MZ˙˙¸@¸ş´ Í!¸LÍ!This program cannot be run in DOS mode. $ő–<ßą÷RŒą÷RŒą÷RŒU‡­Œ°÷RŒU‡P°÷RŒRichą÷RŒPELáŤDnŕ!  @ľĚ@ p8.text°@@.rsrcp @@áŤDn T88áŤDn$ŒŒ8.rdata8x.rdata$zzzdbg `.rsrc$01`!.rsrc$02 ˇ|z$żößZ xuąĎŔńţ‚q5%%˝đKáŤDnL€0€0€H€ `€x€€¨€Ŕ€؀ đ    ˆ6č08Rţ%(`!¨ WEVT_TEMPLATEMUI¤4VS_VERSION_INFO˝ďţ { |O { |O?StringFileInfoŕ040904B0LCompanyNameMicrosoft Corporation\FileDescriptionSecurity Audit Schema DLLn'FileVersion10.0.20348.3451 (WinBuild.160101.0800)<InternalNameadtschema.dll€.LegalCopyrightŠ Microsoft Corporation. All rights reserved.DOriginalFilenameadtschema.dllj%ProductNameMicrosoftŽ WindowsŽ Operating SystemDProductVersion10.0.20348.3451DVarFileInfo$Translation °]`\  Œ $ŔN&<ŒQ>CPŸPcXŹepäĺrŹúşô˝ĂÔĐÚŕßŢŢ< $ &&p:(1(;@IŕPPZč]\^8k`eĚnpy0 Ą´ŁŤÜ´­ť¸źŔĎ|Ó„÷'ěţ02ChL@DL[FM8fP\ _b@‘eh˜”km€™ԞPP`¤¨PŽ€‰<° í ř˙˙ä00D PPX 0p0px 1p 1ph!2p 2pX#3p3pđ%4p4p¨&5p5pŔ'6p6pH)7p7pĚ*8p8pŕ+˙p˙pě,<-°°Ź-°°¤1.°.°A0°0°”E5°5°XI7°7°$MP°P° PZ°^°|Zx°x°b|°|°;(Ă $WEVT,ţt¨ Ź‹Œ8ŒxŒpŁ€ŁCHAN4 SecurityTTBL‹ĚTEMPhÍ’ŚˇSÉZD^‚ťuw @˙˙~D‚ EventDataA˙˙]ŠoDataEK•NameAuthenticationPackageName |8AuthenticationPackageNameTEMP”2!’gDoR0˘Wť˙Ś˙˙ŹD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙KŠoData3K•NameLogonProcessName ř@hŒ$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId(LogonProcessNameTEMPŘTŠ`nŰ5Xîcďɛšo˙˙jD‚ EventDataA˙˙IŠoData1K•NameAuditsDiscarded h$AuditsDiscardedTEMPř<كsŁĂTL|ňęQ&_Ę˙˙zD‚ EventDataA˙˙YŠoDataAK•NameNotificationPackageName P4NotificationPackageNameTEMPh< ‚lšĄ“ÎlWýAFŹę‹Ía˙˙„D‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙IŠoData1K•NameInvalidCallName A˙˙GŠoData/K•NameServerPortName A˙˙=ŠoData%K•Name ProcessId A˙˙AŠoData)K•Name ProcessName Ü  $ L p ” ¸ Đ $SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId$InvalidCallName$ServerPortNameProcessIdProcessNameTEMP( 4V].Ÿ4aSĆؘ€SĄ˘˙˙úD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙CŠoData+K•Name PreviousDate A˙˙CŠoData+K•Name PreviousTime A˙˙9ŠoData!K•NameNewDate A˙˙9ŠoData!K•NameNewTime A˙˙=ŠoData%K•Name ProcessId A˙˙AŠoData)K•Name ProcessName ä,Tx˜¸Ěŕř$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PreviousDate PreviousTimeNewDateNewTimeProcessIdProcessNameTEMP@¸ üƒĄUçÍď¸E{š˙˙pD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙CŠoData+K•Name PreviousTime A˙˙9ŠoData!K•NameNewTime A˙˙=ŠoData%K•Name ProcessId A˙˙AŠoData)K•Name ProcessName X| Čě  8$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PreviousTimeNewTimeProcessIdProcessNameTEMP,ěńĘj…ZţT^ň_cŰx­˙˙dD‚ EventDataA˙˙9ŠoData!K•NameEventId A˙˙CŠoData+K•Name ComputerName A˙˙EŠoData-K•Name TargetUserSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetUserDomain A˙˙EŠoData-K•Name TargetLogonId A˙˙?ŠoData'K•Name EventCount A˙˙;ŠoData#K•NameDuration Œ Ŕŕ,LhEventId ComputerName TargetUserSid$TargetUserName(TargetUserDomain TargetLogonIdEventCountDurationTEMPđ,:OôĽŚYĚ ŠË Ћŕ˙˙vD‚ EventDataA˙˙UŠoData=K•NameCrashOnAuditFailValue @0CrashOnAuditFailValueTEMPčDřZ6=`?]шPřŇ,˙˙rD‚ EventDataA˙˙QŠoData9K•NameSecurityPackageName ,,SecurityPackageNameTEMPt ¤ …ç!°ěěWQkŠ‘iŽ˙˙D‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name TargetUserSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙EŠoData-K•Name TargetLogonId A˙˙=ŠoData%K•Name LogonType A˙˙KŠoData3K•NameLogonProcessName A˙˙]ŠoDataEK•NameAuthenticationPackageName A˙˙IŠoData1K•NameWorkstationName A˙˙=ŠoData%K•Name LogonGuid A˙˙QŠoData9K•NameTransmittedServices A˙˙EŠoData-K•Name LmPackageName A˙˙=ŠoData%K•Name KeyLength A˙˙=ŠoData%K•Name ProcessId A˙˙AŠoData)K•Name ProcessName A˙˙=ŠoData%K•Name IpAddress A˙˙7ŠoDataK•NameIpPort 4"X"|"¤"Č"č" #4#T#l#”#Ě#đ#$4$T$l$„$ $¸$$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId TargetUserSid$TargetUserName(TargetDomainName TargetLogonIdLogonType(LogonProcessName8AuthenticationPackageName$WorkstationNameLogonGuid,TransmittedServices LmPackageNameKeyLengthProcessIdProcessNameIpAddressIpPortTEMP l+Ћ >GÁ_gW„VŃďłó˙˙lD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name TargetUserSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙EŠoData-K•Name TargetLogonId A˙˙=ŠoData%K•Name LogonType A˙˙KŠoData3K•NameLogonProcessName A˙˙]ŠoDataEK•NameAuthenticationPackageName A˙˙IŠoData1K•NameWorkstationName A˙˙=ŠoData%K•Name LogonGuid A˙˙QŠoData9K•NameTransmittedServices A˙˙EŠoData-K•Name LmPackageName A˙˙=ŠoData%K•Name KeyLength A˙˙=ŠoData%K•Name ProcessId A˙˙AŠoData)K•Name ProcessName A˙˙=ŠoData%K•Name IpAddress A˙˙7ŠoDataK•NameIpPort A˙˙OŠoData7K•NameImpersonationLevel -4-X-€-¤-Ä-č-.0.H.p.¨.Ě.ä./0/H/`/|/”/¨/$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId TargetUserSid$TargetUserName(TargetDomainName TargetLogonIdLogonType(LogonProcessName8AuthenticationPackageName$WorkstationNameLogonGuid,TransmittedServices LmPackageNameKeyLengthProcessIdProcessNameIpAddressIpPort,ImpersonationLevelTEMP”€8ϲw`|žXˇŚDĂ'˜Y˙˙vD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name TargetUserSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙EŠoData-K•Name TargetLogonId A˙˙=ŠoData%K•Name LogonType A˙˙KŠoData3K•NameLogonProcessName A˙˙]ŠoDataEK•NameAuthenticationPackageName A˙˙IŠoData1K•NameWorkstationName A˙˙=ŠoData%K•Name LogonGuid A˙˙QŠoData9K•NameTransmittedServices A˙˙EŠoData-K•Name LmPackageName A˙˙=ŠoData%K•Name KeyLength A˙˙=ŠoData%K•Name ProcessId A˙˙AŠoData)K•Name ProcessName A˙˙=ŠoData%K•Name IpAddress A˙˙7ŠoDataK•NameIpPort A˙˙OŠoData7K•NameImpersonationLevel A˙˙QŠoData9K•NameRestrictedAdminMode A˙˙WŠoData?K•NameTargetOutboundUserName A˙˙[ŠoDataCK•NameTargetOutboundDomainName A˙˙GŠoData/K•NameVirtualAccount A˙˙QŠoData9K•NameTargetLinkedLogonId A˙˙EŠoData-K•Name ElevatedToken œ:Ŕ:ä: ;0;P;t;œ;ź;Ô;ü;4<X<p<œ<ź<Ô<ě<= =4=`=Œ=Ŕ=ř=>H>$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId TargetUserSid$TargetUserName(TargetDomainName TargetLogonIdLogonType(LogonProcessName8AuthenticationPackageName$WorkstationNameLogonGuid,TransmittedServices