HEX
Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1j PHP/8.4.25
System: Windows NT DESKTOP-4TAV2RJ 10.0 build 19045 (Windows 10) AMD64
User: fred (0)
PHP: 8.4.25
Disabled: NONE
Upload Files
File: C:/Windows/System32/microsoft-windows-system-events.dll
MZ����@���	�!�L�!This program cannot be run in DOS mode.

$5�<�q�R�q�R�q�R�e���p�R�e�P�p�R�Richq�R�PEd�!'�" ��


��B`A ���&T.rdata�@@.rsrc�� �@@!'
TTT!'$��!'��T.rdataT|.rdata$zzzdbg .rsrc$01!x�.rsrc$02 ��Ҽe�d���y['/ߊ�����!'�(���@�X�p�����	�	�	����0%j�! 
WEVT_TEMPLATEMUI4VS_VERSION_INFO��
{aJ
{aJ?|StringFileInfoX040904B0LCompanyNameMicrosoft Corporation|*FileDescriptionMicrosoft-Windows-System-Events Resourcesn'FileVersion10.0.19041.7291 (WinBuild.160101.0800)h$InternalNamemicrosoft-windows-system-events.dll�.LegalCopyright� Microsoft Corporation. All rights reserved.p$OriginalFilenamemicrosoft-windows-system-events.dllj%ProductNameMicrosoft� Windows� Operating SystemDProductVersion10.0.19041.7291DVarFileInfo$Translation	�CRIMh�*���/��G�!D?8�4�X����O�צ���]�!�,�"{+B��/���|�O�p�sO�Q3�=T�0��c�#w[H���V]s]J>?�Y�F�K��B������7v��PY0J���~�W4���"S���K�����D�Ti�U�?�F�M<n(-�U9bi!�{�s[�Ŋ�Su��0;���EJFTzؤ��7x>�<&�1�M�9�ST�B��)}��@�CH�3UH�D��:��E��4V�^�xL�����L���)j��0�d��jT��N�O��a�.��r���;��@����a��.�`:�m�@ZD�ʙ5�PF���������� �fp�I*�})S2H��C�y:�������wA��(:�RRqp�7�u���HF����M<���D�zM�K��	��^SH'���ĜeN�p�V�‰o�C����D�����/␨��v��z�5F��I�ct�Ĭ�C��1D�A�u�e�G���>����EO�C�E�lD����`{MK�f�/e��@�ڊR�_�O��]�(a4N���B��J���;?&��O
'��2
RC�R۫A��Y�R^񿿁�E�|��چ���56�wuC�$�E��7���P.�K��INo
�p���́���^�a�p���*�u�O�Ȯ	ϛ#[
*��~_H�Ot�(q��Hj{�_0*&^җ`"0ʜxm�*��O�F�Sd^G��o���J���M�<��t|���]�hV��M��D��WEVTh���
� \���CHAN0��4���PMicrosoft-Windows-Kernel-WDI/AnalyticLMicrosoft-Windows-Kernel-WDI/DebugXMicrosoft-Windows-Kernel-WDI/OperationalTTBL�
TEMP��p�iS�^(c`lg�ߜ���D�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
A��M�oData5K�NameDroppedEventCount
A��A�oData)K�NameActionCount
A��MZ�ComplexData'K�Name
SemActions
������0@

Xl�ProviderIDEventID(DroppedEventCountActionCountSemActionsProviderIDLevelReservedKeyword$EnablePropertyNTStatusTEMP,|	ڈ6MhY��F�㐍����D�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
�	�	ProviderIDEventIDTEMP��
��mx
[�GH kA����D�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
A��;�oData#K�NameNTStatus
(DXProviderIDEventIDNTStatusTEMP���kg��T�,�pt����VD�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
A��E�oData-K�Name
ScenarioCount
A��cZ�ComplexData=K�NameScenarioInflightItems
��
�
�
�
8LdProviderIDEventID ScenarioCount0ScenarioInflightItemsProviderIDEventIDReserved InflightCountTEMP,Xڈ6MhY��F�㐍����D�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
��ProviderIDEventIDTEMP�D�{�][�9�H�Nh��`D�	EventDataA��?�oData'K�Name
ProviderID
XProviderIDTEMP����mx
[�GH kA����D�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
A��;�oData#K�NameNTStatus
���ProviderIDEventIDNTStatusTEMP��^�=y�T�[�L�g����D�	EventDataA��9�oData!K�NameSqmType
A��7�oDataK�NameSqmSid
SqmTypeSqmSidTEMPD�4H��5�Sp-	�#;��BD�	EventDataA��G�oData/K�NameSqmSessionGuid
A��5�oDataK�NameSqmID
A��9�oData!K�NameSqmType
A��W�oData?K�NameSqmDWORDDatapointValue
�(<$SqmSessionGuidSqmIDSqmType4SqmDWORDDatapointValueTEMP`8/�Z�>]�$�z�q!���D�	EventDataA��G�oData/K�NameSqmSessionGuid
A��5�oDataK�NameSqmID
A��9�oData!K�NameSqmType
A��O�oData7K�NameSqmStreamRowLength
A��QZ�ComplexData+K�NameSqmStreamRow
��� Ll��$SqmSessionGuidSqmIDSqmType,SqmStreamRowLength SqmStreamRow SqmTypeEntry SqmDWORDEntry$SqmStringEntryPRVAP�Microsoft-Windows-Kernel-WDIOPCO<

0�0�0D

0�0�0@0�0�040�0LWDI_SEM_TASK_SCENARIO_OPCODE_STARTHWDI_SEM_TASK_SCENARIO_OPCODE_ENDPWDI_SEM_TASK_SCENARIO_OPCODE_TIMEOUTXWDI_SEM_TASK_SCENARIO_OPCODE_START_FAILEDTWDI_SEM_TASK_SCENARIO_OPCODE_END_FAILEDXWDI_SEM_TASK_SCENARIO_OPCODE_INFLIGHT_MAXLWDI_SEM_TASK_INIT_OPCODE_MISCONFIGPWDI_SEM_TASK_INIT_OPCODE_SCENARIO_MAXtWDI_SEM_TASK_INIT_OPCODE_SCENARIO_CONTEXT_PROVIDER_MAXdWDI_SEM_TASK_INIT_OPCODE_SCENARIO_END_EVENT_MAXPWDI_SEM_TASK_INIT_OPCODE_PROVIDER_MAXLEVL�P�P�P�win:Errorwin:Warning(win:InformationalTASK�		p,

p\0WDI_SEM_TASK_SCENARIO(WDI_SEM_TASK_INITKEYWt!�"�4�contextdiagwin:SQMEVNT� 
	� ��,���!�!	�!��8���!�"	�"��Dt��!�#	@#�pht��$
	@$��	Pt��%	@%��	\t��&
 &���h�'
 '���h�(
 (���h�)
 )���h�*
 *�tth�+������!,����,��!-����p��!������WEVT�a�	"H"�#
yhy�y$z4}x~CHAN04"�SystemMAPS��"�"`"VMAP4�#����VMAP$h#��VMAPL#��	�
���
�dEx:LeapSecondDataParseFailure.FailureResultMapTEx:LeapSecondDataUpdate.UpdateReasonMap@Ex:SystemTimeChange.ReasonMapTTBLUTEMP �$��ۙ�}(V�X}�=����D�	EventDataA��9�oData!K�NameNewTime
A��9�oData!K�NameOldTime
%%NewTimeOldTimeTEMP�4&�xL��W�ְ�2_����D�	EventDataA��9�oData!K�NameNewTime
A��9�oData!K�NameOldTime
A��7�oDataK�NameReason
p&�&`"�&NewTimeOldTimeReasonTEMPlD(���`�W�.��H�����dD�	EventDataA��9�oData!K�NameNewTime
A��9�oData!K�NameOldTime
A��7�oDataK�NameReason
A��A�oData)K�NameProcessName
A��=�oData%K�Name	ProcessID
�(�(`"�(�()NewTimeOldTimeReasonProcessNameProcessIDTEMPPh))5�H7^A����d����D�	EventDataTEMP��*ݙ!=�YZ	�2:����D�	EventDataA��A�oData)K�NameFinalStatus
A��M�oData5K�NameExtraStringLength
A��A�oData)K�NameExtraString
�*�*+FinalStatus(ExtraStringLengthExtraStringTEMP�l,ݙ!=�YZ	�2:����D�	EventDataA��A�oData)K�NameFinalStatus
A��M�oData5K�NameExtraStringLength
A��A�oData)K�NameExtraString
�,�,�,FinalStatus(ExtraStringLengthExtraStringTEMP��.S"��F�Vַkܭy����D�	EventDataA��M�oData5K�NameExtraStringLength
A��A�oData)K�NameExtraString
A��3�oDataK�NameTmId
A��3�oDataK�NameRmId
A��7�oDataK�NameStatus
A��C�oData+K�NameInternalCode
h/�/�/�/�/�/(ExtraStringLengthExtraStringTmIdRmIdStatus InternalCodeTEMP(h1�iC^s�Z<w��i����4D�	EventDataA��G�oData/K�NameHiveNameLength
A��;�oData#K�NameHiveName
A��C�oData+K�NameOriginalSize
A��9�oData!K�NameNewSize
�1�1�12$HiveNameLengthHiveName OriginalSizeNewSizeTEMP0�3�$3�]SW�=�v���8D�	EventDataA��G�oData/K�NameHiveNameLength
A��;�oData#K�NameHiveName
A��A�oData)K�NameKeysUpdated
A��?�oData'K�Name
DirtyPages
�34 4<4$HiveNameLengthHiveNameKeysUpdatedDirtyPagesTEMP��6IS��Z%ZA��\��D�	EventDataA��C�oData+K�NameMajorVersion
A��C�oData+K�NameMinorVersion
A��C�oData+K�NameBuildVersion
A��?�oData'K�Name
QfeVersion
A��G�oData/K�NameServiceVersion
A��;�oData#K�NameBootMode
A��=�oData%K�Name	StartTime
,7L7l7�7�7�7�7 MajorVersion MinorVersion BuildVersionQfeVersion$ServiceVersionBootModeStartTimeTEMP��8zmU�b!A[Ф㸚�7��\D�	EventDataA��;�oData#K�NameStopTime
�8StopTimeTEMP�*�A�>���8U�
�؋����	D�	EventDataA��3�oDataK�NameMode
A��?�oData'K�Name
ObjectType
A��?�oData'K�Name
ObjectName
A��A�oData)K�NameProcessName
A��[�oDataCK�NameObjectCreatorProcessName
A��?�oData'K�Name
AccessMask
A��=�oData%K�Name	TokenType
A��O�oData7K�NameImpersonationLevel
A��=�oData%K�Name	SessionId
A��C�oData+K�NameLowBoxNumber
	A��K�oData3K�NameTokenGroupsCount
A��OZ�ComplexData)K�NameTokenGroups
�A��M�oData5K�NameTokenPackageCount
A��QZ�ComplexData+K�NameTokenPackage

�A��S�oData;K�NameTokenCapabilityCount
A��[Z�ComplexData5K�NameTokenCapabilities
�A��S�oData;K�NameTokenTrustLevelCount
A��WZ�ComplexData1K�NameTokenTrustLevel
�A��_�oDataGK�NameSecurityDescriptorRevision
A��]�oDataEK�NameSecurityDescriptorControl
A��Y�oDataAK�NameSecurityDescriptorOwner
A��Y�oDataAK�NameSecurityDescriptorGroup
A��C�oData+K�NameDaclRevision
A��C�oData+K�NameDaclAceCount
A��GZ�ComplexData!K�NameDaclAce
�A��C�oData+K�NameSaclRevision
A��C�oData+K�NameSaclAceCount
A��GZ�ComplexData!K�NameSaclAce
�DETEpE�E�E�E�EF@FXFxF
�F�F�FG4G\G!�G�G�G$HXH�H�H"�H�HI& I4IXIpI�I�I�I�IJ(JDJPJdJ|J�JModeObjectTypeObjectNameProcessName8ObjectCreatorProcessNameAccessMaskTokenType,ImpersonationLevelSessionId LowBoxNumber(TokenGroupsCountTokenGroups(TokenPackageCount TokenPackage0TokenCapabilityCount(TokenCapabilities0TokenTrustLevelCount$TokenTrustLevel<SecurityDescriptorRevision8SecurityDescriptorControl4SecurityDescriptorOwner4SecurityDescriptorGroup DaclRevision DaclAceCountDaclAce SaclRevision SaclAceCountSaclAce$GroupAttributesGroupSidPackageSid0CapabilityAttributes CapabilitySid TrustLevelSidAceTypeAceFlagsAccessMaskSidAceTypeAceFlagsAccessMaskSidTEMP��O�(�J�S��1�Ol����D�	EventDataA��?�oData'K�Name
ActionName
A��A�oData)K�NameProcessName
A��A�oData)K�NameAccountName
A��E�oData-K�Name
AuthorityName
A��9�oData!K�NameTokenId
A��K�oData3K�NameAuthenticationId
A��=�oData%K�Name	TokenType
A��O�oData7K�NameImpersonationLevel
A��?�oData'K�Name
TokenFlags
A��Y�oDataAK�NameSidValuesReferenceCount
		A��G�oData/K�NameSidValuesCount
A��KZ�ComplexData%K�Name	SidValues
�A��e�oDataMK�NameSharedSidValuesReferenceCount
	A��S�oData;K�NameSharedSidValuesCount

A��WZ�ComplexData1K�NameSharedSidValues
�QQ8QTQtQ�Q�Q�Q�Q		RDR
hR		�R�R
�RS SActionNameProcessNameAccountName AuthorityNameTokenId(AuthenticationIdTokenType,ImpersonationLevelTokenFlags4SidValuesReferenceCount$SidValuesCountSidValues@SharedSidValuesReferenceCount0SharedSidValuesCount$SharedSidValuesSidSidTEMP�lTa8vXZ-�.��U5��D�	EventDataA��Q�oData9K�NameTransitionStartTime
A��A�oData)K�NameCurrentTime
A��K�oData3K�NameSoftRestartCount
�T�T�T,TransitionStartTimeCurrentTime(SoftRestartCountTEMP�W3�>ʬ�]qX?�o��PD�	EventDataA��E�oData-K�Name
MmPhase0Start

A��C�oData+K�NameMmPhase0Stop

A��A�oData)K�NamePhase1Start

A��M�oData5K�NameKsrExtensionStart

A��K�oData3K�NameKsrExtensionStop

A��S�oData;K�NameStartProcessorsStart

A��Q�oData9K�NameStartProcessorsStop



(X

HX

hX

�X

�X

�X

Y MmPhase0Start MmPhase0StopPhase1Start(KsrExtensionStart(KsrExtensionStop0StartProcessorsStart,StartProcessorsStopTEMPH		d\.]�7�<P���G����D�	EventDataA��E�oData-K�Name
MmPhase0Start

A��C�oData+K�NameMmPhase0Stop

A��A�oData)K�NamePhase1Start

A��M�oData5K�NameKsrExtensionStart

A��K�oData3K�NameKsrExtensionStop

A��S�oData;K�NameStartProcessorsStart

A��Q�oData9K�NameStartProcessorsStop

A��Q�oData9K�NameAutoLoggerInitStart

A��O�oData7K�NameAutoLoggerInitStop



]

8]

X]

t]

�]

�]

�]

 ^

L^ MmPhase0Start MmPhase0StopPhase1Start(KsrExtensionStart(KsrExtensionStop0StartProcessorsStart,StartProcessorsStop,AutoLoggerInitStart,AutoLoggerInitStopTEMP�

c�����Sx1�?D����RD�	EventDataA��E�oData-K�Name
MmPhase0Start

A��C�oData+K�NameMmPhase0Stop

A��A�oData)K�NamePhase1Start

A��M�oData5K�NameKsrExtensionStart

A��K�oData3K�NameKsrExtensionStop

A��S�oData;K�NameStartProcessorsStart

A��Q�oData9K�NameStartProcessorsStop

A��Q�oData9K�NameAutoLoggerInitStart

A��O�oData7K�NameAutoLoggerInitStop

A��E�oData-K�Name
MmPhase1Start
	
A��C�oData+K�NameMmPhase1Stop

A��Y�oDataAK�NameHalPhase0StartCycleTime

A��W�oData?K�NameHalPhase0StopCycleTime



d

$d

Dd

`d

�d

�d

�d

e

8e

de

�e

�e

�e MmPhase0Start MmPhase0StopPhase1Start(KsrExtensionStart(KsrExtensionStop0StartProcessorsStart,StartProcessorsStop,AutoLoggerInitStart,AutoLoggerInitStop MmPhase1Start MmPhase1Stop4HalPhase0StartCycleTime4HalPhase0StopCycleTimeTEMP��jc	�3�s]ѽ�6����D�	EventDataA��E�oData-K�Name
MmPhase0Start

A��C�oData+K�NameMmPhase0Stop

A��A�oData)K�NamePhase1Start

A��M�oData5K�NameKsrExtensionStart

A��K�oData3K�NameKsrExtensionStop

A��S�oData;K�NameStartProcessorsStart

A��Q�oData9K�NameStartProcessorsStop

A��Q�oData9K�NameAutoLoggerInitStart

A��O�oData7K�NameAutoLoggerInitStop

A��E�oData-K�Name
MmPhase1Start
	
A��C�oData+K�NameMmPhase1Stop

A��Y�oDataAK�NameHalPhase0StartCycleTime

A��W�oData?K�NameHalPhase0StopCycleTime

A��7�oDataK�NameMmMark

�

�k

l

(l

Dl

ll

�l

�l

�l

m

Hm

hm

�m

�m

�m MmPhase0Start MmPhase0StopPhase1Start(KsrExtensionStart(KsrExtensionStop0StartProcessorsStart,StartProcessorsStop,AutoLoggerInitStart,AutoLoggerInitStop MmPhase1Start MmPhase1Stop4HalPhase0StartCycleTime4HalPhase0StopCycleTimeMmMarkTEMP hopE�mm��R
f��<�����.D�	EventDataA��C�oData+K�NameUpdateReason
A��?�oData'K�Name
EnabledNew

A��;�oData#K�NameCountNew
A��;�oData#K�NameCountOld
�"�o

�o�op UpdateReasonEnabledNewCountNewCountOldTEMP��pDs;��^P�#�@ݕ3��fD�	EventDataA��E�oData-K�Name
FailureResult
�"�p FailureResultTEMP �qU{x��]��ۡ�|�F���D�	EventDataA��9�oData!K�NameNewBias
A��9�oData!K�NameOldBias
�qrNewBiasOldBiasTEMP		�t�y��%�P���|����XD�	EventDataA��G�oData/K�NameVsmCleanupTime

A��7�oDataK�NameMark#0

A��7�oDataK�NameMark#1

A��7�oDataK�NameMark#2

A��7�oDataK�NameMark#3

A��7�oDataK�NameMark#4

A��7�oDataK�NameMark#5

A��7�oDataK�NameMark#6

A��7�oDataK�NameMark#7



Tu

xu

�u

�u

�u

�u

�u

�u

v$VsmCleanupTimeMark#0Mark#1Mark#2Mark#3Mark#4Mark#5Mark#6Mark#7TEMP��w��5���X��4_+���D�	EventDataA��?�oData'K�Name
ExitReason
A��A�oData)K�NameCurrentBias
A��M�oData5K�NameCurrentTimeZoneID
A��[�oDataCK�NameTimeZoneInfoCacheUpdated
A��C�oData+K�NameFirstRefresh
Xxtx�x�x�xExitReasonCurrentBias(CurrentTimeZoneID8TimeZoneInfoCacheUpdated FirstRefreshPRVAX$yMicrosoft-Windows-Kernel-GeneralOPCO01�ywin:InfoLEVL�P�yP�yP�ywin:Errorwin:Warning(win:InformationalTASK����d{�����{�����{�����{�����{����|����@|����||	�����|
�����|�����|SystemStartSystemStop SoftBootInfo,BootPerformanceData(SystemTimeChange0LeapSecondDataUpdate<LeapSecondDataParseFailure,TimeZoneBiasChange,VsmPerformanceData$ReorganizeHive<TimeZoneInformationRefreshKEYWD�} �����}@����~�����T~<KERNEL_GENERAL_KEYWORD_TIMELKERNEL_GENERAL_SECURITY_ACCESSCHECKLKERNEL_GENERAL_TOKEN_SID_MANAGEMENT$BootPerformanceEVNT��$ty�y8�$"��(%ty�y�z<�$"��&ty�y�z@�$"�)ty�y$"�)ty�y$"�)ty�y$"�h)�y$"�8+�y$"�-ty�y$"��X4ty�y0zD�$"
��
�7ty�yLzH�$" �����8�yL�
�0ty�y,{$"�(2ty�y$"@�����J�yP���,Sty�yhzT�$"�����Uty�y�zX������0Yty�y�z\������x^ty�y�z`������fty�y�zd��nty�y�zh�$"�$pty�y�zl�$"��pty�y�zp�$"	�����rty�y{t��vty�yH{x�$"@}@}@}p}p}P}`}p}p}p}p}p}@}@}@}p}@}WEVT�s�	ԃH���
��P�������CHANt�����XMicrosoft-Windows-Kernel-Process/AnalyticMAPSLX�BMAPt�� ProcessFlagsTTBLdaTEMP�P�
�q���=[�u�����T��|D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��I�oData1K�NameParentProcessID
A��=�oData%K�Name	SessionID
A��=�oData%K�Name	ImageName
��̆��$�ProcessIDCreateTime$ParentProcessIDSessionIDImageNameTEMP�(��a#�m6Z�&M�lk���D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��I�oData1K�NameParentProcessID
A��=�oData%K�Name	SessionID
A��5�oDataK�NameFlags
A��=�oData%K�Name	ImageName
����ԉ��X�� �ProcessIDCreateTime$ParentProcessIDSessionIDFlagsImageNameTEMP$

h�	�	�<RW�@�\:<����D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��I�oData1K�NameParentProcessID
A��=�oData%K�Name	SessionID
A��5�oDataK�NameFlags
A��=�oData%K�Name	ImageName
A��E�oData-K�Name
ImageChecksum
A��E�oData-K�Name
TimeDateStamp
A��I�oData1K�NamePackageFullName
A��S�oData;K�NamePackageRelativeAppId
	0�H�d���X�����Ȏ��,�ProcessIDCreateTime$ParentProcessIDSessionIDFlagsImageName ImageChecksum TimeDateStamp$PackageFullName0PackageRelativeAppIdTEMPX`��}�T#]�Q\c^r����D�	EventDataA��=�oData%K�Name	ProcessID
A��U�oData=K�NameProcessSequenceNumber

A��?�oData'K�Name
CreateTime
A��I�oData1K�NameParentProcessID
A��a�oDataIK�NameParentProcessSequenceNumber

A��=�oData%K�Name	SessionID
A��5�oDataK�NameFlags
A��]�oDataEK�NameProcessTokenElevationType
A��W�oData?K�NameProcessTokenIsElevated
A��G�oData/K�NameMandatoryLabel
	A��=�oData%K�Name	ImageName
A��E�oData-K�Name
ImageChecksum
A��E�oData-K�Name
TimeDateStamp
A��I�oData1K�NamePackageFullName

A��S�oData;K�NamePackageRelativeAppId
��

��ԕ�

�P�X�h�x����� �@�`���ProcessID0ProcessSequenceNumberCreateTime$ParentProcessID<ParentProcessSequenceNumberSessionIDFlags8ProcessTokenElevationType4ProcessTokenIsElevated$MandatoryLabelImageName ImageChecksum TimeDateStamp$PackageFullName0PackageRelativeAppIdTEMP�		��(�G���X�P�@;����D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��;�oData#K�NameExitTime
A��;�oData#K�NameExitCode
A��O�oData7K�NameTokenElevationType
A��A�oData)K�NameHandleCount
A��C�oData+K�NameCommitCharge

A��?�oData'K�Name
CommitPeak

A��=�oData%K�Name	ImageName
8�P�l�����ț

�

� �ProcessIDCreateTimeExitTimeExitCode,TokenElevationTypeHandleCount CommitChargeCommitPeakImageNameTEMP��E��ZY�Aty����D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��;�oData#K�NameExitTime
A��;�oData#K�NameExitCode
A��O�oData7K�NameTokenElevationType
A��A�oData)K�NameHandleCount
A��C�oData+K�NameCommitCharge

A��?�oData'K�Name
CommitPeak

A��E�oData-K�Name
CPUCycleCount

A��O�oData7K�NameReadOperationCount
	A��Q�oData9K�NameWriteOperationCount
A��U�oData=K�NameReadTransferKiloBytes
A��W�oData?K�NameWriteTransferKiloBytes
A��G�oData/K�NameHardFaultCount

A��=�oData%K�Name	ImageName
4�L�h�����Ģ

�

�

�<�h���ģ���ProcessIDCreateTimeExitTimeExitCode,TokenElevationTypeHandleCount CommitChargeCommitPeak CPUCycleCount,ReadOperationCount,WriteOperationCount0ReadTransferKiloBytes4WriteTransferKiloBytes$HardFaultCountImageNameTEMP�`��Uk ݂Z5g'��י����D�	EventDataA��=�oData%K�Name	ProcessID
A��U�oData=K�NameProcessSequenceNumber

A��?�oData'K�Name
CreateTime
A��;�oData#K�NameExitTime
A��;�oData#K�NameExitCode
A��O�oData7K�NameTokenElevationType
A��A�oData)K�NameHandleCount
A��C�oData+K�NameCommitCharge

A��?�oData'K�Name
CommitPeak

A��E�oData-K�Name
CPUCycleCount
	
A��O�oData7K�NameReadOperationCount
A��Q�oData9K�NameWriteOperationCount
A��U�oData=K�NameReadTransferKiloBytes
A��W�oData?K�NameWriteTransferKiloBytes

A��G�oData/K�NameHardFaultCount
A��=�oData%K�Name	ImageName
��

�����4�`�

|�

��

��ث�0�`�����ProcessID0ProcessSequenceNumberCreateTimeExitTimeExitCode,TokenElevationTypeHandleCount CommitChargeCommitPeak CPUCycleCount,ReadOperationCount,WriteOperationCount0ReadTransferKiloBytes4WriteTransferKiloBytes$HardFaultCountImageNameTEMPx		���nUh�2X�l"�&�����D�	EventDataA��=�oData%K�Name	ProcessID
A��;�oData#K�NameThreadID
A��=�oData%K�Name	StackBase
A��?�oData'K�Name
StackLimit
A��E�oData-K�Name
UserStackBase
A��G�oData/K�NameUserStackLimit
A��=�oData%K�Name	StartAddr
A��G�oData/K�NameWin32StartAddr
A��9�oData!K�NameTebBase
P�h�������԰���4�ProcessIDThreadIDStackBaseStackLimit UserStackBase$UserStackLimitStartAddr$Win32StartAddrTebBaseTEMP�

`�Q���]���1�T���D�	EventDataA��=�oData%K�Name	ProcessID
A��;�oData#K�NameThreadID
A��=�oData%K�Name	StackBase
A��?�oData'K�Name
StackLimit
A��E�oData-K�Name
UserStackBase
A��G�oData/K�NameUserStackLimit
A��=�oData%K�Name	StartAddr
A��G�oData/K�NameWin32StartAddr
A��9�oData!K�NameTebBase
A��E�oData-K�Name
SubProcessTag
	(�@�X�p�����е�� �ProcessIDThreadIDStackBaseStackLimit UserStackBase$UserStackLimitStartAddr$Win32StartAddrTebBase SubProcessTagTEMPh����*my_\ǻ�.���&D�	EventDataA��=�oData%K�Name	ProcessID
A��;�oData#K�NameThreadID
A��=�oData%K�Name	StackBase
A��?�oData'K�Name
StackLimit
A��E�oData-K�Name
UserStackBase
A��G�oData/K�NameUserStackLimit
A��=�oData%K�Name	StartAddr
A��G�oData/K�NameWin32StartAddr
A��9�oData!K�NameTebBase
A��E�oData-K�Name
SubProcessTag
	A��=�oData%K�Name	CycleTime

x�������ܺ�� �8�\�p�
��ProcessIDThreadIDStackBaseStackLimit UserStackBase$UserStackLimitStartAddr$Win32StartAddrTebBase SubProcessTagCycleTimeTEMP����|hGH}V�Ȋ`�j�%��
D�	EventDataA��=�oData%K�Name	ImageBase
A��=�oData%K�Name	ImageSize
A��=�oData%K�Name	ProcessID
A��E�oData-K�Name
ImageCheckSum
A��E�oData-K�Name
TimeDateStamp
A��A�oData)K�NameDefaultBase
A��=�oData%K�Name	ImageName
t�������ܾ���ImageBaseImageSizeProcessID ImageCheckSum TimeDateStampDefaultBaseImageNameTEMP�p���|hGH}V�Ȋ`�j�%��
D�	EventDataA��=�oData%K�Name	ImageBase
A��=�oData%K�Name	ImageSize
A��=�oData%K�Name	ProcessID
A��E�oData-K�Name
ImageCheckSum
A��E�oData-K�Name
TimeDateStamp
A��A�oData)K�NameDefaultBase
A��=�oData%K�Name	ImageName
���,�D�d�����ImageBaseImageSizeProcessID ImageCheckSum TimeDateStampDefaultBaseImageNameTEMP���UU�?��M���0D�	EventDataA��=�oData%K�Name	ProcessID
A��;�oData#K�NameThreadID
A��A�oData)K�NameOldPriority
A��A�oData)K�NameNewPriority
l�������ProcessIDThreadIDOldPriorityNewPriorityTEMP�t�2�>!��xX�6�f��P��jD�	EventDataA��I�oData1K�NameFrozenProcessID
��$FrozenProcessIDTEMPL��Env�z��_�����%�����D�	EventDataA��I�oData1K�NameFrozenProcessID
A��?�oData'K�Name
CreateTime
����$FrozenProcessIDCreateTimeTEMP���7ά��Y���`�������D�	EventDataA��C�oData+K�NameContainer ID
A��7�oDataK�NameJob ID
A��?�oData'K�Name
StatusCode
P�p��� Container IDJob IDStatusCodeTEMP���.�n]�y�]b�A��"�h���D�	EventDataA��7�oDataK�NameJob ID
A��M�oData5K�NameDiskIoAttribution
A��?�oData'K�Name
StatusCode
��@�Job ID(DiskIoAttributionStatusCodeTEMPL�w묌
�U��	o	&���D�	EventDataA��7�oDataK�NameJob ID
A��E�oData-K�Name
IoRateControl
A��A�oData)K�NameControlType
A��;�oData#K�NameRateType
A��?�oData'K�Name
RateAmount
A��?�oData'K�Name
StatusCode
�������,�H�Job ID IoRateControlControlTypeRateTypeRateAmountStatusCodeTEMP,����Z�ePSG�(/7�'���D�	EventDataA��7�oDataK�NameJob ID
A��E�oData-K�Name
IoRateControl
A��9�oData!K�NameMaxIops

A��C�oData+K�NameMaxBandwidth

A��G�oData/K�NameMaxTimePercent

A��I�oData1K�NameReservationIops

A��S�oData;K�NameReservationBandwidth

A��W�oData?K�NameReservationTimePercent

A��Y�oDataAK�NameCriticalReservationIops

A��c�oDataKK�NameCriticalReservationBandwidth
	
A��g�oDataOK�NameCriticalReservationTimePercent

A��C�oData+K�NameControlFlags
A��?�oData'K�Name
VolumeName
A��?�oData'K�Name
StatusCode

