�����JFIF��XX����������    $.' ",#(7),01444'9=82<.342  2!!22222222222222222222222222222222222222222222222222�����"����4���������������������������� ���������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������,�PG"Z_�4�˷����kjز�Z�,F+��_z�,�© �����zh6�٨�ic�fu������������������������������������#ډb���_�N��?�����������wQ���5-�~�I���8���������������������������������TK<5o�Iv-������������������k�_U_������������������������������~b�M��d��������Ӝ�U�Hh��?]��E�w��Q���k�{��_}qFW7HTՑ��Y��F�����?_�'ϔ��_�Ջt������������������������=||I �����6�έ"�����D���/[�k�9����Y�8������ds|\���Ҿp6�Ҵ���]��.����6���z<�v��@]�i%������������������������$j��~����g��J>��no����pM[me�i$[�����������s�o�ᘨ�˸ nɜG-�ĨU�ycP���3.DB�li�;���������������������hj���x����7Z^�N�h��������N3u{�:j�����x�힞��#M��&��jL P@��_���� P�������������������&��o8��������9������@Sz���6�t7#O�ߋ �����s}Yf�T������lmr����Z)'N��k�۞p�����w\�T���������������ȯ?�8`���O��i{wﭹW�[�r�� ��Q4F�׊������3m&L�=��h3�������z~��#����\�l :�F,j@�� ʱ�wQT����8�"kJO����6�֚l������������������}����R�>ډK���]��y����&����p�}b������;N�1�m�r$����|��7�>e�@���B�TM*-i�H��g�D�)� E�m�|�ؘbҗ�a���Ҿ����������������t4�����o���G��*oCN�rP���Q��@z,|?W[0���������:�n,j���WiE��W������$~/�hp\��?��{(�0���+�Y8rΟ�+����>S-S���������������VN;���}�s?.����� w��9��˟<���Mq4�Wv'������{)0�1mB����V����W[��������8�/<� �%���wT^�5���b��)iM� p�g�N�&ݝ������������VO~��q���u���9��� ����!��J27�����$����O-���! �:���%H��� ـ�������y�ΠM=t{!S�� �oK8�������t<����è��������:a��������[������ա�H���~��w��Qz`�p����o�^ ������Q��n����� �,uu�C��$ ^���,�������8�#��:�6��e�|~�����������!�3��3.�\0�����q��o�4`.|� ����y�Q�`~;�d�ׯ,��O�Zw�������`73�v�܋�<�����Ȏ�� ـ4k��5�K�a�u�=9Yd��$>x�A�&�� j0� ���vF��� Y���|�y��� ~�6�@c��1vOp��������Ig�����4��l�OD�����L����� R���c���j�_�uX�6��3?nk��Wy�f;^*B� ��@���~a�`��Eu�������+�����6�L��.ü>��}y���}_�O�6�͐�:�Yr���G�X��kG������l^w����������~㒶sy���Iu�!���� W ��X��N�7BV��O��!X�2����wvG�R�f�T#�����t�/?���%8�^�W�aT����G�cL�M���I��(J����1~�8�?aT ���]����AS�E��(��*E}� 2������#I/�׍qz��^t�̔���������b�Yz4x����t�){ OH�����+(E��A&�N�������XT��o��"�XC����'���)}�J�z�p� ����~5�}�^����+�6����w��c��Q�|�Lp�d�H��}�(�.|����k��c4^�����"�����Z?ȕ ��a<�������L�!0�39C� �Eu�����C�F�Ew�ç ;�n?�*o���B�8�bʝ���'#Rqf����M}7����]�������s2tcS{�\icTx;�\��7K���P������ʇ Z O-��~�������c>"��?��������P�����E��O�8��@�8��G��Q�g�a�Վ���󁶠��䧘��_%#r�>�����1�z�a���eb��qcP��ѵ��n���#L��� =��׀t� L�7�`�����V����A{�C:�g���e@�����w1 Xp�3�c3�ġ�������p��M"'-�@n4���fG���B3�DJ�8[Jo�ߐ���gK)ƛ��$���� �������8�3�����+���� �����6�ʻ���� ���S�kI�*KZlT _`�������?��K�����QK�d���������B`�s}�>���`������*�>��,*@J�d�oF*�����弝��O}�k��s��]��y�ߘ�������c1G�V���<=�7��7����6��q�PT��tXԀ�!9*4�4Tހ���3XΛex�46�������Y��D ����� ����BdemDa����\�_l,����G�/���֌7���Y�](�xTt^%�GE�����4�}bT����ڹ�����;��Y)���B�Q��u��>J/J ���⮶.�XԄ��j�ݳ������+E��d ���r�5�_D�����1 ���o�� �B�x�΢�#����<��W�����8���R6�@���g�M�.��� dr�D��>(otU��@�x=��~v���2� ӣ�d�oBd�����3�eO�6�㣷����������ݜ�6��6Y��Qz`����S��{���\P��~z m5{J/L��1������<�e�ͅPu���b�]�ϔ��������'�������f�b� Zpw��c`"��i���BD@:)ִ�:�]��h���v�E��w���T�l�������P����"Ju�}��وV ��J��G6��. J/�Qgl߭�e�����@�z�Zev2u����)]կ���������7x�������s�M�-<ɯ�c��r��v�����@��$�ޮ}lk���a����'����>x��O\�Z������Fu>������ck#��&:��`�$��ai�>2Δ����l���oF[h�������lE�ܺ�Π���k:)���`������� $[6�����9�����kOw�\|�����8}������ބ:��񶐕��������I�A1/���=�2[�,�!��.}gN#�u����b���� ~���������݊��}34q�����d�E��L��������c��$���"�[q�U�硬g^��%B ��z���r�p�������J�ru%v\h�����1Y�ne`������ǥ:g����pQM~�^��Xi� ��`S�:V2������9.�P���V������?B�k�� ��������AEvw%�_�9C�Q����wKekP�ؠ�\������;Io d�{ ߞo�c1eP�����\� `����E=���@K<�Y��������eڼ�J����w����{av�F�'�M�@��������������/J��+9p����|]���������Iw &`���8���&�M�hg���[�{�������Xj���%��Ӓ�������������������$��(�����ʹN�������<>�I���RY�����K2�NPlL�ɀ�)��&e��������B+ь����(������������������� � �JTx����_?EZ� }@���� 6�U���뙢ط�z��dWI��n` D����噥�[��uV��"�G&�����Ú����2�g�}&m���������������������?ċ���"����Om#�������������������������� ��{���������������������ON��"S�X���Ne��ysQ���@�������������Fn��Vg�����dX�~nj����������������������]J�<�K]:����FW���b�������62����������=��5f����JKw����bf�X������������������������55��~J �%^�������:�-�QIE��P��v�nZum� z � ~ə ���� ���ة����;�f��\v�������g�8�1��f2�������������������������4;�V���ǔ�)�������������������9���1\������������������������������c��v�/'Ƞ�w������������������$�4�R-��t����������������������������������� e�6�/�ġ �̕Ecy�J���u�B���<�W�ַ~�w[B1L۲�-JS΂�{���΃�������������������������������������������A��20�c#���������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������@���� 0!1@AP"#2Q`$3V�%45a6�FRUq����� ������^7ׅ,$n��������+��F�`��2X'��0vM��p�L=�������5��8������u�p~���.�`r�����\����O��,ư�0oS ��_�M�����l���4�kv\JSd���x���SW�<��Ae�IX����������$I���w�:S���y���›R��9�Q[���,�5�;�@]�%���u�@ *ro�lbI �� ��+���%m:�͇ZV�����u�̉����θau<�fc�.����{�4Ա� �Q����*�Sm��8\ujqs]{kN���)qO�y�_*dJ�b�7���yQqI&9�ԌK!�M}�R�;�������S�T���1���i[U�ɵz�]��U)V�S6���3$K{��ߊ<�(� E]Զ[ǼENg�����'�\?#)Dkf��J���o��v���'�%ƞ�&K�u��!��b�35LX�Ϸ��63$K�a�;�9>,R��W��3�3� d�JeTYE.Mϧ��-�o�j3+y��y^�c�������VO�9NV\nd�1 ��!͕_)a�v;����թ�M�lWR1��)El��P;��yوÏ�u 3�k�5Pr6<�⒲l�!˞*��u־�n�!�l:����UNW ��%��Chx8vL'��X�@��*��)���̮��ˍ��� ����D-M�+J�U�kvK����+�x8��cY������?�Ԡ��~3mo��|�u@[XeY�C�\Kp�x8�oC�C�&����N�~3-H���� ��MX�s�u<`���~"WL��$8ξ��3���a�)|:@�m�\���^�`�@ҷ)�5p+��6���p�%i)P M���ngc�����#0Aruz���RL+xSS?���ʮ}()#�t��mˇ!��0}}y����<�e� �-ή�Ԩ��X������ MF���ԙ~l L.3���}�V뽺�v������멬��Nl�)�2����^�Iq��a��M��qG��T�����c3#������3U�Ǎ���}��לS�|qa��ڃ�+���-��2�f����/��bz��ڐ�� �ݼ[2�ç����k�X�2�* �Z�d���J�G����M*9W���s{��w���T��x��y,�in�O�v��]���n����P�$��JB@=4�OTI�n��e�22a\����q�d���%�$��(���:���: /*�K[PR�fr\nڙdN���F�n�$�4��[�� U�zƶ����� �mʋ���,�ao�u 3�z� �x��Kn����\[��VFmbE;�_U��&V�Gg�]L�۪&#n%�$ɯ��dG���D�TI=�%+AB�Ru#��b4�1�»x�cs�YzڙJG��f��Il���d�eF'T� iA��T���uC�$����Y��H?����[!G`}���ͪ� �纤Hv\������j�Ex�K���!���OiƸ�Yj�+u-<���'q����uN�*�r\��+�]���<�wOZ.fp�ێ��,-*)V?j-kÊ#�`�r��dV����(�ݽBk�����G�ƛk�QmUڗe��Z���f}|����8�8��a���i��3'J�����~G_�^���d�8w������ R�`(�~�.��u���l�s+g�bv���W���lGc}��u���afE~1�Ue������Z�0�8�=e�� f@/�jqEKQQ�J���oN��J���W5~M>$6�Lt�;$ʳ{���^��6�{����v6���ķܰg�V�cnn �~z�x�«�,2�u�?cE+Ș�H؎�%�Za�)���X>uW�Tz�Nyo����s���FQƤ��$��*�&�LLXL)�1�" L��eO��ɟ�9=���:t��Z���c��Ž���Y?�ӭV�wv�~,Y��r�ۗ�|�y��GaF�����C�����.�+� ���v1���fήJ�����]�S��T��B��n5sW}y�$��~z�'�c ��8 ��� ,! �p��VN�S��N�N�q��y8z˱�A��4��*��'������2n<�s���^ǧ˭P�Jޮɏ�U�G�L�J�*#��<�V��t7�8����TĜ>��i}K%,���)[��z�21z ?�N�i�n1?T�I�R#��m-�����������������1����lA�`��fT5+��ܐ�c�q՝��ʐ��,���3�f2U�եmab��#ŠdQ�y>\��)�SLY����w#��.���ʑ�f��� ,"+�w�~�N�'�c�O�3F�������N<���)j��&��,-� �љ���֊�_�zS���TǦ����w�>��?�������n��U仆�V���e�����0���$�C�d���rP �m�׈e�Xm�Vu� �L��.�bֹ��� �[Դaզ���*��\y�8�Է:�Ez\�0�Kq�C b��̘��cө���Q��=0Y��s�N��S.����3.���O�o:���#���v7�[#߫ ��5�܎�L���Er4���9n��COWlG�^��0k�%<���ZB���aB_���������'=��{i�v�l�$�uC���mƎҝ{�c㱼�y]���W�i ��ߧc��m�H� m�"�"�����;Y�ߝ�Z�Ǔ�����:S#��|}�y�,/k�Ld� TA�(�AI$+I3��;Y*���Z��}|��ӧO��d�v��..#:n��f>�>���ȶI�TX��� 8��y����"d�R�|�)0���=���n4��6ⲑ�+��r<�O�܂~zh�z����7ܓ�HH�Ga롏���nCo�>������a ���~]���R���̲c?�6(�q�;5%� |�uj�~z8R�=X��I�V=�|{v�Gj\gc��q����z�؋%M�ߍ����1y��#��@f^���^�>N������#x#۹��6�Y~�?�dfPO��{��P�4��V��u1E1J �*|���%����JN��`eWu�zk M6���q t[�� ��g�G���v��WIG��u_ft����5�j�"�Y�:T��ɐ���*�;� e5���4����q$C��2d�}���� _S�L#m�Yp��O�.�C�;��c����Hi#֩%+) �Ӎ��ƲV���SYź��g |���tj��3�8���r|���V��1#;.SQ�A[���S������#���`n�+���$��$�I �P\[�@�s��(�ED�z���P��])8�G#��0B��[ى��X�II�q<��9�~[Z멜�Z�⊔IWU&A>�P~�#��dp<�?����7���c��'~���5 ��+$���lx@�M�dm��n<=e�dyX��?{�|Aef ,|n3�<~z�ƃ�uۧ�����P��Y,�ӥQ�*g�#먙R�\���;T��i,��[9Qi歉����c>]9�� ��"�c��P�� �Md?٥��If�ت�u��k��/����F��9�c*9��Ǎ:�ØF���z�n*�@|I�ށ9����N3{'��[�'ͬ�Ҳ4��#}��!�V� Fu��,�,mTIk���v C�7v���B�6k�T9��1�*l� '~��ƞF��lU��'�M ����][ΩũJ_�{�i�I�n��$����L�� j��O�dx�����kza۪��#�E��Cl����x˘�o�����V���ɞ�ljr��)�/,�߬h�L��#��^��L�ф�,íMƁe�̩�NB�L�����iL����q�}��(��q��6IçJ$�W�E$��:������=#����(�K�B����zђ <��K(�N�۫K�w��^O{!����)��H���>x�������lx�?>Պ�+�>�W���,Ly!_�D���Ō�l���Q�!�[ �S����J��1��Ɛ�Y}��b,+�Lo�x�ɓ)����=�y�oh�@�꥟/��I��ѭ=��P�y9��� �ۍYӘ�e+�p�Jnϱ?V\SO%�(�t� ���=?MR�[Ș�����d�/ ��n�l��B�7j� ��!�;ӥ�/�[-���A�>��dN�sLj ��,ɪv��=1c�.SQ�O3�U���ƀ�ܽ�E����������̻��9G�ϷD�7(�}��Ävӌ\��y�_0[w ���<΍>����a_��[0+�L��F.�޺��f�>oN�T����q;���y\��bՃ��y�jH�<|q-eɏ�_?_9+P���Hp$�����[ux�K w�Mw��N�ی'$Y2�=��q���KB��P��~�������Yul:�[<����F1�2�O���5=d����]Y�sw:���Ϯ���E��j,_Q��X��z`H1,#II ��d�wr��P˂@�ZJV����y$�\y�{}��^~���[:N����ߌ�U�������O��d�����ؾe��${p>G��3c���Ė�lʌ�� ת��[��`ϱ�-W����dg�I��ig2��� ��}s ��ؤ(%#sS@���~���3�X�nRG�~\jc3�v��ӍL��M[JB�T��s3}��j�Nʖ��W����;7���ç?=X�F=-�=����q�ߚ���#���='�c��7���ڑW�I(O+=:uxq�������������e2�zi+�kuG�R��������0�&e�n���iT^J����~\jy���p'dtG��s����O��3����9* �b#Ɋ�� p������[Bws�T�>d4�ۧs���nv�n���U���_�~,�v����ƜJ1��s�� �QIz���)�(lv8M���U=�;����56��G���s#�K���MP�=��LvyGd��}�VwWBF�'�à �?MH�U�g2�� ����!�p�7Q��j��ڴ����=��j�u��� Jn�A s���uM������e��Ɔ�Ҕ�!)�'��8Ϣ�ٔ���ޝ(��Vp���צ֖d=�IC�J�Ǡ{q������kԭ�߸���i��@K����u�|�p=..�*+����x�����z[Aqġ#s2a�Ɗ���RR�)*HRsi�~�a &f��M��P����-K�L@��Z��Xy�'x�{}��Zm+���:�)�) IJ�-i�u���� ���ܒH��'��L(7�y�GӜq���� j��� 6ߌg1�g�o���,kر���tY�?W,���p���e���f�OQS��!K�۟cҒA�|ս�j�>��=⬒��˧L[�� �߿2JaB~R��u�:��Q�] �0H~���]�7��Ƽ�I���(�}��cq '�ήET���q�?f�ab���ӥvr� �)o��-Q��_'����ᴎo��K������;��V���o��%���~OK ����*��b�f:���-ťIR��`B�5!RB@���ï�� �u �̯e\�_U�_������� g�ES��3��������QT��a�����x����U<~�c?�*�#]�MW,[8O�a�x��]�1bC|踤�P��lw5V%�)�{t�<��d��5���0i�XSU��m:��Z�┵�i�"��1�^B�-��P�hJ��&)O��*�D��c�W��vM��)����}���P��ܗ-q����\mmζZ-l@�}��a��E�6��F�@��&Sg@���ݚ�M����� ȹ 4����#p�\H����dYDo�H���"��\��..R�B�H�z_�/5˘����6��KhJR��P�mƶi�m���3��,#c�co��q�a)*P�t����R�m�k�7x�D�E�\Y�閣_X�<���~�)���c[[�BP����6�Yq���S��0����%_����;��Àv�~�| VS؇ ��'O0��F0��\���U�-�d@�����7�SJ*z��3n��y��P����O����������m�~�P�3|Y��ʉr#�C�<�G~�.,! ���bqx���h~0=��!ǫ�jy����l��O,�[B��~��|9��ٱ����Xly�#�i�B��g%�S��������tˋ���e���ې��\[d�t)��.+u�|1 ������#�~Oj����hS�%��i.�~X���I�H�m��0n���c�1uE�q��cF�RF�o���7� �O�ꮧ� ���ۛ{��ʛi5�rw?׌#Qn�TW��~?y$��m\�\o����%W� ?=>S�N@�� �Ʈ���R����N�)�r"C�:��:����� �����#��qb��Y�. �6[��2K����2u�Ǧ�HYR��Q�MV��� �G�$��Q+.>�����nNH��q�^��� ����q��mM��V��D�+�-�#*�U�̒ ���p욳��u:�������IB���m����PV@O���r[b= �� ��1U�E��_Nm�yKbN�O���U�}�the�`�|6֮P>�\2�P�V���I�D�i�P�O;�9�r�mAHG�W�S]��J*�_�G��+kP�2����Ka�Z���H�'K�x�W�MZ%�O�YD�Rc+o��?�q��Ghm��d�S�oh�\�D�|:W������UA�Qc yT�q��������~^�H��/��#p�CZ���T�I�1�ӏT����4��"�ČZ�����}��`w�#�*,ʹ�� ��0�i��課�Om�*�da��^gJ݅{���l�e9uF#T�ֲ��̲�ٞC"�q���ߍ ոޑ�o#�XZTp����@ o�8��(jd��xw�]�,f���`~��|,s��^����f�1���t��|��m�򸄭/ctr��5s��7�9Q�4�H1꠲BB@�l9@���C�����+�wp�xu�£Yc�9��?`@#�o�mH�s2��)�=��2�.�l����jg�9$�Y�S�%*L������R�Y������7Z���,*=�䷘$�������arm�o�ϰ���UW.|�r�uf����IGw�t����Zwo��~5 ��YյhO+=8fF�)�W�7�L9lM�̘·Y���֘YLf�큹�pRF���99.A �"wz��=E\Z���'a� 2��Ǚ�#;�'}�G���*��l��^"q��+2FQ� hj��kŦ��${���ޮ-�T�٭cf�|�3#~�RJ����t��$b�(R��(����r���dx� >U b�&9,>���%E\� Ά�e�$��'�q't��*�א���ެ�b��-|d���SB�O�O��$�R+�H�)�܎�K��1m`;�J�2�Y~9��O�g8=vqD`K[�F)k�[���1m޼c��n���]s�k�z$@��)!I �x՝"v��9=�ZA=`Ɠi �:�E��)`�7��vI��}d�YI�_ �o�:ob���o ���3Q��&D&�2=�� �Ά��;>�h����y.*ⅥS������Ӭ�+q&����j|UƧ�����}���J0��WW< ۋS�)jQR�j���Ư��rN)�Gű�4Ѷ(�S)Ǣ�8��i��W52���No˓� ۍ%�5brOn�L�;�n��\G����=�^U�dI���8$�&���h��'���+�(������cȁ߫k�l��S^���cƗjԌE�ꭔ��gF���Ȓ��@���}O���*;e�v�WV���YJ\�]X'5��ղ�k�F��b 6R�o՜m��i N�i�����>J����?��lPm�U��}>_Z&�KK��q�r��I�D�Չ~�q�3fL�:S�e>���E���-G���{L�6p�e,8��������QI��h��a�Xa��U�A'���ʂ���s�+טIjP�-��y�8ۈZ?J$��W�P� ��R�s�]��|�l(�ԓ��sƊi��o(��S0���Y� 8�T97.�����WiL��c�~�dxc�E|�2!�X�K�Ƙਫ਼�$((�6�~|d9u+�qd�^3�89��Y�6L�.I�����?���iI�q���9�)O/뚅����O���X��X�V��ZF[�یgQ�L��K1���RҖr@v�#��X�l��F���Нy�S�8�7�kF!A��sM���^rkp�jP�DyS$N���q���nxҍ!U�f�!eh�i�2�m����`�Y�I�9r�6� �TF���C}/�y�^���Η���5d�'��9A-��J��>{�_l+�`��A���[�'��յ�ϛ#w:݅�%��X�}�&�PSt�Q�"�-��\縵�/����$Ɨh�Xb�*�y��BS����;W�ջ_mc�����vt?2}1�;qS�d�d~u:2k5�2�R�~�z+|HE!)�Ǟl��7`��0�<�,�2*���Hl-��x�^����'_TV�gZA�'j� ^�2Ϊ��N7t�����?w�� �x1��f��Iz�C-Ȗ��K�^q�;���-W�DvT�7��8�Z�������� hK�(P:��Q- �8�n�Z���܃e貾�<�1�YT<�,�����"�6{�/ �?�͟��|1�:�#g��W�>$����d��J��d�B���=��jf[��%rE^��il:��B���x���Sּ�1հ��,�=��*�7 fcG��#q� �eh?��2�7�����,�!7x��6�n�LC�4x��},Geǝ�tC.��vS �F�43��zz\��;QYC,6����~;RYS/6���|2���5���v��T��i����������mlv��������&� �nRh^ejR�LG�f���? �ۉҬܦƩ��|��Ȱ����>3����!v��i�ʯ�>�v��オ�X3e���_1z�Kȗ\<������!�8���V��]��?b�k41�Re��T�q��mz��TiOʦ�Z��Xq���L������q"+���2ۨ��8}�&N7XU7Ap�d�X��~�׿��&4e�o�F��� �H�����O���č�c�� 懴�6���͉��+)��v;j��ݷ�� �UV�� i��� j���Y9GdÒJ1��詞�����V?h��l�����l�cGs�ځ�������y�Ac������\V3�? �� ܙg�>qH�S,�E�W�[�㺨�uch�⍸�O�}���a��>�q�6�n6�����N6�q��������N� ���! 1AQaq�0@����"2BRb�#Pr���3C`��Scst���$4D���%Td���� ?�����N����a��3��m���C���w��������xA�m�q�m����m������$����4n淿t'��C"w��zU=D�\R+w�p+Y�T�&�պ@��ƃ��3ޯ?�Aﶂ��aŘ���@-�����Q�=���9D��ռ�ѻ@��M�V��P��܅�G5�f�Y<�u=,EC)�<�Fy'�"�&�չ�X~f��l�KԆV��?�� �W�N����=(� �;���{�r����ٌ�Y���h{�١������jW����P���Tc�����X�K�r��}���w�R��%��?���E��m�� �Y�q|����\lEE4����r���}�lsI�Y������f�$�=�d�yO����p�����yBj8jU�o�/�S��?�U��*������ˍ�0�������u�q�m [�?f����a�� )Q�>����6#������� ?����0UQ����,IX���(6ڵ[�DI�MNލ�c&���υ�j\��X�R|,4��� j������T�hA�e��^���d���b<����n�� �즇�=!���3�^�`j�h�ȓr��jẕ�c�,ٞX����-����a�ﶔ���#�$��]w�O��Ӫ�1y%��L�Y<�wg#�ǝ�̗`�x�xa�t�w��»1���o7o5��>�m뭛C���Uƃߜ}�C���y1Xνm�F8�jI���]����H���ۺиE@I�i;r�8ӭ�����V�F�Շ| ��&?�3|x�B�MuS�Ge�=Ӕ�#BE5G������Y!z��_e��q�р/W>|-�Ci߇�t�1ޯќd�R3�u��g�=0 5��[?�#͏��q�cf���H��{ ?u�=?�?ǯ���}Z��z���hmΔ�BFTW�����<�q��(v� ��!��z���iW]*�J�V�z��gX֧A�q�&��/w���u�gYӘa���; �i=����g:��?2�dž6�ى�k�4�>�Pxs����}������G�9���3 ���)gG�R<>r h�$��'nc�h�P��Bj��J�ҧH� -��N1���N��?��~��}-q!=��_2hc�M��l�vY%UE�@|�v����M2�.Y[|y�"Eï��K�ZF,�ɯ?,q�?v�M 80jx�"�;�9vk�����+ ֧�� �ȺU��?�%�vcV��mA�6��Qg^M�����A}�3�nl� QRN�l8�kkn�'�����(��M�7m9و�q���%ޟ���*h$Zk"��$�9��: �?U8�Sl��,,|ɒ��xH(ѷ����Gn�/Q�4�P��G�%��Ա8�N��!� �&�7�;���eKM7�4��9R/%����l�c>�x;������>��C�:�����t��h?aKX�bhe�ᜋ^�$�Iհ �hr7%F$�E��Fd���t��5���+�(M6�t����Ü�UU|zW�=a�Ts�Tg������dqP�Q����b'�m���1{|Y����X�N��b �P~��F^F:����k6�"�j!�� �I�r�`��1&�-$�Bevk:y���#y�w��I0��x��=D�4��tU���P�ZH��ڠ底taP��6����b>�xa�����Q�#� WeF��ŮNj�p�J* mQ�N�����*I�-*�ȩ�F�g�3 �5��V�ʊ�ɮ�a��5F���O@{���NX��?����H�]3��1�Ri_u��������ѕ�� ����0��� F��~��:60�p�͈�S��qX#a�5>���`�o&+�<2�D����: �������ڝ�$�nP���*)�N�|y�Ej�F�5ټ�e���ihy�Z �>���k�bH�a�v��h�-#���!�Po=@k̆IEN��@��}Ll?j�O������߭�ʞ���Q|A07x���wt!xf���I2?Z��<ץ�T���cU�j��]���陎Ltl �}5�ϓ��$�,��O�mˊ�;�@O��jE��j(�ا,��LX���LO���Ц�90�O �.����a��nA���7������j4 ��W��_ٓ���zW�jcB������y՗+EM�)d���N�g6�y1_x��p�$Lv�:��9�"z��p���ʙ$��^��JԼ*�ϭ����o���=x�Lj�6�J��u82�A�H�3$�ٕ@�=Vv�]�'�qEz�;I˼��)��=��ɯ���x �/�W(V���p�����$ �m�������u�����񶤑Oqˎ�T����r��㠚x�sr�GC��byp�G��1ߠ�w e�8�$⿄����/�M{*}��W�]˷.�CK\�ުx���/$�WP�w���r� |i���&�}�{�X� �>��$-��l���?-z���g����lΆ���(F���h�vS*���b���߲ڡn,|)mrH[���a�3�ר�[1��3o_�U�3�TC�$��(�=�)0�kgP���� ��u�^=��4 �WYCҸ:��vQ�ר�X�à��tk�m,�t*��^�,�}D*�� �"(�I��9R����>`�`��[~Q]�#af��i6l��8���6�:,s�s�N6�j"�A4���IuQ��6E,�GnH��zS�HO�uk�5$�I�4��ؤ�Q9�@��C����wp��BGv[]�u�Ov����0I4���\��y�����Q�Ѹ��~>Z��8�T��a��q�ޣ;z��a���/��S��I:�ܫ_�|������>=Z����8:�S��U�I�J��"IY���8%b8���H��:�QO�6�;7�I�S��J��ҌAά3��>c���E+&jf$eC+�z�;��V����� �r���ʺ������my�e���aQ�f&��6�ND���.:��NT�vm�<- u���ǝ\MvZY�N�NT��-A�>jr!S��n�O 1�3�Ns�%�3D@���`������ܟ 1�^c<���� �a�ɽ�̲�Xë#�w�|y�cW�=�9I*H8�p�^(4���՗�k��arOcW�tO�\�ƍR��8����'�K���I�Q�����?5�>[�}��yU�ײ -h��=��% q�ThG�2�)���"ו3]�!kB��*p�FDl�A���,�eEi�H�f�Ps�����5�H:�Փ~�H�0Dت�D�I����h�F3�������c��2���E��9�H��5�zԑ�ʚ�i�X�=:m�xg�hd(�v����׊�9iS��O��d@0ڽ���:�p�5�h-��t�&���X�q�ӕ,��ie�|���7A�2���O%P��E��htj��Y1��w�Ѓ!����  ���� ࢽ��My�7�\�a�@�ţ�J ��4�Ȼ�F�@o�̒?4�wx��)��]�P��~�����u�����5�����7X ��9��^ܩ�U;Iꭆ 5 �������eK2�7(�{|��Y׎ �V��\"���Z�1� Z�����}��(�Ǝ"�1S���_�vE30>���p;� ΝD��%x�W�?W?v����o�^V�i�d��r[��/&>�~`�9Wh��y�;���R���� ;;ɮT��?����r$�g1�K����A��C��c��K��l:�'��3 c�ﳯ*"t8�~l��)���m��+U,z��`(��>yJ�?����h>��]��v��ЍG*�{`��;y]��I�T� ;c��NU�fo¾h���/$���|NS���1�S�"�H��V���T���4��uhǜ�]�v;���5�͠x��'C\�SBpl���h}�N����� A�Bx���%��ޭ�l��/����T��w�ʽ]D�=����K���ž�r㻠l4�S�O?=�k �M:� ��c�C�a�#ha���)�ѐxc�s���gP�iG���{+���x���Q���I= �� z��ԫ+ �8"�k�ñ�j=|����c ��y��CF��/���*9ж�h{ �?4�o� ��k�m�Q�N�x��;�Y��4膚�a�w?�6�>�e]�����Q�r�:����g�,i"�����ԩA��*M�<�G��b�if��l^M��5�� �Ҩ�{����6J��ZJ�����P�*�����Y���ݛu�_4�9�I8�7���������,^ToR���m4�H��?�N�S�ѕw��/S��甍�@�9H�S�T��t�ƻ���ʒU��*{Xs�@����f������֒Li�K{H�w^���������Ϥm�tq���s� ���ք��f:��o~s��g�r��ט� �S�ѱC�e]�x���a��) ���(b-$(�j>�7q�B?ӕ�F��hV25r[7 Y� }L�R��}����*sg+��x�r�2�U=�*'WS��ZDW]�WǞ�<��叓���{�$�9Ou4��y�90-�1�'*D`�c�^o?(�9��u���ݐ��'PI&� f�Jݮ�������:wS����jfP1F:X �H�9dԯ����˝[�_54 �}*;@�ܨ�� ð�yn�T���?�ןd�#���4rG�ͨ��H�1�|-#���Mr�S3��G�3�����)�.᧏3v�z֑��r����$G"�`j �1t��x0<Ɔ�Wh6�y�6��,œ�Ga��gA����y��b��)���h�D��ß�_�m��ü �gG;��e�v��ݝ�nQ� ��C����-�*��o���y�a��M��I�>�<���]obD��"�:���G�A��-\%LT�8���c�)��+y76���o�Q�#*{�(F�⽕�y����=���rW�\p���۩�c���A���^e6��K������ʐ�cVf5$�'->���ՉN"���F�"�UQ@�f��Gb~��#�&�M=��8�ט�JNu9��D��[̤�s�o�~������� G��9T�tW^g5y$b��Y'��س�Ǵ�=��U-2 #�MC�t(�i� �lj�@Q 5�̣i�*�O����s�x�K�f��}\��M{E�V�{�υ��Ƈ�����);�H����I��fe�Lȣr�2��>��W��I�Ȃ6������i��k�� �5�YOxȺ����>��Y�f5'��|��H+��98pj�n�.O�y�������jY��~��i�w'������l�;�s�2��Y��:'lg�ꥴ)o#'Sa�a�K��Z� �m��}�`169�n���"���x��I ��*+� }F<��cГ���F�P�������ֹ*�PqX�x۩��,� ��N�� �4<-����%����:��7����W���u�`����� $�?�I��&����o��o��`v�>��P��"��l���4��5'�Z�gE���8���?��[�X�7(��.Q�-��*���ތL@̲����v��.5���[��=�t\+�CNܛ��,g�SQnH����}*F�G16���&:�t��4ُ"A��̣��$�b �|����#rs��a�����T�� ]�<�j��B�S�('$�ɻ� �wP;�/�n��?�ݜ��x�F��yUn�~mL*-�������Xf�wd^�a�}��f�,=t�׵i�.2/wpN�Ep8�OР���•��R�FJ� 55TZ��T �ɭ�<��]��/�0�r�@�f��V��V����Nz�G��^���7hZi����k��3�,kN�e|�vg�1{9]_i��X5y7� 8e]�U����'�-2,���e"����]ot�I��Y_��n�(JҼ��1�O ]bXc���Nu�No��pS���Q_���_�?i�~�x h5d'�(qw52] ��'ޤ�q��o1�R!���`ywy�A4u���h<קy���\[~�4�\ X�Wt/� 6�����n�F�a8��f���z �3$�t(���q��q�x��^�XWeN'p<-v�!�{�(>ӽDP7��ո0�y)�e$ٕv�Ih'Q�EA�m*�H��RI��=:��� ���4牢) �%_iN�ݧ�l]� �Nt���G��H�L��� ɱ�g<���1V�,�J~�ٹ�"K��Q�� 9�HS�9�?@��k����r�;we݁�]I�!{ �@�G�[�"��`���J:�n]�{�cA�E����V��ʆ���#��U9�6����j�#Y�m\��q�e4h�B�7��C�������d<�?J����1g:ٳ���=Y���D�p�ц� ׈ǔ��1�]26؜oS�'��9�V�FVu�P�h�9�xc�oq�X��p�o�5��Ա5$�9W�V(�[Ak�aY錎qf;�'�[�|���b�6�Ck��)��#a#a˙��8���=äh�4��2��C��4tm^ �n'c����]GQ$[Wҿ��i���vN�{Fu ��1�gx��1┷���N�m��{j-,��x�� Ūm�ЧS�[�s���Gna���䑴�� x�p 8<������97�Q���ϴ�v�aϚG��Rt�Һ׈�f^\r��WH�JU�7Z���y)�vg=����n��4�_)y��D'y�6�]�c�5̪��\� �PF�k����&�c;��cq�$~T�7j ���nç]�<�g ":�to�t}�159�<�/�8������m�b�K#g'I'.W������6��I/��>v��\�MN��g���m�A�yQL�4u�Lj�j9��#44�t��l^�}L����n��R��!��t��±]��r��h6ٍ>�yҏ�N��fU�� ���� Fm@�8}�/u��jb9������he:A�y�ծw��GpΧh�5����l}�3p468��)U��d��c����;Us/�֔�YX�1�O2��uq�s��`hwg�r~�{ R��mhN��؎*q 42�*th��>�#���E����#��Hv�O����q�}������6�e��\�,Wk�#���X��b>��p}�դ��3���T5��†��6��[��@��P�y*n��|'f�֧>�lư΂�̺����SU�'*�q�p�_S�����M�� '��c�6������m�� ySʨ;M��r���Ƌ�m�Kxo,���Gm�P��A�G�:��i��w�9�}M(�^�V��$ǒ�ѽ�9���|���� �a����J�SQ�a���r�B;����}���ٻ֢�2�%U���c�#�g���N�a�ݕ�'�v�[�OY'��3L�3�;,p�]@�S��{ls��X�'���c�jw��k'a�.��}�}&�� �dP�*�bK=ɍ!����;3n�gΊU�ߴmt�'*{,=SzfD� A��ko~�G�aoq�_mi}#�m�������P�Xhύ�����mxǍ�΂���巿zf��Q���c���|kc�����?���W��Y�$���_Lv����l߶��c���`?����l�j�ݲˏ!V��6����U�Ђ(A���4y)H���p�Z_�x��>���e���R��$�/�`^'3qˏ�-&Q�=?��CFVR �D�fV�9��{�8g�������n�h�(P"��6�[�D���< E�����~0<@�`�G�6����Hг�cc�� �c�K.5��D��d�B���`?�XQ��2��ٿyqo&+�1^� DW�0�ꊩ���G�#��Q�nL3��c���������/��x ��1�1�[y�x�პCW��C�c�UĨ80�m�e�4.{�m��u���I=��f�����0QRls9���f���������9���~f�����Ǩ��a�"@�8���ȁ�Q����#c�ic������G��$���G���r/$W�(��W���V�"��m�7�[m�A�m����bo��D� j����۳� l���^�k�h׽����� ��#� iXn�v��eT�k�a�^Y�4�BN���ĕ���0������� !01@Q"2AaPq3BR�������?�����@4�Q�����T3,���㺠�W�[=JK�Ϟ���2�r^7��vc�:�9 �E�ߴ�w�S#d���Ix��u��:��Hp��9E!�� V 2;73|F��9Y���*ʬ�F��D����u&���y؟��^EA��A��(ɩ���^��GV:ݜDy�`��Jr29ܾ�㝉��[���E;Fzx��YG��U�e�Y�C���� ����v-tx����I�sם�Ę�q��Eb�+P\ :>�i�C'�;�����k|z�رn�y]�#ǿb��Q��������w�����(�r|ӹs��[�D��2v-%��@;�8<a���[\o[ϧw��I!��*0�krs)�[�J9^��ʜ��p1)� "��/_>��o��<1����A�E�y^�C��`�x1'ܣn�p��s`l���fQ��):�l����b>�Me�jH^?�kl3(�z:���1ŠK&?Q�~�{�ٺ�h�y���/�[��V�|6��}�KbX����mn[-��7�5q�94�������dm���c^���h� X��5��<�eޘ>G���-�}�دB�ޟ� ��|�rt�M��V+�]�c?�-#ڛ��^ǂ}���Lkr���O��u�>�-D�ry� D?:ޞ�U��ǜ�7�V��?瓮�"�#���r��չģVR;�n���/_� ؉v�ݶe5d�b9��/O��009�G���5n�W����JpA�*�r9�>�1��.[t���s�F���nQ� V 77R�]�ɫ8����_0<՜�IF�u(v��4��F�k�3��E)��N:��yڮe��P�`�1}�$WS��J�SQ�N�j��ٺ��޵�#l���ј(�5=��5�lǏmoW�v-�1����v,W�mn��߀$x�<����v�j(����c]��@#��1������Ǔ���o'��u+����;G�#�޸��v-lη��/(`i⣍Pm^����ԯ̾9Z��F��������n��1��� ��]�[��)�'�������:�֪�W��FC����� �B9،!?���]��V��A�Վ�M��b�w��G F>_DȬ0¤�#�QR�[V��kz���m�w�"��9ZG�7'[��=�Q����j8R?�zf�\a�=��O�U����*oB�A�|G���2�54 �p��.w7� �� ���&������ξxGHp� B%��$g�����t�Џ򤵍z���HN�u�Я�-�'4��0���;_���3������� !01"@AQa2Pq#3BR�������?����ʩca��en��^��8���<�u#��m*08r��y�N"�<�Ѳ0��@\�p��� �����Kv�D��J8�Fҽ� �f�Y��-m�ybX�NP����}�!*8t(�OqѢ��Q�wW�K��ZD��Δ^e��!� ��B�K��p~�����e*l}z#9ң�k���q#�Ft�o��S�R����-�w�!�S���Ӥß|M�l޶V��!eˈ�8Y���c�ЮM2��tk���� ������J�fS����Ö*i/2�����n]�k�\���|4yX�8��U�P.���Ы[���l��@"�t�<������5�lF���vU�����W��W��;�b�cД^6[#7@vU�xgZv��F�6��Q,K�v��� �+Ъ��n��Ǣ��Ft���8��0��c�@�!�Zq s�v�t�;#](B��-�nῃ~���3g������5�J�%���O������n�kB�ĺ�.r��+���#�N$?�q�/�s�6��p��a����a��J/��M�8��6�ܰ"�*������ɗud"\w���aT(����[��F��U՛����RT�b���n�*��6���O��SJ�.�ij<�v�MT��R\c��5l�sZB>F��<7�;EA��{��E���Ö��1U/�#��d1�a�n.1ě����0�ʾR�h��|�R��Ao�3�m3 ��%�� ���28Q�� ��y��φ���H�To�7�lW>����#i`�q���c����a��� �m,B�-j����݋�'mR1Ήt�>��V��p���s�0IbI�C.���1R�ea�����]H�6�����������4B>��o��](��$B���m�����a�!=���?�B� K�Ǿ+�Ծ"�n���K��*��+��[T#�{�E�J�S����Q�����s�5�:�U�\wĐ�f�3����܆&�)�����I���Ԇw��E T�lrTf6Q|R�h:��[K�� �z��c֧�G�C��%\��_�a��84��HcO�bi��ؖV��7H �)*ģK~Xhչ0��4?�0��� �E<���}3���#���u�?�� ��|g�S�6ꊤ�|�I#Hڛ� �ա��w�X��9��7���Ŀ%�SL��y6č��|�F�a 8���b���$�sק�h���b9RAu7�˨p�Č�_\*w��묦��F ����4D~�f����|(�"m���NK��i�S�>�$d7SlA��/�²����SL��|6N�}���S�˯���g��]6��; �#�.��<���q'Q�1|KQ$�����񛩶"�$r�b:���N8�w@��8$�� �AjfG|~�9F ���Y��ʺ��Bwؒ������M:I岎�G��`s�YV5����6��A �b:�W���G�q%l�����F��H���7�������Fsv7���k�� 403WebShell
403Webshell
Server IP : 103.30.72.248  /  Your IP : 216.73.216.144
Web Server : Microsoft-IIS/10.0
System : Windows NT WIN-CARKG80MF9A 10.0 build 17763 (Windows Server 2019) AMD64
User : IUSR ( 0)
PHP Version : 8.2.7
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : OFF  |  Perl : OFF  |  Python : OFF  |  Sudo : OFF  |  Pkexec : OFF
Directory :  C:/Windows/System32/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : C:/Windows/System32//microsoft-windows-system-events.dll
MZ����@���	�!�L�!This program cannot be run in DOS mode.