LmPackageNameKeyLengthProcessIdProcessNameIpAddressIpPort,ImpersonationLevel,RestrictedAdminMode4TargetOutboundUserName8TargetOutboundDomainName$VirtualAccount,TargetLinkedLogonId ElevatedTokenTEMPŘ đDxîTo/ŠŔ–tú˙˙TD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name TargetUserSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙7ŠoDataK•NameStatus A˙˙EŠoData-K•Name FailureReason A˙˙=ŠoData%K•Name SubStatus A˙˙=ŠoData%K•Name LogonType A˙˙KŠoData3K•NameLogonProcessName A˙˙]ŠoDataEK•NameAuthenticationPackageName A˙˙IŠoData1K•NameWorkstationName A˙˙QŠoData9K•NameTransmittedServices A˙˙EŠoData-K•Name LmPackageName A˙˙=ŠoData%K•Name KeyLength A˙˙=ŠoData%K•Name ProcessId A˙˙AŠoData)K•Name ProcessName A˙˙=ŠoData%K•Name IpAddress A˙˙7ŠoDataK•NameIpPort ”F¸FÜFG(GHGlG”G¨GČGŕGřG HXH|H¨HČHŕHřHI,I$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId TargetUserSid$TargetUserName(TargetDomainNameStatus FailureReasonSubStatusLogonType(LogonProcessName8AuthenticationPackageName$WorkstationName,TransmittedServices LmPackageNameKeyLengthProcessIdProcessNameIpAddressIpPortTEMPŕ lMeË9˜ŁSű†đB@lKě˙˙řD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name TargetUserSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙EŠoData-K•Name TargetLogonId A˙˙=ŠoData%K•Name LogonType A˙˙;ŠoData#K•NameEventIdx A˙˙IŠoData1K•NameEventCountTotal A˙˙?ŠoData'K•Name UserClaims A˙˙CŠoData+K•Name DeviceClaims pN”N¸NŕNO$OHOpOO¨OŔOäOP$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId TargetUserSid$TargetUserName(TargetDomainName TargetLogonIdLogonTypeEventIdx$EventCountTotalUserClaims DeviceClaimsTEMPt TÁj[h5ëVÎÓbt?*.˙˙¸D‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name TargetUserSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙EŠoData-K•Name TargetLogonId A˙˙=ŠoData%K•Name LogonType A˙˙;ŠoData#K•NameEventIdx A˙˙IŠoData1K•NameEventCountTotal A˙˙IŠoData1K•NameGroupMembership üT UDUlUU°UÔUüUV4VLVpV$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId TargetUserSid$TargetUserName(TargetDomainName TargetLogonIdLogonTypeEventIdx$EventCountTotal$GroupMembershipTEMPÔ`XN¨Ż–h%SÓ"ü~‰đ¤F˙˙–D‚ EventDataA˙˙EŠoData-K•Name TargetUserSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙EŠoData-K•Name TargetLogonId A˙˙=ŠoData%K•Name LogonType ÄXäXY0YPY TargetUserSid$TargetUserName(TargetDomainName TargetLogonIdLogonTypeTEMPĚZeہćÂŁ\ęux_ˇKó˙˙dD‚ EventDataA˙˙CŠoData+K•Name notification Z notificationTEMPdź[\‡÷ ÁQ Ç(?PKÚ˙˙RD‚ EventDataA˙˙EŠoData-K•Name TargetUserSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙EŠoData-K•Name TargetLogonId  \,\P\x\ TargetUserSid$TargetUserName(TargetDomainName TargetLogonIdTEMP@aöWřˆĐŇY)•Ü›ľťl˙˙4D‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙=ŠoData%K•Name LogonGuid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙IŠoData1K•NameTargetLogonGuid A˙˙KŠoData3K•NameTargetServerName A˙˙?ŠoData'K•Name TargetInfo A˙˙=ŠoData%K•Name ProcessId A˙˙AŠoData)K•Name ProcessName A˙˙=ŠoData%K•Name IpAddress A˙˙7ŠoDataK•NameIpPort b$>@>$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdObjectTypeObjectNameAccessListAccessMaskProcessIdTEMPpAƒ—ĚcčńSÄJŔ|bVÉR˙˙ˆD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙AŠoData)K•Name MasterKeyId A˙˙GŠoData/K•NameRecoveryServer A˙˙EŠoData-K•Name RecoveryKeyId A˙˙EŠoData-K•Name FailureReason ´AŘAüA$BHBdBˆB¨B$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdMasterKeyId$RecoveryServer RecoveryKeyId FailureReasonTEMPč ĚE0˛+қÚ×SEłť=%&{X˙˙ÎD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙AŠoData)K•Name MasterKeyId A˙˙GŠoData/K•NameRecoveryReason A˙˙GŠoData/K•NameRecoveryServer A˙˙EŠoData-K•Name RecoveryKeyId A˙˙=ŠoData%K•Name FailureId €F¤FČFđFG0GTGxG˜G$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdMasterKeyId$RecoveryReason$RecoveryServer RecoveryKeyIdFailureIdTEMP ĚJ˘ ]ʖWźĆœTV÷8ę˙˙ćD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙IŠoData1K•NameDataDescription A˙˙AŠoData)K•Name MasterKeyId A˙˙OŠoData7K•NameProtectedDataFlags A˙˙KŠoData3K•NameCryptoAlgorithms A˙˙EŠoData-K•Name FailureReason €K¤KČKđKL8LTL€L¨L$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId$DataDescriptionMasterKeyId,ProtectedDataFlags(CryptoAlgorithms FailureReasonTEMP äO˘ ]ʖWźĆœTV÷8ę˙˙ćD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙IŠoData1K•NameDataDescription A˙˙AŠoData)K•Name MasterKeyId A˙˙OŠoData7K•NameProtectedDataFlags A˙˙KŠoData3K•NameCryptoAlgorithms A˙˙EŠoData-K•Name FailureReason ˜PźPŕPQ,QPQlQ˜QŔQ$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId$DataDescriptionMasterKeyId,ProtectedDataFlags(CryptoAlgorithms FailureReasonTEMPˆ ŘU§ŻIW„^ěÔÔéä!˙˙ÂD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name TargetUserSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙EŠoData-K•Name TargetLogonId A˙˙IŠoData1K•NameTargetProcessId A˙˙MŠoData5K•NameTargetProcessName A˙˙=ŠoData%K•Name ProcessId A˙˙AŠoData)K•Name ProcessName ČVěVW8W\W|W WČWčW X4XLX$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId TargetUserSid$TargetUserName(TargetDomainName TargetLogonId$TargetProcessId(TargetProcessNameProcessIdProcessNameTEMP x[ý,ŕÄ+ßz_ÜůŒŃ…îѢ˙˙ÚD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙AŠoData)K•Name ServiceName A˙˙IŠoData1K•NameServiceFileName A˙˙AŠoData)K•Name ServiceType A˙˙KŠoData3K•NameServiceStartType A˙˙GŠoData/K•NameServiceAccount ,\P\t\œ\Ŕ\Ü\]]D]$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdServiceName$ServiceFileNameServiceType(ServiceStartType$ServiceAccountTEMP° taú$7UŰ$6&ƒăßí˙˙ÖD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙AŠoData)K•Name ServiceName A˙˙IŠoData1K•NameServiceFileName A˙˙AŠoData)K•Name ServiceType A˙˙KŠoData3K•NameServiceStartType A˙˙GŠoData/K•NameServiceAccount A˙˙UŠoData=K•NameClientProcessStartKey A˙˙IŠoData1K•NameClientProcessId