HEX
Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1j PHP/8.4.25
System: Windows NT DESKTOP-4TAV2RJ 10.0 build 19045 (Windows 10) AMD64
User: fred (0)
PHP: 8.4.25
Disabled: NONE
Upload Files
File: C:/ProgramData/Microsoft/Windows Defender/Platform/4.18.26080.3-0/ar-SA/DefenderDiag.dll.mui
MZ����@���	�!�L�!This program cannot be run in DOS mode.

$�;=ߍZS��ZS��ZS�Ӭ��ZS��Q��ZS�Rich�ZS�PEd�'}@0�" ,���$` $��(8.rdata�@@.rsrc� �@@'}@0
lPP'}@0$����8.rdata8.rdata$voltmdP�.rdata$zzzdbg .rsrc$01(�.rsrc$02 u�Z|#�.�<i������ز�'�'}@0��0�H�������%�������(�?@�EX�Fp�G��H��L��R��S��~���0��H��`��x�9��x�������������� ��8��P��h����������������3��4�r(�@�X�p�������� 0@P`p�������� 0@P`p��������'���(J��)v�t+��X-R��.���0��,1d��1H��3��6���9���<6�?���@&�Ot
��\b��`n�dev��j��|p4��q��Dx��,{h�����$���������
���T�����t�l���T��� �8�X��d�v����������(	��MUI���S��E
"��ƚa��ֶ��n���������MUIar-SAGF'DE J*E 'D9+H1 9DI #J E4'CD.D' **HA1 E9DHE'* *A5JDJ).
(J'F'* 'D/9E:
E3*HI 'D*#+J1'D(-+'D*H5J)'DE1',9	'DED'-8'*'DA&)'D*-DJD.7#*-0J1E9DHE'*J*(/JD 'D*FBDPA%*B1J1 'D*-DJD'* 'D*4.J5J) D@ Defender	F81) 9'E)'*5'D'* 'D4(C)'D*H2J9'D%D-'B'D5-)UpToDate
E4CD'* 'D#/'!E4CD'* 'D*CHJFA1FC	'D*9DJE'*ASR:J1 B'(D DD*7(JB:J1 'DECHQF%1 3'9'*JHEJK'PA'D#-/'D%+FJF'D+D'+'!'D#1(9'!'D.EJ3'D,E9)'D3(*#(/'K'.*('1'* '*5'D'* 'D4(C)'.*('1'* F41 MDE'.*('1'* %D-'B MDE'.*('1'* -'D) EJ2'* MDE'.*('1'* MDE 'DE-/+)'.*('1'* 'D#/'!'.*('1'* 'D*CHJF-'.*('1'* CFA ('DH5HD 'DE*-CE (G %DI 'DE,D/'*)!'.*('1'* ASR (*BDJD E3'-) 'DG,HE)EO97QD)-81*/BJB	:J1 E*HA1F9ED'./E) %1 :J1 EH,H/)
:J1 E*HA1)  -'D) :J1 E91HA)9EDJ)EDABJ/ 'D*4:JDE*HBAE*HBA E$B*'K
'D(/! E9DBPA'D%JB'A E9DB'DE*'(9) E9DB)'D%JB'A 'DE$B* E9DB	:J1 E91HA*EGJ/'DF8'E*DB'&JJ/HJEO97QD9'/J'DH69 :J1 'D'3*('BJ'DH69 :J1 'D'3*('BJ SxS:H69 -81 'DC4A 'D*DB'&J H'D'3*,'() 9DI 'DFB7 'DFG'&J) (EDR)H69 'D*/BJB :J1 'D'3*('BJBJ/ 'D%JB'APA'DF*'&,'DF*'&,3'FB1 AHB '1*('7 'D*-DJD DD'7D'9 9DI *A'5JD 'DF*'&,.PAE9DHE'* 'D,G'2E9DHE'* 'D,G'2VMNameVMSize
VMLocationSubscriptionId
ResourceGroupVmId	OSVersion9// 'D0'C1'* 'D#3'3J)9// 'DE9'D,'* 'DEF7BJ)E$41'* 'D*1'(7 DCD BD('D0'C1) 'DA9DJ)EHB9 EDA 'D5A-)'D'3*./'E 'D-'DJ D PageFile'D-,E 'D#3'3J 'DE.55 D PageFile#B5I '3*./'E DEDA *1-JD 'D5A-'**E 'D'F6E'E %DI 'DE,'D*E 6E Azure ADEF6E %DI E3'-) 'D9EDE91A ,G'2 Azure AD-'D) 'D*3,JD(FJ) F8'E 'D*4:JDHB* *4:JD 'DF8'EHCJD WinHTTP 9DI E3*HI 'DF8'E*E *3,JD 'D,G'2 AJ AAD H MEM$'D,G'2 :J1 E3,D HDE J*E *3,JDG E7DB' **E %/'1) 'D,G'2 (H'37) HCJD MDM!**E %/'1) 'D,G'2 (H'37) HCJD SCCM+E4CD) AJ *CHJF %/'1) FB'7 'DFG'J) Microsoft.7# 9'EE4CD) AJ 'D'*5'D#C'F 'D,G'2 E3,D'K HGH 'D"F :J1 E3,D'D,G'2 E9DB (/HF *3,JDA4D *9JJF 'DFG,PAA4D *B1J1 'DFG,A4D 'D'F6E'E 'DE.*D7 'D9'E9/E *7'(B 'DE3*#,1.7# E.*D7 - FB7) '*5'D 'D./E)	.7# 4G'/)*CHJF AAD Connect (4CD .'7&.7# DNSE4CD) AJ E2'EF) 'D3'9)MDE H ConfigMgrE-'HD) *3,JD 'D/.HD 'D#.J1)F,'- *3,JD 'D/.HD 'D#.J1%".1 *-EJD F',- D(J'F'* **(9 'D'3*./'E2SupportedUris D-E'J) 'D4(C) (*'1J. 'D*9/JD 'D#.J1)8customSupportedUris D-E'J) 'D4(C) (*'1J. 'D*9/JD 'D#.J1),'DC4A 'D*DB'&J H'D'3*,'() 9DI 'DFB7 'DFG'&J)E9DHE'* 'D'3*49'1%5/'1 Sense-'D) ./E) SenseE91A 'DE$33)E91QA 'D,G'2+'DE91A 'DA1J/ 'D9EHEJ D-'D) EC'A-) 'D'F*-'D-'D) ./E) DiagTrack (UTC)*E F41 %EC'FJ) EC'A-) 'D'F*-'D%5/'1 *CHJF '3*49'1E91A MachineAuthStartType D./E) '3*49'1EHB9 E1C2 (J'F'* 'D,G'2*E %D-'B 'D,G'2 9(1 '*5'D E(37-FH9 (/! E3'9/ *3,JD 'D/.HD %DI -3'( MicrosoftPADefender AVE9DHE'* Defender AV-'D) ./E) Defender AV %5/'1 'DF8'E 'D#3'3J Defender AV)%5/'1 'D*-DJD 'D0CJ DD#E'F D@ Defender AV%5/'1 E-1C Defender AVH69 Defender AV*CHJF Defender AV SSLOptions*CHJF HCJD Defender AV-'D) ./E) E1C2 #EF Windows-'D) 'D./E) 'D5-J) #EF WindowsPA-'D) ./E) A-5 4(C) Defender-'D) ./E) Defender 'D#3'3J)Defender E-EJ EF 'D9(+E5/1 -E'J) 'D9(+ AJ Defender&'3*+F'!'* 'D-E'J) EF 'D9(+ D@ DefenderH69 SmartLocker*(1F'E, 'D-E'J) EF (1'E, 'D*,33 D@ DefenderH69 -E'J) 4(C) Defendere'D1,'! E1',9) *CHJF 'D4(C) D/JC H'D*#C/ EF 9/E -81 9F'HJF URL 'DE7DH(). 
DE2J/ EF 'DE9DHE'* 1',9: %19F'HJF URL DD./E)o'C*ED '.*('1 'D'*5'D (9F'HJF URL D./E) 'D3-'() D Microsoft Defender DFB7) 'DFG'J) (CnC) (F,'-. %1 E9 'DF*J,) %2�A4D '.*('1 'D'*5'D (9F'HJF URL D./E) 3-'() Microsoft Defender DFB7) 'DFG'J) (CnC). 
A4D 'D'.*('1 D9FH'F URL 'D*'DJ: %1 E9 F*J,) %2�A4D* ,EJ9 '*5'D'* 'D'.*('1 (9F'HJF URL D./E) 3-'() Microsoft Defender DFB7) 'DFG'J) (CnC). 
A4D 'D'.*('1 D9FH'F URL 'D*'DJ: %1 E9 F*J,) %2q'C*ED '.*('1 'D'*5'D (9F'HJF URL D./E) 'D3-'() D Microsoft Defender DFB7) 'DFG'J) (Cyber) (F,'-. %1 E9 'DF*J,) %2�A4D '.*('1 'D'*5'D (9F'HJF URL D./E) 'D3-'() D Microsoft Defender DFB7) 'DFG'J) (Cyber). 