$�<ߵ�R���R���R�Ы����R�ЫP���R�Rich��R�PEd�+у�" 
��


�Fx` ��8.rdata�@@.rsrc�� �@@+у
T88+у$��8.rdata8x.rdata$zzzdbg .rsrc$01!p�.rsrc$02 ,�.��j��8	aH6��m���AO+у�(���@�X�p�����	�	�	����0%b�! 
WEVT_TEMPLATEMUI4VS_VERSION_INFO��
�cE
�cE?|StringFileInfoX040904B0LCompanyNameMicrosoft Corporation|*FileDescriptionMicrosoft-Windows-System-Events Resourcesn'FileVersion10.0.17763.7553 (WinBuild.160101.0800)h$InternalNamemicrosoft-windows-system-events.dll�.LegalCopyright� Microsoft Corporation. All rights reserved.p$OriginalFilenamemicrosoft-windows-system-events.dllj%ProductNameMicrosoft� Windows� Operating SystemDProductVersion10.0.17763.7553DVarFileInfo$Translation	�CRIM`�+���/��G�!D?8�4�l����O�צ���]�!�,�"{+B��/����iO�p�sO�Q3�=T����c�#w[H���V]s]J��+�:WcL�.�?�w�;ȿ?�Y�F�K��B�����x�7v��PY0J���~�W4���"S���K�����D�i�U�?�F�M<n(-�U�8bi!�{�s[�Ŋ�Su���:���EJFTzؤ��78>�<&�1�M�9�ST�A��)}��@�CH�3UH|D��:��E��4V�^�8L�����L���)j��0�d��jT��N�O��a�.��r���;��@����a��.؇`:�m�@ZD�ʙ5�PFP��������� �f0�I*�})S2H��C�y:�Ч�����wA��(:�RRq0�7�u���HF����M<����D�zM�K��	��^S�'���ĜeN�p�V�‰T�C����D�����/��Z�v��z�5F��I�ct�]�C��1D�A�u�e�G���>����EO�C�E�l�����`{MK�f�/e��@8�ڊR�_�O��]�(a�����B��J���;?&�0�
'��2
RC�R۫A��Y��^񿿁�E�|��چ�_��56�wuC�$�E��7�����P.�K��INo
�����́���^�a�p�Ь�*�u�O�Ȯ	ϛ#�
*��~_H�Ot�(q��@�{�_0*&^җ`"0ʜp��*��O�F�Sd^G�x����J���M�<���|���]�hV��M��D3WEVTl���
�4p��CHAN0��H���PMicrosoft-Windows-Kernel-WDI/AnalyticLMicrosoft-Windows-Kernel-WDI/DebugXMicrosoft-Windows-Kernel-WDI/OperationalTTBL�
TEMP��p�iS�^(c`lg�ߜ���D�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
A��M�oData5K�NameDroppedEventCount
A��A�oData)K�NameActionCount
A��MZ�ComplexData'K�Name
SemActions
�����(DT

l��ProviderIDEventID(DroppedEventCountActionCountSemActionsProviderIDLevelReservedKeyword$EnablePropertyNTStatusTEMP,�	ڈ6MhY��F�㐍����D�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
�	�	ProviderIDEventIDTEMP���mx
[�GH kA����D�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
A��;�oData#K�NameNTStatus
<XlProviderIDEventIDNTStatusTEMP
��kg��T�,�pt����VD�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
A��E�oData-K�Name
ScenarioCount
A��cZ�ComplexData=K�NameScenarioInflightItems
��
�
�
0L`xProviderIDEventID ScenarioCount0ScenarioInflightItemsProviderIDEventIDReserved InflightCountTEMP,lڈ6MhY��F�㐍����D�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
��ProviderIDEventIDTEMP�X�{�][�9�H�Nh��`D�	EventDataA��?�oData'K�Name
ProviderID
lProviderIDTEMP����mx
[�GH kA����D�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
A��;�oData#K�NameNTStatus
��ProviderIDEventIDNTStatusTEMP��^�=y�T�[�L�g����D�	EventDataA��9�oData!K�NameSqmType
A��7�oDataK�NameSqmSid
,SqmTypeSqmSidTEMPD�4H��5�Sp-	�#;��BD�	EventDataA��G�oData/K�NameSqmSessionGuid
A��5�oDataK�NameSqmID
A��9�oData!K�NameSqmType
A��W�oData?K�NameSqmDWORDDatapointValue
,<P$SqmSessionGuidSqmIDSqmType4SqmDWORDDatapointValueTEMP`L/�Z�>]�$�z�q!���D�	EventDataA��G�oData/K�NameSqmSessionGuid
A��5�oDataK�NameSqmID
A��9�oData!K�NameSqmType
A��O�oData7K�NameSqmStreamRowLength
A��QZ�ComplexData+K�NameSqmStreamRow
�� 4`���$SqmSessionGuidSqmIDSqmType,SqmStreamRowLength SqmStreamRow SqmTypeEntry SqmDWORDEntry$SqmStringEntryPRVAP�Microsoft-Windows-Kernel-WDIOPCO<

0�00X

0�00T0�0�0H0�0 LWDI_SEM_TASK_SCENARIO_OPCODE_STARTHWDI_SEM_TASK_SCENARIO_OPCODE_ENDPWDI_SEM_TASK_SCENARIO_OPCODE_TIMEOUTXWDI_SEM_TASK_SCENARIO_OPCODE_START_FAILEDTWDI_SEM_TASK_SCENARIO_OPCODE_END_FAILEDXWDI_SEM_TASK_SCENARIO_OPCODE_INFLIGHT_MAXLWDI_SEM_TASK_INIT_OPCODE_MISCONFIGPWDI_SEM_TASK_INIT_OPCODE_SCENARIO_MAXtWDI_SEM_TASK_INIT_OPCODE_SCENARIO_CONTEXT_PROVIDER_MAXdWDI_SEM_TASK_INIT_OPCODE_SCENARIO_END_EVENT_MAXPWDI_SEM_TASK_INIT_OPCODE_PROVIDER_MAXLEVL�P�P�P�win:Errorwin:Warning(win:InformationalTASK�		p@

pp0WDI_SEM_TASK_SCENARIO(WDI_SEM_TASK_INITKEYWt!�"�4�contextdiagwin:SQMEVNT� 
	� ��@��!�!	�!��L��!�"	�"��X��!�#	@#��|��$
	@$��	d��%	@%��	p��&
 &���|$�'
 '���|$�(
 (���|$�)
 )���|$�*
 *���|$�+����$��!,����@��!-�������!������WEVT�G�	0"`"$
�a�ab�b|d�eCHAN0L"�SystemMAPS��"�"x"VMAP4�#����VMAP$�#��VMAPL#��	�
���
�dEx:LeapSecondDataParseFailure.FailureResultMapTEx:LeapSecondDataUpdate.UpdateReasonMap@Ex:SystemTimeChange.ReasonMapTTBLl=TEMP �$��ۙ�}(V�X}�=����D�	EventDataA��9�oData!K�NameNewTime
A��9�oData!K�NameOldTime
%,%NewTimeOldTimeTEMP�L&�xL��W�ְ�2_����D�	EventDataA��9�oData!K�NameNewTime
A��9�oData!K�NameOldTime
A��7�oDataK�NameReason
�&�&x"�&NewTimeOldTimeReasonTEMPl\(���`�W�.��H�����dD�	EventDataA��9�oData!K�NameNewTime
A��9�oData!K�NameOldTime
A��7�oDataK�NameReason
A��A�oData)K�NameProcessName
A��=�oData%K�Name	ProcessID
�(�(x"�(�()NewTimeOldTimeReasonProcessNameProcessIDTEMPP�))5�H7^A����d����D�	EventDataTEMP��*ݙ!=�YZ	�2:����D�	EventDataA��A�oData)K�NameFinalStatus
A��M�oData5K�NameExtraStringLength
A��A�oData)K�NameExtraString
�*+4+FinalStatus(ExtraStringLengthExtraStringTEMP��,ݙ!=�YZ	�2:����D�	EventDataA��A�oData)K�NameFinalStatus
A��M�oData5K�NameExtraStringLength
A��A�oData)K�NameExtraString
�,�,-FinalStatus(ExtraStringLengthExtraStringTEMP�/S"��F�Vַkܭy����D�	EventDataA��M�oData5K�NameExtraStringLength
A��A�oData)K�NameExtraString
A��3�oDataK�NameTmId
A��3�oDataK�NameRmId
A��7�oDataK�NameStatus
A��C�oData+K�NameInternalCode
�/�/�/�/�/�/(ExtraStringLengthExtraStringTmIdRmIdStatus InternalCodeTEMP(�1�iC^s�Z<w��i����4D�	EventDataA��G�oData/K�NameHiveNameLength
A��;�oData#K�NameHiveName
A��C�oData+K�NameOriginalSize
A��9�oData!K�NameNewSize
�1�12,2$HiveNameLengthHiveName OriginalSizeNewSizeTEMP0�3�$3�]SW�=�v���8D�	EventDataA��G�oData/K�NameHiveNameLength
A��;�oData#K�NameHiveName
A��A�oData)K�NameKeysUpdated
A��?�oData'K�Name
DirtyPages
�3 484T4$HiveNameLengthHiveNameKeysUpdatedDirtyPagesTEMP��6IS��Z%ZA��\��D�	EventDataA��C�oData+K�NameMajorVersion
A��C�oData+K�NameMinorVersion
A��C�oData+K�NameBuildVersion
A��?�oData'K�Name
QfeVersion
A��G�oData/K�NameServiceVersion
A��;�oData#K�NameBootMode
A��=�oData%K�Name	StartTime
D7d7�7�7�7�7�7 MajorVersion MinorVersion BuildVersionQfeVersion$ServiceVersionBootModeStartTimeTEMP��8zmU�b!A[Ф㸚�7��\D�	EventDataA��;�oData#K�NameStopTime
�8StopTimeTEMP�*B�>���8U�
�؋����	D�	EventDataA��3�oDataK�NameMode
A��?�oData'K�Name
ObjectType
A��?�oData'K�Name
ObjectName
A��A�oData)K�NameProcessName
A��[�oDataCK�NameObjectCreatorProcessName
A��?�oData'K�Name
AccessMask
A��=�oData%K�Name	TokenType
A��O�oData7K�NameImpersonationLevel
A��=�oData%K�Name	SessionId
A��C�oData+K�NameLowBoxNumber
	A��K�oData3K�NameTokenGroupsCount
A��OZ�ComplexData)K�NameTokenGroups
�A��M�oData5K�NameTokenPackageCount
A��QZ�ComplexData+K�NameTokenPackage

�A��S�oData;K�NameTokenCapabilityCount
A��[Z�ComplexData5K�NameTokenCapabilities
�A��S�oData;K�NameTokenTrustLevelCount
A��WZ�ComplexData1K�NameTokenTrustLevel
�A��_�oDataGK�NameSecurityDescriptorRevision
A��]�oDataEK�NameSecurityDescriptorControl
A��Y�oDataAK�NameSecurityDescriptorOwner
A��Y�oDataAK�NameSecurityDescriptorGroup
A��C�oData+K�NameDaclRevision
A��C�oData+K�NameDaclAceCount
A��GZ�ComplexData!K�NameDaclAce
�A��C�oData+K�NameSaclRevision
A��C�oData+K�NameSaclAceCount
A��GZ�ComplexData!K�NameSaclAce
�\ElE�E�E�E�EF,FXFpF�F
�F�F�FGLGtG!�G�GH<HpH�H�H"�H�HI&8ILIpI�I�I�I�IJ(J@J\JhJ|J�J�JModeObjectTypeObjectNameProcessName8ObjectCreatorProcessNameAccessMaskTokenType,ImpersonationLevelSessionId LowBoxNumber(TokenGroupsCountTokenGroups(TokenPackageCount TokenPackage0TokenCapabilityCount(TokenCapabilities0TokenTrustLevelCount$TokenTrustLevel<SecurityDescriptorRevision8SecurityDescriptorControl4SecurityDescriptorOwner4SecurityDescriptorGroup DaclRevision DaclAceCountDaclAce SaclRevision SaclAceCountSaclAce$GroupAttributesGroupSidPackageSid0CapabilityAttributes CapabilitySid TrustLevelSidAceTypeAceFlagsAccessMaskSidAceTypeAceFlagsAccessMaskSidTEMP��O�(�J�S��1�Ol����D�	EventDataA��?�oData'K�Name
ActionName
A��A�oData)K�NameProcessName
A��A�oData)K�NameAccountName
A��E�oData-K�Name
AuthorityName
A��9�oData!K�NameTokenId
A��K�oData3K�NameAuthenticationId
A��=�oData%K�Name	TokenType
A��O�oData7K�NameImpersonationLevel
A��?�oData'K�Name
TokenFlags
A��Y�oDataAK�NameSidValuesReferenceCount
		A��G�oData/K�NameSidValuesCount
A��KZ�ComplexData%K�Name	SidValues
�A��e�oDataMK�NameSharedSidValuesReferenceCount
	A��S�oData;K�NameSharedSidValuesCount

A��WZ�ComplexData1K�NameSharedSidValues
�Q4QPQlQ�Q�Q�Q�QR		(R\R
�R		�R�R
S,S8SActionNameProcessNameAccountName AuthorityNameTokenId(AuthenticationIdTokenType,ImpersonationLevelTokenFlags4SidValuesReferenceCount$SidValuesCountSidValues@SharedSidValuesReferenceCount0SharedSidValuesCount$SharedSidValuesSidSidTEMP��Ta8vXZ-�.��U5��D�	EventDataA��Q�oData9K�NameTransitionStartTime
A��A�oData)K�NameCurrentTime
A��K�oData3K�NameSoftRestartCount
�T�TU,TransitionStartTimeCurrentTime(SoftRestartCountTEMP�W3�>ʬ�]qX?�o��PD�	EventDataA��E�oData-K�Name
MmPhase0Start

A��C�oData+K�NameMmPhase0Stop

A��A�oData)K�NamePhase1Start

A��M�oData5K�NameKsrExtensionStart

A��K�oData3K�NameKsrExtensionStop

A��S�oData;K�NameStartProcessorsStart

A��Q�oData9K�NameStartProcessorsStop



@X

`X

�X

�X

�X

�X

Y MmPhase0Start MmPhase0StopPhase1Start(KsrExtensionStart(KsrExtensionStop0StartProcessorsStart,StartProcessorsStopTEMPH		|\.]�7�<P���G����D�	EventDataA��E�oData-K�Name
MmPhase0Start

A��C�oData+K�NameMmPhase0Stop

A��A�oData)K�NamePhase1Start

A��M�oData5K�NameKsrExtensionStart

A��K�oData3K�NameKsrExtensionStop

A��S�oData;K�NameStartProcessorsStart

A��Q�oData9K�NameStartProcessorsStop

A��Q�oData9K�NameAutoLoggerInitStart

A��O�oData7K�NameAutoLoggerInitStop



0]

P]

p]

�]

�]

�]

^

8^

d^ MmPhase0Start MmPhase0StopPhase1Start(KsrExtensionStart(KsrExtensionStop0StartProcessorsStart,StartProcessorsStop,AutoLoggerInitStart,AutoLoggerInitStopTEMP �_pE�mm��R
f��<�����.D�	EventDataA��C�oData+K�NameUpdateReason
A��?�oData'K�Name
EnabledNew

A��;�oData#K�NameCountNew
A��;�oData#K�NameCountOld
�"D`

d`�`�` UpdateReasonEnabledNewCountNewCountOldTEMP�LaDs;��^P�#�@ݕ3��fD�	EventDataA��E�oData-K�Name
FailureResult
�"`a FailureResultPRVAX�aMicrosoft-Windows-Kernel-GeneralOPCO01�awin:InfoLEVL�P8bPPbPlbwin:Errorwin:Warning(win:InformationalTASK�����dc�����c�����c�����c�����c����d����@dSystemStartSystemStop SoftBootInfo,BootPerformanceData(SystemTimeChange0LeapSecondDataUpdate<LeapSecondDataParseFailureKEYWD�d ����e@����Pe������e<KERNEL_GENERAL_KEYWORD_TIMELKERNEL_GENERAL_SECURITY_ACCESSCHECKLKERNEL_GENERAL_TOKEN_SID_MANAGEMENT$BootPerformanceEVNT�� $�a,b�i<"��@%�a,bc�i<"��&�a,bc�i<"�0)�a,b<"�0)�a,b<"�0)�a,b<"��)b<"�P+b<"� -�a,b<"��p4�a,b�b�i<"
��
8�a,b�b�i<" �����8b�i�0�a,b<"�@2�a,b<"@�����J,b�i��DS�a,b�b�i<"�����0U�a,b�b�i�����HY�a,b�b�i��^�a,b,c�i<"��`�a bHc�i<"�d�d�d�d�d�d�d�d�d�d�d�dWEVT$b�	j�j�j
H����X��P�CHANt4j����XMicrosoft-Windows-Kernel-Process/AnalyticMAPSL�jBMAP�j� ProcessFlagsTTBLpPTEMP��l
�q���=[�u�����T��|D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��I�oData1K�NameParentProcessID
A��=�oData%K�Name	SessionID
A��=�oData%K�Name	ImageName
�lm,mPmhmProcessIDCreateTime$ParentProcessIDSessionIDImageNameTEMP�lo�a#�m6Z�&M�lk���D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��I�oData1K�NameParentProcessID
A��=�oData%K�Name	SessionID
A��5�oDataK�NameFlags
A��=�oData%K�Name	ImageName
�o�op<p�jTpdpProcessIDCreateTime$ParentProcessIDSessionIDFlagsImageNameTEMP$

�s	�	�<RW�@�\:<����D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��I�oData1K�NameParentProcessID
A��=�oData%K�Name	SessionID
A��5�oDataK�NameFlags
A��=�oData%K�Name	ImageName
A��E�oData-K�Name
ImageChecksum
A��E�oData-K�Name
TimeDateStamp
A��I�oData1K�NamePackageFullName
A��S�oData;K�NamePackageRelativeAppId
	tt�t�t�t�j�t�tu,uLupuProcessIDCreateTime$ParentProcessIDSessionIDFlagsImageName ImageChecksum TimeDateStamp$PackageFullName0PackageRelativeAppIdTEMP�		px(�G���X�P�@;����D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��;�oData#K�NameExitTime
A��;�oData#K�NameExitCode
A��O�oData7K�NameTokenElevationType
A��A�oData)K�NameHandleCount
A��C�oData+K�NameCommitCharge

A��?�oData'K�Name
CommitPeak

A��=�oData%K�Name	ImageName
$y<yXypy�y�y

�y

�yzProcessIDCreateTimeExitTimeExitCode,TokenElevationTypeHandleCount CommitChargeCommitPeakImageNameTEMP��~E��ZY�Aty����D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��;�oData#K�NameExitTime
A��;�oData#K�NameExitCode
A��O�oData7K�NameTokenElevationType
A��A�oData)K�NameHandleCount
A��C�oData+K�NameCommitCharge

A��?�oData'K�Name
CommitPeak

A��E�oData-K�Name
CPUCycleCount

A��O�oData7K�NameReadOperationCount
	A��Q�oData9K�NameWriteOperationCount
A��U�oData=K�NameReadTransferKiloBytes
A��W�oData?K�NameWriteTransferKiloBytes
A��G�oData/K�NameHardFaultCount

A��=�oData%K�Name	ImageName
 �8�T�l�����

̀

�

�(�T�������ProcessIDCreateTimeExitTimeExitCode,TokenElevationTypeHandleCount CommitChargeCommitPeak CPUCycleCount,ReadOperationCount,WriteOperationCount0ReadTransferKiloBytes4WriteTransferKiloBytes$HardFaultCountImageNameTEMPx		��nUh�2X�l"�&�����D�	EventDataA��=�oData%K�Name	ProcessID
A��;�oData#K�NameThreadID
A��=�oData%K�Name	StackBase
A��?�oData'K�Name
StackLimit
A��E�oData-K�Name
UserStackBase
A��G�oData/K�NameUserStackLimit
A��=�oData%K�Name	StartAddr
A��G�oData/K�NameWin32StartAddr
A��9�oData!K�NameTebBase
����Ѕ��$�H�`���ProcessIDThreadIDStackBaseStackLimit UserStackBase$UserStackLimitStartAddr$Win32StartAddrTebBaseTEMP�

��Q���]���1�T���D�	EventDataA��=�oData%K�Name	ProcessID
A��;�oData#K�NameThreadID
A��=�oData%K�Name	StackBase
A��?�oData'K�Name
StackLimit
A��E�oData-K�Name
UserStackBase
A��G�oData/K�NameUserStackLimit
A��=�oData%K�Name	StartAddr
A��G�oData/K�NameWin32StartAddr
A��9�oData!K�NameTebBase
A��E�oData-K�Name
SubProcessTag
	x�������܊�� �8�\�p�ProcessIDThreadIDStackBaseStackLimit UserStackBase$UserStackLimitStartAddr$Win32StartAddrTebBase SubProcessTagTEMPh���*my_\ǻ�.���&D�	EventDataA��=�oData%K�Name	ProcessID
A��;�oData#K�NameThreadID
A��=�oData%K�Name	StackBase
A��?�oData'K�Name
StackLimit
A��E�oData-K�Name
UserStackBase
A��G�oData/K�NameUserStackLimit
A��=�oData%K�Name	StartAddr
A��G�oData/K�NameWin32StartAddr
A��9�oData!K�NameTebBase
A��E�oData-K�Name
SubProcessTag
	A��=�oData%K�Name	CycleTime

