????

Your IP : 18.118.226.34


Current Path : C:/Windows/System32/
Upload File :
Current File : C:/Windows/System32/microsoft-windows-system-events.dll

MZ����@���	�!�L�!This program cannot be run in DOS mode.

$��<߱�R���R���R�U�����R�U�P���R�Rich��R�PEd��`>�" 	�


	C<	`A (�	&T.rdata�@@.rsrc(� � @@�`>
TTT�`>$���`>��T.rdataT|.rdata$zzzdbg .rsrc$01!�.rsrc$02 �x�8�P�+��M��4)��1����ޏ`>�(���@�X�p�����	�	�	�@	�0%
�! 
WEVT_TEMPLATEMUI4VS_VERSION_INFO��
{
|O
{
|O?|StringFileInfoX040904B0LCompanyNameMicrosoft Corporation|*FileDescriptionMicrosoft-Windows-System-Events Resourcesn'FileVersion10.0.20348.3451 (WinBuild.160101.0800)h$InternalNamemicrosoft-windows-system-events.dll�.LegalCopyright� Microsoft Corporation. All rights reserved.p$OriginalFilenamemicrosoft-windows-system-events.dllj%ProductNameMicrosoft� Windows� Operating SystemDProductVersion10.0.20348.3451DVarFileInfo$Translation	�CRIM�,���/��G�!D?8�4�����O�צ���]�!�,�"{+B��/���X�O�p�sO�Q3�=T����c�#w[H���V]s]J�B?�Y�F�K��B�����@�7v��PY0J���~�W4�h�"S���K�����D��i�U�?�F�M<n(-�U�=bi!�{�s[�Ŋ�Su���?���EJFTzؤ��7C�<&�1�M�9�ST�F��)}��@�CH�3UHDI��:��E��4V�^�Q�����L���)j��0pi��jT��N�O��a�.�tw���;��@����a��.��`:�m�@ZD�ʙ5�PF��������� �f��I*�})S2H��C�y:��������wA��(:�RRq��7�u���HF����M<����D�zM�K��	��^S�.'���ĜeN�p�V�‰�w�C����D�����/�X��v��z�5F��I�ct�t��C��1D�A�u�e�G0��>����EO�C�E�l�����`{MK�f�/e��@p,ڊR�_�O��]�(a�b���B��J���;?&�hd
'��2
RC�R۫A��Y�g^񿿁�E�|��چ����56�wuC�$�E��7����P.�K��INo
�8���́���^�a�p�<&�*�u�O�Ȯ	ϛ#v
*��~_H�Ot�(q��@�{�_0*&^җ`"0ʜp��*��O�F�Sd^G�x����J���M�<��|���]�hV��M��D*)��9EM_45�cL����Trl�\�o��[��0�WEVTh��
�H�� CHAN0�\���PMicrosoft-Windows-Kernel-WDI/AnalyticLMicrosoft-Windows-Kernel-WDI/DebugXMicrosoft-Windows-Kernel-WDI/OperationalTTBL�
TEMP��p�iS�^(c`lg�ߜ���D�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
A��M�oData5K�NameDroppedEventCount
A��A�oData)K�NameActionCount
A��MZ�ComplexData'K�Name
SemActions
���� <Xh

���ProviderIDEventID(DroppedEventCountActionCountSemActionsProviderIDLevelReservedKeyword$EnablePropertyNTStatusTEMP,�	ڈ6MhY��F�㐍����D�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
�	�	ProviderIDEventIDTEMP���mx
[�GH kA����D�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
A��;�oData#K�NameNTStatus
Pl�ProviderIDEventIDNTStatusTEMP$
��kg��T�,�pt����VD�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
A��E�oData-K�Name
ScenarioCount
A��cZ�ComplexData=K�NameScenarioInflightItems
��
�
�
D`t�ProviderIDEventID ScenarioCount0ScenarioInflightItemsProviderIDEventIDReserved InflightCountTEMP,�ڈ6MhY��F�㐍����D�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
��ProviderIDEventIDTEMP�l�{�][�9�H�Nh��`D�	EventDataA��?�oData'K�Name
ProviderID
�ProviderIDTEMP����mx
[�GH kA����D�	EventDataA��?�oData'K�Name
ProviderID
A��9�oData!K�NameEventID
A��;�oData#K�NameNTStatus
� ProviderIDEventIDNTStatusTEMP�^�=y�T�[�L�g����D�	EventDataA��9�oData!K�NameSqmType
A��7�oDataK�NameSqmSid
,@SqmTypeSqmSidTEMPD�4H��5�Sp-	�#;��BD�	EventDataA��G�oData/K�NameSqmSessionGuid
A��5�oDataK�NameSqmID
A��9�oData!K�NameSqmType
A��W�oData?K�NameSqmDWORDDatapointValue
@Pd$SqmSessionGuidSqmIDSqmType4SqmDWORDDatapointValueTEMP``/�Z�>]�$�z�q!���D�	EventDataA��G�oData/K�NameSqmSessionGuid
A��5�oDataK�NameSqmID
A��9�oData!K�NameSqmType
A��O�oData7K�NameSqmStreamRowLength
A��QZ�ComplexData+K�NameSqmStreamRow
�$4Ht���$SqmSessionGuidSqmIDSqmType,SqmStreamRowLength SqmStreamRow SqmTypeEntry SqmDWORDEntry$SqmStringEntryPRVAPMicrosoft-Windows-Kernel-WDIOPCO<

0�0$0l

0�00h0�00\0�04LWDI_SEM_TASK_SCENARIO_OPCODE_STARTHWDI_SEM_TASK_SCENARIO_OPCODE_ENDPWDI_SEM_TASK_SCENARIO_OPCODE_TIMEOUTXWDI_SEM_TASK_SCENARIO_OPCODE_START_FAILEDTWDI_SEM_TASK_SCENARIO_OPCODE_END_FAILEDXWDI_SEM_TASK_SCENARIO_OPCODE_INFLIGHT_MAXLWDI_SEM_TASK_INIT_OPCODE_MISCONFIGPWDI_SEM_TASK_INIT_OPCODE_SCENARIO_MAXtWDI_SEM_TASK_INIT_OPCODE_SCENARIO_CONTEXT_PROVIDER_MAXdWDI_SEM_TASK_INIT_OPCODE_SCENARIO_END_EVENT_MAXPWDI_SEM_TASK_INIT_OPCODE_PROVIDER_MAXLEVL�P�P�P�win:Errorwin:Warning(win:InformationalTASK�		pT

p�0WDI_SEM_TASK_SCENARIO(WDI_SEM_TASK_INITKEYWt!�"�4contextdiagwin:SQMEVNT� 
	� �T��!�!	�!�`��!�"	�"��l��!�#	@#�����$
	@$��	x��%	@%��	���&
 &����8�'
 '����8�(
 (����8�)
 )����8�*
 *����8�+����8��!,����T��!-�������!������WEVTpd�	@"p"$$
�{|<|�|� �CHAN0\"�SystemMAPS��"�"�"VMAP4�#����VMAP$�#��VMAPL,#��	�
���
�dEx:LeapSecondDataParseFailure.FailureResultMapTEx:LeapSecondDataUpdate.UpdateReasonMap@Ex:SystemTimeChange.ReasonMapTTBL�WTEMP %��ۙ�}(V�X}�=����D�	EventDataA��9�oData!K�NameNewTime
A��9�oData!K�NameOldTime
(%<%NewTimeOldTimeTEMP�\&�xL��W�ְ�2_����D�	EventDataA��9�oData!K�NameNewTime
A��9�oData!K�NameOldTime
A��7�oDataK�NameReason
�&�&�"�&NewTimeOldTimeReasonTEMPll(���`�W�.��H�����dD�	EventDataA��9�oData!K�NameNewTime
A��9�oData!K�NameOldTime
A��7�oDataK�NameReason
A��A�oData)K�NameProcessName
A��=�oData%K�Name	ProcessID
�(�(�"�()()NewTimeOldTimeReasonProcessNameProcessIDTEMPP�))5�H7^A����d����D�	EventDataTEMP��*ݙ!=�YZ	�2:����D�	EventDataA��A�oData)K�NameFinalStatus
A��M�oData5K�NameExtraStringLength
A��A�oData)K�NameExtraString
++D+FinalStatus(ExtraStringLengthExtraStringTEMP��,ݙ!=�YZ	�2:����D�	EventDataA��A�oData)K�NameFinalStatus
A��M�oData5K�NameExtraStringLength
A��A�oData)K�NameExtraString
�,�,-FinalStatus(ExtraStringLengthExtraStringTEMP�/S"��F�Vַkܭy����D�	EventDataA��M�oData5K�NameExtraStringLength
A��A�oData)K�NameExtraString
A��3�oDataK�NameTmId
A��3�oDataK�NameRmId
A��7�oDataK�NameStatus
A��C�oData+K�NameInternalCode
�/�/�/�/�/0(ExtraStringLengthExtraStringTmIdRmIdStatus InternalCodeTEMP(�1�iC^s�Z<w��i����4D�	EventDataA��G�oData/K�NameHiveNameLength
A��;�oData#K�NameHiveName
A��C�oData+K�NameOriginalSize
A��9�oData!K�NameNewSize
�122<2$HiveNameLengthHiveName OriginalSizeNewSizeTEMP0�3�$3�]SW�=�v���8D�	EventDataA��G�oData/K�NameHiveNameLength
A��;�oData#K�NameHiveName
A��A�oData)K�NameKeysUpdated
A��?�oData'K�Name
DirtyPages
404H4d4$HiveNameLengthHiveNameKeysUpdatedDirtyPagesTEMP��6IS��Z%ZA��\��D�	EventDataA��C�oData+K�NameMajorVersion
A��C�oData+K�NameMinorVersion
A��C�oData+K�NameBuildVersion
A��?�oData'K�Name
QfeVersion
A��G�oData/K�NameServiceVersion
A��;�oData#K�NameBootMode
A��=�oData%K�Name	StartTime
T7t7�7�7�7�78 MajorVersion MinorVersion BuildVersionQfeVersion$ServiceVersionBootModeStartTimeTEMP��8zmU�b!A[Ф㸚�7��\D�	EventDataA��;�oData#K�NameStopTime
�8StopTimeTEMP�*$B�>���8U�
�؋����	D�	EventDataA��3�oDataK�NameMode
A��?�oData'K�Name
ObjectType
A��?�oData'K�Name
ObjectName
A��A�oData)K�NameProcessName
A��[�oDataCK�NameObjectCreatorProcessName
A��?�oData'K�Name
AccessMask
A��=�oData%K�Name	TokenType
A��O�oData7K�NameImpersonationLevel
A��=�oData%K�Name	SessionId
A��C�oData+K�NameLowBoxNumber
	A��K�oData3K�NameTokenGroupsCount
A��OZ�ComplexData)K�NameTokenGroups
�A��M�oData5K�NameTokenPackageCount
A��QZ�ComplexData+K�NameTokenPackage

�A��S�oData;K�NameTokenCapabilityCount
A��[Z�ComplexData5K�NameTokenCapabilities
�A��S�oData;K�NameTokenTrustLevelCount
A��WZ�ComplexData1K�NameTokenTrustLevel
�A��_�oDataGK�NameSecurityDescriptorRevision
A��]�oDataEK�NameSecurityDescriptorControl
A��Y�oDataAK�NameSecurityDescriptorOwner
A��Y�oDataAK�NameSecurityDescriptorGroup
A��C�oData+K�NameDaclRevision
A��C�oData+K�NameDaclAceCount
A��GZ�ComplexData!K�NameDaclAce
�A��C�oData+K�NameSaclRevision
A��C�oData+K�NameSaclAceCount
A��GZ�ComplexData!K�NameSaclAce
�lE|E�E�E�EF$F<FhF�F�F
�F�FG,G\G�G!�G�GHLH�H�H�H"�HI(I&HI\I�I�I�I�IJ$J8JPJlJxJ�J�J�JModeObjectTypeObjectNameProcessName8ObjectCreatorProcessNameAccessMaskTokenType,ImpersonationLevelSessionId LowBoxNumber(TokenGroupsCountTokenGroups(TokenPackageCount TokenPackage0TokenCapabilityCount(TokenCapabilities0TokenTrustLevelCount$TokenTrustLevel<SecurityDescriptorRevision8SecurityDescriptorControl4SecurityDescriptorOwner4SecurityDescriptorGroup DaclRevision DaclAceCountDaclAce SaclRevision SaclAceCountSaclAce$GroupAttributesGroupSidPackageSid0CapabilityAttributes CapabilitySid TrustLevelSidAceTypeAceFlagsAccessMaskSidAceTypeAceFlagsAccessMaskSidTEMP��O�(�J�S��1�Ol����D�	EventDataA��?�oData'K�Name
ActionName
A��A�oData)K�NameProcessName
A��A�oData)K�NameAccountName
A��E�oData-K�Name
AuthorityName
A��9�oData!K�NameTokenId
A��K�oData3K�NameAuthenticationId
A��=�oData%K�Name	TokenType
A��O�oData7K�NameImpersonationLevel
A��?�oData'K�Name
TokenFlags
A��Y�oDataAK�NameSidValuesReferenceCount
		A��G�oData/K�NameSidValuesCount
A��KZ�ComplexData%K�Name	SidValues
�A��e�oDataMK�NameSharedSidValuesReferenceCount
	A��S�oData;K�NameSharedSidValuesCount

A��WZ�ComplexData1K�NameSharedSidValues
�(QDQ`Q|Q�Q�Q�Q�QR		8RlR
�R		�R�R
S<SHSActionNameProcessNameAccountName AuthorityNameTokenId(AuthenticationIdTokenType,ImpersonationLevelTokenFlags4SidValuesReferenceCount$SidValuesCountSidValues@SharedSidValuesReferenceCount0SharedSidValuesCount$SharedSidValuesSidSidTEMP��Ta8vXZ-�.��U5��D�	EventDataA��Q�oData9K�NameTransitionStartTime
A��A�oData)K�NameCurrentTime
A��K�oData3K�NameSoftRestartCount
�T�TU,TransitionStartTimeCurrentTime(SoftRestartCountTEMP|�V� ��6�\��)������^D�	EventDataA��Q�oData9K�NameTransitionStartTime
A��A�oData)K�NameCurrentTime
A��K�oData3K�NameSoftRestartCount
A��K�oData3K�NameBugcheckRecovery

$WPWlW

�W,TransitionStartTimeCurrentTime(SoftRestartCount(BugcheckRecoveryTEMP@Z3�>ʬ�]qX?�o��PD�	EventDataA��E�oData-K�Name
MmPhase0Start

A��C�oData+K�NameMmPhase0Stop

A��A�oData)K�NamePhase1Start

A��M�oData5K�NameKsrExtensionStart

A��K�oData3K�NameKsrExtensionStop

A��S�oData;K�NameStartProcessorsStart

A��Q�oData9K�NameStartProcessorsStop



�Z

�Z

[

([

P[

x[

�[ MmPhase0Start MmPhase0StopPhase1Start(KsrExtensionStart(KsrExtensionStop0StartProcessorsStart,StartProcessorsStopTEMPH		_.]�7�<P���G����D�	EventDataA��E�oData-K�Name
MmPhase0Start

A��C�oData+K�NameMmPhase0Stop

A��A�oData)K�NamePhase1Start

A��M�oData5K�NameKsrExtensionStart

A��K�oData3K�NameKsrExtensionStop

A��S�oData;K�NameStartProcessorsStart

A��Q�oData9K�NameStartProcessorsStop

A��Q�oData9K�NameAutoLoggerInitStart

A��O�oData7K�NameAutoLoggerInitStop



�_

�_

�_

`

@`

h`

�`

�`

�` MmPhase0Start MmPhase0StopPhase1Start(KsrExtensionStart(KsrExtensionStop0StartProcessorsStart,StartProcessorsStop,AutoLoggerInitStart,AutoLoggerInitStopTEMP�

�e�����Sx1�?D����RD�	EventDataA��E�oData-K�Name
MmPhase0Start

A��C�oData+K�NameMmPhase0Stop

A��A�oData)K�NamePhase1Start

A��M�oData5K�NameKsrExtensionStart

A��K�oData3K�NameKsrExtensionStop

A��S�oData;K�NameStartProcessorsStart

A��Q�oData9K�NameStartProcessorsStop

A��Q�oData9K�NameAutoLoggerInitStart

A��O�oData7K�NameAutoLoggerInitStop

A��E�oData-K�Name
MmPhase1Start
	
A��C�oData+K�NameMmPhase1Stop

A��Y�oDataAK�NameHalPhase0StartCycleTime

A��W�oData?K�NameHalPhase0StopCycleTime



�f

�f

�f

g

,g

Tg

�g

�g

�g

h

(h

Hh

|h MmPhase0Start MmPhase0StopPhase1Start(KsrExtensionStart(KsrExtensionStop0StartProcessorsStart,StartProcessorsStop,AutoLoggerInitStart,AutoLoggerInitStop MmPhase1Start MmPhase1Stop4HalPhase0StartCycleTime4HalPhase0StopCycleTimeTEMP�tmc	�3�s]ѽ�6����D�	EventDataA��E�oData-K�Name
MmPhase0Start

A��C�oData+K�NameMmPhase0Stop

A��A�oData)K�NamePhase1Start

A��M�oData5K�NameKsrExtensionStart

A��K�oData3K�NameKsrExtensionStop

A��S�oData;K�NameStartProcessorsStart

A��Q�oData9K�NameStartProcessorsStop

A��Q�oData9K�NameAutoLoggerInitStart

A��O�oData7K�NameAutoLoggerInitStop

A��E�oData-K�Name
MmPhase1Start
	
A��C�oData+K�NameMmPhase1Stop

A��Y�oDataAK�NameHalPhase0StartCycleTime

A��W�oData?K�NameHalPhase0StopCycleTime

A��7�oDataK�NameMmMark

�

�n

�n

�n

�n

o

8o

ho

�o

�o

�o

p

,p

`p

�p MmPhase0Start MmPhase0StopPhase1Start(KsrExtensionStart(KsrExtensionStop0StartProcessorsStart,StartProcessorsStop,AutoLoggerInitStart,AutoLoggerInitStop MmPhase1Start MmPhase1Stop4HalPhase0StartCycleTime4HalPhase0StopCycleTimeMmMarkTEMP rpE�mm��R
f��<�����.D�	EventDataA��C�oData+K�NameUpdateReason
A��?�oData'K�Name
EnabledNew

A��;�oData#K�NameCountNew
A��;�oData#K�NameCountOld
�"\r

|r�r�r UpdateReasonEnabledNewCountNewCountOldTEMP�dsDs;��^P�#�@ݕ3��fD�	EventDataA��E�oData-K�Name
FailureResult
�"xs FailureResultTEMP htU{x��]��ۡ�|�F���D�	EventDataA��9�oData!K�NameNewBias
A��9�oData!K�NameOldBias
�t�tNewBiasOldBiasTEMP		Dw�y��%�P���|����XD�	EventDataA��G�oData/K�NameVsmCleanupTime

A��7�oDataK�NameMark#0

A��7�oDataK�NameMark#1

A��7�oDataK�NameMark#2

A��7�oDataK�NameMark#3

A��7�oDataK�NameMark#4

A��7�oDataK�NameMark#5

A��7�oDataK�NameMark#6

A��7�oDataK�NameMark#7



�w

x

0x

Dx

Xx

lx

�x

�x

�x$VsmCleanupTimeMark#0Mark#1Mark#2Mark#3Mark#4Mark#5Mark#6Mark#7TEMP��z��5���X��4_+���D�	EventDataA��?�oData'K�Name
ExitReason
A��A�oData)K�NameCurrentBias
A��M�oData5K�NameCurrentTimeZoneID
A��[�oDataCK�NameTimeZoneInfoCacheUpdated
A��C�oData+K�NameFirstRefresh
�z{4{\{�{ExitReasonCurrentBias(CurrentTimeZoneID8TimeZoneInfoCacheUpdated FirstRefreshPRVAX�{Microsoft-Windows-Kernel-GeneralOPCO01$|win:InfoLEVL�Pl|P�|P�|win:Errorwin:Warning(win:InformationalTASK����~����$~����@~����`~�����~�����~�����~���� 	����L
����x�����SystemStartSystemStop SoftBootInfo,BootPerformanceData(SystemTimeChange0LeapSecondDataUpdate<LeapSecondDataParseFailure,TimeZoneBiasChange,VsmPerformanceData$ReorganizeHive<TimeZoneInformationRefreshKEYWD$� ����`�@�������������<KERNEL_GENERAL_KEYWORD_TIMELKERNEL_GENERAL_SECURITY_ACCESSCHECKLKERNEL_GENERAL_TOKEN_SID_MANAGEMENT$BootPerformanceEVNT8��0$|`|�L"��P%|`|D}�L"��&|`|D}�L"�@)|`|L"�@)|`|L"�@)|`|L"��)H|L"�`+H|L"�0-|`|L"���4|`|�|�L"
��
$8|`|�| �L" �����8H|$�
�(0|`|�}L"�P2|`|L"@�����J`|(����TS|`|},�L"��@U|`|}0�L"������W|`|(}4�������[|`|(}8������a|`|(}<�������h|`|(}@���p|`|`}D�L"��r|T||}H�L"��s|`|�}L�L"	������t|`|�}P���x|`|�}T�L"������������������WEVTdu�	��$�p�
�d������X�CHANt̆����XMicrosoft-Windows-Kernel-Process/AnalyticMAPSL4�BMAPP�� ProcessFlagsTTBL�bTEMP�,�
�q���=[�u�����T��|D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��I�oData1K�NameParentProcessID
A��=�oData%K�Name	SessionID
A��=�oData%K�Name	ImageName
����ĉ��ProcessIDCreateTime$ParentProcessIDSessionIDImageNameTEMP���a#�m6Z�&M�lk���D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��I�oData1K�NameParentProcessID
A��=�oData%K�Name	SessionID
A��5�oDataK�NameFlags
A��=�oData%K�Name	ImageName
|�����Ԍ4����ProcessIDCreateTime$ParentProcessIDSessionIDFlagsImageNameTEMP$

D�	�	�<RW�@�\:<����D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��I�oData1K�NameParentProcessID
A��=�oData%K�Name	SessionID
A��5�oDataK�NameFlags
A��=�oData%K�Name	ImageName
A��E�oData-K�Name
ImageChecksum
A��E�oData-K�Name
TimeDateStamp
A��I�oData1K�NamePackageFullName
A��S�oData;K�NamePackageRelativeAppId
	�$�@�d�4�|�����đ��ProcessIDCreateTime$ParentProcessIDSessionIDFlagsImageName ImageChecksum TimeDateStamp$PackageFullName0PackageRelativeAppIdTEMPX<��}�T#]�Q\c^r����D�	EventDataA��=�oData%K�Name	ProcessID
A��U�oData=K�NameProcessSequenceNumber

A��?�oData'K�Name
CreateTime
A��I�oData1K�NameParentProcessID
A��a�oDataIK�NameParentProcessSequenceNumber

A��=�oData%K�Name	SessionID
A��5�oDataK�NameFlags
A��]�oDataEK�NameProcessTokenElevationType
A��W�oData?K�NameProcessTokenIsElevated
A��G�oData/K�NameMandatoryLabel
	A��=�oData%K�Name	ImageName
A��E�oData-K�Name
ImageChecksum
A��E�oData-K�Name
TimeDateStamp
A��I�oData1K�NamePackageFullName

A��S�oData;K�NamePackageRelativeAppId
h�

����̘

�,�4�D�T���������<�`�ProcessID0ProcessSequenceNumberCreateTime$ParentProcessID<ParentProcessSequenceNumberSessionIDFlags8ProcessTokenElevationType4ProcessTokenIsElevated$MandatoryLabelImageName ImageChecksum TimeDateStamp$PackageFullName0PackageRelativeAppIdTEMP�		`�(�G���X�P�@;����D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��;�oData#K�NameExitTime
A��;�oData#K�NameExitCode
A��O�oData7K�NameTokenElevationType
A��A�oData)K�NameHandleCount
A��C�oData+K�NameCommitCharge

A��?�oData'K�Name
CommitPeak

A��=�oData%K�Name	ImageName
�,�H�`�x���

��

���ProcessIDCreateTimeExitTimeExitCode,TokenElevationTypeHandleCount CommitChargeCommitPeakImageNameTEMP��E��ZY�Aty����D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��;�oData#K�NameExitTime
A��;�oData#K�NameExitCode
A��O�oData7K�NameTokenElevationType
A��A�oData)K�NameHandleCount
A��C�oData+K�NameCommitCharge

A��?�oData'K�Name
CommitPeak

A��E�oData-K�Name
CPUCycleCount

A��O�oData7K�NameReadOperationCount
	A��Q�oData9K�NameWriteOperationCount
A��U�oData=K�NameReadTransferKiloBytes
A��W�oData?K�NameWriteTransferKiloBytes
A��G�oData/K�NameHardFaultCount

A��=�oData%K�Name	ImageName
�(�D�\�t���

��

ܥ

���D�p���Ԧ��ProcessIDCreateTimeExitTimeExitCode,TokenElevationTypeHandleCount CommitChargeCommitPeak CPUCycleCount,ReadOperationCount,WriteOperationCount0ReadTransferKiloBytes4WriteTransferKiloBytes$HardFaultCountImageNameTEMP�<��Uk ݂Z5g'��י����D�	EventDataA��=�oData%K�Name	ProcessID
A��U�oData=K�NameProcessSequenceNumber

A��?�oData'K�Name
CreateTime
A��;�oData#K�NameExitTime
A��;�oData#K�NameExitCode
A��O�oData7K�NameTokenElevationType
A��A�oData)K�NameHandleCount
A��C�oData+K�NameCommitCharge

A��?�oData'K�Name
CommitPeak

A��E�oData-K�Name
CPUCycleCount
	
A��O�oData7K�NameReadOperationCount
A��Q�oData9K�NameWriteOperationCount
A��U�oData=K�NameReadTransferKiloBytes
A��W�oData?K�NameWriteTransferKiloBytes

A��G�oData/K�NameHardFaultCount
A��=�oData%K�Name	ImageName
|�

��ĭ����<�

X�

x�

������<�p���ProcessID0ProcessSequenceNumberCreateTimeExitTimeExitCode,TokenElevationTypeHandleCount CommitChargeCommitPeak CPUCycleCount,ReadOperationCount,WriteOperationCount0ReadTransferKiloBytes4WriteTransferKiloBytes$HardFaultCountImageNameTEMPx		x��nUh�2X�l"�&�����D�	EventDataA��=�oData%K�Name	ProcessID
A��;�oData#K�NameThreadID
A��=�oData%K�Name	StackBase
A��?�oData'K�Name
StackLimit
A��E�oData-K�Name
UserStackBase
A��G�oData/K�NameUserStackLimit
A��=�oData%K�Name	StartAddr
A��G�oData/K�NameWin32StartAddr
A��9�oData!K�NameTebBase
,�D�\�t�����Գ��ProcessIDThreadIDStackBaseStackLimit UserStackBase$UserStackLimitStartAddr$Win32StartAddrTebBaseTEMP�

<�Q���]���1�T���D�	EventDataA��=�oData%K�Name	ProcessID
A��;�oData#K�NameThreadID
A��=�oData%K�Name	StackBase
A��?�oData'K�Name
StackLimit
A��E�oData-K�Name
UserStackBase
A��G�oData/K�NameUserStackLimit
A��=�oData%K�Name	StartAddr
A��G�oData/K�NameWin32StartAddr
A��9�oData!K�NameTebBase
A��E�oData-K�Name
SubProcessTag
	��4�L�h�����ĸ���ProcessIDThreadIDStackBaseStackLimit UserStackBase$UserStackLimitStartAddr$Win32StartAddrTebBase SubProcessTagTEMPhx���*my_\ǻ�.���&D�	EventDataA��=�oData%K�Name	ProcessID
A��;�oData#K�NameThreadID
A��=�oData%K�Name	StackBase
A��?�oData'K�Name
StackLimit
A��E�oData-K�Name
UserStackBase
A��G�oData/K�NameUserStackLimit
A��=�oData%K�Name	StartAddr
A��G�oData/K�NameWin32StartAddr
A��9�oData!K�NameTebBase
A��E�oData-K�Name
SubProcessTag
	A��=�oData%K�Name	CycleTime

T�l�������ؽ���8�L�
l�ProcessIDThreadIDStackBaseStackLimit UserStackBase$UserStackLimitStartAddr$Win32StartAddrTebBase SubProcessTagCycleTimeTEMP����|hGH}V�Ȋ`�j�%��
D�	EventDataA��=�oData%K�Name	ImageBase
A��=�oData%K�Name	ImageSize
A��=�oData%K�Name	ProcessID
A��E�oData-K�Name
ImageCheckSum
A��E�oData-K�Name
TimeDateStamp
A��A�oData)K�NameDefaultBase
A��=�oData%K�Name	ImageName
P�h���������ImageBaseImageSizeProcessID ImageCheckSum TimeDateStampDefaultBaseImageNameTEMP�L���|hGH}V�Ȋ`�j�%��
D�	EventDataA��=�oData%K�Name	ImageBase
A��=�oData%K�Name	ImageSize
A��=�oData%K�Name	ProcessID
A��E�oData-K�Name
ImageCheckSum
A��E�oData-K�Name
TimeDateStamp
A��A�oData)K�NameDefaultBase
A��=�oData%K�Name	ImageName
����� �@�`�|�ImageBaseImageSizeProcessID ImageCheckSum TimeDateStampDefaultBaseImageNameTEMP����UU�?��M���0D�	EventDataA��=�oData%K�Name	ProcessID
A��;�oData#K�NameThreadID
A��A�oData)K�NameOldPriority
A��A�oData)K�NameNewPriority
H�`�x���ProcessIDThreadIDOldPriorityNewPriorityTEMP�P�2�>!��xX�6�f��P��jD�	EventDataA��I�oData1K�NameFrozenProcessID
d�$FrozenProcessIDTEMPLl�Env�z��_�����%�����D�	EventDataA��I�oData1K�NameFrozenProcessID
A��?�oData'K�Name
CreateTime
����$FrozenProcessIDCreateTimeTEMP����7ά��Y���`�������D�	EventDataA��C�oData+K�NameContainer ID
A��7�oDataK�NameJob ID
A��?�oData'K�Name
StatusCode
,�L�`� Container IDJob IDStatusCodeTEMP���.�n]�y�]b�A��"�h���D�	EventDataA��7�oDataK�NameJob ID
A��M�oData5K�NameDiskIoAttribution
A��?�oData'K�Name
StatusCode
�����Job ID(DiskIoAttributionStatusCodeTEMP(�w묌
�U��	o	&���D�	EventDataA��7�oDataK�NameJob ID
A��E�oData-K�Name
IoRateControl
A��A�oData)K�NameControlType
A��;�oData#K�NameRateType
A��?�oData'K�Name
RateAmount
A��?�oData'K�Name
StatusCode
���������$�Job ID IoRateControlControlTypeRateTypeRateAmountStatusCodeTEMP����Z�ePSG�(/7�'���D�	EventDataA��7�oDataK�NameJob ID
A��E�oData-K�Name
IoRateControl
A��9�oData!K�NameMaxIops

A��C�oData+K�NameMaxBandwidth

A��G�oData/K�NameMaxTimePercent

A��I�oData1K�NameReservationIops

A��S�oData;K�NameReservationBandwidth

A��W�oData?K�NameReservationTimePercent

A��Y�oDataAK�NameCriticalReservationIops

A��c�oDataKK�NameCriticalReservationBandwidth
	
A��g�oDataOK�NameCriticalReservationTimePercent

A��C�oData+K�NameControlFlags
A��?�oData'K�Name
VolumeName
A��?�oData'K�Name
StatusCode

 �4�

T�

h�

��

��

��

�

4�

h�

�����(�Job ID IoRateControlMaxIops MaxBandwidth$MaxTimePercent$ReservationIops0ReservationBandwidth4ReservationTimePercent4CriticalReservationIops@CriticalReservationBandwidthDCriticalReservationTimePercent ControlFlagsVolumeNameStatusCodeTEMP�	���̶�:�S�S�[����D�	EventDataA��7�oDataK�NameJob ID
A��E�oData-K�Name
IoRateControl
A��9�oData!K�NameMaxIops

A��C�oData+K�NameMaxBandwidth

A��G�oData/K�NameMaxTimePercent

A��I�oData1K�NameReservationIops

A��S�oData;K�NameReservationBandwidth

A��W�oData?K�NameReservationTimePercent

A��Y�oDataAK�NameCriticalReservationIops

A��c�oDataKK�NameCriticalReservationBandwidth
	
A��g�oDataOK�NameCriticalReservationTimePercent

A��A�oData)K�NameSoftMaxIops

A��K�oData3K�NameSoftMaxBandwidth

A��O�oData7K�NameSoftMaxTimePercent


A��C�oData+K�NameControlFlags
A��?�oData'K�Name
VolumeName
A��?�oData'K�Name
StatusCode
P�d�

��

��

��

��

�

0�

d�

��

��

�

8�

`�������Job ID IoRateControlMaxIops MaxBandwidth$MaxTimePercent$ReservationIops0ReservationBandwidth4ReservationTimePercent4CriticalReservationIops@CriticalReservationBandwidthDCriticalReservationTimePercentSoftMaxIops(SoftMaxBandwidth,SoftMaxTimePercent ControlFlagsVolumeNameStatusCodeTEMP����_P‹5Z��<���L���D�	EventDataA��Y�oDataAK�NameOldWorkOnBehalfThreadID
A��Y�oDataAK�NameNewWorkOnBehalfThreadID
�P�4OldWorkOnBehalfThreadID4NewWorkOnBehalfThreadIDTEMP���F@mQ�)�Vنo���D�	EventDataA��C�oData+K�NameContainer ID
A��7�oDataK�NameJob ID
A��5�oDataK�NameState
����� Container IDJob IDStateTEMP�8��.���U�x`ߑ�ׂ���D�	EventDataA��C�oData+K�NameContainer ID
A��7�oDataK�NameJob ID
A��A�oData)K�NameMonitorName
t����� Container IDJob IDMonitorNameTEMP �h���[a�BZ����(D�	EventDataA��C�oData+K�NameContainer ID
A��7�oDataK�NameJob ID
A��7�oDataK�NameStatus
A��A�oData)K�NameMonitorName
p������� Container IDJob IDStatusMonitorNameTEMP8��!��03\���|��#���D�	EventDataA��A�oData)K�NameProcessName
A��=�oData%K�Name	ProcessID
����ProcessNameProcessIDPRVAX �Microsoft-Windows-Kernel-ProcessOPCOx1��2��2��win:Infowin:Startwin:StopLEVL@P��(win:InformationalTASK�����<�����\�����x������������������������������	����<�
����h�������
���������������������������8�����\������������� ProcessStartProcessStopThreadStartThreadStopImageLoadImageUnload0CpuBasePriorityChange(CpuPriorityChange,PagePriorityChange(IoPriorityChange ProcessFreezeJobStart JobTerminate$ProcessRundown,PsDiskIoAttribution$PsIoRateControl8ThreadWorkOnBehalfUpdate,JobServerSiloStart,ProcessInPrivateSetKEYWl������ ������@����������H����������������������@������� ������@���� �8WINEVENT_KEYWORD_PROCESS4WINEVENT_KEYWORD_THREAD4WINEVENT_KEYWORD_IMAGE@WINEVENT_KEYWORD_CPU_PRIORITYDWINEVENT_KEYWORD_OTHER_PRIORITYDWINEVENT_KEYWORD_PROCESS_FREEZE0WINEVENT_KEYWORD_JOBhWINEVENT_KEYWORD_ENABLE_PROCESS_TRACING_CALLBACKS4WINEVENT_KEYWORD_JOB_IODWINEVENT_KEYWORD_WORK_ON_BEHALF8WINEVENT_KEYWORD_JOB_SILOEVNTd)��|�|���(�������|���(�������|���(� �����8�|���(�$�����������D�(����������D�,����������D�0��� ����|���`�4��� ��$�|���`�8��� ��������|�<��� �������|�@���@����p�����D���@���p�����H��������p�����L��������p�����P���		�	���p����T���

�
���p���$�X�������|���@�\�������|���@�`�����������@�d�����������@�h���

�
���|���\�l�����������x�p������p�����t�����8�p�����x�������p���|������|�|��������������|����������������8�|��������������@�|��������������D�|��������������8����������������@����������������D����������� �������p���������@�������p��������@������|��������@����������������@������|��������@����������������������p��� �������������������������(�(�8�8�H�H�H�H�X�X�����h�x�x�x�x�x�x�x�x���������������WEVT�F���
`,�,�4�47�9CHAN�8�����������\Microsoft-Windows-Kernel-Registry/Analytic`Microsoft-Windows-Kernel-Registry/PerformanceTTBLl/TEMP�4��zw�_Q
f��i�N���D�	EventDataA��?�oData'K�Name
BaseObject
A��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��A�oData)K�NameDisposition
A��;�oData#K�NameBaseName
A��C�oData+K�NameRelativeName
d���������BaseObjectKeyObjectStatusDispositionBaseName RelativeNameTEMP�����u�Y[`q��BsK���D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��9�oData!K�NameKeyName
LdxKeyObjectStatusKeyNameTEMPx�C���^ζUGr������D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
A��K�oData3K�NameCapturedDataSize
A��C�oData+K�NameCapturedData
Ldx����KeyObjectStatusInfoClassDataSizeKeyName(CapturedDataSize CapturedDataTEMP��U���yZ[A��u����D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��3�oDataK�NameType
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
A��=�oData%K�Name	ValueName
A��K�oData3K�NameCapturedDataSize
A��C�oData+K�NameCapturedData
A��K�oData3K�NamePreviousDataType
A��K�oData3K�NamePreviousDataSize
	A��[�oDataCK�NamePreviousDataCapturedSize
A��C�oData+K�NamePreviousData
�	�	�	�	

