Mini Kabibi Habibi

Current Path : C:/Windows/System32/
Upload File :
Current File : C:/Windows/System32/microsoft-windows-system-events.dll

MZ����@���	�!�L�!This program cannot be run in DOS mode.

$5�<�q�R�q�R�q�R�e���p�R�e�P�p�R�Richq�R�PEd�����" ��


�f$`A ���%T.rdata�@@.rsrc� �@@���
TTT���$�������T.rdataT|.rdata$zzzdbg .rsrc$01!؀.rsrc$02 l�������Y�T7���D(F�%������(���@�X�p�����	�	�	���0%�{! 
WEVT_TEMPLATEMUI4VS_VERSION_INFO��
iaJ
iaJ?|StringFileInfoX040904B0LCompanyNameMicrosoft Corporation|*FileDescriptionMicrosoft-Windows-System-Events Resourcesn'FileVersion10.0.19041.5737 (WinBuild.160101.0800)h$InternalNamemicrosoft-windows-system-events.dll�.LegalCopyright� Microsoft Corporation. All rights reserved.p$OriginalFilenamemicrosoft-windows-system-events.dllj%ProductNameMicrosoft� Windows� Operating SystemDProductVersion10.0.19041.5737DVarFileInfo$Translation	�CRIM�{*���/��G�!D?8�4�X����O�צ���]�!�,�"{+B��/���|�O�p�sO�Q3�=T�0��c�#w[H���V]s]J>?�Y�F�K��B������7v��PY0J���~�W4���"S���K�����D�Ti�U�?�F�M<n(-�U9bi!�{�s[�Ŋ�Su��0;���EJFTzؤ��7x>�<&�1�M�9�ST�B��)}��@�CH�3UH�D��:��E��4V�^�xL�����L���)j��0�d��jT��N�O��a�.��r���;��@����a��.�`:�m�@ZD�ʙ5�PF���������� �fp�I*�})S2H��C�y:�������wA��(:�RRqp�7�u���HF����M<���D�zM�K��	��^SH'���ĜeN�p�V�‰tV�C����D�����/���v��z�5F��I�ct�$��C��1D�A�u�e�G��>����EO�C�E�l�����`{MK�f�/e��@�ڊR�_�O��]�(a�5���B��J���;?&�7
'��2
RC�R۫A��YX:^񿿁�E�|��چP���56�wuC�$�E��7d����P.�K��INo
������́���^�a�p����*�u�O�Ȯ	ϛ#xB
*��~_H�Ot�(q���Q{�_0*&^җ`"0ʜ�T�*��O�F�Sd^G��V���J���M�<�H\|���]�hV��M��D��WEVTh���
� \���CHAN0��4���PMicrosoft-Windows-Kernel-WDI/AnalyticLMicrosoft-Windows-Kernel-WDI/DebugXMicrosoft-Windows-Kernel-WDI/OperationalTTBL�
TEMP��p�iS�^(c`lg�ߜ���D�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
A��M�oData5K�NameDroppedEventCount
A��A�oData)K�NameActionCount
A��MZ�ComplexData'K�Name
SemActions
������0@

Xl�ProviderIDEventID(DroppedEventCountActionCountSemActionsProviderIDLevelReservedKeyword$EnablePropertyNTStatusTEMP,|	ڈ6MhY��F�㐍����D�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
�	�	ProviderIDEventIDTEMP��
��mx
[�GH kA����D�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
A��;�oData#K�NameNTStatus
(DXProviderIDEventIDNTStatusTEMP���kg��T�,�pt����VD�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
A��E�oData-K�Name
ScenarioCount
A��cZ�ComplexData=K�NameScenarioInflightItems
��
�
�
�
8LdProviderIDEventID ScenarioCount0ScenarioInflightItemsProviderIDEventIDReserved InflightCountTEMP,Xڈ6MhY��F�㐍����D�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
��ProviderIDEventIDTEMP�D�{�][�9�H�Nh��`D�	EventDataA��?�oData'K�Name
ProviderID
XProviderIDTEMP����mx
[�GH kA����D�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
A��;�oData#K�NameNTStatus
���ProviderIDEventIDNTStatusTEMP��^�=y�T�[�L�g����D�	EventDataA��9�oData!K�NameSqmType
A��7�oDataK�NameSqmSid
SqmTypeSqmSidTEMPD�4H��5�Sp-	�#;��BD�	EventDataA��G�oData/K�NameSqmSessionGuid
A��5�oDataK�NameSqmID
A��9�oData!K�NameSqmType
A��W�oData?K�NameSqmDWORDDatapointValue
�(<$SqmSessionGuidSqmIDSqmType4SqmDWORDDatapointValueTEMP`8/�Z�>]�$�z�q!���D�	EventDataA��G�oData/K�NameSqmSessionGuid
A��5�oDataK�NameSqmID
A��9�oData!K�NameSqmType
A��O�oData7K�NameSqmStreamRowLength
A��QZ�ComplexData+K�NameSqmStreamRow
��� Ll��$SqmSessionGuidSqmIDSqmType,SqmStreamRowLength SqmStreamRow SqmTypeEntry SqmDWORDEntry$SqmStringEntryPRVAP�Microsoft-Windows-Kernel-WDIOPCO<

0�0�0D

0�0�0@0�0�040�0LWDI_SEM_TASK_SCENARIO_OPCODE_STARTHWDI_SEM_TASK_SCENARIO_OPCODE_ENDPWDI_SEM_TASK_SCENARIO_OPCODE_TIMEOUTXWDI_SEM_TASK_SCENARIO_OPCODE_START_FAILEDTWDI_SEM_TASK_SCENARIO_OPCODE_END_FAILEDXWDI_SEM_TASK_SCENARIO_OPCODE_INFLIGHT_MAXLWDI_SEM_TASK_INIT_OPCODE_MISCONFIGPWDI_SEM_TASK_INIT_OPCODE_SCENARIO_MAXtWDI_SEM_TASK_INIT_OPCODE_SCENARIO_CONTEXT_PROVIDER_MAXdWDI_SEM_TASK_INIT_OPCODE_SCENARIO_END_EVENT_MAXPWDI_SEM_TASK_INIT_OPCODE_PROVIDER_MAXLEVL�P�P�P�win:Errorwin:Warning(win:InformationalTASK�		p,

p\0WDI_SEM_TASK_SCENARIO(WDI_SEM_TASK_INITKEYWt!�"�4�contextdiagwin:SQMEVNT� 
	� ��,���!�!	�!��8���!�"	�"��Dt��!�#	@#�pht��$
	@$��	Pt��%	@%��	\t��&
 &���h�'
 '���h�(
 (���h�)
 )���h�*
 *�tth�+������!,����,��!-����p��!������WEVT�a�	"H"�#
yhy�y$z4}x~CHAN04"�SystemMAPS��"�"`"VMAP4�#����VMAP$h#��VMAPL#��	�
���
�dEx:LeapSecondDataParseFailure.FailureResultMapTEx:LeapSecondDataUpdate.UpdateReasonMap@Ex:SystemTimeChange.ReasonMapTTBLUTEMP �$��ۙ�}(V�X}�=����D�	EventDataA��9�oData!K�NameNewTime
A��9�oData!K�NameOldTime
%%NewTimeOldTimeTEMP�4&�xL��W�ְ�2_����D�	EventDataA��9�oData!K�NameNewTime
A��9�oData!K�NameOldTime
A��7�oDataK�NameReason
p&�&`"�&NewTimeOldTimeReasonTEMPlD(���`�W�.��H�����dD�	EventDataA��9�oData!K�NameNewTime
A��9�oData!K�NameOldTime
A��7�oDataK�NameReason
A��A�oData)K�NameProcessName
A��=�oData%K�Name	ProcessID
�(�(`"�(�()NewTimeOldTimeReasonProcessNameProcessIDTEMPPh))5�H7^A����d����D�	EventDataTEMP��*ݙ!=�YZ	�2:����D�	EventDataA��A�oData)K�NameFinalStatus
A��M�oData5K�NameExtraStringLength
A��A�oData)K�NameExtraString
�*�*+FinalStatus(ExtraStringLengthExtraStringTEMP�l,ݙ!=�YZ	�2:����D�	EventDataA��A�oData)K�NameFinalStatus
A��M�oData5K�NameExtraStringLength
A��A�oData)K�NameExtraString
�,�,�,FinalStatus(ExtraStringLengthExtraStringTEMP��.S"��F�Vַkܭy����D�	EventDataA��M�oData5K�NameExtraStringLength
A��A�oData)K�NameExtraString
A��3�oDataK�NameTmId
A��3�oDataK�NameRmId
A��7�oDataK�NameStatus
A��C�oData+K�NameInternalCode
h/�/�/�/�/�/(ExtraStringLengthExtraStringTmIdRmIdStatus InternalCodeTEMP(h1�iC^s�Z<w��i����4D�	EventDataA��G�oData/K�NameHiveNameLength
A��;�oData#K�NameHiveName
A��C�oData+K�NameOriginalSize
A��9�oData!K�NameNewSize
�1�1�12$HiveNameLengthHiveName OriginalSizeNewSizeTEMP0�3�$3�]SW�=�v���8D�	EventDataA��G�oData/K�NameHiveNameLength
A��;�oData#K�NameHiveName
A��A�oData)K�NameKeysUpdated
A��?�oData'K�Name
DirtyPages
�34 4<4$HiveNameLengthHiveNameKeysUpdatedDirtyPagesTEMP��6IS��Z%ZA��\��D�	EventDataA��C�oData+K�NameMajorVersion
A��C�oData+K�NameMinorVersion
A��C�oData+K�NameBuildVersion
A��?�oData'K�Name
QfeVersion
A��G�oData/K�NameServiceVersion
A��;�oData#K�NameBootMode
A��=�oData%K�Name	StartTime
,7L7l7�7�7�7�7 MajorVersion MinorVersion BuildVersionQfeVersion$ServiceVersionBootModeStartTimeTEMP��8zmU�b!A[Ф㸚�7��\D�	EventDataA��;�oData#K�NameStopTime
�8StopTimeTEMP�*�A�>���8U�
�؋����	D�	EventDataA��3�oDataK�NameMode
A��?�oData'K�Name
ObjectType
A��?�oData'K�Name
ObjectName
A��A�oData)K�NameProcessName
A��[�oDataCK�NameObjectCreatorProcessName
A��?�oData'K�Name
AccessMask
A��=�oData%K�Name	TokenType
A��O�oData7K�NameImpersonationLevel
A��=�oData%K�Name	SessionId
A��C�oData+K�NameLowBoxNumber
	A��K�oData3K�NameTokenGroupsCount
A��OZ�ComplexData)K�NameTokenGroups
�A��M�oData5K�NameTokenPackageCount
A��QZ�ComplexData+K�NameTokenPackage

�A��S�oData;K�NameTokenCapabilityCount
A��[Z�ComplexData5K�NameTokenCapabilities
�A��S�oData;K�NameTokenTrustLevelCount
A��WZ�ComplexData1K�NameTokenTrustLevel
�A��_�oDataGK�NameSecurityDescriptorRevision
A��]�oDataEK�NameSecurityDescriptorControl
A��Y�oDataAK�NameSecurityDescriptorOwner
A��Y�oDataAK�NameSecurityDescriptorGroup
A��C�oData+K�NameDaclRevision
A��C�oData+K�NameDaclAceCount
A��GZ�ComplexData!K�NameDaclAce
�A��C�oData+K�NameSaclRevision
A��C�oData+K�NameSaclAceCount
A��GZ�ComplexData!K�NameSaclAce
�DETEpE�E�E�E�EF@FXFxF
�F�F�FG4G\G!�G�G�G$HXH�H�H"�H�HI& I4IXIpI�I�I�I�IJ(JDJPJdJ|J�JModeObjectTypeObjectNameProcessName8ObjectCreatorProcessNameAccessMaskTokenType,ImpersonationLevelSessionId LowBoxNumber(TokenGroupsCountTokenGroups(TokenPackageCount TokenPackage0TokenCapabilityCount(TokenCapabilities0TokenTrustLevelCount$TokenTrustLevel<SecurityDescriptorRevision8SecurityDescriptorControl4SecurityDescriptorOwner4SecurityDescriptorGroup DaclRevision DaclAceCountDaclAce SaclRevision SaclAceCountSaclAce$GroupAttributesGroupSidPackageSid0CapabilityAttributes CapabilitySid TrustLevelSidAceTypeAceFlagsAccessMaskSidAceTypeAceFlagsAccessMaskSidTEMP��O�(�J�S��1�Ol����D�	EventDataA��?�oData'K�Name
ActionName
A��A�oData)K�NameProcessName
A��A�oData)K�NameAccountName
A��E�oData-K�Name
AuthorityName
A��9�oData!K�NameTokenId
A��K�oData3K�NameAuthenticationId
A��=�oData%K�Name	TokenType
A��O�oData7K�NameImpersonationLevel
A��?�oData'K�Name
TokenFlags
A��Y�oDataAK�NameSidValuesReferenceCount
		A��G�oData/K�NameSidValuesCount
A��KZ�ComplexData%K�Name	SidValues
�A��e�oDataMK�NameSharedSidValuesReferenceCount
	A��S�oData;K�NameSharedSidValuesCount

A��WZ�ComplexData1K�NameSharedSidValues
�QQ8QTQtQ�Q�Q�Q�Q		RDR
hR		�R�R
�RS SActionNameProcessNameAccountName AuthorityNameTokenId(AuthenticationIdTokenType,ImpersonationLevelTokenFlags4SidValuesReferenceCount$SidValuesCountSidValues@SharedSidValuesReferenceCount0SharedSidValuesCount$SharedSidValuesSidSidTEMP�lTa8vXZ-�.��U5��D�	EventDataA��Q�oData9K�NameTransitionStartTime
A��A�oData)K�NameCurrentTime
A��K�oData3K�NameSoftRestartCount
�T�T�T,TransitionStartTimeCurrentTime(SoftRestartCountTEMP�W3�>ʬ�]qX?�o��PD�	EventDataA��E�oData-K�Name
MmPhase0Start

A��C�oData+K�NameMmPhase0Stop

A��A�oData)K�NamePhase1Start

A��M�oData5K�NameKsrExtensionStart

A��K�oData3K�NameKsrExtensionStop

A��S�oData;K�NameStartProcessorsStart

A��Q�oData9K�NameStartProcessorsStop



(X

HX

hX

�X

�X

�X

Y MmPhase0Start MmPhase0StopPhase1Start(KsrExtensionStart(KsrExtensionStop0StartProcessorsStart,StartProcessorsStopTEMPH		d\.]�7�<P���G����D�	EventDataA��E�oData-K�Name
MmPhase0Start

A��C�oData+K�NameMmPhase0Stop

A��A�oData)K�NamePhase1Start

A��M�oData5K�NameKsrExtensionStart

A��K�oData3K�NameKsrExtensionStop

A��S�oData;K�NameStartProcessorsStart

A��Q�oData9K�NameStartProcessorsStop

A��Q�oData9K�NameAutoLoggerInitStart

A��O�oData7K�NameAutoLoggerInitStop



]

8]

X]

t]

�]

�]

�]

 ^

L^ MmPhase0Start MmPhase0StopPhase1Start(KsrExtensionStart(KsrExtensionStop0StartProcessorsStart,StartProcessorsStop,AutoLoggerInitStart,AutoLoggerInitStopTEMP�

c�����Sx1�?D����RD�	EventDataA��E�oData-K�Name
MmPhase0Start

A��C�oData+K�NameMmPhase0Stop

A��A�oData)K�NamePhase1Start

A��M�oData5K�NameKsrExtensionStart

A��K�oData3K�NameKsrExtensionStop

A��S�oData;K�NameStartProcessorsStart

A��Q�oData9K�NameStartProcessorsStop

A��Q�oData9K�NameAutoLoggerInitStart

A��O�oData7K�NameAutoLoggerInitStop

A��E�oData-K�Name
MmPhase1Start
	
A��C�oData+K�NameMmPhase1Stop

A��Y�oDataAK�NameHalPhase0StartCycleTime

A��W�oData?K�NameHalPhase0StopCycleTime



d

$d

Dd

`d

�d

�d

�d

e

8e

de

�e

�e

�e MmPhase0Start MmPhase0StopPhase1Start(KsrExtensionStart(KsrExtensionStop0StartProcessorsStart,StartProcessorsStop,AutoLoggerInitStart,AutoLoggerInitStop MmPhase1Start MmPhase1Stop4HalPhase0StartCycleTime4HalPhase0StopCycleTimeTEMP��jc	�3�s]ѽ�6����D�	EventDataA��E�oData-K�Name
MmPhase0Start

A��C�oData+K�NameMmPhase0Stop

A��A�oData)K�NamePhase1Start

A��M�oData5K�NameKsrExtensionStart

A��K�oData3K�NameKsrExtensionStop

A��S�oData;K�NameStartProcessorsStart

A��Q�oData9K�NameStartProcessorsStop

A��Q�oData9K�NameAutoLoggerInitStart

A��O�oData7K�NameAutoLoggerInitStop

A��E�oData-K�Name
MmPhase1Start
	
A��C�oData+K�NameMmPhase1Stop

A��Y�oDataAK�NameHalPhase0StartCycleTime

A��W�oData?K�NameHalPhase0StopCycleTime

A��7�oDataK�NameMmMark

�

�k

l

(l

Dl

ll

�l

�l

�l

m

Hm

hm

�m

�m

�m MmPhase0Start MmPhase0StopPhase1Start(KsrExtensionStart(KsrExtensionStop0StartProcessorsStart,StartProcessorsStop,AutoLoggerInitStart,AutoLoggerInitStop MmPhase1Start MmPhase1Stop4HalPhase0StartCycleTime4HalPhase0StopCycleTimeMmMarkTEMP hopE�mm��R
f��<�����.D�	EventDataA��C�oData+K�NameUpdateReason
A��?�oData'K�Name
EnabledNew

A��;�oData#K�NameCountNew
A��;�oData#K�NameCountOld
�"�o

�o�op UpdateReasonEnabledNewCountNewCountOldTEMP��pDs;��^P�#�@ݕ3��fD�	EventDataA��E�oData-K�Name
FailureResult
�"�p FailureResultTEMP �qU{x��]��ۡ�|�F���D�	EventDataA��9�oData!K�NameNewBias
A��9�oData!K�NameOldBias
�qrNewBiasOldBiasTEMP		�t�y��%�P���|����XD�	EventDataA��G�oData/K�NameVsmCleanupTime

A��7�oDataK�NameMark#0

A��7�oDataK�NameMark#1

A��7�oDataK�NameMark#2

A��7�oDataK�NameMark#3

A��7�oDataK�NameMark#4

A��7�oDataK�NameMark#5

A��7�oDataK�NameMark#6

A��7�oDataK�NameMark#7



Tu

xu

�u

�u

�u

�u

�u

�u

v$VsmCleanupTimeMark#0Mark#1Mark#2Mark#3Mark#4Mark#5Mark#6Mark#7TEMP��w��5���X��4_+���D�	EventDataA��?�oData'K�Name
ExitReason
A��A�oData)K�NameCurrentBias
A��M�oData5K�NameCurrentTimeZoneID
A��[�oDataCK�NameTimeZoneInfoCacheUpdated
A��C�oData+K�NameFirstRefresh
Xxtx�x�x�xExitReasonCurrentBias(CurrentTimeZoneID8TimeZoneInfoCacheUpdated FirstRefreshPRVAX$yMicrosoft-Windows-Kernel-GeneralOPCO01�ywin:InfoLEVL�P�yP�yP�ywin:Errorwin:Warning(win:InformationalTASK����d{�����{�����{�����{�����{����|����@|����||	�����|
�����|�����|SystemStartSystemStop SoftBootInfo,BootPerformanceData(SystemTimeChange0LeapSecondDataUpdate<LeapSecondDataParseFailure,TimeZoneBiasChange,VsmPerformanceData$ReorganizeHive<TimeZoneInformationRefreshKEYWD�} �����}@����~�����T~<KERNEL_GENERAL_KEYWORD_TIMELKERNEL_GENERAL_SECURITY_ACCESSCHECKLKERNEL_GENERAL_TOKEN_SID_MANAGEMENT$BootPerformanceEVNT��$ty�y8�$"��(%ty�y�z<�$"��&ty�y�z@�$"�)ty�y$"�)ty�y$"�)ty�y$"�h)�y$"�8+�y$"�-ty�y$"��X4ty�y0zD�$"
��
�7ty�yLzH�$" �����8�yL�
�0ty�y,{$"�(2ty�y$"@�����J�yP���,Sty�yhzT�$"�����Uty�y�zX������0Yty�y�z\������x^ty�y�z`������fty�y�zd��nty�y�zh�$"�$pty�y�zl�$"��pty�y�zp�$"	�����rty�y{t��vty�yH{x�$"@}@}@}p}p}P}`}p}p}p}p}p}@}@}@}p}@}WEVT�s�	ԃH���
��P�������CHANt�����XMicrosoft-Windows-Kernel-Process/AnalyticMAPSLX�BMAPt�� ProcessFlagsTTBLdaTEMP�P�
�q���=[�u�����T��|D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��I�oData1K�NameParentProcessID
A��=�oData%K�Name	SessionID
A��=�oData%K�Name	ImageName
��̆��$�ProcessIDCreateTime$ParentProcessIDSessionIDImageNameTEMP�(��a#�m6Z�&M�lk���D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��I�oData1K�NameParentProcessID
A��=�oData%K�Name	SessionID
A��5�oDataK�NameFlags
A��=�oData%K�Name	ImageName
����ԉ��X�� �ProcessIDCreateTime$ParentProcessIDSessionIDFlagsImageNameTEMP$

h�	�	�<RW�@�\:<����D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��I�oData1K�NameParentProcessID
A��=�oData%K�Name	SessionID
A��5�oDataK�NameFlags
A��=�oData%K�Name	ImageName
A��E�oData-K�Name
ImageChecksum
A��E�oData-K�Name
TimeDateStamp
A��I�oData1K�NamePackageFullName
A��S�oData;K�NamePackageRelativeAppId
	0�H�d���X�����Ȏ��,�ProcessIDCreateTime$ParentProcessIDSessionIDFlagsImageName ImageChecksum TimeDateStamp$PackageFullName0PackageRelativeAppIdTEMPX`��}�T#]�Q\c^r����D�	EventDataA��=�oData%K�Name	ProcessID
A��U�oData=K�NameProcessSequenceNumber

A��?�oData'K�Name
CreateTime
A��I�oData1K�NameParentProcessID
A��a�oDataIK�NameParentProcessSequenceNumber

A��=�oData%K�Name	SessionID
A��5�oDataK�NameFlags
A��]�oDataEK�NameProcessTokenElevationType
A��W�oData?K�NameProcessTokenIsElevated
A��G�oData/K�NameMandatoryLabel
	A��=�oData%K�Name	ImageName
A��E�oData-K�Name
ImageChecksum
A��E�oData-K�Name
TimeDateStamp
A��I�oData1K�NamePackageFullName

A��S�oData;K�NamePackageRelativeAppId
��

��ԕ�

�P�X�h�x����� �@�`���ProcessID0ProcessSequenceNumberCreateTime$ParentProcessID<ParentProcessSequenceNumberSessionIDFlags8ProcessTokenElevationType4ProcessTokenIsElevated$MandatoryLabelImageName ImageChecksum TimeDateStamp$PackageFullName0PackageRelativeAppIdTEMP�		��(�G���X�P�@;����D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��;�oData#K�NameExitTime
A��;�oData#K�NameExitCode
A��O�oData7K�NameTokenElevationType
A��A�oData)K�NameHandleCount
A��C�oData+K�NameCommitCharge

A��?�oData'K�Name
CommitPeak

A��=�oData%K�Name	ImageName
8�P�l�����ț

�

� �ProcessIDCreateTimeExitTimeExitCode,TokenElevationTypeHandleCount CommitChargeCommitPeakImageNameTEMP��E��ZY�Aty����D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��;�oData#K�NameExitTime
A��;�oData#K�NameExitCode
A��O�oData7K�NameTokenElevationType
A��A�oData)K�NameHandleCount
A��C�oData+K�NameCommitCharge

A��?�oData'K�Name
CommitPeak

A��E�oData-K�Name
CPUCycleCount

A��O�oData7K�NameReadOperationCount
	A��Q�oData9K�NameWriteOperationCount
A��U�oData=K�NameReadTransferKiloBytes
A��W�oData?K�NameWriteTransferKiloBytes
A��G�oData/K�NameHardFaultCount

A��=�oData%K�Name	ImageName
4�L�h�����Ģ

�

�

�<�h���ģ���ProcessIDCreateTimeExitTimeExitCode,TokenElevationTypeHandleCount CommitChargeCommitPeak CPUCycleCount,ReadOperationCount,WriteOperationCount0ReadTransferKiloBytes4WriteTransferKiloBytes$HardFaultCountImageNameTEMP�`��Uk ݂Z5g'��י����D�	EventDataA��=�oData%K�Name	ProcessID
A��U�oData=K�NameProcessSequenceNumber

A��?�oData'K�Name
CreateTime
A��;�oData#K�NameExitTime
A��;�oData#K�NameExitCode
A��O�oData7K�NameTokenElevationType
A��A�oData)K�NameHandleCount
A��C�oData+K�NameCommitCharge

A��?�oData'K�Name
CommitPeak

A��E�oData-K�Name
CPUCycleCount
	
A��O�oData7K�NameReadOperationCount
A��Q�oData9K�NameWriteOperationCount
A��U�oData=K�NameReadTransferKiloBytes
A��W�oData?K�NameWriteTransferKiloBytes

A��G�oData/K�NameHardFaultCount
A��=�oData%K�Name	ImageName
��

�����4�`�

|�

��

��ث�0�`�����ProcessID0ProcessSequenceNumberCreateTimeExitTimeExitCode,TokenElevationTypeHandleCount CommitChargeCommitPeak CPUCycleCount,ReadOperationCount,WriteOperationCount0ReadTransferKiloBytes4WriteTransferKiloBytes$HardFaultCountImageNameTEMPx		���nUh�2X�l"�&�����D�	EventDataA��=�oData%K�Name	ProcessID
A��;�oData#K�NameThreadID
A��=�oData%K�Name	StackBase
A��?�oData'K�Name
StackLimit
A��E�oData-K�Name
UserStackBase
A��G�oData/K�NameUserStackLimit
A��=�oData%K�Name	StartAddr
A��G�oData/K�NameWin32StartAddr
A��9�oData!K�NameTebBase
P�h�������԰���4�ProcessIDThreadIDStackBaseStackLimit UserStackBase$UserStackLimitStartAddr$Win32StartAddrTebBaseTEMP�

`�Q���]���1�T���D�	EventDataA��=�oData%K�Name	ProcessID
A��;�oData#K�NameThreadID
A��=�oData%K�Name	StackBase
A��?�oData'K�Name
StackLimit
A��E�oData-K�Name
UserStackBase
A��G�oData/K�NameUserStackLimit
A��=�oData%K�Name	StartAddr
A��G�oData/K�NameWin32StartAddr
A��9�oData!K�NameTebBase
A��E�oData-K�Name
SubProcessTag
	(�@�X�p�����е�� �ProcessIDThreadIDStackBaseStackLimit UserStackBase$UserStackLimitStartAddr$Win32StartAddrTebBase SubProcessTagTEMPh����*my_\ǻ�.���&D�	EventDataA��=�oData%K�Name	ProcessID
A��;�oData#K�NameThreadID
A��=�oData%K�Name	StackBase
A��?�oData'K�Name
StackLimit
A��E�oData-K�Name
UserStackBase
A��G�oData/K�NameUserStackLimit
A��=�oData%K�Name	StartAddr
A��G�oData/K�NameWin32StartAddr
A��9�oData!K�NameTebBase
A��E�oData-K�Name
SubProcessTag
	A��=�oData%K�Name	CycleTime

x�������ܺ�� �8�\�p�
��ProcessIDThreadIDStackBaseStackLimit UserStackBase$UserStackLimitStartAddr$Win32StartAddrTebBase SubProcessTagCycleTimeTEMP����|hGH}V�Ȋ`�j�%��
D�	EventDataA��=�oData%K�Name	ImageBase
A��=�oData%K�Name	ImageSize
A��=�oData%K�Name	ProcessID
A��E�oData-K�Name
ImageCheckSum
A��E�oData-K�Name
TimeDateStamp
A��A�oData)K�NameDefaultBase
A��=�oData%K�Name	ImageName
t�������ܾ���ImageBaseImageSizeProcessID ImageCheckSum TimeDateStampDefaultBaseImageNameTEMP�p���|hGH}V�Ȋ`�j�%��
D�	EventDataA��=�oData%K�Name	ImageBase
A��=�oData%K�Name	ImageSize
A��=�oData%K�Name	ProcessID
A��E�oData-K�Name
ImageCheckSum
A��E�oData-K�Name
TimeDateStamp
A��A�oData)K�NameDefaultBase
A��=�oData%K�Name	ImageName
���,�D�d�����ImageBaseImageSizeProcessID ImageCheckSum TimeDateStampDefaultBaseImageNameTEMP���UU�?��M���0D�	EventDataA��=�oData%K�Name	ProcessID
A��;�oData#K�NameThreadID
A��A�oData)K�NameOldPriority
A��A�oData)K�NameNewPriority
l�������ProcessIDThreadIDOldPriorityNewPriorityTEMP�t�2�>!��xX�6�f��P��jD�	EventDataA��I�oData1K�NameFrozenProcessID
��$FrozenProcessIDTEMPL��Env�z��_�����%�����D�	EventDataA��I�oData1K�NameFrozenProcessID
A��?�oData'K�Name
CreateTime
����$FrozenProcessIDCreateTimeTEMP���7ά��Y���`�������D�	EventDataA��C�oData+K�NameContainer ID
A��7�oDataK�NameJob ID
A��?�oData'K�Name
StatusCode
P�p��� Container IDJob IDStatusCodeTEMP���.�n]�y�]b�A��"�h���D�	EventDataA��7�oDataK�NameJob ID
A��M�oData5K�NameDiskIoAttribution
A��?�oData'K�Name
StatusCode
��@�Job ID(DiskIoAttributionStatusCodeTEMPL�w묌
�U��	o	&���D�	EventDataA��7�oDataK�NameJob ID
A��E�oData-K�Name
IoRateControl
A��A�oData)K�NameControlType
A��;�oData#K�NameRateType
A��?�oData'K�Name
RateAmount
A��?�oData'K�Name
StatusCode
�������,�H�Job ID IoRateControlControlTypeRateTypeRateAmountStatusCodeTEMP,����Z�ePSG�(/7�'���D�	EventDataA��7�oDataK�NameJob ID
A��E�oData-K�Name
IoRateControl
A��9�oData!K�NameMaxIops

A��C�oData+K�NameMaxBandwidth

A��G�oData/K�NameMaxTimePercent

A��I�oData1K�NameReservationIops

A��S�oData;K�NameReservationBandwidth

A��W�oData?K�NameReservationTimePercent

A��Y�oDataAK�NameCriticalReservationIops

A��c�oDataKK�NameCriticalReservationBandwidth
	
A��g�oDataOK�NameCriticalReservationTimePercent

A��C�oData+K�NameControlFlags
A��?�oData'K�Name
VolumeName
A��?�oData'K�Name
StatusCode