ȏ����,�L�p�������
�ProcessIDThreadIDStackBaseStackLimit UserStackBase$UserStackLimitStartAddr$Win32StartAddrTebBase SubProcessTagCycleTimeTEMP�8���|hGH}V�Ȋ`�j�%��
D�	EventDataA��=�oData%K�Name	ImageBase
A��=�oData%K�Name	ImageSize
A��=�oData%K�Name	ProcessID
A��E�oData-K�Name
ImageCheckSum
A��E�oData-K�Name
TimeDateStamp
A��A�oData)K�NameDefaultBase
A��=�oData%K�Name	ImageName
ēܓ��,�L�h�ImageBaseImageSizeProcessID ImageCheckSum TimeDateStampDefaultBaseImageNameTEMP�����|hGH}V�Ȋ`�j�%��
D�	EventDataA��=�oData%K�Name	ImageBase
A��=�oData%K�Name	ImageSize
A��=�oData%K�Name	ProcessID
A��E�oData-K�Name
ImageCheckSum
A��E�oData-K�Name
TimeDateStamp
A��A�oData)K�NameDefaultBase
A��=�oData%K�Name	ImageName
L�d�|�����ԗ�ImageBaseImageSizeProcessID ImageCheckSum TimeDateStampDefaultBaseImageNameTEMPl���UU�?��M���0D�	EventDataA��=�oData%K�Name	ProcessID
A��;�oData#K�NameThreadID
A��A�oData)K�NameOldPriority
A��A�oData)K�NameNewPriority
��ԙ��ProcessIDThreadIDOldPriorityNewPriorityTEMP�Ě2�>!��xX�6�f��P��jD�	EventDataA��I�oData1K�NameFrozenProcessID
ؚ$FrozenProcessIDTEMPL�Env�z��_�����%�����D�	EventDataA��I�oData1K�NameFrozenProcessID
A��?�oData'K�Name
CreateTime
�,�$FrozenProcessIDCreateTimeTEMP�d��7ά��Y���`�������D�	EventDataA��C�oData+K�NameContainer ID
A��7�oDataK�NameJob ID
A��?�oData'K�Name
StatusCode
����ԝ Container IDJob IDStatusCodeTEMP��.�n]�y�]b�A��"�h���D�	EventDataA��7�oDataK�NameJob ID
A��M�oData5K�NameDiskIoAttribution
A��?�oData'K�Name
StatusCode
T�h���Job ID(DiskIoAttributionStatusCodeTEMP��w묌
�U��	o	&���D�	EventDataA��7�oDataK�NameJob ID
A��E�oData-K�Name
IoRateControl
A��A�oData)K�NameControlType
A��;�oData#K�NameRateType
A��?�oData'K�Name
RateAmount
A��?�oData'K�Name
StatusCode
�(�H�d�|���Job ID IoRateControlControlTypeRateTypeRateAmountStatusCodeTEMP|����Z�ePSG�(/7�'���D�	EventDataA��7�oDataK�NameJob ID
A��E�oData-K�Name
IoRateControl
A��9�oData!K�NameMaxIops

A��C�oData+K�NameMaxBandwidth

A��G�oData/K�NameMaxTimePercent

A��I�oData1K�NameReservationIops

A��S�oData;K�NameReservationBandwidth

A��W�oData?K�NameReservationTimePercent

A��Y�oDataAK�NameCriticalReservationIops

A��c�oDataKK�NameCriticalReservationBandwidth
	
A��g�oDataOK�NameCriticalReservationTimePercent

A��C�oData+K�NameControlFlags
A��?�oData'K�Name
VolumeName
A��?�oData'K�Name
StatusCode

����

Ȩ

ܨ

��

 �

D�

t�

��

ܩ

�`�����Job ID IoRateControlMaxIops MaxBandwidth$MaxTimePercent$ReservationIops0ReservationBandwidth4ReservationTimePercent4CriticalReservationIops@CriticalReservationBandwidthDCriticalReservationTimePercent ControlFlagsVolumeNameStatusCodeTEMP�	p��̶�:�S�S�[����D�	EventDataA��7�oDataK�NameJob ID
A��E�oData-K�Name
IoRateControl
A��9�oData!K�NameMaxIops

A��C�oData+K�NameMaxBandwidth

A��G�oData/K�NameMaxTimePercent

A��I�oData1K�NameReservationIops

A��S�oData;K�NameReservationBandwidth

A��W�oData?K�NameReservationTimePercent

A��Y�oDataAK�NameCriticalReservationIops

A��c�oDataKK�NameCriticalReservationBandwidth
	
A��g�oDataOK�NameCriticalReservationTimePercent

A��A�oData)K�NameSoftMaxIops

A��K�oData3K�NameSoftMaxBandwidth

A��O�oData7K�NameSoftMaxTimePercent


A��C�oData+K�NameControlFlags
A��?�oData'K�Name
VolumeName
A��?�oData'K�Name
StatusCode
ıر

��

�

,�

P�

t�

��

ز

�

L�

��

��

Գ� �<�Job ID IoRateControlMaxIops MaxBandwidth$MaxTimePercent$ReservationIops0ReservationBandwidth4ReservationTimePercent4CriticalReservationIops@CriticalReservationBandwidthDCriticalReservationTimePercentSoftMaxIops(SoftMaxBandwidth,SoftMaxTimePercent ControlFlagsVolumeNameStatusCodeTEMP�h��_P‹5Z��<���L���D�	EventDataA��Y�oDataAK�NameOldWorkOnBehalfThreadID
A��Y�oDataAK�NameNewWorkOnBehalfThreadID
��ĵ4OldWorkOnBehalfThreadID4NewWorkOnBehalfThreadIDTEMP��F@mQ�)�Vنo���D�	EventDataA��C�oData+K�NameContainer ID
A��7�oDataK�NameJob ID
A��5�oDataK�NameState
H�h�|� Container IDJob IDStateTEMP����.���U�x`ߑ�ׂ���D�	EventDataA��C�oData+K�NameContainer ID
A��7�oDataK�NameJob ID
A��A�oData)K�NameMonitorName
��� Container IDJob IDMonitorNameTEMP��h���[a�BZ����(D�	EventDataA��C�oData+K�NameContainer ID
A��7�oDataK�NameJob ID
A��7�oDataK�NameStatus
A��A�oData)K�NameMonitorName
���,� Container IDJob IDStatusMonitorNamePRVAX\�Microsoft-Windows-Kernel-ProcessOPCOx1л2�2�win:Infowin:Startwin:StopLEVL@P0�(win:InformationalTASK�����\�����|�����������������о��������������4�	����\�
������������
����п��������������,�����X�����|������� ProcessStartProcessStopThreadStartThreadStopImageLoadImageUnload0CpuBasePriorityChange(CpuPriorityChange,PagePriorityChange(IoPriorityChange ProcessFreezeJobStart JobTerminate$ProcessRundown,PsDiskIoAttribution$PsIoRateControl8ThreadWorkOnBehalfUpdate,JobServerSiloStartKEYWl������ �����@����������<�����|����������������4������� ������@�����8WINEVENT_KEYWORD_PROCESS4WINEVENT_KEYWORD_THREAD4WINEVENT_KEYWORD_IMAGE@WINEVENT_KEYWORD_CPU_PRIORITYDWINEVENT_KEYWORD_OTHER_PRIORITYDWINEVENT_KEYWORD_PROCESS_FREEZE0WINEVENT_KEYWORD_JOBhWINEVENT_KEYWORD_ENABLE_PROCESS_TRACING_CALLBACKS4WINEVENT_KEYWORD_JOB_IODWINEVENT_KEYWORD_WORK_ON_BEHALF8WINEVENT_KEYWORD_JOB_SILOEVNT�%���j��$�d�P�$j���m��$�d�T�$j��|p��$�d�X�$j���uĻ$���\�$j��$zĻ$���`�$j �� ���$���d�$j ������$���h�$j �� �Ļ$���l�$j ����Ļ$���p�$j@������$�Լt�$j@������$��x�$j������$��|�$j������$�(���$j		�	����$�D���$j

�
����$�`���$j��$���$�|���$j������$�|���$j��$�Ļ$�|���$j����Ļ$�|���$j

�
�H���$�����$j��H�Ļ$�����$j��|p��$�н��$j������$�����������$����$j������Ļ$����$j���������$����$j���������$����$j���������$����$j�������Ļ$����$j�������Ļ$����$j�������Ļ$����$j �����X���$�$���$j@���������$�@���$j@���������$�@���$j@�����8�Ļ$�@���$j@���������$�@���$j@�������Ļ$�@���$j�����������������,�,�<�<�<�<�L�L��\�l�l�l�l�l�l�l�l�|�����������WEVT�F�4��
����4
CHAN�`�����������\Microsoft-Windows-Kernel-Registry/Analytic`Microsoft-Windows-Kernel-Registry/PerformanceTTBLl/TEMP�4��zw�_Q
f��i�N���D�	EventDataA��?�oData'K�Name
BaseObject
A��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��A�oData)K�NameDisposition
A��;�oData#K�NameBaseName
A��C�oData+K�NameRelativeName
�����������BaseObjectKeyObjectStatusDispositionBaseName RelativeNameTEMP�8�����u�Y[`q��BsK���D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��9�oData!K�NameKeyName
t�����KeyObjectStatusKeyNameTEMPx��C���^ζUGr������D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
A��K�oData3K�NameCapturedDataSize
A��C�oData+K�NameCapturedData
t������������KeyObjectStatusInfoClassDataSizeKeyName(CapturedDataSize CapturedDataTEMP���U���yZ[A��u����D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��3�oDataK�NameType
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
A��=�oData%K�Name	ValueName
A��K�oData3K�NameCapturedDataSize
A��C�oData+K�NameCapturedData
A��K�oData3K�NamePreviousDataType
A��K�oData3K�NamePreviousDataSize
	A��[�oDataCK�NamePreviousDataCapturedSize
A��C�oData+K�NamePreviousData
������,�@�X���������
(�KeyObjectStatusTypeDataSizeKeyNameValueName(CapturedDataSize CapturedData(PreviousDataType(PreviousDataSize8PreviousDataCapturedSize PreviousDataTEMP���5|��
U'VO��C���� D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��9�oData!K�NameKeyName
A��=�oData%K�Name	ValueName
����,�KeyObjectStatusKeyNameValueNameTEMP����Y܄$[�F�@L����BD�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
A��=�oData%K�Name	ValueName
A��K�oData3K�NameCapturedDataSize
A��C�oData+K�NameCapturedData
\�t������������KeyObjectStatusInfoClassDataSizeKeyNameValueName(CapturedDataSize CapturedDataTEMP����f�C��V��`����%��:D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��5�oDataK�NameIndex
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
A��K�oData3K�NameCapturedDataSize
A��C�oData+K�NameCapturedData
<�T�h�x���������KeyObjectStatusIndexInfoClassDataSizeKeyName(CapturedDataSize CapturedDataTEMPp��B!��Q>�Ƅ����dD�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��?�oData'K�Name
EntryCount
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
��,�H�`�KeyObjectStatusEntryCountDataSizeKeyNameTEMPx��C���^ζUGr������D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
A��K�oData3K�NameCapturedDataSize
A��C�oData+K�NameCapturedData
4�L�`�x�������KeyObjectStatusInfoClassDataSizeKeyName(CapturedDataSize CapturedDataTEMP<��Zv��NɋP�};�ɖ���D�	EventDataA��C�oData+K�NameHiveFilePath
A��;�oData#K�NameFileSize
��� HiveFilePathFileSizeTEMP\�%{�1�Uϫ+F�����D�	EventDataA��G�oData/K�NameTotalEntrySize
A��G�oData/K�NameBytesRecovered
<�`�$TotalEntrySize$BytesRecoveredTEMP��9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
,�StatusCodeTEMPT0�/���mT6#W�|4����D�	EventDataA��C�oData+K�NameHiveFilePath
A��G�oData/K�NameHiveMountPoint
X�x� HiveFilePath$HiveMountPointTEMP�0�9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
D�StatusCodeTEMP���ݯ��I^vo��X���D�	EventDataA��C�oData+K�NameHiveFilePath
A��G�oData/K�NameHiveMountPoint
A��?�oData'K�Name
FlushFlags
����� HiveFilePath$HiveMountPointFlushFlagsTEMP���i����T;�qW��w��fD�	EventDataA��E�oData-K�Name
BytesGathered
�� BytesGatheredTEMP���i����T;�qW��w��fD�	EventDataA��E�oData-K�Name
BytesGathered
�� BytesGatheredTEMPL��˦i��=I_��Nm�;���D�	EventDataA��C�oData+K�NameWritesIssued
A��C�oData+K�NameBytesWritten
���� WritesIssued BytesWrittenTEMPL��˦i��=I_��Nm�;���D�	EventDataA��C�oData+K�NameWritesIssued
A��C�oData+K�NameBytesWritten
 �@� WritesIssued BytesWrittenTEMP��9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
�StatusCodeTEMP$�V��U�V6Q�D��Y7{���D�	EventDataA��?�oData'K�Name
SourceFile
A��5�oDataK�NameFlags
�8�SourceFileFlagsTEMP��9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
�StatusCodeTEMP$�V��U�V6Q�D��Y7{���D�	EventDataA��?�oData'K�Name
SourceFile
A��5�oDataK�NameFlags
� �SourceFileFlagsTEMP��9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
�StatusCodeTEMP�����*K�tS
f�g<����fD�	EventDataA��E�oData-K�Name
SourceKeyPath
�� SourceKeyPathTEMP�X�9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
l�StatusCodePRVAX��Microsoft-Windows-Kernel-RegistryOPCO�!2x�2��
������
�����
����@�
��������������������L������������������H
������������������d����� ����!����"����0#����H$����`%����|&�����'�����(�����)����*����8+����`,����x-�����.�����win:Startwin:StopHRegPerfOpHiveMountBaseFileMountedPRegPerfOpHiveFlushBecameActiveFlusherHRegPerfOpShutdownRundownComplete4RegPerfOpSaveFileCopiedHRegPerfOpHiveMountLogEntryAppliedHRegPerfOpHiveFlushGatheredLogData<RegPerfOpShutdownFlushStart4RegPerfOpSaveTreeCopiedPRegPerfOpHiveFlushGatheredPrimaryData<RegPerfOpShutdownFlushStop8RegPerfOpSaveFileWrittenDRegPerfOpHiveFlushWroteLogFileLRegPerfOpHiveFlushWrotePrimaryFileTRegPerfOpHiveFlushBoostedActiveFlusherPRegPerfOpHiveFlushStartWaitForActivePRegPerfOpHiveFlushFinishWaitForActiveCreateKeyOpenKeyDeleteKeyQueryKeySetValueKey$DeleteValueKey QueryValueKey EnumerateKey(EnumerateValueKey0QueryMultipleValueKey(SetInformationKeyFlushKeyCloseKey(QuerySecurityKey$SetSecurityKeyLEVL@P�(win:InformationalTASKs�ssLs|s�s�s0RegPerfTaskHiveMount0RegPerfTaskHiveUnload0RegPerfTaskHiveFlush,RegPerfTaskShutdown,RegPerfTaskHiveLoad4RegPerfTaskHiveRestore,RegPerfTaskHiveSaveKEYW�����0����H����p����� �����@����������	����,	����H	����l	�����	�����	 �����	@�����	������	CloseKey(QuerySecurityKey$SetSecurityKey(EnumerateValueKey0QueryMultipleValueKey(SetInformationKeyFlushKeySetValueKey$DeleteValueKey QueryValueKey EnumerateKeyCreateKeyOpenKeyDeleteKeyQueryKeyEVNT�- �����(����@�! �����(����@�"@�����(����@�#�����������@�$�����,����@�%�����H����@�&�����D����@�'�����,����@�	(�����,�$���@�
) ������0���@�*@�����t�<���@�+������(�H���@�
,�����(�T���@�-�����(�`���@�.�����(�l���@�@������(P�
@��������(P�@����(�4��(P�@���������(P�@����H���DP�@���������DP�@����`���`P�
@������`P�@����(�@��`P�@������d��`P�
@���������`P�@���������`P�@�������`P�@�������`P�@�������`P�@����`����`P� @������|P�!@������|P�"@����L��|P�#@����p��|P�$@�������|P�%@����$����P�&@����H�����P�'@��������P�(@����0�����P�)@��������P�*
@����(���P�+@����X���P�,@����|���P�-@���������P�� ����p���@P`WEVT��	�L
`�����H���0�CHANt8����XMicrosoft-Windows-Kernel-Acpi/DiagnosticMAPS����VMAP$���VMAP$���VMAP$,��VMAPd|
��	�
���
���	�,MapAcpiOverrideTypeHMapActiveCoolingDevicePowerState<MapAmlMethodInvocationState MapResetTypeTTBL�TEMPL}9/��`XuN�y����tD�	EventDataA��C�oData+K�NameResourceFlag
A��A�oData)K�NameGeneralFlag
A��K�oData3K�NameTypeSpecificFlag
A��A�oData)K�NameGranularity

A��?�oData'K�Name
AddressMin

A��?�oData'K�Name
AddressMax

A��O�oData7K�NameAddressTranslation

A��E�oData-K�Name
AddressLength

���

 
<
X
� ResourceFlagGeneralFlag(TypeSpecificFlagGranularityAddressMinAddressMax,AddressTranslation AddressLengthTEMP\��K���;T]��cAl쪙���D�	EventDataA��A�oData)K�NameGpeRegister
A��O�oData7K�NameUnexpectedEventMap
��GpeRegister,UnexpectedEventMapTEMP�P�m��_:����Rt���D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
	A��3�oDataK�Name_AC6
A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9

A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
� � !!,!<!L!\!l!|!�!�!�!�!�!�!DThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance_TMP_PSV_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRTTEMPH%�~���\K�+I���S���D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��O�oData7K�NameActiveCoolingLevel
A��[�oDataCK�NameActiveCoolingDeviceIndex
A��Y�oDataAK�NameFanDeviceInstanceLength
A��M�oData5K�NameFanDeviceInstance
A��K�oData3K�NamePowerStateLength
A��?�oData'K�Name
PowerState
�%�%0&\&�&�&�&'DThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance,ActiveCoolingLevel8ActiveCoolingDeviceIndex4FanDeviceInstanceLength(FanDeviceInstance(PowerStateLengthPowerStateTEMP�*n�V^�_V?��{Lv���D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��O�oData7K�NameActiveCoolingLevel
A��[�oDataCK�NameActiveCoolingDeviceIndex
A��Y�oDataAK�NameFanDeviceInstanceLength
A��M�oData5K�NameFanDeviceInstance
A��?�oData'K�Name
PowerState
�*�*+<+t+�+��+DThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance,ActiveCoolingLevel8ActiveCoolingDeviceIndex4FanDeviceInstanceLength(FanDeviceInstancePowerStateTEMP�(-��]}�[���q�M��D�	EventDataA��S�oData;K�NameDeviceInstanceLength
A��G�oData/K�NameDeviceInstance
A��?�oData'K�Name
PowerState
d-�-��-0DeviceInstanceLength$DeviceInstancePowerStateTEMP�/��۸�̫S����m`���D�	EventDataA��S�oData;K�NameDeviceInstanceLength
A��G�oData/K�NameDeviceInstance
A��;�oData#K�NameThrottle
H/x/�/0DeviceInstanceLength$DeviceInstanceThrottleTEMPX41A*7���U�
G9P����JD�	EventDataA��S�oData;K�NameDeviceInstanceLength
A��G�oData/K�NameDeviceInstance
A��?�oData'K�Name
PowerState
A��;�oData#K�NameThrottle
�1�1��1�10DeviceInstanceLength$DeviceInstancePowerStateThrottleTEMP@x3��j�焴Y�E��3rZ��6D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��A�oData)K�NameTemperature
�3�304DThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstanceTemperatureTEMPt�5�]��S���X�;@��ZD�	EventDataA��Q�oData9K�NameAmlMethodNameLength
A��E�oData-K�Name
AmlMethodName
A��G�oData/K�NameAmlMethodState
A��G�oData/K�NameAmlElapsedTime

,6X6�x6

�6,AmlMethodNameLength AmlMethodName$AmlMethodState$AmlElapsedTimeTEMP��7C��?��,R�!��-ȟ��D�	EventDataA��Q�oData9K�NameAmlMethodNameLength
A��E�oData-K�Name
AmlMethodName
A��=�oData%K�Name	Frequency
48`8�8,AmlMethodNameLength AmlMethodNameFrequencyTEMP,,HD���q"^�8�Iy,���zD�	EventDataA��]�oDataEK�NameThermalZoneBiosNameLength
A��Q�oData9K�NameThermalZoneBiosName
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_TC1
A��3�oDataK�Name_TC2
A��3�oDataK�Name_TSP
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
	A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
A��3�oDataK�Name_AC6

A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9
A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
A��3�oDataK�Name_NTT
A��=�oData%K�Name	_PSLCount
A��A�oData)K�Name_PSLEntries
�A��=�oData%K�Name	_TZDCount
A��A�oData)K�Name_TZDEntries
�A��=�oData%K�Name	_AL0Count
A��A�oData)K�Name_AL0Entries
�A��=�oData%K�Name	_AL1Count
A��A�oData)K�Name_AL1Entries
�A��=�oData%K�Name	_AL2Count
A��A�oData)K�Name_AL2Entries
�A��=�oData%K�Name	_AL3Count
A��A�oData)K�Name_AL3Entries
�A��=�oData%K�Name	_AL4Count
 A��A�oData)K�Name_AL4Entries
!�A��=�oData%K�Name	_AL5Count
"A��A�oData)K�Name_AL5Entries
#�A��=�oData%K�Name	_AL6Count
$A��A�oData)K�Name_AL6Entries
%�A��=�oData%K�Name	_AL7Count
&A��A�oData)K�Name_AL7Entries
'�A��=�oData%K�Name	_AL8Count
(A��A�oData)K�Name_AL8Entries
)�A��=�oData%K�Name	_AL9Count
*A��A�oData)K�Name_AL9Entries
+��G�GH,H<HLH\HlH|H�H�H�H�H�H�H�H�HII,I<ITIpI�I�I�I�I�IJ$J@JXJtJ �J�J"�J�J$�JK&(KDK(\KxK*�K8ThermalZoneBiosNameLength,ThermalZoneBiosName_TMP_PSV_TC1_TC2_TSP_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRT_NTT_PSLCount_PSLEntries_TZDCount_TZDEntries_AL0Count_AL0Entries_AL1Count_AL1Entries_AL2Count_AL2Entries_AL3Count_AL3Entries_AL4Count_AL4Entries_AL5Count_AL5Entries_AL6Count_AL6Entries_AL7Count_AL7Entries_AL8Count_AL8Entries_AL9Count_AL9EntriesTEMP�--�W~����kU�RQ��ow����D�	EventDataA��]�oDataEK�NameThermalZoneBiosNameLength
A��Q�oData9K�NameThermalZoneBiosName
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_TC1
A��3�oDataK�Name_TC2
A��3�oDataK�Name_TSP
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
	A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
A��3�oDataK�Name_AC6

A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9
A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
A��3�oDataK�Name_NTT
A��=�oData%K�Name	_PSLCount
A��A�oData)K�Name_PSLEntries
�A��=�oData%K�Name	_TZDCount
A��A�oData)K�Name_TZDEntries
�A��=�oData%K�Name	_AL0Count
A��A�oData)K�Name_AL0Entries
�A��=�oData%K�Name	_AL1Count
A��A�oData)K�Name_AL1Entries
�A��=�oData%K�Name	_AL2Count
A��A�oData)K�Name_AL2Entries
�A��=�oData%K�Name	_AL3Count
A��A�oData)K�Name_AL3Entries
�A��=�oData%K�Name	_AL4Count
 A��A�oData)K�Name_AL4Entries
!�A��=�oData%K�Name	_AL5Count
"A��A�oData)K�Name_AL5Entries
#�A��=�oData%K�Name	_AL6Count
$A��A�oData)K�Name_AL6Entries
%�A��=�oData%K�Name	_AL7Count
&A��A�oData)K�Name_AL7Entries
'�A��=�oData%K�Name	_AL8Count
(A��A�oData)K�Name_AL8Entries
)�A��=�oData%K�Name	_AL9Count
*A��A�oData)K�Name_AL9Entries
+�A��I�oData1K�NameMinimumThrottle
,0[h[�[�[�[�[�[�[�[\\$\4\D\T\d\t\�\�\�\�\�\�\]]4]P]h]�]�]�]�]�] ^ ^"8^T^$l^�^&�^�^(�^�^*_$_8ThermalZoneBiosNameLength,ThermalZoneBiosName_TMP_PSV_TC1_TC2_TSP_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRT_NTT_PSLCount_PSLEntries_TZDCount_TZDEntries_AL0Count_AL0Entries_AL1Count_AL1Entries_AL2Count_AL2Entries_AL3Count_AL3Entries_AL4Count_AL4Entries_AL5Count_AL5Entries_AL6Count_AL6Entries_AL7Count_AL7Entries_AL8Count_AL8Entries_AL9Count_AL9Entries$MinimumThrottleTEMP�00l���p`�~S�㔿�,�����D�	EventDataA��]�oDataEK�NameThermalZoneBiosNameLength
A��Q�oData9K�NameThermalZoneBiosName
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_TC1
A��3�oDataK�Name_TC2
A��3�oDataK�Name_TSP
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
	A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
A��3�oDataK�Name_AC6

A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9
A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
A��3�oDataK�Name_NTT
A��=�oData%K�Name	_PSLCount
A��A�oData)K�Name_PSLEntries
�A��=�oData%K�Name	_TZDCount
A��A�oData)K�Name_TZDEntries
�A��=�oData%K�Name	_AL0Count
A��A�oData)K�Name_AL0Entries
�A��=�oData%K�Name	_AL1Count
A��A�oData)K�Name_AL1Entries
�A��=�oData%K�Name	_AL2Count
A��A�oData)K�Name_AL2Entries
�A��=�oData%K�Name	_AL3Count
A��A�oData)K�Name_AL3Entries
�A��=�oData%K�Name	_AL4Count
 A��A�oData)K�Name_AL4Entries
!�A��=�oData%K�Name	_AL5Count
"A��A�oData)K�Name_AL5Entries
#�A��=�oData%K�Name	_AL6Count
$A��A�oData)K�Name_AL6Entries
%�A��=�oData%K�Name	_AL7Count
&A��A�oData)K�Name_AL7Entries
'�A��=�oData%K�Name	_AL8Count
(A��A�oData)K�Name_AL8Entries
)�A��=�oData%K�Name	_AL9Count
*A��A�oData)K�Name_AL9Entries
+�A��I�oData1K�NameMinimumThrottle
,A��3�oDataK�Name_CR3
-A��3�oDataK�Name_TFP
.A��U�oData=K�NameOverThrottleThreshold
/�op<pLp\plp|p�p�p�p�p�p�p�p�pqq,q<qLq\qtq�q�q�q�q�qr,rDr`rxr�r �r�r"�r�r$s0s&Hsds(|s�s*�s�s�stt8ThermalZoneBiosNameLength,ThermalZoneBiosName_TMP_PSV_TC1_TC2_TSP_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRT_NTT_PSLCount_PSLEntries_TZDCount_TZDEntries_AL0Count_AL0Entries_AL1Count_AL1Entries_AL2Count_AL2Entries_AL3Count_AL3Entries_AL4Count_AL4Entries_AL5Count_AL5Entries_AL6Count_AL6Entries_AL7Count_AL7Entries_AL8Count_AL8Entries_AL9Count_AL9Entries$MinimumThrottle_CR3_TFP0OverThrottleThresholdTEMP22�� ���;;Rwi��Q���6
D�	EventDataA��]�oDataEK�NameThermalZoneBiosNameLength
A��Q�oData9K�NameThermalZoneBiosName
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_TC1
A��3�oDataK�Name_TC2
A��3�oDataK�Name_TSP
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
	A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
A��3�oDataK�Name_AC6

A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9
A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
A��3�oDataK�Name_NTT
A��=�oData%K�Name	_PSLCount
A��A�oData)K�Name_PSLEntries
�A��=�oData%K�Name	_TZDCount
A��A�oData)K�Name_TZDEntries
�A��=�oData%K�Name	_AL0Count
A��A�oData)K�Name_AL0Entries
�A��=�oData%K�Name	_AL1Count
A��A�oData)K�Name_AL1Entries
�A��=�oData%K�Name	_AL2Count
A��A�oData)K�Name_AL2Entries
�A��=�oData%K�Name	_AL3Count
A��A�oData)K�Name_AL3Entries
�A��=�oData%K�Name	_AL4Count
 A��A�oData)K�Name_AL4Entries
!�A��=�oData%K�Name	_AL5Count
"A��A�oData)K�Name_AL5Entries
#�A��=�oData%K�Name	_AL6Count
$A��A�oData)K�Name_AL6Entries
%�A��=�oData%K�Name	_AL7Count
&A��A�oData)K�Name_AL7Entries
'�A��=�oData%K�Name	_AL8Count
(A��A�oData)K�Name_AL8Entries
)�A��=�oData%K�Name	_AL9Count
*A��A�oData)K�Name_AL9Entries
+�A��I�oData1K�NameMinimumThrottle
,A��3�oDataK�Name_CR3
-A��3�oDataK�Name_TFP
.A��U�oData=K�NameOverThrottleThreshold
/A��M�oData5K�NameDescriptionLength
0A��A�oData)K�NameDescription
1��̅����(�8�H�X�h�x���������Ȇ؆�����0�L�d�������̇���4�P� h���"����$Ј�&� �(8�T�*l�������̉��0$�8ThermalZoneBiosNameLength,ThermalZoneBiosName_TMP_PSV_TC1_TC2_TSP_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRT_NTT_PSLCount_PSLEntries_TZDCount_TZDEntries_AL0Count_AL0Entries_AL1Count_AL1Entries_AL2Count_AL2Entries_AL3Count_AL3Entries_AL4Count_AL4Entries_AL5Count_AL5Entries_AL6Count_AL6Entries_AL7Count_AL7Entries_AL8Count_AL8Entries_AL9Count_AL9Entries$MinimumThrottle_CR3_TFP0OverThrottleThreshold(DescriptionLengthDescriptionTEMP\33�bH׮�5S��E$�7"��p
D�	EventDataA��]�oDataEK�NameThermalZoneBiosNameLength
A��Q�oData9K�NameThermalZoneBiosName
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_TC1
A��3�oDataK�Name_TC2
A��3�oDataK�Name_TSP
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
	A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
A��3�oDataK�Name_AC6

A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9
A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
A��3�oDataK�Name_NTT
A��=�oData%K�Name	_PSLCount
A��A�oData)K�Name_PSLEntries
�A��=�oData%K�Name	_TZDCount
A��A�oData)K�Name_TZDEntries
�A��=�oData%K�Name	_AL0Count
A��A�oData)K�Name_AL0Entries
�A��=�oData%K�Name	_AL1Count
A��A�oData)K�Name_AL1Entries
�A��=�oData%K�Name	_AL2Count
A��A�oData)K�Name_AL2Entries
�A��=�oData%K�Name	_AL3Count
A��A�oData)K�Name_AL3Entries
�A��=�oData%K�Name	_AL4Count
 A��A�oData)K�Name_AL4Entries
!�A��=�oData%K�Name	_AL5Count
"A��A�oData)K�Name_AL5Entries
#�A��=�oData%K�Name	_AL6Count
$A��A�oData)K�Name_AL6Entries
%�A��=�oData%K�Name	_AL7Count
&A��A�oData)K�Name_AL7Entries
'�A��=�oData%K�Name	_AL8Count
(A��A�oData)K�Name_AL8Entries
)�A��=�oData%K�Name	_AL9Count
*A��A�oData)K�Name_AL9Entries
+�A��I�oData1K�NameMinimumThrottle
,A��3�oDataK�Name_CR3
-A��3�oDataK�Name_TFP
.A��U�oData=K�NameOverThrottleThreshold
/A��M�oData5K�NameDescriptionLength
0A��A�oData)K�NameDescription
1A��3�oDataK�Name_TZP
2��D�T�d�t���������ĜԜ����$�4�D�T�d�|�����̝���4�L�h����� ��О"��$�8�&P�l�(����*��ԟ����H�0p���8ThermalZoneBiosNameLength,ThermalZoneBiosName_TMP_PSV_TC1_TC2_TSP_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRT_NTT_PSLCount_PSLEntries_TZDCount_TZDEntries_AL0Count_AL0Entries_AL1Count_AL1Entries_AL2Count_AL2Entries_AL3Count_AL3Entries_AL4Count_AL4Entries_AL5Count_AL5Entries_AL6Count_AL6Entries_AL7Count_AL7Entries_AL8Count_AL8Entries_AL9Count_AL9Entries$MinimumThrottle_CR3_TFP0OverThrottleThreshold(DescriptionLengthDescription_TZPTEMP�X���N��2]���7y�L����D�	EventDataA��M�oData5K�NameFanBiosNameLength
A��A�oData)K�NameFanBiosName
A��C�oData+K�NameFstSupported