A˙˙IŠoData1K•NameParentProcessId dbˆbŹbÔbřbc8cTc|c  cĐcôc$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdServiceName$ServiceFileNameServiceType(ServiceStartType$ServiceAccount0ClientProcessStartKey$ClientProcessId$ParentProcessIdTEMPX0fşş- Í ÂVY‘JŒ„<@˙˙äD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙;ŠoData#K•NameTaskName A˙˙AŠoData)K•Name TaskContent ¨fĚfđfgń=đ˙˙vD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙;ŠoData#K•NameTaskName A˙˙AŠoData)K•Name TaskContent A˙˙UŠoData=K•NameClientProcessStartKey  A˙˙IŠoData1K•NameClientProcessId A˙˙IŠoData1K•NameParentProcessId A˙˙UŠoData=K•NameRpcCallClientLocality A˙˙3ŠoDataK•NameFQDN řkl@lhlŒl¤l Ŕlđlm8mhm$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTaskNameTaskContent0ClientProcessStartKey$ClientProcessId$ParentProcessId0RpcCallClientLocalityFQDNTEMPXoşş- Í ÂVY‘JŒ„<@˙˙äD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙;ŠoData#K•NameTaskName A˙˙AŠoData)K•Name TaskContent p,pPpxpœp´p$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTaskNameTaskContentTEMP |tˆŠĄőŤ ěV;ůČ>ń=đ˙˙vD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙;ŠoData#K•NameTaskName A˙˙AŠoData)K•Name TaskContent A˙˙UŠoData=K•NameClientProcessStartKey  A˙˙IŠoData1K•NameClientProcessId A˙˙IŠoData1K•NameParentProcessId A˙˙UŠoData=K•NameRpcCallClientLocality A˙˙3ŠoDataK•NameFQDN Xu|u uČuěuv vPvtv˜vČv$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTaskNameTaskContent0ClientProcessStartKey$ClientProcessId$ParentProcessId0RpcCallClientLocalityFQDNTEMPXđxşş- Í ÂVY‘JŒ„<@˙˙äD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙;ŠoData#K•NameTaskName A˙˙AŠoData)K•Name TaskContent hyŒy°yŘyüyz$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTaskNameTaskContentTEMP Ü}ˆŠĄőŤ ěV;ůČ>ń=đ˙˙vD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙;ŠoData#K•NameTaskName A˙˙AŠoData)K•Name TaskContent A˙˙UŠoData=K•NameClientProcessStartKey  A˙˙IŠoData1K•NameClientProcessId A˙˙IŠoData1K•NameParentProcessId A˙˙UŠoData=K•NameRpcCallClientLocality A˙˙3ŠoDataK•NameFQDN ¸~Ü~(Ld €°Ôř(€$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTaskNameTaskContent0ClientProcessStartKey$ClientProcessId$ParentProcessId0RpcCallClientLocalityFQDNTEMPXP‚şş- Í ÂVY‘JŒ„<@˙˙äD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙;ŠoData#K•NameTaskName A˙˙AŠoData)K•Name TaskContent Ȃě‚ƒ8ƒ\ƒtƒ$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTaskNameTaskContentTEMP <‡ˆŠĄőŤ ěV;ůČ>ń=đ˙˙vD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙;ŠoData#K•NameTaskName A˙˙AŠoData)K•Name TaskContent A˙˙UŠoData=K•NameClientProcessStartKey  A˙˙IŠoData1K•NameClientProcessId A˙˙IŠoData1K•NameParentProcessId A˙˙UŠoData=K•NameRpcCallClientLocality A˙˙3ŠoDataK•NameFQDN ˆ<ˆ`ˆˆˆʈĈ ŕˆ‰4‰X‰ˆ‰$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTaskNameTaskContent0ClientProcessStartKey$ClientProcessId$ParentProcessId0RpcCallClientLocalityFQDNTEMPh¸‹żÝŇôR‹mmŁôĽŘe˙˙ęD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙;ŠoData#K•NameTaskName A˙˙GŠoData/K•NameTaskContentNew 0ŒTŒxŒ ŒČ܌$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTaskName$TaskContentNewTEMP °jńč,âSQátRĹv˙˙|D‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙;ŠoData#K•NameTaskName A˙˙GŠoData/K•NameTaskContentNew A˙˙UŠoData=K•NameClientProcessStartKey  A˙˙IŠoData1K•NameClientProcessId A˙˙IŠoData1K•NameParentProcessId A˙˙UŠoData=K•NameRpcCallClientLocality A˙˙3ŠoDataK•NameFQDN Œ‘°‘ԑü‘ ’8’ \’Œ’°’Ԓ“$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTaskName$TaskContentNew0ClientProcessStartKey$ClientProcessId$ParentProcessId0RpcCallClientLocalityFQDNTEMPŹ —„ŞľĄd^źĐ33°—K˙˙ÔD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name TargetUserSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙EŠoData-K•Name TargetLogonId A˙˙AŠoData)K•Name ProcessName A˙˙=ŠoData%K•Name ProcessId A˙˙SŠoData;K•NameEnabledPrivilegeList A˙˙UŠoData=K•NameDisabledPrivilegeList  ˜0˜T˜|˜ ˜Ŕ˜ä˜ ™,™H™`™™$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId TargetUserSid$TargetUserName(TargetDomainName TargetLogonIdProcessNameProcessId0EnabledPrivilegeList0DisabledPrivilegeListTEMPdŕ›iƒ2*SŔdśŃ=‘e˙˙ęD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙=ŠoData%K•Name TargetSid A˙˙EŠoData-K•Name PrivilegeList Xœ|œ œȜěœ$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTargetSid PrivilegeListTEMPdDŸiƒ2*SŔdśŃ=‘e˙˙ęD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙=ŠoData%K•Name TargetSid A˙˙EŠoData-K•Name PrivilegeList źŸŕŸ , P h $SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTargetSid PrivilegeListTEMPX ĐŁúU´÷QޚW=úl܏.˙˙D‚ EventDataA˙˙?ŠoData'K•Name DomainName A˙˙=ŠoData%K•Name DomainSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙9ŠoData!K•NameTdoType A˙˙CŠoData+K•Name TdoDirection A˙˙EŠoData-K•Name TdoAttributes A˙˙QŠoData9K•NameSidFilteringEnabled ˜¤´¤̤đ¤Ľ<Ľ`ĽtĽ”Ľ´ĽDomainNameDomainSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTdoType TdoDirection TdoAttributes,SidFilteringEnabledTEMPXř§ŹkkäˇQeî/ĺpt/˙˙äD‚ EventDataA˙˙?ŠoData'K•Name DomainName A˙˙=ŠoData%K•Name DomainSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId p¨Œ¨¤¨Ȩ쨊DomainNameDomainSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMP€@ŞŸŕt%oD^fž‹h[Âýl˙˙ÔD‚ EventDataA˙˙7ŠoDataK•Nameparam1 A˙˙7ŠoDataK•Nameparam2 A˙˙7ŠoDataK•Nameparam3 |ސޤŞparam1param2param3TEMP„Ťť~óü(^€ż$Um0&î˙˙–D‚ EventDataA˙˙7ŠoDataK•Nameparam1 A˙˙7ŠoDataK•Nameparam2 ŹŤŔŤparam1param2TEMP´`Źoî(éôĺ9P𗆤ΫŰá˙˙XD‚ EventDataA˙˙7ŠoDataK•Nameparam1 tŹparam1TEMP´­oî(éôĺ9P𗆤ΫŰá˙˙XD‚ EventDataA˙˙7ŠoDataK•Nameparam1 (­param1TEMP$Ż4{o[i#r^żůČ}—+{Ÿ˙˙´D‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙SŠoData;K•NameKerberosPolicyChange ˆŻŹŻĐŻřݰ$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId0KerberosPolicyChangeTEMPü,˛5N݌=V"̲÷N˙˙ŞD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙IŠoData1K•NameEfsPolicyChange ˛´˛زł$ł$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId$EfsPolicyChangeTEMP4PľHg=ä‹BÝ_MŃŃë%:ő˙˙ŇD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙5ŠoDataK•NameOldSd A˙˙5ŠoDataK•NameNewSd Čľěľś8ś\ślś$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdOldSdNewSdTEMPX ÄšňFӟ}÷ü^Ľż—T€ŇP˙˙D‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙?ŠoData'K•Name DomainName A˙˙=ŠoData%K•Name DomainSid A˙˙9ŠoData!K•NameTdoType A˙˙CŠoData+K•Name TdoDirection A˙˙EŠoData-K•Name TdoAttributes A˙˙QŠoData9K•NameSidFilteringEnabled Œş°şÔşüş ť<ťTťhťˆť¨ť$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdDomainNameDomainSidTdoType TdoDirection TdoAttributes,SidFilteringEnabledTEMPdô˝‚Â|x—+’YŠĄ§ÉĄ{Ž˙˙ęD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙=ŠoData%K•Name TargetSid A˙˙EŠoData-K•Name AccessGranted lžž´žÜžżż$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTargetSid AccessGrantedTEMPdXÁ"ě*bŚů^}ku ފH˙˙ęD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙=ŠoData%K•Name TargetSid A˙˙EŠoData-K•Name AccessRemoved ĐÁôÁÂ@ÂdÂ|Â$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTargetSid AccessRemovedTEMPˆdĹ‘ óÚ2WŻNȅ}i˙˙’D‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙?ŠoData'K•Name CategoryId A˙˙EŠoData-K•Name SubcategoryId A˙˙IŠoData1K•NameSubcategoryGuid A˙˙OŠoData7K•NameAuditPolicyChanges Ć(ĆLĆtĆ˜Ć´ĆÔĆřĆ$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdCategoryId SubcategoryId$SubcategoryGuid,AuditPolicyChangesTEMP° ˜ĘG¸/OECTUęͨĄ‰|˙˙>D‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙?ŠoData'K•Name CategoryId A˙˙EŠoData-K•Name SubcategoryId A˙˙IŠoData1K•NameSubcategoryGuid A˙˙OŠoData7K•NameAuditPolicyChanges A˙˙IŠoData1K•NameClientProcessId A˙˙UŠoData=K•NameClientProcessStartKey `˄˨ËĐËôËĚ0ĚTĚ€Ě ¤Ě$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdCategoryId SubcategoryId$SubcategoryGuid,AuditPolicyChanges$ClientProcessId0ClientProcessStartKeyTEMP” đÔMńl@ ׾Sˆ^#§N‘ş˙˙ćD‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList A˙˙GŠoData/K•NameSamAccountName A˙˙AŠoData)K•Name DisplayName A˙˙MŠoData5K•NameUserPrincipalName A˙˙EŠoData-K•Name HomeDirectory A˙˙;ŠoData#K•NameHomePath A˙˙?ŠoData'K•Name ScriptPath A˙˙AŠoData)K•Name ProfilePath A˙˙KŠoData3K•NameUserWorkstations A˙˙IŠoData1K•NamePasswordLastSet A˙˙GŠoData/K•NameAccountExpires A˙˙GŠoData/K•NamePrimaryGroupId A˙˙QŠoData9K•NameAllowedToDelegateTo A˙˙AŠoData)K•Name OldUacValue A˙˙AŠoData)K•Name NewUacValue A˙˙OŠoData7K•NameUserAccountControl A˙˙GŠoData/K•NameUserParameters A˙˙?ŠoData'K•Name SidHistory A˙˙?ŠoData'K•Name LogonHours řÖ×D×\׀פ×Ě×đ×Ř4ŘPŘxŘ˜Ř°ŘĚŘčŘŮ4ŮXŮ|٨ŮÄŮŕŮ Ú0ÚLÚ$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameDisplayName(UserPrincipalName HomeDirectoryHomePathScriptPathProfilePath(UserWorkstations$PasswordLastSet$AccountExpires$PrimaryGroupId,AllowedToDelegateToOldUacValueNewUacValue,UserAccountControl$UserParametersSidHistoryLogonHoursTEMP €Ý5}>.R@CϐÜ˙˙âD‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙IŠoData1K•NameCallerProcessId A˙˙MŠoData5K•NameCallerProcessName 4ŢXŢ€Ţ˜ŢźŢŕŢß,ßPß$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId$CallerProcessId(CallerProcessNameTEMPřěá—ˇ?1ÉhÂTźô JGt›K˙˙>D‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId xâœâÄâÜâă$ăLă$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMPx0ćVř‡Ô2^‰uhČÁtHj˙˙ŠD‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList Đćôćç4çXç|ç¤çČç$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPř\ę—ˇ?1ÉhÂTźô JGt›K˙˙>D‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId čę ë4ëLëpë”ëźë$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMPřTî—ˇ?1ÉhÂTźô JGt›K˙˙>D‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId ŕîď,ďDďhďŒď´ď$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMPx˜ňVř‡Ô2^‰uhČÁtHj˙˙ŠD‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList 8ó\ó„óœóŔóäó ô0ô$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPt ¤÷ $Ő5ó‹]Eç‘*y<Ó˙˙D‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList A˙˙GŠoData/K•NameSamAccountName A˙˙?ŠoData'K•Name SidHistory lřř¸řĐřôřů@ůdů„ů¨ů$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameSidHistoryTEMP\ ý;RŻëŐ]LńÜůżŢę˙˙D‚ EventDataA˙˙?ŠoData'K•Name MemberName A˙˙=ŠoData%K•Name MemberSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList Ôýđýţ,ţTţlţţ´ţÜţ˙MemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMP  ĚŃ^‡#X˝Q#9Ł$ĺR˙˙vD‚ EventDataA˙˙?ŠoData'K•Name MemberName A˙˙=ŠoData%K•Name MemberSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList A˙˙[ŠoDataCK•NameMembershipExpirationTime ¨ÄÜ(@dˆ°ÔôMemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList8MembershipExpirationTimeTEMP\ t;RŻëŐ]LńÜůżŢę˙˙D‚ EventDataA˙˙?ŠoData'K•Name MemberName A˙˙=ŠoData%K•Name MemberSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList < X p ” ź Ô ř  D h MemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPxH Vř‡Ô2^‰uhČÁtHj˙˙ŠD‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList č  4Lp”źŕ$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPt T $Ő5ó‹]Eç‘*y<Ó˙˙D‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList A˙˙GŠoData/K•NameSamAccountName A˙˙?ŠoData'K•Name SidHistory @h€¤Čđ4X$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameSidHistoryTEMP\ ź;RŻëŐ]LńÜůżŢę˙˙D‚ EventDataA˙˙?ŠoData'K•Name MemberName A˙˙=ŠoData%K•Name MemberSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList „ ¸Ü@dŒ°MemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMP  |Ń^‡#X˝Q#9Ł$ĺR˙˙vD‚ EventDataA˙˙?ŠoData'K•Name MemberName A˙˙=ŠoData%K•Name MemberSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList A˙˙[ŠoDataCK•NameMembershipExpirationTime XtŒ°Řđ8`„¤MemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList8MembershipExpirationTimeTEMP\ $#;RŻëŐ]LńÜůżŢę˙˙D‚ EventDataA˙˙?