D�X�

x�

��

��

��

��

$�

X�

��

���0�L�Job ID IoRateControlMaxIops MaxBandwidth$MaxTimePercent$ReservationIops0ReservationBandwidth4ReservationTimePercent4CriticalReservationIops@CriticalReservationBandwidthDCriticalReservationTimePercent ControlFlagsVolumeNameStatusCodeTEMP�	 ��̶�:�S�S�[����D�	EventDataA��7�oDataK�NameJob ID
A��E�oData-K�Name
IoRateControl
A��9�oData!K�NameMaxIops

A��C�oData+K�NameMaxBandwidth

A��G�oData/K�NameMaxTimePercent

A��I�oData1K�NameReservationIops

A��S�oData;K�NameReservationBandwidth

A��W�oData?K�NameReservationTimePercent

A��Y�oDataAK�NameCriticalReservationIops

A��c�oDataKK�NameCriticalReservationBandwidth
	
A��g�oDataOK�NameCriticalReservationTimePercent

A��A�oData)K�NameSoftMaxIops

A��K�oData3K�NameSoftMaxBandwidth

A��O�oData7K�NameSoftMaxTimePercent


A��C�oData+K�NameControlFlags
A��?�oData'K�Name
VolumeName
A��?�oData'K�Name
StatusCode
t���

��

��

��

�

$�

T�

��

��

��

@�

\�

��������Job ID IoRateControlMaxIops MaxBandwidth$MaxTimePercent$ReservationIops0ReservationBandwidth4ReservationTimePercent4CriticalReservationIops@CriticalReservationBandwidthDCriticalReservationTimePercentSoftMaxIops(SoftMaxBandwidth,SoftMaxTimePercent ControlFlagsVolumeNameStatusCodeTEMP���_P‹5Z��<���L���D�	EventDataA��Y�oDataAK�NameOldWorkOnBehalfThreadID
A��Y�oDataAK�NameNewWorkOnBehalfThreadID
@�t�4OldWorkOnBehalfThreadID4NewWorkOnBehalfThreadIDTEMP���F@mQ�)�Vنo���D�	EventDataA��C�oData+K�NameContainer ID
A��7�oDataK�NameJob ID
A��5�oDataK�NameState
���,� Container IDJob IDStateTEMP�\��.���U�x`ߑ�ׂ���D�	EventDataA��C�oData+K�NameContainer ID
A��7�oDataK�NameJob ID
A��A�oData)K�NameMonitorName
������ Container IDJob IDMonitorNameTEMPD�h���[a�BZ����(D�	EventDataA��C�oData+K�NameContainer ID
A��7�oDataK�NameJob ID
A��7�oDataK�NameStatus
A��A�oData)K�NameMonitorName
�������� Container IDJob IDStatusMonitorNamePRVAX�Microsoft-Windows-Kernel-ProcessOPCOx1��2��2��win:Infowin:Startwin:StopLEVL@P��(win:InformationalTASK����������,�����H�����d�������������������������	�����
����8�����`�
���������������������������������,�����d� ProcessStartProcessStopThreadStartThreadStopImageLoadImageUnload0CpuBasePriorityChange(CpuPriorityChange,PagePriorityChange(IoPriorityChange ProcessFreezeJobStart JobTerminate$ProcessRundown,PsDiskIoAttribution$PsIoRateControl8ThreadWorkOnBehalfUpdate,JobServerSiloStartKEYWl����L� ������@�����������������,�����p�����������������L� ������@������8WINEVENT_KEYWORD_PROCESS4WINEVENT_KEYWORD_THREAD4WINEVENT_KEYWORD_IMAGE@WINEVENT_KEYWORD_CPU_PRIORITYDWINEVENT_KEYWORD_OTHER_PRIORITYDWINEVENT_KEYWORD_PROCESS_FREEZE0WINEVENT_KEYWORD_JOBhWINEVENT_KEYWORD_ENABLE_PROCESS_TRACING_CALLBACKS4WINEVENT_KEYWORD_JOB_IODWINEVENT_KEYWORD_WORK_ON_BEHALF8WINEVENT_KEYWORD_JOB_SILOEVNT0(����h���������<�h���������8�h���������\�h�����������t���0������8�t���0������4�t���0���� ��Ьh���L���� ��H�h���L���� ��Ьt���h���� ��@�t���h����@����\��������@��0�\�������������\������������\�������		�	���\�������

�
���\����������h���,�������h���,�������t���,�������t���,���

�
���h���H�������t���d�����8�\���������\�\�����������\�����������h���������������t�������������\�h������������d�h������������h�h������������\�t������������d�t������������h�t������� ������\�������@�������\�������@�����<�h����� ��@�������t�����$��@�����<�h�����(��@�����<�t�����,�������������������������������������������������������������,�<�<�<�<�<�WEVT�F���h�
�',((0h0�2X5CHAN������������\Microsoft-Windows-Kernel-Registry/Analytic`Microsoft-Windows-Kernel-Registry/PerformanceTTBLl/TEMP`�4��zw�_Q
f��i�N���D�	EventDataA��?�oData'K�Name
BaseObject
A��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��A�oData)K�NameDisposition
A��;�oData#K�NameBaseName
A��C�oData+K�NameRelativeName
��� �<�T�BaseObjectKeyObjectStatusDispositionBaseName RelativeNameTEMP�������u�Y[`q��BsK���D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��9�oData!K�NameKeyName
����KeyObjectStatusKeyNameTEMPx4�C���^ζUGr������D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
A��K�oData3K�NameCapturedDataSize
A��C�oData+K�NameCapturedData
����0XKeyObjectStatusInfoClassDataSizeKeyName(CapturedDataSize CapturedDataTEMP4�U���yZ[A��u����D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��3�oDataK�NameType
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
A��=�oData%K�Name	ValueName
A��K�oData3K�NameCapturedDataSize
A��C�oData+K�NameCapturedData
A��K�oData3K�NamePreviousDataType
A��K�oData3K�NamePreviousDataSize
	A��[�oDataCK�NamePreviousDataCapturedSize
A��C�oData+K�NamePreviousData
$<P`x����<
tKeyObjectStatusTypeDataSizeKeyNameValueName(CapturedDataSize CapturedData(PreviousDataType(PreviousDataSize8PreviousDataCapturedSize PreviousDataTEMP��5|��
U'VO��C���� D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��9�oData!K�NameKeyName
A��=�oData%K�Name	ValueName
8PdxKeyObjectStatusKeyNameValueNameTEMP��Y܄$[�F�@L����BD�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
A��=�oData%K�Name	ValueName
A��K�oData3K�NameCapturedDataSize
A��C�oData+K�NameCapturedData
����0XKeyObjectStatusInfoClassDataSizeKeyNameValueName(CapturedDataSize CapturedDataTEMP���f�C��V��`����%��:D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��5�oDataK�NameIndex
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
A��K�oData3K�NameCapturedDataSize
A��C�oData+K�NameCapturedData
������0KeyObjectStatusIndexInfoClassDataSizeKeyName(CapturedDataSize CapturedDataTEMPp�B!��Q>�Ƅ����dD�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��?�oData'K�Name
EntryCount
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
Ldx��KeyObjectStatusEntryCountDataSizeKeyNameTEMPx�C���^ζUGr������D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
A��K�oData3K�NameCapturedDataSize
A��C�oData+K�NameCapturedData
������KeyObjectStatusInfoClassDataSizeKeyName(CapturedDataSize CapturedDataTEMP<Zv��NɋP�};�ɖ���D�	EventDataA��C�oData+K�NameHiveFilePath
A��;�oData#K�NameFileSize
<\ HiveFilePathFileSizeTEMP\`%{�1�Uϫ+F�����D�	EventDataA��G�oData/K�NameTotalEntrySize
A��G�oData/K�NameBytesRecovered
��$TotalEntrySize$BytesRecoveredTEMP�d9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
xStatusCodeTEMPT|/���mT6#W�|4����D�	EventDataA��C�oData+K�NameHiveFilePath
A��G�oData/K�NameHiveMountPoint
�� HiveFilePath$HiveMountPointTEMP�|9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
�StatusCodeTEMP��ݯ��I^vo��X���D�	EventDataA��C�oData+K�NameHiveFilePath
A��G�oData/K�NameHiveMountPoint
A��?�oData'K�Name
FlushFlags
4X HiveFilePath$HiveMountPointFlushFlagsTEMP�i����T;�qW��w��fD�	EventDataA��E�oData-K�Name
BytesGathered
$ BytesGatheredTEMP��i����T;�qW��w��fD�	EventDataA��E�oData-K�Name
BytesGathered
� BytesGatheredTEMPL�˦i��=I_��Nm�;���D�	EventDataA��C�oData+K�NameWritesIssued
A��C�oData+K�NameBytesWritten
  @  WritesIssued BytesWrittenTEMPLD!˦i��=I_��Nm�;���D�	EventDataA��C�oData+K�NameWritesIssued
A��C�oData+K�NameBytesWritten
l!�! WritesIssued BytesWrittenTEMP�@"9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
T"StatusCodeTEMP$@#V��U�V6Q�D��Y7{���D�	EventDataA��?�oData'K�Name
SourceFile
A��5�oDataK�NameFlags
h#�#SourceFileFlagsTEMP�($9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
<$StatusCodeTEMP$(%V��U�V6Q�D��Y7{���D�	EventDataA��?�oData'K�Name
SourceFile
A��5�oDataK�NameFlags
P%l%SourceFileFlagsTEMP�&9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
$&StatusCodeTEMP��&��*K�tS
f�g<����fD�	EventDataA��E�oData-K�Name
SourceKeyPath
�& SourceKeyPathTEMP��'9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
�'StatusCodePRVAX�'Microsoft-Windows-Kernel-RegistryOPCO�!2�)2�)
�����)
����<*
�����*
�����*����+����P+�����+�����+����,����X,�����,
�����,����-����\-�����-����. ����P.!����h."����|.#�����.$�����.%�����.&�����.'����/(����,/)����T/*�����/+�����/,�����/-�����/.����0win:Startwin:StopHRegPerfOpHiveMountBaseFileMountedPRegPerfOpHiveFlushBecameActiveFlusherHRegPerfOpShutdownRundownComplete4RegPerfOpSaveFileCopiedHRegPerfOpHiveMountLogEntryAppliedHRegPerfOpHiveFlushGatheredLogData<RegPerfOpShutdownFlushStart4RegPerfOpSaveTreeCopiedPRegPerfOpHiveFlushGatheredPrimaryData<RegPerfOpShutdownFlushStop8RegPerfOpSaveFileWrittenDRegPerfOpHiveFlushWroteLogFileLRegPerfOpHiveFlushWrotePrimaryFileTRegPerfOpHiveFlushBoostedActiveFlusherPRegPerfOpHiveFlushStartWaitForActivePRegPerfOpHiveFlushFinishWaitForActiveCreateKeyOpenKeyDeleteKeyQueryKeySetValueKey$DeleteValueKey QueryValueKey EnumerateKey(EnumerateValueKey0QueryMultipleValueKey(SetInformationKeyFlushKeyCloseKey(QuerySecurityKey$SetSecurityKeyLEVL@P@0(win:InformationalTASKs81sh1s�1s�1s�1s 2sT20RegPerfTaskHiveMount0RegPerfTaskHiveUnload0RegPerfTaskHiveFlush,RegPerfTaskShutdown,RegPerfTaskHiveLoad4RegPerfTaskHiveRestore,RegPerfTaskHiveSaveKEYW�����|3�����3�����3�����3 ����4@����84�����`4����x4�����4�����4�����4�����4 ����5@����$5�����<5CloseKey(QuerySecurityKey$SetSecurityKey(EnumerateValueKey0QueryMultipleValueKey(SetInformationKeyFlushKeySetValueKey$DeleteValueKey QueryValueKey EnumerateKeyCreateKeyOpenKeyDeleteKeyQueryKeyEVNT�- �����t�)40�=��! �����t�)40�=��"@�����t�()40�=��#�������4)40�=��$�����x@)40�=��%������L)40�=��&������X)40�=��'�����xd)40�=��	(�����xp)40�=��
) �����P|)40�=��*@�������)40>��+������t��)40>��
,�����t��)40>��-�����t��)40>��.�����t��)40>��@����8(40t0��
@����8P(40t0��@����t�(40t0��@�����D(40t0��@�����8(40�0��@�����D(40�0��@�����8(40�0��
@����\(40�0��@����t�(40�0��@����D�(40�0��
@�����(40�0��@�����(40�0��@�����(40�0��@�����(40�0��@����)40�0��@�����!D(40�0�� @����8(40�0��!@����8(40�0��"@�����(40�0��#@�����(40�0��$@����D(40�0��%@����p"8(40�0��&@�����#D(40�0��'@����X$8(401��(@����|%D(401��)@����@&8(401��*
@����t(401��+@�����(401��,@�����(401��-@����'D(401��<3L3\3l3�233,3�2�2�2�2�2�2�2WEVT���	l>�>�@
�������� �CHANt�>����XMicrosoft-Windows-Kernel-Acpi/DiagnosticMAPS�h?�> ?D?VMAP$�?��VMAP$@@��VMAP$|@��VMAPd�?
��	�
���
���	�,MapAcpiOverrideTypeHMapActiveCoolingDevicePowerState<MapAmlMethodInvocationState MapResetTypeTTBL�TEMPLPC}9/��`XuN�y����tD�	EventDataA��C�oData+K�NameResourceFlag
A��A�oData)K�NameGeneralFlag
A��K�oData3K�NameTypeSpecificFlag
A��A�oData)K�NameGranularity

A��?�oData'K�Name
AddressMin

A��?�oData'K�Name
AddressMax

A��O�oData7K�NameAddressTranslation

A��E�oData-K�Name
AddressLength

�CD,D
TD
pD
�D
�D
�D ResourceFlagGeneralFlag(TypeSpecificFlagGranularityAddressMinAddressMax,AddressTranslation AddressLengthTEMP\�E�K���;T]��cAl쪙���D�	EventDataA��A�oData)K�NameGpeRegister
A��O�oData7K�NameUnexpectedEventMap
F$FGpeRegister,UnexpectedEventMapTEMP��J�m��_:����Rt���D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
	A��3�oDataK�Name_AC6
A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9

A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
�K$L\LlL|L�L�L�L�L�L�L�L�LMM,MDThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance_TMP_PSV_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRTTEMPHdP�~���\K�+I���S���D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��O�oData7K�NameActiveCoolingLevel
A��[�oDataCK�NameActiveCoolingDeviceIndex
A��Y�oDataAK�NameFanDeviceInstanceLength
A��M�oData5K�NameFanDeviceInstance
A��K�oData3K�NamePowerStateLength
A��?�oData'K�Name
PowerState
QHQ�Q�Q�QR@RhRDThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance,ActiveCoolingLevel8ActiveCoolingDeviceIndex4FanDeviceInstanceLength(FanDeviceInstance(PowerStateLengthPowerStateTEMP�XUn�V^�_V?��{Lv���D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��O�oData7K�NameActiveCoolingLevel
A��[�oDataCK�NameActiveCoolingDeviceIndex
A��Y�oDataAK�NameFanDeviceInstanceLength
A��M�oData5K�NameFanDeviceInstance
A��?�oData'K�Name
PowerState
�U(V`V�V�V�V�> WDThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance,ActiveCoolingLevel8ActiveCoolingDeviceIndex4FanDeviceInstanceLength(FanDeviceInstancePowerStateTEMP�xX��]}�[���q�M��D�	EventDataA��S�oData;K�NameDeviceInstanceLength
A��G�oData/K�NameDeviceInstance
A��?�oData'K�Name
PowerState
�X�X�>Y0DeviceInstanceLength$DeviceInstancePowerStateTEMP�\Z��۸�̫S����m`���D�	EventDataA��S�oData;K�NameDeviceInstanceLength
A��G�oData/K�NameDeviceInstance
A��;�oData#K�NameThrottle
�Z�Z�Z0DeviceInstanceLength$DeviceInstanceThrottleTEMPX�\A*7���U�
G9P����JD�	EventDataA��S�oData;K�NameDeviceInstanceLength
A��G�oData/K�NameDeviceInstance
A��?�oData'K�Name
PowerState
A��;�oData#K�NameThrottle
�\]�>(]D]0DeviceInstanceLength$DeviceInstancePowerStateThrottleTEMP@�^��j�焴Y�E��3rZ��6D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��A�oData)K�NameTemperature
_H_�_DThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstanceTemperatureTEMPt,a�]��S���X�;@��ZD�	EventDataA��Q�oData9K�NameAmlMethodNameLength
A��E�oData-K�Name
AmlMethodName
A��G�oData/K�NameAmlMethodState
A��G�oData/K�NameAmlElapsedTime

|a�a ?�a

�a,AmlMethodNameLength AmlMethodName$AmlMethodState$AmlElapsedTimeTEMP�Hc��k�_�]�6����D�	EventDataA��Q�oData9K�NameAmlMethodNameLength
A��E�oData-K�Name
AmlMethodName
A��=�oData%K�Name	Frequency

�c�c

�c,AmlMethodNameLength AmlMethodNameFrequencyTEMP,,�o���q"^�8�Iy,���zD�	EventDataA��]�oDataEK�NameThermalZoneBiosNameLength
A��Q�oData9K�NameThermalZoneBiosName
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_TC1
A��3�oDataK�Name_TC2
A��3�oDataK�Name_TSP
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
	A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
A��3�oDataK�Name_AC6

A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9
A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
A��3�oDataK�Name_NTT
A��=�oData%K�Name	_PSLCount
A��A�oData)K�Name_PSLEntries
�A��=�oData%K�Name	_TZDCount
A��A�oData)K�Name_TZDEntries
�A��=�oData%K�Name	_AL0Count
A��A�oData)K�Name_AL0Entries
�A��=�oData%K�Name	_AL1Count
A��A�oData)K�Name_AL1Entries
�A��=�oData%K�Name	_AL2Count
A��A�oData)K�Name_AL2Entries
�A��=�oData%K�Name	_AL3Count
A��A�oData)K�Name_AL3Entries
�A��=�oData%K�Name	_AL4Count
 A��A�oData)K�Name_AL4Entries
!�A��=�oData%K�Name	_AL5Count
"A��A�oData)K�Name_AL5Entries
#�A��=�oData%K�Name	_AL6Count
$A��A�oData)K�Name_AL6Entries
%�A��=�oData%K�Name	_AL7Count
&A��A�oData)K�Name_AL7Entries
'�A��=�oData%K�Name	_AL8Count
(A��A�oData)K�Name_AL8Entries
)�A��=�oData%K�Name	_AL9Count
*A��A�oData)K�Name_AL9Entries
+�s@sls|s�s�s�s�s�s�s�s�stt,t<tLt\tlt|t�t�t�t�t�tu(u@u\utu�u�u�u �u�u"v,v$Dv`v&xv�v(�v�v*�v8ThermalZoneBiosNameLength,ThermalZoneBiosName_TMP_PSV_TC1_TC2_TSP_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRT_NTT_PSLCount_PSLEntries_TZDCount_TZDEntries_AL0Count_AL0Entries_AL1Count_AL1Entries_AL2Count_AL2Entries_AL3Count_AL3Entries_AL4Count_AL4Entries_AL5Count_AL5Entries_AL6Count_AL6Entries_AL7Count_AL7Entries_AL8Count_AL8Entries_AL9Count_AL9EntriesTEMP�--��~����kU�RQ��ow����D�	EventDataA��]�oDataEK�NameThermalZoneBiosNameLength
A��Q�oData9K�NameThermalZoneBiosName
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_TC1
A��3�oDataK�Name_TC2
A��3�oDataK�Name_TSP
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
	A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
A��3�oDataK�Name_AC6

A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9
A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
A��3�oDataK�Name_NTT
A��=�oData%K�Name	_PSLCount
A��A�oData)K�Name_PSLEntries
�A��=�oData%K�Name	_TZDCount
A��A�oData)K�Name_TZDEntries
�A��=�oData%K�Name	_AL0Count
A��A�oData)K�Name_AL0Entries
�A��=�oData%K�Name	_AL1Count
A��A�oData)K�Name_AL1Entries
�A��=�oData%K�Name	_AL2Count
A��A�oData)K�Name_AL2Entries
�A��=�oData%K�Name	_AL3Count
A��A�oData)K�Name_AL3Entries
�A��=�oData%K�Name	_AL4Count
 A��A�oData)K�Name_AL4Entries
!�A��=�oData%K�Name	_AL5Count
"A��A�oData)K�Name_AL5Entries
#�A��=�oData%K�Name	_AL6Count
$A��A�oData)K�Name_AL6Entries
%�A��=�oData%K�Name	_AL7Count
&A��A�oData)K�Name_AL7Entries
'�A��=�oData%K�Name	_AL8Count
(A��A�oData)K�Name_AL8Entries
)�A��=�oData%K�Name	_AL9Count
*A��A�oData)K�Name_AL9Entries
+�A��I�oData1K�NameMinimumThrottle
,��������$�4�D�T�d�t���������ćԇ����8�P�l�������Ԉ�� �<� T�p�"����$��؉&��($�@�*X�t�8ThermalZoneBiosNameLength,ThermalZoneBiosName_TMP_PSV_TC1_TC2_TSP_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRT_NTT_PSLCount_PSLEntries_TZDCount_TZDEntries_AL0Count_AL0Entries_AL1Count_AL1Entries_AL2Count_AL2Entries_AL3Count_AL3Entries_AL4Count_AL4Entries_AL5Count_AL5Entries_AL6Count_AL6Entries_AL7Count_AL7Entries_AL8Count_AL8Entries_AL9Count_AL9Entries$MinimumThrottleTEMP�00h����p`�~S�㔿�,�����D�	EventDataA��]�oDataEK�NameThermalZoneBiosNameLength
A��Q�oData9K�NameThermalZoneBiosName
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_TC1
A��3�oDataK�Name_TC2
A��3�oDataK�Name_TSP
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
	A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
A��3�oDataK�Name_AC6

A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9
A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
A��3�oDataK�Name_NTT
A��=�oData%K�Name	_PSLCount
A��A�oData)K�Name_PSLEntries
�A��=�oData%K�Name	_TZDCount
A��A�oData)K�Name_TZDEntries
�A��=�oData%K�Name	_AL0Count
A��A�oData)K�Name_AL0Entries
�A��=�oData%K�Name	_AL1Count
A��A�oData)K�Name_AL1Entries
�A��=�oData%K�Name	_AL2Count
A��A�oData)K�Name_AL2Entries
�A��=�oData%K�Name	_AL3Count
A��A�oData)K�Name_AL3Entries
�A��=�oData%K�Name	_AL4Count
 A��A�oData)K�Name_AL4Entries
!�A��=�oData%K�Name	_AL5Count
"A��A�oData)K�Name_AL5Entries
#�A��=�oData%K�Name	_AL6Count
$A��A�oData)K�Name_AL6Entries
%�A��=�oData%K�Name	_AL7Count
&A��A�oData)K�Name_AL7Entries
'�A��=�oData%K�Name	_AL8Count
(A��A�oData)K�Name_AL8Entries
)�A��=�oData%K�Name	_AL9Count
*A��A�oData)K�Name_AL9Entries
+�A��I�oData1K�NameMinimumThrottle
,A��3�oDataK�Name_CR3
-A��3�oDataK�Name_TFP
.A��U�oData=K�NameOverThrottleThreshold
/(�`���������̛ܛ�����,�<�L�\�l�|�������Ĝ����,�H�`�|�����ȝ� ���"0�L�$d���&����(̞�*��@�P�`�8ThermalZoneBiosNameLength,ThermalZoneBiosName_TMP_PSV_TC1_TC2_TSP_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRT_NTT_PSLCount_PSLEntries_TZDCount_TZDEntries_AL0Count_AL0Entries_AL1Count_AL1Entries_AL2Count_AL2Entries_AL3Count_AL3Entries_AL4Count_AL4Entries_AL5Count_AL5Entries_AL6Count_AL6Entries_AL7Count_AL7Entries_AL8Count_AL8Entries_AL9Count_AL9Entries$MinimumThrottle_CR3_TFP0OverThrottleThresholdTEMP22�� ���;;Rwi��Q���6
D�	EventDataA��]�oDataEK�NameThermalZoneBiosNameLength
A��Q�oData9K�NameThermalZoneBiosName
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_TC1
A��3�oDataK�Name_TC2
A��3�oDataK�Name_TSP
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
	A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
A��3�oDataK�Name_AC6

A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9
A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
A��3�oDataK�Name_NTT
A��=�oData%K�Name	_PSLCount
A��A�oData)K�Name_PSLEntries
�A��=�oData%K�Name	_TZDCount
A��A�oData)K�Name_TZDEntries
�A��=�oData%K�Name	_AL0Count
A��A�oData)K�Name_AL0Entries
�A��=�oData%K�Name	_AL1Count
A��A�oData)K�Name_AL1Entries
�A��=�oData%K�Name	_AL2Count
A��A�oData)K�Name_AL2Entries
�A��=�oData%K�Name	_AL3Count
A��A�oData)K�Name_AL3Entries
�A��=�oData%K�Name	_AL4Count
 A��A�oData)K�Name_AL4Entries
!�A��=�oData%K�Name	_AL5Count
"A��A�oData)K�Name_AL5Entries
#�A��=�oData%K�Name	_AL6Count
$A��A�oData)K�Name_AL6Entries
%�A��=�oData%K�Name	_AL7Count
&A��A�oData)K�Name_AL7Entries
'�A��=�oData%K�Name	_AL8Count
(A��A�oData)K�Name_AL8Entries
)�A��=�oData%K�Name	_AL9Count
*A��A�oData)K�Name_AL9Entries
+�A��I�oData1K�NameMinimumThrottle
,A��3�oDataK�Name_CR3
-A��3�oDataK�Name_TFP
.A��U�oData=K�NameOverThrottleThreshold
/A��M�oData5K�NameDescriptionLength
0A��A�oData)K�NameDescription
1��H�X�h�x���������ȱر�����(�8�H�X�h�������в���8�P�l����� ��Գ"��$ �<�&T�p�(����*��ش����L�0t�8ThermalZoneBiosNameLength,ThermalZoneBiosName_TMP_PSV_TC1_TC2_TSP_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRT_NTT_PSLCount_PSLEntries_TZDCount_TZDEntries_AL0Count_AL0Entries_AL1Count_AL1Entries_AL2Count_AL2Entries_AL3Count_AL3Entries_AL4Count_AL4Entries_AL5Count_AL5Entries_AL6Count_AL6Entries_AL7Count_AL7Entries_AL8Count_AL8Entries_AL9Count_AL9Entries$MinimumThrottle_CR3_TFP0OverThrottleThreshold(DescriptionLengthDescriptionTEMP\334�bH׮�5S��E$�7"��p
D�	EventDataA��]�oDataEK�NameThermalZoneBiosNameLength
A��Q�oData9K�NameThermalZoneBiosName
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_TC1
A��3�oDataK�Name_TC2
A��3�oDataK�Name_TSP
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
	A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
A��3�oDataK�Name_AC6

A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9
A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
A��3�oDataK�Name_NTT
A��=�oData%K�Name	_PSLCount
A��A�oData)K�Name_PSLEntries
�A��=�oData%K�Name	_TZDCount
A��A�oData)K�Name_TZDEntries
�A��=�oData%K�Name	_AL0Count
A��A�oData)K�Name_AL0Entries
�A��=�oData%K�Name	_AL1Count
A��A�oData)K�Name_AL1Entries
�A��=�oData%K�Name	_AL2Count
A��A�oData)K�Name_AL2Entries
�A��=�oData%K�Name	_AL3Count
A��A�oData)K�Name_AL3Entries
�A��=�oData%K�Name	_AL4Count
 A��A�oData)K�Name_AL4Entries
!�A��=�oData%K�Name	_AL5Count
"A��A�oData)K�Name_AL5Entries
#�A��=�oData%K�Name	_AL6Count
$A��A�oData)K�Name_AL6Entries
%�A��=�oData%K�Name	_AL7Count
&A��A�oData)K�Name_AL7Entries
'�A��=�oData%K�Name	_AL8Count
(A��A�oData)K�Name_AL8Entries
)�A��=�oData%K�Name	_AL9Count
*A��A�oData)K�Name_AL9Entries
+�A��I�oData1K�NameMinimumThrottle
,A��3�oDataK�Name_CR3
-A��3�oDataK�Name_TFP
.A��U�oData=K�NameOverThrottleThreshold
/A��M�oData5K�NameDescriptionLength
0A��A�oData)K�NameDescription
1A��3�oDataK�Name_TZP
20�h�����������������$�4�D�T�d�t���������������4�P�h����������� � �"8�T�$l���&����(����*�$�H�X�h���0����8ThermalZoneBiosNameLength,ThermalZoneBiosName_TMP_PSV_TC1_TC2_TSP_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRT_NTT_PSLCount_PSLEntries_TZDCount_TZDEntries_AL0Count_AL0Entries_AL1Count_AL1Entries_AL2Count_AL2Entries_AL3Count_AL3Entries_AL4Count_AL4Entries_AL5Count_AL5Entries_AL6Count_AL6Entries_AL7Count_AL7Entries_AL8Count_AL8Entries_AL9Count_AL9Entries$MinimumThrottle_CR3_TFP0OverThrottleThreshold(DescriptionLengthDescription_TZPTEMP�����N��2]���7y�L����D�	EventDataA��M�oData5K�NameFanBiosNameLength
A��A�oData)K�NameFanBiosName
A��C�oData+K�NameFstSupported

A��?�oData'K�Name
PowerState
A��9�oData!K�NameControl
�4�

P��>p���(FanBiosNameLengthFanBiosName FstSupportedPowerStateControlTEMP���v��'_�֓
3�>���D�	EventDataA��M�oData5K�NameFanBiosNameLength
A��A�oData)K�NameFanBiosName
A��?�oData'K�Name
PowerState
�4��>P�(FanBiosNameLengthFanBiosNamePowerStateTEMP������
�(�Z��Ӗ���z���D�	EventDataA��M�oData5K�NameFanBiosNameLength
A��A�oData)K�NameFanBiosName
A��9�oData!K�NameControl
�����(FanBiosNameLengthFanBiosNameControlTEMP`<��-F)徤^Y(K�P��C���D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��S�oData;K�NameDeviceInstanceLength
A��G�oData/K�NameDeviceInstance
A��?�oData'K�Name
PowerState
�����L��>p�DThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance0DeviceInstanceLength$DeviceInstancePowerStateTEMPl��7i�u�p]^H���)���D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��S�oData;K�NameDeviceInstanceLength
A��G�oData/K�NameDeviceInstance
A��E�oData-K�Name
ThrottleLimit
�L�������DThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance0DeviceInstanceLength$DeviceInstance ThrottleLimitTEMP`|�ro�窯Q�Z�ٍ����PD�	EventDataA��S�oData;K�NameDeviceBiosNameLength
A��G�oData/K�NameDeviceBiosName
A��I�oData1K�NameDeviceResetType
A��7�oDataK�NameStatus
����D? �D�0DeviceBiosNameLength$DeviceBiosName$DeviceResetTypeStatusTEMP���]�	V�DW�gguF��lD�	EventDataA��K�oData3K�NameAcpiOverrideType
h?�(AcpiOverrideTypeTEMP|<�!6�;xv0R��F��*����D�	EventDataA��5�oDataK�NameScope
A��7�oDataK�NameObject
A��7�oDataK�NameStatus
x�����ScopeObjectStatusPRVAP��Microsoft-Windows-Kernel-AcpiOPCOLEVL�P<�PT�Pp�win:Errorwin:Warning(win:InformationalTASKDd�����e����8�f����`�g������h������i������j���� �k����L�l����|�m������n������o�����p�����q����H�r����l�s������t������u�����v����`�w����|�x������y������,ResourceTranslation(GpeEventHandling4TemperatureNotification0TripPointNotification8ActiveCoolingDevicePower$AmlMethodTrace,DeviceActiveCooling0DevicePassiveCooling0DeviceCoolingRundown(TemperatureChange,ThermalZoneRundownFanRundown,FanPowerStateChange$FanStatusChange4ActiveCoolingConstraintDActiveCoolingConstraintRundown8PassiveCoolingConstraintDPassiveCoolingConstraintRundownDeviceReset AcpiOverrideAMLIError(FrequentAmlMethodKEYW@����H�����l������� ������@�������������$acpi:Diagnostic acpi:Thermal0ms:ReservedKeyword40 ms:Telemetryms:Measures$ms:CriticalDataEVNT�d���@0���@�x>e���D0���D�x>f��PF0���H�x>g��PF0���L�x>h��<M0��P�x>h���R0��T�x>i ���_0�0�X�x>j��<W0�L�`�x>	k�	�$Y0�h�d�x>
l�
�[0���h�x>m�����\]0���l�x>n������c0���p�x>n������v0���t�x>n�������0���x�x>n�������0���|�x>n�������0�����x>
o�������0�����x>p�������0�����x>q�����l�0����x>r�����,�0�,���x>s�����,�0�H���x>t�������0�d���x>u�������0�����x>v ����0�����x>w ��X�0�����x>x��4������x>y��b$�����x>���������������������������������������������������������WEVT(���
�D�t�,�8�p�CHAND�	�`�����������ApplicationXMicrosoft-Windows-User-Loader/OperationalTMicrosoft-Windows-User-Loader/AnalyticTTBL�

TEMP����<z�#aSl3�z�R���\D�	EventDataA��;�oData#K�NameFileName
��FileNameTEMP�d�T��̫�[��L?��ZD�	EventDataA��9�oData!K�NameDllName
x�DllNameTEMP���S�C�Rd���7!C%���D�	EventDataA��]�oDataEK�NameProcessFileNamePathLength
A��Q�oData9K�NameProcessFileNamePath
����8ProcessFileNamePathLength,ProcessFileNamePathTEMP�T�
n��f�S��}�<���D�	EventDataA��E�oData-K�Name
FailureReason
A��E�oData-K�Name
ImportDllName
A��C�oData+K�NameExportModule
������ FailureReason ImportDllName ExportModuleTEMP�����[�t_�(m4�>�A���]EventXML+�xmlnsUser-Loader��&.�
FailureReason
��&�
ImportDllName
��,1ProcessImagePath
4�T�t� FailureReason ImportDllName(ProcessImagePathTEMPLx�԰R�7nU]=�	���A���]EventXML+�xmlnsUser-Loader��,1ProcessImagePath
��&��
CurDirDllPath
����(ProcessImagePath CurDirDllPathTEMP��R ֿy�pTZ4,�X��A���]EventXML+�xmlnsUser-Loader��,1ProcessImagePath
��&��
CurDirDllPath
��$��FoundDllPath
,�T�t�(ProcessImagePath CurDirDllPath FoundDllPathTEMP��(/E��TRO�^�]L���D�	EventDataA��E�oData-K�Name
FailureReason
A��E�oData-K�Name
ImportDllName
A��K�oData3K�NameProcessImagePath
�(�H� FailureReason ImportDllName(ProcessImagePathTEMP���<z�#aSl3�z�R���\D�	EventDataA��;�oData#K�NameFileName
�FileNameTEMP�\�ϙ���G\���{�ɼ>���D�	EventDataA��=�oData%K�Name	ProcessId
A��U�oData=K�NameSuspendProcessRequest
A��9�oData!K�NameDLLName
�����ProcessId0SuspendProcessRequestDLLNamePRVAP�Microsoft-Windows-User-LoaderOPCO01\�win:InfoLEVL�U��P�P�P� win:Criticalwin:Errorwin:Warning(win:InformationalTASKKEYW4�� �@@����	�
�LUSER_LOADER_KEYWORD_DEPRECATED_DLLPUSER_LOADER_FATAL_CALLBACK_EXCEPTIONHUSER_LOADER_KEYWORD_LOAD_FAILURE@USER_LOADER_LAUNCH_16BIT_APPTUSER_LOADER_KEYWORD_COMPONENT_ON_DEMANDPUSER_LOADER_KEYWORD_LOAD_FATAL_ERROREVNTp ��P����4�  ���P����4�@ 
��P����4�� �p�P����4� �,�P����4� ��P����4� ��P����4� 
$�P���4�	 	��P����4�
	�
��P����	���P����	���P����D�T�d�t���������WEVTt�(
�H��CHAN�D����lMicrosoft-Windows-Kernel-BootDiagnostics/DiagnosticPRVAh�Microsoft-Windows-Kernel-BootDiagnosticsOPCO020win:StartLEVL@P`(win:InformationalTASKD������SystemBootKEYWD1�(win:ResponseTimeEVNTD�������$T�P4�WEVT�5����� 
H2�23X35X5CHAN|�����`Microsoft-Windows-Kernel-Prefetch/DiagnosticTTBL(.
TEMPh�	{]�̝�S�V��..Ϫ��RD�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
0Pt,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeTEMP�	��0�nd^ᥦ�\�-y��6D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��E�oData-K�Name
PrefetchPhase
A��C�oData+K�NamePrefetchType
A��G�oData/K�NameIsTricklePhase
�	�	�	�	
<
\
,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType PrefetchPhase PrefetchType$IsTricklePhaseTEMP��;�
/�T�'�6z�f���>D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��M�oData5K�NamePrefetchPhaseMask
A��C�oData+K�NamePrefetchType
A��G�oData/K�NameIsTricklePhase
�
�
�
�
8X,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType(PrefetchPhaseMask PrefetchType$IsTricklePhaseTEMP		���Q�NoY���A����D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��E�oData-K�Name
PrefetchPhase
A��C�oData+K�NamePrefetchType
A��G�oData/K�NameIsTricklePhase
A��O�oData7K�NameNumPagesPrefetched

A��C�oData+K�NameNumReadLists
<h����

0\,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType PrefetchPhase PrefetchType$IsTricklePhase,NumPagesPrefetched NumReadListsTEMP		���|Xo�^{�k�1�l���D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��M�oData5K�NamePrefetchPhaseMask
A��C�oData+K�NamePrefetchType
A��G�oData/K�NameIsTricklePhase
A��O�oData7K�NameNumPagesPrefetched

A��C�oData+K�NameNumReadLists
Dp����

@l,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType(PrefetchPhaseMask PrefetchType$IsTricklePhase,NumPagesPrefetched NumReadListsTEMP�`��<޲5�U�K���v����D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��E�oData-K�Name
PrefetchPhase
��4T,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType PrefetchPhaseTEMP�P*�B�eh9[�������D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��M�oData5K�NamePrefetchPhaseMask
��$D,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType(PrefetchPhaseMaskTEMPh�	{]�̝�S�V��..Ϫ��RD�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
D p � � ,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeTEMP��"�.d�2ˮV��O��`���D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��=�oData%K�Name	EndReason
#0#P#t#�#,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeEndReasonTEMP�&������\Ic�ܑ(���0D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��A�oData)K�NameActionFlags
A��A�oData)K�NameTraceReason
A��G�oData/K�NamePrefetchReason
�&�&�&','H'd',ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeActionFlagsTraceReason$PrefetchReasonTEMP�		�*�Y�	U��Z����������D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��A�oData)K�NameActionFlags
A��A�oData)K�NameTraceReason
A��G�oData/K�NamePrefetchReason
A��A�oData)K�NameNumLaunches
A��W�oData?K�NameTimeSinceLastLaunchInS
H+t+�+�+�+�+,4,P,,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeActionFlagsTraceReason$PrefetchReasonNumLaunches4TimeSinceLastLaunchInSTEMP�X.Z
G,�GQ��W93�����D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��G�oData/K�NameWorkItemsCount
�.�./,/L/,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType$WorkItemsCountTEMP�<1ޞoد=�QI���������D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��=�oData%K�Name	NumPhases
�1�1�1202,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeNumPhasesPRVAX\2Microsoft-Windows-Kernel-PrefetchOPCOx1�22�223win:Infowin:Startwin:StopLEVL@P03(win:InformationalTASK�����(4����P4����x4�����4�����4	�����4
�����4(PrefetchSections(PrefetchMetadataOpenVolumesEndTrace(ScenarioDecision GetReadListsAsyncWorkerKEYWD ����,5(BasicInformationEVNT� �������2$3d3�8� ������
�2$3d3�8� �����|�2$3d3�8� �����|�2$3d3�8� �������2$3�3�8� �����t�2$3�3�8� �������2$3�3�8� �����t�2$3�3�8� �����l�2$3�3�8� �����l�2$3�3�8� ������ �2$3�3�8� ������#�2$3�3�8� ������'�2$3�3�8�		 ������,�2$3�3�8�
	 �����,�2$3�39�
 �����p/�2$349�
 �����,�2$349�

 �����,�2$349�555555555555555555WEVT �`9�9
 :`:l:�:�:�:CHANd|9�HMicrosoft-Windows-UAC/OperationalTTBL\TEMPP :)5�H7^A����d����D�	EventDataPRVA@4:Microsoft-Windows-UACOPCOLEVL0P�:win:ErrorTASKH�����: CreateProcessKEYWEVNT@���9x:�:l9WEVTH��;<
H=�=�=�=,>8>CHAN��;�hMicrosoft-Windows-Security-Adminless/OperationalTTBLDTEMP8�<�/c���UX�q��r�Y���D�	EventDataA��A�oData)K�NameFailureTime
A��=�oData%K�Name	StackHash
=0=FailureTimeStackHashPRVA`\=Microsoft-Windows-Security-AdminlessOPCOLEVL0P�=win:ErrorTASKH����> AccessFailureKEYWEVNT@��<�=�=�;WEVT�	�>l?
�@0A<AlA�A�ACHAN��>�Microsoft-Windows-Security-LessPrivilegedAppContainer/OperationalTTBLDTEMP8T@�/c���UX�q��r�Y���D�	EventDataA��A�oData)K�NameFailureTime
A��=�oData%K�Name	StackHash
|@�@FailureTimeStackHashPRVA��@Microsoft-Windows-Security-LessPrivilegedAppContainerOPCOLEVL0PTAwin:ErrorTASKH�����A AccessFailureKEYWEVNT@�
x?HAxA�>WEVT��PB�B
lC�C�CD(DxDCHAN`lB����DMicrosoft-Windows-COM/AnalyticTTBL�TEMP�HC�w�Nm\"l):��N��VD�	EventDataA��5�oDataK�NameCLSID
\CCLSIDPRVA@�CMicrosoft-Windows-COMOPCO01�Cwin:InfoLEVL@P�C(win:InformationalTASKKEYWLDD0COM_CLASSNOTREG_ERROREVNTD���B�C�C�D\B4DWEVT��EDE
LJ�J�J0K<KHKCHAN8(E	�ApplicationTTBLTEMPHdF���̧��Vv�@�gA����8Path��xmlnsDhttp://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0��&Q
AttemptedPath
xF AttemptedPathTEMP��G���Ew��\�C_�_�3A����PathAndGuid��xmlnsDhttp://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0��&Q
AttemptedPath
��"��SrpRuleGuid
H,H AttemptedPathSrpRuleGuidTEMP�I7z7�--Wj�Mi(JRA��@%�PathGuidAndRule��xmlnsDhttp://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0��&Q
AttemptedPath
��"��SrpRuleGuid
����RulePath
�IJ4J AttemptedPathSrpRuleGuidRulePathPRVAp`JMicrosoft-Windows-SoftwareRestrictionPoliciesOPCOLEVLhP�JPKwin:Warning(win:InformationalTASKKEYWEVNT02	�2	�F�JEa	�a	PE�JEb	�b	HH�JEc	�c	PE�JEd	�d	�F�JEr	�r	�F�JEWEVTp��LN
]L]l^�^�_�_CHANPM�\M��M��M�HMicrosoft-Windows-MUI/Operational<Microsoft-Windows-MUI/AdminDMicrosoft-Windows-MUI/Analytic<Microsoft-Windows-MUI/DebugTTBL�TEMP��N$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
�NStatusTEMP�hO�<z�#aSl3�z�R���\D�	EventDataA��;�oData#K�NameFileName
|OFileNameTEMP��P;o��s\fj������D�	EventDataA��;�oData#K�NameFileName
A��3�oDataK�NameType
A��C�oData+K�NameFunctionName
�P�PQFileNameType FunctionNameTEMP��Q�<z�#aSl3�z�R���\D�	EventDataA��;�oData#K�NameFileName
�QFileNameTEMP$PS�*z�8�WM
sWR�	���2D�	EventDataA��5�oDataK�NameFlags
A��A�oData)K�NameNewLanguage
A��C�oData+K�NamePrevLanguage
A��C�oData+K�NameExtendedFlag
�S�S�S�SFlagsNewLanguage PrevLanguage ExtendedFlagTEMP�0U �ُ_�<�vw����D�	EventDataA��;�oData#K�NameFileName
A��C�oData+K�NameFunctionName
A��A�oData)K�NameReturnValue
lU�U�UFileName FunctionNameReturnValueTEMP�TV)�Y�?��T0��U�����^D�	EventDataA��=�oData%K�Name	Parameter
hVParameterTEMPP�V)5�H7^A����d����D�	EventDataTEMPP W)5�H7^A����d����D�	EventDataTEMP��W4�=��|NP5��pk7��TD�	EventDataA��3�oDataK�NameName
�WNameTEMP��X�f��dY��x(������D�	EventDataA��E�oData-K�Name
NewCacheIndex
A��G�oData/K�NameLiveCacheIndex
A��7�oDataK�NameConfig
0YPYtY NewCacheIndex$LiveCacheIndexConfigTEMP�Z?~�v|�Uj��]�4���^D�	EventDataA��=�oData%K�Name	ErrorCode
0ZErrorCodeTEMP�[aM?��iV����"D�	EventDataA��;�oData#K�NameFileName
A��;�oData#K�NameAffinity
A��;�oData#K�NameSequence
A��;�oData#K�NamePriority
�[\ \8\FileNameAffinitySequencePriorityTEMP��\�<z�#aSl3�z�R���\D�	EventDataA��;�oData#K�NameFileName
�\FileNamePRVA@ ]Microsoft-Windows-MUIOPCO :�]:�]  :�]!!:^"":0^##:L^$$:\^Initialize$InvokeCallback DisableCache$UpdateManifestBuildCacheEntryExitLEVL�P�^P�^P�^win:Errorwin:Warning(win:InformationalTASK�z<_zl_0NotifyLanguageChange RescacheBuildKEYWEVNTP����$Nd]x^_�L�@���Nd]x^_�L�@���Od]x^_�L�@��,Qd]x^_�L�@��,Qd]x^_�L�����VX]x^ _�L�����VX]x^ _�L� ����Vp]x^ _�L�����VX]x^ _�L�!@���V|]x^ _�L�!����V|]x^ _�L�"����Y�]x^ _�L�"����V�]x^ _�L�����VX]x^ _�L�����QX]�^_�L����Td]�^_�L�����UX]�^ _�L�!��HZ|]�^ _M�" �� W�]�^ _�L�" �� W�]�^ _�L�"����W�]�^ _�L�# �� W�]�^ _�L�$ �� W�]�^ _�L�# �� W�]�^ _�L�$ �� W�]�^ _�L�!��P\|]�^ _M�����VX]�^ _�L�" ���V�]�^ _�LWEVT,8e$f
�k(l�lm0oxoCHAN�de�����e����\Microsoft-Windows-Kernel-AppCompat/GeneraldMicrosoft-Windows-Kernel-AppCompat/PerformanceTTBL�TEMP��gc��snGa_�!(�y���bD�	EventDataA��S�oData;K�NameExecutablePathLength
A��G�oData/K�NameExecutablePath
A��O�oData7K�NameRegistryPathLength
A��C�oData+K�NameRegistryPath
hHhlh�h0ExecutablePathLength$ExecutablePath,RegistryPathLength RegistryPathTEMP�Li9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
`iStatusCodeTEMPP�jj��F<U�Z����8���JD�	EventDataA��E�oData-K�Name
KeyNameLength
A��9�oData!K�NameKeyName
A��Q�oData9K�NameParentKeyNameLength
A��E�oData-K�Name
ParentKeyName
Lklk�k�k KeyNameLengthKeyName,ParentKeyNameLength ParentKeyNamePRVA\�kMicrosoft-Windows-Kernel-AppCompatOPCOx1Xl2pl2�lwin:Infowin:Startwin:StopLEVLdP�lP�lwin:Error(win:InformationalTASK,�����m����n����<n����`n�����n�����n�����n�����n$CompatCacheInit(CompatCacheQuery$CompatCdbQuery$CompatMapQuirks(CompatCacheUpdate,CompatUserModeQuery$CompatSdbQuery4CompatCacheQueryProcessKEYWH����Lo,RegWrpAccessDeniedEVNTt�60f4l�l�rDe@����@l�lmTe@�����hLl�lmTe@����@l�l�mTe@�����hLl�l�mTe@����@l�l,mTe@�����hLl�l,mTe@����@l�lHmTe	@�����hLl�lHmTe
@����@l�ldmTe@�����hLl�ldmTe@����@l�l�mTe
@�����hLl�l�mTe@����@l�l�mTe@�����hLl�l�mTe@����@l�l�mTe@�����hLl�l�mTe��	|i�lDe<oWEVT,-4s
X����������TTBL$TEMP�t\��S�CL�93���� D�	EventDataA��Y�oDataAK�NamecchAppPathIncludingNull
A��_�oDataGK�NameApplicationImageHeaderHash
A��9�oData!K�NameAppPath
�tu@u4cchAppPathIncludingNull<ApplicationImageHeaderHashAppPathTEMP|Pv}�풚T�Xh���������D�	EventDataA��A�oData)K�NameFeatureGuid
A��_�oDataGK�NameApplicationImageHeaderHash
xv�vFeatureGuid<ApplicationImageHeaderHashTEMP4@x��H�^�m#��!���:D�	EventDataA��A�oData)K�NameFeatureGuid
A��C�oData+K�NameCallerIdType
A��C�oData+K�NamecchImagePath
A��=�oData%K�Name	ImagePath
�x�x�x�xFeatureGuid CallerIdType cchImagePathImagePathTEMP��zx�a8p�RX1��z�`���D�	EventDataA��i�oDataQK�NamecchParentImagePathIncludingNull
A��A�oData)K�NameFeatureGuid
A��c�oDataKK�NameParentProcessImageHeaderHash
A��I�oData1K�NameParentImagePath
{X{t{�{DcchParentImagePathIncludingNullFeatureGuid@ParentProcessImageHeaderHash$ParentImagePathTEMP		�~U��[W_���y��x���D�	EventDataA��5�oDataK�NameFlags
A��[�oDataCK�NamecchIdStringIncludingNull
A��Y�oDataAK�NamecchDllPathIncludingNull
A��;�oData#K�NameCategory
A��I�oData1K�NameManifestVersion
A��E�oData-K�Name
DllHeaderHash
A��_�oDataGK�NameApplicationImageHeaderHash
A��;�oData#K�NameIdString
A��9�oData!K�NameDllPath
����4�X�x���̀Flags8cchIdStringIncludingNull4cchDllPathIncludingNullCategory$ManifestVersion DllHeaderHash<ApplicationImageHeaderHashIdStringDllPathTEMPx�]ng��P\��\堟����D�	EventDataA��5�oDataK�NameFlags
A��[�oDataCK�NamecchIdStringIncludingNull
A��;�oData#K�NameCategory
A��I�oData1K�NameManifestVersion
A��_�oDataGK�NameApplicationImageHeaderHash
A��;�oData#K�NameIdString
����ȃ��@�Flags8cchIdStringIncludingNullCategory$ManifestVersion<ApplicationImageHeaderHashIdStringPRVA@l�Microsoft-Windows-AITOPCOLEVL@P��(win:InformationalTASK�����������Ѕ���������������D�����p�������AitFeature,AitParentAitFeatureAitAppInfo,AitSystemUsageByDll,AitSystemUsageByExe AitProcessEndKitFeatureKEYWEVNT`����Tu�������y�������@s��(������{��D��������`�������|������v����WEVTx0`�
\����8�D�P�TTBL�TEMP����{��U+0"�����vD�	EventDataA��U�oData=K�NameAeLookupServieTrigger
,�0AeLookupServieTriggerPRVA�p�Microsoft-Windows-ApplicationExperience-LookupServiceTriggerOPCOLEVL@P�(win:InformationalTASKKEYWEVNT@����l��WEVT�.�D�
���������CHANd����������������hMicrosoft-Windows-Kernel-ApphelpCache/Operational\Microsoft-Windows-Kernel-ApphelpCache/DebugdMicrosoft-Windows-Kernel-ApphelpCache/AnalyticTTBL�TEMP��_�Yn5�]�S�#����pD�	EventDataA��O�oData7K�NameOperationalMessage
�,OperationalMessageTEMP�̍nШ)�\�����{���bD�	EventDataA��A�oData)K�NameInfoMessage
�InfoMessageTEMP���$&��_��XB�8'�;���dD�	EventDataA��C�oData+K�NameDebugMessage
�� DebugMessageTEMPTH�G'L46߬U��|�8����LD�	EventDataA��9�oData!K�NameMatches

A��A�oData)K�NameCheckerName
A��E�oData-K�Name
AttributeName
A��W�oData?K�NameAttributeExpectedValue


����Ȑ�MatchesCheckerName AttributeName4AttributeExpectedValueTEMPT���B���S%�N���*���LD�	EventDataA��9�oData!K�NameMatches

A��A�oData)K�NameCheckerName
A��E�oData-K�Name
AttributeName
A��W�oData?K�NameAttributeExpectedValue


���<�MatchesCheckerName AttributeName4AttributeExpectedValueTEMPT�N�T3��*T}�O�(�U���LD�	EventDataA��9�oData!K�NameMatches

A��A�oData)K�NameCheckerName
A��E�oData-K�Name
AttributeName
A��W�oData?K�NameAttributeExpectedValue


@�T�p���MatchesCheckerName AttributeName4AttributeExpectedValueTEMPTD�^T����Q
1����M���LD�	EventDataA��9�oData!K�NameMatches

A��A�oData)K�NameCheckerName
A��E�oData-K�Name
AttributeName
A��W�oData?K�NameAttributeExpectedValue



����ė

�MatchesCheckerName AttributeName4AttributeExpectedValuePRVAp,�Microsoft-Windows-ApplicationExperience-CacheOPCOLEVLdP��PИwin:Error(win:InformationalTASKKEYWEVNT`�3P���� 44����@5������@4Ȏ����@4�����@4p�����	@4ĕ����WEVT�
/��
d���,�0�@�TTBL�
TEMPx�No��X�Z-YT��i����D�	EventDataA��K�oData3K�NameSwitchBranchGuid
A��W�oData?K�NameSwitchBranchNameLength
A��K�oData3K�NameSwitchBranchName
A��e�oDataMK�NameSwitchBranchDescriptionLength
A��Y�oDataAK�NameSwitchBranchDescription
D�l���ȝ�(SwitchBranchGuid4SwitchBranchNameLength(SwitchBranchName@SwitchBranchDescriptionLength4SwitchBranchDescriptionTEMP����O���P�.��>$��D�	EventDataA��S�oData;K�NameSwitchBranchImplGuid
A��_�oDataGK�NameSwitchBranchImplNameLength
A��S�oData;K�NameSwitchBranchImplName
A��m�oDataUK�Name!SwitchBranchImplDescriptionLength
A��a�oDataIK�NameSwitchBranchImplDescription
��P���ȡ0SwitchBranchImplGuid<SwitchBranchImplNameLength0SwitchBranchImplNameHSwitchBranchImplDescriptionLength<SwitchBranchImplDescriptionTEMPt���=�t�\U�����ZD�	EventDataA��M�oData5K�NameTargetContextGuid
A��M�oData5K�NameTargetContextType
A��K�oData3K�NameModuleNameLength
A��?�oData'K�Name
ModuleName
��4�\�(TargetContextGuid(TargetContextType(ModuleNameLengthModuleNameTEMP� �mUl���S��G4�1���tD�	EventDataA��S�oData;K�NameContextUpdateCounter



4�0ContextUpdateCounterPRVA|x�Microsoft-Windows-ApplicationExperience-SwitchBackOPCOLEVL@P�(win:InformationalTASK����������������ئ�����AeSbCallAeSbImpl(AeSbContextUpdate0AeSbContextReadRetryKEYWEVNT�����Ě��8�����<���T��������p�����x�����WEVT`'�`�Ԩ
H���D���8���CHANt|�����XMicrosoft-Windows-Kernel-Network/AnalyticTTBLtTEMP(

��l\FX_TR4Ԅ/"\��zD�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��;�oData#K�Namestartime
A��9�oData!K�Nameendtime
A��7�oDataK�Nameseqnum
A��7�oDataK�Nameconnid
	X�d�t���������̬��PIDsizedaddrsaddrdportsportstartimeendtimeseqnumconnidTEMPP4�ؕ�`�]O QjYDz����D�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��7�oDataK�Nameseqnum
A��7�oDataK�Nameconnid
ԯ���� �0�D�PIDsizedaddrsaddrdportsportseqnumconnidTEMP(D�A�r���S����K������D�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��1�oDataK�Namemss
A��9�oData!K�Namesackopt
A��5�oDataK�Nametsopt
A��5�oDataK�Namewsopt
	A��7�oDataK�Namercvwin
A��A�oData)K�Namercvwinscale
A��A�oData)K�Namesndwinscale
A��7�oDataK�Nameseqnum

A��7�oDataK�Nameconnid
p�|���������̵ص���� �<�X�l�PIDsizedaddrsaddrdportsportmsssackopttsoptwsoptrcvwinrcvwinscalesndwinscaleseqnumconnidTEMP(T�(n�n3��^���2�P���D�	EventDataA��5�oDataK�NameProto
A��A�oData)K�NameFailureCode
|���ProtoFailureCodeTEMP(

X�{i^�Ӻ.\���F����zD�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��;�oData#K�Namestartime
A��9�oData!K�Nameendtime
A��7�oDataK�Nameseqnum
A��7�oDataK�Nameconnid
	 �,�<�L�\�l�|�������PIDsizedaddrsaddrdportsportstartimeendtimeseqnumconnidTEMPP��5[� 7�WIh�C4����D�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��7�oDataK�Nameseqnum
A��7�oDataK�Nameconnid
������Ⱦؾ����PIDsizedaddrsaddrdportsportseqnumconnidTEMP(�����OQ�s��W����D�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��1�oDataK�Namemss
A��9�oData!K�Namesackopt
A��5�oDataK�Nametsopt
A��5�oDataK�Namewsopt
	A��7�oDataK�Namercvwin
A��A�oData)K�Namercvwinscale
A��A�oData)K�Namesndwinscale
A��7�oDataK�Nameseqnum

A��7�oDataK�Nameconnid
8�D�T�d�t���������������� �4�PIDsizedaddrsaddrdportsportmsssackopttsoptwsoptrcvwinrcvwinscalesndwinscaleseqnumconnidPRVAX\�Microsoft-Windows-Kernel-NetworkOPCO�
�<��x����
����<����������D�*���+���1�<KERNEL_NETWORK_OPCODE_SEND<KERNEL_NETWORK_OPCODE_RECV@KERNEL_NETWORK_OPCODE_CONNECTHKERNEL_NETWORK_OPCODE_DISCONNECTHKERNEL_NETWORK_OPCODE_RETRANSMIT@KERNEL_NETWORK_OPCODE_ACCEPTDKERNEL_NETWORK_OPCODE_RECONNECT<KERNEL_NETWORK_OPCODE_FAIL@KERNEL_NETWORK_OPCODE_TCPCOPY@KERNEL_NETWORK_OPCODE_SENDUDP@KERNEL_NETWORK_OPCODE_RECVUDP@KERNEL_NETWORK_OPCODE_FAILUDPLEVL@P\�(win:InformationalTASK�
�����������8KERNEL_NETWORK_TASK_TCPIP8KERNEL_NETWORK_TASK_UDPIPKEYW�����d� ������<KERNEL_NETWORK_KEYWORD_IPV4<KERNEL_NETWORK_KEYWORD_IPV6EVNT�


����P����l�
����P����l�
�X���P����l�

����P����l�
����P��� �l�
�X���P���$�l�
����P���(�l�
0����P���,�l�
�	��P���4�l�

 �
����P���8�l�
 ��P���<�l�
 � ���P���@�l�
 ��P���D�l�
 ��P���H�l�
 � ���P���L�l� 
 ��P���P�l�"
 �л�P���T�l�**�
��P���X�l�++��$�P���\�l�110���0�P���`�l�:* �л�P���h�l�;+ �л$�P���l�l�D�D�D�D�D�D�D�D�T�D�T�T�T�T�T�T�T�T�D�D�D�T�T�T�WEVT�X��0�
����X�d�p�CHANp������TMicrosoft-Windows-Kernel-Disk/AnalyticTTBL�TEMP,���ѵ�ggZ�� *B��bD�	EventDataA��?�oData'K�Name
DiskNumber
A��;�oData#K�NameIrpFlags
A��C�oData+K�NameTransferSize
A��;�oData#K�NameReserved
A��?�oData'K�Name
ByteOffset

A��?�oData'K�Name
FileObject
A��I�oData1K�NameIORequestPacket
A��Q�oData9K�NameHighResResponseTime

t�������

�����

<�DiskNumberIrpFlags TransferSizeReservedByteOffsetFileObject$IORequestPacket,HighResResponseTimeTEMPT��(u��&,&V�O��2���JD�	EventDataA��?�oData'K�Name
DiskNumber
A��;�oData#K�NameIrpFlags
A��Q�oData9K�NameHighResResponseTime

A��I�oData1K�NameIORequestPacket
8�T�

l���DiskNumberIrpFlags,HighResResponseTime$IORequestPacketPRVAP��Microsoft-Windows-Kernel-DiskOPCOLEVL@P0�(win:InformationalTASKKEYWEVNT�
�Y<�$����Z<�$����[h�$���WEVT8D�	h�T���
��4��CHAN�������\Microsoft-Windows-Kernel-EventTracing/AdmindMicrosoft-Windows-Kernel-EventTracing/AnalyticMAPS�d�VMAPd��
��������	�
� StopReasonMapTTBL�1TEMPX�
�9G�U�d��A�v��0D�	EventDataA��A�oData)K�NameSessionName
A��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��A�oData)K�NameLoggingMode
��������SessionNameFileNameErrorCodeLoggingModeTEMP���i[%�_�[Vw'�֦Z���|D�	EventDataA��A�oData)K�NameSessionName
A��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��A�oData)K�NameLoggingMode
A��E�oData-K�Name
FailureReason
$�@�X�p�d���SessionNameFileNameErrorCodeLoggingMode FailureReasonTEMP�X��A\�X+�P2�Z;f���xD�	EventDataA��A�oData)K�NameSessionName
A��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��A�oData)K�NameLoggingMode
A��A�oData)K�NameMaxFileSize