0
X
x
�
�

KeyObjectStatusTypeDataSizeKeyNameValueName(CapturedDataSize CapturedData(PreviousDataType(PreviousDataSize8PreviousDataCapturedSize PreviousDataTEMP�t5|��
U'VO��C���� D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��9�oData!K�NameKeyName
A��=�oData%K�Name	ValueName
���
KeyObjectStatusKeyNameValueNameTEMP���Y܄$[�F�@L����BD�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
A��=�oData%K�Name	ValueName
A��K�oData3K�NameCapturedDataSize
A��C�oData+K�NameCapturedData
4L`x����KeyObjectStatusInfoClassDataSizeKeyNameValueName(CapturedDataSize CapturedDataTEMP�t�f�C��V��`����%��:D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��5�oDataK�NameIndex
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
A��K�oData3K�NameCapturedDataSize
A��C�oData+K�NameCapturedData
,@Ph���KeyObjectStatusIndexInfoClassDataSizeKeyName(CapturedDataSize CapturedDataTEMPptB!��Q>�Ƅ����dD�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��?�oData'K�Name
EntryCount
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
�� 8KeyObjectStatusEntryCountDataSizeKeyNameTEMPx�C���^ζUGr������D�	EventDataA��=�oData%K�Name	KeyObject
A��7�oDataK�NameStatus
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameDataSize
A��9�oData!K�NameKeyName
A��K�oData3K�NameCapturedDataSize
A��C�oData+K�NameCapturedData
$8Ph|�KeyObjectStatusInfoClassDataSizeKeyName(CapturedDataSize CapturedDataTEMP<�Zv��NɋP�};�ɖ���D�	EventDataA��C�oData+K�NameHiveFilePath
A��;�oData#K�NameFileSize
�� HiveFilePathFileSizeTEMP\�%{�1�Uϫ+F�����D�	EventDataA��G�oData/K�NameTotalEntrySize
A��G�oData/K�NameBytesRecovered
8$TotalEntrySize$BytesRecoveredTEMP��9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
StatusCodeTEMPT/���mT6#W�|4����D�	EventDataA��C�oData+K�NameHiveFilePath
A��G�oData/K�NameHiveMountPoint
0P HiveFilePath$HiveMountPointTEMP� 9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
 StatusCodeTEMP�d!ݯ��I^vo��X���D�	EventDataA��C�oData+K�NameHiveFilePath
A��G�oData/K�NameHiveMountPoint
A��?�oData'K�Name
FlushFlags
�!�!�! HiveFilePath$HiveMountPointFlushFlagsTEMP��"i����T;�qW��w��fD�	EventDataA��E�oData-K�Name
BytesGathered
�" BytesGatheredTEMP�l#i����T;�qW��w��fD�	EventDataA��E�oData-K�Name
BytesGathered
�# BytesGatheredTEMPL�$˦i��=I_��Nm�;���D�	EventDataA��C�oData+K�NameWritesIssued
A��C�oData+K�NameBytesWritten
�$�$ WritesIssued BytesWrittenTEMPL�%˦i��=I_��Nm�;���D�	EventDataA��C�oData+K�NameWritesIssued
A��C�oData+K�NameBytesWritten
�%& WritesIssued BytesWrittenTEMP��&9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
�&StatusCodeTEMP$�'V��U�V6Q�D��Y7{���D�	EventDataA��?�oData'K�Name
SourceFile
A��5�oDataK�NameFlags
�'(SourceFileFlagsTEMP��(9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
�(StatusCodeTEMP$�)V��U�V6Q�D��Y7{���D�	EventDataA��?�oData'K�Name
SourceFile
A��5�oDataK�NameFlags
�)�)SourceFileFlagsTEMP��*9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
�*StatusCodeTEMP�h+��*K�tS
f�g<����fD�	EventDataA��E�oData-K�Name
SourceKeyPath
|+ SourceKeyPathTEMP�0,9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
D,StatusCodePRVAXt,Microsoft-Windows-Kernel-RegistryOPCO�!2P.2h.
�����.
�����.
����/
����`/�����/�����/����$0����`0�����0�����0���� 1
����X1�����1�����1����<2�����2 �����2!�����2"����3#���� 3$����83%����T3&����x3'�����3(�����3)�����3*����4+����84,����P4-����h4.�����4win:Startwin:StopHRegPerfOpHiveMountBaseFileMountedPRegPerfOpHiveFlushBecameActiveFlusherHRegPerfOpShutdownRundownComplete4RegPerfOpSaveFileCopiedHRegPerfOpHiveMountLogEntryAppliedHRegPerfOpHiveFlushGatheredLogData<RegPerfOpShutdownFlushStart4RegPerfOpSaveTreeCopiedPRegPerfOpHiveFlushGatheredPrimaryData<RegPerfOpShutdownFlushStop8RegPerfOpSaveFileWrittenDRegPerfOpHiveFlushWroteLogFileLRegPerfOpHiveFlushWrotePrimaryFileTRegPerfOpHiveFlushBoostedActiveFlusherPRegPerfOpHiveFlushStartWaitForActivePRegPerfOpHiveFlushFinishWaitForActiveCreateKeyOpenKeyDeleteKeyQueryKeySetValueKey$DeleteValueKey QueryValueKey EnumerateKey(EnumerateValueKey0QueryMultipleValueKey(SetInformationKeyFlushKeyCloseKey(QuerySecurityKey$SetSecurityKeyLEVL@P�4(win:InformationalTASKs�5s�5s$6sT6s�6s�6s�60RegPerfTaskHiveMount0RegPerfTaskHiveUnload0RegPerfTaskHiveFlush,RegPerfTaskShutdown,RegPerfTaskHiveLoad4RegPerfTaskHiveRestore,RegPerfTaskHiveSaveKEYW�����8���� 8����H8����l8 �����8@�����8������8����9���� 9����D9����d9�����9 �����9@�����9������9CloseKey(QuerySecurityKey$SetSecurityKey(EnumerateValueKey0QueryMultipleValueKey(SetInformationKeyFlushKeySetValueKey$DeleteValueKey QueryValueKey EnumerateKeyCreateKeyOpenKeyDeleteKeyQueryKeyEVNT�- �������-�4`B�! �������-�4dB�"@������-�4hB�#��������-�4lB�$������-�4pB�%����� �-�4tB�&�����
�-�4xB�'������-�4|B�	(������-�4�B�
) ������.�4�B�*@�����L.�4�B�+������ .�4�B�
,�����,.�4�B�-�����8.�4�B�.�����D.�4�B�@�����,�45(�
@������,�45(�@����-�45(�@����\�,�45(�@���� �,�45(�@����t�,�45(�@����8 �,�485(�
@�����,�485(�@����"-�485(�@�����"<-�485(�
@�����#`-�485(�@�����#l-�485(�@����x-�485(�@�����-�485(�@�����-�485(�@����8&�,�485(� @�����,�4T5(�!@�����,�4T5(�"@����$-�4T5(�#@����H-�4T5(�$@�����,�4T5(�%@�����&�,�4p5(�&@���� (�,�4p5(�'@�����(�,�4�5(�(@����*�,�4�5(�)@�����*�,�4�5(�*
@����-�4�5(�+@����0-�4�5(�,@����T-�4�5(�-@�����+�,�4�5(��7�7�7�7�7�7�7�7H7X7h7x77(787WEVT���	�BhC$E
8����� �d���CHANtC����XMicrosoft-Windows-Kernel-Acpi/DiagnosticMAPS��C�C�C�CVMAP$�D��VMAP$�D��VMAP$E��VMAPdTD
��	�
���
���	�,MapAcpiOverrideTypeHMapActiveCoolingDevicePowerState<MapAmlMethodInvocationState MapResetTypeTTBL�TEMPL�G}9/��`XuN�y����tD�	EventDataA��C�oData+K�NameResourceFlag
A��A�oData)K�NameGeneralFlag
A��K�oData3K�NameTypeSpecificFlag
A��A�oData)K�NameGranularity

A��?�oData'K�Name
AddressMin

A��?�oData'K�Name
AddressMax

A��O�oData7K�NameAddressTranslation

A��E�oData-K�Name
AddressLength

xH�H�H
�H
�H
I
0I
\I ResourceFlagGeneralFlag(TypeSpecificFlagGranularityAddressMinAddressMax,AddressTranslation AddressLengthTEMP\hJ�K���;T]��cAl쪙���D�	EventDataA��A�oData)K�NameGpeRegister
A��O�oData7K�NameUnexpectedEventMap
�J�JGpeRegister,UnexpectedEventMapTEMP�(O�m��_:����Rt���D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
	A��3�oDataK�Name_AC6
A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9

A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
hP�P�P�PQQ$Q4QDQTQdQtQ�Q�Q�Q�QDThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance_TMP_PSV_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRTTEMPH�T�~���\K�+I���S���D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��O�oData7K�NameActiveCoolingLevel
A��[�oDataCK�NameActiveCoolingDeviceIndex
A��Y�oDataAK�NameFanDeviceInstanceLength
A��M�oData5K�NameFanDeviceInstance
A��K�oData3K�NamePowerStateLength
A��?�oData'K�Name
PowerState
�U�UV4VlV�V�V�VDThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance,ActiveCoolingLevel8ActiveCoolingDeviceIndex4FanDeviceInstanceLength(FanDeviceInstance(PowerStateLengthPowerStateTEMP��Yn�V^�_V?��{Lv���D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��O�oData7K�NameActiveCoolingLevel
A��[�oDataCK�NameActiveCoolingDeviceIndex
A��Y�oDataAK�NameFanDeviceInstanceLength
A��M�oData5K�NameFanDeviceInstance
A��?�oData'K�Name
PowerState
lZ�Z�Z[L[�[�C�[DThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance,ActiveCoolingLevel8ActiveCoolingDeviceIndex4FanDeviceInstanceLength(FanDeviceInstancePowerStateTEMP�]��]}�[���q�M��D�	EventDataA��S�oData;K�NameDeviceInstanceLength
A��G�oData/K�NameDeviceInstance
A��?�oData'K�Name
PowerState
<]l]�C�]0DeviceInstanceLength$DeviceInstancePowerStateTEMP��^��۸�̫S����m`���D�	EventDataA��S�oData;K�NameDeviceInstanceLength
A��G�oData/K�NameDeviceInstance
A��;�oData#K�NameThrottle
 _P_t_0DeviceInstanceLength$DeviceInstanceThrottleTEMPXaA*7���U�
G9P����JD�	EventDataA��S�oData;K�NameDeviceInstanceLength
A��G�oData/K�NameDeviceInstance
A��?�oData'K�Name
PowerState
A��;�oData#K�NameThrottle
\a�a�C�a�a0DeviceInstanceLength$DeviceInstancePowerStateThrottleTEMP@Pc��j�焴Y�E��3rZ��6D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��A�oData)K�NameTemperature
�c�cdDThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstanceTemperatureTEMPt�e�]��S���X�;@��ZD�	EventDataA��Q�oData9K�NameAmlMethodNameLength
A��E�oData-K�Name
AmlMethodName
A��G�oData/K�NameAmlMethodState
A��G�oData/K�NameAmlElapsedTime

f0f�CPf

tf,AmlMethodNameLength AmlMethodName$AmlMethodState$AmlElapsedTimeTEMP��g��k�_�]�6����D�	EventDataA��Q�oData9K�NameAmlMethodNameLength
A��E�oData-K�Name
AmlMethodName
A��=�oData%K�Name	Frequency

h8h

Xh,AmlMethodNameLength AmlMethodNameFrequencyTEMP,, t���q"^�8�Iy,���zD�	EventDataA��]�oDataEK�NameThermalZoneBiosNameLength
A��Q�oData9K�NameThermalZoneBiosName
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_TC1
A��3�oDataK�Name_TC2
A��3�oDataK�Name_TSP
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
	A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
A��3�oDataK�Name_AC6

A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9
A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
A��3�oDataK�Name_NTT
A��=�oData%K�Name	_PSLCount
A��A�oData)K�Name_PSLEntries
�A��=�oData%K�Name	_TZDCount
A��A�oData)K�Name_TZDEntries
�A��=�oData%K�Name	_AL0Count
A��A�oData)K�Name_AL0Entries
�A��=�oData%K�Name	_AL1Count
A��A�oData)K�Name_AL1Entries
�A��=�oData%K�Name	_AL2Count
A��A�oData)K�Name_AL2Entries
�A��=�oData%K�Name	_AL3Count
A��A�oData)K�Name_AL3Entries
�A��=�oData%K�Name	_AL4Count
 A��A�oData)K�Name_AL4Entries
!�A��=�oData%K�Name	_AL5Count
"A��A�oData)K�Name_AL5Entries
#�A��=�oData%K�Name	_AL6Count
$A��A�oData)K�Name_AL6Entries
%�A��=�oData%K�Name	_AL7Count
&A��A�oData)K�Name_AL7Entries
'�A��=�oData%K�Name	_AL8Count
(A��A�oData)K�Name_AL8Entries
)�A��=�oData%K�Name	_AL9Count
*A��A�oData)K�Name_AL9Entries
+��w�w�wxx$x4xDxTxdxtx�x�x�x�x�x�x�x�xyy,yHy`y|y�y�y�y�y�yz0zLz dz�z"�z�z$�z�z&{{(4{P{*h{8ThermalZoneBiosNameLength,ThermalZoneBiosName_TMP_PSV_TC1_TC2_TSP_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRT_NTT_PSLCount_PSLEntries_TZDCount_TZDEntries_AL0Count_AL0Entries_AL1Count_AL1Entries_AL2Count_AL2Entries_AL3Count_AL3Entries_AL4Count_AL4Entries_AL5Count_AL5Entries_AL6Count_AL6Entries_AL7Count_AL7Entries_AL8Count_AL8Entries_AL9Count_AL9EntriesTEMP�--��~����kU�RQ��ow����D�	EventDataA��]�oDataEK�NameThermalZoneBiosNameLength
A��Q�oData9K�NameThermalZoneBiosName
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_TC1
A��3�oDataK�Name_TC2
A��3�oDataK�Name_TSP
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
	A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
A��3�oDataK�Name_AC6

A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9
A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
A��3�oDataK�Name_NTT
A��=�oData%K�Name	_PSLCount
A��A�oData)K�Name_PSLEntries
�A��=�oData%K�Name	_TZDCount
A��A�oData)K�Name_TZDEntries
�A��=�oData%K�Name	_AL0Count
A��A�oData)K�Name_AL0Entries
�A��=�oData%K�Name	_AL1Count
A��A�oData)K�Name_AL1Entries
�A��=�oData%K�Name	_AL2Count
A��A�oData)K�Name_AL2Entries
�A��=�oData%K�Name	_AL3Count
A��A�oData)K�Name_AL3Entries
�A��=�oData%K�Name	_AL4Count
 A��A�oData)K�Name_AL4Entries
!�A��=�oData%K�Name	_AL5Count
"A��A�oData)K�Name_AL5Entries
#�A��=�oData%K�Name	_AL6Count
$A��A�oData)K�Name_AL6Entries
%�A��=�oData%K�Name	_AL7Count
&A��A�oData)K�Name_AL7Entries
'�A��=�oData%K�Name	_AL8Count
(A��A�oData)K�Name_AL8Entries
)�A��=�oData%K�Name	_AL9Count
*A��A�oData)K�Name_AL9Entries
+�A��I�oData1K�NameMinimumThrottle
,�@�l�|���������̋܋�����,�<�L�\�l�|�������،��(�@�\�t�����č ܍��"�,�$D�`�&x���(��Ȏ*���8ThermalZoneBiosNameLength,ThermalZoneBiosName_TMP_PSV_TC1_TC2_TSP_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRT_NTT_PSLCount_PSLEntries_TZDCount_TZDEntries_AL0Count_AL0Entries_AL1Count_AL1Entries_AL2Count_AL2Entries_AL3Count_AL3Entries_AL4Count_AL4Entries_AL5Count_AL5Entries_AL6Count_AL6Entries_AL7Count_AL7Entries_AL8Count_AL8Entries_AL9Count_AL9Entries$MinimumThrottleTEMP�00����p`�~S�㔿�,�����D�	EventDataA��]�oDataEK�NameThermalZoneBiosNameLength
A��Q�oData9K�NameThermalZoneBiosName
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_TC1
A��3�oDataK�Name_TC2
A��3�oDataK�Name_TSP
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
	A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
A��3�oDataK�Name_AC6

A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9
A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
A��3�oDataK�Name_NTT
A��=�oData%K�Name	_PSLCount
A��A�oData)K�Name_PSLEntries
�A��=�oData%K�Name	_TZDCount
A��A�oData)K�Name_TZDEntries
�A��=�oData%K�Name	_AL0Count
A��A�oData)K�Name_AL0Entries
�A��=�oData%K�Name	_AL1Count
A��A�oData)K�Name_AL1Entries
�A��=�oData%K�Name	_AL2Count
A��A�oData)K�Name_AL2Entries
�A��=�oData%K�Name	_AL3Count
A��A�oData)K�Name_AL3Entries
�A��=�oData%K�Name	_AL4Count
 A��A�oData)K�Name_AL4Entries
!�A��=�oData%K�Name	_AL5Count
"A��A�oData)K�Name_AL5Entries
#�A��=�oData%K�Name	_AL6Count
$A��A�oData)K�Name_AL6Entries
%�A��=�oData%K�Name	_AL7Count
&A��A�oData)K�Name_AL7Entries
'�A��=�oData%K�Name	_AL8Count
(A��A�oData)K�Name_AL8Entries
)�A��=�oData%K�Name	_AL9Count
*A��A�oData)K�Name_AL9Entries
+�A��I�oData1K�NameMinimumThrottle
,A��3�oDataK�Name_CR3
-A��3�oDataK�Name_TFP
.A��U�oData=K�NameOverThrottleThreshold
/����$�4�D�T�d�t���������ĠԠ����$�4�L�h�������С���8�P�l� ����"��Ԣ$��& �<�(T�p�*����ȣأ�8ThermalZoneBiosNameLength,ThermalZoneBiosName_TMP_PSV_TC1_TC2_TSP_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRT_NTT_PSLCount_PSLEntries_TZDCount_TZDEntries_AL0Count_AL0Entries_AL1Count_AL1Entries_AL2Count_AL2Entries_AL3Count_AL3Entries_AL4Count_AL4Entries_AL5Count_AL5Entries_AL6Count_AL6Entries_AL7Count_AL7Entries_AL8Count_AL8Entries_AL9Count_AL9Entries$MinimumThrottle_CR3_TFP0OverThrottleThresholdTEMP22�� ���;;Rwi��Q���6
D�	EventDataA��]�oDataEK�NameThermalZoneBiosNameLength
A��Q�oData9K�NameThermalZoneBiosName
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_TC1
A��3�oDataK�Name_TC2
A��3�oDataK�Name_TSP
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
	A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
A��3�oDataK�Name_AC6

A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9
A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
A��3�oDataK�Name_NTT
A��=�oData%K�Name	_PSLCount
A��A�oData)K�Name_PSLEntries
�A��=�oData%K�Name	_TZDCount
A��A�oData)K�Name_TZDEntries
�A��=�oData%K�Name	_AL0Count
A��A�oData)K�Name_AL0Entries
�A��=�oData%K�Name	_AL1Count
A��A�oData)K�Name_AL1Entries
�A��=�oData%K�Name	_AL2Count
A��A�oData)K�Name_AL2Entries
�A��=�oData%K�Name	_AL3Count
A��A�oData)K�Name_AL3Entries
�A��=�oData%K�Name	_AL4Count
 A��A�oData)K�Name_AL4Entries
!�A��=�oData%K�Name	_AL5Count
"A��A�oData)K�Name_AL5Entries
#�A��=�oData%K�Name	_AL6Count
$A��A�oData)K�Name_AL6Entries
%�A��=�oData%K�Name	_AL7Count
&A��A�oData)K�Name_AL7Entries
'�A��=�oData%K�Name	_AL8Count
(A��A�oData)K�Name_AL8Entries
)�A��=�oData%K�Name	_AL9Count
*A��A�oData)K�Name_AL9Entries
+�A��I�oData1K�NameMinimumThrottle
,A��3�oDataK�Name_CR3
-A��3�oDataK�Name_TFP
.A��U�oData=K�NameOverThrottleThreshold
/A��M�oData5K�NameDescriptionLength
0A��A�oData)K�NameDescription
1l���е���� �0�@�P�`�p�����������ж���$�<�X�p�������ط��(� @�\�"t���$��ĸ&ܸ��(�,�*D�`�������Թ0��8ThermalZoneBiosNameLength,ThermalZoneBiosName_TMP_PSV_TC1_TC2_TSP_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRT_NTT_PSLCount_PSLEntries_TZDCount_TZDEntries_AL0Count_AL0Entries_AL1Count_AL1Entries_AL2Count_AL2Entries_AL3Count_AL3Entries_AL4Count_AL4Entries_AL5Count_AL5Entries_AL6Count_AL6Entries_AL7Count_AL7Entries_AL8Count_AL8Entries_AL9Count_AL9Entries$MinimumThrottle_CR3_TFP0OverThrottleThreshold(DescriptionLengthDescriptionTEMP\33��bH׮�5S��E$�7"��p
D�	EventDataA��]�oDataEK�NameThermalZoneBiosNameLength
A��Q�oData9K�NameThermalZoneBiosName
A��3�oDataK�Name_TMP
A��3�oDataK�Name_PSV
A��3�oDataK�Name_TC1
A��3�oDataK�Name_TC2
A��3�oDataK�Name_TSP
A��3�oDataK�Name_AC0
A��3�oDataK�Name_AC1
A��3�oDataK�Name_AC2
	A��3�oDataK�Name_AC3
A��3�oDataK�Name_AC4
A��3�oDataK�Name_AC5
A��3�oDataK�Name_AC6

A��3�oDataK�Name_AC7
A��3�oDataK�Name_AC8
A��3�oDataK�Name_AC9
A��3�oDataK�Name_HOT
A��3�oDataK�Name_CRT
A��3�oDataK�Name_NTT
A��=�oData%K�Name	_PSLCount
A��A�oData)K�Name_PSLEntries
�A��=�oData%K�Name	_TZDCount
A��A�oData)K�Name_TZDEntries
�A��=�oData%K�Name	_AL0Count
A��A�oData)K�Name_AL0Entries
�A��=�oData%K�Name	_AL1Count
A��A�oData)K�Name_AL1Entries
�A��=�oData%K�Name	_AL2Count
A��A�oData)K�Name_AL2Entries
�A��=�oData%K�Name	_AL3Count
A��A�oData)K�Name_AL3Entries
�A��=�oData%K�Name	_AL4Count
 A��A�oData)K�Name_AL4Entries
!�A��=�oData%K�Name	_AL5Count
"A��A�oData)K�Name_AL5Entries
#�A��=�oData%K�Name	_AL6Count
$A��A�oData)K�Name_AL6Entries
%�A��=�oData%K�Name	_AL7Count
&A��A�oData)K�Name_AL7Entries
'�A��=�oData%K�Name	_AL8Count
(A��A�oData)K�Name_AL8Entries
)�A��=�oData%K�Name	_AL9Count
*A��A�oData)K�Name_AL9Entries
+�A��I�oData1K�NameMinimumThrottle
,A��3�oDataK�Name_CR3
-A��3�oDataK�Name_TFP
.A��U�oData=K�NameOverThrottleThreshold
/A��M�oData5K�NameDescriptionLength
0A��A�oData)K�NameDescription
1A��3�oDataK�Name_TZP
2�����,�<�L�\�l�|�������������������,�<�T�p������������$�@�X�t� ����"����$���&(�D�(\�x�*���������� �0H�d�8ThermalZoneBiosNameLength,ThermalZoneBiosName_TMP_PSV_TC1_TC2_TSP_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRT_NTT_PSLCount_PSLEntries_TZDCount_TZDEntries_AL0Count_AL0Entries_AL1Count_AL1Entries_AL2Count_AL2Entries_AL3Count_AL3Entries_AL4Count_AL4Entries_AL5Count_AL5Entries_AL6Count_AL6Entries_AL7Count_AL7Entries_AL8Count_AL8Entries_AL9Count_AL9Entries$MinimumThrottle_CR3_TFP0OverThrottleThreshold(DescriptionLengthDescription_TZPTEMP�0���N��2]���7y�L����D�	EventDataA��M�oData5K�NameFanBiosNameLength
A��A�oData)K�NameFanBiosName
A��C�oData+K�NameFstSupported

A��?�oData'K�Name
PowerState
A��9�oData!K�NameControl
����

���C���(FanBiosNameLengthFanBiosName FstSupportedPowerStateControlTEMP�X�v��'_�֓
3�>���D�	EventDataA��M�oData5K�NameFanBiosNameLength
A��A�oData)K�NameFanBiosName
A��?�oData'K�Name
PowerState
�����C��(FanBiosNameLengthFanBiosNamePowerStateTEMP� ����
�(�Z��Ӗ���z���D�	EventDataA��M�oData5K�NameFanBiosNameLength
A��A�oData)K�NameFanBiosName
A��9�oData!K�NameControl
\�����(FanBiosNameLengthFanBiosNameControlTEMP`���-F)徤^Y(K�P��C���D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��S�oData;K�NameDeviceInstanceLength
A��G�oData/K�NameDeviceInstance
A��?�oData'K�Name
PowerState
(�l������C��DThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance0DeviceInstanceLength$DeviceInstancePowerStateTEMPl,�7i�u�p]^H���)���D�	EventDataA��i�oDataQK�NameThermalZoneDeviceInstanceLength
A��]�oDataEK�NameThermalZoneDeviceInstance
A��S�oData;K�NameDeviceInstanceLength
A��G�oData/K�NameDeviceInstance
A��E�oData-K�Name
ThrottleLimit
�����<�`�DThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance0DeviceInstanceLength$DeviceInstance ThrottleLimitTEMP`�ro�窯Q�Z�ٍ����PD�	EventDataA��S�oData;K�NameDeviceBiosNameLength
A��G�oData/K�NameDeviceBiosName
A��I�oData1K�NameDeviceResetType
A��7�oDataK�NameStatus
T����C����0DeviceBiosNameLength$DeviceBiosName$DeviceResetTypeStatusTEMP���]�	V�DW�gguF��lD�	EventDataA��K�oData3K�NameAcpiOverrideType
�C��(AcpiOverrideTypeTEMP|��!6�;xv0R��F��*����D�	EventDataA��5�oDataK�NameScope
A��7�oDataK�NameObject
A��7�oDataK�NameStatus
��$�ScopeObjectStatusPRVAPL�Microsoft-Windows-Kernel-AcpiOPCOLEVL�P��P��P��win:Errorwin:Warning(win:InformationalTASKDd������e������f������g�����h����L�i������j������k������l�����m����4�n����\�o������p������q������r������s����(�t����l�u������v������w�����x����$�y����<�,ResourceTranslation(GpeEventHandling4TemperatureNotification0TripPointNotification8ActiveCoolingDevicePower$AmlMethodTrace,DeviceActiveCooling0DevicePassiveCooling0DeviceCoolingRundown(TemperatureChange,ThermalZoneRundownFanRundown,FanPowerStateChange$FanStatusChange4ActiveCoolingConstraintDActiveCoolingConstraintRundown8PassiveCoolingConstraintDPassiveCoolingConstraintRundownDeviceReset AcpiOverrideAMLIError(FrequentAmlMethodKEYW@����������������� ����D�@����d��������$acpi:Diagnostic acpi:Thermal0ms:ReservedKeyword40 ms:Telemetryms:Measures$ms:CriticalDataEVNT�d��0E��,���Ce��|I��H���Cf���J��d���Cg���J������Ch���Q������Ch��W������Ci ��$d������Cj���[������C	k�	��]������C
l�
��_�����Cm������a��(���Cn�����ph��D���Cn������{��D���Cn����� ���D��Cn��������D��Cn��������D��C
o�����t���`��Cp�����(���|��Cq������������Cr������������Cs������������Ct���������� �Cu���������$�Cv ������$�(�Cw ������@�0�Cx������\�8�Cy���f��x�<�Cp�p���������p�����������������������������������p���p���p�p�WEVT(�����
|�������CHAN��	�������@�����ApplicationXMicrosoft-Windows-User-Loader/OperationalTMicrosoft-Windows-User-Loader/AnalyticTTBL�

TEMP�0��<z�#aSl3�z�R���\D�	EventDataA��;�oData#K�NameFileName
D�FileNameTEMP���T��̫�[��L?��ZD�	EventDataA��9�oData!K�NameDllName
�DllNameTEMP� �S�C�Rd���7!C%���D�	EventDataA��]�oDataEK�NameProcessFileNamePathLength
A��Q�oData9K�NameProcessFileNamePath
H���8ProcessFileNamePathLength,ProcessFileNamePathTEMP��
n��f�S��}�<���D�	EventDataA��E�oData-K�Name
FailureReason
A��E�oData-K�Name
ImportDllName
A��C�oData+K�NameExportModule
�8�X� FailureReason ImportDllName ExportModuleTEMP�����[�t_�(m4�>�A���]EventXML+�xmlnsUser-Loader��&.�
FailureReason
��&�
ImportDllName
��,1ProcessImagePath
����� FailureReason ImportDllName(ProcessImagePathTEMPL�԰R�7nU]=�	���A���]EventXML+�xmlnsUser-Loader��,1ProcessImagePath
��&��
CurDirDllPath
(�P�(ProcessImagePath CurDirDllPathTEMP�x�R ֿy�pTZ4,�X��A���]EventXML+�xmlnsUser-Loader��,1ProcessImagePath
��&��
CurDirDllPath
��$��FoundDllPath
�����(ProcessImagePath CurDirDllPath FoundDllPathTEMP�T�(/E��TRO�^�]L���D�	EventDataA��E�oData-K�Name
FailureReason
A��E�oData-K�Name
ImportDllName
A��K�oData3K�NameProcessImagePath
����� FailureReason ImportDllName(ProcessImagePathTEMP����<z�#aSl3�z�R���\D�	EventDataA��;�oData#K�NameFileName
��FileNameTEMP��ϙ���G\���{�ɼ>���D�	EventDataA��=�oData%K�Name	ProcessId
A��U�oData=K�NameSuspendProcessRequest
A��9�oData!K�NameDLLName
 �8�h�ProcessId0SuspendProcessRequestDLLNamePRVAP��Microsoft-Windows-User-LoaderOPCO01�win:InfoLEVL�U8PXPpP� win:Criticalwin:Errorwin:Warning(win:InformationalTASKKEYW4, x@��	P
�LUSER_LOADER_KEYWORD_DEPRECATED_DLLPUSER_LOADER_FATAL_CALLBACK_EXCEPTIONHUSER_LOADER_KEYWORD_LOAD_FAILURE@USER_LOADER_LAUNCH_16BIT_APPTUSER_LOADER_KEYWORD_COMPONENT_ON_DEMANDPUSER_LOADER_KEYWORD_LOAD_FATAL_ERROREVNTp ����,H��  ���,L��@ 
��,P��� ����,T�� ����,X�� ���� \�� ���� `�� 
���,��	 	����d��
	�
x��,��	�p�� ��	�$��������WEVTt��
8��T�CHAN������lMicrosoft-Windows-Kernel-BootDiagnostics/DiagnosticPRVAhLMicrosoft-Windows-Kernel-BootDiagnosticsOPCO02�win:StartLEVL@P�(win:InformationalTASKD�����8SystemBootKEYWD1p(win:ResponseTimeEVNTD�����������`WEVT�5����,�
�6(7�7�7�9�9CHAN|H����`Microsoft-Windows-Kernel-Prefetch/DiagnosticTTBL(.
TEMPh<
	{]�̝�S�V��..Ϫ��RD�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
�
�
�
�
,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeTEMP��
��0�nd^ᥦ�\�-y��6D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��E�oData-K�Name
PrefetchPhase
A��C�oData+K�NamePrefetchType
A��G�oData/K�NameIsTricklePhase
@`����,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType PrefetchPhase PrefetchType$IsTricklePhaseTEMP�|;�
/�T�'�6z�f���>D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��M�oData5K�NamePrefetchPhaseMask
A��C�oData+K�NamePrefetchType
A��G�oData/K�NameIsTricklePhase
4Tx���,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType(PrefetchPhaseMask PrefetchType$IsTricklePhaseTEMP		��Q�NoY���A����D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��E�oData-K�Name
PrefetchPhase
A��C�oData+K�NamePrefetchType
A��G�oData/K�NameIsTricklePhase
A��O�oData7K�NameNumPagesPrefetched

A��C�oData+K�NameNumReadLists
��4Tt�

��,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType PrefetchPhase PrefetchType$IsTricklePhase,NumPagesPrefetched NumReadListsTEMP		��|Xo�^{�k�1�l���D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��M�oData5K�NamePrefetchPhaseMask
A��C�oData+K�NamePrefetchType
A��G�oData/K�NameIsTricklePhase
A��O�oData7K�NameNumPagesPrefetched

A��C�oData+K�NameNumReadLists
��<\��

��,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType(PrefetchPhaseMask PrefetchType$IsTricklePhase,NumPagesPrefetched NumReadListsTEMP����<޲5�U�K���v����D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��E�oData-K�Name
PrefetchPhase
Lx���,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType PrefetchPhaseTEMP��!*�B�eh9[�������D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��M�oData5K�NamePrefetchPhaseMask
<"h"�"�"�",ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType(PrefetchPhaseMaskTEMPh|$	{]�̝�S�V��..Ϫ��RD�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
�$�$%<%,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeTEMP�('�.d�2ˮV��O��`���D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��=�oData%K�Name	EndReason
�'�'�'�'(,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeEndReasonTEMP��*������\Ic�ܑ(���0D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��A�oData)K�NameActionFlags
A��A�oData)K�NameTraceReason
A��G�oData/K�NamePrefetchReason
$+P+p+�+�+�+�+,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeActionFlagsTraceReason$PrefetchReasonTEMP�		/�Y�	U��Z����������D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��A�oData)K�NameActionFlags
A��A�oData)K�NameTraceReason
A��G�oData/K�NamePrefetchReason
A��A�oData)K�NameNumLaunches
A��W�oData?K�NameTimeSinceLastLaunchInS
�/�/0@0`0|0�0�0�0,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeActionFlagsTraceReason$PrefetchReasonNumLaunches4TimeSinceLastLaunchInSTEMP��2Z
G,�GQ��W93�����D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��G�oData/K�NameWorkItemsCount
D3p3�3�3�3,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType$WorkItemsCountTEMP��5ޞoد=�QI���������D�	EventDataA��O�oData7K�NameScenarioNameLength
A��C�oData+K�NameScenarioName
A��G�oData/K�NameScenarioHashId
A��C�oData+K�NameScenarioType
A��=�oData%K�Name	NumPhases
(6T6t6�6�6,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeNumPhasesPRVAX�6Microsoft-Windows-Kernel-PrefetchOPCOx1X72p72�7win:Infowin:Startwin:StopLEVL@P�7(win:InformationalTASK������8�����8����9����9����49	����\9
����|9(PrefetchSections(PrefetchMetadataOpenVolumesEndTrace(ScenarioDecision GetReadListsAsyncWorkerKEYWD �����9(BasicInformationEVNT� �����@7�7�7P=8 �����@7�7�7T=8 �����L7�7�7X=8 �����L7�7�7\=8 �����@7�78`=8 ������@7�78d=8 �����L7�78h=8 ������L7�78l=8 ������"@7�7$8p=8 ������"L7�7$8t=8 �����\%47�7@8x=8 �����4(47�7\8|=8 �����,47�7\8�=8		 �����1@7�7x8�=8
	 ������L7�7x8�=8
 ������3@7�7�8�=8
 ������L7�7�8�=8