A��?�oData'K�Name
PowerState
A��9�oData!K�NameControl
���

�� �<�(FanBiosNameLengthFanBiosName FstSupportedPowerStateControlTEMP���v��'_�֓
3�>���D�	EventDataA��M�oData5K�NameFanBiosNameLength
A��A�oData)K�NameFanBiosName
A��?�oData'K�Name
PowerState
�����(FanBiosNameLengthFanBiosNamePowerStateTEMP�H����
�(�Z��Ӗ���z���D�	EventDataA��M�oData5K�NameFanBiosNameLength
A��A�oData)K�NameFanBiosName
A��9�oData!K�NameControl
����Ȧ(FanBiosNameLengthFanBiosNameControlTEMP`��-F)徤^Y(K�P��C���D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��S�oData;K�NameDeviceInstanceLength
A��G�oData/K�NameDeviceInstance
A��?�oData'K�Name
PowerState
P���̩��� �DThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance0DeviceInstanceLength$DeviceInstancePowerStateTEMPlT�7i�u�p]^H���)���D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��S�oData;K�NameDeviceInstanceLength
A��G�oData/K�NameDeviceInstance
A��E�oData-K�Name
ThrottleLimit
����4�d���DThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance0DeviceInstanceLength$DeviceInstance ThrottleLimitTEMP`,�ro�窯Q�Z�ٍ����PD�	EventDataA��S�oData;K�NameDeviceBiosNameLength
A��G�oData/K�NameDeviceBiosName
A��I�oData1K�NameDeviceResetType
A��7�oDataK�NameStatus
|�����0DeviceBiosNameLength$DeviceBiosName$DeviceResetTypeStatusTEMP���]�	V�DW�gguF��lD�	EventDataA��K�oData3K�NameAcpiOverrideType
��(AcpiOverrideTypeTEMP|�!6�;xv0R��F��*����D�	EventDataA��5�oDataK�NameScope
A��7�oDataK�NameObject
A��7�oDataK�NameStatus
(�8�L�ScopeObjectStatusPRVAPt�Microsoft-Windows-Kernel-AcpiOPCOLEVL�P�P�P �win:Errorwin:Warning(win:InformationalTASKDd������e�����f�����g����D�h����t�i������j����жk������l����,�m����\�n������o������p����̷q������r�����s����P�t������u����̸v�����w����,�x����L�y����d�,ResourceTranslation(GpeEventHandling4TemperatureNotification0TripPointNotification8ActiveCoolingDevicePower$AmlMethodTrace,DeviceActiveCooling0DevicePassiveCooling0DeviceCoolingRundown(TemperatureChange,ThermalZoneRundownFanRundown,FanPowerStateChange$FanStatusChange4ActiveCoolingConstraintDActiveCoolingConstraintRundown8PassiveCoolingConstraintDPassiveCoolingConstraintRundownDeviceReset AcpiOverrideAMLIError(FrequentAmlMethodKEYW�����ȹ����� �����$acpi:Diagnostic acpi:Thermal ms:TelemetryEVNT�d��X�T�P�(e����p�T�(f�����X�(g�����\�(h���!�ij`�(h��4'�ijd�(i ��L4��h�(j���+���p�(	k�	��-��t�(
l�
��/�4�x�(m�����2�P�|�(n������8�l���(n������K�l���(n�����H_�l���(n�����@t�l���(n�����@��l���(
o������������(p�����P������(q�����������(r�����ܦ�ܴ��(s�����ܦ�����(t�����<�����(u�����<��0���(v �����L���(w ����h���(x���Ȳ����(y���6Բ��Ŀ(������������������������������������������������������������WEVT�+����
��4������CHANx4��\Microsoft-Windows-International/OperationalTTBLPTEMP���!�ӊ�V��j̊c�%���D�	EventDataA��A�oData)K�NameRegistryKey
A��=�oData%K�Name	ErrorCode
A��9�oData!K�NameMessage
��(�RegistryKeyErrorCodeMessageTEMP<�(����JP�=L��m���D�	EventDataA��A�oData)K�NameRegistryKey
A��?�oData'K�Name
StatusCode
@�\�RegistryKeyStatusCodeTEMP���X=A+SA��EQ���bD�	EventDataA��A�oData)K�NameRegistryKey
$�RegistryKeyTEMP,�Ӭ"�S^Ln��������D�	EventDataA��;�oData#K�NameCodePage
A��;�oData#K�NameFileName
<�T�CodePageFileNameTEMP,@��^٤�T���/mi�����D�	EventDataA��?�oData'K�Name
LocaleName
A��7�oDataK�NameWinDir
h���LocaleNameWinDirTEMPp0���aM.�|P�#�2�*3o��dD�	EventDataA��=�oData%K�Name	ProcessId
A��A�oData)K�NameProdessName
A��7�oDataK�NameLocale
A��7�oDataK�NameLCType
A��;�oData#K�NamelpLCData
����������ProcessIdProdessNameLocaleLCTypelpLCDataTEMP�����
�5�R��N�!=���D�	EventDataA��=�oData%K�Name	ProcessId
A��A�oData)K�NameProdessName
A��7�oDataK�NameLocale
A��;�oData#K�NameCalendar
A��9�oData!K�NameCalType
A��?�oData'K�Name
lpLCalData
`�x���������ProcessIdProdessNameLocaleCalendarCalTypelpLCalDataTEMP���]�B���P=��C�#����D�	EventDataA��=�oData%K�Name	ProcessId
A��A�oData)K�NameProdessName
A��5�oDataK�NameGeoId
D�\�x�ProcessIdProdessNameGeoIdTEMP�,��
�G�}�P�4�m�u���nD�	EventDataA��?�oData'K�Name
LocaleName
A��5�oDataK�NameFlags
A��=�oData%K�Name	ProcessId
A��A�oData)K�NameProdessName
A��?�oData'K�Name
ReturnCode
����������LocaleNameFlagsProcessIdProdessNameReturnCodeTEMP8��ٰU���:Rw?ZZ�����D�	EventDataA��=�oData%K�Name	ProcessId
A��A�oData)K�NameProdessName
�(�ProcessIdProdessNameTEMP�X��UhM�MP��%��B���D�	EventDataA��;�oData#K�NameFileName
A��?�oData'K�Name
LineNumber
A��7�oDataK�NameReason
������FileNameLineNumberReasonTEMP�l��<z�#aSl3�z�R���\D�	EventDataA��;�oData#K�NameFileName
��FileNameTEMP�,����X���\1�8c�J���`D�	EventDataA��?�oData'K�Name
StatusCode
@�StatusCodeTEMP���lmJt��TH���d�;���`D�	EventDataA��?�oData'K�Name
LocaleName
�LocaleNameTEMP<����V����[U�,���Oy���D�	EventDataA��?�oData'K�Name
LocaleName
A��?�oData'K�Name
StatusCode
$�@�LocaleNameStatusCodeTEMP����6��LPTk'�@=h ��VD�	EventDataA��5�oDataK�NameValue
��ValueTEMP�8�1��j�[?���ף���D�	EventDataA��5�oDataK�NameValue
A��G�oData/K�NameWin32ErrorCode
A��M�oData5K�NameWin32ErrorMessage
t�����Value$Win32ErrorCode(Win32ErrorMessageTEMP�\��h�U��]�I���2�n��XD�	EventDataA��7�oDataK�NameString
p�StringTEMPP�a�]��_[�p�!�s���D�	EventDataA��9�oData!K�NameAltSort
A��7�oDataK�NameLocale
x���AltSortLocaleTEMP,����2�wX�똗��k��6D�	EventDataA��7�oDataK�NameLCType
A��5�oDataK�NameValue
A��G�oData/K�NameWin32ErrorCode
A��M�oData5K�NameWin32ErrorMessage
\�p�����LCTypeValue$Win32ErrorCode(Win32ErrorMessageTEMP����7oP�cUl�A���D�	EventDataA��7�oDataK�NameLCType
A��5�oDataK�NameValue
����LCTypeValuePRVAT��Microsoft-Windows-InternationalOPCO�5|�5��  5��!!5��""5��DataTableInitialize,ConfigurationChangeOperationCleanupLEVL�UP�Pp�P��P��U�� win:Criticalwin:Errorwin:Warning(win:Informationalwin:VerboseTASK$u��  u��!!u��""u��##u��(CharacterEncoding(DateTimeCalendarCMEGroupPolicyLocaleKEYWEVNT`
7�#�����L��d�$��#���<�L��d�$�����@�@����$�����@�@����$��#���l�@��d�$��#���l�@��d�$��!"����d�,�H�$��!"���d�,�H�$��!"���\�d�,�H�$��!"���\�d�,�H�$��#���x�L�,�d�$��	#��	�L�D�d�$��!#�����d�8�d�$��! ����d�8��$��!#�����d�8�d�$��!#�����d�8�d�$�'!!�'�D�d� �,�$�'!!�'�d� �,�$�'!!�'�\�d� �,�$�'!!�'�\�d� �,�$�'!!�'���d� �,�$�'!!�'�d� �,�$�'!!�'���d� �,�$�'!!�'�\�d� �,�$�'!!�'��d� �,�$�'!!�'� �d� �,�$�'!!�'� �d� �,�$�'!!�'���d� �,�$�'!!�'���d� �,�$�'!!�'���d� �,�$�'!!�'���d� �,�$�'!!�'���d� �,�$��'!!��'�d� �,�$��'!!��'�d� �,�$��'!!��'�d� �,�$��'!!��'�d�D�,�$��'!!��'�d�D�,�$��'!!��'�d�D�,�$��'!!��'�d�D�,�$��'!!��'���d�D�,�$��'!!��'�d�D�,�$�<(!!�<(�d�,�,�$��2!!��2�\�d�8�,�$��2!!��2�\�d�8�,�$��2!!��2���d�8�,�$��2!!��2�d�8�,�$��2!!��2�\�d�8�,�$��2!!��2���d�8�,�$��2!!��2���d�8�,�$��2!!��2�\�d�8�,�$��2!!��2�\�d�8�,�$��2!!��2�d�8�,�$��2!!��2�d�8�,�$��2!!��2�\�d�8�,�$��2!!��2�\�d�8�,�$�WEVT(�����
���4����0�CHAN�	� �����x�����ApplicationXMicrosoft-Windows-User-Loader/OperationalTMicrosoft-Windows-User-Loader/AnalyticTTBL�

TEMP�h��<z�#aSl3�z�R���\D�	EventDataA��;�oData#K�NameFileName
|�FileNameTEMP�$�T��̫�[��L?��ZD�	EventDataA��9�oData!K�NameDllName
8�DllNameTEMP�X�S�C�Rd���7!C%���D�	EventDataA��]�oDataEK�NameProcessFileNamePathLength
A��Q�oData9K�NameProcessFileNamePath
����8ProcessFileNamePathLength,ProcessFileNamePathTEMP��
n��f�S��}�<���D�	EventDataA��E�oData-K�Name
FailureReason
A��E�oData-K�Name
ImportDllName
A��C�oData+K�NameExportModule
P�p��� FailureReason ImportDllName ExportModuleTEMP�����[�t_�(m4�>�A���]EventXML+�xmlnsUser-Loader��&.�
FailureReason
��&�
ImportDllName
��,1ProcessImagePath
���4� FailureReason ImportDllName(ProcessImagePathTEMPL8�԰R�7nU]=�	���A���]EventXML+�xmlnsUser-Loader��,1ProcessImagePath
��&��
CurDirDllPath
`���(ProcessImagePath CurDirDllPathTEMP���R ֿy�pTZ4,�X��A���]EventXML+�xmlnsUser-Loader��,1ProcessImagePath
��&��
CurDirDllPath
��$��FoundDllPath
��4�(ProcessImagePath CurDirDllPath FoundDllPathTEMP���(/E��TRO�^�]L���D�	EventDataA��E�oData-K�Name
FailureReason
A��E�oData-K�Name
ImportDllName
A��K�oData3K�NameProcessImagePath
��� FailureReason ImportDllName(ProcessImagePathTEMP����<z�#aSl3�z�R���\D�	EventDataA��;�oData#K�NameFileName
�FileNameTEMP��ϙ���G\���{�ɼ>���D�	EventDataA��=�oData%K�Name	ProcessId
A��U�oData=K�NameSuspendProcessRequest
A��9�oData!K�NameDLLName
X�p���ProcessId0SuspendProcessRequestDLLNamePRVAP�Microsoft-Windows-User-LoaderOPCO01�win:InfoLEVL�Up�P��P��P� win:Criticalwin:Errorwin:Warning(win:InformationalTASKKEYW4d� ��@��H�	��
�LUSER_LOADER_KEYWORD_DEPRECATED_DLLPUSER_LOADER_FATAL_CALLBACK_EXCEPTIONHUSER_LOADER_KEYWORD_LOAD_FAILURE@USER_LOADER_LAUNCH_16BIT_APPTUSER_LOADER_KEYWORD_COMPONENT_ON_DEMANDPUSER_LOADER_KEYWORD_LOAD_FATAL_ERROREVNTp ����d����  �L��d����@ 
T��d����� �0��d���� ���d���� ����X���� ����X���� 
���d���	 	����@����
	�
���d���	����X���	�\��L�����$�4�D�T�T�T�WEVTt��
p�H��CHAN�����lMicrosoft-Windows-Kernel-BootDiagnostics/DiagnosticPRVAh�Microsoft-Windows-Kernel-BootDiagnosticsOPCO02�win:StartLEVL@P (win:InformationalTASKD�����pSystemBootKEYWD1�(win:ResponseTimeEVNTD��������T��WEVT�5����d�
2`2�23�45CHAN|�����`Microsoft-Windows-Kernel-Prefetch/DiagnosticTTBL(.
TEMPht	{]�̝�S�V��..Ϫ��RD�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
��4,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeTEMP����0�nd^ᥦ�\�-y��6D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��E�oData-K�Name
PrefetchPhase
A��C�oData+K�NamePrefetchType
A��G�oData/K�NameIsTricklePhase
L	x	�	�	�	�	
,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType PrefetchPhase PrefetchType$IsTricklePhaseTEMP��;�
/�T�'�6z�f���>D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��M�oData5K�NamePrefetchPhaseMask
A��C�oData+K�NamePrefetchType
A��G�oData/K�NameIsTricklePhase
@
l
�
�
�
�
,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType(PrefetchPhaseMask PrefetchType$IsTricklePhaseTEMP		H��Q�NoY���A����D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��E�oData-K�Name
PrefetchPhase
A��C�oData+K�NamePrefetchType
A��G�oData/K�NameIsTricklePhase
A��O�oData7K�NameNumPagesPrefetched

A��C�oData+K�NameNumReadLists
�(Hl���

�,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType PrefetchPhase PrefetchType$IsTricklePhase,NumPagesPrefetched NumReadListsTEMP		P��|Xo�^{�k�1�l���D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��M�oData5K�NamePrefetchPhaseMask
A��C�oData+K�NamePrefetchType
A��G�oData/K�NameIsTricklePhase
A��O�oData7K�NameNumPagesPrefetched

A��C�oData+K�NameNumReadLists
0Pt���

,,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType(PrefetchPhaseMask PrefetchType$IsTricklePhase,NumPagesPrefetched NumReadListsTEMP� ��<޲5�U�K���v����D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��E�oData-K�Name
PrefetchPhase
����,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType PrefetchPhaseTEMP�*�B�eh9[�������D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��M�oData5K�NamePrefetchPhaseMask
t���,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType(PrefetchPhaseMaskTEMPh�	{]�̝�S�V��..Ϫ��RD�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
 0 P t ,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeTEMP�`"�.d�2ˮV��O��`���D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��=�oData%K�Name	EndReason
�"�"#4#T#,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeEndReasonTEMP��%������\Ic�ܑ(���0D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��A�oData)K�NameActionFlags
A��A�oData)K�NameTraceReason
A��G�oData/K�NamePrefetchReason
\&�&�&�&�&'$',ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeActionFlagsTraceReason$PrefetchReasonTEMP�		T*�Y�	U��Z����������D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��A�oData)K�NameActionFlags
A��A�oData)K�NameTraceReason
A��G�oData/K�NamePrefetchReason
A��A�oData)K�NameNumLaunches
A��W�oData?K�NameTimeSinceLastLaunchInS
+4+T+x+�+�+�+�+,,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeActionFlagsTraceReason$PrefetchReasonNumLaunches4TimeSinceLastLaunchInSTEMP�.Z
G,�GQ��W93�����D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��G�oData/K�NameWorkItemsCount
|.�.�.�./,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType$WorkItemsCountTEMP��0ޞoد=�QI���������D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��=�oData%K�Name	NumPhases
`1�1�1�1�1,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeNumPhasesPRVAX2Microsoft-Windows-Kernel-PrefetchOPCOx1�22�22�2win:Infowin:Startwin:StopLEVL@P�2(win:InformationalTASK������3����4����84����T4����l4	�����4
�����4(PrefetchSections(PrefetchMetadataOpenVolumesEndTrace(ScenarioDecision GetReadListsAsyncWorkerKEYWD �����4(BasicInformationEVNT� �����Tx2�2$3�8p �����@
x2�2$3�8p �����<�2�2$3�8p �����<�2�2$3�8p �����Lx2�2@3�8p �����4x2�2@3�8p �����L�2�2@3�8p �����4�2�2@3�8p �����,x2�2\3�8p �����,�2�2\3�8p ������ l2�2x3�8p �����l#l2�2�3�8p �����H'l2�2�3�8p		 �����D,x2�2�3�8p
	 �������2�2�3�8p
 �����0/x2�2�3�8p
 �������2�2�3�8p

 ������l2�2�3�8p�4�4�4�4�4�4�4�4�4�4�4�4�4�4�4�4�4�4WEVT � 9�9
�9 :,:\:�:�:CHANd<9�HMicrosoft-Windows-UAC/OperationalTTBL\TEMPP�9)5�H7^A����d����D�	EventDataPRVA@�9Microsoft-Windows-UACOPCOLEVL0PD:win:ErrorTASKH�����: CreateProcessKEYWEVNT@���98:h:,9WEVTH�@;�;
=h=t=�=�=�=CHAN�\;�hMicrosoft-Windows-Security-Adminless/OperationalTTBLDTEMP8�<�/c���UX�q��r�Y���D�	EventDataA��A�oData)K�NameFailureTime
A��=�oData%K�Name	StackHash
�<�<FailureTimeStackHashPRVA`=Microsoft-Windows-Security-AdminlessOPCOLEVL0P�=win:ErrorTASKH�����= AccessFailureKEYWEVNT@���;�=�=L;WEVT�	�>,?
p@�@�@,AtA�ACHAN��>�Microsoft-Windows-Security-LessPrivilegedAppContainer/OperationalTTBLDTEMP8@�/c���UX�q��r�Y���D�	EventDataA��A�oData)K�NameFailureTime
A��=�oData%K�Name	StackHash
<@X@FailureTimeStackHashPRVA��@Microsoft-Windows-Security-LessPrivilegedAppContainerOPCOLEVL0PAwin:ErrorTASKH����TA AccessFailureKEYWEVNT@�
8?A8A�>WEVT��BpB
,ClC�C�C�C8DCHAN`,B����DMicrosoft-Windows-COM/AnalyticTTBL�TEMP�C�w�Nm\"l):��N��VD�	EventDataA��5�oDataK�NameCLSID
CCLSIDPRVA@@CMicrosoft-Windows-COMOPCO01�Cwin:InfoLEVL@P�C(win:InformationalTASKKEYWLD0COM_CLASSNOTREG_ERROREVNTD��|BxC�CxDB�CWEVT���DE
J|J�J�J�JKCHAN8�D	�ApplicationTTBLTEMPH$F���̧��Vv�@�gA����8Path��xmlnsDhttp://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0��&Q
AttemptedPath
8F AttemptedPathTEMP��G���Ew��\�C_�_�3A����PathAndGuid��xmlnsDhttp://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0��&Q
AttemptedPath
��"��SrpRuleGuid
�G�G AttemptedPathSrpRuleGuidTEMP|I7z7�--Wj�Mi(JRA��@%�PathGuidAndRule��xmlnsDhttp://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0��&Q
AttemptedPath
��"��SrpRuleGuid
����RulePath
�I�I�I AttemptedPathSrpRuleGuidRulePathPRVAp JMicrosoft-Windows-SoftwareRestrictionPoliciesOPCOLEVLhP�JP�Jwin:Warning(win:InformationalTASKKEYWEVNT02	�2
XF�J�Da	�a
E�J�Db	�b
H�J�Dc	�c
E�J�Dd	�d
XF�J�Dr	�r
XF�J�DWEVTp��L�M
�\],^�^L_X_CHANP�L�M�XM��M�HMicrosoft-Windows-MUI/Operational<Microsoft-Windows-MUI/AdminDMicrosoft-Windows-MUI/Analytic<Microsoft-Windows-MUI/DebugTTBL�TEMP�pN$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
�NStatusTEMP�(O�<z�#aSl3�z�R���\D�	EventDataA��;�oData#K�NameFileName
<OFileNameTEMP�hP;o��s\fj������D�	EventDataA��;�oData#K�NameFileName
A��3�oDataK�NameType
A��C�oData+K�NameFunctionName
�P�P�PFileNameType FunctionNameTEMP�|Q�<z�#aSl3�z�R���\D�	EventDataA��;�oData#K�NameFileName
�QFileNameTEMP$S�*z�8�WM
sWR�	���2D�	EventDataA��5�oDataK�NameFlags
A��A�oData)K�NameNewLanguage
A��C�oData+K�NamePrevLanguage
A��C�oData+K�NameExtendedFlag
`SpS�S�SFlagsNewLanguage PrevLanguage ExtendedFlagTEMP��T �ُ_�<�vw����D�	EventDataA��;�oData#K�NameFileName
A��C�oData+K�NameFunctionName
A��A�oData)K�NameReturnValue
,UDUdUFileName FunctionNameReturnValueTEMP�V)�Y�?��T0��U�����^D�	EventDataA��=�oData%K�Name	Parameter
(VParameterTEMPP�V)5�H7^A����d����D�	EventDataTEMPP�V)5�H7^A����d����D�	EventDataTEMP�hW4�=��|NP5��pk7��TD�	EventDataA��3�oDataK�NameName
|WNameTEMP��X�f��dY��x(������D�	EventDataA��E�oData-K�Name
NewCacheIndex
A��G�oData/K�NameLiveCacheIndex
A��7�oDataK�NameConfig
�XY4Y NewCacheIndex$LiveCacheIndexConfigTEMP��Y?~�v|�Uj��]�4���^D�	EventDataA��=�oData%K�Name	ErrorCode
�YErrorCodeTEMP`[aM?��iV����"D�	EventDataA��;�oData#K�NameFileName
A��;�oData#K�NameAffinity
A��;�oData#K�NameSequence
A��;�oData#K�NamePriority
�[�[�[�[FileNameAffinitySequencePriorityTEMP��\�<z�#aSl3�z�R���\D�	EventDataA��;�oData#K�NameFileName
�\FileNamePRVA@�\Microsoft-Windows-MUIOPCO ;l];�]  ;�]!!;�]"";�]##;^$$;^Initialize$InvokeCallback DisableCache$UpdateManifestBuildCacheEntryExitLEVL�P\^Pt^P�^win:Errorwin:Warning(win:InformationalTASK�{�^{,_0NotifyLanguageChange RescacheBuildKEYWEVNTP�����M$]8^�^�L�@���N$]8^�^�L�@��TO$]8^�^�L�@���P$]8^�^�L�@���P$]8^�^�L����@V]8^�^�L����@V]8^�^�L� ���@V0]8^�^�L����@V]8^�^�L�!@��@V<]8^�^�L�!���@V<]8^�^�L�"���HYH]8^�^�L�"���@VH]8^�^�L����@V]8^�^�L�����Q]P^�^�L�����S$]P^�^�L�����U]P^�^�L�!��Z<]P^�^�L�" ���VH]P^�^�L�" ���VH]P^�^�L�"����WH]P^�^�L�# ���VT]P^�^�L�$ ���V`]P^�^�L�# ���VT]P^�^�L�$ ���V`]P^�^�L�!��\<]P^�^�L�����V]P^�^�L�" ��@VH]D^�^�LWEVT,�d�e
�k�k`l�l�n8oCHAN�$e�����e����\Microsoft-Windows-Kernel-AppCompat/GeneraldMicrosoft-Windows-Kernel-AppCompat/PerformanceTTBL�TEMP��gc��snGa_�!(�y���bD�	EventDataA��S�oData;K�NameExecutablePathLength
A��G�oData/K�NameExecutablePath
A��O�oData7K�NameRegistryPathLength
A��C�oData+K�NameRegistryPath
�gh,hXh0ExecutablePathLength$ExecutablePath,RegistryPathLength RegistryPathTEMP�i9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
 iStatusCodeTEMPP�jj��F<U�Z����8���JD�	EventDataA��E�oData-K�Name
KeyNameLength
A��9�oData!K�NameKeyName
A��Q�oData9K�NameParentKeyNameLength
A��E�oData-K�Name
ParentKeyName
k,k@klk KeyNameLengthKeyName,ParentKeyNameLength ParentKeyNamePRVA\�kMicrosoft-Windows-Kernel-AppCompatOPCOx1l20l2Hlwin:Infowin:Startwin:StopLEVLdP�lP�lwin:Error(win:InformationalTASK,�����m�����m�����m���� n����Dn����ln�����n�����n$CompatCacheInit(CompatCacheQuery$CompatCdbQuery$CompatMapQuirks(CompatCacheUpdate,CompatUserModeQuery$CompatSdbQuery4CompatCacheQueryProcessKEYWH����o,RegWrpAccessDeniedEVNTt�6�e�kxl�re@����lxl�le@����xhlxl�le@����lxl@me@����xhlxl@me@����lxl�le@����xhlxl�le@����lxlme	@����xhlxlme
@����lxl$me@����xhlxl$me@����lxl\me
@����xhlxl\me@����lxlxme@����xhlxlxme@����lxl�me@����xhlxl�me��	<ille�nWEVT,-�r
�X�d���l�x�TTBL$TEMPTt\��S�CL�93���� D�	EventDataA��Y�oDataAK�NamecchAppPathIncludingNull
A��_�oDataGK�NameApplicationImageHeaderHash
A��9�oData!K�NameAppPath
�t�tu4cchAppPathIncludingNull<ApplicationImageHeaderHashAppPathTEMP|v}�풚T�Xh���������D�	EventDataA��A�oData)K�NameFeatureGuid
A��_�oDataGK�NameApplicationImageHeaderHash
8vTvFeatureGuid<ApplicationImageHeaderHashTEMP4x��H�^�m#��!���:D�	EventDataA��A�oData)K�NameFeatureGuid
A��C�oData+K�NameCallerIdType
A��C�oData+K�NamecchImagePath
A��=�oData%K�Name	ImagePath
Pxlx�x�xFeatureGuid CallerIdType cchImagePathImagePathTEMP��zx�a8p�RX1��z�`���D�	EventDataA��i�oDataQK�NamecchParentImagePathIncludingNull
A��A�oData)K�NameFeatureGuid
A��c�oDataKK�NameParentProcessImageHeaderHash
A��I�oData1K�NameParentImagePath
�z{4{t{DcchParentImagePathIncludingNullFeatureGuid@ParentProcessImageHeaderHash$ParentImagePathTEMP		�~U��[W_���y��x���D�	EventDataA��5�oDataK�NameFlags
A��[�oDataCK�NamecchIdStringIncludingNull
A��Y�oDataAK�NamecchDllPathIncludingNull
A��;�oData#K�NameCategory
A��I�oData1K�NameManifestVersion
A��E�oData-K�Name
DllHeaderHash
A��_�oDataGK�NameApplicationImageHeaderHash
A��;�oData#K�NameIdString
A��9�oData!K�NameDllPath
`p����8�t���Flags8cchIdStringIncludingNull4cchDllPathIncludingNullCategory$ManifestVersion DllHeaderHash<ApplicationImageHeaderHashIdStringDllPathTEMPxȂ]ng��P\��\堟����D�	EventDataA��5�oDataK�NameFlags
A��[�oDataCK�NamecchIdStringIncludingNull
A��;�oData#K�NameCategory
A��I�oData1K�NameManifestVersion
A��_�oDataGK�NameApplicationImageHeaderHash
A��;�oData#K�NameIdString
@�P�����ă�Flags8cchIdStringIncludingNullCategory$ManifestVersion<ApplicationImageHeaderHashIdStringPRVA@,�Microsoft-Windows-AITOPCOLEVL@P|�(win:InformationalTASK�����t�����������������؅���������0�����P�AitFeature,AitParentAitFeatureAitAppInfo,AitSystemUsageByDll,AitSystemUsageByExe AitProcessEndKitFeatureKEYWEVNT`����up��������xp�̄����sp�������{p��������p� �����p�<������vp�X�WEVTx0 �
���������TTBL�TEMP�؈��{��U+0"�����vD�	EventDataA��U�oData=K�NameAeLookupServieTrigger
�0AeLookupServieTriggerPRVA�0�Microsoft-Windows-ApplicationExperience-LookupServiceTriggerOPCOLEVL@PЉ(win:InformationalTASKKEYWEVNT@����,�ĉWEVT�.���
ؗH�T���ĘИCHANd܊����D�����������hMicrosoft-Windows-Kernel-ApphelpCache/Operational\Microsoft-Windows-Kernel-ApphelpCache/DebugdMicrosoft-Windows-Kernel-ApphelpCache/AnalyticTTBL�TEMP���_�Yn5�]�S�#����pD�	EventDataA��O�oData7K�NameOperationalMessage
Ȍ,OperationalMessageTEMP���nШ)�\�����{���bD�	EventDataA��A�oData)K�NameInfoMessage
��InfoMessageTEMP�T�$&��_��XB�8'�;���dD�	EventDataA��C�oData+K�NameDebugMessage
h� DebugMessageTEMPT�G'L46߬U��|�8����LD�	EventDataA��9�oData!K�NameMatches

A��A�oData)K�NameCheckerName
A��E�oData-K�Name
AttributeName
A��W�oData?K�NameAttributeExpectedValue


X�l�����MatchesCheckerName AttributeName4AttributeExpectedValueTEMPT\��B���S%�N���*���LD�	EventDataA��9�oData!K�NameMatches

A��A�oData)K�NameCheckerName
A��E�oData-K�Name
AttributeName
A��W�oData?K�NameAttributeExpectedValue


����ܒ��MatchesCheckerName AttributeName4AttributeExpectedValueTEMPT��N�T3��*T}�O�(�U���LD�	EventDataA��9�oData!K�NameMatches

A��A�oData)K�NameCheckerName
A��E�oData-K�Name
AttributeName
A��W�oData?K�NameAttributeExpectedValue


��0�P�MatchesCheckerName AttributeName4AttributeExpectedValueTEMPT�^T����Q
1����M���LD�	EventDataA��9�oData!K�NameMatches

A��A�oData)K�NameCheckerName
A��E�oData-K�Name
AttributeName
A��W�oData?K�NameAttributeExpectedValue



T�h���

��MatchesCheckerName AttributeName4AttributeExpectedValuePRVAp�Microsoft-Windows-ApplicationExperience-CacheOPCOLEVLdPx�P��win:Error(win:InformationalTASKKEYWEVNT`�3�l��� 4�l�̊@5��`���@4��l���@4ܐl���@40�l���	@4��l���WEVT�
/x�
$��������TTBL�
TEMPx��No��X�Z-YT��i����D�	EventDataA��K�oData3K�NameSwitchBranchGuid
A��W�oData?K�NameSwitchBranchNameLength
A��K�oData3K�NameSwitchBranchName
A��e�oDataMK�NameSwitchBranchDescriptionLength
A��Y�oDataAK�NameSwitchBranchDescription
�,�`���ȝ(SwitchBranchGuid4SwitchBranchNameLength(SwitchBranchName@SwitchBranchDescriptionLength4SwitchBranchDescriptionTEMP�@��O���P�.��>$��D�	EventDataA��S�oData;K�NameSwitchBranchImplGuid
A��_�oDataGK�NameSwitchBranchImplNameLength
A��S�oData;K�NameSwitchBranchImplName
A��m�oDataUK�Name!SwitchBranchImplDescriptionLength
A��a�oDataIK�NameSwitchBranchImplDescription
��Ԡ�@���0SwitchBranchImplGuid<SwitchBranchImplNameLength0SwitchBranchImplNameHSwitchBranchImplDescriptionLength<SwitchBranchImplDescriptionTEMPtT��=�t�\U�����ZD�	EventDataA��M�oData5K�NameTargetContextGuid
A��M�oData5K�NameTargetContextType
A��K�oData3K�NameModuleNameLength
A��?�oData'K�Name
ModuleName
��̣��(TargetContextGuid(TargetContextType(ModuleNameLengthModuleNameTEMP��mUl���S��G4�1���tD�	EventDataA��S�oData;K�NameContextUpdateCounter



