MZ @ !L!This program cannot be run in DOS mode.
$ E[$5K$5K$5K4J$5K\K$5K$4K 5K6J$5K1J$5K0J$5K5J$5K=J$5KK$5KK$5K7J$5KRich$5K PE L P ! & ( `+ @
.s @A 6 Q | ` ( B % p P p P .text ' ( `.data @ , @ .idata P
. @ @.rsrc ( ` 8 @ @.reloc P p > @ B @ 8A @@ @ Q u Q ' ' P P p" # # & ' ' ( `+ + 1 2 \ \ . \ D D 9 A D A A A - 2 5 8 5 - 4 1 C 5 - 9 8 4 7 - 2 8 A 1 9 B A 9 F 3 4 4 ntdll.dll MicrosoftTelemetryAssertTriggeredUM P & P
P $
P , ,
1 \ 4 0 %3 53 3 3 94 4 4 4 4 4 5 @ $ 0 @ 1 s 5 ETW0 + 4 SensorRegistered SensorId FileHandle Context SensorUnregistered Context ! FreeSensorEvent EventPacket D AllocateSensorEvent Context EventId DataSizeInB EventPacket @ ? SensorUnregistrationError Context Error
PartA_PrivTags
@ A SendEventError Context EventPacket Error
PartA_PrivTags
@ > SensorRegistrationError SensorId Error
PartA_PrivTags
: SendEvent Context EventPacket IoRequestsInProgress @ > FreeSensorEventError EventPacket Error
PartA_PrivTags
@ T AllocateSensorEventError Context EventId DataSizeInB Error
PartA_PrivTags
mAw˴C7T*xF Microsoft.OneCore.WebThreatDefense.Client.Sensor sPOωGv RSDS
^'W wtdsensor.pdb GCTL .rdata$brc .CRT$XCA .CRT$XCZ .CRT$XIA .CRT$XIC .CRT$XIZ .CRT$XPA .CRT$XPZ .CRT$XTA .CRT$XTZ P .gfids @ .rdata @ .rdata$sxdata D | .rdata$voltmd .rdata$zETW0 .rdata$zETW1 W .rdata$zETW2 .rdata$zETW9 L .rdata$zzzdbg 0 .rtc$IAA 4 .rtc$IZZ 8 .rtc$TAA < .rtc$TZZ @ @ .text .text$mn X6 .xdata$x 6 .edata @ @ .data$brc @@ ` .data @ .bss P .idata$5 Q .00cfg Q h .idata$2 pR .idata$3 R .idata$4 S p .idata$6 ` .rsrc$01 ` x .rsrc$02
^'W mrو˛];P UU(tmE S]W} t,u*˸ AzEMEBE J B " ME Vr t r$u$WPQuSu u Q ^_[]$ ̋U@@ 3ʼnE@ @ V5@ W}v𥥥tjY)% @ E%$@ h@ h @ hP PP t N
@ PQj5 @ 5@ P M_3^ ̋U @@ 3ʼnEJEBVuEB E@ M3ɉN@ Vu FF VNF - F EEQQEP5 @ 5@ P M3^t ̋UE E t:
@ @ #M#E t!@ @ #E#U ;@ u;@ t2] ̋̋UE t*uUuDP u^ h D P Q0h D |P @ W
@ % @ PQf@ P ] ̋Ut@@ 3ĉD$pE SV3ۉD$} W[ S SSjSjh hH P uP t% SD$(PSSjEPh" V4P uP d0 j jpP uj CPP C ﾭމsEh D CCxP ,@ (@ 9tjY) Ch D ,@ tP jZ9 @ vcE3ɉD$D$D$HD$D$XD$D$hD$(PjQT$\T$lT$| QL$\L$dt$(L$lL$t\$$L$|$ D$ jW_= @ h @ StsER D$ D$ D$HD$jYD$XD$D$hD$(PjQQ\$\L$`\$d|$$\$lL$p\$tD$( \$,\$|DŽ$ $ dtV P L$|_^[3Z
] ̋Ul@@ 3ĉD$hSVu3WujW_ h D xP $ PvF0P 9~ t~jh D WP ~ u9q F90 Avf P u d0 Vj pP jY39
@ v+!|$DD$!|$L D$@D$ PjQQt$ L$XCh D tP = @ v|h @ j tlD$\$D$@3jZD$T$HD$PD$D$`D$ PjQT$d QL$TL$\|$$L$dL$lD$( L$,L$tD$x L$|L$t_^[3 ] jY)̋U @@ 3ĉ$ d$ ES]VW}D$D$ ujW
th D D$xP ω|$R D$w8Pd0 jpP fM T$fH,p(3jP4@0ﾭY9
