!ValidatedUnsealPolicy->BootmgrSVN
&A��k�oDataSK�Name ValidatedUnsealPolicy->LKeyPkgId
'
�,-
T-
�-
�-.X.
�.
�.
�.
$/
`/�/�/ 080�0�0(1

�1�1

,2�2�23
p3�34

T4

�4

�4,5p5�5

6`6�6�6H7

�7StatusDSecondaryProtectorVariableName@NeedToResealPrimaryProtectorDNeedToResealSecondaryProtector@NeedToResealPca2023Protector@SealedBackupEncryptionKeySizeDSealedPca2023EncryptionKeySize(UefiBlobIsCorrupt$Pcr7SealingUsed<CreationStateVerifiedLocal<VerifiedMicrosoftAuthority0ContainsAuthorityData<BootmgrAuthorityEventCountTPrimaryProtectorTargetPcrSealMaskLocalAuthorityLpSubStatus->PrimaryBlobUnsealStatusLpSubStatus->BackupBlobUnsealStatusXpSubStatus->Pca2023ProtectorUnsealStatusXpSubStatus->BackupBlobValidityCheckStatusHpSubStatus->BackupBlobStillValiddpSubStatus->Pca2023ProtectorValidityCheckStatusTpSubStatus->Pca2023ProtectorStillValidLpSubStatus->PrimaryBlobResealStatusLpSubStatus->BackupBlobResealStatusXpSubStatus->Pca2023ProtectorResealStatus@pSubStatus->V2ProtectorsUsedPpSubStatus->LegacyUefiVarQueryStatusTpSubStatus->LegacyUefiVarCleanupStatusDpSubStatus->ActivePolicyVersionHpSubStatus->LatchedPolicyVersionLpSubStatus->UnlatchedPolicyVersionDValidatedUnsealPolicy->VersionPValidatedUnsealPolicy->VarDataOffsetPValidatedUnsealPolicy->StructureSizePValidatedUnsealPolicy->PolicyVersionTValidatedUnsealPolicy->PolicyHashLengthHValidatedUnsealPolicy->WinloadSVNLValidatedUnsealPolicy->WinresumeSVNHValidatedUnsealPolicy->BootmgrSVNHValidatedUnsealPolicy->LKeyPkgIdTEMP�PB��H��aIP��]����B
D�	EventDataA��_�oDataGK�NameLegacyMainBlobVariableName
A��s�oData[K�Name$LegacySecondaryProtectorVariableName
A��i�oDataQK�NamePkgWasCorruptOrUnavailableLocal
A��O�oData7K�NameKeysAreLegacyLocal
A��_�oDataGK�NameCreationStateVerifiedLocal
A��w�oData_K�Name&PrimaryProtectorTargetPcrSealMaskLocal
A��q�oDataYK�Name#pSubStatus->PrimaryBlobUnsealStatus
A��o�oDataWK�Name"pSubStatus->BackupBlobUnsealStatus
A��{�oDatacK�Name(pSubStatus->Pca2023ProtectorUnsealStatus
A��}�oDataeK�Name)pSubStatus->BackupBlobValidityCheckStatus
	A��k�oDataSK�Name pSubStatus->BackupBlobStillValid

A����oDataqK�Name/pSubStatus->Pca2023ProtectorValidityCheckStatus
A��w�oData_K�Name&pSubStatus->Pca2023ProtectorStillValid

A��q�oDataYK�Name#pSubStatus->PrimaryBlobResealStatus

A��o�oDataWK�Name"pSubStatus->BackupBlobResealStatus
A��{�oDatacK�Name(pSubStatus->Pca2023ProtectorResealStatus
A��c�oDataKK�NamepSubStatus->V2ProtectorsUsed
A��s�oData[K�Name$pSubStatus->LegacyUefiVarQueryStatus
A��w�oData_K�Name&pSubStatus->LegacyUefiVarCleanupStatus
A��i�oDataQK�NamepSubStatus->ActivePolicyVersion

A��k�oDataSK�Name pSubStatus->LatchedPolicyVersion

A��o�oDataWK�Name"pSubStatus->UnlatchedPolicyVersion

DDD
�D
�D
E@E�E�E,F�F

�F$G

�G�G(HtH
�HI\I

�I

�I

<J<LegacyMainBlobVariableNamePLegacySecondaryProtectorVariableNameDPkgWasCorruptOrUnavailableLocal,KeysAreLegacyLocal<CreationStateVerifiedLocalTPrimaryProtectorTargetPcrSealMaskLocalLpSubStatus->PrimaryBlobUnsealStatusLpSubStatus->BackupBlobUnsealStatusXpSubStatus->Pca2023ProtectorUnsealStatusXpSubStatus->BackupBlobValidityCheckStatusHpSubStatus->BackupBlobStillValiddpSubStatus->Pca2023ProtectorValidityCheckStatusTpSubStatus->Pca2023ProtectorStillValidLpSubStatus->PrimaryBlobResealStatusLpSubStatus->BackupBlobResealStatusXpSubStatus->Pca2023ProtectorResealStatus@pSubStatus->V2ProtectorsUsedPpSubStatus->LegacyUefiVarQueryStatusTpSubStatus->LegacyUefiVarCleanupStatusDpSubStatus->ActivePolicyVersionHpSubStatus->LatchedPolicyVersionLpSubStatus->UnlatchedPolicyVersionTEMP''x[qr�&X�xB)������D�	EventDataA��7�oDataK�NameStatus
A��?�oData'K�Name
OsDeviceId
A��G�oData/K�NameOsDataDeviceId
A��?�oData'K�Name
SystemRoot
A��G�oData/K�NameVsmLKeyRelPath
A��_�oDataGK�NameLatchedUnsealPolicyRelPath
A��c�oDataKK�NameUnlatchedUnsealPolicyRelPath
A��q�oDataYK�Name#LatchedPrimaryProtectorVariableName
A��u�oData]K�Name%LatchedSecondaryProtectorVariableName
A��u�oData]K�Name%UnlatchedPrimaryProtectorVariableName
	A��y�oDataaK�Name'UnlatchedSecondaryProtectorVariableName
A��_�oDataGK�NameLegacyMainBlobVariableName
A��s�oData[K�Name$LegacySecondaryProtectorVariableName
A��]�oDataEK�NameLatchedProtectorUsedLocal

A��W�oData?K�NameLatchTheUnlatchedLocal
A��[�oDataCK�NameUnsupportedRollbackLocal
A��u�oData]K�Name%UpgradedAntirollbackPolicyExistsLocal
A��U�oData=K�NameFirstWriteToDiskLocal
A��Q�oData9K�NameWritePkgToUefiLocal
A��i�oDataQK�NamePkgWasCorruptOrUnavailableLocal
A��O�oData7K�NameKeysAreLegacyLocal
A��_�oDataGK�NameCreationStateVerifiedLocal
A��w�oData_K�Name&PrimaryProtectorTargetPcrSealMaskLocal
A��q�oDataYK�Name#pSubStatus->PrimaryBlobUnsealStatus
A��o�oDataWK�Name"pSubStatus->BackupBlobUnsealStatus
A��{�oDatacK�Name(pSubStatus->Pca2023ProtectorUnsealStatus
A��}�oDataeK�Name)pSubStatus->BackupBlobValidityCheckStatus
A��k�oDataSK�Name pSubStatus->BackupBlobStillValid

A����oDataqK�Name/pSubStatus->Pca2023ProtectorValidityCheckStatus
A��w�oData_K�Name&pSubStatus->Pca2023ProtectorStillValid

A��q�oDataYK�Name#pSubStatus->PrimaryBlobResealStatus
A��o�oDataWK�Name"pSubStatus->BackupBlobResealStatus
A��{�oDatacK�Name(pSubStatus->Pca2023ProtectorResealStatus
 A��c�oDataKK�NamepSubStatus->V2ProtectorsUsed
!A��s�oData[K�Name$pSubStatus->LegacyUefiVarQueryStatus
"A��w�oData_K�Name&pSubStatus->LegacyUefiVarCleanupStatus
#A��i�oDataQK�NamepSubStatus->ActivePolicyVersion
$
A��k�oDataSK�Name pSubStatus->LatchedPolicyVersion
%
A��o�oDataWK�Name"pSubStatus->UnlatchedPolicyVersion
&
�^�^�^�^�^_T_�_�_0`�`�`a
`a
�a
�a
b
Tb
�b
�b
�b
 c\c�c�cHd�d

�d@e

�e�eDf�f
�f(gxg

�g

h

XhStatusOsDeviceId$OsDataDeviceIdSystemRoot$VsmLKeyRelPath<LatchedUnsealPolicyRelPath@UnlatchedUnsealPolicyRelPathLLatchedPrimaryProtectorVariableNamePLatchedSecondaryProtectorVariableNamePUnlatchedPrimaryProtectorVariableNameTUnlatchedSecondaryProtectorVariableName<LegacyMainBlobVariableNamePLegacySecondaryProtectorVariableName8LatchedProtectorUsedLocal4LatchTheUnlatchedLocal8UnsupportedRollbackLocalPUpgradedAntirollbackPolicyExistsLocal0FirstWriteToDiskLocal,WritePkgToUefiLocalDPkgWasCorruptOrUnavailableLocal,KeysAreLegacyLocal<CreationStateVerifiedLocalTPrimaryProtectorTargetPcrSealMaskLocalLpSubStatus->PrimaryBlobUnsealStatusLpSubStatus->BackupBlobUnsealStatusXpSubStatus->Pca2023ProtectorUnsealStatusXpSubStatus->BackupBlobValidityCheckStatusHpSubStatus->BackupBlobStillValiddpSubStatus->Pca2023ProtectorValidityCheckStatusTpSubStatus->Pca2023ProtectorStillValidLpSubStatus->PrimaryBlobResealStatusLpSubStatus->BackupBlobResealStatusXpSubStatus->Pca2023ProtectorResealStatus@pSubStatus->V2ProtectorsUsedPpSubStatus->LegacyUefiVarQueryStatusTpSubStatus->LegacyUefiVarCleanupStatusDpSubStatus->ActivePolicyVersionHpSubStatus->LatchedPolicyVersionLpSubStatus->UnlatchedPolicyVersionTEMP�
�nz����VX���6mc���D�	EventDataA��7�oDataK�NameStatus
A��9�oData!K�NamePcrMask
A��O�oData7K�NameUnsealPolicyPdGuid
A��i�oDataQK�NameSealingProtectorFixedBufferSize
A��g�oDataOK�NameSealingProtectorUsedBufferSize
A��W�oData?K�NameSealedSecretBufferSize
A��Q�oData9K�NamePcrInfoArrayElCount
A��U�oData=K�NameUnsealPolicy->Version
A��a�oDataIK�NameUnsealPolicy->VarDataOffset
A��a�oDataIK�NameUnsealPolicy->StructureSize
	A��a�oDataIK�NameUnsealPolicy->PolicyVersion

A��g�oDataOK�NameUnsealPolicy->PolicyHashLength
A��[�oDataCK�NameUnsealPolicy->WinloadSVN
A��_�oDataGK�NameUnsealPolicy->WinresumeSVN

A��[�oDataCK�NameUnsealPolicy->BootmgrSVN
A��Y�oDataAK�NameUnsealPolicy->LKeyPkgId

(p<pPp|p�pq8qdq�q�q

rHr�r�rs

8sStatusPcrMask,UnsealPolicyPdGuidDSealingProtectorFixedBufferSizeDSealingProtectorUsedBufferSize4SealedSecretBufferSize,PcrInfoArrayElCount0UnsealPolicy->Version<UnsealPolicy->VarDataOffset<UnsealPolicy->StructureSize<UnsealPolicy->PolicyVersionDUnsealPolicy->PolicyHashLength8UnsealPolicy->WinloadSVN<UnsealPolicy->WinresumeSVN8UnsealPolicy->BootmgrSVN4UnsealPolicy->LKeyPkgIdTEMP�u�
w��W\R��}Su�0��xD�	EventDataA��7�oDataK�NameStatus
A��E�oData-K�Name
ProtectorName
A��Y�oDataAK�NameSealedEncryptionKeySize
A��m�oDataUK�Name!ProtectorBlobFromUefiVariableSize
hu|u�u�uStatus ProtectorName4SealedEncryptionKeySizeHProtectorBlobFromUefiVariableSizeTEMPpwi�����[��y�i��r��$D�	EventDataA��5�oDataK�NamealgID
A��C�oData+K�NamedigestLength
A��;�oData#K�NamePcrIndex
A��;�oData#K�NamePcrValue
�w�w�wxalgID digestLengthPcrIndexPcrValueTEMP��y>ӎ�uoX���T��J���fD�	EventDataA��K�oData3K�NameCachedCopyStatus
A��Q�oData9K�NameKeyGenerationStatus
A��M�oData5K�NameSealAndSaveStatus
A��G�oData/K�NameUEFIKeysStatus
z4z`z�z(CachedCopyStatus,KeyGenerationStatus(SealAndSaveStatus$UEFIKeysStatusTEMP�����3_S4Z�!;�+��0D�	EventDataA��K�oData3K�NameCachedCopyStatus
A��Q�oData9K�NameKeyGenerationStatus
A��M�oData5K�NameSealAndSaveStatus
A��G�oData/K�NameUEFIKeysStatus
A��[�oDataCK�NameUnLatchedCiPolicyVersion

A��W�oData?K�NameLatchedCiPolicyVersion

A��i�oDataQK�NameLatchedAntiRollbackCounterValue

A��W�oData?K�NameCurrentCiPolicyVersion

A��i�oDataQK�NameCurrentAntiRollbackCounterValue

A��c�oDataKK�NameMinimumUnsealCiPolicyVersion
	
A��[�oDataCK�NameAuthorizationIsDelegated

��@�h�

��

Ā

��

<�

p�

��

�(CachedCopyStatus,KeyGenerationStatus(SealAndSaveStatus$UEFIKeysStatus8UnLatchedCiPolicyVersion4LatchedCiPolicyVersionDLatchedAntiRollbackCounterValue4CurrentCiPolicyVersionDCurrentAntiRollbackCounterValue@MinimumUnsealCiPolicyVersion8AuthorizationIsDelegatedTEMP�؂�*��T�X��Y�Y��\��xD�	EventDataA��W�oData?K�NameRetrieveDriverListTime



�4RetrieveDriverListTimeTEMPhX��L%�<:R��K�˴��D�	EventDataA��[�oDataCK�NameTpmSrkProvisioningStatus
A��W�oData?K�NameTpmSrkPolicyReadStatus
A��Y�oDataAK�NameTpmSrkSymKeyPolicyValue
A��W�oData?K�NameTpmSrkSymKeyCapability
A��M�oData5K�NameTpmSrkAesBitsUsed
A��[�oDataCK�NameTpmSrkAsymKeyPolicyValue
A��Y�oDataAK�NameTpmSrkAsymKeyCapability
A��M�oData5K�NameTpmSrkRsaBitsUsed
��0�d���̇�,�`�8TpmSrkProvisioningStatus4TpmSrkPolicyReadStatus4TpmSrkSymKeyPolicyValue4TpmSrkSymKeyCapability(TpmSrkAesBitsUsed8TpmSrkAsymKeyPolicyValue4TpmSrkAsymKeyCapability(TpmSrkRsaBitsUsedTEMP`��$�F�m�[�sY�����D�	EventDataA��W�oData?K�NameTpmSrkProvisioningTime

A��W�oData?K�NameTpmSrkPolicyReadStatus
A��Y�oDataAK�NameTpmSrkSymKeyPolicyValue
A��W�oData?K�NameTpmSrkSymKeyCapability
A��M�oData5K�NameTpmSrkAesBitsUsed
A��[�oDataCK�NameTpmSrkAsymKeyPolicyValue
A��Y�oDataAK�NameTpmSrkAsymKeyCapability
A��M�oData5K�NameTpmSrkRsaBitsUsed


\�����,�T�����4TpmSrkProvisioningTime4TpmSrkPolicyReadStatus4TpmSrkSymKeyPolicyValue4TpmSrkSymKeyCapability(TpmSrkAesBitsUsed8TpmSrkAsymKeyPolicyValue4TpmSrkAsymKeyCapability(TpmSrkRsaBitsUsedTEMP��.A�a�M�T��q�`����D�	EventDataA��c�oDataKK�NameTpmBindingProvisioningStatus
��@TpmBindingProvisioningStatusTEMP����Ea3�[���>B:���jD�	EventDataA��I�oData1K�NameLoadDriversTime



��$LoadDriversTimeTEMP,��.�=����W$ V^ϻп���D�	EventDataA��3�oDataK�NamePath
A��C�oData+K�NameLoadHiveTime

Ȑ

ؐPath LoadHiveTimeTEMP����Z�\�J�Z�d$���D�	EventDataA��U�oData=K�NameApplicationIdentifier
A��Q�oData9K�NameApplicationLoadTime

$�

T�0ApplicationIdentifier,ApplicationLoadTimeTEMP���L���/!~U1&�ݟ�)���D�	EventDataA��U�oData=K�NameApplicationIdentifier
A��[�oDataCK�NameApplicationExecutionTime

��

�0ApplicationIdentifier8ApplicationExecutionTimeTEMP$��,�L&�SY���������D�	EventDataA��7�oDataK�NameStatus
A��;�oData#K�NameFileName
�(�StatusFileNameTEMP4�x_T��U�]�x����D�	EventDataA��7�oDataK�NameStatus
A��C�oData+K�NameFailurePoint
@��0T�Status FailurePointTEMP��$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
�StatusTEMP�����a��R���>�������D�	EventDataA��7�oDataK�NameStatus
A��1�oDataK�NameTag
�(�StatusTagTEMP�ؘ�5	0�&U��H�v�%��pD�	EventDataA��O�oData7K�NameReserveDescriptors
�,ReserveDescriptorsTEMP�8���~��]ͽ'�1����D�	EventDataA��E�oData-K�Name
ApplicationId
A��;�oData#K�NameRunCount
A��=�oData%K�Name	PageCount

t���

�� ApplicationIdRunCountPageCountTEMP��s�Z�j��_��jz(�V(���D�	EventDataA��7�oDataK�NameStatus
A��9�oData!K�NameBlockId

��
̛StatusBlockIdTEMP����'v~�rPx�zx^X
V��rD�	EventDataA��Q�oData9K�NameFreePersistentPages



��,FreePersistentPagesTEMPD����*�P��
7`:o���D�	EventDataA��7�oDataK�NameStatus
A��K�oData3K�NameOutstandingCount

Н

�Status(OutstandingCountTEMP4|��/�L�
P\�z���d���:D�	EventDataA��7�oDataK�NameStatus
A��K�oData3K�NameOutstandingCount

A��M�oData5K�NameApplicationsCount
A��5�oDataK�NameAppId
�̟

��0�Status(OutstandingCount(ApplicationsCountAppIdTEMPh4�� ��N��YB�B���
���D�	EventDataA��E�oData-K�Name
ApplicationId
A��Q�oData9K�NameFreePersistentPages

\�

|� ApplicationId,FreePersistentPagesTEMP�ܢ��*?�S�Y��z\����D�	EventDataA��E�oData-K�Name
ApplicationId
A��9�oData!K�NameBlockId

A��Q�oData9K�NameFreePersistentPages

�
8�

L� ApplicationIdBlockId,FreePersistentPagesTEMP�����/��yTQ��lC\V���D�	EventDataA��E�oData-K�Name
ApplicationId
A��9�oData!K�NameBlockId

A��5�oDataK�NameFlags
̤

�� ApplicationIdBlockIdFlagsTEMP�(�݆��@:[%�ʼnD��Y���D�	EventDataA��7�oDataK�NameStatus
A��A�oData)K�NameRunsClaimed
A��=�oData%K�Name	PageCount

d�x�

��StatusRunsClaimedPageCountTEMP�T��'v~�rPx�zx^X
V��rD�	EventDataA��Q�oData9K�NameFreePersistentPages



h�,FreePersistentPagesTEMP8p�7!�~�Z�]��I)���D�	EventDataA��E�oData-K�Name
ApplicationId
A��9�oData!K�NameBlockId