A4D 'D'.*('1 D URL 'D*'DJ: %1 E9 'DF*J,) %2�A4D* ,EJ9 '*5'D'* 'D'.*('1 (9F'HJF URL DD./E) 'D3-'(J) Microsoft Defender DFB7) 'DFG'J) (Cyber). 
A4D 'D'.*('1 D9FH'F URL 'D*'DJ: %1 E9 F*J,) %2o*E (F,'- '.*('1 'D'*5'D (9F'HJF URL D./E) 'D3-'() D Microsoft Defender DFB7) 'DFG'J) (AutoIR). %1 E9 'DF*J,) %2�A4D '.*('1 'D'*5'D (9F'HJF URL D./E) 3-'() Microsoft Defender DFB7) 'DFG'J) (AutoIR). 
A4D 'D'.*('1 D9FH'F URL 'D*'DJ: %1 E9 F*J,) %2�A4D* ,EJ9 '*5'D'* 'D'.*('1 (9F'HJF URL D./E) 3-'() Microsoft Defender DFB7) 'DFG'J) (AutoIR). 
A4D 'D'.*('1 D9FH'F URL 'D*'DJ: %1 E9 F*J,) %2o'C*ED '.*('1 'D'*5'D (9F'HJF URL D./E) 'D3-'() D Microsoft Defender DFB7) 'DFG'J) (CnC) (F,'-. %1 E9 'DF*J,) %2�A4D '.*('1 'D'*5'D (9F'HJF URL DD./E) 'D3-'(J) D Microsoft Defender DFB7) 'DFG'J) (SampleUpload). 
A4D 'D'.*('1 D9FH'F URL 'D*'DJ: %1 E9 F*J,) %2�A4D* ,EJ9 '*5'D'* 'D'.*('1 (9F'HJF URL DD./E) 'D3-'(J) Microsoft Defender DFB7) 'DFG'J) (SampleUpload). 
A4D 'D'.*('1 D9FH'F URL 'D*'DJ: %1 E9 F*J,) %2t'C*ED '.*('1 'D'*5'D (9F'HJF URL D./E) 'D3-'() Microsoft Defender DFB7) 'DFG'J) (MdeConfigMgr) (F,'-. %1 ('DF*'&, %2PA�A4D '.*('1 'D'*5'D (9F'HJF URL D./E) 3-'() Microsoft Defender DFB7) 'DFG'J) (MdeConfigMgr). 
A4D 'D'.*('1 D9FH'F URL 'D*'DJ: %1 E9 F*J,) %2�A4D* ,EJ9 '*5'D'* 'D'.*('1 (9F'HJF URL D./E) 3-'() Microsoft Defender DFB7) 'DFG'J) (MdeConfigMgr). 
A4D 'D'.*('1 D9FH'F URL 'D*'DJ: %1 E9 F*J,) %2q'C*ED '.*('1 'D'*5'D (9F'HJF URL D./E) 'D3-'() D Microsoft Defender DFB7) 'DFG'J) (OneDs) (F,'-. %1 E9 'DF*J,) %2�A4D '.*('1 'D'*5'D (9F'HJF URL D./E) 3-'() Microsoft Defender DFB7) 'DFG'J) (OneDs). 
A4D 'D'.*('1 D9FH'F URL 'D*'DJ: %1 E9 F*J,) %2�A4D* ,EJ9 '*5'D'* 'D'.*('1 (9F'HJF URL D./E) 3-'() Microsoft Defender DFB7) 'DFG'J) (OneDs). 
A4D 'D'.*('1 D9FH'F URL 'D*'DJ: %1 E9 F*J,) %2G'C*ED 'D*-BB EF 5-) 'D4G'/) D./E) Defender for Endpoint 'D3-'(J) (F,'-.DE J*E '.*('1 %(7'D 'D4G'/).:B/ JCHF '*5'D 'D3-'() 69JA' (3(( -'D'* A4D %(7'D 'D4G'/'*.�'D1,'! 'D*#C/ EF 9/E -81 9F'HJF URL 'D*'DJ): %1 H%2. DE2J/ EF 'DE9DHE'* J1,I 'D1,H9 %DI %3. DD-5HD 9DI E9DHE'* EA5D) 9F 'D.7# 1',9 %4.['C*ED '.*('1 'D'*5'D (./E) 'D3-'() (1F'E, 'D-E'J) EF 'DAJ1H3'* EF Microsoft Defender (F,'-.TA4D '.*('1 'D'*5'D (./E) 'D3-'() D(1F'E, 'D-E'J) EF 'DAJ1H3'* EF Microsoft Defender.:%0' C'F (1F'E, 'D-E'J) EF 'DAJ1H3'* EF Microsoft Defender GH -D 'D-E'J) EF 'DAJ1H3'* 'D#3'3J #H %0' '.*1* *ECJF H69 -81 EDR A'D1,'! 'D*#C/ EF 9/E -81 'D'*5'D'* (9F'HJF URL D3-'() AV. DE2J/ EF 'DE9DHE'* 1',9: https://learn.microsoft.com/defender-endpoint/configure-network-connections-microsoft-defender-antivirus'*5'D 'D4(C) 'D-'DJ :J1 E-/H/.'*5'D 'D4(C) 'D-'DJ E-/H/. %1�JECF #F *-/ 'D4(C'* 'DE-/H/) EF 'DH8'&A AJ '*5'D'* Defender MAPS 9DI 3(JD 'DE+'D D' J*E %13'D 7D('* *HBJ9 'D7H'1& (E7DH() DDE$41'* 'DE.55) ('D%6'A) %DI *H'BJ9 'D7H'1&).ApproachingDataLimit: %1OverDataLimit: %1'D*,H'D: %1NetworkCostType: %1r'C*ED '*5'D '.*('1 9F'HJF URL D./E) 'D3-'() D Microsoft Defender DFB7) 'DFG'J) (*CHJF ECS) (F,'-. %1 E9 'DF*J,) %2�'.*('1 'D'*5'D (./E) 3-'() Microsoft Defender DFB7) 'DFG'J) (*CHJF ECS) #1,9* HTTP 502 (H'() :J1 5-J-). G0G E4CD) E*B79) E91HA) AJ (H'() *7(JB Azure HB/ J*E -DG' EF *DB'! FA3G'. #9/ E-'HD) 'D*-BB EE' %0' '3*E1* G0G 'DE4CD). %1 E9 %2 'DF*J,)�A4D* ,EJ9 '*5'D'* 'D'.*('1 (9F'HJF URL D./E) 3-'() Microsoft Defender DFB7) 'DFG'J) (*CHJF ECS). 