D�X�

x�

��

��

��

��

$�

X�

��

���0�L�Job ID IoRateControlMaxIops MaxBandwidth$MaxTimePercent$ReservationIops0ReservationBandwidth4ReservationTimePercent4CriticalReservationIops@CriticalReservationBandwidthDCriticalReservationTimePercent ControlFlagsVolumeNameStatusCodeTEMP�	 ��̶�:�S�S�[����D�	EventDataA��7�oDataK�NameJob ID
A��E�oData-K�Name
IoRateControl
A��9�oData!K�NameMaxIops

A��C�oData+K�NameMaxBandwidth

A��G�oData/K�NameMaxTimePercent

A��I�oData1K�NameReservationIops

A��S�oData;K�NameReservationBandwidth

A��W�oData?K�NameReservationTimePercent

A��Y�oDataAK�NameCriticalReservationIops

A��c�oDataKK�NameCriticalReservationBandwidth
	
A��g�oDataOK�NameCriticalReservationTimePercent

A��A�oData)K�NameSoftMaxIops

A��K�oData3K�NameSoftMaxBandwidth

A��O�oData7K�NameSoftMaxTimePercent


A��C�oData+K�NameControlFlags
A��?�oData'K�Name
VolumeName
A��?�oData'K�Name
StatusCode
t���

��

��

��

�

$�

T�

��

��

��

@�

\�

��������Job ID IoRateControlMaxIops MaxBandwidth$MaxTimePercent$ReservationIops0ReservationBandwidth4ReservationTimePercent4CriticalReservationIops@CriticalReservationBandwidthDCriticalReservationTimePercentSoftMaxIops(SoftMaxBandwidth,SoftMaxTimePercent ControlFlagsVolumeNameStatusCodeTEMP���_P‹5Z��<���L���D�	EventDataA��Y�oDataAK�NameOldWorkOnBehalfThreadID
A��Y�oDataAK�NameNewWorkOnBehalfThreadID
@�t�4OldWorkOnBehalfThreadID4NewWorkOnBehalfThreadIDTEMP���F@mQ�)�Vنo���D�	EventDataA��C�oData+K�NameContainer ID
A��7�oDataK�NameJob ID
A��5�oDataK�NameState
���,� Container IDJob IDStateTEMP�\��.���U�x`ߑ�ׂ���D�	EventDataA��C�oData+K�NameContainer ID
A��7�oDataK�NameJob ID
A��A�oData)K�NameMonitorName
������ Container IDJob IDMonitorNameTEMPD�h���[a�BZ����(D�	EventDataA��C�oData+K�NameContainer ID
A��7�oDataK�NameJob ID
A��7�oDataK�NameStatus
A��A�oData)K�NameMonitorName
�������� Container IDJob IDStatusMonitorNamePRVAX�Microsoft-Windows-Kernel-ProcessOPCOx1��2��2��win:Infowin:Startwin:StopLEVL@P��(win:InformationalTASK����������,�����H�����d�������������������������	�����
����8�����`�
���������������������������������,�����d� ProcessStartProcessStopThreadStartThreadStopImageLoadImageUnload0CpuBasePriorityChange(CpuPriorityChange,PagePriorityChange(IoPriorityChange ProcessFreezeJobStart JobTerminate$ProcessRundown,PsDiskIoAttribution$PsIoRateControl8ThreadWorkOnBehalfUpdate,JobServerSiloStartKEYWl����L� ������@�����������������,�����p�����������������L� ������@������8WINEVENT_KEYWORD_PROCESS4WINEVENT_KEYWORD_THREAD4WINEVENT_KEYWORD_IMAGE@WINEVENT_KEYWORD_CPU_PRIORITYDWINEVENT_KEYWORD_OTHER_PRIORITYDWINEVENT_KEYWORD_PROCESS_FREEZE0WINEVENT_KEYWORD_JOBhWINEVENT_KEYWORD_ENABLE_PROCESS_TRACING_CALLBACKS4WINEVENT_KEYWORD_JOB_IODWINEVENT_KEYWORD_WORK_ON_BEHALF8WINEVENT_KEYWORD_JOB_SILOEVNT0(����h���������<�h���������8�h���������\�h�����������t���0������8�t���0������4�t���0���� ��Ьh���L���� ��H�h���L���� ��Ьt���h���� ��@�t���h����@����\��������@��0�\�������������\������������\�������		�	���\�������

�
���\����������h���,�������h���,�������t���,�������t���,���

�
���h���H�������t���d�����8�\���������\�\�����������\�����������h���������������t�������������\�h������������d�h������������h�h������������\�t������������d�t������������h�t������� ������\�������@�������\�������@�����<�h����� ��@�������t�����$��@�����<�h�����(��@�����<�t�����,�������������������������������������������������������������,�<�<�<�<�<�WEVT�F���h�
�',((0h0�2X5CHAN������������\Microsoft-Windows-Kernel-Registry/Analytic`Microsoft-Windows-Kernel-Registry/PerformanceTTBLl/TEMP`�4��zw�_Q
f��i�N���D�	EventDataA��?�oData'K�Name
BaseObject
A��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��A�oData)K�NameDisposition
A��;�oData#K�NameBaseName
A��C�oData+K�NameRelativeName
��� �<�T�BaseObjectKeyObjectStatusDispositionBaseName RelativeNameTEMP�������u�Y[`q��BsK���D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��9�oData!K�NameKeyName
����KeyObjectStatusKeyNameTEMPx4�C���^ζUGr������D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
A��K�oData3K�NameCapturedDataSize
A��C�oData+K�NameCapturedData
����0XKeyObjectStatusInfoClassDataSizeKeyName(CapturedDataSize CapturedDataTEMP4�U���yZ[A��u����D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��3�oDataK�NameType
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
A��=�oData%K�Name	ValueName
A��K�oData3K�NameCapturedDataSize
A��C�oData+K�NameCapturedData
A��K�oData3K�NamePreviousDataType
A��K�oData3K�NamePreviousDataSize
	A��[�oDataCK�NamePreviousDataCapturedSize
A��C�oData+K�NamePreviousData
$<P`x����<
tKeyObjectStatusTypeDataSizeKeyNameValueName(CapturedDataSize CapturedData(PreviousDataType(PreviousDataSize8PreviousDataCapturedSize PreviousDataTEMP��5|��
U'VO��C���� D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��9�oData!K�NameKeyName
A��=�oData%K�Name	ValueName
8PdxKeyObjectStatusKeyNameValueNameTEMP��Y܄$[�F�@L����BD�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
A��=�oData%K�Name	ValueName
A��K�oData3K�NameCapturedDataSize
A��C�oData+K�NameCapturedData
����0XKeyObjectStatusInfoClassDataSizeKeyNameValueName(CapturedDataSize CapturedDataTEMP���f�C��V��`����%��:D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��5�oDataK�NameIndex
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
A��K�oData3K�NameCapturedDataSize
A��C�oData+K�NameCapturedData
������0KeyObjectStatusIndexInfoClassDataSizeKeyName(CapturedDataSize CapturedDataTEMPp�B!��Q>�Ƅ����dD�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��?�oData'K�Name
EntryCount
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
Ldx��KeyObjectStatusEntryCountDataSizeKeyNameTEMPx�C���^ζUGr������D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
A��K�oData3K�NameCapturedDataSize
A��C�oData+K�NameCapturedData
������KeyObjectStatusInfoClassDataSizeKeyName(CapturedDataSize CapturedDataTEMP<Zv��NɋP�};�ɖ���D�	EventDataA��C�oData+K�NameHiveFilePath
A��;�oData#K�NameFileSize
<\ HiveFilePathFileSizeTEMP\`%{�1�Uϫ+F�����D�	EventDataA��G�oData/K�NameTotalEntrySize
A��G�oData/K�NameBytesRecovered
��$TotalEntrySize$BytesRecoveredTEMP�d9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
xStatusCodeTEMPT|/���mT6#W�|4����D�	EventDataA��C�oData+K�NameHiveFilePath
A��G�oData/K�NameHiveMountPoint
�� HiveFilePath$HiveMountPointTEMP�|9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
�StatusCodeTEMP��ݯ��I^vo��X���D�	EventDataA��C�oData+K�NameHiveFilePath
A��G�oData/K�NameHiveMountPoint
A��?�oData'K�Name
FlushFlags
4X HiveFilePath$HiveMountPointFlushFlagsTEMP�i����T;�qW��w��fD�	EventDataA��E�oData-K�Name
BytesGathered
$ BytesGatheredTEMP��i����T;�qW��w��fD�	EventDataA��E�oData-K�Name
BytesGathered
� BytesGatheredTEMPL�˦i��=I_��Nm�;���D�	EventDataA��C�oData+K�NameWritesIssued
A��C�oData+K�NameBytesWritten
  @  WritesIssued BytesWrittenTEMPLD!˦i��=I_��Nm�;���D�	EventDataA��C�oData+K�NameWritesIssued
A��C�oData+K�NameBytesWritten
l!�! WritesIssued BytesWrittenTEMP�@"9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
T"StatusCodeTEMP$@#V��U�V6Q�D��Y7{���D�	EventDataA��?�oData'K�Name
SourceFile
A��5�oDataK�NameFlags
h#�#SourceFileFlagsTEMP�($9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
<$StatusCodeTEMP$(%V��U�V6Q�D��Y7{���D�	EventDataA��?�oData'K�Name
SourceFile
A��5�oDataK�NameFlags
P%l%SourceFileFlagsTEMP�&9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
$&StatusCodeTEMP��&��*K�tS
f�g<����fD�	EventDataA��E�oData-K�Name
SourceKeyPath
�& SourceKeyPathTEMP��'9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
�'StatusCodePRVAX�'Microsoft-Windows-Kernel-RegistryOPCO�!2�)2�)
�����)
����<*
�����*
�����*����+����P+�����+�����+����,����X,�����,
�����,����-����\-�����-����. ����P.!����h."����|.#�����.$�����.%�����.&�����.'����/(����,/)����T/*�����/+�����/,�����/-�����/.����0win:Startwin:StopHRegPerfOpHiveMountBaseFileMountedPRegPerfOpHiveFlushBecameActiveFlusherHRegPerfOpShutdownRundownComplete4RegPerfOpSaveFileCopiedHRegPerfOpHiveMountLogEntryAppliedHRegPerfOpHiveFlushGatheredLogData<RegPerfOpShutdownFlushStart4RegPerfOpSaveTreeCopiedPRegPerfOpHiveFlushGatheredPrimaryData<RegPerfOpShutdownFlushStop8RegPerfOpSaveFileWrittenDRegPerfOpHiveFlushWroteLogFileLRegPerfOpHiveFlushWrotePrimaryFileTRegPerfOpHiveFlushBoostedActiveFlusherPRegPerfOpHiveFlushStartWaitForActivePRegPerfOpHiveFlushFinishWaitForActiveCreateKeyOpenKeyDeleteKeyQueryKeySetValueKey$DeleteValueKey QueryValueKey EnumerateKey(EnumerateValueKey0QueryMultipleValueKey(SetInformationKeyFlushKeyCloseKey(QuerySecurityKey$SetSecurityKeyLEVL@P@0(win:InformationalTASKs81sh1s�1s�1s�1s 2sT20RegPerfTaskHiveMount0RegPerfTaskHiveUnload0RegPerfTaskHiveFlush,RegPerfTaskShutdown,RegPerfTaskHiveLoad4RegPerfTaskHiveRestore,RegPerfTaskHiveSaveKEYW�����|3�����3�����3�����3 ����4@����84�����`4����x4�����4�����4�����4�����4 ����5@����$5�����<5CloseKey(QuerySecurityKey$SetSecurityKey(EnumerateValueKey0QueryMultipleValueKey(SetInformationKeyFlushKeySetValueKey$DeleteValueKey QueryValueKey EnumerateKeyCreateKeyOpenKeyDeleteKeyQueryKeyEVNT�- �����t�)40�=��! �����t�)40�=��"@�����t�()40�=��#�������4)40�=��$�����x@)40�=��%������L)40�=��&������X)40�=��'�����xd)40�=��	(�����xp)40�=��
) �����P|)40�=��*@�������)40>��+������t��)40>��
,�����t��)40>��-�����t��)40>��.�����t��)40>��@����8(40t0��
@����8P(40t0��@����t�(40t0��@�����D(40t0��@�����8(40�0��@�����D(40�0��@�����8(40�0��
@����\(40�0��@����t�(40�0��@����D�(40�0��
@�����(40�0��@�����(40�0��@�����(40�0��@�����(40�0��@����)40�0��@�����!D(40�0�� @����8(40�0��!@����8(40�0��"@�����(40�0��#@�����(40�0��$@����D(40�0��%@����p"8(40�0��&@�����#D(40�0��'@����X$8(401��(@����|%D(401��)@����@&8(401��*
@����t(401��+@�����(401��,@�����(401��-@����'D(401��<3L3\3l3�233,3�2�2�2�2�2�2�2WEVT���	l>�>�@
�������� �CHANt�>����XMicrosoft-Windows-Kernel-Acpi/DiagnosticMAPS�h?�> ?D?VMAP$�?��VMAP$@@��VMAP$|@��VMAPd�?
��	�
���
���	�,MapAcpiOverrideTypeHMapActiveCoolingDevicePowerState<MapAmlMethodInvocationState MapResetTypeTTBL�TEMPLPC}9/��`XuN�y����tD�	EventDataA��C�oData+K�NameResourceFlag
A��A�oData)K�NameGeneralFlag
A��K�oData3K�NameTypeSpecificFlag
A��A�oData)K�NameGranularity

A��?�oData'K�Name
AddressMin

A��?�oData'K�Name
AddressMax

A��O�oData7K�NameAddressTranslation

A��E�oData-K�Name
AddressLength

�CD,D
TD
pD
�D
�D
�D ResourceFlagGeneralFlag(TypeSpecificFlagGranularityAddressMinAddressMax,AddressTranslation AddressLengthTEMP\�E�K���;T]��cAl쪙���D�	EventDataA��A�oData)K�NameGpeRegister
A��O�oData7K�NameUnexpectedEventMap
F$FGpeRegister,UnexpectedEventMapTEMP��J�m��_:����Rt���D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
	A��3�oDataK�Name_AC6
A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9

A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
�K$L\LlL|L�L�L�L�L�L�L�L�LMM,MDThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance_TMP_PSV_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRTTEMPHdP�~���\K�+I���S���D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��O�oData7K�NameActiveCoolingLevel
A��[�oDataCK�NameActiveCoolingDeviceIndex
A��Y�oDataAK�NameFanDeviceInstanceLength
A��M�oData5K�NameFanDeviceInstance
A��K�oData3K�NamePowerStateLength
A��?�oData'K�Name
PowerState
QHQ�Q�Q�QR@RhRDThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance,ActiveCoolingLevel8ActiveCoolingDeviceIndex4FanDeviceInstanceLength(FanDeviceInstance(PowerStateLengthPowerStateTEMP�XUn�V^�_V?��{Lv���D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��O�oData7K�NameActiveCoolingLevel
A��[�oDataCK�NameActiveCoolingDeviceIndex
A��Y�oDataAK�NameFanDeviceInstanceLength
A��M�oData5K�NameFanDeviceInstance
A��?�oData'K�Name
PowerState
�U(V`V�V�V�V�> WDThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance,ActiveCoolingLevel8ActiveCoolingDeviceIndex4FanDeviceInstanceLength(FanDeviceInstancePowerStateTEMP�xX��]}�[���q�M��D�	EventDataA��S�oData;K�NameDeviceInstanceLength
A��G�oData/K�NameDeviceInstance
A��?�oData'K�Name
PowerState
�X�X�>Y0DeviceInstanceLength$DeviceInstancePowerStateTEMP�\Z��۸�̫S����m`���D�	EventDataA��S�oData;K�NameDeviceInstanceLength
A��G�oData/K�NameDeviceInstance
A��;�oData#K�NameThrottle
�Z�Z�Z0DeviceInstanceLength$DeviceInstanceThrottleTEMPX�\A*7���U�
G9P����JD�	EventDataA��S�oData;K�NameDeviceInstanceLength
A��G�oData/K�NameDeviceInstance
A��?�oData'K�Name
PowerState
A��;�oData#K�NameThrottle
�\]�>(]D]0DeviceInstanceLength$DeviceInstancePowerStateThrottleTEMP@�^��j�焴Y�E��3rZ��6D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��A�oData)K�NameTemperature
_H_�_DThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstanceTemperatureTEMPt,a�]��S���X�;@��ZD�	EventDataA��Q�oData9K�NameAmlMethodNameLength
A��E�oData-K�Name
AmlMethodName
A��G�oData/K�NameAmlMethodState
A��G�oData/K�NameAmlElapsedTime

|a�a ?�a

�a,AmlMethodNameLength AmlMethodName$AmlMethodState$AmlElapsedTimeTEMP�Hc��k�_�]�6����D�	EventDataA��Q�oData9K�NameAmlMethodNameLength
A��E�oData-K�Name
AmlMethodName
A��=�oData%K�Name	Frequency

�c�c

�c,AmlMethodNameLength AmlMethodNameFrequencyTEMP,,�o���q"^�8�Iy,���zD�	EventDataA��]�oDataEK�NameThermalZoneBiosNameLength
A��Q�oData9K�NameThermalZoneBiosName
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_TC1
A��3�oDataK�Name_TC2
A��3�oDataK�Name_TSP
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
	A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
A��3�oDataK�Name_AC6

A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9
A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
A��3�oDataK�Name_NTT
A��=�oData%K�Name	_PSLCount
A��A�oData)K�Name_PSLEntries
�A��=�oData%K�Name	_TZDCount
A��A�oData)K�Name_TZDEntries
�A��=�oData%K�Name	_AL0Count
A��A�oData)K�Name_AL0Entries
�A��=�oData%K�Name	_AL1Count
A��A�oData)K�Name_AL1Entries
�A��=�oData%K�Name	_AL2Count
A��A�oData)K�Name_AL2Entries
�A��=�oData%K�Name	_AL3Count
A��A�oData)K�Name_AL3Entries
�A��=�oData%K�Name	_AL4Count
 A��A�oData)K�Name_AL4Entries
!�A��=�oData%K�Name	_AL5Count
"A��A�oData)K�Name_AL5Entries
#�A��=�oData%K�Name	_AL6Count
$A��A�oData)K�Name_AL6Entries
%�A��=�oData%K�Name	_AL7Count
&A��A�oData)K�Name_AL7Entries
'�A��=�oData%K�Name	_AL8Count
(A��A�oData)K�Name_AL8Entries
)�A��=�oData%K�Name	_AL9Count
*A��A�oData)K�Name_AL9Entries
+�s@sls|s�s�s�s�s�s�s�s�stt,t<tLt\tlt|t�t�t�t�t�tu(u@u\utu�u�u�u �u�u"v,v$Dv`v&xv�v(�v�v*�v8ThermalZoneBiosNameLength,ThermalZoneBiosName_TMP_PSV_TC1_TC2_TSP_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRT_NTT_PSLCount_PSLEntries_TZDCount_TZDEntries_AL0Count_AL0Entries_AL1Count_AL1Entries_AL2Count_AL2Entries_AL3Count_AL3Entries_AL4Count_AL4Entries_AL5Count_AL5Entries_AL6Count_AL6Entries_AL7Count_AL7Entries_AL8Count_AL8Entries_AL9Count_AL9EntriesTEMP�--��~����kU�RQ��ow����D�	EventDataA��]�oDataEK�NameThermalZoneBiosNameLength
A��Q�oData9K�NameThermalZoneBiosName
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_TC1
A��3�oDataK�Name_TC2
A��3�oDataK�Name_TSP
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
	A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
A��3�oDataK�Name_AC6

A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9
A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
A��3�oDataK�Name_NTT
A��=�oData%K�Name	_PSLCount
A��A�oData)K�Name_PSLEntries
�A��=�oData%K�Name	_TZDCount
A��A�oData)K�Name_TZDEntries
�A��=�oData%K�Name	_AL0Count
A��A�oData)K�Name_AL0Entries
�A��=�oData%K�Name	_AL1Count
A��A�oData)K�Name_AL1Entries
�A��=�oData%K�Name	_AL2Count
A��A�oData)K�Name_AL2Entries
�A��=�oData%K�Name	_AL3Count
A��A�oData)K�Name_AL3Entries
�A��=�oData%K�Name	_AL4Count
 A��A�oData)K�Name_AL4Entries
!�A��=�oData%K�Name	_AL5Count
"A��A�oData)K�Name_AL5Entries
#�A��=�oData%K�Name	_AL6Count
$A��A�oData)K�Name_AL6Entries
%�A��=�oData%K�Name	_AL7Count
&A��A�oData)K�Name_AL7Entries
'�A��=�oData%K�Name	_AL8Count
(A��A�oData)K�Name_AL8Entries
)�A��=�oData%K�Name	_AL9Count
*A��A�oData)K�Name_AL9Entries
+�A��I�oData1K�NameMinimumThrottle
,��������$�4�D�T�d�t���������ćԇ����8�P�l�������Ԉ�� �<� T�p�"����$��؉&��($�@�*X�t�8ThermalZoneBiosNameLength,ThermalZoneBiosName_TMP_PSV_TC1_TC2_TSP_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRT_NTT_PSLCount_PSLEntries_TZDCount_TZDEntries_AL0Count_AL0Entries_AL1Count_AL1Entries_AL2Count_AL2Entries_AL3Count_AL3Entries_AL4Count_AL4Entries_AL5Count_AL5Entries_AL6Count_AL6Entries_AL7Count_AL7Entries_AL8Count_AL8Entries_AL9Count_AL9Entries$MinimumThrottleTEMP�00h����p`�~S�㔿�,�����D�	EventDataA��]�oDataEK�NameThermalZoneBiosNameLength
A��Q�oData9K�NameThermalZoneBiosName
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_TC1
A��3�oDataK�Name_TC2
A��3�oDataK�Name_TSP
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
	A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
A��3�oDataK�Name_AC6

A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9
A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
A��3�oDataK�Name_NTT
A��=�oData%K�Name	_PSLCount
A��A�oData)K�Name_PSLEntries
�A��=�oData%K�Name	_TZDCount
A��A�oData)K�Name_TZDEntries
�A��=�oData%K�Name	_AL0Count
A��A�oData)K�Name_AL0Entries
�A��=�oData%K�Name	_AL1Count
A��A�oData)K�Name_AL1Entries
�A��=�oData%K�Name	_AL2Count
A��A�oData)K�Name_AL2Entries
�A��=�oData%K�Name	_AL3Count
A��A�oData)K�Name_AL3Entries
�A��=�oData%K�Name	_AL4Count
 A��A�oData)K�Name_AL4Entries
!�A��=�oData%K�Name	_AL5Count
"A��A�oData)K�Name_AL5Entries
#�A��=�oData%K�Name	_AL6Count
$A��A�oData)K�Name_AL6Entries
%�A��=�oData%K�Name	_AL7Count
&A��A�oData)K�Name_AL7Entries
'�A��=�oData%K�Name	_AL8Count
(A��A�oData)K�Name_AL8Entries
)�A��=�oData%K�Name	_AL9Count
*A��A�oData)K�Name_AL9Entries
+�A��I�oData1K�NameMinimumThrottle
,A��3�oDataK�Name_CR3
-A��3�oDataK�Name_TFP
.A��U�oData=K�NameOverThrottleThreshold
/(�`���������̛ܛ�����,�<�L�\�l�|�������Ĝ����,�H�`�|�����ȝ� ���"0�L�$d���&����(̞�*��@�P�`�8ThermalZoneBiosNameLength,ThermalZoneBiosName_TMP_PSV_TC1_TC2_TSP_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRT_NTT_PSLCount_PSLEntries_TZDCount_TZDEntries_AL0Count_AL0Entries_AL1Count_AL1Entries_AL2Count_AL2Entries_AL3Count_AL3Entries_AL4Count_AL4Entries_AL5Count_AL5Entries_AL6Count_AL6Entries_AL7Count_AL7Entries_AL8Count_AL8Entries_AL9Count_AL9Entries$MinimumThrottle_CR3_TFP0OverThrottleThresholdTEMP22�� ���;;Rwi��Q���6
D�	EventDataA��]�oDataEK�NameThermalZoneBiosNameLength
A��Q�oData9K�NameThermalZoneBiosName
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_TC1
A��3�oDataK�Name_TC2
A��3�oDataK�Name_TSP
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
	A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
A��3�oDataK�Name_AC6

A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9
A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
A��3�oDataK�Name_NTT
A��=�oData%K�Name	_PSLCount
A��A�oData)K�Name_PSLEntries
�A��=�oData%K�Name	_TZDCount
A��A�oData)K�Name_TZDEntries
�A��=�oData%K�Name	_AL0Count
A��A�oData)K�Name_AL0Entries
�A��=�oData%K�Name	_AL1Count
A��A�oData)K�Name_AL1Entries
�A��=�oData%K�Name	_AL2Count
A��A�oData)K�Name_AL2Entries
�A��=�oData%K�Name	_AL3Count
A��A�oData)K�Name_AL3Entries
�A��=�oData%K�Name	_AL4Count
 A��A�oData)K�Name_AL4Entries
!�A��=�oData%K�Name	_AL5Count
"A��A�oData)K�Name_AL5Entries
#�A��=�oData%K�Name	_AL6Count
$A��A�oData)K�Name_AL6Entries
%�A��=�oData%K�Name	_AL7Count
&A��A�oData)K�Name_AL7Entries
'�A��=�oData%K�Name	_AL8Count
(A��A�oData)K�Name_AL8Entries
)�A��=�oData%K�Name	_AL9Count
*A��A�oData)K�Name_AL9Entries
+�A��I�oData1K�NameMinimumThrottle
,A��3�oDataK�Name_CR3
-A��3�oDataK�Name_TFP
.A��U�oData=K�NameOverThrottleThreshold
/A��M�oData5K�NameDescriptionLength
0A��A�oData)K�NameDescription
1��H�X�h�x���������ȱر�����(�8�H�X�h�������в���8�P�l����� ��Գ"��$ �<�&T�p�(����*��ش����L�0t�8ThermalZoneBiosNameLength,ThermalZoneBiosName_TMP_PSV_TC1_TC2_TSP_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRT_NTT_PSLCount_PSLEntries_TZDCount_TZDEntries_AL0Count_AL0Entries_AL1Count_AL1Entries_AL2Count_AL2Entries_AL3Count_AL3Entries_AL4Count_AL4Entries_AL5Count_AL5Entries_AL6Count_AL6Entries_AL7Count_AL7Entries_AL8Count_AL8Entries_AL9Count_AL9Entries$MinimumThrottle_CR3_TFP0OverThrottleThreshold(DescriptionLengthDescriptionTEMP\334�bH׮�5S��E$�7"��p
D�	EventDataA��]�oDataEK�NameThermalZoneBiosNameLength
A��Q�oData9K�NameThermalZoneBiosName
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_TC1
A��3�oDataK�Name_TC2
A��3�oDataK�Name_TSP
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
	A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
A��3�oDataK�Name_AC6

A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9
A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
A��3�oDataK�Name_NTT
A��=�oData%K�Name	_PSLCount
A��A�oData)K�Name_PSLEntries
�A��=�oData%K�Name	_TZDCount
A��A�oData)K�Name_TZDEntries
�A��=�oData%K�Name	_AL0Count
A��A�oData)K�Name_AL0Entries
�A��=�oData%K�Name	_AL1Count
A��A�oData)K�Name_AL1Entries
�A��=�oData%K�Name	_AL2Count
A��A�oData)K�Name_AL2Entries
�A��=�oData%K�Name	_AL3Count
A��A�oData)K�Name_AL3Entries
�A��=�oData%K�Name	_AL4Count
 A��A�oData)K�Name_AL4Entries
!�A��=�oData%K�Name	_AL5Count
"A��A�oData)K�Name_AL5Entries
#�A��=�oData%K�Name	_AL6Count
$A��A�oData)K�Name_AL6Entries
%�A��=�oData%K�Name	_AL7Count
&A��A�oData)K�Name_AL7Entries
'�A��=�oData%K�Name	_AL8Count
(A��A�oData)K�Name_AL8Entries
)�A��=�oData%K�Name	_AL9Count
*A��A�oData)K�Name_AL9Entries
+�A��I�oData1K�NameMinimumThrottle
,A��3�oDataK�Name_CR3
-A��3�oDataK�Name_TFP
.A��U�oData=K�NameOverThrottleThreshold
/A��M�oData5K�NameDescriptionLength
0A��A�oData)K�NameDescription
1A��3�oDataK�Name_TZP
20�h�����������������$�4�D�T�d�t���������������4�P�h����������� � �"8�T�$l���&����(����*�$�H�X�h���0����8ThermalZoneBiosNameLength,ThermalZoneBiosName_TMP_PSV_TC1_TC2_TSP_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRT_NTT_PSLCount_PSLEntries_TZDCount_TZDEntries_AL0Count_AL0Entries_AL1Count_AL1Entries_AL2Count_AL2Entries_AL3Count_AL3Entries_AL4Count_AL4Entries_AL5Count_AL5Entries_AL6Count_AL6Entries_AL7Count_AL7Entries_AL8Count_AL8Entries_AL9Count_AL9Entries$MinimumThrottle_CR3_TFP0OverThrottleThreshold(DescriptionLengthDescription_TZPTEMP�����N��2]���7y�L����D�	EventDataA��M�oData5K�NameFanBiosNameLength
A��A�oData)K�NameFanBiosName
A��C�oData+K�NameFstSupported