 ������47�7�8�=8�9�9�9�9�9�9�9�9�9�9�9�9�9�9�9�9�9�9WEVT ��=L>
�>�>�>$?l?x?CHANd>�HMicrosoft-Windows-UAC/OperationalTTBL\TEMPP�>)5�H7^A����d����D�	EventDataPRVA@�>Microsoft-Windows-UACOPCOLEVL0P?win:ErrorTASKH����L? CreateProcessKEYWEVNT@��X>?0?�=WEVTH�@�@
�A0B<BlB�B�BCHAN�$@�hMicrosoft-Windows-Security-Adminless/OperationalTTBLDTEMP8tA�/c���UX�q��r�Y���D�	EventDataA��A�oData)K�NameFailureTime
A��=�oData%K�Name	StackHash
�A�AFailureTimeStackHashPRVA`�AMicrosoft-Windows-Security-AdminlessOPCOLEVL0PTBwin:ErrorTASKH�����B AccessFailureKEYWEVNT@���@HBxB@WEVT�	PC�C
8E�E�E�E<FHFCHAN�lC�Microsoft-Windows-Security-LessPrivilegedAppContainer/OperationalTTBLDTEMP8�D�/c���UX�q��r�Y���D�	EventDataA��A�oData)K�NameFailureTime
A��=�oData%K�Name	StackHash
E EFailureTimeStackHashPRVA�LEMicrosoft-Windows-Security-LessPrivilegedAppContainerOPCOLEVL0P�Ewin:ErrorTASKH����F AccessFailureKEYWEVNT@�
D�EF\CWEVT���F8G
�G4HdH�H�HICHAN`�F����DMicrosoft-Windows-COM/AnalyticTTBL�TEMP��G�w�Nm\"l):��N��VD�	EventDataA��5�oDataK�NameCLSID
�GCLSIDPRVA@HMicrosoft-Windows-COMOPCO01LHwin:InfoLEVL@P|H(win:InformationalTASKKEYWL�H0COM_CLASSNOTREG_ERROREVNTD��DG@HpH@I�F�HWEVT���I�I
�NDOPO�O�O�OCHAN8�I	�ApplicationTTBLTEMPH�J���̧��Vv�@�gA����8Path��xmlnsDhttp://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0��&Q
AttemptedPath
K AttemptedPathTEMP�lL���Ew��\�C_�_�3A����PathAndGuid��xmlnsDhttp://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0��&Q
AttemptedPath
��"��SrpRuleGuid
�L�L AttemptedPathSrpRuleGuidTEMPDN7z7�--Wj�Mi(JRA��@%�PathGuidAndRule��xmlnsDhttp://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0��&Q
AttemptedPath
��"��SrpRuleGuid
����RulePath
�N�N�N AttemptedPathSrpRuleGuidRulePathPRVAp�NMicrosoft-Windows-SoftwareRestrictionPoliciesOPCOLEVLhPtOP�Owin:Warning(win:InformationalTASKKEYWEVNT02	�2	 KhO�Ia	�a	�I\O�Ib	�b	�L\O�Ic	�c	�I\O�Id	�d	 K\O�Ir	�r	 K\O�IWEVTp�PQ�R
�a�a�b�cd dCHANP�Q��Q� R�dR�HMicrosoft-Windows-MUI/Operational<Microsoft-Windows-MUI/AdminDMicrosoft-Windows-MUI/Analytic<Microsoft-Windows-MUI/DebugTTBL�TEMP�8S$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
LSStatusTEMP��S�<z�#aSl3�z�R���\D�	EventDataA��;�oData#K�NameFileName
TFileNameTEMP�0U;o��s\fj������D�	EventDataA��;�oData#K�NameFileName
A��3�oDataK�NameType
A��C�oData+K�NameFunctionName
lU�U�UFileNameType FunctionNameTEMP�DV�<z�#aSl3�z�R���\D�	EventDataA��;�oData#K�NameFileName
XVFileNameTEMP$�W�*z�8�WM
sWR�	���2D�	EventDataA��5�oDataK�NameFlags
A��A�oData)K�NameNewLanguage
A��C�oData+K�NamePrevLanguage
A��C�oData+K�NameExtendedFlag
(X8XTXtXFlagsNewLanguage PrevLanguage ExtendedFlagTEMP��Y �ُ_�<�vw����D�	EventDataA��;�oData#K�NameFileName
A��C�oData+K�NameFunctionName
A��A�oData)K�NameReturnValue
�YZ,ZFileName FunctionNameReturnValueTEMP��Z)�Y�?��T0��U�����^D�	EventDataA��=�oData%K�Name	Parameter
�ZParameterTEMPPX[)5�H7^A����d����D�	EventDataTEMPP�[)5�H7^A����d����D�	EventDataTEMP�0\4�=��|NP5��pk7��TD�	EventDataA��3�oDataK�NameName
D\NameTEMP�|]�f��dY��x(������D�	EventDataA��E�oData-K�Name
NewCacheIndex
A��G�oData/K�NameLiveCacheIndex
A��7�oDataK�NameConfig
�]�]�] NewCacheIndex$LiveCacheIndexConfigTEMP��^?~�v|�Uj��]�4���^D�	EventDataA��=�oData%K�Name	ErrorCode
�^ErrorCodeTEMP(`aM?��iV����"D�	EventDataA��;�oData#K�NameFileName
A��;�oData#K�NameAffinity
A��;�oData#K�NameSequence
A��;�oData#K�NamePriority
x`�`�`�`FileNameAffinitySequencePriorityTEMP�ha�<z�#aSl3�z�R���\D�	EventDataA��;�oData#K�NameFileName
|aFileNamePRVA@�aMicrosoft-Windows-MUIOPCO :4b:Pb  :tb!!:�b"":�b##:�b$$:�bInitialize$InvokeCallback DisableCache$UpdateManifestBuildCacheEntryExitLEVL�P$cP<cPXcwin:Errorwin:Warning(win:InformationalTASK�z�cz�c0NotifyLanguageChange RescacheBuildKEYWEVNTP�����R�ac�c\Q�@��`S�ac�clQ�@��T�ac�clQ�@���U�ac�clQ�@���U�ac�clQ����[�ac�c\Q����[�ac�c\Q� ���[�ac�c\Q����[�ac�c\Q�!@��[bc�clQ�!���[bc�c\Q�"���^bc�c\Q�"���[bc�c\Q����[�ac�c\Q����pV�ac�c\Q�����X�ac�c\Q����HZ�ac�c\Q�!���^bc�c�Q�" ���[bc�c|Q�" ���[bc�c|Q�"���T\bc�c\Q�# ���[bc�c|Q�$ ���[(bc�c|Q�# ���[bc�c|Q�$ ���[(bc�c|Q�!���`bc�c�Q����X[�ac�c\Q�" ��[bc�c|QWEVT,�i�j
Tp�p(q�q�stCHAN��i����Hj����\Microsoft-Windows-Kernel-AppCompat/GeneraldMicrosoft-Windows-Kernel-AppCompat/PerformanceTTBL�TEMP�Plc��snGa_�!(�y���bD�	EventDataA��S�oData;K�NameExecutablePathLength
A��G�oData/K�NameExecutablePath
A��O�oData7K�NameRegistryPathLength
A��C�oData+K�NameRegistryPath
�l�l�l m0ExecutablePathLength$ExecutablePath,RegistryPathLength RegistryPathTEMP��m9�̡^`U�@��w ���`D�	EventDataA��?�oData'K�Name
StatusCode
�mStatusCodeTEMPP�oj��F<U�Z����8���JD�	EventDataA��E�oData-K�Name
KeyNameLength
A��9�oData!K�NameKeyName
A��Q�oData9K�NameParentKeyNameLength
A��E�oData-K�Name
ParentKeyName
�o�op4p KeyNameLengthKeyName,ParentKeyNameLength ParentKeyNamePRVA\hpMicrosoft-Windows-Kernel-AppCompatOPCOx1�p2�p2qwin:Infowin:Startwin:StopLEVLdPLqPdqwin:Error(win:InformationalTASK,����xr�����r�����r�����r����s����4s����`s�����s$CompatCacheInit(CompatCacheQuery$CompatCdbQuery$CompatMapQuirks(CompatCacheUpdate,CompatUserModeQuery$CompatSdbQuery4CompatCacheQueryProcessKEYWH�����s,RegWrpAccessDeniedEVNTt�6�j�p@qpw�i@�����p@q�q�i@����@m�p@q�q�i@�����p@qr�i@����@m�p@qr�i@�����p@q�q�i@����@m�p@q�q�i@�����p@q�q�i	@����@m�p@q�q�i
@�����p@q�q�i@����@m�p@q�q�i@�����p@q$r�i
@����@m�p@q$r�i@�����p@q@r�i@����@m�p@q@r�i@�����p@q\r�i@����@m�p@q\r�i��	n4q�i�sWEVT,-�w
� �,�l�4�@�TTBL$TEMPy\��S�CL�93���� D�	EventDataA��Y�oDataAK�NamecchAppPathIncludingNull
A��_�oDataGK�NameApplicationImageHeaderHash
A��9�oData!K�NameAppPath
Xy�y�y4cchAppPathIncludingNull<ApplicationImageHeaderHashAppPathTEMP|�z}�풚T�Xh���������D�	EventDataA��A�oData)K�NameFeatureGuid
A��_�oDataGK�NameApplicationImageHeaderHash
{{FeatureGuid<ApplicationImageHeaderHashTEMP4�|��H�^�m#��!���:D�	EventDataA��A�oData)K�NameFeatureGuid
A��C�oData+K�NameCallerIdType
A��C�oData+K�NamecchImagePath
A��=�oData%K�Name	ImagePath
}4}T}t}FeatureGuid CallerIdType cchImagePathImagePathTEMP�Lx�a8p�RX1��z�`���D�	EventDataA��i�oDataQK�NamecchParentImagePathIncludingNull
A��A�oData)K�NameFeatureGuid
A��c�oDataKK�NameParentProcessImageHeaderHash
A��I�oData1K�NameParentImagePath
���<�DcchParentImagePathIncludingNullFeatureGuid@ParentProcessImageHeaderHash$ParentImagePathTEMP		t�U��[W_���y��x���D�	EventDataA��5�oDataK�NameFlags
A��[�oDataCK�NamecchIdStringIncludingNull
A��Y�oDataAK�NamecchDllPathIncludingNull
A��;�oData#K�NameCategory
A��I�oData1K�NameManifestVersion
A��E�oData-K�Name
DllHeaderHash
A��_�oDataGK�NameApplicationImageHeaderHash
A��;�oData#K�NameIdString
A��9�oData!K�NameDllPath
(�8�p�������<�T�Flags8cchIdStringIncludingNull4cchDllPathIncludingNullCategory$ManifestVersion DllHeaderHash<ApplicationImageHeaderHashIdStringDllPathTEMPx��]ng��P\��\堟����D�	EventDataA��5�oDataK�NameFlags
A��[�oDataCK�NamecchIdStringIncludingNull
A��;�oData#K�NameCategory
A��I�oData1K�NameManifestVersion
A��_�oDataGK�NameApplicationImageHeaderHash
A��;�oData#K�NameIdString
��P�h���ȈFlags8cchIdStringIncludingNullCategory$ManifestVersion<ApplicationImageHeaderHashIdStringPRVA@�Microsoft-Windows-AITOPCOLEVL@PD�(win:InformationalTASK�����<�����X�����������������̊�����������AitFeature,AitParentAitFeatureAitAppInfo,AitSystemUsageByDll,AitSystemUsageByExe AitProcessEndKitFeatureKEYWEVNT`�����y8�x������}8��������w8�������`�8�̉����h�8������8������X{8� �WEVTx0�
�t�����̎؎TTBL�TEMP�����{��U+0"�����vD�	EventDataA��U�oData=K�NameAeLookupServieTrigger
��0AeLookupServieTriggerPRVA���Microsoft-Windows-ApplicationExperience-LookupServiceTriggerOPCOLEVL@P��(win:InformationalTASKKEYWEVNT@�������WEVT�.h�̐
����������CHANd�����������h�����hMicrosoft-Windows-Kernel-ApphelpCache/Operational\Microsoft-Windows-Kernel-ApphelpCache/DebugdMicrosoft-Windows-Kernel-ApphelpCache/AnalyticTTBL�TEMP�|�_�Yn5�]�S�#����pD�	EventDataA��O�oData7K�NameOperationalMessage
��,OperationalMessageTEMP�T�nШ)�\�����{���bD�	EventDataA��A�oData)K�NameInfoMessage
h�InfoMessageTEMP��$&��_��XB�8'�;���dD�	EventDataA��C�oData+K�NameDebugMessage
0� DebugMessageTEMPTДG'L46߬U��|�8����LD�	EventDataA��9�oData!K�NameMatches

A��A�oData)K�NameCheckerName
A��E�oData-K�Name
AttributeName
A��W�oData?K�NameAttributeExpectedValue


 �4�P�p�MatchesCheckerName AttributeName4AttributeExpectedValueTEMPT$��B���S%�N���*���LD�	EventDataA��9�oData!K�NameMatches

A��A�oData)K�NameCheckerName
A��E�oData-K�Name
AttributeName
A��W�oData?K�NameAttributeExpectedValue


t�����ėMatchesCheckerName AttributeName4AttributeExpectedValueTEMPTx�N�T3��*T}�O�(�U���LD�	EventDataA��9�oData!K�NameMatches

A��A�oData)K�NameCheckerName
A��E�oData-K�Name
AttributeName
A��W�oData?K�NameAttributeExpectedValue


șܙ���MatchesCheckerName AttributeName4AttributeExpectedValueTEMPT̛^T����Q
1����M���LD�	EventDataA��9�oData!K�NameMatches

A��A�oData)K�NameCheckerName
A��E�oData-K�Name
AttributeName
A��W�oData?K�NameAttributeExpectedValue



�0�L�

l�MatchesCheckerName AttributeName4AttributeExpectedValuePRVAp��Microsoft-Windows-ApplicationExperience-CacheOPCOLEVLdP@�PX�win:Error(win:InformationalTASKKEYWEVNT`�3ؐ4�t� 4��4���@5��(���@4P�4���@4��4���@4��4���	@4L�4���WEVT�
/@�
�h�t�����ȫTTBL�
TEMPxh�No��X�Z-YT��i����D�	EventDataA��K�oData3K�NameSwitchBranchGuid
A��W�oData?K�NameSwitchBranchNameLength
A��K�oData3K�NameSwitchBranchName
A��e�oDataMK�NameSwitchBranchDescriptionLength
A��Y�oDataAK�NameSwitchBranchDescription
̡�(�P���(SwitchBranchGuid4SwitchBranchNameLength(SwitchBranchName@SwitchBranchDescriptionLength4SwitchBranchDescriptionTEMP���O���P�.��>$��D�	EventDataA��S�oData;K�NameSwitchBranchImplGuid
A��_�oDataGK�NameSwitchBranchImplNameLength
A��S�oData;K�NameSwitchBranchImplName
A��m�oDataUK�Name!SwitchBranchImplDescriptionLength
A��a�oDataIK�NameSwitchBranchImplDescription
l���إ�P�0SwitchBranchImplGuid<SwitchBranchImplNameLength0SwitchBranchImplNameHSwitchBranchImplDescriptionLength<SwitchBranchImplDescriptionTEMPt��=�t�\U�����ZD�	EventDataA��M�oData5K�NameTargetContextGuid
A��M�oData5K�NameTargetContextType
A��K�oData3K�NameModuleNameLength
A��?�oData'K�Name
ModuleName
l������(TargetContextGuid(TargetContextType(ModuleNameLengthModuleNameTEMP���mUl���S��G4�1���tD�	EventDataA��S�oData;K�NameContextUpdateCounter



��0ContextUpdateCounterPRVA|�Microsoft-Windows-ApplicationExperience-SwitchBackOPCOLEVL@P��(win:InformationalTASK����0�����H�����`�������AeSbCallAeSbImpl(AeSbContextUpdate0AeSbContextReadRetryKEYWEVNT�����L���������Ģ��ܪ������������������WEVT`'��\�
��(������h�CHANt�����XMicrosoft-Windows-Kernel-Network/AnalyticTTBLtTEMP(

�l\FX_TR4Ԅ/"\��zD�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��;�oData#K�Namestartime
A��9�oData!K�Nameendtime
A��7�oDataK�Nameseqnum
A��7�oDataK�Nameconnid
	������,�<�T�h�|�PIDsizedaddrsaddrdportsportstartimeendtimeseqnumconnidTEMPP��ؕ�`�]O QjYDz����D�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��7�oDataK�Nameseqnum
A��7�oDataK�Nameconnid
\�h�x���������̴PIDsizedaddrsaddrdportsportseqnumconnidTEMP(̸A�r���S����K������D�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��1�oDataK�Namemss
A��9�oData!K�Namesackopt
A��5�oDataK�Nametsopt
A��5�oDataK�Namewsopt
	A��7�oDataK�Namercvwin
A��A�oData)K�Namercvwinscale
A��A�oData)K�Namesndwinscale
A��7�oDataK�Nameseqnum

A��7�oDataK�Nameconnid
����$�4�D�T�`�t�������ĺ��PIDsizedaddrsaddrdportsportmsssackopttsoptwsoptrcvwinrcvwinscalesndwinscaleseqnumconnidTEMP(ܻ(n�n3��^���2�P���D�	EventDataA��5�oDataK�NameProto
A��A�oData)K�NameFailureCode
��ProtoFailureCodeTEMP(

�{i^�Ӻ.\���F����zD�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��;�oData#K�Namestartime
A��9�oData!K�Nameendtime
A��7�oDataK�Nameseqnum
A��7�oDataK�Nameconnid
	����ĿԿ����0�D�PIDsizedaddrsaddrdportsportstartimeendtimeseqnumconnidTEMPP��5[� 7�WIh�C4����D�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��7�oDataK�Nameseqnum
A��7�oDataK�Nameconnid
$�0�@�P�`�p�����PIDsizedaddrsaddrdportsportseqnumconnidTEMP(������OQ�s��W����D�	EventDataA��1�oDataK�NamePID
A��3�oDataK�Namesize
A��5�oDataK�Namedaddr
A��5�oDataK�Namesaddr
A��5�oDataK�Namedport
A��5�oDataK�Namesport
A��1�oDataK�Namemss
A��9�oData!K�Namesackopt
A��5�oDataK�Nametsopt
A��5�oDataK�Namewsopt
	A��7�oDataK�Namercvwin
A��A�oData)K�Namercvwinscale
A��A�oData)K�Namesndwinscale
A��7�oDataK�Nameseqnum

A��7�oDataK�Nameconnid
������������(�<�L�\�p�������PIDsizedaddrsaddrdportsportmsssackopttsoptwsoptrcvwinrcvwinscalesndwinscaleseqnumconnidPRVAX��Microsoft-Windows-Kernel-NetworkOPCO�
������<�
�|�������L�������*��+�L�1��<KERNEL_NETWORK_OPCODE_SEND<KERNEL_NETWORK_OPCODE_RECV@KERNEL_NETWORK_OPCODE_CONNECTHKERNEL_NETWORK_OPCODE_DISCONNECTHKERNEL_NETWORK_OPCODE_RETRANSMIT@KERNEL_NETWORK_OPCODE_ACCEPTDKERNEL_NETWORK_OPCODE_RECONNECT<KERNEL_NETWORK_OPCODE_FAIL@KERNEL_NETWORK_OPCODE_TCPCOPY@KERNEL_NETWORK_OPCODE_SENDUDP@KERNEL_NETWORK_OPCODE_RECVUDP@KERNEL_NETWORK_OPCODE_FAILUDPLEVL@P��(win:InformationalTASK�
����P�������8KERNEL_NETWORK_TASK_TCPIP8KERNEL_NETWORK_TASK_UDPIPKEYW������� ����(�<KERNEL_NETWORK_KEYWORD_IPV4<KERNEL_NETWORK_KEYWORD_IPV6EVNT�


�h�4�������
���@�������
��L�������

���X�������
���d�������
��p�������
���|�������
0����������
�	����������

 �
0�4�������
 �X�@�������
 ���L�������
 �X�X�������
 �X�d�������
 ���p������� 
 �X�|�������"
 �X���������**�
������4����++�������4����110������4����:* �X�����4����;+ �X�����4����������������������������������������������������WEVT�XH���
D�����������CHANpd�����TMicrosoft-Windows-Kernel-Disk/AnalyticTTBL�TEMP,\��ѵ�ggZ�� *B��bD�	EventDataA��?�oData'K�Name
DiskNumber
A��;�oData#K�NameIrpFlags
A��C�oData+K�NameTransferSize
A��;�oData#K�NameReserved
A��?�oData'K�Name
ByteOffset

A��?�oData'K�Name
FileObject
A��I�oData1K�NameIORequestPacket
A��Q�oData9K�NameHighResResponseTime

���0�P�

h�����

��DiskNumberIrpFlags TransferSizeReservedByteOffsetFileObject$IORequestPacket,HighResResponseTimeTEMPTp�(u��&,&V�O��2���JD�	EventDataA��?�oData'K�Name
DiskNumber
A��;�oData#K�NameIrpFlags
A��Q�oData9K�NameHighResResponseTime

A��I�oData1K�NameIORequestPacket
����

�� �DiskNumberIrpFlags,HighResResponseTime$IORequestPacketPRVAPX�Microsoft-Windows-Kernel-DiskOPCOLEVL@P��(win:InformationalTASKKEYWEVNT�
�Y����T��Z����T��[����T�WEVT�Q�	����p�
<��T#x%CHAN���x��\Microsoft-Windows-Kernel-EventTracing/AdmindMicrosoft-Windows-Kernel-EventTracing/AnalyticMAPS���VMAPdP�
��������	�
� StopReasonMapTTBL�<TEMP��
�9G�U�d��A�v��0D�	EventDataA��A�oData)K�NameSessionName
A��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��A�oData)K�NameLoggingMode
0�L�d�|�SessionNameFileNameErrorCodeLoggingModeTEMP�H�i[%�_�[Vw'�֦Z���|D�	EventDataA��A�oData)K�NameSessionName
A��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��A�oData)K�NameLoggingMode
A��E�oData-K�Name
FailureReason
�����������SessionNameFileNameErrorCodeLoggingMode FailureReasonTEMP����A\�X+�P2�Z;f���xD�	EventDataA��A�oData)K�NameSessionName
A��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��A�oData)K�NameLoggingMode
A��A�oData)K�NameMaxFileSize

D�`�x���

��SessionNameFileNameErrorCodeLoggingModeMaxFileSizeTEMP������d��TY��|������D�	EventDataA��A�oData)K�NameSessionName
A��=�oData%K�Name	ErrorCode
A��A�oData)K�NameLoggingMode
(�D�\�SessionNameErrorCodeLoggingModeTEMPDX��X�f��Z�pI�n���D�	EventDataA��C�oData+K�NameProviderName
A��A�oData)K�NameSessionName
���� ProviderNameSessionNameTEMP�T� ����Y�{?C����dD�	EventDataA��C�oData+K�NameProviderName
h� ProviderNameTEMP,���#�|��VS��?����8D�	EventDataA��A�oData)K�NameSessionGuid
A��?�oData'K�Name
LoggerMode
A��A�oData)K�NameSessionName
A��A�oData)K�NameLogFileName
D�`�|���SessionGuidLoggerModeSessionNameLogFileNameTEMP�T�� �!@�T�TQ�/�Z��jD�	EventDataA��I�oData1K�NameLoggerSlotsUsed



h�$LoggerSlotsUsedTEMP\

��?����a
]�>��;��Q��D�	EventDataA��A�oData)K�NameSessionGuid
A��?�oData'K�Name
LoggerMode
A��A�oData)K�NameSessionName
A��A�oData)K�NameLogFileName
A��G�oData/K�NameMinimumBuffers
A��G�oData/K�NameMaximumBuffers
A��?�oData'K�Name
BufferSize
A��K�oData3K�NamePeakBuffersCount
A��Q�oData9K�NameCurrentBuffersCount
A��G�oData/K�NameFlushThreshold
	���������0�T�p�����SessionGuidLoggerModeSessionNameLogFileName$MinimumBuffers$MaximumBuffersBufferSize(PeakBuffersCount,CurrentBuffersCount$FlushThresholdTEMPPX��$���[�㟿�Q��:D�	EventDataA��A�oData)K�NameSessionGuid
A��?�oData'K�Name
LoggerMode
A��A�oData)K�NameSessionName
A��A�oData)K�NameLogFileName
A��G�oData/K�NameMinimumBuffers
A��G�oData/K�NameMaximumBuffers
A��?�oData'K�Name
BufferSize
A��K�oData3K�NamePeakBuffersCount
A��Q�oData9K�NameCurrentBuffersCount
A��G�oData/K�NameFlushThreshold
	A��?�oData'K�Name
EventsLost
A��A�oData)K�NameBuffersLost
A��Q�oData9K�NameRealTimeBuffersLost
A��;�oData#K�NameLoggerId

p��������(�D�l������� �SessionGuidLoggerModeSessionNameLogFileName$MinimumBuffers$MaximumBuffersBufferSize(PeakBuffersCount,CurrentBuffersCount$FlushThresholdEventsLostBuffersLost,RealTimeBuffersLostLoggerIdTEMP�p�
.��tX�W���G
��D�	EventDataA��A�oData)K�NameSessionName
A��I�oData1K�NameSecurityDescOld
A��I�oData1K�NameSecurityDescNew
����SessionName$SecurityDescOld$SecurityDescNewTEMPt�˥����Y�P_��y���.D�	EventDataA��?�oData'K�Name
ProviderId
A��?�oData'K�Name
StatusCode
A��9�oData!K�NameEventId
A��A�oData)K�NameSessionName
�����ProviderIdStatusCodeEventIdSessionNameTEMP$���G��.�TZ;7T���>��2D�	EventDataA��?�oData'K�Name
ProviderId
A��?�oData'K�Name
StatusCode
A��=�oData%K�Name	EventName
A��A�oData)K�NameSessionName
��#�4�ProviderIdStatusCodeEventNameSessionNameTEMP4��y$h��W6�a�+gQ(��<D�	EventDataA��A�oData)K�NameMessageGuid
A��E�oData-K�Name
MessageNumber
A��?�oData'K�Name
StatusCode
A��A�oData)K�NameSessionName
,LhMessageGuid MessageNumberStatusCodeSessionNameTEMP��!��n^a�KӾr����D�	EventDataA��7�oDataK�NameHookId
A��?�oData'K�Name
StatusCode
A��A�oData)K�NameSessionName
��HookIdStatusCodeSessionNameTEMP<49�'H�*bR�J�����D�	EventDataA��C�oData+K�NameProviderName
A��A�oData)K�NameSessionName
A��I�oData1K�NameMatchAnyKeyword

A��I�oData1K�NameMatchAllKeyword

A��G�oData/K�NameEnableProperty
A��5�oDataK�NameLevel
��
�
0T ProviderNameSessionName$MatchAnyKeyword$MatchAllKeyword$EnablePropertyLevelTEMP��茴��\��i������D�	EventDataA��;�oData#K�NameFileName
A��?�oData'K�Name
BufferSize
A��K�oData3K�NameBuffersPersisted
A��G�oData/K�NameBuffersWritten
A��7�oDataK�NameStatus
|����FileNameBufferSize(BuffersPersisted$BuffersWrittenStatusTEMP$�`�Z�S��.�ۊ���D�	EventDataA��;�oData#K�NameFileName
A��?�oData'K�Name
BufferSize
A��K�oData3K�NameBuffersPersisted
A��G�oData/K�NameBuffersWritten
A��7�oDataK�NameStatus
A��A�oData)K�NameBuffersLost
����FileNameBufferSize(BuffersPersisted$BuffersWrittenStatusBuffersLostTEMP\ 
w�,V�
tZ�$@6�������D�	EventDataA��C�oData+K�NameProviderGuid
A��M�oData5K�NameProviderGroupGuid
H
h
 ProviderGuid(ProviderGroupGuidTEMP<l�o���U}2jYn��:���D�	EventDataA��C�oData+K�NameProviderGuid
A��=�oData%K�Name	ErrorCode
�� ProviderGuidErrorCodeTEMP�C��6R�SСC��Qa����D�	EventDataA��C�oData+K�NameProviderGUID
A��=�oData%K�Name	GroupGUID
A��5�oDataK�NameFlags
A��?�oData'K�Name
EnableMask
A��I�oData1K�NameGroupEnableMask
A��=�oData%K�Name	ProcessId
8Xp��� ProviderGUIDGroupGUIDFlagsEnableMask$GroupEnableMaskProcessIdTEMPp׺��}YEA��C����D�	EventDataA��3�oDataK�NameGUID
A��5�oDataK�NameIndex
A��;�oData#K�NameLoggerId
A��I�oData1K�NameMatchAnyKeyword

A��I�oData1K�NameMatchAllKeyword

A��5�oDataK�NameLevel
A��G�oData/K�NameEnableProperty
���
�
�$GUIDIndexLoggerId$MatchAnyKeyword$MatchAllKeywordLevel$EnablePropertyTEMP�p1��WPZ“���لb���D�	EventDataA��3�oDataK�NameGUID
A��A�oData)K�NameFilterFlags
A��O�oData7K�NameLastEnableLoggerId
���GUIDFilterFlags,LastEnableLoggerIdTEMPh_�If�TP�������.D�	EventDataA��C�oData+K�NameProviderGuid
A��A�oData)K�NameSessionName
A��=�oData%K�Name	ProcessId
A��7�oDataK�NameStatus
��� ProviderGuidSessionNameProcessIdStatusTEMP�_�If�TP�������.D�	EventDataA��C�oData+K�NameProviderGuid
A��A�oData)K�NameSessionName
A��=�oData%K�Name	ProcessId
A��7�oDataK�NameStatus
��( ProviderGuidSessionNameProcessIdStatusPRVA`PMicrosoft-Windows-Kernel-EventTracingOPCOx1h2�2�
������@�d��������<�lU�V�win:Infowin:Startwin:Stop4ETW_OPCODE_WRITE_BUFFER4ETW_OPCODE_FILE_SWITCH(ETW_OPCODE_START$ETW_OPCODE_STOP(ETW_OPCODE_FLUSH,ETW_OPCODE_REGISTER0ETW_OPCODE_UNREGISTER(ETW_OPCODE_ENABLE,ETW_OPCODE_DISABLE0ETW_OPCODE_CONFIGUREHETW_OPCODE_USER_MODE_STACK_TRACE0ETW_OPCODE_SET_TRAITS0ETW_OPCODE_GROUP_JOINLEVL�PPPhP�[�win:Errorwin:Warning(win:Informationalwin:VerboseTASK��$!�L!�t!��!��!��!�("����T"	T�"
\�"]�"^#(ETW_TASK_LOGGING(ETW_TASK_SESSION(ETW_TASK_PROVIDER,ETW_TASK_GUID_ENTRY0ETW_TASK_GROUP_ENTRY0ETW_TASK_STACK_TRACE,ETW_TASK_LOST_EVENT,SavePersistedLogger0ETW_TASK_ENABLE_INFO4ETW_TASK_LOST_TLG_EVENT4ETW_TASK_LOST_WPP_EVENT<ETW_TASK_LOST_SYSTEM_EVENTKEYW ��# �$@�<$�����p$�����$�����$����%����L%,ETW_KEYWORD_SESSION0ETW_KEYWORD_PROVIDER4ETW_KEYWORD_LOST_EVENT8ETW_KEYWORD_SOFT_RESTART8ETW_KEYWORD_CAPTURE_STATE8ETW_KEYWORD_REGISTRATION4ETW_KEYWORD_ENABLEMENT(ETW_KEYWORD_GROUPEVNT	+
��|�� ��-��
�����,��-����|�� ��-����|�� ��-������� ��-��
��4��,��-����|�� ��-�� @���D �-�	 @���D �-�
@����D��-�
@����D��-�@����D��-�@����D��-�@����D��-�@���8D��-�
@����D��-� @�x� D �-� @�( D �-� @�x�,D �-�@���8D��-��D8` @������ | �-�������D�.�������D�.������8� .�����d�8� .�����	�8� .���d� � .�����	� � .�� ����H�D(  .	����H�DD (.	 ������D� 0. ������D 8. 
�R�
P  @.�� 
@S4\D L.� @��D X.�
@����,�� � `. 0� � �, d.��!@����P�� � l."@������ !p.#@������� �t.�( @�( D x.�) @�x�,D �.�`#`#`#`#`#`#`#p#�#p#�#`#`#`#`#`#`#`#p#�#p#�#p#�#`#�#`#`#�#�#�#�#�#�#p#�#�#�#p#�#p#�#p#�#�#p#�#�#p#�#�#`#p#�#�#`#p#�#p#�#WEVT@I�	�.�/(:
 pL%�%`CFCHAN�/�0/�����/����SystemTMicrosoft-Windows-Kernel-Boot/AnalyticXMicrosoft-Windows-Kernel-Boot/OperationalMAPSL
�080�8�8 7�0VMAP|L9
��������d	�e
�f�g�h
�BMAP|:
������ �@��	�
��� 
�VMAP$�8���� � � �0�0�0�0�0�0�0�P�@�@�@�@�@ �@!�@"� @#� @$� @%� @&� @'� @(� @)� @*� @+�	 @,�
 @-� @.� @/�
 @0� @1� @2� @3� @4� @5� @6� @7� @8� @9� @:� @;� @<� @=� @>� @?� @@�0@A�0@B�0@C�0@D�0@E�0@F�0@G�0@H�	0@I�
0@J�0@K�0@L�
0@M�0@N�0@O�0@P�0@Q�0@R�0@S�0@T�0@U�0@V�0@W�0@X�0@Y�0@Z�0@[�0@\�0@]�0@^�0@_� 0@`�!0@a�"0@b�#0@c�$0@d�%0@e�&0@f�'0@g�(0@h�)0@i�*0@j�+0@k�,0@l�-0@m�.0@n�/0@o�00@p�10@q�20@r�30@s�40@t�50@u�60@v�70@w�80@x�90@y�:0@z�;0@{�<0@|�=0@}�>0@~�?0@�@0@��A0@��B0@��C0@��D0@��E0@��Y0@��@@��@@��@@��@@��@@��@@��@@��P@��P@��P@��P@��P@��P@��P@��P@��P@��	P@��
P@��P@��P@��
P@��P@��P@��`@��`@��`@��`@��`@��`@��`@��`@��	`@��
`@��`@��`@��
`@��`@��`@��`@��`@��`@��`@��`@��`@��`@��`@��`@��`@��`@��`@��`@��`@��`@��`@�� `@��!`@��"`@��#`@��$`@��%`@��&`@��'`@��(`@��)`@��*`@��+`@��,`@��-`@��.`@��/`@��0`@��1`@��2`@��VMAP��9������������������	��
������
������������������������������VMAPt$9������������������	��
����VMAP4�9��������VMAP<�9���������,BootDiagMessageMap(DebuggerStatusMap4EnableDisableReasonMap,SbatUpdateStatusMap<SecureBootBcdMitigationMap TxtStatusMap VsmPolicyMapTTBL���TEMP`�;��Ǎ��Y<��������D�	EventDataA��9�oData!K�NameSqmType
A��G�oData/K�NameSqmSessionGuid
A��5�oDataK�NameSqmID
A��O�oData7K�NameSqmStreamRowLength
A��QZ�ComplexData+K�NameSqmStreamRow
��<�<�<�<=0=P=p=SqmType$SqmSessionGuidSqmID,SqmStreamRowLength SqmStreamRow SqmTypeEntry SqmDWORDEntry$SqmStringEntryTEMP��>*�d�Ÿ[�|5�NR����D�	EventDataA��5�oDataK�NameWidth
A��7�oDataK�NameHeight
A��C�oData+K�NameBitsPerPixel
�>�>?WidthHeight BitsPerPixelTEMP��?A�g���[k#l�'t���`D�	EventDataA��?�oData'K�Name
BytesPerMs
�?BytesPerMsTEMPLA�
1�BW[�n��Ts��,D�	EventDataA��;�oData#K�NameDeviceID
A��;�oData#K�NameFileName
A��=�oData%K�Name	BytesRead

A��C�oData+K�NameBytesWritten

�A�A

�A

�ADeviceIDFileNameBytesRead BytesWrittenTEMP�C�چ�ЛV���k+�[b���D�	EventDataA��;�oData#K�NameDeviceID
A��;�oData#K�NameFileName
A��7�oDataK�NameStatus
PChC�CDeviceIDFileNameStatusTEMP��Dj���_��������D�	EventDataA��I�oData1K�NameApplicationGuid
A��=�oData%K�Name	BytesRead

A��C�oData+K�NameBytesWritten

�D

 E

8E$ApplicationGuidBytesRead BytesWrittenTEMP�F�f��
�Rۓ����F���,D�	EventDataA��=�oData%K�Name	ImageName
A��?�oData'K�Name
ImageFlags
A��7�oDataK�NameReason
A��C�oData+K�NameErrorIgnored
G G<GPGImageNameImageFlagsReason ErrorIgnoredTEMP�H�4�~MQ9�TsK,^.��bD�	EventDataA��A�oData)K�NameBootmgrTime



HBootmgrTimeTEMP��H��H�Q��b����^D�	EventDataA��=�oData%K�Name	ImageName
�HImageNameTEMP��IR��6Am�Z�������bD�	EventDataA��A�oData)K�NameDriveNumber
�IDriveNumberTEMPXpL�@a�]�0gډ�����zD�	EventDataA��A�oData)K�NameFwStartPage

A��A�oData)K�NameFwPageCount

A��C�oData+K�NameFwMemoryType
A��O�oData7K�NameFwMemoryAttributes
A��A�oData)K�NameBlStartPage

A��A�oData)K�NameBlPageCount

A��C�oData+K�NameBlMemoryType
A��O�oData7K�NameBlMemoryAttributes

M
,MHMhM
�M
�M�M�MFwStartPageFwPageCount FwMemoryType,FwMemoryAttributesBlStartPageBlPageCount BlMemoryType,BlMemoryAttributesTEMP��N�"�jfg$\���L�����hD�	EventDataA��G�oData/K�NamePreBootMgrTime



�N$PreBootMgrTimeTEMP�P�&6�ؕ]�nZ�H����D�	EventDataA��K�oData3K�NameUefiVariableName
A��3�oDataK�NameSize
A��7�oDataK�NameStatus
@PhPxP(UefiVariableNameSizeStatusTEMP@lQ7":���Q:��b��M���D�	EventDataA��I�oData1K�NameApplicationGuid
A��9�oData!K�NameElement
�Q�Q$ApplicationGuidElementTEMP�XR$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
lRStatusTEMP�S$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
 SStatusTEMPLTI��Q�H�\�p�Ԧ����D�	EventDataA��E�oData-K�Name
FailureStatus

A��C�oData+K�NameFailureMsgId


@T
`T FailureStatus FailureMsgIdTEMPD`U�UaJ˅W�����������D�	EventDataA��E�oData-K�Name
FailureStatus
A��?�oData'K�Name
FailureMsg
�U�U FailureStatusFailureMsgTEMPPV)5�H7^A����d����D�	EventDataTEMP��V�H�tjI�Q��Bn�a���`D�	EventDataA��?�oData'K�Name
EntryCount
�VEntryCountTEMP�lW���X��4`����`D�	EventDataA��?�oData'K�Name
ToolsCount
�WToolsCountTEMP\�X�;���W�Q[\4�����D�	EventDataA��K�oData3K�NameLastShutdownGood

A��C�oData+K�NameLastBootGood



�X

�X(LastShutdownGood LastBootGoodTEMP`|Zg����+�[d��f���ND�	EventDataA��K�oData3K�NameLastShutdownGood

A��C�oData+K�NameLastBootGood

A��?�oData'K�Name
LastBootId
A��K�oData3K�NameBootStatusPolicy


�Z

�Z[0[(LastShutdownGood LastBootGoodLastBootId(BootStatusPolicyTEMP��[
r�y��Wyþ���T��hD�	EventDataA��G�oData/K�NameOptionSelected
\$OptionSelectedTEMPP|\)5�H7^A����d����D�	EventDataTEMPP�\)5�H7^A����d����D�	EventDataTEMPP])5�H7^A����d����D�	EventDataTEMP��]S�/y^�����q0��hD�	EventDataA��G�oData/K�NameBootMenuPolicy
�]$BootMenuPolicyTEMPP@^)5�H7^A����d����D�	EventDataTEMP��^w��-g0�^���"	���\D�	EventDataA��;�oData#K�NameBootType
�^BootTypeTEMP4�_��	;H�^Fߟ�U�����D�	EventDataA��;�oData#K�NameBootType
A��A�oData)K�NameLoadOptions
�_`BootTypeLoadOptionsTEMP,(bv5Y�0�EX��5f0�q����D�	EventDataA��E�oData-K�Name
ResetEndStart

A��K�oData3K�NameLoadOSImageStart

A��M�oData5K�NameStartOSImageStart

A��U�oData=K�NameExitBootServicesEntry

A��S�oData;K�NameExitBootServicesExit



�b

�b

�b

�b

,c ResetEndStart(LoadOSImageStart(StartOSImageStart0ExitBootServicesEntry0ExitBootServicesExitTEMP��c$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
�cStatusTEMP��d��{��b(]�O]9�����xD�	EventDataA��W�oData?K�NameBitlockerUserInputTime