��

�� ApplicationIdBlockIdTEMP�ة�r�e~SV��C.`J����D�	EventDataA��3�oDataK�NameType
A��5�oDataK�NameFlags
A��?�oData'K�Name
BufferSize
�$�4�TypeFlagsBufferSizeTEMP$ �s4y�[�X���—8���D�	EventDataA��;�oData#K�NameDiagCode
A��7�oDataK�NameStatus
�0H�`�DiagCodeStatusTEMP����E�{�wHX�}u�;G�����D�	EventDataA��7�oDataK�NameStatus
A��;�oData#K�NameDataSize
A��?�oData'K�Name
BufferSize
Ĭج�StatusDataSizeBufferSizeTEMPԭBRuu��T;CB��w����D�	EventDataA��5�oDataK�NamePhase
A��7�oDataK�NameStatus
���PhaseStatusTEMP�H�7C�{��S5�o/Q9����D�	EventDataA��7�oDataK�NameStatus
A��Q�oData9K�NameEnableDisableReason
A��=�oData%K�Name	VsmPolicy
��0���0įStatus,EnableDisableReasonVsmPolicyTEMP�ı����ݺB[���C~7���D�	EventDataA��?�oData'K�Name
LowAddress

A��A�oData)K�NameHighAddress

A��=�oData%K�Name	SkipBytes

A��?�oData'K�Name
TotalBytes

A��=�oData%K�Name	CacheType
A��5�oDataK�NameFlags

<�
X�
t�

������LowAddressHighAddressSkipBytesTotalBytesCacheTypeFlagsTEMP�X��s/��T1X��D>��RD�	EventDataA��1�oDataK�NameMdl
l�MdlTEMP�������L�X+I%��n�v��XD�	EventDataA��7�oDataK�NameSecure



�SecureTEMP�̴
+t�]��K~p���lD�	EventDataA��K�oData3K�NameSoftRestartCount
�(SoftRestartCountTEMPD�i%�O댘\@2���\����D�	EventDataA��K�oData3K�NameSoftRestartCount
A��7�oDataK�NameSecure

�

8�(SoftRestartCountSecureTEMP���c��U�@M�Ƒ���D�	EventDataA��G�oData/K�NameSequenceNumber
A��I�oData1K�NameDescriptorCount
A��YZ�ComplexData3K�NameMemoryDescriptor
�$�H�l�
��

��ĸ�$SequenceNumber$DescriptorCount(MemoryDescriptorBasePagePageCountMemoryTypeReservedTEMP�������Uߔ�镢���jD�	EventDataA��I�oData1K�NameDescriptorCount
��$DescriptorCountTEMP��w���0b�Y�G�N��}V���D�	EventDataA��7�oDataK�NameStatus
A��=�oData%K�Name	PageCount

A��?�oData'K�Name
MemoryType
A��?�oData'K�Name
Attributes
A��?�oData'K�Name
LowAddress

A��A�oData)K�NameHighAddress

4�

H�`�|�
��
��StatusPageCountMemoryTypeAttributesLowAddressHighAddressTEMP�H��5��?U�N><�E����BD�	EventDataA��7�oDataK�NameStatus
A��=�oData%K�Name	PageCount

A��?�oData'K�Name
MemoryType
A��?�oData'K�Name
Attributes
A��?�oData'K�Name
LowAddress

A��A�oData)K�NameHighAddress

A��=�oData%K�Name	Alignment
A��A�oData)K�NameProximityId
�

���0�
L�
h�����StatusPageCountMemoryTypeAttributesLowAddressHighAddressAlignmentProximityIdTEMP�L���/��TR��w���^D�	EventDataA��=�oData%K�Name	StartTime
`�StartTimeTEMPP�)5�H7^A����d����D�	EventDataTEMPP�)5�H7^A����d����D�	EventDataTEMP`4�8�^�Q2I�w+�*���D�	EventDataA��?�oData'K�Name
Identifier
A��A�oData)K�NamePartitionId
A��Q�oData9K�NameAllocatedBlockCount

A��M�oData5K�NameAllocatedRunCount

A��O�oData7K�NameAllocatedPageCount

A��7�oDataK�NameStatus
����

��

�

8�d�IdentifierPartitionId,AllocatedBlockCount(AllocatedRunCount,AllocatedPageCountStatusTEMP<T�w)ϻ�6^lV���Aw����D�	EventDataA��?�oData'K�Name
Identifier
A��A�oData)K�NamePartitionId
|���IdentifierPartitionIdTEMP����hl��N�Y&���hQO
���D�	EventDataA��?�oData'K�Name
Identifier
A��O�oData7K�NamePartitionPageCount

A��Q�oData9K�NameAllocatedBlockCount

A��M�oData5K�NameAllocatedRunCount

A��O�oData7K�NameAllocatedPageCount

A��7�oDataK�NameStatus
X�

t�

��

��

�� �Identifier,PartitionPageCount,AllocatedBlockCount(AllocatedRunCount,AllocatedPageCountStatusTEMP�\���޺�Vx�BDX|���D�	EventDataA��?�oData'K�Name
Identifier
A��O�oData7K�NamePartitionPageCount

A��7�oDataK�NameStatus
��

����Identifier,PartitionPageCountStatusTEMPl��R�;��RP˭���ث]���D�	EventDataA��?�oData'K�Name
Identifier
A��7�oDataK�NameStatus
A��?�oData'K�Name
NameLength
A��E�oData-K�Name
PartitoinName
A��K�oData3K�NameMemoryRangeCount
A��G�oData/K�NameMemorPageCount

A��M�oData5K�NameIoSpaceRangeCount
A��K�oData3K�NameIoSpacePageCount

A��]�oDataEK�NameAllocatedMemoryBlockCount

A��Y�oDataAK�NameAllocatedMemoryRunCount
	
A��[�oDataCK�NameAllocatedMemoryPageCount

A��_�oDataGK�NameAllocatedIoSpaceBlockCount

A��[�oDataCK�NameAllocatedIoSpaceRunCount

A��]�oDataEK�NameAllocatedIoSpacePageCount


�$�8�T�t�

����

��

�

H�

|�

��

��

(�IdentifierStatusNameLength PartitoinName(MemoryRangeCount$MemorPageCount(IoSpaceRangeCount(IoSpacePageCount8AllocatedMemoryBlockCount4AllocatedMemoryRunCount8AllocatedMemoryPageCount<AllocatedIoSpaceBlockCount8AllocatedIoSpaceRunCount8AllocatedIoSpacePageCountTEMP,4�d�i�dl�YUY�O�S����D�	EventDataA��?�oData'K�Name
Identifier
A��7�oDataK�NameStatus
\�x�IdentifierStatusTEMP� ���*)�R�#����.��`D�	EventDataA��?�oData'K�Name
Identifier
4�IdentifierTEMP L���o�L)�^*�v��w�����D�	EventDataA��?�oData'K�Name
Identifier
A��;�oData#K�NameRunCount
A��=�oData%K�Name	PageCount

A��7�oDataK�NameStatus
A��Q�oData9K�NamePartitionNameLength
A��E�oData-K�Name
PartitionName
����

���$�P�IdentifierRunCountPageCountStatus,PartitionNameLength PartitionNameTEMP8��1�"�S�XQ�ڥ6��jD�	EventDataA��?�oData'K�Name
Identifier
A��;�oData#K�NameRunCount
A��=�oData%K�Name	PageCount

A��I�oData1K�NameIoSpaceRunCount
A��K�oData3K�NameIoSpacePageCount

A��7�oDataK�NameStatus
A��Q�oData9K�NamePartitionNameLength
A��E�oData-K�Name
PartitionName
����

����

 �H�\���IdentifierRunCountPageCount$IoSpaceRunCount(IoSpacePageCountStatus,PartitionNameLength PartitionNameTEMP���09Q���S�����K&����D�	EventDataA��7�oDataK�NameStatus
A��?�oData'K�Name
ActualSize
A��C�oData+K�NameExpectedSize
��0�StatusActualSize ExpectedSizeTEMP�l��D RUW8Sҍ�Ƶ����D�	EventDataA��A�oData)K�NamePartitionId
A��;�oData#K�NameRunCount
A��=�oData%K�Name	PageCount

����

��PartitionIdRunCountPageCountTEMP$\��"��}f_�R��lhH��4D�	EventDataA��A�oData)K�NamePartitionId
A��;�oData#K�NameRunCount
A��=�oData%K�Name	PageCount

A��E�oData-K�Name
IoSpaceMemory

����

��

��PartitionIdRunCountPageCount IoSpaceMemoryTEMP���Wt�ȒIOZ���u�_N��xD�	EventDataA��A�oData)K�NamePartitionId
A��;�oData#K�NameRunCount

A��=�oData%K�Name	PageCount

A��E�oData-K�Name
IoSpaceMemory

A��=�oData%K�Name	Allocated

(�

D�

\�

t�

��PartitionIdRunCountPageCount IoSpaceMemoryAllocatedTEMP,���{cZ(�uZ,K�37J2���D�	EventDataA��;�oData#K�NameBasePage

A��=�oData%K�Name	PageCount


��

��BasePagePageCountTEMP�����HZ>�^�3Gjk�X���D�	EventDataA��A�oData)K�NameCommandCode
A��C�oData+K�NameResponseCode
A��S�oData;K�NameResponseMilliseconds

P�l�

��CommandCode ResponseCode0ResponseMillisecondsTEMP��;��{�R�^�
r%ʫ���*D�	EventDataA��A�oData)K�NameCommandCode
A��C�oData+K�NameResponseCode
A��S�oData;K�NameResponseMilliseconds

A��A�oData)K�NameCommandSize
A��A�oData)K�NameCommandData
A��C�oData+K�NameResponseSize
A��C�oData+K�NameResponseData
����

���0�L�l�CommandCode ResponseCode0ResponseMillisecondsCommandSizeCommandData ResponseSize ResponseDataTEMP���
��.�m�Z��z;l���D�	EventDataA��A�oData)K�NameCommandCode
A��=�oData%K�Name	ErrorCode
A��S�oData;K�NameResponseMilliseconds

���

0�CommandCodeErrorCode0ResponseMillisecondsTEMP�$��ecv�U�U���'*l}���D�	EventDataA��A�oData)K�NameCommandCode
A��=�oData%K�Name	ErrorCode
A��S�oData;K�NameResponseMilliseconds

A��A�oData)K�NameCommandSize
A��A�oData)K�NameCommandData
����

�����CommandCodeErrorCode0ResponseMillisecondsCommandSizeCommandDataTEMP���VC��SR�s�ġ����pD�	EventDataA��O�oData7K�NameFveGlobalDataFlags
��,FveGlobalDataFlagsTEMP l�_�2Y�?B�8��.D�	EventDataA��?�oData'K�Name
VendorGuid
A��C�oData+K�NameVariableName
A��?�oData'K�Name
Attributes
A��7�oDataK�NameStatus
�������VendorGuid VariableNameAttributesStatusTEMP����~�w
�^�ڴl�����dD�	EventDataA��C�oData+K�NameTxtErrorCode
�� TxtErrorCodeTEMP��t�0w�@Wf�#t�cg���D�	EventDataA��3�oDataK�NameBase

A��3�oDataK�NameSize


�
�BaseSizeTEMP����Mp�dnT!+���3���dD�	EventDataA��C�oData+K�NameBiosDataSize



�� BiosDataSizeTEMPt�n�p�;�WN=���"���D�	EventDataA��O�oData7K�NameAcmMinMleHeaderVer
A��K�oData3K�NameMleHeaderVersion
��,AcmMinMleHeaderVer(MleHeaderVersionTEMP�� U�)%�KQ�����"����D�	EventDataA��?�oData'K�Name
PmrLowBase

A��?�oData'K�Name
PmrLowSize

A��A�oData)K�NamePmrHighBase

A��A�oData)K�NamePmrHighSize

A��Q�oData9K�NameFirmwareProvidedAcm



h�

��

��

��

�PmrLowBasePmrLowSizePmrHighBasePmrHighSize,FirmwareProvidedAcmTEMPX��]�)A�_s`C�Af�� D�	EventDataA��M�oData5K�NameGetCapabilityTime

A��K�oData3K�NameGetResourcesTime

A��Y�oDataAK�NameResourcesValidationTime



��

��

�(GetCapabilityTime(GetResourcesTime4ResourcesValidationTimeTEMP����Gg�`6XRN�r��HJ��^D�	EventDataA��=�oData%K�Name	TxtStatus
(7��TxtStatusTEMP���ݞ���s\k�rT�O���D�	EventDataA��5�oDataK�NamePhase
A��?�oData'K�Name
StatusCode
A��K�oData3K�NameEnvironmentState
8�H�d�PhaseStatusCode(EnvironmentStateTEMP�L���05R���c'K3����D�	EventDataA��=�oData%K�Name	InitState
A��?�oData'K�Name
StatusCode
A��G�oData/K�NameFailureAddress

A��K�oData3K�NameReferenceAddress

A��?�oData'K�Name
ReasonCode
��
�
0InitStateStatusCode$FailureAddress(ReferenceAddressReasonCodeTEMP0���KknT׉�&�:���6D�	EventDataA��C�oData+K�NameSvnCounterId
A��?�oData'K�Name
StatusCode
A��;�oData#K�NameSvnValue
A��C�oData+K�NamePrevSvnValue
(D\ SvnCounterIdStatusCodeSvnValue PrevSvnValueTEMP<X�X�@EJ�Q8A�%�)2����D�	EventDataA��;�oData#K�NameSvnValue
A��C�oData+K�NamePrevSvnValue
��SvnValue PrevSvnValueTEMP�P��	͓^����؟����bD�	EventDataA��A�oData)K�NameSinitTimeMs



dSinitTimeMsTEMP4X9s��B�V݇���0,���D�	EventDataA��?�oData'K�Name
StatusCode
A��;�oData#K�NamePosition
��StatusCodePositionTEMP��p�5�g�\3�����W���D�	EventDataA��?�oData'K�Name
AcmDateDay
A��C�oData+K�NameAcmDateMonth
A��A�oData)K�NameAcmDateYear
	4	T	AcmDateDay AcmDateMonthAcmDateYearTEMP�
�Gg�`6XRN�r��HJ��^D�	EventDataA��=�oData%K�Name	TxtStatus
(7
TxtStatusTEMP�L���Og�]2e��{���D�	EventDataA��=�oData%K�Name	TxtStatus
A��=�oData%K�Name	Argument1

A��=�oData%K�Name	Argument2

(7�

�

�TxtStatusArgument1Argument2TEMP4
7�@��ir\��hZc�a��.D�	EventDataA��=�oData%K�Name	TxtStatus
A��A�oData)K�NamePolicyLevel
A��=�oData%K�Name	Argument1

A��=�oData%K�Name	Argument2

(7�
�


�


�
TxtStatusPolicyLevelArgument1Argument2TEMP�^p%`�$^U��l�T�?���D�	EventDataA��5�oDataK�NamePhase
A��7�oDataK�NameStatus
A��5�oDataK�NameTries
A��Q�oData9K�NameRemainingNodesCount
A��UZ�ComplexData/K�NameRemainingNodes
�,<P`���PhaseStatusTries,RemainingNodesCount$RemainingNodesNodeNumber$RemainingRangesTEMP<�YTɁ���T����H���D�	EventDataA��K�oData3K�NameAllocatedRegions
A��5�oDataK�NameTries
�(AllocatedRegionsTriesTEMP$��-��Dz[*��$������D�	EventDataA��?�oData'K�Name
PathLength
A��3�oDataK�NamePath
$@PathLengthPathTEMP��[�C4VZ��ss�	���bD�	EventDataA��A�oData)K�NameTryComplete



�TryCompleteTEMP�,�[��b��Q�,]��U�����D�	EventDataA��;�oData#K�NameFunction
A��7�oDataK�NameStatus
A��?�oData'K�Name
Checkpoint
h��FunctionStatusCheckpointTEMP<��H-"��m^�&��O�����D�	EventDataA��G�oData/K�NameDebuggerStatus
A��7�oDataK�NameStatus
8��$DebuggerStatusStatusTEMPP<)5�H7^A����d����D�	EventDataTEMP�.p�U��[t��MJ�����D�	EventDataA��9�oData!K�NameKeyType
A��3�oDataK�NameCode
,@KeyTypeCodeTEMPL4���<Q���<�����D�	EventDataA��E�oData-K�Name
DisableReason
A��C�oData+K�NameTcgLogStatus
\| DisableReason TcgLogStatusTEMP4tx_T��U�]�x����D�	EventDataA��7�oDataK�NameStatus
A��C�oData+K�NameFailurePoint
��Status FailurePointTEMP�h�i{�0W'D�d�����dD�	EventDataA��C�oData+K�NameMirrorStatus
| MirrorStatusTEMP�<��X4��rXr�.;�a���lD�	EventDataA��K�oData3K�NameMirrorPercentage
P(MirrorPercentageTEMPdh�M�L3�$\�G��̚����D�	EventDataA��I�oData1K�NameEfiTimeZoneBias
A��K�oData3K�NameEfiDaylightFlags
��$EfiTimeZoneBias(EfiDaylightFlagsTEMP��jt�t΀V�D(	z����D�	EventDataA��I�oData1K�NameEfiTimeZoneBias
A��K�oData3K�NameEfiDaylightFlags
A��9�oData!K�NameEfiTime
Hl�$EfiTimeZoneBias(EfiDaylightFlagsEfiTimeTEMP�"�Ig���R������>D�	EventDataA��5�oDataK�NamePages

A��?�oData'K�Name
MemoryType
A��?�oData'K�Name
Attributes
A��=�oData%K�Name	Alignment
A��7�oDataK�NameStatus
A��C�oData+K�NameRangeMinimum