�0ContextUpdateCounterPRVA|8�Microsoft-Windows-ApplicationExperience-SwitchBackOPCOLEVL@Pĥ(win:InformationalTASK����h�������������������AeSbCallAeSbImpl(AeSbContextUpdate0AeSbContextReadRetryKEYWEVNT������������������������ġ��0�����8���L�WEVT`'� ���
�`��D�����CHANt<�����XMicrosoft-Windows-Kernel-Network/AnalyticTTBLtTEMP(

P�l\FX_TR4Ԅ/"\��zD�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��;�oData#K�Namestartime
A��9�oData!K�Nameendtime
A��7�oDataK�Nameseqnum
A��7�oDataK�Nameconnid
	�$�4�D�T�d�t�������PIDsizedaddrsaddrdportsportstartimeendtimeseqnumconnidTEMPP�ؕ�`�]O QjYDz����D�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��7�oDataK�Nameseqnum
A��7�oDataK�Nameconnid
�����������PIDsizedaddrsaddrdportsportseqnumconnidTEMP(�A�r���S����K������D�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��1�oDataK�Namemss
A��9�oData!K�Namesackopt
A��5�oDataK�Nametsopt
A��5�oDataK�Namewsopt
	A��7�oDataK�Namercvwin
A��A�oData)K�Namercvwinscale
A��A�oData)K�Namesndwinscale
A��7�oDataK�Nameseqnum

A��7�oDataK�Nameconnid
0�<�L�\�l�|���������̵����,�PIDsizedaddrsaddrdportsportmsssackopttsoptwsoptrcvwinrcvwinscalesndwinscaleseqnumconnidTEMP(�(n�n3��^���2�P���D�	EventDataA��5�oDataK�NameProto
A��A�oData)K�NameFailureCode
<�L�ProtoFailureCodeTEMP(

�{i^�Ӻ.\���F����zD�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��;�oData#K�Namestartime
A��9�oData!K�Nameendtime
A��7�oDataK�Nameseqnum
A��7�oDataK�Nameconnid
	������,�<�T�h�|�PIDsizedaddrsaddrdportsportstartimeendtimeseqnumconnidTEMPP��5[� 7�WIh�C4����D�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��7�oDataK�Nameseqnum
A��7�oDataK�Nameconnid
\�h�x���������̾PIDsizedaddrsaddrdportsportseqnumconnidTEMP(������OQ�s��W����D�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��1�oDataK�Namemss
A��9�oData!K�Namesackopt
A��5�oDataK�Nametsopt
A��5�oDataK�Namewsopt
	A��7�oDataK�Namercvwin
A��A�oData)K�Namercvwinscale
A��A�oData)K�Namesndwinscale
A��7�oDataK�Nameseqnum

A��7�oDataK�Nameconnid
����$�4�D�T�`�t�������������PIDsizedaddrsaddrdportsportmsssackopttsoptwsoptrcvwinrcvwinscalesndwinscaleseqnumconnidPRVAX�Microsoft-Windows-Kernel-NetworkOPCO�
����8��t�
�������D���������*�D�+���1��<KERNEL_NETWORK_OPCODE_SEND<KERNEL_NETWORK_OPCODE_RECV@KERNEL_NETWORK_OPCODE_CONNECTHKERNEL_NETWORK_OPCODE_DISCONNECTHKERNEL_NETWORK_OPCODE_RETRANSMIT@KERNEL_NETWORK_OPCODE_ACCEPTDKERNEL_NETWORK_OPCODE_RECONNECT<KERNEL_NETWORK_OPCODE_FAIL@KERNEL_NETWORK_OPCODE_TCPCOPY@KERNEL_NETWORK_OPCODE_SENDUDP@KERNEL_NETWORK_OPCODE_RECVUDP@KERNEL_NETWORK_OPCODE_FAILUDPLEVL@P�(win:InformationalTASK�
������������8KERNEL_NETWORK_TASK_TCPIP8KERNEL_NETWORK_TASK_UDPIPKEYW�����$� ����`�<KERNEL_NETWORK_KEYWORD_IPV4<KERNEL_NETWORK_KEYWORD_IPV6EVNT�


���l��P���,�
�Ȭx��P���,�
�����P���,�

�Ȭ���P���,�
�Ȭ���P���,�
�����P���,�
�Ȭ���P���,�
0�@����P���,�
�	Ȭ���P���,�

 �
h�l��P���,�
 ���x��P���,�
 �����P��,�
 ������P��,�
 ������P��,�
 �����P��,� 
 ������P��,�"
 ������P��,�**�
Ȭ���l��,�++�Ȭ���l��,�110�@����l� �,�:* ������l�(�,�;+ ������l�,�,�������������������������WEVT�X����
|������$�0�CHANp������TMicrosoft-Windows-Kernel-Disk/AnalyticTTBL�TEMP,���ѵ�ggZ�� *B��bD�	EventDataA��?�oData'K�Name
DiskNumber
A��;�oData#K�NameIrpFlags
A��C�oData+K�NameTransferSize
A��;�oData#K�NameReserved
A��?�oData'K�Name
ByteOffset

A��?�oData'K�Name
FileObject
A��I�oData1K�NameIORequestPacket
A��Q�oData9K�NameHighResResponseTime

4�P�h���

������

��DiskNumberIrpFlags TransferSizeReservedByteOffsetFileObject$IORequestPacket,HighResResponseTimeTEMPT��(u��&,&V�O��2���JD�	EventDataA��?�oData'K�Name
DiskNumber
A��;�oData#K�NameIrpFlags
A��Q�oData9K�NameHighResResponseTime

A��I�oData1K�NameIORequestPacket
���

,�X�DiskNumberIrpFlags,HighResResponseTime$IORequestPacketPRVAP��Microsoft-Windows-Kernel-DiskOPCOLEVL@P��(win:InformationalTASKKEYWEVNT�
�Y�������Z�������[(�����WEVT�@�	(����
D��d�CHAN�T�����\Microsoft-Windows-Kernel-EventTracing/AdmindMicrosoft-Windows-Kernel-EventTracing/AnalyticMAPS�$�VMAPd��
��������	�
� StopReasonMapTTBL�.TEMP�
�9G�U�d��A�v��0D�	EventDataA��A�oData)K�NameSessionName
A��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��A�oData)K�NameLoggingMode
h�������SessionNameFileNameErrorCodeLoggingModeTEMP���i[%�_�[Vw'�֦Z���|D�	EventDataA��A�oData)K�NameSessionName
A��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��A�oData)K�NameLoggingMode
A��E�oData-K�Name
FailureReason
����0�$�L�SessionNameFileNameErrorCodeLoggingMode FailureReasonTEMP���A\�X+�P2�Z;f���xD�	EventDataA��A�oData)K�NameSessionName
A��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��A�oData)K�NameLoggingMode
A��A�oData)K�NameMaxFileSize

|�������

��SessionNameFileNameErrorCodeLoggingModeMaxFileSizeTEMP�$����d��TY��|������D�	EventDataA��A�oData)K�NameSessionName
A��=�oData%K�Name	ErrorCode
A��A�oData)K�NameLoggingMode
`�|���SessionNameErrorCodeLoggingModeTEMPD���X�f��Z�pI�n���D�	EventDataA��C�oData+K�NameProviderName
A��A�oData)K�NameSessionName
���� ProviderNameSessionNameTEMP��� ����Y�{?C����dD�	EventDataA��C�oData+K�NameProviderName
�� ProviderNameTEMP,,��#�|��VS��?����8D�	EventDataA��A�oData)K�NameSessionGuid
A��?�oData'K�Name
LoggerMode
A��A�oData)K�NameSessionName
A��A�oData)K�NameLogFileName
|�������SessionGuidLoggerModeSessionNameLogFileNameTEMP\

4�?����a
]�>��;��Q��D�	EventDataA��A�oData)K�NameSessionGuid
A��?�oData'K�Name
LoggerMode
A��A�oData)K�NameSessionName
A��A�oData)K�NameLogFileName
A��G�oData/K�NameMinimumBuffers
A��G�oData/K�NameMaximumBuffers
A��?�oData'K�Name
BufferSize
A��K�oData3K�NamePeakBuffersCount
A��Q�oData9K�NameCurrentBuffersCount
A��G�oData/K�NameFlushThreshold
	���4�P�l���������$�SessionGuidLoggerModeSessionNameLogFileName$MinimumBuffers$MaximumBuffersBufferSize(PeakBuffersCount,CurrentBuffersCount$FlushThresholdTEMPP���$���[�㟿�Q��:D�	EventDataA��A�oData)K�NameSessionGuid
A��?�oData'K�Name
LoggerMode
A��A�oData)K�NameSessionName
A��A�oData)K�NameLogFileName
A��G�oData/K�NameMinimumBuffers
A��G�oData/K�NameMaximumBuffers
A��?�oData'K�Name
BufferSize
A��K�oData3K�NamePeakBuffersCount
A��Q�oData9K�NameCurrentBuffersCount
A��G�oData/K�NameFlushThreshold
	A��?�oData'K�Name
EventsLost
A��A�oData)K�NameBuffersLost
A��Q�oData9K�NameRealTimeBuffersLost
A��;�oData#K�NameLoggerId

�����$�@�d����������8�T���SessionGuidLoggerModeSessionNameLogFileName$MinimumBuffers$MaximumBuffersBufferSize(PeakBuffersCount,CurrentBuffersCount$FlushThresholdEventsLostBuffersLost,RealTimeBuffersLostLoggerIdTEMP���
.��tX�W���G
��D�	EventDataA��A�oData)K�NameSessionName
A��I�oData1K�NameSecurityDescOld
A��I�oData1K�NameSecurityDescNew
�(�L�SessionName$SecurityDescOld$SecurityDescNewTEMP�˥����Y�P_��y���.D�	EventDataA��?�oData'K�Name
ProviderId
A��?�oData'K�Name
StatusCode
A��9�oData!K�NameEventId
A��A�oData)K�NameSessionName
$�@�\�p�ProviderIdStatusCodeEventIdSessionNameTEMP<��9�'H�*bR�J�����D�	EventDataA��C�oData+K�NameProviderName
A��A�oData)K�NameSessionName
A��I�oData1K�NameMatchAnyKeyword

A��I�oData1K�NameMatchAllKeyword

A��G�oData/K�NameEnableProperty
A��5�oDataK�NameLevel
�0�
L�
p����� ProviderNameSessionName$MatchAnyKeyword$MatchAllKeyword$EnablePropertyLevelTEMP�|��茴��\��i������D�	EventDataA��;�oData#K�NameFileName
A��?�oData'K�Name
BufferSize
A��K�oData3K�NameBuffersPersisted
A��G�oData/K�NameBuffersWritten
A��7�oDataK�NameStatus
����<�`�FileNameBufferSize(BuffersPersisted$BuffersWrittenStatusTEMP\`�w�,V�
tZ�$@6�������D�	EventDataA��C�oData+K�NameProviderGuid
A��M�oData5K�NameProviderGroupGuid
���� ProviderGuid(ProviderGroupGuidTEMP<���o���U}2jYn��:���D�	EventDataA��C�oData+K�NameProviderGuid
A��=�oData%K�Name	ErrorCode
�� ProviderGuidErrorCodeTEMPC��6R�SСC��Qa����D�	EventDataA��C�oData+K�NameProviderGUID
A��=�oData%K�Name	GroupGUID
A��5�oDataK�NameFlags
A��?�oData'K�Name
EnableMask
A��I�oData1K�NameGroupEnableMask
A��=�oData%K�Name	ProcessId
x���� ProviderGUIDGroupGUIDFlagsEnableMask$GroupEnableMaskProcessIdTEMPpH׺��}YEA��C����D�	EventDataA��3�oDataK�NameGUID
A��5�oDataK�NameIndex
A��;�oData#K�NameLoggerId
A��I�oData1K�NameMatchAnyKeyword

A��I�oData1K�NameMatchAllKeyword

A��5�oDataK�NameLevel
A��G�oData/K�NameEnableProperty
���

0TdGUIDIndexLoggerId$MatchAnyKeyword$MatchAllKeywordLevel$EnablePropertyTEMP��1��WPZ“���لb���D�	EventDataA��3�oDataK�NameGUID
A��A�oData)K�NameFilterFlags
A��O�oData7K�NameLastEnableLoggerId
��GUIDFilterFlags,LastEnableLoggerIdPRVA`XMicrosoft-Windows-Kernel-EventTracingOPCOx1p	2�	2�	
��	��	� 
�H
�l
��
��
��
��D�tU�V�win:Infowin:Startwin:Stop4ETW_OPCODE_WRITE_BUFFER4ETW_OPCODE_FILE_SWITCH(ETW_OPCODE_START$ETW_OPCODE_STOP(ETW_OPCODE_FLUSH,ETW_OPCODE_REGISTER0ETW_OPCODE_UNREGISTER(ETW_OPCODE_ENABLE,ETW_OPCODE_DISABLE0ETW_OPCODE_CONFIGUREHETW_OPCODE_USER_MODE_STACK_TRACE0ETW_OPCODE_SET_TRAITS0ETW_OPCODE_GROUP_JOINLEVL�PXPpP�U�win:Errorwin:Warning(win:Informationalwin:VerboseTASK�	��
��(�P�|��������	T4(ETW_TASK_LOGGING(ETW_TASK_SESSION(ETW_TASK_PROVIDER,ETW_TASK_GUID_ENTRY0ETW_TASK_GROUP_ENTRY0ETW_TASK_STACK_TRACE,ETW_TASK_LOST_EVENT,SavePersistedLogger0ETW_TASK_ENABLE_INFOKEYW �� �@�L��������������������(����\,ETW_KEYWORD_SESSION0ETW_KEYWORD_PROVIDER4ETW_KEYWORD_LOST_EVENT8ETW_KEYWORD_SOFT_RESTART8ETW_KEYWORD_CAPTURE_STATE8ETW_KEYWORD_REGISTRATION4ETW_KEYWORD_ENABLEMENT(ETW_KEYWORD_GROUPEVNT�!
�����(��4�
����4��4������(��4������(��4������(��4�
��l��4��4������(��4� @���	L
�D�	 @���	L
�D�
@����L��D�
@����L��D�@����L��D�@����L�D�@�H��L�D�@���@	L�D�
@���	L�D� @���(	L
D� @���(	L
D� @���4	L
 D�@���@	L�(D��L	@h
@����p��(�
,�������L�0����H��L�4������@�
<�������@�
@�����(�
D4� ������L0
H	������LL
P	 �����L�
X �����L
` 
�R�X	(
h4� 
@St�d	L
tD�ppppppp����ppppppp������p�pp������������������WEVT��	��@!
����8�����CHAN��(����|����SystemTMicrosoft-Windows-Kernel-Boot/AnalyticXMicrosoft-Windows-Kernel-Boot/OperationalMAPSl����$tVMAP|d 
��������d	�e
�f�g�h
�BMAP| !
������ �@��	�
��� 
�VMAP48 ���� � � �0�0�0�0�0�0�P�@�@�@�@�@�@ �@!� @"� @#� @$� @%� @&� @'� @(� @)� @*�	 @+�
 @,� @-� @.�
 @/� @0� @1� @2� @3� @4� @5� @6� @7� @8� @9� @:� @;� @<� @=� @>� @?�0@@�0@A�0@B�0@C�0@D�0@E�0@F�0@G�	0@H�
0@I�0@J�0@K�
0@L�0@M�0@N�0@O�0@P�0@Q�0@R�0@S�0@T�0@U�0@V�0@W�0@X�0@Y�0@Z�0@[�0@\�0@]�0@^� 0@_�!0@`�"0@a�#0@b�$0@c�%0@d�&0@e�'0@f�(0@g�)0@h�*0@i�+0@j�,0@k�-0@l�.0@m�/0@n�00@o�10@p�20@q�30@r�40@s�50@t�60@u�70@v�80@w�90@x�:0@y�;0@z�<0@{�=0@|�>0@}�?0@~�@0@�A0@��B0@��Y0@��@@��@@��@@��@@��@@��@@��P@��P@��P@��P@��P@��P@��P@��P@��P@��VMAP�!������������������	��
������
����������VMAP4� ��������VMAP<� ����������,BootDiagMessageMap4EnableDisableReasonMap,SbatUpdateStatusMap<SecureBootBcdMitigationMap TxtStatusMap VsmPolicyMapTTBL\�wTEMP`#��Ǎ��Y<��������D�	EventDataA��9�oData!K�NameSqmType
A��G�oData/K�NameSqmSessionGuid
A��5�oDataK�NameSqmID
A��O�oData7K�NameSqmStreamRowLength
A��QZ�ComplexData+K�NameSqmStreamRow
��#�#�#�#($H$h$�$SqmType$SqmSessionGuidSqmID,SqmStreamRowLength SqmStreamRow SqmTypeEntry SqmDWORDEntry$SqmStringEntryTEMP��%*�d�Ÿ[�|5�NR����D�	EventDataA��5�oDataK�NameWidth
A��7�oDataK�NameHeight
A��C�oData+K�NameBitsPerPixel
�%& &WidthHeight BitsPerPixelTEMP��&A�g���[k#l�'t���`D�	EventDataA��?�oData'K�Name
BytesPerMs
�&BytesPerMsTEMPd(�
1�BW[�n��Ts��,D�	EventDataA��;�oData#K�NameDeviceID
A��;�oData#K�NameFileName
A��=�oData%K�Name	BytesRead

A��C�oData+K�NameBytesWritten

�(�(

�(

�(DeviceIDFileNameBytesRead BytesWrittenTEMP�,*�چ�ЛV���k+�[b���D�	EventDataA��;�oData#K�NameDeviceID
A��;�oData#K�NameFileName
A��7�oDataK�NameStatus
h*�*�*DeviceIDFileNameStatusTEMP��+j���_��������D�	EventDataA��I�oData1K�NameApplicationGuid
A��=�oData%K�Name	BytesRead

A��C�oData+K�NameBytesWritten

,

8,

P,$ApplicationGuidBytesRead BytesWrittenTEMP�-�f��
�Rۓ����F���,D�	EventDataA��=�oData%K�Name	ImageName
A��?�oData'K�Name
ImageFlags
A��7�oDataK�NameReason
A��C�oData+K�NameErrorIgnored
 .8.T.h.ImageNameImageFlagsReason ErrorIgnoredTEMP� /�4�~MQ9�TsK,^.��bD�	EventDataA��A�oData)K�NameBootmgrTime



4/BootmgrTimeTEMP��/��H�Q��b����^D�	EventDataA��=�oData%K�Name	ImageName
�/ImageNameTEMP��0R��6Am�Z�������bD�	EventDataA��A�oData)K�NameDriveNumber
�0DriveNumberTEMPX�3�@a�]�0gډ�����zD�	EventDataA��A�oData)K�NameFwStartPage

A��A�oData)K�NameFwPageCount

A��C�oData+K�NameFwMemoryType
A��O�oData7K�NameFwMemoryAttributes
A��A�oData)K�NameBlStartPage

A��A�oData)K�NameBlPageCount

A��C�oData+K�NameBlMemoryType
A��O�oData7K�NameBlMemoryAttributes

(4
D4`4�4
�4
�4�45FwStartPageFwPageCount FwMemoryType,FwMemoryAttributesBlStartPageBlPageCount BlMemoryType,BlMemoryAttributesTEMP��5�"�jfg$\���L�����hD�	EventDataA��G�oData/K�NamePreBootMgrTime



�5$PreBootMgrTimeTEMP�7�&6�ؕ]�nZ�H����D�	EventDataA��K�oData3K�NameUefiVariableName
A��3�oDataK�NameSize
A��7�oDataK�NameStatus
X7�7�7(UefiVariableNameSizeStatusTEMP@�87":���Q:��b��M���D�	EventDataA��I�oData1K�NameApplicationGuid
A��9�oData!K�NameElement
�8�8$ApplicationGuidElementTEMP�p9$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
�9StatusTEMP�$:$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
8:StatusTEMPL0;I��Q�H�\�p�Ԧ����D�	EventDataA��E�oData-K�Name
FailureStatus

A��C�oData+K�NameFailureMsgId


X;
x; FailureStatus FailureMsgIdTEMPDx<�UaJ˅W�����������D�	EventDataA��E�oData-K�Name
FailureStatus
A��?�oData'K�Name
FailureMsg
�<�< FailureStatusFailureMsgTEMPP,=)5�H7^A����d����D�	EventDataTEMP��=�H�tjI�Q��Bn�a���`D�	EventDataA��?�oData'K�Name
EntryCount
�=EntryCountTEMP��>���X��4`����`D�	EventDataA��?�oData'K�Name
ToolsCount
�>ToolsCountTEMP\�?�;���W�Q[\4�����D�	EventDataA��K�oData3K�NameLastShutdownGood

A��C�oData+K�NameLastBootGood



�?

�?(LastShutdownGood LastBootGoodTEMP`�Ag����+�[d��f���ND�	EventDataA��K�oData3K�NameLastShutdownGood

A��C�oData+K�NameLastBootGood

A��?�oData'K�Name
LastBootId
A��K�oData3K�NameBootStatusPolicy


�A

B,BHB(LastShutdownGood LastBootGoodLastBootId(BootStatusPolicyTEMP�C
r�y��Wyþ���T��hD�	EventDataA��G�oData/K�NameOptionSelected
 C$OptionSelectedTEMPP�C)5�H7^A����d����D�	EventDataTEMPP�C)5�H7^A����d����D�	EventDataTEMPP4D)5�H7^A����d����D�	EventDataTEMP��DS�/y^�����q0��hD�	EventDataA��G�oData/K�NameBootMenuPolicy
�D$BootMenuPolicyTEMPPXE)5�H7^A����d����D�	EventDataTEMP��Ew��-g0�^���"	���\D�	EventDataA��;�oData#K�NameBootType
�EBootTypeTEMP4�F��	;H�^Fߟ�U�����D�	EventDataA��;�oData#K�NameBootType
A��A�oData)K�NameLoadOptions
G,GBootTypeLoadOptionsTEMP,@Iv5Y�0�EX��5f0�q����D�	EventDataA��E�oData-K�Name
ResetEndStart

A��K�oData3K�NameLoadOSImageStart

A��M�oData5K�NameStartOSImageStart

A��U�oData=K�NameExitBootServicesEntry

A��S�oData;K�NameExitBootServicesExit



�I

�I

�I

J

DJ ResetEndStart(LoadOSImageStart(StartOSImageStart0ExitBootServicesEntry0ExitBootServicesExitTEMP�K$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
KStatusTEMP��K��{��b(]�O]9�����xD�	EventDataA��W�oData?K�NameBitlockerUserInputTime



�K4BitlockerUserInputTimeTEMPHM�m�[ MkV,Bc�t���D�	EventDataA��=�oData%K�Name	ImageName
A��I�oData1K�NameImageLoadStatus
(M@MImageName$ImageLoadStatusTEMPXPN�bIU�2Z"��M���D�	EventDataA��A�oData)K�NamePeImageName
A��M�oData5K�NamePeImageLoadStatus
xN�NPeImageName(PeImageLoadStatusTEMP�dO�QI��-R�d�(P��rD�	EventDataA��Q�oData9K�NameUpdateCapsuleStatus
xO,UpdateCapsuleStatusTEMP��PJ�M�9��T2�`0cX���D�	EventDataA��A�oData)K�NameDeviceFlags
A��=�oData%K�Name	PcrBitmap
A��U�oData=K�NameUpdateSupportedStatus
Q4QLQDeviceFlagsPcrBitmap0UpdateSupportedStatusTEMPH`R�m�[ MkV,Bc�t���D�	EventDataA��=�oData%K�Name	ImageName
A��I�oData1K�NameImageLoadStatus
�R�RImageName$ImageLoadStatusTEMPH�S�m�[ MkV,Bc�t���D�	EventDataA��=�oData%K�Name	ImageName
A��I�oData1K�NameImageLoadStatus
�S�SImageName$ImageLoadStatusTEMPD�T�#|�'$\-]���H���D�	EventDataA��=�oData%K�Name	ImageName
A��G�oData/K�NameSiPolicyStatus
U,UImageName$SiPolicyStatusTEMPD0V�T&��{Z�pu�t�����D�	EventDataA��;�oData#K�NameHiveName
A��G�oData/K�NameHiveLoadStatus
XVpVHiveName$HiveLoadStatusTEMP� W$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
4WStatusTEMP��W$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
�WStatusTEMP�YX���S#…�H9����D�	EventDataA��3�oDataK�NamePath
A��?�oData'K�Name
FailedPath
A��7�oDataK�NameStatus
DYTYpYPathFailedPathStatusTEMPx�ZdC��6lZ'H_�?Z�����D�	EventDataA��3�oDataK�NamePath
A��7�oDataK�NameImport
A��7�oDataK�NameStatus
�Z�Z�ZPathImportStatusTEMP��\�Njzp�P�N?�����tD�	EventDataA��K�oData3K�NameCachedCopyStatus
A��Q�oData9K�NameIdkGenerationStatus
A��I�oData1K�NameMeasuringStatus
A��Y�oDataAK�NameSealingAndCachingStatus
�\]H]l](CachedCopyStatus,IdkGenerationStatus$MeasuringStatus4SealingAndCachingStatusTEMP�

�ao^xN�VrV���6{y���D�	EventDataA��K�oData3K�NameCachedCopyStatus
A��]�oDataEK�NameUnsealingCachedCopyStatus
A��_�oDataGK�NameKeyGenerationAndSaveStatus
A��E�oData-K�Name
SealingStatus
A��?�oData'K�Name
TpmPcrMask
A��e�oDataMK�NameProtectorAssistedUnsealStatus
A��e�oDataMK�NameProtectorAssistedResealStatus
A��]�oDataEK�NameProtectorSealUpdateStatus
A��O�oData7K�NameTpmCounterOpStatus
A��W�oData?K�NameTpmCounterCreateStatus
	Tb|b�b�bc,clc�c�cd(CachedCopyStatus8UnsealingCachedCopyStatus<KeyGenerationAndSaveStatus SealingStatusTpmPcrMask@ProtectorAssistedUnsealStatus@ProtectorAssistedResealStatus8ProtectorSealUpdateStatus,TpmCounterOpStatus4TpmCounterCreateStatusTEMP|tk��3��bVԡ�R���D�	EventDataA��K�oData3K�NameCachedCopyStatus
A��Y�oDataAK�NamePrimaryBlobUnsealStatus
A��W�oData?K�NameBackupBlobUnsealStatus
A��g�oDataOK�NameKickbackBackupBlobUnsealStatus
A��e�oDataMK�NameBackupBlobValidityCheckStatus
A��S�oData;K�NameBackupBlobStillValid

A��u�oData]K�Name%KickbackBackupBlobValidityCheckStatus
A��c�oDataKK�NameKickbackBackupBlobStillValid

A��Y�oDataAK�NamePrimaryBlobResealStatus
A��W�oData?K�NameBackupBlobResealStatus
	A��g�oDataOK�NameKickbackBackupBlobResealStatus
A��_�oDataGK�NameKeyGenerationAndSaveStatus
A��E�oData-K�Name
SealingStatus
A��?�oData'K�Name
TpmPcrMask

A��O�oData7K�NameTpmCounterOpStatus
A��W�oData?K�NameTpmCounterCreateStatus
A��S�oData;K�NameBackupSealedBlobUsed

A���oDatagK�Name*KickbackBackupBlobCleanupPostUpgradeStatus
�lm8mlm�m

�m n

pn�n�no\o�o�o�op

4pdp(CachedCopyStatus4PrimaryBlobUnsealStatus4BackupBlobUnsealStatusDKickbackBackupBlobUnsealStatus@BackupBlobValidityCheckStatus0BackupBlobStillValidPKickbackBackupBlobValidityCheckStatus@KickbackBackupBlobStillValid4PrimaryBlobResealStatus4BackupBlobResealStatusDKickbackBackupBlobResealStatus<KeyGenerationAndSaveStatus SealingStatusTpmPcrMask,TpmCounterOpStatus4TpmCounterCreateStatus0BackupSealedBlobUsed\KickbackBackupBlobCleanupPostUpgradeStatusTEMP�\r>ӎ�uoX���T��J���fD�	EventDataA��K�oData3K�NameCachedCopyStatus
A��Q�oData9K�NameKeyGenerationStatus
A��M�oData5K�NameSealAndSaveStatus
A��G�oData/K�NameUEFIKeysStatus
�r�rs(s(CachedCopyStatus,KeyGenerationStatus(SealAndSaveStatus$UEFIKeysStatusTEMP��s�*��T�X��Y�Y��\��xD�	EventDataA��W�oData?K�NameRetrieveDriverListTime



t4RetrieveDriverListTimeTEMP��t�衻<�_%L�zJ���|D�	EventDataA��[�oDataCK�NameTpmSrkProvisioningStatus
u8TpmSrkProvisioningStatusTEMP��ut��
�X/X������xD�	EventDataA��W�oData?K�NameTpmSrkProvisioningTime



�u4TpmSrkProvisioningTimeTEMP�v.A�a�M�T��q�`����D�	EventDataA��c�oDataKK�NameTpmBindingProvisioningStatus
�v@TpmBindingProvisioningStatusTEMP��w�Ea3�[���>B:���jD�	EventDataA��I�oData1K�NameLoadDriversTime



�w$LoadDriversTimeTEMP,�x.�=����W$ V^ϻп���D�	EventDataA��3�oDataK�NamePath
A��C�oData+K�NameLoadHiveTime

y

 yPath LoadHiveTimeTEMP�Dz�Z�\�J�Z�d$���D�	EventDataA��U�oData=K�NameApplicationIdentifier
A��Q�oData9K�NameApplicationLoadTime

lz

�z0ApplicationIdentifier,ApplicationLoadTimeTEMP��{L���/!~U1&�ݟ�)���D�	EventDataA��U�oData=K�NameApplicationIdentifier
A��[�oDataCK�NameApplicationExecutionTime

�{

,|0ApplicationIdentifier8ApplicationExecutionTimeTEMP$4}�,�L&�SY���������D�	EventDataA��7�oDataK�NameStatus
A��;�oData#K�NameFileName
\}p}StatusFileNameTEMP4`~x_T��U�]�x����D�	EventDataA��7�oDataK�NameStatus
A��C�oData+K�NameFailurePoint
�~�~Status FailurePointTEMP�H$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
\StatusTEMP���5	0�&U��H�v�%��pD�	EventDataA��O�oData7K�NameReserveDescriptors
(�,ReserveDescriptorsTEMP�t���~��]ͽ'�1����D�	EventDataA��E�oData-K�Name
ApplicationId
A��;�oData#K�NameRunCount
A��=�oData%K�Name	PageCount

��Ё

� ApplicationIdRunCountPageCountTEMP̂s�Z�j��_��jz(�V(���D�	EventDataA��7�oDataK�NameStatus
A��9�oData!K�NameBlockId

�
�StatusBlockIdTEMP�ă�'v~�rPx�zx^X
V��rD�	EventDataA��Q�oData9K�NameFreePersistentPages



؃,FreePersistentPagesTEMPD���*�P��
7`:o���D�	EventDataA��7�oDataK�NameStatus
A��K�oData3K�NameOutstandingCount

�

 �Status(OutstandingCountTEMPh<�� ��N��YB�B���
���D�	EventDataA��E�oData-K�Name
ApplicationId
A��Q�oData9K�NameFreePersistentPages

d�

�� ApplicationId,FreePersistentPagesTEMP����*?�S�Y��z\����D�	EventDataA��E�oData-K�Name
ApplicationId
A��9�oData!K�NameBlockId

A��Q�oData9K�NameFreePersistentPages

 �
@�

T� ApplicationIdBlockId,FreePersistentPagesTEMP�����/��yTQ��lC\V���D�	EventDataA��E�oData-K�Name
ApplicationId
A��9�oData!K�NameBlockId