�������

$�SessionNameFileNameErrorCodeLoggingModeMaxFileSizeTEMP�d����d��TY��|������D�	EventDataA��A�oData)K�NameSessionName
A��=�oData%K�Name	ErrorCode
A��A�oData)K�NameLoggingMode
������SessionNameErrorCodeLoggingModeTEMPD���X�f��Z�pI�n���D�	EventDataA��C�oData+K�NameProviderName
A��A�oData)K�NameSessionName
��� ProviderNameSessionNameTEMP��� ����Y�{?C����dD�	EventDataA��C�oData+K�NameProviderName
�� ProviderNameTEMP,l��#�|��VS��?����8D�	EventDataA��A�oData)K�NameSessionGuid
A��?�oData'K�Name
LoggerMode
A��A�oData)K�NameSessionName
A��A�oData)K�NameLogFileName
�������SessionGuidLoggerModeSessionNameLogFileNameTEMP\

t�?����a
]�>��;��Q��D�	EventDataA��A�oData)K�NameSessionGuid
A��?�oData'K�Name
LoggerMode
A��A�oData)K�NameSessionName
A��A�oData)K�NameLogFileName
A��G�oData/K�NameMinimumBuffers
A��G�oData/K�NameMaximumBuffers
A��?�oData'K�Name
BufferSize
A��K�oData3K�NamePeakBuffersCount
A��Q�oData9K�NameCurrentBuffersCount
A��G�oData/K�NameFlushThreshold
	<�X�t����������8�d�SessionGuidLoggerModeSessionNameLogFileName$MinimumBuffers$MaximumBuffersBufferSize(PeakBuffersCount,CurrentBuffersCount$FlushThresholdTEMPP���$���[�㟿�Q��:D�	EventDataA��A�oData)K�NameSessionGuid
A��?�oData'K�Name
LoggerMode
A��A�oData)K�NameSessionName
A��A�oData)K�NameLogFileName
A��G�oData/K�NameMinimumBuffers
A��G�oData/K�NameMaximumBuffers
A��?�oData'K�Name
BufferSize
A��K�oData3K�NamePeakBuffersCount
A��Q�oData9K�NameCurrentBuffersCount
A��G�oData/K�NameFlushThreshold
	A��?�oData'K�Name
EventsLost
A��A�oData)K�NameBuffersLost
A��Q�oData9K�NameRealTimeBuffersLost
A��;�oData#K�NameLoggerId

�,�H�d����������8�\�x�����SessionGuidLoggerModeSessionNameLogFileName$MinimumBuffers$MaximumBuffersBufferSize(PeakBuffersCount,CurrentBuffersCount$FlushThresholdEventsLostBuffersLost,RealTimeBuffersLostLoggerIdTEMP��
.��tX�W���G
��D�	EventDataA��A�oData)K�NameSessionName
A��I�oData1K�NameSecurityDescOld
A��I�oData1K�NameSecurityDescNew
L�h���SessionName$SecurityDescOld$SecurityDescNewTEMP�˥����Y�P_��y���.D�	EventDataA��?�oData'K�Name
ProviderId
A��?�oData'K�Name
StatusCode
A��9�oData!K�NameEventId
A��A�oData)K�NameSessionName
d�������ProviderIdStatusCodeEventIdSessionNameTEMP<�9�'H�*bR�J�����D�	EventDataA��C�oData+K�NameProviderName
A��A�oData)K�NameSessionName
A��I�oData1K�NameMatchAnyKeyword

A��I�oData1K�NameMatchAllKeyword

A��G�oData/K�NameEnableProperty
A��5�oDataK�NameLevel
P�p�
��
����� ProviderNameSessionName$MatchAnyKeyword$MatchAllKeyword$EnablePropertyLevelTEMP����茴��\��i������D�	EventDataA��;�oData#K�NameFileName
A��?�oData'K�Name
BufferSize
A��K�oData3K�NameBuffersPersisted
A��G�oData/K�NameBuffersWritten
A��7�oDataK�NameStatus
 �8�T�|���FileNameBufferSize(BuffersPersisted$BuffersWrittenStatusTEMP$���`�Z�S��.�ۊ���D�	EventDataA��;�oData#K�NameFileName
A��?�oData'K�Name
BufferSize
A��K�oData3K�NameBuffersPersisted
A��G�oData/K�NameBuffersWritten
A��7�oDataK�NameStatus
A��A�oData)K�NameBuffersLost
(@\���FileNameBufferSize(BuffersPersisted$BuffersWrittenStatusBuffersLostTEMP\�w�,V�
tZ�$@6�������D�	EventDataA��C�oData+K�NameProviderGuid
A��M�oData5K�NameProviderGroupGuid
� ProviderGuid(ProviderGroupGuidTEMP<�o���U}2jYn��:���D�	EventDataA��C�oData+K�NameProviderGuid
A��=�oData%K�Name	ErrorCode
8X ProviderGuidErrorCodeTEMPdC��6R�SСC��Qa����D�	EventDataA��C�oData+K�NameProviderGUID
A��=�oData%K�Name	GroupGUID
A��5�oDataK�NameFlags
A��?�oData'K�Name
EnableMask
A��I�oData1K�NameGroupEnableMask
A��=�oData%K�Name	ProcessId
��$@d ProviderGUIDGroupGUIDFlagsEnableMask$GroupEnableMaskProcessIdTEMPp�׺��}YEA��C����D�	EventDataA��3�oDataK�NameGUID
A��5�oDataK�NameIndex
A��;�oData#K�NameLoggerId
A��I�oData1K�NameMatchAnyKeyword

A��I�oData1K�NameMatchAllKeyword

A��5�oDataK�NameLevel
A��G�oData/K�NameEnableProperty
8	H	X	
p	
�	�	�	GUIDIndexLoggerId$MatchAnyKeyword$MatchAllKeywordLevel$EnablePropertyTEMP�1��WPZ“���لb���D�	EventDataA��3�oDataK�NameGUID
A��A�oData)K�NameFilterFlags
A��O�oData7K�NameLastEnableLoggerId
P`|GUIDFilterFlags,LastEnableLoggerIdPRVA`�Microsoft-Windows-Kernel-EventTracingOPCOx1�2�2

�
�P
��
��
��
��
�$�T�|����U VPwin:Infowin:Startwin:Stop4ETW_OPCODE_WRITE_BUFFER4ETW_OPCODE_FILE_SWITCH(ETW_OPCODE_START$ETW_OPCODE_STOP(ETW_OPCODE_FLUSH,ETW_OPCODE_REGISTER0ETW_OPCODE_UNREGISTER(ETW_OPCODE_ENABLE,ETW_OPCODE_DISABLE0ETW_OPCODE_CONFIGUREHETW_OPCODE_USER_MODE_STACK_TRACE0ETW_OPCODE_SET_TRAITS0ETW_OPCODE_GROUP_JOINLEVL�P�P�P�[win:Errorwin:Warning(win:Informationalwin:VerboseTASK�	�<�d��������@����l	T�(ETW_TASK_LOGGING(ETW_TASK_SESSION(ETW_TASK_PROVIDER,ETW_TASK_GUID_ENTRY0ETW_TASK_GROUP_ENTRY0ETW_TASK_STACK_TRACE,ETW_TASK_LOST_EVENT,SavePersistedLogger0ETW_TASK_ENABLE_INFOKEYW �T ��@����������������T����������,ETW_KEYWORD_SESSION0ETW_KEYWORD_PROVIDER4ETW_KEYWORD_LOST_EVENT8ETW_KEYWORD_SOFT_RESTART8ETW_KEYWORD_CAPTURE_STATE8ETW_KEYWORD_REGISTRATION4ETW_KEYWORD_ENABLEMENT(ETW_KEYWORD_GROUPEVNT`#
����8�@�t�
��@�8�@�t�����P�\�t�����\�\�t����\�\�t�
����8�@�t�����D�@�t� @�4�t�x���	 @�4���x���
@��P�\���
@�,�P�\���@��\�\���@�,�\�\���@���\�\���@����\���
@��h�\��� @�����x��� @����x��� @�����x���@����\�������@�������������,��\��������\������ ��������,��������,������t�������t� �����	��	�����	��	 ����|�   ����p�x( 
�R4��x0t� 
@S���x<����������$�$��������4�4�4�����D���$D�$DWEVT�R�	���&
8��!d"�>hACHAN��������D����SystemTMicrosoft-Windows-Kernel-Boot/AnalyticXMicrosoft-Windows-Kernel-Boot/OperationalMAPSL	��$�|%H%�#@VMAP|&
��������d	�e
�f�g�h
�BMAP|�&
������ �@��	�
��� 
�VMAP,�%���� � � �0�0�0�0�0�0�0�P�@�@�@�@�@ �@!�@"� @#� @$� @%� @&� @'� @(� @)� @*� @+�	 @,�
 @-� @.� @/�
 @0� @1� @2� @3� @4� @5� @6� @7� @8� @9� @:� @;� @<� @=� @>� @?� @@� @A�0@B�0@C�0@D�0@E�0@F�0@G�0@H�0@I�	0@J�
0@K�0@L�0@M�
0@N�0@O�0@P�0@Q�0@R�0@S�0@T�0@U�0@V�0@W�0@X�0@Y�0@Z�0@[�0@\�0@]�0@^�0@_�0@`� 0@a�!0@b�"0@c�#0@d�$0@e�%0@f�&0@g�'0@h�(0@i�)0@j�*0@k�+0@l�,0@m�-0@n�.0@o�/0@p�00@q�10@r�20@s�30@t�40@u�50@v�60@w�70@x�80@y�90@z�:0@{�;0@|�<0@}�=0@~�>0@�?0@��@0@��A0@��B0@��Y0@��@@��@@��@@��@@��@@��@@��@@��P@��P@��P@��P@��P@��P@��P@��P@��P@��	P@��
P@��P@��P@��
P@��P@��P@��`@��`@��`@��`@��`@��`@��`@��`@��	`@��
`@��`@��`@��
`@��`@��`@��`@��`@��`@��`@��`@��`@��VMAP��&������������������	��
������
������������������������������VMAPl�%������������������	��
��VMAP4l&��������VMAP<@&����������,BootDiagMessageMap(DebuggerStatusMap4EnableDisableReasonMap,SbatUpdateStatusMap<SecureBootBcdMitigationMap TxtStatusMap VsmPolicyMapTTBLP��TEMP`�(��Ǎ��Y<��������D�	EventDataA��9�oData!K�NameSqmType
A��G�oData/K�NameSqmSessionGuid
A��5�oDataK�NameSqmID
A��O�oData7K�NameSqmStreamRowLength
A��QZ�ComplexData+K�NameSqmStreamRow
�\)p)�)�)�)�)*0*SqmType$SqmSessionGuidSqmID,SqmStreamRowLength SqmStreamRow SqmTypeEntry SqmDWORDEntry$SqmStringEntryTEMP�h+*�d�Ÿ[�|5�NR����D�	EventDataA��5�oDataK�NameWidth
A��7�oDataK�NameHeight
A��C�oData+K�NameBitsPerPixel
�+�+�+WidthHeight BitsPerPixelTEMP�|,A�g���[k#l�'t���`D�	EventDataA��?�oData'K�Name
BytesPerMs
�,BytesPerMsTEMP.�
1�BW[�n��Ts��,D�	EventDataA��;�oData#K�NameDeviceID
A��;�oData#K�NameFileName
A��=�oData%K�Name	BytesRead

A��C�oData+K�NameBytesWritten

\.t.

�.

�.DeviceIDFileNameBytesRead BytesWrittenTEMP��/�چ�ЛV���k+�[b���D�	EventDataA��;�oData#K�NameDeviceID
A��;�oData#K�NameFileName
A��7�oDataK�NameStatus
0(0@0DeviceIDFileNameStatusTEMP��1j���_��������D�	EventDataA��I�oData1K�NameApplicationGuid
A��=�oData%K�Name	BytesRead

A��C�oData+K�NameBytesWritten

�1

�1

�1$ApplicationGuidBytesRead BytesWrittenTEMPx3�f��
�Rۓ����F���,D�	EventDataA��=�oData%K�Name	ImageName
A��?�oData'K�Name
ImageFlags
A��7�oDataK�NameReason
A��C�oData+K�NameErrorIgnored
�3�3�34ImageNameImageFlagsReason ErrorIgnoredTEMP��4�4�~MQ9�TsK,^.��bD�	EventDataA��A�oData)K�NameBootmgrTime



�4BootmgrTimeTEMP��5��H�Q��b����^D�	EventDataA��=�oData%K�Name	ImageName
�5ImageNameTEMP�P6R��6Am�Z�������bD�	EventDataA��A�oData)K�NameDriveNumber
d6DriveNumberTEMPX09�@a�]�0gډ�����zD�	EventDataA��A�oData)K�NameFwStartPage

A��A�oData)K�NameFwPageCount

A��C�oData+K�NameFwMemoryType
A��O�oData7K�NameFwMemoryAttributes
A��A�oData)K�NameBlStartPage

A��A�oData)K�NameBlPageCount

A��C�oData+K�NameBlMemoryType
A��O�oData7K�NameBlMemoryAttributes

�9
�9:(:
T:
p:�:�:FwStartPageFwPageCount FwMemoryType,FwMemoryAttributesBlStartPageBlPageCount BlMemoryType,BlMemoryAttributesTEMP�t;�"�jfg$\���L�����hD�	EventDataA��G�oData/K�NamePreBootMgrTime



�;$PreBootMgrTimeTEMP��<�&6�ؕ]�nZ�H����D�	EventDataA��K�oData3K�NameUefiVariableName
A��3�oDataK�NameSize
A��7�oDataK�NameStatus
=(=8=(UefiVariableNameSizeStatusTEMP@,>7":���Q:��b��M���D�	EventDataA��I�oData1K�NameApplicationGuid
A��9�oData!K�NameElement
T>x>$ApplicationGuidElementTEMP�?$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
,?StatusTEMP��?$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
�?StatusTEMPL�@I��Q�H�\�p�Ԧ����D�	EventDataA��E�oData-K�Name
FailureStatus

A��C�oData+K�NameFailureMsgId


A
 A FailureStatus FailureMsgIdTEMPD B�UaJ˅W�����������D�	EventDataA��E�oData-K�Name
FailureStatus
A��?�oData'K�Name
FailureMsg
HBhB FailureStatusFailureMsgTEMPP�B)5�H7^A����d����D�	EventDataTEMP�hC�H�tjI�Q��Bn�a���`D�	EventDataA��?�oData'K�Name
EntryCount
|CEntryCountTEMP�,D���X��4`����`D�	EventDataA��?�oData'K�Name
ToolsCount
@DToolsCountTEMP\HE�;���W�Q[\4�����D�	EventDataA��K�oData3K�NameLastShutdownGood

A��C�oData+K�NameLastBootGood



pE

�E(LastShutdownGood LastBootGoodTEMP`<Gg����+�[d��f���ND�	EventDataA��K�oData3K�NameLastShutdownGood

A��C�oData+K�NameLastBootGood

A��?�oData'K�Name
LastBootId
A��K�oData3K�NameBootStatusPolicy


�G

�G�G�G(LastShutdownGood LastBootGoodLastBootId(BootStatusPolicyTEMP��H
r�y��Wyþ���T��hD�	EventDataA��G�oData/K�NameOptionSelected
�H$OptionSelectedTEMPP<I)5�H7^A����d����D�	EventDataTEMPP�I)5�H7^A����d����D�	EventDataTEMPP�I)5�H7^A����d����D�	EventDataTEMP�xJS�/y^�����q0��hD�	EventDataA��G�oData/K�NameBootMenuPolicy
�J$BootMenuPolicyTEMPPK)5�H7^A����d����D�	EventDataTEMP��Kw��-g0�^���"	���\D�	EventDataA��;�oData#K�NameBootType
�KBootTypeTEMP4�L��	;H�^Fߟ�U�����D�	EventDataA��;�oData#K�NameBootType
A��A�oData)K�NameLoadOptions
�L�LBootTypeLoadOptionsTEMP,�Nv5Y�0�EX��5f0�q����D�	EventDataA��E�oData-K�Name
ResetEndStart

A��K�oData3K�NameLoadOSImageStart

A��M�oData5K�NameStartOSImageStart

A��U�oData=K�NameExitBootServicesEntry

A��S�oData;K�NameExitBootServicesExit



LO

lO

�O

�O

�O ResetEndStart(LoadOSImageStart(StartOSImageStart0ExitBootServicesEntry0ExitBootServicesExitTEMP��P$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
�PStatusTEMP�|Q��{��b(]�O]9�����xD�	EventDataA��W�oData?K�NameBitlockerUserInputTime



�Q4BitlockerUserInputTimeTEMPH�R�m�[ MkV,Bc�t���D�	EventDataA��=�oData%K�Name	ImageName
A��I�oData1K�NameImageLoadStatus
�R�RImageName$ImageLoadStatusTEMPX�S�bIU�2Z"��M���D�	EventDataA��A�oData)K�NamePeImageName
A��M�oData5K�NamePeImageLoadStatus
 T<TPeImageName(PeImageLoadStatusTEMP�U�QI��-R�d�(P��rD�	EventDataA��Q�oData9K�NameUpdateCapsuleStatus
 U,UpdateCapsuleStatusTEMP��VJ�M�9��T2�`0cX���D�	EventDataA��A�oData)K�NameDeviceFlags
A��=�oData%K�Name	PcrBitmap
A��U�oData=K�NameUpdateSupportedStatus
�V�V�VDeviceFlagsPcrBitmap0UpdateSupportedStatusTEMPHX�m�[ MkV,Bc�t���D�	EventDataA��=�oData%K�Name	ImageName
A��I�oData1K�NameImageLoadStatus
0XHXImageName$ImageLoadStatusTEMPHPY�m�[ MkV,Bc�t���D�	EventDataA��=�oData%K�Name	ImageName
A��I�oData1K�NameImageLoadStatus
xY�YImageName$ImageLoadStatusTEMPD�Z�#|�'$\-]���H���D�	EventDataA��=�oData%K�Name	ImageName
A��G�oData/K�NameSiPolicyStatus
�Z�ZImageName$SiPolicyStatusTEMPD�[�T&��{Z�pu�t�����D�	EventDataA��;�oData#K�NameHiveName
A��G�oData/K�NameHiveLoadStatus
\\HiveName$HiveLoadStatusTEMP��\$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
�\StatusTEMP�|]$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
�]StatusTEMP��^X���S#…�H9����D�	EventDataA��3�oDataK�NamePath
A��?�oData'K�Name
FailedPath
A��7�oDataK�NameStatus
�^�^_PathFailedPathStatusTEMPx0`dC��6lZ'H_�?Z�����D�	EventDataA��3�oDataK�NamePath
A��7�oDataK�NameImport
A��7�oDataK�NameStatus
l`|`�`PathImportStatusTEMPD�dv2Ͼ��S�9�$ѱD��D�	EventDataA��K�oData3K�NameCachedCopyStatus
A��]�oDataEK�NameUnsealingCachedCopyStatus
A��_�oDataGK�NameKeyGenerationAndSaveStatus
A��E�oData-K�Name
SealingStatus
A��?�oData'K�Name
TpmPcrMask
A��e�oDataMK�NameProtectorAssistedUnsealStatus
A��e�oDataMK�NameProtectorAssistedResealStatus
A��]�oDataEK�NameProtectorSealUpdateStatus
A��O�oData7K�NameTpmCounterOpStatus
A��W�oData?K�NameTpmCounterCreateStatus
	A��S�oData;K�NameBackupSealedBlobUsed
�e�e(fdf�f�f�f gXg�g�g(CachedCopyStatus8UnsealingCachedCopyStatus<KeyGenerationAndSaveStatus SealingStatusTpmPcrMask@ProtectorAssistedUnsealStatus@ProtectorAssistedResealStatus8ProtectorSealUpdateStatus,TpmCounterOpStatus4TpmCounterCreateStatus0BackupSealedBlobUsedTEMP��i�Njzp�P�N?�����tD�	EventDataA��K�oData3K�NameCachedCopyStatus
A��Q�oData9K�NameIdkGenerationStatus
A��I�oData1K�NameMeasuringStatus
A��Y�oDataAK�NameSealingAndCachingStatus
�ij4jXj(CachedCopyStatus,IdkGenerationStatus$MeasuringStatus4SealingAndCachingStatusTEMP|�q��3��bVԡ�R���D�	EventDataA��K�oData3K�NameCachedCopyStatus
A��Y�oDataAK�NamePrimaryBlobUnsealStatus
A��W�oData?K�NameBackupBlobUnsealStatus
A��g�oDataOK�NameKickbackBackupBlobUnsealStatus
A��e�oDataMK�NameBackupBlobValidityCheckStatus
A��S�oData;K�NameBackupBlobStillValid

A��u�oData]K�Name%KickbackBackupBlobValidityCheckStatus
A��c�oDataKK�NameKickbackBackupBlobStillValid

A��Y�oDataAK�NamePrimaryBlobResealStatus
A��W�oData?K�NameBackupBlobResealStatus
	A��g�oDataOK�NameKickbackBackupBlobResealStatus
A��_�oDataGK�NameKeyGenerationAndSaveStatus
A��E�oData-K�Name
SealingStatus
A��?�oData'K�Name
TpmPcrMask

A��O�oData7K�NameTpmCounterOpStatus
A��W�oData?K�NameTpmCounterCreateStatus
A��S�oData;K�NameBackupSealedBlobUsed

A���oDatagK�Name*KickbackBackupBlobCleanupPostUpgradeStatus
$sLs�s�s�s

8tht

�t�t,u`u�u�uvvHv

|v�v(CachedCopyStatus4PrimaryBlobUnsealStatus4BackupBlobUnsealStatusDKickbackBackupBlobUnsealStatus@BackupBlobValidityCheckStatus0BackupBlobStillValidPKickbackBackupBlobValidityCheckStatus@KickbackBackupBlobStillValid4PrimaryBlobResealStatus4BackupBlobResealStatusDKickbackBackupBlobResealStatus<KeyGenerationAndSaveStatus SealingStatusTpmPcrMask,TpmCounterOpStatus4TpmCounterCreateStatus0BackupSealedBlobUsed\KickbackBackupBlobCleanupPostUpgradeStatusTEMPD
�~_�,�Y�U"�z�-x��jD�	EventDataA��K�oData3K�NameCachedCopyStatus
A��Y�oDataAK�NamePrimaryBlobUnsealStatus
A��W�oData?K�NameBackupBlobUnsealStatus
A��g�oDataOK�NameKickbackBackupBlobUnsealStatus
A��g�oDataOK�NameLostOemPkProtectorUnsealStatus
A��e�oDataMK�NameBackupBlobValidityCheckStatus
A��S�oData;K�NameBackupBlobStillValid

A��u�oData]K�Name%KickbackBackupBlobValidityCheckStatus
A��c�oDataKK�NameKickbackBackupBlobStillValid

A��Y�oDataAK�NamePrimaryBlobResealStatus
	A��W�oData?K�NameBackupBlobResealStatus
A��g�oDataOK�NameKickbackBackupBlobResealStatus
A��_�oDataGK�NameKeyGenerationAndSaveStatus
A��E�oData-K�Name
SealingStatus

A��?�oData'K�Name
TpmPcrMask
A��O�oData7K�NameTpmCounterOpStatus
A��W�oData?K�NameTpmCounterCreateStatus
A��S�oData;K�NameBackupSealedBlobUsed

A���oDatagK�Name*KickbackBackupBlobCleanupPostUpgradeStatus
$�L�������<�

|���

��<�p����$�D�`���

���(CachedCopyStatus4PrimaryBlobUnsealStatus4BackupBlobUnsealStatusDKickbackBackupBlobUnsealStatusDLostOemPkProtectorUnsealStatus@BackupBlobValidityCheckStatus0BackupBlobStillValidPKickbackBackupBlobValidityCheckStatus@KickbackBackupBlobStillValid4PrimaryBlobResealStatus4BackupBlobResealStatusDKickbackBackupBlobResealStatus<KeyGenerationAndSaveStatus SealingStatusTpmPcrMask,TpmCounterOpStatus4TpmCounterCreateStatus0BackupSealedBlobUsed\KickbackBackupBlobCleanupPostUpgradeStatusTEMP�
��z����VX���6mc���D�	EventDataA��7�oDataK�NameStatus
A��9�oData!K�NamePcrMask
A��O�oData7K�NameUnsealPolicyPdGuid
A��i�oDataQK�NameSealingProtectorFixedBufferSize
A��g�oDataOK�NameSealingProtectorUsedBufferSize
A��W�oData?K�NameSealedSecretBufferSize
A��Q�oData9K�NamePcrInfoArrayElCount
A��U�oData=K�NameUnsealPolicy->Version
A��a�oDataIK�NameUnsealPolicy->VarDataOffset
A��a�oDataIK�NameUnsealPolicy->StructureSize
	A��a�oDataIK�NameUnsealPolicy->PolicyVersion

A��g�oDataOK�NameUnsealPolicy->PolicyHashLength
A��[�oDataCK�NameUnsealPolicy->WinloadSVN
A��_�oDataGK�NameUnsealPolicy->WinresumeSVN

A��[�oDataCK�NameUnsealPolicy->BootmgrSVN
A��Y�oDataAK�NameUnsealPolicy->LKeyPkgId

Ћ���$�h�����<�x�

���4�l���

�StatusPcrMask,UnsealPolicyPdGuidDSealingProtectorFixedBufferSizeDSealingProtectorUsedBufferSize4SealedSecretBufferSize,PcrInfoArrayElCount0UnsealPolicy->Version<UnsealPolicy->VarDataOffset<UnsealPolicy->StructureSize<UnsealPolicy->PolicyVersionDUnsealPolicy->PolicyHashLength8UnsealPolicy->WinloadSVN<UnsealPolicy->WinresumeSVN8UnsealPolicy->BootmgrSVN4UnsealPolicy->LKeyPkgIdTEMP���>ӎ�uoX���T��J���fD�	EventDataA��K�oData3K�NameCachedCopyStatus
A��Q�oData9K�NameKeyGenerationStatus
A��M�oData5K�NameSealAndSaveStatus
A��G�oData/K�NameUEFIKeysStatus
�(�T�|�(CachedCopyStatus,KeyGenerationStatus(SealAndSaveStatus$UEFIKeysStatusTEMP�L��*��T�X��Y�Y��\��xD�	EventDataA��W�oData?K�NameRetrieveDriverListTime



`�4RetrieveDriverListTimeTEMP�D��衻<�_%L�zJ���|D�	EventDataA��[�oDataCK�NameTpmSrkProvisioningStatus
X�8TpmSrkProvisioningStatusTEMP�<�t��
�X/X������xD�	EventDataA��W�oData?K�NameTpmSrkProvisioningTime



P�4TpmSrkProvisioningTimeTEMP<�.A�a�M�T��q�`����D�	EventDataA��c�oDataKK�NameTpmBindingProvisioningStatus
P�@TpmBindingProvisioningStatusTEMP�0��Ea3�[���>B:���jD�	EventDataA��I�oData1K�NameLoadDriversTime



D�$LoadDriversTimeTEMP,<�.�=����W$ V^ϻп���D�	EventDataA��3�oDataK�NamePath
A��C�oData+K�NameLoadHiveTime

d�

t�Path LoadHiveTimeTEMP����Z�\�J�Z�d$���D�	EventDataA��U�oData=K�NameApplicationIdentifier
A��Q�oData9K�NameApplicationLoadTime

��

�0ApplicationIdentifier,ApplicationLoadTimeTEMP�(�L���/!~U1&�ݟ�)���D�	EventDataA��U�oData=K�NameApplicationIdentifier
A��[�oDataCK�NameApplicationExecutionTime

P�

��0ApplicationIdentifier8ApplicationExecutionTimeTEMP$���,�L&�SY���������D�	EventDataA��7�oDataK�NameStatus
A��;�oData#K�NameFileName
��ěStatusFileNameTEMP4��x_T��U�]�x����D�	EventDataA��7�oDataK�NameStatus
A��C�oData+K�NameFailurePoint
ܜ��Status FailurePointTEMP���$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
��StatusTEMP�h��5	0�&U��H�v�%��pD�	EventDataA��O�oData7K�NameReserveDescriptors
|�,ReserveDescriptorsTEMP�ȟ��~��]ͽ'�1����D�	EventDataA��E�oData-K�Name
ApplicationId
A��;�oData#K�NameRunCount
A��=�oData%K�Name	PageCount

�$�

<� ApplicationIdRunCountPageCountTEMP �s�Z�j��_��jz(�V(���D�	EventDataA��7�oDataK�NameStatus
A��9�oData!K�NameBlockId

H�
\�StatusBlockIdTEMP���'v~�rPx�zx^X
V��rD�	EventDataA��Q�oData9K�NameFreePersistentPages



,�,FreePersistentPagesTEMPD8���*�P��
7`:o���D�	EventDataA��7�oDataK�NameStatus
A��K�oData3K�NameOutstandingCount

`�

t�Status(OutstandingCountTEMPP�7,�-�W�ڲ�Rvr<��HD�	EventDataA��7�oDataK�NameStatus
A��K�oData3K�NameOutstandingCount

A��M�oData5K�NameApplicationsCount
A��C�oData+K�NameApplications
�h�

|���̥Status(OutstandingCount(ApplicationsCount ApplicationsTEMPh�� ��N��YB�B���
���D�	EventDataA��E�oData-K�Name
ApplicationId
A��Q�oData9K�NameFreePersistentPages

�

(� ApplicationId,FreePersistentPagesTEMP�����*?�S�Y��z\����D�	EventDataA��E�oData-K�Name
ApplicationId
A��9�oData!K�NameBlockId

A��Q�oData9K�NameFreePersistentPages

Ĩ
�

�� ApplicationIdBlockId,FreePersistentPagesTEMP�<���/��yTQ��lC\V���D�	EventDataA��E�oData-K�Name
ApplicationId
A��9�oData!K�NameBlockId

A��5�oDataK�NameFlags
x�

���� ApplicationIdBlockIdFlagsTEMP�ԫ݆��@:[%�ʼnD��Y���D�	EventDataA��7�oDataK�NameStatus
A��A�oData)K�NameRunsClaimed
A��=�oData%K�Name	PageCount

�$�

@�StatusRunsClaimedPageCountTEMP���'v~�rPx�zx^X
V��rD�	EventDataA��Q�oData9K�NameFreePersistentPages



�,FreePersistentPagesTEMP8�7!�~�Z�]��I)���D�	EventDataA��E�oData-K�Name
ApplicationId
A��9�oData!K�NameBlockId

D�

d� ApplicationIdBlockIdTEMP����r�e~SV��C.`J����D�	EventDataA��3�oDataK�NameType
A��5�oDataK�NameFlags
A��?�oData'K�Name
BufferSize
��Я�TypeFlagsBufferSizeTEMP$̰s4y�[�X���—8���D�	EventDataA��;�oData#K�NameDiagCode
A��7�oDataK�NameStatus
���DiagCodeStatusTEMP�4��E�{�wHX�}u�;G�����D�	EventDataA��7�oDataK�NameStatus
A��;�oData#K�NameDataSize
A��?�oData'K�Name
BufferSize
p�����StatusDataSizeBufferSizeTEMP��BRuu��T;CB��w����D�	EventDataA��5�oDataK�NamePhase
A��7�oDataK�NameStatus
����PhaseStatusTEMP��7C�{��S5�o/Q9����D�	EventDataA��7�oDataK�NameStatus
A��Q�oData9K�NameEnableDisableReason
A��=�oData%K�Name	VsmPolicy
0��D�@p�Status,EnableDisableReasonVsmPolicyTEMP�p�����ݺB[���C~7���D�	EventDataA��?�oData'K�Name
LowAddress

A��A�oData)K�NameHighAddress

A��=�oData%K�Name	SkipBytes

A��?�oData'K�Name
TotalBytes

A��=�oData%K�Name	CacheType
A��5�oDataK�NameFlags

�
�
 �

8�T�l�LowAddressHighAddressSkipBytesTotalBytesCacheTypeFlagsTEMP���s/��T1X��D>��RD�	EventDataA��1�oDataK�NameMdl
�MdlTEMP��������L�X+I%��n�v��XD�	EventDataA��7�oDataK�NameSecure



ĹSecureTEMP�x�
+t�]��K~p���lD�	EventDataA��K�oData3K�NameSoftRestartCount
��(SoftRestartCountTEMPD��i%�O댘\@2���\����D�	EventDataA��K�oData3K�NameSoftRestartCount
A��7�oDataK�NameSecure