A��C�oData+K�NameRangeMaximum

A��?�oData'K�Name
RangeFlags


�"�"�"##

0#

P#p#PagesMemoryTypeAttributesAlignmentStatus RangeMinimum RangeMaximumRangeFlagsTEMP�($�~f{��U�/��HXۂ��hD�	EventDataA��G�oData/K�NameIsolationLevel
<$$IsolationLevelTEMPD@%$ɿ��[�NA�6z����D�	EventDataA��K�oData3K�NameInformationClass
A��7�oDataK�NameStatus
h%�%(InformationClassStatusTEMP�8&v\����V�e��46���^D�	EventDataA��=�oData%K�Name	BcdOption
�8L&BcdOptionTEMP��&�Py��TU��R�RM���ZD�	EventDataA��9�oData!K�NameVersion
'VersionTEMP(�(W��,�FTTϞ*,H�H��4D�	EventDataA��7�oDataK�NameStatus
A��C�oData+K�NameFailurePoint
A��K�oData3K�NameUpdateStatusEnum
A��9�oData!K�NameFwLevel
�(�(�8)0)Status FailurePoint(UpdateStatusEnumFwLevelPRVAPX)Microsoft-Windows-Kernel-BootOPCO�.1�+2�+2�+����,H����@,L����d,N�����,O�����,X�����,Y�����,_�����,`����0-c����H-d����\-f����|-}�����-�����-H����.L����(.N����P.X����|.Y�����.`�����.d�����.}�����.L
���� /N
����P/Y
����p/L�����/N�����/L�����/L����0L����40L����P0L�����0L�����0L�����0L����1L����41L����h1L�����1L�����1L�����1L����2L����$2L����D2win:Infowin:Startwin:Stop0InitializationFailure$GetEfiVariable(TxtLaunchPreparedInitStatusOpenFailureBdEnabledAllocation8ListInitializationFailureKdEnabledTpmInit NotSupported0BlMmAllocationFailure(SbatUpdateSuccess0MeasurementsDisabled$SetEfiVariable(PreviousTxtError,EnterInsecureState BdInitFailure(AllocationFailure KdInitFailureEnabled(SbatUpdateFailure0InvalidTxtSinitRange DrtmSvnCheck(EnumerateFailure,InvalidTxtHeapRange$BootmgrSvnCheck$MleLoadFailure(MissingRsdpTableNoSinitAcm4ComputePmrRangesFailure<InvalidTxtHeapBiosDataSize$MleHeaderTooOld(SinitPerformance(PrepareLcpFailure4TxtRejectedFirmwareAcm$TxtInformation$TxtNotSupported8DrtmDriversNotSupportVbsPpamFailure SmmLevelCheck SmmIsolation,TxtSmmIsolationPerfLEVL�P�2P�2P�2win:Errorwin:Warning(win:InformationalTASK�k�����>�����>����?����8?����T?����t?�����?�����?	�����?
����@����X@�����@
�����@�����@����A����8A����hA�����A�����A�����A����B����(B����DB����\B�����B�����B����C����4C����XC����|C�����C �����C!�����C"�����C#����4D$����XD%�����D&�����D'�����D(����E)����@E*����xE+�����E,�����E-�����E.���� F/����PF0����|F1�����F2�����F3����G4����<G5����hG6�����G7�����G8�����G9�����G:����$H;����DH<����|H=�����H>�����H?�����H@����<IA����`IB�����IC�����ID�����IE�����IF���� JG����DJH����lJI�����JJ�����JK�����JL����KM����8KN����dKO����xKP�����KQ�����KR�����KS����$LT����XLU�����LV�����LW�����LX�����LY����MZ����0M[����XM\�����M]�����M^����N_����DN`����hNa�����Nb�����Nc����Od���� Oe����DOf����xOg�����Oh�����Ol�����Ot����8P}����hP(InitializeLibrary PrepareTarget4RebuildKernelMemoryMapFatalError PersistMemory0ClaimPersistedMemory,FreePersistedMemory,CleanupPageDatabaseCancelBoot@AttachPersistentPageDatabase,MemoryBlockRundown0BuildKernelMemoryMap GetMemoryMap<AllocatePhysicalPagesForMdl(ExecuteTransition0DisconnectHypervisor(MemoryMapRundown@PhysicalPageAllocationFailureBootManagerPreBoot(FirmwareBootDataLoadDriversLoadHive8BootApplicationExecution8WaitForPartitionsRestored4MemoryPartitionRestore4PersistMemoryPartition$RegisterLoader$SiPolicyFailureBootTotalIo(DirtyBootShutdown$BootMenuPolicyBootType8MemoryPartitionsRestored$QueryStatistics,ConnectSecureLoader$BootFileAccess4RetrieveDriverListTime8FreePersistedMemoryBlock,PrepareNotification8PartitionInitialAddMemory$ImageHashCheck,ImageIntegrityCheck,BootPolicyMigration,RemoveEnclavePages0EnumerateEnclavePages,GetSystemBootDevice4NormalizeBootOptionList4CreateLibraryParameters CreateDevices8SoftRestartHostCapability,CancelNotificationBootDiag(ImageLoadFailure,FirmwareResolution(BootEnvResolution(BootmgrEntryCount UserInputTime8VsmIdkProvisioningStatus$BootAppLoadTime0PrepareTargetFailure,VsmPolicyEnablement@InitializeMeasurementContext$KsrMeasurement$TpmMeasurement,CloseMeasurementLog,CommitPendingEventsCapTpmPcr,TpmCommandResponse$TpmSubmitError(TpmBitLockerUsage(EfiVariableAccess4GetFirmwareInformation$VerifyBootEntry(InvalidNfitTable$MeasuredLaunch,EFICapsuleCreationBootSIFileOpen(VsmPolicyFailure8VsmLKeyProvisioningStatus4SecureBootVariableUsage4MiniFilterStartFailure(FileModification0RegistryModificationSoftReboot$RegisterFilter BootDebugger IoSpaceMemory(FinalizeMemoryMapPRegisterHvloaderPersistenceInterface<LoadHvloaderForPersistence0VsmBootNoSecretsMode0BootMenuTimerCanceled$BadMemoryPages$KernelDebuggerDMemoryPartitionFreeUnusedMemory<MemoryPartitionRestoreStatsBootTpm$MemoryMirroring4EfiTimeZoneInformation(MemoryAllocation0FinalizeNotification(PersistBcdFailure@QuerySystemInformationFailure0SecureBootMitigationsSbatUpdateKEYW�
����`Q����|Q�����Q�����Q�����Q ���� R@����HR����hR�����R �����R@�����R������R4SSoftRestart,MemoryPreservation,MemoryBlockRundown$PhysicalMemory(MemoryMapRundown(MemoryPartitions EfiVariables$LOG_TO_BOOTSTAT0ms:ReservedKeyword40 ms:Telemetryms:Measures$ms:CriticalDatawin:SQMEVNT2�7@��=�2�8�.8@��=�29�.@�0?�2�.%@��?�2�6�. @��C�246P��.+(@�`E�)|2�7T��. @�xG�25\��.*(@�@H�)�2�7`��.	 @�I�2h��.
 �
�I|2l��.@� N�25�.R@��N�2�;�.
 @��P�2p��.@��Q�2�.@��R�2�.�<S|2�.��T|2t��.��U�2�.9�V�2(9�.��V�2�.��W�2P6�.�Y�2P6�.�`[�2�.�4\�2�.��\�2�.��\�2�. �$]�2l6�.��]�2x��.!�H^�2�6�.!�_�2�6�.����<:�2|��<S|2�.��T|2���.�8`�285�.@�dc�2�. :� d�2D9�.!(@!�e|2���."(@"�Tf|2���.#( #��g|2��/$@$��h�2�.%(@%�lj|2���.&6( &��k|2�8��/'  '�@n|2��/(  (��o|2��/)  )�8p|2��/*( *��p|2��/+( +�tr|2��/, ,��s|2Ȃ/-; -��s�2`9/.&@�,��27�./@���2T5�.0@�̏�2p5�.1 1��l|26/2Q 2��v|2�;/2Q 2��}|2�;/2Q 2�(�|2�;/2Q 2�\�|2�;/3Q 3��v�2�;/3Q 3��}�2�;/3Q 3�(��2�;/3Q 3�\��2�;/4<@����2|9�.5@����2�5�.6@��|2�.7=@�@�|2�9�.8@�t�|2̂�.9 9� �|2/: :����2/; ;��|2/<K <��)�2 ;/=L@����@��)�2<;Ђ�.>L >�(�x*|2<;Ԃ/?
L@�������*|2<;؂�.@L@�������*|2<;܂�.AL@����t�+|2<;��.BL@����t�+|2<;��.CL@����t� +|2<;��.DL@�����8+|2<;��.EL@�����D+|2<;��.FL@����t�,+|2<;��.GO����B�)�2�;HL@����t�\+|2<;���.IL I��h+�2<;/JQ J� x|2�;/JQ J��z|2�;/KQ K� x�2�;/KQ K��z�2�;/LX����*�2�<MX������*�2�<N`������*�2l=O`����$*�2l=Q Q��2/SQ S����2�;/TQ T�x��2�;/UQ U���2�;/VQ V��2�;/WQ W��7|2�;/XQ X��J�2�;/YQ Y��h�2�;/ZQ Z�ls�2�;/[Q [�v�2�;/d�����)�23��d����x��)�23�e����t��)�23�f�����)�2$3�f����,��)�2$3�f������)�2$3�g����t��)�2$3�h����4��)�2@3�i����t��)�2@3�j������)�2x3 �k����Ě�)�2x3$�l����t��)|2\3(�m������)�2�30�n����t��)�2�38�o����@��)�2�3@�p����t��)�2�3D�q����x��)�2�3H�r������)�2�3L�s	�s���)�2�3P��.t	�tt��)�2�3T��.u
�����)�24X�v
����t��)�24`�w�������)�2 4h�x�����)�2<4l�y����t��)�2<4p�z
����̨�)�2X4t�{
����t��)�2X4x�|PH�|�|2�;|��.~	����ܯ�)�2t4��	����в�)�2t4����������)�2�4��������)�2�4�������L��)�2�4��������)�2�4����������)�2�4���	 ����й�)|2�4��/�	 ����м�)|2�4��/������)�2�5��������)�2�5��� ��Ȝ�)|2�3��/� ����)|2�3ȃ/�����x��)�2�5Ѓ��������)�2�5؃�����4��)�2�5���������)�2�5�� ��`��)|2�5�/��������)�2�5�������P��)�2�5������p��)�2�5�� �����)|2�5�/�"����t��)�2�6��#�����)�2�6��#����t��)�2�6 ��$ ��t��)|2�6$�/�'�������)�207(��'����t��)�207,��(�����)�2L70��(����t��)�2L74��(����(��)�2L78��) ����P��)�2h7<��) �������)�2h7@��) ������)�2h7D��) ����t��)�2h7H��>�� ��2�9�.�, ��t��)�2�7/�, ��t��)�2�7/��� ��2�.�5��P��2�8L��5 ��P�|2�8P�/�-�������)�2�7T��4����t��)�2�8X��4����t��)�2�8\��/ ����t��)|28`�/�0 ����t��)|2,8d�/�1 ����t��)|2H8h�/� ����t��)|23l�/�2 ����t��)|2d8p�/�3 ����t��)|2�8t�/�. ����t��)|2�7x�/�? ����t��)|2�9|�/�? ������)|2�9��/�@ ��t��)|2�9��/�A ��t��)|2:��/�B ��t��)|2$:��/�C ����t��)|2@:��/�D ����t��)|2\:��/�D ����t��)|2\:��/� ����t��)|23��/�H@������)�2�:���H@�����l*�2�:���I ����t��)|2�:��/�J ����t��)|2;��/�W ��t��)�2p<��/�
Y ����t��*|2�<��/�_ ����t�*|2P=��/�?����P`*�2�9���h ��t�|2L>��/�E@�����)�2x:�.�E@�����)�2x:�.�F �����)|2�:Ą/�F ��`��)|2�:Ȅ/�G@��$��)|2�:�.�M�����)�2X;̄�M����t��)�2X;Є�N@����)�2t;�.�N �����*|2t;Ԅ/�
N ��L�*|2t;/�L ���P+�2<;/�S ����t��)|2<؄/�T@��,�)�2<܄�.�U@��,�)�28<��.�V��P�)�2T<��.�V��t��)�2T<��.�V���)�2T<��.�V��t��)�2T<��.�V��|2T<��.�L ���t+�2<;/�L ��p	�+�2<;/�L���+|2<;�.�L��0
�+|2<;�.�Y �����
�*|2�</�Y �����*�2�</�] ����)�2=/�Z�����)�2�<���Z�����)�2�<��Z����t��)|2�<��[����t��)|2�<��\����t��)|2�<��^ ��<�)�24=�/�a����x��)�2�=��a������)�2�=��b������)�2�=$��c ���0*|2�=,�/�L ����+�2<;/�d ���<*|2�=/�e���x�)�2�=�.�e����)�2�=�.�f@�����H*�2>�.�g�����)�20>0��g����t��)�20>4��L���#�+�2<;�.�d ����*�2�=/�L@������+�2<;�.�l ����`$|2h>8�/t ��%�2�>/N�|�*|2t;<��.t �d&�2�>/t �d&�2�>/#}  #�'T*�2�>@�/$}  $�'�*|2�>D�/ QQ Q QQ Q Q Q QQQPQQQ QQ QQ QQ QQ Q Q Q QQ QQ QQQQQQQQQQQQQQ�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�PQ0Q�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�PQQ�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�P�PQQ�P�PQ�P�P�P�P�P�P�P�P�P�P�P�P�P�PQ�P�P�P�P�P�PQ�P�P�PQ Q QWEVT�; ���
(�x������CHANp������TMicrosoft-Windows-Kernel-File/AnalyticTTBL )TEMP�L����[�xdS�2iY���
��D�	EventDataA��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��E�oData-K�Name
CreateOptions
A��K�oData3K�NameCreateAttributes
A��A�oData)K�NameShareAccess
A��;�oData#K�NameFileName
؈����8�`�|�IrpThreadIdFileObject CreateOptions(CreateAttributesShareAccessFileNameTEMP8��>���_Ql%x�t%����D�	EventDataA��?�oData'K�Name
ByteOffset

A��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��7�oDataK�NameIOSize
A��9�oData!K�NameIOFlags

4�P�\�t�������ByteOffsetIrpThreadIdFileObjectFileKeyIOSizeIOFlagsTEMP���a��RR!Y�-�%���D�	EventDataA��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��K�oData3K�NameExtraInformation
A��=�oData%K�Name	InfoClass
(�4�L�h�|���IrpThreadIdFileObjectFileKey(ExtraInformationInfoClassTEMP`�����RXZ��t�K����D�	EventDataA��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��K�oData3K�NameExtraInformation
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameFilePath
p�|�������IrpThreadIdFileObjectFileKey(ExtraInformationInfoClassFilePathTEMP�t�9�k���R�BC�K&���"D�	EventDataA��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��7�oDataK�NameLength
A��=�oData%K�Name	InfoClass
A��=�oData%K�Name	FileIndex
A��;�oData#K�NameFileName
� �8�T�h�|�����IrpThreadIdFileObjectFileKeyLengthInfoClassFileIndexFileNameTEMP��[��ҟ�hQou����D�	EventDataA��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
d�p�����IrpThreadIdFileObjectFileKeyTEMP����ԋR�W�!ssx��D�	EventDataA��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��I�oData1K�NameIssuingThreadId
A��E�oData-K�Name
CreateOptions
A��K�oData3K�NameCreateAttributes
A��A�oData)K�NameShareAccess
A��;�oData#K�NameFileName
������ԛ��8�IrpFileObject$IssuingThreadId CreateOptions(CreateAttributesShareAccessFileNameTEMP���ު��N[�^�kљ9و���2D�	EventDataA��?�oData'K�Name
ByteOffset

A��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��I�oData1K�NameIssuingThreadId
A��7�oDataK�NameIOSize
A��9�oData!K�NameIOFlags
A��?�oData'K�Name
ExtraFlags

X�t�������ԟ���ByteOffsetIrpFileObjectFileKey$IssuingThreadIdIOSizeIOFlagsExtraFlagsTEMP��ty��:[�PW�<����D�	EventDataA��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��K�oData3K�NameExtraInformation
A��I�oData1K�NameIssuingThreadId
A��=�oData%K�Name	InfoClass
����������IrpFileObjectFileKey(ExtraInformation$IssuingThreadIdInfoClassTEMPxX��Z�Q��	U�K�n?�,��D�	EventDataA��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��K�oData3K�NameExtraInformation
A��I�oData1K�NameIssuingThreadId
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameFilePath
��� �H�l���IrpFileObjectFileKey(ExtraInformation$IssuingThreadIdInfoClassFilePathTEMP��t�욷�X_������0D�	EventDataA��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��I�oData1K�NameIssuingThreadId
A��7�oDataK�NameLength
A��=�oData%K�Name	InfoClass
A��=�oData%K�Name	FileIndex
A��;�oData#K�NameFileName
����ȩܩ��,�D�IrpFileObjectFileKey$IssuingThreadIdLengthInfoClassFileIndexFileNameTEMP����]�@L,Xӑ�2��\��(D�	EventDataA��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��I�oData1K�NameIssuingThreadId
��0�D�IrpFileObjectFileKey$IssuingThreadIdTEMP�����-�IT�S��BD����D�	EventDataA��1�oDataK�NameIrp
A��K�oData3K�NameExtraInformation
A��7�oDataK�NameStatus
��ȭ�Irp(ExtraInformationStatusTEMP$Ԯ��`Ӓ��],��Ӛ����D�	EventDataA��9�oData!K�NameFileKey
A��;�oData#K�NameFileName
���FileKeyFileNamePRVAP<�Microsoft-Windows-Kernel-FileOPCO01��win:InfoLEVL@P��(win:InformationalTASK$
����������̲�����
��������������� �����0�����@�����d�����|�����������������������ܳ��������������$�����@�����\�����x������������� ����ȴ!�����"������NameCreateNameDeleteCreateCleanupCloseReadWrite$SetInformationSetDeleteRenameDirEnumFlush(QueryInformationFSCTL OperationEndDirNotifyDeletePathRenamePathSetLinkPathSetLink CreateNewFileSetSecurity QuerySecuritySetEAQueryEAKEYW�	������ �����@����$������`�����������Զ���������P�������@KERNEL_FILE_KEYWORD_FILENAME<KERNEL_FILE_KEYWORD_FILEIO<KERNEL_FILE_KEYWORD_OP_END<KERNEL_FILE_KEYWORD_CREATE8KERNEL_FILE_KEYWORD_READ8KERNEL_FILE_KEYWORD_WRITEDKERNEL_FILE_KEYWORD_DELETE_PATHTKERNEL_FILE_KEYWORD_RENAME_SETLINK_PATHLKERNEL_FILE_KEYWORD_CREATE_NEW_FILEEVNT�+

���������������������������������������,����������������,� ���

 ���������H�(���

 �����\�����H�,��� �����Ė����d�0��� �����\�����d�4��� �������������8��� �����P�������@��� �������������H��� �����P�������P��� �����̌������X��� ������������\��� �����̌����԰`��� ����������԰d��� �����̌�����h��� �����������l��� �����������p��� ������������t��� �����Ė����(�x��� �����\�����(�|��� �����̌����D����� ����������D����� �����̌����`����� ����������`�����`�����h�����|����� ���������������� ���������������������������������������$����������������������б���������$�����б�������������������������$���������� �����̌��������� �������������������������$����������������$���� ����������@����   ����������\����!! ����������x����"" �����������������(�H�(�H�(�(�(�(�(�X�(�X�(�h�(�h�(�(�(�(�(�(�(�(�(�(�(�(�(�(�(�8�(�(�x�x���������(�(�����(�(�(�(�WEVT� �
����4�����CHANd<�����HMicrosoft-Windows-PCI/DiagnosticPRVA@��Microsoft-Windows-PCIOPCO01�win:InfoLEVL@P�(win:InformationalTASKP
����\�(AspmErrataRundownKEYW,������DiagEVNTD

�������@���,���WEVT�,�	L�4���
��<���������CHAN�x��������\Microsoft-Windows-Kernel-StoreMgr/Analytic`Microsoft-Windows-Kernel-StoreMgr/OperationalMAPS�l�H�VMAP$����VMAP$����4CacheTerminationMsgMap8StoreMgrCorruptPageMsgMapTTBL� TEMP|��w��49�-T��O[T!����lD�	EventDataA��9�oData!K�NameDataKey
A��9�oData!K�NameDataMgr
A��A�oData)K�NameStoreOffset
A��G�oData/K�NameCompressedSize
A��5�oDataK�NameFlags
� �4�P�t�DataKeyDataMgrStoreOffset$CompressedSizeFlagsTEMP�����` �U�E3�C�����D�	EventDataA��9�oData!K�NameDataKey
A��9�oData!K�NameDataMgr
A��A�oData)K�NameStoreOffset
�����DataKeyDataMgrStoreOffsetTEMPt	��U�81��P{G]\��-���D�	EventDataA��;�oData#K�NameStoreKey
A��C�oData+K�NameStoreFileKey
A��A�oData)K�NameUserDataMgr
A��A�oData)K�NameMetadataMgr
A��?�oData'K�Name
RegionSize
A��A�oData)K�NameRegionCount
A��=�oData%K�Name	BlockSize
A��?�oData'K�Name
SectorSize
A��O�oData7K�NameEncryptionStrength
A��=�oData%K�Name	StoreType
	A��9�oData!K�NameStoreId
A��C�oData+K�NameBlocksStored
A��C�oData+K�NameRegionsInUse
A��G�oData/K�NameTotalSpaceUsed

A��5�oDataK�NameFlags
A��I�oData1K�NameMetaRegionCount
A��K�oData3K�NameMetaRegionsInUse
A��S�oData;K�NameMetaRegionsSpaceUsed
A��=�oData%K�Name	StoreTime
T�l������������0�\�t����������� �H�x�StoreKey StoreFileKeyUserDataMgrMetadataMgrRegionSizeRegionCountBlockSizeSectorSize,EncryptionStrengthStoreTypeStoreId BlocksStored RegionsInUse$TotalSpaceUsedFlags$MetaRegionCount(MetaRegionsInUse0MetaRegionsSpaceUsedStoreTimeTEMP� ��4�d*�cS�Ս&w)�t��\D�	EventDataA��;�oData#K�NameStoreKey
4�StoreKeyTEMP�������_Ql6��a� ��D�	EventDataA��9�oData!K�NameDataMgr
A��G�oData/K�NameVirtualAddress
A��I�oData1K�NamePhysicalAddress