ŠoData'K•Name MemberName A˙˙=ŠoData%K•Name MemberSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList ě#$ $D$l$„$¨$Ě$ô$%MemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPxř'Vř‡Ô2^‰uhČÁtHj˙˙ŠD‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList ˜(ź(ä(ü( )D)l))$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPt - $Ő5ó‹]Eç‘*y<Ó˙˙D‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList A˙˙GŠoData/K•NameSamAccountName A˙˙?ŠoData'K•Name SidHistory Ě-đ-.0.T.x. .Ä.ä./$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameSidHistoryTEMP <25}>.R@CϐÜ˙˙âD‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙IŠoData1K•NameCallerProcessId A˙˙MŠoData5K•NameCallerProcessName đ23<3T3x3œ3Ä3č3 4$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId$CallerProcessId(CallerProcessNameTEMPt ˆ7 $Ő5ó‹]Eç‘*y<Ó˙˙D‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList A˙˙GŠoData/K•NameSamAccountName A˙˙?ŠoData'K•Name SidHistory P8t8œ8´8Ř8ü8$9H9h9Œ9$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameSidHistoryTEMPô B„Ynţh˛^Ëä§ ™ĽÔž˙˙"D‚ EventDataA˙˙5ŠoDataK•NameDummy A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList A˙˙GŠoData/K•NameSamAccountName A˙˙AŠoData)K•Name DisplayName A˙˙MŠoData5K•NameUserPrincipalName A˙˙EŠoData-K•Name HomeDirectory A˙˙;ŠoData#K•NameHomePath A˙˙?ŠoData'K•Name ScriptPath A˙˙AŠoData)K•Name ProfilePath A˙˙KŠoData3K•NameUserWorkstations A˙˙IŠoData1K•NamePasswordLastSet A˙˙GŠoData/K•NameAccountExpires A˙˙GŠoData/K•NamePrimaryGroupId A˙˙QŠoData9K•NameAllowedToDelegateTo A˙˙AŠoData)K•Name OldUacValue A˙˙AŠoData)K•Name NewUacValue A˙˙OŠoData7K•NameUserAccountControl A˙˙GŠoData/K•NameUserParameters A˙˙?ŠoData'K•Name SidHistory A˙˙?ŠoData'K•Name LogonHours D,DPDxDD´DŘDE$EDEhE„EŹEĚEäEFFDFhFŒF°FÜFřFG@GdG€GDummy$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameDisplayName(UserPrincipalName HomeDirectoryHomePathScriptPathProfilePath(UserWorkstations$PasswordLastSet$AccountExpires$PrimaryGroupId,AllowedToDelegateToOldUacValueNewUacValue,UserAccountControl$UserParametersSidHistoryLogonHoursTEMPÄ ˜N>Ó% ëΨS7­  Ř‘ň˙˙ČD‚ EventDataA˙˙QŠoData9K•NameDomainPolicyChanged A˙˙?ŠoData'K•Name DomainName A˙˙=ŠoData%K•Name DomainSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList A˙˙GŠoData/K•NameMinPasswordAge A˙˙GŠoData/K•NameMaxPasswordAge A˙˙AŠoData)K•Name ForceLogoff A˙˙KŠoData3K•NameLockoutThreshold A˙˙[ŠoDataCK•NameLockoutObservationWindow A˙˙IŠoData1K•NameLockoutDuration A˙˙OŠoData7K•NamePasswordProperties A˙˙MŠoData5K•NameMinPasswordLength A˙˙UŠoData=K•NamePasswordHistoryLength A˙˙QŠoData9K•NameMachineAccountQuota A˙˙IŠoData1K•NameMixedDomainMode A˙˙UŠoData=K•NameDomainBehaviorVersion A˙˙GŠoData/K•NameOemInformation D‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId `V„VŹVÄVčV W4W$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMPŹ`˛~š. !XQc×7TBn˙˙ŠD‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList A˙˙GŠoData/K•NameSamAccountName A˙˙AŠoData)K•Name DisplayName A˙˙MŠoData5K•NameUserPrincipalName A˙˙EŠoData-K•Name HomeDirectory A˙˙;ŠoData#K•NameHomePath A˙˙?ŠoData'K•Name ScriptPath A˙˙AŠoData)K•Name ProfilePath A˙˙KŠoData3K•NameUserWorkstations A˙˙IŠoData1K•NamePasswordLastSet A˙˙GŠoData/K•NameAccountExpires A˙˙GŠoData/K•NamePrimaryGroupId A˙˙QŠoData9K•NameAllowedToDelegateTo A˙˙AŠoData)K•Name OldUacValue A˙˙AŠoData)K•Name NewUacValue A˙˙OŠoData7K•NameUserAccountControl A˙˙GŠoData/K•NameUserParameters A˙˙?ŠoData'K•Name SidHistory A˙˙?ŠoData'K•Name LogonHours A˙˙AŠoData)K•Name DnsHostName A˙˙UŠoData=K•NameServicePrincipalNames Hblb”bŹbĐbôbc@c`c„c cČcčcdd8d`d„d¨dĚdřde0e\e€eœe¸eÔe$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameDisplayName(UserPrincipalName HomeDirectoryHomePathScriptPathProfilePath(UserWorkstations$PasswordLastSet$AccountExpires$PrimaryGroupId,AllowedToDelegateToOldUacValueNewUacValue,UserAccountControl$UserParametersSidHistoryLogonHoursDnsHostName0ServicePrincipalNamesTEMPL o–†M‘OQ{#$ĐŰŚ—ü˙˙ćD‚ EventDataA˙˙UŠoData=K•NameComputerAccountChange A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList A˙˙GŠoData/K•NameSamAccountName A˙˙AŠoData)K•Name DisplayName A˙˙MŠoData5K•NameUserPrincipalName A˙˙EŠoData-K•Name HomeDirectory A˙˙;ŠoData#K•NameHomePath A˙˙?ŠoData'K•Name ScriptPath A˙˙AŠoData)K•Name ProfilePath A˙˙KŠoData3K•NameUserWorkstations A˙˙IŠoData1K•NamePasswordLastSet A˙˙GŠoData/K•NameAccountExpires A˙˙GŠoData/K•NamePrimaryGroupId A˙˙QŠoData9K•NameAllowedToDelegateTo A˙˙AŠoData)K•Name OldUacValue A˙˙AŠoData)K•Name NewUacValue A˙˙OŠoData7K•NameUserAccountControl A˙˙GŠoData/K•NameUserParameters A˙˙?ŠoData'K•Name SidHistory A˙˙?ŠoData'K•Name LogonHours A˙˙AŠoData)K•Name DnsHostName A˙˙UŠoData=K•NameServicePrincipalNames dq”q¸qŕqřqr@rhrŒrŹrĐrěrs4sLshs„sŹsĐsôstDt`t|t¨tĚtčtu u0ComputerAccountChange$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameDisplayName(UserPrincipalName HomeDirectoryHomePathScriptPathProfilePath(UserWorkstations$PasswordLastSet$AccountExpires$PrimaryGroupId,AllowedToDelegateToOldUacValueNewUacValue,UserAccountControl$UserParametersSidHistoryLogonHoursDnsHostName0ServicePrincipalNamesTEMPxxVř‡Ô2^‰uhČÁtHj˙˙ŠD‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList °xÔxüxy8y\y„y¨y$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPt } $Ő5ó‹]Eç‘*y<Ó˙˙D‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList A˙˙GŠoData/K•NameSamAccountName A˙˙?ŠoData'K•Name SidHistory ä}~0~H~l~~¸~Ü~ü~ $TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameSidHistoryTEMPt ‚ $Ő5ó‹]Eç‘*y<Ó˙˙D‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList A˙˙GŠoData/K•NameSamAccountName A˙˙?ŠoData'K•Name SidHistory Xƒ|ƒ¤ƒźƒŕƒ„,„P„p„”„$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameSidHistoryTEMP\ ř‡;RŻëŐ]LńÜůżŢę˙˙D‚ EventDataA˙˙?ŠoData'K•Name MemberName A˙˙=ŠoData%K•Name MemberSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList Ŕˆ܈ôˆ‰@‰X‰|‰ ‰ȉě‰MemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMP  ¸Ń^‡#X˝Q#9Ł$ĺR˙˙vD‚ EventDataA˙˙?