A��5�oDataK�NameFlags
ԉ

�� ApplicationIdBlockIdFlagsTEMP�0�݆��@:[%�ʼnD��Y���D�	EventDataA��7�oDataK�NameStatus
A��A�oData)K�NameRunsClaimed
A��=�oData%K�Name	PageCount

l���

��StatusRunsClaimedPageCountTEMP�\��'v~�rPx�zx^X
V��rD�	EventDataA��Q�oData9K�NameFreePersistentPages



p�,FreePersistentPagesTEMP8x�7!�~�Z�]��I)���D�	EventDataA��E�oData-K�Name
ApplicationId
A��9�oData!K�NameBlockId

��

�� ApplicationIdBlockIdTEMP���r�e~SV��C.`J����D�	EventDataA��3�oDataK�NameType
A��5�oDataK�NameFlags
A��?�oData'K�Name
BufferSize
�,�<�TypeFlagsBufferSizeTEMP$(�s4y�[�X���—8���D�	EventDataA��;�oData#K�NameDiagCode
A��7�oDataK�NameStatus
�P�h�DiagCodeStatusTEMP����E�{�wHX�}u�;G�����D�	EventDataA��7�oDataK�NameStatus
A��;�oData#K�NameDataSize
A��?�oData'K�Name
BufferSize
̑���StatusDataSizeBufferSizeTEMPܒBRuu��T;CB��w����D�	EventDataA��5�oDataK�NamePhase
A��7�oDataK�NameStatus
��PhaseStatusTEMP�P�7C�{��S5�o/Q9����D�	EventDataA��7�oDataK�NameStatus
A��Q�oData9K�NameEnableDisableReason
A��=�oData%K�Name	VsmPolicy
�����t̔Status,EnableDisableReasonVsmPolicyTEMP�̖����ݺB[���C~7���D�	EventDataA��?�oData'K�Name
LowAddress

A��A�oData)K�NameHighAddress

A��=�oData%K�Name	SkipBytes

A��?�oData'K�Name
TotalBytes

A��=�oData%K�Name	CacheType
A��5�oDataK�NameFlags

D�
`�
|�

����ȗLowAddressHighAddressSkipBytesTotalBytesCacheTypeFlagsTEMP�`��s/��T1X��D>��RD�	EventDataA��1�oDataK�NameMdl
t�MdlTEMP�������L�X+I%��n�v��XD�	EventDataA��7�oDataK�NameSecure



 �SecureTEMP�ԙ
+t�]��K~p���lD�	EventDataA��K�oData3K�NameSoftRestartCount
�(SoftRestartCountTEMPD�i%�O댘\@2���\����D�	EventDataA��K�oData3K�NameSoftRestartCount
A��7�oDataK�NameSecure

�

@�(SoftRestartCountSecureTEMP���c��U�@M�Ƒ���D�	EventDataA��G�oData/K�NameSequenceNumber
A��I�oData1K�NameDescriptorCount
A��YZ�ComplexData3K�NameMemoryDescriptor
�,�P�t�
��

��̝�$SequenceNumber$DescriptorCount(MemoryDescriptorBasePagePageCountMemoryTypeReservedTEMP�������Uߔ�镢���jD�	EventDataA��I�oData1K�NameDescriptorCount
��$DescriptorCountTEMPĠw���0b�Y�G�N��}V���D�	EventDataA��7�oDataK�NameStatus
A��=�oData%K�Name	PageCount

A��?�oData'K�Name
MemoryType
A��?�oData'K�Name
Attributes
A��?�oData'K�Name
LowAddress

A��A�oData)K�NameHighAddress

<�

P�h���
��
��StatusPageCountMemoryTypeAttributesLowAddressHighAddressTEMP�l���/��TR��w���^D�	EventDataA��=�oData%K�Name	StartTime
��StartTimeTEMP<t�w)ϻ�6^lV���Aw����D�	EventDataA��?�oData'K�Name
Identifier
A��A�oData)K�NamePartitionId
����IdentifierPartitionIdTEMP���hl��N�Y&���hQO
���D�	EventDataA��?�oData'K�Name
Identifier
A��O�oData7K�NamePartitionPageCount

A��Q�oData9K�NameAllocatedBlockCount

A��M�oData5K�NameAllocatedRunCount

A��O�oData7K�NameAllocatedPageCount

A��7�oDataK�NameStatus
x�

��

��

�

�@�Identifier,PartitionPageCount,AllocatedBlockCount(AllocatedRunCount,AllocatedPageCountStatusTEMP,(�d�i�dl�YUY�O�S����D�	EventDataA��?�oData'K�Name
Identifier
A��7�oDataK�NameStatus
P�l�IdentifierStatusTEMP����*)�R�#����.��`D�	EventDataA��?�oData'K�Name
Identifier
(�IdentifierTEMP @���o�L)�^*�v��w�����D�	EventDataA��?�oData'K�Name
Identifier
A��;�oData#K�NameRunCount
A��=�oData%K�Name	PageCount

A��7�oDataK�NameStatus
A��Q�oData9K�NamePartitionNameLength
A��E�oData-K�Name
PartitionName
��ԫ

���D�IdentifierRunCountPageCountStatus,PartitionNameLength PartitionNameTEMP���09Q���S�����K&����D�	EventDataA��7�oDataK�NameStatus
A��?�oData'K�Name
ActualSize
A��C�oData+K�NameExpectedSize
��Э�StatusActualSize ExpectedSizeTEMP�(��D RUW8Sҍ�Ƶ����D�	EventDataA��A�oData)K�NamePartitionId
A��;�oData#K�NameRunCount
A��=�oData%K�Name	PageCount

d���

��PartitionIdRunCountPageCountTEMP,���{cZ(�uZ,K�37J2���D�	EventDataA��;�oData#K�NameBasePage

A��=�oData%K�Name	PageCount


��

İBasePagePageCountTEMP�����HZ>�^�3Gjk�X���D�	EventDataA��A�oData)K�NameCommandCode
A��C�oData+K�NameResponseCode
A��S�oData;K�NameResponseMilliseconds

T�p�

��CommandCode ResponseCode0ResponseMillisecondsTEMP� �;��{�R�^�
r%ʫ���*D�	EventDataA��A�oData)K�NameCommandCode
A��C�oData+K�NameResponseCode
A��S�oData;K�NameResponseMilliseconds

A��A�oData)K�NameCommandSize
A��A�oData)K�NameCommandData
A��C�oData+K�NameResponseSize
A��C�oData+K�NameResponseData
��ȵ

��4�P�p�CommandCode ResponseCode0ResponseMillisecondsCommandSizeCommandData ResponseSize ResponseDataTEMP�ķ
��.�m�Z��z;l���D�	EventDataA��A�oData)K�NameCommandCode
A��=�oData%K�Name	ErrorCode
A��S�oData;K�NameResponseMilliseconds

��

4�CommandCodeErrorCode0ResponseMillisecondsTEMP�(��ecv�U�U���'*l}���D�	EventDataA��A�oData)K�NameCommandCode
A��=�oData%K�Name	ErrorCode
A��S�oData;K�NameResponseMilliseconds

A��A�oData)K�NameCommandSize
A��A�oData)K�NameCommandData
����

����CommandCodeErrorCode0ResponseMillisecondsCommandSizeCommandDataTEMP�̻VC��SR�s�ġ����pD�	EventDataA��O�oData7K�NameFveGlobalDataFlags
�,FveGlobalDataFlagsTEMP p�_�2Y�?B�8��.D�	EventDataA��?�oData'K�Name
VendorGuid
A��C�oData+K�NameVariableName
A��?�oData'K�Name
Attributes
A��7�oDataK�NameStatus
��ܽ���VendorGuid VariableNameAttributesStatusTEMP�ľ�~�w
�^�ڴl�����dD�	EventDataA��C�oData+K�NameTxtErrorCode
ؾ TxtErrorCodeTEMP��t�0w�@Wf�#t�cg���D�	EventDataA��3�oDataK�NameBase

A��3�oDataK�NameSize


�
�BaseSizeTEMP����Mp�dnT!+���3���dD�	EventDataA��C�oData+K�NameBiosDataSize



�� BiosDataSizeTEMPt�n�p�;�WN=���"���D�	EventDataA��O�oData7K�NameAcmMinMleHeaderVer
A��K�oData3K�NameMleHeaderVersion
��,AcmMinMleHeaderVer(MleHeaderVersionTEMP�� U�)%�KQ�����"����D�	EventDataA��?�oData'K�Name
PmrLowBase

A��?�oData'K�Name
PmrLowSize

A��A�oData)K�NamePmrHighBase

A��A�oData)K�NamePmrHighSize

A��Q�oData9K�NameFirmwareProvidedAcm



l�

��

��

��

��PmrLowBasePmrLowSizePmrHighBasePmrHighSize,FirmwareProvidedAcmTEMP����Gg�`6XRN�r��HJ��^D�	EventDataA��=�oData%K�Name	TxtStatus
$��TxtStatusTEMP���ݞ���s\k�rT�O���D�	EventDataA��5�oDataK�NamePhase
A��?�oData'K�Name
StatusCode
A��K�oData3K�NameEnvironmentState
(�8�T�PhaseStatusCode(EnvironmentStateTEMP�<����05R���c'K3����D�	EventDataA��=�oData%K�Name	InitState
A��?�oData'K�Name
StatusCode
A��G�oData/K�NameFailureAddress

A��K�oData3K�NameReferenceAddress

A��?�oData'K�Name
ReasonCode
����
��
�� �InitStateStatusCode$FailureAddress(ReferenceAddressReasonCodeTEMP0����KknT׉�&�:���6D�	EventDataA��C�oData+K�NameSvnCounterId
A��?�oData'K�Name
StatusCode
A��;�oData#K�NameSvnValue
A��C�oData+K�NamePrevSvnValue
���4�L� SvnCounterIdStatusCodeSvnValue PrevSvnValueTEMP<H��X�@EJ�Q8A�%�)2����D�	EventDataA��;�oData#K�NameSvnValue
A��C�oData+K�NamePrevSvnValue
p���SvnValue PrevSvnValueTEMPT��y����X���֥.0���D�	EventDataA��G�oData/K�NameSinitStartTime

A��C�oData+K�NameSinitEndTime



��

��$SinitStartTime SinitEndTimeTEMP�$�p�5�g�\3�����W���D�	EventDataA��?�oData'K�Name
AcmDateDay
A��C�oData+K�NameAcmDateMonth
A��A�oData)K�NameAcmDateYear
`�|���AcmDateDay AcmDateMonthAcmDateYearTEMP�L��Gg�`6XRN�r��HJ��^D�	EventDataA��=�oData%K�Name	TxtStatus
$`�TxtStatusTEMP$H��-��Dz[*��$������D�	EventDataA��?�oData'K�Name
PathLength
A��3�oDataK�NamePath
p���PathLengthPathTEMP�4�[�C4VZ��ss�	���bD�	EventDataA��A�oData)K�NameTryComplete



H�TryCompleteTEMP�x��[��b��Q�,]��U�����D�	EventDataA��;�oData#K�NameFunction
A��7�oDataK�NameStatus
A��?�oData'K�Name
Checkpoint
������FunctionStatusCheckpointTEMP���v\����V�e��46���^D�	EventDataA��=�oData%K�Name	BcdOption
���BcdOptionTEMP�L��Py��TU��R�RM���ZD�	EventDataA��9�oData!K�NameVersion
`�VersionTEMP(��W��,�FTTϞ*,H�H��4D�	EventDataA��7�oDataK�NameStatus
A��C�oData+K�NameFailurePoint
A��K�oData3K�NameUpdateStatusEnum
A��9�oData!K�NameFwLevel
,�@��`���Status FailurePoint(UpdateStatusEnumFwLevelPRVAP��Microsoft-Windows-Kernel-BootOPCOL1<�2T�2l�H������L������N������O������}�����H����0�L����T�N����|�}������L
������N
�����L���� �N����L�L����p�L������L������L������L�����L����H�L����l�L������L������L������L�����win:Infowin:Startwin:Stop$GetEfiVariable(TxtLaunchPreparedInitStatusOpenFailure(SbatUpdateSuccess$SetEfiVariable(PreviousTxtError,EnterInsecureState(SbatUpdateFailure0InvalidTxtSinitRange DrtmSvnCheck,InvalidTxtHeapRange$BootmgrSvnCheck$MleLoadFailure(MissingRsdpTableNoSinitAcm4ComputePmrRangesFailure<InvalidTxtHeapBiosDataSize$MleHeaderTooOld(SinitPerformance(PrepareLcpFailure4TxtRejectedFirmwareAcm$TxtInformation$TxtNotSupportedLEVL�Ph�P��P��win:Errorwin:Warning(win:InformationalTASKX����p����������������������������(�����X�������	������
���������������8�
����h����������������������������D����������������������������������������H����������������������������0�����L� ����t�!������"������#������$�����%����8�&����\�'������(������)������*����,�+����P�,����|�-������.������/�����0����0�1����d�2������3������4������5�����6����4�7����\�8������9������:������;������<����0�=����T�>������?������@������A�����B����8�C����d�D������E������F������G������H���� �I����H�J����|�K������L������M������N�����O����,�P����D�Q����l�R������S�����T�����U����4�V����d�t������}������(InitializeLibrary PrepareTarget4RebuildKernelMemoryMapFatalError PersistMemory0ClaimPersistedMemory,FreePersistedMemory,CleanupPageDatabaseCancelBoot@AttachPersistentPageDatabase,MemoryBlockRundown0BuildKernelMemoryMap GetMemoryMap<AllocatePhysicalPagesForMdl(ExecuteTransition0DisconnectHypervisor(MemoryMapRundown@PhysicalPageAllocationFailureBootManagerPreBoot(FirmwareBootDataLoadDriversLoadHive8BootApplicationExecution8WaitForPartitionsRestored4MemoryPartitionRestore4PersistMemoryPartition$RegisterLoader$SiPolicyFailureBootTotalIo(DirtyBootShutdown$BootMenuPolicyBootType8MemoryPartitionsRestored$QueryStatistics,ConnectSecureLoader$BootFileAccess4RetrieveDriverListTime8FreePersistedMemoryBlock,PrepareNotification8PartitionInitialAddMemory$ImageHashCheck,ImageIntegrityCheck,BootPolicyMigration,RemoveEnclavePages0EnumerateEnclavePages,GetSystemBootDevice4NormalizeBootOptionList4CreateLibraryParameters CreateDevices8SoftRestartHostCapability,CancelNotificationBootDiag(ImageLoadFailure,FirmwareResolution(BootEnvResolution(BootmgrEntryCount UserInputTime8VsmIdkProvisioningStatus$BootAppLoadTime0PrepareTargetFailure,VsmPolicyEnablement@InitializeMeasurementContext$KsrMeasurement$TpmMeasurement,CloseMeasurementLog,CommitPendingEventsCapTpmPcr,TpmCommandResponse$TpmSubmitError(TpmBitLockerUsage(EfiVariableAccess4GetFirmwareInformation$VerifyBootEntry(InvalidNfitTable$MeasuredLaunch,EFICapsuleCreationBootSIFileOpen(VsmPolicyFailure8VsmLKeyProvisioningStatus4SecureBootVariableUsage4MiniFilterStartFailure(FileModification0RegistryModificationSoftReboot0SecureBootMitigationsSbatUpdateKEYW8��������������������������� � ����H�@����p������� ������@�����4�SoftRestart,MemoryPreservation,MemoryBlockRundown$PhysicalMemory(MemoryMapRundown(MemoryPartitions EfiVariables$LOG_TO_BOOTSTAT ms:Telemetryms:Measureswin:SQMEVNTL&�7@��$\����8@��$\����@�@&\��%@�'\���� @��*\�����+(@�p,��D�h��� @��.\�����*(@�P/��P�L���	 @�0P��
 �
�0D��@�05\����R@�6\����
 @��7P��@��8\��@��9\���L:D����;D����<\��9�,=\������=\����>\����@\����pB\���DC\����C\����C\�� �4D\�4���E\��!�XE\�P��!�F\�P������L!\��L:D����;D���HG\���@�tJ\�� :� (K\���!(@!�LD��"(@"�dMD�$�#( #��ND�,$@$��O\��%(@%�|QD�4�&6( &��RD���<'  '�PUD�D(  (��VD�H)  )�HWD�L*( *��WD�P+( +��YD�X, ,��ZD�`-; -��Z\�(�.&@�Ls\����/@�<w\���0@�x\�8��1 1�TD���2Q 2��]D���2Q 2�DdD���3Q 3��]\���3Q 3�Dd\���4<@�@y\�D��5@��z\�T��6@�d|D��7=@��}D�`��8@��~D�d�9 9�@tD�: :�<u\�; ;�0vD�<K <���P���=L@����D�(�\��h�>L >�,�d�D��l?
L@��������D��p�@L@��������D��t�AL@�����~��D��x�BL@�����~��D��|�CL@�����~��D����DL@�������D����EL@�������D����FL@�����~��D����GO����)@�P�X�HL@�����~�D����IL I���\��JQ J��pD���KQ K��p\���d�����\����d�������\����e�����~�\����f�����\����f����4��\����f������\����g�����~�\����h����p�\���i�����~�\���j����T��\�@��k������\�@��l�����~��D�$��m������\����n�����~�\����o����H��\�x��p�����~�\�x��q�������\�\��r������\�\��s	�s���P�����t	�t�~�P�����u
�����\����v
�����~�\����w��������\���x�����\��y�����~�\��z
����ԍ�\� �{
����|��\� �|PH�|�D�t��~	������\�<�	����ؗ�\�<�$�����ء�\�X�,������\�t�0�����T���\���4������\���8�������\���<�	 ����؞��D���@������\�p�H������\�p�L� �����D���P��������\���X�����ԣ�\���`� ��T���D���h��������\���p�����D��\���x� ��d���D�����"�����~��\�l���#�����\�����#�����~�\�����$ ���~��D�����'�������\�����'�����~�\�����(�����\����(�����~�\����) ������\�0���) �����~�\�0���>��(�\�|���, ���~��\����, ���~��P������(�P���5 ��X�\�����5 ��X�D�����-�������\�����4�����~�\�d���4�����~�\�d���/ �����~��D�����0 �����~��D�����1 �����~��D���� �����~��D�����2 �����~��D�,���3 �����~��D�H���. �����~��D�����? �����~��D�����@ �����~��D�����A �����~��D�����B �����~��D�����C �����~��D����D �����~��D�$���D �����~��D�$��� �����~��D�����H@������\����H@�����X�\����I �����~��D����J �����~��D����E@��ܰ��\�@���E@������\�@���F ������D�\��F ��d���D�\��G@��(���D�x���M�����\� ��M�����~�\� ��N@����4�\�<���N ��|�p�D�<� �
N ��<���D�<��L �������\���S �����~��D���$�T@��x���\���(��U@��x���\��,��V�����\��0��V���~�\��4��V���\��8��V���~�\��<��V��d�D��@��L ������$�\���L ������0�\��t ���P�8�N�l���D�<�H�t ���\�8�t ���\�8�#}  #�t�L�\�T�L$}  $�t�|�D�T�PX�H�X�X�H�X�X�X�X�H�H�x�H�H�X�H�X�H�X�H�X�H�X�X�X�X�H�X�H�X�H�H�H�H�H�H�H�H�H�H�H�H�H����������������������������������H�h������������������������������������(�(�H�H�������������������8�8���H�H���H����������H�X�X�WEVT�; � 
4I�I�I�IORCHANp�����TMicrosoft-Windows-Kernel-File/AnalyticTTBL )TEMP�X"���[�xdS�2iY���
��D�	EventDataA��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��E�oData-K�Name
CreateOptions
A��K�oData3K�NameCreateAttributes
A��A�oData)K�NameShareAccess
A��;�oData#K�NameFileName
�"�"#$#D#l#�#IrpThreadIdFileObject CreateOptions(CreateAttributesShareAccessFileNameTEMP8�%>���_Ql%x�t%����D�	EventDataA��?�oData'K�Name
ByteOffset

A��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��7�oDataK�NameIOSize
A��9�oData!K�NameIOFlags

@&\&h&�&�&�&�&ByteOffsetIrpThreadIdFileObjectFileKeyIOSizeIOFlagsTEMP��(a��RR!Y�-�%���D�	EventDataA��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��K�oData3K�NameExtraInformation
A��=�oData%K�Name	InfoClass
4)@)X)t)�)�)IrpThreadIdFileObjectFileKey(ExtraInformationInfoClassTEMP`�+����RXZ��t�K����D�	EventDataA��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��K�oData3K�NameExtraInformation
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameFilePath
|,�,�,�,�,�,-IrpThreadIdFileObjectFileKey(ExtraInformationInfoClassFilePathTEMP��/9�k���R�BC�K&���"D�	EventDataA��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��7�oDataK�NameLength
A��=�oData%K�Name	InfoClass
A��=�oData%K�Name	FileIndex
A��;�oData#K�NameFileName
 0,0D0`0t0�0�0�0IrpThreadIdFileObjectFileKeyLengthInfoClassFileIndexFileNameTEMP� 2[��ҟ�hQou����D�	EventDataA��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
p2|2�2�2IrpThreadIdFileObjectFileKeyTEMP�5�ԋR�W�!ssx��D�	EventDataA��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��I�oData1K�NameIssuingThreadId
A��E�oData-K�Name
CreateOptions
A��K�oData3K�NameCreateAttributes
A��A�oData)K�NameShareAccess
A��;�oData#K�NameFileName
�5�5�5�56(6D6IrpFileObject$IssuingThreadId CreateOptions(CreateAttributesShareAccessFileNameTEMP��8ު��N[�^�kљ9و���2D�	EventDataA��?�oData'K�Name
ByteOffset

A��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��I�oData1K�NameIssuingThreadId
A��7�oDataK�NameIOSize
A��9�oData!K�NameIOFlags
A��?�oData'K�Name
ExtraFlags

d9�9�9�9�9�9�9:ByteOffsetIrpFileObjectFileKey$IssuingThreadIdIOSizeIOFlagsExtraFlagsTEMP<�ty��:[�PW�<����D�	EventDataA��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��K�oData3K�NameExtraInformation
A��I�oData1K�NameIssuingThreadId
A��=�oData%K�Name	InfoClass
�<�<�<�<�<=IrpFileObjectFileKey(ExtraInformation$IssuingThreadIdInfoClassTEMPxd?�Z�Q��	U�K�n?�,��D�	EventDataA��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��K�oData3K�NameExtraInformation
A��I�oData1K�NameIssuingThreadId
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameFilePath
�?�?@,@T@x@�@IrpFileObjectFileKey(ExtraInformation$IssuingThreadIdInfoClassFilePathTEMP�Ct�욷�X_������0D�	EventDataA��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��I�oData1K�NameIssuingThreadId
A��7�oDataK�NameLength
A��=�oData%K�Name	InfoClass
A��=�oData%K�Name	FileIndex
A��;�oData#K�NameFileName
�C�C�C�CD D8DPDIrpFileObjectFileKey$IssuingThreadIdLengthInfoClassFileIndexFileNameTEMP�E��]�@L,Xӑ�2��\��(D�	EventDataA��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��I�oData1K�NameIssuingThreadId
F F<FPFIrpFileObjectFileKey$IssuingThreadIdTEMP��G��-�IT�S��BD����D�	EventDataA��1�oDataK�NameIrp
A��K�oData3K�NameExtraInformation
A��7�oDataK�NameStatus
�G�G�GIrp(ExtraInformationStatusTEMP$�H��`Ӓ��],��Ӛ����D�	EventDataA��9�oData!K�NameFileKey
A��;�oData#K�NameFileName
IIFileKeyFileNamePRVAPHIMicrosoft-Windows-Kernel-FileOPCO01�Iwin:InfoLEVL@P�I(win:InformationalTASK$
�����L�����L�����L
����M����M����,M����<M����LM����pM�����M�����M�����M�����M�����M�����M����N����0N����LN����hN�����N�����N�����N �����N!�����N"����ONameCreateNameDeleteCreateCleanupCloseReadWrite$SetInformationSetDeleteRenameDirEnumFlush(QueryInformationFSCTL OperationEndDirNotifyDeletePathRenamePathSetLinkPathSetLink CreateNewFileSetSecurity QuerySecuritySetEAQueryEAKEYW�	�����O �����O@����0P�����lP�����P�����P����Q����\Q�����Q@KERNEL_FILE_KEYWORD_FILENAME<KERNEL_FILE_KEYWORD_FILEIO<KERNEL_FILE_KEYWORD_OP_END<KERNEL_FILE_KEYWORD_CREATE8KERNEL_FILE_KEYWORD_READ8KERNEL_FILE_KEYWORD_WRITEDKERNEL_FILE_KEYWORD_DELETE_PATHTKERNEL_FILE_KEYWORD_RENAME_SETLINK_PATHLKERNEL_FILE_KEYWORD_CREATE_NEW_FILEEVNT�+

�����H�I�IJ Z������H�I�IJ$Z�������  �I�I8J(Z��������2�I�I8J0Z�

 ������0�I�ITJ8Z�

 �����hD�I�ITJ<Z� ������0�I�IpJ@Z� �����hD�I�IpJDZ� ������#�I�I�JHZ� �����\6�I�I�JPZ� ������#�I�I�JXZ� �����\6�I�I�J`Z� ������&�I�I�JhZ� �����$:�I�I�JlZ� ������&�I�I�JpZ� �����$:�I�I�JtZ� ������&�I�I�JxZ� �����$:�I�I�J|Z� �����(-�I�IK�Z� ������@�I�IK�Z� ������0�I�I4K�Z� �����hD�I�I4K�Z� ������&�I�IPK�Z� �����$:�I�IPK�Z� ������&�I�IlK�Z� �����$:�I�IlK�Z�`�����tF�I�I�K�Z� �����(-�I�I�K�Z� ������@�I�I�K�Z�������)�I�I�K�Z������0=�I�I�K�Z�������)�I�I�K�Z������0=�I�I�K�Z�������)�I�I�K�Z������0=�I�I�K�Z� ������&�I�I�J�Z� �����$:�I�I�J�Z������  �I�I0L�Z�������2�I�I0L�Z� �����$:�I�ILL�Z�   �����$:�I�IhL�Z�!! �����$:�I�I�L�Z�"" �����$:�I�I�L�Z�$O$O4OTO4OTO4O4O4O4O4OdO4OdO4OtO4OtO4O4O4O4O4O4O4O4O4O4O4O4O4O4O4ODO4O4O�O�O�O�O�O�O4O4O�O�O4O4O4O4OWEVT�0[
�[�[\D\�\�\CHANdL[����HMicrosoft-Windows-PCI/DiagnosticPRVA@�[Microsoft-Windows-PCIOPCO01�[win:InfoLEVL@P\(win:InformationalTASKP
����l\(AspmErrataRundownKEYW,�����\DiagEVNTD

������[\P\]<[�\WEVT�,�	\]D^_
�L�Ā��ȅCHAN��]�����]�\Microsoft-Windows-Kernel-StoreMgr/Analytic`Microsoft-Windows-Kernel-StoreMgr/OperationalMAPS�|^X^VMAP$�^��VMAP$�^��4CacheTerminationMsgMap8StoreMgrCorruptPageMsgMapTTBL� TEMP|�`w��49�-T��O[T!����lD�	EventDataA��9�oData!K�NameDataKey
A��9�oData!K�NameDataMgr
A��A�oData)K�NameStoreOffset
A��G�oData/K�NameCompressedSize
A��5�oDataK�NameFlags
a0aDa`a�aDataKeyDataMgrStoreOffset$CompressedSizeFlagsTEMP��b��` �U�E3�C�����D�	EventDataA��9�oData!K�NameDataKey
A��9�oData!K�NameDataMgr
A��A�oData)K�NameStoreOffset
�b�bcDataKeyDataMgrStoreOffsetTEMPt	�hU�81��P{G]\��-���D�	EventDataA��;�oData#K�NameStoreKey
A��C�oData+K�NameStoreFileKey
A��A�oData)K�NameUserDataMgr
A��A�oData)K�NameMetadataMgr
A��?�oData'K�Name
RegionSize
A��A�oData)K�NameRegionCount
A��=�oData%K�Name	BlockSize
A��?�oData'K�Name
SectorSize
A��O�oData7K�NameEncryptionStrength
A��=�oData%K�Name	StoreType
	A��9�oData!K�NameStoreId
A��C�oData+K�NameBlocksStored
A��C�oData+K�NameRegionsInUse
A��G�oData/K�NameTotalSpaceUsed

A��5�oDataK�NameFlags
A��I�oData1K�NameMetaRegionCount
A��K�oData3K�NameMetaRegionsInUse
A��S�oData;K�NameMetaRegionsSpaceUsed
A��=�oData%K�Name	StoreTime
dj|j�j�j�j�jk$k@klk�k�k�k�k�kl0lXl�lStoreKey StoreFileKeyUserDataMgrMetadataMgrRegionSizeRegionCountBlockSizeSectorSize,EncryptionStrengthStoreTypeStoreId BlocksStored RegionsInUse$TotalSpaceUsedFlags$MetaRegionCount(MetaRegionsInUse0MetaRegionsSpaceUsedStoreTimeTEMP�0m�4�d*�cS�Ս&w)�t��\D�	EventDataA��;�oData#K�NameStoreKey
DmStoreKeyTEMP��o����_Ql6��a� ��D�	EventDataA��9�oData!K�NameDataMgr
A��G�oData/K�NameVirtualAddress
A��I�oData1K�NamePhysicalAddress

A��3�oDataK�NameSize
A��?�oData'K�Name
FileBacked
A��G�oData/K�NameCorruptionType
A��5�oDataK�NameFlags
 p4p
Xp|pX^�p�p�pDataMgr$VirtualAddress$PhysicalAddressSizeFileBacked$CorruptionTypeFlagsTEMP��r���v�z]���	8XIG��rD�	EventDataA��9�oData!K�NameDataMgr
A��A�oData)K�NameRegionIndex
A��7�oDataK�NameStatus
A��=�oData%K�Name	SpaceUsed
A��G�oData/K�NameLastAccessTime
�r�rs,sDsDataMgrRegionIndexStatusSpaceUsed$LastAccessTimeTEMP@�t�B��ZR�-))��>D�	EventDataA��?�oData'K�Name
FailReason
A��?�oData'K�Name
FailStatus
A��K�oData3K�NameObjectPathLength
A��?�oData'K�Name
ObjectPath
,uHudu�uFailReasonFailStatus(ObjectPathLengthObjectPathTEMPlvKz�?�pY�ޔaB@�d���D�	EventDataA��3�oDataK�NameSize
A��3�oDataK�NameData
�v�vSizeDataTEMPx�w��(߀09S���	6����D�	EventDataA��;�oData#K�NameStoreKey
A��3�oDataK�NameSize
A��3�oDataK�NameData
�wxxStoreKeySizeDataTEMP�xR0qTBV��) ���D�	EventDataA��;�oData#K�NameStoreKey
A��5�oDataK�NameParam
 y8yStoreKeyParamTEMPLX{�Y�q�U���������D�	EventDataA��7�oDataK�NameReason
A��?�oData'K�Name
FailStatus
A��K�oData3K�NameDeviceDescLength
A��M�oData5K�NameDeviceDescription
A��K�oData3K�NameObjectPathLength
A��?�oData'K�Name
ObjectPath
|^�{�{|(|P|x|ReasonFailStatus(DeviceDescLength(DeviceDescription(ObjectPathLengthObjectPathTEMP`\~��Ǎ��Y<��������D�	EventDataA��9�oData!K�NameSqmType
A��G�oData/K�NameSqmSessionGuid
A��5�oDataK�NameSqmID
A��O�oData7K�NameSqmStreamRowLength
A��QZ�ComplexData+K�NameSqmStreamRow
��~4Dp���SqmType$SqmSessionGuidSqmID,SqmStreamRowLength SqmStreamRow SqmTypeEntry SqmDWORDEntry$SqmStringEntryPRVAX�Microsoft-Windows-Kernel-StoreMgrOPCOx1|�2��2��win:Infowin:Startwin:StopLEVL@P܀(win:InformationalTASK�������������� �����<�����X�����x�����������ă	�����
����������$�����D�
����`�����|�����������������܄StoreAddStoreRemoveStoreCreateStoreDelete StoreRundown$StoreCorruption(StorePageRundownRegionEvictRegionWrite(UnpersistFailure StoreIoStatsGlobalStatsStoreEmpty RegionRelease RegionCompact RegionRundown(CacheTerminationKEYW�����P�@����h��������4��StoreOpsStoreDiag0StoreContentsRundownwin:SQMEVNT������_X�Ѐ�h�h]������aX�Ѐ,�l�h]�����,cX�ЀH�p�h]������lX�Ѐd�t�h]�����,cX�Ѐ��x�h]P@�\mX�Ѐ��|�x]������_X�Ѐ����h]������pX�Ѐԁ��h]		������pX�Ѐ���h]