A��3�oDataK�NameSize
A��?�oData'K�Name
FileBacked
A��G�oData/K�NameCorruptionType
A��5�oDataK�NameFlags
�$�
H�l�H�|�����DataMgr$VirtualAddress$PhysicalAddressSizeFileBacked$CorruptionTypeFlagsTEMP�t����v�z]���	8XIG��rD�	EventDataA��9�oData!K�NameDataMgr
A��A�oData)K�NameRegionIndex
A��7�oDataK�NameStatus
A��=�oData%K�Name	SpaceUsed
A��G�oData/K�NameLastAccessTime
������4�DataMgrRegionIndexStatusSpaceUsed$LastAccessTimeTEMP@���B��ZR�-))��>D�	EventDataA��?�oData'K�Name
FailReason
A��?�oData'K�Name
FailStatus
A��K�oData3K�NameObjectPathLength
A��?�oData'K�Name
ObjectPath
�8�T�|�FailReasonFailStatus(ObjectPathLengthObjectPathTEMP\�Kz�?�pY�ޔaB@�d���D�	EventDataA��3�oDataK�NameSize
A��3�oDataK�NameData
����SizeDataTEMPx����(߀09S���	6����D�	EventDataA��;�oData#K�NameStoreKey
A��3�oDataK�NameSize
A��3�oDataK�NameData
�����StoreKeySizeDataTEMP��R0qTBV��) ���D�	EventDataA��;�oData#K�NameStoreKey
A��5�oDataK�NameParam
�(�StoreKeyParamTEMPLH��Y�q�U���������D�	EventDataA��7�oDataK�NameReason
A��?�oData'K�Name
FailStatus
A��K�oData3K�NameDeviceDescLength
A��M�oData5K�NameDeviceDescription
A��K�oData3K�NameObjectPathLength
A��?�oData'K�Name
ObjectPath
l��������@�h�ReasonFailStatus(DeviceDescLength(DeviceDescription(ObjectPathLengthObjectPathTEMP`L���Ǎ��Y<��������D�	EventDataA��9�oData!K�NameSqmType
A��G�oData/K�NameSqmSessionGuid
A��5�oDataK�NameSqmID
A��O�oData7K�NameSqmStreamRowLength
A��QZ�ComplexData+K�NameSqmStreamRow
����$�4�`�������SqmType$SqmSessionGuidSqmID,SqmStreamRowLength SqmStreamRow SqmTypeEntry SqmDWORDEntry$SqmStringEntryPRVAX��Microsoft-Windows-Kernel-StoreMgrOPCOx1l�2��2��win:Infowin:Startwin:StopLEVL@P��(win:InformationalTASK���������������������,�����H�����h�������������	������
���������������4�
����P�����l�������������������StoreAddStoreRemoveStoreCreateStoreDelete StoreRundown$StoreCorruption(StorePageRundownRegionEvictRegionWrite(UnpersistFailure StoreIoStatsGlobalStatsStoreEmpty RegionRelease RegionCompact RegionRundown(CacheTerminationKEYW�����@�@����X������p�4��StoreOpsStoreDiag0StoreContentsRundownwin:SQMEVNT�������H����X�X��������H����\�X�������H���8�`�X��������H���T�d�X�������H���p�h�X�P@�L�H�����l�h��������H�����t�X��������H�����x�X�		�������H�����|�X�

P@�X�H�������h��������H������X��������H���4���X�

������H���P���X��������H���l���X��������T�������X��������`�������X���������H�������X�P@�8�H�������h������������������ ����������� ���0�WEVT�������
H��������0�TTBLPTEMPD|��͟�,�Vo�9��{���BD�	EventDataA��9�oData!K�NameSqmType
A��G�oData/K�NameSqmSessionGuid
A��5�oDataK�NameSqmID
A��W�oData?K�NameSqmDWORDDatapointValue
������SqmType$SqmSessionGuidSqmID4SqmDWORDDatapointValuePRVA`\�Microsoft-Windows-Kernel-LicensingSqmOPCOLEVL@P��(win:InformationalTASKKEYW04�win:SQMEVNTD�������p��WEVT|F������8�
�/80�0�0�3h5CHANt������XMicrosoft-Windows-Kernel-Memory/AnalyticTTBL�;TEMP�

�!5
.)]���Z�����^D�	EventDataA��G�oData/K�NamePriorityLevels
A��E�oData-K�Name
ZeroPageCount
A��E�oData-K�Name
FreePageCount
A��M�oData5K�NameModifiedPageCount
A��[�oDataCK�NameModifiedNoWritePageCount
A��C�oData+K�NameBadPageCount
A��M�oData5K�NameStandbyPageCounts
�A��S�oData;K�NameRepurposedPageCounts
�A��]�oDataEK�NameModifiedPageCountPageFile
A��O�oData7K�NamePagedPoolPageCount
	A��U�oData=K�NameNonPagedPoolPageCount
A��C�oData+K�NameMdlPageCount
A��I�oData1K�NameCommitPageCount
�� �@�h�������P�|����$PriorityLevels ZeroPageCount FreePageCount(ModifiedPageCount8ModifiedNoWritePageCount BadPageCount(StandbyPageCounts0RepurposedPageCounts8ModifiedPageCountPageFile,PagedPoolPageCount0NonPagedPoolPageCount MdlPageCount$CommitPageCountTEMPp�R���n.R����H����D�	EventDataA��5�oDataK�NameCount
A��QZ�ComplexData+K�NameWSCommitInfo
�`�p��������$�Count WSCommitInfoProcessID,WorkingSetPageCount$CommitPageCount,VirtualSizeInPages<PrivateWorkingSetPageCountTEMP$
D�R���n.R����H����D�	EventDataA��5�oDataK�NameCount
A��QZ�ComplexData+K�NameWSCommitInfo
�<T���8\Count WSCommitInfoProcessID,WorkingSetPageCount$CommitPageCount,VirtualSizeInPages<PrivateWorkingSetPageCount,StoreSizePageCount$StoredPageCount(CommitDebtInPagesTEMPdhR���n.R����H����D�	EventDataA��5�oDataK�NameCount
A��QZ�ComplexData+K�NameWSCommitInfo
�D	Tt���Dp��Count WSCommitInfoProcessID,WorkingSetPageCount$CommitPageCount,VirtualSizeInPages<PrivateWorkingSetPageCount,StoreSizePageCount$StoredPageCount(CommitDebtInPages,SharedCommitInPagesTEMP����?"~�[&
�S�%�\���D�	EventDataA��5�oDataK�NameCount
A��_Z�ComplexData9K�NameSessionWSCommitInfo
�dt���4Count,SessionWSCommitInfoSessionId,WorkingSetPageCount$CommitPageCount,PagedPoolPageCount<PrivateWorkingSetPageCountTEMP<
`��?"~�[&
�S�%�\���D�	EventDataA��5�oDataK�NameCount
A��_Z�ComplexData9K�NameSessionWSCommitInfo
�(	8	d	|	�	�	�	4
`
�
Count,SessionWSCommitInfoSessionId,WorkingSetPageCount$CommitPageCount,PagedPoolPageCount<PrivateWorkingSetPageCount,StoreSizePageCount$StoredPageCount(CommitDebtInPagesTEMP|���?"~�[&
�S�%�\���D�	EventDataA��5�oDataK�NameCount
A��_Z�ComplexData9K�NameSessionWSCommitInfo
�x	����
H
�
�
�
�
Count,SessionWSCommitInfoSessionId,WorkingSetPageCount$CommitPageCount,PagedPoolPageCount<PrivateWorkingSetPageCount,StoreSizePageCount$StoredPageCount(CommitDebtInPages,SharedCommitInPagesTEMP���)m���N_}݉�T3n��^D�	EventDataA��=�oData%K�Name	ProcessId
�ProcessIdTEMP ��de�^��<3�����D�	EventDataA��=�oData%K�Name	ProcessId
A��5�oDataK�NameFlags
��ProcessIdFlagsTEMP�(�tMO%�XRVw�*�����D�	EventDataA��=�oData%K�Name	ProcessId
A��7�oDataK�NameStatus
A��G�oData/K�NamePagesProcessed
d|�ProcessIdStatus$PagesProcessedTEMP�����USg�\zY�4.��D�	EventDataA��=�oData%K�Name	ProcessId
A��7�oDataK�NameStatus
A��G�oData/K�NamePagesProcessed
A��_�oDataGK�NameWriteCombinePagesProcessed
A��W�oData?K�NameUncachedPagesProcessed
A��Q�oData9K�NameCleanPagesProcessed
h����(ProcessIdStatus$PagesProcessed<WriteCombinePagesProcessed4UncachedPagesProcessed,CleanPagesProcessedTEMP$$�V]���])&�l�Q|{���D�	EventDataA��=�oData%K�Name	ProcessId
A��7�oDataK�NameStatus
LdProcessIdStatusTEMP�bP���P���J&� ���ZD�	EventDataA��9�oData!K�NameAcgFlag
AcgFlagTEMP8������Z�v��N˝���jD�	EventDataA��W�oData?K�NameDurationInMicroseconds

A��?�oData'K�Name
TotalBytes

A��?�oData'K�Name
LowAddress

A��A�oData)K�NameHighAddress

A��=�oData%K�Name	SkipBytes

A��S�oData;K�NameMemoryDescriptorList
A��=�oData%K�Name	IdealNode
A��5�oDataK�NameFlags


p

�
�
�
�@X4DurationInMicrosecondsTotalBytesLowAddressHighAddressSkipBytes0MemoryDescriptorListIdealNodeFlagsTEMPd

��s��cR��5���Ͻ��D�	EventDataA��W�oData?K�NameDurationInMicroseconds

A��?�oData'K�Name
TotalBytes

A��?�oData'K�Name
LowAddress

A��A�oData)K�NameHighAddress

A��;�oData#K�NameBoundary

A��I�oData1K�NamePhysicalAddress

A��E�oData-K�Name
MappedAddress
A��M�oData5K�NameAllocatedFromPool

A��G�oData/K�NameProtectionMask
A��E�oData-K�Name
PreferredNode
	

|

�
�
�
 
 @ 

` � � 4DurationInMicrosecondsTotalBytesLowAddressHighAddressBoundary$PhysicalAddress MappedAddress(AllocatedFromPool$ProtectionMask PreferredNodeTEMP<4%eر��4Q��˭A�Am��2D�	EventDataA��W�oData?K�NameDurationInMicroseconds

A��?�oData'K�Name
TotalBytes

A��?�oData'K�Name
LowAddress

A��A�oData)K�NameHighAddress

A��;�oData#K�NameBoundary

A��I�oData1K�NamePhysicalAddress

A��E�oData-K�Name
MappedAddress
A��G�oData/K�NameProtectionMask
A��E�oData-K�Name
PreferredNode
A��A�oData)K�NamePartitionId
	A��1�oDataK�NameTag
A��5�oDataK�NameFlags
A��M�oData5K�NameAllocatedFromPool

A��W�oData?K�NameAllocatedFromExtension




L&

�&
�&
�&
�&
�&'0'T't'�'�'

�'

�'4DurationInMicrosecondsTotalBytesLowAddressHighAddressBoundary$PhysicalAddress MappedAddress$ProtectionMask PreferredNodePartitionIdTagFlags(AllocatedFromPool4AllocatedFromExtensionTEMP
8)�깗x��S���њ���D�	EventDataA��A�oData)K�NamePartitionId
A��5�oDataK�NameCount
A��UZ�ComplexData/K�NameMemoryNodeInfo
�<*X*
h*�*�*�*�*$+P+|+�+�+�+PartitionIdCount$MemoryNodeInfoNodeNumber$TotalPageCount,SmallFreePageCount,SmallZeroPageCount,MediumFreePageCount,MediumZeroPageCount,LargeFreePageCount,LargeZeroPageCount(HugeFreePageCount(HugeZeroPageCountTEMP�T-�깗x��S���њ���D�	EventDataA��A�oData)K�NamePartitionId
A��5�oDataK�NameCount
A��UZ�ComplexData/K�NameMemoryNodeInfo
��-�-.0.L.p.�.PartitionIdCount$MemoryNodeInfoNodeNumber$TotalPageCount(HugeFreePageCount(HugeZeroPageCountTEMP$�/-��0_��1������D�	EventDataA��A�oData)K�NameBaseAddress
A��3�oDataK�NameSize
�/�/BaseAddressSizePRVAT�/Microsoft-Windows-Kernel-MemoryOPCOx1h02�02�0win:Infowin:Startwin:StopLEVL@P�0(win:InformationalTASK�����02����D2����\2�����2�����2�����2�����2����3	����$3
����@3����l3MemInfoMemInfoWS(MemInfoSessionWS(WorkingSetOutSwap(WorkingSetInSwapAcg MdlAllocation$ContAllocationMemInfoNode,MemInfoHugeIoSpaceContFreeKEYW� �����3@����,4�����l4�����4�����4����$5<KERNEL_MEM_KEYWORD_MEMINFO@KERNEL_MEM_KEYWORD_MEMINFO_EX<KERNEL_MEM_KEYWORD_WS_SWAP4KERNEL_MEM_KEYWORD_ACGHKERNEL_MEM_KEYWORD_PHYSICAL_ALLOCDKERNEL_MEM_KEYWORD_MEMINFO_NODEEVNT� �����D�D0�0�0�9��@������D0�01�9��@�����`�D0�01�9��@������D0�01�9��@������D0�041�9��@�����pD0�041�9��@������
D0�041�9��������(P0�0P1�9���������P0�0P1�9��������\0�0P1�9���������\0�0P1�9��������(P0�0l1�9���������P0�0l1�9��������T\0�0l1�9�������xD0�0�1�9��	������TD0�0l1�9��
�����0D0�0�1�9�������hD0�0�1�9�������� D0�0�1�9��	�����(D0�0�1�9��

�����$,D0�0�1�9��������.D0�02�9���3�3�3�3�3�3�3�3�3�3�3�3�3�3�3�3�3�3�3�3�3�3WEVT�6�	H:�;�<
<i�i�iTj`j8lCHAN\�:�����:�@;����XMicrosoft-Windows-Kernel-ShimEngine/DebugdMicrosoft-Windows-Kernel-ShimEngine/OperationaldMicrosoft-Windows-Kernel-ShimEngine/DiagnosticMAPS��;�;VMAP$L<��VMAP$<��LKSE:DeviceFlagApplied.FlagSourceMapLKSE:DriverShimApplied.ShimSourceMapTTBL�,TEMP4|=Z~�B ;�\�Y�q�h:���D�	EventDataA��9�oData!K�NameEventId
A��C�oData+K�NameDebugMessage
�=�=EventId DebugMessageTEMP(@?�%oM���]�@/Hxɫ��4D�	EventDataA��?�oData'K�Name
DriverName
A��?�oData'K�Name
ShimSource
A��=�oData%K�Name	ShimCount
A��C�oData+K�NameAppliedGuids
�?�;�?�?�?DriverNameShimSourceShimCount AppliedGuidsTEMP`A-
U&O�SA����4��*D�	EventDataA��?�oData'K�Name
DeviceName
A��A�oData)K�NameDeviceClass
A��?�oData'K�Name
FlagSource
A��5�oDataK�NameFlags

�A�A�;�A

BDeviceNameDeviceClassFlagSourceFlagsTEMP��C�N��_���ք������D�	EventDataA��?�oData'K�Name
DriverName
A��?�oData'K�Name
DriverBase
A��?�oData'K�Name
DriverSize
A��I�oData1K�NameDriverTimeStamp
A��G�oData/K�NameDriverCheckSum
8DTDpD�D�DDriverNameDriverBaseDriverSize$DriverTimeStamp$DriverCheckSumTEMPD�Eef2�_�Ǎ;�vB���D�	EventDataA��C�oData+K�NameDriverObject
A��?�oData'K�Name
DriverBase
�E�E DriverObjectDriverBaseTEMPd@HO]S��Rx�������D�	EventDataA��?�oData'K�Name
DriverBase
A��?�oData'K�Name
DriverSize
A��C�oData+K�NameDriverObject
A��1�oDataK�NamePdo
A��7�oDataK�NameStatus
A��A�oData)K�NameServiceName
A��?�oData'K�Name
HardwareId
�H�HI$I0IDI`IDriverBaseDriverSize DriverObjectPdoStatusServiceNameHardwareIdTEMP0�J�<au2Pۜ�]i���DD�	EventDataA��9�oData!K�NameAddress
A��7�oDataK�NameCaller
A��3�oDataK�NameType
A��3�oDataK�NameSize
A��1�oDataK�NameTag
XKlK�K�K�KAddressCallerTypeSizeTagTEMPt�Le�5��J]Y���9����D�	EventDataA��9�oData!K�NameAddress
A��7�oDataK�NameCaller
A��1�oDataK�NameTag
�LMMAddressCallerTagTEMP|(N��k,H�lZ.�7u1�n:���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
dN�N�N DriverObjectFdoIrpTEMP�P��h؂iAQ��՜����D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��?�oData'K�Name
DeviceType
A��U�oData=K�NameDeviceCharacteristics
A��=�oData%K�Name	Exclusive
A��7�oDataK�NameStatus
Q(Q4QPQ�Q�Q DriverObjectFdoDeviceType0DeviceCharacteristicsExclusiveStatusTEMPT8S���ܐ�_���R����VD�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��=�oData%K�Name	MajorCode
A��7�oDataK�NameStatus
�S�S�S�S�S DriverObjectFdoIrpMajorCodeStatusTEMPT�Uw����RĚ�pȧ'��VD�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��=�oData%K�Name	MinorCode
A��7�oDataK�NameStatus
�UVV(V@V DriverObjectFdoIrpMinorCodeStatusTEMP��W�b6wm+^��>��.���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��7�oDataK�NameStatus
�WXX$X DriverObjectFdoIrpStatusTEMP��Y�b6wm+^��>��.���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��7�oDataK�NameStatus
�Y�Y�YZ DriverObjectFdoIrpStatusTEMP80\��g��cQ胉� �o8���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��=�oData%K�Name	MinorCode
A��=�oData%K�Name	PowerType
A��?�oData'K�Name
PowerState
A��7�oDataK�NameStatus
�\�\�\�\]$]@] DriverObjectFdoIrpMinorCodePowerTypePowerStateStatusTEMP8h_��g��cQ胉� �o8���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��=�oData%K�Name	MinorCode
A��=�oData%K�Name	PowerType
A��?�oData'K�Name
PowerState
A��7�oDataK�NameStatus
�_` `,`D`\`x` DriverObjectFdoIrpMinorCodePowerTypePowerStateStatusTEMP�\bb}}����_�G��&Sv����D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��=�oData%K�Name	MinorCode
A��?�oData'K�Name
PowerState
A��7�oDataK�NameStatus
�b�bcc$c@c DriverObjectFdoIrpMinorCodePowerStateStatusTEMP��d�b6wm+^��>��.���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��7�oDataK�NameStatus
�dee$e DriverObjectFdoIrpStatusTEMP��f�N��_���ք������D�	EventDataA��?�oData'K�Name
DriverName
A��?�oData'K�Name
DriverBase
A��?�oData'K�Name
DriverSize
A��I�oData1K�NameDriverTimeStamp
A��G�oData/K�NameDriverCheckSum
\gxg�g�g�gDriverNameDriverBaseDriverSize$DriverTimeStamp$DriverCheckSumTEMPD�hef2�_�Ǎ;�vB���D�	EventDataA��C�oData+K�NameDriverObject
A��?�oData'K�Name
DriverBase
i i DriverObjectDriverBasePRVA\PiMicrosoft-Windows-Kernel-ShimEngineOPCO01�iwin:InfoLEVL�P�iPj[8jwin:Error(win:Informationalwin:VerboseTASKKEYW������j����k����@k����lk�����k�����k�����k ����l(ShimEngineEvents,ShimEngineMessages,DriverScopeGeneral$DriverScopePnp(DriverScopePower$DriverScopeIrps$DriverScopePool4SkipDriverUnloadGeneralEVNTD������<�iT:������<�iT:@��=�i�id:@�@�i�id: @����8e�i8pd: @�����g�i<pd:
 ����B�i@pt: �����D�iDpt: ����F�iHpt:
 ����|I�iLpt: �����K�iPpt: ���� M�iTpt: �����N�iXpt: �����Q�i\pt: ����T�i`pt: ����TV�idpt: ����8X�ihpt: ����Z�ilpt: ����T]�ippt: �����`�itpt: ����Tc�ixpt:�j�j�j�j�j�j�j�j�j�j�j�j�j�j�j�j�jWEVTl�
�p@qLq�q�q�qPRVA��pMicrosoft-Windows-Kernel-Licensing-StartServiceTriggerOPCOLEVL@Pdq(win:InformationalTASKKEYWEVNT@����XqWEVTX����0r
�rs0s�s`tptCHANxLr����\Microsoft-Windows-Kernel-IoTrace/DiagnosticPRVAX�rMicrosoft-Windows-Kernel-IoTraceOPCO01swin:InfoLEVLhPTs[|s(win:Informationalwin:VerboseTASK������s����t����4t$UserInitiatedIoKernelIo,ActivityIdTransferKEYWEVNT������s<s�s<r�����sHs�s<r�����sHs�s<r�����s<s�s<rWEVT�o��uxw
 �|�������CHAN��u	�v�dv�����v����w����Application\Microsoft-Windows-AppModel-Runtime/AnalyticXMicrosoft-Windows-AppModel-Runtime/AdminXMicrosoft-Windows-AppModel-Runtime/DebugdMicrosoft-Windows-AppModel-Runtime/DiagnosticsTTBL�I)TEMPHhx��U�%T�d<�
�����D�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
�x�xErrorCode$PackageFullNameTEMPt�z'$�vS�^a�[.�������D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��I�oData1K�NameParentProcessID
A��I�oData1K�NamePackageFullName
A��=�oData%K�Name	ImageName
A��c�oDataKK�NamePackageRelativeApplicationId
l{�{�{�{�{|ProcessIDCreateTime$ParentProcessID$PackageFullNameImageName@PackageRelativeApplicationIdTEMP�l}zsS��&]����%Ǚ���D�	EventDataA��I�oData1K�NamePackageFullName
A��=�oData%K�Name	ErrorCode
A��C�oData+K�NameErrorMessage
�}�}�}$PackageFullNameErrorCode ErrorMessageTEMP�0}��s!t
^�p�v�W���D�	EventDataA��I�oData1K�NamePackageFullName
A��=�oData%K�Name	ErrorCode
A��C�oData+K�NameFailedBinary
l��$PackageFullNameErrorCode FailedBinaryTEMP�\�?~�v|�Uj��]�4���^D�	EventDataA��=�oData%K�Name	ErrorCode
p�ErrorCodeTEMP@�������wZۉML-e�����D�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��3�oDataK�NameSize