@ D$|$D$H3fE fD$D$D$XD$D$hD$ D$xD$(PjQT$$j Q|$\L$`|$d|$lD$p |$t|$|$ $ \$ $ $ $ 8 j^j_9= @ h @ 3S D$, D$ D$ D$HfE fD$D$D$XD$D$D$D$hD$ jYD$xD$ $ D$(PjQQ\$\L$`\$d\$l|$p\$t\$|$ $ t$,$ $ $ D$0 \$4$ DŽ$ $ J|$ t h D tP $ _^[36 ] ̋Ul@@ 3ĉD$hSVu3WujW_N~0ﾭu@d0 VSpP t+jX9 @ D$HL$D$ L$@Pj= t = @ vyh @ S-tjD$|$jD$DL$XD$H D$XD$D$`D$ PL$T\$X\$`D$ \$ \$hD$l \$pjQQt$ \$T\$\L$t_^[3 ] ̋UE3Ʌtx0ﾭu9H4tH8] ̋U @@ 3ĉ$ S] 3VW}D$ D$D$ jW^= @ h @ 3S D$ D$D$D$HD$D$D$D$XD$ jYD$hD$ D$xD$(PjQQ\$\L$`\$d\$lL$p\$tt$,\$|$ $ D$0 \$4$ DŽ$ $ |$ t h D tP $ _^[3 ] {0ﾭމ\$|$ h D D$xP C(;G G h D tP C43QQQQ8PSh" w4P h D xP u O GPP uP /hj3Y9
@ D$T$LD$HD$ D$XG D$D$D$hD$(PjQT$`T$hT$pT$x$ Q|$$L$`\$,L$p$ r̋U @@ 3ʼnES] VWu3Vh dP u
P @VjEPj\WP y PP EMECK W P ur M_^3[ ̋V~ ﾭtjWX^á(@ (@ ;t
;u ^Ã~ u ~
| 38Fj2YD^̋U$e EVPh j t V Ytu ju6 Q @ 3@]u0 Y3Md
Y_^[jv jhx6 @ 3gH@ 3Fue G Eu=@ ui& %@ e 7 j u YY3ɄDuE" ƋMd
Y_^[Ëuus YËu j j h6 H } u9=@ 3 e t
t]1]SWu u SWuu SWuuu"u SPuSVuRSVup tuHSWu5ut5SWuJ $MQ0h ( uu u Ëe3uEƋMd
Y_^[̋UV5@ u3@uu u Q ^] ̋U} u uu u ] ;
@@ u ̋UEWPfEP E3EELP 1ETP 1EEPlP EM3E3E3̋
@@ VWN@ ;tu&;uO@u
G ȉ
@@ _
@ ^h@ (P h@ YBH$H@HH̋UEVH<AQAk(;tM ;J r
BB ;r (;u3^]Ë̋VL t d @ P;t3u2^ð^ t& PA Yt2L j Yf u2Z uQ A < ̋U u} uuMPu Q Uu u YY]\ t h@ Y u j Y ̋U} u@ ( u2] u
j Y]̋U=@ t]Vutub t&u"h@ Yuh@ Yt+20
@
@
@
@
@
@ @ ^]j jh6 e MZ f9 u]< PE uL f9 u>E +PQgYYt'x$ |!E E 3Ɂ8 ËeE2Md
Y_^[̋U t} u 3@ ]̋U=@ t} uu u YY]̸ D ̋U$ Vj`P tM)j $ j P |xffftfpflfhEEDž @jPEj P E E @E E P EEj E P EPP u
tj
Y^̃%@ ̋SV4 4 ;sW>t
Q ׃;r_^[̋SV< < ;sW>t
Q ׃;r_^[h1 d5 D$l$l$+SVW@@ 1E3PeuEEEEd ËMd
Y__^[]Q̋UVu6 uuu Vh+ h@@ ^] ̋Uj P uP h XP PPP ]̋U$ j`P tjY)A
A A A 5A =A f B f
A f A fA f%A f-A A E A EA EA 8A A @ @ @ @ jXk ǀ@ jXk
@@ LjX
@ Lh ̋U%D $
@ j
`P e 3SVW3ɍ}S[wO3ɉW E܋}EGenuE5ineIEE5ntelE3@S[]܉E E ljsKS uCE%?= t#=` t =p t=P t=` t=p u=D =D =D MjXM9E|03S[]܉sKMS ] t=D ]@ D @ D @ ty tq3ЉEUEMj^#;uW@ D @ t; D @ #;u E M#;u
@ @5D _^[33@39@ %P %P %P %P %P %P %P %P %P %P %P ̰3̋UQ=D M|\ t uL]E?tB u é t- u é u é Dȋø ;) * ) * + A/ T/ P N7 7 $7 @7 p" # & # P \7 n7 |7 7 7 7 7 WTDSENSOR.dll WtdsAllocateEvent WtdsFreeEvent WtdsGetEventData WtdsGetProcessId WtdsRegisterSensor WtdsSendEvent WtdsUnregisterSensor (@ (@ N@ D V W "W :V ,V JV V XV U Y Y TU V pW V \W @W Y |V U U U "U V U U V S S S
T &T JT hT T S S ~T pU fV U >U Y Y T T 2 HS S P $S T P TS T P pS U P \S W P R W tP R W
Y P R `Y `P V W "W :V ,V JV V XV U Y Y TU V pW V \W @W Y |V U U U "U V U U V S S S