ŠoData'K•Name MemberName A˙˙=ŠoData%K•Name MemberSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList A˙˙[ŠoDataCK•NameMembershipExpirationTime ”ްŽȎ쮏,PtœŔŕMemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList8MembershipExpirationTimeTEMP\ `“;RŻëŐ]LńÜůżŢę˙˙D‚ EventDataA˙˙?ŠoData'K•Name MemberName A˙˙=ŠoData%K•Name MemberSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList (”D”\”€”¨”Ŕ”䔕0•T•MemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPx4˜Vř‡Ô2^‰uhČÁtHj˙˙ŠD‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList Ԙř˜ ™8™\™€™¨™̙$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPt @ $Ő5ó‹]Eç‘*y<Ó˙˙D‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList A˙˙GŠoData/K•NameSamAccountName A˙˙?ŠoData'K•Name SidHistory ž,žTžlžž´žܞŸ ŸDŸ$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameSidHistoryTEMPt ´˘ $Ő5ó‹]Eç‘*y<Ó˙˙D‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList A˙˙GŠoData/K•NameSamAccountName A˙˙?ŠoData'K•Name SidHistory |Ł ŁČŁŕ٤(¤P¤t¤”¤¸¤$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameSidHistoryTEMP\ ¨;RŻëŐ]LńÜůżŢę˙˙D‚ EventDataA˙˙?ŠoData'K•Name MemberName A˙˙=ŠoData%K•Name MemberSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList 䨊Š<ŠdŠ|Š ŠÄŠěŠŞMemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMP  Ü­Ń^‡#X˝Q#9Ł$ĺR˙˙vD‚ EventDataA˙˙?ŠoData'K•Name MemberName A˙˙=ŠoData%K•Name MemberSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList A˙˙[ŠoDataCK•NameMembershipExpirationTime ¸ŽÔŽěŽŻ8ŻPŻtŻ˜ŻŔŻäݰMemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList8MembershipExpirationTimeTEMP\ „ł;RŻëŐ]LńÜůżŢę˙˙D‚ EventDataA˙˙?ŠoData'K•Name MemberName A˙˙=ŠoData%K•Name MemberSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList L´h´€´¤´Ě´ä´ľ,ľTľxľMemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPxX¸Vř‡Ô2^‰uhČÁtHj˙˙ŠD‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList ř¸šDš\š€š¤šĚšđš$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPt d˝ $Ő5ó‹]Eç‘*y<Ó˙˙D‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList A˙˙GŠoData/K•NameSamAccountName A˙˙?ŠoData'K•Name SidHistory ,žPžxžž´žŘžż$żDżhż$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameSidHistoryTEMPt Ř $Ő5ó‹]Eç‘*y<Ó˙˙D‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList A˙˙GŠoData/K•NameSamAccountName A˙˙?ŠoData'K•Name SidHistory  ĂÄĂěĂÄ(ÄLÄtĘĸÄÜÄ$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameSidHistoryTEMP\ @Č;RŻëŐ]LńÜůżŢę˙˙D‚ EventDataA˙˙?ŠoData'K•Name MemberName A˙˙=ŠoData%K•Name MemberSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList É$É<É`ɈɠÉÄÉčÉĘ4ĘMemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMP  ÎŃ^‡#X˝Q#9Ł$ĺR˙˙vD‚ EventDataA˙˙?ŠoData'K•Name MemberName A˙˙=ŠoData%K•Name MemberSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList A˙˙[ŠoDataCK•NameMembershipExpirationTime ÜÎřÎĎ4Ď\ĎtĎ˜ĎźĎäĎĐ(ĐMemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList8MembershipExpirationTimeTEMP\ ¨Ó;RŻëŐ]LńÜůżŢę˙˙D‚ EventDataA˙˙?ŠoData'K•Name MemberName A˙˙=ŠoData%K•Name MemberSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList pԌԤÔČÔđÔŐ,ŐPŐxŐœŐMemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPx|ŘVř‡Ô2^‰uhČÁtHj˙˙ŠD‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList Ů@Ůhـ٤ŮČŮđŮÚ$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPt ˆÝ $Ő5ó‹]Eç‘*y<Ó˙˙D‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList A˙˙GŠoData/K•NameSamAccountName A˙˙?ŠoData'K•Name SidHistory PŢtŢœŢ´ŢŘŢüŢ$ßHßhߌß$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameSidHistoryTEMPt ü⠝$Ő5ó‹]Eç‘*y<Ó˙˙D‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList A˙˙GŠoData/K•NameSamAccountName A˙˙?ŠoData'K•Name SidHistory Äăčăä(äLäpä˜äźäÜäĺ$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList$SamAccountNameSidHistoryTEMP\ dč;RŻëŐ]LńÜůżŢę˙˙D‚ EventDataA˙˙?ŠoData'K•Name MemberName A˙˙=ŠoData%K•Name MemberSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList ,éHé`é„éŹéÄéčé ę4ęXęMemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMP  $îŃ^‡#X˝Q#9Ł$ĺR˙˙vD‚ EventDataA˙˙?ŠoData'K•Name MemberName A˙˙=ŠoData%K•Name MemberSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList A˙˙[ŠoDataCK•NameMembershipExpirationTime ďď4ďXď€ď˜ďźďŕďđ,đLđMemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeList8MembershipExpirationTimeTEMP\ Ěó;RŻëŐ]LńÜůżŢę˙˙D‚ EventDataA˙˙?ŠoData'K•Name MemberName A˙˙=ŠoData%K•Name MemberSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList ”ô°ôČôěôő,őPőtőœőŔőMemberNameMemberSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPx řVř‡Ô2^‰uhČÁtHj˙˙ŠD‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList @ůdůŒů¤ůČůěůú8ú$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMP hý#9ďeśK QÄuÎřŕŤ[˙˙ÚD‚ EventDataA˙˙IŠoData1K•NameGroupTypeChange A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList ţ@ţdţŒţ¤ţČţěţ˙8˙$GroupTypeChange$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPÔ č]T.âŸh‡Z´R펚žó8˙˙\D‚ EventDataA˙˙GŠoData/K•NameSourceUserName A˙˙=ŠoData%K•Name SourceSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList A˙˙9ŠoData!K•NameSidList Äč$LdˆŹÔř$SourceUserNameSourceSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListSidListTEMPÔ ź]T.âŸh‡Z´R펚žó8˙˙\D‚ EventDataA˙˙GŠoData/K•NameSourceUserName A˙˙=ŠoData%K•Name SourceSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList A˙˙9ŠoData!K•NameSidList ˜ ź Ô ř  8 \ € ¨ Ě ě $SourceUserNameSourceSid$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListSidListTEMPxŔ Ëw‡[k@XŹţ–×űŁ˙˙ŠD‚ EventDataA˙˙GŠoData/K•NameSourceUserName A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name PrivilegeList `„¨Đč 4X$SourceUserName$TargetUserName(TargetDomainNameTargetSid$SubjectUserName(SubjectDomainName$SubjectLogonId PrivilegeListTEMPřě—ˇ?1ÉhÂTźô JGt›K˙˙>D‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId xœÄÜ$L$TargetUserName(TargetDomainNameTargetSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMP,Ě Hx”\”1Xţݑ˙˙(D‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙AŠoData)K•Name ServiceName A˙˙?