A4D 'D'.*('1 D9FH'F URL 'D*'DJ: %1 E9 F*J,) %2PAg%0' CF* *FHJ *ECJF %/'1) *CHJF #E'F MDE A'D1,'! 'D1,H9 %DI 'DH+'&B 'D*'DJ) DD-5HD 9DI B'&E) 'DE*7D('*.'D#F8E) 'D#3'3J) 'DE/9HE)PD' J-*HJ 'D,G'2 9DI 'D-/ 'D#/FI DE3*HI 'D*5-J- D%D-'B %/'1) *CHJF 'D#E'F MDE: %1y*E *+(J* /H1 Active Directory Name Services 9DI 'D,G'2. /9E H-/'* 'D*-CE ('DE,'D BJ/ 'DE9'JF) -'DJ' HJ*7D( *CHJF' %6'AJ'.`%0' CF* *FHJ *ECJF %/'1) *CHJF #E'F MDE DH-/'* 'D*-CE ('DE,'D AJ1,I 'D1,H9 %DI 'DH+'&B 'D*'DJ).5'3*./'E %/'1) %9/'/'* 'D#E'F 9DI H-/'* 'D*-CE ('DE,'DIJ9ED 'D,G'2 (F8'E *4:JD 32 (* HGH :J1 E/9HE D%D-'B %/'1) *CHJF #E'F MDE.PAQ'D1,'! ED'-8) #F %5/'1 F8'E *4:JD 'D,G'2 :J1 E/9HE EF B(D MDE HD' JECF %D-'BG: %1I'D1,'! 'D1,H9 %DI G0G 'DEB'D) DD-5HD 9DI B'&E) (%5/'1'* Windows 'DE9*E/).1D' J9ED %1 9DI G0' 'D,G'2 (E3*HI 'D-E'J) 'DE*HB9.iDE2J/ EF 'DE9DHE'* -HD -E'J) PPL H3(( #GEJ*G'  1',9 G0G 'DH+'&B. '*5D (/9E Microsoft %0' '3*E1* 'DE4CD).PPLa'D1,'! ED'-8) #F %5/'1 .'/E Hyper-V 'DE+(* 9DI G0' 'D,G'2 :J1 E/9E EF B(D MDE HD' JECF %D-'BG: %1T'D1,'! 'D1,H9 %DI 'DH+'&B 'DE/9HE) EF MDE DD-5HD 9DI B'&E) (%5/'1'* 'D.'/E 'DE9*E/).%5/'1'* Windows 'DE9*E/)./E) '3*49'1 MDE./E) MDE AV Windefend./E) #EF Windows WscSvc./E) Windows SecurityHealth./E) WdnisSvc D-E'J) 4(C) MDE3'D./E) 'D#3'3J) EF Microsoft Defender DFB7) 'DFG'J)PA!DE2J/ EF 'DE9DHE'* 1',9 'DEB'D).�'D1,'! ED'-8) #F G0' 'D,G'2 J9ED (%5/'1 B/JE EF F8'E Defender 'D#3'3J. DF J*E /9E %5/'1'* 'DF8'E 'D#3'3J 'D#B/E EF N-2 (9/ 'D"F.='DF8'E 'D#3'3J DD-E'J) EF 'D(1'E, 'D6'1) D Microsoft Defender�J1,I ED'-8) #F G0' 'D,G'2 J9ED (%5/'1 B/JE EF E-1C (1F'E, 'D-E'J) EF 'DAJ1H3'* EF Defender. (9/ %5/'1 F3.) ,/J/) EF 'D-2E) JB*51 'D/9E DD%5/'1JF 'D3'(B*JF 9DI 'D/9E 'DAFJ AB7. 'D%5/'1'* 'D#B/E EF 0DC E/1,) AJ G0' 'DB3E HE*HA1) D/9E 'D*1BJ) 'DAFJ) AB7.6E-1C (1F'E, 'D-E'J) EF 'DAJ1H3'* EF Microsoft Defender�'D1,'! ED'-8) #F G0' 'D,G'2 J9ED (%5/'1 E9DHE'* #E'F B/JE. JH5I (*7(JB #-/+ %5/'1 EF E9DHE'* 'D#E'F D6E'F 'D-E'J) H'D*H'AB 'D#E+D.-*-/J+'* EC'A-) 'DAJ1H3'* D Microsoft DefenderS*E* ED'-8) '1*A'9 '3*./'E H-/) 'DE9'D,) 'DE1C2J) '3*49'1 (3(( -1C) E1H1 NDR '3*49'17-'HD *7(JB '3*+F'!'* Sense EDR 9DI 'D9EDJ'* 'D*'DJ): %1#'3*./'E 9'D DH-/) 'DE9'D,) 'DE1C2J)EH',G 'DF8'E 'D#3'3J MDE '3*./'E' 9'DJ' DD0'C1) E9 %5/'1'* MDE 'D-'DJ)'3*./'E 'D0'C1) 'D9'DJ$-'D'* A4D *-/J+ 'DF8'E 'D#3'3J D MDE-'D'* A4D *-/J+ E-1C MDE-'D'* A4D *-/J+ *HBJ9 MDE6A4D *-/J+ *HBJ9 MDE F81' DH,H/ E+JD BJ/ 'D*4:JD ('DA9DX'F*81 -*I J*E %FG'! C'A) E+JD'* 'D9EDJ) MpSigStub.exe B(D E-'HD) *-/J+ 'D*HBJ9 E1) #.1I.=A4D* ./E) MDE Windefend AJ 'D*GJ&) (F,'- H*,E/* AJ 'DE1-D) %1i#9/ *4:JD 'D,G'2 HBE ('D*-/J+ %DI F8'E Defender 'D#3'3J 'D#.J1 H%0' '3*E1* 'DE4CD) ABE (%(D': Microsoft.CA4D* ./E) MDE Windefend AJ %JB'A 'D*4:JD (F,'- H*HBA* AJ 'DE1-D) %1WBE ('D*-/J+ %DI F8'E Defender 'D#3'3J 'D#.J1 H%0' '3*E1* 'DE4CD) ABE (%(D': Microsoft.JJ4J1 '3*+F'! MDE %DI E*:J1 (E*:J1'*) 'D(J&) (%1) 'D*J DJ3* E*:J1'* 'DF8'E.N'D1,'! E1',9) '3*+F'!'*C:
'%1'
DD*#C/ EF #FG' *4J1 %DI E*:J1'* 'D(J&) 'D5-J-).PA'J*901 '3*1/'/ *A6JD'* Windows Defender.^%0' CF* *FHJ *FAJ0 %/'1) *CHJF ,G'2 MDE  AJ1,I 'D1,H9 %DI 'DEB'D) 'D*'DJ) DE2J/ EF 'DE9DHE'*.2*-BB EF *4:JD ./E) Windows Defender H'DH5HD %DJG'.M*CHJF (1F'E, 'D-E'J) EF 'DAJ1H3'* EF Microsoft Defender ('3*./'E FG, 'DE,EH9)E*7D('* 'D'*5'DB*CHJF 'D'F6E'E 'DE.*D7 %DI Azure Active Directory DDE,'D'* 'DE/'1)E/.D #E'F M365PAY'3*C4'A E4CD'* 'D%D-'B 'DE*9DB) (%/'1) 'D#E'F D Microsoft Defender DFB7) 'DFG'J) H%5D'-G'EA*'- FG, MDE 'D'A*1'6JEA*'- ./E) E3*491 MDE 'D'A*1'6J/'DE3'1 'D'A*1'6J D/DJD 0'C1) 'D*.2JF 'DE$B* MDE&E3'1 'D/DJD 'D%DC*1HFJ D MDE 'D'A*1'6J'DE3'1 'D'A*1'6J D/DJD MDE#E3'1 /DJD MDE ProgramData 'D'A*1'6JE3'1 /DJD MDE Temp 'D'A*1'6JE3'1 /DJD **(9 MDE 'D'A*1'6Jr'-0A EA'*J- 'D*3,JD 'DE*9DB) (@ AntiSpoofing D%,('1 'D,G'2 9DI %F4'! EA*'- .'5 ,/J/ H%9'/) 'D*3,JD. *4:JD 'D#E1 %1�D' JH,/ 4J! D*FAJ0G. .D'D 'DA*1) 'D2EFJ) 'D*J *(/# AJ Cyberthrottling (/! *4:JD '3*49'1 'D(J'F'* 9(1 'D%F*1F* DE J*E */AB 'D(J'F'* 9(1 'D%F*1F* %DI E/.D MDATP.z-'HD G0' 'D,G'2 'D%D-'B EF .D'D 9'ED Microsoft Monitoring Agent (MMA) HDCFG A4D D#FG D' J/9E 'D%D-'B ('3*./'E G0' 'D#3DH(.['D1,'! 'D1,H9 %DI H+'&BF' 9(1 'D%F*1F* DAGE #3DH( 'D%D-'B 'DEF'3( DF8'E 'D*4:JD G0' 'D,G'2.'D*CHJF 'DE9*E/ D6E MDE#'D,G'2 EB*1F (E91A E3*#,1 AAD E-//.�'D1,'! 'D*#C/ EF #F E91A E3*#,1 AAD EF E3*#,1 MDE 'D.'5 (C J*7'(B E9 E91A E3*#,1 SCP 'DE0CH1 #9D'G. DD'7D'9 9DI *91JA E3*#,1 MDE 'D.'5 (C 'D1,'! 'D1,H9 %DI E/.D #E'F M3650'D,G'2 B'/1 9DI EC'A-) 'D'F*-'D HAJ -'D) E3*B1).<*E *CHJF SharedSignatureRoot HJECF 'DH5HD %DJG D-3'( SYSTEM.%J(/H *CHJF SharedSignatureRoot 9'/J'.>BJE) *3,JD SharedSignatureRoot :J1 ECHF) #H JECF 'DH5HD %DJG'.SG0G E9DHE'*J) - *-BB EE' %0' C'F *CHJF SharedSignatureRoot E*HB9' DD(J&) 'D.'5) (C.*CHJF ,/HD *-/J+ 'D*HBJ9: %15SignatureScheduleDay: %1, SignatureUpdateInterval: %2B1',9 %9/'/'* ,/HD *-/J+ 'D*HBJ9 CE' *B*6J 'D-',) DD(J&) 'D.'5) (C.N*CHJF 9EDJ'* 'DA-5 'DE,/HD) D(1F'E, 'D-E'J) EF 'DAJ1H3'* EF Microsoft Defender.SignatureDefinitionUpdateFileSharesSources: %1EE1',9) EDA 'D*HBJ9 J4'1C %9/'/'* 'DE5'/1 -3( 'D-',) DD(J&) 'D.'5) (C.SignatureFallbackOrder: %1A1',9 %9/'/'* 'D7D( 'D'-*J'7J DD*HBJ9 -3( 'D-',) DD(J&) 'D.'5) (C.�'D1,'! ED'-8) #F G0' 'D,G'2 D/JG FG, J3E- (%6'A) 'DF'41JF 'DEH+HB (GE 'DE3*F/JF %DI 'DE,'D AB7. B/ J*/'.D G0' E9 E3*491 MDE 'D0J J-*', %DI *+(J* 'D4G'/'* %DI E.2F Publisher 'DEH+HB (G.�DE2J/ EF 'DE9DHE'* 1',9 'DEB'D). 