A��7�oDataK�NameOffset
A��?�oData'K�Name
HeaderAddr
A��9�oData!K�NameSection
A��=�oData%K�Name	ProcessId
,�D�

\�l�������FileNameErrorCodeSizeOffsetHeaderAddrSectionProcessIdTEMP����2Ol�T�>��6�����D�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��3�oDataK�NameSize

A��?�oData'K�Name
HeaderAddr
A��9�oData!K�NameSection
A��=�oData%K�Name	ProcessId
�0�

H�X�t���FileNameErrorCodeSizeHeaderAddrSectionProcessIdTEMP����/Q}�Q����B����D�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��3�oDataK�NameSize

A��?�oData'K�Name
HeaderAddr
A��W�oData?K�NameApplicationUserModelId
A��=�oData%K�Name	ProcessId
�(�

@�P�l���FileNameErrorCodeSizeHeaderAddr4ApplicationUserModelIdProcessIdTEMPpP�&�8#}�NX[V��PpK���dD�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��3�oDataK�NameSize

A��?�oData'K�Name
HeaderAddr
A��=�oData%K�Name	ProcessId
��̋

���FileNameErrorCodeSizeHeaderAddrProcessIdTEMP�@�R�n#�V�!�qT����D�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��=�oData%K�Name	ProcessId
|�����FileNameErrorCodeProcessIdTEMP<�����DI�]���jzXK���D�	EventDataA��;�oData#K�NameFileName
A��E�oData-K�Name
ExceptionCode
Ȏ�FileName ExceptionCodeTEMP�T�B��
��;V ,��1~���D�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��3�oDataK�NameType
A��=�oData%K�Name	ProcessId
����Ԑ�FileNameErrorCodeTypeProcessIdTEMPH��uSQk�Xޱt!֝6A���D�	EventDataA��I�oData1K�NamePackageFullName
A��=�oData%K�Name	ErrorCode
�,�$PackageFullNameErrorCodeTEMP��}4j�n��]l���=�0��$D�	EventDataA��I�oData1K�NamePackageFullName
A��1�oDataK�NameKey
A��7�oDataK�NameSubkey
A��=�oData%K�Name	ErrorCode
���0�$PackageFullNameKeySubkeyErrorCodeTEMP��}4j�n��]l���=�0��$D�	EventDataA��I�oData1K�NamePackageFullName
A��1�oDataK�NameKey
A��7�oDataK�NameSubkey
A��=�oData%K�Name	ErrorCode
�� �4�$PackageFullNameKeySubkeyErrorCodeTEMP��}4j�n��]l���=�0��$D�	EventDataA��I�oData1K�NamePackageFullName
A��1�oDataK�NameKey
A��7�oDataK�NameSubkey
A��=�oData%K�Name	ErrorCode
��$�8�$PackageFullNameKeySubkeyErrorCodeTEMPP8�	�p\k��&�����D�	EventDataA��M�oData5K�NamePackageFamilyName
A��=�oData%K�Name	ErrorCode
`���(PackageFamilyNameErrorCodeTEMP(t��c��+U���w�6p����D�	EventDataA��=�oData%K�Name	ErrorCode
A��9�oData!K�NameContext
����ErrorCodeContextTEMP(���c��+U���w�6p����D�	EventDataA��=�oData%K�Name	ErrorCode
A��9�oData!K�NameContext
ěܛErrorCodeContextTEMP���?~�v|�Uj��]�4���^D�	EventDataA��=�oData%K�Name	ErrorCode
��ErrorCodeTEMP�P��&؍1�
U)��;߸C��lD�	EventDataA��K�oData3K�NameAppContainerName
d�(AppContainerNameTEMP�,�t+=D{��Q
��m����jD�	EventDataA��I�oData1K�NamePackageFullName
@�$PackageFullNameTEMPHH� ����2B[&�Ŧ�]$���D�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
p���ErrorCode$PackageFullNameTEMP,���ˀf��S �t�:sV����D�	EventDataA��=�oData%K�Name	ErrorCode
A��;�oData#K�NameResource
����ErrorCodeResourceTEMP,���ˀf��S �t�:sV����D�	EventDataA��=�oData%K�Name	ErrorCode
A��;�oData#K�NameResource
ԡ�ErrorCodeResourceTEMPH� ����2B[&�Ŧ�]$���D�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
�(�ErrorCode$PackageFullNameTEMP�h�ر`n���[m��,l��.���D�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
A��3�oDataK�NameUser
�����ErrorCode$PackageFullNameUserTEMPHl�uBԘ|Xl��%�{�Z��FD�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
A��E�oData-K�Name
DesiredStatus
A��E�oData-K�Name
CurrentStatus
��Ԧ���ErrorCode$PackageFullName DesiredStatus CurrentStatusTEMP�p��~��uB�YĴ��z�E��D�	EventDataA��I�oData1K�NamePackageFullName
A��E�oData-K�Name
DesiredStatus
A��E�oData-K�Name
CurrentStatus
��Ш�$PackageFullName DesiredStatus CurrentStatusTEMP�Ī��^�m�Q���w�
���D�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
A��3�oDataK�NameUser
A��E�oData-K�Name
DesiredStatus
A��E�oData-K�Name
CurrentStatus
(�@�d�t���ErrorCode$PackageFullNameUser DesiredStatus CurrentStatusTEMP4$��9%�'S��`Zdv{���<D�	EventDataA��I�oData1K�NamePackageFullName
A��3�oDataK�NameUser
A��E�oData-K�Name
DesiredStatus
A��E�oData-K�Name
CurrentStatus
t�����ȭ$PackageFullNameUser DesiredStatus CurrentStatusTEMP(���c��+U���w�6p����D�	EventDataA��=�oData%K�Name	ErrorCode
A��9�oData!K�NameContext
���ErrorCodeContextTEMP���ü��V�]6�D����zD�	EventDataA��=�oData%K�Name	ProcessID
A��A�oData)K�NamePackageName
A��=�oData%K�Name	ImageName
A��I�oData1K�NameApplicationName
A��9�oData!K�NameMessage
$�<�X�p���ProcessIDPackageNameImageName$ApplicationNameMessageTEMP�X���6���RSX�˜����zD�	EventDataA��A�oData)K�NamePackageName
A��=�oData%K�Name	ImageName
A��I�oData1K�NameApplicationName
A��=�oData%K�Name	ErrorCode
A��9�oData!K�NameMessage
��س��,�PackageNameImageName$ApplicationNameErrorCodeMessageTEMP�l��n#Ύ��X��sk�	�����D�	EventDataA��A�oData)K�NamePackageName
A��E�oData-K�Name
ContainerName
A��A�oData)K�NameContainerId
��ĵ�PackageName ContainerNameContainerIdTEMP�$�C|3*C�uVo���.}+���D�	EventDataA��=�oData%K�Name	ProcessID
A��A�oData)K�NamePackageName
A��A�oData)K�NameContainerId
`�x���ProcessIDPackageNameContainerIdTEMP �z`y�-'1T��x¤�r���2D�	EventDataA��=�oData%K�Name	ErrorCode
A��=�oData%K�Name	ProcessID
A��A�oData)K�NamePackageName
A��A�oData)K�NameContainerId
h�������ErrorCodeProcessIDPackageNameContainerIdTEMP����vgz!XX_�HT
"I���D�	EventDataA��=�oData%K�Name	ErrorCode
A��A�oData)K�NamePackageName
A��E�oData-K�Name
ContainerName
4�L�h�ErrorCodePackageName ContainerNameTEMP@h��O�L�W�ּY=���D�	EventDataA��A�oData)K�NamePackageName
A��A�oData)K�NameContainerId
����PackageNameContainerIdTEMP�h��Cg�6hT���v#��E��lD�	EventDataA��]�oDataEK�NameCleanupContainerErrorCode
A��W�oData?K�NameMakeTemporaryErrorCode
A��A�oData)K�NamePackageName
A��A�oData)K�NameContainerId
���$�@�8CleanupContainerErrorCode4MakeTemporaryErrorCodePackageNameContainerIdTEMP�������V�?d�qz����D�	EventDataA��I�oData1K�NamePackageFullName
A��E�oData-K�Name
ApplicationId
A��;�oData#K�NamePsmFlags

��
�$PackageFullName ApplicationIdPsmFlagsPRVA\4�Microsoft-Windows-AppModel-RuntimeOPCOT2��2��win:Startwin:StopLEVL�U�P,�PD�P`� win:Criticalwin:Errorwin:Warning(win:InformationalTASK����������������������@�������������d�����e����`�f������g������h����(�i����h��������������������������@���������������0AppModelProcessStartHAppIntegrityDependencyGraphCheck<AppIntegrityProcessCreationHAppIntegrityInAppValidatePackageLAppModelDynamicPropertiesReadFailedHAppModelDynamicPropertiesInvalidDRestrictedAppContainerCreationDRestrictedAppContainerDeletion<RestrictedAppContainerOpenHRestrictedAppContainerEnumeration@RestrictedAppContainerLaunchLRestrictedAppContainerTerminateAll0AppContainerCreation0AppContainerDeletion,AppContainerUpdate@FirewallAppContainerCreation@FirewallAppContainerDeletionXRestrictedAppContainerUpdateCapabilitiesKEYW������������4� ����d�@�������������Process AppContainer,DesktopAppXProcess0DesktopAppXContainer0ms:ReservedKeyword40 ms:Telemetryms:Measures$ms:CriticalDataEVNTl�@��x���u@ �@|���u@ �@|���u@ �@|���u@ �@|�$��u@ �@|�,��u �@|�4��u �~�8��u		�	~�<��u �~�@��u ���D��u ����H��u �ȃ�L��u ����P��u ����T��u �(��X��u �č�\��u@ �@|�`��u@ ����h��u ����p��u ����t��u ����x��u ����|��u �������u �������u �������u �������u �������u ������u   �������u! !������u" "������u# #������u$ $������u% %������u& &������u' '�������u( (�������u) )�������u* *�������u+ +�������u, ,�������u- -�������u. .������u/ /������u0 0�������u1 1�������u2 2�������u3 3�������u4 4�������u5 5�������u6 6�������u7 7�������u8 8�������u9 9�d�����u: :�d����u; ;�d����u< <������u=@ =�@|���u> >�d����u? ?������u@ @�ؠ���uA A��� ��uB B�L��$��uC C���(��uD D�8��,��uE E���0��uF F����4��uG G���8��uHH��<��uI I�@|�@��uJ J���D��uK K����H��uL L�D��L��uM M�H��P��uN N�L��T��uO  O�P��X��uP  P�P��`��uQ Q��w�h��ue�e��������l��uf�f��������p��ug�g�������t��uh�h�������x��ui�i�������|��uj�j����������uk�k������8����ul�l�Ț���8����um�m������T����un�n�Ț���T����uodo������<����updp�Ț���<����uqeq������X����urer�Ț���X����usfs������t����utft�Ț���t����uugu�����������uvgv�Ț��������uwhw�����������uxhx�Ț��������uyiy�����������uziz�Ț��������u{{�����������u||�d���������u}}�����������u~~�d���������u�����������u���d���������u���������8����u���������p����u����Ț���p����u� �������u� ��������u� ��������u� ��������u� ��������u� ��������u� �������u� �������u� �������u� ��@����u� ������u� �������u� ��й���u� ��й���u� ��й� ��u� ��й�$��u� �����(��u� ��ȼ�,��u� ��\��0��u$�$���$���$���$���$���$�$�$�$�$�$�$�$�$�$�$�$���4���4�4�4�4�4�4�4�4�4�4�4�4�4�4�4�4�4�4�4�4�4�$�$�$�$�$�$�$�$�$�$�$�$�$�$�$�$�$�$�$���$�$�$�$�$�$�$�$�$�$�$�$�$�$�$�$�$�$�t�$�t�$�4�4�4�4�4�4�4�4�4�4�4�4�4�4�4�4�4�4�4�4�4�4�$�$�$�$�$�$�4�4�4�D�D�D�D�D�D�D�D�D�T�T�T�T�T�T�T�T�T�D�WEVT?�����
0�����h��H
CHAN��	����0��ApplicationTMicrosoft-Windows-AppModel-State/Debug\Microsoft-Windows-AppModel-State/DiagnosticTTBL�
TEMP�@�!��5�"0W�
P�څ���rD�	EventDataA��Q�oData9K�NameInformationalString
T�,InformationalStringTEMP(T�v��(8\�$������D�	EventDataA��A�oData)K�NameErrorString
A��5�oDataK�NameError
|���ErrorStringErrorTEMP�������br�RiM1$U�����D�	EventDataA��C�oData+K�NameFolderString
A��E�oData-K�Name
PackageString
A��5�oDataK�NameError
�$�D� FolderString PackageStringErrorTEMP�l�p���p[&Xp�� T�����D�	EventDataA��E�oData-K�Name
PackageString
A��9�oData!K�NameUserSid
A��5�oDataK�NameError
������ PackageStringUserSidErrorTEMP��v��k�T�l/�;c���D�	EventDataA��=�oData%K�Name	Operation
A��E�oData-K�Name
PackageFamily
A��G�oData/K�NameOperationError
T�l���Operation PackageFamily$OperationErrorTEMP\4�hyVb��X\x�5y�f/��ND�	EventDataA��=�oData%K�Name	Operation
A��E�oData-K�Name
PackageFamily
A��G�oData/K�NameOperationError
A��O�oData7K�NameRepairTriggerError
��������Operation PackageFamily$OperationError,RepairTriggerErrorTEMP$���mQ�5�Qj�8!~��C���D�	EventDataA��?�oData'K�Name
FolderPath
A��5�oDataK�NameError
� �FolderPathErrorPRVAXD�Microsoft-Windows-AppModel-StateOPCOT2��2��win:Startwin:StopLEVL�P�P$�P@�win:Errorwin:Warning(win:InformationalTASK�+����(�����p�����������������P����������������8�d����|�e�����f����\�g�����h����L�i�����j����d�k������l������m�����n������o����(�p������q����Pr�����s����|t����u�����v����4w�����x����\y�����z����|{����|�����}���� ~���������<�����������T	������	�����l
������
�����,�����|HAppModel.Task.State.WriteSettingDAppModel.Task.State.ReadSettingHAppModel.Task.State.DeleteSettingTAppModel.Task.State.WriteSettingInAtomPAppModel.Task.State.ReadSettingInAtomTAppModel.Task.State.DeleteSettingInAtomDAppModel.Task.State.CommitAtomDAppModel.Task.State.LoadAppHivelAppModel.Task.StateWinRT.AppDataFactory_ActivationtAppModel.Task.StateWinRT.ApplicationDataServer_LifespanxAppModel.Task.StateWinRT.ApplicationDataServer_GetVersionxAppModel.Task.StateWinRT.ApplicationDataServer_SetVersion�AppModel.Task.StateWinRT.ApplicationDataServer_RoamingStorageQuota�AppModel.Task.StateWinRT.ApplicationDataServer_RoamingStorageUsage�AppModel.Task.StateWinRT.ApplicationDataServer_ActivateContainerServer�AppModel.Task.StateWinRT.ApplicationDataServer_ActivateFileItemServer�AppModel.Task.StateWinRT.ApplicationDataContainerServer_Lifespan�AppModel.Task.StateWinRT.ApplicationDataContainerServer_GetValues�AppModel.Task.StateWinRT.ApplicationDataContainerServer_GetContainers�AppModel.Task.StateWinRT.ApplicationDataContainerServer_CreateContainer�AppModel.Task.StateWinRT.ApplicationDataContainerServer_DeleteContainer�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Lifespan�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Lookup�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Size�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_HasKey�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_GetView�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Insert�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Remove�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Clear�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_First�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Lifespan�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Lookup�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Size�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_HasKey�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_GetView�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Insert�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Remove�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Clear�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_FirstXAppModel.Task.StateWinRT.RoamingRpcSignalhAppModel.Task.StateWinRT.DataChangedEventDispatchPAppModel.Task.StateWinRT.TempCleanuptAppModel.Task.StateWinRT.ApplicationDataServer_ForUserKEYWTl���� �1
Structured(UnstructuredResetOutOfMemoryApiSetErrorWinRT$DataStoreError(win:ResponseTimeEVNTl@�����!��@�����!��@����!��@������!�� @������!��@����@����@�������	@	�����
	�
������	�������	�������
	�
������@�T����@�T����@�T����@�T����@������@�������	�������	�������	������	�������	�������2 �������t��!��3 �������t��!��< ����������!��= ����������!��F ����������!��G ����������!��P ����������!��Q ����������!��Z ����������!��[ ����������!��d ���������!��e ��������"��n ��������"��o ��������"��x �������8�"��y �������8�$"���d �������T�,"���d �������T�4"���e �������p�<"���e �������p�D"���f ���������L"���f ���������T"���g ���������\"���g ���������d"���h ���������l"���h ���������t"���j ���������|"���j ����������"���k ���������"���k ���������"���l �������4��"���l �������4��"���m �������P��"���m �������P��"���n �������l��"���n �������l��"��o ����������"��o ����������"��p ����������"��p ����������"��q ����������"��q ����������"��"r ����������"��#r ���������#��,s ���������#��-s ���������#��6t ��������#��7t ��������$#��@u �������0�,#��Au �������0�4#��Jv �������L�<#��Kv �������L�D#��Tw �������h�L#��Uw �������h�T#��^x ���������\#��_x ���������d#��hy ���������l#��iy ���������t#��rz ���������|#��sz ����������#��|{ ���������#��}{ ���������#���| ���������#���| ���������#���} ���������#���} ���������#���~ �������,��#���~ �������,��#��� �������H��#��� �������H��#���� �������d��#���� �������d��#���� ����������#���� ����������#���� ����������#���� ���������$���� ���������$���� ���������$���� ��������$���� ��������$$���� ��������,$���� ��������4$���� ��������<$���� ��������D$��,L�\�\�\�\�\�\�\�\�\�\�\�\�\�\�\�\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\WEVTl�
�$%%\%h%x%PRVA��$Microsoft-Windows-Kernel-WSService-StartServiceTriggerOPCOLEVL@P4%(win:InformationalTASKKEYWEVNT@����(%WEVT�	&�&('
�/$0�0(1�12CHAN�<&��&�TMicrosoft-Windows-Kernel-IO/OperationalSystemMAPS��&VMAP4�&����@IoMgrDmpEncryptionFailureMapTTBL�TEMP�`(�~�b?P��\�X^����D�	EventDataA��?�oData'K�Name
VolumeGuid
A��K�oData3K�NameVolumeNameLength
A��?�oData'K�Name
VolumeName
�(�(�(VolumeGuid(VolumeNameLengthVolumeNameTEMP(d*3n�d���TX�¶?�,���4D�	EventDataA��?�oData'K�Name
VolumeGuid
A��K�oData3K�NameVolumeNameLength
A��?�oData'K�Name
VolumeName
A��5�oDataK�NameError
�*�*�*+VolumeGuid(VolumeNameLengthVolumeNameErrorTEMPT,A���Ug���f����D�	EventDataA��K�oData3K�NameFilterNameLength
A��?�oData'K�Name
FilterName
4,\,(FilterNameLengthFilterNameTEMPX�-�E���]�y��9щw��JD�	EventDataA��K�oData3K�NameFilterNameLength
A��?�oData'K�Name
FilterName
A��K�oData3K�NameVolumeNameLength
A��?�oData'K�Name
VolumeName
H.p.�.�.(FilterNameLengthFilterName(VolumeNameLengthVolumeNameTEMP�/n��	Y�ώ)@b.����D�	EventDataA��a�oDataIK�NameDumpEncryptionFailureReason
�&�/<DumpEncryptionFailureReasonPRVAL�/Microsoft-Windows-Kernel-IOOPCOx1T02l02�0win:Infowin:Startwin:StopLEVL�P�0P�0P1win:Errorwin:Warning(win:InformationalTASK�����l1�����1VolumeMount,LoadBootHotPatchesKEYWd�����1����2 VolumeMountsHotPatchEVNT���4'<0�041�3&��4'H0�041�3&���(H0�041�3&�@�$+00�0,&�@�x,00�0,&�@��.00�0,&����<0�0P1�3����H0�0P1�3�1�1�1�1�1WEVT�OL4�4
|o�o$vdv�x�xCHAN�84M�4\Microsoft-Windows-Kernel-LiveDump/Analytic`Microsoft-Windows-Kernel-LiveDump/OperationalTTBL�:TEMP4�7��W�#5]e��b�����ZD�	EventDataA��;�oData#K�NameNTStatus
A��C�oData+K�NameBugcheckCode
A��O�oData7K�NameBugCheckParameter1
A��O�oData7K�NameBugCheckParameter2
A��O�oData7K�NameBugCheckParameter3
A��O�oData7K�NameBugCheckParameter4
A��U�oData=K�NameAbortIfMemoryPressure
848T8�8�8�89NTStatus BugcheckCode,BugCheckParameter1,BugCheckParameter2,BugCheckParameter3,BugCheckParameter40AbortIfMemoryPressureTEMPX8;E���*S\=Pu�����D�	EventDataA��q�oDataYK�Name#NtEstimatedRequiredPrimaryDataBytes