�d4BitlockerUserInputTimeTEMPH�e�m�[ MkV,Bc�t���D�	EventDataA��=�oData%K�Name	ImageName
A��I�oData1K�NameImageLoadStatus
f(fImageName$ImageLoadStatusTEMPX8g�bIU�2Z"��M���D�	EventDataA��A�oData)K�NamePeImageName
A��M�oData5K�NamePeImageLoadStatus
`g|gPeImageName(PeImageLoadStatusTEMP�Lh�QI��-R�d�(P��rD�	EventDataA��Q�oData9K�NameUpdateCapsuleStatus
`h,UpdateCapsuleStatusTEMP��iJ�M�9��T2�`0cX���D�	EventDataA��A�oData)K�NameDeviceFlags
A��=�oData%K�Name	PcrBitmap
A��U�oData=K�NameUpdateSupportedStatus
jj4jDeviceFlagsPcrBitmap0UpdateSupportedStatusTEMPHHk�m�[ MkV,Bc�t���D�	EventDataA��=�oData%K�Name	ImageName
A��I�oData1K�NameImageLoadStatus
pk�kImageName$ImageLoadStatusTEMPH�l�m�[ MkV,Bc�t���D�	EventDataA��=�oData%K�Name	ImageName
A��I�oData1K�NameImageLoadStatus
�l�lImageName$ImageLoadStatusTEMPD�m�#|�'$\-]���H���D�	EventDataA��=�oData%K�Name	ImageName
A��G�oData/K�NameSiPolicyStatus
�mnImageName$SiPolicyStatusTEMPDo�T&��{Z�pu�t�����D�	EventDataA��;�oData#K�NameHiveName
A��G�oData/K�NameHiveLoadStatus
@oXoHiveName$HiveLoadStatusTEMP�p$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
pStatusTEMP��p$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
�pStatusTEMP��qX���S#…�H9����D�	EventDataA��3�oDataK�NamePath
A��?�oData'K�Name
FailedPath
A��7�oDataK�NameStatus
,r<rXrPathFailedPathStatusTEMPxpsdC��6lZ'H_�?Z�����D�	EventDataA��3�oDataK�NamePath
A��7�oDataK�NameImport
A��7�oDataK�NameStatus
�s�s�sPathImportStatusTEMP��u�Njzp�P�N?�����tD�	EventDataA��K�oData3K�NameCachedCopyStatus
A��Q�oData9K�NameIdkGenerationStatus
A��I�oData1K�NameMeasuringStatus
A��Y�oDataAK�NameSealingAndCachingStatus
�uv0vTv(CachedCopyStatus,IdkGenerationStatus$MeasuringStatus4SealingAndCachingStatusTEMPD�z*--�c�
_-tn��y���D�	EventDataA��K�oData3K�NameCachedCopyStatus
A��]�oDataEK�NameUnsealingCachedCopyStatus
A��_�oDataGK�NameKeyGenerationAndSaveStatus
A��E�oData-K�Name
SealingStatus
A��?�oData'K�Name
TpmPcrMask
A��e�oDataMK�NameProtectorAssistedUnsealStatus
A��e�oDataMK�NameProtectorAssistedResealStatus
A��]�oDataEK�NameProtectorSealUpdateStatus
A��O�oData7K�NameTpmCounterOpStatus
A��W�oData?K�NameTpmCounterCreateStatus
	A��S�oData;K�NameBackupSealedBlobUsed

�{�{|H|h|�|�|}<}h}

�}(CachedCopyStatus8UnsealingCachedCopyStatus<KeyGenerationAndSaveStatus SealingStatusTpmPcrMask@ProtectorAssistedUnsealStatus@ProtectorAssistedResealStatus8ProtectorSealUpdateStatus,TpmCounterOpStatus4TpmCounterCreateStatus0BackupSealedBlobUsedTEMPT�/�kb.�R$+��\T����D�	EventDataA��K�oData3K�NameCachedCopyStatus
A��Y�oDataAK�NamePrimaryBlobUnsealStatus
A��W�oData?K�NameBackupBlobUnsealStatus
A��c�oDataKK�NamePca2023ProtectorUnsealStatus
A��e�oDataMK�NameBackupBlobValidityCheckStatus
A��S�oData;K�NameBackupBlobStillValid

A��q�oDataYK�Name#Pca2023ProtectorValidityCheckStatus
A��_�oDataGK�NamePca2023ProtectorStillValid

A��Y�oDataAK�NamePrimaryBlobResealStatus
A��W�oData?K�NameBackupBlobResealStatus
	A��c�oDataKK�NamePca2023ProtectorResealStatus
A��_�oDataGK�NameKeyGenerationAndSaveStatus
A��E�oData-K�Name
SealingStatus
A��?�oData'K�Name
TpmPcrMask

A��O�oData7K�NameTpmCounterOpStatus
A��W�oData?K�NameTpmCounterCreateStatus
A��S�oData;K�NameBackupSealedBlobUsed

A��{�oDatacK�Name(Pca2023ProtectorCleanupPostUpgradeStatus
P�x���� �

`���

܇�L��������8�d�

��ȉ(CachedCopyStatus4PrimaryBlobUnsealStatus4BackupBlobUnsealStatus@Pca2023ProtectorUnsealStatus@BackupBlobValidityCheckStatus0BackupBlobStillValidLPca2023ProtectorValidityCheckStatus<Pca2023ProtectorStillValid4PrimaryBlobResealStatus4BackupBlobResealStatus@Pca2023ProtectorResealStatus<KeyGenerationAndSaveStatus SealingStatusTpmPcrMask,TpmCounterOpStatus4TpmCounterCreateStatus0BackupSealedBlobUsedXPca2023ProtectorCleanupPostUpgradeStatusTEMP4,,؛D����wQ|��o�����D�	EventDataA��K�oData3K�NameCachedCopyStatus
A��Y�oDataAK�NamePrimaryBlobUnsealStatus
A��W�oData?K�NameBackupBlobUnsealStatus
A��c�oDataKK�NamePca2023ProtectorUnsealStatus
A��e�oDataMK�NameBackupBlobValidityCheckStatus
A��S�oData;K�NameBackupBlobStillValid

A��q�oDataYK�Name#Pca2023ProtectorValidityCheckStatus
A��_�oDataGK�NamePca2023ProtectorStillValid

A��Y�oDataAK�NamePrimaryBlobResealStatus
A��W�oData?K�NameBackupBlobResealStatus
	A��c�oDataKK�NamePca2023ProtectorResealStatus
A��_�oDataGK�NameKeyGenerationAndSaveStatus
A��E�oData-K�Name
SealingStatus
A��?�oData'K�Name
TpmPcrMask

A��O�oData7K�NameTpmCounterOpStatus
A��W�oData?K�NameTpmCounterCreateStatus
A��S�oData;K�NameBackupSealedBlobUsed

A��{�oDatacK�Name(Pca2023ProtectorCleanupPostUpgradeStatus
A��G�oData/K�NameNeedToRollLkey
A��U�oData=K�NameCreationStateVerified
A��K�oData3K�NameV2ProtectorsUsed
A��[�oDataCK�NameLegacyUefiVarQueryStatus
A��_�oDataGK�NameLegacyUefiVarCleanupStatus
A��k�oDataSK�Name VbsRollbackDataProtectionEnabled
A��k�oDataSK�Name VbsRollbackDataProtectionOptedIn
A��}�oDataeK�Name)VbsRollbackDataProtectionTpmCounterStatus
A��K�oData3K�NameFirstWriteToDisk
A��G�oData/K�NameWritePkgToUefi
A��S�oData;K�NameLatchedProtectorUsed
A��M�oData5K�NameLatchTheUnlatched
A��Q�oData9K�NameUnsupportedRollback
A��Y�oDataAK�NameUpgradedVbsPolicyExists
A��]�oDataEK�NameTpmCounterIncrementStatus
 A��Q�oData9K�NameActivePolicyVersion
!
A��S�oData;K�NameLatchedPolicyVersion
"
A��W�oData?K�NameUnlatchedPolicyVersion
#
A��k�oDataSK�Name LatchedPrimaryBlobResealStatusV2
$A��i�oDataQK�NameLatchedBackupBlobResealStatusV2
%A��u�oData]K�Name%LatchedPca2023ProtectorResealStatusV2
&A����oDatauK�Name1LatchedPca2023ProtectorCleanupPostUpgradeStatusV2
'A��o�oDataWK�Name"UnlatchedPrimaryBlobResealStatusV2
(A��m�oDataUK�Name!UnlatchedBackupBlobResealStatusV2
)A��y�oDataaK�Name'UnlatchedPca2023ProtectorResealStatusV2
*A����oDatayK�Name3UnlatchedPca2023ProtectorCleanupPostUpgradeStatusV2
+H�p���؟�

X���

Ԡ�D�x�����0�\�

����
�
<�
l���̣
�
P���
�
�
<�
l�
��
���

,�

X�

�����H����L����(CachedCopyStatus4PrimaryBlobUnsealStatus4BackupBlobUnsealStatus@Pca2023ProtectorUnsealStatus@BackupBlobValidityCheckStatus0BackupBlobStillValidLPca2023ProtectorValidityCheckStatus<Pca2023ProtectorStillValid4PrimaryBlobResealStatus4BackupBlobResealStatus@Pca2023ProtectorResealStatus<KeyGenerationAndSaveStatus SealingStatusTpmPcrMask,TpmCounterOpStatus4TpmCounterCreateStatus0BackupSealedBlobUsedXPca2023ProtectorCleanupPostUpgradeStatus$NeedToRollLkey0CreationStateVerified(V2ProtectorsUsed8LegacyUefiVarQueryStatus<LegacyUefiVarCleanupStatusHVbsRollbackDataProtectionEnabledHVbsRollbackDataProtectionOptedInXVbsRollbackDataProtectionTpmCounterStatus(FirstWriteToDisk$WritePkgToUefi0LatchedProtectorUsed(LatchTheUnlatched,UnsupportedRollback4UpgradedVbsPolicyExists8TpmCounterIncrementStatus,ActivePolicyVersion0LatchedPolicyVersion4UnlatchedPolicyVersionHLatchedPrimaryBlobResealStatusV2DLatchedBackupBlobResealStatusV2PLatchedPca2023ProtectorResealStatusV2hLatchedPca2023ProtectorCleanupPostUpgradeStatusV2LUnlatchedPrimaryBlobResealStatusV2HUnlatchedBackupBlobResealStatusV2TUnlatchedPca2023ProtectorResealStatusV2lUnlatchedPca2023ProtectorCleanupPostUpgradeStatusV2TEMP�  ����4��Q�m�]j�x��"
D�	EventDataA��7�oDataK�NameStatus
A��?�oData'K�Name
OsDeviceId
A��?�oData'K�Name
SystemRoot
A��A�oData)K�NamePcrSealMask
A��M�oData5K�NameLatchTheUnlatched
A��k�oDataSK�Name UpgradedAntirollbackPolicyExists
A��K�oData3K�NameEncryptionStatus
A��Y�oDataAK�NameKeyPkgIdTpmCounterValue

A��]�oDataEK�NameEncryptedLKeyArrayPkgSize
A��W�oData?K�NameEncryptedLKeyPkgPdGuid
	A��]�oDataEK�NameUnlatchedUnsealPolicySize
A��[�oDataCK�NameUnlatchedProtectorExists
A��Y�oDataAK�NameLatchedUnsealPolicySize
A��W�oData?K�NameLatchedProtectorExists

A��c�oDataKK�NameLatchedUnsealPolicy->Version
A��o�oDataWK�Name"LatchedUnsealPolicy->VarDataOffset
A��o�oDataWK�Name"LatchedUnsealPolicy->StructureSize
A��o�oDataWK�Name"LatchedUnsealPolicy->PolicyVersion

A��u�oData]K�Name%LatchedUnsealPolicy->PolicyHashLength
A��i�oDataQK�NameLatchedUnsealPolicy->WinloadSVN
A��m�oDataUK�Name!LatchedUnsealPolicy->WinresumeSVN
A��i�oDataQK�NameLatchedUnsealPolicy->BootmgrSVN
A��g�oDataOK�NameLatchedUnsealPolicy->LKeyPkgId

A��g�oDataOK�NameUnlatchedUnsealPolicy->Version
A��s�oData[K�Name$UnlatchedUnsealPolicy->VarDataOffset
A��s�oData[K�Name$UnlatchedUnsealPolicy->StructureSize
A��s�oData[K�Name$UnlatchedUnsealPolicy->PolicyVersion

A��y�oDataaK�Name'UnlatchedUnsealPolicy->PolicyHashLength
A��m�oDataUK�Name!UnlatchedUnsealPolicy->WinloadSVN
A��q�oDataYK�Name#UnlatchedUnsealPolicy->WinresumeSVN
A��m�oDataUK�Name!UnlatchedUnsealPolicy->BootmgrSVN
A��k�oDataSK�Name UnlatchedUnsealPolicy->LKeyPkgId

,�@�\�x�
��
���

,�`���̺
�<�
p����0�

|�ȼ�\���

�,�p���

�`�����H�

��StatusOsDeviceIdSystemRootPcrSealMask(LatchTheUnlatchedHUpgradedAntirollbackPolicyExists(EncryptionStatus4KeyPkgIdTpmCounterValue8EncryptedLKeyArrayPkgSize4EncryptedLKeyPkgPdGuid8UnlatchedUnsealPolicySize8UnlatchedProtectorExists4LatchedUnsealPolicySize4LatchedProtectorExists@LatchedUnsealPolicy->VersionLLatchedUnsealPolicy->VarDataOffsetLLatchedUnsealPolicy->StructureSizeLLatchedUnsealPolicy->PolicyVersionPLatchedUnsealPolicy->PolicyHashLengthDLatchedUnsealPolicy->WinloadSVNHLatchedUnsealPolicy->WinresumeSVNDLatchedUnsealPolicy->BootmgrSVNDLatchedUnsealPolicy->LKeyPkgIdDUnlatchedUnsealPolicy->VersionPUnlatchedUnsealPolicy->VarDataOffsetPUnlatchedUnsealPolicy->StructureSizePUnlatchedUnsealPolicy->PolicyVersionTUnlatchedUnsealPolicy->PolicyHashLengthHUnlatchedUnsealPolicy->WinloadSVNLUnlatchedUnsealPolicy->WinresumeSVNHUnlatchedUnsealPolicy->BootmgrSVNHUnlatchedUnsealPolicy->LKeyPkgIdTEMP�/==��\��1�X��ט��G
���D�	EventDataA��7�oDataK�NameStatus
A��?�oData'K�Name
OsDeviceId
A��?�oData'K�Name
SystemRoot
A��G�oData/K�NameVsmLKeyRelPath
A��_�oDataGK�NameLatchedUnsealPolicyRelPath
A��c�oDataKK�NameUnlatchedUnsealPolicyRelPath
A��q�oDataYK�Name#LatchedPrimaryProtectorVariableName
A��u�oData]K�Name%LatchedSecondaryProtectorVariableName
A��u�oData]K�Name%UnlatchedPrimaryProtectorVariableName
A��y�oDataaK�Name'UnlatchedSecondaryProtectorVariableName
	A��]�oDataEK�NameLatchedProtectorUsedLocal
A��W�oData?K�NameLatchTheUnlatchedLocal
A��[�oDataCK�NameUnsupportedRollbackLocal
A��u�oData]K�Name%UpgradedAntirollbackPolicyExistsLocal

A��i�oDataQK�NamePkgWasCorruptOrUnavailableLocal
A��_�oDataGK�NameCreationStateVerifiedLocal
A��w�oData_K�Name&PrimaryProtectorTargetPcrSealMaskLocal
A��W�oData?K�NameLatchedProtectorExists
A��[�oDataCK�NameUnlatchedProtectorExists
A��Y�oDataAK�NameKeyPkgIdTpmCounterValue

A��Q�oData9K�NameActivePolicyVersion

A��U�oData=K�NameUseUnlatchedProtector
A��c�oDataKK�NameNeedToResealPrimaryProtector
A��g�oDataOK�NameNeedToResealSecondaryProtector
A��c�oDataKK�NameNeedToResealPca2023Protector
A��q�oDataYK�Name#pSubStatus->PrimaryBlobUnsealStatus
A��o�oDataWK�Name"pSubStatus->BackupBlobUnsealStatus
A��{�oDatacK�Name(pSubStatus->Pca2023ProtectorUnsealStatus
A��}�oDataeK�Name)pSubStatus->BackupBlobValidityCheckStatus
A��k�oDataSK�Name pSubStatus->BackupBlobStillValid

A����oDataqK�Name/pSubStatus->Pca2023ProtectorValidityCheckStatus
A��w�oData_K�Name&pSubStatus->Pca2023ProtectorStillValid

A��q�oDataYK�Name#pSubStatus->PrimaryBlobResealStatus
 A��o�oDataWK�Name"pSubStatus->BackupBlobResealStatus
!A��{�oDatacK�Name(pSubStatus->Pca2023ProtectorResealStatus
"A��c�oDataKK�NamepSubStatus->V2ProtectorsUsed
#A��s�oData[K�Name$pSubStatus->LegacyUefiVarQueryStatus
$A��w�oData_K�Name&pSubStatus->LegacyUefiVarCleanupStatus
%A��i�oDataQK�NamepSubStatus->ActivePolicyVersion
&
A��k�oDataSK�Name pSubStatus->LatchedPolicyVersion
'
A��o�oDataWK�Name"pSubStatus->UnlatchedPolicyVersion
(
A��[�oDataCK�NameLatchedUnsealPolicyValid
)A��c�oDataKK�NameLatchedUnsealPolicy->Version
*A��o�oDataWK�Name"LatchedUnsealPolicy->VarDataOffset
+A��o�oDataWK�Name"LatchedUnsealPolicy->StructureSize
,A��o�oDataWK�Name"LatchedUnsealPolicy->PolicyVersion
-
A��u�oData]K�Name%LatchedUnsealPolicy->PolicyHashLength
.A��i�oDataQK�NameLatchedUnsealPolicy->WinloadSVN
/A��m�oDataUK�Name!LatchedUnsealPolicy->WinresumeSVN
0A��i�oDataQK�NameLatchedUnsealPolicy->BootmgrSVN
1A��g�oDataOK�NameLatchedUnsealPolicy->LKeyPkgId
2
A��_�oDataGK�NameUnlatchedUnsealPolicyValid
3A��g�oDataOK�NameUnlatchedUnsealPolicy->Version
4A��s�oData[K�Name$UnlatchedUnsealPolicy->VarDataOffset
5A��s�oData[K�Name$UnlatchedUnsealPolicy->StructureSize
6A��s�oData[K�Name$UnlatchedUnsealPolicy->PolicyVersion
7
A��y�oDataaK�Name'UnlatchedUnsealPolicy->PolicyHashLength
8A��m�oDataUK�Name!UnlatchedUnsealPolicy->WinloadSVN
9A��q�oDataYK�Name#UnlatchedUnsealPolicy->WinresumeSVN
:A��m�oDataUK�Name!UnlatchedUnsealPolicy->BootmgrSVN
;A��k�oDataSK�Name UnlatchedUnsealPolicy->LKeyPkgId
<
l����������X�����D�
��
��
�
<�
��
���
`�
��

��

�
,�
\�
��
�� �l����

h���

�h����
X�����

<�

��

��
�L�����

$�p����L�

��
���T���

��D�����,�

t�StatusOsDeviceIdSystemRoot$VsmLKeyRelPath<LatchedUnsealPolicyRelPath@UnlatchedUnsealPolicyRelPathLLatchedPrimaryProtectorVariableNamePLatchedSecondaryProtectorVariableNamePUnlatchedPrimaryProtectorVariableNameTUnlatchedSecondaryProtectorVariableName8LatchedProtectorUsedLocal4LatchTheUnlatchedLocal8UnsupportedRollbackLocalPUpgradedAntirollbackPolicyExistsLocalDPkgWasCorruptOrUnavailableLocal<CreationStateVerifiedLocalTPrimaryProtectorTargetPcrSealMaskLocal4LatchedProtectorExists8UnlatchedProtectorExists4KeyPkgIdTpmCounterValue,ActivePolicyVersion0UseUnlatchedProtector@NeedToResealPrimaryProtectorDNeedToResealSecondaryProtector@NeedToResealPca2023ProtectorLpSubStatus->PrimaryBlobUnsealStatusLpSubStatus->BackupBlobUnsealStatusXpSubStatus->Pca2023ProtectorUnsealStatusXpSubStatus->BackupBlobValidityCheckStatusHpSubStatus->BackupBlobStillValiddpSubStatus->Pca2023ProtectorValidityCheckStatusTpSubStatus->Pca2023ProtectorStillValidLpSubStatus->PrimaryBlobResealStatusLpSubStatus->BackupBlobResealStatusXpSubStatus->Pca2023ProtectorResealStatus@pSubStatus->V2ProtectorsUsedPpSubStatus->LegacyUefiVarQueryStatusTpSubStatus->LegacyUefiVarCleanupStatusDpSubStatus->ActivePolicyVersionHpSubStatus->LatchedPolicyVersionLpSubStatus->UnlatchedPolicyVersion8LatchedUnsealPolicyValid@LatchedUnsealPolicy->VersionLLatchedUnsealPolicy->VarDataOffsetLLatchedUnsealPolicy->StructureSizeLLatchedUnsealPolicy->PolicyVersionPLatchedUnsealPolicy->PolicyHashLengthDLatchedUnsealPolicy->WinloadSVNHLatchedUnsealPolicy->WinresumeSVNDLatchedUnsealPolicy->BootmgrSVNDLatchedUnsealPolicy->LKeyPkgId<UnlatchedUnsealPolicyValidDUnlatchedUnsealPolicy->VersionPUnlatchedUnsealPolicy->VarDataOffsetPUnlatchedUnsealPolicy->StructureSizePUnlatchedUnsealPolicy->PolicyVersionTUnlatchedUnsealPolicy->PolicyHashLengthHUnlatchedUnsealPolicy->WinloadSVNLUnlatchedUnsealPolicy->WinresumeSVNHUnlatchedUnsealPolicy->BootmgrSVNHUnlatchedUnsealPolicy->LKeyPkgIdTEMP$$$��϶؍�<^�!dT�+2���D�	EventDataA��7�oDataK�NameStatus
A��U�oData=K�NamePrimarySealedBlobName
A��g�oDataOK�NameSecondaryProtectorVariableName
A��[�oDataCK�NameBlobFromUefiVariableSize
A��Q�oData9K�NameUefiContentIsSealed
A��K�oData3K�NameUnsealedBlobSize
A��I�oData1K�NamePcr7SealingUsed
A��Q�oData9K�NamePkgTpmSealMaskLocal
A��Y�oDataAK�NamePkgTpmCreationMaskLocal
A��O�oData7K�NameNeedToResealKeyPkg
	A��O�oData7K�NameNeedToResealBackup
A��c�oDataKK�NameNeedToResealPca2023Protector
A��M�oData5K�NamePlaintextBlobSize
A��Y�oDataAK�NamePlaintextIsLegacyFormat

A��M�oData5K�NameUefiBlobIsCorrupt
A��;�oData#K�NameNewKeyID
A��_�oDataGK�NameVerifiedMicrosoftAuthority
A��U�oData=K�NameContainsAuthorityData
A��_�oDataGK�NameBootmgrAuthorityEventCount
A��=�oData%K�Name	Authority
A��q�oDataYK�Name#pSubStatus->PrimaryBlobUnsealStatus
A��o�oDataWK�Name"pSubStatus->BackupBlobUnsealStatus
A��{�oDatacK�Name(pSubStatus->Pca2023ProtectorUnsealStatus
A��}�oDataeK�Name)pSubStatus->BackupBlobValidityCheckStatus
A��k�oDataSK�Name pSubStatus->BackupBlobStillValid

A����oDataqK�Name/pSubStatus->Pca2023ProtectorValidityCheckStatus
A��w�oData_K�Name&pSubStatus->Pca2023ProtectorStillValid

A��q�oDataYK�Name#pSubStatus->PrimaryBlobResealStatus
A��o�oDataWK�Name"pSubStatus->BackupBlobResealStatus
A��{�oDatacK�Name(pSubStatus->Pca2023ProtectorResealStatus
A��c�oDataKK�NamepSubStatus->V2ProtectorsUsed
A��s�oData[K�Name$pSubStatus->LegacyUefiVarQueryStatus
A��w�oData_K�Name&pSubStatus->LegacyUefiVarCleanupStatus
 A��i�oDataQK�NamepSubStatus->ActivePolicyVersion
!
A��k�oDataSK�Name pSubStatus->LatchedPolicyVersion
"
A��o�oDataWK�Name"pSubStatus->UnlatchedPolicyVersion
#
`t��
 L
t��
�
$
P�
�
�
,
h���8��

4|

�4��
$	d	�	




L


�
Status0PrimarySealedBlobNameDSecondaryProtectorVariableName8BlobFromUefiVariableSize,UefiContentIsSealed(UnsealedBlobSize$Pcr7SealingUsed,PkgTpmSealMaskLocal4PkgTpmCreationMaskLocal,NeedToResealKeyPkg,NeedToResealBackup@NeedToResealPca2023Protector(PlaintextBlobSize4PlaintextIsLegacyFormat(UefiBlobIsCorruptNewKeyID<VerifiedMicrosoftAuthority0ContainsAuthorityData<BootmgrAuthorityEventCountAuthorityLpSubStatus->PrimaryBlobUnsealStatusLpSubStatus->BackupBlobUnsealStatusXpSubStatus->Pca2023ProtectorUnsealStatusXpSubStatus->BackupBlobValidityCheckStatusHpSubStatus->BackupBlobStillValiddpSubStatus->Pca2023ProtectorValidityCheckStatusTpSubStatus->Pca2023ProtectorStillValidLpSubStatus->PrimaryBlobResealStatusLpSubStatus->BackupBlobResealStatusXpSubStatus->Pca2023ProtectorResealStatus@pSubStatus->V2ProtectorsUsedPpSubStatus->LegacyUefiVarQueryStatusTpSubStatus->LegacyUefiVarCleanupStatusDpSubStatus->ActivePolicyVersionHpSubStatus->LatchedPolicyVersionLpSubStatus->UnlatchedPolicyVersionTEMP�((��~�a�T�P�\c����D�	EventDataA��7�oDataK�NameStatus
A��g�oDataOK�NameSecondaryProtectorVariableName
A��c�oDataKK�NameNeedToResealPrimaryProtector
A��g�oDataOK�NameNeedToResealSecondaryProtector
A��c�oDataKK�NameNeedToResealPca2023Protector
A��e�oDataMK�NameSealedBackupEncryptionKeySize
A��g�oDataOK�NameSealedPca2023EncryptionKeySize
A��M�oData5K�NameUefiBlobIsCorrupt
A��I�oData1K�NamePcr7SealingUsed
A��_�oDataGK�NameCreationStateVerifiedLocal
	A��_�oDataGK�NameVerifiedMicrosoftAuthority
A��U�oData=K�NameContainsAuthorityData
A��_�oDataGK�NameBootmgrAuthorityEventCount
A��w�oData_K�Name&PrimaryProtectorTargetPcrSealMaskLocal

A��=�oData%K�Name	Authority
A��q�oDataYK�Name#pSubStatus->PrimaryBlobUnsealStatus
A��o�oDataWK�Name"pSubStatus->BackupBlobUnsealStatus
A��{�oDatacK�Name(pSubStatus->Pca2023ProtectorUnsealStatus
A��}�oDataeK�Name)pSubStatus->BackupBlobValidityCheckStatus
A��k�oDataSK�Name pSubStatus->BackupBlobStillValid

A����oDataqK�Name/pSubStatus->Pca2023ProtectorValidityCheckStatus
A��w�oData_K�Name&pSubStatus->Pca2023ProtectorStillValid

A��q�oDataYK�Name#pSubStatus->PrimaryBlobResealStatus
A��o�oDataWK�Name"pSubStatus->BackupBlobResealStatus
A��{�oDatacK�Name(pSubStatus->Pca2023ProtectorResealStatus
A��c�oDataKK�NamepSubStatus->V2ProtectorsUsed
A��s�oData[K�Name$pSubStatus->LegacyUefiVarQueryStatus
A��w�oData_K�Name&pSubStatus->LegacyUefiVarCleanupStatus
A��i�oDataQK�NamepSubStatus->ActivePolicyVersion

A��k�oDataSK�Name pSubStatus->LatchedPolicyVersion

A��o�oDataWK�Name"pSubStatus->UnlatchedPolicyVersion

A��g�oDataOK�NameValidatedUnsealPolicy->Version
A��s�oData[K�Name$ValidatedUnsealPolicy->VarDataOffset
 A��s�oData[K�Name$ValidatedUnsealPolicy->StructureSize
!A��s�oData[K�Name$ValidatedUnsealPolicy->PolicyVersion
"
A��y�oDataaK�Name'ValidatedUnsealPolicy->PolicyHashLength
#A��m�oDataUK�Name!ValidatedUnsealPolicy->WinloadSVN
$A��q�oDataYK�Name#ValidatedUnsealPolicy->WinresumeSVN
%A��m�oDataUK�Name!ValidatedUnsealPolicy->BootmgrSVN
&A��k�oDataSK�Name ValidatedUnsealPolicy->LKeyPkgId
'
��
0 
p 
� � 4!
x!
�!
�!
"
<"l"�"�"#`#�#$

\$�$

%\%�%�%
L&�&�&

0'

t'

�'(L(�(

�(<)�)�)$*

l*StatusDSecondaryProtectorVariableName@NeedToResealPrimaryProtectorDNeedToResealSecondaryProtector@NeedToResealPca2023Protector@SealedBackupEncryptionKeySizeDSealedPca2023EncryptionKeySize(UefiBlobIsCorrupt$Pcr7SealingUsed<CreationStateVerifiedLocal<VerifiedMicrosoftAuthority0ContainsAuthorityData<BootmgrAuthorityEventCountTPrimaryProtectorTargetPcrSealMaskLocalAuthorityLpSubStatus->PrimaryBlobUnsealStatusLpSubStatus->BackupBlobUnsealStatusXpSubStatus->Pca2023ProtectorUnsealStatusXpSubStatus->BackupBlobValidityCheckStatusHpSubStatus->BackupBlobStillValiddpSubStatus->Pca2023ProtectorValidityCheckStatusTpSubStatus->Pca2023ProtectorStillValidLpSubStatus->PrimaryBlobResealStatusLpSubStatus->BackupBlobResealStatusXpSubStatus->Pca2023ProtectorResealStatus@pSubStatus->V2ProtectorsUsedPpSubStatus->LegacyUefiVarQueryStatusTpSubStatus->LegacyUefiVarCleanupStatusDpSubStatus->ActivePolicyVersionHpSubStatus->LatchedPolicyVersionLpSubStatus->UnlatchedPolicyVersionDValidatedUnsealPolicy->VersionPValidatedUnsealPolicy->VarDataOffsetPValidatedUnsealPolicy->StructureSizePValidatedUnsealPolicy->PolicyVersionTValidatedUnsealPolicy->PolicyHashLengthHValidatedUnsealPolicy->WinloadSVNLValidatedUnsealPolicy->WinresumeSVNHValidatedUnsealPolicy->BootmgrSVNHValidatedUnsealPolicy->LKeyPkgIdTEMP�,5��H��aIP��]����B
D�	EventDataA��_�oDataGK�NameLegacyMainBlobVariableName
A��s�oData[K�Name$LegacySecondaryProtectorVariableName
A��i�oDataQK�NamePkgWasCorruptOrUnavailableLocal
A��O�oData7K�NameKeysAreLegacyLocal
A��_�oDataGK�NameCreationStateVerifiedLocal
A��w�oData_K�Name&PrimaryProtectorTargetPcrSealMaskLocal
A��q�oDataYK�Name#pSubStatus->PrimaryBlobUnsealStatus
A��o�oDataWK�Name"pSubStatus->BackupBlobUnsealStatus
A��{�oDatacK�Name(pSubStatus->Pca2023ProtectorUnsealStatus
A��}�oDataeK�Name)pSubStatus->BackupBlobValidityCheckStatus
	A��k�oDataSK�Name pSubStatus->BackupBlobStillValid

A����oDataqK�Name/pSubStatus->Pca2023ProtectorValidityCheckStatus
A��w�oData_K�Name&pSubStatus->Pca2023ProtectorStillValid

A��q�oDataYK�Name#pSubStatus->PrimaryBlobResealStatus

A��o�oDataWK�Name"pSubStatus->BackupBlobResealStatus
A��{�oDatacK�Name(pSubStatus->Pca2023ProtectorResealStatus
A��c�oDataKK�NamepSubStatus->V2ProtectorsUsed
A��s�oData[K�Name$pSubStatus->LegacyUefiVarQueryStatus
A��w�oData_K�Name&pSubStatus->LegacyUefiVarCleanupStatus
A��i�oDataQK�NamepSubStatus->ActivePolicyVersion

A��k�oDataSK�Name pSubStatus->LatchedPolicyVersion

A��o�oDataWK�Name"pSubStatus->UnlatchedPolicyVersion

�6 7
p7
�7
�78p8�89`9

�9:

d:�:;P;
�;�;8<

�<

�<

=<LegacyMainBlobVariableNamePLegacySecondaryProtectorVariableNameDPkgWasCorruptOrUnavailableLocal,KeysAreLegacyLocal<CreationStateVerifiedLocalTPrimaryProtectorTargetPcrSealMaskLocalLpSubStatus->PrimaryBlobUnsealStatusLpSubStatus->BackupBlobUnsealStatusXpSubStatus->Pca2023ProtectorUnsealStatusXpSubStatus->BackupBlobValidityCheckStatusHpSubStatus->BackupBlobStillValiddpSubStatus->Pca2023ProtectorValidityCheckStatusTpSubStatus->Pca2023ProtectorStillValidLpSubStatus->PrimaryBlobResealStatusLpSubStatus->BackupBlobResealStatusXpSubStatus->Pca2023ProtectorResealStatus@pSubStatus->V2ProtectorsUsedPpSubStatus->LegacyUefiVarQueryStatusTpSubStatus->LegacyUefiVarCleanupStatusDpSubStatus->ActivePolicyVersionHpSubStatus->LatchedPolicyVersionLpSubStatus->UnlatchedPolicyVersionTEMP''TNqr�&X�xB)������D�	EventDataA��7�oDataK�NameStatus
A��?�oData'K�Name
OsDeviceId
A��G�oData/K�NameOsDataDeviceId
A��?�oData'K�Name
SystemRoot
A��G�oData/K�NameVsmLKeyRelPath
A��_�oDataGK�NameLatchedUnsealPolicyRelPath
A��c�oDataKK�NameUnlatchedUnsealPolicyRelPath
A��q�oDataYK�Name#LatchedPrimaryProtectorVariableName
A��u�oData]K�Name%LatchedSecondaryProtectorVariableName
A��u�oData]K�Name%UnlatchedPrimaryProtectorVariableName
	A��y�oDataaK�Name'UnlatchedSecondaryProtectorVariableName
A��_�oDataGK�NameLegacyMainBlobVariableName
A��s�oData[K�Name$LegacySecondaryProtectorVariableName
A��]�oDataEK�NameLatchedProtectorUsedLocal

A��W�oData?K�NameLatchTheUnlatchedLocal
A��[�oDataCK�NameUnsupportedRollbackLocal
A��u�oData]K�Name%UpgradedAntirollbackPolicyExistsLocal
A��U�oData=K�NameFirstWriteToDiskLocal
A��Q�oData9K�NameWritePkgToUefiLocal
A��i�oDataQK�NamePkgWasCorruptOrUnavailableLocal
A��O�oData7K�NameKeysAreLegacyLocal
A��_�oDataGK�NameCreationStateVerifiedLocal
A��w�oData_K�Name&PrimaryProtectorTargetPcrSealMaskLocal
A��q�oDataYK�Name#pSubStatus->PrimaryBlobUnsealStatus
A��o�oDataWK�Name"pSubStatus->BackupBlobUnsealStatus
A��{�oDatacK�Name(pSubStatus->Pca2023ProtectorUnsealStatus
A��}�oDataeK�Name)pSubStatus->BackupBlobValidityCheckStatus
A��k�oDataSK�Name pSubStatus->BackupBlobStillValid

A����oDataqK�Name/pSubStatus->Pca2023ProtectorValidityCheckStatus
A��w�oData_K�Name&pSubStatus->Pca2023ProtectorStillValid

A��q�oDataYK�Name#pSubStatus->PrimaryBlobResealStatus
A��o�oDataWK�Name"pSubStatus->BackupBlobResealStatus
A��{�oDatacK�Name(pSubStatus->Pca2023ProtectorResealStatus
 A��c�oDataKK�NamepSubStatus->V2ProtectorsUsed
!A��s�oData[K�Name$pSubStatus->LegacyUefiVarQueryStatus
"A��w�oData_K�Name&pSubStatus->LegacyUefiVarCleanupStatus
#A��i�oDataQK�NamepSubStatus->ActivePolicyVersion
$
A��k�oDataSK�Name pSubStatus->LatchedPolicyVersion
%
A��o�oDataWK�Name"pSubStatus->UnlatchedPolicyVersion
&
`QtQ�Q�Q�Q�Q0RpR�RS\S�S�S
<T
tT
�T
�T
0U
`U
�U
�U
�U8V�V�V$W|W

�WX

�X�X YlY
�YZTZ

�Z

�Z

4[StatusOsDeviceId$OsDataDeviceIdSystemRoot$VsmLKeyRelPath<LatchedUnsealPolicyRelPath@UnlatchedUnsealPolicyRelPathLLatchedPrimaryProtectorVariableNamePLatchedSecondaryProtectorVariableNamePUnlatchedPrimaryProtectorVariableNameTUnlatchedSecondaryProtectorVariableName<LegacyMainBlobVariableNamePLegacySecondaryProtectorVariableName8LatchedProtectorUsedLocal4LatchTheUnlatchedLocal8UnsupportedRollbackLocalPUpgradedAntirollbackPolicyExistsLocal0FirstWriteToDiskLocal,WritePkgToUefiLocalDPkgWasCorruptOrUnavailableLocal,KeysAreLegacyLocal<CreationStateVerifiedLocalTPrimaryProtectorTargetPcrSealMaskLocalLpSubStatus->PrimaryBlobUnsealStatusLpSubStatus->BackupBlobUnsealStatusXpSubStatus->Pca2023ProtectorUnsealStatusXpSubStatus->BackupBlobValidityCheckStatusHpSubStatus->BackupBlobStillValiddpSubStatus->Pca2023ProtectorValidityCheckStatusTpSubStatus->Pca2023ProtectorStillValidLpSubStatus->PrimaryBlobResealStatusLpSubStatus->BackupBlobResealStatusXpSubStatus->Pca2023ProtectorResealStatus@pSubStatus->V2ProtectorsUsedPpSubStatus->LegacyUefiVarQueryStatusTpSubStatus->LegacyUefiVarCleanupStatusDpSubStatus->ActivePolicyVersionHpSubStatus->LatchedPolicyVersionLpSubStatus->UnlatchedPolicyVersionTEMP�
�az����VX���6mc���D�	EventDataA��7�oDataK�NameStatus
A��9�oData!K�NamePcrMask
A��O�oData7K�NameUnsealPolicyPdGuid
A��i�oDataQK�NameSealingProtectorFixedBufferSize
A��g�oDataOK�NameSealingProtectorUsedBufferSize
A��W�oData?K�NameSealedSecretBufferSize
A��Q�oData9K�NamePcrInfoArrayElCount
A��U�oData=K�NameUnsealPolicy->Version
A��a�oDataIK�NameUnsealPolicy->VarDataOffset
A��a�oDataIK�NameUnsealPolicy->StructureSize
	A��a�oDataIK�NameUnsealPolicy->PolicyVersion