��

�(SoftRestartCountSecureTEMP�D�c��U�@M�Ƒ���D�	EventDataA��G�oData/K�NameSequenceNumber
A��I�oData1K�NameDescriptorCount
A��YZ�ComplexData3K�NameMemoryDescriptor
��
@�

X�p���$SequenceNumber$DescriptorCount(MemoryDescriptorBasePagePageCountMemoryTypeReservedTEMP�D�����Uߔ�镢���jD�	EventDataA��I�oData1K�NameDescriptorCount
X�$DescriptorCountTEMPh�w���0b�Y�G�N��}V���D�	EventDataA��7�oDataK�NameStatus
A��=�oData%K�Name	PageCount

A��?�oData'K�Name
MemoryType
A��?�oData'K�Name
Attributes
A��?�oData'K�Name
LowAddress

A��A�oData)K�NameHighAddress

�

��(�
D�
`�StatusPageCountMemoryTypeAttributesLowAddressHighAddressTEMP����5��?U�N><�E����BD�	EventDataA��7�oDataK�NameStatus
A��=�oData%K�Name	PageCount

A��?�oData'K�Name
MemoryType
A��?�oData'K�Name
Attributes
A��?�oData'K�Name
LowAddress

A��A�oData)K�NameHighAddress

A��=�oData%K�Name	Alignment
A��A�oData)K�NameProximityId
��

������
��
�0�H�StatusPageCountMemoryTypeAttributesLowAddressHighAddressAlignmentProximityIdTEMP�����/��TR��w���^D�	EventDataA��=�oData%K�Name	StartTime
�StartTimeTEMPPt�)5�H7^A����d����D�	EventDataTEMPP��)5�H7^A����d����D�	EventDataTEMP`��8�^�Q2I�w+�*���D�	EventDataA��?�oData'K�Name
Identifier
A��A�oData)K�NamePartitionId
A��Q�oData9K�NameAllocatedBlockCount

A��M�oData5K�NameAllocatedRunCount

A��O�oData7K�NameAllocatedPageCount

A��7�oDataK�NameStatus
X�t�

��

��

���IdentifierPartitionId,AllocatedBlockCount(AllocatedRunCount,AllocatedPageCountStatusTEMP<�w)ϻ�6^lV���Aw����D�	EventDataA��?�oData'K�Name
Identifier
A��A�oData)K�NamePartitionId
(�D�IdentifierPartitionIdTEMP����hl��N�Y&���hQO
���D�	EventDataA��?�oData'K�Name
Identifier
A��O�oData7K�NamePartitionPageCount

A��Q�oData9K�NameAllocatedBlockCount

A��M�oData5K�NameAllocatedRunCount

A��O�oData7K�NameAllocatedPageCount

A��7�oDataK�NameStatus
�

 �

L�

x�

����Identifier,PartitionPageCount,AllocatedBlockCount(AllocatedRunCount,AllocatedPageCountStatusTEMP����޺�Vx�BDX|���D�	EventDataA��?�oData'K�Name
Identifier
A��O�oData7K�NamePartitionPageCount

A��7�oDataK�NameStatus
D�

`���Identifier,PartitionPageCountStatusTEMP,t�d�i�dl�YUY�O�S����D�	EventDataA��?�oData'K�Name
Identifier
A��7�oDataK�NameStatus
����IdentifierStatusTEMP�`���*)�R�#����.��`D�	EventDataA��?�oData'K�Name
Identifier
t�IdentifierTEMP ����o�L)�^*�v��w�����D�	EventDataA��?�oData'K�Name
Identifier
A��;�oData#K�NameRunCount
A��=�oData%K�Name	PageCount

A��7�oDataK�NameStatus
A��Q�oData9K�NamePartitionNameLength
A��E�oData-K�Name
PartitionName
� �

8�P�d���IdentifierRunCountPageCountStatus,PartitionNameLength PartitionNameTEMP8P��1�"�S�XQ�ڥ6��jD�	EventDataA��?�oData'K�Name
Identifier
A��;�oData#K�NameRunCount
A��=�oData%K�Name	PageCount

A��I�oData1K�NameIoSpaceRunCount
A��K�oData3K�NameIoSpacePageCount

A��7�oDataK�NameStatus
A��Q�oData9K�NamePartitionNameLength
A��E�oData-K�Name
PartitionName
���

$�<�

`�������IdentifierRunCountPageCount$IoSpaceRunCount(IoSpacePageCountStatus,PartitionNameLength PartitionNameTEMP��09Q���S�����K&����D�	EventDataA��7�oDataK�NameStatus
A��?�oData'K�Name
ActualSize
A��C�oData+K�NameExpectedSize
@�T�p�StatusActualSize ExpectedSizeTEMP����D RUW8Sҍ�Ƶ����D�	EventDataA��A�oData)K�NamePartitionId
A��;�oData#K�NameRunCount
A��=�oData%K�Name	PageCount

���

�PartitionIdRunCountPageCountTEMP$���"��}f_�R��lhH��4D�	EventDataA��A�oData)K�NamePartitionId
A��;�oData#K�NameRunCount
A��=�oData%K�Name	PageCount

A��E�oData-K�Name
IoSpaceMemory

���

 �

8�PartitionIdRunCountPageCount IoSpaceMemoryTEMP,,��{cZ(�uZ,K�37J2���D�	EventDataA��;�oData#K�NameBasePage

A��=�oData%K�Name	PageCount


T�

l�BasePagePageCountTEMP������HZ>�^�3Gjk�X���D�	EventDataA��A�oData)K�NameCommandCode
A��C�oData+K�NameResponseCode
A��S�oData;K�NameResponseMilliseconds

���

8�CommandCode ResponseCode0ResponseMillisecondsTEMP���;��{�R�^�
r%ʫ���*D�	EventDataA��A�oData)K�NameCommandCode
A��C�oData+K�NameResponseCode
A��S�oData;K�NameResponseMilliseconds

A��A�oData)K�NameCommandSize
A��A�oData)K�NameCommandData
A��C�oData+K�NameResponseSize
A��C�oData+K�NameResponseData
T�p�

���������CommandCode ResponseCode0ResponseMillisecondsCommandSizeCommandData ResponseSize ResponseDataTEMP�l�
��.�m�Z��z;l���D�	EventDataA��A�oData)K�NameCommandCode
A��=�oData%K�Name	ErrorCode
A��S�oData;K�NameResponseMilliseconds

����

��CommandCodeErrorCode0ResponseMillisecondsTEMP����ecv�U�U���'*l}���D�	EventDataA��A�oData)K�NameCommandCode
A��=�oData%K�Name	ErrorCode
A��S�oData;K�NameResponseMilliseconds

A��A�oData)K�NameCommandSize
A��A�oData)K�NameCommandData
4�P�

h�����CommandCodeErrorCode0ResponseMillisecondsCommandSizeCommandDataTEMP�t�VC��SR�s�ġ����pD�	EventDataA��O�oData7K�NameFveGlobalDataFlags
��,FveGlobalDataFlagsTEMP �_�2Y�?B�8��.D�	EventDataA��?�oData'K�Name
VendorGuid
A��C�oData+K�NameVariableName
A��?�oData'K�Name
Attributes
A��7�oDataK�NameStatus
h�������VendorGuid VariableNameAttributesStatusTEMP�l��~�w
�^�ڴl�����dD�	EventDataA��C�oData+K�NameTxtErrorCode
�� TxtErrorCodeTEMPd�t�0w�@Wf�#t�cg���D�	EventDataA��3�oDataK�NameBase

A��3�oDataK�NameSize


��
��BaseSizeTEMP�D��Mp�dnT!+���3���dD�	EventDataA��C�oData+K�NameBiosDataSize



X� BiosDataSizeTEMPtp�n�p�;�WN=���"���D�	EventDataA��O�oData7K�NameAcmMinMleHeaderVer
A��K�oData3K�NameMleHeaderVersion
����,AcmMinMleHeaderVer(MleHeaderVersionTEMP��� U�)%�KQ�����"����D�	EventDataA��?�oData'K�Name
PmrLowBase

A��?�oData'K�Name
PmrLowSize

A��A�oData)K�NamePmrHighBase

A��A�oData)K�NamePmrHighSize

A��Q�oData9K�NameFirmwareProvidedAcm



�

0�

L�

h�

��PmrLowBasePmrLowSizePmrHighBasePmrHighSize,FirmwareProvidedAcmTEMP�D��Gg�`6XRN�r��HJ��^D�	EventDataA��=�oData%K�Name	TxtStatus
�#X�TxtStatusTEMP���ݞ���s\k�rT�O���D�	EventDataA��5�oDataK�NamePhase
A��?�oData'K�Name
StatusCode
A��K�oData3K�NameEnvironmentState
����PhaseStatusCode(EnvironmentStateTEMP�����05R���c'K3����D�	EventDataA��=�oData%K�Name	InitState
A��?�oData'K�Name
StatusCode
A��G�oData/K�NameFailureAddress

A��K�oData3K�NameReferenceAddress

A��?�oData'K�Name
ReasonCode
H�`�
|�
���InitStateStatusCode$FailureAddress(ReferenceAddressReasonCodeTEMP0P���KknT׉�&�:���6D�	EventDataA��C�oData+K�NameSvnCounterId
A��?�oData'K�Name
StatusCode
A��;�oData#K�NameSvnValue
A��C�oData+K�NamePrevSvnValue
������ SvnCounterIdStatusCodeSvnValue PrevSvnValueTEMP<��X�@EJ�Q8A�%�)2����D�	EventDataA��;�oData#K�NameSvnValue
A��C�oData+K�NamePrevSvnValue
�0�SvnValue PrevSvnValueTEMP����	͓^����؟����bD�	EventDataA��A�oData)K�NameSinitTimeMs



��SinitTimeMsTEMP4�9s��B�V݇���0,���D�	EventDataA��?�oData'K�Name
StatusCode
A��;�oData#K�NamePosition
4StatusCodePositionTEMP�tp�5�g�\3�����W���D�	EventDataA��?�oData'K�Name
AcmDateDay
A��C�oData+K�NameAcmDateMonth
A��A�oData)K�NameAcmDateYear
���AcmDateDay AcmDateMonthAcmDateYearTEMP���Gg�`6XRN�r��HJ��^D�	EventDataA��=�oData%K�Name	TxtStatus
�#�TxtStatusTEMP�����Og�]2e��{���D�	EventDataA��=�oData%K�Name	TxtStatus
A��=�oData%K�Name	Argument1

A��=�oData%K�Name	Argument2

�# 

8

PTxtStatusArgument1Argument2TEMP�7�@��ir\��hZc�a��.D�	EventDataA��=�oData%K�Name	TxtStatus
A��A�oData)K�NamePolicyLevel
A��=�oData%K�Name	Argument1

A��=�oData%K�Name	Argument2

�#4

P

hTxtStatusPolicyLevelArgument1Argument2TEMP8^p%`�$^U��l�T�?���D�	EventDataA��5�oDataK�NamePhase
A��7�oDataK�NameStatus
A��5�oDataK�NameTries
A��Q�oData9K�NameRemainingNodesCount
A��UZ�ComplexData/K�NameRemainingNodes
�����$	H	d	PhaseStatusTries,RemainingNodesCount$RemainingNodesNodeNumber$RemainingRangesTEMP<d
YTɁ���T����H���D�	EventDataA��K�oData3K�NameAllocatedRegions
A��5�oDataK�NameTries
�
�
(AllocatedRegionsTriesTEMP$��-��Dz[*��$������D�	EventDataA��?�oData'K�Name
PathLength
A��3�oDataK�NamePath
��PathLengthPathTEMP��[�C4VZ��ss�	���bD�	EventDataA��A�oData)K�NameTryComplete



�TryCompleteTEMP��
�[��b��Q�,]��U�����D�	EventDataA��;�oData#K�NameFunction
A��7�oDataK�NameStatus
A��?�oData'K�Name
Checkpoint
,FunctionStatusCheckpointTEMP<$�H-"��m^�&��O�����D�	EventDataA��G�oData/K�NameDebuggerStatus
A��7�oDataK�NameStatus
�$Lp$DebuggerStatusStatusTEMPP�)5�H7^A����d����D�	EventDataTEMP��.p�U��[t��MJ�����D�	EventDataA��9�oData!K�NameKeyType
A��3�oDataK�NameCode
��KeyTypeCodeTEMPL����<Q���<�����D�	EventDataA��E�oData-K�Name
DisableReason
A��C�oData+K�NameTcgLogStatus
� DisableReason TcgLogStatusTEMP4x_T��U�]�x����D�	EventDataA��7�oDataK�NameStatus
A��C�oData+K�NameFailurePoint
4HStatus FailurePointTEMP��i{�0W'D�d�����dD�	EventDataA��C�oData+K�NameMirrorStatus
 MirrorStatusTEMPd$�M�L3�$\�G��̚����D�	EventDataA��I�oData1K�NameEfiTimeZoneBias
A��K�oData3K�NameEfiDaylightFlags
Lp$EfiTimeZoneBias(EfiDaylightFlagsTEMP�,v\����V�e��46���^D�	EventDataA��=�oData%K�Name	BcdOption
H%@BcdOptionTEMP���Py��TU��R�RM���ZD�	EventDataA��9�oData!K�NameVersion
�VersionTEMP(xW��,�FTTϞ*,H�H��4D�	EventDataA��7�oDataK�NameStatus
A��C�oData+K�NameFailurePoint
A��K�oData3K�NameUpdateStatusEnum
A��9�oData!K�NameFwLevel
��|%�$Status FailurePoint(UpdateStatusEnumFwLevelPRVAPLMicrosoft-Windows-Kernel-BootOPCOP+1�2�2������H����L����4N����\O����xX�����Y�����_�����`����c����d����,}����L����tH�����L�����N�����X����Y����<`����d}�����L
�����N
�����Y
�����L����$N����PL����tL�����L�����L�����L���� L����L L����p L����� L����� L����� L����!L����<!L����t!L�����!L �����!win:Infowin:Startwin:Stop0InitializationFailure$GetEfiVariable(TxtLaunchPreparedInitStatusOpenFailureBdEnabledAllocation8ListInitializationFailureKdEnabledTpmInit NotSupported(SbatUpdateSuccess0MeasurementsDisabled$SetEfiVariable(PreviousTxtError,EnterInsecureState BdInitFailure(AllocationFailure KdInitFailure(SbatUpdateFailure0InvalidTxtSinitRange DrtmSvnCheck(EnumerateFailure,InvalidTxtHeapRange$BootmgrSvnCheck$MleLoadFailure(MissingRsdpTableNoSinitAcm4ComputePmrRangesFailure<InvalidTxtHeapBiosDataSize$MleHeaderTooOld(SinitPerformance(PrepareLcpFailure4TxtRejectedFirmwareAcm$TxtInformation$TxtNotSupported8DrtmDriversNotSupportVbsPpamFailure SmmLevelCheck(TprSetupRequestedLEVL�P"P "P<"win:Errorwin:Warning(win:InformationalTASKXg�����-�����-�����-����0.����L.����l.�����.�����.	�����.
����/����P/����|/
�����/�����/����0����00����`0�����0�����0�����0�����0���� 1����<1����T1�����1�����1�����1����,2����P2����t2�����2 �����2!�����2"�����2#����,3$����P3%����|3&�����3'�����3(����4)����84*����p4+�����4,�����4-�����4.����5/����H50����t51�����52�����53�����54����465����`66����x67�����68�����69�����6:����7;����<7<����t7=�����7>�����7?�����7@����48A����X8B����|8C�����8D�����8E�����8F����9G����<9H����d9I�����9J�����9K�����9L����:M����0:N����\:O����p:P�����:Q�����:R�����:S����;T����P;U����x;V�����;W�����;X�����;Y����<Z����(<[����P<\�����<]�����<^����=_����<=`����`=a�����=b�����=c����>d����>e����<>t����p>}�����>(InitializeLibrary PrepareTarget4RebuildKernelMemoryMapFatalError PersistMemory0ClaimPersistedMemory,FreePersistedMemory,CleanupPageDatabaseCancelBoot@AttachPersistentPageDatabase,MemoryBlockRundown0BuildKernelMemoryMap GetMemoryMap<AllocatePhysicalPagesForMdl(ExecuteTransition0DisconnectHypervisor(MemoryMapRundown@PhysicalPageAllocationFailureBootManagerPreBoot(FirmwareBootDataLoadDriversLoadHive8BootApplicationExecution8WaitForPartitionsRestored4MemoryPartitionRestore4PersistMemoryPartition$RegisterLoader$SiPolicyFailureBootTotalIo(DirtyBootShutdown$BootMenuPolicyBootType8MemoryPartitionsRestored$QueryStatistics,ConnectSecureLoader$BootFileAccess4RetrieveDriverListTime8FreePersistedMemoryBlock,PrepareNotification8PartitionInitialAddMemory$ImageHashCheck,ImageIntegrityCheck,BootPolicyMigration,RemoveEnclavePages0EnumerateEnclavePages,GetSystemBootDevice4NormalizeBootOptionList4CreateLibraryParameters CreateDevices8SoftRestartHostCapability,CancelNotificationBootDiag(ImageLoadFailure,FirmwareResolution(BootEnvResolution(BootmgrEntryCount UserInputTime8VsmIdkProvisioningStatus$BootAppLoadTime0PrepareTargetFailure,VsmPolicyEnablement@InitializeMeasurementContext$KsrMeasurement$TpmMeasurement,CloseMeasurementLog,CommitPendingEventsCapTpmPcr,TpmCommandResponse$TpmSubmitError(TpmBitLockerUsage(EfiVariableAccess4GetFirmwareInformation$VerifyBootEntry(InvalidNfitTable$MeasuredLaunch,EFICapsuleCreationBootSIFileOpen(VsmPolicyFailure8VsmLKeyProvisioningStatus4SecureBootVariableUsage4MiniFilterStartFailure(FileModification0RegistryModificationSoftReboot$RegisterFilter BootDebugger IoSpaceMemory(FinalizeMemoryMapPRegisterHvloaderPersistenceInterface<LoadHvloaderForPersistence0VsmBootNoSecretsMode0BootMenuTimerCanceled$BadMemoryPages$KernelDebuggerDMemoryPartitionFreeUnusedMemory<MemoryPartitionRestoreStatsBootTpm$MemoryMirroring4EfiTimeZoneInformation0SecureBootMitigationsSbatUpdateKEYW�
�����?�����?�����?����@����0@ ����X@@�����@�����@�����@ �����@@����A�����0A4TASoftRestart,MemoryPreservation,MemoryBlockRundown$PhysicalMemory(MemoryMapRundown(MemoryPartitions EfiVariables$LOG_TO_BOOTSTAT0ms:ReservedKeyword40 ms:Telemetryms:Measures$ms:CriticalDatawin:SQMEVNT�-�7@�T*�!X(�8@�T*�!t(�@��+�!�%@��,�!`&� @�T0�!�%8l�+(@�2��!'<l� @�04�!h$Dl�*(@��4��!�&Hl�	 @��5�!Pl�
 �
�6�!Tl�@��:�!�$�R@��;�!L+�
 @�L=�!Xl�@��>�!�@�@?�!���?�!��@A�!\l���B�!�9��B�!�(���C�!��\D�!�%���E�!�%��H�!���H�!��<I�!���I�!� ��I�!�%���J�!`l�!�K�!�%�!��K�!�%������&�!dl��?�!��@A�!hl���L�!�$�@�P�!� :� �P�!�(�!(@!��Q�!ll�"(@"�S�!tl�#( #�dT�!|l�$@$�LU�!�%(@%�$W�!�l�&6( &�lX�!<(�l�'  '��Z�!�l�(  (�<\�!�l�)  )��\�!�l�*( *��]�!�l�+( +�,_�!�l�, ,��g�!�l�-; -��g�!�(�.&@����!|&�/@����!�$�0@�h��!�$�1 1��Y�!�%�2Q 2��`�!0+�2Q 2��j�!0+�2Q 2�w�!0+�3Q 3��`�!0+�3Q 3��j�!0+�3Q 3�w�!0+�4<@����!�(�5@���!�$�6@����!�7=@�ܛ�!)�8@���!�l�9 9����!�: :����!�; ;����!�<K <���!�*�=L@��������!�*�l�>L >���`�!�*�l�?
L@��������!�*�l�@L@��������!�*�l�AL@�������!�*�l�BL@�������!�*�l�CL@�������!�*�l�DL@�������!�*�l�EL@����x� �!�*�l�FL@������!�*�l�GO�����.��!�*HL@�����8�!�*�l�IL I���D�!�*�JQ J���!0+�KQ K���!0+�LX������!�+MX����Hx�!�+N`����H��!�,O`�����!�,Q Q��!�YQ Y�L��!0+�d������!p"�ld����$���!p"�le�������!p"�lf������!�"�lf����ع��!�"�lf��������!�"�lg�������!�"�lh����ĝ��!�"mi�������!�"mj��������!�"mk����T���!�"ml�������!�"mm����p���!4#mn�������!4# mo�������!#(mp�������!#,mq����$���!�"0mr��������!�"4ms	�sX���!P#8m�t	�t���!P#<m�u
������!l#@mv
�������!l#Hmw����@���!�#Pmx������!�#Tmy�������!�#Xmz
����x���!�#\m{
���� ���!�#`m|PH�|���!+dm�~	��������!�#lm	����|���!�#tm�����d���!�#|m�������!$�m���������!0$�m�������!0$�m���������!0$�m�	 ����|���!L$�m��	 ����|���!L$�m��������!%�m�������!%�m� ��X���!4#�m�� ������!4#�m������$���!,%�m�����`���!,%�m���������!,%�m� ������!,%�m����������!H%�m���������!H%�m���������!H%�m� ������!d%�m��"�������!&�m�#������!(&�m�#�������!(&n�$ �����!D&n��'����T���!�&n�'�������!�&n�(������!�&n�(�������!�&n�) ��������!�&n�) ����4���!�&n�) �������!�& n�>��̳�!)��, �����!$'��, �����!$'����̳�!��5�����! ($n�5 �����! ((n��-����X���!@',n�4�������!(0n�4�������!(4n�/ �������!x'8n��0 �������!�'<n��1 �������!�'@n�� �������!p"Dn��2 �������!�'Hn��3 �������!�'Ln��. �������!\'Pn��? �������!8)Tn��? ����4��!8)Xn��@ �������!T)\n��A �������!p)`n��B �������!�)dn��C �������!�)hn��D �������!�)ln��D �������!�)pn�� �������!p"tn��H@��������!4*xn�H@������T�!4*|n�I �������!P*�n��J �������!l*�n��W �����!�+�n��
Y �������!,�n��_ ������!�,�n��?�����H�!8)�n�E@������!�)��E@��h���!�)��F ��8���!�)�n��F �����!�)�n��G@������!*��M������!�*�n�M�������!�*�n�N@��p���!�*��N ��$�l�!�*�n��
N �����!�*��L ��P�,�!�*��S �������!h+�n��T@���
��!�+�n��U@���
��!�+�n��V�����!�+�n��V�����!�+�n��V����!�+�n��V�����!�+�n��V����!�+�n��L ��LP�!�*��L ��\�!�*��L��h�!�*��L���t�!�*��Y �������!,��Y �����	�!,��] �����!�,��Z������!,,�n�Z������!,,�n�Z�������!,,�n�[�������!H,�n�\�������!d,�n�^ �����!�,�n��a����$���!�,�n�a����t���!�,�n�b��������!-�n�c ���$�!(-o��L ��h��!�*��d ��h0�!D-��e��4��!`-� L ���!�*o�t ���!|-�N����!�*o�t �X�!|-�t �X�!|-�#}  #�<�!�-o�$}  $���!�-o�X?8?X?X?8?X?X?X?X?8?8?�?8?8?X?8?X?8?X?8?X?8?X?X?X?X?8?X?8?X?8?8?8?8?8?8?8?8?8?8?8?8?8?�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>8?h?�>�>�>�>�>�>???�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>???8?8?�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>(?(?�>�>�>�>�>�>8?8?�>�>8?�>�>�>�>�>�>�>�>�>�>�>�>�>�>8?�>�>�>�>�>�>8?8?8?X?X?WEVT�; do�o
�D�t���؞��CHANp�o����TMicrosoft-Windows-Kernel-File/AnalyticTTBL )TEMP�r���[�xdS�2iY���
��D�	EventDataA��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��E�oData-K�Name
CreateOptions
A��K�oData3K�NameCreateAttributes
A��A�oData)K�NameShareAccess
A��;�oData#K�NameFileName
�r�r�r�rs,sHsIrpThreadIdFileObject CreateOptions(CreateAttributesShareAccessFileNameTEMP8tu>���_Ql%x�t%����D�	EventDataA��?�oData'K�Name
ByteOffset

A��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��7�oDataK�NameIOSize
A��9�oData!K�NameIOFlags

vv(v@v\vpv�vByteOffsetIrpThreadIdFileObjectFileKeyIOSizeIOFlagsTEMP�|xa��RR!Y�-�%���D�	EventDataA��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��K�oData3K�NameExtraInformation
A��=�oData%K�Name	InfoClass
�xyy4yHypyIrpThreadIdFileObjectFileKey(ExtraInformationInfoClassTEMP`�{����RXZ��t�K����D�	EventDataA��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��K�oData3K�NameExtraInformation
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameFilePath
<|H|`|||�|�|�|IrpThreadIdFileObjectFileKey(ExtraInformationInfoClassFilePathTEMP�@9�k���R�BC�K&���"D�	EventDataA��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��7�oDataK�NameLength
A��=�oData%K�Name	InfoClass
A��=�oData%K�Name	FileIndex
A��;�oData#K�NameFileName
��� �4�H�`�x�IrpThreadIdFileObjectFileKeyLengthInfoClassFileIndexFileNameTEMP��[��ҟ�hQou����D�	EventDataA��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
0�<�T�p�IrpThreadIdFileObjectFileKeyTEMP�Ȅ�ԋR�W�!ssx��D�	EventDataA��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��I�oData1K�NameIssuingThreadId
A��E�oData-K�Name
CreateOptions
A��K�oData3K�NameCreateAttributes
A��A�oData)K�NameShareAccess
A��;�oData#K�NameFileName
T�`�|�������IrpFileObject$IssuingThreadId CreateOptions(CreateAttributesShareAccessFileNameTEMP���ު��N[�^�kљ9و���2D�	EventDataA��?�oData'K�Name
ByteOffset

A��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��I�oData1K�NameIssuingThreadId
A��7�oDataK�NameIOSize
A��9�oData!K�NameIOFlags
A��?�oData'K�Name
ExtraFlags

$�@�L�h�|�����ȉByteOffsetIrpFileObjectFileKey$IssuingThreadIdIOSizeIOFlagsExtraFlagsTEMP؋�ty��:[�PW�<����D�	EventDataA��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��K�oData3K�NameExtraInformation
A��I�oData1K�NameIssuingThreadId
A��=�oData%K�Name	InfoClass
P�\�x�����،IrpFileObjectFileKey(ExtraInformation$IssuingThreadIdInfoClassTEMPx$��Z�Q��	U�K�n?�,��D�	EventDataA��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��K�oData3K�NameExtraInformation
A��I�oData1K�NameIssuingThreadId
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameFilePath
����؏��8�P�IrpFileObjectFileKey(ExtraInformation$IssuingThreadIdInfoClassFilePathTEMP�̒t�욷�X_������0D�	EventDataA��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��I�oData1K�NameIssuingThreadId
A��7�oDataK�NameLength
A��=�oData%K�Name	InfoClass
A��=�oData%K�Name	FileIndex
A��;�oData#K�NameFileName
l�x�����̓����IrpFileObjectFileKey$IssuingThreadIdLengthInfoClassFileIndexFileNameTEMP����]�@L,Xӑ�2��\��(D�	EventDataA��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��I�oData1K�NameIssuingThreadId
ԕ����IrpFileObjectFileKey$IssuingThreadIdTEMP�L���-�IT�S��BD����D�	EventDataA��1�oDataK�NameIrp
A��K�oData3K�NameExtraInformation
A��7�oDataK�NameStatus
������Irp(ExtraInformationStatusTEMP$����`Ӓ��],��Ӛ����D�	EventDataA��9�oData!K�NameFileKey
A��;�oData#K�NameFileName
ȘܘFileKeyFileNamePRVAP�Microsoft-Windows-Kernel-FileOPCO01\�win:InfoLEVL@P��(win:InformationalTASK$
����|�������������
����Ȝ����ܜ��������������������0�����H�����\�����p�����������������������؝��������������(�����D�����X�����x� ������!������"����ĞNameCreateNameDeleteCreateCleanupCloseReadWrite$SetInformationSetDeleteRenameDirEnumFlush(QueryInformationFSCTL OperationEndDirNotifyDeletePathRenamePathSetLinkPathSetLink CreateNewFileSetSecurity QuerySecuritySetEAQueryEAKEYW�	����t� ������@����������,�����h�����������ؠ���������p�@KERNEL_FILE_KEYWORD_FILENAME<KERNEL_FILE_KEYWORD_FILEIO<KERNEL_FILE_KEYWORD_OP_END<KERNEL_FILE_KEYWORD_CREATE8KERNEL_FILE_KEYWORD_READ8KERNEL_FILE_KEYWORD_WRITEDKERNEL_FILE_KEYWORD_DELETE_PATHTKERNEL_FILE_KEYWORD_RENAME_SETLINK_PATHLKERNEL_FILE_KEYWORD_CREATE_NEW_FILEEVNT�+

�����ЗP������po�����ЗP���ܙ�po�������oP������po��������P������po

 �������P������po

 �����(�P������po �������P���0��po �����(�P���0��po �����`sP���L��po ������P���L��po �����`sP���h��po ������P���h� �po ������vP�����(�po ������P�����,�po ������vP�����0�po ������P�����4�po ������vP�����8�po ������P�����<�po ������|P���ؚ@�po �����h�P���ؚD�po �������P����H�po �����(�P����L�po ������vP����P�po ������P����T�po ������vP���,�X�po ������P���,�\�po`�����4�P���H�`�po ������|P���d�h�po �����h�P���d�l�po������yP�����p�po������P�����t�po������yP�����x�po������P�����|�po������yP�������po������P�������po ������vP�������po ������P�������po������oP������po�������P������po ������P������po   ������P���(���po!! ������P���D���po"" ������P���`���po�����������$��$��4��4�������������������D�D�T�T�T�T���d�d�����WEVT��
T���ī�T���CHANd�����HMicrosoft-Windows-PCI/DiagnosticPRVA@h�Microsoft-Windows-PCIOPCO01��win:InfoLEVL@Pܫ(win:InformationalTASKP
����,�(AspmErrataRundownKEYW,����p�DiagEVNTD

�������Ы�����`�WEVT�,�	��̮
�����������CHAN�H��������\Microsoft-Windows-Kernel-StoreMgr/Analytic`Microsoft-Windows-Kernel-StoreMgr/OperationalMAPS�<��VMAP$����VMAP$`���4CacheTerminationMsgMap8StoreMgrCorruptPageMsgMapTTBL� TEMP|x�w��49�-T��O[T!����lD�	EventDataA��9�oData!K�NameDataKey
A��9�oData!K�NameDataMgr
A��A�oData)K�NameStoreOffset
A��G�oData/K�NameCompressedSize
A��5�oDataK�NameFlags
ܰ�� �D�DataKeyDataMgrStoreOffset$CompressedSizeFlagsTEMP�l���` �U�E3�C�����D�	EventDataA��9�oData!K�NameDataKey
A��9�oData!K�NameDataMgr
A��A�oData)K�NameStoreOffset
����вDataKeyDataMgrStoreOffsetTEMPt	��U�81��P{G]\��-���D�	EventDataA��;�oData#K�NameStoreKey
A��C�oData+K�NameStoreFileKey
A��A�oData)K�NameUserDataMgr
A��A�oData)K�NameMetadataMgr
A��?�oData'K�Name
RegionSize
A��A�oData)K�NameRegionCount
A��=�oData%K�Name	BlockSize
A��?�oData'K�Name
SectorSize
A��O�oData7K�NameEncryptionStrength
A��=�oData%K�Name	StoreType
	A��9�oData!K�NameStoreId
A��C�oData+K�NameBlocksStored
A��C�oData+K�NameRegionsInUse
A��G�oData/K�NameTotalSpaceUsed

