MZ@ !L!This program cannot be run in DOS mode. $A[=:S:S:S|:S|Q:SRich:SPELϛRT! &b $k@ _8.text@@.rsrc_ `@@ϛRT lPPϛRT$8.rdata8.rdata$voltmdP.rdata$zzzdbg `.rsrc$01`!^.rsrc$02 b GIƘ:Zg%gQӸY*0_fϛRTL00H `x     ~V( %1`! WEVT_TEMPLATEMUI4VS_VERSION_INFO e e?StringFileInfo040904B0LCompanyNameMicrosoft Corporation\FileDescriptionSecurity Audit Schema DLLn'FileVersion10.0.26100.8328 (WinBuild.160101.0800)<InternalNameadtschema.dll.LegalCopyright Microsoft Corporation. All rights reserved.DOriginalFilenameadtschema.dllj%ProductNameMicrosoft Windows Operating SystemDProductVersion10.0.26100.8328DVarFileInfo$Translation _xt   4<O&<Q>CPcep<rLX8 $&&:(1\;@IQPZ^\^lk`eopydD( 02IR@DaFMlP\_behkmPPPܪ̴  ,*00*PP*0p0p*1p 1p+2p 2p-3p3p804p4p05p5p26p6p37p7p58p8p(6pp4777;..XK00O55S77lWPPTZZ^dxxl||o,rtw;( $WEVT' t lȴ80@CHAN4 SecurityTTBLijTEMPh͒SZD^uw @~D EventDataA]oDataEKNameAuthenticationPackageName |8AuthenticationPackageNameTEMP2!gDoR0WD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AKoData3KNameLogonProcessName @h$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId(LogonProcessNameTEMPT`n5XcɛojD EventDataAIoData1KNameAuditsDiscarded h$AuditsDiscardedTEMP<كsTL|Q&_zD EventDataAYoDataAKNameNotificationPackageName P4NotificationPackageNameTEMPh< llWAFaD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AIoData1KNameInvalidCallName AGoData/KNameServerPortName A=oData%KName ProcessId AAoData)KName ProcessName   $ L p    $SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId$InvalidCallName$ServerPortNameProcessIdProcessNameTEMP( 4V].4aSؘSD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId ACoData+KName PreviousDate ACoData+KName PreviousTime A9oData!KNameNewDate A9oData!KNameNewTime A=oData%KName ProcessId AAoData)KName ProcessName ,Tx$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PreviousDate PreviousTimeNewDateNewTimeProcessIdProcessNameTEMP@ UE{pD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId ACoData+KName PreviousTime A9oData!KNameNewTime A=oData%KName ProcessId AAoData)KName ProcessName X|  8$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PreviousTimeNewTimeProcessIdProcessNameTEMP,jZT^_cxdD EventDataA9oData!KNameEventId ACoData+KName ComputerName AEoData-KName TargetUserSid AGoData/KNameTargetUserName AKoData3KNameTargetUserDomain AEoData-KName TargetLogonId A?oData'KName EventCount A;oData#KNameDuration ,LhEventId ComputerName TargetUserSid$TargetUserName(TargetUserDomain TargetLogonIdEventCountDurationTEMP,:OY̠ ЋvD EventDataAUoData=KNameCrashOnAuditFailValue @0CrashOnAuditFailValueTEMPDZ6=`?]шP,rD EventDataAQoData9KNameSecurityPackageName ,,SecurityPackageNameTEMPt  !WQkiD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName TargetUserSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName AEoData-KName TargetLogonId A=oData%KName LogonType AKoData3KNameLogonProcessName A]oDataEKNameAuthenticationPackageName AIoData1KNameWorkstationName A=oData%KName LogonGuid AQoData9KNameTransmittedServices AEoData-KName LmPackageName A=oData%KName KeyLength A=oData%KName ProcessId AAoData)KName ProcessName A=oData%KName IpAddress A7oDataKNameIpPort 4"X"|"""" #4#T#l####$4$T$l$$$$$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId TargetUserSid$TargetUserName(TargetDomainName TargetLogonIdLogonType(LogonProcessName8AuthenticationPackageName$WorkstationNameLogonGuid,TransmittedServices LmPackageNameKeyLengthProcessIdProcessNameIpAddressIpPortTEMP l+Ћ >G_gWVlD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName TargetUserSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName AEoData-KName TargetLogonId A=oData%KName LogonType AKoData3KNameLogonProcessName A]oDataEKNameAuthenticationPackageName AIoData1KNameWorkstationName A=oData%KName LogonGuid AQoData9KNameTransmittedServices AEoData-KName LmPackageName A=oData%KName KeyLength A=oData%KName ProcessId AAoData)KName ProcessName A=oData%KName IpAddress A7oDataKNameIpPort AOoData7KNameImpersonationLevel -4-X-----.0.H.p..../0/H/`/|///$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId TargetUserSid$TargetUserName(TargetDomainName TargetLogonIdLogonType(LogonProcessName8AuthenticationPackageName$WorkstationNameLogonGuid,TransmittedServices LmPackageNameKeyLengthProcessIdProcessNameIpAddressIpPort,ImpersonationLevelTEMP8ϲw`|XD'YvD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName TargetUserSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName AEoData-KName TargetLogonId A=oData%KName LogonType AKoData3KNameLogonProcessName A]oDataEKNameAuthenticationPackageName AIoData1KNameWorkstationName A=oData%KName LogonGuid AQoData9KNameTransmittedServices AEoData-KName LmPackageName A=oData%KName KeyLength A=oData%KName ProcessId AAoData)KName ProcessName A=oData%KName IpAddress A7oDataKNameIpPort AOoData7KNameImpersonationLevel AQoData9KNameRestrictedAdminMode AWoData?KNameTargetOutboundUserName A[oDataCKNameTargetOutboundDomainName AGoData/KNameVirtualAccount AQoData9KNameTargetLinkedLogonId AEoData-KName ElevatedToken ::: ;0;P;t;;;;;4<X<p<<<<<= =4=`====>H>$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId TargetUserSid$TargetUserName(TargetDomainName TargetLogonIdLogonType(LogonProcessName8AuthenticationPackageName$WorkstationNameLogonGuid,TransmittedServices LmPackageNameKeyLengthProcessIdProcessNameIpAddressIpPort,ImpersonationLevel,RestrictedAdminMode4TargetOutboundUserName8TargetOutboundDomainName$VirtualAccount,TargetLinkedLogonId ElevatedTokenTEMP4pG`nXI D EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName TargetUserSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName AEoData-KName TargetLogonId A=oData%KName LogonType AKoData3KNameLogonProcessName A]oDataEKNameAuthenticationPackageName AIoData1KNameWorkstationName A=oData%KName LogonGuid AQoData9KNameTransmittedServices AEoData-KName LmPackageName A=oData%KName KeyLength A=oData%KName ProcessId AAoData)KName ProcessName A=oData%KName IpAddress A7oDataKNameIpPort AOoData7KNameImpersonationLevel AQoData9KNameRestrictedAdminMode AUoData=KNameRemoteCredentialGuard AWoData?KNameTargetOutboundUserName A[oDataCKNameTargetOutboundDomainName AGoData/KNameVirtualAccount AQoData9KNameTargetLinkedLogonId AEoData-KName ElevatedToken IIIJ4JTJxJJJJK8K\KtKKKKK L$L8LdLLLL,MPM|M$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId TargetUserSid$TargetUserName(TargetDomainName TargetLogonIdLogonType(LogonProcessName8AuthenticationPackageName$WorkstationNameLogonGuid,TransmittedServices LmPackageNameKeyLengthProcessIdProcessNameIpAddressIpPort,ImpersonationLevel,RestrictedAdminMode0RemoteCredentialGuard4TargetOutboundUserName8TargetOutboundDomainName$VirtualAccount,TargetLinkedLogonId ElevatedTokenTEMP $TxTo/tTD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName TargetUserSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName A7oDataKNameStatus AEoData-KName FailureReason A=oData%KName SubStatus A=oData%KName LogonType AKoData3KNameLogonProcessName A]oDataEKNameAuthenticationPackageName AIoData1KNameWorkstationName AQoData9KNameTransmittedServices AEoData-KName LmPackageName A=oData%KName KeyLength A=oData%KName ProcessId AAoData)KName ProcessName A=oData%KName IpAddress A7oDataKNameIpPort UUV8V\V|VVVVVW,WTWWWWWX,XHX`X$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId TargetUserSid$TargetUserName(TargetDomainNameStatus FailureReasonSubStatusLogonType(LogonProcessName8AuthenticationPackageName$WorkstationName,TransmittedServices LmPackageNameKeyLengthProcessIdProcessNameIpAddressIpPortTEMP \e9SB@lKD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName TargetUserSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName AEoData-KName TargetLogonId A=oData%KName LogonType A;oData#KNameEventIdx AIoData1KNameEventCountTotal A?oData'KName UserClaims ACoData+KName DeviceClaims ]]]^8^X^|^^^^^_4_$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId TargetUserSid$TargetUserName(TargetDomainName TargetLogonIdLogonTypeEventIdx$EventCountTotalUserClaims DeviceClaimsTEMPt @cj[h5Vbt?