A��g�oDataOK�NameUnsealPolicy->PolicyHashLength
A��[�oDataCK�NameUnsealPolicy->WinloadSVN
A��_�oDataGK�NameUnsealPolicy->WinresumeSVN

A��[�oDataCK�NameUnsealPolicy->BootmgrSVN
A��Y�oDataAK�NameUnsealPolicy->LKeyPkgId

cc,cXc�c�cd@dpd�d

�d$ehe�e�e

fStatusPcrMask,UnsealPolicyPdGuidDSealingProtectorFixedBufferSizeDSealingProtectorUsedBufferSize4SealedSecretBufferSize,PcrInfoArrayElCount0UnsealPolicy->Version<UnsealPolicy->VarDataOffset<UnsealPolicy->StructureSize<UnsealPolicy->PolicyVersionDUnsealPolicy->PolicyHashLength8UnsealPolicy->WinloadSVN<UnsealPolicy->WinresumeSVN8UnsealPolicy->BootmgrSVN4UnsealPolicy->LKeyPkgIdTEMP��g�
w��W\R��}Su�0��xD�	EventDataA��7�oDataK�NameStatus
A��E�oData-K�Name
ProtectorName
A��Y�oDataAK�NameSealedEncryptionKeySize
A��m�oDataUK�Name!ProtectorBlobFromUefiVariableSize
DhXhxh�hStatus ProtectorName4SealedEncryptionKeySizeHProtectorBlobFromUefiVariableSizeTEMPLji�����[��y�i��r��$D�	EventDataA��5�oDataK�NamealgID
A��C�oData+K�NamedigestLength
A��;�oData#K�NamePcrIndex
A��;�oData#K�NamePcrValue
�j�j�j�jalgID digestLengthPcrIndexPcrValueTEMP��l>ӎ�uoX���T��J���fD�	EventDataA��K�oData3K�NameCachedCopyStatus
A��Q�oData9K�NameKeyGenerationStatus
A��M�oData5K�NameSealAndSaveStatus
A��G�oData/K�NameUEFIKeysStatus
�lm<mdm(CachedCopyStatus,KeyGenerationStatus(SealAndSaveStatus$UEFIKeysStatusTEMP��q����3_S4Z�!;�+��0D�	EventDataA��K�oData3K�NameCachedCopyStatus
A��Q�oData9K�NameKeyGenerationStatus
A��M�oData5K�NameSealAndSaveStatus
A��G�oData/K�NameUEFIKeysStatus
A��[�oDataCK�NameUnLatchedCiPolicyVersion

A��W�oData?K�NameLatchedCiPolicyVersion

A��i�oDataQK�NameLatchedAntiRollbackCounterValue

A��W�oData?K�NameCurrentCiPolicyVersion

A��i�oDataQK�NameCurrentAntiRollbackCounterValue

A��c�oDataKK�NameMinimumUnsealCiPolicyVersion
	
A��[�oDataCK�NameAuthorizationIsDelegated

�r�rsDs

hs

�s

�s

t

Lt

�t

�t(CachedCopyStatus,KeyGenerationStatus(SealAndSaveStatus$UEFIKeysStatus8UnLatchedCiPolicyVersion4LatchedCiPolicyVersionDLatchedAntiRollbackCounterValue4CurrentCiPolicyVersionDCurrentAntiRollbackCounterValue@MinimumUnsealCiPolicyVersion8AuthorizationIsDelegatedTEMP��u�*��T�X��Y�Y��\��xD�	EventDataA��W�oData?K�NameRetrieveDriverListTime



�u4RetrieveDriverListTimeTEMPh4y�L%�<:R��K�˴��D�	EventDataA��[�oDataCK�NameTpmSrkProvisioningStatus
A��W�oData?K�NameTpmSrkPolicyReadStatus
A��Y�oDataAK�NameTpmSrkSymKeyPolicyValue
A��W�oData?K�NameTpmSrkSymKeyCapability
A��M�oData5K�NameTpmSrkAesBitsUsed
A��[�oDataCK�NameTpmSrkAsymKeyPolicyValue
A��Y�oDataAK�NameTpmSrkAsymKeyCapability
A��M�oData5K�NameTpmSrkRsaBitsUsed
�yz@ztz�z�z{<{8TpmSrkProvisioningStatus4TpmSrkPolicyReadStatus4TpmSrkSymKeyPolicyValue4TpmSrkSymKeyCapability(TpmSrkAesBitsUsed8TpmSrkAsymKeyPolicyValue4TpmSrkAsymKeyCapability(TpmSrkRsaBitsUsedTEMP`�~$�F�m�[�sY�����D�	EventDataA��W�oData?K�NameTpmSrkProvisioningTime

A��W�oData?K�NameTpmSrkPolicyReadStatus
A��Y�oDataAK�NameTpmSrkSymKeyPolicyValue
A��W�oData?K�NameTpmSrkSymKeyCapability
A��M�oData5K�NameTpmSrkAesBitsUsed
A��[�oDataCK�NameTpmSrkAsymKeyPolicyValue
A��Y�oDataAK�NameTpmSrkAsymKeyCapability
A��M�oData5K�NameTpmSrkRsaBitsUsed


8l���0�h���4TpmSrkProvisioningTime4TpmSrkPolicyReadStatus4TpmSrkSymKeyPolicyValue4TpmSrkSymKeyCapability(TpmSrkAesBitsUsed8TpmSrkAsymKeyPolicyValue4TpmSrkAsymKeyCapability(TpmSrkRsaBitsUsedTEMP|�.A�a�M�T��q�`����D�	EventDataA��c�oDataKK�NameTpmBindingProvisioningStatus
��@TpmBindingProvisioningStatusTEMP�p��Ea3�[���>B:���jD�	EventDataA��I�oData1K�NameLoadDriversTime



��$LoadDriversTimeTEMP,|�.�=����W$ V^ϻп���D�	EventDataA��3�oDataK�NamePath
A��C�oData+K�NameLoadHiveTime

��

��Path LoadHiveTimeTEMP�؄�Z�\�J�Z�d$���D�	EventDataA��U�oData=K�NameApplicationIdentifier
A��Q�oData9K�NameApplicationLoadTime

�

0�0ApplicationIdentifier,ApplicationLoadTimeTEMP�h�L���/!~U1&�ݟ�)���D�	EventDataA��U�oData=K�NameApplicationIdentifier
A��[�oDataCK�NameApplicationExecutionTime

��

��0ApplicationIdentifier8ApplicationExecutionTimeTEMP$ȇ�,�L&�SY���������D�	EventDataA��7�oDataK�NameStatus
A��;�oData#K�NameFileName
��StatusFileNameTEMP4�x_T��U�]�x����D�	EventDataA��7�oDataK�NameStatus
A��C�oData+K�NameFailurePoint
��00�Status FailurePointTEMP�܉$*��Qq�����XD�	EventDataA��7�oDataK�NameStatus
�StatusTEMPȊ����a��R���>�������D�	EventDataA��7�oDataK�NameStatus
A��1�oDataK�NameTag
��StatusTagTEMP����5	0�&U��H�v�%��pD�	EventDataA��O�oData7K�NameReserveDescriptors
ȋ,ReserveDescriptorsTEMP����~��]ͽ'�1����D�	EventDataA��E�oData-K�Name
ApplicationId
A��;�oData#K�NameRunCount
A��=�oData%K�Name	PageCount

P�p�

�� ApplicationIdRunCountPageCountTEMPl�s�Z�j��_��jz(�V(���D�	EventDataA��7�oDataK�NameStatus
A��9�oData!K�NameBlockId

��
��StatusBlockIdTEMP�d��'v~�rPx�zx^X
V��rD�	EventDataA��Q�oData9K�NameFreePersistentPages



x�,FreePersistentPagesTEMPD����*�P��
7`:o���D�	EventDataA��7�oDataK�NameStatus
A��K�oData3K�NameOutstandingCount

��

��Status(OutstandingCountTEMP4X��/�L�
P\�z���d���:D�	EventDataA��7�oDataK�NameStatus
A��K�oData3K�NameOutstandingCount

A��M�oData5K�NameApplicationsCount
A��5�oDataK�NameAppId
���

����Status(OutstandingCount(ApplicationsCountAppIdTEMPh�� ��N��YB�B���
���D�	EventDataA��E�oData-K�Name
ApplicationId
A��Q�oData9K�NameFreePersistentPages

8�

X� ApplicationId,FreePersistentPagesTEMP�����*?�S�Y��z\����D�	EventDataA��E�oData-K�Name
ApplicationId
A��9�oData!K�NameBlockId

A��Q�oData9K�NameFreePersistentPages

�
�

(� ApplicationIdBlockId,FreePersistentPagesTEMP�l���/��yTQ��lC\V���D�	EventDataA��E�oData-K�Name
ApplicationId
A��9�oData!K�NameBlockId

A��5�oDataK�NameFlags
��

ȗܗ ApplicationIdBlockIdFlagsTEMP��݆��@:[%�ʼnD��Y���D�	EventDataA��7�oDataK�NameStatus
A��A�oData)K�NameRunsClaimed
A��=�oData%K�Name	PageCount

@�T�

p�StatusRunsClaimedPageCountTEMP�0��'v~�rPx�zx^X
V��rD�	EventDataA��Q�oData9K�NameFreePersistentPages



D�,FreePersistentPagesTEMP8L�7!�~�Z�]��I)���D�	EventDataA��E�oData-K�Name
ApplicationId
A��9�oData!K�NameBlockId

t�

�� ApplicationIdBlockIdTEMP����r�e~SV��C.`J����D�	EventDataA��3�oDataK�NameType
A��5�oDataK�NameFlags
A��?�oData'K�Name
BufferSize
���TypeFlagsBufferSizeTEMP$��s4y�[�X���—8���D�	EventDataA��;�oData#K�NameDiagCode
A��7�oDataK�NameStatus
�0$�<�DiagCodeStatusTEMP�d��E�{�wHX�}u�;G�����D�	EventDataA��7�oDataK�NameStatus
A��;�oData#K�NameDataSize
A��?�oData'K�Name
BufferSize
����̟StatusDataSizeBufferSizeTEMP��BRuu��T;CB��w����D�	EventDataA��5�oDataK�NamePhase
A��7�oDataK�NameStatus
ؠ�PhaseStatusTEMP�$�7C�{��S5�o/Q9����D�	EventDataA��7�oDataK�NameStatus
A��Q�oData9K�NameEnableDisableReason
A��=�oData%K�Name	VsmPolicy
`�0t��0��Status,EnableDisableReasonVsmPolicyTEMP�������ݺB[���C~7���D�	EventDataA��?�oData'K�Name
LowAddress

A��A�oData)K�NameHighAddress

A��=�oData%K�Name	SkipBytes

A��?�oData'K�Name
TotalBytes

A��=�oData%K�Name	CacheType
A��5�oDataK�NameFlags

�
4�
P�

h�����LowAddressHighAddressSkipBytesTotalBytesCacheTypeFlagsTEMP�4��s/��T1X��D>��RD�	EventDataA��1�oDataK�NameMdl
H�MdlTEMP�������L�X+I%��n�v��XD�	EventDataA��7�oDataK�NameSecure



�SecureTEMP���
+t�]��K~p���lD�	EventDataA��K�oData3K�NameSoftRestartCount
��(SoftRestartCountTEMPDĨi%�O댘\@2���\����D�	EventDataA��K�oData3K�NameSoftRestartCount
A��7�oDataK�NameSecure

�

�(SoftRestartCountSecureTEMP�t�c��U�@M�Ƒ���D�	EventDataA��G�oData/K�NameSequenceNumber
A��I�oData1K�NameDescriptorCount
A��YZ�ComplexData3K�NameMemoryDescriptor
��$�H�
p�

������$SequenceNumber$DescriptorCount(MemoryDescriptorBasePagePageCountMemoryTypeReservedTEMP�t�����Uߔ�镢���jD�	EventDataA��I�oData1K�NameDescriptorCount
��$DescriptorCountTEMP��w���0b�Y�G�N��}V���D�	EventDataA��7�oDataK�NameStatus
A��=�oData%K�Name	PageCount

A��?�oData'K�Name
MemoryType
A��?�oData'K�Name
Attributes
A��?�oData'K�Name
LowAddress

A��A�oData)K�NameHighAddress

�

$�<�X�
t�
��StatusPageCountMemoryTypeAttributesLowAddressHighAddressTEMP�$��5��?U�N><�E����BD�	EventDataA��7�oDataK�NameStatus
A��=�oData%K�Name	PageCount

A��?�oData'K�Name
MemoryType
A��?�oData'K�Name
Attributes
A��?�oData'K�Name
LowAddress

A��A�oData)K�NameHighAddress

A��=�oData%K�Name	Alignment
A��A�oData)K�NameProximityId
IJ

ز��
(�
D�`�x�StatusPageCountMemoryTypeAttributesLowAddressHighAddressAlignmentProximityIdTEMP�(���/��TR��w���^D�	EventDataA��=�oData%K�Name	StartTime
<�StartTimeTEMPP��)5�H7^A����d����D�	EventDataTEMPP�)5�H7^A����d����D�	EventDataTEMP`�8�^�Q2I�w+�*���D�	EventDataA��?�oData'K�Name
Identifier
A��A�oData)K�NamePartitionId
A��Q�oData9K�NameAllocatedBlockCount

A��M�oData5K�NameAllocatedRunCount

A��O�oData7K�NameAllocatedPageCount

A��7�oDataK�NameStatus
����

��

�

�@�IdentifierPartitionId,AllocatedBlockCount(AllocatedRunCount,AllocatedPageCountStatusTEMP<0�w)ϻ�6^lV���Aw����D�	EventDataA��?�oData'K�Name
Identifier
A��A�oData)K�NamePartitionId
X�t�IdentifierPartitionIdTEMP����hl��N�Y&���hQO
���D�	EventDataA��?�oData'K�Name
Identifier
A��O�oData7K�NamePartitionPageCount

A��Q�oData9K�NameAllocatedBlockCount

A��M�oData5K�NameAllocatedRunCount

A��O�oData7K�NameAllocatedPageCount

A��7�oDataK�NameStatus
4�

P�

|�

��

м��Identifier,PartitionPageCount,AllocatedBlockCount(AllocatedRunCount,AllocatedPageCountStatusTEMP�8���޺�Vx�BDX|���D�	EventDataA��?�oData'K�Name
Identifier
A��O�oData7K�NamePartitionPageCount

A��7�oDataK�NameStatus
t�

����Identifier,PartitionPageCountStatusTEMPl��R�;��RP˭���ث]���D�	EventDataA��?�oData'K�Name
Identifier
A��7�oDataK�NameStatus
A��?�oData'K�Name
NameLength
A��E�oData-K�Name
PartitoinName
A��K�oData3K�NameMemoryRangeCount
A��G�oData/K�NameMemorPageCount

A��M�oData5K�NameIoSpaceRangeCount
A��K�oData3K�NameIoSpacePageCount

A��]�oDataEK�NameAllocatedMemoryBlockCount

A��Y�oDataAK�NameAllocatedMemoryRunCount
	
A��[�oDataCK�NameAllocatedMemoryPageCount

A��_�oDataGK�NameAllocatedIoSpaceBlockCount

A��[�oDataCK�NameAllocatedIoSpaceRunCount

A��]�oDataEK�NameAllocatedIoSpacePageCount


����0�P�

x���

��

��

$�

X�

��

��

�IdentifierStatusNameLength PartitoinName(MemoryRangeCount$MemorPageCount(IoSpaceRangeCount(IoSpacePageCount8AllocatedMemoryBlockCount4AllocatedMemoryRunCount8AllocatedMemoryPageCount<AllocatedIoSpaceBlockCount8AllocatedIoSpaceRunCount8AllocatedIoSpacePageCountTEMP,�d�i�dl�YUY�O�S����D�	EventDataA��?�oData'K�Name
Identifier
A��7�oDataK�NameStatus
8�T�IdentifierStatusTEMP�����*)�R�#����.��`D�	EventDataA��?�oData'K�Name
Identifier
�IdentifierTEMP (���o�L)�^*�v��w�����D�	EventDataA��?�oData'K�Name
Identifier
A��;�oData#K�NameRunCount
A��=�oData%K�Name	PageCount

A��7�oDataK�NameStatus
A��Q�oData9K�NamePartitionNameLength
A��E�oData-K�Name
PartitionName
����

�����,�IdentifierRunCountPageCountStatus,PartitionNameLength PartitionNameTEMP8���1�"�S�XQ�ڥ6��jD�	EventDataA��?�oData'K�Name
Identifier
A��;�oData#K�NameRunCount
A��=�oData%K�Name	PageCount

A��I�oData1K�NameIoSpaceRunCount
A��K�oData3K�NameIoSpacePageCount

A��7�oDataK�NameStatus
A��Q�oData9K�NamePartitionNameLength
A��E�oData-K�Name
PartitionName
����

����

��$�8�d�IdentifierRunCountPageCount$IoSpaceRunCount(IoSpacePageCountStatus,PartitionNameLength PartitionNameTEMP���09Q���S�����K&����D�	EventDataA��7�oDataK�NameStatus
A��?�oData'K�Name
ActualSize
A��C�oData+K�NameExpectedSize
�����StatusActualSize ExpectedSizeTEMP�H��D RUW8Sҍ�Ƶ����D�	EventDataA��A�oData)K�NamePartitionId
A��;�oData#K�NameRunCount
A��=�oData%K�Name	PageCount

����

��PartitionIdRunCountPageCountTEMP$8��"��}f_�R��lhH��4D�	EventDataA��A�oData)K�NamePartitionId
A��;�oData#K�NameRunCount
A��=�oData%K�Name	PageCount

A��E�oData-K�Name
IoSpaceMemory

����

��

��PartitionIdRunCountPageCount IoSpaceMemoryTEMP���Wt�ȒIOZ���u�_N��xD�	EventDataA��A�oData)K�NamePartitionId
A��;�oData#K�NameRunCount

A��=�oData%K�Name	PageCount

A��E�oData-K�Name
IoSpaceMemory

A��=�oData%K�Name	Allocated

�

 �

8�

P�

p�PartitionIdRunCountPageCount IoSpaceMemoryAllocatedTEMP,\��{cZ(�uZ,K�37J2���D�	EventDataA��;�oData#K�NameBasePage

A��=�oData%K�Name	PageCount


��

��BasePagePageCountTEMP������HZ>�^�3Gjk�X���D�	EventDataA��A�oData)K�NameCommandCode
A��C�oData+K�NameResponseCode
A��S�oData;K�NameResponseMilliseconds

,�H�

h�CommandCode ResponseCode0ResponseMillisecondsTEMP���;��{�R�^�
r%ʫ���*D�	EventDataA��A�oData)K�NameCommandCode
A��C�oData+K�NameResponseCode
A��S�oData;K�NameResponseMilliseconds

A��A�oData)K�NameCommandSize
A��A�oData)K�NameCommandData
A��C�oData+K�NameResponseSize
A��C�oData+K�NameResponseData
����

�����(�H�CommandCode ResponseCode0ResponseMillisecondsCommandSizeCommandData ResponseSize ResponseDataTEMP���
��.�m�Z��z;l���D�	EventDataA��A�oData)K�NameCommandCode
A��=�oData%K�Name	ErrorCode
A��S�oData;K�NameResponseMilliseconds

����

�CommandCodeErrorCode0ResponseMillisecondsTEMP���ecv�U�U���'*l}���D�	EventDataA��A�oData)K�NameCommandCode
A��=�oData%K�Name	ErrorCode
A��S�oData;K�NameResponseMilliseconds

A��A�oData)K�NameCommandSize
A��A�oData)K�NameCommandData
d���

������CommandCodeErrorCode0ResponseMillisecondsCommandSizeCommandDataTEMP���VC��SR�s�ġ����pD�	EventDataA��O�oData7K�NameFveGlobalDataFlags
��,FveGlobalDataFlagsTEMP H�_�2Y�?B�8��.D�	EventDataA��?�oData'K�Name
VendorGuid
A��C�oData+K�NameVariableName
A��?�oData'K�Name
Attributes
A��7�oDataK�NameStatus
��������VendorGuid VariableNameAttributesStatusTEMP����~�w
�^�ڴl�����dD�	EventDataA��C�oData+K�NameTxtErrorCode
�� TxtErrorCodeTEMP��t�0w�@Wf�#t�cg���D�	EventDataA��3�oDataK�NameBase

A��3�oDataK�NameSize


��
��BaseSizeTEMP�t��Mp�dnT!+���3���dD�	EventDataA��C�oData+K�NameBiosDataSize



�� BiosDataSizeTEMPt��n�p�;�WN=���"���D�	EventDataA��O�oData7K�NameAcmMinMleHeaderVer
A��K�oData3K�NameMleHeaderVersion
����,AcmMinMleHeaderVer(MleHeaderVersionTEMP��� U�)%�KQ�����"����D�	EventDataA��?�oData'K�Name
PmrLowBase

A��?�oData'K�Name
PmrLowSize

A��A�oData)K�NamePmrHighBase

A��A�oData)K�NamePmrHighSize

A��Q�oData9K�NameFirmwareProvidedAcm



D�

`�

|�

��

��PmrLowBasePmrLowSizePmrHighBasePmrHighSize,FirmwareProvidedAcmTEMP4��]�)A�_s`C�Af�� D�	EventDataA��M�oData5K�NameGetCapabilityTime

A��K�oData3K�NameGetResourcesTime

A��Y�oDataAK�NameResourcesValidationTime



p�

��

��(GetCapabilityTime(GetResourcesTime4ResourcesValidationTimeTEMP����Gg�`6XRN�r��HJ��^D�	EventDataA��=�oData%K�Name	TxtStatus
 7��TxtStatusTEMP���ݞ���s\k�rT�O���D�	EventDataA��5�oDataK�NamePhase
A��?�oData'K�Name
StatusCode
A��K�oData3K�NameEnvironmentState
�$�@�PhaseStatusCode(EnvironmentStateTEMP�(����05R���c'K3����D�	EventDataA��=�oData%K�Name	InitState
A��?�oData'K�Name
StatusCode
A��G�oData/K�NameFailureAddress

A��K�oData3K�NameReferenceAddress

A��?�oData'K�Name
ReasonCode
����
��
���InitStateStatusCode$FailureAddress(ReferenceAddressReasonCodeTEMP0����KknT׉�&�:���6D�	EventDataA��C�oData+K�NameSvnCounterId
A��?�oData'K�Name
StatusCode
A��;�oData#K�NameSvnValue
A��C�oData+K�NamePrevSvnValue
�� �8� SvnCounterIdStatusCodeSvnValue PrevSvnValueTEMP<4��X�@EJ�Q8A�%�)2����D�	EventDataA��;�oData#K�NameSvnValue
A��C�oData+K�NamePrevSvnValue
\�t�SvnValue PrevSvnValueTEMP�,���	͓^����؟����bD�	EventDataA��A�oData)K�NameSinitTimeMs



@�SinitTimeMsTEMP44�9s��B�V݇���0,���D�	EventDataA��?�oData'K�Name
StatusCode
A��;�oData#K�NamePosition
\�x�StatusCodePositionTEMP���p�5�g�\3�����W���D�	EventDataA��?�oData'K�Name
AcmDateDay
A��C�oData+K�NameAcmDateMonth
A��A�oData)K�NameAcmDateYear
��0�AcmDateDay AcmDateMonthAcmDateYearTEMP���Gg�`6XRN�r��HJ��^D�	EventDataA��=�oData%K�Name	TxtStatus
 7�TxtStatusTEMP�(����Og�]2e��{���D�	EventDataA��=�oData%K�Name	TxtStatus
A��=�oData%K�Name	Argument1

A��=�oData%K�Name	Argument2

 7d�

|�

��TxtStatusArgument1Argument2TEMP7�@��ir\��hZc�a��.D�	EventDataA��=�oData%K�Name	TxtStatus
A��A�oData)K�NamePolicyLevel
A��=�oData%K�Name	Argument1

A��=�oData%K�Name	Argument2

 7`x

�

�TxtStatusPolicyLevelArgument1Argument2TEMP|^p%`�$^U��l�T�?���D�	EventDataA��5�oDataK�NamePhase
A��7�oDataK�NameStatus
A��5�oDataK�NameTries
A��Q�oData9K�NameRemainingNodesCount
A��UZ�ComplexData/K�NameRemainingNodes
�,<h��PhaseStatusTries,RemainingNodesCount$RemainingNodesNodeNumber$RemainingRangesTEMP<�YTɁ���T����H���D�	EventDataA��K�oData3K�NameAllocatedRegions
A��5�oDataK�NameTries
��(AllocatedRegionsTriesTEMP$��-��Dz[*��$������D�	EventDataA��?�oData'K�Name
PathLength
A��3�oDataK�NamePath
PathLengthPathTEMP��[�C4VZ��ss�	���bD�	EventDataA��A�oData)K�NameTryComplete



�TryCompleteTEMP��[��b��Q�,]��U�����D�	EventDataA��;�oData#K�NameFunction
A��7�oDataK�NameStatus
A��?�oData'K�Name
Checkpoint
D\pFunctionStatusCheckpointTEMP<h	�H-"��m^�&��O�����D�	EventDataA��G�oData/K�NameDebuggerStatus
A��7�oDataK�NameStatus
8�	�	$DebuggerStatusStatusTEMPP
)5�H7^A����d����D�	EventDataTEMP�
�.p�U��[t��MJ�����D�	EventDataA��9�oData!K�NameKeyType
A��3�oDataK�NameCode
KeyTypeCodeTEMPL���<Q���<�����D�	EventDataA��E�oData-K�Name
DisableReason
A��C�oData+K�NameTcgLogStatus
8X DisableReason TcgLogStatusTEMP4P
x_T��U�]�x����D�	EventDataA��7�oDataK�NameStatus
A��C�oData+K�NameFailurePoint
x
�
Status FailurePointTEMP�D�i{�0W'D�d�����dD�	EventDataA��C�oData+K�NameMirrorStatus
X MirrorStatusTEMP���X4��rXr�.;�a���lD�	EventDataA��K�oData3K�NameMirrorPercentage
,(MirrorPercentageTEMPdD�M�L3�$\�G��̚����D�	EventDataA��I�oData1K�NameEfiTimeZoneBias
A��K�oData3K�NameEfiDaylightFlags
l�$EfiTimeZoneBias(EfiDaylightFlagsTEMP���jt�t΀V�D(	z����D�	EventDataA��I�oData1K�NameEfiTimeZoneBias
A��K�oData3K�NameEfiDaylightFlags
A��9�oData!K�NameEfiTime
$Hp$EfiTimeZoneBias(EfiDaylightFlagsEfiTimeTEMP���Ig���R������>D�	EventDataA��5�oDataK�NamePages

A��?�oData'K�Name
MemoryType
A��?�oData'K�Name
Attributes
A��=�oData%K�Name	Alignment
A��7�oDataK�NameStatus
A��C�oData+K�NameRangeMinimum

A��C�oData+K�NameRangeMaximum

A��?�oData'K�Name
RangeFlags


�����



,LPagesMemoryTypeAttributesAlignmentStatus RangeMinimum RangeMaximumRangeFlagsTEMP��~f{��U�/��HXۂ��hD�	EventDataA��G�oData/K�NameIsolationLevel
$IsolationLevelTEMPD$ɿ��[�NA�6z����D�	EventDataA��K�oData3K�NameInformationClass
A��7�oDataK�NameStatus
Dl(InformationClassStatusTEMP�v\����V�e��46���^D�	EventDataA��=�oData%K�Name	BcdOption
�8(BcdOptionTEMP���Py��TU��R�RM���ZD�	EventDataA��9�oData!K�NameVersion
�VersionTEMP(`W��,�FTTϞ*,H�H��4D�	EventDataA��7�oDataK�NameStatus
A��C�oData+K�NameFailurePoint
A��K�oData3K�NameUpdateStatusEnum
A��9�oData!K�NameFwLevel
���8�Status FailurePoint(UpdateStatusEnumFwLevelPRVAP4Microsoft-Windows-Kernel-BootOPCO�.1�2�2������H����L����@N����hO�����X�����Y�����_�����`���� c����$ d����8 f����X }����� ����� H����� L����!N����,!X����X!Y����x!`�����!d�����!}�����!L
�����!N
����,"Y
����L"L����t"N�����"L�����"L�����"L����#L����,#L����`#L�����#L�����#L�����#L����$L����D$L����h$L�����$L�����$L�����$L����%L���� %win:Infowin:Startwin:Stop0InitializationFailure$GetEfiVariable(TxtLaunchPreparedInitStatusOpenFailureBdEnabledAllocation8ListInitializationFailureKdEnabledTpmInit NotSupported0BlMmAllocationFailure(SbatUpdateSuccess0MeasurementsDisabled$SetEfiVariable(PreviousTxtError,EnterInsecureState BdInitFailure(AllocationFailure KdInitFailureEnabled(SbatUpdateFailure0InvalidTxtSinitRange DrtmSvnCheck(EnumerateFailure,InvalidTxtHeapRange$BootmgrSvnCheck$MleLoadFailure(MissingRsdpTableNoSinitAcm4ComputePmrRangesFailure<InvalidTxtHeapBiosDataSize$MleHeaderTooOld(SinitPerformance(PrepareLcpFailure4TxtRejectedFirmwareAcm$TxtInformation$TxtNotSupported8DrtmDriversNotSupportVbsPpamFailure SmmLevelCheck SmmIsolation,TxtSmmIsolationPerfLEVL�P|%P�%P�%win:Errorwin:Warning(win:InformationalTASK�k�����1�����1�����1����2����02����P2�����2�����2	�����2
�����2����43����`3
�����3�����3�����3����4����D4����l4�����4�����4�����4����5���� 5����85����p5�����5�����5����6����46����X6����t6 �����6!�����6"�����6#����7$����47%����`7&�����7'�����7(�����7)����8*����T8+����x8,�����8-�����8.�����8/����,90����X91�����92�����93�����94����:5����D:6����\:7�����:8�����:9�����::����;;���� ;<����X;=����|;>�����;?�����;@����<A����<<B����`<C�����<D�����<E�����<F�����<G���� =H����H=I����p=J�����=K�����=L�����=M����>N����@>O����T>P����l>Q�����>R�����>S����?T����4?U����\?V�����?W�����?X�����?Y�����?Z����@[����4@\�����@]�����@^�����@_���� A`����DAa����hAb�����Ac�����Ad�����Ae���� Bf����TBg����|Bh�����Bl�����Bt����C}����DC(InitializeLibrary PrepareTarget4RebuildKernelMemoryMapFatalError PersistMemory0ClaimPersistedMemory,FreePersistedMemory,CleanupPageDatabaseCancelBoot@AttachPersistentPageDatabase,MemoryBlockRundown0BuildKernelMemoryMap GetMemoryMap<AllocatePhysicalPagesForMdl(ExecuteTransition0DisconnectHypervisor(MemoryMapRundown@PhysicalPageAllocationFailureBootManagerPreBoot(FirmwareBootDataLoadDriversLoadHive8BootApplicationExecution8WaitForPartitionsRestored4MemoryPartitionRestore4PersistMemoryPartition$RegisterLoader$SiPolicyFailureBootTotalIo(DirtyBootShutdown$BootMenuPolicyBootType8MemoryPartitionsRestored$QueryStatistics,ConnectSecureLoader$BootFileAccess4RetrieveDriverListTime8FreePersistedMemoryBlock,PrepareNotification8PartitionInitialAddMemory$ImageHashCheck,ImageIntegrityCheck,BootPolicyMigration,RemoveEnclavePages0EnumerateEnclavePages,GetSystemBootDevice4NormalizeBootOptionList4CreateLibraryParameters CreateDevices8SoftRestartHostCapability,CancelNotificationBootDiag(ImageLoadFailure,FirmwareResolution(BootEnvResolution(BootmgrEntryCount UserInputTime8VsmIdkProvisioningStatus$BootAppLoadTime0PrepareTargetFailure,VsmPolicyEnablement@InitializeMeasurementContext$KsrMeasurement$TpmMeasurement,CloseMeasurementLog,CommitPendingEventsCapTpmPcr,TpmCommandResponse$TpmSubmitError(TpmBitLockerUsage(EfiVariableAccess4GetFirmwareInformation$VerifyBootEntry(InvalidNfitTable$MeasuredLaunch,EFICapsuleCreationBootSIFileOpen(VsmPolicyFailure8VsmLKeyProvisioningStatus4SecureBootVariableUsage4MiniFilterStartFailure(FileModification0RegistryModificationSoftReboot$RegisterFilter BootDebugger IoSpaceMemory(FinalizeMemoryMapPRegisterHvloaderPersistenceInterface<LoadHvloaderForPersistence0VsmBootNoSecretsMode0BootMenuTimerCanceled$BadMemoryPages$KernelDebuggerDMemoryPartitionFreeUnusedMemory<MemoryPartitionRestoreStatsBootTpm$MemoryMirroring4EfiTimeZoneInformation(MemoryAllocation0FinalizeNotification(PersistBcdFailure@QuerySystemInformationFailure0SecureBootMitigationsSbatUpdateKEYW�
����<D����XD�����D�����D�����D �����D@����$E����DE����hE �����E@�����E������E4�ESoftRestart,MemoryPreservation,MemoryBlockRundown$PhysicalMemory(MemoryMapRundown(MemoryPartitions EfiVariables$LOG_TO_BOOTSTAT0ms:ReservedKeyword40 ms:Telemetryms:Measures$ms:CriticalDatawin:SQMEVNT�1�7@��=p%�+�.8@��=p%�+�.@�(?p%�.%@��?p%�)�. @��Cp%)�t�.+(@�XE|X%|*�t�. @�pGp%�'�t�.*(@�8H|d%`*�t�.	 @��Hd%�t�.
 �
�IX%�t�.@�Np%�'�.R@��Np%�.�.
 @��Pd%�t�.@��Qp%�.@��Rp%�.�4SX%�.��TX%�t�.��Up%�.9�Vp%,�.��Vp%�.��Wp%,)�.��Xp%,)�.�X[p%�.�,\p%�.�|\p%�.��\p%�. �]p%H)�.��]p%�t�.!�@^p%d)�.!��^p%d)�.����4:p%�t�4SX%�.��TX%u�.�0`p%(�.@�\cp%�. :� dp% ,�.!(@!�eX%u�."(@"�LfX%u�.#( #��gX%u/$@$��hp%�.%(@%�djX%u�.&6( &��kX%�+$u/'  '�8nX%,u/(  (�|oX%0u/)  )�0pX%4u/*( *��pX%8u/+( +�lrX%@u/, ,��sX%Hu/-; -��sp%<,/.&@�up%�)�./@�Ёp%0(�.0@���p%L(�.1 1��lX%�(/2Q 2��vX%�./2Q 2��}X%�./2Q 2� �X%�./3Q 3��vp%�./3Q 3��}p%�./3Q 3� �p%�./4<@�ԃp%X,�.5@�\�p%h(�.6@���X%�.7=@��X%t,�.8@�P�X%Lu�.9 9��uX%/: :�d{p%/; ;�ĀX%/<K <�|d%�-/=L@������p%.Pu�.>L >��TX%.Tu/?
L@�������X%.Xu�.@L@�������X%.\u�.AL@����P��X%.`u�.BL@����P��X%.du�.CL@����P��X%.hu�.DL@������X%.lu�.EL@������ X%.pu�.FL@����P�X%.tu�.GO����B�d%l.HL@����P�8X%.xu�.IL I���Dp%./JQ J��jX%�./JQ J��mX%�./KQ K��jp%�./KQ K��mp%�./LX�����p%h/MX�����ld%h/N`������d%H0O`����p%H0Q Q�p%/SQ S��p%�./TQ T�T�p%�./UQ U���p%�./VQ V��
p%�./WQ W��*X%�./XQ X�d=p%�./YQ Y��[p%�./ZQ Z�Hfp%�./[Q [��hp%�./d�����p%�%|ud����T��p%�%�ue����P��p%�%�uf�����p%&�uf������p%&�uf������p%&�ug����P��p%&�uh������p%&�ui����P��p%&�uj������p%T&�uk�������p%T&�ul����P�|X%8&�um�������p%�&�un����P��p%�&�uo������p%�&�up����P��p%�&�uq����T��p%p&�ur������p%p&�us	�s���d%�&�u�.t	�tP��d%�&�u�.u
�����p%�&�uv
����P��p%�&�uw����p�|p%�&�ux�����p%'�uy����P��p%'�uz
�������p%4'�u{
����P��p%4'�u|PH�|�X%�.�u�.~	�������p%P'v	�������p%P'v��������p%l'v������p%�'v�����(�|p%�'v������p%�' v�����ԫ�p%�'$v�	 ������|X%�'(v/�	 ������|X%�'0v/������p%�(8v������p%�(<v� ����|X%�&@v/� ���|X%�&Hv/�����T��p%�(Pv��������p%�(Xv�������p%�(`v�����о�p%�(hv� ��<�|X%�(pv/�����h��p%�(xv�����,��p%�(�v�����L��p%�(�v� ����|X%�(�v/�"����P�|p%�)�v�#�����p%�)�v�#����P��p%�)�v�$ ��P�|X%�)�v/�'�������p%*�v�'����P��p%*�v�(�����p%(*�v�(����P��p%(*�v�(������p%(*�v�) ����,��p%D*�v�) �������p%D*�v�) �������p%D*�v�) ����P��p%D*�v�>����p%�,�.�, ��P�|p%�*/�, ��P�|d%�*/�����d%�.�5��,�p%�+�v�5 ��,�X%�+�v/�-�������p%�*�v�4����P��p%x+�v�4����P��p%x+�v�/ ����P�|X%�*�v/�0 ����P�|X%+�v/�1 ����P�|X%$+�v/� ����P�|X%�%�v/�2 ����P�|X%@+�v/�3 ����P�|X%\+�v/�. ����P�|X%�*�v/�? ����P�|X%�,�v/�? ����x�X%�,w/�@ ��P�|X%�,w/�A ��P�|X%�,w/�B ��P�|X%-w/�C ����P�|X%-w/�D ����P�|X%8-w/�D ����P�|X%8-w/� ����P�|X%�%w/�H@�������p%�- w�H@������Hp%�-$w�I ����P�|X%�-(w/�J ����P�|X%�-,w/�W ��P�|d%L/0w/�
Y ����P��X%�/4w/�_ ����P��X%,08w/�?����,<d%�,<w�h ��P�X%(1@w/�E@����|p%T-�.�E@����|p%T-�.�F ��h�|X%p-Dw/�F ��<�|X%p-Hw/�G@���|X%�-�.�M�����p%4.Lw�M����P��p%4.Pw�N@�����p%P.�.�N ��h�`X%P.Tw/�
N ��(��X%P./�L ����,p%./�S ����P�|X%�.Xw/�T@��|p%�.\w�.�U@��|p%/`w�.�V��,�p%0/dw�.�V��P��p%0/hw�.�V���p%0/lw�.�V��P��p%0/pw�.�V���X%0/tw�.�L ����Pp%./�L ��L�\p%./�L��hX%.�.�L���tX%.�.�Y �����xX%�//�Y ������p%�//�] ���	|p%�//�Z�����p%�/|w�Z�����p%�/�w�Z����P��X%�/�w�[����P�|X%�/�w�\����P�|X%�/�w�^ ��
|p%0�w/�a����T��p%d0�w�a�������p%d0�w�b�����|p%�0�w�c ��\�X%�0�w/�L �����p%./�d ���
X%�0/�e���T|p%�0�.�e���|p%�0�.�f@�����$d%�0�.�g�����p%1�w�g����P��p%1�w�L��h�p%.�.�d ��x�p%�0/�L@�������p%.�.�l ����<X%D1�w/t ��d%`1/N�X��X%P.�w�.t �@p%`1/t �@p%`1/#}  #��0p%|1�w/$}  $���X%|1�w/�C�C�C�C�C�C�C�C�C�C�C,D�C�C�C�C�C�C�C�C�C�C�C�C�C�C�C�C�C�C�C�C�C�C�C�C�C�C�C�C�C�C�ClClClClClClClClClC|C|ClC|ClC|ClC|C|C|C|C|ClClClC|ClC|C�ClClClClC�CDlC�ClC�ClClC�C�C�ClC�ClC�ClClClC|ClC|ClC|ClC|ClC|ClC|ClC|ClC|ClC|ClC|ClClC|ClClClC|C|ClClClC�C�C�C�C�C�C|ClClClClClClClClClClClClClClClClClClC�C�ClClClClClClClC�C�ClClC�ClClClClClClClClC|ClClClClClC�ClC|ClC|ClC|C�ClClClC�C�C�CWEVT�; x�x
����(�h���p�CHANp4x����TMicrosoft-Windows-Kernel-File/AnalyticTTBL )TEMP��z���[�xdS�2iY���
��D�	EventDataA��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��E�oData-K�Name
CreateOptions
A��K�oData3K�NameCreateAttributes
A��A�oData)K�NameShareAccess
A��;�oData#K�NameFileName
X{d{|{�{�{�{�{IrpThreadIdFileObject CreateOptions(CreateAttributesShareAccessFileNameTEMP8(~>���_Ql%x�t%����D�	EventDataA��?�oData'K�Name
ByteOffset

A��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��7�oDataK�NameIOSize
A��9�oData!K�NameIOFlags

�~�~�~�~$8ByteOffsetIrpThreadIdFileObjectFileKeyIOSizeIOFlagsTEMP�0�a��RR!Y�-�%���D�	EventDataA��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��K�oData3K�NameExtraInformation
A��=�oData%K�Name	InfoClass
����́���$�IrpThreadIdFileObjectFileKey(ExtraInformationInfoClassTEMP`d�����RXZ��t�K�Ł���D�	EventDataA��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��K�oData3K�NameExtraInformation
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameFilePath
����0�D�l���IrpThreadIdFileObjectFileKey(ExtraInformationInfoClassFilePathTEMP��9�k���R�BC�K&���"D�	EventDataA��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��7�oDataK�NameLength
A��=�oData%K�Name	InfoClass
A��=�oData%K�Name	FileIndex
A��;�oData#K�NameFileName
������Ԉ����,�IrpThreadIdFileObjectFileKeyLengthInfoClassFileIndexFileNameTEMP���[��ҟ�hQou����D�	EventDataA��1�oDataK�NameIrp
A��;�oData#K�NameThreadId
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
���$�IrpThreadIdFileObjectFileKeyTEMP�|��ԋR�W�!ssx��D�	EventDataA��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��I�oData1K�NameIssuingThreadId
A��E�oData-K�Name
CreateOptions
A��K�oData3K�NameCreateAttributes
A��A�oData)K�NameShareAccess
A��;�oData#K�NameFileName
��0�T�t�����IrpFileObject$IssuingThreadId CreateOptions(CreateAttributesShareAccessFileNameTEMP�8�ު��N[�^�kљ9و���2D�	EventDataA��?�oData'K�Name
ByteOffset

A��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��I�oData1K�NameIssuingThreadId
A��7�oDataK�NameIOSize
A��9�oData!K�NameIOFlags
A��?�oData'K�Name
ExtraFlags

ؑ���0�T�h�|�ByteOffsetIrpFileObjectFileKey$IssuingThreadIdIOSizeIOFlagsExtraFlagsTEMP���ty��:[�PW�<����D�	EventDataA��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��K�oData3K�NameExtraInformation
A��I�oData1K�NameIssuingThreadId
A��=�oData%K�Name	InfoClass
��,�@�h���IrpFileObjectFileKey(ExtraInformation$IssuingThreadIdInfoClassTEMPxؗ�Z�Q��	U�K�n?�,��D�	EventDataA��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��K�oData3K�NameExtraInformation
A��I�oData1K�NameIssuingThreadId
A��=�oData%K�Name	InfoClass
A��;�oData#K�NameFilePath
d�p�����Ș��IrpFileObjectFileKey(ExtraInformation$IssuingThreadIdInfoClassFilePathTEMP���t�욷�X_������0D�	EventDataA��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��I�oData1K�NameIssuingThreadId
A��7�oDataK�NameLength
A��=�oData%K�Name	InfoClass
A��=�oData%K�Name	FileIndex
A��;�oData#K�NameFileName
 �,�H�\�������ĜIrpFileObjectFileKey$IssuingThreadIdLengthInfoClassFileIndexFileNameTEMP8���]�@L,Xӑ�2��\��(D�	EventDataA��1�oDataK�NameIrp
A��?�oData'K�Name
FileObject
A��9�oData!K�NameFileKey
A��I�oData1K�NameIssuingThreadId
������ĞIrpFileObjectFileKey$IssuingThreadIdTEMP����-�IT�S��BD����D�	EventDataA��1�oDataK�NameIrp
A��K�oData3K�NameExtraInformation
A��7�oDataK�NameStatus
<�H�p�Irp(ExtraInformationStatusTEMP$T���`Ӓ��],��Ӛ����D�	EventDataA��9�oData!K�NameFileKey
A��;�oData#K�NameFileName
|���FileKeyFileNamePRVAP��Microsoft-Windows-Kernel-FileOPCO01�win:InfoLEVL@P@�(win:InformationalTASK$
����0�����L�����h�
����|���������������������������������������������$�����4�����\�����l�����������������������ܦ���������������,� ����H�!����h�"����x�NameCreateNameDeleteCreateCleanupCloseReadWrite$SetInformationSetDeleteRenameDirEnumFlush(QueryInformationFSCTL OperationEndDirNotifyDeletePathRenamePathSetLinkPathSetLink CreateNewFileSetSecurity QuerySecuritySetEAQueryEAKEYW�	����(� ����h�@���������������������T�����������Щ����$�@KERNEL_FILE_KEYWORD_FILENAME<KERNEL_FILE_KEYWORD_FILEIO<KERNEL_FILE_KEYWORD_OP_END<KERNEL_FILE_KEYWORD_CREATE8KERNEL_FILE_KEYWORD_READ8KERNEL_FILE_KEYWORD_WRITEDKERNEL_FILE_KEYWORD_DELETE_PATHTKERNEL_FILE_KEYWORD_RENAME_SETLINK_PATHLKERNEL_FILE_KEYWORD_CREATE_NEW_FILEEVNT�+

��������4�t���$x��������4�����$x�������x�4�����$x������8��4�����$x

 �����D��4�Ȣ��$x

 �����ܜ�4�Ȣ��$x �����D��4����$x �����ܜ�4����$x �����|�4����$x �����Ў�4����$x �����|�4��Ȳ$x �����Ў�4��в$x �����L�4�8�ز$x ��������4�8�ܲ$x �����L�4�T��$x ��������4�T��$x �����L�4�p��$x ��������4�p��$x ��������4����$x �������4����$x �����D��4�����$x �����ܜ�4�����$x �����L�4�ģ�$x ��������4�ģ�$x �����L�4���$x ��������4���$x`�������4����$x ��������4���$x �������4���$x�����<��4�4� �$x��������4�4�$�$x�����<��4�P�(�$x��������4�P�,�$x�����<��4�l�0�$x��������4�l�4�$x �����L�4�p�8�$x ��������4�p�<�$x������x�4���@�$x�����8��4���D�$x ��������4���H�$x   ��������4�ܤL�$x!! ��������4���P�$x"" ��������4��T�$x������ȧ��ȧ����������ا��ا����������������������������������������������������������������WEVT���
�D�t����0�CHANd������HMicrosoft-Windows-PCI/DiagnosticPRVA@�Microsoft-Windows-PCIOPCO01\�win:InfoLEVL@P��(win:InformationalTASKP
����ܴ(AspmErrataRundownKEYW,���� �DiagEVNTD

�����P�����p����WEVT�,�	̵��|�
d���4�t�t�8�CHAN�������T��\Microsoft-Windows-Kernel-StoreMgr/Analytic`Microsoft-Windows-Kernel-StoreMgr/OperationalMAPS��ȶVMAP$D���VMAP$���4CacheTerminationMsgMap8StoreMgrCorruptPageMsgMapTTBL� TEMP|(�w��49�-T��O[T!����lD�	EventDataA��9�oData!K�NameDataKey
A��9�oData!K�NameDataMgr
A��A�oData)K�NameStoreOffset
A��G�oData/K�NameCompressedSize
A��5�oDataK�NameFlags
������й�DataKeyDataMgrStoreOffset$CompressedSizeFlagsTEMP����` �U�E3�C�����D�	EventDataA��9�oData!K�NameDataKey
A��9�oData!K�NameDataMgr
A��A�oData)K�NameStoreOffset
X�l���DataKeyDataMgrStoreOffsetTEMPt	X�U�81��P{G]\��-���D�	EventDataA��;�oData#K�NameStoreKey
A��C�oData+K�NameStoreFileKey
A��A�oData)K�NameUserDataMgr
A��A�oData)K�NameMetadataMgr
A��?�oData'K�Name
RegionSize
A��A�oData)K�NameRegionCount
A��=�oData%K�Name	BlockSize
A��?�oData'K�Name
SectorSize
A��O�oData7K�NameEncryptionStrength
A��=�oData%K�Name	StoreType
	A��9�oData!K�NameStoreId
A��C�oData+K�NameBlocksStored
A��C�oData+K�NameRegionsInUse
A��G�oData/K�NameTotalSpaceUsed

A��5�oDataK�NameFlags
A��I�oData1K�NameMetaRegionCount
A��K�oData3K�NameMetaRegionsInUse
A��S�oData;K�NameMetaRegionsSpaceUsed
A��=�oData%K�Name	StoreTime
�����(�D�`�|����������(�H�l�|�������StoreKey StoreFileKeyUserDataMgrMetadataMgrRegionSizeRegionCountBlockSizeSectorSize,EncryptionStrengthStoreTypeStoreId BlocksStored RegionsInUse$TotalSpaceUsedFlags$MetaRegionCount(MetaRegionsInUse0MetaRegionsSpaceUsedStoreTimeTEMP����4�d*�cS�Ս&w)�t��\D�	EventDataA��;�oData#K�NameStoreKey
��StoreKeyTEMP������_Ql6��a� ��D�	EventDataA��9�oData!K�NameDataMgr
A��G�oData/K�NameVirtualAddress
A��I�oData1K�NamePhysicalAddress

A��3�oDataK�NameSize
A��?�oData'K�Name
FileBacked
A��G�oData/K�NameCorruptionType
A��5�oDataK�NameFlags
����
����ȶ���<�DataMgr$VirtualAddress$PhysicalAddressSizeFileBacked$CorruptionTypeFlagsTEMP������v�z]���	8XIG��rD�	EventDataA��9�oData!K�NameDataMgr
A��A�oData)K�NameRegionIndex
A��7�oDataK�NameStatus
A��=�oData%K�Name	SpaceUsed
A��G�oData/K�NameLastAccessTime
X�l�������DataMgrRegionIndexStatusSpaceUsed$LastAccessTimeTEMP@L��B��ZR�-))��>D�	EventDataA��?�oData'K�Name
FailReason
A��?�oData'K�Name
FailStatus
A��K�oData3K�NameObjectPathLength
A��?�oData'K�Name
ObjectPath
��������FailReasonFailStatus(ObjectPathLengthObjectPathTEMP��Kz�?�pY�ޔaB@�d���D�	EventDataA��3�oDataK�NameSize
A��3�oDataK�NameData
��SizeDataTEMPx(���(߀09S���	6����D�	EventDataA��;�oData#K�NameStoreKey
A��3�oDataK�NameSize
A��3�oDataK�NameData
d�|���StoreKeySizeDataTEMPh�R0qTBV��) ���D�	EventDataA��;�oData#K�NameStoreKey
A��5�oDataK�NameParam
����StoreKeyParamTEMPL���Y�q�U���������D�	EventDataA��7�oDataK�NameReason
A��?�oData'K�Name
FailStatus
A��K�oData3K�NameDeviceDescLength
A��M�oData5K�NameDeviceDescription
A��K�oData3K�NameObjectPathLength
A��?�oData'K�Name
ObjectPath
�@�T�p�������ReasonFailStatus(DeviceDescLength(DeviceDescription(ObjectPathLengthObjectPathTEMP`����Ǎ��Y<��������D�	EventDataA��9�oData!K�NameSqmType
A��G�oData/K�NameSqmSessionGuid
A��5�oDataK�NameSqmID
A��O�oData7K�NameSqmStreamRowLength
A��QZ�ComplexData+K�NameSqmStreamRow
�l���������� �@�SqmType$SqmSessionGuidSqmID,SqmStreamRowLength SqmStreamRow SqmTypeEntry SqmDWORDEntry$SqmStringEntryPRVAXx�Microsoft-Windows-Kernel-StoreMgrOPCOx1��2�2�win:Infowin:Startwin:StopLEVL@PL�(win:InformationalTASK����\�����t����������������������������������4�	����P�
����l�������������
���������������������,�����L�StoreAddStoreRemoveStoreCreateStoreDelete StoreRundown$StoreCorruption(StorePageRundownRegionEvictRegionWrite(UnpersistFailure StoreIoStatsGlobalStatsStoreEmpty RegionRelease RegionCompact RegionRundown(CacheTerminationKEYW�������@�������������4 �StoreOpsStoreDiag0StoreContentsRundownwin:SQMEVNT����������@�����ص��������@�����ص���������@�����ص��������@�����ص���������@�����صP@�����@���������������@�(���ص�����L���@�D���ص		�����L���@�`���ص

P@�����@�|��������$���@����ص��������@����ص

���������@����ص�����L���@����ص�����L���@���ص�����L���@���ص������L���@�$� �صP@�����@�@�$�������@�,���������������������������������������������WEVT�����x�
��(�4�t�����TTBLPTEMPD���͟�,�Vo�9��{���BD�	EventDataA��9�oData!K�NameSqmType
A��G�oData/K�NameSqmSessionGuid
A��5�oDataK�NameSqmID
A��W�oData?K�NameSqmDWORDDatapointValue
L�`�����SqmType$SqmSessionGuidSqmID4SqmDWORDDatapointValuePRVA`��Microsoft-Windows-Kernel-LicensingSqmOPCOLEVL@PL�(win:InformationalTASKKEYW04��win:SQMEVNTD������@�����WEVT|F����D���
d"�"0#p#&�'CHANt`�����XMicrosoft-Windows-Kernel-Memory/AnalyticTTBL�;TEMP�

X�!5
.)]���Z�����^D�	EventDataA��G�oData/K�NamePriorityLevels
A��E�oData-K�Name
ZeroPageCount
A��E�oData-K�Name
FreePageCount
A��M�oData5K�NameModifiedPageCount
A��[�oDataCK�NameModifiedNoWritePageCount
A��C�oData+K�NameBadPageCount
A��M�oData5K�NameStandbyPageCounts
�A��S�oData;K�NameRepurposedPageCounts
�A��]�oDataEK�NameModifiedPageCountPageFile
A��O�oData7K�NamePagedPoolPageCount
	A��U�oData=K�NameNonPagedPoolPageCount
A��C�oData+K�NameMdlPageCount
A��I�oData1K�NameCommitPageCount
\��������� �@�h�������,�L�$PriorityLevels ZeroPageCount FreePageCount(ModifiedPageCount8ModifiedNoWritePageCount BadPageCount(StandbyPageCounts0RepurposedPageCounts8ModifiedPageCountPageFile,PagedPoolPageCount0NonPagedPoolPageCount MdlPageCount$CommitPageCountTEMPpT�R���n.R����H����D�	EventDataA��5�oDataK�NameCount
A��QZ�ComplexData+K�NameWSCommitInfo
������(�T�x���Count WSCommitInfoProcessID,WorkingSetPageCount$CommitPageCount,VirtualSizeInPages<PrivateWorkingSetPageCountTEMP$
��R���n.R����H����D�	EventDataA��5�oDataK�NameCount
A��QZ�ComplexData+K�NameWSCommitInfo
����������$�P�������Count WSCommitInfoProcessID,WorkingSetPageCount$CommitPageCount,VirtualSizeInPages<PrivateWorkingSetPageCount,StoreSizePageCount$StoredPageCount(CommitDebtInPagesTEMPd��R���n.R����H����D�	EventDataA��5�oDataK�NameCount
A��QZ�ComplexData+K�NameWSCommitInfo
��	���8�\������<�Count WSCommitInfoProcessID,WorkingSetPageCount$CommitPageCount,VirtualSizeInPages<PrivateWorkingSetPageCount,StoreSizePageCount$StoredPageCount(CommitDebtInPages,SharedCommitInPagesTEMP�X���?"~�[&
�S�%�\���D�	EventDataA��5�oDataK�NameCount
A��_Z�ComplexData9K�NameSessionWSCommitInfo
��� �8�d�����Count,SessionWSCommitInfoSessionId,WorkingSetPageCount$CommitPageCount,PagedPoolPageCount<PrivateWorkingSetPageCountTEMP<
���?"~�[&
�S�%�\���D�	EventDataA��5�oDataK�NameCount
A��_Z�ComplexData9K�NameSessionWSCommitInfo
��������(�L�x�����Count,SessionWSCommitInfoSessionId,WorkingSetPageCount$CommitPageCount,PagedPoolPageCount<PrivateWorkingSetPageCount,StoreSizePageCount$StoredPageCount(CommitDebtInPagesTEMP|���?"~�[&
�S�%�\���D�	EventDataA��5�oDataK�NameCount
A��_Z�ComplexData9K�NameSessionWSCommitInfo
���	�4�L�x����0T|Count,SessionWSCommitInfoSessionId,WorkingSetPageCount$CommitPageCount,PagedPoolPageCount<PrivateWorkingSetPageCount,StoreSizePageCount$StoredPageCount(CommitDebtInPages,SharedCommitInPagesTEMP�<�)m���N_}݉�T3n��^D�	EventDataA��=�oData%K�Name	ProcessId
PProcessIdTEMP 8�de�^��<3�����D�	EventDataA��=�oData%K�Name	ProcessId
A��5�oDataK�NameFlags
`xProcessIdFlagsTEMP���tMO%�XRVw�*�����D�	EventDataA��=�oData%K�Name	ProcessId
A��7�oDataK�NameStatus
A��G�oData/K�NamePagesProcessed
��ProcessIdStatus$PagesProcessedTEMP�p���USg�\zY�4.��D�	EventDataA��=�oData%K�Name	ProcessId
A��7�oDataK�NameStatus
A��G�oData/K�NamePagesProcessed
A��_�oDataGK�NameWriteCombinePagesProcessed
A��W�oData?K�NameUncachedPagesProcessed
A��Q�oData9K�NameCleanPagesProcessed
�8t�ProcessIdStatus$PagesProcessed<WriteCombinePagesProcessed4UncachedPagesProcessed,CleanPagesProcessedTEMP$��V]���])&�l�Q|{���D�	EventDataA��=�oData%K�Name	ProcessId
A��7�oDataK�NameStatus
��ProcessIdStatusTEMP��	bP���P���J&� ���ZD�	EventDataA��9�oData!K�NameAcgFlag
�	AcgFlagTEMP8P�����Z�v��N˝���jD�	EventDataA��W�oData?K�NameDurationInMicroseconds

A��?�oData'K�Name
TotalBytes

A��?�oData'K�Name
LowAddress

A��A�oData)K�NameHighAddress

A��=�oData%K�Name	SkipBytes

A��S�oData;K�NameMemoryDescriptorList
A��=�oData%K�Name	IdealNode
A��5�oDataK�NameFlags


�

$

@

\

x
�
�
�
4DurationInMicrosecondsTotalBytesLowAddressHighAddressSkipBytes0MemoryDescriptorListIdealNodeFlagsTEMPd

4�s��cR��5���Ͻ��D�	EventDataA��W�oData?K�NameDurationInMicroseconds

A��?�oData'K�Name
TotalBytes

A��?�oData'K�Name
LowAddress

A��A�oData)K�NameHighAddress

A��;�oData#K�NameBoundary

A��I�oData1K�NamePhysicalAddress

A��E�oData-K�Name
MappedAddress
A��M�oData5K�NameAllocatedFromPool

A��G�oData/K�NameProtectionMask
A��E�oData-K�Name
PreferredNode
	

�

0
L
h
�
��

�,4DurationInMicrosecondsTotalBytesLowAddressHighAddressBoundary$PhysicalAddress MappedAddress(AllocatedFromPool$ProtectionMask PreferredNodeTEMP<�eر��4Q��˭A�Am��2D�	EventDataA��W�oData?K�NameDurationInMicroseconds

A��?�oData'K�Name
TotalBytes

A��?�oData'K�Name
LowAddress

A��A�oData)K�NameHighAddress

A��;�oData#K�NameBoundary

A��I�oData1K�NamePhysicalAddress

A��E�oData-K�Name
MappedAddress
A��G�oData/K�NameProtectionMask
A��E�oData-K�Name
PreferredNode
A��A�oData)K�NamePartitionId
	A��1�oDataK�NameTag
A��5�oDataK�NameFlags
A��M�oData5K�NameAllocatedFromPool

A��W�oData?K�NameAllocatedFromExtension




�



8
T
l����

,

T4DurationInMicrosecondsTotalBytesLowAddressHighAddressBoundary$PhysicalAddress MappedAddress$ProtectionMask PreferredNodePartitionIdTagFlags(AllocatedFromPool4AllocatedFromExtensionTEMP
��깗x��S���њ���D�	EventDataA��A�oData)K�NamePartitionId
A��5�oDataK�NameCount
A��UZ�ComplexData/K�NameMemoryNodeInfo
���
�(Lx���(T|PartitionIdCount$MemoryNodeInfoNodeNumber$TotalPageCount,SmallFreePageCount,SmallZeroPageCount,MediumFreePageCount,MediumZeroPageCount,LargeFreePageCount,LargeZeroPageCount(HugeFreePageCount(HugeZeroPageCountTEMP���깗x��S���њ���D�	EventDataA��A�oData)K�NamePartitionId
A��5�oDataK�NameCount
A��UZ�ComplexData/K�NameMemoryNodeInfo
�` | � � � � !PartitionIdCount$MemoryNodeInfoNodeNumber$TotalPageCount(HugeFreePageCount(HugeZeroPageCountTEMP$"-��0_��1������D�	EventDataA��A�oData)K�NameBaseAddress
A��3�oDataK�NameSize
8"T"BaseAddressSizePRVATx"Microsoft-Windows-Kernel-MemoryOPCOx1�"2#2#win:Infowin:Startwin:StopLEVL@PH#(win:InformationalTASK������$�����$�����$����%����,%����T%����`%�����%	�����%
�����%�����%MemInfoMemInfoWS(MemInfoSessionWS(WorkingSetOutSwap(WorkingSetInSwapAcg MdlAllocation$ContAllocationMemInfoNode,MemInfoHugeIoSpaceContFreeKEYW� ����p&@�����&������&����('����\'�����'<KERNEL_MEM_KEYWORD_MEMINFO@KERNEL_MEM_KEYWORD_MEMINFO_EX<KERNEL_MEM_KEYWORD_WS_SWAP4KERNEL_MEM_KEYWORD_ACGHKERNEL_MEM_KEYWORD_PHYSICAL_ALLOCDKERNEL_MEM_KEYWORD_MEMINFO_NODEEVNT� ��������"<#|#,P�@�����p��"<#�#,P�@��������"<#�# ,P�@�������"<#�#$,P�@�����h��"<#�#(,P�@�������"<#�#,,P�@�����,��"<#�#0,P���������"<#�#4,P�������h�"<#�#8,P���������"<#�#<,P�������4�"<#�#@,P���������"<#�#D,P�������h�"<#�#H,P���������"<#�#L,P��������"<#$P,P�	��������"<#�#T,P�
������	�"<#$$X,P�������
�"<#@$\,P������L�"<#@$`,P�	�������"<#\$d,P�

�������"<#x$h,P������@!�"<#�$l,P�& & & & & & &0&0&0&0&0&0&0&@&0&P&P&P&`&`&P&WEVT�6�	�,$./
�[\H\�\�\�^CHAN\-����\-��-����XMicrosoft-Windows-Kernel-ShimEngine/DebugdMicrosoft-Windows-Kernel-ShimEngine/OperationaldMicrosoft-Windows-Kernel-ShimEngine/DiagnosticMAPS�\.8.VMAP$�.��VMAP$�.��LKSE:DeviceFlagApplied.FlagSourceMapLKSE:DriverShimApplied.ShimSourceMapTTBL�,TEMP4�/Z~�B ;�\�Y�q�h:���D�	EventDataA��9�oData!K�NameEventId
A��C�oData+K�NameDebugMessage
$080EventId DebugMessageTEMP(�1�%oM���]�@/Hxɫ��4D�	EventDataA��?�oData'K�Name
DriverName
A��?�oData'K�Name
ShimSource
A��=�oData%K�Name	ShimCount
A��C�oData+K�NameAppliedGuids
28.,2H2`2DriverNameShimSourceShimCount AppliedGuidsTEMP�3-
U&O�SA����4��*D�	EventDataA��?�oData'K�Name
DeviceName
A��A�oData)K�NameDeviceClass
A��?�oData'K�Name
FlagSource
A��5�oDataK�NameFlags

04L4\.h4

�4DeviceNameDeviceClassFlagSourceFlagsTEMP�T6�N��_���ք������D�	EventDataA��?�oData'K�Name
DriverName
A��?�oData'K�Name
DriverBase
A��?�oData'K�Name
DriverSize
A��I�oData1K�NameDriverTimeStamp
A��G�oData/K�NameDriverCheckSum
�6�6�6707DriverNameDriverBaseDriverSize$DriverTimeStamp$DriverCheckSumTEMPD48ef2�_�Ǎ;�vB���D�	EventDataA��C�oData+K�NameDriverObject
A��?�oData'K�Name
DriverBase
\8|8 DriverObjectDriverBaseTEMPd�:O]S��Rx�������D�	EventDataA��?�oData'K�Name
DriverBase
A��?�oData'K�Name
DriverSize
A��C�oData+K�NameDriverObject
A��1�oDataK�NamePdo
A��7�oDataK�NameStatus
A��A�oData)K�NameServiceName
A��?�oData'K�Name
HardwareId
L;h;�;�;�;�;�;DriverBaseDriverSize DriverObjectPdoStatusServiceNameHardwareIdTEMP0t=�<au2Pۜ�]i���DD�	EventDataA��9�oData!K�NameAddress
A��7�oDataK�NameCaller
A��3�oDataK�NameType
A��3�oDataK�NameSize
A��1�oDataK�NameTag
�=�=>> >AddressCallerTypeSizeTagTEMPt0?e�5��J]Y���9����D�	EventDataA��9�oData!K�NameAddress
A��7�oDataK�NameCaller
A��1�oDataK�NameTag
l?�?�?AddressCallerTagTEMP|�@��k,H�lZ.�7u1�n:���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
�@AA DriverObjectFdoIrpTEMPC��h؂iAQ��՜����D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��?�oData'K�Name
DeviceType
A��U�oData=K�NameDeviceCharacteristics
A��=�oData%K�Name	Exclusive
A��7�oDataK�NameStatus
�C�C�C�CDD DriverObjectFdoDeviceType0DeviceCharacteristicsExclusiveStatusTEMPT�E���ܐ�_���R����VD�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��=�oData%K�Name	MajorCode
A��7�oDataK�NameStatus
F<FHFTFlF DriverObjectFdoIrpMajorCodeStatusTEMPTHw����RĚ�pȧ'��VD�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��=�oData%K�Name	MinorCode
A��7�oDataK�NameStatus
pH�H�H�H�H DriverObjectFdoIrpMinorCodeStatusTEMP�J�b6wm+^��>��.���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��7�oDataK�NameStatus
lJ�J�J�J DriverObjectFdoIrpStatusTEMP�L�b6wm+^��>��.���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��7�oDataK�NameStatus
PLpL|L�L DriverObjectFdoIrpStatusTEMP8�N��g��cQ胉� �o8���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��=�oData%K�Name	MinorCode
A��=�oData%K�Name	PowerType
A��?�oData'K�Name
PowerState
A��7�oDataK�NameStatus
<O\OhOtO�O�O�O DriverObjectFdoIrpMinorCodePowerTypePowerStateStatusTEMP8�Q��g��cQ胉� �o8���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��=�oData%K�Name	MinorCode
A��=�oData%K�Name	PowerType
A��?�oData'K�Name
PowerState
A��7�oDataK�NameStatus
tR�R�R�R�R�R�R DriverObjectFdoIrpMinorCodePowerTypePowerStateStatusTEMP��Tb}}����_�G��&Sv����D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��=�oData%K�Name	MinorCode
A��?�oData'K�Name
PowerState
A��7�oDataK�NameStatus
TUtU�U�U�U�U DriverObjectFdoIrpMinorCodePowerStateStatusTEMP�W�b6wm+^��>��.���D�	EventDataA��C�oData+K�NameDriverObject
A��1�oDataK�NameFdo
A��1�oDataK�NameIrp
A��7�oDataK�NameStatus
lW�W�W�W DriverObjectFdoIrpStatusTEMP�xY�N��_���ք������D�	EventDataA��?�oData'K�Name
DriverName
A��?�oData'K�Name
DriverBase
A��?�oData'K�Name
DriverSize
A��I�oData1K�NameDriverTimeStamp
A��G�oData/K�NameDriverCheckSum
�Y�YZ0ZTZDriverNameDriverBaseDriverSize$DriverTimeStamp$DriverCheckSumTEMPDX[ef2�_�Ǎ;�vB���D�	EventDataA��C�oData+K�NameDriverObject
A��?�oData'K�Name
DriverBase
�[�[ DriverObjectDriverBasePRVA\�[Microsoft-Windows-Kernel-ShimEngineOPCO010\win:InfoLEVL�Px\P�\[�\win:Error(win:Informationalwin:VerboseTASKKEYW�����l]�����]�����]�����]����^����8^����\^ �����^(ShimEngineEvents,ShimEngineMessages,DriverScopeGeneral$DriverScopePnp(DriverScopePower$DriverScopeIrps$DriverScopePool4SkipDriverUnloadGeneralEVNTD�����$/T\�,�����$/`\�,@�X0$\`\�,@��2$\`\�, @�����Wl\�b�, @����xZl\�b�,
 �����4l\�b�, ����T7l\�b�, �����8l\�b�,
 �����;l\�b�, ����,>l\�b�, �����?l\�b�, ����Al\�b�, ����,Dl\�b�, �����Fl\�b�, �����Hl\�b�, �����Jl\�b�, �����Ll\�b�, �����Ol\�b�, ����Sl\�b�, �����Ul\�b�,\]\]]]]L]L]<]]<]]]],],],],]WEVTl�
<c�c�cdd(dPRVA�PcMicrosoft-Windows-Kernel-Licensing-StartServiceTriggerOPCOLEVL@P�c(win:InformationalTASKKEYWEVNT@�����cWEVTX�����d
(e�e�ef�f�fCHANx�d����\Microsoft-Windows-Kernel-IoTrace/DiagnosticPRVAX<eMicrosoft-Windows-Kernel-IoTraceOPCO01�ewin:InfoLEVLhP�e[�e(win:Informationalwin:VerboseTASK�����xf�����f�����f$UserInitiatedIoKernelIo,ActivityIdTransferKEYWEVNT�������e�e$f�d������e�e@f�d������e�e@f�d������e�e\f�dWEVT�o�h�i
����P����H�CHAN�lh	��h��h����<i�����i����Application\Microsoft-Windows-AppModel-Runtime/AnalyticXMicrosoft-Windows-AppModel-Runtime/AdminXMicrosoft-Windows-AppModel-Runtime/DebugdMicrosoft-Windows-AppModel-Runtime/DiagnosticsTTBL�I)TEMPH�j��U�%T�d<�
�����D�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
k(kErrorCode$PackageFullNameTEMPttm'$�vS�^a�[.�������D�	EventDataA��=�oData%K�Name	ProcessID
A��?�oData'K�Name
CreateTime
A��I�oData1K�NameParentProcessID
A��I�oData1K�NamePackageFullName
A��=�oData%K�Name	ImageName
A��c�oDataKK�NamePackageRelativeApplicationId
�mn nDnhn�nProcessIDCreateTime$ParentProcessID$PackageFullNameImageName@PackageRelativeApplicationIdTEMP��ozsS��&]����%Ǚ���D�	EventDataA��I�oData1K�NamePackageFullName
A��=�oData%K�Name	ErrorCode
A��C�oData+K�NameErrorMessage
(pLpdp$PackageFullNameErrorCode ErrorMessageTEMP��q}��s!t
^�p�v�W���D�	EventDataA��I�oData1K�NamePackageFullName
A��=�oData%K�Name	ErrorCode
A��C�oData+K�NameFailedBinary
�qr(r$PackageFullNameErrorCode FailedBinaryTEMP��r?~�v|�Uj��]�4���^D�	EventDataA��=�oData%K�Name	ErrorCode
�rErrorCodeTEMP@ u�����wZۉML-e�����D�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��3�oDataK�NameSize

A��7�oDataK�NameOffset
A��?�oData'K�Name
HeaderAddr
A��9�oData!K�NameSection
A��=�oData%K�Name	ProcessId
�u�u

�u�uvv0vFileNameErrorCodeSizeOffsetHeaderAddrSectionProcessIdTEMP� x�2Ol�T�>��6�����D�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��3�oDataK�NameSize

A��?�oData'K�Name
HeaderAddr
A��9�oData!K�NameSection
A��=�oData%K�Name	ProcessId
�x�x

�x�x�xyFileNameErrorCodeSizeHeaderAddrSectionProcessIdTEMP{��/Q}�Q����B����D�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��3�oDataK�NameSize

A��?�oData'K�Name
HeaderAddr
A��W�oData?K�NameApplicationUserModelId
A��=�oData%K�Name	ProcessId
�{�{

�{�{�{ |FileNameErrorCodeSizeHeaderAddr4ApplicationUserModelIdProcessIdTEMPp�}&�8#}�NX[V��PpK���dD�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��3�oDataK�NameSize