P@�hsX�Ѐ���x]������vX�Ѐ(���h]������uX�ЀD���h]

�����,xX�Ѐ`���h]������pX�Ѐ|���h]������pd�Ѐ����h]������pp�Ѐ����h]�������pX�Ѐ����h]P@�HyX�ЀЂ��x]�����|Ѐ�������� �0���� �������0�� �@�WEVT������
X���Č��@�TTBLPTEMPD���͟�,�Vo�9��{���BD�	EventDataA��9�oData!K�NameSqmType
A��G�oData/K�NameSqmSessionGuid
A��5�oDataK�NameSqmID
A��W�oData?K�NameSqmDWORDDatapointValue
܋��$�SqmType$SqmSessionGuidSqmID4SqmDWORDDatapointValuePRVA`l�Microsoft-Windows-Kernel-LicensingSqmOPCOLEVL@P܌(win:InformationalTASKKEYW04,�win:SQMEVNTD�����Ќ���WEVT�*����ԍH�
@����L����CHANt�����XMicrosoft-Windows-Kernel-Memory/AnalyticTTBL�"
TEMP�

�!5
.)]���Z�����^D�	EventDataA��G�oData/K�NamePriorityLevels
A��E�oData-K�Name
ZeroPageCount
A��E�oData-K�Name
FreePageCount
A��M�oData5K�NameModifiedPageCount
A��[�oDataCK�NameModifiedNoWritePageCount
A��C�oData+K�NameBadPageCount
A��M�oData5K�NameStandbyPageCounts
�A��S�oData;K�NameRepurposedPageCounts
�A��]�oDataEK�NameModifiedPageCountPageFile
A��O�oData7K�NamePagedPoolPageCount
	A��U�oData=K�NameNonPagedPoolPageCount
A��C�oData+K�NameMdlPageCount
A��I�oData1K�NameCommitPageCount
��0�P�x���Д��(�`�����ܕ$PriorityLevels ZeroPageCount FreePageCount(ModifiedPageCount8ModifiedNoWritePageCount BadPageCount(StandbyPageCounts0RepurposedPageCounts8ModifiedPageCountPageFile,PagedPoolPageCount0NonPagedPoolPageCount MdlPageCount$CommitPageCountTEMPp�R���n.R����H����D�	EventDataA��5�oDataK�NameCount
A��QZ�ComplexData+K�NameWSCommitInfo
�p���������4�Count WSCommitInfoProcessID,WorkingSetPageCount$CommitPageCount,VirtualSizeInPages<PrivateWorkingSetPageCountTEMP$
T�R���n.R����H����D�	EventDataA��5�oDataK�NameCount
A��QZ�ComplexData+K�NameWSCommitInfo
��,�L�d�������H�l�Count WSCommitInfoProcessID,WorkingSetPageCount$CommitPageCount,VirtualSizeInPages<PrivateWorkingSetPageCount,StoreSizePageCount$StoredPageCount(CommitDebtInPagesTEMPdx�R���n.R����H����D�	EventDataA��5�oDataK�NameCount
A��QZ�ComplexData+K�NameWSCommitInfo
�T�	d�����ȝ��T�����̞Count WSCommitInfoProcessID,WorkingSetPageCount$CommitPageCount,VirtualSizeInPages<PrivateWorkingSetPageCount,StoreSizePageCount$StoredPageCount(CommitDebtInPages,SharedCommitInPagesTEMP����?"~�[&
�S�%�\���D�	EventDataA��5�oDataK�NameCount
A��_Z�ComplexData9K�NameSessionWSCommitInfo
�t�����Ƞ��D�Count,SessionWSCommitInfoSessionId,WorkingSetPageCount$CommitPageCount,PagedPoolPageCount<PrivateWorkingSetPageCountTEMP<
p���?"~�[&
�S�%�\���D�	EventDataA��5�oDataK�NameCount
A��_Z�ComplexData9K�NameSessionWSCommitInfo
�8�H�t�����ܣ�D�p���Count,SessionWSCommitInfoSessionId,WorkingSetPageCount$CommitPageCount,PagedPoolPageCount<PrivateWorkingSetPageCount,StoreSizePageCount$StoredPageCount(CommitDebtInPagesTEMP|����?"~�[&
�S�%�\���D�	EventDataA��5�oDataK�NameCount
A��_Z�ComplexData9K�NameSessionWSCommitInfo
���	��Ħܦ�,�X�������Count,SessionWSCommitInfoSessionId,WorkingSetPageCount$CommitPageCount,PagedPoolPageCount<PrivateWorkingSetPageCount,StoreSizePageCount$StoredPageCount(CommitDebtInPages,SharedCommitInPagesTEMP�̨�)m���N_}݉�T3n��^D�	EventDataA��=�oData%K�Name	ProcessId
�ProcessIdTEMP ȩ�de�^��<3�����D�	EventDataA��=�oData%K�Name	ProcessId
A��5�oDataK�NameFlags
��ProcessIdFlagsTEMP�8��tMO%�XRVw�*�����D�	EventDataA��=�oData%K�Name	ProcessId
A��7�oDataK�NameStatus
A��G�oData/K�NamePagesProcessed
t�����ProcessIdStatus$PagesProcessedTEMP�����USg�\zY�4.��D�	EventDataA��=�oData%K�Name	ProcessId
A��7�oDataK�NameStatus
A��G�oData/K�NamePagesProcessed
A��_�oDataGK�NameWriteCombinePagesProcessed
A��W�oData?K�NameUncachedPagesProcessed
A��Q�oData9K�NameCleanPagesProcessed
x�����Ȯ�8�ProcessIdStatus$PagesProcessed<WriteCombinePagesProcessed4UncachedPagesProcessed,CleanPagesProcessedTEMP$4��V]���])&�l�Q|{���D�	EventDataA��=�oData%K�Name	ProcessId
A��7�oDataK�NameStatus
\�t�ProcessIdStatusTEMP��bP���P���J&� ���ZD�	EventDataA��9�oData!K�NameAcgFlag
,�AcgFlagPRVATT�Microsoft-Windows-Kernel-MemoryOPCOx1ı2ܱ2�win:Infowin:Startwin:StopLEVL@P$�(win:InformationalTASKd��������������,�����T�����|�������MemInfoMemInfoWS(MemInfoSessionWS(WorkingSetOutSwap(WorkingSetInSwapAcgKEYW8 ������@����8������x�������<KERNEL_MEM_KEYWORD_MEMINFO@KERNEL_MEM_KEYWORD_MEMINFO_EX<KERNEL_MEM_KEYWORD_WS_SWAP4KERNEL_MEM_KEYWORD_ACGEVNTP �����T����X����@���������t����@�����p����t���@����������t���@��������������@��������������@��������������������8�������������������������������������������ī����� ��������8����Ȳ$�������������Ȳ(��������d����Ȳ,�������������0��	������d����Ȳ4����̳̳̳̳̳̳ܳܳܳܳܳܳܳ�ܳWEVT�6�	����
�����������CHAN\̸����$��������XMicrosoft-Windows-Kernel-ShimEngine/DebugdMicrosoft-Windows-Kernel-ShimEngine/OperationaldMicrosoft-Windows-Kernel-ShimEngine/DiagnosticMAPS�$��VMAP$����VMAP$H���LKSE:DeviceFlagApplied.FlagSourceMapLKSE:DriverShimApplied.ShimSourceMapTTBL�,TEMP4ĻZ~�B ;�\�Y�q�h:���D�	EventDataA��9�oData!K�NameEventId
A��C�oData+K�NameDebugMessage
��EventId DebugMessageTEMP(���%oM���]�@/Hxɫ��4D�	EventDataA��?�oData'K�Name
DriverName
A��?�oData'K�Name
ShimSource
A��=�oData%K�Name	ShimCount
A��C�oData+K�NameAppliedGuids
ؽ���(�DriverNameShimSourceShimCount AppliedGuidsTEMP��-
U&O�SA����4��*D�	EventDataA��?�oData'K�Name
DeviceName
A��A�oData)K�NameDeviceClass
A��?�oData'K�Name
FlagSource
A��5�oDataK�NameFlags

���$�0�

L�DeviceNameDeviceClassFlagSourceFlagsTEMP���N��_���ք������D�	EventDataA��?�oData'K�Name
DriverName
A��?�oData'K�Name
DriverBase
A��?�oData'K�Name
DriverSize
A��I�oData1K�NameDriverTimeStamp
A��G�oData/K�NameDriverCheckSum
����������DriverNameDriverBaseDriverSize$DriverTimeStamp$DriverCheckSumTEMPD��ef2�_�Ǎ;�vB���D�	EventDataA��C�oData+K�NameDriverObject
A��?�oData'K�Name
DriverBase
$�D� DriverObjectDriverBaseTEMPd��O]S��Rx�������D�	EventDataA��?�oData'K�Name
DriverBase
A��?�oData'K�Name
DriverSize
A��C�oData+K�NameDriverObject
A��1�oDataK�NamePdo
A��7�oDataK�NameStatus
A��A�oData)K�NameServiceName
A��?�oData'K�Name
HardwareId
�0�L�l�x�����DriverBaseDriverSize DriverObjectPdoStatusServiceNameHardwareIdTEMP0<��<au2Pۜ�]i���DD�	EventDataA��9�oData!K�NameAddress
A��7�oDataK�NameCaller
A��3�oDataK�NameType
A��3�oDataK�NameSize
A��1�oDataK�NameTag
����������AddressCallerTypeSizeTagTEMPt��e�5��J]Y���9����D�	EventDataA��9�oData!K�NameAddress
A��7�oDataK�NameCaller
A��1�oDataK�NameTag
4�H�\�AddressCallerTagTEMP|p���k,H�lZ.�7u1�n:���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
������ DriverObjectFdoIrpTEMP����h؂iAQ��՜����D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��?�oData'K�Name
DeviceType
A��U�oData=K�NameDeviceCharacteristics
A��=�oData%K�Name	Exclusive
A��7�oDataK�NameStatus
P�p�|������� DriverObjectFdoDeviceType0DeviceCharacteristicsExclusiveStatusTEMPT�����ܐ�_���R����VD�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��=�oData%K�Name	MajorCode
A��7�oDataK�NameStatus
�����4� DriverObjectFdoIrpMajorCodeStatusTEMPT��w����RĚ�pȧ'��VD�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��=�oData%K�Name	MinorCode
A��7�oDataK�NameStatus
8�X�d�p��� DriverObjectFdoIrpMinorCodeStatusTEMP����b6wm+^��>��.���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��7�oDataK�NameStatus
4�T�`�l� DriverObjectFdoIrpStatusTEMP����b6wm+^��>��.���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��7�oDataK�NameStatus
�8�D�P� DriverObjectFdoIrpStatusTEMP8x���g��cQ胉� �o8���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��=�oData%K�Name	MinorCode
A��=�oData%K�Name	PowerType
A��?�oData'K�Name
PowerState
A��7�oDataK�NameStatus
�$�0�<�T�l��� DriverObjectFdoIrpMinorCodePowerTypePowerStateStatusTEMP8����g��cQ胉� �o8���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��=�oData%K�Name	MinorCode
A��=�oData%K�Name	PowerType
A��?�oData'K�Name
PowerState
A��7�oDataK�NameStatus
<�\�h�t������� DriverObjectFdoIrpMinorCodePowerTypePowerStateStatusTEMP���b}}����_�G��&Sv����D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��=�oData%K�Name	MinorCode
A��?�oData'K�Name
PowerState
A��7�oDataK�NameStatus
�<�H�T�l��� DriverObjectFdoIrpMinorCodePowerStateStatusTEMP����b6wm+^��>��.���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��7�oDataK�NameStatus
4�T�`�l� DriverObjectFdoIrpStatusTEMP�@��N��_���ք������D�	EventDataA��?�oData'K�Name
DriverName
A��?�oData'K�Name
DriverBase
A��?�oData'K�Name
DriverSize
A��I�oData1K�NameDriverTimeStamp
A��G�oData/K�NameDriverCheckSum
���������DriverNameDriverBaseDriverSize$DriverTimeStamp$DriverCheckSumTEMPD �ef2�_�Ǎ;�vB���D�	EventDataA��C�oData+K�NameDriverObject
A��?�oData'K�Name
DriverBase
H�h� DriverObjectDriverBasePRVA\��Microsoft-Windows-Kernel-ShimEngineOPCO01��win:InfoLEVL�P@�PX�U��win:Error(win:Informationalwin:VerboseTASKKEYW�����4�����\����������������������������$� ����H�(ShimEngineEvents,ShimEngineMessages,DriverScopeGeneral$DriverScopePnp(DriverScopePower$DriverScopeIrps$DriverScopePool4SkipDriverUnloadGeneralEVNTD���������������(���@� ���(���@�H���(��� @������4����� @����@�4�����
 ����\�4����� �����4����� ����`�4�����
 ������4����� ������4����� ����h�4����� ������4����� ������4����� ����H�4����� ������4����� ������4����� ����d�4����� ������4����� ������4����� ������4�����$�$���������������������������WEVTl�
�����������PRVA��Microsoft-Windows-Kernel-Licensing-StartServiceTriggerOPCOLEVL@P��(win:InformationalTASKKEYWEVNT@������WEVTX����x�
��H�x�������CHANx������\Microsoft-Windows-Kernel-IoTrace/DiagnosticPRVAX�Microsoft-Windows-Kernel-IoTraceOPCO01`�win:InfoLEVLhP��U��(win:Informationalwin:VerboseTASK�����@�����d�����|�$UserInitiatedIoKernelIo,ActivityIdTransferKEYWEVNT������T������������T�����������T�����������T���$���WEVTl�����
\<�<=�=TD�ECHAN�4�	�P�������������\�����Application\Microsoft-Windows-AppModel-Runtime/AnalyticXMicrosoft-Windows-AppModel-Runtime/AdminXMicrosoft-Windows-AppModel-Runtime/DebugdMicrosoft-Windows-AppModel-Runtime/DiagnosticsTTBL�F'TEMPt�'$�vS�^a�[.�������D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��I�oData1K�NameParentProcessID
A��I�oData1K�NamePackageFullName
A��=�oData%K�Name	ImageName
A��c�oDataKK�NamePackageRelativeApplicationId
l��������ProcessIDCreateTime$ParentProcessID$PackageFullNameImageName@PackageRelativeApplicationIdTEMP�l�zsS��&]����%Ǚ���D�	EventDataA��I�oData1K�NamePackageFullName
A��=�oData%K�Name	ErrorCode
A��C�oData+K�NameErrorMessage
����$PackageFullNameErrorCode ErrorMessageTEMP�0�}��s!t
^�p�v�W���D�	EventDataA��I�oData1K�NamePackageFullName
A��=�oData%K�Name	ErrorCode
A��C�oData+K�NameFailedBinary
l�����$PackageFullNameErrorCode FailedBinaryTEMP�\�?~�v|�Uj��]�4���^D�	EventDataA��=�oData%K�Name	ErrorCode
p�ErrorCodeTEMP@�������wZۉML-e�����D�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��3�oDataK�NameSize

A��7�oDataK�NameOffset
A��?�oData'K�Name
HeaderAddr
A��9�oData!K�NameSection
A��=�oData%K�Name	ProcessId
,D

\l���FileNameErrorCodeSizeOffsetHeaderAddrSectionProcessIdTEMP���2Ol�T�>��6�����D�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��3�oDataK�NameSize

A��?�oData'K�Name
HeaderAddr
A��9�oData!K�NameSection
A��=�oData%K�Name	ProcessId
0

HXt�FileNameErrorCodeSizeHeaderAddrSectionProcessIdTEMP���/Q}�Q����B����D�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��3�oDataK�NameSize

A��?�oData'K�Name
HeaderAddr
A��W�oData?K�NameApplicationUserModelId
A��=�oData%K�Name	ProcessId
(

@Pl�FileNameErrorCodeSizeHeaderAddr4ApplicationUserModelIdProcessIdTEMPpP&�8#}�NX[V��PpK���dD�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��3�oDataK�NameSize

A��?�oData'K�Name
HeaderAddr
A��=�oData%K�Name	ProcessId
��

��	FileNameErrorCodeSizeHeaderAddrProcessIdTEMP�@
R�n#�V�!�qT����D�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��=�oData%K�Name	ProcessId
|
�
�
FileNameErrorCodeProcessIdTEMP<����DI�]���jzXK���D�	EventDataA��;�oData#K�NameFileName
A��E�oData-K�Name
ExceptionCode
��FileName ExceptionCodeTEMP�T
B��
��;V ,��1~���D�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��3�oDataK�NameType
A��=�oData%K�Name	ProcessId
�
�
�
�
FileNameErrorCodeTypeProcessIdTEMPH��uSQk�Xޱt!֝6A���D�	EventDataA��I�oData1K�NamePackageFullName
A��=�oData%K�Name	ErrorCode
,$PackageFullNameErrorCodeTEMP�}4j�n��]l���=�0��$D�	EventDataA��I�oData1K�NamePackageFullName
A��1�oDataK�NameKey
A��7�oDataK�NameSubkey
A��=�oData%K�Name	ErrorCode
�0$PackageFullNameKeySubkeyErrorCodeTEMP�}4j�n��]l���=�0��$D�	EventDataA��I�oData1K�NamePackageFullName
A��1�oDataK�NameKey
A��7�oDataK�NameSubkey
A��=�oData%K�Name	ErrorCode
� 4$PackageFullNameKeySubkeyErrorCodeTEMP�}4j�n��]l���=�0��$D�	EventDataA��I�oData1K�NamePackageFullName
A��1�oDataK�NameKey
A��7�oDataK�NameSubkey
A��=�oData%K�Name	ErrorCode
�$8$PackageFullNameKeySubkeyErrorCodeTEMPP8	�p\k��&�����D�	EventDataA��M�oData5K�NamePackageFamilyName
A��=�oData%K�Name	ErrorCode
`�(PackageFamilyNameErrorCodeTEMP(t�c��+U���w�6p����D�	EventDataA��=�oData%K�Name	ErrorCode
A��9�oData!K�NameContext
��ErrorCodeContextTEMP(��c��+U���w�6p����D�	EventDataA��=�oData%K�Name	ErrorCode
A��9�oData!K�NameContext
��ErrorCodeContextTEMP��?~�v|�Uj��]�4���^D�	EventDataA��=�oData%K�Name	ErrorCode
�ErrorCodeTEMP�P�&؍1�
U)��;߸C��lD�	EventDataA��K�oData3K�NameAppContainerName
d(AppContainerNameTEMP�,t+=D{��Q
��m����jD�	EventDataA��I�oData1K�NamePackageFullName
@$PackageFullNameTEMPHH ����2B[&�Ŧ�]$���D�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
p�ErrorCode$PackageFullNameTEMP,��ˀf��S �t�:sV����D�	EventDataA��=�oData%K�Name	ErrorCode
A��;�oData#K�NameResource
��ErrorCodeResourceTEMP,��ˀf��S �t�:sV����D�	EventDataA��=�oData%K�Name	ErrorCode
A��;�oData#K�NameResource
��ErrorCodeResourceTEMPH� ����2B[&�Ŧ�]$���D�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
 ( ErrorCode$PackageFullNameTEMP�h!ر`n���[m��,l��.���D�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
A��3�oDataK�NameUser
�!�!�!ErrorCode$PackageFullNameUserTEMPHl#uBԘ|Xl��%�{�Z��FD�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
A��E�oData-K�Name
DesiredStatus
A��E�oData-K�Name
CurrentStatus
�#�#�#$ErrorCode$PackageFullName DesiredStatus CurrentStatusTEMP�p%�~��uB�YĴ��z�E��D�	EventDataA��I�oData1K�NamePackageFullName
A��E�oData-K�Name
DesiredStatus
A��E�oData-K�Name
CurrentStatus
�%�%�%$PackageFullName DesiredStatus CurrentStatusTEMP��'��^�m�Q���w�
���D�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
A��3�oDataK�NameUser
A��E�oData-K�Name
DesiredStatus
A��E�oData-K�Name
CurrentStatus
((@(d(t(�(ErrorCode$PackageFullNameUser DesiredStatus CurrentStatusTEMP4$*�9%�'S��`Zdv{���<D�	EventDataA��I�oData1K�NamePackageFullName
A��3�oDataK�NameUser
A��E�oData-K�Name
DesiredStatus
A��E�oData-K�Name
CurrentStatus
t*�*�*�*$PackageFullNameUser DesiredStatus CurrentStatusTEMP(�+�c��+U���w�6p����D�	EventDataA��=�oData%K�Name	ErrorCode
A��9�oData!K�NameContext
�+�+ErrorCodeContextTEMP��-ü��V�]6�D����zD�	EventDataA��=�oData%K�Name	ProcessID
A��A�oData)K�NamePackageName
A��=�oData%K�Name	ImageName
A��I�oData1K�NameApplicationName
A��9�oData!K�NameMessage
$.<.X.p.�.ProcessIDPackageNameImageName$ApplicationNameMessageTEMP�X0��6���RSX�˜����zD�	EventDataA��A�oData)K�NamePackageName
A��=�oData%K�Name	ImageName
A��I�oData1K�NameApplicationName
A��=�oData%K�Name	ErrorCode
A��9�oData!K�NameMessage
�0�0�01,1PackageNameImageName$ApplicationNameErrorCodeMessageTEMP�l2�n#Ύ��X��sk�	�����D�	EventDataA��A�oData)K�NamePackageName
A��E�oData-K�Name
ContainerName
A��A�oData)K�NameContainerId
�2�2�2PackageName ContainerNameContainerIdTEMP�$4C|3*C�uVo���.}+���D�	EventDataA��=�oData%K�Name	ProcessID
A��A�oData)K�NamePackageName
A��A�oData)K�NameContainerId
`4x4�4ProcessIDPackageNameContainerIdTEMP 6z`y�-'1T��x¤�r���2D�	EventDataA��=�oData%K�Name	ErrorCode
A��=�oData%K�Name	ProcessID
A��A�oData)K�NamePackageName
A��A�oData)K�NameContainerId
h6�6�6�6ErrorCodeProcessIDPackageNameContainerIdTEMP��7�vgz!XX_�HT
"I���D�	EventDataA��=�oData%K�Name	ErrorCode
A��A�oData)K�NamePackageName
A��E�oData-K�Name
ContainerName
48L8h8ErrorCodePackageName ContainerNameTEMP@h9�O�L�W�ּY=���D�	EventDataA��A�oData)K�NamePackageName
A��A�oData)K�NameContainerId
�9�9PackageNameContainerIdTEMP�h;�Cg�6hT���v#��E��lD�	EventDataA��]�oDataEK�NameCleanupContainerErrorCode
A��W�oData?K�NameMakeTemporaryErrorCode
A��A�oData)K�NamePackageName
A��A�oData)K�NameContainerId
�;�;$<@<8CleanupContainerErrorCode4MakeTemporaryErrorCodePackageNameContainerIdPRVA\p<Microsoft-Windows-AppModel-RuntimeOPCOT2�<2�<win:Startwin:StopLEVL�UH=Ph=P�=P�= win:Criticalwin:Errorwin:Warning(win:InformationalTASK������?�����?����@@����|@�����@����Ad����XAe�����Af�����Ag����Bh����dBi�����B������B����� C�����PC�����|C������C������C0AppModelProcessStartHAppIntegrityDependencyGraphCheck<AppIntegrityProcessCreationHAppIntegrityInAppValidatePackageLAppModelDynamicPropertiesReadFailedHAppModelDynamicPropertiesInvalidDRestrictedAppContainerCreationDRestrictedAppContainerDeletion<RestrictedAppContainerOpenHRestrictedAppContainerEnumeration@RestrictedAppContainerLaunchLRestrictedAppContainerTerminateAll0AppContainerCreation0AppContainerDeletion,AppContainerUpdate@FirewallAppContainerCreation@FirewallAppContainerDeletionXRestrictedAppContainerUpdateCapabilitiesKEYW8�D�D�D E ����PE@����pEProcess AppContainer,DesktopAppXProcess0DesktopAppXContainer ms:Telemetryms:MeasuresEVNT@��<=p]��@ �@�$=t]�@ �@�$=|]�@ �@�$=�]�@ �@�$=�]�@ �@�$=�]� �@�$=�]� ��$=�]�		�	�$=�]�� ��0=�]� ��0=�]� ���$=�]� ��$=�]� ���$=�]� ���$=�]� �(	$=�]� ��
$=�]�@ �@�$=�]�@ ��$=�]� ��$=�]� ��$=�]� ��$=�]� ��$=�]� ��$=�]� ��$=�]� ��$=�]� ��$=�]� ��$=�]� ��$=�]�   ��$=^�! !��$=^�" "��$=^�# #��$=^�$ $��$=^�% %��$=^�& &��$=^�' '��<=^�( (��<= ^�) )��<=$^�* *��<=(^�+ +��$=,^�, ,��$=0^�- -��$=4^�. .��$=8^�/ /��$=<^�0 0��$=@^�1 1��$=D^�2 2��$=H^�3 3��$=L^�4 4��$=P^�5 5��<=T^�6 6��$=X^�7 7��$=\^�8 8��<=`^�9 9�d$=d^�: :�d$=h^�; ;�d$=l^�< <��$=p^�=@ =�@�$=t^�> >�d$=|^�? ?��$=�^�@ @��$=�^�A A�$=�^�B B�L $=�^�C C��!$=�^�D D�8$<=�^�E E�&$=�^�F F��(<=�^�G G��*$=�^�HH�<=�^�I I�@�$=�^�J J�$=�^�K K��
$=�^�L L�D$=�^�M M�H$=�^�N N�L$=�^�O  O�P=�^�P  P�P$=�^�e�e���<<= ?�^$�f�f���<<= ?�^$�g�g���<<=<?�^$�h�h���<<=<?�^$�i�i���<<=X?�^$�j�j���<<=X?�^$�k�k���<<=t?�^$�l�l���<<=t?�^$�m�m���<<=�?�^$�n�n���<<=�?�^$�odo���<<=x>�^$�pdp���<<=x>�^$�qeq���<<=�>_$�rer���<<=�>_$�sfs���<<=�>_$�tft���<<=�>_$�ugu���<<=�>_$�vgv���<<=�>_$�whw���<<=�>_$�xhx���<<=�>_$�yiy���<<=? _$�ziz���<<=?$_$�{{���<<=�=(_$�||�d�<<=�=,_$�}}���<<=>0_$�~~�d�<<=>4_$����<<=$>8_$����d�<<=$><_$�������<<=t?@_$�������<<=�?D_$�������<<=�?H_$�� ��,<=L_�� ���.$=P_�� ���.$=T_�� ���.$=X_�� ���.$=\_�� ���.$=`_�� ���.$=d_�� ���.$=h_�� ���.$=l_�� ��@1<=p_�� ��3<=t_�� ���4$=x_�� ���6$=|_�� ���6$=�_�� ���6$=�_�� ���6$=�_�� ���8<=�_�� ���9<=�_�`D`D�D`D�D`D�D`D�D`D�D`D`D`D`D`D`D`D`D`D`D`D`D�DpD�DpDpDpDpDpDpDpDpDpDpDpDpDpDpDpDpDpDpDpDpDpD`D`D`D`D`D`D`D`D`D`D`D`D`D`D`D`D`D`D`D�D`D`D`D`D`D`D`D`D`D`D`D`D`D`D`D`D`D`D�D`D�DpDpDpDpDpDpDpDpDpDpDpDpDpDpDpDpDpDpDpDpDpDpD`D`D`D`D`D`DpDpDpD�D�D�D�D�D�D�D�D�D�D�D�D�D�D�D�D�D�DWEVT?��_�`
�k�k<l�lP���CHAN `	�<`��`�ApplicationTMicrosoft-Windows-AppModel-State/Debug\Microsoft-Windows-AppModel-State/DiagnosticTTBL�
TEMP��a!��5�"0W�
P�څ���rD�	EventDataA��Q�oData9K�NameInformationalString
�a,InformationalStringTEMP(�bv��(8\�$������D�	EventDataA��A�oData)K�NameErrorString
A��5�oDataK�NameError
�b�bErrorStringErrorTEMP�(d����br�RiM1$U�����D�	EventDataA��C�oData+K�NameFolderString
A��E�oData-K�Name
PackageString
A��5�oDataK�NameError
dd�d�d FolderString PackageStringErrorTEMP��ep���p[&Xp�� T�����D�	EventDataA��E�oData-K�Name
PackageString
A��9�oData!K�NameUserSid
A��5�oDataK�NameError
f(f<f PackageStringUserSidErrorTEMP�xgv��k�T�l/�;c���D�	EventDataA��=�oData%K�Name	Operation
A��E�oData-K�Name
PackageFamily
A��G�oData/K�NameOperationError
�g�g�gOperation PackageFamily$OperationErrorTEMP\�ihyVb��X\x�5y�f/��ND�	EventDataA��=�oData%K�Name	Operation
A��E�oData-K�Name
PackageFamily
A��G�oData/K�NameOperationError
A��O�oData7K�NameRepairTriggerError
�i�ij@jOperation PackageFamily$OperationError,RepairTriggerErrorTEMP$<k�mQ�5�Qj�8!~��C���D�	EventDataA��?�oData'K�Name
FolderPath
A��5�oDataK�NameError
dk�kFolderPathErrorPRVAX�kMicrosoft-Windows-AppModel-StateOPCOT2l2$lwin:Startwin:StopLEVL�PllP�lP�lwin:Errorwin:Warning(win:InformationalTASK�+�����q�����q����r����\r�����r����s����Ts�����sd�����se����Htf�����tg����4uh�����ui����8vj�����vk����Xwl�����wm����pxn�����xo�����yp����zq�����zr����H{s�����{t����l|u����}v�����}w����(~x�����~y����Lz�����{����l�|������}������~����������������(�������������@������̄�����$�������������܅HAppModel.Task.State.WriteSettingDAppModel.Task.State.ReadSettingHAppModel.Task.State.DeleteSettingTAppModel.Task.State.WriteSettingInAtomPAppModel.Task.State.ReadSettingInAtomTAppModel.Task.State.DeleteSettingInAtomDAppModel.Task.State.CommitAtomDAppModel.Task.State.LoadAppHivelAppModel.Task.StateWinRT.AppDataFactory_ActivationtAppModel.Task.StateWinRT.ApplicationDataServer_LifespanxAppModel.Task.StateWinRT.ApplicationDataServer_GetVersionxAppModel.Task.StateWinRT.ApplicationDataServer_SetVersion�AppModel.Task.StateWinRT.ApplicationDataServer_RoamingStorageQuota�AppModel.Task.StateWinRT.ApplicationDataServer_RoamingStorageUsage�AppModel.Task.StateWinRT.ApplicationDataServer_ActivateContainerServer�AppModel.Task.StateWinRT.ApplicationDataServer_ActivateFileItemServer�AppModel.Task.StateWinRT.ApplicationDataContainerServer_Lifespan�AppModel.Task.StateWinRT.ApplicationDataContainerServer_GetValues�AppModel.Task.StateWinRT.ApplicationDataContainerServer_GetContainers�AppModel.Task.StateWinRT.ApplicationDataContainerServer_CreateContainer�AppModel.Task.StateWinRT.ApplicationDataContainerServer_DeleteContainer�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Lifespan�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Lookup�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Size�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_HasKey�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_GetView�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Insert�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Remove�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Clear�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_First�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Lifespan�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Lookup�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Size�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_HasKey�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_GetView�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Insert�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Remove�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Clear�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_FirstXAppModel.Task.StateWinRT.RoamingRpcSignalhAppModel.Task.StateWinRT.DataChangedEventDispatchPAppModel.Task.StateWinRT.TempCleanuptAppModel.Task.StateWinRT.ApplicationDataServer_ForUserKEYWT̆��,�H� X�1|�Structured(UnstructuredResetOutOfMemoryApiSetErrorWinRT$DataStoreError(win:ResponseTimeEVNTl@��a`l��`@��a`l��`@�Hl�`@��aHl�` @��aHl�`@�`l`@�`l`@��aHl`	@	�Hl`
	�
�aHl�_	��aHl�_	��aHl�_
	�
cHl�_@��d`l`@��d`l`@��d`l`@��d`l`@��``l`@��aHl`	�LfTl�_	�hTl�_	�ljTl�_	�LfTl�_	�hTl�_2 �����k`l�l�`3 ����l`l�l�`< �����k`l�l�`= ����l`l�l$�`F �����k`lm,�`G ����l`lm4�`P �����k`l(m<�`Q ����l`l(mD�`Z �����k`lDmL�`[ ����l`lDmT�`d �����k`l`m\�`e ����l`l`md�`n �����k`l|ml�`o ����l`l|mt�`x �����k`l�m|�`y ����l`l�m��`�d �����k`l�m��`�d ����l`l�m��`�e �����k`l�m��`�e ����l`l�m��`�f �����k`l�m��`�f ����l`l�m��`�g �����k`ln��`�g ����l`lnĜ`�h �����k`l$n̜`�h ����l`l$nԜ`�j �����k`l\nܜ`�j ����l`l\n�`�k �����k`lxn�`�k ����l`lxn�`�l �����k`l�n��`�l ����l`l�n�`�m �����k`l�n�`�m ����l`l�n�`�n �����k`l�n�`�n ����l`l�n$�`o �����k`l�n,�`o ����l`l�n4�`p �����k`lo<�`p ����l`loD�`q �����k`l oL�`q ����l`l oT�`"r �����k`l<o\�`#r ����l`l<od�`,s �����k`lXol�`-s ����l`lXot�`6t �����k`lto|�`7t ����l`lto��`@u �����k`l�o��`Au ����l`l�o��`Jv �����k`l�o��`Kv ����l`l�o��`Tw �����k`l�o��`Uw ����l`l�o��`^x �����k`l�o��`_x ����l`l�oĝ`hy �����k`lp̝`iy ����l`lpԝ`rz �����k`lpܝ`sz ����l`lp�`|{ �����k`l8p�`}{ ����l`l8p�`�| �����k`lTp��`�| ����l`lTp�`�} �����k`lpp�`�} ����l`lpp�`�~ �����k`l�p�`�~ ����l`l�p$�`� �����k`l�p,�`� ����l`l�p4�`�� �����k`l�p<�`�� ����l`l�pD�`�� �����k`l�pL�`�� ����l`l�pT�`�� �����k`l�p\�`�� ����l`l�pd�`�� �����k`lql�`�� ����l`lqt�`�� �����k`l4q|�`�� ����l`l4q��`�� �����k`lPq��`�� ����l`lPq��`�� �����k`llq��`�� ����l`llq��`l�l�|�����\���\���\���\���\���\���\���\���\���\���\���\���\���\���\���\�����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������WEVTl�
�p�|���ȟ؟PRVA��Microsoft-Windows-Kernel-WSService-StartServiceTriggerOPCOLEVL@P��(win:InformationalTASKKEYWEVNT@������WEVT��	p����
8�����������CHAN������TMicrosoft-Windows-Kernel-IO/OperationalSystemMAPS��VMAP4H�����@IoMgrDmpEncryptionFailureMapTTBL�TEMP����~�b?P��\�X^����D�	EventDataA��?�oData'K�Name
VolumeGuid
A��K�oData3K�NameVolumeNameLength
A��?�oData'K�Name
VolumeName
���@�VolumeGuid(VolumeNameLengthVolumeNameTEMP(Ĥ3n�d���TX�¶?�,���4D�	EventDataA��?�oData'K�Name
VolumeGuid
A��K�oData3K�NameVolumeNameLength
A��?�oData'K�Name
VolumeName
A��5�oDataK�NameError
�0�X�t�VolumeGuid(VolumeNameLengthVolumeNameErrorTEMPTl�A���Ug���f����D�	EventDataA��K�oData3K�NameFilterNameLength
A��?�oData'K�Name
FilterName
����(FilterNameLengthFilterNameTEMPXX��E���]�y��9щw��JD�	EventDataA��K�oData3K�NameFilterNameLength
A��?�oData'K�Name
FilterName
A��K�oData3K�NameVolumeNameLength
A��?�oData'K�Name
VolumeName
��Ш��(FilterNameLengthFilterName(VolumeNameLengthVolumeNameTEMP�n��	Y�ώ)@b.����D�	EventDataA��a�oDataIK�NameDumpEncryptionFailureReason
���<DumpEncryptionFailureReasonPRVALL�Microsoft-Windows-Kernel-IOOPCOx1��2̪2�win:Infowin:Startwin:StopLEVL�P,�PD�P`�win:Errorwin:Warning(win:InformationalTASKKEYWEVNT0������ �|������� �|���\����|��@���������@�ئ������@�0������WEVT@L ���
ظ0��L�P�`�CHANx<�M\Microsoft-Windows-Kernel-LiveDump/AnalyticTTBL@TEMP�4�>c'�޽XS떂7�r���\D�	EventDataA��;�oData#K�NameNTStatus
H�NTStatusTEMPXd�E���*S\=Pu�����D�	EventDataA��q�oDataYK�Name#NtEstimatedRequiredPrimaryDataBytes