A��?�oData'K�Name
PowerState
A��9�oData!K�NameControl
�4�

P��>p���(FanBiosNameLengthFanBiosName FstSupportedPowerStateControlTEMP���v��'_�֓
3�>���D�	EventDataA��M�oData5K�NameFanBiosNameLength
A��A�oData)K�NameFanBiosName
A��?�oData'K�Name
PowerState
�4��>P�(FanBiosNameLengthFanBiosNamePowerStateTEMP������
�(�Z��Ӗ���z���D�	EventDataA��M�oData5K�NameFanBiosNameLength
A��A�oData)K�NameFanBiosName
A��9�oData!K�NameControl
�����(FanBiosNameLengthFanBiosNameControlTEMP`<��-F)徤^Y(K�P��C���D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��S�oData;K�NameDeviceInstanceLength
A��G�oData/K�NameDeviceInstance
A��?�oData'K�Name
PowerState
�����L��>p�DThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance0DeviceInstanceLength$DeviceInstancePowerStateTEMPl��7i�u�p]^H���)���D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��S�oData;K�NameDeviceInstanceLength
A��G�oData/K�NameDeviceInstance
A��E�oData-K�Name
ThrottleLimit
�L�������DThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance0DeviceInstanceLength$DeviceInstance ThrottleLimitTEMP`|�ro�窯Q�Z�ٍ����PD�	EventDataA��S�oData;K�NameDeviceBiosNameLength
A��G�oData/K�NameDeviceBiosName
A��I�oData1K�NameDeviceResetType
A��7�oDataK�NameStatus
����D? �D�0DeviceBiosNameLength$DeviceBiosName$DeviceResetTypeStatusTEMP���]�	V�DW�gguF��lD�	EventDataA��K�oData3K�NameAcpiOverrideType
h?�(AcpiOverrideTypeTEMP|<�!6�;xv0R��F��*����D�	EventDataA��5�oDataK�NameScope
A��7�oDataK�NameObject
A��7�oDataK�NameStatus
x�����ScopeObjectStatusPRVAP��Microsoft-Windows-Kernel-AcpiOPCOLEVL�P<�PT�Pp�win:Errorwin:Warning(win:InformationalTASKDd�����e����8�f����`�g������h������i������j���� �k����L�l����|�m������n������o�����p�����q����H�r����l�s������t������u�����v����`�w����|�x������y������,ResourceTranslation(GpeEventHandling4TemperatureNotification0TripPointNotification8ActiveCoolingDevicePower$AmlMethodTrace,DeviceActiveCooling0DevicePassiveCooling0DeviceCoolingRundown(TemperatureChange,ThermalZoneRundownFanRundown,FanPowerStateChange$FanStatusChange4ActiveCoolingConstraintDActiveCoolingConstraintRundown8PassiveCoolingConstraintDPassiveCoolingConstraintRundownDeviceReset AcpiOverrideAMLIError(FrequentAmlMethodKEYW@����H�����l������� ������@�������������$acpi:Diagnostic acpi:Thermal0ms:ReservedKeyword40 ms:Telemetryms:Measures$ms:CriticalDataEVNT�d���@0���@�x>e���D0���D�x>f��PF0���H�x>g��PF0���L�x>h��<M0��P�x>h���R0��T�x>i ���_0�0�X�x>j��<W0�L�`�x>	k�	�$Y0�h�d�x>
l�
�[0���h�x>m�����\]0���l�x>n������c0���p�x>n������v0���t�x>n�������0���x�x>n�������0���|�x>n�������0�����x>
o�������0�����x>p�������0�����x>q�����l�0����x>r�����,�0�,���x>s�����,�0�H���x>t�������0�d���x>u�������0�����x>v ����0�����x>w ��X�0�����x>x��4������x>y��b$�����x>���������������������������������������������������������WEVT(���
�D�t�,�8�p�CHAND�	�`�����������ApplicationXMicrosoft-Windows-User-Loader/OperationalTMicrosoft-Windows-User-Loader/AnalyticTTBL�

TEMP����<z�#aSl3�z�R���\D�	EventDataA��;�oData#K�NameFileName
��FileNameTEMP�d�T��̫�[��L?��ZD�	EventDataA��9�oData!K�NameDllName
x�DllNameTEMP���S�C�Rd���7!C%���D�	EventDataA��]�oDataEK�NameProcessFileNamePathLength
A��Q�oData9K�NameProcessFileNamePath
����8ProcessFileNamePathLength,ProcessFileNamePathTEMP�T�
n��f�S��}�<���D�	EventDataA��E�oData-K�Name
FailureReason
A��E�oData-K�Name
ImportDllName
A��C�oData+K�NameExportModule
������ FailureReason ImportDllName ExportModuleTEMP�����[�t_�(m4�>�A���]EventXML+�xmlnsUser-Loader��&.�
FailureReason
��&�
ImportDllName
��,1ProcessImagePath
4�T�t� FailureReason ImportDllName(ProcessImagePathTEMPLx�԰R�7nU]=�	���A���]EventXML+�xmlnsUser-Loader��,1ProcessImagePath
��&��
CurDirDllPath
����(ProcessImagePath CurDirDllPathTEMP��R ֿy�pTZ4,�X��A���]EventXML+�xmlnsUser-Loader��,1ProcessImagePath
��&��
CurDirDllPath
��$��FoundDllPath
,�T�t�(ProcessImagePath CurDirDllPath FoundDllPathTEMP��(/E��TRO�^�]L���D�	EventDataA��E�oData-K�Name
FailureReason
A��E�oData-K�Name
ImportDllName
A��K�oData3K�NameProcessImagePath
�(�H� FailureReason ImportDllName(ProcessImagePathTEMP���<z�#aSl3�z�R���\D�	EventDataA��;�oData#K�NameFileName
�FileNameTEMP�\�ϙ���G\���{�ɼ>���D�	EventDataA��=�oData%K�Name	ProcessId
A��U�oData=K�NameSuspendProcessRequest
A��9�oData!K�NameDLLName
�����ProcessId0SuspendProcessRequestDLLNamePRVAP�Microsoft-Windows-User-LoaderOPCO01\�win:InfoLEVL�U��P�P�P� win:Criticalwin:Errorwin:Warning(win:InformationalTASKKEYW4�� �@@����	�
�LUSER_LOADER_KEYWORD_DEPRECATED_DLLPUSER_LOADER_FATAL_CALLBACK_EXCEPTIONHUSER_LOADER_KEYWORD_LOAD_FAILURE@USER_LOADER_LAUNCH_16BIT_APPTUSER_LOADER_KEYWORD_COMPONENT_ON_DEMANDPUSER_LOADER_KEYWORD_LOAD_FATAL_ERROREVNTp ��P����4�  ���P����4�@ 
��P����4�� �p�P����4� �,�P����4� ��P����4� ��P����4� 
$�P���4�	 	��P����4�
	�
��P����	���P����	���P����D�T�d�t���������WEVTt�(
�H��CHAN�D����lMicrosoft-Windows-Kernel-BootDiagnostics/DiagnosticPRVAh�Microsoft-Windows-Kernel-BootDiagnosticsOPCO020win:StartLEVL@P`(win:InformationalTASKD������SystemBootKEYWD1�(win:ResponseTimeEVNTD�������$T�P4�WEVT�5����� 
H2�23X35X5CHAN|�����`Microsoft-Windows-Kernel-Prefetch/DiagnosticTTBL(.
TEMPh�	{]�̝�S�V��..Ϫ��RD�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
0Pt,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeTEMP�	��0�nd^ᥦ�\�-y��6D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��E�oData-K�Name
PrefetchPhase
A��C�oData+K�NamePrefetchType
A��G�oData/K�NameIsTricklePhase
�	�	�	�	
<
\
,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType PrefetchPhase PrefetchType$IsTricklePhaseTEMP��;�
/�T�'�6z�f���>D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��M�oData5K�NamePrefetchPhaseMask
A��C�oData+K�NamePrefetchType
A��G�oData/K�NameIsTricklePhase
�
�
�
�
8X,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType(PrefetchPhaseMask PrefetchType$IsTricklePhaseTEMP		���Q�NoY���A����D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��E�oData-K�Name
PrefetchPhase
A��C�oData+K�NamePrefetchType
A��G�oData/K�NameIsTricklePhase
A��O�oData7K�NameNumPagesPrefetched

A��C�oData+K�NameNumReadLists
<h����

0\,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType PrefetchPhase PrefetchType$IsTricklePhase,NumPagesPrefetched NumReadListsTEMP		���|Xo�^{�k�1�l���D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��M�oData5K�NamePrefetchPhaseMask
A��C�oData+K�NamePrefetchType
A��G�oData/K�NameIsTricklePhase
A��O�oData7K�NameNumPagesPrefetched

A��C�oData+K�NameNumReadLists
Dp����

@l,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType(PrefetchPhaseMask PrefetchType$IsTricklePhase,NumPagesPrefetched NumReadListsTEMP�`��<޲5�U�K���v����D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��E�oData-K�Name
PrefetchPhase
��4T,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType PrefetchPhaseTEMP�P*�B�eh9[�������D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��M�oData5K�NamePrefetchPhaseMask
��$D,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType(PrefetchPhaseMaskTEMPh�	{]�̝�S�V��..Ϫ��RD�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
D p � � ,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeTEMP��"�.d�2ˮV��O��`���D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��=�oData%K�Name	EndReason
#0#P#t#�#,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeEndReasonTEMP�&������\Ic�ܑ(���0D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��A�oData)K�NameActionFlags
A��A�oData)K�NameTraceReason
A��G�oData/K�NamePrefetchReason
�&�&�&','H'd',ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeActionFlagsTraceReason$PrefetchReasonTEMP�		�*�Y�	U��Z����������D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��A�oData)K�NameActionFlags
A��A�oData)K�NameTraceReason
A��G�oData/K�NamePrefetchReason
A��A�oData)K�NameNumLaunches
A��W�oData?K�NameTimeSinceLastLaunchInS
H+t+�+�+�+�+,4,P,,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeActionFlagsTraceReason$PrefetchReasonNumLaunches4TimeSinceLastLaunchInSTEMP�X.Z
G,�GQ��W93�����D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��G�oData/K�NameWorkItemsCount
�.�./,/L/,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType$WorkItemsCountTEMP�<1ޞoد=�QI���������D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��=�oData%K�Name	NumPhases
�1�1�1202,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeNumPhasesPRVAX\2Microsoft-Windows-Kernel-PrefetchOPCOx1�22�223win:Infowin:Startwin:StopLEVL@P03(win:InformationalTASK�����(4����P4����x4�����4�����4	�����4
�����4(PrefetchSections(PrefetchMetadataOpenVolumesEndTrace(ScenarioDecision GetReadListsAsyncWorkerKEYWD ����,5(BasicInformationEVNT� �������2$3d3�8� ������
�2$3d3�8� �����|�2$3d3�8� �����|�2$3d3�8� �������2$3�3�8� �����t�2$3�3�8� �������2$3�3�8� �����t�2$3�3�8� �����l�2$3�3�8� �����l�2$3�3�8� ������ �2$3�3�8� ������#�2$3�3�8� ������'�2$3�3�8�		 ������,�2$3�3�8�
	 �����,�2$3�39�
 �����p/�2$349�
 �����,�2$349�

 �����,�2$349�555555555555555555WEVT �`9�9
 :`:l:�:�:�:CHANd|9�HMicrosoft-Windows-UAC/OperationalTTBL\TEMPP :)5�H7^A����d����D�	EventDataPRVA@4:Microsoft-Windows-UACOPCOLEVL0P�:win:ErrorTASKH�����: CreateProcessKEYWEVNT@���9x:�:l9WEVTH��;<
H=�=�=�=,>8>CHAN��;�hMicrosoft-Windows-Security-Adminless/OperationalTTBLDTEMP8�<�/c���UX�q��r�Y���D�	EventDataA��A�oData)K�NameFailureTime
A��=�oData%K�Name	StackHash
=0=FailureTimeStackHashPRVA`\=Microsoft-Windows-Security-AdminlessOPCOLEVL0P�=win:ErrorTASKH����> AccessFailureKEYWEVNT@��<�=�=�;WEVT�	�>l?
�@0A<AlA�A�ACHAN��>�Microsoft-Windows-Security-LessPrivilegedAppContainer/OperationalTTBLDTEMP8T@�/c���UX�q��r�Y���D�	EventDataA��A�oData)K�NameFailureTime
A��=�oData%K�Name	StackHash
|@�@FailureTimeStackHashPRVA��@Microsoft-Windows-Security-LessPrivilegedAppContainerOPCOLEVL0PTAwin:ErrorTASKH�����A AccessFailureKEYWEVNT@�
x?HAxA�>WEVT��PB�B
lC�C�CD(DxDCHAN`lB����DMicrosoft-Windows-COM/AnalyticTTBL�TEMP�HC�w�Nm\"l):��N��VD�	EventDataA��5�oDataK�NameCLSID
\CCLSIDPRVA@�CMicrosoft-Windows-COMOPCO01�Cwin:InfoLEVL@P�C(win:InformationalTASKKEYWLDD0COM_CLASSNOTREG_ERROREVNTD���B�C�C�D\B4DWEVT��EDE
LJ�J�J0K<KHKCHAN8(E	�ApplicationTTBLTEMPHdF���̧��Vv�@�gA����8Path��xmlnsDhttp://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0��&Q
AttemptedPath
xF AttemptedPathTEMP��G���Ew��\�C_�_�3A����PathAndGuid��xmlnsDhttp://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0��&Q
AttemptedPath
��"��SrpRuleGuid
H,H AttemptedPathSrpRuleGuidTEMP�I7z7�--Wj�Mi(JRA��@%�PathGuidAndRule��xmlnsDhttp://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0��&Q
AttemptedPath
��"��SrpRuleGuid
����RulePath
�IJ4J AttemptedPathSrpRuleGuidRulePathPRVAp`JMicrosoft-Windows-SoftwareRestrictionPoliciesOPCOLEVLhP�JPKwin:Warning(win:InformationalTASKKEYWEVNT02	�2	�F�JEa	�a	PE�JEb	�b	HH�JEc	�c	PE�JEd	�d	�F�JEr	�r	�F�JEWEVTp��LN
]L]l^�^�_�_CHANPM�\M��M��M�HMicrosoft-Windows-MUI/Operational<Microsoft-Windows-MUI/AdminDMicrosoft-Windows-MUI/Analytic<Microsoft-Windows-MUI/DebugTTBL�TEMP��N$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
�NStatusTEMP�hO�<z�#aSl3�z�R���\D�	EventDataA��;�oData#K�NameFileName
|OFileNameTEMP��P;o��s\fj������D�	EventDataA��;�oData#K�NameFileName
A��3�oDataK�NameType
A��C�oData+K�NameFunctionName
�P�PQFileNameType FunctionNameTEMP��Q�<z�#aSl3�z�R���\D�	EventDataA��;�oData#K�NameFileName
�QFileNameTEMP$PS�*z�8�WM
sWR�	���2D�	EventDataA��5�oDataK�NameFlags
A��A�oData)K�NameNewLanguage
A��C�oData+K�NamePrevLanguage
A��C�oData+K�NameExtendedFlag
�S�S�S�SFlagsNewLanguage PrevLanguage ExtendedFlagTEMP�0U �ُ_�<�vw����D�	EventDataA��;�oData#K�NameFileName
A��C�oData+K�NameFunctionName
A��A�oData)K�NameReturnValue
lU�U�UFileName FunctionNameReturnValueTEMP�TV)�Y�?��T0��U�����^D�	EventDataA��=�oData%K�Name	Parameter
hVParameterTEMPP�V)5�H7^A����d����D�	EventDataTEMPP W)5�H7^A����d����D�	EventDataTEMP��W4�=��|NP5��pk7��TD�	EventDataA��3�oDataK�NameName
�WNameTEMP��X�f��dY��x(������D�	EventDataA��E�oData-K�Name
NewCacheIndex
A��G�oData/K�NameLiveCacheIndex
A��7�oDataK�NameConfig
0YPYtY NewCacheIndex$LiveCacheIndexConfigTEMP�Z?~�v|�Uj��]�4���^D�	EventDataA��=�oData%K�Name	ErrorCode
0ZErrorCodeTEMP�[aM?��iV����"D�	EventDataA��;�oData#K�NameFileName
A��;�oData#K�NameAffinity
A��;�oData#K�NameSequence
A��;�oData#K�NamePriority
�[\ \8\FileNameAffinitySequencePriorityTEMP��\�<z�#aSl3�z�R���\D�	EventDataA��;�oData#K�NameFileName
�\FileNamePRVA@ ]Microsoft-Windows-MUIOPCO :�]:�]  :�]!!:^"":0^##:L^$$:\^Initialize$InvokeCallback DisableCache$UpdateManifestBuildCacheEntryExitLEVL�P�^P�^P�^win:Errorwin:Warning(win:InformationalTASK�z<_zl_0NotifyLanguageChange RescacheBuildKEYWEVNTP����$Nd]x^_�L�@���Nd]x^_�L�@���Od]x^_�L�@��,Qd]x^_�L�@��,Qd]x^_�L�����VX]x^ _�L�����VX]x^ _�L� ����Vp]x^ _�L�����VX]x^ _�L�!@���V|]x^ _�L�!����V|]x^ _�L�"����Y�]x^ _�L�"����V�]x^ _�L�����VX]x^ _�L�����QX]�^_�L����Td]�^_�L�����UX]�^ _�L�!��HZ|]�^ _M�" �� W�]�^ _�L�" �� W�]�^ _�L�"����W�]�^ _�L�# �� W�]�^ _�L�$ �� W�]�^ _�L�# �� W�]�^ _�L�$ �� W�]�^ _�L�!��P\|]�^ _M�����VX]�^ _�L�" ���V�]�^ _�LWEVT,8e$f
�k(l�lm0oxoCHAN�de�����e����\Microsoft-Windows-Kernel-AppCompat/GeneraldMicrosoft-Windows-Kernel-AppCompat/PerformanceTTBL�TEMP��gc��snGa_�!(�y���bD�	EventDataA��S�oData;K�NameExecutablePathLength
A��G�oData/K�NameExecutablePath
A��O�oData7K�NameRegistryPathLength
A��C�oData+K�NameRegistryPath
hHhlh�h0ExecutablePathLength$ExecutablePath,RegistryPathLength RegistryPathTEMP�Li9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
`iStatusCodeTEMPP�jj��F<U�Z����8���JD�	EventDataA��E�oData-K�Name
KeyNameLength
A��9�oData!K�NameKeyName
A��Q�oData9K�NameParentKeyNameLength
A��E�oData-K�Name
ParentKeyName
Lklk�k�k KeyNameLengthKeyName,ParentKeyNameLength ParentKeyNamePRVA\�kMicrosoft-Windows-Kernel-AppCompatOPCOx1Xl2pl2�lwin:Infowin:Startwin:StopLEVLdP�lP�lwin:Error(win:InformationalTASK,�����m����n����<n����`n�����n�����n�����n�����n$CompatCacheInit(CompatCacheQuery$CompatCdbQuery$CompatMapQuirks(CompatCacheUpdate,CompatUserModeQuery$CompatSdbQuery4CompatCacheQueryProcessKEYWH����Lo,RegWrpAccessDeniedEVNTt�60f4l�l�rDe@����@l�lmTe@�����hLl�lmTe@����@l�l�mTe@�����hLl�l�mTe@����@l�l,mTe@�����hLl�l,mTe@����@l�lHmTe	@�����hLl�lHmTe
@����@l�ldmTe@�����hLl�ldmTe@����@l�l�mTe
@�����hLl�l�mTe@����@l�l�mTe@�����hLl�l�mTe@����@l�l�mTe@�����hLl�l�mTe��	|i�lDe<oWEVT,-4s
X����������TTBL$TEMP�t\��S�CL�93���� D�	EventDataA��Y�oDataAK�NamecchAppPathIncludingNull
A��_�oDataGK�NameApplicationImageHeaderHash
A��9�oData!K�NameAppPath
�tu@u4cchAppPathIncludingNull<ApplicationImageHeaderHashAppPathTEMP|Pv}�풚T�Xh���������D�	EventDataA��A�oData)K�NameFeatureGuid
A��_�oDataGK�NameApplicationImageHeaderHash
xv�vFeatureGuid<ApplicationImageHeaderHashTEMP4@x��H�^�m#��!���:D�	EventDataA��A�oData)K�NameFeatureGuid
A��C�oData+K�NameCallerIdType
A��C�oData+K�NamecchImagePath
A��=�oData%K�Name	ImagePath
�x�x�x�xFeatureGuid CallerIdType cchImagePathImagePathTEMP��zx�a8p�RX1��z�`���D�	EventDataA��i�oDataQK�NamecchParentImagePathIncludingNull
A��A�oData)K�NameFeatureGuid
A��c�oDataKK�NameParentProcessImageHeaderHash
A��I�oData1K�NameParentImagePath
{X{t{�{DcchParentImagePathIncludingNullFeatureGuid@ParentProcessImageHeaderHash$ParentImagePathTEMP		�~U��[W_���y��x���D�	EventDataA��5�oDataK�NameFlags
A��[�oDataCK�NamecchIdStringIncludingNull
A��Y�oDataAK�NamecchDllPathIncludingNull
A��;�oData#K�NameCategory
A��I�oData1K�NameManifestVersion
A��E�oData-K�Name
DllHeaderHash
A��_�oDataGK�NameApplicationImageHeaderHash
A��;�oData#K�NameIdString
A��9�oData!K�NameDllPath
����4�X�x���̀Flags8cchIdStringIncludingNull4cchDllPathIncludingNullCategory$ManifestVersion DllHeaderHash<ApplicationImageHeaderHashIdStringDllPathTEMPx�]ng��P\��\堟����D�	EventDataA��5�oDataK�NameFlags
A��[�oDataCK�NamecchIdStringIncludingNull
A��;�oData#K�NameCategory
A��I�oData1K�NameManifestVersion
A��_�oDataGK�NameApplicationImageHeaderHash
A��;�oData#K�NameIdString
����ȃ��@�Flags8cchIdStringIncludingNullCategory$ManifestVersion<ApplicationImageHeaderHashIdStringPRVA@l�Microsoft-Windows-AITOPCOLEVL@P��(win:InformationalTASK�����������Ѕ���������������D�����p�������AitFeature,AitParentAitFeatureAitAppInfo,AitSystemUsageByDll,AitSystemUsageByExe AitProcessEndKitFeatureKEYWEVNT`����Tu�������y�������@s��(������{��D��������`�������|������v����WEVTx0`�
\����8�D�P�TTBL�TEMP����{��U+0"�����vD�	EventDataA��U�oData=K�NameAeLookupServieTrigger
,�0AeLookupServieTriggerPRVA�p�Microsoft-Windows-ApplicationExperience-LookupServiceTriggerOPCOLEVL@P�(win:InformationalTASKKEYWEVNT@����l��WEVT�.�D�
���������CHANd����������������hMicrosoft-Windows-Kernel-ApphelpCache/Operational\Microsoft-Windows-Kernel-ApphelpCache/DebugdMicrosoft-Windows-Kernel-ApphelpCache/AnalyticTTBL�TEMP��_�Yn5�]�S�#����pD�	EventDataA��O�oData7K�NameOperationalMessage
�,OperationalMessageTEMP�̍nШ)�\�����{���bD�	EventDataA��A�oData)K�NameInfoMessage
�InfoMessageTEMP���$&��_��XB�8'�;���dD�	EventDataA��C�oData+K�NameDebugMessage
�� DebugMessageTEMPTH�G'L46߬U��|�8����LD�	EventDataA��9�oData!K�NameMatches

A��A�oData)K�NameCheckerName
A��E�oData-K�Name
AttributeName
A��W�oData?K�NameAttributeExpectedValue


����Ȑ�MatchesCheckerName AttributeName4AttributeExpectedValueTEMPT���B���S%�N���*���LD�	EventDataA��9�oData!K�NameMatches

A��A�oData)K�NameCheckerName
A��E�oData-K�Name
AttributeName
A��W�oData?K�NameAttributeExpectedValue


���<�MatchesCheckerName AttributeName4AttributeExpectedValueTEMPT�N�T3��*T}�O�(�U���LD�	EventDataA��9�oData!K�NameMatches

A��A�oData)K�NameCheckerName
A��E�oData-K�Name
AttributeName
A��W�oData?K�NameAttributeExpectedValue


@�T�p���MatchesCheckerName AttributeName4AttributeExpectedValueTEMPTD�^T����Q
1����M���LD�	EventDataA��9�oData!K�NameMatches

A��A�oData)K�NameCheckerName
A��E�oData-K�Name
AttributeName
A��W�oData?K�NameAttributeExpectedValue



����ė

�MatchesCheckerName AttributeName4AttributeExpectedValuePRVAp,�Microsoft-Windows-ApplicationExperience-CacheOPCOLEVLdP��PИwin:Error(win:InformationalTASKKEYWEVNT`�3P���� 44����@5������@4Ȏ����@4�����@4p�����	@4ĕ����WEVT�
/��
d���,�0�@�TTBL�
TEMPx�No��X�Z-YT��i����D�	EventDataA��K�oData3K�NameSwitchBranchGuid
A��W�oData?K�NameSwitchBranchNameLength
A��K�oData3K�NameSwitchBranchName
A��e�oDataMK�NameSwitchBranchDescriptionLength
A��Y�oDataAK�NameSwitchBranchDescription
D�l���ȝ�(SwitchBranchGuid4SwitchBranchNameLength(SwitchBranchName@SwitchBranchDescriptionLength4SwitchBranchDescriptionTEMP����O���P�.��>$��D�	EventDataA��S�oData;K�NameSwitchBranchImplGuid
A��_�oDataGK�NameSwitchBranchImplNameLength
A��S�oData;K�NameSwitchBranchImplName
A��m�oDataUK�Name!SwitchBranchImplDescriptionLength
A��a�oDataIK�NameSwitchBranchImplDescription
��P���ȡ0SwitchBranchImplGuid<SwitchBranchImplNameLength0SwitchBranchImplNameHSwitchBranchImplDescriptionLength<SwitchBranchImplDescriptionTEMPt���=�t�\U�����ZD�	EventDataA��M�oData5K�NameTargetContextGuid
A��M�oData5K�NameTargetContextType
A��K�oData3K�NameModuleNameLength
A��?�oData'K�Name
ModuleName
��4�\�(TargetContextGuid(TargetContextType(ModuleNameLengthModuleNameTEMP� �mUl���S��G4�1���tD�	EventDataA��S�oData;K�NameContextUpdateCounter



4�0ContextUpdateCounterPRVA|x�Microsoft-Windows-ApplicationExperience-SwitchBackOPCOLEVL@P�(win:InformationalTASK����������������ئ�����AeSbCallAeSbImpl(AeSbContextUpdate0AeSbContextReadRetryKEYWEVNT�����Ě��8�����<���T��������p�����x�����WEVT`'�`�Ԩ
H���D���8���CHANt|�����XMicrosoft-Windows-Kernel-Network/AnalyticTTBLtTEMP(

��l\FX_TR4Ԅ/"\��zD�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��;�oData#K�Namestartime
A��9�oData!K�Nameendtime
A��7�oDataK�Nameseqnum
A��7�oDataK�Nameconnid
	X�d�t���������̬��PIDsizedaddrsaddrdportsportstartimeendtimeseqnumconnidTEMPP4�ؕ�`�]O QjYDz����D�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��7�oDataK�Nameseqnum
A��7�oDataK�Nameconnid
ԯ���� �0�D�PIDsizedaddrsaddrdportsportseqnumconnidTEMP(D�A�r���S����K������D�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��1�oDataK�Namemss
A��9�oData!K�Namesackopt
A��5�oDataK�Nametsopt
A��5�oDataK�Namewsopt
	A��7�oDataK�Namercvwin
A��A�oData)K�Namercvwinscale
A��A�oData)K�Namesndwinscale
A��7�oDataK�Nameseqnum

A��7�oDataK�Nameconnid
p�|���������̵ص���� �<�X�l�PIDsizedaddrsaddrdportsportmsssackopttsoptwsoptrcvwinrcvwinscalesndwinscaleseqnumconnidTEMP(T�(n�n3��^���2�P���D�	EventDataA��5�oDataK�NameProto
A��A�oData)K�NameFailureCode
|���ProtoFailureCodeTEMP(

X�{i^�Ӻ.\���F����zD�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��;�oData#K�Namestartime
A��9�oData!K�Nameendtime
A��7�oDataK�Nameseqnum
A��7�oDataK�Nameconnid
	 �,�<�L�\�l�|�������PIDsizedaddrsaddrdportsportstartimeendtimeseqnumconnidTEMPP��5[� 7�WIh�C4����D�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��7�oDataK�Nameseqnum
A��7�oDataK�Nameconnid
������Ⱦؾ����PIDsizedaddrsaddrdportsportseqnumconnidTEMP(�����OQ�s��W����D�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��1�oDataK�Namemss
A��9�oData!K�Namesackopt
A��5�oDataK�Nametsopt
A��5�oDataK�Namewsopt
	A��7�oDataK�Namercvwin
A��A�oData)K�Namercvwinscale
A��A�oData)K�Namesndwinscale
A��7�oDataK�Nameseqnum

A��7�oDataK�Nameconnid
8�D�T�d�t���������������� �4�PIDsizedaddrsaddrdportsportmsssackopttsoptwsoptrcvwinrcvwinscalesndwinscaleseqnumconnidPRVAX\�Microsoft-Windows-Kernel-NetworkOPCO�
�<��x����
����<����������D�*���+���1�<KERNEL_NETWORK_OPCODE_SEND<KERNEL_NETWORK_OPCODE_RECV@KERNEL_NETWORK_OPCODE_CONNECTHKERNEL_NETWORK_OPCODE_DISCONNECTHKERNEL_NETWORK_OPCODE_RETRANSMIT@KERNEL_NETWORK_OPCODE_ACCEPTDKERNEL_NETWORK_OPCODE_RECONNECT<KERNEL_NETWORK_OPCODE_FAIL@KERNEL_NETWORK_OPCODE_TCPCOPY@KERNEL_NETWORK_OPCODE_SENDUDP@KERNEL_NETWORK_OPCODE_RECVUDP@KERNEL_NETWORK_OPCODE_FAILUDPLEVL@P\�(win:InformationalTASK�
�����������8KERNEL_NETWORK_TASK_TCPIP8KERNEL_NETWORK_TASK_UDPIPKEYW�����d� ������<KERNEL_NETWORK_KEYWORD_IPV4<KERNEL_NETWORK_KEYWORD_IPV6EVNT�


����P����l�
����P����l�
�X���P����l�

����P����l�
����P��� �l�
�X���P���$�l�
����P���(�l�
0����P���,�l�
�	��P���4�l�

 �
����P���8�l�
 ��P���<�l�
 � ���P���@�l�
 ��P���D�l�
 ��P���H�l�
 � ���P���L�l� 
 ��P���P�l�"
 �л�P���T�l�**�
��P���X�l�++��$�P���\�l�110���0�P���`�l�:* �л�P���h�l�;+ �л$�P���l�l�D�D�D�D�D�D�D�D�T�D�T�T�T�T�T�T�T�T�D�D�D�T�T�T�WEVT�X��0�
����X�d�p�CHANp������TMicrosoft-Windows-Kernel-Disk/AnalyticTTBL�TEMP,���ѵ�ggZ�� *B��bD�	EventDataA��?�oData'K�Name
DiskNumber
A��;�oData#K�NameIrpFlags
A��C�oData+K�NameTransferSize
A��;�oData#K�NameReserved
A��?�oData'K�Name
ByteOffset

A��?�oData'K�Name
FileObject
A��I�oData1K�NameIORequestPacket
A��Q�oData9K�NameHighResResponseTime

t�������

�����

<�DiskNumberIrpFlags TransferSizeReservedByteOffsetFileObject$IORequestPacket,HighResResponseTimeTEMPT��(u��&,&V�O��2���JD�	EventDataA��?�oData'K�Name
DiskNumber
A��;�oData#K�NameIrpFlags
A��Q�oData9K�NameHighResResponseTime