A��a�oDataIK�NameNtEstimatedPrimaryDataBytes

A��a�oDataIK�NameHvEstimatedPrimaryDataBytes

A��e�oDataMK�NameHvEstimatedSecondaryDataBytes



�;

�;

<

L<LNtEstimatedRequiredPrimaryDataBytes<NtEstimatedPrimaryDataBytes<HvEstimatedPrimaryDataBytes@HvEstimatedSecondaryDataBytesTEMP��Ap���o�[�BpZ�������D�	EventDataA��q�oDataYK�Name#NtEstimatedRequiredPrimaryDataBytes

A��a�oDataIK�NameNtEstimatedPrimaryDataBytes

A��a�oDataIK�NameHvEstimatedPrimaryDataBytes

A��e�oDataMK�NameHvEstimatedSecondaryDataBytes

A��a�oDataIK�NameSkEstimatedPrimaryDataBytes

A��a�oDataIK�NameMemoryEstimationDuration_ms

A��]�oDataEK�NameSystemQuiescedDuration_ms

A��e�oDataMK�NameEndMirroringPhasesDuration_ms

A����oDatakK�Name,TotalMirrorPhysicalMemoryCallbackDuration_ms

A��w�oData_K�Name&TotalMirrorPhysicalMemoryCallbackBytes
	
A��q�oDataYK�Name#HvlCalculateLiveDumpSizeDuration_ms



�B

�B

C

PC

�C

�C

D

@D

�D

�D

4ELNtEstimatedRequiredPrimaryDataBytes<NtEstimatedPrimaryDataBytes<HvEstimatedPrimaryDataBytes@HvEstimatedSecondaryDataBytes<SkEstimatedPrimaryDataBytes<MemoryEstimationDuration_ms8SystemQuiescedDuration_ms@EndMirroringPhasesDuration_ms`TotalMirrorPhysicalMemoryCallbackDuration_msTTotalMirrorPhysicalMemoryCallbackBytesLHvlCalculateLiveDumpSizeDuration_msTEMP�Fe����[�$`����� D�	EventDataA��O�oData7K�NameNtPrimaryDataBytes

A��O�oData7K�NameHvPrimaryDataBytes

A��S�oData;K�NameHvSecondaryDataBytes



G

<G

hG,NtPrimaryDataBytes,HvPrimaryDataBytes0HvSecondaryDataBytesTEMP$�JL����[�^暔��:����D�	EventDataA��O�oData7K�NameNtPrimaryDataBytes

A��O�oData7K�NameHvPrimaryDataBytes

A��S�oData;K�NameHvSecondaryDataBytes

A��O�oData7K�NameSkPrimaryDataBytes

A��g�oDataOK�NameAllocateDumpBuffersDuration_ms

A��i�oDataQK�NameAllocateExtraBuffersDuration_ms

A��y�oDataaK�Name'HvlPrepareLivedumpDescriptorDuration_ms



,K

XK

�K

�K

�K

$L

hL,NtPrimaryDataBytes,HvPrimaryDataBytes0HvSecondaryDataBytes,SkPrimaryDataBytesDAllocateDumpBuffersDuration_msDAllocateExtraBuffersDuration_msTHvlPrepareLivedumpDescriptorDuration_msTEMPl�N_M3���+Yٺ_�Õ)m���D�	EventDataA��;�oData#K�NameNTStatus
A��?�oData'K�Name
TotalBytes

A��A�oData)K�NameHeaderBytes

A��K�oData3K�NamePrimaryDataBytes

A��O�oData7K�NameSecondaryDataBytes

A��S�oData;K�NameDumpWriteDuration_ms

TO

lO

�O

�O

�O

�ONTStatusTotalBytesHeaderBytes(PrimaryDataBytes,SecondaryDataBytes0DumpWriteDuration_msTEMP��P�8 Q��C�Y�]���pD�	EventDataA��O�oData7K�NameCallbackIdentifier
�P,CallbackIdentifierTEMPT�QB|�SUY҂K$���+���D�	EventDataA��O�oData7K�NameCallbackIdentifier
A��;�oData#K�NameNTStatus
RHR,CallbackIdentifierNTStatusTEMPhtT��H��VE�\�6����D�	EventDataA��O�oData7K�NameEstimatedPageCount

A��O�oData7K�NameAllocatedPageCount

A��M�oData5K�NameLimitDumpFileSize
A��[�oDataCK�NameDumpFileSizeLimitInBytes

A��[�oDataCK�NameDumpFileSizeLimitReached


�T

U0U

XU�U,EstimatedPageCount,AllocatedPageCount(LimitDumpFileSize8DumpFileSizeLimitInBytes8DumpFileSizeLimitReachedTEMP�XV>c'�޽XS떂7�r���\D�	EventDataA��;�oData#K�NameNTStatus
lVNTStatusTEMP�W>c'�޽XS떂7�r���\D�	EventDataA��;�oData#K�NameNTStatus
(WNTStatusTEMP��W>c'�޽XS떂7�r���\D�	EventDataA��;�oData#K�NameNTStatus
�WNTStatusTEMP��X�RT���C^�Q5�q���bD�	EventDataA��A�oData)K�NameDuration_ms



�XDuration_msTEMP�YQ=Ȋ��YO)�TMa���D�	EventDataA��i�oDataQK�NameMarkRequiredDumpDataDuration_ms



�YDMarkRequiredDumpDataDuration_msTEMP�ZѦ��YX�-O�p����D�	EventDataA��k�oDataSK�Name MarkImportantDumpDataDuration_ms



�ZHMarkImportantDumpDataDuration_msTEMP�4\*E�I��S}�A��Y~���D�	EventDataA��k�oDataSK�Name PopulateBitmapForDumpDuration_ms

A��s�oData[K�Name$RemoveSystemCacheFromDumpDuration_ms



\\

�\HPopulateBitmapForDumpDuration_msPRemoveSystemCacheFromDumpDuration_msTEMP��]�RT���C^�Q5�q���bD�	EventDataA��A�oData)K�NameDuration_ms



�]Duration_msTEMP�T^�RT���C^�Q5�q���bD�	EventDataA��A�oData)K�NameDuration_ms



h^Duration_msTEMP�_�RT���C^�Q5�q���bD�	EventDataA��A�oData)K�NameDuration_ms



0_Duration_msTEMP 0ag�C����P��=�`��4���D�	EventDataA��M�oData5K�NameCorralDuration_ms

A��c�oDataKK�NameDisableInterruptsDuration_ms

A��g�oDataOK�NameSaveSupervisorStateDuration_ms

A��c�oDataKK�NameSuspendClockTimerDuration_ms



�a

�a

�a

,b(CorralDuration_ms@DisableInterruptsDuration_msDSaveSupervisorStateDuration_ms@SuspendClockTimerDuration_msTEMP(Xd�Q��VˡW�k؄'T8S���D�	EventDataA��Q�oData9K�NameUncorralDuration_ms

A��a�oDataIK�NameEnableInterruptsDuration_ms

A��m�oDataUK�Name!RestoreSupervisorStateDuration_ms

A��a�oDataIK�NameResumeClockTimerDuration_ms



�d

�d

e

Xe,UncorralDuration_ms<EnableInterruptsDuration_msHRestoreSupervisorStateDuration_ms<ResumeClockTimerDuration_msTEMP��hB%LD-R�_�[�4�S��*D�	EventDataA��[�oDataCK�NameMemoryCaptureDuration_ms

A��]�oDataEK�NameSystemQuiescedDuration_ms

A��e�oDataMK�NameEndMirroringPhasesDuration_ms

A����oDatakK�Name,TotalMirrorPhysicalMemoryCallbackDuration_ms

A��w�oData_K�Name&TotalMirrorPhysicalMemoryCallbackBytes

A��e�oDataMK�NameHvlCollectLivedumpDuration_ms

A��c�oDataKK�NameDumpDataBufferingDuration_ms



�i

�i

�i

0j

�j

�j

$k8MemoryCaptureDuration_ms8SystemQuiescedDuration_ms@EndMirroringPhasesDuration_ms`TotalMirrorPhysicalMemoryCallbackDuration_msTTotalMirrorPhysicalMemoryCallbackBytes@HvlCollectLivedumpDuration_ms@DumpDataBufferingDuration_msTEMPLHl�Rt��S��t�������D�	EventDataA��;�oData#K�NameNTStatus
A��K�oData3K�NameMirrorInProgress

pl

�lNTStatus(MirrorInProgressTEMP�Lm�.���\�x�XZ_CN��fD�	EventDataA��E�oData-K�Name
OperationType
`m OperationTypeTEMP4Xn�2ig�8�\���'���d���D�	EventDataA��A�oData)K�NamePolicyValue
A��;�oData#K�NameNTStatus
�n�nPolicyValueNTStatusTEMP�Lo���HS�ga=F�,���bD�	EventDataA��A�oData)K�NamePolicyValue
`oPolicyValuePRVAX�oMicrosoft-Windows-Kernel-LiveDumpOPCOP
c0qdHqe\q
f�qg�qh�qirjDrkprl�rm�rv�rws}<s�Xs��s��s��s�t�Ht��t��t ��t!��t"�(u#�`u$��u%��uAPIStartAPIEnd8WriteDumpDataToFileStart4WriteDumpDataToFileEnd$MirroringStart,MirroringPhase0End,MirroringPhase1End,SystemQuiesceStart(SystemQuiesceEnd,PageBufferingStart(PageBufferingEnd(BufferEstimation(BufferAllocationRemovePages4CaptureProcessorContext0MarkRequiredDumpData0MarkImportantDumpData0PopulateBitmapForDump,HvlCollectLiveDump8GenerateIptSecondaryData(DumpDataBuffering(CorralProcessors,UncorralProcessors,CaptureMemoryPages8MmDuplicateMemoryFailureDLiveDumpPolicyOperationFailure<LiveDumpPolicyValueChangedDLiveDumpDisabledOnBootByPolicyLEVL@P<v(win:InformationalTASK`NwOPwP�wQ�wR0x��x8LIVEDUMP_TASK_CAPTURE_API@LIVEDUMP_TASK_SIZING_WORKFLOWPLIVEDUMP_TASK_CAPTURE_PAGES_WORKFLOWPLIVEDUMP_TASK_WRITE_DEFERRED_DATA_APITLIVEDUMP_TASK_DISCARD_DEFERRED_DATA_API@LIVEDUMP_TASK_LIVEDUMP_POLICYKEYWEVNT�
9
�_�o0vpv4@`5�o0vpv(4@a�o0vpv(4
@b�Lp0vpv(4�~pp0vpv4e@Sp0v�v(4f�Tp0v�v4g�U(p0v�v4h@V4p0v�v(4i@W@p0v�v(4j@t49dp0v�v(4j@��<dp0v�v(4k@u�Epp0v�v(4k@��Gpp0v�v(4l�x|p0v�v4m�y|p0v�v4n�z(P|p0v�v4o�{(P|p0v�v4p�|Q|p0v�v4q@�`Rdp0v�v(4r@��Udp0v�v(4s@��Vpp0v�v(4t@�@Wpp0v�v(4u���W�p0v�v4v���X�p0v�v4w���Y�p0v�v4x���Z�p0v�v4y��L_�p0v�v4z ��lb�p0v�v4{"@�dkq0v�v(4��Xp0v�v4��Yp0v�v4��Z(p0v�v4�@[4p0v�v(4�@\@p0v�v(4�@]Lp0v�v(4�@^Xp0v�v(4����W�p0v�v4����X�p0v�v4����Y�p0v�v4����Z�p0v�v4����\�p0v�v4����]�p0v�v4����^�p0v�v4���L_�p0v�v4� ��lb�p0v�v4�!@��e�p0v�v(4�"@�dkq0v�v(4�
�n�o0v�v4�@o5�o0v�v(4�@p�o0v�v(4�
@q�Lp0v�v(4�
�r�o0v�v4�@s5�o0v�v(4#@��lq0v�v(4$@��mq0v�v(4%@��n$q0v�v(4WEVT0؃
@���ؐ�$�0�TTBLhTEMP�x�I��,c_����v�N��`D�	EventDataA��?�oData'K�Name
ReturnCode
��ReturnCodeTEMPd���y�i,UTu�j������D�	EventDataA��S�oData;K�NameNotifyRoutineAddress
A��?�oData'K�Name
ReturnCode
���0NotifyRoutineAddressReturnCodeTEMPL�=�R�ӛT9����F���D�	EventDataA��I�oData1K�NameTargetProcessId
A��?�oData'K�Name
ReturnCode
�<�$TargetProcessIdReturnCodeTEMP���2�l�l9Q+Y�%�6����D�	EventDataA��I�oData1K�NameTargetProcessId
A��E�oData-K�Name
DesiredAccess
A��?�oData'K�Name
ReturnCode
Ĉ��$TargetProcessId DesiredAccessReturnCodeTEMPT����v"�\�[�R=����JD�	EventDataA��I�oData1K�NameTargetProcessId
A��G�oData/K�NameTargetThreatId
A��E�oData-K�Name
DesiredAccess
A��?�oData'K�Name
ReturnCode
��<�\�$TargetProcessId$TargetThreatId DesiredAccessReturnCodeTEMP<T��(�FG�\�\9����I���D�	EventDataA��?�oData'K�Name
DriverName
A��?�oData'K�Name
ReturnCode
|���DriverNameReturnCodeTEMP<���(�FG�\�\9����I���D�	EventDataA��?�oData'K�Name
DriverName
A��?�oData'K�Name
ReturnCode
��ԍDriverNameReturnCodeTEMPPl�NV���]ۏ�WD�{��HD�	EventDataA��G�oData/K�NameLinkSourceName
A��G�oData/K�NameLinkTargetName
A��E�oData-K�Name
DesiredAccess
A��?�oData'K�Name
ReturnCode
����$�$LinkSourceName$LinkTargetName DesiredAccessReturnCodePRVAhT�Microsoft-Windows-Kernel-Audit-API-CallsOPCO01��win:InfoLEVL@P�(win:InformationalTASKKEYWEVNT��������������������������������������X��������$��������x�������������WEVT0x�l�
���4�h�t���CHAN\<�	�X��ApplicationSystemTTBLLTEMP@X�-�v6R�^l/{/!�I���D�	EventDataA��5�oDataK�NameCVEID
A��M�oData5K�NameAdditionalDetails
����CVEID(AdditionalDetailsPRVAL̔Microsoft-Windows-Audit-CVEOPCO01�win:InfoLEVL4PL�win:WarningTASKKEYWEVNTp	�x��@��@x��@�,�WEVT�8�
�\�h�������TTBL�TEMP�ؖ?~�v|�Uj��]�4���^D�	EventDataA��=�oData%K�Name	ErrorCode
�ErrorCodePRVAX�Microsoft-Windows-User-DiagnosticOPCOLEVL4P��win:WarningTASKKEYWEVNT@����D�t�WEVTh@@�
h���ȜԜ��TTBL(TEMP���]@Zl�_k�3�8�2����D�	EventDataA��S�oData;K�NameHeapSnapshotInstance
A��S�oData;K�NameHeapSnapshotSequence
A��U�oData=K�NameHeapSnapshotBufferLen
A��O�oData7K�NameHeapSnapshotBuffer
P������0HeapSnapshotInstance0HeapSnapshotSequence0HeapSnapshotBufferLen,HeapSnapshotBufferTEMP\���@�
D�WP�+��;����D�	EventDataA��S�oData;K�NameHeapSnapshotInstance
A��=�oData%K�Name	TotalData
 �P�0HeapSnapshotInstanceTotalDataPRVAT|�Microsoft-Windows-Heap-SnapshotOPCOLEVLTASKKEYWEVNTpd����L�������WEVT8�l	�����
d&�&�&,'�/0CHAN��mL�nhMicrosoft-Windows-Security-Mitigations/KernelModedMicrosoft-Windows-Security-Mitigations/UserModeMAPShP�,��̞VMAP4������VMAP,x����VMAP$���VMAPl���ControlProtectionKernelModeReturnMismatchNonenforcementReasonMap�ControlProtectionUserModeReturnMismatchNonenforcementReasonMap@RedirectionTrustPolicyTypeMap`SetContextIpValidationFailureContinueTypeMapTTBLL�TEMP�̥!�^��[��I���`���tD�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
	A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
����8�d���

ħ��8������(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLine(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTimeTEMPh
$��2�4��oQlW�����D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
	A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��[�oDataCK�NameChildImagePathNameLength
A��O�oData7K�NameChildImagePathName