A��?�oData'K�Name
HeaderAddr
A��=�oData%K�Name	ProcessId
4~L~

d~t~�~FileNameErrorCodeSizeHeaderAddrProcessIdTEMP��R�n#�V�!�qT����D�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��=�oData%K�Name	ProcessId
��,�FileNameErrorCodeProcessIdTEMP< ����DI�]���jzXK���D�	EventDataA��;�oData#K�NameFileName
A��E�oData-K�Name
ExceptionCode
H�`�FileName ExceptionCodeTEMP�ԂB��
��;V ,��1~���D�	EventDataA��;�oData#K�NameFileName
A��=�oData%K�Name	ErrorCode
A��3�oDataK�NameType
A��=�oData%K�Name	ProcessId
$�<�T�d�FileNameErrorCodeTypeProcessIdTEMPH`��uSQk�Xޱt!֝6A���D�	EventDataA��I�oData1K�NamePackageFullName
A��=�oData%K�Name	ErrorCode
����$PackageFullNameErrorCodeTEMP�}4j�n��]l���=�0��$D�	EventDataA��I�oData1K�NamePackageFullName
A��1�oDataK�NameKey
A��7�oDataK�NameSubkey
A��=�oData%K�Name	ErrorCode
l�������$PackageFullNameKeySubkeyErrorCodeTEMP �}4j�n��]l���=�0��$D�	EventDataA��I�oData1K�NamePackageFullName
A��1�oDataK�NameKey
A��7�oDataK�NameSubkey
A��=�oData%K�Name	ErrorCode
p�������$PackageFullNameKeySubkeyErrorCodeTEMP$�}4j�n��]l���=�0��$D�	EventDataA��I�oData1K�NamePackageFullName
A��1�oDataK�NameKey
A��7�oDataK�NameSubkey
A��=�oData%K�Name	ErrorCode
t�������$PackageFullNameKeySubkeyErrorCodeTEMPP��	�p\k��&�����D�	EventDataA��M�oData5K�NamePackageFamilyName
A��=�oData%K�Name	ErrorCode
��(PackageFamilyNameErrorCodeTEMP(��c��+U���w�6p����D�	EventDataA��=�oData%K�Name	ErrorCode
A��9�oData!K�NameContext
�4�ErrorCodeContextTEMP(��c��+U���w�6p����D�	EventDataA��=�oData%K�Name	ErrorCode
A��9�oData!K�NameContext
D�\�ErrorCodeContextTEMP��?~�v|�Uj��]�4���^D�	EventDataA��=�oData%K�Name	ErrorCode
�ErrorCodeTEMP�Џ�&؍1�
U)��;߸C��lD�	EventDataA��K�oData3K�NameAppContainerName
�(AppContainerNameTEMP���t+=D{��Q
��m����jD�	EventDataA��I�oData1K�NamePackageFullName
��$PackageFullNameTEMPHȑ ����2B[&�Ŧ�]$���D�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
��ErrorCode$PackageFullNameTEMP,��ˀf��S �t�:sV����D�	EventDataA��=�oData%K�Name	ErrorCode
A��;�oData#K�NameResource
(�@�ErrorCodeResourceTEMP,,��ˀf��S �t�:sV����D�	EventDataA��=�oData%K�Name	ErrorCode
A��;�oData#K�NameResource
T�l�ErrorCodeResourceTEMPHh� ����2B[&�Ŧ�]$���D�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
����ErrorCode$PackageFullNameTEMP��ر`n���[m��,l��.���D�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
A��3�oDataK�NameUser
$�<�`�ErrorCode$PackageFullNameUserTEMPH�uBԘ|Xl��%�{�Z��FD�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
A��E�oData-K�Name
DesiredStatus
A��E�oData-K�Name
CurrentStatus
<�T�x���ErrorCode$PackageFullName DesiredStatus CurrentStatusTEMP���~��uB�YĴ��z�E��D�	EventDataA��I�oData1K�NamePackageFullName
A��E�oData-K�Name
DesiredStatus
A��E�oData-K�Name
CurrentStatus
,�P�p�$PackageFullName DesiredStatus CurrentStatusTEMP�D���^�m�Q���w�
���D�	EventDataA��=�oData%K�Name	ErrorCode
A��I�oData1K�NamePackageFullName
A��3�oDataK�NameUser
A��E�oData-K�Name
DesiredStatus
A��E�oData-K�Name
CurrentStatus
�������ErrorCode$PackageFullNameUser DesiredStatus CurrentStatusTEMP4���9%�'S��`Zdv{���<D�	EventDataA��I�oData1K�NamePackageFullName
A��3�oDataK�NameUser
A��E�oData-K�Name
DesiredStatus
A��E�oData-K�Name
CurrentStatus
��(�H�$PackageFullNameUser DesiredStatus CurrentStatusTEMP(<��c��+U���w�6p����D�	EventDataA��=�oData%K�Name	ErrorCode
A��9�oData!K�NameContext
d�|�ErrorCodeContextTEMP�@�ü��V�]6�D����zD�	EventDataA��=�oData%K�Name	ProcessID
A��A�oData)K�NamePackageName
A��=�oData%K�Name	ImageName
A��I�oData1K�NameApplicationName
A��9�oData!K�NameMessage
����أ��ProcessIDPackageNameImageName$ApplicationNameMessageTEMP�إ��6���RSX�˜����zD�	EventDataA��A�oData)K�NamePackageName
A��=�oData%K�Name	ImageName
A��I�oData1K�NameApplicationName
A��=�oData%K�Name	ErrorCode
A��9�oData!K�NameMessage
<�X�p�����PackageNameImageName$ApplicationNameErrorCodeMessageTEMP���n#Ύ��X��sk�	�����D�	EventDataA��A�oData)K�NamePackageName
A��E�oData-K�Name
ContainerName
A��A�oData)K�NameContainerId
(�D�d�PackageName ContainerNameContainerIdTEMP���C|3*C�uVo���.}+���D�	EventDataA��=�oData%K�Name	ProcessID
A��A�oData)K�NamePackageName
A��A�oData)K�NameContainerId
����ProcessIDPackageNameContainerIdTEMP ��z`y�-'1T��x¤�r���2D�	EventDataA��=�oData%K�Name	ErrorCode
A��=�oData%K�Name	ProcessID
A��A�oData)K�NamePackageName
A��A�oData)K�NameContainerId
���4�ErrorCodeProcessIDPackageNameContainerIdTEMP�x��vgz!XX_�HT
"I���D�	EventDataA��=�oData%K�Name	ErrorCode
A��A�oData)K�NamePackageName
A��E�oData-K�Name
ContainerName
��̭�ErrorCodePackageName ContainerNameTEMP@��O�L�W�ּY=���D�	EventDataA��A�oData)K�NamePackageName
A��A�oData)K�NameContainerId
�,�PackageNameContainerIdTEMP���Cg�6hT���v#��E��lD�	EventDataA��]�oDataEK�NameCleanupContainerErrorCode
A��W�oData?K�NameMakeTemporaryErrorCode
A��A�oData)K�NamePackageName
A��A�oData)K�NameContainerId
8�p�����8CleanupContainerErrorCode4MakeTemporaryErrorCodePackageNameContainerIdTEMP������V�?d�qz����D�	EventDataA��I�oData1K�NamePackageFullName
A��E�oData-K�Name
ApplicationId
A��;�oData#K�NamePsmFlags

D�h�
��$PackageFullName ApplicationIdPsmFlagsPRVA\��Microsoft-Windows-AppModel-RuntimeOPCOT2 �28�win:Startwin:StopLEVL�U��P��PĴP� win:Criticalwin:Errorwin:Warning(win:InformationalTASK����������<����������������������T�d������e�����f����$�g����`�h������i����������4������d��������������������������@�0AppModelProcessStartHAppIntegrityDependencyGraphCheck<AppIntegrityProcessCreationHAppIntegrityInAppValidatePackageLAppModelDynamicPropertiesReadFailedHAppModelDynamicPropertiesInvalidDRestrictedAppContainerCreationDRestrictedAppContainerDeletion<RestrictedAppContainerOpenHRestrictedAppContainerEnumeration@RestrictedAppContainerLaunchLRestrictedAppContainerTerminateAll0AppContainerCreation0AppContainerDeletion,AppContainerUpdate@FirewallAppContainerCreation@FirewallAppContainerDeletionXRestrictedAppContainerUpdateCapabilitiesKEYW�$�8�X��������� �����@���������� �Process AppContainer,DesktopAppXProcess0DesktopAppXContainer0ms:ReservedKeyword40 ms:Telemetryms:Measures$ms:CriticalDataEVNTl�@�Lk����,h@ ��nh���<h@ ��nh���<h@ ��nh���<h@ ��nh���<h@ ��nh���<h ��nh���<h ��ph���<h		�	�ph���h ��pt���<h �Hrt���<h �sh���<h �Hvh���<h �sh���<h �sh���<h ��~h���<h �D�h���<h@ ��nh���<h@ � �h���<h � �h���<h � �h���<h � �h���<h � �h���<h � �h��<h � �h��<h � �h��<h � �h��<h � �h��<h �p�h��<h   � �h��<h! !�p�h��<h" "�p�h� �<h# #�p�h�$�<h$ $�p�h�(�<h% %�p�h�,�<h& &�p�h�0�<h' '�0���4�<h( (�0���8�<h) )�0���<�<h* *�0���@�<h+ +� yh�D�<h, ,�8|h�H�<h- -� �h�L�<h. .�p�h�P�<h/ /�p�h�T�<h0 0� �h�X�<h1 1� �h�\�<h2 2� �h�`�<h3 3� �h�d�<h4 4� �h�h�<h5 5����l�<h6 6��h�p�<h7 7��h�t�<h8 8����x�<h9 9��h�|�<h: :��h���<h; ;��h���<h< <��h���<h=@ =��nh���<h> >��h���<h? ?�,�h���<h@ @�X�h���<hA A���h���<hB B�̕h���<hC C�p�����<hD D�������<hE E�������<hF F�4�����<hG G�h�h���<hHH�����LhI I��nh���<hJ J���h���<hK K�|�h���<hL L�Ąh���<hM M�Ȇh���<hN N�̈h���<hO  O�Њ\���<hP  P�Њh���<hQ Q�jh���<he�e�0����d���\hf�f� ����d���\hg�g�0��������\hh�h� ��������\hi�i�0��������\hj�j� �������\hk�k�0�������\hl�l�H�������\hm�m�0����Զ�\hn�n�H����Զ�\hodo�0�������\hpdp�H�������\hqeq�0����ص�\hrer�H����ص �\hsfs�0�����$�\htft�H�����(�\hugu�0�����,�\hvgv�H�����0�\hwhw�0����,�4�\hxhx�H����,�8�\hyiy�0����H�<�\hziz�H����H�@�\h{{�����0�D�\h||�����0�H�\h}}�����L�L�\h~~�����L�P�\h�����h�T�\h�������h�X�\h����0������\�\h����0�����`�\h����H�����d�\h� ������h�<h� ��(�h�l�<h� ��(�h�p�<h� ��(�h�t�<h� ��(�h�x�<h� ��(�h�|�<h� ��(�h���<h� ��(�h���<h� ��(�h���<h� ��������<h� ��������<h� ��0�h���<h� ��P�h���<h� ��P�h���<h� ��P�h���<h� ��P�h���<h� �������<h� ��H�����<h� ��ܱ����<h��������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������ĻĻĻĻĻĻĻĻĻԻԻԻԻԻԻԻԻԻĻWEVT?���
���\���p��CHAN@�	�\�����ApplicationTMicrosoft-Windows-AppModel-State/Debug\Microsoft-Windows-AppModel-State/DiagnosticTTBL�
TEMP���!��5�"0W�
P�څ���rD�	EventDataA��Q�oData9K�NameInformationalString
��,InformationalStringTEMP(��v��(8\�$������D�	EventDataA��A�oData)K�NameErrorString
A��5�oDataK�NameError
���ErrorStringErrorTEMP�H�����br�RiM1$U�����D�	EventDataA��C�oData+K�NameFolderString
A��E�oData-K�Name
PackageString
A��5�oDataK�NameError
������ FolderString PackageStringErrorTEMP���p���p[&Xp�� T�����D�	EventDataA��E�oData-K�Name
PackageString
A��9�oData!K�NameUserSid
A��5�oDataK�NameError
(�H�\� PackageStringUserSidErrorTEMP���v��k�T�l/�;c���D�	EventDataA��=�oData%K�Name	Operation
A��E�oData-K�Name
PackageFamily
A��G�oData/K�NameOperationError
�����Operation PackageFamily$OperationErrorTEMP\��hyVb��X\x�5y�f/��ND�	EventDataA��=�oData%K�Name	Operation
A��E�oData-K�Name
PackageFamily
A��G�oData/K�NameOperationError
A��O�oData7K�NameRepairTriggerError
��<�`�Operation PackageFamily$OperationError,RepairTriggerErrorTEMP$\��mQ�5�Qj�8!~��C���D�	EventDataA��?�oData'K�Name
FolderPath
A��5�oDataK�NameError
����FolderPathErrorPRVAX��Microsoft-Windows-AppModel-StateOPCOT2,�2D�win:Startwin:StopLEVL�P��P��P��win:Errorwin:Warning(win:InformationalTASK�+����������������4�����|����������� �����t�������d������e����h�f������g����T�h������i����X�j������k����x�l�����m������n�����o������p����<�q������r����h�s������t������u���� �v������w����H�x�����y����l�z������{������|�����}������~����,������������H������������`������������D���������������HAppModel.Task.State.WriteSettingDAppModel.Task.State.ReadSettingHAppModel.Task.State.DeleteSettingTAppModel.Task.State.WriteSettingInAtomPAppModel.Task.State.ReadSettingInAtomTAppModel.Task.State.DeleteSettingInAtomDAppModel.Task.State.CommitAtomDAppModel.Task.State.LoadAppHivelAppModel.Task.StateWinRT.AppDataFactory_ActivationtAppModel.Task.StateWinRT.ApplicationDataServer_LifespanxAppModel.Task.StateWinRT.ApplicationDataServer_GetVersionxAppModel.Task.StateWinRT.ApplicationDataServer_SetVersion�AppModel.Task.StateWinRT.ApplicationDataServer_RoamingStorageQuota�AppModel.Task.StateWinRT.ApplicationDataServer_RoamingStorageUsage�AppModel.Task.StateWinRT.ApplicationDataServer_ActivateContainerServer�AppModel.Task.StateWinRT.ApplicationDataServer_ActivateFileItemServer�AppModel.Task.StateWinRT.ApplicationDataContainerServer_Lifespan�AppModel.Task.StateWinRT.ApplicationDataContainerServer_GetValues�AppModel.Task.StateWinRT.ApplicationDataContainerServer_GetContainers�AppModel.Task.StateWinRT.ApplicationDataContainerServer_CreateContainer�AppModel.Task.StateWinRT.ApplicationDataContainerServer_DeleteContainer�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Lifespan�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Lookup�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Size�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_HasKey�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_GetView�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Insert�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Remove�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Clear�AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_First�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Lifespan�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Lookup�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Size�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_HasKey�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_GetView�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Insert�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Remove�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Clear�AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_FirstXAppModel.Task.StateWinRT.RoamingRpcSignalhAppModel.Task.StateWinRT.DataChangedEventDispatchPAppModel.Task.StateWinRT.TempCleanuptAppModel.Task.StateWinRT.ApplicationDataServer_ForUserKEYWT��0�L�h� x�1��Structured(UnstructuredResetOutOfMemoryApiSetErrorWinRT$DataStoreError(win:ResponseTimeEVNTl@���� �@���� �@�h�  �@��h�$ � @��h�( �@��� �@��� �@��h� �	@	�h� �
	�
�h��	��h��	��h��
	�
(�h��@����� �@����� �@����� �@����� �@���� �@��h� �	�l�t��	�0�t��	���t��	�l�t��	�0�t��2 ���������,0�3 ���� �����40�< ��������<0�= ���� ����D0�F �������,�L0�G ���� ���,�T0�P �������H�\0�Q ���� ���H�d0�Z �������d�l0�[ ���� ���d�t0�d ���������|0�e ���� ������0�n ����������0�o ���� ������0�x ����������0�y ���� ������0��d ����������0��d ���� ������0��e ����������0��e ���� ������0��f ���������0��f ���� �����0��g �������(��0��g ���� ���(��0��h �������D��0��h ���� ���D��0��j �������|��0��j ���� ���|�0��k ���������0��k ���� �����0��l ���������0��l ���� �����$0��m ���������,0��m ���� �����40��n ���������<0��n ���� �����D0�o ��������L0�o ���� ����T0�p �������$�\0�p ���� ���$�d0�q �������@�l0�q ���� ���@�t0�"r �������\�|0�#r ���� ���\��0�,s �������x��0�-s ���� ���x��0�6t ����������0�7t ���� ������0�@u ����������0�Au ���� ������0�Jv ����������0�Kv ���� ������0�Tw ����������0�Uw ���� ������0�^x ���������0�_x ���� �����0�hy ������� ��0�iy ���� ��� ��0�rz �������<��0�sz ���� ���<�0�|{ �������X�0�}{ ���� ���X�0��| �������t�0��| ���� ���t�$0��} ���������,0��} ���� �����40��~ ���������<0��~ ���� �����D0�� ���������L0�� ���� �����T0��� ���������\0��� ���� �����d0��� ��������l0��� ���� ����t0��� ��������|0��� ���� �����0��� �������8��0��� ���� ���8��0��� �������T��0��� ���� ���T��0��� �������p��0��� ���� ���p��0��� ����������0��� ���� ������0����������|��|��|��|��|��|��|��|��|��|��|��|��|��|��|��|��������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������WEVTl�
�����PRVA� Microsoft-Windows-Kernel-WSService-StartServiceTriggerOPCOLEVL@P�(win:InformationalTASKKEYWEVNT@�����WEVT�	�$�
X"�"#�#4$�$CHAN����TMicrosoft-Windows-Kernel-IO/OperationalSystemMAPS�4VMAP4h����@IoMgrDmpEncryptionFailureMapTTBL�TEMP���~�b?P��\�X^����D�	EventDataA��?�oData'K�Name
VolumeGuid
A��K�oData3K�NameVolumeNameLength
A��?�oData'K�Name
VolumeName
8`VolumeGuid(VolumeNameLengthVolumeNameTEMP(�3n�d���TX�¶?�,���4D�	EventDataA��?�oData'K�Name
VolumeGuid
A��K�oData3K�NameVolumeNameLength
A��?�oData'K�Name
VolumeName
A��5�oDataK�NameError
4Px�VolumeGuid(VolumeNameLengthVolumeNameErrorTEMPT�A���Ug���f����D�	EventDataA��K�oData3K�NameFilterNameLength
A��?�oData'K�Name
FilterName
��(FilterNameLengthFilterNameTEMPXx �E���]�y��9щw��JD�	EventDataA��K�oData3K�NameFilterNameLength
A��?�oData'K�Name
FilterName
A��K�oData3K�NameVolumeNameLength
A��?�oData'K�Name
VolumeName
� � !4!(FilterNameLengthFilterName(VolumeNameLengthVolumeNameTEMP"n��	Y�ώ)@b.����D�	EventDataA��a�oDataIK�NameDumpEncryptionFailureReason
4"<DumpEncryptionFailureReasonPRVALl"Microsoft-Windows-Kernel-IOOPCOx1�"2�"2#win:Infowin:Startwin:StopLEVL�PL#Pd#P�#win:Errorwin:Warning(win:InformationalTASK������#����$VolumeMount,LoadBootHotPatchesKEYWd����`$�����$ VolumeMountsHotPatchEVNT�����"@#�#(&�����"@#�#,&���|�"4#�#0&��@���"(#��@���"(#��@�P!�"(#������"@#�#4&�����"@#�#8&@$@$@$P$P$WEVT�OL�&t'
�aTb�h�hDkPkCHAN��&M'\Microsoft-Windows-Kernel-LiveDump/Analytic`Microsoft-Windows-Kernel-LiveDump/OperationalTTBL�:TEMP4*��W�#5]e��b�����ZD�	EventDataA��;�oData#K�NameNTStatus
A��C�oData+K�NameBugcheckCode
A��O�oData7K�NameBugCheckParameter1
A��O�oData7K�NameBugCheckParameter2
A��O�oData7K�NameBugCheckParameter3
A��O�oData7K�NameBugCheckParameter4
A��U�oData=K�NameAbortIfMemoryPressure
�*�*�*+,+X+�+NTStatus BugcheckCode,BugCheckParameter1,BugCheckParameter2,BugCheckParameter3,BugCheckParameter40AbortIfMemoryPressureTEMPX�-E���*S\=Pu�����D�	EventDataA��q�oDataYK�Name#NtEstimatedRequiredPrimaryDataBytes

A��a�oDataIK�NameNtEstimatedPrimaryDataBytes

A��a�oDataIK�NameHvEstimatedPrimaryDataBytes

A��e�oDataMK�NameHvEstimatedSecondaryDataBytes



.

T.

�.

�.LNtEstimatedRequiredPrimaryDataBytes<NtEstimatedPrimaryDataBytes<HvEstimatedPrimaryDataBytes@HvEstimatedSecondaryDataBytesTEMP�04p���o�[�BpZ�������D�	EventDataA��q�oDataYK�Name#NtEstimatedRequiredPrimaryDataBytes

A��a�oDataIK�NameNtEstimatedPrimaryDataBytes

A��a�oDataIK�NameHvEstimatedPrimaryDataBytes

A��e�oDataMK�NameHvEstimatedSecondaryDataBytes

A��a�oDataIK�NameSkEstimatedPrimaryDataBytes

A��a�oDataIK�NameMemoryEstimationDuration_ms

A��]�oDataEK�NameSystemQuiescedDuration_ms

A��e�oDataMK�NameEndMirroringPhasesDuration_ms

A����oDatakK�Name,TotalMirrorPhysicalMemoryCallbackDuration_ms

A��w�oData_K�Name&TotalMirrorPhysicalMemoryCallbackBytes
	
A��q�oDataYK�Name#HvlCalculateLiveDumpSizeDuration_ms



5

X5

�5

�5

6

L6

�6

�6

7

`7

�7LNtEstimatedRequiredPrimaryDataBytes<NtEstimatedPrimaryDataBytes<HvEstimatedPrimaryDataBytes@HvEstimatedSecondaryDataBytes<SkEstimatedPrimaryDataBytes<MemoryEstimationDuration_ms8SystemQuiescedDuration_ms@EndMirroringPhasesDuration_ms`TotalMirrorPhysicalMemoryCallbackDuration_msTTotalMirrorPhysicalMemoryCallbackBytesLHvlCalculateLiveDumpSizeDuration_msTEMPT9e����[�$`����� D�	EventDataA��O�oData7K�NameNtPrimaryDataBytes

A��O�oData7K�NameHvPrimaryDataBytes

A��S�oData;K�NameHvSecondaryDataBytes



�9

�9

�9,NtPrimaryDataBytes,HvPrimaryDataBytes0HvSecondaryDataBytesTEMP$ =L����[�^暔��:����D�	EventDataA��O�oData7K�NameNtPrimaryDataBytes

A��O�oData7K�NameHvPrimaryDataBytes

A��S�oData;K�NameHvSecondaryDataBytes

A��O�oData7K�NameSkPrimaryDataBytes

A��g�oDataOK�NameAllocateDumpBuffersDuration_ms

A��i�oDataQK�NameAllocateExtraBuffersDuration_ms

A��y�oDataaK�Name'HvlPrepareLivedumpDescriptorDuration_ms



�=

�=

>

4>

`>

�>

�>,NtPrimaryDataBytes,HvPrimaryDataBytes0HvSecondaryDataBytes,SkPrimaryDataBytesDAllocateDumpBuffersDuration_msDAllocateExtraBuffersDuration_msTHvlPrepareLivedumpDescriptorDuration_msTEMPl\A_M3���+Yٺ_�Õ)m���D�	EventDataA��;�oData#K�NameNTStatus
A��?�oData'K�Name
TotalBytes

A��A�oData)K�NameHeaderBytes

A��K�oData3K�NamePrimaryDataBytes

A��O�oData7K�NameSecondaryDataBytes

A��S�oData;K�NameDumpWriteDuration_ms

�A

�A

B

$B

LB

xBNTStatusTotalBytesHeaderBytes(PrimaryDataBytes,SecondaryDataBytes0DumpWriteDuration_msTEMP�LC�8 Q��C�Y�]���pD�	EventDataA��O�oData7K�NameCallbackIdentifier
`C,CallbackIdentifierTEMPTtDB|�SUY҂K$���+���D�	EventDataA��O�oData7K�NameCallbackIdentifier
A��;�oData#K�NameNTStatus
�D�D,CallbackIdentifierNTStatusTEMPh�F��H��VE�\�6����D�	EventDataA��O�oData7K�NameEstimatedPageCount

A��O�oData7K�NameAllocatedPageCount

A��M�oData5K�NameLimitDumpFileSize
A��[�oDataCK�NameDumpFileSizeLimitInBytes

A��[�oDataCK�NameDumpFileSizeLimitReached


XG

�G�G

�GH,EstimatedPageCount,AllocatedPageCount(LimitDumpFileSize8DumpFileSizeLimitInBytes8DumpFileSizeLimitReachedTEMP��H>c'�޽XS떂7�r���\D�	EventDataA��;�oData#K�NameNTStatus
�HNTStatusTEMP��I>c'�޽XS떂7�r���\D�	EventDataA��;�oData#K�NameNTStatus
�INTStatusTEMP�PJ>c'�޽XS떂7�r���\D�	EventDataA��;�oData#K�NameNTStatus
dJNTStatusTEMP�K�RT���C^�Q5�q���bD�	EventDataA��A�oData)K�NameDuration_ms



(KDuration_msTEMPLQ=Ȋ��YO)�TMa���D�	EventDataA��i�oDataQK�NameMarkRequiredDumpDataDuration_ms



LDMarkRequiredDumpDataDuration_msTEMPMѦ��YX�-O�p����D�	EventDataA��k�oDataSK�Name MarkImportantDumpDataDuration_ms



0MHMarkImportantDumpDataDuration_msTEMP��N*E�I��S}�A��Y~���D�	EventDataA��k�oDataSK�Name PopulateBitmapForDumpDuration_ms

A��s�oData[K�Name$RemoveSystemCacheFromDumpDuration_ms



�N

$OHPopulateBitmapForDumpDuration_msPRemoveSystemCacheFromDumpDuration_msTEMP�P�RT���C^�Q5�q���bD�	EventDataA��A�oData)K�NameDuration_ms



 PDuration_msTEMP��P�RT���C^�Q5�q���bD�	EventDataA��A�oData)K�NameDuration_ms



�PDuration_msTEMP��Q�RT���C^�Q5�q���bD�	EventDataA��A�oData)K�NameDuration_ms



�QDuration_msTEMP �Sg�C����P��=�`��4���D�	EventDataA��M�oData5K�NameCorralDuration_ms

A��c�oDataKK�NameDisableInterruptsDuration_ms

A��g�oDataOK�NameSaveSupervisorStateDuration_ms

A��c�oDataKK�NameSuspendClockTimerDuration_ms



T

(T

hT

�T(CorralDuration_ms@DisableInterruptsDuration_msDSaveSupervisorStateDuration_ms@SuspendClockTimerDuration_msTEMP(�V�Q��VˡW�k؄'T8S���D�	EventDataA��Q�oData9K�NameUncorralDuration_ms

A��a�oDataIK�NameEnableInterruptsDuration_ms

A��m�oDataUK�Name!RestoreSupervisorStateDuration_ms

A��a�oDataIK�NameResumeClockTimerDuration_ms



(W

TW

�W

�W,UncorralDuration_ms<EnableInterruptsDuration_msHRestoreSupervisorStateDuration_ms<ResumeClockTimerDuration_msTEMP�t[B%LD-R�_�[�4�S��*D�	EventDataA��[�oDataCK�NameMemoryCaptureDuration_ms

A��]�oDataEK�NameSystemQuiescedDuration_ms

A��e�oDataMK�NameEndMirroringPhasesDuration_ms

A����oDatakK�Name,TotalMirrorPhysicalMemoryCallbackDuration_ms

A��w�oData_K�Name&TotalMirrorPhysicalMemoryCallbackBytes

A��e�oDataMK�NameHvlCollectLivedumpDuration_ms

A��c�oDataKK�NameDumpDataBufferingDuration_ms



\

8\

p\

�\

]

d]

�]8MemoryCaptureDuration_ms8SystemQuiescedDuration_ms@EndMirroringPhasesDuration_ms`TotalMirrorPhysicalMemoryCallbackDuration_msTTotalMirrorPhysicalMemoryCallbackBytes@HvlCollectLivedumpDuration_ms@DumpDataBufferingDuration_msTEMPL�^�Rt��S��t�������D�	EventDataA��;�oData#K�NameNTStatus
A��K�oData3K�NameMirrorInProgress

�^

_NTStatus(MirrorInProgressTEMP��_�.���\�x�XZ_CN��fD�	EventDataA��E�oData-K�Name
OperationType
�_ OperationTypeTEMP4�`�2ig�8�\���'���d���D�	EventDataA��A�oData)K�NamePolicyValue
A��;�oData#K�NameNTStatus
aaPolicyValueNTStatusTEMP��a���HS�ga=F�,���bD�	EventDataA��A�oData)K�NamePolicyValue
�aPolicyValuePRVAXbMicrosoft-Windows-Kernel-LiveDumpOPCOP
c�cd�ce�c
fdgHdhldi�dj�dk�dlemDevlew�e}�e��e�f�<f�lf��f��f�g�(g �Pg!�|g"��g#��g$�$h%�`hAPIStartAPIEnd8WriteDumpDataToFileStart4WriteDumpDataToFileEnd$MirroringStart,MirroringPhase0End,MirroringPhase1End,SystemQuiesceStart(SystemQuiesceEnd,PageBufferingStart(PageBufferingEnd(BufferEstimation(BufferAllocationRemovePages4CaptureProcessorContext0MarkRequiredDumpData0MarkImportantDumpData0PopulateBitmapForDump,HvlCollectLiveDump8GenerateIptSecondaryData(DumpDataBuffering(CorralProcessors,UncorralProcessors,CaptureMemoryPages8MmDuplicateMemoryFailureDLiveDumpPolicyOperationFailure<LiveDumpPolicyValueChangedDLiveDumpDisabledOnBootByPolicyLEVL@P�h(win:InformationalTASK`N�iO�iPjQ`jR�j�k8LIVEDUMP_TASK_CAPTURE_API@LIVEDUMP_TASK_SIZING_WORKFLOWPLIVEDUMP_TASK_CAPTURE_PAGES_WORKFLOWPLIVEDUMP_TASK_WRITE_DEFERRED_DATA_APITLIVEDUMP_TASK_DISCARD_DEFERRED_DATA_API@LIVEDUMP_TASK_LIVEDUMP_POLICYKEYWEVNT�
9
�_`b�h�h�&@`�'lb�h�h�&@axb�h�h�&
@b<?�b�h�h�&�~�b�h�h�&e@S�b�hi�&f�T�b�hi�&g�U�b�hi�&h@V�b�hi�&i@W�b�hi�&j@t�+�b�hi�&j@�/�b�hi�&k@u8�b�hi�&k@�:�b�hi�&l�x�b�hi�&m�y�b�hi�&n�z�B�b�hi�&o�{�B�b�hi�&p�|�C�b�hi�&q@��D�b�hi�&r@�HH�b�hi�&s@�I�b�hi�&t@��I�b�hi�&u��|Jc�hi�&v��DKc�hi�&w��\L c�hi�&x��xM,c�hi�&y���Q\c�hi�&z ���Thc�hi�&{"@��]�c�hi�&��X�b�h(i�&��Y�b�h(i�&��Z�b�h(i�&�@[�b�h(i�&�@\�b�h(i�&�@]�b�h(i�&�@^�b�h(i�&���|Jc�h(i�&���DKc�h(i�&���\L c�h(i�&���xM,c�h(i�&���tO8c�h(i�&���<PDc�h(i�&���QPc�h(i�&����Q\c�h(i�&� ���Thc�h(i�&�!@�Xtc�h(i�&�"@��]�c�h(i�&�
�n`b�hDi�&�@o�'lb�hDi�&�@pxb�hDi�&�
@q<?�b�hDi�&�
�r`b�h`i�&�@s�'lb�h`i�&#@�0_�c�h|i�&$@�`�c�h|i�&%@�4a�c�h|i�&WEVT0Xv
��(�X�������TTBLhTEMP��vI��,c_����v�N��`D�	EventDataA��?�oData'K�Name
ReturnCode
wReturnCodeTEMPdx�y�i,UTu�j������D�	EventDataA��S�oData;K�NameNotifyRoutineAddress
A��?�oData'K�Name
ReturnCode
@xpx0NotifyRoutineAddressReturnCodeTEMPLpy=�R�ӛT9����F���D�	EventDataA��I�oData1K�NameTargetProcessId
A��?�oData'K�Name
ReturnCode
�y�y$TargetProcessIdReturnCodeTEMP�{2�l�l9Q+Y�%�6����D�	EventDataA��I�oData1K�NameTargetProcessId
A��E�oData-K�Name
DesiredAccess
A��?�oData'K�Name
ReturnCode
D{h{�{$TargetProcessId DesiredAccessReturnCodeTEMPT$}��v"�\�[�R=����JD�	EventDataA��I�oData1K�NameTargetProcessId
A��G�oData/K�NameTargetThreatId
A��E�oData-K�Name
DesiredAccess
A��?�oData'K�Name
ReturnCode
t}�}�}�}$TargetProcessId$TargetThreatId DesiredAccessReturnCodeTEMP<�~�(�FG�\�\9����I���D�	EventDataA��?�oData'K�Name
DriverName
A��?�oData'K�Name
ReturnCode
�~DriverNameReturnCodeTEMP<��(�FG�\�\9����I���D�	EventDataA��?�oData'K�Name
DriverName
A��?�oData'K�Name
ReturnCode
8�T�DriverNameReturnCodeTEMPP�NV���]ۏ�WD�{��HD�	EventDataA��G�oData/K�NameLinkSourceName
A��G�oData/K�NameLinkTargetName
A��E�oData-K�Name
DesiredAccess
A��?�oData'K�Name
ReturnCode
<�`�����$LinkSourceName$LinkTargetName DesiredAccessReturnCodePRVAhԂMicrosoft-Windows-Kernel-Audit-API-CallsOPCO01@�win:InfoLEVL@Pp�(win:InformationalTASKKEYWEVNT�����(w4�d������x4�d�����p�4�d�����dv4�d������y4�d������{4�d������}4�d�����44�d�WEVT0x���
8��������CHAN\��	�؅�ApplicationSystemTTBLLTEMP@؆-�v6R�^l/{/!�I���D�	EventDataA��5�oDataK�NameCVEID
A��M�oData5K�NameAdditionalDetails
��CVEID(AdditionalDetailsPRVALL�Microsoft-Windows-Audit-CVEOPCO01��win:InfoLEVL4Ṗwin:WarningTASKKEYWEVNTp	���������@��������WEVT���
��܉��(�8�TTBL�TEMP�X�?~�v|�Uj��]�4���^D�	EventDataA��=�oData%K�Name	ErrorCode
l�ErrorCodePRVAX��Microsoft-Windows-User-DiagnosticOPCOLEVL4P�win:WarningTASKKEYWEVNT@����Ĉ�WEVTh@��
�<�H�T�`�p�TTBL(TEMP����]@Zl�_k�3�8�2����D�	EventDataA��S�oData;K�NameHeapSnapshotInstance
A��S�oData;K�NameHeapSnapshotSequence
A��U�oData=K�NameHeapSnapshotBufferLen
A��O�oData7K�NameHeapSnapshotBuffer
Ќ�0�`�0HeapSnapshotInstance0HeapSnapshotSequence0HeapSnapshotBufferLen,HeapSnapshotBufferTEMP\x��@�
D�WP�+��;����D�	EventDataA��S�oData;K�NameHeapSnapshotInstance
A��=�oData%K�Name	TotalData
��Ў0HeapSnapshotInstanceTotalDataPRVAT��Microsoft-Windows-Heap-SnapshotOPCOLEVLTASKKEYWEVNTpd����̊�������WEVT8�l	8�0���
�HT�|"�"CHAN�d�m̐nhMicrosoft-Windows-Security-Mitigations/KernelModedMicrosoft-Windows-Security-Mitigations/UserModeMAPShБ����L�VMAP48�����VMAP,�����VMAP$t���VMAP���ControlProtectionKernelModeReturnMismatchNonenforcementReasonMap�ControlProtectionUserModeReturnMismatchNonenforcementReasonMap@RedirectionTrustPolicyTypeMap`SetContextIpValidationFailureContinueTypeMapTTBLL�TEMP�L�!�^��[��I���`���tD�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
	A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
<�d�������

D�x����<�`�(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLine(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTimeTEMPh
���2�4��oQlW�����D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
	A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��[�oDataCK�NameChildImagePathNameLength
A��O�oData7K�NameChildImagePathName

A��W�oData?K�NameChildCommandLineLength
A��K�oData3K�NameChildCommandLine
��(�`�����

� �`�����<�t���ԥ(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLine(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime8ChildImagePathNameLength,ChildImagePathName4ChildCommandLineLength(ChildCommandLineTEMP4���O�	��X�s���Ɏ����D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��G�oData/K�NameTargetThreadId
A��W�oData?K�NameTargetThreadCreateTime
A��I�oData1K�NameImageNameLength
A��=�oData%K�Name	ImageName

�� �<�t�����

��4�t�������(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection$TargetThreadId4TargetThreadCreateTime$ImageNameLengthImageNameTEMP`	��kh�
��U�P�	Q���\D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��G�oData/K�NameTargetThreadId
A��W�oData?K�NameTargetThreadCreateTime
A��W�oData?K�NameRequiredSignatureLevel
A��G�oData/K�NameSignatureLevel

A��I�oData1K�NameImageNameLength
A��=�oData%K�Name	ImageName
�(�D�|�����

��<�|���ȶ��0�T�x�(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection$TargetThreadId4TargetThreadCreateTime4RequiredSignatureLevel$SignatureLevel$ImageNameLengthImageNameTEMPD��H@9�^
��M|6����D�	EventDataA��9�oData!K�NameSubcode
A��A�oData)K�NameProcessPath
A��=�oData%K�Name	ProcessId
A��G�oData/K�NameModuleFullPath
A��?�oData'K�Name
ModuleBase
A��E�oData-K�Name
ModuleAddress
A��?�oData'K�Name
MemAddress
A��M�oData5K�NameMemModuleFullPath
A��E�oData-K�Name
MemModuleBase
A��9�oData!K�NameAPIName
	A��K�oData3K�NameProcessStartTime
A��;�oData#K�NameThreadId
4�H�d�|�����ܼ�� �@�T�|�SubcodeProcessPathProcessId$ModuleFullPathModuleBase ModuleAddressMemAddress(MemModuleFullPath MemModuleBaseAPIName(ProcessStartTimeThreadIdTEMP@h�&R��Tv)b�s�E���D�	EventDataA��9�oData!K�NameSubcode
A��A�oData)K�NameProcessPath
A��=�oData%K�Name	ProcessId
A��=�oData%K�Name	HookedAPI
A��E�oData-K�Name
ReturnAddress
A��E�oData-K�Name
CalledAddress
A��E�oData-K�Name
TargetAddress
A��C�oData+K�NameStackAddress
A��C�oData+K�NameFrameAddress
A��a�oDataIK�NameReturnAddressModuleFullPath
	A��K�oData3K�NameProcessStartTime
A��;�oData#K�NameThreadId
X�l������������8�X�����SubcodeProcessPathProcessIdHookedAPI ReturnAddress CalledAddress TargetAddress StackAddress FrameAddress<ReturnAddressModuleFullPath(ProcessStartTimeThreadIdTEMP���T�.�߸S���Л����D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��[�oDataCK�NameControlPcImageNameLength
A��O�oData7K�NameControlPcImageName
A��_�oDataGK�NameRspContentsImageNameLength
A��S�oData;K�NameRspContentsImageName

�0�L�������

���D�����
���L�(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection8ControlPcImageNameLength,ControlPcImageName<RspContentsImageNameLength0RspContentsImageNameTEMP 	���TA*�WVԳ������.D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��[�oDataCK�NameControlPcImageNameLength
A��O�oData7K�NameControlPcImageName
A��_�oDataGK�NameRspContentsImageNameLength
A��S�oData;K�NameRspContentsImageName