A��I�oData1K�NameIORequestPacket
8�T�

l���DiskNumberIrpFlags,HighResResponseTime$IORequestPacketPRVAP��Microsoft-Windows-Kernel-DiskOPCOLEVL@P0�(win:InformationalTASKKEYWEVNT�
�Y<�$����Z<�$����[h�$���WEVT8D�	h�T���
��4��CHAN�������\Microsoft-Windows-Kernel-EventTracing/AdmindMicrosoft-Windows-Kernel-EventTracing/AnalyticMAPS�d�VMAPd��
��������	�
� StopReasonMapTTBL�1TEMPX�
�9G�U�d��A�v��0D�	EventDataA��A�oData)K�NameSessionName
A��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��A�oData)K�NameLoggingMode
��������SessionNameFileNameErrorCodeLoggingModeTEMP���i[%�_�[Vw'�֦Z���|D�	EventDataA��A�oData)K�NameSessionName
A��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��A�oData)K�NameLoggingMode
A��E�oData-K�Name
FailureReason
$�@�X�p�d���SessionNameFileNameErrorCodeLoggingMode FailureReasonTEMP�X��A\�X+�P2�Z;f���xD�	EventDataA��A�oData)K�NameSessionName
A��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��A�oData)K�NameLoggingMode
A��A�oData)K�NameMaxFileSize

�������

$�SessionNameFileNameErrorCodeLoggingModeMaxFileSizeTEMP�d����d��TY��|������D�	EventDataA��A�oData)K�NameSessionName
A��=�oData%K�Name	ErrorCode
A��A�oData)K�NameLoggingMode
������SessionNameErrorCodeLoggingModeTEMPD���X�f��Z�pI�n���D�	EventDataA��C�oData+K�NameProviderName
A��A�oData)K�NameSessionName
��� ProviderNameSessionNameTEMP��� ����Y�{?C����dD�	EventDataA��C�oData+K�NameProviderName
�� ProviderNameTEMP,l��#�|��VS��?����8D�	EventDataA��A�oData)K�NameSessionGuid
A��?�oData'K�Name
LoggerMode
A��A�oData)K�NameSessionName
A��A�oData)K�NameLogFileName
�������SessionGuidLoggerModeSessionNameLogFileNameTEMP\

t�?����a
]�>��;��Q��D�	EventDataA��A�oData)K�NameSessionGuid
A��?�oData'K�Name
LoggerMode
A��A�oData)K�NameSessionName
A��A�oData)K�NameLogFileName
A��G�oData/K�NameMinimumBuffers
A��G�oData/K�NameMaximumBuffers
A��?�oData'K�Name
BufferSize
A��K�oData3K�NamePeakBuffersCount
A��Q�oData9K�NameCurrentBuffersCount
A��G�oData/K�NameFlushThreshold
	<�X�t����������8�d�SessionGuidLoggerModeSessionNameLogFileName$MinimumBuffers$MaximumBuffersBufferSize(PeakBuffersCount,CurrentBuffersCount$FlushThresholdTEMPP���$���[�㟿�Q��:D�	EventDataA��A�oData)K�NameSessionGuid
A��?�oData'K�Name
LoggerMode
A��A�oData)K�NameSessionName
A��A�oData)K�NameLogFileName
A��G�oData/K�NameMinimumBuffers
A��G�oData/K�NameMaximumBuffers
A��?�oData'K�Name
BufferSize
A��K�oData3K�NamePeakBuffersCount
A��Q�oData9K�NameCurrentBuffersCount
A��G�oData/K�NameFlushThreshold
	A��?�oData'K�Name
EventsLost
A��A�oData)K�NameBuffersLost
A��Q�oData9K�NameRealTimeBuffersLost
A��;�oData#K�NameLoggerId

�,�H�d����������8�\�x�����SessionGuidLoggerModeSessionNameLogFileName$MinimumBuffers$MaximumBuffersBufferSize(PeakBuffersCount,CurrentBuffersCount$FlushThresholdEventsLostBuffersLost,RealTimeBuffersLostLoggerIdTEMP��
.��tX�W���G
��D�	EventDataA��A�oData)K�NameSessionName
A��I�oData1K�NameSecurityDescOld
A��I�oData1K�NameSecurityDescNew
L�h���SessionName$SecurityDescOld$SecurityDescNewTEMP�˥����Y�P_��y���.D�	EventDataA��?�oData'K�Name
ProviderId
A��?�oData'K�Name
StatusCode
A��9�oData!K�NameEventId
A��A�oData)K�NameSessionName
d�������ProviderIdStatusCodeEventIdSessionNameTEMP<�9�'H�*bR�J�����D�	EventDataA��C�oData+K�NameProviderName
A��A�oData)K�NameSessionName
A��I�oData1K�NameMatchAnyKeyword

A��I�oData1K�NameMatchAllKeyword

A��G�oData/K�NameEnableProperty
A��5�oDataK�NameLevel
P�p�
��
����� ProviderNameSessionName$MatchAnyKeyword$MatchAllKeyword$EnablePropertyLevelTEMP����茴��\��i������D�	EventDataA��;�oData#K�NameFileName
A��?�oData'K�Name
BufferSize
A��K�oData3K�NameBuffersPersisted
A��G�oData/K�NameBuffersWritten
A��7�oDataK�NameStatus
 �8�T�|���FileNameBufferSize(BuffersPersisted$BuffersWrittenStatusTEMP$���`�Z�S��.�ۊ���D�	EventDataA��;�oData#K�NameFileName
A��?�oData'K�Name
BufferSize
A��K�oData3K�NameBuffersPersisted
A��G�oData/K�NameBuffersWritten
A��7�oDataK�NameStatus
A��A�oData)K�NameBuffersLost
(@\���FileNameBufferSize(BuffersPersisted$BuffersWrittenStatusBuffersLostTEMP\�w�,V�
tZ�$@6�������D�	EventDataA��C�oData+K�NameProviderGuid
A��M�oData5K�NameProviderGroupGuid
� ProviderGuid(ProviderGroupGuidTEMP<�o���U}2jYn��:���D�	EventDataA��C�oData+K�NameProviderGuid
A��=�oData%K�Name	ErrorCode
8X ProviderGuidErrorCodeTEMPdC��6R�SСC��Qa����D�	EventDataA��C�oData+K�NameProviderGUID
A��=�oData%K�Name	GroupGUID
A��5�oDataK�NameFlags
A��?�oData'K�Name
EnableMask
A��I�oData1K�NameGroupEnableMask
A��=�oData%K�Name	ProcessId
��$@d ProviderGUIDGroupGUIDFlagsEnableMask$GroupEnableMaskProcessIdTEMPp�׺��}YEA��C����D�	EventDataA��3�oDataK�NameGUID
A��5�oDataK�NameIndex
A��;�oData#K�NameLoggerId
A��I�oData1K�NameMatchAnyKeyword

A��I�oData1K�NameMatchAllKeyword

A��5�oDataK�NameLevel
A��G�oData/K�NameEnableProperty
8	H	X	
p	
�	�	�	GUIDIndexLoggerId$MatchAnyKeyword$MatchAllKeywordLevel$EnablePropertyTEMP�1��WPZ“���لb���D�	EventDataA��3�oDataK�NameGUID
A��A�oData)K�NameFilterFlags
A��O�oData7K�NameLastEnableLoggerId
P`|GUIDFilterFlags,LastEnableLoggerIdPRVA`�Microsoft-Windows-Kernel-EventTracingOPCOx1�2�2

�
�P
��
��
��
��
�$�T�|����U VPwin:Infowin:Startwin:Stop4ETW_OPCODE_WRITE_BUFFER4ETW_OPCODE_FILE_SWITCH(ETW_OPCODE_START$ETW_OPCODE_STOP(ETW_OPCODE_FLUSH,ETW_OPCODE_REGISTER0ETW_OPCODE_UNREGISTER(ETW_OPCODE_ENABLE,ETW_OPCODE_DISABLE0ETW_OPCODE_CONFIGUREHETW_OPCODE_USER_MODE_STACK_TRACE0ETW_OPCODE_SET_TRAITS0ETW_OPCODE_GROUP_JOINLEVL�P�P�P�[win:Errorwin:Warning(win:Informationalwin:VerboseTASK�	�<�d��������@����l	T�(ETW_TASK_LOGGING(ETW_TASK_SESSION(ETW_TASK_PROVIDER,ETW_TASK_GUID_ENTRY0ETW_TASK_GROUP_ENTRY0ETW_TASK_STACK_TRACE,ETW_TASK_LOST_EVENT,SavePersistedLogger0ETW_TASK_ENABLE_INFOKEYW �T ��@����������������T����������,ETW_KEYWORD_SESSION0ETW_KEYWORD_PROVIDER4ETW_KEYWORD_LOST_EVENT8ETW_KEYWORD_SOFT_RESTART8ETW_KEYWORD_CAPTURE_STATE8ETW_KEYWORD_REGISTRATION4ETW_KEYWORD_ENABLEMENT(ETW_KEYWORD_GROUPEVNT`#
����8�@�t�
��@�8�@�t�����P�\�t�����\�\�t����\�\�t�
����8�@�t�����D�@�t� @�4�t�x���	 @�4���x���
@��P�\���
@�,�P�\���@��\�\���@�,�\�\���@���\�\���@����\���
@��h�\��� @�����x��� @����x��� @�����x���@����\�������@�������������,��\��������\������ ��������,��������,������t�������t� �����	��	�����	��	 ����|�   ����p�x( 
�R4��x0t� 
@S���x<����������$�$��������4�4�4�����D���$D�$DWEVT,:�	���&
$t�	P
�&X)CHAN��������D����SystemTMicrosoft-Windows-Kernel-Boot/AnalyticXMicrosoft-Windows-Kernel-Boot/OperationalMAPSD	��$�t%@%�#@VMAP|&
��������d	�e
�f�g�h
�BMAP|�&
������ �@��	�
��� 
�VMAP$�%���� � � �0�0�0�0�0�0�0�P�@�@�@�@�@ �@!�@"� @#� @$� @%� @&� @'� @(� @)� @*� @+�	 @,�
 @-� @.� @/�
 @0� @1� @2� @3� @4� @5� @6� @7� @8� @9� @:� @;� @<� @=� @>� @?� @@�0@A�0@B�0@C�0@D�0@E�0@F�0@G�0@H�	0@I�
0@J�0@K�0@L�
0@M�0@N�0@O�0@P�0@Q�0@R�0@S�0@T�0@U�0@V�0@W�0@X�0@Y�0@Z�0@[�0@\�0@]�0@^�0@_� 0@`�!0@a�"0@b�#0@c�$0@d�%0@e�&0@f�'0@g�(0@h�)0@i�*0@j�+0@k�,0@l�-0@m�.0@n�/0@o�00@p�10@q�20@r�30@s�40@t�50@u�60@v�70@w�80@x�90@y�:0@z�;0@{�<0@|�=0@}�>0@~�?0@�@0@��A0@��B0@��Y0@��@@��@@��@@��@@��@@��@@��@@��P@��P@��P@��P@��P@��P@��P@��P@��P@��	P@��
P@��P@��P@��
P@��P@��P@��`@��`@��`@��`@��`@��`@��`@��`@��	`@��
`@��`@��`@��
`@��`@��`@��`@��`@��`@��`@��`@��`@��VMAP��&������������������	��
������
������������������������������VMAPl�%������������������	��
��VMAP4d&��������VMAP<8&����������,BootDiagMessageMap(DebuggerStatusMap4EnableDisableReasonMap,SbatUpdateStatusMap<SecureBootBcdMitigationMap TxtStatusMap VsmPolicyMapTTBLD��TEMP`�(��Ǎ��Y<��������D�	EventDataA��9�oData!K�NameSqmType
A��G�oData/K�NameSqmSessionGuid
A��5�oDataK�NameSqmID
A��O�oData7K�NameSqmStreamRowLength
A��QZ�ComplexData+K�NameSqmStreamRow
�T)h)�)�)�)�)*(*SqmType$SqmSessionGuidSqmID,SqmStreamRowLength SqmStreamRow SqmTypeEntry SqmDWORDEntry$SqmStringEntryTEMP�`+*�d�Ÿ[�|5�NR����D�	EventDataA��5�oDataK�NameWidth
A��7�oDataK�NameHeight
A��C�oData+K�NameBitsPerPixel
�+�+�+WidthHeight BitsPerPixelTEMP�t,A�g���[k#l�'t���`D�	EventDataA��?�oData'K�Name
BytesPerMs
�,BytesPerMsTEMP.�
1�BW[�n��Ts��,D�	EventDataA��;�oData#K�NameDeviceID
A��;�oData#K�NameFileName
A��=�oData%K�Name	BytesRead

A��C�oData+K�NameBytesWritten

T.l.

�.

�.DeviceIDFileNameBytesRead BytesWrittenTEMP��/�چ�ЛV���k+�[b���D�	EventDataA��;�oData#K�NameDeviceID
A��;�oData#K�NameFileName
A��7�oDataK�NameStatus
0 080DeviceIDFileNameStatusTEMP�x1j���_��������D�	EventDataA��I�oData1K�NameApplicationGuid
A��=�oData%K�Name	BytesRead

A��C�oData+K�NameBytesWritten

�1

�1

�1$ApplicationGuidBytesRead BytesWrittenTEMPp3�f��
�Rۓ����F���,D�	EventDataA��=�oData%K�Name	ImageName
A��?�oData'K�Name
ImageFlags
A��7�oDataK�NameReason
A��C�oData+K�NameErrorIgnored
�3�3�34ImageNameImageFlagsReason ErrorIgnoredTEMP��4�4�~MQ9�TsK,^.��bD�	EventDataA��A�oData)K�NameBootmgrTime



�4BootmgrTimeTEMP��5��H�Q��b����^D�	EventDataA��=�oData%K�Name	ImageName
�5ImageNameTEMP�H6R��6Am�Z�������bD�	EventDataA��A�oData)K�NameDriveNumber
\6DriveNumberTEMPX(9�@a�]�0gډ�����zD�	EventDataA��A�oData)K�NameFwStartPage

A��A�oData)K�NameFwPageCount

A��C�oData+K�NameFwMemoryType
A��O�oData7K�NameFwMemoryAttributes
A��A�oData)K�NameBlStartPage

A��A�oData)K�NameBlPageCount

A��C�oData+K�NameBlMemoryType
A��O�oData7K�NameBlMemoryAttributes

�9
�9: :
L:
h:�:�:FwStartPageFwPageCount FwMemoryType,FwMemoryAttributesBlStartPageBlPageCount BlMemoryType,BlMemoryAttributesTEMP�l;�"�jfg$\���L�����hD�	EventDataA��G�oData/K�NamePreBootMgrTime



�;$PreBootMgrTimeTEMP��<�&6�ؕ]�nZ�H����D�	EventDataA��K�oData3K�NameUefiVariableName
A��3�oDataK�NameSize
A��7�oDataK�NameStatus
�< =0=(UefiVariableNameSizeStatusTEMP@$>7":���Q:��b��M���D�	EventDataA��I�oData1K�NameApplicationGuid
A��9�oData!K�NameElement
L>p>$ApplicationGuidElementTEMP�?$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
$?StatusTEMP��?$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
�?StatusTEMPL�@I��Q�H�\�p�Ԧ����D�	EventDataA��E�oData-K�Name
FailureStatus

A��C�oData+K�NameFailureMsgId


�@
A FailureStatus FailureMsgIdTEMPDB�UaJ˅W�����������D�	EventDataA��E�oData-K�Name
FailureStatus
A��?�oData'K�Name
FailureMsg
@B`B FailureStatusFailureMsgTEMPP�B)5�H7^A����d����D�	EventDataTEMP�`C�H�tjI�Q��Bn�a���`D�	EventDataA��?�oData'K�Name
EntryCount
tCEntryCountTEMP�$D���X��4`����`D�	EventDataA��?�oData'K�Name
ToolsCount
8DToolsCountTEMP\@E�;���W�Q[\4�����D�	EventDataA��K�oData3K�NameLastShutdownGood

A��C�oData+K�NameLastBootGood



hE

�E(LastShutdownGood LastBootGoodTEMP`4Gg����+�[d��f���ND�	EventDataA��K�oData3K�NameLastShutdownGood

A��C�oData+K�NameLastBootGood

A��?�oData'K�Name
LastBootId
A��K�oData3K�NameBootStatusPolicy


�G

�G�G�G(LastShutdownGood LastBootGoodLastBootId(BootStatusPolicyTEMP��H
r�y��Wyþ���T��hD�	EventDataA��G�oData/K�NameOptionSelected
�H$OptionSelectedTEMPP4I)5�H7^A����d����D�	EventDataTEMPP�I)5�H7^A����d����D�	EventDataTEMPP�I)5�H7^A����d����D�	EventDataTEMP�pJS�/y^�����q0��hD�	EventDataA��G�oData/K�NameBootMenuPolicy
�J$BootMenuPolicyTEMPP�J)5�H7^A����d����D�	EventDataTEMP��Kw��-g0�^���"	���\D�	EventDataA��;�oData#K�NameBootType
�KBootTypeTEMP4�L��	;H�^Fߟ�U�����D�	EventDataA��;�oData#K�NameBootType
A��A�oData)K�NameLoadOptions
�L�LBootTypeLoadOptionsTEMP,�Nv5Y�0�EX��5f0�q����D�	EventDataA��E�oData-K�Name
ResetEndStart

A��K�oData3K�NameLoadOSImageStart

A��M�oData5K�NameStartOSImageStart

A��U�oData=K�NameExitBootServicesEntry

A��S�oData;K�NameExitBootServicesExit



DO

dO

�O

�O

�O ResetEndStart(LoadOSImageStart(StartOSImageStart0ExitBootServicesEntry0ExitBootServicesExitTEMP��P$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
�PStatusTEMP�tQ��{��b(]�O]9�����xD�	EventDataA��W�oData?K�NameBitlockerUserInputTime



�Q4BitlockerUserInputTimeTEMPH�R�m�[ MkV,Bc�t���D�	EventDataA��=�oData%K�Name	ImageName
A��I�oData1K�NameImageLoadStatus
�R�RImageName$ImageLoadStatusTEMPX�S�bIU�2Z"��M���D�	EventDataA��A�oData)K�NamePeImageName
A��M�oData5K�NamePeImageLoadStatus
T4TPeImageName(PeImageLoadStatusTEMP�U�QI��-R�d�(P��rD�	EventDataA��Q�oData9K�NameUpdateCapsuleStatus
U,UpdateCapsuleStatusTEMP�|VJ�M�9��T2�`0cX���D�	EventDataA��A�oData)K�NameDeviceFlags
A��=�oData%K�Name	PcrBitmap
A��U�oData=K�NameUpdateSupportedStatus
�V�V�VDeviceFlagsPcrBitmap0UpdateSupportedStatusTEMPHX�m�[ MkV,Bc�t���D�	EventDataA��=�oData%K�Name	ImageName
A��I�oData1K�NameImageLoadStatus
(X@XImageName$ImageLoadStatusTEMPHHY�m�[ MkV,Bc�t���D�	EventDataA��=�oData%K�Name	ImageName
A��I�oData1K�NameImageLoadStatus
pY�YImageName$ImageLoadStatusTEMPD�Z�#|�'$\-]���H���D�	EventDataA��=�oData%K�Name	ImageName
A��G�oData/K�NameSiPolicyStatus
�Z�ZImageName$SiPolicyStatusTEMPD�[�T&��{Z�pu�t�����D�	EventDataA��;�oData#K�NameHiveName
A��G�oData/K�NameHiveLoadStatus
�[\HiveName$HiveLoadStatusTEMP��\$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
�\StatusTEMP�t]$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
�]StatusTEMP��^X���S#…�H9����D�	EventDataA��3�oDataK�NamePath
A��?�oData'K�Name
FailedPath
A��7�oDataK�NameStatus
�^�^_PathFailedPathStatusTEMPx(`dC��6lZ'H_�?Z�����D�	EventDataA��3�oDataK�NamePath
A��7�oDataK�NameImport
A��7�oDataK�NameStatus
d`t`�`PathImportStatusTEMPD�dv2Ͼ��S�9�$ѱD��D�	EventDataA��K�oData3K�NameCachedCopyStatus
A��]�oDataEK�NameUnsealingCachedCopyStatus
A��_�oDataGK�NameKeyGenerationAndSaveStatus
A��E�oData-K�Name
SealingStatus
A��?�oData'K�Name
TpmPcrMask
A��e�oDataMK�NameProtectorAssistedUnsealStatus
A��e�oDataMK�NameProtectorAssistedResealStatus
A��]�oDataEK�NameProtectorSealUpdateStatus
A��O�oData7K�NameTpmCounterOpStatus
A��W�oData?K�NameTpmCounterCreateStatus
	A��S�oData;K�NameBackupSealedBlobUsed
�e�e f\f|f�f�fgPg|g�g(CachedCopyStatus8UnsealingCachedCopyStatus<KeyGenerationAndSaveStatus SealingStatusTpmPcrMask@ProtectorAssistedUnsealStatus@ProtectorAssistedResealStatus8ProtectorSealUpdateStatus,TpmCounterOpStatus4TpmCounterCreateStatus0BackupSealedBlobUsedTEMP��i�Njzp�P�N?�����tD�	EventDataA��K�oData3K�NameCachedCopyStatus
A��Q�oData9K�NameIdkGenerationStatus
A��I�oData1K�NameMeasuringStatus
A��Y�oDataAK�NameSealingAndCachingStatus
�ij,jPj(CachedCopyStatus,IdkGenerationStatus$MeasuringStatus4SealingAndCachingStatusTEMP|�q��3��bVԡ�R���D�	EventDataA��K�oData3K�NameCachedCopyStatus
A��Y�oDataAK�NamePrimaryBlobUnsealStatus
A��W�oData?K�NameBackupBlobUnsealStatus
A��g�oDataOK�NameKickbackBackupBlobUnsealStatus
A��e�oDataMK�NameBackupBlobValidityCheckStatus
A��S�oData;K�NameBackupBlobStillValid

A��u�oData]K�Name%KickbackBackupBlobValidityCheckStatus
A��c�oDataKK�NameKickbackBackupBlobStillValid

A��Y�oDataAK�NamePrimaryBlobResealStatus
A��W�oData?K�NameBackupBlobResealStatus
	A��g�oDataOK�NameKickbackBackupBlobResealStatus
A��_�oDataGK�NameKeyGenerationAndSaveStatus
A��E�oData-K�Name
SealingStatus
A��?�oData'K�Name
TpmPcrMask

A��O�oData7K�NameTpmCounterOpStatus
A��W�oData?K�NameTpmCounterCreateStatus
A��S�oData;K�NameBackupSealedBlobUsed

A���oDatagK�Name*KickbackBackupBlobCleanupPostUpgradeStatus
sDsxs�s�s

0t`t

�t�t$uXu�u�u�uv@v

tv�v(CachedCopyStatus4PrimaryBlobUnsealStatus4BackupBlobUnsealStatusDKickbackBackupBlobUnsealStatus@BackupBlobValidityCheckStatus0BackupBlobStillValidPKickbackBackupBlobValidityCheckStatus@KickbackBackupBlobStillValid4PrimaryBlobResealStatus4BackupBlobResealStatusDKickbackBackupBlobResealStatus<KeyGenerationAndSaveStatus SealingStatusTpmPcrMask,TpmCounterOpStatus4TpmCounterCreateStatus0BackupSealedBlobUsed\KickbackBackupBlobCleanupPostUpgradeStatusTEMP��x>ӎ�uoX���T��J���fD�	EventDataA��K�oData3K�NameCachedCopyStatus
A��Q�oData9K�NameKeyGenerationStatus
A��M�oData5K�NameSealAndSaveStatus
A��G�oData/K�NameUEFIKeysStatus
�xy@yhy(CachedCopyStatus,KeyGenerationStatus(SealAndSaveStatus$UEFIKeysStatusTEMP�8z�*��T�X��Y�Y��\��xD�	EventDataA��W�oData?K�NameRetrieveDriverListTime



Lz4RetrieveDriverListTimeTEMP�0{�衻<�_%L�zJ���|D�	EventDataA��[�oDataCK�NameTpmSrkProvisioningStatus
D{8TpmSrkProvisioningStatusTEMP�(|t��
�X/X������xD�	EventDataA��W�oData?K�NameTpmSrkProvisioningTime



<|4TpmSrkProvisioningTimeTEMP(}.A�a�M�T��q�`����D�	EventDataA��c�oDataKK�NameTpmBindingProvisioningStatus
<}@TpmBindingProvisioningStatusTEMP�~�Ea3�[���>B:���jD�	EventDataA��I�oData1K�NameLoadDriversTime



0~$LoadDriversTimeTEMP,(.�=����W$ V^ϻп���D�	EventDataA��3�oDataK�NamePath
A��C�oData+K�NameLoadHiveTime

P

`Path LoadHiveTimeTEMP����Z�\�J�Z�d$���D�	EventDataA��U�oData=K�NameApplicationIdentifier
A��Q�oData9K�NameApplicationLoadTime

��

܀0ApplicationIdentifier,ApplicationLoadTimeTEMP��L���/!~U1&�ݟ�)���D�	EventDataA��U�oData=K�NameApplicationIdentifier
A��[�oDataCK�NameApplicationExecutionTime

<�

l�0ApplicationIdentifier8ApplicationExecutionTimeTEMP$t��,�L&�SY���������D�	EventDataA��7�oDataK�NameStatus
A��;�oData#K�NameFileName
����StatusFileNameTEMP4��x_T��U�]�x����D�	EventDataA��7�oDataK�NameStatus
A��C�oData+K�NameFailurePoint
Ȅ�܄Status FailurePointTEMP���$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
��StatusTEMP�T��5	0�&U��H�v�%��pD�	EventDataA��O�oData7K�NameReserveDescriptors
h�,ReserveDescriptorsTEMP�����~��]ͽ'�1����D�	EventDataA��E�oData-K�Name
ApplicationId
A��;�oData#K�NameRunCount
A��=�oData%K�Name	PageCount

��

(� ApplicationIdRunCountPageCountTEMP�s�Z�j��_��jz(�V(���D�	EventDataA��7�oDataK�NameStatus
A��9�oData!K�NameBlockId

4�
H�StatusBlockIdTEMP���'v~�rPx�zx^X
V��rD�	EventDataA��Q�oData9K�NameFreePersistentPages



�,FreePersistentPagesTEMPD$���*�P��
7`:o���D�	EventDataA��7�oDataK�NameStatus
A��K�oData3K�NameOutstandingCount

L�

`�Status(OutstandingCountTEMPP�7,�-�W�ڲ�Rvr<��HD�	EventDataA��7�oDataK�NameStatus
A��K�oData3K�NameOutstandingCount

A��M�oData5K�NameApplicationsCount
A��C�oData+K�NameApplications
�T�

h�����Status(OutstandingCount(ApplicationsCount ApplicationsTEMPh̎� ��N��YB�B���
���D�	EventDataA��E�oData-K�Name
ApplicationId
A��Q�oData9K�NameFreePersistentPages

�

� ApplicationId,FreePersistentPagesTEMP�t���*?�S�Y��z\����D�	EventDataA��E�oData-K�Name
ApplicationId
A��9�oData!K�NameBlockId

A��Q�oData9K�NameFreePersistentPages

��
А

� ApplicationIdBlockId,FreePersistentPagesTEMP�(���/��yTQ��lC\V���D�	EventDataA��E�oData-K�Name
ApplicationId
A��9�oData!K�NameBlockId

A��5�oDataK�NameFlags
d�

���� ApplicationIdBlockIdFlagsTEMP���݆��@:[%�ʼnD��Y���D�	EventDataA��7�oDataK�NameStatus
A��A�oData)K�NameRunsClaimed
A��=�oData%K�Name	PageCount

���

,�StatusRunsClaimedPageCountTEMP���'v~�rPx�zx^X
V��rD�	EventDataA��Q�oData9K�NameFreePersistentPages



�,FreePersistentPagesTEMP8�7!�~�Z�]��I)���D�	EventDataA��E�oData-K�Name
ApplicationId
A��9�oData!K�NameBlockId

0�

P� ApplicationIdBlockIdTEMP�p��r�e~SV��C.`J����D�	EventDataA��3�oDataK�NameType
A��5�oDataK�NameFlags
A��?�oData'K�Name
BufferSize
����̗TypeFlagsBufferSizeTEMP$��s4y�[�X���—8���D�	EventDataA��;�oData#K�NameDiagCode
A��7�oDataK�NameStatus
����DiagCodeStatusTEMP� ��E�{�wHX�}u�;G�����D�	EventDataA��7�oDataK�NameStatus
A��;�oData#K�NameDataSize
A��?�oData'K�Name
BufferSize
\�p���StatusDataSizeBufferSizeTEMPl�BRuu��T;CB��w����D�	EventDataA��5�oDataK�NamePhase
A��7�oDataK�NameStatus
����PhaseStatusTEMP��7C�{��S5�o/Q9����D�	EventDataA��7�oDataK�NameStatus
A��Q�oData9K�NameEnableDisableReason
A��=�oData%K�Name	VsmPolicy
��0�@\�Status,EnableDisableReasonVsmPolicyTEMP�\�����ݺB[���C~7���D�	EventDataA��?�oData'K�Name
LowAddress

A��A�oData)K�NameHighAddress

A��=�oData%K�Name	SkipBytes

A��?�oData'K�Name
TotalBytes

A��=�oData%K�Name	CacheType
A��5�oDataK�NameFlags

ԟ
�
�

$�@�X�LowAddressHighAddressSkipBytesTotalBytesCacheTypeFlagsTEMP���s/��T1X��D>��RD�	EventDataA��1�oDataK�NameMdl
�MdlTEMP��������L�X+I%��n�v��XD�	EventDataA��7�oDataK�NameSecure



��SecureTEMP�d�
+t�]��K~p���lD�	EventDataA��K�oData3K�NameSoftRestartCount
x�(SoftRestartCountTEMPD��i%�O댘\@2���\����D�	EventDataA��K�oData3K�NameSoftRestartCount
A��7�oDataK�NameSecure

��

У(SoftRestartCountSecureTEMP�0�c��U�@M�Ƒ���D�	EventDataA��G�oData/K�NameSequenceNumber
A��I�oData1K�NameDescriptorCount
A��YZ�ComplexData3K�NameMemoryDescriptor
�����
,�

D�\�x�$SequenceNumber$DescriptorCount(MemoryDescriptorBasePagePageCountMemoryTypeReservedTEMP�0�����Uߔ�镢���jD�	EventDataA��I�oData1K�NameDescriptorCount
D�$DescriptorCountTEMPT�w���0b�Y�G�N��}V���D�	EventDataA��7�oDataK�NameStatus
A��=�oData%K�Name	PageCount

A��?�oData'K�Name
MemoryType
A��?�oData'K�Name
Attributes
A��?�oData'K�Name
LowAddress

A��A�oData)K�NameHighAddress

̩

����
0�
L�StatusPageCountMemoryTypeAttributesLowAddressHighAddressTEMP���5��?U�N><�E����BD�	EventDataA��7�oDataK�NameStatus
A��=�oData%K�Name	PageCount

A��?�oData'K�Name
MemoryType
A��?�oData'K�Name
Attributes
A��?�oData'K�Name
LowAddress