*.D EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName TargetUserSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName AEoData-KName TargetLogonId A=oData%KName LogonType A;oData#KNameEventIdx AIoData1KNameEventCountTotal AIoData1KNameGroupMembership 0dTdxdddde0ePeheee$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId TargetUserSid$TargetUserName(TargetDomainName TargetLogonIdLogonTypeEventIdx$EventCountTotal$GroupMembershipTEMPgNh%S"~FD EventDataAEoData-KName TargetUserSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName AEoData-KName TargetLogonId A=oData%KName LogonType gh>>>?$?H?t?????@4@\@$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId NewProcessId$NewProcessName,TokenElevationTypeProcessIdCommandLine TargetUserSid$TargetUserName(TargetDomainName TargetLogonId(ParentProcessName$MandatoryLabelTEMPB^bGT[Y$D EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A7oDataKNameStatus A=oData%KName ProcessId AAoData)KName ProcessName dCCCCC D$D$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdStatusProcessIdProcessNameTEMP G@zF_=GaD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AGoData/KNameSourceHandleId AIoData1KNameSourceProcessId AGoData/KNameTargetHandleId AIoData1KNameTargetProcessId GGGH@HdHHH$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId$SourceHandleId$SourceProcessId$TargetHandleId$TargetProcessIdTEMP K}O:^_?"R^D EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A?oData'KName ObjectType A?oData'KName ObjectName A?oData'KName AccessList A?oData'KName AccessMask A=oData%KName ProcessId pLLLLM M=vD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A;oData#KNameTaskName AAoData)KName TaskContent AUoData=KNameClientProcessStartKey  AIoData1KNameClientProcessId AIoData1KNameParentProcessId AUoData=KNameRpcCallClientLocality A3oDataKNameFQDN ,{P{t{{{{ {$|H|l||$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTaskNameTaskContent0ClientProcessStartKey$ClientProcessId$ParentProcessId0RpcCallClientLocalityFQDNTEMPX~- VYJ<@D EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A;oData#KNameTaskName AAoData)KName TaskContent <`$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTaskNameTaskContentTEMP  V;>=vD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A;oData#KNameTaskName AAoData)KName TaskContent AUoData=KNameClientProcessStartKey  AIoData1KNameClientProcessId AIoData1KNameParentProcessId AUoData=KNameRpcCallClientLocality A3oDataKNameFQDN Ԅ 8 T̅$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTaskNameTaskContent0ClientProcessStartKey$ClientProcessId$ParentProcessId0RpcCallClientLocalityFQDNTEMPX$- VYJ<@D EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A;oData#KNameTaskName AAoData)KName TaskContent  0H$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTaskNameTaskContentTEMP  V;>=vD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A;oData#KNameTaskName AAoData)KName TaskContent AUoData=KNameClientProcessStartKey  AIoData1KNameClientProcessId AIoData1KNameParentProcessId AUoData=KNameRpcCallClientLocality A3oDataKNameFQDN 4\ ,\$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTaskNameTaskContent0ClientProcessStartKey$ClientProcessId$ParentProcessId0RpcCallClientLocalityFQDNTEMPX- VYJ<@D EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A;oData#KNameTaskName AAoData)KName TaskContent  Dl$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTaskNameTaskContentTEMP p V;>=vD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A;oData#KNameTaskName AAoData)KName TaskContent AUoData=KNameClientProcessStartKey  AIoData1KNameClientProcessId AIoData1KNameParentProcessId AUoData=KNameRpcCallClientLocality A3oDataKNameFQDN Lp Dh$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTaskNameTaskContent0ClientProcessStartKey$ClientProcessId$ParentProcessId0RpcCallClientLocalityFQDNTEMPhRmmeD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A;oData#KNameTaskName AGoData/KNameTaskContentNew dԛ$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTaskName$TaskContentNewTEMP j,SQtRv|D EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A;oData#KNameTaskName AGoData/KNameTaskContentNew AUoData=KNameClientProcessStartKey  AIoData1KNameClientProcessId AIoData1KNameParentProcessId AUoData=KNameRpcCallClientLocality A3oDataKNameFQDN 0Tl 8$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTaskName$TaskContentNew0ClientProcessStartKey$ClientProcessId$ParentProcessId0RpcCallClientLocalityFQDNTEMP Pd^33KD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName TargetUserSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName AEoData-KName TargetLogonId AAoData)KName ProcessName A=oData%KName ProcessId ASoData;KNameEnabledPrivilegeList AUoData=KNameDisabledPrivilegeList @dԧ@`|Ĩ$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId TargetUserSid$TargetUserName(TargetDomainName TargetLogonIdProcessNameProcessId0EnabledPrivilegeList0DisabledPrivilegeListTEMPdi2*Sd=eD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A=oData%KName TargetSid AEoData-KName PrivilegeList ԫ 8$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTargetSid PrivilegeListTEMPdxi2*Sd=eD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A=oData%KName TargetSid AEoData-KName PrivilegeList 8`$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTargetSid PrivilegeListTEMPX UQW=l܏.D EventDataA?oData'KName DomainName A=oData%KName DomainSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A9oData!KNameTdoType ACoData+KName TdoDirection AEoData-KName TdoAttributes AQoData9KNameSidFilteringEnabled ̳$HpȴDomainNameDomainSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTdoType TdoDirection TdoAttributes,SidFilteringEnabledTEMPX,kkQe/pt/D EventDataA?oData'KName DomainName A=oData%KName DomainSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId ط HDomainNameDomainSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMPtt%oD^fh[lD EventDataA7oDataKNameparam1 A7oDataKNameparam2 A7oDataKNameparam3 Ĺعparam1param2param3TEMP~(^$Um0&D EventDataA7oDataKNameparam1 A7oDataKNameparam2 param1param2TEMPo(9P𗆤ΫXD EventDataA7oDataKNameparam1 param1TEMPHo(9P𗆤ΫXD EventDataA7oDataKNameparam1 \param1TEMPX4{o[i#r^}+{D EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId ASoData;KNameKerberosPolicyChange ,P$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId0KerberosPolicyChangeTEMP`5N=V"̲ND EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AIoData1KNameEfsPolicyChange  4X$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId$EfsPolicyChangeTEMP4Hg=B_M%:D EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A5oDataKNameOldSd A5oDataKNameNewSd  Dl$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdOldSdNewSdTEMPX Fӟ}^TPD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A?oData'KName DomainName A=oData%KName DomainSid A9oData!KNameTdoType ACoData+KName TdoDirection AEoData-KName TdoAttributes AQoData9KNameSidFilteringEnabled 0Tp$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdDomainNameDomainSidTdoType TdoDirection TdoAttributes,SidFilteringEnabledTEMPd(|x+Yɡ{D EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A=oData%KName TargetSid AEoData-KName AccessGranted 4L$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTargetSid AccessGrantedTEMPd"*b^}ku HD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A=oData%KName TargetSid AEoData-KName AccessRemoved (Lt$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTargetSid AccessRemovedTEMP 2WNȅ}iD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A?oData'KName CategoryId AEoData-KName SubcategoryId AIoData1KNameSubcategoryGuid AOoData7KNameAuditPolicyChanges 8\,$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdCategoryId SubcategoryId$SubcategoryGuid,AuditPolicyChangesTEMP G/OECTUͨ|>D EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A?oData'KName CategoryId AEoData-KName SubcategoryId AIoData1KNameSubcategoryGuid AOoData7KNameAuditPolicyChanges AIoData1KNameClientProcessId AUoData=KNameClientProcessStartKey (Dd $SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdCategoryId SubcategoryId$SubcategoryGuid,AuditPolicyChanges$ClientProcessId0ClientProcessStartKeyTEMP $Ml@ ׵S^#ND EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList AGoData/KNameSamAccountName AAoData)KName DisplayName AMoData5KNameUserPrincipalName AEoData-KName HomeDirectory A;oData#KNameHomePath A?oData'KName ScriptPath AAoData)KName ProfilePath AKoData3KNameUserWorkstations AIoData1KNamePasswordLastSet AGoData/KNameAccountExpires AGoData/KNamePrimaryGroupId AQoData9KNameAllowedToDelegateTo AAoData)KName OldUacValue AAoData)KName NewUacValue AOoData7KNameUserAccountControl AGoData/KNameUserParameters A?oData'KName SidHistory A?oData'KName LogonHours ,Px$DhDh@d$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameDisplayName(UserPrincipalName HomeDirectoryHomePathScriptPathProfilePath(UserWorkstations$PasswordLastSet$AccountExpires$PrimaryGroupId,AllowedToDelegateToOldUacValueNewUacValue,UserAccountControl$UserParametersSidHistoryLogonHoursTEMP 5}>.R@CϐD EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AIoData1KNameCallerProcessId AMoData5KNameCallerProcessName h<`$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId$CallerProcessId(CallerProcessNameTEMP ?1hT JGtK>D EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId 4X$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMPxdV2^uhtHjD EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList (Ph$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMP?1hT JGtK>D EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId @h$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMP?1hT JGtK>D EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId 8`x$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMPxV2^uhtHjD EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList l@d$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPt  $5]E*y<D EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList AGoData/KNameSamAccountName A?oData'KName SidHistory (Lt$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameSidHistoryTEMP\ @ ;R]LD EventDataA?oData'KName MemberName A=oData%KName MemberSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList  $ < `     4MemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMP  ^#XQ#9$RvD EventDataA?oData'KName MemberName A=oData%KName MemberSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList A[oDataCKNameMembershipExpirationTime 4\t(MemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList8MembershipExpirationTimeTEMP\ ;R]LD EventDataA?oData'KName MemberName A=oData%KName MemberSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList p,PxMemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPx|V2^uhtHjD EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList @h$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPt ! $5]E*y<D EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList AGoData/KNameSamAccountName A?oData'KName SidHistory P"t"""""$#H#h##$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameSidHistoryTEMP\ &;R]LD EventDataA?oData'KName MemberName A=oData%KName MemberSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList '''(8(P(t((((MemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMP  ,^#XQ#9$RvD EventDataA?oData'KName MemberName A=oData%KName MemberSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList A[oDataCKNameMembershipExpirationTime ---- .$.H.l....MemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList8MembershipExpirationTimeTEMP\ X2;R]LD EventDataA?oData'KName MemberName A=oData%KName MemberSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList  3<3T3x33334(4L4MemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPx,7V2^uhtHjD EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList 77808T8x888$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPt 8< $5]E*y<D EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList AGoData/KNameSamAccountName A?oData'KName SidHistory =$=L=d=====><>$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameSidHistoryTEMP pA5}>.R@CϐD EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AIoData1KNameCallerProcessId AMoData5KNameCallerProcessName $BHBpBBBBBC@C$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId$CallerProcessId(CallerProcessNameTEMPt F $5]E*y<D EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList AGoData/KNameSamAccountName A?oData'KName SidHistory GGGG H0HXH|HHH$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameSidHistoryTEMP 4QYnh^䧠Ծ"D EventDataA5oDataKNameDummy AGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList AGoData/KNameSamAccountName AAoData)KName DisplayName AMoData5KNameUserPrincipalName AEoData-KName HomeDirectory A;oData#KNameHomePath A?oData'KName ScriptPath AAoData)KName ProfilePath AKoData3KNameUserWorkstations AIoData1KNamePasswordLastSet AGoData/KNameAccountExpires AGoData/KNamePrimaryGroupId AQoData9KNameAllowedToDelegateTo AAoData)KName OldUacValue AAoData)KName NewUacValue AOoData7KNameUserAccountControl AGoData/KNameUserParameters A?oData'KName SidHistory A?oData'KName LogonHours PS`SSSSS T4TXTxTTTTUU4UPUxUUUUV,VHVtVVVDummy$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameDisplayName(UserPrincipalName HomeDirectoryHomePathScriptPathProfilePath(UserWorkstations$PasswordLastSet$AccountExpires$PrimaryGroupId,AllowedToDelegateToOldUacValueNewUacValue,UserAccountControl$UserParametersSidHistoryLogonHoursTEMP ]>% ΨS7 ؑD EventDataAQoData9KNameDomainPolicyChanged A?oData'KName DomainName A=oData%KName DomainSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList AGoData/KNameMinPasswordAge AGoData/KNameMaxPasswordAge AAoData)KName ForceLogoff AKoData3KNameLockoutThreshold A[oDataCKNameLockoutObservationWindow AIoData1KNameLockoutDuration AOoData7KNamePasswordProperties AMoData5KNameMinPasswordLength AUoData=KNamePasswordHistoryLength AQoData9KNameMachineAccountQuota AIoData1KNameMixedDomainMode AUoData=KNameDomainBehaviorVersion AGoData/KNameOemInformation p_____`@`d`````aHalaaaab@bpb,DomainPolicyChangedDomainNameDomainSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$MinPasswordAge$MaxPasswordAgeForceLogoff(LockoutThreshold8LockoutObservationWindow$LockoutDuration,PasswordProperties(MinPasswordLength0PasswordHistoryLength,MachineAccountQuota$MixedDomainMode0DomainBehaviorVersion$OemInformationTEMPe?1hT JGtK>D EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId eeeef@fhf$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMPLo~. !XQc7TBnD EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList AGoData/KNameSamAccountName AAoData)KName DisplayName AMoData5KNameUserPrincipalName AEoData-KName HomeDirectory A;oData#KNameHomePath A?oData'KName ScriptPath AAoData)KName ProfilePath AKoData3KNameUserWorkstations