T &T JT hT T S S ~T pU fV U >U Y Y T T 8 _initterm 9 _initterm_e api-ms-win-crt-runtime-l1-1-0.dll _o___std_type_info_destroy_list _o__cexit _o__configure_narrow_argv _o__execute_onexit_table c_o__initialize_narrow_environment d_o__initialize_onexit_table _o__seh_filter_dll memset 2 _except_handler4_common api-ms-win-crt-private-l1-1-0.dll api-ms-win-crt-string-l1-1-0.dll RtlAllocateHeap RtlFreeHeap ntdll.dll EventUnregister InitializeCriticalSection EventSetInformation DisableThreadLibraryCalls EventRegister DeleteCriticalSection . SleepConditionVariableCS EnterCriticalSection DeviceIoControl < WakeConditionVariable LeaveCriticalSection InitializeConditionVariable CreateFileW GetLastError CloseHandle CancelIoEx EventWriteTransfer QueryPerformanceCounter
GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter 2 IsProcessorFeaturePresent GetCurrentProcess U TerminateProcess api-ms-win-eventing-provider-l1-1-0.dll api-ms-win-core-synch-l1-1-0.dll api-ms-win-core-libraryloader-l1-2-0.dll api-ms-win-core-synch-l1-2-0.dll api-ms-win-core-io-l1-1-0.dll api-ms-win-core-file-l1-1-0.dll api-ms-win-core-errorhandling-l1-1-0.dll api-ms-win-core-handle-l1-1-0.dll api-ms-win-core-profile-l1-1-0.dll api-ms-win-core-processthreads-l1-1-0.dll api-ms-win-core-sysinfo-l1-1-0.dll api-ms-win-core-interlocked-l1-1-0.dll api-ms-win-core-debug-l1-1-0.dll api-ms-win-core-processthreads-l1-1-1.dll NtQueryInformationProcess RtlNtStatusToDosError GetModuleHandleExA GetProcAddress 3 OpenProcess 8 P h `d ` M U I 4 V S _ V E R S I O N _ I N F O
e
e? S t r i n g F i l e I n f o 0 4 0 9 0 4 B 0 L C o m p a n y N a m e M i c r o s o f t C o r p o r a t i o n ` F i l e D e s c r i p t i o n W T D F r a m e w o r k S e n s o r C l i e n t h $ F i l e V e r s i o n 1 0 . 0 . 2 6 1 0 0 . 1 ( W i n B u i l d . 1 6 0 1 0 1 . 0 8 0 0 ) < I n t e r n a l N a m e w t d s e n s o r . d l l . L e g a l C o p y r i g h t M i c r o s o f t C o r p o r a t i o n . A l l r i g h t s r e s e r v e d . D O r i g i n a l F i l e n a m e w t d s e n s o r . d l l j % P r o d u c t N a m e M i c r o s o f t W i n d o w s O p e r a t i n g S y s t e m >
P r o d u c t V e r s i o n 1 0 . 0 . 2 6 1 0 0 . 1 D V a r F i l e I n f o $ T r a n s l a t i o n $I:#qR' cEM. M U I M U I e n - U S 00D0H0P0X000099999 ::: :%:,:J:W:]:c::::::;;
;5;:;I;O;[;c;;;;;;;;;;; \>{>>>>>> ? ? ?=?C?Q?? 0F0Q0000T1x1=2C2|2222233 4%4445
52585T5Y5a5y5555)6E6Q6e6p6666 7%747=7i7w777^88888888*929k9u9999 :1::0;J;;;;;;;5<>T>z>>>>>>>>>>>>?? ????? 0 00001 1 1;1@1S1q1111"2+262=2X2f2l2r2x2~2222222222222222233!313:3R3\3e344 4[4e4n4w444444445555E5Q5]5i5u55555555p6666666 @ 0(0,0 P 1 % 0% *H
%0%10
`He 0\
+7N0L0
+70 010
`He nR8, *PX'n9u xz,
0 03 _l _0
*H
01 0 UUS10U
Washington10URedmond1 0 U
Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20110