A��A�oData)K�NameHighAddress

A��=�oData%K�Name	Alignment
A��A�oData)K�NameProximityId
��

����ȭ
�
��4�StatusPageCountMemoryTypeAttributesLowAddressHighAddressAlignmentProximityIdTEMP����/��TR��w���^D�	EventDataA��=�oData%K�Name	StartTime
��StartTimeTEMPP`�)5�H7^A����d����D�	EventDataTEMPP��)5�H7^A����d����D�	EventDataTEMP`̱8�^�Q2I�w+�*���D�	EventDataA��?�oData'K�Name
Identifier
A��A�oData)K�NamePartitionId
A��Q�oData9K�NameAllocatedBlockCount

A��M�oData5K�NameAllocatedRunCount

A��O�oData7K�NameAllocatedPageCount

A��7�oDataK�NameStatus
D�`�

|�

��

в��IdentifierPartitionId,AllocatedBlockCount(AllocatedRunCount,AllocatedPageCountStatusTEMP<�w)ϻ�6^lV���Aw����D�	EventDataA��?�oData'K�Name
Identifier
A��A�oData)K�NamePartitionId
�0�IdentifierPartitionIdTEMP�x��hl��N�Y&���hQO
���D�	EventDataA��?�oData'K�Name
Identifier
A��O�oData7K�NamePartitionPageCount

A��Q�oData9K�NameAllocatedBlockCount

A��M�oData5K�NameAllocatedRunCount

A��O�oData7K�NameAllocatedPageCount

A��7�oDataK�NameStatus
�

�

8�

d�

����Identifier,PartitionPageCount,AllocatedBlockCount(AllocatedRunCount,AllocatedPageCountStatusTEMP����޺�Vx�BDX|���D�	EventDataA��?�oData'K�Name
Identifier
A��O�oData7K�NamePartitionPageCount

A��7�oDataK�NameStatus
0�

L�x�Identifier,PartitionPageCountStatusTEMP,`�d�i�dl�YUY�O�S����D�	EventDataA��?�oData'K�Name
Identifier
A��7�oDataK�NameStatus
����IdentifierStatusTEMP�L���*)�R�#����.��`D�	EventDataA��?�oData'K�Name
Identifier
`�IdentifierTEMP x���o�L)�^*�v��w�����D�	EventDataA��?�oData'K�Name
Identifier
A��;�oData#K�NameRunCount
A��=�oData%K�Name	PageCount

A��7�oDataK�NameStatus
A��Q�oData9K�NamePartitionNameLength
A��E�oData-K�Name
PartitionName
��

$�<�P�|�IdentifierRunCountPageCountStatus,PartitionNameLength PartitionNameTEMP8<��1�"�S�XQ�ڥ6��jD�	EventDataA��?�oData'K�Name
Identifier
A��;�oData#K�NameRunCount
A��=�oData%K�Name	PageCount

A��I�oData1K�NameIoSpaceRunCount
A��K�oData3K�NameIoSpacePageCount

A��7�oDataK�NameStatus
A��Q�oData9K�NamePartitionNameLength
A��E�oData-K�Name
PartitionName
���

�(�

L�t�����IdentifierRunCountPageCount$IoSpaceRunCount(IoSpacePageCountStatus,PartitionNameLength PartitionNameTEMP���09Q���S�����K&����D�	EventDataA��7�oDataK�NameStatus
A��?�oData'K�Name
ActualSize
A��C�oData+K�NameExpectedSize
,�@�\�StatusActualSize ExpectedSizeTEMP����D RUW8Sҍ�Ƶ����D�	EventDataA��A�oData)K�NamePartitionId
A��;�oData#K�NameRunCount
A��=�oData%K�Name	PageCount

����

�PartitionIdRunCountPageCountTEMP$���"��}f_�R��lhH��4D�	EventDataA��A�oData)K�NamePartitionId
A��;�oData#K�NameRunCount
A��=�oData%K�Name	PageCount

A��E�oData-K�Name
IoSpaceMemory

����

�

$�PartitionIdRunCountPageCount IoSpaceMemoryTEMP,��{cZ(�uZ,K�37J2���D�	EventDataA��;�oData#K�NameBasePage

A��=�oData%K�Name	PageCount


@�

X�BasePagePageCountTEMP������HZ>�^�3Gjk�X���D�	EventDataA��A�oData)K�NameCommandCode
A��C�oData+K�NameResponseCode
A��S�oData;K�NameResponseMilliseconds

���

$�CommandCode ResponseCode0ResponseMillisecondsTEMP���;��{�R�^�
r%ʫ���*D�	EventDataA��A�oData)K�NameCommandCode
A��C�oData+K�NameResponseCode
A��S�oData;K�NameResponseMilliseconds

A��A�oData)K�NameCommandSize
A��A�oData)K�NameCommandData
A��C�oData+K�NameResponseSize
A��C�oData+K�NameResponseData
@�\�

|��������CommandCode ResponseCode0ResponseMillisecondsCommandSizeCommandData ResponseSize ResponseDataTEMP�X�
��.�m�Z��z;l���D�	EventDataA��A�oData)K�NameCommandCode
A��=�oData%K�Name	ErrorCode
A��S�oData;K�NameResponseMilliseconds

����

��CommandCodeErrorCode0ResponseMillisecondsTEMP����ecv�U�U���'*l}���D�	EventDataA��A�oData)K�NameCommandCode
A��=�oData%K�Name	ErrorCode
A��S�oData;K�NameResponseMilliseconds

A��A�oData)K�NameCommandSize
A��A�oData)K�NameCommandData
 �<�

T�����CommandCodeErrorCode0ResponseMillisecondsCommandSizeCommandDataTEMP�`�VC��SR�s�ġ����pD�	EventDataA��O�oData7K�NameFveGlobalDataFlags
t�,FveGlobalDataFlagsTEMP �_�2Y�?B�8��.D�	EventDataA��?�oData'K�Name
VendorGuid
A��C�oData+K�NameVariableName
A��?�oData'K�Name
Attributes
A��7�oDataK�NameStatus
T�p�����VendorGuid VariableNameAttributesStatusTEMP�X��~�w
�^�ڴl�����dD�	EventDataA��C�oData+K�NameTxtErrorCode
l� TxtErrorCodeTEMPP�t�0w�@Wf�#t�cg���D�	EventDataA��3�oDataK�NameBase

A��3�oDataK�NameSize


x�
��BaseSizeTEMP�0��Mp�dnT!+���3���dD�	EventDataA��C�oData+K�NameBiosDataSize



D� BiosDataSizeTEMPt\�n�p�;�WN=���"���D�	EventDataA��O�oData7K�NameAcmMinMleHeaderVer
A��K�oData3K�NameMleHeaderVersion
����,AcmMinMleHeaderVer(MleHeaderVersionTEMP��� U�)%�KQ�����"����D�	EventDataA��?�oData'K�Name
PmrLowBase

A��?�oData'K�Name
PmrLowSize

A��A�oData)K�NamePmrHighBase

A��A�oData)K�NamePmrHighSize

A��Q�oData9K�NameFirmwareProvidedAcm



�

�

8�

T�

p�PmrLowBasePmrLowSizePmrHighBasePmrHighSize,FirmwareProvidedAcmTEMP�0��Gg�`6XRN�r��HJ��^D�	EventDataA��=�oData%K�Name	TxtStatus
�#D�TxtStatusTEMP���ݞ���s\k�rT�O���D�	EventDataA��5�oDataK�NamePhase
A��?�oData'K�Name
StatusCode
A��K�oData3K�NameEnvironmentState
������PhaseStatusCode(EnvironmentStateTEMP������05R���c'K3����D�	EventDataA��=�oData%K�Name	InitState
A��?�oData'K�Name
StatusCode
A��G�oData/K�NameFailureAddress

A��K�oData3K�NameReferenceAddress

A��?�oData'K�Name
ReasonCode
4�L�
h�
����InitStateStatusCode$FailureAddress(ReferenceAddressReasonCodeTEMP0<���KknT׉�&�:���6D�	EventDataA��C�oData+K�NameSvnCounterId
A��?�oData'K�Name
StatusCode
A��;�oData#K�NameSvnValue
A��C�oData+K�NamePrevSvnValue
�������� SvnCounterIdStatusCodeSvnValue PrevSvnValueTEMP<���X�@EJ�Q8A�%�)2����D�	EventDataA��;�oData#K�NameSvnValue
A��C�oData+K�NamePrevSvnValue
��SvnValue PrevSvnValueTEMP�����	͓^����؟����bD�	EventDataA��A�oData)K�NameSinitTimeMs



��SinitTimeMsTEMP4��9s��B�V݇���0,���D�	EventDataA��?�oData'K�Name
StatusCode
A��;�oData#K�NamePosition
� �StatusCodePositionTEMP�`�p�5�g�\3�����W���D�	EventDataA��?�oData'K�Name
AcmDateDay
A��C�oData+K�NameAcmDateMonth
A��A�oData)K�NameAcmDateYear
������AcmDateDay AcmDateMonthAcmDateYearTEMP����Gg�`6XRN�r��HJ��^D�	EventDataA��=�oData%K�Name	TxtStatus
�#��TxtStatusTEMP������Og�]2e��{���D�	EventDataA��=�oData%K�Name	TxtStatus
A��=�oData%K�Name	Argument1

A��=�oData%K�Name	Argument2

�#�

$�

<�TxtStatusArgument1Argument2TEMP��7�@��ir\��hZc�a��.D�	EventDataA��=�oData%K�Name	TxtStatus
A��A�oData)K�NamePolicyLevel
A��=�oData%K�Name	Argument1

A��=�oData%K�Name	Argument2

�#� �

<�

T�TxtStatusPolicyLevelArgument1Argument2TEMP$�^p%`�$^U��l�T�?���D�	EventDataA��5�oDataK�NamePhase
A��7�oDataK�NameStatus
A��5�oDataK�NameTries
A��Q�oData9K�NameRemainingNodesCount
A��UZ�ComplexData/K�NameRemainingNodes
����������4�P�PhaseStatusTries,RemainingNodesCount$RemainingNodesNodeNumber$RemainingRangesTEMP<P�YTɁ���T����H���D�	EventDataA��K�oData3K�NameAllocatedRegions
A��5�oDataK�NameTries
x���(AllocatedRegionsTriesTEMP$���-��Dz[*��$������D�	EventDataA��?�oData'K�Name
PathLength
A��3�oDataK�NamePath
����PathLengthPathTEMP�l�[�C4VZ��ss�	���bD�	EventDataA��A�oData)K�NameTryComplete



��TryCompleteTEMP����[��b��Q�,]��U�����D�	EventDataA��;�oData#K�NameFunction
A��7�oDataK�NameStatus
A��?�oData'K�Name
Checkpoint
���FunctionStatusCheckpointTEMP<��H-"��m^�&��O�����D�	EventDataA��G�oData/K�NameDebuggerStatus
A��7�oDataK�NameStatus
�$8�\�$DebuggerStatusStatusTEMPP��)5�H7^A����d����D�	EventDataTEMP���.p�U��[t��MJ�����D�	EventDataA��9�oData!K�NameKeyType
A��3�oDataK�NameCode
���KeyTypeCodeTEMPL�����<Q���<�����D�	EventDataA��E�oData-K�Name
DisableReason
A��C�oData+K�NameTcgLogStatus
�� DisableReason TcgLogStatusTEMP4��x_T��U�]�x����D�	EventDataA��7�oDataK�NameStatus
A��C�oData+K�NameFailurePoint
 �4�Status FailurePointTEMP���i{�0W'D�d�����dD�	EventDataA��C�oData+K�NameMirrorStatus
� MirrorStatusTEMPd��M�L3�$\�G��̚����D�	EventDataA��I�oData1K�NameEfiTimeZoneBias
A��K�oData3K�NameEfiDaylightFlags
8�\�$EfiTimeZoneBias(EfiDaylightFlagsTEMP��v\����V�e��46���^D�	EventDataA��=�oData%K�Name	BcdOption
@%,�BcdOptionTEMP���Py��TU��R�RM���ZD�	EventDataA��9�oData!K�NameVersion
�VersionTEMP(dW��,�FTTϞ*,H�H��4D�	EventDataA��7�oDataK�NameStatus
A��C�oData+K�NameFailurePoint
A��K�oData3K�NameUpdateStatusEnum
A��9�oData!K�NameFwLevel
��t%�Status FailurePoint(UpdateStatusEnumFwLevelPRVAP8Microsoft-Windows-Kernel-BootOPCOP+1�2�2������H�����L���� N����HO����dX�����Y�����_�����`�����c����d����}����8����`H�����L�����N�����X����Y����(`����P}����pL
�����N
�����Y
�����L����N����<L����`L�����L�����L�����L�����L����8L����\L�����L�����L�����L����	L����(	L����`	L����|	L �����	win:Infowin:Startwin:Stop0InitializationFailure$GetEfiVariable(TxtLaunchPreparedInitStatusOpenFailureBdEnabledAllocation8ListInitializationFailureKdEnabledTpmInit NotSupported(SbatUpdateSuccess0MeasurementsDisabled$SetEfiVariable(PreviousTxtError,EnterInsecureState BdInitFailure(AllocationFailure KdInitFailure(SbatUpdateFailure0InvalidTxtSinitRange DrtmSvnCheck(EnumerateFailure,InvalidTxtHeapRange$BootmgrSvnCheck$MleLoadFailure(MissingRsdpTableNoSinitAcm4ComputePmrRangesFailure<InvalidTxtHeapBiosDataSize$MleHeaderTooOld(SinitPerformance(PrepareLcpFailure4TxtRejectedFirmwareAcm$TxtInformation$TxtNotSupported8DrtmDriversNotSupportVbsPpamFailure SmmLevelCheck(TprSetupRequestedLEVL�P�	P
P(
win:Errorwin:Warning(win:InformationalTASKXg�����������������������8����X����������	�����
���������<����h
�����������������������L����t�����������������������(����@����x������������������<����`����| �����!�����"�����#����$����<%����h&�����'�����(�����)����$*����\+�����,�����-�����.����/����40����`1�����2�����3�����4���� 5����L6����d7�����8�����9�����:����;����(<����`=�����>�����?�����@����  A����D B����h C����� D����� E����� F����!G����(!H����P!I����x!J�����!K�����!L�����!M����"N����H"O����\"P����t"Q�����"R�����"S����#T����<#U����d#V�����#W�����#X�����#Y�����#Z����$[����<$\�����$]�����$^�����$_����(%`����L%a����p%b�����%c�����%d����&e����(&t����\&}�����&(InitializeLibrary PrepareTarget4RebuildKernelMemoryMapFatalError PersistMemory0ClaimPersistedMemory,FreePersistedMemory,CleanupPageDatabaseCancelBoot@AttachPersistentPageDatabase,MemoryBlockRundown0BuildKernelMemoryMap GetMemoryMap<AllocatePhysicalPagesForMdl(ExecuteTransition0DisconnectHypervisor(MemoryMapRundown@PhysicalPageAllocationFailureBootManagerPreBoot(FirmwareBootDataLoadDriversLoadHive8BootApplicationExecution8WaitForPartitionsRestored4MemoryPartitionRestore4PersistMemoryPartition$RegisterLoader$SiPolicyFailureBootTotalIo(DirtyBootShutdown$BootMenuPolicyBootType8MemoryPartitionsRestored$QueryStatistics,ConnectSecureLoader$BootFileAccess4RetrieveDriverListTime8FreePersistedMemoryBlock,PrepareNotification8PartitionInitialAddMemory$ImageHashCheck,ImageIntegrityCheck,BootPolicyMigration,RemoveEnclavePages0EnumerateEnclavePages,GetSystemBootDevice4NormalizeBootOptionList4CreateLibraryParameters CreateDevices8SoftRestartHostCapability,CancelNotificationBootDiag(ImageLoadFailure,FirmwareResolution(BootEnvResolution(BootmgrEntryCount UserInputTime8VsmIdkProvisioningStatus$BootAppLoadTime0PrepareTargetFailure,VsmPolicyEnablement@InitializeMeasurementContext$KsrMeasurement$TpmMeasurement,CloseMeasurementLog,CommitPendingEventsCapTpmPcr,TpmCommandResponse$TpmSubmitError(TpmBitLockerUsage(EfiVariableAccess4GetFirmwareInformation$VerifyBootEntry(InvalidNfitTable$MeasuredLaunch,EFICapsuleCreationBootSIFileOpen(VsmPolicyFailure8VsmLKeyProvisioningStatus4SecureBootVariableUsage4MiniFilterStartFailure(FileModification0RegistryModificationSoftReboot$RegisterFilter BootDebugger IoSpaceMemory(FinalizeMemoryMapPRegisterHvloaderPersistenceInterface<LoadHvloaderForPersistence0VsmBootNoSecretsMode0BootMenuTimerCanceled$BadMemoryPages$KernelDebuggerDMemoryPartitionFreeUnusedMemory<MemoryPartitionRestoreStatsBootTpm$MemoryMirroring4EfiTimeZoneInformation0SecureBootMitigationsSbatUpdateKEYW�
�����'�����'�����'�����'����( ����D(@����l(�����(�����( �����(@����)�����)4@)SoftRestart,MemoryPreservation,MemoryBlockRundown$PhysicalMemory(MemoryMapRundown(MemoryPartitions EfiVariables$LOG_TO_BOOTSTAT0ms:ReservedKeyword40 ms:Telemetryms:Measures$ms:CriticalDatawin:SQMEVNT-�7@�L*�	D�8@�L*�	`�@��+�	�%@��,�	L� @�L0�	�
�S�+(@�2��	��S� @�(4�	T�S�*(@��4��	��S�	 @��5�	�S�
 �
x6�	�S�@��:�	p�R@��;�	8�
 @�D=�	�S�@��>�	�@�8?�	���?�	��8A�	�S��|B�	�9��B�	|���C�	��TD�	�
���E�	�
��H�	���H�	��4I�	���I�	� ��I�	�
���J�	�S�!��J�	�
�!��K�	�
������&�	�S��?�	��8A�	�S���L�	��@�P�	� :� �P�	��!(@!��Q�	�S�"(@"�S�	�S�#( #�\T�	�S�$@$�DU�	�%(@%�W�	�S�&6( &�dX�	(�S�'  '��Z�	�S�(  (�4\�	�S�)  )��\�	�S�*( *��]�	T�+( +�$_�	T�, ,��g�	T�-; -��g�	��.&@��y�	h�/@�|}�	��0@�T~�	��1 1��Y�	l
�2Q 2��`�	�2Q 2��j�	�3Q 3��`�	�3Q 3��j�	�4<@���	��5@���	��6@����	�7=@�ȃ�	��8@����	T�9 9��z�	�: :�|{�	�; ;�p|�	�<K <���	t�=L@��������	�T�>L >���L�	�T�?
L@��������	� T�@L@��������	�$T�AL@��������	�(T�BL@��������	�,T�CL@��������	�0T�DL@�������	�4T�EL@����d��	�8T�FL@��������	�<T�GO�����.��	�HL@������$�	�@T�IL I���0�	��JQ J�w�	�KQ K�w�	�LX������	�MX����4�d�	�N`����4�|�	�O`�����	�Q Q��	�d������	\
DTd�������	\
HTe��������	\
LTf������	x
PTf����ġ��	x
TTf��������	x
XTg��������	x
\Th��������	�
`Ti��������	�
dTj��������	�
hTk����@���	�
lTl��������	�
pTm����\���	 xTn��������	 �To����؍��	�Tp��������	�Tq�������	�
�Tr��������	�
�Ts	�sD���	<�T�t	�t����	<�T�u
������	X�Tv
��������	X�Tw����,���	t�Tx������	��Ty��������	��Tz
����d���	��T{
�������	��T|PH�|���	�T�~	����t���	��T	����h���	��T�����P���	��T�������	�T��������	�T�������	�T���������	�T�	 ����h���	8�T��	 ����h���	8�T��������	�U�������	�U� ��D���	 U�� ������	 U���������	
U�����L���	
 U�����̷��	
(U� ������	
0U����������	4
8U�����|���	4
@U���������	4
HU� ������	P
PU��"��������	�
TU�#������	\U�#��������	`U�$ ������	0dU��'����@���	�hU�'��������	�lU�(������	�pU�(��������	�tU�) ����|���	�xU�) ���� ���	�|U�) ��������	��U�>�����	��, ������	��, ������	�������	��5����	�U�5 ����	�U��-����D���	,�U�4��������	��U�4��������	��U�/ ��������	d�U��0 ��������	��U��1 ��������	��U�� ��������	\
�U��2 ��������	��U��3 ��������	��U��. ��������	H�U��? ��������	$�U��? ���� ���	$�U��@ ��������	@�U��A ��������	\�U��B ��������	x�U��C ��������	��U��D ��������	��U��D ��������	��U�� ��������	\
�U��H@��������	 �U�H@������@�	 �U�I ��������	<�U��J ��������	X�U��W ������	��U��
Y ��������	��U��_ ��������	��U��?�����4�	$�U�E@��p���	���E@��T���	���F ��$���	��U��F ������	��U��G@������	��M������	�V�M��������	�V�N@��\���	���N ���X�	�V��
N ������	���L ��<��	���S ��������	TV��T@������	pV��U@������	�V��V������	�V��V������	�V��V����	� V��V������	�$V��V�����	�(V��L ��8�<�	���L ����H�	���L��T�	���L����`�	���Y ����l�p�	���Y ����t���	���] ��p���	l��Z������	0V�Z������	4V�Z��������	8V�[��������	4<V�\��������	P@V�^ ������	�DV��a�������	�HV�a����`���	�PV�b��������	�XV�c ����	`V��L ��T�l�	���d ��T��	0��e�� ���	L� L �x�	�dV�t ����	h�N����	�hV�t �D��	h�t �D��	h�#}  #���(�	�lV�$}  $�����	�pV�D'$'D'D'$'D'D'D'D'$'$'t'$'$'D'$'D'$'D'$'D'$'D'D'D'D'$'D'$'D'$'$'$'$'$'$'$'$'$'$'$'$'$'�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&$'T'�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&'''$'$'�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&�&''�&�&�&�&�&�&$'$'�&�&$'�&�&�&�&�&�&�&�&�&�&�&�&�&�&$'�&�&�&�&�&�&$'$'$'D'D'WEVT�; �V4W
T���Ԁ�8� �CHANp�V����TMicrosoft-Windows-Kernel-File/AnalyticTTBL )TEMP�xY���[�xdS�2iY���
��D�	EventDataA��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��E�oData-K�Name
CreateOptions
A��K�oData3K�NameCreateAttributes
A��A�oData)K�NameShareAccess
A��;�oData#K�NameFileName
ZZ(ZDZdZ�Z�ZIrpThreadIdFileObject CreateOptions(CreateAttributesShareAccessFileNameTEMP8�\>���_Ql%x�t%����D�	EventDataA��?�oData'K�Name
ByteOffset

A��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��7�oDataK�NameIOSize
A��9�oData!K�NameIOFlags

`]|]�]�]�]�]�]ByteOffsetIrpThreadIdFileObjectFileKeyIOSizeIOFlagsTEMP��_a��RR!Y�-�%���D�	EventDataA��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��K�oData3K�NameExtraInformation
A��=�oData%K�Name	InfoClass
T```x`�`�`�`IrpThreadIdFileObjectFileKey(ExtraInformationInfoClassTEMP`c����RXZ��t�K����D�	EventDataA��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��K�oData3K�NameExtraInformation
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameFilePath
�c�c�c�c�cd0dIrpThreadIdFileObjectFileKey(ExtraInformationInfoClassFilePathTEMP��f9�k���R�BC�K&���"D�	EventDataA��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��7�oDataK�NameLength
A��=�oData%K�Name	InfoClass
A��=�oData%K�Name	FileIndex
A��;�oData#K�NameFileName
@gLgdg�g�g�g�g�gIrpThreadIdFileObjectFileKeyLengthInfoClassFileIndexFileNameTEMP�@i[��ҟ�hQou����D�	EventDataA��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
�i�i�i�iIrpThreadIdFileObjectFileKeyTEMP�(l�ԋR�W�!ssx��D�	EventDataA��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��I�oData1K�NameIssuingThreadId
A��E�oData-K�Name
CreateOptions
A��K�oData3K�NameCreateAttributes
A��A�oData)K�NameShareAccess
A��;�oData#K�NameFileName
�l�l�lm mHmdmIrpFileObject$IssuingThreadId CreateOptions(CreateAttributesShareAccessFileNameTEMP��oު��N[�^�kљ9و���2D�	EventDataA��?�oData'K�Name
ByteOffset

A��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��I�oData1K�NameIssuingThreadId
A��7�oDataK�NameIOSize
A��9�oData!K�NameIOFlags
A��?�oData'K�Name
ExtraFlags

�p�p�p�p�pqq(qByteOffsetIrpFileObjectFileKey$IssuingThreadIdIOSizeIOFlagsExtraFlagsTEMP8s�ty��:[�PW�<����D�	EventDataA��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��K�oData3K�NameExtraInformation
A��I�oData1K�NameIssuingThreadId
A��=�oData%K�Name	InfoClass
�s�s�s�st8tIrpFileObjectFileKey(ExtraInformation$IssuingThreadIdInfoClassTEMPx�v�Z�Q��	U�K�n?�,��D�	EventDataA��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��K�oData3K�NameExtraInformation
A��I�oData1K�NameIssuingThreadId
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameFilePath
ww8wLwtw�w�wIrpFileObjectFileKey(ExtraInformation$IssuingThreadIdInfoClassFilePathTEMP�,zt�욷�X_������0D�	EventDataA��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��I�oData1K�NameIssuingThreadId
A��7�oDataK�NameLength
A��=�oData%K�Name	InfoClass
A��=�oData%K�Name	FileIndex
A��;�oData#K�NameFileName
�z�z�z{,{@{X{p{IrpFileObjectFileKey$IssuingThreadIdLengthInfoClassFileIndexFileNameTEMP�|��]�@L,Xӑ�2��\��(D�	EventDataA��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��I�oData1K�NameIssuingThreadId
4}@}\}p}IrpFileObjectFileKey$IssuingThreadIdTEMP��~��-�IT�S��BD����D�	EventDataA��1�oDataK�NameIrp
A��K�oData3K�NameExtraInformation
A��7�oDataK�NameStatus
�~�~Irp(ExtraInformationStatusTEMP$���`Ӓ��],��Ӛ����D�	EventDataA��9�oData!K�NameFileKey
A��;�oData#K�NameFileName
(�<�FileKeyFileNamePRVAPh�Microsoft-Windows-Kernel-FileOPCO01��win:InfoLEVL@P�(win:InformationalTASK$
����܃�����������
����(�����<�����L�����\�����l�����������������������Є�������������������8�����P�����l�����������������������؅ �����!�����"����$�NameCreateNameDeleteCreateCleanupCloseReadWrite$SetInformationSetDeleteRenameDirEnumFlush(QueryInformationFSCTL OperationEndDirNotifyDeletePathRenamePathSetLinkPathSetLink CreateNewFileSetSecurity QuerySecuritySetEAQueryEAKEYW�	����Ԇ �����@����P������������ȇ���������8�����|�����Ј@KERNEL_FILE_KEYWORD_FILENAME<KERNEL_FILE_KEYWORD_FILEIO<KERNEL_FILE_KEYWORD_OP_END<KERNEL_FILE_KEYWORD_CREATE8KERNEL_FILE_KEYWORD_READ8KERNEL_FILE_KEYWORD_WRITEDKERNEL_FILE_KEYWORD_DELETE_PATHTKERNEL_FILE_KEYWORD_RENAME_SETLINK_PATHLKERNEL_FILE_KEYWORD_CREATE_NEW_FILEEVNT�+

�����0��� �@��V�����0���<�D��V������@W���X�H��V�������i���X�P��V

 ������g���t�X��V

 ������{���t�\��V ������g�����`��V ������{�����d��V ������Z�����h��V �����|m�����p��V ������Z���ȁx��V �����|m���ȁ���V ������]�������V �����Dq�������V ������]�������V �����Dq�������V ������]�������V �����Dq�������V �����Hd���8����V ������w���8����V ������g���T����V ������{���T����V ������]���p����V �����Dq���p����V ������]��������V �����Dq��������V`������}��������V �����Hd���Ăȑ�V ������w���Ă̑�V������`����Б�V�����Pt����ԑ�V������`�����ؑ�V�����Pt�����ܑ�V������`������V�����Pt������V ������]������V �����Dq������V�����@W���P���V������i���P���V �����Dq���l����V   �����Dq��������V!! �����Dq�������V"" �����Dq�������VD�D�T�t�T�t�T�T�T�T�T���T���T���T���T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�d�T�T�������������T�T�ĆĆT�T�T�T�WEVT�P�
���$�d����CHANdl�����HMicrosoft-Windows-PCI/DiagnosticPRVA@ȒMicrosoft-Windows-PCIOPCO01�win:InfoLEVL@P<�(win:InformationalTASKP
������(AspmErrataRundownKEYW,����ГDiagEVNTD

������0�p� �\���WEVT�,�	|�d�,�
�l��$�$��CHAN���������\Microsoft-Windows-Kernel-StoreMgr/Analytic`Microsoft-Windows-Kernel-StoreMgr/OperationalMAPS���x�VMAP$���VMAP$����4CacheTerminationMsgMap8StoreMgrCorruptPageMsgMapTTBL� TEMP|ؗw��49�-T��O[T!����lD�	EventDataA��9�oData!K�NameDataKey
A��9�oData!K�NameDataMgr
A��A�oData)K�NameStoreOffset
A��G�oData/K�NameCompressedSize
A��5�oDataK�NameFlags
<�P�d�����DataKeyDataMgrStoreOffset$CompressedSizeFlagsTEMP�̙��` �U�E3�C�����D�	EventDataA��9�oData!K�NameDataKey
A��9�oData!K�NameDataMgr
A��A�oData)K�NameStoreOffset
��0�DataKeyDataMgrStoreOffsetTEMPt	�U�81��P{G]\��-���D�	EventDataA��;�oData#K�NameStoreKey
A��C�oData+K�NameStoreFileKey
A��A�oData)K�NameUserDataMgr
A��A�oData)K�NameMetadataMgr
A��?�oData'K�Name
RegionSize
A��A�oData)K�NameRegionCount
A��=�oData%K�Name	BlockSize
A��?�oData'K�Name
SectorSize
A��O�oData7K�NameEncryptionStrength
A��=�oData%K�Name	StoreType
	A��9�oData!K�NameStoreId
A��C�oData+K�NameBlocksStored
A��C�oData+K�NameRegionsInUse
A��G�oData/K�NameTotalSpaceUsed

A��5�oDataK�NameFlags
A��I�oData1K�NameMetaRegionCount
A��K�oData3K�NameMetaRegionsInUse
A��S�oData;K�NameMetaRegionsSpaceUsed
A��=�oData%K�Name	StoreTime
������ء��,�D�`�������آ���,�P�x���StoreKey StoreFileKeyUserDataMgrMetadataMgrRegionSizeRegionCountBlockSizeSectorSize,EncryptionStrengthStoreTypeStoreId BlocksStored RegionsInUse$TotalSpaceUsedFlags$MetaRegionCount(MetaRegionsInUse0MetaRegionsSpaceUsedStoreTimeTEMP�P��4�d*�cS�Ս&w)�t��\D�	EventDataA��;�oData#K�NameStoreKey
d�StoreKeyTEMP�������_Ql6��a� ��D�	EventDataA��9�oData!K�NameDataMgr
A��G�oData/K�NameVirtualAddress
A��I�oData1K�NamePhysicalAddress