AIoData1KNamePasswordLastSet AGoData/KNameAccountExpires AGoData/KNamePrimaryGroupId AQoData9KNameAllowedToDelegateTo AAoData)KName OldUacValue AAoData)KName NewUacValue AOoData7KNameUserAccountControl AGoData/KNameUserParameters A?oData'KName SidHistory A?oData'KName LogonHours AAoData)KName DnsHostName AUoData=KNameServicePrincipalNames |qqqqr(rPrtrrrrrs4sPslsssst,tHtdtttttu$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameDisplayName(UserPrincipalName HomeDirectoryHomePathScriptPathProfilePath(UserWorkstations$PasswordLastSet$AccountExpires$PrimaryGroupId,AllowedToDelegateToOldUacValueNewUacValue,UserAccountControl$UserParametersSidHistoryLogonHoursDnsHostName0ServicePrincipalNamesTEMPLT~MOQ{#$ۦD EventDataAUoData=KNameComputerAccountChange AGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList AGoData/KNameSamAccountName AAoData)KName DisplayName AMoData5KNameUserPrincipalName AEoData-KName HomeDirectory A;oData#KNameHomePath A?oData'KName ScriptPath AAoData)KName ProfilePath AKoData3KNameUserWorkstations AIoData1KNamePasswordLastSet AGoData/KNameAccountExpires AGoData/KNamePrimaryGroupId AQoData9KNameAllowedToDelegateTo AAoData)KName OldUacValue AAoData)KName NewUacValue AOoData7KNameUserAccountControl AGoData/KNameUserParameters A?oData'KName SidHistory A?oData'KName LogonHours AAoData)KName DnsHostName AUoData=KNameServicePrincipalNames Ȁ,Pt Hh(Lx܃8T0ComputerAccountChange$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameDisplayName(UserPrincipalName HomeDirectoryHomePathScriptPathProfilePath(UserWorkstations$PasswordLastSet$AccountExpires$PrimaryGroupId,AllowedToDelegateToOldUacValueNewUacValue,UserAccountControl$UserParametersSidHistoryLogonHoursDnsHostName0ServicePrincipalNamesTEMPxDV2^uhtHjD EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList 0Hl܈$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPt P $5]E*y<D EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList AGoData/KNameSamAccountName A?oData'KName SidHistory <d|č0T$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameSidHistoryTEMPt đ $5]E*y<D EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList AGoData/KNameSamAccountName A?oData'KName SidHistory ؒ8`ȓ$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameSidHistoryTEMP\ ,;R]LD EventDataA?oData'KName MemberName A=oData%KName MemberSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList (LtԘ MemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMP  ^#XQ#9$RvD EventDataA?oData'KName MemberName A=oData%KName MemberSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList A[oDataCKNameMembershipExpirationTime ȝ H`ОMemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList8MembershipExpirationTimeTEMP\ ;R]LD EventDataA?oData'KName MemberName A=oData%KName MemberSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList \xܣ<dMemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPxhV2^uhtHjD EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList ,Tlܨ$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPt t $5]E*y<D EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList AGoData/KNameSamAccountName A?oData'KName SidHistory <`ĭ4Tx$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameSidHistoryTEMPt  $5]E*y<D EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList AGoData/KNameSamAccountName A?oData'KName SidHistory Բ8\ȳ$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameSidHistoryTEMP\ P;R]LD EventDataA?oData'KName MemberName A=oData%KName MemberSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList 4LpԸ DMemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMP  ^#XQ#9$RvD EventDataA?oData'KName MemberName A=oData%KName MemberSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList A[oDataCKNameMembershipExpirationTime  Dl̾8MemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList8MembershipExpirationTimeTEMP\ ;R]LD EventDataA?oData'KName MemberName A=oData%KName MemberSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList <`MemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPxV2^uhtHjD EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList ,Px$$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPt  $5]E*y<D EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList AGoData/KNameSamAccountName A?oData'KName SidHistory ` 4Xx$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameSidHistoryTEMPt  $5]E*y<D EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList AGoData/KNameSamAccountName A?oData'KName SidHistory  8\$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameSidHistoryTEMP\ t;R]LD EventDataA?oData'KName MemberName A=oData%KName MemberSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList <XpDhMemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMP  4^#XQ#9$RvD EventDataA?oData'KName MemberName A=oData%KName MemberSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList A[oDataCKNameMembershipExpirationTime ,Dh<\MemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList8MembershipExpirationTimeTEMP\ ;R]LD EventDataA?oData'KName MemberName A=oData%KName MemberSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList $<`MemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPxV2^uhtHjD EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList Pt$H$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPt  $5]E*y<D EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList AGoData/KNameSamAccountName A?oData'KName SidHistory  0X|$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameSidHistoryTEMPt 0 $5]E*y<D EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList AGoData/KNameSamAccountName A?oData'KName SidHistory D\4$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameSidHistoryTEMP\ ;R]LD EventDataA?oData'KName MemberName A=oData%KName MemberSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList `|@hMemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMP  X^#XQ#9$RvD EventDataA?oData'KName MemberName A=oData%KName MemberSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList A[oDataCKNameMembershipExpirationTime 4Ph<`MemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList8MembershipExpirationTimeTEMP\ ;R]LD EventDataA?oData'KName MemberName A=oData%KName MemberSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList  H`MemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPxV2^uhtHjD EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList t H l $TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMP #9eK Qu[D EventDataAIoData1KNameGroupTypeChange AGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList P t      Hl$GroupTypeChange$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMP ]T.hZR8\D EventDataAGoData/KNameSourceUserName A=oData%KName SourceSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList A9oData!KNameSidList 4X,L$SourceUserNameSourceSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListSidListTEMP ]T.hZR8\D EventDataAGoData/KNameSourceUserName A=oData%KName SourceSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList A9oData!KNameSidList ,Tl $SourceUserNameSourceSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListSidListTEMPxw[k@XD EventDataAGoData/KNameSourceUserName AGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName PrivilegeList @h$SourceUserName$TargetUserName(TargetDomainNameTargetSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMP !?1hT JGtK>D EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId !!!"4"X""$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMP,' Hx\1Xݑ(D EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AAoData)KName