A��5�oDataK�NameFlags
A��I�oData1K�NameMetaRegionCount
A��K�oData3K�NameMetaRegionsInUse
A��S�oData;K�NameMetaRegionsSpaceUsed
A��=�oData%K�Name	StoreTime
$�<�\�x�����̺��,�D�X�x�����̻��H�StoreKey StoreFileKeyUserDataMgrMetadataMgrRegionSizeRegionCountBlockSizeSectorSize,EncryptionStrengthStoreTypeStoreId BlocksStored RegionsInUse$TotalSpaceUsedFlags$MetaRegionCount(MetaRegionsInUse0MetaRegionsSpaceUsedStoreTimeTEMP���4�d*�cS�Ս&w)�t��\D�	EventDataA��;�oData#K�NameStoreKey
�StoreKeyTEMP�T�����_Ql6��a� ��D�	EventDataA��9�oData!K�NameDataMgr
A��G�oData/K�NameVirtualAddress
A��I�oData1K�NamePhysicalAddress

A��3�oDataK�NameSize
A��?�oData'K�Name
FileBacked
A��G�oData/K�NameCorruptionType
A��5�oDataK�NameFlags
��
�<��L�h���DataMgr$VirtualAddress$PhysicalAddressSizeFileBacked$CorruptionTypeFlagsTEMP�D����v�z]���	8XIG��rD�	EventDataA��9�oData!K�NameDataMgr
A��A�oData)K�NameRegionIndex
A��7�oDataK�NameStatus
A��=�oData%K�Name	SpaceUsed
A��G�oData/K�NameLastAccessTime
���������DataMgrRegionIndexStatusSpaceUsed$LastAccessTimeTEMP@���B��ZR�-))��>D�	EventDataA��?�oData'K�Name
FailReason
A��?�oData'K�Name
FailStatus
A��K�oData3K�NameObjectPathLength
A��?�oData'K�Name
ObjectPath
���$�L�FailReasonFailStatus(ObjectPathLengthObjectPathTEMP,�Kz�?�pY�ޔaB@�d���D�	EventDataA��3�oDataK�NameSize
A��3�oDataK�NameData
T�d�SizeDataTEMPxx���(߀09S���	6����D�	EventDataA��;�oData#K�NameStoreKey
A��3�oDataK�NameSize
A��3�oDataK�NameData
������StoreKeySizeDataTEMP��R0qTBV��) ���D�	EventDataA��;�oData#K�NameStoreKey
A��5�oDataK�NameParam
����StoreKeyParamTEMPL��Y�q�U���������D�	EventDataA��7�oDataK�NameReason
A��?�oData'K�Name
FailStatus
A��K�oData3K�NameDeviceDescLength
A��M�oData5K�NameDeviceDescription
A��K�oData3K�NameObjectPathLength
A��?�oData'K�Name
ObjectPath
<����������8�ReasonFailStatus(DeviceDescLength(DeviceDescription(ObjectPathLengthObjectPathTEMP`���Ǎ��Y<��������D�	EventDataA��9�oData!K�NameSqmType
A��G�oData/K�NameSqmSessionGuid
A��5�oDataK�NameSqmID
A��O�oData7K�NameSqmStreamRowLength
A��QZ�ComplexData+K�NameSqmStreamRow
��������0�P�p���SqmType$SqmSessionGuidSqmID,SqmStreamRowLength SqmStreamRow SqmTypeEntry SqmDWORDEntry$SqmStringEntryPRVAX��Microsoft-Windows-Kernel-StoreMgrOPCOx1<�2T�2l�win:Infowin:Startwin:StopLEVL@P��(win:InformationalTASK���������������������������������8�����\�������	������
�����������������
���� �����<�����\�����|�������StoreAddStoreRemoveStoreCreateStoreDelete StoreRundown$StoreCorruption(StorePageRundownRegionEvictRegionWrite(UnpersistFailure StoreIoStatsGlobalStatsStoreEmpty RegionRelease RegionCompact RegionRundown(CacheTerminationKEYW������@����(������@�4p�StoreOpsStoreDiag0StoreContentsRundownwin:SQMEVNT������خ�����(�(������T������,�(�����������0�(������`����$�4�(����������@�8�(�P@�����\�<�8�������خ���x�D�(�������������H�(�		������������L�(�

P@�(������P�8������t������X�(������h�����\�(�

���������� �`�(�����������<�d�(��������$���X�h�(��������0���X�l�(������������t�p�(�P@�������t�8�����T���|��������������������������������������������WEVT�������
�x��������TTBLPTEMPDL��͟�,�Vo�9��{���BD�	EventDataA��9�oData!K�NameSqmType
A��G�oData/K�NameSqmSessionGuid
A��5�oDataK�NameSqmID
A��W�oData?K�NameSqmDWORDDatapointValue
��������SqmType$SqmSessionGuidSqmID4SqmDWORDDatapointValuePRVA`,�Microsoft-Windows-Kernel-LicensingSqmOPCOLEVL@P��(win:InformationalTASKKEYW04��win:SQMEVNTD��������@���WEVTh:�������
�����CHANt������XMicrosoft-Windows-Kernel-Memory/AnalyticTTBL�0TEMP�

��!5
.)]���Z�����^D�	EventDataA��G�oData/K�NamePriorityLevels
A��E�oData-K�Name
ZeroPageCount
A��E�oData-K�Name
FreePageCount
A��M�oData5K�NameModifiedPageCount
A��[�oDataCK�NameModifiedNoWritePageCount
A��C�oData+K�NameBadPageCount
A��M�oData5K�NameStandbyPageCounts
�A��S�oData;K�NameRepurposedPageCounts
�A��]�oDataEK�NameModifiedPageCountPageFile
A��O�oData7K�NamePagedPoolPageCount
	A��U�oData=K�NameNonPagedPoolPageCount
A��C�oData+K�NameMdlPageCount
A��I�oData1K�NameCommitPageCount
�������8�p������� �L�|���$PriorityLevels ZeroPageCount FreePageCount(ModifiedPageCount8ModifiedNoWritePageCount BadPageCount(StandbyPageCounts0RepurposedPageCounts8ModifiedPageCountPageFile,PagedPoolPageCount0NonPagedPoolPageCount MdlPageCount$CommitPageCountTEMPp��R���n.R����H����D�	EventDataA��5�oDataK�NameCount
A��QZ�ComplexData+K�NameWSCommitInfo
�0�@�`�x�������Count WSCommitInfoProcessID,WorkingSetPageCount$CommitPageCount,VirtualSizeInPages<PrivateWorkingSetPageCountTEMP$
�R���n.R����H����D�	EventDataA��5�oDataK�NameCount
A��QZ�ComplexData+K�NameWSCommitInfo
������$�P�t������,�Count WSCommitInfoProcessID,WorkingSetPageCount$CommitPageCount,VirtualSizeInPages<PrivateWorkingSetPageCount,StoreSizePageCount$StoredPageCount(CommitDebtInPagesTEMPd8�R���n.R����H����D�	EventDataA��5�oDataK�NameCount
A��QZ�ComplexData+K�NameWSCommitInfo
��	$�D�\��������@�d���Count WSCommitInfoProcessID,WorkingSetPageCount$CommitPageCount,VirtualSizeInPages<PrivateWorkingSetPageCount,StoreSizePageCount$StoredPageCount(CommitDebtInPages,SharedCommitInPagesTEMP�����?"~�[&
�S�%�\���D�	EventDataA��5�oDataK�NameCount
A��_Z�ComplexData9K�NameSessionWSCommitInfo
�4�D�p��������Count,SessionWSCommitInfoSessionId,WorkingSetPageCount$CommitPageCount,PagedPoolPageCount<PrivateWorkingSetPageCountTEMP<
0���?"~�[&
�S�%�\���D�	EventDataA��5�oDataK�NameCount
A��_Z�ComplexData9K�NameSessionWSCommitInfo
����4�L�x������0�T�Count,SessionWSCommitInfoSessionId,WorkingSetPageCount$CommitPageCount,PagedPoolPageCount<PrivateWorkingSetPageCount,StoreSizePageCount$StoredPageCount(CommitDebtInPagesTEMP|l���?"~�[&
�S�%�\���D�	EventDataA��5�oDataK�NameCount
A��_Z�ComplexData9K�NameSessionWSCommitInfo
�H�	X��������T������Count,SessionWSCommitInfoSessionId,WorkingSetPageCount$CommitPageCount,PagedPoolPageCount<PrivateWorkingSetPageCount,StoreSizePageCount$StoredPageCount(CommitDebtInPages,SharedCommitInPagesTEMP����)m���N_}݉�T3n��^D�	EventDataA��=�oData%K�Name	ProcessId
��ProcessIdTEMP ���de�^��<3�����D�	EventDataA��=�oData%K�Name	ProcessId
A��5�oDataK�NameFlags
���ProcessIdFlagsTEMP����tMO%�XRVw�*�����D�	EventDataA��=�oData%K�Name	ProcessId
A��7�oDataK�NameStatus
A��G�oData/K�NamePagesProcessed
4�L�`�ProcessIdStatus$PagesProcessedTEMP������USg�\zY�4.��D�	EventDataA��=�oData%K�Name	ProcessId
A��7�oDataK�NameStatus
A��G�oData/K�NamePagesProcessed
A��_�oDataGK�NameWriteCombinePagesProcessed
A��W�oData?K�NameUncachedPagesProcessed
A��Q�oData9K�NameCleanPagesProcessed
8�P�d������ProcessIdStatus$PagesProcessed<WriteCombinePagesProcessed4UncachedPagesProcessed,CleanPagesProcessedTEMP$��V]���])&�l�Q|{���D�	EventDataA��=�oData%K�Name	ProcessId
A��7�oDataK�NameStatus
4ProcessIdStatusTEMP��bP���P���J&� ���ZD�	EventDataA��9�oData!K�NameAcgFlag
�AcgFlagTEMP8������Z�v��N˝���jD�	EventDataA��W�oData?K�NameDurationInMicroseconds

A��?�oData'K�Name
TotalBytes

A��?�oData'K�Name
LowAddress

A��A�oData)K�NameHighAddress

A��=�oData%K�Name	SkipBytes

A��S�oData;K�NameMemoryDescriptorList
A��=�oData%K�Name	IdealNode
A��5�oDataK�NameFlags


@

t
�
�
��(4DurationInMicrosecondsTotalBytesLowAddressHighAddressSkipBytes0MemoryDescriptorListIdealNodeFlagsTEMPd

��s��cR��5���Ͻ��D�	EventDataA��W�oData?K�NameDurationInMicroseconds

A��?�oData'K�Name
TotalBytes

A��?�oData'K�Name
LowAddress

A��A�oData)K�NameHighAddress

A��;�oData#K�NameBoundary

A��I�oData1K�NamePhysicalAddress

A��E�oData-K�Name
MappedAddress
A��M�oData5K�NameAllocatedFromPool

A��G�oData/K�NameProtectionMask
A��E�oData-K�Name
PreferredNode
	

L	

�	
�	
�	
�	
�	


0
X
|
4DurationInMicrosecondsTotalBytesLowAddressHighAddressBoundary$PhysicalAddress MappedAddress(AllocatedFromPool$ProtectionMask PreferredNodeTEMP
��깗x��S���њ���D�	EventDataA��A�oData)K�NamePartitionId
A��5�oDataK�NameCount
A��UZ�ComplexData/K�NameMemoryNodeInfo
���
� 
<
`
�
�
�
<h�PartitionIdCount$MemoryNodeInfoNodeNumber$TotalPageCount,SmallFreePageCount,SmallZeroPageCount,MediumFreePageCount,MediumZeroPageCount,LargeFreePageCount,LargeZeroPageCount(HugeFreePageCount(HugeZeroPageCountPRVAT�Microsoft-Windows-Kernel-MemoryOPCOx1<2T2lwin:Infowin:Startwin:StopLEVL@P�(win:InformationalTASK	������������������� ����H����p����|�����	�����MemInfoMemInfoWS(MemInfoSessionWS(WorkingSetOutSwap(WorkingSetInSwapAcg MdlAllocation$ContAllocationMemInfoNodeKEYW� ����H@�������������������4����|<KERNEL_MEM_KEYWORD_MEMINFO@KERNEL_MEM_KEYWORD_MEMINFO_EX<KERNEL_MEM_KEYWORD_WS_SWAP4KERNEL_MEM_KEYWORD_ACGHKERNEL_MEM_KEYWORD_PHYSICAL_ALLOCDKERNEL_MEM_KEYWORD_MEMINFO_NODEEVNT� ��������`��@���������d��@�����0���h��@�����T���l��@��������p��@�����@��t��@�����|��x����������$�$|����������$�$����������0�$�����������0�$�����������$�@�����������$�@���������$�0�@��������H�\���	������$��@���
������x��������8�����	������
������������((8WEVT�6�	`T
�FTG�GHH�ICHAN\@�����������XMicrosoft-Windows-Kernel-ShimEngine/DebugdMicrosoft-Windows-Kernel-ShimEngine/OperationaldMicrosoft-Windows-Kernel-ShimEngine/DiagnosticMAPS��tVMAP$��VMAP$���LKSE:DeviceFlagApplied.FlagSourceMapLKSE:DriverShimApplied.ShimSourceMapTTBL�,TEMP48Z~�B ;�\�Y�q�h:���D�	EventDataA��9�oData!K�NameEventId
A��C�oData+K�NameDebugMessage
`tEventId DebugMessageTEMP(��%oM���]�@/Hxɫ��4D�	EventDataA��?�oData'K�Name
DriverName
A��?�oData'K�Name
ShimSource
A��=�oData%K�Name	ShimCount
A��C�oData+K�NameAppliedGuids
Lth��DriverNameShimSourceShimCount AppliedGuidsTEMP-
U&O�SA����4��*D�	EventDataA��?�oData'K�Name
DeviceName
A��A�oData)K�NameDeviceClass
A��?�oData'K�Name
FlagSource
A��5�oDataK�NameFlags

l���

�DeviceNameDeviceClassFlagSourceFlagsTEMP��!�N��_���ք������D�	EventDataA��?�oData'K�Name
DriverName
A��?�oData'K�Name
DriverBase
A��?�oData'K�Name
DriverSize
A��I�oData1K�NameDriverTimeStamp
A��G�oData/K�NameDriverCheckSum
�!","H"l"DriverNameDriverBaseDriverSize$DriverTimeStamp$DriverCheckSumTEMPDp#ef2�_�Ǎ;�vB���D�	EventDataA��C�oData+K�NameDriverObject
A��?�oData'K�Name
DriverBase
�#�# DriverObjectDriverBaseTEMPd�%O]S��Rx�������D�	EventDataA��?�oData'K�Name
DriverBase
A��?�oData'K�Name
DriverSize
A��C�oData+K�NameDriverObject
A��1�oDataK�NamePdo
A��7�oDataK�NameStatus
A��A�oData)K�NameServiceName
A��?�oData'K�Name
HardwareId
�&�&�&�&�&''DriverBaseDriverSize DriverObjectPdoStatusServiceNameHardwareIdTEMP0�(�<au2Pۜ�]i���DD�	EventDataA��9�oData!K�NameAddress
A��7�oDataK�NameCaller
A��3�oDataK�NameType
A��3�oDataK�NameSize
A��1�oDataK�NameTag
)()<)L)\)AddressCallerTypeSizeTagTEMPtl*e�5��J]Y���9����D�	EventDataA��9�oData!K�NameAddress
A��7�oDataK�NameCaller
A��1�oDataK�NameTag
�*�*�*AddressCallerTagTEMP|�+��k,H�lZ.�7u1�n:���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
 ,@,L, DriverObjectFdoIrpTEMPL.��h؂iAQ��՜����D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��?�oData'K�Name
DeviceType
A��U�oData=K�NameDeviceCharacteristics
A��=�oData%K�Name	Exclusive
A��7�oDataK�NameStatus
�.�.�./</T/ DriverObjectFdoDeviceType0DeviceCharacteristicsExclusiveStatusTEMPT�0���ܐ�_���R����VD�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��=�oData%K�Name	MajorCode
A��7�oDataK�NameStatus
X1x1�1�1�1 DriverObjectFdoIrpMajorCodeStatusTEMPTH3w����RĚ�pȧ'��VD�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��=�oData%K�Name	MinorCode
A��7�oDataK�NameStatus
�3�3�3�3�3 DriverObjectFdoIrpMinorCodeStatusTEMP�X5�b6wm+^��>��.���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��7�oDataK�NameStatus
�5�5�5�5 DriverObjectFdoIrpStatusTEMP�<7�b6wm+^��>��.���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��7�oDataK�NameStatus
�7�7�7�7 DriverObjectFdoIrpStatusTEMP8�9��g��cQ胉� �o8���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��=�oData%K�Name	MinorCode
A��=�oData%K�Name	PowerType
A��?�oData'K�Name
PowerState
A��7�oDataK�NameStatus
x:�:�:�:�:�:�: DriverObjectFdoIrpMinorCodePowerTypePowerStateStatusTEMP8$=��g��cQ胉� �o8���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��=�oData%K�Name	MinorCode
A��=�oData%K�Name	PowerType
A��?�oData'K�Name
PowerState
A��7�oDataK�NameStatus
�=�=�=�=>>4> DriverObjectFdoIrpMinorCodePowerTypePowerStateStatusTEMP�@b}}����_�G��&Sv����D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��=�oData%K�Name	MinorCode
A��?�oData'K�Name
PowerState
A��7�oDataK�NameStatus
�@�@�@�@�@�@ DriverObjectFdoIrpMinorCodePowerStateStatusTEMP�XB�b6wm+^��>��.���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��7�oDataK�NameStatus
�B�B�B�B DriverObjectFdoIrpStatusTEMP��D�N��_���ք������D�	EventDataA��?�oData'K�Name
DriverName
A��?�oData'K�Name
DriverBase
A��?�oData'K�Name
DriverSize
A��I�oData1K�NameDriverTimeStamp
A��G�oData/K�NameDriverCheckSum
E4EPElE�EDriverNameDriverBaseDriverSize$DriverTimeStamp$DriverCheckSumTEMPD�Fef2�_�Ǎ;�vB���D�	EventDataA��C�oData+K�NameDriverObject
A��?�oData'K�Name
DriverBase
�F�F DriverObjectDriverBasePRVA\GMicrosoft-Windows-Kernel-ShimEngineOPCO01lGwin:InfoLEVL�P�GP�G[�Gwin:Error(win:Informationalwin:VerboseTASKKEYW������H�����H�����H����(I����LI����tI�����I �����I(ShimEngineEvents,ShimEngineMessages,DriverScopeGeneral$DriverScopePnp(DriverScopePower$DriverScopeIrps$DriverScopePool4SkipDriverUnloadGeneralEVNTD�����`�G�����`�G@��`G�G @��`G�G  @�����B�G�M  @�����E�G�M 
 ������G�M0 �����"�G�M0 �����#�GN0
 ����8'�GN0 ����h)�GN0 �����*�GN0 ����X,�GN0 ����h/�GN0 �����1�GN0 ����4�GN0 �����5�G N0 �����7�G$N0 ����;�G(N0 ����H>�G,N0 ����A�G0N0�H�HHHHHHH�H�HxHHHxHXHXHXHhHhHhHhHWEVTl�
tN�NODOPO`OPRVA��NMicrosoft-Windows-Kernel-Licensing-StartServiceTriggerOPCOLEVL@PO(win:InformationalTASKKEYWEVNT@����OWEVTX�����O
`P�P�PPQR(RCHANxP����\Microsoft-Windows-Kernel-IoTrace/DiagnosticPRVAXtPMicrosoft-Windows-Kernel-IoTraceOPCO01�Pwin:InfoLEVLhPQ[4Q(win:Informationalwin:VerboseTASK������Q�����Q�����Q$UserInitiatedIoKernelIo,ActivityIdTransferKEYWEVNT�������P�P\Q�O������PQxQ�O������PQxQ�O������P�P�Q�OWEVT�m�HS0U
�p�ĝ|����CHAN��S	��S�T����tT�����T����Application\Microsoft-Windows-AppModel-Runtime/AnalyticXMicrosoft-Windows-AppModel-Runtime/AdminXMicrosoft-Windows-AppModel-Runtime/DebugdMicrosoft-Windows-AppModel-Runtime/DiagnosticsTTBL�G(TEMPH V��U�%T�d<�
�����D�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
HV`VErrorCode$PackageFullNameTEMPt�X'$�vS�^a�[.�������D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��I�oData1K�NameParentProcessID
A��I�oData1K�NamePackageFullName
A��=�oData%K�Name	ImageName
A��c�oDataKK�NamePackageRelativeApplicationId
$Y<YXY|Y�Y�YProcessIDCreateTime$ParentProcessID$PackageFullNameImageName@PackageRelativeApplicationIdTEMP�$[zsS��&]����%Ǚ���D�	EventDataA��I�oData1K�NamePackageFullName
A��=�oData%K�Name	ErrorCode
A��C�oData+K�NameErrorMessage
`[�[�[$PackageFullNameErrorCode ErrorMessageTEMP��\}��s!t
^�p�v�W���D�	EventDataA��I�oData1K�NamePackageFullName
A��=�oData%K�Name	ErrorCode
A��C�oData+K�NameFailedBinary
$]H]`]$PackageFullNameErrorCode FailedBinaryTEMP�^?~�v|�Uj��]�4���^D�	EventDataA��=�oData%K�Name	ErrorCode
(^ErrorCodeTEMP@X`�����wZۉML-e�����D�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��3�oDataK�NameSize

A��7�oDataK�NameOffset
A��?�oData'K�Name
HeaderAddr
A��9�oData!K�NameSection
A��=�oData%K�Name	ProcessId
�`�`

a$a8aTahaFileNameErrorCodeSizeOffsetHeaderAddrSectionProcessIdTEMP�Xc�2Ol�T�>��6�����D�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��3�oDataK�NameSize

A��?�oData'K�Name
HeaderAddr
A��9�oData!K�NameSection
A��=�oData%K�Name	ProcessId
�c�c

dd,d@dFileNameErrorCodeSizeHeaderAddrSectionProcessIdTEMPPf��/Q}�Q����B����D�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��3�oDataK�NameSize

A��?�oData'K�Name
HeaderAddr
A��W�oData?K�NameApplicationUserModelId
A��=�oData%K�Name	ProcessId
�f�f

�fg$gXgFileNameErrorCodeSizeHeaderAddr4ApplicationUserModelIdProcessIdTEMPpi&�8#}�NX[V��PpK���dD�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��3�oDataK�NameSize