A��W�oData?K�NameChildCommandLineLength
A��K�oData3K�NameChildCommandLine
d�������4�

l����,�d������ �T�(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLine(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime8ChildImagePathNameLength,ChildImagePathName4ChildCommandLineLength(ChildCommandLineTEMP4`���O�	��X�s���Ɏ����D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��G�oData/K�NameTargetThreadId
A��W�oData?K�NameTargetThreadCreateTime
A��I�oData1K�NameImageNameLength
A��=�oData%K�Name	ImageName

x������ �8�

`�������@�t���(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection$TargetThreadId4TargetThreadCreateTime$ImageNameLengthImageNameTEMP`	@�kh�
��U�P�	Q���\D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��G�oData/K�NameTargetThreadId
A��W�oData?K�NameTargetThreadCreateTime
A��W�oData?K�NameRequiredSignatureLevel
A��G�oData/K�NameSignatureLevel

A��I�oData1K�NameImageNameLength
A��=�oData%K�Name	ImageName
��������(�@�

h�������$�H�|�������(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection$TargetThreadId4TargetThreadCreateTime4RequiredSignatureLevel$SignatureLevel$ImageNameLengthImageNameTEMP���H@9�^
��M|6����D�	EventDataA��9�oData!K�NameSubcode
A��A�oData)K�NameProcessPath
A��=�oData%K�Name	ProcessId
A��G�oData/K�NameModuleFullPath
A��?�oData'K�Name
ModuleBase
A��E�oData-K�Name
ModuleAddress
A��?�oData'K�Name
MemAddress
A��M�oData5K�NameMemModuleFullPath
A��E�oData-K�Name
MemModuleBase
A��9�oData!K�NameAPIName
	A��K�oData3K�NameProcessStartTime
A��;�oData#K�NameThreadId
�������� �<�\�x���������SubcodeProcessPathProcessId$ModuleFullPathModuleBase ModuleAddressMemAddress(MemModuleFullPath MemModuleBaseAPIName(ProcessStartTimeThreadIdTEMP@��&R��Tv)b�s�E���D�	EventDataA��9�oData!K�NameSubcode
A��A�oData)K�NameProcessPath
A��=�oData%K�Name	ProcessId
A��=�oData%K�Name	HookedAPI
A��E�oData-K�Name
ReturnAddress
A��E�oData-K�Name
CalledAddress
A��E�oData-K�Name
TargetAddress
A��C�oData+K�NameStackAddress
A��C�oData+K�NameFrameAddress
A��a�oDataIK�NameReturnAddressModuleFullPath
	A��K�oData3K�NameProcessStartTime
A��;�oData#K�NameThreadId
����� �8�X�x��������<�SubcodeProcessPathProcessIdHookedAPI ReturnAddress CalledAddress TargetAddress StackAddress FrameAddress<ReturnAddressModuleFullPath(ProcessStartTimeThreadIdTEMP�p�T�.�߸S���Л����D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��[�oDataCK�NameControlPcImageNameLength
A��O�oData7K�NameControlPcImageName
A��_�oDataGK�NameRspContentsImageNameLength
A��S�oData;K�NameRspContentsImageName

�������0�H�

p������,�
d�����(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection8ControlPcImageNameLength,ControlPcImageName<RspContentsImageNameLength0RspContentsImageNameTEMP 	`��TA*�WVԳ������.D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��[�oDataCK�NameControlPcImageNameLength
A��O�oData7K�NameControlPcImageName
A��_�oDataGK�NameRspContentsImageNameLength
A��S�oData;K�NameRspContentsImageName

A��?�oData'K�Name
StrictMode

�������4�L�

t������0�
h�����

�(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection8ControlPcImageNameLength,ControlPcImageName<RspContentsImageNameLength0RspContentsImageNameStrictModeTEMP�
4�)��ҵS�̶T��oz���D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��[�oDataCK�NameControlPcImageNameLength
A��O�oData7K�NameControlPcImageName
A��_�oDataGK�NameRspContentsImageNameLength
A��S�oData;K�NameRspContentsImageName

A��?�oData'K�Name
StrictMode

A��Y�oDataAK�NameUserCetAppcompatOptions
A��S�oData;K�NameNonenforcementReason
A��K�oData3K�NameControlPcAddress
A��I�oData1K�NameControlPcOffset
A��O�oData7K�NameControlPcCetCompat

A��O�oData7K�NameRspContentsAddress
A��M�oData5K�NameRspContentsOffset
A��S�oData;K�NameRspContentsCetCompat

�(�D�|�����

���<�|���
���D�

t���,������

@�l���

��(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection8ControlPcImageNameLength,ControlPcImageName<RspContentsImageNameLength0RspContentsImageNameStrictMode4UserCetAppcompatOptions0NonenforcementReason(ControlPcAddress$ControlPcOffset,ControlPcCetCompat,RspContentsAddress(RspContentsOffset0RspContentsCetCompatTEMP

���2�q��\*n�kj8׃��pD�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	\��������

D�h����(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtectionTEMP<�Ai�ui�S�xH�n^���D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��Y�oDataAK�NameTargetIpImageNameLength
A��M�oData5K�NameTargetIpImageName
A��?�oData'K�Name
StrictMode

A��C�oData+K�NameContinueType

�(�D�|�����

��<�|���
�

�̞�(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection4TargetIpImageNameLength(TargetIpImageNameStrictMode ContinueTypeTEMP0	����W��Q��~�0���<D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��U�oData=K�NameMappedImageNameLength
A��I�oData1K�NameMappedImageName
A��]�oDataEK�NameImageCetShadowStacksReady

A��i�oDataQK�NameImageEHContinuationTablePresent


A��E�oData-K�Name
NonEhcontMode

�T��

��T|
�

�



L(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection0MappedImageNameLength$MappedImageName8ImageCetShadowStacksReadyDImageEHContinuationTablePresent NonEhcontModeTEMP..,���kgW�Q�(�
ozS���
D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��I�oData1K�NameRedirectionType
A��Q�oData9K�NameOperationPathLength
A��E�oData-K�Name
OperationPath
A��E�oData-K�Name
Impersonating


A��9�oData!K�NameModule1
A��E�oData-K�Name
Module1Offset

A��9�oData!K�NameModule2
A��E�oData-K�Name
Module2Offset

A��9�oData!K�NameModule3
A��E�oData-K�Name
Module3Offset

A��9�oData!K�NameModule4
A��E�oData-K�Name
Module4Offset

A��9�oData!K�NameModule5
A��E�oData-K�Name
Module5Offset

A��9�oData!K�NameModule6
A��E�oData-K�Name
Module6Offset

A��9�oData!K�NameModule7
A��E�oData-K�Name
Module7Offset

A��9�oData!K�NameModule8
A��E�oData-K�Name
Module8Offset

A��9�oData!K�NameModule9
A��E�oData-K�Name
Module9Offset

A��;�oData#K�NameModule10
 A��G�oData/K�NameModule10Offset
!
A��;�oData#K�NameModule11
"A��G�oData/K�NameModule11Offset
#
A��;�oData#K�NameModule12
$A��G�oData/K�NameModule12Offset
%
A��;�oData#K�NameModule13
&A��G�oData/K�NameModule13Offset
'
A��;�oData#K�NameModule14
(A��G�oData/K�NameModule14Offset
)
A��;�oData#K�NameModule15
*A��G�oData/K�NameModule15Offset
+
A��;�oData#K�NameModule16
,A��G�oData/K�NameModule16Offset
-
��@l�

��@�h��

��

,

@`

t�

��

��

0

Dd

x�

��

�

 D

\�

��

��

4

L(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection$RedirectionType,OperationPathLength OperationPath ImpersonatingModule1 Module1OffsetModule2 Module2OffsetModule3 Module3OffsetModule4 Module4OffsetModule5 Module5OffsetModule6 Module6OffsetModule7 Module7OffsetModule8 Module8OffsetModule9 Module9OffsetModule10$Module10OffsetModule11$Module11OffsetModule12$Module12OffsetModule13$Module13OffsetModule14$Module14OffsetModule15$Module15OffsetModule16$Module16OffsetTEMP��#E�:ƭR=�
+,\�����D�	EventDataA��[�oDataCK�NameControlPcImageNameLength
A��O�oData7K�NameControlPcImageName
A��_�oDataGK�NameRspContentsImageNameLength
A��S�oData;K�NameRspContentsImageName
A��S�oData;K�NameNonenforcementReason
A��K�oData3K�NameControlPcAddress
A��I�oData1K�NameControlPcOffset
A��O�oData7K�NameControlPcCetCompat

A��O�oData7K�NameRspContentsAddress
A��M�oData5K�NameRspContentsOffset
	A��S�oData;K�NameRspContentsCetCompat

h$�$�$%P�8%h%�%

�%�%&

4&8ControlPcImageNameLength,ControlPcImageName<RspContentsImageNameLength0RspContentsImageName0NonenforcementReason(ControlPcAddress$ControlPcOffset,ControlPcCetCompat,RspContentsAddress(RspContentsOffset0RspContentsCetCompatPRVAdx&Microsoft-Windows-Security-MitigationsOPCOLEVLXP�&P'win:Errorwin:WarningTASK�����)����t)�����)����P*�����*���� +�����+�����+	����T,
�����,�����,����L-
�����-���� .�����.����/����l/`KERNEL_MITIGATION_TASK_PROHIBIT_DYNAMIC_CODEtKERNEL_MITIGATION_TASK_PROHIBIT_CHILD_PROCESS_CREATIONhKERNEL_MITIGATION_TASK_PROHIBIT_REMOTE_IMAGE_MAPdKERNEL_MITIGATION_TASK_PROHIBIT_LOWIL_IMAGE_MAPlKERNEL_MITIGATION_TASK_PROHIBIT_WIN32K_SYSTEM_CALLStKERNEL_MITIGATION_TASK_PROHIBIT_NON_MICROSOFT_BINARIES\USER_MITIGATION_TASK_EXPORT_ADDRESS_FILTERdUSER_MITIGATION_TASK_EXPORT_ADDRESS_FILTER_PLUS\USER_MITIGATION_TASK_IMPORT_ADDRESS_FILTERLUSER_MITIGATION_TASK_ROP_STACKPIVOTPUSER_MITIGATION_TASK_ROP_CALLERCHECKHUSER_MITIGATION_TASK_ROP_SIMEXEC�KERNEL_MITIGATION_TASK_CONTROL_PROTECTION_USER_MODE_RETURN_MISMATCH�KERNEL_MITIGATION_TASK_USER_CET_SET_CONTEXT_IP_VALIDATION_FAILURE`KERNEL_MITIGATION_TASK_BLOCK_NON_CET_BINARIESdKERNEL_MITIGATION_TASK_REDIRECTION_TRUST_POLICY�KERNEL_MITIGATION_TASK_CONTROL_PROTECTION_KERNEL_MODE_RETURN_MISMATCHKEYWEVNT�(�o$�8'ĝ�p$��&8'ĝ�q�T'ĝ�r��&T'ĝ�s|��'ĝ�t|��&�'ĝ�u$�p'ĝ�v$��&p'ĝ	�w$��'ĝ
�x$��&�'ĝ�y���'ĝ�z���&�'ĝ
@{��'ԝ@|��&�'ԝ@{��'ԝ@|��&�'ԝ	@}�(ԝ	@~��&(ԝ
@�4(ԝ
@���&4(ԝ@�P(ԝ@���&P(ԝ@�l(ԝ@���&l(ԝ
��T��&�(ĝ
�����&�(ĝ
����&�(ĝ
��T��&�(ĝ
�����&�(ĝ
����&�(ĝ�����&�(ĝ����&�(ĝ�����&�(ĝ����&�(ĝ��<��&�(ĝ��<��&�(ĝ��l�&�(ĝ ��l�&�(ĝ!��p�&�(ĝ"��p�&�(ĝWEVT���7h8
x�غ�$�0�X�CHAN�8����dMicrosoft-Windows-Threat-Intelligence/AnalyticTTBL�TEMP��A�@���%NX�{�{z����D�	EventDataA��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
A��Y�oDataAK�NameTargetProcessCreateTime
	A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel
A��Y�oDataAK�NameTargetProcessProtection

A��M�oData5K�NameOriginalProcessId
A��]�oDataEK�NameOriginalProcessCreateTime
A��Y�oDataAK�NameOriginalProcessStartKey

A��e�oDataMK�NameOriginalProcessSignatureLevel
A��s�oData[K�Name$OriginalProcessSectionSignatureLevel
A��]�oDataEK�NameOriginalProcessProtection
A��A�oData)K�NameBaseAddress
A��?�oData'K�Name
RegionSize
A��G�oData/K�NameAllocationType
A��G�oData/K�NameProtectionMask
�C�C

�CDTD�D�D�D0ETE

�E�E�E@FtF�F

�FGHG�G�G�GH,H(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtection(OriginalProcessId8OriginalProcessCreateTime4OriginalProcessStartKey@OriginalProcessSignatureLevelPOriginalProcessSectionSignatureLevel8OriginalProcessProtectionBaseAddressRegionSize$AllocationType$ProtectionMaskTEMP��Q�vPɡ$BS�-�Ա����D�	EventDataA��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
A��Y�oDataAK�NameTargetProcessCreateTime
	A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel
A��Y�oDataAK�NameTargetProcessProtection

A��M�oData5K�NameOriginalProcessId
A��]�oDataEK�NameOriginalProcessCreateTime
A��Y�oDataAK�NameOriginalProcessStartKey

A��e�oDataMK�NameOriginalProcessSignatureLevel
A��s�oData[K�Name$OriginalProcessSectionSignatureLevel
A��]�oDataEK�NameOriginalProcessProtection
A��A�oData)K�NameBaseAddress
A��?�oData'K�Name
RegionSize
A��G�oData/K�NameProtectionMask
A��O�oData7K�NameLastProtectionMask
dS�S

�S�S8T�T�T�TU8U

lU�U�U$VXV�V

�V�V,W|W�W�W�WX(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtection(OriginalProcessId8OriginalProcessCreateTime4OriginalProcessStartKey@OriginalProcessSignatureLevelPOriginalProcessSectionSignatureLevel8OriginalProcessProtectionBaseAddressRegionSize$ProtectionMask,LastProtectionMaskTEMP�_��Wf�U�
%�X|����D�	EventDataA��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
A��Y�oDataAK�NameTargetProcessCreateTime
	A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel
A��Y�oDataAK�NameTargetProcessProtection

A��A�oData)K�NameBaseAddress
A��;�oData#K�NameViewSize
A��G�oData/K�NameAllocationType
A��G�oData/K�NameProtectionMask
h`�`

�`�`<a�a�a�ab<b

pb�b�b(c\cxc�c�c(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtectionBaseAddressViewSize$AllocationType$ProtectionMaskTEMP�**�s���AoXU�]�:�3���D�	EventDataA��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
A��Y�oDataAK�NameTargetProcessCreateTime
	A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel
A��Y�oDataAK�NameTargetProcessProtection

A��G�oData/K�NameTargetThreadId
A��W�oData?K�NameTargetThreadCreateTime
A��M�oData5K�NameOriginalProcessId
A��]�oDataEK�NameOriginalProcessCreateTime
A��Y�oDataAK�NameOriginalProcessStartKey

A��e�oDataMK�NameOriginalProcessSignatureLevel
A��s�oData[K�Name$OriginalProcessSectionSignatureLevel
A��]�oDataEK�NameOriginalProcessProtection
A��U�oData=K�NameTargetThreadAlertable
A��?�oData'K�Name
ApcRoutine
A��C�oData+K�NameApcArgument1
A��C�oData+K�NameApcArgument2
A��C�oData+K�NameApcArgument3
A��E�oData-K�Name
RealEventTime
A��[�oDataCK�NameApcRoutineVadQueryResult
A��a�oDataIK�NameApcRoutineVadAllocationBase
A��g�oDataOK�NameApcRoutineVadAllocationProtect
A��Y�oDataAK�NameApcRoutineVadRegionType
A��Y�oDataAK�NameApcRoutineVadRegionSize
 A��Y�oDataAK�NameApcRoutineVadCommitSize
!A��S�oData;K�NameApcRoutineVadMmfName
"A��_�oDataGK�NameApcArgument1VadQueryResult
#A��e�oDataMK�NameApcArgument1VadAllocationBase
$A��k�oDataSK�Name ApcArgument1VadAllocationProtect
%A��]�oDataEK�NameApcArgument1VadRegionType
&A��]�oDataEK�NameApcArgument1VadRegionSize
'A��]�oDataEK�NameApcArgument1VadCommitSize
(A��W�oData?K�NameApcArgument1VadMmfName
)w@w

xw�w�w8xpx�x�x�x

 yPy�y�yz0zdz�z

�z�z8{�{�{�{|,|L|l|�|�|}D}x}�}�}~L~�~�~D|(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtection$TargetThreadId4TargetThreadCreateTime(OriginalProcessId8OriginalProcessCreateTime4OriginalProcessStartKey@OriginalProcessSignatureLevelPOriginalProcessSectionSignatureLevel8OriginalProcessProtection0TargetThreadAlertableApcRoutine ApcArgument1 ApcArgument2 ApcArgument3 RealEventTime8ApcRoutineVadQueryResult<ApcRoutineVadAllocationBaseDApcRoutineVadAllocationProtect4ApcRoutineVadRegionType4ApcRoutineVadRegionSize4ApcRoutineVadCommitSize0ApcRoutineVadMmfName<ApcArgument1VadQueryResult@ApcArgument1VadAllocationBaseHApcArgument1VadAllocationProtect8ApcArgument1VadRegionType8ApcArgument1VadRegionSize8ApcArgument1VadCommitSize4ApcArgument1VadMmfNameTEMPx&&ċ	�a�' �TH�SUZ'����D�	EventDataA��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
A��Y�oDataAK�NameTargetProcessCreateTime
	A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel
A��Y�oDataAK�NameTargetProcessProtection

A��G�oData/K�NameTargetThreadId
A��W�oData?K�NameTargetThreadCreateTime
A��C�oData+K�NameContextFlags
A��A�oData)K�NameContextMask
A��/�oDataK�NamePc
A��/�oDataK�NameSp
A��/�oDataK�NameLr
A��/�oDataK�NameFp
A��3�oDataK�NameReg0
A��3�oDataK�NameReg1
A��3�oDataK�NameReg2
A��3�oDataK�NameReg3
A��3�oDataK�NameReg4
A��3�oDataK�NameReg5
A��3�oDataK�NameReg6
A��3�oDataK�NameReg7
A��E�oData-K�Name
RealEventTime
A��K�oData3K�NamePcVadQueryResult
A��Q�oData9K�NamePcVadAllocationBase
 A��W�oData?K�NamePcVadAllocationProtect
!A��I�oData1K�NamePcVadRegionType
"A��I�oData1K�NamePcVadRegionSize
#A��I�oData1K�NamePcVadCommitSize
$A��C�oData+K�NamePcVadMmfName
%���

�P���܏�8�l���

Đ�0�|���ԑ�(�D�P�\�h�t���������ĒԒ���<�h�������(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtection$TargetThreadId4TargetThreadCreateTime ContextFlagsContextMaskPcSpLrFpReg0Reg1Reg2Reg3Reg4Reg5Reg6Reg7 RealEventTime(PcVadQueryResult,PcVadAllocationBase4PcVadAllocationProtect$PcVadRegionType$PcVadRegionSize$PcVadCommitSize PcVadMmfNameTEMP$��Rӹ���Z8&1�dYJ��JD�	EventDataA��I�oData1K�NameOperationStatus
A��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
	A��Y�oDataAK�NameTargetProcessCreateTime
A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel

A��Y�oDataAK�NameTargetProcessProtection
A��A�oData)K�NameBaseAddress
A��A�oData)K�NameBytesCopied
�� �H�

�����@�x����

(�X�����0�$OperationStatus(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtectionBaseAddressBytesCopiedTEMP`��&�-.�+U���~	��fD�	EventDataA��I�oData1K�NameOperationStatus
A��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
	A��Y�oDataAK�NameTargetProcessCreateTime
A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel

A��Y�oDataAK�NameTargetProcessProtection
A��G�oData/K�NameTargetThreadId
A��W�oData?K�NameTargetThreadCreateTime
<�`���

���4�����ܨ�4�

h���ԩ �T�x�$OperationStatus(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtection$TargetThreadId4TargetThreadCreateTimeTEMP4
��Ɯڙs�T��9��O���D�	EventDataA��I�oData1K�NameOperationStatus
A��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
	A��Y�oDataAK�NameTargetProcessCreateTime
A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel

A��Y�oDataAK�NameTargetProcessProtection
ȱ��

L������D�h�����

�$�`���$OperationStatus(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtectionTEMP� ���:*ޠ3W����W��
D�	EventDataA��K�oData3K�NameDriverNameLength
A��?�oData'K�Name
DriverName
A��Q�oData9K�NameCodeIntegrityOption
\�����(DriverNameLengthDriverName,CodeIntegrityOptionTEMPT��0f���S*Y>Б�����D�	EventDataA��K�oData3K�NameDriverNameLength
A��?�oData'K�Name
DriverName
ܷ�(DriverNameLengthDriverNameTEMPX����Ey{BP�xaW�^���JD�	EventDataA��K�oData3K�NameDriverNameLength
A��?�oData'K�Name
DriverName
A��K�oData3K�NameDeviceNameLength
A��?�oData'K�Name
DeviceName
��4�\�(DriverNameLengthDriverName(DeviceNameLengthDeviceNamePRVA`��Microsoft-Windows-Threat-IntelligenceOPCOLEVL@P��(win:InformationalTASK
����H�����������̼���������X����������������,�	������
�����@KERNEL_THREATINT_TASK_ALLOCVMDKERNEL_THREATINT_TASK_PROTECTVM@KERNEL_THREATINT_TASK_MAPVIEWLKERNEL_THREATINT_TASK_QUEUEUSERAPCTKERNEL_THREATINT_TASK_SETTHREADCONTEXT@KERNEL_THREATINT_TASK_READVM@KERNEL_THREATINT_TASK_WRITEVM\KERNEL_THREATINT_TASK_SUSPENDRESUME_THREAD\KERNEL_THREATINT_TASK_SUSPENDRESUME_PROCESSLKERNEL_THREATINT_TASK_DRIVER_DEVICEKEYW$ ����<����������������T������� �����@�����������������\����������� �����t������� ����D�@�����������(�����������������P������������� ����L�@�����������������L�����������������D������� ����,�@������������TKERNEL_THREATINT_KEYWORD_ALLOCVM_LOCALpKERNEL_THREATINT_KEYWORD_ALLOCVM_LOCAL_KERNEL_CALLERTKERNEL_THREATINT_KEYWORD_ALLOCVM_REMOTEpKERNEL_THREATINT_KEYWORD_ALLOCVM_REMOTE_KERNEL_CALLERXKERNEL_THREATINT_KEYWORD_PROTECTVM_LOCALtKERNEL_THREATINT_KEYWORD_PROTECTVM_LOCAL_KERNEL_CALLERXKERNEL_THREATINT_KEYWORD_PROTECTVM_REMOTEtKERNEL_THREATINT_KEYWORD_PROTECTVM_REMOTE_KERNEL_CALLERTKERNEL_THREATINT_KEYWORD_MAPVIEW_LOCALpKERNEL_THREATINT_KEYWORD_MAPVIEW_LOCAL_KERNEL_CALLERTKERNEL_THREATINT_KEYWORD_MAPVIEW_REMOTEpKERNEL_THREATINT_KEYWORD_MAPVIEW_REMOTE_KERNEL_CALLER`KERNEL_THREATINT_KEYWORD_QUEUEUSERAPC_REMOTE|KERNEL_THREATINT_KEYWORD_QUEUEUSERAPC_REMOTE_KERNEL_CALLERhKERNEL_THREATINT_KEYWORD_SETTHREADCONTEXT_REMOTE�KERNEL_THREATINT_KEYWORD_SETTHREADCONTEXT_REMOTE_KERNEL_CALLERPKERNEL_THREATINT_KEYWORD_READVM_LOCALTKERNEL_THREATINT_KEYWORD_READVM_REMOTETKERNEL_THREATINT_KEYWORD_WRITEVM_LOCALTKERNEL_THREATINT_KEYWORD_WRITEVM_REMOTETKERNEL_THREATINT_KEYWORD_SUSPEND_THREADTKERNEL_THREATINT_KEYWORD_RESUME_THREADXKERNEL_THREATINT_KEYWORD_SUSPEND_PROCESSTKERNEL_THREATINT_KEYWORD_RESUME_PROCESSTKERNEL_THREATINT_KEYWORD_FREEZE_PROCESSPKERNEL_THREATINT_KEYWORD_THAW_PROCESSTKERNEL_THREATINT_KEYWORD_CONTEXT_PARSEpKERNEL_THREATINT_KEYWORD_EXECUTION_ADDRESS_VAD_PROBExKERNEL_THREATINT_KEYWORD_EXECUTION_ADDRESS_MMF_NAME_PROBE�KERNEL_THREATINT_KEYWORD_READWRITEVM_NO_SIGNATURE_RESTRICTIONTKERNEL_THREATINT_KEYWORD_DRIVER_EVENTSTKERNEL_THREATINT_KEYWORD_DEVICE_EVENTSEVNT(�����t8�0���7@�����PH�L���7�����<X�h���7������c�����7@�����������7�����t8�0���7�����PH�L� ��7�����<X�h�$��7�����(����(��7�����(��ػ,��7
�����(����0��7�����(��ػ4��7�����L���8��7 �����L���<��7	@���������@��7	����������D��7	���������H��7	���������L��7�����t8�0�P��7������PH�L�T��7�����<X�h�X��7 ������c���\��7����������`��7�����t8�0�d��7 �����PH�L�h��7�����<X�h�l��7
@�������,�p��7
@�����̶�,�t��7
������ ��,�x��7 
������ ��,�|��7\���ܿ���<�|���<�\�L�l�|����������l�����,�L���̿��,�,�WEVT04��D�
�l�`�����CHANt��5XMicrosoft-Windows-Kernel-Dump/OperationalTTBL�TEMP����.���\�x�XZ_CN��fD�	EventDataA��E�oData-K�Name
OperationType
� OperationTypeTEMP4���2ig�8�\���'���d���D�	EventDataA��A�oData)K�NamePolicyValue
A��;�oData#K�NameNTStatus
 �<�PolicyValueNTStatusTEMP������HS�ga=F�,���bD�	EventDataA��A�oData)K�NamePolicyValue
�PolicyValuePRVAP0�Microsoft-Windows-Kernel-DumpOPCO�:��;��
<�DCrashDumpPolicyOperationFailure<CrashDumpPolicyValueChangedDCrashDumpDisabledOnBootByPolicyLEVL@Px�(win:InformationalTASKd6��<DUMP_TASK_CRASHDUMP_POLICYKEYWEVNT��7P�x�l������8 ���l�����
�9T���l�����WEVT�����
����L�4���CHAN���lMicrosoft-Windows-Kernel-CPU-Starvation/OperationalTTBL,
TEMP���dWA�gM[QB'/��K?k��D�	EventDataA��E�oData-K�Name
DpcRoutineKey
A��;�oData#K�NameThreadID
A��=�oData%K�Name	CpuNumber
A��=�oData%K�Name	TickCount
A��K�oData3K�NameSoftTimeoutTicks
A��K�oData3K�NameModuleNameLength
A��?�oData'K�Name
ModuleName
p����������(� DpcRoutineKeyThreadIDCpuNumberTickCount(SoftTimeoutTicks(ModuleNameLengthModuleNameTEMP|��
��BAE^��0�	�M���^D�	EventDataA��;�oData#K�NameThreadID
A��=�oData%K�Name	CpuNumber
A��Q�oData9K�NameCumulativeTickCount
A��_�oDataGK�NameCumulativeSoftTimeoutTicks
(�@�X���ThreadIDCpuNumber,CumulativeTickCount<CumulativeSoftTimeoutTicksTEMP<����s��PZ'ϗH*�����D�	EventDataA��M�oData5K�NameDpcSequenceNumber
A��3�oDataK�NameTick
����(DpcSequenceNumberTickTEMP���^��� �YKF&�6S���D�	EventDataA��;�oData#K�NameThreadID
A��=�oData%K�Name	CpuNumber
A��M�oData5K�NameDpcSequenceNumber
A��G�oData/K�NameThresholdTicks
A��?�oData'K�Name
Cumulative
�4�L�t���ThreadIDCpuNumber(DpcSequenceNumber$ThresholdTicksCumulativePRVAd��Microsoft-Windows-Kernel-CPU-StarvationOPCO�T����
������0SingleDpcSoftTimeout8CumulativeDpcSoftTimeout4DpcProfilingStackBegin(DpcProfilingStackLEVL4P0�win:WarningTASK�������PCPU_STARVATION_TASK_DPC_SOFT_TIMEOUTTCPU_STARVATION_TASK_DPC_PROFILING_STACKKEYWp����`�������$DpcSoftTimeout DpcProfilingEVNT�����$�$�X�x����D�0�$�X�|��
���<�$�t������H�$�t���@�@�P�P����G=���2hEZ�E;O���PO .�ĀV9m	?��*����WEVT_TEMPLATEMUIMUIen-US&0�&
	*�H��
��%�0�%�10
	`�He0\
+�7�N0L0
+�70	���010
	`�He ��M�J�
3�EPi��	[�%�ݻۭ��5H��
�0�	0��3A��˭)O0
	*�H��
0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20110
250619181143Z
260617181143Z0p10	UUS10U
Washington10URedmond10U
Microsoft Corporation10UMicrosoft Windows0�"0
	*�H��
�0�
��y���K1�C�*$"�W%W�H��(v|3}�_0�sȔ��ɫO�}k�WS(�"�����@�C�p�6o��
w ,lc��(
���T-^����䐧�͍��ӑd��Χ�������1p�8��d�������k
�w�D�wB');j��@�&��r�zv;$�0�����c�J���,�?7H��o���.-��)��r<�
�q��S$j|��A]�G_�Z���೉�n����-���s
����2����0��0U%0
+�7
+0U�xԏ���~.I��Ԡ�|�@�0TUM0K�I0G1-0+U$Microsoft Ireland Operations Limited10U
229879+5053360U#0��)9�ėx͐��O��|U�S0WUP0N0L�J�H�Fhttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl%200a+U0S0Q+0�Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0U�00
	*�H��
�;ܴ�W6��K26KV�j> b�j}��BE>��Ұ=Y�'��*���_�u��Y�V��u{Y��2Bon�%�ęW�eW�>Z�I̎��#M,����Nⷅ�&8T�E�⇃������bw�폥i�R�O���"{KN���x�="t��a�w�H+GB�����S���8�#X��q�:Ӏ�g�ړ�jp*;�mH�I���-�NQ�;yOك��9��f��ڨ�l��V���X��/�1t1�3���
x��	0��0���
avV0
	*�H��
0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100
111019184142Z
261019185142Z0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20110�"0
	*�H��
�0�
�����.	����i�!�i33��T����� ��ҋ�8����-|by��J?5 p���k�6u�1ݍp��7�tF�([�`#,��G�g�Q'�r��ɹ;S5|���'�����#	o�F��n�<A�ˣ?]jM�i%(\6��C
��������['�'x0�[*	k"�S`,�hS��I�a��h	sD]}�T+�y��5]l+\μ�#�on�&�6�O�'��2;A�,���w�TN�\�e�C���mw�Z$�H��C0�?0	+�70U�)9�ėx͐��O��|U�S0	+�7
SubCA0U�0U�0�0U#0��Vˏ�\bh�=��[�Κ�0VUO0M0K�I�G�Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0�>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
	*�H��
��|qQ�y�n��9>�<Rn+?s��h�H�4M��&�1F�ay�8.Ek��(�����	��L
6fj���������@26v�Zƿ���Ӭ�h�b��TlP0X��|���N���|�sW�R!s4Z�V��	����~�����?�rS��c��=1e�������=����BА�_T���G�o�sNA�@�_�*��s�!(���s9_>�\`����	���Q�fG���=�*hw��Lb{��Ǻz�4Kbz����J7�-�W|�=ܸZ��ij�:��n�i!7ށ�ugӓW^)9��-���Es[���z��FX�^���g�l5��?$�5�
u�V��x,��Ј���ߺ~,c��#!�xl�X6+�̤��-����@�E�Ί\k>��p*
j�_G��c
2��6*pZ�BYqKW�~���!<��Ź���E��� ����ŕ�]b֠c �uw}=�E�����W�o3��w�bY~1��0��0��0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20113A��˭)O0
	`�He��0	*�H��
	1
+�70
+�710
+�70/	*�H��
	1" �v�2�$,KS�)YY��[b����9�	(���0P
+�7
1B@DFF5C634231B9E32D3E64A0FCF616D81C80F681B424DFDCCC58FE80156ED69280Z
+�71L0J�$�"Microsoft Windows�"� http://www.microsoft.com/windows0
	*�H��
������.�M�����7��$«�:>�K��j�~��.�'
�
������{W0C�:�>�=�I��7x㈘�n�N��“F�!\B�+o�G����_��t���=+���,�4��]�d.|��e����f�1a5��8��&'y�O�QZ��sL�����o	��	 �]����l� RA,�RQ���,]E
ՔSKٞ>��/���5+{<���6Ȩ��H	V�X��*�`�h?����0��
+�71��0��	*�H��
���0��10
	`�He0�Z*�H��
	��I�E0�A
+�Y
010
	`�He �tN�U�j̬�'����N�-T���#�����i�?��20260411055531.777Z0��٤��0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1-0+U$Microsoft Ireland Operations Limited1'0%UnShield TSS ESN:321A-05E0-D9471%0#UMicrosoft Time-Stamp Service���0�(0��3���C�0
	*�H��
0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100
250814184828Z
261113184828Z0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1-0+U$Microsoft Ireland Operations Limited1'0%UnShield TSS ESN:321A-05E0-D9471%0#UMicrosoft Time-Stamp Service0�"0
	*�H��
�0�
����$��ڶWvV�D��J��P��r��w]��Gٮ�*%�=�F%1��*���9�l<�{Dަ�EW�X��8�
�E(�o�"�Rl�*dU�=��Z�͚A�8��
�&Q���@���L^�i��l�}E�27T7g�#FH_�\� ��x�j}(�a��."�S��1���@�`�i�>��������`�K*V��B!tr��\�*��XaQ�s����LU�̽`7�V�g�u�%[`�%�\���ʈa9Q��I^���صE{��=�\���L������$Ӷ�[vfy�>�o����Ȇ�C|2��l�s0nW��Y>�����a�Ivv�z P�+S���!�yr�@dW��^(Q����u�v|R����
������d�+�K��h�v��Ή1�FhL�z��d�u�	fX4Iy����m��?�`J�bh2c��,'[Q�MA��6�F� ?N���{��چF�C�Uظ�@�SA5��I0�E0U�"	�(=�pgF���c�%60U#0���]^b]����e�S5�r0_UX0V0T�R�P�Nhttp://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l+`0^0\+0�Phttp://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0U�00U%�0
+0U��0
	*�H��
�ծ�XZ���OuN'mg�:'ӿ��[�V�=�2뻲��1�"�3K�N[�kq����j���<�i_���ޣ|���bN��Om��	lʮ�F�M���8"����f1H{��=/��?8����M�� ����qӘ�'�D�`�1?bV��9�p{�c�ځ0K��o�b*�t��}�B�Hy
U=>
:zH�o�	�<�����¶��.�a�I���;���wHx�Q�cqvm|B��F��6*�|��	+���F@Ϣ�_`��"���&OU�q,�;hG��5N�˫�%�Nj�d*�x��]co�Y�b)6�����D��68ԝv�y��Ur���fA��Q�
��X�!vUPNi���"]��nt}�Aĭw?.�T�A�#8�.މU[r�Z7��у��}�3��+�.R�cVz�K.����+���?����a�n�ptla���sl�b���z��Yz"_:�7�˔�I{�} �H�FV�Uw����*�"�������lB�`�tA\0�q0�Y�3��k��I�0
	*�H��
0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100
210930182225Z
300930183225Z0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100�"0
	*�H��
�0�
���L�r!y���$y�Ղ��ҩlNu��5W�lJ�⽹>`3�\O�f��SqZ�~JZ��6g�F#���w2��`}jR�D���Fk��v��P�D�q\Q17�
8n����&S|9azĪ�ri����6�5&dژ;�{3��[~��R���b%�j�]�S���VM�ݼ��㑏�9,Q��pi
�6-p�1�5(�㴇$��ɏ~�T��U�mh;�F��z)7���E�Fn�2��0\O,�b�͹⍈䖬J��q�[g`���=� �s}A�Fu��_4���� }~�ٞE߶r/�}_��۪~6�6L�+n�Q���s�M7t�4���G��|?Lۯ^����s=CN�39L��Bh.�QF�ѽjZas�g�^�(v�3rק ��
�co�6d�[���!]_0t���عP��a�65�G������k�\RQ]�%��Pzl�r�Rą��<�7�?x�E���^ڏ�riƮ{��>j�.����0��0	+�70#	+�7*�R�dĚ���<F5)��/�0U��]^b]����e�S5�r0\U U0S0Q+�7L�}0A0?+3http://www.microsoft.com/pkiops/Docs/Repository.htm0U%0
+0	+�7
SubCA0U�0U�0�0U#0��Vˏ�\bh�=��[�Κ�0VUO0M0K�I�G�Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0�>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
	*�H��
��U}�*��,g1$[�rK��o�\�>NGdx���=13�9��q6?�dl|�u9m�1��lѡ�"��fg:SMݘ��x�6.���V����i�	�{�jo�)�n�?Hu��m��m#T�xSu$W�ݟ�=��h�e��V����(U'�$�@���]='�@�8���)�ü�T�B�������j�BRu�6��as.,k{n?,	x鑲�[�I�t�쑀�=�J>f;O���2ٖ����t��Lro�u0�4�z�P�
X�@<�Tm�ctH,�NG-�q�d�$�smʎ	��WITd�s�[D�Z�k
��(�g($�8K�n�!TkjEG����^O���Lv�WT	�iD~|�als�
��Af=i��AI~~���;����>�1Q������{��p���(��6ںL���
�4�$5g+�
�挙��"��'B=%��tt[jў>�~�13}���{�8pDѐ�ȫ:�:b�pcSM��m��qj�U3X��pf�V0�>0���٤��0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1-0+U$Microsoft Ireland Operations Limited1'0%UnShield TSS ESN:321A-05E0-D9471%0#UMicrosoft Time-Stamp Service�#
0+��b�J��	��N)�Qm�6���0���~0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100
	*�H��
탽50"20260410181725Z20260411181725Z0t0:
+�Y
1,0*0
탽500�0
��06
+�Y
1(0&0
+�Y
�
0� �
0��0
	*�H��
� N+���-����Qis���a�0������W@���$���g�wy��0�\6��K���<�l�F�� �W�o_�ܸ�e��i��>�O%u-&�]�~���euyK'	}���xR�n��o���r�LX����g��w}V�ȆI��O�++��YC۹�~	N~�-<�{���4(�x@T�[y�2U�,����GCIБH�?>�Ff�j��!k`�r.�M9�!�7cZ���A!EQ|�>��wQ�1�
0�	0��0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103���C�0
	`�He��J0	*�H��
	1
*�H��
	0/	*�H��
	1" ��[w��'��Y��5��kv�a�<S��E��0��*�H��
	/1��0��0��0�� �z!ǭ�i)��GhUO=XrĻ�~�hw��0��0���~0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103���C�0" �	C����e�S����'�`GԺ���W��>0
	*�H��
�����}��A5wNzʜ���H�xd?�c�E�.�7�u�a\��љ͋ՓM=?����h|6�m�w�rA�GcE�7Ml/�P#�w��?.�E�T�)�X�TI��S�O��6��`+�4��<�2�VZ��u.��!R���r{�s��jE�6K�ş6�E�#%c�=U�_��J.п���;�ǐ��
��B%f	|�^��z!0�%�m�r�m;�����fJ+��4++�u���O��wBX�����,9�P�@�.�(ܯ:`��KrV��ɱ�р��� �L@2�ƍi��~�vT���mw��v��!�6s�(ɔ@'H���̝E����L[r|��?�Z4r��J��{����k�%���������]��z��~���-���XpW�4<�����q<R��m��6\�vc��G��Fy��$�\�	2%��|���28w;��y�����(
�����ql��gs?+d�?-�tf����NmO�v���S�&F6Dl�O;�/

Youez - 2016 - github.com/yon3zu
LinuXploit