A��3�oDataK�NameSize
A��?�oData'K�Name
FileBacked
A��G�oData/K�NameCorruptionType
A��5�oDataK�NameFlags
@�T�
x���x���ȧ�DataMgr$VirtualAddress$PhysicalAddressSizeFileBacked$CorruptionTypeFlagsTEMP������v�z]���	8XIG��rD�	EventDataA��9�oData!K�NameDataMgr
A��A�oData)K�NameRegionIndex
A��7�oDataK�NameStatus
A��=�oData%K�Name	SpaceUsed
A��G�oData/K�NameLastAccessTime
��8�L�d�DataMgrRegionIndexStatusSpaceUsed$LastAccessTimeTEMP@���B��ZR�-))��>D�	EventDataA��?�oData'K�Name
FailReason
A��?�oData'K�Name
FailStatus
A��K�oData3K�NameObjectPathLength
A��?�oData'K�Name
ObjectPath
L�h�����FailReasonFailStatus(ObjectPathLengthObjectPathTEMP��Kz�?�pY�ޔaB@�d���D�	EventDataA��3�oDataK�NameSize
A��3�oDataK�NameData
��ĭSizeDataTEMPxخ��(߀09S���	6����D�	EventDataA��;�oData#K�NameStoreKey
A��3�oDataK�NameSize
A��3�oDataK�NameData
�,�<�StoreKeySizeDataTEMP�R0qTBV��) ���D�	EventDataA��;�oData#K�NameStoreKey
A��5�oDataK�NameParam
@�X�StoreKeyParamTEMPLx��Y�q�U���������D�	EventDataA��7�oDataK�NameReason
A��?�oData'K�Name
FailStatus
A��K�oData3K�NameDeviceDescLength
A��M�oData5K�NameDeviceDescription
A��K�oData3K�NameObjectPathLength
A��?�oData'K�Name
ObjectPath
���� �H�p���ReasonFailStatus(DeviceDescLength(DeviceDescription(ObjectPathLengthObjectPathTEMP`|���Ǎ��Y<��������D�	EventDataA��9�oData!K�NameSqmType
A��G�oData/K�NameSqmSessionGuid
A��5�oDataK�NameSqmID
A��O�oData7K�NameSqmStreamRowLength
A��QZ�ComplexData+K�NameSqmStreamRow
��0�T�d�����ж�SqmType$SqmSessionGuidSqmID,SqmStreamRowLength SqmStreamRow SqmTypeEntry SqmDWORDEntry$SqmStringEntryPRVAX(�Microsoft-Windows-Kernel-StoreMgrOPCOx1��2��2̷win:Infowin:Startwin:StopLEVL@P��(win:InformationalTASK���������$�����@�����\�����x������������������	�����
���������D�����d�
����������������������ܻ������StoreAddStoreRemoveStoreCreateStoreDelete StoreRundown$StoreCorruption(StorePageRundownRegionEvictRegionWrite(UnpersistFailure StoreIoStatsGlobalStatsStoreEmpty RegionRelease RegionCompact RegionRundown(CacheTerminationKEYW�����p�@�������������4мStoreOpsStoreDiag0StoreContentsRundownwin:SQMEVNT������8�x��0������������x��L����������L�x��h������������x�������������L�x��������P@�|�x��������������8�x��ظ�����������x�������		�������x�������

P@���x��,����������ԭx��H����������Ȭx��d�����

�����L�x���������������x���������������������������������������������x��Թ���P@�h�x��������������0�0�0�0�0�0�@�P�0�0�0�@�0�0�0�0�0�0�P�0�@�`�WEVT�����(�
x�����$�0�`�TTBLPTEMPD���͟�,�Vo�9��{���BD�	EventDataA��9�oData!K�NameSqmType
A��G�oData/K�NameSqmSessionGuid
A��5�oDataK�NameSqmID
A��W�oData?K�NameSqmDWORDDatapointValue
���4�D�SqmType$SqmSessionGuidSqmID4SqmDWORDDatapointValuePRVA`��Microsoft-Windows-Kernel-LicensingSqmOPCOLEVL@P��(win:InformationalTASKKEYW04L�win:SQMEVNTD����4�����<�WEVTh:������h�
�l��$�<� �CHANt�����XMicrosoft-Windows-Kernel-Memory/AnalyticTTBL�0TEMP�

�!5
.)]���Z�����^D�	EventDataA��G�oData/K�NamePriorityLevels
A��E�oData-K�Name
ZeroPageCount
A��E�oData-K�Name
FreePageCount
A��M�oData5K�NameModifiedPageCount
A��[�oDataCK�NameModifiedNoWritePageCount
A��C�oData+K�NameBadPageCount
A��M�oData5K�NameStandbyPageCounts
�A��S�oData;K�NameRepurposedPageCounts
�A��]�oDataEK�NameModifiedPageCountPageFile
A��O�oData7K�NamePagedPoolPageCount
	A��U�oData=K�NameNonPagedPoolPageCount
A��C�oData+K�NameMdlPageCount
A��I�oData1K�NameCommitPageCount
�0�P�p��������H���������$PriorityLevels ZeroPageCount FreePageCount(ModifiedPageCount8ModifiedNoWritePageCount BadPageCount(StandbyPageCounts0RepurposedPageCounts8ModifiedPageCountPageFile,PagedPoolPageCount0NonPagedPoolPageCount MdlPageCount$CommitPageCountTEMPp�R���n.R����H����D�	EventDataA��5�oDataK�NameCount
A��QZ�ComplexData+K�NameWSCommitInfo
����������(�T�Count WSCommitInfoProcessID,WorkingSetPageCount$CommitPageCount,VirtualSizeInPages<PrivateWorkingSetPageCountTEMP$
t�R���n.R����H����D�	EventDataA��5�oDataK�NameCount
A��QZ�ComplexData+K�NameWSCommitInfo
�<�L�l��������<�h���Count WSCommitInfoProcessID,WorkingSetPageCount$CommitPageCount,VirtualSizeInPages<PrivateWorkingSetPageCount,StoreSizePageCount$StoredPageCount(CommitDebtInPagesTEMPd��R���n.R����H����D�	EventDataA��5�oDataK�NameCount
A��QZ�ComplexData+K�NameWSCommitInfo
�t�	���������8�t�������Count WSCommitInfoProcessID,WorkingSetPageCount$CommitPageCount,VirtualSizeInPages<PrivateWorkingSetPageCount,StoreSizePageCount$StoredPageCount(CommitDebtInPages,SharedCommitInPagesTEMP����?"~�[&
�S�%�\���D�	EventDataA��5�oDataK�NameCount
A��_Z�ComplexData9K�NameSessionWSCommitInfo
����������8�d�Count,SessionWSCommitInfoSessionId,WorkingSetPageCount$CommitPageCount,PagedPoolPageCount<PrivateWorkingSetPageCountTEMP<
����?"~�[&
�S�%�\���D�	EventDataA��5�oDataK�NameCount
A��_Z�ComplexData9K�NameSessionWSCommitInfo
�X�h���������(�d�����Count,SessionWSCommitInfoSessionId,WorkingSetPageCount$CommitPageCount,PagedPoolPageCount<PrivateWorkingSetPageCount,StoreSizePageCount$StoredPageCount(CommitDebtInPagesTEMP|����?"~�[&
�S�%�\���D�	EventDataA��5�oDataK�NameCount
A��_Z�ComplexData9K�NameSessionWSCommitInfo
���	������(�L�x������,�Count,SessionWSCommitInfoSessionId,WorkingSetPageCount$CommitPageCount,PagedPoolPageCount<PrivateWorkingSetPageCount,StoreSizePageCount$StoredPageCount(CommitDebtInPages,SharedCommitInPagesTEMP����)m���N_}݉�T3n��^D�	EventDataA��=�oData%K�Name	ProcessId
�ProcessIdTEMP ���de�^��<3�����D�	EventDataA��=�oData%K�Name	ProcessId
A��5�oDataK�NameFlags
�(�ProcessIdFlagsTEMP�X��tMO%�XRVw�*�����D�	EventDataA��=�oData%K�Name	ProcessId
A��7�oDataK�NameStatus
A��G�oData/K�NamePagesProcessed
������ProcessIdStatus$PagesProcessedTEMP� ����USg�\zY�4.��D�	EventDataA��=�oData%K�Name	ProcessId
A��7�oDataK�NameStatus
A��G�oData/K�NamePagesProcessed
A��_�oDataGK�NameWriteCombinePagesProcessed
A��W�oData?K�NameUncachedPagesProcessed
A��Q�oData9K�NameCleanPagesProcessed
��������$�X�ProcessIdStatus$PagesProcessed<WriteCombinePagesProcessed4UncachedPagesProcessed,CleanPagesProcessedTEMP$T��V]���])&�l�Q|{���D�	EventDataA��=�oData%K�Name	ProcessId
A��7�oDataK�NameStatus
|���ProcessIdStatusTEMP�8�bP���P���J&� ���ZD�	EventDataA��9�oData!K�NameAcgFlag
L�AcgFlagTEMP8������Z�v��N˝���jD�	EventDataA��W�oData?K�NameDurationInMicroseconds

A��?�oData'K�Name
TotalBytes

A��?�oData'K�Name
LowAddress

A��A�oData)K�NameHighAddress

A��=�oData%K�Name	SkipBytes

A��S�oData;K�NameMemoryDescriptorList
A��=�oData%K�Name	IdealNode
A��5�oDataK�NameFlags


��

��
��
�
(�@�p���4DurationInMicrosecondsTotalBytesLowAddressHighAddressSkipBytes0MemoryDescriptorListIdealNodeFlagsTEMPd

���s��cR��5���Ͻ��D�	EventDataA��W�oData?K�NameDurationInMicroseconds

A��?�oData'K�Name
TotalBytes

A��?�oData'K�Name
LowAddress

A��A�oData)K�NameHighAddress

A��;�oData#K�NameBoundary

A��I�oData1K�NamePhysicalAddress

A��E�oData-K�Name
MappedAddress
A��M�oData5K�NameAllocatedFromPool

A��G�oData/K�NameProtectionMask
A��E�oData-K�Name
PreferredNode
	

��

��
��
�
4�
L�p�

������4DurationInMicrosecondsTotalBytesLowAddressHighAddressBoundary$PhysicalAddress MappedAddress(AllocatedFromPool$ProtectionMask PreferredNodeTEMP
,��깗x��S���њ���D�	EventDataA��A�oData)K�NamePartitionId
A��5�oDataK�NameCount
A��UZ�ComplexData/K�NameMemoryNodeInfo
�0�L�
\����������D�p�����PartitionIdCount$MemoryNodeInfoNodeNumber$TotalPageCount,SmallFreePageCount,SmallZeroPageCount,MediumFreePageCount,MediumZeroPageCount,LargeFreePageCount,LargeZeroPageCount(HugeFreePageCount(HugeZeroPageCountPRVAT,�Microsoft-Windows-Kernel-MemoryOPCOx1��2��2�win:Infowin:Startwin:StopLEVL@P��(win:InformationalTASK	����,�����@�����X�����������������������������	���� �MemInfoMemInfoWS(MemInfoSessionWS(WorkingSetOutSwap(WorkingSetInSwapAcg MdlAllocation$ContAllocationMemInfoNodeKEYW� ������@����������$�����`������������<KERNEL_MEM_KEYWORD_MEMINFO@KERNEL_MEM_KEYWORD_MEMINFO_EX<KERNEL_MEM_KEYWORD_WS_SWAP4KERNEL_MEM_KEYWORD_ACGHKERNEL_MEM_KEYWORD_PHYSICAL_ALLOCDKERNEL_MEM_KEYWORD_MEMINFO_NODEEVNT� �����t�x��0����@����� �x��L���@�������x��L���@�������x��L���@������x��h���@�������x��h���@�������x��h���������X����������������������������8�����������������������������X��������������������������������������������x�������	��������x�������
�����`�x������������x�����	�������x�����H�X�X�X�X�X�X�h�h�h�h�h�h�h�x�h�������WEVT�6�	d���
X.�.�.p/|/P1CHAN\���������\����XMicrosoft-Windows-Kernel-ShimEngine/DebugdMicrosoft-Windows-Kernel-ShimEngine/OperationaldMicrosoft-Windows-Kernel-ShimEngine/DiagnosticMAPS���VMAP$h��VMAP$��LKSE:DeviceFlagApplied.FlagSourceMapLKSE:DriverShimApplied.ShimSourceMapTTBL�,TEMP4�Z~�B ;�\�Y�q�h:���D�	EventDataA��9�oData!K�NameEventId
A��C�oData+K�NameDebugMessage
��EventId DebugMessageTEMP(\�%oM���]�@/Hxɫ��4D�	EventDataA��?�oData'K�Name
DriverName
A��?�oData'K�Name
ShimSource
A��=�oData%K�Name	ShimCount
A��C�oData+K�NameAppliedGuids
�����DriverNameShimSourceShimCount AppliedGuidsTEMP|-
U&O�SA����4��*D�	EventDataA��?�oData'K�Name
DeviceName
A��A�oData)K�NameDeviceClass
A��?�oData'K�Name
FlagSource
A��5�oDataK�NameFlags

���

 DeviceNameDeviceClassFlagSourceFlagsTEMP���N��_���ք������D�	EventDataA��?�oData'K�Name
DriverName
A��?�oData'K�Name
DriverBase
A��?�oData'K�Name
DriverSize
A��I�oData1K�NameDriverTimeStamp
A��G�oData/K�NameDriverCheckSum
T	p	�	�	�	DriverNameDriverBaseDriverSize$DriverTimeStamp$DriverCheckSumTEMPD�
ef2�_�Ǎ;�vB���D�	EventDataA��C�oData+K�NameDriverObject
A��?�oData'K�Name
DriverBase
�
 DriverObjectDriverBaseTEMPd\
O]S��Rx�������D�	EventDataA��?�oData'K�Name
DriverBase
A��?�oData'K�Name
DriverSize
A��C�oData+K�NameDriverObject
A��1�oDataK�NamePdo
A��7�oDataK�NameStatus
A��A�oData)K�NameServiceName
A��?�oData'K�Name
HardwareId
�
 @L`|DriverBaseDriverSize DriverObjectPdoStatusServiceNameHardwareIdTEMP0�<au2Pۜ�]i���DD�	EventDataA��9�oData!K�NameAddress
A��7�oDataK�NameCaller
A��3�oDataK�NameType
A��3�oDataK�NameSize
A��1�oDataK�NameTag
t����AddressCallerTypeSizeTagTEMPt�e�5��J]Y���9����D�	EventDataA��9�oData!K�NameAddress
A��7�oDataK�NameCaller
A��1�oDataK�NameTag
0AddressCallerTagTEMP|D��k,H�lZ.�7u1�n:���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
��� DriverObjectFdoIrpTEMP���h؂iAQ��՜����D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��?�oData'K�Name
DeviceType
A��U�oData=K�NameDeviceCharacteristics
A��=�oData%K�Name	Exclusive
A��7�oDataK�NameStatus
$DPl�� DriverObjectFdoDeviceType0DeviceCharacteristicsExclusiveStatusTEMPTT���ܐ�_���R����VD�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��=�oData%K�Name	MajorCode
A��7�oDataK�NameStatus
���� DriverObjectFdoIrpMajorCodeStatusTEMPT�w����RĚ�pȧ'��VD�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��=�oData%K�Name	MinorCode
A��7�oDataK�NameStatus
,8D\ DriverObjectFdoIrpMinorCodeStatusTEMP���b6wm+^��>��.���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��7�oDataK�NameStatus
(4@ DriverObjectFdoIrpStatusTEMP���b6wm+^��>��.���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��7�oDataK�NameStatus
�$ DriverObjectFdoIrpStatusTEMP8L!��g��cQ胉� �o8���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��=�oData%K�Name	MinorCode
A��=�oData%K�Name	PowerType
A��?�oData'K�Name
PowerState
A��7�oDataK�NameStatus
�!�!""("@"\" DriverObjectFdoIrpMinorCodePowerTypePowerStateStatusTEMP8�$��g��cQ胉� �o8���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��=�oData%K�Name	MinorCode
A��=�oData%K�Name	PowerType
A��?�oData'K�Name
PowerState
A��7�oDataK�NameStatus
%0%<%H%`%x%�% DriverObjectFdoIrpMinorCodePowerTypePowerStateStatusTEMP�x'b}}����_�G��&Sv����D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��=�oData%K�Name	MinorCode
A��?�oData'K�Name
PowerState
A��7�oDataK�NameStatus
�'((((@(\( DriverObjectFdoIrpMinorCodePowerStateStatusTEMP��)�b6wm+^��>��.���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��7�oDataK�NameStatus
*(*4*@* DriverObjectFdoIrpStatusTEMP�,�N��_���ք������D�	EventDataA��?�oData'K�Name
DriverName
A��?�oData'K�Name
DriverBase
A��?�oData'K�Name
DriverSize
A��I�oData1K�NameDriverTimeStamp
A��G�oData/K�NameDriverCheckSum
x,�,�,�,�,DriverNameDriverBaseDriverSize$DriverTimeStamp$DriverCheckSumTEMPD�-ef2�_�Ǎ;�vB���D�	EventDataA��C�oData+K�NameDriverObject
A��?�oData'K�Name
DriverBase
.<. DriverObjectDriverBasePRVA\l.Microsoft-Windows-Kernel-ShimEngineOPCO01�.win:InfoLEVL�P/P,/[T/win:Error(win:Informationalwin:VerboseTASKKEYW�����0����00����\0�����0�����0�����0�����0 ����1(ShimEngineEvents,ShimEngineMessages,DriverScopeGeneral$DriverScopePnp(DriverScopePower$DriverScopeIrps$DriverScopePool4SkipDriverUnloadGeneralEVNTD�������.p��������.p�@���.�.��@��.�.�� @����T*/P5�� @����-/T5��
 ����0/X5�� �����	/\5�� ����4/`5��
 �����/d5�� �����/h5�� ����</l5�� �����/p5�� �����/t5�� ����/x5�� ����p/|5�� ����T/�5�� ����8/�5�� ����p"/�5�� �����%/�5�� ����p(/�5���/�/�/�/�/�/�/�/�/�/�/�/�/�/�/�/�/WEVTl�
�5X6d6�6�6�6PRVA��5Microsoft-Windows-Kernel-Licensing-StartServiceTriggerOPCOLEVL@P|6(win:InformationalTASKKEYWEVNT@����p6WEVTX����H7
�78H8�8x9�9CHANxd7����\Microsoft-Windows-Kernel-IoTrace/DiagnosticPRVAX�7Microsoft-Windows-Kernel-IoTraceOPCO0108win:InfoLEVLhPl8[�8(win:Informationalwin:VerboseTASK�����9����49����L9$UserInitiatedIoKernelIo,ActivityIdTransferKEYWEVNT������$8T8�8T7�����$8`8�8T7�����$8`8�8T7�����$8T8�8T7WEVT�m��:�<
t�Є$�܅l��CHAN�;	� ;�|;�����;����,<����Application\Microsoft-Windows-AppModel-Runtime/AnalyticXMicrosoft-Windows-AppModel-Runtime/AdminXMicrosoft-Windows-AppModel-Runtime/DebugdMicrosoft-Windows-AppModel-Runtime/DiagnosticsTTBL�G(TEMPH�=��U�%T�d<�
�����D�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
�=�=ErrorCode$PackageFullNameTEMPt@'$�vS�^a�[.�������D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��I�oData1K�NameParentProcessID
A��I�oData1K�NamePackageFullName
A��=�oData%K�Name	ImageName
A��c�oDataKK�NamePackageRelativeApplicationId
�@�@�@�@AAProcessIDCreateTime$ParentProcessID$PackageFullNameImageName@PackageRelativeApplicationIdTEMP��BzsS��&]����%Ǚ���D�	EventDataA��I�oData1K�NamePackageFullName
A��=�oData%K�Name	ErrorCode
A��C�oData+K�NameErrorMessage
�B�B�B$PackageFullNameErrorCode ErrorMessageTEMP�HD}��s!t
^�p�v�W���D�	EventDataA��I�oData1K�NamePackageFullName
A��=�oData%K�Name	ErrorCode
A��C�oData+K�NameFailedBinary
�D�D�D$PackageFullNameErrorCode FailedBinaryTEMP�tE?~�v|�Uj��]�4���^D�	EventDataA��=�oData%K�Name	ErrorCode
�EErrorCodeTEMP@�G�����wZۉML-e�����D�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��3�oDataK�NameSize

A��7�oDataK�NameOffset
A��?�oData'K�Name
HeaderAddr
A��9�oData!K�NameSection
A��=�oData%K�Name	ProcessId
DH\H

tH�H�H�H�HFileNameErrorCodeSizeOffsetHeaderAddrSectionProcessIdTEMP��J�2Ol�T�>��6�����D�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��3�oDataK�NameSize

A��?�oData'K�Name
HeaderAddr
A��9�oData!K�NameSection
A��=�oData%K�Name	ProcessId
0KHK

`KpK�K�KFileNameErrorCodeSizeHeaderAddrSectionProcessIdTEMP�M��/Q}�Q����B����D�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��3�oDataK�NameSize

A��?�oData'K�Name
HeaderAddr
A��W�oData?K�NameApplicationUserModelId
A��=�oData%K�Name	ProcessId
(N@N

XNhN�N�NFileNameErrorCodeSizeHeaderAddr4ApplicationUserModelIdProcessIdTEMPphP&�8#}�NX[V��PpK���dD�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��3�oDataK�NameSize