D*,F( 'DE4'CD :J1 'DE*HB9) BE (%2'D) *CHJF FG, 'DE,EH9) 'DEB*1F: 9D'E'* 1EH2 'DE5'/B) 'DE-DJ)= %1 9D'E'* E5'/B) GP = %2.TrustedPublishersPAB*901* B1'!) FB7) '*5'D 'D./E) (SCP) EF B3E *CHJF Active Directory.5*-*HJ FB7) '*5'D 'D./E) (SCP) 9DI *CHJF :J1 E9*E/: %12*-*HJ FB7) '*5'D 'D./E) (SCP) 9DI *CHJF :J1 E9*E/.LJ*901 6E 'D,G'2 %DI Azure AD F81' D*CHJF 3,D SCP D6E 'D,G'2 %DI DRS DDE$33).CDE J*E *CHJF FB7) '*5'D 'D./E) (SCP) AJ B3E *CHJF Active Directory.LJ*901 'D'*5'D (H-/) 'D*-CE ('DE,'D D'3*1/'/ E9DHE'* FB7) '*5'D 'D./E) (SCP).QJH,/ '.*D'A (JF E91A E3*#,1 AAD EF E3*#,1 MDE HE91A 'DE3*#,1 AJ %/.'D SCP DE,'DC.�'D1,'! 'D*#C/ EF #F E91A E3*#,1 AAD EF E3*#,1 MDE 'D.'5 (C J*7'(B E9 E91A E3*#,1 SCP 'DE0CH1 #9D'G. DD'7D'9 9DI *91JA E3*#,1 MDE 'D.'5 (C JECFC 'D1,H9 %DI 'DH+'&B.J**E %/'1) 'D,G'2 (H'37) 9'ED SCCM HDF **E %/'1*G (H'37) -D %/'1) #E'F MDE.MJO91A ECHF %/'1) 'D*CHJF CGJ&) %/'1) 'D#E'F 'DH-J/). DF J/J1 (1F'E, Defender DFB7) 'DFG'J) %9/'/'* 'D#E'F 9DI 'D#,G2) 'D*J *O/'1 ('DA9D (H'37) %/'1) 'D*CHJF. 
%0' CF* *1:( AJ *:JJ1 G0' 'D3DHC A3*-*', %DI *9JJF EA*'- *(/JD "%/'1) %9/'/'* 'D#E'F ('3*./'E %/'1) 'D*CHJF" 9DI H69 'D%JB'A. 1',9 'DH+'&B 'D*'DJ) DD-5HD 9DI E9DHE'* %6'AJ).9'D,G'2 B'/1 9DI EC'A-) 'D'F*-'D HDCFG DJ3 AJ -'D) E3*B1).^J1,I 'D1,H9 %DI 'D%14'/'* 'DH'1/) AJ 'DEB'D) 'D*'DJ). 
'*5D (/9E Microsoft %0' '3*E1* 'DE4CD).0Microsoft Defender for Endpoint - CVE-2022-232782Microsoft Defender DFB7) 'DFG'J) - *-DJD'* 'DE.'71'DE3'1'* 'D'A*1'6J) EABH/): %1.�'D1,'! 'D*#C/ EF H,H/ 'DE3'1 ('DE3'1'*) 'DEABH/) 'DE0CH1) HDE **E %9'/) *3EJ*G'. B/ *-*', %DI %F4'! 'DE,D/ ('DE,D/'*) 'DEABH/) E9 3J'B 'DF8'E.BA4D %D-'B G0' 'D,G'2 9(1 Microsoft Endpoint Configuration Manager.pJECF #F *-/+ G0G 'DE4CD) %0' C'F EA*'- 'D*3,JD %1 EABH/' EF: %2. 
D%F4'! EA*'- 'D*3,JD 'DEABH/ JECFC '3*./'E: %37JBHE 'D,G'2 ('D%(D': 9F E91A E$33) EF*GJ) 'D5D'-J): %1. J,( 9DJC %D:'! %D-'B 'D,G'2 EF G0G 'DE$33) +E %D-'BG (E$33*C 'D-'DJ).
'*5D (/9E Microsoft %0' DE JCF D/JC -B 'DH5HD %DI 'D(1F'E, 'DF5J D%D:'! 'D%D-'B ('3*./'E OrgID 'DE0CH1.
ED'-8): D916 E91A 'DE$33) 'D-'DJ 'D1,'! 'D'F*B'D %DI E/.D MDE H'DFB1 AHB '3E 'DE3*./E AJ 'D2'HJ) 'D9DHJ) 'DJEFI.E1C2 'D#E'FbJ1,I ED'-8) #F 'D,G'2 J-*HJ 9DI .7# ",'1M *-EJD 'DEA*'- 'D.'5 D4G'/) E5'/B) 'D9EJD" AJ 3,D OpsMgr.p'D1,'! %D:'! *+(J* MMA (9'ED 'DE1'B() EF Microsoft) H%9'/) *+(J*G 9DI G0' 'D,G'2 H'D*-BB EE' %0' '3*E1* 'DE4CD).4D' J*7'(B 'DHB* 'DE-DJ 9DI 'D,G'2 E9 'DHB* AJ Azure./'D1,'! 'D*-BB EF /B) HB* 'DF8'E 'DE-DJ HEF *9JJF 'DEF7B) 'D2EFJ) 'D5-J-).
%0' C'F G0' 'D,G'2 EF6E' DDE,'D AJ1,I 'D*#C/ EF *4:JD ./E) "HB* Windows" HEF E2'EF) 'D,G'2 E9 HB* 'DE,'D. 
DE2J/ EF 'DE9DHE'* -HD CJAJ) *CHJF E2'EF) 'DHB* H'D*-CE AJG' 'D1,'! 'D1,H9 %DI 'DEB'D) D6E'F /B) 'D*HBJ* 'DE-DJ AJ BIOS.WindowsTimeGJBHE 'D,G'2 (*4:JD %5/'1 #B/E EF System Center Endpoint Protection: %1.~J,( 9DJC 'D*1BJ) %DI #-/+ %5/'1 E*'- D6E'F 'D*H'AB H'D3E'- (*3,JD 'C*4'A'* 'D(1'E, 'D6'1) AJ E/.D #E'F Defender DFB7) 'DFG'J).#-/+ .7# AJ */AB %/'1) *CHJF 'D#E'F.�F,- %D-'B 'D,G'2 (@ Microsoft Defender DFB7) 'DFG'J). HE9 0DC -/+ .7# AJ */AB %/'1) *CHJF 'D#E'F. B/ JCHF 0DC (3(( 9/E '3*JA'! 'D,G'2 DDE*7D('* 'D#3'3J) DBF') %/'1) Microsoft Defender DFB7) 'DFG'J).5'DE*7D('* 'D#3'3J) D Microsoft Defender DFB7) 'DFG'J)#-/+ .7# AJ */AB %/'1) *CHJF 'D#E'F.PA�*E %D-'B 'D,G'2 (F,'- ( Microsoft Defender DFB7) 'DFG'J). HE9 0DC DE J*E *CHJF %/'1) FB'7 'DFG'J) EF Microsoft EF .D'D E1C2 E3$HD DD3E'- (*CHJF #E'F Microsoft Defender DFB7) 'DFG'J).'*CHJF E3*#,1 Microsoft Endpoint Manager-/+* E4CD) AJ 'D'*5'D.�F,- %D-'B 'D,G'2 (@ Microsoft Defender DFB7) 'DFG'J). HE9 0DC C'F GF'C .7# AJ 9EDJ) %/'1) *CHJF 'D#E'F H'D0J B/ JCHF (3(( E4CD) AJ 'D'*5'D. 
*-BB EF %EC'FJ) '*5'D 'D,G'2 (FB'7 FG'J) MDE.=FB'7 FG'J) Azure Active Directory HMicrosoft Endpoint ManagerA4D 'D'F6E'E 'DE.*D7 'D9'E.�F,- %D-'B 'D,G'2 (@ Microsoft Defender DFB7) 'DFG'J). HE9 0DC -/+ .7# AJ */AB %/'1) *CHJF 'D#E'F HA4D F8'E 'D*4:JD AJ *FAJ0 'D1(7 'DE.*D7.
1',9 'D'1*('7'* DE91A) CJAJ) '3*C4'A #.7'! A4D 'D1(7 'DG,JF 9DI E3*HI F8'E 'D*4:JD H%5D'-G'.I'3*C4'A #.7'! 'D#,G2) 'DE.*D7) 'DE1*(7) ( Azure Active Directory H%5D'-G'9/E *7'(B 'DE3*#,1.EF,- %D-'B 'D,G'2 (@ Microsoft Defender DFB7) 'DFG'J). HE9 0DC -/+ .7# AJ */AB %/'1) *CHJF 'D#E'F D#F E91A E3*#,1 Microsoft Defender DFB7) 'DFG'J) D' J*7'(B E9 E91A E3*#,1 Azure Active Directory 'D.'5 (C. 
*#C/ EF *7'(B E91A E3*#,1 Azure Active Directory EF E3*#,1 Defender DFB7) 'DFG'J) E9 E91A 'DE3*#,1 AJ %/.'D SCP DE,'DC..7# E.*D7 - FB7) '*5'D 'D./E).0F,- %D-'B 'D,G'2 (@ Microsoft Defender DFB7) 'DFG'J). HE9 0DC DE J*E *CHJF 3,D FB7) '*5'D 'D./E) (SCP) (4CD 5-J- H*901 6E 'D,G'2 %DI Azure AD. B/ JCHF 0DC (3(( *CHJF SCP DD'F6E'E %DI DRS DDE$33). 