231116192008Z
241114192008Z0p1 0 UUS10U
Washington10URedmond1 0 U
Microsoft Corporation10UMicrosoft Windows0"0
*H
0
C`C%#<{_ j !XsNħ3-Z]_1a4F(*f mK$/[n~1l%ľM<*f2(Z2}kNS <$UT49i'T ¥e\nEiWe;Ihttp://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
*H
|qQyn9>\` QfG=*hwLb{Ǻz4KbzJ7-W| =ܸZij:ni!7ށugӓW^)9-Es[zFX^gl5?$5
uVx,Јߺ~,c#!xlX6+̤-@EΊ\k>p*
j_Gc
26 *pZBYqKW~!< ŹE ŕ]b֠c uw}=EWo3wb Y~1)0%001 0 UUS10U
Washington10URedmond1 0 U
Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20113 _l _0
`He 0 *H
1
+70
+7 10
+70/ *H
1" MήM!t(j C ZfB:0Z
+7 1L0J$" M i c r o s o f t W i n d o w s" http://www.microsoft.com/windows0
*H
n#wLCAlF!UցVƟ~}h"
t+J. )3 ~N44~2xi(w$ ÿIέ[8R_=cѤv (ûܷBb!h^0*dm(x#U
#jigEי 0
+710| *H
m0i10
`He 0R *H
A=09
+Y
010
`He 4ͥ}fyG{ 2=fGdq
n $N0O
nzԴ[@'@}/Olyv!ݰZuAYq/q $k構L0d#~1G=&9d
;`ӛ"4~ԊU*}ޏ(^< Ow\N;S 1<şcbw ǶS\"l[,.+qb9pCj!{TZY Q 2T=)f Nϧ )XPIxҥ- he鎮'@0q0Y3 kI 0
*H
01 0 UUS10U
Washington10URedmond1 0 U
Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100
210930182225Z
300930183225Z0|1 0 UUS10U
Washington10URedmond1 0 U
Microsoft Corporation1&0$U Microsoft Time-Stamp PCA 20100"0
*H
0
Lr! y$yՂҩlNu5WlJ⽹>`3\OfSqZ~JZ6gF# w2`}jRDFkvPDq\Q17
8n&S|9azĪri 65&dژ;{3[~ Rb%j]SVMݼ㑏9,Qpi
6-p15(㴇$ɏ~TUmh;Fz)7EFn20\O,b⍈䖬Jq[g` = s}AFu_4 }~ٞE߶r/}_۪~66L+nQsM7t 4G|?Lۯ^s=CN39LBh.QFѽjZasg^(v3rק
co 6d[!]_0tعP a65G k\RQ]%Pzl rRą<7?xE ^ڏriƮ{>j. 00 +7 0# +7*RdĚhttp://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
*H
U}*, g1$[rKo\>NGdx=139q6?dl|u9m1lѡ"fg:SMݘ x6.V i {jo)n?Hum m#TxSu$Wݟ=heV(U'$@]='@8)üTB jBRu6 as.,k{n?, x鑲[It 쑀=J>f;O2ٖtLrou04zP
X@1Q{ p( 6ںL
4$5g+
挙"'B=%tt[jў>~13}{8pDѐȫ::bpcSMmqj U3XpfM050Ѥ01 0 UUS10U
Washington10URedmond1 0 U
Microsoft Corporation1%0#U Microsoft America Operations1'0%U nShield TSS ESN:E002-05E0-D9471%0#U Microsoft Time-Stamp Service#
0+ 6X ݆
ˣ0~0|1 0 UUS10U
Washington10URedmond1 0 U
Microsoft Corporation1&0$U Microsoft Time-Stamp PCA 20100
*H
0"20240331165049Z20240401165049Z0t0:
+Y
1,0*0
0 0 0
di 06
+Y
1(0&0
+Y
0
0 0
*H
F웡OA+I +/XS"j3y?]d4i1
0 00|1 0 UUS10U
Washington10URedmond1 0 U
Microsoft Corporation1&0$U Microsoft Time-Stamp PCA 20103 0 0
`He J0 *H
1
*H
0/ *H
1" =lSа98-}^8 $I? r0 *H
/1000 OPwU >B$?h /AGTa~0!00~0|1 0 UUS10U
Washington10URedmond1 0 U
Microsoft Corporation1&0$U Microsoft Time-Stamp PCA 20103 0 0" iY<2vͨ\ڬؔ w20
*H
~p6hY(M;vgs,_)4ٷ;p G(Dl5^V|ր_v.S3鱉7]a2U~R*
Px)h}0oЁDپކ[BkV詘9H5SJEUȠ|]>fD)zmƘ iUgJ59֢Pg~O3 ֳᢩ.7&YBr:`+nZ;>IMz!.ϙ
肇>I$H4l .7*UA7C({( ) _unvٍX>]Ԝ]ڿzDc ґAp5pҘ+w '1 0!tߗlB!4P~ _ n\ lźtI#ha8g# J @XFj~?קjl3hs۾!F&| 5B *Oo {gn