A��?�oData'K�Name
StrictMode

�4�P�������

���H�����
���P�

��(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection8ControlPcImageNameLength,ControlPcImageName<RspContentsImageNameLength0RspContentsImageNameStrictModeTEMP�
��)��ҵS�̶T��oz���D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��[�oDataCK�NameControlPcImageNameLength
A��O�oData7K�NameControlPcImageName
A��_�oDataGK�NameRspContentsImageNameLength
A��S�oData;K�NameRspContentsImageName

A��?�oData'K�Name
StrictMode

A��Y�oDataAK�NameUserCetAppcompatOptions
A��S�oData;K�NameNonenforcementReason
A��K�oData3K�NameControlPcAddress
A��I�oData1K�NameControlPcOffset
A��O�oData7K�NameControlPcCetCompat

A��O�oData7K�NameRspContentsAddress
A��M�oData5K�NameRspContentsOffset
A��S�oData;K�NameRspContentsCetCompat

��������(�@�

h�������$�
\�����

�����D�t���

�����

@�(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection8ControlPcImageNameLength,ControlPcImageName<RspContentsImageNameLength0RspContentsImageNameStrictMode4UserCetAppcompatOptions0NonenforcementReason(ControlPcAddress$ControlPcOffset,ControlPcCetCompat,RspContentsAddress(RspContentsOffset0RspContentsCetCompatTEMP

��2�q��\*n�kj8׃��pD�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	��� �X�����

�����X�(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtectionTEMP<h�Ai�ui�S�xH�n^���D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��Y�oDataAK�NameTargetIpImageNameLength
A��M�oData5K�NameTargetIpImageName
A��?�oData'K�Name
StrictMode

A��C�oData+K�NameContinueType

��������(�@�

h�������$�
X�

��L���(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection4TargetIpImageNameLength(TargetIpImageNameStrictMode ContinueTypeTEMP0	,����W��Q��~�0���<D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��U�oData=K�NameMappedImageNameLength
A��I�oData1K�NameMappedImageName
A��]�oDataEK�NameImageCetShadowStacksReady

A��i�oDataQK�NameImageEHContinuationTablePresent


A��E�oData-K�Name
NonEhcontMode

X��������

@�d������
,�

P�

��

�(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection0MappedImageNameLength$MappedImageName8ImageCetShadowStacksReadyDImageEHContinuationTablePresent NonEhcontModeTEMP..����kgW�Q�(�
ozS���
D�	EventDataA��M�oData5K�NameProcessPathLength
A��A�oData)K�NameProcessPath
A��[�oDataCK�NameProcessCommandLineLength
A��O�oData7K�NameProcessCommandLine
A��=�oData%K�Name	ProcessId
A��M�oData5K�NameProcessCreateTime
A��I�oData1K�NameProcessStartKey

A��U�oData=K�NameProcessSignatureLevel
A��c�oDataKK�NameProcessSectionSignatureLevel
A��M�oData5K�NameProcessProtection
	A��I�oData1K�NameRedirectionType
A��Q�oData9K�NameOperationPathLength
A��E�oData-K�Name
OperationPath
A��E�oData-K�Name
Impersonating


A��9�oData!K�NameModule1
A��E�oData-K�Name
Module1Offset

A��9�oData!K�NameModule2
A��E�oData-K�Name
Module2Offset

A��9�oData!K�NameModule3
A��E�oData-K�Name
Module3Offset

A��9�oData!K�NameModule4
A��E�oData-K�Name
Module4Offset

A��9�oData!K�NameModule5
A��E�oData-K�Name
Module5Offset

A��9�oData!K�NameModule6
A��E�oData-K�Name
Module6Offset

A��9�oData!K�NameModule7
A��E�oData-K�Name
Module7Offset

A��9�oData!K�NameModule8
A��E�oData-K�Name
Module8Offset

A��9�oData!K�NameModule9
A��E�oData-K�Name
Module9Offset

A��;�oData#K�NameModule10
 A��G�oData/K�NameModule10Offset
!
A��;�oData#K�NameModule11
"A��G�oData/K�NameModule11Offset
#
A��;�oData#K�NameModule12
$A��G�oData/K�NameModule12Offset
%
A��;�oData#K�NameModule13
&A��G�oData/K�NameModule13Offset
'
A��;�oData#K�NameModule14
(A��G�oData/K�NameModule14Offset
)
A��;�oData#K�NameModule15
*A��G�oData/K�NameModule15Offset
+
A��;�oData#K�NameModule16
,A��G�oData/K�NameModule16Offset
-
Dl���


,
P
�
�
���
8

Xx

��

��

�

(H

\|

��

��

�

,L

d�

��

�

<

Tx

��

�(ProcessPathLengthProcessPath8ProcessCommandLineLength,ProcessCommandLineProcessId(ProcessCreateTime$ProcessStartKey0ProcessSignatureLevel@ProcessSectionSignatureLevel(ProcessProtection$RedirectionType,OperationPathLength OperationPath ImpersonatingModule1 Module1OffsetModule2 Module2OffsetModule3 Module3OffsetModule4 Module4OffsetModule5 Module5OffsetModule6 Module6OffsetModule7 Module7OffsetModule8 Module8OffsetModule9 Module9OffsetModule10$Module10OffsetModule11$Module11OffsetModule12$Module12OffsetModule13$Module13OffsetModule14$Module14OffsetModule15$Module15OffsetModule16$Module16OffsetTEMP�E�:ƭR=�
+,\�����D�	EventDataA��[�oDataCK�NameControlPcImageNameLength
A��O�oData7K�NameControlPcImageName
A��_�oDataGK�NameRspContentsImageNameLength
A��S�oData;K�NameRspContentsImageName
A��S�oData;K�NameNonenforcementReason
A��K�oData3K�NameControlPcAddress
A��I�oData1K�NameControlPcOffset
A��O�oData7K�NameControlPcCetCompat

A��O�oData7K�NameRspContentsAddress
A��M�oData5K�NameRspContentsOffset
	A��S�oData;K�NameRspContentsCetCompat

� L�Б��

4`�

�8ControlPcImageNameLength,ControlPcImageName<RspContentsImageNameLength0RspContentsImageName0NonenforcementReason(ControlPcAddress$ControlPcOffset,ControlPcCetCompat,RspContentsAddress(RspContentsOffset0RspContentsCetCompatPRVAd�Microsoft-Windows-Security-MitigationsOPCOLEVLXPxP�win:Errorwin:WarningTASK���������������h���������4�������������p	�����
����0����|�����
���� ����� ����(!�����!�����!`KERNEL_MITIGATION_TASK_PROHIBIT_DYNAMIC_CODEtKERNEL_MITIGATION_TASK_PROHIBIT_CHILD_PROCESS_CREATIONhKERNEL_MITIGATION_TASK_PROHIBIT_REMOTE_IMAGE_MAPdKERNEL_MITIGATION_TASK_PROHIBIT_LOWIL_IMAGE_MAPlKERNEL_MITIGATION_TASK_PROHIBIT_WIN32K_SYSTEM_CALLStKERNEL_MITIGATION_TASK_PROHIBIT_NON_MICROSOFT_BINARIES\USER_MITIGATION_TASK_EXPORT_ADDRESS_FILTERdUSER_MITIGATION_TASK_EXPORT_ADDRESS_FILTER_PLUS\USER_MITIGATION_TASK_IMPORT_ADDRESS_FILTERLUSER_MITIGATION_TASK_ROP_STACKPIVOTPUSER_MITIGATION_TASK_ROP_CALLERCHECKHUSER_MITIGATION_TASK_ROP_SIMEXEC�KERNEL_MITIGATION_TASK_CONTROL_PROTECTION_USER_MODE_RETURN_MISMATCH�KERNEL_MITIGATION_TASK_USER_CET_SET_CONTEXT_IP_VALIDATION_FAILURE`KERNEL_MITIGATION_TASK_BLOCK_NON_CET_BINARIESdKERNEL_MITIGATION_TASK_REDIRECTION_TRUST_POLICY�KERNEL_MITIGATION_TASK_CONTROL_PROTECTION_KERNEL_MODE_RETURN_MISMATCHKEYWEVNT�(�o���D��p��l�D��q���D��r��l�D��s��D��t��lD��u���D��v��l�D�	�w��(D�
�x��l(D��y0�DD��z0�lDD�
@{��`T�@|��l`T�@{��|T�@|��l|T�	@}���T�	@~��l�T�
@���T�
@���l�T�@���T�@���l�T�@���T�@���l�T�
����lD�
��|�lD�
����lD�
����`D�
��|�`D�
����`D���p�l$D�����l$D���p�`$D�����`$D�����l@D�����`@D����l\D� ���`\D�!���lxD�"���`xD�WEVT��h*�*
��X�d�����ؿCHAN��*����dMicrosoft-Windows-Threat-Intelligence/AnalyticTTBL�TEMP� 4�@���%NX�{�{z����D�	EventDataA��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
A��Y�oDataAK�NameTargetProcessCreateTime
	A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel
A��Y�oDataAK�NameTargetProcessProtection

A��M�oData5K�NameOriginalProcessId
A��]�oDataEK�NameOriginalProcessCreateTime
A��Y�oDataAK�NameOriginalProcessStartKey

A��e�oDataMK�NameOriginalProcessSignatureLevel
A��s�oData[K�Name$OriginalProcessSectionSignatureLevel
A��]�oDataEK�NameOriginalProcessProtection
A��A�oData)K�NameBaseAddress
A��?�oData'K�Name
RegionSize
A��G�oData/K�NameAllocationType
A��G�oData/K�NameProtectionMask
6(6

`6�6�6 7X7|7�7�7

888t8�8�89

T9�9�9:P:l:�:�:(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtection(OriginalProcessId8OriginalProcessCreateTime4OriginalProcessStartKey@OriginalProcessSignatureLevelPOriginalProcessSectionSignatureLevel8OriginalProcessProtectionBaseAddressRegionSize$AllocationType$ProtectionMaskTEMP�D�vPɡ$BS�-�Ա����D�	EventDataA��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
A��Y�oDataAK�NameTargetProcessCreateTime
	A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel
A��Y�oDataAK�NameTargetProcessProtection

A��M�oData5K�NameOriginalProcessId
A��]�oDataEK�NameOriginalProcessCreateTime
A��Y�oDataAK�NameOriginalProcessStartKey

A��e�oDataMK�NameOriginalProcessSignatureLevel
A��s�oData[K�Name$OriginalProcessSectionSignatureLevel
A��]�oDataEK�NameOriginalProcessProtection
A��A�oData)K�NameBaseAddress
A��?�oData'K�Name
RegionSize
A��G�oData/K�NameProtectionMask
A��O�oData7K�NameLastProtectionMask
�EF

DFxF�FG<G`G�G�G

�GHXH�H�HI

8IlI�I�I4JPJlJ�J(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtection(OriginalProcessId8OriginalProcessCreateTime4OriginalProcessStartKey@OriginalProcessSignatureLevelPOriginalProcessSectionSignatureLevel8OriginalProcessProtectionBaseAddressRegionSize$ProtectionMask,LastProtectionMaskTEMP��Q��Wf�U�
%�X|����D�	EventDataA��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
A��Y�oDataAK�NameTargetProcessCreateTime
	A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel
A��Y�oDataAK�NameTargetProcessProtection

A��A�oData)K�NameBaseAddress
A��;�oData#K�NameViewSize
A��G�oData/K�NameAllocationType
A��G�oData/K�NameProtectionMask
�RS

HS|S�ST@TdT�T�T

�T U\U�U�U�UV4V(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtectionBaseAddressViewSize$AllocationType$ProtectionMaskTEMP�**Pf���AoXU�]�:�3���D�	EventDataA��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
A��Y�oDataAK�NameTargetProcessCreateTime
	A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel
A��Y�oDataAK�NameTargetProcessProtection

A��G�oData/K�NameTargetThreadId
A��W�oData?K�NameTargetThreadCreateTime
A��M�oData5K�NameOriginalProcessId
A��]�oDataEK�NameOriginalProcessCreateTime
A��Y�oDataAK�NameOriginalProcessStartKey

A��e�oDataMK�NameOriginalProcessSignatureLevel
A��s�oData[K�Name$OriginalProcessSectionSignatureLevel
A��]�oDataEK�NameOriginalProcessProtection
A��U�oData=K�NameTargetThreadAlertable
A��?�oData'K�Name
ApcRoutine
A��C�oData+K�NameApcArgument1
A��C�oData+K�NameApcArgument2
A��C�oData+K�NameApcArgument3
A��E�oData-K�Name
RealEventTime
A��[�oDataCK�NameApcRoutineVadQueryResult
A��a�oDataIK�NameApcRoutineVadAllocationBase
A��g�oDataOK�NameApcRoutineVadAllocationProtect
A��Y�oDataAK�NameApcRoutineVadRegionType
A��Y�oDataAK�NameApcRoutineVadRegionSize
 A��Y�oDataAK�NameApcRoutineVadCommitSize
!A��S�oData;K�NameApcRoutineVadMmfName
"A��_�oDataGK�NameApcArgument1VadQueryResult
#A��e�oDataMK�NameApcArgument1VadAllocationBase
$A��k�oDataSK�Name ApcArgument1VadAllocationProtect
%A��]�oDataEK�NameApcArgument1VadRegionType
&A��]�oDataEK�NameApcArgument1VadRegionSize
'A��]�oDataEK�NameApcArgument1VadCommitSize
(A��W�oData?K�NameApcArgument1VadMmfName
)�i�i

�i,jlj�j�jkHklk

�k�klXl�l�l�lm

Dmxm�mn@npn�n�n�n�noDo�o�o�o,p`p�p�pqTq�q�q�q(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtection$TargetThreadId4TargetThreadCreateTime(OriginalProcessId8OriginalProcessCreateTime4OriginalProcessStartKey@OriginalProcessSignatureLevelPOriginalProcessSectionSignatureLevel8OriginalProcessProtection0TargetThreadAlertableApcRoutine ApcArgument1 ApcArgument2 ApcArgument3 RealEventTime8ApcRoutineVadQueryResult<ApcRoutineVadAllocationBaseDApcRoutineVadAllocationProtect4ApcRoutineVadRegionType4ApcRoutineVadRegionSize4ApcRoutineVadCommitSize0ApcRoutineVadMmfName<ApcArgument1VadQueryResult@ApcArgument1VadAllocationBaseHApcArgument1VadAllocationProtect8ApcArgument1VadRegionType8ApcArgument1VadRegionSize8ApcArgument1VadCommitSize4ApcArgument1VadMmfNameTEMPx&&D~	�a�' �TH�SUZ'����D�	EventDataA��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
A��Y�oDataAK�NameTargetProcessCreateTime
	A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel
A��Y�oDataAK�NameTargetProcessProtection

A��G�oData/K�NameTargetThreadId
A��W�oData?K�NameTargetThreadCreateTime
A��C�oData+K�NameContextFlags
A��A�oData)K�NameContextMask
A��/�oDataK�NamePc
A��/�oDataK�NameSp
A��/�oDataK�NameLr
A��/�oDataK�NameFp
A��3�oDataK�NameReg0
A��3�oDataK�NameReg1
A��3�oDataK�NameReg2
A��3�oDataK�NameReg3
A��3�oDataK�NameReg4
A��3�oDataK�NameReg5
A��3�oDataK�NameReg6
A��3�oDataK�NameReg7
A��E�oData-K�Name
RealEventTime
A��K�oData3K�NamePcVadQueryResult
A��Q�oData9K�NamePcVadAllocationBase
 A��W�oData?K�NamePcVadAllocationProtect
!A��I�oData1K�NamePcVadRegionType
"A��I�oData1K�NamePcVadRegionSize
#A��I�oData1K�NamePcVadCommitSize
$A��C�oData+K�NamePcVadMmfName
%<�d�

��Ё�\�������

D�t�����0�T�����ĄЄ܄����$�4�D�T�d�t�������@�d���(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtection$TargetThreadId4TargetThreadCreateTime ContextFlagsContextMaskPcSpLrFpReg0Reg1Reg2Reg3Reg4Reg5Reg6Reg7 RealEventTime(PcVadQueryResult,PcVadAllocationBase4PcVadAllocationProtect$PcVadRegionType$PcVadRegionSize$PcVadCommitSize PcVadMmfNameTEMP$(�Rӹ���Z8&1�dYJ��JD�	EventDataA��I�oData1K�NameOperationStatus
A��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
	A��Y�oDataAK�NameTargetProcessCreateTime
A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel

A��Y�oDataAK�NameTargetProcessProtection
A��A�oData)K�NameBaseAddress
A��A�oData)K�NameBytesCopied
|���Ȏ

�4�t������P�t�

��ؐ�`�����$OperationStatus(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtectionBaseAddressBytesCopiedTEMP`h��&�-.�+U���~	��fD�	EventDataA��I�oData1K�NameOperationStatus
A��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
	A��Y�oDataAK�NameTargetProcessCreateTime
A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel

A��Y�oDataAK�NameTargetProcessProtection
A��G�oData/K�NameTargetThreadId
A��W�oData?K�NameTargetThreadCreateTime
����

@�t����8�\�����

��T���Ԝ��$OperationStatus(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtection$TargetThreadId4TargetThreadCreateTimeTEMP4
�Ɯڙs�T��9��O���D�	EventDataA��I�oData1K�NameOperationStatus
A��K�oData3K�NameCallingProcessId
A��[�oDataCK�NameCallingProcessCreateTime
A��W�oData?K�NameCallingProcessStartKey

A��c�oDataKK�NameCallingProcessSignatureLevel
A��q�oDataYK�Name#CallingProcessSectionSignatureLevel
A��[�oDataCK�NameCallingProcessProtection
A��I�oData1K�NameCallingThreadId
A��Y�oDataAK�NameCallingThreadCreateTime
A��I�oData1K�NameTargetProcessId
	A��Y�oDataAK�NameTargetProcessCreateTime
A��U�oData=K�NameTargetProcessStartKey

A��a�oDataIK�NameTargetProcessSignatureLevel
A��o�oDataWK�Name"TargetProcessSectionSignatureLevel

A��Y�oDataAK�NameTargetProcessProtection
H�l���

̤�@���ĥ��@�

t����,�$OperationStatus(CallingProcessId8CallingProcessCreateTime4CallingProcessStartKey@CallingProcessSignatureLevelLCallingProcessSectionSignatureLevel8CallingProcessProtection$CallingThreadId4CallingThreadCreateTime$TargetProcessId4TargetProcessCreateTime0TargetProcessStartKey<TargetProcessSignatureLevelLTargetProcessSectionSignatureLevel4TargetProcessProtectionTEMP�����:*ޠ3W����W��
D�	EventDataA��K�oData3K�NameDriverNameLength
A��?�oData'K�Name
DriverName
A��Q�oData9K�NameCodeIntegrityOption
ܨ� �(DriverNameLengthDriverName,CodeIntegrityOptionTEMPT4�0f���S*Y>Б�����D�	EventDataA��K�oData3K�NameDriverNameLength
A��?�oData'K�Name
DriverName
\���(DriverNameLengthDriverNameTEMPX ���Ey{BP�xaW�^���JD�	EventDataA��K�oData3K�NameDriverNameLength
A��?�oData'K�Name
DriverName
A��K�oData3K�NameDeviceNameLength
A��?�oData'K�Name
DeviceName
p�����ܬ(DriverNameLengthDriverName(DeviceNameLengthDeviceNamePRVA`�Microsoft-Windows-Threat-IntelligenceOPCOLEVL@P|�(win:InformationalTASK
����Ȯ���������L�����������د����,�����l�������	�����
����d�@KERNEL_THREATINT_TASK_ALLOCVMDKERNEL_THREATINT_TASK_PROTECTVM@KERNEL_THREATINT_TASK_MAPVIEWLKERNEL_THREATINT_TASK_QUEUEUSERAPCTKERNEL_THREATINT_TASK_SETTHREADCONTEXT@KERNEL_THREATINT_TASK_READVM@KERNEL_THREATINT_TASK_WRITEVM\KERNEL_THREATINT_TASK_SUSPENDRESUME_THREAD\KERNEL_THREATINT_TASK_SUSPENDRESUME_PROCESSLKERNEL_THREATINT_TASK_DRIVER_DEVICEKEYW$ ���������������������Դ����D� ������@����������h�����ܶ����0����������������d� ����ĸ@����@������������,�����|�����к����$�����x� ����̻@���� ������x�����̼���� �����p�����Ľ����4� ������@����,��������TKERNEL_THREATINT_KEYWORD_ALLOCVM_LOCALpKERNEL_THREATINT_KEYWORD_ALLOCVM_LOCAL_KERNEL_CALLERTKERNEL_THREATINT_KEYWORD_ALLOCVM_REMOTEpKERNEL_THREATINT_KEYWORD_ALLOCVM_REMOTE_KERNEL_CALLERXKERNEL_THREATINT_KEYWORD_PROTECTVM_LOCALtKERNEL_THREATINT_KEYWORD_PROTECTVM_LOCAL_KERNEL_CALLERXKERNEL_THREATINT_KEYWORD_PROTECTVM_REMOTEtKERNEL_THREATINT_KEYWORD_PROTECTVM_REMOTE_KERNEL_CALLERTKERNEL_THREATINT_KEYWORD_MAPVIEW_LOCALpKERNEL_THREATINT_KEYWORD_MAPVIEW_LOCAL_KERNEL_CALLERTKERNEL_THREATINT_KEYWORD_MAPVIEW_REMOTEpKERNEL_THREATINT_KEYWORD_MAPVIEW_REMOTE_KERNEL_CALLER`KERNEL_THREATINT_KEYWORD_QUEUEUSERAPC_REMOTE|KERNEL_THREATINT_KEYWORD_QUEUEUSERAPC_REMOTE_KERNEL_CALLERhKERNEL_THREATINT_KEYWORD_SETTHREADCONTEXT_REMOTE�KERNEL_THREATINT_KEYWORD_SETTHREADCONTEXT_REMOTE_KERNEL_CALLERPKERNEL_THREATINT_KEYWORD_READVM_LOCALTKERNEL_THREATINT_KEYWORD_READVM_REMOTETKERNEL_THREATINT_KEYWORD_WRITEVM_LOCALTKERNEL_THREATINT_KEYWORD_WRITEVM_REMOTETKERNEL_THREATINT_KEYWORD_SUSPEND_THREADTKERNEL_THREATINT_KEYWORD_RESUME_THREADXKERNEL_THREATINT_KEYWORD_SUSPEND_PROCESSTKERNEL_THREATINT_KEYWORD_RESUME_PROCESSTKERNEL_THREATINT_KEYWORD_FREEZE_PROCESSPKERNEL_THREATINT_KEYWORD_THAW_PROCESSTKERNEL_THREATINT_KEYWORD_CONTEXT_PARSEpKERNEL_THREATINT_KEYWORD_EXECUTION_ADDRESS_VAD_PROBExKERNEL_THREATINT_KEYWORD_EXECUTION_ADDRESS_MMF_NAME_PROBE�KERNEL_THREATINT_KEYWORD_READWRITEVM_NO_SIGNATURE_RESTRICTIONTKERNEL_THREATINT_KEYWORD_DRIVER_EVENTSTKERNEL_THREATINT_KEYWORD_DEVICE_EVENTSEVNT(������*p�����t*@������:p�̭��t*������Jp����t*�����XVp����t*@�����0rp� ���t*������*p�����t*������:p�̭��t*������Jp����t*�������p�<���t*�������p�X���t*
�������p�<���t*�������p�X���t*�����̑p�t���t* �����̑p�t���t*	@�����,�p�����t*	������,�p�����t*	�����,�p�����t*	�����,�p�����t*������*p�����t*�������:p�̭��t*������Jp����t* �����XVp����t*������0rp� ���t*������*p�����t* ������:p�̭��t*������Jp����t*
@�����`�p�����t*
@�����L�p�����t*
��������p�����t* 
��������p�����t*ܱ�\�|�������<���̲ܲ�����,�<�L��,�l�����̱�L���������WEVT04P���
������ �����CHANtl�5XMicrosoft-Windows-Kernel-Dump/OperationalTTBL�TEMP�l��.���\�x�XZ_CN��fD�	EventDataA��E�oData-K�Name
OperationType
�� OperationTypeTEMP4x��2ig�8�\���'���d���D�	EventDataA��A�oData)K�NamePolicyValue
A��;�oData#K�NameNTStatus
����PolicyValueNTStatusTEMP�l����HS�ga=F�,���bD�	EventDataA��A�oData)K�NamePolicyValue
��PolicyValuePRVAP��Microsoft-Windows-Kernel-DumpOPCO�:�;`�
<��DCrashDumpPolicyOperationFailure<CrashDumpPolicyValueChangedDCrashDumpDisabledOnBootByPolicyLEVL@P��(win:InformationalTASKd6H�<DUMP_TASK_CRASHDUMP_POLICYKEYWEVNT��7������,�\��8�����,�\�
�9�����,�\�WEVT�����
4���������(�CHAN����lMicrosoft-Windows-Kernel-CPU-Starvation/OperationalTTBL,
TEMP�d�dWA�gM[QB'/��K?k��D�	EventDataA��E�oData-K�Name
DpcRoutineKey
A��;�oData#K�NameThreadID
A��=�oData%K�Name	CpuNumber
A��=�oData%K�Name	TickCount
A��K�oData3K�NameSoftTimeoutTicks
A��K�oData3K�NameModuleNameLength
A��?�oData'K�Name
ModuleName
���(�@�X����� DpcRoutineKeyThreadIDCpuNumberTickCount(SoftTimeoutTicks(ModuleNameLengthModuleNameTEMP|X�
��BAE^��0�	�M���^D�	EventDataA��;�oData#K�NameThreadID
A��=�oData%K�Name	CpuNumber
A��Q�oData9K�NameCumulativeTickCount
A��_�oDataGK�NameCumulativeSoftTimeoutTicks
�������ThreadIDCpuNumber,CumulativeTickCount<CumulativeSoftTimeoutTicksTEMP<���s��PZ'ϗH*�����D�	EventDataA��M�oData5K�NameDpcSequenceNumber
A��3�oDataK�NameTick
D�l�(DpcSequenceNumberTickTEMP�8�^��� �YKF&�6S���D�	EventDataA��;�oData#K�NameThreadID
A��=�oData%K�Name	CpuNumber
A��M�oData5K�NameDpcSequenceNumber
A��G�oData/K�NameThresholdTicks
A��?�oData'K�Name
Cumulative
���������ThreadIDCpuNumber(DpcSequenceNumber$ThresholdTicksCumulativePRVAdH�Microsoft-Windows-Kernel-CPU-StarvationOPCO�����
�<��p�0SingleDpcSoftTimeout8CumulativeDpcSoftTimeout4DpcProfilingStackBegin(DpcProfilingStackLEVL4P��win:WarningTASK����`�PCPU_STARVATION_TASK_DPC_SOFT_TIMEOUTTCPU_STARVATION_TASK_DPC_PROFILING_STACKKEYWp�����������$DpcSoftTimeout DpcProfilingEVNT����������������������������
�|���������@�������������������$1&	c��㖋/+�2�]�PO .�ĀV9m	?��*����WEVT_TEMPLATEMUIMUIen-US&0�%�	*�H��
��%�0�%�10
	`�He0\
+�7�N0L0
+�70	���010
	`�He ���b���i�Rr�Di��)/VH�>��^ˤ��
�0�	0��3�>�"�4���0
	*�H��
0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20110
240912200406Z
250911200406Z0p10	UUS10U
Washington10URedmond10U
Microsoft Corporation10UMicrosoft Windows0�"0
	*�H��
�0�
���a��ya�q�k�o�{��pV���Q���8�i|<5�e�@��^�'�(ْ�.��g�aa`�n!7c,�i���ע�8�K��� }�hZ�����$��hE��@�*�Iƣ���
����o����2�,�����A�ա�����x����֤	N�P��U~�NI�t�3�I��х&Aw��Kk�������i��_hhe�u���v�J�ͷ���_x�|�<-�}-}}HU��[���r��$����0��0U%0
+�7
+0Ul�y�������%��޾����0TUM0K�I0G1-0+U$Microsoft Ireland Operations Limited10U
229879+5029620U#0��)9�ėx͐��O��|U�S0WUP0N0L�J�H�Fhttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl%200a+U0S0Q+0�Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0U�00
	*�H��
�e���b�]g��Q��ưr�����!:�MPFa={�
�g��=v{�*+4�5�t]A��r'�+�h��ͤ�`-�TOfT���X��*�Yq�Q[�]�{vC#�%�`�}��_Vv0�b+���K�.Y*B!�ě��Ig6�'�:�rɜ������X����*"�.8�I�ry�cӾ'��������A��G_oe�*\n�;_���'��P_[�ֻE�#u��oڠbۯ��:͡#puyϬ�u�5=o�0��0���
avV0
	*�H��
0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100
111019184142Z
261019185142Z0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20110�"0
	*�H��
�0�
�����.	����i�!�i33��T����� ��ҋ�8����-|by��J?5 p���k�6u�1ݍp��7�tF�([�`#,��G�g�Q'�r��ɹ;S5|���'�����#	o�F��n�<A�ˣ?]jM�i%(\6��C
��������['�'x0�[*	k"�S`,�hS��I�a��h	sD]}�T+�y��5]l+\μ�#�on�&�6�O�'��2;A�,���w�TN�\�e�C���mw�Z$�H��C0�?0	+�70U�)9�ėx͐��O��|U�S0	+�7
SubCA0U�0U�0�0U#0��Vˏ�\bh�=��[�Κ�0VUO0M0K�I�G�Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0�>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
	*�H��
��|qQ�y�n��9>�<Rn+?s��h�H�4M��&�1F�ay�8.Ek��(�����	��L
6fj���������@26v�Zƿ���Ӭ�h�b��TlP0X��|���N���|�sW�R!s4Z�V��	����~�����?�rS��c��=1e�������=����BА�_T���G�o�sNA�@�_�*��s�!(���s9_>�\`����	���Q�fG���=�*hw��Lb{��Ǻz�4Kbz����J7�-�W|�=ܸZ��ij�:��n�i!7ށ�ugӓW^)9��-���Es[���z��FX�^���g�l5��?$�5�
u�V��x,��Ј���ߺ~,c��#!�xl�X6+�̤��-����@�E�Ί\k>��p*
j�_G��c
2��6*pZ�BYqKW�~���!<��Ź���E��� ����ŕ�]b֠c �uw}=�E�����W�o3��w�bY~1��0�}0��0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20113�>�"�4���0
	`�He��0	*�H��
	1
+�70
+�710
+�70/	*�H��
	1" �Շ�[��1�!�;)H��z@Q������0<
+�7
1.,8MmUu6aci6XJfMFgD1cFjaM2NApeHupICpBMXEsrNlk=0Z
+�71L0J�$�"Microsoft Windows�"� http://www.microsoft.com/windows0
	*�H��
�)G�v���jj�#0�G�&�l�W��
����C�"S�ئ�U�9-�7���*�o�`V���e_l���Z^$���r����̯|�L�4���a��D��#	;��x�X�9�v{�;�TQ��f������*e!�ɍ@��:yĕ��"Z>�E���x��-e0t�T
<p+)�	�P绪eG>ܛ��'�ۤ��=V�5�����j��f����=�?S@�⠐�"&|�����pK�='g�Z���0��
+�71��0��	*�H��
���0��10
	`�He0�Z*�H��
	��I�E0�A
+�Y
010
	`�He J9f�?6��D����'�W܏�ⱻ:��Mvg�4o��20250402060653.538Z0��٤��0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1-0+U$Microsoft Ireland Operations Limited1'0%UnShield TSS ESN:521A-05E0-D9471%0#UMicrosoft Time-Stamp Service���0�(0��3ת*V0
	*�H��
0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100
240725183121Z
251022183121Z0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1-0+U$Microsoft Ireland Operations Limited1'0%UnShield TSS ESN:521A-05E0-D9471%0#UMicrosoft Time-Stamp Service0�"0
	*�H��
�0�
��U�iҤ?d�z����{(�=����/۩��Hf�`��ؤ>��帅 w:.��z��O��i,�R��FP[f����yt����suZ(\v�QI���^�ֳ	��IV�ɳ�K����\�XJ���L��
���6[�@��6:q)�2V.�y%����~)���֜�JI�� J�wނ��y���XP
Y�9͇�:�6�y,��-���}���.��Aq�(8)٨XcX��{�'|�����I��R�a�/�/�v�˄�p�o�<�8e�Y��p�
ۑ-�5���:�su�X���a��u�+L|`=��͈Y��t�L,���[���3`m�ª�I�F����;c��e6������{)��Y�Y�3aQ���]ŦƮU�k�v��3��C�&�Y��wDh��Y���p��;���|"2&�!J��l����%z�=�>��-���Q�=6�eV1���pђ���)cW���y�8�ϴ�Y<���nɡ!�NӾ���\����I0�E0U�%$ھ	#*��^}�}ww:0U#0���]^b]����e�S5�r0_UX0V0T�R�P�Nhttp://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l+`0^0\+0�Phttp://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0U�00U%�0
+0U��0
	*�H��
�(�xѴ�����
sX�8�ǽn�W��`�9iS�`��ط��Ke-؀ǃL���U��]z��62����S�x�-5��`:z;]�;{z�-a=*��b����p"ĨK`����O(s0Z���e���
���q�f����~� �w=;�x87u�SZ���|P�bU�x B.�O@1��DR�q%0���t��q�"
e��\� a��w�F�^4L~y*I_)Q�]�[�� ^����F�V��2�5��/�]�5�	�#�U��06�^����x ob��}�_�X7��>ZbP7�N~��4x5�)��Z���fEÕ~Ⱥ��;���QR��ݜ;"l�s��m��))L��ы��Ԋ�q�����.��K�@�~���Nx��EpsL�U��3�yѵ��1%��LVw�a!��2%;��f���1J�}ㄤ"���`����
|�!�mͶ�%Oo�Ґ۟g�8ْ>B�����A��e�NML`ICN�C0�q0�Y�3��k��I�0
	*�H��
0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100
210930182225Z
300930183225Z0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100�"0
	*�H��
�0�
���L�r!y���$y�Ղ��ҩlNu��5W�lJ�⽹>`3�\O�f��SqZ�~JZ��6g�F#���w2��`}jR�D���Fk��v��P�D�q\Q17�
8n����&S|9azĪ�ri����6�5&dژ;�{3��[~��R���b%�j�]�S���VM�ݼ��㑏�9,Q��pi
�6-p�1�5(�㴇$��ɏ~�T��U�mh;�F��z)7���E�Fn�2��0\O,�b�͹⍈䖬J��q�[g`���=� �s}A�Fu��_4���� }~�ٞE߶r/�}_��۪~6�6L�+n�Q���s�M7t�4���G��|?Lۯ^����s=CN�39L��Bh.�QF�ѽjZas�g�^�(v�3rק ��
�co�6d�[���!]_0t���عP��a�65�G������k�\RQ]�%��Pzl�r�Rą��<�7�?x�E���^ڏ�riƮ{��>j�.����0��0	+�70#	+�7*�R�dĚ���<F5)��/�0U��]^b]����e�S5�r0\U U0S0Q+�7L�}0A0?+3http://www.microsoft.com/pkiops/Docs/Repository.htm0U%0
+0	+�7
SubCA0U�0U�0�0U#0��Vˏ�\bh�=��[�Κ�0VUO0M0K�I�G�Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0�>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
	*�H��
��U}�*��,g1$[�rK��o�\�>NGdx���=13�9��q6?�dl|�u9m�1��lѡ�"��fg:SMݘ��x�6.���V����i�	�{�jo�)�n�?Hu��m��m#T�xSu$W�ݟ�=��h�e��V����(U'�$�@���]='�@�8���)�ü�T�B�������j�BRu�6��as.,k{n?,	x鑲�[�I�t�쑀�=�J>f;O���2ٖ����t��Lro�u0�4�z�P�
X�@<�Tm�ctH,�NG-�q�d�$�smʎ	��WITd�s�[D�Z�k
��(�g($�8K�n�!TkjEG����^O���Lv�WT	�iD~|�als�
��Af=i��AI~~���;����>�1Q������{��p���(��6ںL���
�4�$5g+�
�挙��"��'B=%��tt[jў>�~�13}���{�8pDѐ�ȫ:�:b�pcSM��m��qj�U3X��pf�V0�>0���٤��0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1-0+U$Microsoft Ireland Operations Limited1'0%UnShield TSS ESN:521A-05E0-D9471%0#UMicrosoft Time-Stamp Service�#
0+���-�����/{.U�l�֎d���0���~0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100
	*�H��
떽0"20250401192930Z20250402192930Z0t0:
+�Y
1,0*0
떽0�0�0
��06
+�Y
1(0&0
+�Y
�
0� �
0��0
	*�H��
�i���ȟ�nJ�Pa�/s5�G��*?�?��ijx*7'ޕ���Z�Մ��e��-�-�2��ߦk��c��I����j�:�'���z6Ӈ�m���4CO�h�e�x�m��$�$(����t3&8C��Tm_�ܿ��A�]vK��t�:N{�~m�"�=ԉd�o��NںM�e2c��lvX�rD#j��yRC���aA�#�P#��4���|,��m�H����g�r��[E��GL���o�D�v]6x��t1�
0�	0��0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103ת*V0
	`�He��J0	*�H��
	1
*�H��
	0/	*�H��
	1" �wI>�֦Ϙ:�1SaaÚ)��G2����9�0��*�H��
	/1��0��0��0�� ����5�ۺ�MeW�_3h᥮F�H��JO�'0��0���~0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103ת*V0" [.!Rd]�����	�{�_�K���	�����0
	*�H��
�F�{ 4 h��=U���T����۰���&��7�"�X�b�7�\��7]u�Z�x�u=�E'��֘������m.�>|W���V �y���4@��O���ap�IW�;m��ō��̹="7i���e�=��\��*w�%_v�4w�"���+w��r�/��S�gj�@���a����G�SsPe$w��oy�cX�thkǙ�<�h�n�����6�� �m�)cɪ�����h��"�iJ���Z�y5GŎW����q�@�7��	�{+�b@Dwy��e�r;����4��`�Ռ������=��W�����\�oH���m��HsE�g���8ѿ�E\4S���r���s$��y�Z�m�!T�����H?���s��t�[�;��R�*7�s�?�`R���2~�+�{N��L��x��6��Ħc
�����e�i����>#���Y
��+0��-�Q����U�����ݘ2h3u������5��u�w�²;�'|