*#C/ EF #F 3,D SCP J4J1 %DI AAD HSCP *E *CHJFG ('*('9 #A6D 'DEE'13'*. DE2J/ EF 'DE9DHE'* 1',9 'D'1*('7'*.*CHJF FB7) '*5'D ./E)
.7# 4G'/).�F,- %D-'B 'D,G'2 (@ Microsoft Defender DFB7) 'DFG'J). HE9 0DC -/+ .7# AJ */AB %/'1) *CHJF 'D#E'F (3(( .7# AJ 4G'/) 'D,G'2. 
*F*EJ 4G'/) 'D,G'2 %DI E3*#,1 E.*DA. *-BB EF '*('9 #A6D 'DEE'13'* 9F/ %F4'! EDA'* 'D*91JA. EDA'* *91JA 'D4G'/'* 'DEH+HB (G'PA'D*CHJF 'D.'7& D AAD Connect.�F,- %D-'B 'D,G'2 (@ Microsoft Defender DFB7) 'DFG'J). HE9 0DC -/+ .7# AJ */AB %/'1) *CHJF 'D#E'F (3(( *CHJF .'7& AJ AAD Connect. 
D*-/J/ E' JEF9 'D,G'2 EF 'D*3,JD AJ AAD 69 AJ -3('FC *4:JD #/H'* '3*C4'A 'D#.7'! H%5D'-G'.&#/') E3*C4A #.7'! *3,JD 'D,G'2 HE5D-G'BD%14'/'* '3*C4'A 'D#.7'! H%5D'-G' 'DE.55) D Windows Server 2012 R2.7# DNS.UF,- %D-'B 'D,G'2 (@ Microsoft Defender DFB7) 'DFG'J). HE9 0DC -/+ .7# AJ */AB %/'1) *CHJF 'D#E'F (3(( .7# DNS. *-BB EF '*5'D 'D%F*1F* #H %9/'/'* DNS 9DI 'D,G'2 #H CD'GE'. B/ *CHF %9/'/'* DNS :J1 'D5'D-) 9DI ,'F( E-7) 'D9ED. 
J*7D( Active Directory '3*./'E DNS DDE,'D DD9ED (4CD 5-J- (HDJ3 9FH'F 'DEH,G). DE2J/ EF 'DE9DHE'* 1',9 'D'1*('7'*.E4CD) AJ E2'EF) 'D3'9).�F,- %D-'B 'D,G'2 (@ Microsoft Defender DFB7) 'DFG'J). HE9 0DC -/+ .7# AJ */AB %/'1) *CHJF 'D#E'F. *-BB EF *9JJF 'D3'9) (4CD 5-J- HE2'EF*G' 9DI 'D,G'2 'D0J J-/+ AJG 'D.7#.A4D *F2JD 'DFG,.�F,- %D-'B 'D,G'2 (@ Microsoft Defender DFB7) 'DFG'J). HE9 0DC *901 9DI 'D,G'2 *F2JD FOG, #E'F FB7) 'DFG'J) EF MEM. 
*-BB EF %EC'FJ) '*5'D 'D,G'2 (FB'7 FG'J) MDE.A4D %D:'! 'D*3,JD.�'D,G'2 E3,D -'DJ' HDCF J,( %D:'! *3,JDG. HE9 0DC DE *F,- 9EDJ) %D:'! 'D*3,JD (3(( .7# 9'(1. 
*-BB EF %EC'FJ) '*5'D 'D,G'2 (FB'7 FG'J) MDE.A4D *9JJF 'DFG,.�F,- %D-'B 'D,G'2 (@ Microsoft Defender DFB7) 'DFG'J) HC'F B'/1'K 9DI *F2JD FOG, #E'F FB7) 'DFG'J) EF MEM. HE9 0DC -/+ A4D .D'D *9JJF 'DFOG,.A4D *B1J1 'DFG,.�F,- %D-'B 'D,G'2 (@ Microsoft Defender DFB7) 'DFG'J) HC'F B'/1'K 9DI *F2JD FOG, #E'F FB7) 'DFG'J) EF MEM. HE9 0DC -/+ A4D .D'D %9/'/ *B'1J1 'DFOG, %DI MEM.ND' JECF %D-'B G0' 'D,G'2 AJ 'D-'D) 'D-'DJ) D#F ImageState /'.D '%1' :J1 EC*ED.�JECF #F *-/+ G0G 'DE4CD) %0' B'E* 5H1) F8'E 'D*4:JD (9/) E-'HD'* E**'DJ) D*,GJ2 'DF8'E H*E *9JJF 'D*3,JD %DI '%1'.
'*5D (/9E Microsoft %0' '3*E1* 'DE4CD).E9DHE'* -'D) %9/'/ Windows51(E' *E 'D*D'9( (BJE) ImagePath AJ 'D3,D B(D 'D%D-'B.T'D1,'! E1',9) G0' 'D.7# HA-5 ImagePath (6EF %1) DD*#C/ EF #FG J4J1 %DI E3'1 %2 5'D-.5*E 'DC4A 9F #-/'+ EBJ/) DD(J'F'* 9DI 'D4(C'* EF SenseMDE H ConfigMgr�'D,G'2 EO/'1 ('3*./'E %/'1) 'D*CHJF HMicrosoft Defender DFB7) 'DFG'J). B/ J$/J 'D*-CE AJ 'DFOG, EF .D'D 'DBF'*JF %DI -/H+ *9'16'* H8GH1 F*'&, :J1 E1:H( AJG'. 
D*,F( 0DC J,( 92D FOG, #E'F FB7) 'DFG'J) AJ H-/) *-CE H'-/).;'D*H',/ 'DE4*1C E9 Microsoft Endpoint Configuration Manager*E *:JJ1 -'D) 'D*3,JD�'D,G'2 EO/'1 ('3*./'E %/'1) 'D*CHJF HMicrosoft Defender DFB7) 'DFG'J). 3(B %D:'! *3,JD 'D,G'2 EF -D %/'1) *CHJF 'D#E'F %E' (3(( *:J1 F7'B 'DA16 #H %2'D) 9D'E) MDE-Management EF 'D,G'2.E*:J1 (J&) 'DF8'E %%TEMP%% (H%%TMP%%) :J1 E91A. B/ J$/J 0DC %DI A4D AJ Defender HECHF'* 'DF8'E 'D#.1I 'D*J *9*E/ 9DI /DJD E$B*.�BE (*91JA E*:J1'* (J&) 'DF8'E TEMP HTMP. 'DBJE) 'D'A*1'6J) GJ %%SystemRoot%%\TEMP D-3'('* 'DF8'E. *-BB EF H,H/ 'DE3'1 HEF H,H/ 'D#0HF'* 'DEF'3().nD' JECF 'DH5HD %DI /DJD %%TEMP%%. B/ J$/J 0DC %DI A4D AJ ECHF'* Defender 'D*J *-*', %DI C*'() 'DEDA'* 'DE$B*).J*-BB EF H,H/ /DJD %%TEMP%% H#F 'D-3'( 'D-'DJ D/JG #0HF'* 'DB1'!) H'DC*'().}*E *9JJF /DJD %%TEMP%% %DI E3'1 :J1 'A*1'6J. B/ J*3(( E3'1 TEMP :J1 'DBJ'3J AJ E4'CD E9 'DECHF'* 'D*J *A*16 'DEHB9 'D'A*1'6J.�1',9 E' %0' C'F E3'1 %%TEMP%% 'DE.55 EB5H/K'. %0' DE JCF E*HB9K' ABE (%9'/) *9JJF E*:J1'* (J&) 'DF8'E TEMP HTMP %DI 'DBJE) 'D'A*1'6J) (%%SystemRoot%%\TEMP D-3'('* 'DF8'E).L'D1,'! ED'-8) #F 'D,G'2 J-*HJ 9DI E3'-'* 9ED 9'ED E1'B() EF Microsoft (MMA).%0' *E %D-'B 'D,G'2 ( Defender DFB7) 'DFG'J) 9(1 *C'ED ASC ('DE91HA #J6' ('3E Azure Defender DD.H'/E) AEF 'DE3*-3F %2'D) E3'-) 9ED MDE D*,F( E4CD'* 'D*-EJD 9(1 'D%F*1F*. 