ServiceName A?oData'KName ServiceSid AEoData-KName TicketOptions A7oDataKNameStatus ASoData;KNameTicketEncryptionType AAoData)KName PreAuthType A=oData%KName IpAddress A7oDataKNameIpPort AGoData/KNameCertIssuerName AKoData3KNameCertSerialNumber AGoData/KNameCertThumbprint (<(d(|((((()4)L)`)))$TargetUserName(TargetDomainNameTargetSidServiceNameServiceSid TicketOptionsStatus0TicketEncryptionTypePreAuthTypeIpAddressIpPort$CertIssuerName(CertSerialNumber$CertThumbprintTEMP|.l EmSPoïLvD EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AAoData)KName ServiceName A?oData'KName ServiceSid AEoData-KName TicketOptions A7oDataKNameStatus ASoData;KNameTicketEncryptionType AAoData)KName PreAuthType A=oData%KName IpAddress A7oDataKNameIpPort AGoData/KNameCertIssuerName AKoData3KNameCertSerialNumber AGoData/KNameCertThumbprint AGoData/KNameResponseTicket /// 0(0D0d0x000001<1`1$TargetUserName(TargetDomainNameTargetSidServiceNameServiceSid TicketOptionsStatus0TicketEncryptionTypePreAuthTypeIpAddressIpPort$CertIssuerName(CertSerialNumber$CertThumbprint$ResponseTicketTEMP 9:piWaSD EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid AAoData)KName ServiceName A?oData'KName ServiceSid AEoData-KName TicketOptions A7oDataKNameStatus ASoData;KNameTicketEncryptionType AAoData)KName PreAuthType A=oData%KName IpAddress A7oDataKNameIpPort AGoData/KNameCertIssuerName AKoData3KNameCertSerialNumber AGoData/KNameCertThumbprint AGoData/KNameResponseTicket AioDataQKNameAccountSupportedEncryptionTypes ASoData;KNameAccountAvailableKeys AioDataQKNameServiceSupportedEncryptionTypes ASoData;KNameServiceAvailableKeys A_oDataGKNameDCSupportedEncryptionTypes AIoData1KNameDCAvailableKeys AioDataQKNameClientAdvertizedEncryptionTypes A[oDataCKNameSessionKeyEncryptionType AUoData=KNamePreAuthEncryptionType ;;;;<$<D<X<<<<<<=@=d===>L>>>>(?$TargetUserName(TargetDomainNameTargetSidServiceNameServiceSid TicketOptionsStatus0TicketEncryptionTypePreAuthTypeIpAddressIpPort$CertIssuerName(CertSerialNumber$CertThumbprint$ResponseTicketDAccountSupportedEncryptionTypes0AccountAvailableKeysDServiceSupportedEncryptionTypes0ServiceAvailableKeys<DCSupportedEncryptionTypes$DCAvailableKeysDClientAdvertizedEncryptionTypes8SessionKeyEncryptionType0PreAuthEncryptionTypeTEMP D]Vc]@D EventDataAGoData/KNameTargetUserName AKoData3KNameTargetDomainName A=oData%KName TargetSid A?oData'KName DeviceName AAoData)KName ServiceName A?oData'KName ServiceSid AEoData-KName TicketOptions A7oDataKNameStatus ASoData;KNameTicketEncryptionType AAoData)KName PreAuthType A=oData%KName IpAddress A7oDataKNameIpPort AGoData/KNameCertIssuerName AKoData3KNameCertSerialNumber AGoData/KNameCertThumbprint A;oData#KNameSiloName A?oData'KName PolicyName ACoData+KName TGT Lifetime 4FXFFFFFF G GPGlGGGGGH HSD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId ACoData+KName ObjectServer A?oData'KName ObjectType A=oData%KName AddedCAPs AAoData)KName DeletedCAPs ACoData+KName ModifiedCAPs A;oData#KNameAsIsCAPs 0Tx  4 T $SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId ObjectServerObjectTypeAddedCAPsDeletedCAPs ModifiedCAPsAsIsCAPsTEMPz_<3Xj*D EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AAoData)KName LoadOptions AIoData1KNameAdvancedOptions AOoData7KNameConfigAccessPolicy AOoData7KNameRemoteEventLogging AAoData)KName KernelDebug AEoData-KName VsmLaunchType AAoData)KName TestSigning AEoData-KName FlightSigning AWoData?KNameDisableIntegrityChecks AUoData=KNameHypervisorLoadOptions ASoData;KNameHypervisorLaunchType AIoData1KNameHypervisorDebug  0T| 8TtD$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdLoadOptions$AdvancedOptions,ConfigAccessPolicy,RemoteEventLoggingKernelDebug VsmLaunchTypeTestSigning FlightSigning4DisableIntegrityChecks0HypervisorLoadOptions0HypervisorLaunchType$HypervisorDebugTEMP$xT>Qb!MbD EventDataAQoData9KNameCollisionTargetType AQoData9KNameCollisionTargetName A?oData'KName ForestRoot ACoData+KName TopLevelName A9oData!KNameDnsName AAoData)KName NetbiosName A=oData%KName DomainSid A5oDataKNameFlags 4Hd|,CollisionTargetType,CollisionTargetNameForestRoot TopLevelNameDnsNameNetbiosNameDomainSidFlagsTEMP 79Yߗ^ʧD EventDataA?oData'KName ForestRoot AEoData-KName ForestRootSid AAoData)KName OperationId A=oData%KName EntryType A5oDataKNameFlags ACoData+KName TopLevelName A9oData!KNameDnsName AAoData)KName NetbiosName A=oData%KName DomainSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId 0D`xForestRoot ForestRootSidOperationIdEntryTypeFlags TopLevelNameDnsNameNetbiosNameDomainSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMP !79Yߗ^ʧD EventDataA?oData'KName ForestRoot AEoData-KName ForestRootSid AAoData)KName OperationId A=oData%KName EntryType A5oDataKNameFlags ACoData+KName TopLevelName A9oData!KNameDnsName AAoData)KName NetbiosName A=oData%KName DomainSid AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId ","L"h"""""""#@#h#ForestRoot ForestRootSidOperationIdEntryTypeFlags TopLevelNameDnsNameNetbiosNameDomainSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMP 'XD,QG/|D EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A?oData'KName ForestRoot AEoData-KName ForestRootSid AAoData)KName OperationId A=oData%KName EntryType A5oDataKNameFlags ACoData+KName TopLevelName A9oData!KNameDnsName AAoData)KName NetbiosName A=oData%KName DomainSid ((()$)@)`)|))))))$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdForestRoot ForestRootSidOperationIdEntryTypeFlags TopLevelNameDnsNameNetbiosNameDomainSidTEMP+t''Q/_s :D EventDataA=oData%KName RequestId AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId D,\,,,,RequestId$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMP.t''Q/_s :D EventDataA=oData%KName RequestId AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId (/@/d///RequestId$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMP2\9Q_]M,>L>t>>>> ?4?RequestId ExtensionName(ExtensionDataType0ExtensionPolicyFlags ExtensionData$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMPXpALj_[y JKd+jxD EventDataA=oData%KName RequestId A?oData'KName Attributes AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId ABB@BdBBRequestIdAttributes$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMPDʹUpD EventDataA?oData'KName BackupType AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId DE(ELEtEBackupType$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMPt(GO3vVCME`acZD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId xGGGG$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMPIj'Zc 6xD EventDataAYoDataAKNameCertificateDatabaseHash ASoData;KNamePrivateKeyUsageCount AMoData5KNameCACertificateHash AIoData1KNameCAPublicKeyHash Jf`D EventDataAGoData/KNameDestinationDRA A=oData%KName SourceDRA AEoData-KName NamingContext A9oData!KNameOptions A=oData%KName SessionID A7oDataKNameEndUSN A?oData'KName StatusCode ,Ph$DestinationDRASourceDRA NamingContextOptionsSessionIDEndUSNStatusCodeTEMPxŒTk5D EventDataAGoData/KNameDestinationDRA A=oData%KName SourceDRA AEoData-KName NamingContext A9oData!KNameOptions  A=oData%KName SessionID A7oDataKNameEndUSN A?oData'KName StatusCode  ,@$DestinationDRASourceDRA NamingContextOptionsSessionIDEndUSNStatusCodeTEMPP|܇4,>_&CF`תD EventDataA=oData%KName SessionID A7oDataKNameObject A=oData%KName Attribute ACoData+KName TypeOfChange A;oData#KNameNewValue A1oDataKNameUSN A?oData'KName StatusCode  4LlSessionIDObjectAttribute TypeOfChangeNewValue USNStatusCodeTEMPd;XELp|D EventDataAKoData3KNameReplicationEvent AIoData1KNameAuditStatusCode (ReplicationEvent$AuditStatusCodeTEMP\l깎PIK- `_D EventDataAKoData3KNameReplicationEvent