A��?�oData'K�Name
HeaderAddr
A��=�oData%K�Name	ProcessId
li�i

�i�i�iFileNameErrorCodeSizeHeaderAddrProcessIdTEMP��jR�n#�V�!�qT����D�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��=�oData%K�Name	ProcessId
4kLkdkFileNameErrorCodeProcessIdTEMP<Xl���DI�]���jzXK���D�	EventDataA��;�oData#K�NameFileName
A��E�oData-K�Name
ExceptionCode
�l�lFileName ExceptionCodeTEMP�nB��
��;V ,��1~���D�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��3�oDataK�NameType
A��=�oData%K�Name	ProcessId
\ntn�n�nFileNameErrorCodeTypeProcessIdTEMPH�o�uSQk�Xޱt!֝6A���D�	EventDataA��I�oData1K�NamePackageFullName
A��=�oData%K�Name	ErrorCode
�o�o$PackageFullNameErrorCodeTEMPTq}4j�n��]l���=�0��$D�	EventDataA��I�oData1K�NamePackageFullName
A��1�oDataK�NameKey
A��7�oDataK�NameSubkey
A��=�oData%K�Name	ErrorCode
�q�q�q�q$PackageFullNameKeySubkeyErrorCodeTEMPXs}4j�n��]l���=�0��$D�	EventDataA��I�oData1K�NamePackageFullName
A��1�oDataK�NameKey
A��7�oDataK�NameSubkey
A��=�oData%K�Name	ErrorCode
�s�s�s�s$PackageFullNameKeySubkeyErrorCodeTEMP\u}4j�n��]l���=�0��$D�	EventDataA��I�oData1K�NamePackageFullName
A��1�oDataK�NameKey
A��7�oDataK�NameSubkey
A��=�oData%K�Name	ErrorCode
�u�u�u�u$PackageFullNameKeySubkeyErrorCodeTEMPP�v	�p\k��&�����D�	EventDataA��M�oData5K�NamePackageFamilyName
A��=�oData%K�Name	ErrorCode
w@w(PackageFamilyNameErrorCodeTEMP(,x�c��+U���w�6p����D�	EventDataA��=�oData%K�Name	ErrorCode
A��9�oData!K�NameContext
TxlxErrorCodeContextTEMP(Ty�c��+U���w�6p����D�	EventDataA��=�oData%K�Name	ErrorCode
A��9�oData!K�NameContext
|y�yErrorCodeContextTEMP�<z?~�v|�Uj��]�4���^D�	EventDataA��=�oData%K�Name	ErrorCode
PzErrorCodeTEMP�{�&؍1�
U)��;߸C��lD�	EventDataA��K�oData3K�NameAppContainerName
{(AppContainerNameTEMP��{t+=D{��Q
��m����jD�	EventDataA��I�oData1K�NamePackageFullName
�{$PackageFullNameTEMPH} ����2B[&�Ŧ�]$���D�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
(}@}ErrorCode$PackageFullNameTEMP,8~�ˀf��S �t�:sV����D�	EventDataA��=�oData%K�Name	ErrorCode
A��;�oData#K�NameResource
`~x~ErrorCodeResourceTEMP,d�ˀf��S �t�:sV����D�	EventDataA��=�oData%K�Name	ErrorCode
A��;�oData#K�NameResource
��ErrorCodeResourceTEMPH�� ����2B[&�Ŧ�]$���D�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
Ȁ�ErrorCode$PackageFullNameTEMP� �ر`n���[m��,l��.���D�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
A��3�oDataK�NameUser
\�t���ErrorCode$PackageFullNameUserTEMPH$�uBԘ|Xl��%�{�Z��FD�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
A��E�oData-K�Name
DesiredStatus
A��E�oData-K�Name
CurrentStatus
t�����ЄErrorCode$PackageFullName DesiredStatus CurrentStatusTEMP�(��~��uB�YĴ��z�E��D�	EventDataA��I�oData1K�NamePackageFullName
A��E�oData-K�Name
DesiredStatus
A��E�oData-K�Name
CurrentStatus
d�����$PackageFullName DesiredStatus CurrentStatusTEMP�|���^�m�Q���w�
���D�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
A��3�oDataK�NameUser
A��E�oData-K�Name
DesiredStatus
A��E�oData-K�Name
CurrentStatus
����,�L�ErrorCode$PackageFullNameUser DesiredStatus CurrentStatusTEMP4܊�9%�'S��`Zdv{���<D�	EventDataA��I�oData1K�NamePackageFullName
A��3�oDataK�NameUser
A��E�oData-K�Name
DesiredStatus
A��E�oData-K�Name
CurrentStatus
,�P�`���$PackageFullNameUser DesiredStatus CurrentStatusTEMP(t��c��+U���w�6p����D�	EventDataA��=�oData%K�Name	ErrorCode
A��9�oData!K�NameContext
����ErrorCodeContextTEMP�x�ü��V�]6�D����zD�	EventDataA��=�oData%K�Name	ProcessID
A��A�oData)K�NamePackageName
A��=�oData%K�Name	ImageName
A��I�oData1K�NameApplicationName
A��9�oData!K�NameMessage
܎��(�L�ProcessIDPackageNameImageName$ApplicationNameMessageTEMP����6���RSX�˜����zD�	EventDataA��A�oData)K�NamePackageName
A��=�oData%K�Name	ImageName
A��I�oData1K�NameApplicationName
A��=�oData%K�Name	ErrorCode
A��9�oData!K�NameMessage
t�����̑�PackageNameImageName$ApplicationNameErrorCodeMessageTEMP�$��n#Ύ��X��sk�	�����D�	EventDataA��A�oData)K�NamePackageName
A��E�oData-K�Name
ContainerName
A��A�oData)K�NameContainerId
`�|���PackageName ContainerNameContainerIdTEMP�ܔC|3*C�uVo���.}+���D�	EventDataA��=�oData%K�Name	ProcessID
A��A�oData)K�NamePackageName
A��A�oData)K�NameContainerId
�0�L�ProcessIDPackageNameContainerIdTEMP Жz`y�-'1T��x¤�r���2D�	EventDataA��=�oData%K�Name	ErrorCode
A��=�oData%K�Name	ProcessID
A��A�oData)K�NamePackageName
A��A�oData)K�NameContainerId
 �8�P�l�ErrorCodeProcessIDPackageNameContainerIdTEMP����vgz!XX_�HT
"I���D�	EventDataA��=�oData%K�Name	ErrorCode
A��A�oData)K�NamePackageName
A��E�oData-K�Name
ContainerName
�� �ErrorCodePackageName ContainerNameTEMP@ ��O�L�W�ּY=���D�	EventDataA��A�oData)K�NamePackageName
A��A�oData)K�NameContainerId
H�d�PackageNameContainerIdTEMP� ��Cg�6hT���v#��E��lD�	EventDataA��]�oDataEK�NameCleanupContainerErrorCode
A��W�oData?K�NameMakeTemporaryErrorCode
A��A�oData)K�NamePackageName
A��A�oData)K�NameContainerId
p���ܜ��8CleanupContainerErrorCode4MakeTemporaryErrorCodePackageNameContainerIdPRVA\(�Microsoft-Windows-AppModel-RuntimeOPCOT2��2��win:Startwin:StopLEVL�U�P �P8�PT� win:Criticalwin:Errorwin:Warning(win:InformationalTASK�����������������������4�����|�����ȡd�����e����T�f������g����Ԣh�����i����\�������������أ�����������4������t��������0AppModelProcessStartHAppIntegrityDependencyGraphCheck<AppIntegrityProcessCreationHAppIntegrityInAppValidatePackageLAppModelDynamicPropertiesReadFailedHAppModelDynamicPropertiesInvalidDRestrictedAppContainerCreationDRestrictedAppContainerDeletion<RestrictedAppContainerOpenHRestrictedAppContainerEnumeration@RestrictedAppContainerLaunchLRestrictedAppContainerTerminateAll0AppContainerCreation0AppContainerDeletion,AppContainerUpdate@FirewallAppContainerCreation@FirewallAppContainerDeletionXRestrictedAppContainerUpdateCapabilitiesKEYW�����̥������(� ����X�@����x��������Process AppContainer,DesktopAppXProcess0DesktopAppXContainer0ms:ReservedKeyword40 ms:Telemetryms:Measures$ms:CriticalDataEVNT8�@��V�ȾdS@ ��Yܝ̾tS@ ��YܝԾtS@ ��YܝܾtS@ ��Yܝ�tS@ ��Yܝ�tS ��Yܝ�tS ��[ܝ��tS		�	�[ܝ��TS ��[��tS ��]��tS �@^ܝ�tS ��aܝ�tS �@^ܝ�tS �@^ܝ�tS ��iܝ�tS �|kܝ�tS@ ��Yܝ �tS@ �Xwܝ(�tS �Xwܝ0�tS �Xwܝ4�tS �Xwܝ8�tS �Xwܝ<�tS �Xwܝ@�tS �XwܝD�tS �XwܝH�tS �XwܝL�tS �XwܝP�tS ��yܝT�tS   �XwܝX�tS! !��yܝ\�tS" "��yܝ`�tS# #��yܝd�tS$ $��yܝh�tS% %��yܝl�tS& &��yܝp�tS' '�hz�t�tS( (�hz�x�tS) )�hz�|�tS* *�hz���tS+ +�Xdܝ��tS, ,�pgܝ��tS- -�Xwܝ��tS. .��yܝ��tS/ /��yܝ��tS0 0�Xwܝ��tS1 1�Xwܝ��tS2 2�Xwܝ��tS3 3�Xwܝ��tS4 4�Xwܝ��tS5 5�D{���tS6 6�D{ܝ��tS7 7�D{ܝ��tS8 8�D{���tS9 9�|ܝ��tS: :�|ܝ��tS; ;�|ܝĿtS< <�D{ܝȿtS=@ =��Yܝ̿tS> >�|ܝԿtS? ?�d}ܝؿtS@ @��~ܝܿtSA A��ܝ�tSB B��ܝ�tSC C�����tSD D����tSE E�Ȇ��tSF F�l���tSG G���ܝ��tSHH�����SI I��Yܝ�tSJ J��lܝ�tSK K��nܝ�tSL L��oܝ�tSM M�rܝ�tSN N�tܝ�tSO  O�vН�tSP  P�vܝ �tSQ Q�<Uܝ(�tSe�e�hz|��؟,��Sf�f�Xw���؟0��Sg�g�hz|���4��Sh�h�Xw����8��Si�i�hz|���<��Sj�j�Xw����@��Sk�k�hz|��,�D��Sl�l��x���,�H��Sm�m�hz|��H�L��Sn�n��x���H�P��Sodo�hz|��0�T��Spdp��x���0�X��Sqeq�hz|��L�\��Srer��x���L�`��Ssfs�hz|��h�d��Stft��x���h�h��Sugu�hz|����l��Svgv��x�����p��Swhw�hz|����t��Sxhx��x�����x��Syiy�hz|����|��Sziz��x��������S{{�D{|�������S||�|��������S}}�D{|�������S~~�|��������S�D{|��ܞ���S���|���ܞ���S����hz���,����S����hz|��d����S�����x���d����S� ��Ȍ���tS� ��`�ܝ��tS� ��`�ܝ��tS� ��`�ܝ��tS� ��`�ܝ��tS� ��`�ܝ��tS� ��`�ܝ��tS� ��`�ܝ�tS� ��`�ܝ�tS� ������tS� ������tS� ��h�ܝ�tS� ����ܝ�tS� ����ܝ�tS� ����ܝ�tS� ����ܝ�tS� ��@���tS� ������tS��x��x��x��x��x�������������x�(�x�(�(�(�(�(�(�(�(�(�(�(�(�(�(�(�(�(�(�(�(�(��������������������x�������������������h��h��(�(�(�(�(�(�(�(�(�(�(�(�(�(�(�(�(�(�(�(�(�(�������(�(�(�8�8�8�8�8�8�8�8�8�H�H�H�H�H�H�H�H�H�WEVT?�@�H�
��D���$����CHAN|�	������ApplicationTMicrosoft-Windows-AppModel-State/Debug\Microsoft-Windows-AppModel-State/DiagnosticTTBL�
TEMP���!��5�"0W�
P�څ���rD�	EventDataA��Q�oData9K�NameInformationalString
�,InformationalStringTEMP(�v��(8\�$������D�	EventDataA��A�oData)K�NameErrorString
A��5�oDataK�NameError
8�T�ErrorStringErrorTEMP�������br�RiM1$U�����D�	EventDataA��C�oData+K�NameFolderString
A��E�oData-K�Name
PackageString
A��5�oDataK�NameError
����� FolderString PackageStringErrorTEMP�(�p���p[&Xp�� T�����D�	EventDataA��E�oData-K�Name
PackageString
A��9�oData!K�NameUserSid
A��5�oDataK�NameError
d����� PackageStringUserSidErrorTEMP���v��k�T�l/�;c���D�	EventDataA��=�oData%K�Name	Operation
A��E�oData-K�Name
PackageFamily
A��G�oData/K�NameOperationError
�(�H�Operation PackageFamily$OperationErrorTEMP\��hyVb��X\x�5y�f/��ND�	EventDataA��=�oData%K�Name	Operation
A��E�oData-K�Name
PackageFamily
A��G�oData/K�NameOperationError
A��O�oData7K�NameRepairTriggerError
@�X�x���Operation PackageFamily$OperationError,RepairTriggerErrorTEMP$���mQ�5�Qj�8!~��C���D�	EventDataA��?�oData'K�Name
FolderPath
A��5�oDataK�NameError
����FolderPathErrorPRVAX�Microsoft-Windows-AppModel-StateOPCOT2h�2��win:Startwin:StopLEVL�P��P��P��win:Errorwin:Warning(win:InformationalTASK�+����������,�����p����������������\�������������d����8�e������f�����g������h�����i������j���� �k������l����D�m������n����T�o������p����x�q�����r������s����8�t������u����\�v������w������x�����y������z����8�{������|����T�}������~����h��������������������������������(��������������������8�HAppModel.Task.State.WriteSettingDAppModel.Task.State.ReadSettingHAppModel.Task.State.DeleteSettingTAppModel.Task.State.WriteSettingInAtomPAppModel.Task.State.ReadSettingInAtomTAppModel.Task.State.DeleteSettingInAtomDAppModel.Task.State.CommitAtomDAppModel.Task.State.LoadAppHivelAppModel.Task.StateWinRT.AppDataFactory_ActivationtAppModel.Task.StateWinRT.ApplicationDataServer_LifespanxAppModel.Task.StateWinRT.ApplicationDataServer_GetVersionxAppModel.Task.StateWinRT.ApplicationDataServer_SetVersion�AppModel.Task.StateWinRT.ApplicationDataServer_RoamingStorageQuota�AppModel.Task.StateWinRT.ApplicationDataServer_RoamingStorageUsage�AppModel.Task.StateWinRT.ApplicationDataServer_ActivateContainerServer�AppModel.Task.StateWinRT.ApplicationDataServer_ActivateFileItemServer�AppModel.Task.StateWinRT.ApplicationDataContainerServer_Lifespan�AppModel.Task.StateWinRT.ApplicationDataContainerServer_GetValues�AppModel.Task.StateWinRT.ApplicationDataContainerServer_GetContainers�AppModel.Task.StateWinRT.ApplicationDataContainerServer_CreateContainer�AppModel.Task.StateWinRT.ApplicationDataContainerServer_DeleteContainer�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Lifespan�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Lookup�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Size�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_HasKey�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_GetView�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Insert�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Remove�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Clear�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_First�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Lifespan�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Lookup�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Size�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_HasKey�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_GetView�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Insert�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Remove�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Clear�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_FirstXAppModel.Task.StateWinRT.RoamingRpcSignalhAppModel.Task.StateWinRT.DataChangedEventDispatchPAppModel.Task.StateWinRT.TempCleanuptAppModel.Task.StateWinRT.ApplicationDataServer_ForUserKEYWT(�D�l����� ��1��Structured(UnstructuredResetOutOfMemoryApiSetErrorWinRT$DataStoreError(win:ResponseTimeEVNTl@�<���P�\�@�<���T�\�@���X�\�@�<���\�\� @�<���`�\�@���\�@���\�@�<���\�	@	���\�
	�
<���L�	�<���L�	�<���L�
	�
d���L�@����\�@����\�@����\�@����\�@�T���\�@�<���\�	�����L�	�l���L�	�����L�	�����L�	�l���L�2 ����P���0�d�l�3 ����\���0�l�l�< ����P���L�t�l�= ����\���L�|�l�F ����P���h���l�G ����\���h���l�P ����P�������l�Q ����\�������l�Z ����P�������l�[ ����\�������l�d ����P�������l�e ����\�������l�n ����P������l�o ����\������l�x ����P������l�y ����\������l��d ����P�����l��d ����\�����l��e ����P���,��l��e ����\���,���l��f ����P���H��l��f ����\���H��l��g ����P���d��l��g ����\���d��l��h ����P�����$�l��h ����\�����,�l��j ����P�����4�l��j ����\�����<�l��k ����P�����D�l��k ����\�����L�l��l ����P�����T�l��l ����\�����\�l��m ����P����d�l��m ����\����l�l��n ����P���(�t�l��n ����\���(�|�l�o ����P���D���l�o ����\���D���l�p ����P���`���l�p ����\���`���l�q ����P���|���l�q ����\���|���l�"r ����P�������l�#r ����\�������l�,s ����P������l�-s ����\������l�6t ����P������l�7t ����\������l�@u ����P������l�Au ����\������l�Jv ����P�����l�Kv ����\������l�Tw ����P���$��l�Uw ����\���$��l�^x ����P���@��l�_x ����\���@��l�hy ����P���\�$�l�iy ����\���\�,�l�rz ����P���x�4�l�sz ����\���x�<�l�|{ ����P�����D�l�}{ ����\�����L�l��| ����P�����T�l��| ����\�����\�l��} ����P�����d�l��} ����\�����l�l��~ ����P�����t�l��~ ����\�����|�l�� ����P������l�� ����\������l��� ����P��� ���l��� ����\��� ���l��� ����P���<���l��� ����\���<���l��� ����P���X���l��� ����\���X���l��� ����P���t��l��� ����\���t��l��� ����P������l��� ����\������l��� ����P������l��� ����\������l��� ����P������l��� ����\�������l����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������WEVTl�
D�� 0PRVA�XMicrosoft-Windows-Kernel-WSService-StartServiceTriggerOPCOLEVL@P�(win:InformationalTASKKEYWEVNT@�����WEVT,
�	�\�
��T�$
`
CHAN���H�TMicrosoft-Windows-Kernel-IO/OperationalSystemMAPS�lVMAP4�����@IoMgrDmpEncryptionFailureMapTTBL�TEMP��~�b?P��\�X^����D�	EventDataA��?�oData'K�Name
VolumeGuid
A��K�oData3K�NameVolumeNameLength
A��?�oData'K�Name
VolumeName
Tp�VolumeGuid(VolumeNameLengthVolumeNameTEMP(3n�d���TX�¶?�,���4D�	EventDataA��?�oData'K�Name
VolumeGuid
A��K�oData3K�NameVolumeNameLength
A��?�oData'K�Name
VolumeName
A��5�oDataK�NameError
l���VolumeGuid(VolumeNameLengthVolumeNameErrorTEMPT�A���Ug���f����D�	EventDataA��K�oData3K�NameFilterNameLength
A��?�oData'K�Name
FilterName
�(FilterNameLengthFilterNameTEMPX�	�E���]�y��9щw��JD�	EventDataA��K�oData3K�NameFilterNameLength
A��?�oData'K�Name
FilterName
A��K�oData3K�NameVolumeNameLength
A��?�oData'K�Name
VolumeName

(
D
l
(FilterNameLengthFilterName(VolumeNameLengthVolumeNameTEMP@n��	Y�ώ)@b.����D�	EventDataA��a�oDataIK�NameDumpEncryptionFailureReason
lT<DumpEncryptionFailureReasonPRVAL�Microsoft-Windows-Kernel-IOOPCOx12$2<win:Infowin:Startwin:StopLEVL�P�P�P�win:Errorwin:Warning(win:InformationalTASKD����
VolumeMountKEYW<����@
 VolumeMountsEVNT<����x������x������l����@���`��@�0�`��@��
�`�0
0
0
WEVT|LL��
�H0I�N�N�P�PCHAN�Mt\Microsoft-Windows-Kernel-LiveDump/Analytic`Microsoft-Windows-Kernel-LiveDump/OperationalTTBL9TEMP�p>c'�޽XS떂7�r���\D�	EventDataA��;�oData#K�NameNTStatus
�NTStatusTEMPX�E���*S\=Pu�����D�	EventDataA��q�oDataYK�Name#NtEstimatedRequiredPrimaryDataBytes

A��a�oDataIK�NameNtEstimatedPrimaryDataBytes

A��a�oDataIK�NameHvEstimatedPrimaryDataBytes

A��e�oDataMK�NameHvEstimatedSecondaryDataBytes



�

<

x

�LNtEstimatedRequiredPrimaryDataBytes<NtEstimatedPrimaryDataBytes<HvEstimatedPrimaryDataBytes@HvEstimatedSecondaryDataBytesTEMP�p���o�[�BpZ�������D�	EventDataA��q�oDataYK�Name#NtEstimatedRequiredPrimaryDataBytes

A��a�oDataIK�NameNtEstimatedPrimaryDataBytes

A��a�oDataIK�NameHvEstimatedPrimaryDataBytes

A��e�oDataMK�NameHvEstimatedSecondaryDataBytes

A��a�oDataIK�NameSkEstimatedPrimaryDataBytes

A��a�oDataIK�NameMemoryEstimationDuration_ms

A��]�oDataEK�NameSystemQuiescedDuration_ms

A��e�oDataMK�NameEndMirroringPhasesDuration_ms

A����oDatakK�Name,TotalMirrorPhysicalMemoryCallbackDuration_ms

A��w�oData_K�Name&TotalMirrorPhysicalMemoryCallbackBytes
	
A��q�oDataYK�Name#HvlCalculateLiveDumpSizeDuration_ms



�

@

|

�

�

4

p

�

�

H

�LNtEstimatedRequiredPrimaryDataBytes<NtEstimatedPrimaryDataBytes<HvEstimatedPrimaryDataBytes@HvEstimatedSecondaryDataBytes<SkEstimatedPrimaryDataBytes<MemoryEstimationDuration_ms8SystemQuiescedDuration_ms@EndMirroringPhasesDuration_ms`TotalMirrorPhysicalMemoryCallbackDuration_msTTotalMirrorPhysicalMemoryCallbackBytesLHvlCalculateLiveDumpSizeDuration_msTEMP<e����[�$`����� D�	EventDataA��O�oData7K�NameNtPrimaryDataBytes

A��O�oData7K�NameHvPrimaryDataBytes

A��S�oData;K�NameHvSecondaryDataBytes



x

�

�,NtPrimaryDataBytes,HvPrimaryDataBytes0HvSecondaryDataBytesTEMP$"L����[�^暔��:����D�	EventDataA��O�oData7K�NameNtPrimaryDataBytes

A��O�oData7K�NameHvPrimaryDataBytes

A��S�oData;K�NameHvSecondaryDataBytes

A��O�oData7K�NameSkPrimaryDataBytes

A��g�oDataOK�NameAllocateDumpBuffersDuration_ms

A��i�oDataQK�NameAllocateExtraBuffersDuration_ms

A��y�oDataaK�Name'HvlPrepareLivedumpDescriptorDuration_ms



�"

�"

�"

#

H#

�#

�#,NtPrimaryDataBytes,HvPrimaryDataBytes0HvSecondaryDataBytes,SkPrimaryDataBytesDAllocateDumpBuffersDuration_msDAllocateExtraBuffersDuration_msTHvlPrepareLivedumpDescriptorDuration_msTEMP��%i:9��p�U�sn���Vg���D�	EventDataA��;�oData#K�NameNTStatus
A��?�oData'K�Name
TotalBytes

A��A�oData)K�NameHeaderBytes

A��K�oData3K�NamePrimaryDataBytes

A��O�oData7K�NameSecondaryDataBytes

P&

h&

�&

�&

�&NTStatusTotalBytesHeaderBytes(PrimaryDataBytes,SecondaryDataBytesTEMP��'�8 Q��C�Y�]���pD�	EventDataA��O�oData7K�NameCallbackIdentifier
�',CallbackIdentifierTEMPT�(B|�SUY҂K$���+���D�	EventDataA��O�oData7K�NameCallbackIdentifier
A��;�oData#K�NameNTStatus
�(),CallbackIdentifierNTStatusTEMPh@+��:��W���|�v]���D�	EventDataA��O�oData7K�NameEstimatedPageCount

A��O�oData7K�NameAllocatedPageCount

A��M�oData5K�NameLimitDumpFileSize

A��[�oDataCK�NameDumpFileSizeLimitInBytes

A��[�oDataCK�NameDumpFileSizeLimitReached



�+

�+

�+

$,

\,,EstimatedPageCount,AllocatedPageCount(LimitDumpFileSize8DumpFileSizeLimitInBytes8DumpFileSizeLimitReachedTEMP�$->c'�޽XS떂7�r���\D�	EventDataA��;�oData#K�NameNTStatus
8-NTStatusTEMPd@.N��X��Z��#�G���D�	EventDataA��W�oData?K�NameBufferAllocationScheme

A��;�oData#K�NameNTStatus


h.�.4BufferAllocationSchemeNTStatusTEMPd�/N��X��Z��#�G���D�	EventDataA��W�oData?K�NameBufferAllocationScheme

A��;�oData#K�NameNTStatus


�/04BufferAllocationSchemeNTStatusTEMP��0�RT���C^�Q5�q���bD�	EventDataA��A�oData)K�NameDuration_ms



�0Duration_msTEMP�1Q=Ȋ��YO)�TMa���D�	EventDataA��i�oDataQK�NameMarkRequiredDumpDataDuration_ms



�1DMarkRequiredDumpDataDuration_msTEMP�2Ѧ��YX�-O�p����D�	EventDataA��k�oDataSK�Name MarkImportantDumpDataDuration_ms



�2HMarkImportantDumpDataDuration_msTEMP�6ţB�h}�^��l<FQ����FD�	EventDataA��k�oDataSK�Name PopulateBitmapForDumpDuration_ms

A��s�oData[K�Name$RemoveSystemCacheFromDumpDuration_ms

A��a�oDataIK�NameMemoryEstimationDuration_ms

A��]�oDataEK�NameSystemQuiescedDuration_ms

A��e�oDataMK�NameEndMirroringPhasesDuration_ms

A����oDatakK�Name,TotalMirrorPhysicalMemoryCallbackDuration_ms

A��w�oData_K�Name&TotalMirrorPhysicalMemoryCallbackBytes



7

d7

�7

�7

(8

h8

�8HPopulateBitmapForDumpDuration_msPRemoveSystemCacheFromDumpDuration_ms<MemoryEstimationDuration_ms8SystemQuiescedDuration_ms@EndMirroringPhasesDuration_ms`TotalMirrorPhysicalMemoryCallbackDuration_msTTotalMirrorPhysicalMemoryCallbackBytesTEMP��9�RT���C^�Q5�q���bD�	EventDataA��A�oData)K�NameDuration_ms



�9Duration_msTEMP�|:�RT���C^�Q5�q���bD�	EventDataA��A�oData)K�NameDuration_ms



�:Duration_msTEMP�D;�RT���C^�Q5�q���bD�	EventDataA��A�oData)K�NameDuration_ms



X;Duration_msTEMP X=g�C����P��=�`��4���D�	EventDataA��M�oData5K�NameCorralDuration_ms

A��c�oDataKK�NameDisableInterruptsDuration_ms

A��g�oDataOK�NameSaveSupervisorStateDuration_ms

A��c�oDataKK�NameSuspendClockTimerDuration_ms



�=

�=

>

T>(CorralDuration_ms@DisableInterruptsDuration_msDSaveSupervisorStateDuration_ms@SuspendClockTimerDuration_msTEMP(�@�Q��VˡW�k؄'T8S���D�	EventDataA��Q�oData9K�NameUncorralDuration_ms

A��a�oDataIK�NameEnableInterruptsDuration_ms

A��m�oDataUK�Name!RestoreSupervisorStateDuration_ms

A��a�oDataIK�NameResumeClockTimerDuration_ms



�@

�@

8A

�A,UncorralDuration_ms<EnableInterruptsDuration_msHRestoreSupervisorStateDuration_ms<ResumeClockTimerDuration_msTEMP�EB%LD-R�_�[�4�S��*D�	EventDataA��[�oDataCK�NameMemoryCaptureDuration_ms

A��]�oDataEK�NameSystemQuiescedDuration_ms

A��e�oDataMK�NameEndMirroringPhasesDuration_ms

A����oDatakK�Name,TotalMirrorPhysicalMemoryCallbackDuration_ms

A��w�oData_K�Name&TotalMirrorPhysicalMemoryCallbackBytes

A��e�oDataMK�NameHvlCollectLivedumpDuration_ms

A��c�oDataKK�NameDumpDataBufferingDuration_ms



�E

�E

F

XF

�F

G

LG8MemoryCaptureDuration_ms8SystemQuiescedDuration_ms@EndMirroringPhasesDuration_ms`TotalMirrorPhysicalMemoryCallbackDuration_msTTotalMirrorPhysicalMemoryCallbackBytes@HvlCollectLivedumpDuration_ms@DumpDataBufferingDuration_msTEMPLpH�Rt��S��t�������D�	EventDataA��;�oData#K�NameNTStatus
A��K�oData3K�NameMirrorInProgress

�H

�HNTStatus(MirrorInProgressPRVAX�HMicrosoft-Windows-Kernel-LiveDumpOPCOh
chJd�Je�J
f�JgKh$KiPKj|Kk�Kl�Km�Kv$LwLL}tL��L��L��L�$M�TM��M��M��M �N!�4N"�`NAPIStartAPIEnd8WriteDumpDataToFileStart4WriteDumpDataToFileEnd$MirroringStart,MirroringPhase0End,MirroringPhase1End,SystemQuiesceStart(SystemQuiesceEnd,PageBufferingStart(PageBufferingEnd(BufferEstimation(BufferAllocationRemovePages4CaptureProcessorContext0MarkRequiredDumpData0MarkImportantDumpData0PopulateBitmapForDump,HvlCollectLiveDump8GenerateIptSecondaryData(DumpDataBuffering(CorralProcessors,UncorralProcessors,CaptureMemoryPages8MmDuplicateMemoryFailureLEVL@P�N(win:InformationalTASKNpOO�OP�OQ8PR�P8LIVEDUMP_TASK_CAPTURE_API@LIVEDUMP_TASK_SIZING_WORKFLOWPLIVEDUMP_TASK_CAPTURE_PAGES_WORKFLOWPLIVEDUMP_TASK_WRITE_DEFERRED_DATA_APITLIVEDUMP_TASK_DISCARD_DEFERRED_DATA_APIKEYWEVNT0
6
�_<I�N�N��`�HI�N�N��aTI�N�N�
�b$$`I�N�N��~�I�N�N�e�SlI�NO�f�TxI�NO�g�U�I�NO�h@V�I�NOi@W�I�NOj@t��I�NOj@���I�NOk@u��I�NOk@��I�NOl�x�I�NO�m�y�I�NO�n�z�&�I�NO�o�{�&�I�NO�p�|�'�I�NO�q@�,)�I�NOr@��,�I�NOs@�P-�I�NOt@��.�I�NOu��0�I�NO�v���0�I�NO�w���1�I�NO�x��3J�NO�y��t;8J�NO�z ���>DJ�NO�{"@��G\J�NO��XlI�NO���YxI�NO���Z�I�NO��@[�I�NO�@\�I�NO�@]�I�NO�@^�I�NO���0�I�NO�����0�I�NO�����1�I�NO����3J�NO����9J�NO�����9 J�NO�����:,J�NO����t;8J�NO�� ���>DJ�NO��!@��APJ�NO�"@��G\J�NO�
�n<I�N8O���o�HI�N8O���pTI�N8O��
�q$$`I�N8O��
�r<I�NTO���s�HI�NTO�WEVT0`[
�g0h`h�h�h�hTTBLhTEMP�\I��,c_����v�N��`D�	EventDataA��?�oData'K�Name
ReturnCode
\ReturnCodeTEMPd ]�y�i,UTu�j������D�	EventDataA��S�oData;K�NameNotifyRoutineAddress
A��?�oData'K�Name
ReturnCode
H]x]0NotifyRoutineAddressReturnCodeTEMPLx^=�R�ӛT9����F���D�	EventDataA��I�oData1K�NameTargetProcessId
A��?�oData'K�Name
ReturnCode
�^�^$TargetProcessIdReturnCodeTEMP�`2�l�l9Q+Y�%�6����D�	EventDataA��I�oData1K�NameTargetProcessId
A��E�oData-K�Name
DesiredAccess
A��?�oData'K�Name
ReturnCode
L`p`�`$TargetProcessId DesiredAccessReturnCodeTEMPT,b��v"�\�[�R=����JD�	EventDataA��I�oData1K�NameTargetProcessId
A��G�oData/K�NameTargetThreatId
A��E�oData-K�Name
DesiredAccess
A��?�oData'K�Name
ReturnCode
|b�b�b�b$TargetProcessId$TargetThreatId DesiredAccessReturnCodeTEMP<�c�(�FG�\�\9����I���D�	EventDataA��?�oData'K�Name
DriverName
A��?�oData'K�Name
ReturnCode
d dDriverNameReturnCodeTEMP<e�(�FG�\�\9����I���D�	EventDataA��?�oData'K�Name
DriverName
A��?�oData'K�Name
ReturnCode
@e\eDriverNameReturnCodeTEMPP�fNV���]ۏ�WD�{��HD�	EventDataA��G�oData/K�NameLinkSourceName
A��G�oData/K�NameLinkTargetName
A��E�oData-K�Name
DesiredAccess
A��?�oData'K�Name
ReturnCode
Dghg�g�g$LinkSourceName$LinkTargetName DesiredAccessReturnCodePRVAh�gMicrosoft-Windows-Kernel-Audit-API-CallsOPCO01Hhwin:InfoLEVL@Pxh(win:InformationalTASKKEYWEVNT�����0\<hlh�����]<hlh����xe<hlh����l[<hlh�����^<hlh�����`<hlh����c<hlh����<d<hlhWEVT0x�j�j
@l�l�l�l�lmCHAN\�j	��j�ApplicationSystemTTBLLTEMP@�k-�v6R�^l/{/!�I���D�	EventDataA��5�oDataK�NameCVEID
A��M�oData5K�NameAdditionalDetails
llCVEID(AdditionalDetailsPRVALTlMicrosoft-Windows-Audit-CVEOPCO01�lwin:InfoLEVL4P�lwin:WarningTASKKEYWEVNTp	�k�l�l�j@k�l�l�jWEVT��m
�n�n�n$o0o@oTTBL�TEMP�`n?~�v|�Uj��]�4���^D�	EventDataA��=�oData%K�Name	ErrorCode
tnErrorCodePRVAX�nMicrosoft-Windows-User-DiagnosticOPCOLEVL4Powin:WarningTASKKEYWEVNT@�����m�nWEVTh@�o
�sDtPt\thtxtTTBL(TEMP��q�]@Zl�_k�3�8�2����D�	EventDataA��S�oData;K�NameHeapSnapshotInstance
A��S�oData;K�NameHeapSnapshotSequence
A��U�oData=K�NameHeapSnapshotBufferLen
A��O�oData7K�NameHeapSnapshotBuffer
�qr8rhr0HeapSnapshotInstance0HeapSnapshotSequence0HeapSnapshotBufferLen,HeapSnapshotBufferTEMP\�s�@�
D�WP�+��;����D�	EventDataA��S�oData;K�NameHeapSnapshotInstance
A��=�oData%K�Name	TotalData
�s�s0HeapSnapshotInstanceTotalDataPRVATtMicrosoft-Windows-Heap-SnapshotOPCOLEVLTASKKEYWEVNTpd�����o������rWEVT��l	@u8vLw
��4�@���D�P�CHAN�lum�unhMicrosoft-Windows-Security-Mitigations/KernelModedMicrosoft-Windows-Security-Mitigations/UserModeMAPS�vLvVMAP4�v����VMAP,�v���@RedirectionTrustPolicyTypeMap`SetContextIpValidationFailureContinueTypeMapTTBL�pTEMP�|!�^��[��I���`���tD�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
	A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
�|}4}l}�}�}

�},~l~�~�~(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLine(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTimeTEMPh
X��2�4��oQlW�����D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
	A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��[�oDataCK�NameChildImagePathNameLength
A��O�oData7K�NameChildImagePathName

A��W�oData?K�NameChildCommandLineLength
A��K�oData3K�NameChildCommandLine
����܆�@�h�

��ԇ�`������(�T���(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLine(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime8ChildImagePathNameLength,ChildImagePathName4ChildCommandLineLength(ChildCommandLineTEMP4����O�	��X�s���Ɏ����D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��G�oData/K�NameTargetThreadId
A��W�oData?K�NameTargetThreadCreateTime
A��I�oData1K�NameImageNameLength
A��=�oData%K�Name	ImageName

��ԏ�(�T�l�

�����(�P�t���̑(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection$TargetThreadId4TargetThreadCreateTime$ImageNameLengthImageNameTEMP`	t�kh�
��U�P�	Q���\D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��G�oData/K�NameTargetThreadId
A��W�oData?K�NameTargetThreadCreateTime
A��W�oData?K�NameRequiredSignatureLevel
A��G�oData/K�NameSignatureLevel

A��I�oData1K�NameImageNameLength
A��=�oData%K�Name	ImageName
��ܘ��0�\�t�

�����0�X�|�����,�(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection$TargetThreadId4TargetThreadCreateTime4RequiredSignatureLevel$SignatureLevel$ImageNameLengthImageNameTEMP���H@9�^
��M|6����D�	EventDataA��9�oData!K�NameSubcode
A��A�oData)K�NameProcessPath
A��=�oData%K�Name	ProcessId
A��G�oData/K�NameModuleFullPath
A��?�oData'K�Name
ModuleBase
A��E�oData-K�Name
ModuleAddress
A��?�oData'K�Name
MemAddress
A��M�oData5K�NameMemModuleFullPath
A��E�oData-K�Name
MemModuleBase
A��9�oData!K�NameAPIName
	A��K�oData3K�NameProcessStartTime
A��;�oData#K�NameThreadId
����0�T�p�����Ԡ��0�SubcodeProcessPathProcessId$ModuleFullPathModuleBase ModuleAddressMemAddress(MemModuleFullPath MemModuleBaseAPIName(ProcessStartTimeThreadIdTEMP@�&R��Tv)b�s�E���D�	EventDataA��9�oData!K�NameSubcode
A��A�oData)K�NameProcessPath
A��=�oData%K�Name	ProcessId
A��=�oData%K�Name	HookedAPI
A��E�oData-K�Name
ReturnAddress
A��E�oData-K�Name
CalledAddress
A��E�oData-K�Name
TargetAddress
A��C�oData+K�NameStackAddress
A��C�oData+K�NameFrameAddress
A��a�oDataIK�NameReturnAddressModuleFullPath
	A��K�oData3K�NameProcessStartTime
A��;�oData#K�NameThreadId
� �<�T�l�����̦��H�p�SubcodeProcessPathProcessIdHookedAPI ReturnAddress CalledAddress TargetAddress StackAddress FrameAddress<ReturnAddressModuleFullPath(ProcessStartTimeThreadIdTEMP���T�.�߸S���Л����D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��[�oDataCK�NameControlPcImageNameLength
A��O�oData7K�NameControlPcImageName
A��_�oDataGK�NameRspContentsImageNameLength
A��S�oData;K�NameRspContentsImageName

����8�d�|�

��Ȯ��8�`�
��į�(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection8ControlPcImageNameLength,ControlPcImageName<RspContentsImageNameLength0RspContentsImageNameTEMP 	���TA*�WVԳ������.D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��[�oDataCK�NameControlPcImageNameLength
A��O�oData7K�NameControlPcImageName
A��_�oDataGK�NameRspContentsImageNameLength
A��S�oData;K�NameRspContentsImageName