A��?�oData'K�Name
HeaderAddr
A��=�oData%K�Name	ProcessId
�P�P

�PQ(QFileNameErrorCodeSizeHeaderAddrProcessIdTEMP�XRR�n#�V�!�qT����D�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��=�oData%K�Name	ProcessId
�R�R�RFileNameErrorCodeProcessIdTEMP<�S���DI�]���jzXK���D�	EventDataA��;�oData#K�NameFileName
A��E�oData-K�Name
ExceptionCode
�S�SFileName ExceptionCodeTEMP�lUB��
��;V ,��1~���D�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��3�oDataK�NameType
A��=�oData%K�Name	ProcessId
�U�U�U�UFileNameErrorCodeTypeProcessIdTEMPH�V�uSQk�Xޱt!֝6A���D�	EventDataA��I�oData1K�NamePackageFullName
A��=�oData%K�Name	ErrorCode
 WDW$PackageFullNameErrorCodeTEMP�X}4j�n��]l���=�0��$D�	EventDataA��I�oData1K�NamePackageFullName
A��1�oDataK�NameKey
A��7�oDataK�NameSubkey
A��=�oData%K�Name	ErrorCode
Y(Y4YHY$PackageFullNameKeySubkeyErrorCodeTEMP�Z}4j�n��]l���=�0��$D�	EventDataA��I�oData1K�NamePackageFullName
A��1�oDataK�NameKey
A��7�oDataK�NameSubkey
A��=�oData%K�Name	ErrorCode
[,[8[L[$PackageFullNameKeySubkeyErrorCodeTEMP�\}4j�n��]l���=�0��$D�	EventDataA��I�oData1K�NamePackageFullName
A��1�oDataK�NameKey
A��7�oDataK�NameSubkey
A��=�oData%K�Name	ErrorCode
]0]<]P]$PackageFullNameKeySubkeyErrorCodeTEMPPP^	�p\k��&�����D�	EventDataA��M�oData5K�NamePackageFamilyName
A��=�oData%K�Name	ErrorCode
x^�^(PackageFamilyNameErrorCodeTEMP(�_�c��+U���w�6p����D�	EventDataA��=�oData%K�Name	ErrorCode
A��9�oData!K�NameContext
�_�_ErrorCodeContextTEMP(�`�c��+U���w�6p����D�	EventDataA��=�oData%K�Name	ErrorCode
A��9�oData!K�NameContext
�`�`ErrorCodeContextTEMP��a?~�v|�Uj��]�4���^D�	EventDataA��=�oData%K�Name	ErrorCode
�aErrorCodeTEMP�hb�&؍1�
U)��;߸C��lD�	EventDataA��K�oData3K�NameAppContainerName
|b(AppContainerNameTEMP�Dct+=D{��Q
��m����jD�	EventDataA��I�oData1K�NamePackageFullName
Xc$PackageFullNameTEMPH`d ����2B[&�Ŧ�]$���D�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
�d�dErrorCode$PackageFullNameTEMP,�e�ˀf��S �t�:sV����D�	EventDataA��=�oData%K�Name	ErrorCode
A��;�oData#K�NameResource
�e�eErrorCodeResourceTEMP,�f�ˀf��S �t�:sV����D�	EventDataA��=�oData%K�Name	ErrorCode
A��;�oData#K�NameResource
�fgErrorCodeResourceTEMPHh ����2B[&�Ŧ�]$���D�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
(h@hErrorCode$PackageFullNameTEMP��iر`n���[m��,l��.���D�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
A��3�oDataK�NameUser
�i�i�iErrorCode$PackageFullNameUserTEMPH�kuBԘ|Xl��%�{�Z��FD�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
A��E�oData-K�Name
DesiredStatus
A��E�oData-K�Name
CurrentStatus
�k�kl0lErrorCode$PackageFullName DesiredStatus CurrentStatusTEMP��m�~��uB�YĴ��z�E��D�	EventDataA��I�oData1K�NamePackageFullName
A��E�oData-K�Name
DesiredStatus
A��E�oData-K�Name
CurrentStatus
�m�mn$PackageFullName DesiredStatus CurrentStatusTEMP��o��^�m�Q���w�
���D�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
A��3�oDataK�NameUser
A��E�oData-K�Name
DesiredStatus
A��E�oData-K�Name
CurrentStatus
@pXp|p�p�pErrorCode$PackageFullNameUser DesiredStatus CurrentStatusTEMP4<r�9%�'S��`Zdv{���<D�	EventDataA��I�oData1K�NamePackageFullName
A��3�oDataK�NameUser
A��E�oData-K�Name
DesiredStatus
A��E�oData-K�Name
CurrentStatus
�r�r�r�r$PackageFullNameUser DesiredStatus CurrentStatusTEMP(�s�c��+U���w�6p����D�	EventDataA��=�oData%K�Name	ErrorCode
A��9�oData!K�NameContext
�stErrorCodeContextTEMP��uü��V�]6�D����zD�	EventDataA��=�oData%K�Name	ProcessID
A��A�oData)K�NamePackageName
A��=�oData%K�Name	ImageName
A��I�oData1K�NameApplicationName
A��9�oData!K�NameMessage
<vTvpv�v�vProcessIDPackageNameImageName$ApplicationNameMessageTEMP�px��6���RSX�˜����zD�	EventDataA��A�oData)K�NamePackageName
A��=�oData%K�Name	ImageName
A��I�oData1K�NameApplicationName
A��=�oData%K�Name	ErrorCode
A��9�oData!K�NameMessage
�x�xy,yDyPackageNameImageName$ApplicationNameErrorCodeMessageTEMP��z�n#Ύ��X��sk�	�����D�	EventDataA��A�oData)K�NamePackageName
A��E�oData-K�Name
ContainerName
A��A�oData)K�NameContainerId
�z�z�zPackageName ContainerNameContainerIdTEMP�<|C|3*C�uVo���.}+���D�	EventDataA��=�oData%K�Name	ProcessID
A��A�oData)K�NamePackageName
A��A�oData)K�NameContainerId
x|�|�|ProcessIDPackageNameContainerIdTEMP 0~z`y�-'1T��x¤�r���2D�	EventDataA��=�oData%K�Name	ErrorCode
A��=�oData%K�Name	ProcessID
A��A�oData)K�NamePackageName
A��A�oData)K�NameContainerId
�~�~�~�~ErrorCodeProcessIDPackageNameContainerIdTEMP���vgz!XX_�HT
"I���D�	EventDataA��=�oData%K�Name	ErrorCode
A��A�oData)K�NamePackageName
A��E�oData-K�Name
ContainerName
L�d���ErrorCodePackageName ContainerNameTEMP@���O�L�W�ּY=���D�	EventDataA��A�oData)K�NamePackageName
A��A�oData)K�NameContainerId
��āPackageNameContainerIdTEMP����Cg�6hT���v#��E��lD�	EventDataA��]�oDataEK�NameCleanupContainerErrorCode
A��W�oData?K�NameMakeTemporaryErrorCode
A��A�oData)K�NamePackageName
A��A�oData)K�NameContainerId
Ѓ�<�X�8CleanupContainerErrorCode4MakeTemporaryErrorCodePackageNameContainerIdPRVA\��Microsoft-Windows-AppModel-RuntimeOPCOT2�2�win:Startwin:StopLEVL�U`�P��P��P�� win:Criticalwin:Errorwin:Warning(win:InformationalTASK���������������X�����������܈����(�d����p�e������f������g����4�h����|�i�����������������8������h�������������ԋ������0AppModelProcessStartHAppIntegrityDependencyGraphCheck<AppIntegrityProcessCreationHAppIntegrityInAppValidatePackageLAppModelDynamicPropertiesReadFailedHAppModelDynamicPropertiesInvalidDRestrictedAppContainerCreationDRestrictedAppContainerDeletion<RestrictedAppContainerOpenHRestrictedAppContainerEnumeration@RestrictedAppContainerLaunchLRestrictedAppContainerTerminateAll0AppContainerCreation0AppContainerDeletion,AppContainerUpdate@FirewallAppContainerCreation@FirewallAppContainerDeletionXRestrictedAppContainerUpdateCapabilitiesKEYW����,�X������� ������@����؍������Process AppContainer,DesktopAppXProcess0DesktopAppXContainer0ms:ReservedKeyword40 ms:Telemetryms:Measures$ms:CriticalDataEVNT8�@��=T�(��:@ �XA<�,��:@ �XA<�4��:@ �XA<�<��:@ �XA<�D��:@ �XA<�L��: �XA<�T��: �C<�X��:		�	C<�\��: �CH�`��: ��DH�d��: ��E<�h��: ��H<�l��: ��E<�p��: ��E<�t��: �@Q<�x��: ��R<�|��:@ �XA<����:@ ��^<����: ��^<����: ��^<����: ��^<����: ��^<����: ��^<����: ��^<����: ��^<����: ��^<����: ��^<����: �a<����:   ��^<����:! !�a<����:" "�a<����:# #�a<�Ħ�:$ $�a<�Ȧ�:% %�a<�̦�:& &�a<�Ц�:' '��aT�Ԧ�:( (��aT�ئ�:) )��aT�ܦ�:* *��aT���:+ +��K<���:, ,��N<���:- -��^<���:. .�a<���:/ /�a<���:0 0��^<����:1 1��^<����:2 2��^<���:3 3��^<���:4 4��^<���:5 5��bT���:6 6��b<���:7 7��b<���:8 8��bT���:9 9�|c<���:: :�|c<� ��:; ;�|c<�$��:< <��b<�(��:=@ =�XA<�,��:> >�|c<�4��:? ?��d<�8��:@ @��e<�<��:A A�g<�@��:B B�dh<�D��:C C�jT�H��:D D�PlT�L��:E E�(nT�P��:F F��pT�T��:G G�s<�X��:HH�T�\��:I I�XA<�`��:J J�T<�d��:K K�V<�h��:L L�\W<�l��:M M�`Y<�p��:N N�d[<�t��:O  O�h]0�x��:P  P�h]<����:Q Q��<<����:e�e��a܄T�8����:f�f��^�T�8����:g�g��a܄T�T����:h�h��^�T�T����:i�i��a܄T�p����:j�j��^�T�p����:k�k��a܄T������:l�l��_�T������:m�m��a܄T������:n�n��_�T������:odo��a܄T������:pdp��_�T������:qeq��a܄T������:rer��_�T������:sfs��a܄T�Ȇħ�:tft��_�T�Ȇȧ�:ugu��a܄T��̧�:vgv��_�T��Ч�:whw��a܄T��ԧ�:xhx��_�T��ا�:yiy��a܄T��ܧ�:ziz��_�T����:{{��b܄T����:||�|c�T����:}}��b܄T� ���:~~�|c�T� ���:��b܄T�<���:���|c�T�<����:�����a�T������:�����a܄T�ć��:�����_�T�ć��:� ��(tT���:� ���v<���:� ���v<���:� ���v<���:� ���v<���:� ���v<���:� ���v<� ��:� ���v<�$��:� ���v<�(��:� ��XyT�,��:� ��{T�0��:� ���|<�4��:� ���~<�8��:� ���~<�<��:� ���~<�@��:� ���~<�D��:� ����T�H��:� ���T�L��:x�x�،x�،x�،x�،x�،x�x�x�x�x�x�x�x�x�x�x�x�،��،������������������������������������������x�x�x�x�x�x�x�x�x�x�x�x�x�x�x�x�x�x�x�،x�x�x�x�x�x�x�x�x�x�x�x�x�x�x�x�x�x�Ȍx�Ȍx���������������������������������������������x�x�x�x�x�x�������������������������������������������WEVT?�����
L��������`�CHANܨ	����L��ApplicationTMicrosoft-Windows-AppModel-State/Debug\Microsoft-Windows-AppModel-State/DiagnosticTTBL�
TEMP�\�!��5�"0W�
P�څ���rD�	EventDataA��Q�oData9K�NameInformationalString
p�,InformationalStringTEMP(p�v��(8\�$������D�	EventDataA��A�oData)K�NameErrorString
A��5�oDataK�NameError
����ErrorStringErrorTEMP������br�RiM1$U�����D�	EventDataA��C�oData+K�NameFolderString
A��E�oData-K�Name
PackageString
A��5�oDataK�NameError
 �@�`� FolderString PackageStringErrorTEMP���p���p[&Xp�� T�����D�	EventDataA��E�oData-K�Name
PackageString
A��9�oData!K�NameUserSid
A��5�oDataK�NameError
Į��� PackageStringUserSidErrorTEMP�4�v��k�T�l/�;c���D�	EventDataA��=�oData%K�Name	Operation
A��E�oData-K�Name
PackageFamily
A��G�oData/K�NameOperationError
p�����Operation PackageFamily$OperationErrorTEMP\P�hyVb��X\x�5y�f/��ND�	EventDataA��=�oData%K�Name	Operation
A��E�oData-K�Name
PackageFamily
A��G�oData/K�NameOperationError
A��O�oData7K�NameRepairTriggerError
����ز��Operation PackageFamily$OperationError,RepairTriggerErrorTEMP$���mQ�5�Qj�8!~��C���D�	EventDataA��?�oData'K�Name
FolderPath
A��5�oDataK�NameError
 �<�FolderPathErrorPRVAX`�Microsoft-Windows-AppModel-StateOPCOT2ȴ2�win:Startwin:StopLEVL�P(�P@�P\�win:Errorwin:Warning(win:InformationalTASK�+����D�����������к���������l����������������T�d������e�����f����x�g�����h����h�i�����j������k�����l������m����,�n������o����D�p������q����l�r�����s������t����(�u������v����P�w������x����x�y�����z������{����(�|������}����<�~����������X�������������p���������������������������H��������HAppModel.Task.State.WriteSettingDAppModel.Task.State.ReadSettingHAppModel.Task.State.DeleteSettingTAppModel.Task.State.WriteSettingInAtomPAppModel.Task.State.ReadSettingInAtomTAppModel.Task.State.DeleteSettingInAtomDAppModel.Task.State.CommitAtomDAppModel.Task.State.LoadAppHivelAppModel.Task.StateWinRT.AppDataFactory_ActivationtAppModel.Task.StateWinRT.ApplicationDataServer_LifespanxAppModel.Task.StateWinRT.ApplicationDataServer_GetVersionxAppModel.Task.StateWinRT.ApplicationDataServer_SetVersion�AppModel.Task.StateWinRT.ApplicationDataServer_RoamingStorageQuota�AppModel.Task.StateWinRT.ApplicationDataServer_RoamingStorageUsage�AppModel.Task.StateWinRT.ApplicationDataServer_ActivateContainerServer�AppModel.Task.StateWinRT.ApplicationDataServer_ActivateFileItemServer�AppModel.Task.StateWinRT.ApplicationDataContainerServer_Lifespan�AppModel.Task.StateWinRT.ApplicationDataContainerServer_GetValues�AppModel.Task.StateWinRT.ApplicationDataContainerServer_GetContainers�AppModel.Task.StateWinRT.ApplicationDataContainerServer_CreateContainer�AppModel.Task.StateWinRT.ApplicationDataContainerServer_DeleteContainer�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Lifespan�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Lookup�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Size�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_HasKey�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_GetView�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Insert�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Remove�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Clear�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_First�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Lifespan�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Lookup�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Size�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_HasKey�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_GetView�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Insert�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Remove�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Clear�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_FirstXAppModel.Task.StateWinRT.RoamingRpcSignalhAppModel.Task.StateWinRT.DataChangedEventDispatchPAppModel.Task.StateWinRT.TempCleanuptAppModel.Task.StateWinRT.ApplicationDataServer_ForUserKEYWT��������� �18�Structured(UnstructuredResetOutOfMemoryApiSetErrorWinRT$DataStoreError(win:ResponseTimeEVNTl@��������@��������@������@�������� @��������@����@����@������	@	����
	�
�����	������	������
	�
ī���@�p����@�p����@�p����@�p����@������@������	�����	�̰���	�(����	�����	�̰���2 �����������̨3 �����������̨< �����������̨= �����������̨F �������ȵ��̨G �������ȵ��̨P ����������̨Q ����������̨Z ���������̨[ ���������̨d ���������̨e ���������̨n �������8�$�̨o �������8�,�̨x �������T�4�̨y �������T�<�̨�d �������p�D�̨�d �������p�L�̨�e ���������T�̨�e ���������\�̨�f ���������d�̨�f ���������l�̨�g �������Ķt�̨�g �������Ķ|�̨�h ����������̨�h ����������̨�j ����������̨�j ����������̨�k �������4���̨�k �������4���̨�l �������P���̨�l �������P���̨�m �������l���̨�m �������l���̨�n �����������̨�n �����������̨o �����������̨o �����������̨p �����������̨p �����������̨q �������ܷ�̨q �������ܷ�̨"r ����������̨#r ����������̨,s ��������$�̨-s ��������,�̨6t �������0�4�̨7t �������0�<�̨@u �������L�D�̨Au �������L�L�̨Jv �������h�T�̨Kv �������h�\�̨Tw ���������d�̨Uw ���������l�̨^x ���������t�̨_x ���������|�̨hy �����������̨iy �����������̨rz �������ظ��̨sz �������ظ��̨|{ ����������̨}{ ����������̨�| ����������̨�| ����������̨�} �������,���̨�} �������,���̨�~ �������H���̨�~ �������H���̨� �������d���̨� �������d���̨�� �����������̨�� �����������̨�� ����������̨�� ����������̨�� ����������̨�� ����������̨�� �������Թ$�̨�� �������Թ,�̨�� ��������4�̨�� ��������<�̨�� ��������D�̨�� ��������L�̨�� �������(�T�̨�� �������(�\�̨(�(�8�H�h��x��x��x��x��x��x��x��x��x��x��x��x��x��x��x��x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�X�x�WEVTl�
��(�4�t�����PRVA���Microsoft-Windows-Kernel-WSService-StartServiceTriggerOPCOLEVL@PL�(win:InformationalTASKKEYWEVNT@����@�WEVT,
�	(���@�
��<���@�����CHAN�T�����TMicrosoft-Windows-Kernel-IO/OperationalSystemMAPS���VMAP4�����@IoMgrDmpEncryptionFailureMapTTBL�TEMP�x��~�b?P��\�X^����D�	EventDataA��?�oData'K�Name
VolumeGuid
A��K�oData3K�NameVolumeNameLength
A��?�oData'K�Name
VolumeName
������VolumeGuid(VolumeNameLengthVolumeNameTEMP(|�3n�d���TX�¶?�,���4D�	EventDataA��?�oData'K�Name
VolumeGuid
A��K�oData3K�NameVolumeNameLength
A��?�oData'K�Name
VolumeName
A��5�oDataK�NameError
�����,�VolumeGuid(VolumeNameLengthVolumeNameErrorTEMPT$�A���Ug���f����D�	EventDataA��K�oData3K�NameFilterNameLength
A��?�oData'K�Name
FilterName
L�t�(FilterNameLengthFilterNameTEMPX��E���]�y��9щw��JD�	EventDataA��K�oData3K�NameFilterNameLength
A��?�oData'K�Name
FilterName
A��K�oData3K�NameVolumeNameLength
A��?�oData'K�Name
VolumeName
`�������(FilterNameLengthFilterName(VolumeNameLengthVolumeNameTEMP��n��	Y�ώ)@b.����D�	EventDataA��a�oDataIK�NameDumpEncryptionFailureReason
����<DumpEncryptionFailureReasonPRVAL�Microsoft-Windows-Kernel-IOOPCOx1l�2��2��win:Infowin:Startwin:StopLEVL�P��P��P�win:Errorwin:Warning(win:InformationalTASKD����h�VolumeMountKEYW<������ VolumeMountsEVNT<��L�T���L��4���L�`���L��4����`���L���4��@�<�H���D��@���H���D��@���H���D�������WEVT|LLL�4�
80�0�586<8H8CHAN�x�M�\Microsoft-Windows-Kernel-LiveDump/Analytic`Microsoft-Windows-Kernel-LiveDump/OperationalTTBL9TEMP��>c'�޽XS떂7�r���\D�	EventDataA��;�oData#K�NameNTStatus
�NTStatusTEMPX�E���*S\=Pu�����D�	EventDataA��q�oDataYK�Name#NtEstimatedRequiredPrimaryDataBytes

A��a�oDataIK�NameNtEstimatedPrimaryDataBytes

A��a�oDataIK�NameHvEstimatedPrimaryDataBytes

A��e�oDataMK�NameHvEstimatedSecondaryDataBytes



P�

��

�

�LNtEstimatedRequiredPrimaryDataBytes<NtEstimatedPrimaryDataBytes<HvEstimatedPrimaryDataBytes@HvEstimatedSecondaryDataBytesTEMP�xp���o�[�BpZ�������D�	EventDataA��q�oDataYK�Name#NtEstimatedRequiredPrimaryDataBytes

A��a�oDataIK�NameNtEstimatedPrimaryDataBytes

A��a�oDataIK�NameHvEstimatedPrimaryDataBytes

A��e�oDataMK�NameHvEstimatedSecondaryDataBytes

A��a�oDataIK�NameSkEstimatedPrimaryDataBytes

A��a�oDataIK�NameMemoryEstimationDuration_ms

A��]�oDataEK�NameSystemQuiescedDuration_ms

A��e�oDataMK�NameEndMirroringPhasesDuration_ms

A����oDatakK�Name,TotalMirrorPhysicalMemoryCallbackDuration_ms

A��w�oData_K�Name&TotalMirrorPhysicalMemoryCallbackBytes
	
A��q�oDataYK�Name#HvlCalculateLiveDumpSizeDuration_ms



T

�

�



X

�

�



H

�

�LNtEstimatedRequiredPrimaryDataBytes<NtEstimatedPrimaryDataBytes<HvEstimatedPrimaryDataBytes@HvEstimatedSecondaryDataBytes<SkEstimatedPrimaryDataBytes<MemoryEstimationDuration_ms8SystemQuiescedDuration_ms@EndMirroringPhasesDuration_ms`TotalMirrorPhysicalMemoryCallbackDuration_msTTotalMirrorPhysicalMemoryCallbackBytesLHvlCalculateLiveDumpSizeDuration_msTEMP�e����[�$`����� D�	EventDataA��O�oData7K�NameNtPrimaryDataBytes

A��O�oData7K�NameHvPrimaryDataBytes

A��S�oData;K�NameHvSecondaryDataBytes



�



0,NtPrimaryDataBytes,HvPrimaryDataBytes0HvSecondaryDataBytesTEMP$h	L����[�^暔��:����D�	EventDataA��O�oData7K�NameNtPrimaryDataBytes

A��O�oData7K�NameHvPrimaryDataBytes

A��S�oData;K�NameHvSecondaryDataBytes

A��O�oData7K�NameSkPrimaryDataBytes

A��g�oDataOK�NameAllocateDumpBuffersDuration_ms

A��i�oDataQK�NameAllocateExtraBuffersDuration_ms

A��y�oDataaK�Name'HvlPrepareLivedumpDescriptorDuration_ms



�	

 


L


|


�


�


0,NtPrimaryDataBytes,HvPrimaryDataBytes0HvSecondaryDataBytes,SkPrimaryDataBytesDAllocateDumpBuffersDuration_msDAllocateExtraBuffersDuration_msTHvlPrepareLivedumpDescriptorDuration_msTEMP�L
i:9��p�U�sn���Vg���D�	EventDataA��;�oData#K�NameNTStatus
A��?�oData'K�Name
TotalBytes

A��A�oData)K�NameHeaderBytes

A��K�oData3K�NamePrimaryDataBytes

A��O�oData7K�NameSecondaryDataBytes

�


�


�




(NTStatusTotalBytesHeaderBytes(PrimaryDataBytes,SecondaryDataBytesTEMP���8 Q��C�Y�]���pD�	EventDataA��O�oData7K�NameCallbackIdentifier
,CallbackIdentifierTEMPT B|�SUY҂K$���+���D�	EventDataA��O�oData7K�NameCallbackIdentifier
A��;�oData#K�NameNTStatus
Ht,CallbackIdentifierNTStatusTEMPh���:��W���|�v]���D�	EventDataA��O�oData7K�NameEstimatedPageCount

A��O�oData7K�NameAllocatedPageCount

A��M�oData5K�NameLimitDumpFileSize

A��[�oDataCK�NameDumpFileSizeLimitInBytes

A��[�oDataCK�NameDumpFileSizeLimitReached





0

\

�

�,EstimatedPageCount,AllocatedPageCount(LimitDumpFileSize8DumpFileSizeLimitInBytes8DumpFileSizeLimitReachedTEMP��>c'�޽XS떂7�r���\D�	EventDataA��;�oData#K�NameNTStatus
�NTStatusTEMPd�N��X��Z��#�G���D�	EventDataA��W�oData?K�NameBufferAllocationScheme

A��;�oData#K�NameNTStatus


��4BufferAllocationSchemeNTStatusTEMPdN��X��Z��#�G���D�	EventDataA��W�oData?K�NameBufferAllocationScheme

A��;�oData#K�NameNTStatus


,`4BufferAllocationSchemeNTStatusTEMP��RT���C^�Q5�q���bD�	EventDataA��A�oData)K�NameDuration_ms



$Duration_msTEMPQ=Ȋ��YO)�TMa���D�	EventDataA��i�oDataQK�NameMarkRequiredDumpDataDuration_ms



DMarkRequiredDumpDataDuration_msTEMPѦ��YX�-O�p����D�	EventDataA��k�oDataSK�Name MarkImportantDumpDataDuration_ms



,HMarkImportantDumpDataDuration_msTEMP�ţB�h}�^��l<FQ����FD�	EventDataA��k�oDataSK�Name PopulateBitmapForDumpDuration_ms

A��s�oData[K�Name$RemoveSystemCacheFromDumpDuration_ms

A��a�oDataIK�NameMemoryEstimationDuration_ms

A��]�oDataEK�NameSystemQuiescedDuration_ms

A��e�oDataMK�NameEndMirroringPhasesDuration_ms

A����oDatakK�Name,TotalMirrorPhysicalMemoryCallbackDuration_ms

A��w�oData_K�Name&TotalMirrorPhysicalMemoryCallbackBytes



|

�



P

�

�

( HPopulateBitmapForDumpDuration_msPRemoveSystemCacheFromDumpDuration_ms<MemoryEstimationDuration_ms8SystemQuiescedDuration_ms@EndMirroringPhasesDuration_ms`TotalMirrorPhysicalMemoryCallbackDuration_msTTotalMirrorPhysicalMemoryCallbackBytesTEMP�!�RT���C^�Q5�q���bD�	EventDataA��A�oData)K�NameDuration_ms



(!Duration_msTEMP��!�RT���C^�Q5�q���bD�	EventDataA��A�oData)K�NameDuration_ms



�!Duration_msTEMP��"�RT���C^�Q5�q���bD�	EventDataA��A�oData)K�NameDuration_ms



�"Duration_msTEMP �$g�C����P��=�`��4���D�	EventDataA��M�oData5K�NameCorralDuration_ms

A��c�oDataKK�NameDisableInterruptsDuration_ms

A��g�oDataOK�NameSaveSupervisorStateDuration_ms

A��c�oDataKK�NameSuspendClockTimerDuration_ms



%

0%

p%

�%(CorralDuration_ms@DisableInterruptsDuration_msDSaveSupervisorStateDuration_ms@SuspendClockTimerDuration_msTEMP(�'�Q��VˡW�k؄'T8S���D�	EventDataA��Q�oData9K�NameUncorralDuration_ms

A��a�oDataIK�NameEnableInterruptsDuration_ms

A��m�oDataUK�Name!RestoreSupervisorStateDuration_ms

A��a�oDataIK�NameResumeClockTimerDuration_ms



0(

\(

�(

�(,UncorralDuration_ms<EnableInterruptsDuration_msHRestoreSupervisorStateDuration_ms<ResumeClockTimerDuration_msTEMP�|,B%LD-R�_�[�4�S��*D�	EventDataA��[�oDataCK�NameMemoryCaptureDuration_ms

A��]�oDataEK�NameSystemQuiescedDuration_ms

A��e�oDataMK�NameEndMirroringPhasesDuration_ms

A����oDatakK�Name,TotalMirrorPhysicalMemoryCallbackDuration_ms

A��w�oData_K�Name&TotalMirrorPhysicalMemoryCallbackBytes

A��e�oDataMK�NameHvlCollectLivedumpDuration_ms

A��c�oDataKK�NameDumpDataBufferingDuration_ms



-

@-

x-

�-

.

l.

�.8MemoryCaptureDuration_ms8SystemQuiescedDuration_ms@EndMirroringPhasesDuration_ms`TotalMirrorPhysicalMemoryCallbackDuration_msTTotalMirrorPhysicalMemoryCallbackBytes@HvlCollectLivedumpDuration_ms@DumpDataBufferingDuration_msTEMPL�/�Rt��S��t�������D�	EventDataA��;�oData#K�NameNTStatus
A��K�oData3K�NameMirrorInProgress

�/

0NTStatus(MirrorInProgressPRVAXL0Microsoft-Windows-Kernel-LiveDumpOPCOh
c�1d�1e�1
f,2g`2h�2i�2j�2k3l03m\3v�3w�3}�3��3�$4�T4��4��4��4�5�@5 �h5!��5"��5APIStartAPIEnd8WriteDumpDataToFileStart4WriteDumpDataToFileEnd$MirroringStart,MirroringPhase0End,MirroringPhase1End,SystemQuiesceStart(SystemQuiesceEnd,PageBufferingStart(PageBufferingEnd(BufferEstimation(BufferAllocationRemovePages4CaptureProcessorContext0MarkRequiredDumpData0MarkImportantDumpData0PopulateBitmapForDump,HvlCollectLiveDump8GenerateIptSecondaryData(DumpDataBuffering(CorralProcessors,UncorralProcessors,CaptureMemoryPages8MmDuplicateMemoryFailureLEVL@P6(win:InformationalTASKN�6O7PH7Q�7R�78LIVEDUMP_TASK_CAPTURE_API@LIVEDUMP_TASK_SIZING_WORKFLOWPLIVEDUMP_TASK_CAPTURE_PAGES_WORKFLOWPLIVEDUMP_TASK_WRITE_DEFERRED_DATA_APITLIVEDUMP_TASK_DISCARD_DEFERRED_DATA_APIKEYWEVNT0
6
�_�06D6X��`@��06D6X��a�06D6X�
�b��06D6X��~,16D6X�e�S�06`6X�f�T�06`6X�g�U�06`6X�h@V�06`6h�i@W�06`6h�j@t�� 16`6h�j@�T� 16`6h�k@uH,16`6h�k@�`,16`6h�l�x816`6X�m�y816`6X�n�zT816`6X�o�{T816`6X�p�|8816`6X�q@�� 16`6h�r@�� 16`6h�s@��,16`6h�t@�,16`6h�u��xD16`6X�v��@P16`6X�w��X\16`6X�x��th16`6X�y���"�16`6X�z ���%�16`6X�{"@��.�16`6h���X�06|6X���Y�06|6X���Z�06|6X��@[�06|6h��@\�06|6h��@]16|6h��@^16|6h����xD16|6X����@P16|6X����X\16|6X����th16|6X����| t16|6X����D!�16|6X����"�16|6X�����"�16|6X�� ���%�16|6X��!@�)�16|6h��"@��.�16|6h��
�n�06�6X���o@��06�6X���p�06�6X��
�q��06�6X��
�r�06�6X���s@��06�6X�WEVT0�B
(O�O�OPPPTTBLhTEMP�`CI��,c_����v�N��`D�	EventDataA��?�oData'K�Name
ReturnCode
tCReturnCodeTEMPd�D�y�i,UTu�j������D�	EventDataA��S�oData;K�NameNotifyRoutineAddress
A��?�oData'K�Name
ReturnCode
�D�D0NotifyRoutineAddressReturnCodeTEMPL�E=�R�ӛT9����F���D�	EventDataA��I�oData1K�NameTargetProcessId
A��?�oData'K�Name
ReturnCode
F$F$TargetProcessIdReturnCodeTEMP�pG2�l�l9Q+Y�%�6����D�	EventDataA��I�oData1K�NameTargetProcessId
A��E�oData-K�Name
DesiredAccess
A��?�oData'K�Name
ReturnCode
�G�G�G$TargetProcessId DesiredAccessReturnCodeTEMPT�I��v"�\�[�R=����JD�	EventDataA��I�oData1K�NameTargetProcessId
A��G�oData/K�NameTargetThreatId
A��E�oData-K�Name
DesiredAccess
A��?�oData'K�Name
ReturnCode
�IJ$JDJ$TargetProcessId$TargetThreatId DesiredAccessReturnCodeTEMP<<K�(�FG�\�\9����I���D�	EventDataA��?�oData'K�Name
DriverName
A��?�oData'K�Name
ReturnCode
dK�KDriverNameReturnCodeTEMP<xL�(�FG�\�\9����I���D�	EventDataA��?�oData'K�Name
DriverName
A��?�oData'K�Name
ReturnCode
�L�LDriverNameReturnCodeTEMPPTNNV���]ۏ�WD�{��HD�	EventDataA��G�oData/K�NameLinkSourceName
A��G�oData/K�NameLinkTargetName
A��E�oData-K�Name
DesiredAccess
A��?�oData'K�Name
ReturnCode
�N�N�NO$LinkSourceName$LinkTargetName DesiredAccessReturnCodePRVAh<OMicrosoft-Windows-Kernel-Audit-API-CallsOPCO01�Owin:InfoLEVL@P�O(win:InformationalTASKKEYWEVNT������C�O�O�����D�O�O�����L�O�O�����B�O�O����@F�O�O����H�O�O����`J�O�O�����K�O�OWEVT0x�QTR
�S�STPT\ThTCHAN\$R	�@R�ApplicationSystemTTBLLTEMP@@S-�v6R�^l/{/!�I���D�	EventDataA��5�oDataK�NameCVEID
A��M�oData5K�NameAdditionalDetails
hSxSCVEID(AdditionalDetailsPRVAL�SMicrosoft-Windows-Audit-CVEOPCO01Twin:InfoLEVL4P4Twin:WarningTASKKEYWEVNTp	�`R�S(TR@`R�S(TRWEVT� U
�UDVPV�V�V�VTTBL�TEMP��U?~�v|�Uj��]�4���^D�	EventDataA��=�oData%K�Name	ErrorCode
�UErrorCodePRVAXVMicrosoft-Windows-User-DiagnosticOPCOLEVL4PhVwin:WarningTASKKEYWEVNT@����,U\VWEVTh@(W
P[�[�[�[�[�[TTBL(TEMP��X�]@Zl�_k�3�8�2����D�	EventDataA��S�oData;K�NameHeapSnapshotInstance
A��S�oData;K�NameHeapSnapshotSequence
A��U�oData=K�NameHeapSnapshotBufferLen
A��O�oData7K�NameHeapSnapshotBuffer
8YhY�Y�Y0HeapSnapshotInstance0HeapSnapshotSequence0HeapSnapshotBufferLen,HeapSnapshotBufferTEMP\�Z�@�
D�WP�+��;����D�	EventDataA��S�oData;K�NameHeapSnapshotInstance
A��=�oData%K�Name	TotalData
[8[0HeapSnapshotInstanceTotalDataPRVATd[Microsoft-Windows-Heap-SnapshotOPCOLEVLTASKKEYWEVNTpd����4W������YWEVT��l	�\�]�^
0�����������CHAN��\m4]nhMicrosoft-Windows-Security-Mitigations/KernelModedMicrosoft-Windows-Security-Mitigations/UserModeMAPS�]�]VMAP4L^����VMAP,^���@RedirectionTrustPolicyTypeMap`SetContextIpValidationFailureContinueTypeMapTTBL�pTEMP�`c!�^��[��I���`���tD�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
	A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
Pdxd�d�d�d e

Xe�e�efPftf(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLine(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTimeTEMPh
�l�2�4��oQlW�����D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
	A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��[�oDataCK�NameChildImagePathNameLength
A��O�oData7K�NameChildImagePathName

A��W�oData?K�NameChildCommandLineLength
A��K�oData3K�NameChildCommandLine
�m n<ntn�n�n

o4oto�o�opPp�p�p�p(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLine(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime8ChildImagePathNameLength,ChildImagePathName4ChildCommandLineLength(ChildCommandLineTEMP4�u��O�	��X�s���Ɏ����D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��G�oData/K�NameTargetThreadId
A��W�oData?K�NameTargetThreadCreateTime
A��I�oData1K�NameImageNameLength
A��=�oData%K�Name	ImageName

w4wPw�w�w�w

�wxHx�x�x�xy,y(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection$TargetThreadId4TargetThreadCreateTime$ImageNameLengthImageNameTEMP`	�~kh�
��U�P�	Q���\D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��G�oData/K�NameTargetThreadId
A��W�oData?K�NameTargetThreadCreateTime
A��W�oData?K�NameRequiredSignatureLevel
A��G�oData/K�NameSignatureLevel

A��I�oData1K�NameImageNameLength
A��=�oData%K�Name	ImageName
�<�X�����Ԁ

�� �P�����܁�D�h���(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection$TargetThreadId4TargetThreadCreateTime4RequiredSignatureLevel$SignatureLevel$ImageNameLengthImageNameTEMPX��H@9�^
��M|6����D�	EventDataA��9�oData!K�NameSubcode
A��A�oData)K�NameProcessPath
A��=�oData%K�Name	ProcessId
A��G�oData/K�NameModuleFullPath
A��?�oData'K�Name
ModuleBase
A��E�oData-K�Name
ModuleAddress
A��?�oData'K�Name
MemAddress
A��M�oData5K�NameMemModuleFullPath
A��E�oData-K�Name
MemModuleBase
A��9�oData!K�NameAPIName
	A��K�oData3K�NameProcessStartTime
A��;�oData#K�NameThreadId
H�\�x�����Ї��4�T�h���SubcodeProcessPathProcessId$ModuleFullPathModuleBase ModuleAddressMemAddress(MemModuleFullPath MemModuleBaseAPIName(ProcessStartTimeThreadIdTEMP@|�&R��Tv)b�s�E���D�	EventDataA��9�oData!K�NameSubcode
A��A�oData)K�NameProcessPath
A��=�oData%K�Name	ProcessId
A��=�oData%K�Name	HookedAPI
A��E�oData-K�Name
ReturnAddress
A��E�oData-K�Name
CalledAddress
A��E�oData-K�Name
TargetAddress
A��C�oData+K�NameStackAddress
A��C�oData+K�NameFrameAddress
A��a�oDataIK�NameReturnAddressModuleFullPath
	A��K�oData3K�NameProcessStartTime
A��;�oData#K�NameThreadId
l�������̍��,�L�l���ЎSubcodeProcessPathProcessIdHookedAPI ReturnAddress CalledAddress TargetAddress StackAddress FrameAddress<ReturnAddressModuleFullPath(ProcessStartTimeThreadIdTEMP��T�.�߸S���Л����D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��[�oDataCK�NameControlPcImageNameLength
A��O�oData7K�NameControlPcImageName
A��_�oDataGK�NameRspContentsImageNameLength
A��S�oData;K�NameRspContentsImageName

�D�`���ĕܕ

�(�X�����
��$�`�(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection8ControlPcImageNameLength,ControlPcImageName<RspContentsImageNameLength0RspContentsImageNameTEMP 	��TA*�WVԳ������.D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��[�oDataCK�NameControlPcImageNameLength
A��O�oData7K�NameControlPcImageName
A��_�oDataGK�NameRspContentsImageNameLength
A��S�oData;K�NameRspContentsImageName

A��?�oData'K�Name
StrictMode

 �H�d���Ȟ�

�,�\���ğ
��(�d�

��(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection8ControlPcImageNameLength,ControlPcImageName<RspContentsImageNameLength0RspContentsImageNameStrictModeTEMP

T��2�q��\*n�kj8׃��pD�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	�D�`���ĥܥ

�(�X���(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtectionTEMP<��Ai�ui�S�xH�n^���D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��Y�oDataAK�NameTargetIpImageNameLength
A��M�oData5K�NameTargetIpImageName
A��?�oData'K�Name
StrictMode

A��C�oData+K�NameContinueType

����<�h���

��̭��<�d�
��

���]ܮ(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection4TargetIpImageNameLength(TargetIpImageNameStrictMode ContinueTypeTEMP0	l����W��Q��~�0���<D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��U�oData=K�NameMappedImageNameLength
A��I�oData1K�NameMappedImageName
A��]�oDataEK�NameImageCetShadowStacksReady