DE2J/ EF 'DE9DHE'* -HD *C'ED ASC E9 Defender DFB7) 'DFG'J) 'D1,'! 'D1,H9 %DI 'DEB'D).MDE AJ AzurebA4D %D-'B G0' 'D,G'2 (3(( AB/'F #0HF'* EA*'- 'D*3,JD HKLM_System_CurrentControlSet_Services_Sense.�B/ J-/+ 0DC (3(( 'D*/'.D EF EF*,'* 'D#E'F 'D*'(9) D,G) .'1,J) #H %0' C'F* #0HF'* 'D*-CE 'DC'ED D-3'( SYSTEM EABH/) HKLM_System_CurrentControlSet_Services_Sense. 'D#0HF'* 'D*J *E 'D9+H1 9DJG' D-3'( SYSTEM GJ: %1AJ1,I ED'-8) #F G0' 'D.'/E DE J*E *+(J* 'D9'ED 'DEH-/ 'D-/J+ 9DJG.�'D9'ED 'DEH-/ D.H'/E 'DE3*HI 'D#/FI :J1 E+(* 9DI G0' 'D,G'2. EF 'DE3*-3F *+(J* 'D9'ED 'D,/J/ DD-5HD 9DI 'D#/'! 'D#E+D H%EC'FJ'* 'D-E'J). DE2J/ EF 'DE9DHE'* 1',9 'DH+'&B:%D-'B .H'/E Windows (./E) Microsoft Defender DFB7) 'DFG'J)7-/+ A4D AJ *9JJF 'DFOG, (3(( E*:J1'* 'D(J&) 'D*'DJ): %1�F,- %D-'B 'D,G'2 (@ Microsoft Defender DFB7) 'DFG'J) HC'F B'/1'K 9DI *F2JD FOG, #E'F FB7) 'DFG'J) EF MEM. HE9 0DC -/+ A4D .D'D *9JJF 'DFOG,. 
 'D1,'! %2'D) #J E3'1 (E3'1'*) :J1 EH,H/ EF E*:J1 (E*:J1) (J&) 'DF8'E #9D'G.(*9JJF E*:J1'* 'D(J&) AJ DH-) *-CE 'DF8'EZ-/+ A4D AJ *9JJF 'DFOG, F81'K D*ECJF ,/HD) 'DE4'1C) 'D9'/D) 'D/JF'EJCJ) (DFSS) 9DI 'D,G'2.F,- %D-'B 'D,G'2 (@ Microsoft Defender DFB7) 'DFG'J) HC'F B'/1'K 9DI *F2JD FOG, #E'F FB7) 'DFG'J) EF MEM. 
 HE9 0DC -/+ A4D #+F'! *9JJF 'DFG, (3(( BJH/ H',G) (1E,) 'D*7(JB'* 'D*J JECF #F *-/+ 9F/ *ECJF DFSS. 
 'D1,'! 'D'*5'D (/9E Microsoft DD-5HD 9DI 'DE3'9/).D'D,G'2 :J1 E-/+ HD' J-*HJ 9DI %EC'FJ) EC'A-) 'D'F*-'D 'D*J *E F41G'.o'D1,'! 'D*#C/ EF F41 *5-J- 'D#E'F 'DEH5I (G D-E'J) 'D,G'2 EF *2JJA 'DGHJ) DE2J/ EF 'DE9DHE'* 1',9 'D'1*('7'*.1Microsoft Defender DFB7) 'DFG'J) - CVE-2022-232782Microsoft Defender DFB7) 'DFG'J) - *-DJD'* 'DE.'71k'D,G'2 J9ED (%5/'1 B/JE EF 'DC4A 'D*DB'&J H'D'3*,'() 9DI 'DFB7 'DFG'&J) EF Microsoft Defender DFB7) 'DFG'J)@'D1,'! *-/J+ 'DE3*491 D6E'F -5HDC 9DI 'D-E'J) H'D'3*B1'1 'D#E+D.2*-/J+ Microsoft Defender DFB7) 'DFG'J) DE3*491 EDRlA4D %D-'B G0' 'D,G'2 (3(( *97D MsSense.exe #+F'! E1-D) 'D*GJ&) D TelLib.dll.
 C'F 'D.7# 'DF'*, 9F 'D*97D: %1
JECF #F J-/+ G0' %0' DE JCF -3'( 'DF8'E D/JG #0HF'* DDC*'() %DI 'DE3'1 'DE*HB9 (ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Cyber).
 'D1,'! 'D*-BB EF 5-) BH'&E 'D*-CE ('DH5HD (ACLs) AJ 'DE3'1 H%9'/) *9JJF 'D#0HF'* EF 'DE,D/ 'D#5D %0' D2E 'D#E1.B'D,G'2 B'/1 9DI EC'A-) *2JJA 'DGHJ) HDCFG :J1 E3,D (9/ AJ 'D3-'().k'D1,'! 'D*#C/ EF 9/E -81 'D'*5'D (9F'HJF URL 'D.'5) ( EDRCloud CnC. '*5D (/9E Microsoft %0' '3*E1* 'DE4CD)..JEF9 *CHJF #H *(9J) E' (/! *4:JD -E'J) 'D4(C).8'D1,'! E1',9) 13'D) 'D.7# G0G DAGE E4CD) 'D-81 H-DG': %1ZDE J*E *ECJF *4AJ1'* TLS 'DE9*E/) 9DI G0' 'D,G'2. JECF #F J$+1 G0' 9DI 'D'*5'D (3-'() MDE.�'D1,'! A-5 'D*4AJ1'* 'DECHF) (6EF HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002) DD*#C/ EF #FG' *-*HJ 9DI 'D-/ 'D#/FI EF 'D*4AJ1'* 'DE7DH() DD'*5'D (3-'() MDE.E*7D('* TLS HE,EH9'* 'D*4AJ1[DE J*E *ECJF (1H*HCHD 9EJD TLS 1.2 9DI G0' 'D,G'2. JECF #F J$+1 G0' 9DI 'D'*5'D (3-'() MDE.�'D1,'! 'D*#C/ EF *ECJF 9EJD 'D%5/'1 1.2 EF TLS (6EF HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client).PARDE J*E *ECJF *4AJ1'* ECDH 9DI G0' 'D,G'2. JECF #F J$+1 G0' 9DI 'D'*5'D (3-'() MDE.�'D1,'! 'D*#C/ EF *ECJF ECDH KeyExchangeAlgorithm (6EF HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\ECDH).A4D '.*('1 9FH'F URL 'D#3'3J�*E *97JD ECHF NetworkProtection #H A4D '.*('1 'D*-BB EF 9FH'F URL. B/ J4J1 G0' %DI H,H/ E9J/ *H,JG 4(C) (9DI 3(JD 'DE+'D: Cisco Umbrella).�[NetworkProtection URL check failed and a network redirector was detected (%1). Redirectors such as Cisco Umbrella proxy traffic through the local host, so NetworkProtection sees connections as originating from localhost and cannot determine the real destination. Uninstall the redirector, or reconfigure it so it no longer intercepts/proxies traffic on this device, then re-run the test.]F[Address false positives/negatives in Microsoft Defender for Endpoint]'DH5HD 'DE*-CE (G %DI 'DE,D/'*DA4D *-EJD 'DH-/) 'DFE7J) mde_cfa_evaluation - *4.J5'* CFA :J1 E*HA1)-'D*-BB EF *+(J* MdeDiag H*3,JD 'DH-/) 'DFE7J)QDE J*E 'D9+H1 9DI 9EDJ'* 'DC4A 9F CFA ('DH5HD 'DE*-CE (G %DI 'DE,D/'*) AJ 'D3,D'*)D' JH,/ %,1'! E7DH( - CFA J9ED (4CD 7(J9J+*E *-DJD %1 EF 'DEDA'* 'DE4(HG) D-'D) 'D+B)NE1',9) CfaTrustChecks.txt AJ 'D%.1', 'D*4.J5J DD-5HD 9DI F*'&, *-DJD +B) EA5D)`%1 :J1 EH+HB (G EF B(D 'DH5HD %DI 'DE,D/'* 'DE-EJ) (CFA) D#F 5H1) 'D9EDJ) :J1 E91HA) (#FG' ,J/).Y#6AG %DI B'&E) 'D*7(JB'* 'DE3EH- (G' #H #6A '3*+F'! AV DG0' 'DEDA %0' CF* *+B (G0' 'DEDA..%1 :J1 EH+HB (G EF B(D CFA D#F #5DG :J1 E91HA.2%1 :J1 EH+HB (G EF B(D CFA D#F #5DG GH (1F'E, F5J.@%1 :J1 EH+HB (G EF B(D CFA D#FG B'E (*-EJD EDA :J1 EH+HB (G: %2.C%1 :J1 EH+HB (G EF B(D CFA D#FG *E -BFG AJ 9EDJ) :J1 EH+HB (G': %2.1#6A '3*+F'! AV DG0' 'DEDA %0' CF* *+B (G0' 'DEDA.=#6A '3*+F'! AV DG0G 'D9EDJ) %0' CF* *+B (G ('3*+F'! 'D9EDJ)).'D9EDJ): %1
#-/'+ CFA:  - 'D%,1'!: %1 'D3((: %2#-/'+ Taint:"  - TaintType: %1 TaintReason: %2