A��a�oDataIK�NameNtEstimatedPrimaryDataBytes

A��a�oDataIK�NameHvEstimatedPrimaryDataBytes

A��e�oDataMK�NameHvEstimatedSecondaryDataBytes



��

�

<�

x�LNtEstimatedRequiredPrimaryDataBytes<NtEstimatedPrimaryDataBytes<HvEstimatedPrimaryDataBytes@HvEstimatedSecondaryDataBytesTEMP�e����[�$`����� D�	EventDataA��O�oData7K�NameNtPrimaryDataBytes

A��O�oData7K�NameHvPrimaryDataBytes

A��S�oData;K�NameHvSecondaryDataBytes



H�

t�

��,NtPrimaryDataBytes,HvPrimaryDataBytes0HvSecondaryDataBytesTEMP���i:9��p�U�sn���Vg���D�	EventDataA��;�oData#K�NameNTStatus
A��?�oData'K�Name
TotalBytes

A��A�oData)K�NameHeaderBytes

A��K�oData3K�NamePrimaryDataBytes

A��O�oData7K�NameSecondaryDataBytes

��

�

0�

L�

t�NTStatusTotalBytesHeaderBytes(PrimaryDataBytes,SecondaryDataBytesTEMP�D��8 Q��C�Y�]���pD�	EventDataA��O�oData7K�NameCallbackIdentifier
X�,CallbackIdentifierTEMPTl�B|�SUY҂K$���+���D�	EventDataA��O�oData7K�NameCallbackIdentifier
A��;�oData#K�NameNTStatus
����,CallbackIdentifierNTStatusPRVAX�Microsoft-Windows-Kernel-LiveDumpOPCO�
c�d��e�
fH�g|�h��i̺j��k$�lL�mx�v��wȻ}�APIStartAPIEnd8WriteDumpDataToFileStart4WriteDumpDataToFileEnd$MirroringStart,MirroringPhase0End,MirroringPhase1End,SystemQuiesceStart(SystemQuiesceEnd,PageBufferingStart(PageBufferingEnd(BufferEstimation(BufferAllocationRemovePagesLEVL@P$�(win:InformationalTASKN�O�P\�Q��R��8LIVEDUMP_TASK_CAPTURE_API@LIVEDUMP_TASK_SIZING_WORKFLOWPLIVEDUMP_TASK_CAPTURE_PAGES_WORKFLOWPLIVEDUMP_TASK_WRITE_DEFERRED_DATA_APITLIVEDUMP_TASK_DISCARD_DEFERRED_DATA_APIKEYWEVNT�
�_<��X�,��`��H��X�,��aT��X�,�
�bг`��X�,��~̹�X�,�e�Sl��t�,�f�Tx��t�,�g�U���t�,�h�V���t�,�i�W���t�,�j�t`����t�,�k�u��̹�t�,�l�xع�t�,�m�yع�t�,�n�z��ع�t�,�o�{��ع�t�,�p�|��ع�t�,���Xl����,���Yx����,���Z�����,���[�����,���\�����,���]�����,���^�����,��
�n<����,���o��H����,���pT����,��
�qг`����,��
�r<��ȼ,���s��H��ȼ,�WEVT0X�
��(�X�������TTBLhTEMP���I��,c_����v�N��`D�	EventDataA��?�oData'K�Name
ReturnCode
�ReturnCodeTEMPd��y�i,UTu�j������D�	EventDataA��S�oData;K�NameNotifyRoutineAddress
A��?�oData'K�Name
ReturnCode
@�p�0NotifyRoutineAddressReturnCodeTEMPLp�=�R�ӛT9����F���D�	EventDataA��I�oData1K�NameTargetProcessId
A��?�oData'K�Name
ReturnCode
����$TargetProcessIdReturnCodeTEMP��2�l�l9Q+Y�%�6����D�	EventDataA��I�oData1K�NameTargetProcessId
A��E�oData-K�Name
DesiredAccess
A��?�oData'K�Name
ReturnCode
D�h���$TargetProcessId DesiredAccessReturnCodeTEMPT$���v"�\�[�R=����JD�	EventDataA��I�oData1K�NameTargetProcessId
A��G�oData/K�NameTargetThreatId
A��E�oData-K�Name
DesiredAccess
A��?�oData'K�Name
ReturnCode
t�������$TargetProcessId$TargetThreatId DesiredAccessReturnCodeTEMP<���(�FG�\�\9����I���D�	EventDataA��?�oData'K�Name
DriverName
A��?�oData'K�Name
ReturnCode
���DriverNameReturnCodeTEMP<��(�FG�\�\9����I���D�	EventDataA��?�oData'K�Name
DriverName
A��?�oData'K�Name
ReturnCode
8�T�DriverNameReturnCodeTEMPP��NV���]ۏ�WD�{��HD�	EventDataA��G�oData/K�NameLinkSourceName
A��G�oData/K�NameLinkTargetName
A��E�oData-K�Name
DesiredAccess
A��?�oData'K�Name
ReturnCode
<�`�����$LinkSourceName$LinkTargetName DesiredAccessReturnCodePRVAh��Microsoft-Windows-Kernel-Audit-API-CallsOPCO01@�win:InfoLEVL@Pp�(win:InformationalTASKKEYWEVNT�����(�4�d�������4�d�����p�4�d�����d�4�d�������4�d�������4�d�������4�d�����4�4�d�WEVT0x����
8����������CHAN\��	����ApplicationSystemTTBLLTEMP@��-�v6R�^l/{/!�I���D�	EventDataA��5�oDataK�NameCVEID
A��M�oData5K�NameAdditionalDetails
��CVEID(AdditionalDetailsPRVALL�Microsoft-Windows-Audit-CVEOPCO01��win:InfoLEVL4P��win:WarningTASKKEYWEVNTp	���������@��������WEVT���
�������(�8�TTBL�TEMP�X�?~�v|�Uj��]�4���^D�	EventDataA��=�oData%K�Name	ErrorCode
l�ErrorCodePRVAX��Microsoft-Windows-User-DiagnosticOPCOLEVL4P�win:WarningTASKKEYWEVNT@��������WEVTh@��
��<�H�T�`�p�TTBL(TEMP����]@Zl�_k�3�8�2����D�	EventDataA��S�oData;K�NameHeapSnapshotInstance
A��S�oData;K�NameHeapSnapshotSequence
A��U�oData=K�NameHeapSnapshotBufferLen
A��O�oData7K�NameHeapSnapshotBuffer
���0�`�0HeapSnapshotInstance0HeapSnapshotSequence0HeapSnapshotBufferLen,HeapSnapshotBufferTEMP\x��@�
D�WP�+��;����D�	EventDataA��S�oData;K�NameHeapSnapshotInstance
A��=�oData%K�Name	TotalData
����0HeapSnapshotInstanceTotalDataPRVAT��Microsoft-Windows-Heap-SnapshotOPCOLEVLTASKKEYWEVNTpd�������������WEVT0Ul	8�0���
�&P'\'�'. .CHAN�d�m��nhMicrosoft-Windows-Security-Mitigations/KernelModedMicrosoft-Windows-Security-Mitigations/UserModeMAPS|@�VMAP,l����@RedirectionTrustPolicyTypeMapTTBL@GTEMP�`�!�^��[��I���`���tD�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
	A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
P�x������� �

X������P�t�(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLine(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTimeTEMPh
���2�4��oQlW�����D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
	A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��[�oDataCK�NameChildImagePathNameLength
A��O�oData7K�NameChildImagePathName

A��W�oData?K�NameChildCommandLineLength
A��K�oData3K�NameChildCommandLine
�� �<�t�����

�4�t������P�������(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLine(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime8ChildImagePathNameLength,ChildImagePathName4ChildCommandLineLength(ChildCommandLineTEMP4���O�	��X�s���Ɏ����D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��G�oData/K�NameTargetThreadId
A��W�oData?K�NameTargetThreadCreateTime
A��I�oData1K�NameImageNameLength
A��=�oData%K�Name	ImageName

�4�P������

��H�������,�(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection$TargetThreadId4TargetThreadCreateTime$ImageNameLengthImageNameTEMP`	�kh�
��U�P�	Q���\D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��G�oData/K�NameTargetThreadId
A��W�oData?K�NameTargetThreadCreateTime
A��W�oData?K�NameRequiredSignatureLevel
A��G�oData/K�NameSignatureLevel

A��I�oData1K�NameImageNameLength
A��=�oData%K�Name	ImageName
<X���

� P���Dh�(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection$TargetThreadId4TargetThreadCreateTime4RequiredSignatureLevel$SignatureLevel$ImageNameLengthImageNameTEMPX�H@9�^
��M|6����D�	EventDataA��9�oData!K�NameSubcode
A��A�oData)K�NameProcessPath
A��=�oData%K�Name	ProcessId
A��G�oData/K�NameModuleFullPath
A��?�oData'K�Name
ModuleBase
A��E�oData-K�Name
ModuleAddress
A��?�oData'K�Name
MemAddress
A��M�oData5K�NameMemModuleFullPath
A��E�oData-K�Name
MemModuleBase
A��9�oData!K�NameAPIName
	A��K�oData3K�NameProcessStartTime
A��;�oData#K�NameThreadId
H\x����	4	T	h	�	SubcodeProcessPathProcessId$ModuleFullPathModuleBase ModuleAddressMemAddress(MemModuleFullPath MemModuleBaseAPIName(ProcessStartTimeThreadIdTEMP@|
&R��Tv)b�s�E���D�	EventDataA��9�oData!K�NameSubcode
A��A�oData)K�NameProcessPath
A��=�oData%K�Name	ProcessId
A��=�oData%K�Name	HookedAPI
A��E�oData-K�Name
ReturnAddress
A��E�oData-K�Name
CalledAddress
A��E�oData-K�Name
TargetAddress
A��C�oData+K�NameStackAddress
A��C�oData+K�NameFrameAddress
A��a�oDataIK�NameReturnAddressModuleFullPath
	A��K�oData3K�NameProcessStartTime
A��;�oData#K�NameThreadId
l�����,Ll��SubcodeProcessPathProcessIdHookedAPI ReturnAddress CalledAddress TargetAddress StackAddress FrameAddress<ReturnAddressModuleFullPath(ProcessStartTimeThreadIdTEMP..����kgW�Q�(�
ozS���
D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��I�oData1K�NameRedirectionType
A��Q�oData9K�NameOperationPathLength
A��E�oData-K�Name
OperationPath
A��E�oData-K�Name
Impersonating


A��9�oData!K�NameModule1
A��E�oData-K�Name
Module1Offset

A��9�oData!K�NameModule2
A��E�oData-K�Name
Module2Offset

A��9�oData!K�NameModule3
A��E�oData-K�Name
Module3Offset

A��9�oData!K�NameModule4
A��E�oData-K�Name
Module4Offset

A��9�oData!K�NameModule5
A��E�oData-K�Name
Module5Offset

A��9�oData!K�NameModule6
A��E�oData-K�Name
Module6Offset

A��9�oData!K�NameModule7
A��E�oData-K�Name
Module7Offset

A��9�oData!K�NameModule8
A��E�oData-K�Name
Module8Offset

A��9�oData!K�NameModule9
A��E�oData-K�Name
Module9Offset

A��;�oData#K�NameModule10
 A��G�oData/K�NameModule10Offset
!
A��;�oData#K�NameModule11
"A��G�oData/K�NameModule11Offset
#
A��;�oData#K�NameModule12
$A��G�oData/K�NameModule12Offset
%
A��;�oData#K�NameModule13
&A��G�oData/K�NameModule13Offset
'
A��;�oData#K�NameModule14
(A��G�oData/K�NameModule14Offset
)
A��;�oData#K�NameModule15
*A��G�oData/K�NameModule15Offset
+
A��;�oData#K�NameModule16
,A��G�oData/K�NameModule16Offset
-
@!h!�!�!�!"

("L"|"�"@��"#4#

T#t#

�#�#

�#�#

�#$

$$D$

X$x$

�$�$

�$�$

�$%

(%H%

`%�%

�%�%

�%�%

&8&

P&t&

�&�&

�&(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection$RedirectionType,OperationPathLength OperationPath ImpersonatingModule1 Module1OffsetModule2 Module2OffsetModule3 Module3OffsetModule4 Module4OffsetModule5 Module5OffsetModule6 Module6OffsetModule7 Module7OffsetModule8 Module8OffsetModule9 Module9OffsetModule10$Module10OffsetModule11$Module11OffsetModule12$Module12OffsetModule13$Module13OffsetModule14$Module14OffsetModule15$Module15OffsetModule16$Module16OffsetPRVAd'Microsoft-Windows-Security-MitigationsOPCOLEVLXP�'P�'win:Errorwin:WarningTASK\
����,)�����)����*����h*�����*����8+�����+����,	����l,
�����,����-����d-�����-`KERNEL_MITIGATION_TASK_PROHIBIT_DYNAMIC_CODEtKERNEL_MITIGATION_TASK_PROHIBIT_CHILD_PROCESS_CREATIONhKERNEL_MITIGATION_TASK_PROHIBIT_REMOTE_IMAGE_MAPdKERNEL_MITIGATION_TASK_PROHIBIT_LOWIL_IMAGE_MAPlKERNEL_MITIGATION_TASK_PROHIBIT_WIN32K_SYSTEM_CALLStKERNEL_MITIGATION_TASK_PROHIBIT_NON_MICROSOFT_BINARIES\USER_MITIGATION_TASK_EXPORT_ADDRESS_FILTERdUSER_MITIGATION_TASK_EXPORT_ADDRESS_FILTER_PLUS\USER_MITIGATION_TASK_IMPORT_ADDRESS_FILTERLUSER_MITIGATION_TASK_ROP_STACKPIVOTPUSER_MITIGATION_TASK_ROP_CALLERCHECKHUSER_MITIGATION_TASK_ROP_SIMEXECdKERNEL_MITIGATION_TASK_REDIRECTION_TRUST_POLICYKEYWEVNT��o���'D��p��t'�'D��q���'D��r��t'�'D��s�(D��t�t'(D��u���'D��v��t'�'D�	�w��0(D�
�x��t'0(D��yD�L(D��zD�t'L(D�
@{�h(T�@|�t'h(T�@{��(T�@|�t'�(T�	@}��(T�	@~�t'�(T�
@�	�(T�
@��	t'�(T�@�	�(T�@��	t'�(T�@�	�(T�@��	t'�(T����t')D� ���h')D�WEVTP��`3�3
X�������CHAN�|3����dMicrosoft-Windows-Threat-Intelligence/AnalyticTTBLx|TEMP�=�@���%NX�{�{z����D�	EventDataA��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
A��Y�oDataAK�NameTargetProcessCreateTime
	A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel
A��Y�oDataAK�NameTargetProcessProtection

A��M�oData5K�NameOriginalProcessId
A��]�oDataEK�NameOriginalProcessCreateTime
A��Y�oDataAK�NameOriginalProcessStartKey

A��e�oDataMK�NameOriginalProcessSignatureLevel
A��s�oData[K�Name$OriginalProcessSectionSignatureLevel
A��]�oDataEK�NameOriginalProcessProtection
A��A�oData)K�NameBaseAddress
A��?�oData'K�Name
RegionSize
A��G�oData/K�NameAllocationType
A��G�oData/K�NameProtectionMask
�> ?

X?�?�?@P@t@�@�@

A0AlA�A�AB

LB�B�BCHCdC�C�C(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtection(OriginalProcessId8OriginalProcessCreateTime4OriginalProcessStartKey@OriginalProcessSignatureLevelPOriginalProcessSectionSignatureLevel8OriginalProcessProtectionBaseAddressRegionSize$AllocationType$ProtectionMaskTEMP��L�vPɡ$BS�-�Ա����D�	EventDataA��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
A��Y�oDataAK�NameTargetProcessCreateTime
	A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel
A��Y�oDataAK�NameTargetProcessProtection

A��M�oData5K�NameOriginalProcessId
A��]�oDataEK�NameOriginalProcessCreateTime
A��Y�oDataAK�NameOriginalProcessStartKey

A��e�oDataMK�NameOriginalProcessSignatureLevel
A��s�oData[K�Name$OriginalProcessSectionSignatureLevel
A��]�oDataEK�NameOriginalProcessProtection
A��A�oData)K�NameBaseAddress
A��?�oData'K�Name
RegionSize
A��G�oData/K�NameProtectionMask
A��O�oData7K�NameLastProtectionMask
�NO

<OpO�O�O4PXP�P�P

�PQPQ�Q�Q�Q

0RdR�R�R,SHSdS�S(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtection(OriginalProcessId8OriginalProcessCreateTime4OriginalProcessStartKey@OriginalProcessSignatureLevelPOriginalProcessSectionSignatureLevel8OriginalProcessProtectionBaseAddressRegionSize$ProtectionMask,LastProtectionMaskTEMP�xZ��Wf�U�
%�X|����D�	EventDataA��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
A��Y�oDataAK�NameTargetProcessCreateTime
	A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel
A��Y�oDataAK�NameTargetProcessProtection

A��A�oData)K�NameBaseAddress
A��;�oData#K�NameViewSize
A��G�oData/K�NameAllocationType
A��G�oData/K�NameProtectionMask
�[\

@\t\�\]8]\]�]�]

�]^T^�^�^�^_,_(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtectionBaseAddressViewSize$AllocationType$ProtectionMaskTEMP�**Ho���AoXU�]�:�3���D�	EventDataA��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
A��Y�oDataAK�NameTargetProcessCreateTime
	A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel
A��Y�oDataAK�NameTargetProcessProtection

A��G�oData/K�NameTargetThreadId
A��W�oData?K�NameTargetThreadCreateTime
A��M�oData5K�NameOriginalProcessId
A��]�oDataEK�NameOriginalProcessCreateTime
A��Y�oDataAK�NameOriginalProcessStartKey

A��e�oDataMK�NameOriginalProcessSignatureLevel
A��s�oData[K�Name$OriginalProcessSectionSignatureLevel
A��]�oDataEK�NameOriginalProcessProtection
A��U�oData=K�NameTargetThreadAlertable
A��?�oData'K�Name
ApcRoutine
A��C�oData+K�NameApcArgument1
A��C�oData+K�NameApcArgument2
A��C�oData+K�NameApcArgument3
A��E�oData-K�Name
RealEventTime
A��[�oDataCK�NameApcRoutineVadQueryResult
A��a�oDataIK�NameApcRoutineVadAllocationBase
A��g�oDataOK�NameApcRoutineVadAllocationProtect
A��Y�oDataAK�NameApcRoutineVadRegionType
A��Y�oDataAK�NameApcRoutineVadRegionSize
 A��Y�oDataAK�NameApcRoutineVadCommitSize
!A��S�oData;K�NameApcRoutineVadMmfName
"A��_�oDataGK�NameApcArgument1VadQueryResult
#A��e�oDataMK�NameApcArgument1VadAllocationBase
$A��k�oDataSK�Name ApcArgument1VadAllocationProtect
%A��]�oDataEK�NameApcArgument1VadRegionType
&A��]�oDataEK�NameApcArgument1VadRegionSize
'A��]�oDataEK�NameApcArgument1VadCommitSize
(A��W�oData?K�NameApcArgument1VadMmfName
)�r�r

�r$sds�s�st@tdt

�t�tuPu�u�u�uv

<vpv�vw8whw�w�w�w�wx<xxx�x�x$yXy�y�yzLz�z�z�z(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtection$TargetThreadId4TargetThreadCreateTime(OriginalProcessId8OriginalProcessCreateTime4OriginalProcessStartKey@OriginalProcessSignatureLevelPOriginalProcessSectionSignatureLevel8OriginalProcessProtection0TargetThreadAlertableApcRoutine ApcArgument1 ApcArgument2 ApcArgument3 RealEventTime8ApcRoutineVadQueryResult<ApcRoutineVadAllocationBaseDApcRoutineVadAllocationProtect4ApcRoutineVadRegionType4ApcRoutineVadRegionSize4ApcRoutineVadCommitSize0ApcRoutineVadMmfName<ApcArgument1VadQueryResult@ApcArgument1VadAllocationBaseHApcArgument1VadAllocationProtect8ApcArgument1VadRegionType8ApcArgument1VadRegionSize8ApcArgument1VadCommitSize4ApcArgument1VadMmfNameTEMPx&&<�	�a�' �TH�SUZ'����D�	EventDataA��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
A��Y�oDataAK�NameTargetProcessCreateTime
	A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel
A��Y�oDataAK�NameTargetProcessProtection

A��G�oData/K�NameTargetThreadId
A��W�oData?K�NameTargetThreadCreateTime
A��C�oData+K�NameContextFlags
A��A�oData)K�NameContextMask
A��/�oDataK�NamePc
A��/�oDataK�NameSp
A��/�oDataK�NameLr
A��/�oDataK�NameFp
A��3�oDataK�NameReg0
A��3�oDataK�NameReg1
A��3�oDataK�NameReg2
A��3�oDataK�NameReg3
A��3�oDataK�NameReg4
A��3�oDataK�NameReg5
A��3�oDataK�NameReg6
A��3�oDataK�NameReg7
A��E�oData-K�Name
RealEventTime
A��K�oData3K�NamePcVadQueryResult
A��Q�oData9K�NamePcVadAllocationBase
 A��W�oData?K�NamePcVadAllocationProtect
!A��I�oData1K�NamePcVadRegionType
"A��I�oData1K�NamePcVadRegionSize
#A��I�oData1K�NamePcVadCommitSize
$A��C�oData+K�NamePcVadMmfName
%4�\�

��Ȋ�T�������

<�l����(�L�������ȍԍ������,�<�L�\�l�������8�\���(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtection$TargetThreadId4TargetThreadCreateTime ContextFlagsContextMaskPcSpLrFpReg0Reg1Reg2Reg3Reg4Reg5Reg6Reg7 RealEventTime(PcVadQueryResult,PcVadAllocationBase4PcVadAllocationProtect$PcVadRegionType$PcVadRegionSize$PcVadCommitSize PcVadMmfNameTEMP$ �Rӹ���Z8&1�dYJ��JD�	EventDataA��I�oData1K�NameOperationStatus
A��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
	A��Y�oDataAK�NameTargetProcessCreateTime
A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel

A��Y�oDataAK�NameTargetProcessProtection
A��A�oData)K�NameBaseAddress
A��A�oData)K�NameBytesCopied
t�����

��,�l�����H�l�

��Й�X�����$OperationStatus(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtectionBaseAddressBytesCopiedTEMP``��&�-.�+U���~	��fD�	EventDataA��I�oData1K�NameOperationStatus
A��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
	A��Y�oDataAK�NameTargetProcessCreateTime
A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel

A��Y�oDataAK�NameTargetProcessProtection
A��G�oData/K�NameTargetThreadId
A��W�oData?K�NameTargetThreadCreateTime
��آ�

8�l�����0�T�����

��L���̥�$OperationStatus(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtection$TargetThreadId4TargetThreadCreateTimeTEMP4
�Ɯڙs�T��9��O���D�	EventDataA��I�oData1K�NameOperationStatus
A��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
	A��Y�oDataAK�NameTargetProcessCreateTime
A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel

A��Y�oDataAK�NameTargetProcessProtection
@�d���

ĭ��8�������8�

l���د$�$OperationStatus(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtectionPRVA`l�Microsoft-Windows-Threat-IntelligenceOPCOLEVL@Pܰ(win:InformationalTASK�	���������L�����������в���������p������������	����L�@KERNEL_THREATINT_TASK_ALLOCVMDKERNEL_THREATINT_TASK_PROTECTVM@KERNEL_THREATINT_TASK_MAPVIEWLKERNEL_THREATINT_TASK_QUEUEUSERAPCTKERNEL_THREATINT_TASK_SETTHREADCONTEXT@KERNEL_THREATINT_TASK_READVM@KERNEL_THREATINT_TASK_WRITEVM\KERNEL_THREATINT_TASK_SUSPENDRESUME_THREAD\KERNEL_THREATINT_TASK_SUSPENDRESUME_PROCESSKEYW\
���������������X������������ ����t�@����������@����������������x�����̺����<� ������@���������������������T�����������������P� ������@�����������P�����������������H������������ ������TKERNEL_THREATINT_KEYWORD_ALLOCVM_LOCALpKERNEL_THREATINT_KEYWORD_ALLOCVM_LOCAL_KERNEL_CALLERTKERNEL_THREATINT_KEYWORD_ALLOCVM_REMOTEpKERNEL_THREATINT_KEYWORD_ALLOCVM_REMOTE_KERNEL_CALLERXKERNEL_THREATINT_KEYWORD_PROTECTVM_LOCALtKERNEL_THREATINT_KEYWORD_PROTECTVM_LOCAL_KERNEL_CALLERXKERNEL_THREATINT_KEYWORD_PROTECTVM_REMOTEtKERNEL_THREATINT_KEYWORD_PROTECTVM_REMOTE_KERNEL_CALLERTKERNEL_THREATINT_KEYWORD_MAPVIEW_LOCALpKERNEL_THREATINT_KEYWORD_MAPVIEW_LOCAL_KERNEL_CALLERTKERNEL_THREATINT_KEYWORD_MAPVIEW_REMOTEpKERNEL_THREATINT_KEYWORD_MAPVIEW_REMOTE_KERNEL_CALLER`KERNEL_THREATINT_KEYWORD_QUEUEUSERAPC_REMOTE|KERNEL_THREATINT_KEYWORD_QUEUEUSERAPC_REMOTE_KERNEL_CALLERhKERNEL_THREATINT_KEYWORD_SETTHREADCONTEXT_REMOTE�KERNEL_THREATINT_KEYWORD_SETTHREADCONTEXT_REMOTE_KERNEL_CALLERPKERNEL_THREATINT_KEYWORD_READVM_LOCALTKERNEL_THREATINT_KEYWORD_READVM_REMOTETKERNEL_THREATINT_KEYWORD_WRITEVM_LOCALTKERNEL_THREATINT_KEYWORD_WRITEVM_REMOTETKERNEL_THREATINT_KEYWORD_SUSPEND_THREADTKERNEL_THREATINT_KEYWORD_RESUME_THREADXKERNEL_THREATINT_KEYWORD_SUSPEND_PROCESSTKERNEL_THREATINT_KEYWORD_RESUME_PROCESSTKERNEL_THREATINT_KEYWORD_FREEZE_PROCESSPKERNEL_THREATINT_KEYWORD_THAW_PROCESSTKERNEL_THREATINT_KEYWORD_CONTEXT_PARSEpKERNEL_THREATINT_KEYWORD_EXECUTION_ADDRESS_VAD_PROBExKERNEL_THREATINT_KEYWORD_EXECUTION_ADDRESS_MMF_NAME_PROBE�KERNEL_THREATINT_KEYWORD_READWRITEVM_NO_SIGNATURE_RESTRICTIONEVNTX������3а���l3@������Cа,���l3������SаH��l3�����P_аd��l3@�����({а���l3������3а��l3������Cа,��l3������SаH��l3�������а���l3�������а���l3
�������а�� �l3�������а��$�l3�����ĚаԱ(�l3 �����ĚаԱ,�l3	@�����$�а�0�l3	������$�а�4�l3	�����$�а�8�l3	�����$�а�<�l3������3а�@�l3�������Cа,�D�l3������SаH�H�l3 �����P_аd�L�l3������({а��P�l3������3а�T�l3 ������Cа,�X�l3������SаH�\�l3Դ�T�t������4���Եĵ����$�4�D��$�d�����Ĵ�D������q�ČR�
��O�PO .�ĀV9m	?��*����WEVT_TEMPLATEMUIMUIen-US

Youez - 2016 - github.com/yon3zu
LinuXploit