ŠoData'K•Name ServiceSid A˙˙EŠoData-K•Name TicketOptions A˙˙7ŠoDataK•NameStatus A˙˙SŠoData;K•NameTicketEncryptionType A˙˙AŠoData)K•Name PreAuthType A˙˙=ŠoData%K•Name IpAddress A˙˙7ŠoDataK•NameIpPort A˙˙GŠoData/K•NameCertIssuerName A˙˙KŠoData3K•NameCertSerialNumber A˙˙GŠoData/K•NameCertThumbprint ä0Hd€ ´ä,Px$TargetUserName(TargetDomainNameTargetSidServiceNameServiceSid TicketOptionsStatus0TicketEncryptionTypePreAuthTypeIpAddressIpPort$CertIssuerName(CertSerialNumber$CertThumbprintTEMP´Hl ĺE´mSPoiă̈L˙˙vD‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙AŠoData)K•Name ServiceName A˙˙?ŠoData'K•Name ServiceSid A˙˙EŠoData-K•Name TicketOptions A˙˙7ŠoDataK•NameStatus A˙˙SŠoData;K•NameTicketEncryptionType A˙˙AŠoData)K•Name PreAuthType A˙˙=ŠoData%K•Name IpAddress A˙˙7ŠoDataK•NameIpPort A˙˙GŠoData/K•NameCertIssuerName A˙˙KŠoData3K•NameCertSerialNumber A˙˙GŠoData/K•NameCertThumbprint A˙˙GŠoData/K•NameResponseTicket t ˜ Ŕ Ř ô !0!D!t!!¨!ź!ŕ!","$TargetUserName(TargetDomainNameTargetSidServiceNameServiceSid TicketOptionsStatus0TicketEncryptionTypePreAuthTypeIpAddressIpPort$CertIssuerName(CertSerialNumber$CertThumbprint$ResponseTicketTEMPÔ t*:ÍâpiޏWűťźŠ“ˆaS˙˙îD‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙AŠoData)K•Name ServiceName A˙˙?ŠoData'K•Name ServiceSid A˙˙EŠoData-K•Name TicketOptions A˙˙7ŠoDataK•NameStatus A˙˙SŠoData;K•NameTicketEncryptionType A˙˙AŠoData)K•Name PreAuthType A˙˙=ŠoData%K•Name IpAddress A˙˙7ŠoDataK•NameIpPort A˙˙GŠoData/K•NameCertIssuerName A˙˙KŠoData3K•NameCertSerialNumber A˙˙GŠoData/K•NameCertThumbprint A˙˙GŠoData/K•NameResponseTicket A˙˙iŠoDataQK•NameAccountSupportedEncryptionTypes A˙˙SŠoData;K•NameAccountAvailableKeys A˙˙iŠoDataQK•NameServiceSupportedEncryptionTypes A˙˙SŠoData;K•NameServiceAvailableKeys A˙˙_ŠoDataGK•NameDCSupportedEncryptionTypes A˙˙IŠoData1K•NameDCAvailableKeys A˙˙iŠoDataQK•NameClientAdvertizedEncryptionTypes A˙˙[ŠoDataCK•NameSessionKeyEncryptionType A˙˙UŠoData=K•NamePreAuthEncryptionType T,x, ,¸,Ô,đ,-$-T-p-ˆ-œ-Ŕ-č- .0.t.¤.č./T/x/ź/ô/$TargetUserName(TargetDomainNameTargetSidServiceNameServiceSid TicketOptionsStatus0TicketEncryptionTypePreAuthTypeIpAddressIpPort$CertIssuerName(CertSerialNumber$CertThumbprint$ResponseTicketDAccountSupportedEncryptionTypes0AccountAvailableKeysDServiceSupportedEncryptionTypes0ServiceAvailableKeys<DCSupportedEncryptionTypes$DCAvailableKeysDClientAdvertizedEncryptionTypes8SessionKeyEncryptionType0PreAuthEncryptionTypeTEMP ˜5˝ŒÍĆ]ŸV•cěů…]˙˙@D‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙=ŠoData%K•Name TargetSid A˙˙?ŠoData'K•Name DeviceName A˙˙AŠoData)K•Name ServiceName A˙˙?ŠoData'K•Name ServiceSid A˙˙EŠoData-K•Name TicketOptions A˙˙7ŠoDataK•NameStatus A˙˙SŠoData;K•NameTicketEncryptionType A˙˙AŠoData)K•Name PreAuthType A˙˙=ŠoData%K•Name IpAddress A˙˙7ŠoDataK•NameIpPort A˙˙GŠoData/K•NameCertIssuerName A˙˙KŠoData3K•NameCertSerialNumber A˙˙GŠoData/K•NameCertThumbprint A˙˙;ŠoData#K•NameSiloName A˙˙?ŠoData'K•Name PolicyName A˙˙CŠoData+K•Name TGT Lifetime 7$7L7d7€7œ7¸7Ř7ě7888P8d8ˆ8°8Ô8ě89$TargetUserName(TargetDomainNameTargetSidDeviceNameServiceNameServiceSid TicketOptionsStatus0TicketEncryptionTypePreAuthTypeIpAddressIpPort$CertIssuerName(CertSerialNumber$CertThumbprintSiloNamePolicyName TGT LifetimeTEMP´ ¨<ŔCukÎ3T(‰l7œ(˙˙JD‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙AŠoData)K•Name ServiceName A˙˙?ŠoData'K•Name ServiceSid A˙˙EŠoData-K•Name TicketOptions A˙˙SŠoData;K•NameTicketEncryptionType A˙˙=ŠoData%K•Name IpAddress A˙˙7ŠoDataK•NameIpPort A˙˙7ŠoDataK•NameStatus A˙˙=ŠoData%K•Name LogonGuid A˙˙QŠoData9K•NameTransmittedServices „=¨=Đ=ě=>(>X>p>„>˜>°>$TargetUserName(TargetDomainNameServiceNameServiceSid TicketOptions0TicketEncryptionTypeIpAddressIpPortStatusLogonGuid,TransmittedServicesTEMPŘ C—ćI§ÄŇ˝QŠLŽ’ý ž˙˙ôD‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙AŠoData)K•Name ServiceName A˙˙?ŠoData'K•Name ServiceSid A˙˙EŠoData-K•Name TicketOptions A˙˙SŠoData;K•NameTicketEncryptionType A˙˙=ŠoData%K•Name IpAddress A˙˙7ŠoDataK•NameIpPort A˙˙7ŠoDataK•NameStatus A˙˙=ŠoData%K•Name LogonGuid A˙˙QŠoData9K•NameTransmittedServices A˙˙MŠoData5K•NameRequestTicketHash A˙˙OŠoData7K•NameResponseTicketHash D,DTDpDŒDŹDÜDôDEE4E`EˆE$TargetUserName(TargetDomainNameServiceNameServiceSid TicketOptions0TicketEncryptionTypeIpAddressIpPortStatusLogonGuid,TransmittedServices(RequestTicketHash,ResponseTicketHashTEMPX řL‚H•¨Łˆâ]j@™ăÄo˘ˇ˙˙D‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙AŠoData)K•Name ServiceName A˙˙?ŠoData'K•Name ServiceSid A˙˙EŠoData-K•Name TicketOptions A˙˙SŠoData;K•NameTicketEncryptionType A˙˙=ŠoData%K•Name IpAddress A˙˙7ŠoDataK•NameIpPort A˙˙7ŠoDataK•NameStatus A˙˙=ŠoData%K•Name LogonGuid A˙˙QŠoData9K•NameTransmittedServices A˙˙MŠoData5K•NameRequestTicketHash A˙˙OŠoData7K•NameResponseTicketHash A˙˙iŠoDataQK•NameAccountSupportedEncryptionTypes A˙˙SŠoData;K•NameAccountAvailableKeys A˙˙iŠoDataQK•NameServiceSupportedEncryptionTypes A˙˙SŠoData;K•NameServiceAvailableKeys A˙˙_ŠoDataGK•NameDCSupportedEncryptionTypes A˙˙IŠoData1K•NameDCAvailableKeys A˙˙iŠoDataQK•NameClientAdvertizedEncryptionTypes A˙˙[ŠoDataCK•NameSessionKeyEncryptionType œNŔNčNO O@OpOˆOœO°OČOôOPHPŒPźPQ0QlQQÔQ$TargetUserName(TargetDomainNameServiceNameServiceSid TicketOptions0TicketEncryptionTypeIpAddressIpPortStatusLogonGuid,TransmittedServices(RequestTicketHash,ResponseTicketHashDAccountSupportedEncryptionTypes0AccountAvailableKeysDServiceSupportedEncryptionTypes0ServiceAvailableKeys<DCSupportedEncryptionTypes$DCAvailableKeysDClientAdvertizedEncryptionTypes8SessionKeyEncryptionTypeTEMPTV.