'D%14'/'*: %1(%1 *C1'1'*)wJ-*HJ '%2' 'DE91A 'DA1J/ 'D9EHEJ D ASR %1 ('DE5/1: %3) 9DI E3'A'*/9D'E'* *(HJ( ('/&) #H D'-B) JECFG' EF9 *7(JB 'DB'9/).eBE (%2'D) 'DE3'A'* 'D('/&) H'DD'-B) EF E91A B'9/) ASR (GUID) AJ *CHJF FG, 'DE,EH9) #H 'D3,D 'D.'5 (C.�J-*HJ ASR %1 GUID '%2' ('DE5/1: %3) 9DI #BH'3 E*91,). J,( *-/J/ E91A'* GUID (/HF #BH'3 (9DI 3(JD 'DE+'D 56a863a9-875e-4185-98a7-b882c64b5ce5).^BE (%2'D) 'D#BH'3 'DE*91,) EF 'DE91A 'DA1J/ 'D9EHEJ DB'9/) ASR AJ *CHJF 'D3,D #H FG, 'DE,EH9).hJ-*HJ '3*+F'! ASR '%1' ('DE5/1: %2) 9DI E3'A'*/9D'E'* *(HJ( ('/&) #H D'-B) B/ *EF9 'D'3*+F'! EF 'D*7'(B.^BE (%2'D) 'DE3'A) 'D(J6'! 'D('/&) H'DD'-B) EF E3'1 '3*+F'! ASR AJ *CHJF 'D3,D #H FG, 'DE,EH9).�ASR %1 GUID '%2' ('DE5/1: %3) DJ3 GUID 5'D-'. 'D*F3JB 'DE*HB9: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx (9DI 3(JD 'DE+'D 56a863a9-875e-4185-98a7-b882c64b5ce5).PAtBE (*5-J- 'DE91A 'DA1J/ 'D9EHEJ DB'9/) ASR AJ FG, 'DE,EH9) #H *CHJF 'D3,D D'3*./'E *F3JB GUID 5'D- (/HF #-1A %6'AJ).�J-*HJ '3*+F'! ASR '%1' ('DE5/1: %2) 9DI EB79 /DJD #5D ('..'). (9/ -D '..' B/ JCHF 'DE3'1 'DE3*+FI 'DA9'D #H39 (C+J1 EE' JB*1-G 'D%/.'D 'D-1AJ -J+ J9ED AJ 'D.DAJ) 9DI *H3J9 F7'B 'D'3*+F'! .'1, F7'BG 'DE3*G/A.�'3*(/D 'DE3'1 'DE7DB 'DE-DHD ('DC'ED 'D0J D' J*6EF EB'79 '..' (%/.'D '3*+F'! ASR. *1A6 'D%5/'1'* 'D#.J1) EF Microsoft Defender %/.'D'* 'D'3*+F'! :J1 'DE*9'1A 9DJG' AJ HB* *-EJD 'D*CHJF.PA#E' 'D*-DJD'* 'D*4.J5J) AJ Defender�%F Defender Diagnostic Insights GJ #/') *4.J5 E3'9/) 0'*J) *,E9 'D(J'F'* 'D*4.J5J) H*-DDG' H*HA1 *B1J1' DDE3'9/) AJ '3*C4'A E4CD'* #/'! 'D,G'2 'D8'G1J D Windows H%5D'-G' AJ Azure. H+'&B Windows D*4.J5 Defender GJ %1.%EF #JF JECFFJ (/! E1',9) G0' 'D*B1J1�'(/# (9D'E) 'D*(HJ( "F81) 9'E)". 1',9 'D*H5J'* H'D'1*('7'* 'D.'5) ('DF*'&,. *91A 9DI CJAJ) *#+J1G' 9DI 'D#/'! HC0DC -HD #A6D 'DEE'13'* DD*CHJF'* 'DE-3F) DD#/'!. *91A 9DI 'DE2J/ -HD E1',9) 'D*B1J1 %1.KE' FH9 'D(J'F'* 'D*J J*E ,E9G' (H'37) F*'&, 'D*-DJD'* 'D*4.J5J) D DefenderJ,E9 Defender Diagnostic Insights E9DHE'* -HD 'D,G'2 'D8'G1J D Windows #H 'D#B1'5 #H E,EH9'* 'D*.2JF H9/'/'* 'D#/'! HE3*GDCJ 'DEH'1/ 'D9'DJ) H'D3,D'* H9EDJ'* 'D**(9 'DE.*DA). *A'5JD -HD FH9 'DE9DHE'* 'D*J J*E ,E9G' (H'37) Defender Diagnostic Insights GJ %1.PAP�P�P�P�,T-/+ .7# .D'D *4:JD H-/) LUA 'DFE7J).

\-/+ .7# .D'D *-EJD 'DH-/) 'DFE7J) D@ LUA.

l-/+ .7# AJ (F'! 'D,ED) AJ 'DH-/) 'DFE7J) D@ LUA.

4-/+ .7# AJ 0'C1) LUA.

0-/+ .7# 9'E D@ LUA.

,-/+ .7# 1,H9 LUA.

d'C*ED* EB'79) *FAJ0 LUA (H'37) %4'1) 'D%JB'A.

x*901 *CHJF DB7'* 'D0'C1) 'DEC/3) (4CD /JF'EJCJ DD9EDJ).

�4VS_VERSION_INFO���e�e?ZStringFileInfo6040104B0LCompanyNameMicrosoft Corporation�,FileDescriptionE-1C *4.J5 Microsoft Defender DFB7) 'DFG'J)BInternalNamedefenderdiag.dll�.LegalCopyright� Microsoft Corporation. All rights reserved.ROriginalFilenamedefenderdiag.dll.muij%ProductNameMicrosoft� Windows� Operating System�8FileVersion4.18.26080.3 (9e1f3147fbc83f18a98a965394a23e07747d7295)>
ProductVersion4.18.26080.3DVarFileInfo$Translation�PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD(0�(	*�H��
��'�0�'�10
	`�He0\
+�7�N0L0
+�70	���010
	`�He ��=���$a�R��r|�\�Ƀ5+�扄}\E���A��
0�a0�I�3$]��q� ��$0
	*�H��
0S10	UUS10U
Microsoft Corporation1$0"UWindows Production PCA 20230
260430183934Z
270429183934Z0p10	UUS10U
Washington10URedmond10U
Microsoft Corporation10UMicrosoft Windows0��0
	*�H��
��0�����4�bI��p�%�x�3 m���˝~���83`�;P#tίe��C�#3�&��	�j���1z�Q��,-�KM���_�ɨ$�8�
/���?��vE���^Wxq�e��nQ�v��ϗ3�I�~d��B�o�K�>w/���LF������"U�	HP��	LR�.�k'�mAѶ�t�ի
!N	_G��aE3�X�2�r��0�{:s���V1!��i�a�F�4�j8.�.�wk!�G'��	�X��n̍���d%�&_'�9���4ˑk[�;��?�9��ē���x����+vE��->�L�T��C�_ �n#��o�]y��Og���V��gHG+?��at��ʮ,1�^r-�������15�t����0��0U��0U%0
+�7
+0U+N����N�"�����!�	0EU>0<�:0810UMicrosoft Corporation10U
500446+5079150U#0����?Z	�=!U�1S"�0ZUS0Q0O�M�K�Ihttp://www.microsoft.com/pkiops/crl/Windows%20Production%20PCA%202023.crl0g+[0Y0W+0�Khttp://www.microsoft.com/pkiops/certs/Windows%20Production%20PCA%202023.crt0U�00
	*�H��
��4Z�����
1��
�	�˫5F��V�5��;DŐ-%�ۚ�i�����
����M���r�'4�Ɣ��!I皸a08.�wq��̔`Щ�!əO�����{�����y��eNu���j�҂�����Xf��C
�˼�S�.�
T�QG���R��|d5$����k���O���J��L3���$�|���!&O̅X=��H\�\��{�P�Ξ�e��;�ϳb��'iN���۲c����-f�x��9��b�+�V#)�!˜�y���^\�);��W툊kLf3���S71��� �r�P��`FV�sa��� /C)Ҩ:�/Њ$n�Eh�1�w�o�mGP��6�h��~�!R����&���a��r��!4��� Bs�w�r��_�ew�|�8�bP�O�B�_�L�;����p��5�z����Ι/2�)�t�a��#Z�\�ԝ�l�(�CR�|�3�!^
�B�$������VH�,�F��D?�0��0���3��V	K��!0
	*�H��
0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100
230613183415Z
350613184415Z0S10	UUS10U
Microsoft Corporation1$0"UWindows Production PCA 20230�"0
	*�H��
�0�
��.�
]nqK��H���b!�NF��-i�Y�3���'x���v}���/g��W����@�Sp����גrKҳ>��e�)�V�ƃ�o���[��y��2��������i�]U`�˰ʹ������g����xL�m%5����uG<�>#��ҥ_x
B�f.��ޕFo��)���ݹ�<-�}���έ���=p2蝁y��Q���UAo���C�ĵ����Z�U~�f*>��P�I!#�x(Lii�njk�I��sWL��3uo�Ŀ���X�-*e+�H$�
��y��\�
��n%�8���!���_>�Զ
RH�0ƥ>f��~4�Qb�o�=����5?QI^�}�����P�u��O�lzp0H}q���RQ#��O�3�J/�xw_�	W��;Q5x?�E��pd���"H��i�'ư ��<��N���d"�άk���ˡ��<$��q����s�х[*:�4
G���g�c�%,�CXt��E���p��������F0�B0U��0	+�70U���?Z	�=!U�1S"�0	+�7
SubCA0U�0�0U#0��Vˏ�\bh�=��[�Κ�0VUO0M0K�I�G�Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0�>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
	*�H��
��0Bh߄�<�o��Nr��U���|q���5��r5����wy^�Hw��4��A���`�6�(י�V�o�BRm�Mv��s%�����D��� �Д�(��8-n���E"}��K��|���lB�s�y����[���Q���`riAj��/7�X,!�Nvw�Z����*Yۺ�T��
�Jq�ƾ�a�܀�r�?T�AG���ޖ��B��sQ���W[4��Y�eɃ�`�	�z�+���t����8�+[ge��<	�WI� 2i�K ��
M�Ky��W�{ԜGH������$��r9���{�.�Y�k�����!��Bt�5�ϼ߳�.���:�ݒa��5ʡ��ήz�-�{]v�Z����\aL�lt��ov�s
��|jll8���U��pkJ��{���Dqۋ`Q��Jzz�Q�D�=��E�_c
E�oM0v��݁�U�ʃ��UF����
��]���k%Xa
�	��Jb�^g|X\��#��okPy/�p1�^0�Z0j0S10	UUS10U
Microsoft Corporation1$0"UWindows Production PCA 20233$]��q� ��$0
	`�He���0	*�H��
	1
+�70
+�710
+�70/	*�H��
	1" ��d峯��N-��*.’�!�� x#%G0D�N0B
+�71402��Microsoft��http://www.microsoft.com0
	*�H��
��B�'Fg�?���͍��s���(\�7��`�=Չ�(���:�M��ǥ�3�x�c�'���i�����I���W��/ۮ)K|��!P��'I=$���MID�$*�1"�`�Ԓ�Vb#�<�K�L����'��7�9v�履Ot�h�s��������� �j
�Y�D������]�2���"�uMOm��\��P�)����]���s���`���XW��M�i�;Nݚp^��=�4C�b"���\D�e���G�n�6����ݽWk�!犒�|ڌ%ƹ�����	3�d�kj��ams�>�}.�b��P#�n��CU�|�tQ���v6��Ql�"<���PM\�d"�,�ڭ�MN=�~�p���B�Up��=�\e�����0��
+�71��0�|	*�H��
��m0�i10
	`�He0�R*�H��
	��A�=0�9
+�Y
010
	`�He �Ѭ��j� �́����2а�S��Y�`j_mq�20260815031019.709Z0��Ѥ��0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1%0#UMicrosoft America Operations1'0%UnShield TSS ESN:A935-03E0-D9471%0#UMicrosoft Time-Stamp Service���0� 0��3'��ñ.W-'0
	*�H��
0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100
260219194004Z
270517194004Z0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1%0#UMicrosoft America Operations1'0%UnShield TSS ESN:A935-03E0-D9471%0#UMicrosoft Time-Stamp Service0�"0
	*�H��
�0�
���l�|3�/���
iiܾzR/	��K�̒[�pH+�-�+�P���MIu���v�>�!�f��Lj���Y[~d���<��j����?
M�����c��5��pU���Ȍ�=�C��oL�Æc/���Xw�D��O�d���L���BD����Q���
튀���z��g(9}[C�HF��/6����P'�C��X���)��j�����&G���=]V�S&�:��Ѝ�.�-�@��L�����c�ph�^Տ�C�doh_�|v/�,I����D�XB	�^(	] ){'����H�@�B��y�C[cwIC�� L4-V���&1�"�xl�^I�c���Z�g�S�W��ģ<�֨��
cm^Ub3GƲk��k���el~�����=�;����qL��4 ������`�?�u�m��� Vta3�"�m���'�?���l���nr�Q�L���J��
3��^���(ξߖ���I0�E0U����x0d���{�j�Oݨ��^0U#0���]^b]����e�S5�r0_UX0V0T�R�P�Nhttp://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l+`0^0\+0�Phttp://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0U�00U%�0
+0U��0
	*�H��
�*�˝���כ�~�F컰8�+]�\��Tݣc�����N�����p�4�.���xi��>̈���ahq.�\��}��JȂ<���7�	�O/�x�c�;��a�;
v�s唓>�od��r)P��S�'<��;C���<&���3���#D�E����
�~W�-7
��Z��^e5�ΰ�n�Ҏ��`��D���XD�r��8���oMa)d$
�V�e0�<եV]�\�G5"Y9`�w��B�v�n]�ݢ:cɄ�軍�Rh�>�C��gykq�0�������s�Y�|��۽��Pj�_��U�f�^�5�
�ڝ3�������߳:X���S��w�v����Ai���zg��������'քX~s���H�KF
76?h�༑��;��L���Y>͒qW{맂�����pwM�@��;7�~Rd�=��4��lH��q��ume{���`�n1�0�q0�Y�3��k��I�0
	*�H��
0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100
210930182225Z
300930183225Z0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100�"0
	*�H��
�0�
���L�r!y���$y�Ղ��ҩlNu��5W�lJ�⽹>`3�\O�f��SqZ�~JZ��6g�F#���w2��`}jR�D���Fk��v��P�D�q\Q17�
8n����&S|9azĪ�ri����6�5&dژ;�{3��[~��R���b%�j�]�S���VM�ݼ��㑏�9,Q��pi
�6-p�1�5(�㴇$��ɏ~�T��U�mh;�F��z)7���E�Fn�2��0\O,�b�͹⍈䖬J��q�[g`���=� �s}A�Fu��_4���� }~�ٞE߶r/�}_��۪~6�6L�+n�Q���s�M7t�4���G��|?Lۯ^����s=CN�39L��Bh.�QF�ѽjZas�g�^�(v�3rק ��
�co�6d�[���!]_0t���عP��a�65�G������k�\RQ]�%��Pzl�r�Rą��<�7�?x�E���^ڏ�riƮ{��>j�.����0��0	+�70#	+�7*�R�dĚ���<F5)��/�0U��]^b]����e�S5�r0\U U0S0Q+�7L�}0A0?+3http://www.microsoft.com/pkiops/Docs/Repository.htm0U%0
+0	+�7
SubCA0U�0U�0�0U#0��Vˏ�\bh�=��[�Κ�0VUO0M0K�I�G�Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0�>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
	*�H��
��U}�*��,g1$[�rK��o�\�>NGdx���=13�9��q6?�dl|�u9m�1��lѡ�"��fg:SMݘ��x�6.���V����i�	�{�jo�)�n�?Hu��m��m#T�xSu$W�ݟ�=��h�e��V����(U'�$�@���]='�@�8���)�ü�T�B�������j�BRu�6��as.,k{n?,	x鑲�[�I�t�쑀�=�J>f;O���2ٖ����t��Lro�u0�4�z�P�
X�@<�Tm�ctH,�NG-�q�d�$�smʎ	��WITd�s�[D�Z�k
��(�g($�8K�n�!TkjEG����^O���Lv�WT	�iD~|�als�
��Af=i��AI~~���;����>�1Q������{��p���(��6ںL���
�4�$5g+�
�挙��"��'B=%��tt[jў>�~�13}���{�8pDѐ�ȫ:�:b�pcSM��m��qj�U3X��pf�M0�50����Ѥ��0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1%0#UMicrosoft America Operations1'0%UnShield TSS ESN:A935-03E0-D9471%0#UMicrosoft Time-Stamp Service�#
0+#:����`ܐ3�x���*���0���~0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100
	*�H��
�*4�0"20260815004426Z20260816004426Z0t0:
+�Y
1,0*0
�*4�0I�0c0
�+�j06
+�Y
1(0&0
+�Y
�
0� �
0��0
	*�H��
�c�8���KBBu�f��ٖۢ��r0O#L�6.r��"i����h��k3,��mg2	F<,{40����i������$�������)���h�C�z��
gO��A��
]�Xgl���{����K��'�s��s�A�>��wB?��1�6.�ü��w��o{��gjLŜv��N9d�|��聘.�c_��c�i��G����c��,'���2����~�ɸ���R����0�WNЏE�[��1�
0�	0��0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103'��ñ.W-'0
	`�He��J0	*�H��
	1
*�H��
	0/	*�H��
	1" X[�V����r�OL��^o�0��57�/�G0��*�H��
	/1��0��0��0�� ��5�R8�J�Dѧj�6}Mwe�u�qq��r0��0���~0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103'��ñ.W-'0" ��(��zb#E(���^���m�eJ���۾w0
	*�H��
�i/	e^f9a� �'Q�r����[	A�j*��5
�X���.(L��0���'@6�����Ex��'7��F���6�]��:x��?��Z
�֑�Y��sϪ�S������f��.g���PX8�X"e��a�˶�����?3�7�4D����O�?�o�F�W�=�w��4@VO9� m�ׇ&��U�'ܡsz%���7��~|�3z1v�<�m"-�xv�ѿ��J�#�{Kτ��=
�;��VT���1�!��_9���{ɞan��||Ɵzn���WXF�_��m���Y#Bƅ�6���Y=�Ś�>4���ی����HF�e��A�T6s�0�es5v����j	rD}�9�����O�
��%4i,3�G�-~Y#^4y�F�l'��ܹ��ȶ&J6fFZ�G�Bp��1���X}ȹ��l\�Xv���YR4P~��[H1�b�1V/�B����k}��L�Gz�$��c·�ud��s��
�f�h�\��@�Z��