A��?�oData'K�Name
StrictMode

����<�h���

��̷��<�d�
��ȸ�

4�(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection8ControlPcImageNameLength,ControlPcImageName<RspContentsImageNameLength0RspContentsImageNameStrictModeTEMP

��2�q��\*n�kj8׃��pD�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	����8�d�|�

��Ⱦ��8�(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtectionTEMP<H�Ai�ui�S�xH�n^���D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��Y�oDataAK�NameTargetIpImageNameLength
A��M�oData5K�NameTargetIpImageName
A��?�oData'K�Name
StrictMode

A��C�oData+K�NameContinueType

`�������� �

H�l������
8�

`�Lv|�(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection4TargetIpImageNameLength(TargetIpImageNameStrictMode ContinueTypeTEMP0	����W��Q��~�0���<D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��U�oData=K�NameMappedImageNameLength
A��I�oData1K�NameMappedImageName
A��]�oDataEK�NameImageCetShadowStacksReady

A��i�oDataQK�NameImageEHContinuationTablePresent


A��E�oData-K�Name
NonEhcontMode

8�`�|�������

 �D�t�����
�

0�

h�

��(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection0MappedImageNameLength$MappedImageName8ImageCetShadowStacksReadyDImageEHContinuationTablePresent NonEhcontModeTEMP..�����kgW�Q�(�
ozS���
D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��I�oData1K�NameRedirectionType
A��Q�oData9K�NameOperationPathLength
A��E�oData-K�Name
OperationPath
A��E�oData-K�Name
Impersonating


A��9�oData!K�NameModule1
A��E�oData-K�Name
Module1Offset

A��9�oData!K�NameModule2
A��E�oData-K�Name
Module2Offset

A��9�oData!K�NameModule3
A��E�oData-K�Name
Module3Offset

A��9�oData!K�NameModule4
A��E�oData-K�Name
Module4Offset

A��9�oData!K�NameModule5
A��E�oData-K�Name
Module5Offset

A��9�oData!K�NameModule6
A��E�oData-K�Name
Module6Offset

A��9�oData!K�NameModule7
A��E�oData-K�Name
Module7Offset

A��9�oData!K�NameModule8
A��E�oData-K�Name
Module8Offset

A��9�oData!K�NameModule9
A��E�oData-K�Name
Module9Offset

A��;�oData#K�NameModule10
 A��G�oData/K�NameModule10Offset
!
A��;�oData#K�NameModule11
"A��G�oData/K�NameModule11Offset
#
A��;�oData#K�NameModule12
$A��G�oData/K�NameModule12Offset
%
A��;�oData#K�NameModule13
&A��G�oData/K�NameModule13Offset
'
A��;�oData#K�NameModule14
(A��G�oData/K�NameModule14Offset
)
A��;�oData#K�NameModule15
*A��G�oData/K�NameModule15Offset
+
A��;�oData#K�NameModule16
,A��G�oData/K�NameModule16Offset
-
$�L�h�������

�0�`����v�����

8�X�

l���

����

����

�(�

<�\�

p���

����

����

�,�

D�h�

����

����

���

4�X�

p���

��(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection$RedirectionType,OperationPathLength OperationPath ImpersonatingModule1 Module1OffsetModule2 Module2OffsetModule3 Module3OffsetModule4 Module4OffsetModule5 Module5OffsetModule6 Module6OffsetModule7 Module7OffsetModule8 Module8OffsetModule9 Module9OffsetModule10$Module10OffsetModule11$Module11OffsetModule12$Module12OffsetModule13$Module13OffsetModule14$Module14OffsetModule15$Module15OffsetModule16$Module16OffsetPRVAd��Microsoft-Windows-Security-MitigationsOPCOLEVLXPd�P|�win:Errorwin:WarningTASK�����������������T����������� ����������������\�	������
���������h�������
��������������������t�������`KERNEL_MITIGATION_TASK_PROHIBIT_DYNAMIC_CODEtKERNEL_MITIGATION_TASK_PROHIBIT_CHILD_PROCESS_CREATIONhKERNEL_MITIGATION_TASK_PROHIBIT_REMOTE_IMAGE_MAPdKERNEL_MITIGATION_TASK_PROHIBIT_LOWIL_IMAGE_MAPlKERNEL_MITIGATION_TASK_PROHIBIT_WIN32K_SYSTEM_CALLStKERNEL_MITIGATION_TASK_PROHIBIT_NON_MICROSOFT_BINARIES\USER_MITIGATION_TASK_EXPORT_ADDRESS_FILTERdUSER_MITIGATION_TASK_EXPORT_ADDRESS_FILTER_PLUS\USER_MITIGATION_TASK_IMPORT_ADDRESS_FILTERLUSER_MITIGATION_TASK_ROP_STACKPIVOTPUSER_MITIGATION_TASK_ROP_CALLERCHECKHUSER_MITIGATION_TASK_ROP_SIMEXEC�KERNEL_MITIGATION_TASK_CONTROL_PROTECTION_USER_MODE_RETURN_MISMATCH�KERNEL_MITIGATION_TASK_USER_CET_SET_CONTEXT_IP_VALIDATION_FAILURE`KERNEL_MITIGATION_TASK_BLOCK_NON_CET_BINARIESdKERNEL_MITIGATION_TASK_REDIRECTION_TRUST_POLICYlKERNEL_MITIGATION_TASK_PROHIBIT_FSCTL_SYSTEM_CALLSKEYWEVNT0&�oXw��Lu�pXwX���Lu�qH��Lu�rHX���Lu�s����Lu�t��X���Lu�uXw��Lu�vXwX���Lu	�wXw�Lu
�xXwX��Lu�y�0�Lu�z�X�0�Lu
@{D�L�\u@|D�X�L�\u@{D�h�\u@|D�X�h�\u	@}D���\u	@~D�X���\u
@H���\u
@�H�X���\u@H���\u@�H�X���\u@H���\u@�H�X���\u
����X���Lu
��0�X���Lu
����L���Lu
��0�L���Lu��P�X��Lu��`�X��Lu��P�L��Lu��`�L��Lu����X�,�Lu����L�,�Lu����X�H�Lu ����L�H�Lu!��Xwd�Lu"��XwX�d�LuWEVT���P�
`{�{�{|�@�CHAN������dMicrosoft-Windows-Threat-Intelligence/AnalyticTTBL�TEMP���@���%NX�{�{z����D�	EventDataA��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
A��Y�oDataAK�NameTargetProcessCreateTime
	A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel
A��Y�oDataAK�NameTargetProcessProtection

A��M�oData5K�NameOriginalProcessId
A��]�oDataEK�NameOriginalProcessCreateTime
A��Y�oDataAK�NameOriginalProcessStartKey

A��e�oDataMK�NameOriginalProcessSignatureLevel
A��s�oData[K�Name$OriginalProcessSectionSignatureLevel
A��]�oDataEK�NameOriginalProcessProtection
A��A�oData)K�NameBaseAddress
A��?�oData'K�Name
RegionSize
A��G�oData/K�NameAllocationType
A��G�oData/K�NameProtectionMask
h�

��<���<

p��(\�

��0����	(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtection(OriginalProcessId8OriginalProcessCreateTime4OriginalProcessStartKey@OriginalProcessSignatureLevelPOriginalProcessSectionSignatureLevel8OriginalProcessProtectionBaseAddressRegionSize$AllocationType$ProtectionMaskTEMP�l�vPɡ$BS�-�Ա����D�	EventDataA��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
A��Y�oDataAK�NameTargetProcessCreateTime
	A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel
A��Y�oDataAK�NameTargetProcessProtection

A��M�oData5K�NameOriginalProcessId
A��]�oDataEK�NameOriginalProcessCreateTime
A��Y�oDataAK�NameOriginalProcessStartKey

A��e�oDataMK�NameOriginalProcessSignatureLevel
A��s�oData[K�Name$OriginalProcessSectionSignatureLevel
A��]�oDataEK�NameOriginalProcessProtection
A��A�oData)K�NameBaseAddress
A��?�oData'K�Name
RegionSize
A��G�oData/K�NameProtectionMask
A��O�oData7K�NameLastProtectionMask
Lt

�� l��� 

T��@h

��d����(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtection(OriginalProcessId8OriginalProcessCreateTime4OriginalProcessStartKey@OriginalProcessSignatureLevelPOriginalProcessSectionSignatureLevel8OriginalProcessProtectionBaseAddressRegionSize$ProtectionMask,LastProtectionMaskTEMP����Wf�U�
%�X|����D�	EventDataA��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
A��Y�oDataAK�NameTargetProcessCreateTime
	A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel
A��Y�oDataAK�NameTargetProcessProtection

A��A�oData)K�NameBaseAddress
A��;�oData#K�NameViewSize
A��G�oData/K�NameAllocationType
A��G�oData/K�NameProtectionMask
P!x!

�!�!$"p"�"�"#$#

X#�#�#$D$`$x$�$(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtectionBaseAddressViewSize$AllocationType$ProtectionMaskTEMP�**�4���AoXU�]�:�3���D�	EventDataA��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
A��Y�oDataAK�NameTargetProcessCreateTime
	A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel
A��Y�oDataAK�NameTargetProcessProtection

A��G�oData/K�NameTargetThreadId
A��W�oData?K�NameTargetThreadCreateTime
A��M�oData5K�NameOriginalProcessId
A��]�oDataEK�NameOriginalProcessCreateTime
A��Y�oDataAK�NameOriginalProcessStartKey

A��e�oDataMK�NameOriginalProcessSignatureLevel
A��s�oData[K�Name$OriginalProcessSectionSignatureLevel
A��]�oDataEK�NameOriginalProcessProtection
A��U�oData=K�NameTargetThreadAlertable
A��?�oData'K�Name
ApcRoutine
A��C�oData+K�NameApcArgument1
A��C�oData+K�NameApcArgument2
A��C�oData+K�NameApcArgument3
A��E�oData-K�Name
RealEventTime
A��[�oDataCK�NameApcRoutineVadQueryResult
A��a�oDataIK�NameApcRoutineVadAllocationBase
A��g�oDataOK�NameApcRoutineVadAllocationProtect
A��Y�oDataAK�NameApcRoutineVadRegionType
A��Y�oDataAK�NameApcRoutineVadRegionSize
 A��Y�oDataAK�NameApcRoutineVadCommitSize
!A��S�oData;K�NameApcRoutineVadMmfName
"A��_�oDataGK�NameApcArgument1VadQueryResult
#A��e�oDataMK�NameApcArgument1VadAllocationBase
$A��k�oDataSK�Name ApcArgument1VadAllocationProtect
%A��]�oDataEK�NameApcArgument1VadRegionType
&A��]�oDataEK�NameApcArgument1VadRegionSize
'A��]�oDataEK�NameApcArgument1VadCommitSize
(A��W�oData?K�NameApcArgument1VadMmfName
)8(8

`8�8�8 9X9|9�9�9

:8:t:�:�:;L;t;

�;�; <p<�<�<�<=4=T=t=�=�=,>`>�>�>�>4?t?�?�?,@d@(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtection$TargetThreadId4TargetThreadCreateTime(OriginalProcessId8OriginalProcessCreateTime4OriginalProcessStartKey@OriginalProcessSignatureLevelPOriginalProcessSectionSignatureLevel8OriginalProcessProtection0TargetThreadAlertableApcRoutine ApcArgument1 ApcArgument2 ApcArgument3 RealEventTime8ApcRoutineVadQueryResult<ApcRoutineVadAllocationBaseDApcRoutineVadAllocationProtect4ApcRoutineVadRegionType4ApcRoutineVadRegionSize4ApcRoutineVadCommitSize0ApcRoutineVadMmfName<ApcArgument1VadQueryResult@ApcArgument1VadAllocationBaseHApcArgument1VadAllocationProtect8ApcArgument1VadRegionType8ApcArgument1VadRegionSize8ApcArgument1VadCommitSize4ApcArgument1VadMmfNameTEMPx&&�L	�a�' �TH�SUZ'����D�	EventDataA��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
A��Y�oDataAK�NameTargetProcessCreateTime
	A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel
A��Y�oDataAK�NameTargetProcessProtection

A��G�oData/K�NameTargetThreadId
A��W�oData?K�NameTargetThreadCreateTime
A��C�oData+K�NameContextFlags
A��A�oData)K�NameContextMask
A��/�oDataK�NamePc
A��/�oDataK�NameSp
A��/�oDataK�NameLr
A��/�oDataK�NameFp
A��3�oDataK�NameReg0
A��3�oDataK�NameReg1
A��3�oDataK�NameReg2
A��3�oDataK�NameReg3
A��3�oDataK�NameReg4
A��3�oDataK�NameReg5
A��3�oDataK�NameReg6
A��3�oDataK�NameReg7
A��E�oData-K�Name
RealEventTime
A��K�oData3K�NamePcVadQueryResult
A��Q�oData9K�NamePcVadAllocationBase
 A��W�oData?K�NamePcVadAllocationProtect
!A��I�oData1K�NamePcVadRegionType
"A��I�oData1K�NamePcVadRegionSize
#A��I�oData1K�NamePcVadCommitSize
$A��C�oData+K�NamePcVadMmfName
%�O�O

P8PxP�P�P QTQxQ

�Q�QRdR�R�R�RS,S8SDSPS\SlS|S�S�S�S�S�S�S�S$TPT�T�T�T�T(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtection$TargetThreadId4TargetThreadCreateTime ContextFlagsContextMaskPcSpLrFpReg0Reg1Reg2Reg3Reg4Reg5Reg6Reg7 RealEventTime(PcVadQueryResult,PcVadAllocationBase4PcVadAllocationProtect$PcVadRegionType$PcVadRegionSize$PcVadCommitSize PcVadMmfNameTEMP$�[Rӹ���Z8&1�dYJ��JD�	EventDataA��I�oData1K�NameOperationStatus
A��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
	A��Y�oDataAK�NameTargetProcessCreateTime
A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel

A��Y�oDataAK�NameTargetProcessProtection
A��A�oData)K�NameBaseAddress
A��A�oData)K�NameBytesCopied
�\]0]

h]�]�](^`^�^�^�^

_@_|_�_�_`$OperationStatus(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtectionBaseAddressBytesCopiedTEMP`�f�&�-.�+U���~	��fD�	EventDataA��I�oData1K�NameOperationStatus
A��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
	A��Y�oDataAK�NameTargetProcessCreateTime
A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel

A��Y�oDataAK�NameTargetProcessProtection
A��G�oData/K�NameTargetThreadId
A��W�oData?K�NameTargetThreadCreateTime
$hHhph

�h�hihi�i�i�ij

Pj�j�jk<k`k$OperationStatus(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtection$TargetThreadId4TargetThreadCreateTimeTEMP4
�qƜڙs�T��9��O���D�	EventDataA��I�oData1K�NameOperationStatus
A��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
	A��Y�oDataAK�NameTargetProcessCreateTime
A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel

A��Y�oDataAK�NameTargetProcessProtection
�r�r�r

4shs�s�s,tPt�t�t

�tuHu�u$OperationStatus(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtectionTEMP�w��:*ޠ3W����W��
D�	EventDataA��K�oData3K�NameDriverNameLength
A��?�oData'K�Name
DriverName
A��Q�oData9K�NameCodeIntegrityOption
Dwlw�w(DriverNameLengthDriverName,CodeIntegrityOptionTEMPT�x0f���S*Y>Б�����D�	EventDataA��K�oData3K�NameDriverNameLength
A��?�oData'K�Name
DriverName
�x�x(DriverNameLengthDriverNameTEMPX�z��Ey{BP�xaW�^���JD�	EventDataA��K�oData3K�NameDriverNameLength
A��?�oData'K�Name
DriverName
A��K�oData3K�NameDeviceNameLength
A��?�oData'K�Name
DeviceName
�z{{D{(DriverNameLengthDriverName(DeviceNameLengthDeviceNamePRVA`t{Microsoft-Windows-Threat-IntelligenceOPCOLEVL@P�{(win:InformationalTASK
����0}����p}�����}�����}����@~�����~�����~����	����p
�����@KERNEL_THREATINT_TASK_ALLOCVMDKERNEL_THREATINT_TASK_PROTECTVM@KERNEL_THREATINT_TASK_MAPVIEWLKERNEL_THREATINT_TASK_QUEUEUSERAPCTKERNEL_THREATINT_TASK_SETTHREADCONTEXT@KERNEL_THREATINT_TASK_READVM@KERNEL_THREATINT_TASK_WRITEVM\KERNEL_THREATINT_TASK_SUSPENDRESUME_THREAD\KERNEL_THREATINT_TASK_SUSPENDRESUME_PROCESSLKERNEL_THREATINT_TASK_DRIVER_DEVICEKEYW$ ����$�����x����������<������� �����@����x������Є����D����������������\�����̆ ����,�@���������������������������8������������ ����4�@����������������4�����������؋����,������� �����@������������TKERNEL_THREATINT_KEYWORD_ALLOCVM_LOCALpKERNEL_THREATINT_KEYWORD_ALLOCVM_LOCAL_KERNEL_CALLERTKERNEL_THREATINT_KEYWORD_ALLOCVM_REMOTEpKERNEL_THREATINT_KEYWORD_ALLOCVM_REMOTE_KERNEL_CALLERXKERNEL_THREATINT_KEYWORD_PROTECTVM_LOCALtKERNEL_THREATINT_KEYWORD_PROTECTVM_LOCAL_KERNEL_CALLERXKERNEL_THREATINT_KEYWORD_PROTECTVM_REMOTEtKERNEL_THREATINT_KEYWORD_PROTECTVM_REMOTE_KERNEL_CALLERTKERNEL_THREATINT_KEYWORD_MAPVIEW_LOCALpKERNEL_THREATINT_KEYWORD_MAPVIEW_LOCAL_KERNEL_CALLERTKERNEL_THREATINT_KEYWORD_MAPVIEW_REMOTEpKERNEL_THREATINT_KEYWORD_MAPVIEW_REMOTE_KERNEL_CALLER`KERNEL_THREATINT_KEYWORD_QUEUEUSERAPC_REMOTE|KERNEL_THREATINT_KEYWORD_QUEUEUSERAPC_REMOTE_KERNEL_CALLERhKERNEL_THREATINT_KEYWORD_SETTHREADCONTEXT_REMOTE�KERNEL_THREATINT_KEYWORD_SETTHREADCONTEXT_REMOTE_KERNEL_CALLERPKERNEL_THREATINT_KEYWORD_READVM_LOCALTKERNEL_THREATINT_KEYWORD_READVM_REMOTETKERNEL_THREATINT_KEYWORD_WRITEVM_LOCALTKERNEL_THREATINT_KEYWORD_WRITEVM_REMOTETKERNEL_THREATINT_KEYWORD_SUSPEND_THREADTKERNEL_THREATINT_KEYWORD_RESUME_THREADXKERNEL_THREATINT_KEYWORD_SUSPEND_PROCESSTKERNEL_THREATINT_KEYWORD_RESUME_PROCESSTKERNEL_THREATINT_KEYWORD_FREEZE_PROCESSPKERNEL_THREATINT_KEYWORD_THAW_PROCESSTKERNEL_THREATINT_KEYWORD_CONTEXT_PARSEpKERNEL_THREATINT_KEYWORD_EXECUTION_ADDRESS_VAD_PROBExKERNEL_THREATINT_KEYWORD_EXECUTION_ADDRESS_MMF_NAME_PROBE�KERNEL_THREATINT_KEYWORD_READWRITEVM_NO_SIGNATURE_RESTRICTIONTKERNEL_THREATINT_KEYWORD_DRIVER_EVENTSTKERNEL_THREATINT_KEYWORD_DEVICE_EVENTSEVNT(�����\��{|��@�����8	�{4|�������$�{P|���������$�{l|���@������@�{�|�������\��{|�������8	�{4|�������$�{P|�������U�{�|�������U�{�|��
�����U�{�|�������U�{�|�������4`�{�| �� �����4`�{�|$��	@������k�{�|(��	�������k�{�|,��	������k�{�|0��	������k�{�|4�������\��{|8��������8	�{4|<�������$�{P|@�� ������$�{l|D���������@�{�|H�������\��{|L�� �����8	�{4|P�������$�{P|T��
@������u�{}X��
@������w�{}\��
������y�{}`�� 
������y�{}d��D���Ā��$�d���$�D�4�T�d�t���������T���Ԁ��4�t����������%O(,0���C�b���PO .�ĀV9m	?��*����WEVT_TEMPLATEMUIMUIen-US&0�%�	*�H��
��%�0�%�10
	`�He0\
+�7�N0L0
+�70	���010
	`�He ��wL]�9�:���WE�ӯ�]�V� ����
�0�	0��3A��˭)O0
	*�H��
0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20110
250619181143Z
260617181143Z0p10	UUS10U
Washington10URedmond10U
Microsoft Corporation10UMicrosoft Windows0�"0
	*�H��
�0�
��y���K1�C�*$"�W%W�H��(v|3}�_0�sȔ��ɫO�}k�WS(�"�����@�C�p�6o��
w ,lc��(
���T-^����䐧�͍��ӑd��Χ�������1p�8��d�������k
�w�D�wB');j��@�&��r�zv;$�0�����c�J���,�?7H��o���.-��)��r<�
�q��S$j|��A]�G_�Z���೉�n����-���s
����2����0��0U%0
+�7
+0U�xԏ���~.I��Ԡ�|�@�0TUM0K�I0G1-0+U$Microsoft Ireland Operations Limited10U
229879+5053360U#0��)9�ėx͐��O��|U�S0WUP0N0L�J�H�Fhttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl%200a+U0S0Q+0�Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0U�00
	*�H��
�;ܴ�W6��K26KV�j> b�j}��BE>��Ұ=Y�'��*���_�u��Y�V��u{Y��2Bon�%�ęW�eW�>Z�I̎��#M,����Nⷅ�&8T�E�⇃������bw�폥i�R�O���"{KN���x�="t��a�w�H+GB�����S���8�#X��q�:Ӏ�g�ړ�jp*;�mH�I���-�NQ�;yOك��9��f��ڨ�l��V���X��/�1t1�3���
x��	0��0���
avV0
	*�H��
0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100
111019184142Z
261019185142Z0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20110�"0
	*�H��
�0�
�����.	����i�!�i33��T����� ��ҋ�8����-|by��J?5 p���k�6u�1ݍp��7�tF�([�`#,��G�g�Q'�r��ɹ;S5|���'�����#	o�F��n�<A�ˣ?]jM�i%(\6��C
��������['�'x0�[*	k"�S`,�hS��I�a��h	sD]}�T+�y��5]l+\μ�#�on�&�6�O�'��2;A�,���w�TN�\�e�C���mw�Z$�H��C0�?0	+�70U�)9�ėx͐��O��|U�S0	+�7
SubCA0U�0U�0�0U#0��Vˏ�\bh�=��[�Κ�0VUO0M0K�I�G�Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0�>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
	*�H��
��|qQ�y�n��9>�<Rn+?s��h�H�4M��&�1F�ay�8.Ek��(�����	��L
6fj���������@26v�Zƿ���Ӭ�h�b��TlP0X��|���N���|�sW�R!s4Z�V��	����~�����?�rS��c��=1e�������=����BА�_T���G�o�sNA�@�_�*��s�!(���s9_>�\`����	���Q�fG���=�*hw��Lb{��Ǻz�4Kbz����J7�-�W|�=ܸZ��ij�:��n�i!7ށ�ugӓW^)9��-���Es[���z��FX�^���g�l5��?$�5�
u�V��x,��Ј���ߺ~,c��#!�xl�X6+�̤��-����@�E�Ί\k>��p*
j�_G��c
2��6*pZ�BYqKW�~���!<��Ź���E��� ����ŕ�]b֠c �uw}=�E�����W�o3��w�bY~1�y0�u0��0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20113A��˭)O0
	`�He���0	*�H��
	1
+�70/	*�H��
	1" {�3z��֏*�k�~�!$*���/>N��0P
+�7
1B@AB8C07CF00629B83E527AC8346A1ADDDE8A488012978FC491E5583DBE01736C80Z
+�71L0J�$�"Microsoft Windows�"� http://www.microsoft.com/windows0
	*�H��
�Rh��Y��NJ��KxUL�^G�����{^Kgޣ���S����aV����yhھë�X{N����w�ra����;A���T\�ĈL4������g��GiT�5��i��HE{{���Q�3Y��T/|!�
w�cs+�8`I!eH�m!x�Ȉ���J�3�E��M�Ϊ�Q�p�G��%T��ߍ�k���Sd���dƵ��j�h��m���|)���}j��Y@>&͛��y�C�ҡ��0��
+�71��0��	*�H��
���0��10
	`�He0�Z*�H��
	��I�E0�A
+�Y
010
	`�He �����a�d�`]KV�����.��{�K��1Ai�M��820260506093314.494Z0��٤��0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1-0+U$Microsoft Ireland Operations Limited1'0%UnShield TSS ESN:6B05-05E0-D9471%0#UMicrosoft Time-Stamp Service���0�(0��3E9�C�l0
	*�H��
0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100
250814184813Z
261113184813Z0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1-0+U$Microsoft Ireland Operations Limited1'0%UnShield TSS ESN:6B05-05E0-D9471%0#UMicrosoft Time-Stamp Service0�"0
	*�H��
�0�
�Ϲ�3/�Zʹ;��(�i�7�d�p����Hq��w�J�����v��n�3���IF�UZ�h����$.�6�
7u�Uп���&�υ2������ڧ�MS�8����T��\��g_���O��R�����ϓV�,ga\��Ei���}��KQ^�&���K<��=\�G3��e�a�|v�:a�T�*7�a3��M�\͖���?��?)j�5��v��e�TءB�����u���e9�qj��tN&����c�$Y���r!A"�a�M�s�?�ɴ���A@�q�K$xE!���[�Z��w�v�*�����D��2�
;`5$��}Bso�nj�?O��:�0v�bMɥ*V�C�i������[�h��P��a�T�U~�x���0�	3�gD��<�Dž!��4��:�ʜ�}�m��(q^�Z��<b�J̾�vJ�:����Y|C�	׾>{*�ʖ=>�"b..@`�U��x��/�`��s�Mk���I0�E0Ub}E���!��o���]f~�p0U#0���]^b]����e�S5�r0_UX0V0T�R�P�Nhttp://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l+`0^0\+0�Phttp://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0U�00U%�0
+0U��0
	*�H��
��B��Lj!H��g����ͅ)3�i�v5K�f��sw\��H�}��"�{���:�}
�R�爮ÛF���l+N���-��D����4�z������wY0˚����ӦUkp�x#�I��ٮ
l+ײg��\���l�TX7�bw���?r�2���8��;���Ϛ0�W�M�TUl�2��i��S���@�1��v�7f���I�<�$�v^�/�����VԵ���n���@���#kÄk_q�xw�[�x�����b��;��:m9�^,�?1��/���%�Ӆ�G���9�gu�J��x6��Hg`%<�i�rgrӍ���D@���������rm3�n���GT�'9�X��f�dU���8@���%p#ay�/�&G��^����/�Rr
�f�u��b��
g���$�R�CÄ��ܻ�����V�+�KE1r�ߞJ�F~??Fː�b
��io������ɶB
O�1�K��o=0UɍJ�T3Lk]��a�U^&0�q0�Y�3��k��I�0
	*�H��
0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100
210930182225Z
300930183225Z0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100�"0
	*�H��
�0�
���L�r!y���$y�Ղ��ҩlNu��5W�lJ�⽹>`3�\O�f��SqZ�~JZ��6g�F#���w2��`}jR�D���Fk��v��P�D�q\Q17�
8n����&S|9azĪ�ri����6�5&dژ;�{3��[~��R���b%�j�]�S���VM�ݼ��㑏�9,Q��pi
�6-p�1�5(�㴇$��ɏ~�T��U�mh;�F��z)7���E�Fn�2��0\O,�b�͹⍈䖬J��q�[g`���=� �s}A�Fu��_4���� }~�ٞE߶r/�}_��۪~6�6L�+n�Q���s�M7t�4���G��|?Lۯ^����s=CN�39L��Bh.�QF�ѽjZas�g�^�(v�3rק ��
�co�6d�[���!]_0t���عP��a�65�G������k�\RQ]�%��Pzl�r�Rą��<�7�?x�E���^ڏ�riƮ{��>j�.����0��0	+�70#	+�7*�R�dĚ���<F5)��/�0U��]^b]����e�S5�r0\U U0S0Q+�7L�}0A0?+3http://www.microsoft.com/pkiops/Docs/Repository.htm0U%0
+0	+�7
SubCA0U�0U�0�0U#0��Vˏ�\bh�=��[�Κ�0VUO0M0K�I�G�Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0�>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
	*�H��
��U}�*��,g1$[�rK��o�\�>NGdx���=13�9��q6?�dl|�u9m�1��lѡ�"��fg:SMݘ��x�6.���V����i�	�{�jo�)�n�?Hu��m��m#T�xSu$W�ݟ�=��h�e��V����(U'�$�@���]='�@�8���)�ü�T�B�������j�BRu�6��as.,k{n?,	x鑲�[�I�t�쑀�=�J>f;O���2ٖ����t��Lro�u0�4�z�P�
X�@<�Tm�ctH,�NG-�q�d�$�smʎ	��WITd�s�[D�Z�k
��(�g($�8K�n�!TkjEG����^O���Lv�WT	�iD~|�als�
��Af=i��AI~~���;����>�1Q������{��p���(��6ںL���
�4�$5g+�
�挙��"��'B=%��tt[jў>�~�13}���{�8pDѐ�ȫ:�:b�pcSM��m��qj�U3X��pf�Y0�A0���٤��0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1-0+U$Microsoft Ireland Operations Limited1'0%UnShield TSS ESN:6B05-05E0-D9471%0#UMicrosoft Time-Stamp Service�#
0++*|�e]�
�Ti3w��^�5͠��0���~0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100
	*�H��
��0"20260505225850Z20260506225850Z0w0=
+�Y
1/0-0
��0

��0-0
�F*06
+�Y
1(0&0
+�Y
�
0� �
0��0
	*�H��
��3A��4�`���Tg$�@���qQYqW|�݋U��j!��@.f]��'� ���`�u���29p�p���r�<2@�ڊ��c{����]���V�U+�0���HԢ��W���QGwm�eկ�Оv�����#�b�d�f�Eީ� `�T%�b�t)��@�9n�VOeu�})=�Ly�GS����J�Eݻ
�d���"3YZ���H>�sr���;{,H�d�^"1)�sT�4��������w��hW|Z���1�
0�	0��0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103E9�C�l0
	`�He��J0	*�H��
	1
*�H��
	0/	*�H��
	1" 4����O'��3��� 5Z�3��F�rA?;��0��*�H��
	/1��0��0��0�� ,�3���N�Z\\/���P#ME�9b�43&�0��0���~0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103E9�C�l0" k���0@���y��d��m�U"���UN-0
	*�H��
��Iw4��1l������~/��혉�:
�o�8���C��jg���*"�d�B��!���ۿ�!|{��`��
u�$O9@����}h��A��ۓ�L?�!غ�:.��JW�G����&�"�N���[�B_�S]��w�g?1d_ې�HM&�k��sh;GO�����~r�5`��
 �W��0�T��D���\��=R�V��j��QWǯH�	ޱ����i���t���6��.�"�)�\�}2�ۗ*�W�L#�c�O`ӯۣMZ�x&xL_�ҵ&���o
���vx�d�CլOQn�|���Mx�L��e�XRQd.���h[��9	����<
�륾��!ɍ���<��	
�*�l��E���%q�S�Q?Qnٷo־+>h����د��n
��Rs+V�&�EKl��y��l,Б�K��<����}�M�S������v�k�_Z{��R�-A[��c�g��;���1�TV������i��MmO��}����Pp�v!