AIoData1KNameAuditStatusCode AUoData=KNameReplicationStatusCode (ReplicationEvent$AuditStatusCode0ReplicationStatusCodeTEMP^2Q_u;pD EventDataAGoData/KNameDestinationDRA A=oData%KName SourceDRA A7oDataKNameObject A9oData!KNameOptions A?oData'KName StatusCode @Xl$DestinationDRASourceDRAObjectOptionsStatusCodeTEMP@ӠWfOpD EventDataAGoData/KNameDestinationDRA A=oData%KName SourceDRA A7oDataKNameObject A9oData!KNameOptions  A?oData'KName StatusCode  $DestinationDRASourceDRAObjectOptionsStatusCodeTEMPx"g SQ~<D EventDataAOoData7KNameGroupPolicyApplied A9oData!KNameProfile AEoData-KName OperationMode AOoData7KNameRemoteAdminEnabled AUoData=KNameMulticastFlowsEnabled A[oDataCKNameLogDroppedPacketsEnabled AioDataQKNameLogSuccessfulConnectionsEnabled d X,GroupPolicyAppliedProfile OperationMode,RemoteAdminEnabled0MulticastFlowsEnabled8LogDroppedPacketsEnabledDLogSuccessfulConnectionsEnabledTEMPNǖ\MkӶD EventDataAAoData)KName ProfileUsed A7oDataKNameRuleId A;oData#KNameRuleName   ProfileUsedRuleIdRuleNameTEMPTtMeEZW $D EventDataAGoData/KNameProfileChanged A7oDataKNameRuleId A;oData#KNameRuleName $ProfileChangedRuleIdRuleNameTEMPtMeEZW $D EventDataAGoData/KNameProfileChanged A7oDataKNameRuleId A;oData#KNameRuleName 8\p$ProfileChangedRuleIdRuleNameTEMPtMeEZW $D EventDataAGoData/KNameProfileChanged A7oDataKNameRuleId A;oData#KNameRuleName $ProfileChangedRuleIdRuleNameTEMP``I5Q\}Ҙ3D EventDataAGoData/KNameProfileChanged AAoData)KName SettingType ACoData+KName SettingValue $ProfileChangedSettingType SettingValueTEMP X[ZL|ZpD EventDataA9oData!KNameProfile A7oDataKNameRuleId A;oData#KNameRuleName H\pProfileRuleIdRuleNameTEMPX[ZL|ZpD EventDataA9oData!KNameProfile A7oDataKNameRuleId A;oData#KNameRuleName ProfileRuleIdRuleNameTEMP x !CSsKNt0D EventDataA9oData!KNameProfile AOoData7KNameReasonForRejection A7oDataKNameRuleId A;oData#KNameRuleName     Profile,ReasonForRejectionRuleIdRuleNameTEMP :a7 SՑ0JfD EventDataAEoData-KName ActiveProfile   ActiveProfileTEMP ,8#JTC,۴\D EventDataA7oDataKNameRuleId A;oData#KNameRuleName A;oData#KNameRuleAttr P d | RuleIdRuleNameRuleAttrTEMP :b#$_%eZ0D EventDataA7oDataKNameRuleId A;oData#KNameRuleName A5oDataKNameError A7oDataKNameReason ,@XhRuleIdRuleNameErrorReasonTEMPOViCo0.D EventDataAMoData5KNameCallerProcessName A=oData%KName ProcessId A=oData%KName Publisher  $(CallerProcessNameProcessIdPublisherTEMP(N5/PoX`H*<8D EventDataAEoData-KName RemoteAddress A1oDataKNameSPI 8X RemoteAddress SPITEMP(8N5/PoX`H*<8D EventDataAEoData-KName RemoteAddress A1oDataKNameSPI ` RemoteAddress SPITEMP(`N5/PoX`H*<8D EventDataAEoData-KName RemoteAddress A1oDataKNameSPI  RemoteAddress SPITEMP(N5/PoX`H*<8D EventDataAEoData-KName RemoteAddress A1oDataKNameSPI  RemoteAddress SPITEMP(N5/PoX`H*<8D EventDataAEoData-KName RemoteAddress A1oDataKNameSPI  RemoteAddress SPITEMP o[UTaV+e=fD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A=oData%KName LogonGuid AEoData-KName TargetUserSid AGoData/KNameTargetUserName AKoData3KNameTargetDomainName AEoData-KName TargetLogonId AIoData1KNameTargetLogonGuid A9oData!KNameSidList |(Hl$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdLogonGuid TargetUserSid$TargetUserName(TargetDomainName TargetLogonId$TargetLogonGuidSidListTEMPA|oT<'DD EventDataACoData+KName LocalAddress AEoData-KName RemoteAddress A?oData'KName KeyModName Tt LocalAddress RemoteAddressKeyModNameTEMPA|oT<'DD EventDataACoData+KName LocalAddress AEoData-KName RemoteAddress A?oData'KName KeyModName 8X LocalAddress RemoteAddressKeyModNameTEMP A|oT<'DD EventDataACoData+KName LocalAddress AEoData-KName RemoteAddress A?oData'KName KeyModName   ! LocalAddress RemoteAddressKeyModNameTEMP '%ӾMV?ѡ,fD EventDataASoData;KNameLocalMMPrincipalName AUoData=KNameRemoteMMPrincipalName ACoData+KName LocalAddress AIoData1KNameLocalKeyModPort AEoData-KName RemoteAddress AKoData3KNameRemoteKeyModPort ACoData+KName MMAuthMethod AAoData)KName MMCipherAlg AGoData/KNameMMIntegrityAlg A9oData!KNameDHGroup A?oData'KName MMLifetime A9oData!KNameQMLimit A3oDataKNameRole ASoData;KNameMMImpersonationState A?oData'KName MMFilterID  A7oDataKNameMMSAID  ASoData;KNameLocalEMPrincipalName AUoData=KNameRemoteEMPrincipalName ACoData+KName EMAuthMethod ASoData;KNameEMImpersonationState A?oData'KName QMFilterID  x))))*<*d******++ H+ d+x++++ (,0LocalMMPrincipalName0RemoteMMPrincipalName LocalAddress$LocalKeyModPort RemoteAddress(RemoteKeyModPort MMAuthMethodMMCipherAlg$MMIntegrityAlgDHGroupMMLifetimeQMLimitRole0MMImpersonationStateMMFilterIDMMSAID0LocalEMPrincipalName0RemoteEMPrincipalName EMAuthMethod0EMImpersonationStateQMFilterIDTEMP x4FwRj\*kD EventDataASoData;KNameLocalMMPrincipalName AUoData=KNameRemoteMMPrincipalName ACoData+KName LocalAddress AIoData1KNameLocalKeyModPort AEoData-KName RemoteAddress AKoData3KNameRemoteKeyModPort ACoData+KName MMAuthMethod AAoData)KName MMCipherAlg AGoData/KNameMMIntegrityAlg A9oData!KNameDHGroup A?oData'KName MMLifetime A9oData!KNameQMLimit A3oDataKNameRole ASoData;KNameMMImpersonationState A?oData'KName MMFilterID  A7oDataKNameMMSAID  ASoData;KNameLocalEMPrincipalName AIoData1KNameLocalEMCertHash AKoData3KNameLocalEMIssuingCA AEoData-KName LocalEMRootCA AUoData=KNameRemoteEMPrincipalName AKoData3KNameRemoteEMCertHash AMoData5KNameRemoteEMIssuingCA AGoData/KNameRemoteEMRootCA ASoData;KNameEMImpersonationState A?oData'KName QMFilterID  6667$7D7l7777778 8 P8 l888889L9t999 90LocalMMPrincipalName0RemoteMMPrincipalName LocalAddress$LocalKeyModPort RemoteAddress(RemoteKeyModPort MMAuthMethodMMCipherAlg$MMIntegrityAlgDHGroupMMLifetimeQMLimitRole0MMImpersonationStateMMFilterIDMMSAID0LocalEMPrincipalName$LocalEMCertHash(LocalEMIssuingCA LocalEMRootCA0RemoteEMPrincipalName(RemoteEMCertHash(RemoteEMIssuingCA$RemoteEMRootCA0EMImpersonationStateQMFilterIDTEMP @B$36$\V_#jD EventDataASoData;KNameLocalMMPrincipalName AIoData1KNameLocalMMCertHash AKoData3KNameLocalMMIssuingCA AEoData-KName LocalMMRootCA AUoData=KNameRemoteMMPrincipalName AKoData3KNameRemoteMMCertHash AMoData5KNameRemoteMMIssuingCA AGoData/KNameRemoteMMRootCA ACoData+KName LocalAddress AIoData1KNameLocalKeyModPort AEoData-KName RemoteAddress AKoData3KNameRemoteKeyModPort AAoData)KName MMCipherAlg AGoData/KNameMMIntegrityAlg A9oData!KNameDHGroup A?oData'KName MMLifetime A9oData!KNameQMLimit A3oDataKNameRole ASoData;KNameMMImpersonationState A?oData'KName MMFilterID  A7oDataKNameMMSAID  ASoData;KNameLocalEMPrincipalName AUoData=KNameRemoteEMPrincipalName ACoData+KName EMAuthMethod ASoData;KNameEMImpersonationState A?oData'KName QMFilterID  HDxDDDDE6WIeXD EventDataAOoData7KNameOldBlockedOrdinals AOoData7KNameNewBlockedOrdinals  L,OldBlockedOrdinals,NewBlockedOrdinalsTEMP$8:]Z>-QFD EventDataA[oDataCKNameOldIgnoreDefaultSettings A[oDataCKNameNewIgnoreDefaultSettings AWoData?KNameOldIgnoreLocalSettings AWoData?KNameNewIgnoreLocalSettings AOoData7KNameOldBlockedOrdinals AOoData7KNameNewBlockedOrdinals l܃Dp8OldIgnoreDefaultSettings8NewIgnoreDefaultSettings4OldIgnoreLocalSettings4NewIgnoreLocalSettings,OldBlockedOrdinals,NewBlockedOrdinalsTEMP`PLVAD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A?oData'KName ObjectPath AMoData5KNameObjectVirtualPath A=oData%KName ProcessId AAoData)KName ProcessName 8`Ȉ$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdObjectPath(ObjectVirtualPathProcessIdProcessNameTEMP LtnQ~ިV3HD EventDataAGoData/KNameProfileChanged AQoData9KNameAuthenticationSetId AUoData=KNameAuthenticationSetName ؊$ProfileChanged,AuthenticationSetId0AuthenticationSetNameTEMP XtnQ~ިV3HD EventDataAGoData/KNameProfileChanged AQoData9KNameAuthenticationSetId AUoData=KNameAuthenticationSetName $ProfileChanged,AuthenticationSetId0AuthenticationSetNameTEMP dtnQ~ިV3HD EventDataAGoData/KNameProfileChanged AQoData9KNameAuthenticationSetId AUoData=KNameAuthenticationSetName Ď$ProfileChanged,AuthenticationSetId0AuthenticationSetNameTEMP8Wc_F?0D EventDataAGoData/KNameProfileChanged A[oDataCKNameConnectionSecurityRuleId A_oDataGKNameConnectionSecurityRuleName $ProfileChanged8ConnectionSecurityRuleId<ConnectionSecurityRuleNameTEMP8Wc_F?0D EventDataAGoData/KNameProfileChanged A[oDataCKNameConnectionSecurityRuleId A_oDataGKNameConnectionSecurityRuleName T$ProfileChanged8ConnectionSecurityRuleId<ConnectionSecurityRuleNameTEMP8Wc_F?0D EventDataAGoData/KNameProfileChanged A[oDataCKNameConnectionSecurityRuleId A_oDataGKNameConnectionSecurityRuleName 0T$ProfileChanged8ConnectionSecurityRuleId<ConnectionSecurityRuleNameTEMPXyX獻fD EventDataAGoData/KNameProfileChanged AOoData7KNameCryptographicSetId ASoData;KNameCryptographicSetName Pt$ProfileChanged,CryptographicSetId0CryptographicSetNameTEMPXyX獻fD EventDataAGoData/KNameProfileChanged AOoData7KNameCryptographicSetId ASoData;KNameCryptographicSetName X|$ProfileChanged,CryptographicSetId0CryptographicSetNameTEMP$XyX獻fD EventDataAGoData/KNameProfileChanged AOoData7KNameCryptographicSetId ASoData;KNameCryptographicSetName `$ProfileChanged,CryptographicSetId0CryptographicSetNameTEMPHLm?_⭉ bf8D EventDataAGoData/KNameProfileChanged A_oDataGKNameIpSecSecurityAssociationId AcoDataKKNameIpSecSecurityAssociationName $ProfileChanged<IpSecSecurityAssociationId@IpSecSecurityAssociationNameTEMPPԠmU'Y n xD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A;oData#KNameFileName AIoData1KNameVirtualFileName A=oData%KName ProcessId AAoData)KName ProcessName t D\$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdFileName$VirtualFileNameProcessIdProcessNameTEMPPG2=;Y%mO]=D EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A7oDataKNameModule A?oData'KName ReturnCode (Lt$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdModuleReturnCodeTEMPLp/N*Z_`)4P+tD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId ACoData+KName ProviderName AEoData-KName AlgorithmName A7oDataKNameReason A?oData'KName ReturnCode 4Xĩ$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId ProviderName AlgorithmNameReasonReturnCodeTEMP U@Q(;6XvBD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId ACoData+KName ProviderName AEoData-KName AlgorithmName A9oData!KNameKeyName A9oData!KNameKeyType AAoData)KName KeyFilePath A=oData%KName Operation A?oData'KName ReturnCode hخ<Pd$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId ProviderName AlgorithmNameKeyNameKeyTypeKeyFilePathOperationReturnCodeTEMP г@ȫF^^j-rD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AIoData1KNameClientProcessId AOoData7KNameClientCreationTime ACoData+KName ProviderName AEoData-KName AlgorithmName A9oData!KNameKeyName A9oData!KNameKeyType AAoData)KName KeyFilePath A=oData%KName Operation A?oData'KName ReturnCode ԴDhص  <T$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId$ClientProcessId,ClientCreationTime ProviderName AlgorithmNameKeyNameKeyTypeKeyFilePathOperationReturnCodeTEMP( Y\TD EventDataA3oDataKNameType TypeTEMP<p8II[K0^tD EventDataA3oDataKNameType AKoData3KNamePacketsDiscarded   Type(PacketsDiscardedTEMP Ph,]24YD EventDataA=oData%KName Direction AEoData-KName SourceAddress AAoData)KName DestAddress A=oData%KName EtherType A=oData%KName MediaType AEoData-KName InterfaceType A9oData!KNameVlanTag A?oData'KName FilterRTID  A=oData%KName LayerName A=oData%KName LayerRTID  $D Xt Direction SourceAddressDestAddressEtherTypeMediaType InterfaceTypeVlanTagFilterRTIDLayerNameLayerRTIDTEMP oU{3\ s|<D EventDataA=oData%KName Direction AEoData-KName SourceAddress AAoData)KName DestAddress A=oData%KName EtherType A9oData!KNameVlanTag A?oData'KName vSwitch ID AMoData5KNameSourcevSwitchPort AWoData?KNameDestinationvSwitchPort A?oData'KName FilterRTID  A=oData%KName LayerName A=oData%KName LayerRTID (D\p  Direction SourceAddressDestAddressEtherTypeVlanTagvSwitch ID(SourcevSwitchPort4DestinationvSwitchPortFilterRTIDLayerNameLayerRTIDTEMP < Ph,]24YD EventDataA=oData%KName Direction AEoData-KName SourceAddress AAoData)KName DestAddress A=oData%KName EtherType A=oData%KName MediaType AEoData-KName InterfaceType A9oData!KNameVlanTag A?oData'KName FilterRTID  A=oData%KName LayerName A=oData%KName LayerRTID !! =QZI(mD EventDataAIoData1KNameOpCorrelationID AKoData3KNameAppCorrelationID AGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A7oDataKNameDSName A7oDataKNameDSType A;oData#KNameObjectDN A?oData'KName ObjectGUID AAoData)KName ObjectClass A[oDataCKNameAttributeLDAPDisplayName AOoData7KNameAttributeSyntaxOID AGoData/KNameAttributeValue AGoData/KNameExpirationTime AEoData-KName OperationType Pt 0DXp 0T$OpCorrelationID(AppCorrelationID$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdDSNameDSTypeObjectDNObjectGUIDObjectClass8AttributeLDAPDisplayName,AttributeSyntaxOID$AttributeValue$ExpirationTime OperationTypeTEMPtO3vVCME`acZD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId Tx$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMPlF_`͆]KcPD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AGoData/KNameBackupFileName AQoData9KNameProcessCreationTime AIoData1KNameClientProcessId @h$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId$BackupFileName,ProcessCreationTime$ClientProcessIdTEMPtO3vVCME`acZD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId (P$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMPF_`͆]KcPD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AGoData/KNameBackupFileName AQoData9KNameProcessCreationTime AIoData1KNameClientProcessId <h$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId$BackupFileName,ProcessCreationTime$ClientProcessIdTEMP <w"BUPU:zD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A?oData'KName TargetName A3oDataKNameType A_oDataGKNameCountOfCredentialsReturned AEoData-KName ReadOperation A?oData'KName ReturnCode AQoData9KNameProcessCreationTime AIoData1KNameClientProcessId <`4P|$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTargetNameType<CountOfCredentialsReturned ReadOperationReturnCode,ProcessCreationTime$ClientProcessIdTEMP ؋ PL2oS~FD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId ACoData+KName SearchString AOoData7KNameSchemaFriendlyName A7oDataKNameSchema A_oDataGKNameCountOfCredentialsReturned AQoData9KNameProcessCreationTime AIoData1KNameClientProcessId ,Tx@$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId SearchString,SchemaFriendlyNameSchema<CountOfCredentialsReturned,ProcessCreationTime$ClientProcessIdTEMP< ZmȫʭD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A5oDataKNameFlags A_oDataGKNameCountOfCredentialsReturned AQoData9KNameProcessCreationTime AIoData1KNameClientProcessId $Lp$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdFlags<CountOfCredentialsReturned,ProcessCreationTime$ClientProcessIdTEMP $ (Nw_{S̻K [D EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AOoData7KNameSchemaFriendlyName A7oDataKNameSchema A;oData#KNameResource A;oData#KNameIdentity A?oData'KName PackageSid A5oDataKNameFlags A?oData'KName ReturnCode AQoData9KNameProcessCreationTime AIoData1KNameClientProcessId (Lp,HXt$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId,SchemaFriendlyNameSchemaResourceIdentityPackageSidFlagsReturnCode,ProcessCreationTime$ClientProcessIdTEMP0`Pr.]