A��i�oDataQK�NameImageEHContinuationTablePresent


A��E�oData-K�Name
NonEhcontMode

����ܵ�@�X�

����Զ�<�
l�

��

ȷ

�(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection0MappedImageNameLength$MappedImageName8ImageCetShadowStacksReadyDImageEHContinuationTablePresent NonEhcontModeTEMP..�����kgW�Q�(�
ozS���
D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��I�oData1K�NameRedirectionType
A��Q�oData9K�NameOperationPathLength
A��E�oData-K�Name
OperationPath
A��E�oData-K�Name
Impersonating


A��9�oData!K�NameModule1
A��E�oData-K�Name
Module1Offset

A��9�oData!K�NameModule2
A��E�oData-K�Name
Module2Offset

A��9�oData!K�NameModule3
A��E�oData-K�Name
Module3Offset

A��9�oData!K�NameModule4
A��E�oData-K�Name
Module4Offset

A��9�oData!K�NameModule5
A��E�oData-K�Name
Module5Offset

A��9�oData!K�NameModule6
A��E�oData-K�Name
Module6Offset

A��9�oData!K�NameModule7
A��E�oData-K�Name
Module7Offset

A��9�oData!K�NameModule8
A��E�oData-K�Name
Module8Offset

A��9�oData!K�NameModule9
A��E�oData-K�Name
Module9Offset

A��;�oData#K�NameModule10
 A��G�oData/K�NameModule10Offset
!
A��;�oData#K�NameModule11
"A��G�oData/K�NameModule11Offset
#
A��;�oData#K�NameModule12
$A��G�oData/K�NameModule12Offset
%
A��;�oData#K�NameModule13
&A��G�oData/K�NameModule13Offset
'
A��;�oData#K�NameModule14
(A��G�oData/K�NameModule14Offset
)
A��;�oData#K�NameModule15
*A��G�oData/K�NameModule15Offset
+
A��;�oData#K�NameModule16
,A��G�oData/K�NameModule16Offset
-
�������,�D�

l�������](�L�x�

����

����

� �

4�T�

h���

����

����

�$�

8�X�

l���

����

���

�@�

X�|�

����

����

�(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection$RedirectionType,OperationPathLength OperationPath ImpersonatingModule1 Module1OffsetModule2 Module2OffsetModule3 Module3OffsetModule4 Module4OffsetModule5 Module5OffsetModule6 Module6OffsetModule7 Module7OffsetModule8 Module8OffsetModule9 Module9OffsetModule10$Module10OffsetModule11$Module11OffsetModule12$Module12OffsetModule13$Module13OffsetModule14$Module14OffsetModule15$Module15OffsetModule16$Module16OffsetPRVAdD�Microsoft-Windows-Security-MitigationsOPCOLEVLXP��P��win:Errorwin:WarningTASK�����������@����������������������������`�������	���� �
����|������������
����`�����������t�����������8�`KERNEL_MITIGATION_TASK_PROHIBIT_DYNAMIC_CODEtKERNEL_MITIGATION_TASK_PROHIBIT_CHILD_PROCESS_CREATIONhKERNEL_MITIGATION_TASK_PROHIBIT_REMOTE_IMAGE_MAPdKERNEL_MITIGATION_TASK_PROHIBIT_LOWIL_IMAGE_MAPlKERNEL_MITIGATION_TASK_PROHIBIT_WIN32K_SYSTEM_CALLStKERNEL_MITIGATION_TASK_PROHIBIT_NON_MICROSOFT_BINARIES\USER_MITIGATION_TASK_EXPORT_ADDRESS_FILTERdUSER_MITIGATION_TASK_EXPORT_ADDRESS_FILTER_PLUS\USER_MITIGATION_TASK_IMPORT_ADDRESS_FILTERLUSER_MITIGATION_TASK_ROP_STACKPIVOTPUSER_MITIGATION_TASK_ROP_CALLERCHECKHUSER_MITIGATION_TASK_ROP_SIMEXEC�KERNEL_MITIGATION_TASK_CONTROL_PROTECTION_USER_MODE_RETURN_MISMATCH�KERNEL_MITIGATION_TASK_USER_CET_SET_CONTEXT_IP_VALIDATION_FAILURE`KERNEL_MITIGATION_TASK_BLOCK_NON_CET_BINARIESdKERNEL_MITIGATION_TASK_REDIRECTION_TRUST_POLICYlKERNEL_MITIGATION_TASK_PROHIBIT_FSCTL_SYSTEM_CALLSKEYWEVNT0&�o�^��\�p�^����\�q�f ��\�r�f�� ��\�sqX��\�tq��X��\�u�^<��\�v�^��<��\	�w�^t��\
�x�^��t��\�yDy���\�zDy�����\
@{�����\@|�������\@{�����\@|�������\	@}�����\	@~�������\
@����\
@�������\@����\@�������\@��8��\@�����8��\
�����T��\
������T��\
�����T��\
������T��\������p��\������p��\������p��\������p��\���������\���������\��,������\ ��,������\!���^���\"���^�����\WEVT��0���
�b c,clcxg�uCHAN�L�����dMicrosoft-Windows-Threat-Intelligence/AnalyticTTBL�TEMP����@���%NX�{�{z����D�	EventDataA��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
A��Y�oDataAK�NameTargetProcessCreateTime
	A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel
A��Y�oDataAK�NameTargetProcessProtection

A��M�oData5K�NameOriginalProcessId
A��]�oDataEK�NameOriginalProcessCreateTime
A��Y�oDataAK�NameOriginalProcessStartKey

A��e�oDataMK�NameOriginalProcessSignatureLevel
A��s�oData[K�Name$OriginalProcessSectionSignatureLevel
A��]�oDataEK�NameOriginalProcessProtection
A��A�oData)K�NameBaseAddress
A��?�oData'K�Name
RegionSize
A��G�oData/K�NameAllocationType
A��G�oData/K�NameProtectionMask
����

(�\����� �D�x���

���<�������

�P������4�P�t�(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtection(OriginalProcessId8OriginalProcessCreateTime4OriginalProcessStartKey@OriginalProcessSignatureLevelPOriginalProcessSectionSignatureLevel8OriginalProcessProtectionBaseAddressRegionSize$AllocationType$ProtectionMaskTEMP���vPɡ$BS�-�Ա����D�	EventDataA��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
A��Y�oDataAK�NameTargetProcessCreateTime
	A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel
A��Y�oDataAK�NameTargetProcessProtection

A��M�oData5K�NameOriginalProcessId
A��]�oDataEK�NameOriginalProcessCreateTime
A��Y�oDataAK�NameOriginalProcessStartKey

A��e�oDataMK�NameOriginalProcessSignatureLevel
A��s�oData[K�Name$OriginalProcessSectionSignatureLevel
A��]�oDataEK�NameOriginalProcessProtection
A��A�oData)K�NameBaseAddress
A��?�oData'K�Name
RegionSize
A��G�oData/K�NameProtectionMask
A��O�oData7K�NameLastProtectionMask
���

�@�����(�\���

��� �l����

�4�t����4X(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtection(OriginalProcessId8OriginalProcessCreateTime4OriginalProcessStartKey@OriginalProcessSignatureLevelPOriginalProcessSectionSignatureLevel8OriginalProcessProtectionBaseAddressRegionSize$ProtectionMask,LastProtectionMaskTEMP�H��Wf�U�
%�X|����D�	EventDataA��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
A��Y�oDataAK�NameTargetProcessCreateTime
	A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel
A��Y�oDataAK�NameTargetProcessProtection

A��A�oData)K�NameBaseAddress
A��;�oData#K�NameViewSize
A��G�oData/K�NameAllocationType
A��G�oData/K�NameProtectionMask
��

	D	�	�	
,
`
�


�
�
$p����(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtectionBaseAddressViewSize$AllocationType$ProtectionMaskTEMP�**���AoXU�]�:�3���D�	EventDataA��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
A��Y�oDataAK�NameTargetProcessCreateTime
	A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel
A��Y�oDataAK�NameTargetProcessProtection

A��G�oData/K�NameTargetThreadId
A��W�oData?K�NameTargetThreadCreateTime
A��M�oData5K�NameOriginalProcessId
A��]�oDataEK�NameOriginalProcessCreateTime
A��Y�oDataAK�NameOriginalProcessStartKey

A��e�oDataMK�NameOriginalProcessSignatureLevel
A��s�oData[K�Name$OriginalProcessSectionSignatureLevel
A��]�oDataEK�NameOriginalProcessProtection
A��U�oData=K�NameTargetThreadAlertable
A��?�oData'K�Name
ApcRoutine
A��C�oData+K�NameApcArgument1
A��C�oData+K�NameApcArgument2
A��C�oData+K�NameApcArgument3
A��E�oData-K�Name
RealEventTime
A��[�oDataCK�NameApcRoutineVadQueryResult
A��a�oDataIK�NameApcRoutineVadAllocationBase
A��g�oDataOK�NameApcRoutineVadAllocationProtect
A��Y�oDataAK�NameApcRoutineVadRegionType
A��Y�oDataAK�NameApcRoutineVadRegionSize
 A��Y�oDataAK�NameApcRoutineVadCommitSize
!A��S�oData;K�NameApcRoutineVadMmfName
"A��_�oDataGK�NameApcArgument1VadQueryResult
#A��e�oDataMK�NameApcArgument1VadAllocationBase
$A��k�oDataSK�Name ApcArgument1VadAllocationProtect
%A��]�oDataEK�NameApcArgument1VadRegionType
&A��]�oDataEK�NameApcArgument1VadRegionSize
'A��]�oDataEK�NameApcArgument1VadCommitSize
(A��W�oData?K�NameApcArgument1VadMmfName
)`�

��4 � � � !4!

h!�!�! "T"x"�"�"

#@#�#�#$8$T$t$�$�$�$%H%�%�%�%(&X&�&�&'T'�'�'(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtection$TargetThreadId4TargetThreadCreateTime(OriginalProcessId8OriginalProcessCreateTime4OriginalProcessStartKey@OriginalProcessSignatureLevelPOriginalProcessSectionSignatureLevel8OriginalProcessProtection0TargetThreadAlertableApcRoutine ApcArgument1 ApcArgument2 ApcArgument3 RealEventTime8ApcRoutineVadQueryResult<ApcRoutineVadAllocationBaseDApcRoutineVadAllocationProtect4ApcRoutineVadRegionType4ApcRoutineVadRegionSize4ApcRoutineVadCommitSize0ApcRoutineVadMmfName<ApcArgument1VadQueryResult@ApcArgument1VadAllocationBaseHApcArgument1VadAllocationProtect8ApcArgument1VadRegionType8ApcArgument1VadRegionSize8ApcArgument1VadCommitSize4ApcArgument1VadMmfNameTEMPx&&4	�a�' �TH�SUZ'����D�	EventDataA��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
A��Y�oDataAK�NameTargetProcessCreateTime
	A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel
A��Y�oDataAK�NameTargetProcessProtection

A��G�oData/K�NameTargetThreadId
A��W�oData?K�NameTargetThreadCreateTime
A��C�oData+K�NameContextFlags
A��A�oData)K�NameContextMask
A��/�oDataK�NamePc
A��/�oDataK�NameSp
A��/�oDataK�NameLr
A��/�oDataK�NameFp
A��3�oDataK�NameReg0
A��3�oDataK�NameReg1
A��3�oDataK�NameReg2
A��3�oDataK�NameReg3
A��3�oDataK�NameReg4
A��3�oDataK�NameReg5
A��3�oDataK�NameReg6
A��3�oDataK�NameReg7
A��E�oData-K�Name
RealEventTime
A��K�oData3K�NamePcVadQueryResult
A��Q�oData9K�NamePcVadAllocationBase
 A��W�oData?K�NamePcVadAllocationProtect
!A��I�oData1K�NamePcVadRegionType
"A��I�oData1K�NamePcVadRegionSize
#A��I�oData1K�NamePcVadCommitSize
$A��C�oData+K�NamePcVadMmfName
%7,7

d7�7�7$8\8�8�8�8

9<9x9�9�9:P:p:�:�:�:�:�:�:�:�:�:;;,;<;\;�;�;�;<,<P<(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtection$TargetThreadId4TargetThreadCreateTime ContextFlagsContextMaskPcSpLrFpReg0Reg1Reg2Reg3Reg4Reg5Reg6Reg7 RealEventTime(PcVadQueryResult,PcVadAllocationBase4PcVadAllocationProtect$PcVadRegionType$PcVadRegionSize$PcVadCommitSize PcVadMmfNameTEMP$�BRӹ���Z8&1�dYJ��JD�	EventDataA��I�oData1K�NameOperationStatus
A��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
	A��Y�oDataAK�NameTargetProcessCreateTime
A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel

A��Y�oDataAK�NameTargetProcessProtection
A��A�oData)K�NameBaseAddress
A��A�oData)K�NameBytesCopied
DDhD�D

�D�D<E�E�E�EF<F

pF�F�F(G\GxG$OperationStatus(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtectionBaseAddressBytesCopiedTEMP`0N�&�-.�+U���~	��fD�	EventDataA��I�oData1K�NameOperationStatus
A��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
	A��Y�oDataAK�NameTargetProcessCreateTime
A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel

A��Y�oDataAK�NameTargetProcessProtection
A��G�oData/K�NameTargetThreadId
A��W�oData?K�NameTargetThreadCreateTime
�O�O�O

P<P|P�PQ$QXQ|Q

�Q�QRhR�R�R$OperationStatus(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtection$TargetThreadId4TargetThreadCreateTimeTEMP4
�XƜڙs�T��9��O���D�	EventDataA��I�oData1K�NameOperationStatus
A��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
	A��Y�oDataAK�NameTargetProcessCreateTime
A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel

A��Y�oDataAK�NameTargetProcessProtection
Z4Z\Z

�Z�Z[T[�[�[�[\

<\l\�\�\$OperationStatus(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtectionTEMP�h^��:*ޠ3W����W��
D�	EventDataA��K�oData3K�NameDriverNameLength
A��?�oData'K�Name
DriverName
A��Q�oData9K�NameCodeIntegrityOption
�^�^�^(DriverNameLengthDriverName,CodeIntegrityOptionTEMPT�_0f���S*Y>Б�����D�	EventDataA��K�oData3K�NameDriverNameLength
A��?�oData'K�Name
DriverName
$`L`(DriverNameLengthDriverNameTEMPX�a��Ey{BP�xaW�^���JD�	EventDataA��K�oData3K�NameDriverNameLength
A��?�oData'K�Name
DriverName
A��K�oData3K�NameDeviceNameLength
A��?�oData'K�Name
DeviceName
8b`b|b�b(DriverNameLengthDriverName(DeviceNameLengthDeviceNamePRVA`�bMicrosoft-Windows-Threat-IntelligenceOPCOLEVL@PDc(win:InformationalTASK
�����d�����d����e����Te�����e�����e����4f����tf	�����f
����,g@KERNEL_THREATINT_TASK_ALLOCVMDKERNEL_THREATINT_TASK_PROTECTVM@KERNEL_THREATINT_TASK_MAPVIEWLKERNEL_THREATINT_TASK_QUEUEUSERAPCTKERNEL_THREATINT_TASK_SETTHREADCONTEXT@KERNEL_THREATINT_TASK_READVM@KERNEL_THREATINT_TASK_WRITEVM\KERNEL_THREATINT_TASK_SUSPENDRESUME_THREAD\KERNEL_THREATINT_TASK_SUSPENDRESUME_PROCESSLKERNEL_THREATINT_TASK_DRIVER_DEVICEKEYW$ �����i�����i����Hj�����j����k ����dk@�����k�����0l�����l�����l����hm�����m����,n �����n@����o�����po�����o����Dp�����p�����p����@q �����q@�����q�����@r�����r�����r����8s�����s�����s ����tt@�����t�����HuTKERNEL_THREATINT_KEYWORD_ALLOCVM_LOCALpKERNEL_THREATINT_KEYWORD_ALLOCVM_LOCAL_KERNEL_CALLERTKERNEL_THREATINT_KEYWORD_ALLOCVM_REMOTEpKERNEL_THREATINT_KEYWORD_ALLOCVM_REMOTE_KERNEL_CALLERXKERNEL_THREATINT_KEYWORD_PROTECTVM_LOCALtKERNEL_THREATINT_KEYWORD_PROTECTVM_LOCAL_KERNEL_CALLERXKERNEL_THREATINT_KEYWORD_PROTECTVM_REMOTEtKERNEL_THREATINT_KEYWORD_PROTECTVM_REMOTE_KERNEL_CALLERTKERNEL_THREATINT_KEYWORD_MAPVIEW_LOCALpKERNEL_THREATINT_KEYWORD_MAPVIEW_LOCAL_KERNEL_CALLERTKERNEL_THREATINT_KEYWORD_MAPVIEW_REMOTEpKERNEL_THREATINT_KEYWORD_MAPVIEW_REMOTE_KERNEL_CALLER`KERNEL_THREATINT_KEYWORD_QUEUEUSERAPC_REMOTE|KERNEL_THREATINT_KEYWORD_QUEUEUSERAPC_REMOTE_KERNEL_CALLERhKERNEL_THREATINT_KEYWORD_SETTHREADCONTEXT_REMOTE�KERNEL_THREATINT_KEYWORD_SETTHREADCONTEXT_REMOTE_KERNEL_CALLERPKERNEL_THREATINT_KEYWORD_READVM_LOCALTKERNEL_THREATINT_KEYWORD_READVM_REMOTETKERNEL_THREATINT_KEYWORD_WRITEVM_LOCALTKERNEL_THREATINT_KEYWORD_WRITEVM_REMOTETKERNEL_THREATINT_KEYWORD_SUSPEND_THREADTKERNEL_THREATINT_KEYWORD_RESUME_THREADXKERNEL_THREATINT_KEYWORD_SUSPEND_PROCESSTKERNEL_THREATINT_KEYWORD_RESUME_PROCESSTKERNEL_THREATINT_KEYWORD_FREEZE_PROCESSPKERNEL_THREATINT_KEYWORD_THAW_PROCESSTKERNEL_THREATINT_KEYWORD_CONTEXT_PARSEpKERNEL_THREATINT_KEYWORD_EXECUTION_ADDRESS_VAD_PROBExKERNEL_THREATINT_KEYWORD_EXECUTION_ADDRESS_MMF_NAME_PROBE�KERNEL_THREATINT_KEYWORD_READWRITEVM_NO_SIGNATURE_RESTRICTIONTKERNEL_THREATINT_KEYWORD_DRIVER_EVENTSTKERNEL_THREATINT_KEYWORD_DEVICE_EVENTSEVNT(�������8cxcP{<�@�������8c�cT{<�������8c�cX{<������ 8c�c\{<�@������'8c�c`{<��������8cxcd{<��������8c�ch{<�������8c�cl{<������p<8cdp{<������p<8c dt{<�
�����p<8cdx{<������p<8c d|{<�������G8c<d�{<� ������G8c<d�{<�	@������R8cXd�{<�	�������R8cXd�{<�	������R8cXd�{<�	������R8cXd�{<��������8cxc�{<���������8c�c�{<�������8c�c�{<� ����� 8c�c�{<��������'8c�c�{<��������8cxc�{<� �������8c�c�{<�������8c�c�{<�
@�����(]8ctd�{<�
@�����_8ctd�{<�
������h`8ctd�{<� 
������h`8ctd�{<��g�g$hDhdh�g�gh�h�h�h�h�h�h�h�hii�g�g4hThth�g�ghdidititi���4"(��T�)&-�I��[�PO .�ĀV9m	?��*����WEVT_TEMPLATEMUIMUIen-US�%0�%�	*�H��
��%�0�%�10
	`�He0\
+�7�N0L0
+�70	���010
	`�He E`kMou&(��J�Z��@$��k�zq��
�0�	0��3�>�"�4���0
	*�H��
0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20110
240912200406Z
250911200406Z0p10	UUS10U
Washington10URedmond10U
Microsoft Corporation10UMicrosoft Windows0�"0
	*�H��
�0�
���a��ya�q�k�o�{��pV���Q���8�i|<5�e�@��^�'�(ْ�.��g�aa`�n!7c,�i���ע�8�K��� }�hZ�����$��hE��@�*�Iƣ���
����o����2�,�����A�ա�����x����֤	N�P��U~�NI�t�3�I��х&Aw��Kk�������i��_hhe�u���v�J�ͷ���_x�|�<-�}-}}HU��[���r��$����0��0U%0
+�7
+0Ul�y�������%��޾����0TUM0K�I0G1-0+U$Microsoft Ireland Operations Limited10U
229879+5029620U#0��)9�ėx͐��O��|U�S0WUP0N0L�J�H�Fhttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl%200a+U0S0Q+0�Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0U�00
	*�H��
�e���b�]g��Q��ưr�����!:�MPFa={�
�g��=v{�*+4�5�t]A��r'�+�h��ͤ�`-�TOfT���X��*�Yq�Q[�]�{vC#�%�`�}��_Vv0�b+���K�.Y*B!�ě��Ig6�'�:�rɜ������X����*"�.8�I�ry�cӾ'��������A��G_oe�*\n�;_���'��P_[�ֻE�#u��oڠbۯ��:͡#puyϬ�u�5=o�0��0���
avV0
	*�H��
0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100
111019184142Z
261019185142Z0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20110�"0
	*�H��
�0�
�����.	����i�!�i33��T����� ��ҋ�8����-|by��J?5 p���k�6u�1ݍp��7�tF�([�`#,��G�g�Q'�r��ɹ;S5|���'�����#	o�F��n�<A�ˣ?]jM�i%(\6��C
��������['�'x0�[*	k"�S`,�hS��I�a��h	sD]}�T+�y��5]l+\μ�#�on�&�6�O�'��2;A�,���w�TN�\�e�C���mw�Z$�H��C0�?0	+�70U�)9�ėx͐��O��|U�S0	+�7
SubCA0U�0U�0�0U#0��Vˏ�\bh�=��[�Κ�0VUO0M0K�I�G�Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0�>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
	*�H��
��|qQ�y�n��9>�<Rn+?s��h�H�4M��&�1F�ay�8.Ek��(�����	��L
6fj���������@26v�Zƿ���Ӭ�h�b��TlP0X��|���N���|�sW�R!s4Z�V��	����~�����?�rS��c��=1e�������=����BА�_T���G�o�sNA�@�_�*��s�!(���s9_>�\`����	���Q�fG���=�*hw��Lb{��Ǻz�4Kbz����J7�-�W|�=ܸZ��ij�:��n�i!7ށ�ugӓW^)9��-���Es[���z��FX�^���g�l5��?$�5�
u�V��x,��Ј���ߺ~,c��#!�xl�X6+�̤��-����@�E�Ί\k>��p*
j�_G��c
2��6*pZ�BYqKW�~���!<��Ź���E��� ����ŕ�]b֠c �uw}=�E�����W�o3��w�bY~1�E0�A0��0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20113�>�"�4���0
	`�He���0	*�H��
	1
+�70
+�710
+�70/	*�H��
	1" ;Z���1����iFt4��N���� �0Z
+�71L0J�$�"Microsoft Windows�"� http://www.microsoft.com/windows0
	*�H��
����{
m�xmv����Cg�`�L�F�_G.Y�7����o_>�a�_�*:;�U�ܦ¾l�Ղ�H����)��׾�\2��[�
l��Y�H�>��)9�&����RI;A��M_�WO���[��P.x��Uѫ�M�Bc��ĥ;�+�v�+㥹ec��9{������֑�d�iH��+�Ta‘M2�����ي�&�_Q�k4k*���<B��;v蠗����=�KR7�[���Ե�>���a73��"���ơ��0��
+�71��0��	*�H��
���0��10
	`�He0�Z*�H��
	��I�E0�A
+�Y
010
	`�He b�̸H��(��>Y0��D�N���+ٴ\g�g�#G~20250406211403.857Z0��٤��0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1-0+U$Microsoft Ireland Operations Limited1'0%UnShield TSS ESN:4C1A-05E0-D9471%0#UMicrosoft Time-Stamp Service���0�(0��3�8|��e֡�0
	*�H��
0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100
240725183119Z
251022183119Z0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1-0+U$Microsoft Ireland Operations Limited1'0%UnShield TSS ESN:4C1A-05E0-D9471%0#UMicrosoft Time-Stamp Service0�"0
	*�H��
�0�
���Ґ{n?��� �%y�%c؂OfLg�ޜЦ̫D�DY˜�u���>S�B�D^���P5;A�){i���n"J��Q.
�!a\�0�۽	
���^�٪���<ad��]�I@�0U�|F�$�9������_D~l0'����q�i���L�	?+HwmD����C��)d(���� [���*6���!d8y?w�����}��B��|�na�%Ɨ�S��@�l��>��'Q�%��p׫l��H@ʓ{�Ժ��6���!ʐm{�p2����w|�k������/��Whe�F��aR�=	�"�&l�m��JO9w�'�X��F�uH�ѝ��h:�]ܩ���ЧL4p�.�δk�CԞ�@�	9��i�"�k�WƱ�T�t'���pW�[�~p���n�Y�.A�E����,10o�@�-��o�C~h�H����i�	�_�_�
!�X��5��L�<_[5����3.=��L�YS�K۔����rވ����9'��I0�E0U����w�?�;�}0��a0U#0���]^b]����e�S5�r0_UX0V0T�R�P�Nhttp://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l+`0^0\+0�Phttp://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0U�00U%�0
+0U��0
	*�H��
�9#M��K�+��κ~���H]k2�.i�fO~ <-�3L̹ba�����H��b�x�YH������Á����t7��`ˎ�Z����OؓG����:'�}��9?�~�%	����\ڻ�Hء�N��TTt��ig�>3�if:�;�=ɕ�Ʀ͓
�8���5o��h�fa�uou%�]r^��P����
���(��]��=E��$�_:�^׍^h(%f��<\��^��s���L=��P^�ڵ���7�uю"SI�"G�G2�r��`�G
�C��v���QkB���I�#,p�<����+?�͸���9�ݧ#����wF���8��D)W�)�c
�ֆv�C��Z�EF��j�I���ܭ��Xa�J����]"�:�c�&[P_�e�U��Qe��"�F��.?7~KF�7p7]N��ע�?!cR'�n�Y����7���S�m='Oy9��t�"��c���e5Iv���R?{|�f��+mn���mE��N�Ő�0�q0�Y�3��k��I�0
	*�H��
0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100
210930182225Z
300930183225Z0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100�"0
	*�H��
�0�
���L�r!y���$y�Ղ��ҩlNu��5W�lJ�⽹>`3�\O�f��SqZ�~JZ��6g�F#���w2��`}jR�D���Fk��v��P�D�q\Q17�
8n����&S|9azĪ�ri����6�5&dژ;�{3��[~��R���b%�j�]�S���VM�ݼ��㑏�9,Q��pi
�6-p�1�5(�㴇$��ɏ~�T��U�mh;�F��z)7���E�Fn�2��0\O,�b�͹⍈䖬J��q�[g`���=� �s}A�Fu��_4���� }~�ٞE߶r/�}_��۪~6�6L�+n�Q���s�M7t�4���G��|?Lۯ^����s=CN�39L��Bh.�QF�ѽjZas�g�^�(v�3rק ��
�co�6d�[���!]_0t���عP��a�65�G������k�\RQ]�%��Pzl�r�Rą��<�7�?x�E���^ڏ�riƮ{��>j�.����0��0	+�70#	+�7*�R�dĚ���<F5)��/�0U��]^b]����e�S5�r0\U U0S0Q+�7L�}0A0?+3http://www.microsoft.com/pkiops/Docs/Repository.htm0U%0
+0	+�7
SubCA0U�0U�0�0U#0��Vˏ�\bh�=��[�Κ�0VUO0M0K�I�G�Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0�>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
	*�H��
��U}�*��,g1$[�rK��o�\�>NGdx���=13�9��q6?�dl|�u9m�1��lѡ�"��fg:SMݘ��x�6.���V����i�	�{�jo�)�n�?Hu��m��m#T�xSu$W�ݟ�=��h�e��V����(U'�$�@���]='�@�8���)�ü�T�B�������j�BRu�6��as.,k{n?,	x鑲�[�I�t�쑀�=�J>f;O���2ٖ����t��Lro�u0�4�z�P�
X�@<�Tm�ctH,�NG-�q�d�$�smʎ	��WITd�s�[D�Z�k
��(�g($�8K�n�!TkjEG����^O���Lv�WT	�iD~|�als�
��Af=i��AI~~���;����>�1Q������{��p���(��6ںL���
�4�$5g+�
�挙��"��'B=%��tt[jў>�~�13}���{�8pDѐ�ȫ:�:b�pcSM��m��qj�U3X��pf�Y0�A0���٤��0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1-0+U$Microsoft Ireland Operations Limited1'0%UnShield TSS ESN:4C1A-05E0-D9471%0#UMicrosoft Time-Stamp Service�#
0+��lļ%�%rs��D�Ų����0���~0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100
	*�H��
��0"20250406114417Z20250407114417Z0w0=
+�Y
1/0-0
��0
�0�0
�906
+�Y
1(0&0
+�Y
�
0� �
0��0
	*�H��
�rSO�fAf�;�饸�]�rc�+�#��r�}���9�h��F^�aZ�e�2�X'p,�p@�D�}�W��i�f͜�;�ڝ�#+����M=b��`�I�͟:�笩���	�u/Ӻ��7�@�-g����t=sվ�о���4��%�K'�=�P���ۭ��1ؽ�(�/�f�;>c����C���w|Z�N��e��L����=w��1�!Я�lu�O| �������ڌb�����a+q�e�u�+ȼ���s�1�
0�	0��0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103�8|��e֡�0
	`�He��J0	*�H��
	1
*�H��
	0/	*�H��
	1" BxӌUi��ۡ>�(�iA	�����g�d0��*�H��
	/1��0��0��0�� �2��wi��"���;$یiS�ޠ�HE|����0��0���~0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103�8|��e֡�0" 2n�'�O`�q�+��v@@�]')4����?f�-0
	*�H��
�a���
�,�6�mT��Y�6�E[�a�5����x�!�l�_��hV(wXK�y�{�6�o?��:h\�+[ZH�y;��o�$���Cx��j=f�@Q�Ӷ�ıv�qz�K@&y��ϋ0L!��͸w ��j@�B͉C����?�iG���b�XxVX�!V&p�<�MG1>h�{��Bo�?�y�����\B��d8�7��sӜ5r"����3tvׇ��`�ܩ�,�L.�9-�*�ڝ��|���D�<�e��0՗Oyf+�VioJ^t�A�$o�N˗O���c	9��F��{�S;%b�
���Ͳ�S�q����[[ n$X�p}��S���teS�Y5�@s��az�}	ѼI�ZW�V㪍h|��c�c
�b?q|�C�/~:�"2C�u��H^��T1ZЭ�)7����>~�p{�����(MU�ٶ������N���+<���=3
�x����!��������ҹ�
��@���
�2M2���