ٿ fD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A9oData!KNamePackage A9oData!KNameUserUPN ACoData+KName TargetServer A;oData#KNameCredType $Hp$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdPackageUserUPN TargetServerCredTypeTEMP )fKR#  D EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId AEoData-KName TransactionId A;oData#KNameNewState AIoData1KNameResourceManager A=oData%KName ProcessId AAoData)KName ProcessName 4Tl$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId TransactionIdNewState$ResourceManagerProcessIdProcessNameTEMP Ӟ6s@Tȇۂ0yD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId  A=oData%KName ProcessId AAoData)KName ProcessName AIoData1KNameRemoteIpAddress A?oData'KName RemotePort AEoData-KName InterfaceUuid AKoData3KNameProtocolSequence AUoData=KNameAuthenticationService AQoData9KNameAuthenticationLevel  (Ld8$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdProcessIdProcessName$RemoteIpAddressRemotePort InterfaceUuid(ProtocolSequence0AuthenticationService,AuthenticationLevelTEMP |7ZjV\ z~rl D EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId  A=oData%KName ProcessId AAoData)KName ProcessName AIoData1KNameRemoteIpAddress A?oData'KName RemotePort AEoData-KName InterfaceUuid AKoData3KNameProtocolSequence AUoData=KNameAuthenticationService AQoData9KNameAuthenticationLevel A5oDataKNameOpNum  <Tp( T $SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdProcessIdProcessName$RemoteIpAddressRemotePort InterfaceUuid(ProtocolSequence0AuthenticationService,AuthenticationLevelOpNumTEMP,AcQQED EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId  A=oData%KName ProcessId AAoData)KName ProcessName AIoData1KNameRemoteIpAddress A?oData'KName RemotePort AEoData-KName InterfaceUuid AKoData3KNameProtocolSequence AUoData=KNameAuthenticationService AQoData9KNameAuthenticationLevel A5oDataKNameOpNum A;oData#KNameEndpoint A?oData'KName RemoteHost X|  D`,$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdProcessIdProcessName$RemoteIpAddressRemotePort InterfaceUuid(ProtocolSequence0AuthenticationService,AuthenticationLevelOpNumEndpointRemoteHostTEMPX zÛ\fhD EventDataA3oDataKNameSSID A;oData#KNameIdentity AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A9oData!KNamePeerMac A;oData#KNameLocalMac A;oData#KNameIntfGuid A?oData'KName ReasonCode A?oData'KName ReasonText A=oData%KName ErrorCode t  8PlSSIDIdentity$SubjectUserName(SubjectDomainName$SubjectLogonIdPeerMacLocalMacIntfGuidReasonCodeReasonTextErrorCodeTEMP) vR !D EventDataA3oDataKNameSSID A;oData#KNameIdentity AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A9oData!KNamePeerMac A;oData#KNameLocalMac A;oData#KNameIntfGuid A?oData'KName ReasonCode A?oData'KName ReasonText A=oData%KName ErrorCode AEoData-KName EAPReasonCode AOoData7KNameEapRootCauseString ACoData+KName EAPErrorCode @h @lSSIDIdentity$SubjectUserName(SubjectDomainName$SubjectLogonIdPeerMacLocalMacIntfGuidReasonCodeReasonTextErrorCode EAPReasonCode,EapRootCauseString EAPErrorCodeTEMP8, D۰[ARݸijD EventDataAEoData-KName InterfaceName A;oData#KNameIdentity AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A?oData'KName ReasonCode A?oData'KName ReasonText A=oData%KName ErrorCode   !(!P!t!!! InterfaceNameIdentity$SubjectUserName(SubjectDomainName$SubjectLogonIdReasonCodeReasonTextErrorCodeTEMP` $!r=T%usD EventDataAAoData)KName ProviderKey ACoData+KName ProviderName A?oData'KName CalloutKey AAoData)KName CalloutName AAoData)KName CalloutType A=oData%KName CalloutId A;oData#KNameLayerKey A=oData%KName LayerName A9oData!KNameLayerId 8%T%t%%%%%%&ProviderKey ProviderNameCalloutKeyCalloutNameCalloutTypeCalloutIdLayerKeyLayerNameLayerIdTEMP,*"iϜVW221D EventDataAAoData)KName ProviderKey ACoData+KName ProviderName A=oData%KName FilterKey A?oData'KName FilterName A?oData'KName FilterType A;oData#KNameFilterId  A;oData#KNameLayerKey A=oData%KName LayerName A9oData!KNameLayerId A7oDataKNameWeight A?oData'KName Conditions A7oDataKNameAction A?oData'KName CalloutKey AAoData)KName CalloutName D+`++++ ++,, ,,@,\,p,,ProviderKey ProviderNameFilterKeyFilterNameFilterTypeFilterIdLayerKeyLayerNameLayerIdWeightConditionsActionCalloutKeyCalloutNameTEMP-ol^j&PpHg卲xD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AeoDataMKNameFullyQualifiedSubjectUserName K4KXKK$SubjectUserSid$SubjectUserName(SubjectDomainName@FullyQualifiedSubjectUserNameTEMPlMx,~OO>PpHg卲xD EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AeoDataMKNameFullyQualifiedSubjectUserName MMN,N$SubjectUserSid$SubjectUserName(SubjectDomainName@FullyQualifiedSubjectUserNameTEMPNo(9P𗆤ΫXD EventDataA7oDataKNameparam1  Oparam1TEMPOգ`u>X6[L}vjD EventDataAIoData1KNameClientIPAddress O$ClientIPAddressTEMPPգ`u>X6[L}vjD EventDataAIoData1KNameClientIPAddress P$ClientIPAddressTEMPpQգ`u>X6[L}vjD EventDataAIoData1KNameClientIPAddress Q$ClientIPAddressTEMPHRP6cσW ^BjD EventDataAIoData1KNameHostedCacheName \R$HostedCacheNameTEMPHdS!OƑW#&l:D EventDataAIoData1KNameHostedCacheName A=oData%KName ErrorCode SS$HostedCacheNameErrorCodeTEMPT2W#cІQD EventDataA9oData!KNameEventId A5oDataKNameCount TTEventIdCountTEMP<U )oYNYv-D EventDataAAoData)KName ProductName A?oData'KName Categories UVProductNameCategoriesTEMPV8p1,W fZD EventDataA9oData!KNameMessage VMessageTEMP<W )oYNYv-D EventDataAAoData)KName ProductName A?oData'KName Categories WWProductNameCategoriesTEMPXN0x}RϦ5(TD EventDataA3oDataKNameGUID XGUIDTEMPHYo(9P𗆤ΫXD EventDataA7oDataKNameparam1 \Yparam1TEMPd(\wӆZ% D EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A9oData!KNameClassId A=oData%KName VendorIds AEoData-KName CompatibleIds AQoData9KNameLocationInformation \\]8]\]p]]]$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdClassIdVendorIds CompatibleIds,LocationInformationTEMP daHuVQu}A;\D EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A;oData#KNameDeviceId AMoData5KNameDeviceDescription A9oData!KNameClassId A=oData%KName ClassName A=oData%KName VendorIds AEoData-KName CompatibleIds AQoData9KNameLocationInformation @bdbbbbbc(c@cXcxc$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdDeviceId(DeviceDescriptionClassIdClassNameVendorIds CompatibleIds,LocationInformationTEMP8de0#U%F<ªAD EventDataA=oData%KName ProcessId AAoData)KName ProcessName ddProcessIdProcessNameTEMPeȊdvӂXΨvnD EventDataA=oData%KName ProcessId AAoData)KName ProcessName A=oData%KName FatalCode 8fPflfProcessIdProcessNameFatalCodeTEMP jdx} SS0j`D EventDataAGoData/KNameSubjectUserSid AIoData1KNameSubjectUserName AMoData5KNameSubjectDomainName AGoData/KNameSubjectLogonId A;oData#KNameDeviceId AMoData5KNameDeviceDescription A9oData!KNameClassId A=oData%KName ClassName AAoData)KName HardwareIds AEoData-KName CompatibleIds AQoData9KNameLocationInformation jkԴ MԴ tXԴ T_Դ eԴ& &hԴ' 'hiԴ( (kԴ) ) sԴ* *@zԴ+ +Դ, ,܎Դ- -Դ. .Դ. .pԴ/ /ܶԴ0 0Դ0 0Դ1 1Դ2 2Դ3 3Դ4 4Դ5 5XԴ5 5Դ6 6,Դ7 7hԴ7 7Դ8 8<Դ9 9 Դ: : Դ; ;TԴ< <Դ> >Դ? ?0|Դ@ @ԴA AԴB B$ԴC C*ԴP P.ԴP Pl3ԴP P`8ԴQ Q@ԴR R@DԴS SHԴT TMԴU UQԴV VVԴW W[ԴX XaԴY YgԴY YlԴZ ZLsԴZ ZvԴ[ [|Դ[ [Դ\ \ Դ\ \dԴ] ]lԴ] ]ĒԴ^ ^̘Դ^ ^4Դ_ _HԴ` `Դa aXԴb bԴc cԴe elԴf fԴg gԴh hԴi ipԴj jԴk k|Դl lԴm mԴn nlԴo oԴo oXԴp pԴr rԴs sԴt tԴu uԴv v Դw wԴx xԴx xTԴy y`Դz zԴ{ {4Դ| |#Դ| |)Դ} }/Դ~ ~l4Դ 8Դ hCԴ HԴ VԴ bԴ fԴ 8uԴ Դ Դ pԴ Դ @Դ LԴ Դ  Դ Դ Դ dԴ pԴ Դ DԴ Դ ,Դ Դ Դ Դ hԴ Դ PԴ Դ Դ Դ  Դ Դ 4Դ Դ "Դ )Դ 1Դ \HԴ NԴ TԴ DhԴ lԴ qԴ  }Դ Դ \Դ Դ \Դ Դ Դ Դ TԴ ̜Դ ܡԴ dԴ تԴ LԴ Դ Դ Դ lԴ Դ @Դ Դ (Դ Դ xԴ Դ Դ X>Դ Դ Դ pԴ DԴ Դ Դ dԴ Դ 0Դ X?Դ @aԴ Դ ,Դ wԴ $Դ l Դ `Դ hԴ Դ  Դ #Դ  *Դ ,Դ /Դ |3Դ 7Դ   H:Դ   X?Դ   dMԴ   BԴ   EԴ Դ Դ  HԴ JԴ OԴ RԴ UԴ YԴ \Դ ]Դ PdԴ tgԴ mԴ  qԴ uԴ yԴ }Դ Դ 8Դ Դ HԴ ,Դ   ܏Դ! !Դ" "Դ# #<Դ$ $Դ& & Դ( (@Դ) )Դ* *Դ+ +Դ, ,Դ- -~Դ. .xԴ/ /Դ0 0Դ1 1Դ@ @Դ@ @ԴA AԴA AԴB BԴB B ԴC C$ԴC C<ԴD DTԴD D`ԴE ElԴE EԴF F\ԴG GԴH HԴI IԴI IԴP P$ԴQ QԴR R8ԴS SԴT TԴU UԴV V0ԴW WԴX XԴY YԴZ ZԴ\ \4 Դ] ] Դ^ ^ Դ` `<Դa adԴb bԴc cԴd dԴe eԴp pԴq qԴr rtԴs s8!Դt tD,Դu u :Դv vGԴw wWԴx xaԴy yԴ Դ Դ vԴ wԴ |xԴ