ť‡gĹ˝Rü“wČ2Ĺ=˙˙D‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙?ŠoData'K•Name DeviceName A˙˙AŠoData)K•Name ServiceName A˙˙?ŠoData'K•Name ServiceSid A˙˙EŠoData-K•Name TicketOptions A˙˙SŠoData;K•NameTicketEncryptionType A˙˙=ŠoData%K•Name IpAddress A˙˙7ŠoDataK•NameIpPort A˙˙7ŠoDataK•NameStatus A˙˙=ŠoData%K•Name LogonGuid A˙˙MŠoData5K•NameTransitedServices A˙˙;ŠoData#K•NameSiloName A˙˙?ŠoData'K•Name PolicyName lWW¸WÔWđW X,X\XtXˆXœX´XÜXôX$TargetUserName(TargetDomainNameDeviceNameServiceNameServiceSid TicketOptions0TicketEncryptionTypeIpAddressIpPortStatusLogonGuid(TransitedServicesSiloNamePolicyNameTEMPD´[+Ě$„d[QöĐ ŠŸYžä˙˙pD‚ EventDataA˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙AŠoData)K•Name ServiceName A˙˙?ŠoData'K•Name ServiceSid A˙˙EŠoData-K•Name TicketOptions A˙˙SŠoData;K•NameTicketEncryptionType A˙˙=ŠoData%K•Name IpAddress A˙˙7ŠoDataK•NameIpPort T\x\ \ź\Ř\ř\(]@]$TargetUserName(TargetDomainNameServiceNameServiceSid TicketOptions0TicketEncryptionTypeIpAddressIpPortTEMPl ¤`DO6°gíšSŞż˙˙D‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙CŠoData+K•Name ObjectServer A˙˙?ŠoData'K•Name ObjectType A˙˙=ŠoData%K•Name AddedCAPs A˙˙AŠoData)K•Name DeletedCAPs A˙˙CŠoData+K•Name ModifiedCAPs A˙˙;ŠoData#K•NameAsIsCAPs üř ůDůlůů°ůĚůäůú ú$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId ObjectServerObjectTypeAddedCAPsDeletedCAPs ModifiedCAPsAsIsCAPsTEMPü˜˙Öôˇzčž_•<3Xäj˙˙*D‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙AŠoData)K•Name LoadOptions A˙˙IŠoData1K•NameAdvancedOptions A˙˙OŠoData7K•NameConfigAccessPolicy A˙˙OŠoData7K•NameRemoteEventLogging A˙˙AŠoData)K•Name KernelDebug A˙˙EŠoData-K•Name VsmLaunchType A˙˙AŠoData)K•Name TestSigning A˙˙EŠoData-K•Name FlightSigning A˙˙WŠoData?K•NameDisableIntegrityChecks A˙˙UŠoData=K•NameHypervisorLoadOptions A˙˙SŠoData;K•NameHypervisorLaunchType A˙˙IŠoData1K•NameHypervisorDebug Řü HlˆŹŘ @\|°ŕ$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdLoadOptions$AdvancedOptions,ConfigAccessPolicy,RemoteEventLoggingKernelDebug VsmLaunchTypeTestSigning FlightSigning4DisableIntegrityChecks0HypervisorLoadOptions0HypervisorLaunchType$HypervisorDebugTEMP$ĚčĽxTÁ>Qb!ĂM’÷›ˆ˙˙bD‚ EventDataA˙˙QŠoData9K•NameCollisionTargetType A˙˙QŠoData9K•NameCollisionTargetName A˙˙?ŠoData'K•Name ForestRoot A˙˙CŠoData+K•Name TopLevelName A˙˙9ŠoData!K•NameDnsName A˙˙AŠoData)K•Name NetbiosName A˙˙=ŠoData%K•Name DomainSid A˙˙5ŠoDataK•NameFlags l˜Äŕ0H,CollisionTargetType,CollisionTargetNameForestRoot TopLevelNameDnsNameNetbiosNameDomainSidFlagsTEMP€ X Ű79ŸşŠŹYߗŰ^ʧ˙˙ĘD‚ EventDataA˙˙?ŠoData'K•Name ForestRoot A˙˙EŠoData-K•Name ForestRootSid A˙˙AŠoData)K•Name OperationId A˙˙=ŠoData%K•Name EntryType A˙˙5ŠoDataK•NameFlags A˙˙CŠoData+K•Name TopLevelName A˙˙9ŠoData!K•NameDnsName A˙˙AŠoData)K•Name NetbiosName A˙˙=ŠoData%K•Name DomainSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId \ x ˜ ´ Ě Ü ü  , D h Œ ´ ForestRoot ForestRootSidOperationIdEntryTypeFlags TopLevelNameDnsNameNetbiosNameDomainSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMP€ ŘŰ79ŸşŠŹYߗŰ^ʧ˙˙ĘD‚ EventDataA˙˙?ŠoData'K•Name ForestRoot A˙˙EŠoData-K•Name ForestRootSid A˙˙AŠoData)K•Name OperationId A˙˙=ŠoData%K•Name EntryType A˙˙5ŠoDataK•NameFlags A˙˙CŠoData+K•Name TopLevelName A˙˙9ŠoData!K•NameDnsName A˙˙AŠoData)K•Name NetbiosName A˙˙=ŠoData%K•Name DomainSid A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId Üř4L\|ŹÄč 4ForestRoot ForestRootSidOperationIdEntryTypeFlags TopLevelNameDnsNameNetbiosNameDomainSid$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMP€ XX„DÔ×,QG/Ůčř…|˙˙ĘD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙?ŠoData'K•Name ForestRoot A˙˙EŠoData-K•Name ForestRootSid A˙˙AŠoData)K•Name OperationId A˙˙=ŠoData%K•Name EntryType A˙˙5ŠoDataK•NameFlags A˙˙CŠoData+K•Name TopLevelName A˙˙9ŠoData!K•NameDnsName A˙˙AŠoData)K•Name NetbiosName A˙˙=ŠoData%K•Name DomainSid \€¤Ěđ ,H`p¤Ŕ$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdForestRoot ForestRootSidOperationIdEntryTypeFlags TopLevelNameDnsNameNetbiosNameDomainSidTEMPäŹt'˝ƒ§‰'Q/_és Ç:Ű˙˙žD‚ EventDataA˙˙=ŠoData%K•Name RequestId A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId (Lp˜RequestId$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMPät'˝ƒ§‰'Q/_és Ç:Ű˙˙žD‚ EventDataA˙˙=ŠoData%K•Name RequestId A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId ô 0 T | RequestId$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMP¨ŕ"\ąŠ9Q_é]M4CertificateDatabaseHash0PrivateKeyUsageCount(CACertificateHash$CAPublicKeyHashTEMPtŔ?Oʜ3vóVCŽME`ac˙˙ZD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId @4@X@€@$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMP„B¤ç-mĄ\Ţl‡Ź7Ő0ć˙˙ŹD‚ EventDataA˙˙KŠoData3K•NameSecuritySettings A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId čBC4CXC€C(SecuritySettings$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMPäxEt'˝ƒ§‰'Q/_és Ç:Ű˙˙žD‚ EventDataA˙˙=ŠoData%K•Name RequestId A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId ÜEôEF¨f`ź˙˙D‚ EventDataA˙˙GŠoData/K•NameDestinationDRA A˙˙=ŠoData%K•Name SourceDRA A˙˙EŠoData-K•Name NamingContext A˙˙9ŠoData!K•NameOptions A˙˙=ŠoData%K•Name SessionID A˙˙7ŠoDataK•NameEndUSN A˙˙?ŠoData'K•Name StatusCode řŘŮ4ŮTŮhـٔŮ$DestinationDRASourceDRA NamingContextOptionsSessionIDEndUSNStatusCodeTEMPxäŰšŒČüTý—k5•ńÎ˙˙D‚ EventDataA˙˙GŠoData/K•NameDestinationDRA A˙˙=ŠoData%K•Name SourceDRA A˙˙EŠoData-K•Name NamingContext A˙˙9ŠoData!K•NameOptions  A˙˙=ŠoData%K•Name SessionID A˙˙7ŠoDataK•NameEndUSN A˙˙?ŠoData'K•Name StatusCode pÜ”ÜŹÜ ĚÜŕÜřÜ Ý$DestinationDRASourceDRA NamingContextOptionsSessionIDEndUSNStatusCodeTEMPPHßË܇4,>_&CF`íתÎ˙˙ęD‚ EventDataA˙˙=ŠoData%K•Name SessionID A˙˙7ŠoDataK•NameObject A˙˙=ŠoData%K•Name Attribute A˙˙CŠoData+K•Name TypeOfChange A˙˙;ŠoData#K•NameNewValue A˙˙1ŠoDataK•NameUSN A˙˙?ŠoData'K•Name StatusCode Ôßěßŕŕ8ŕPŕ\ŕSessionIDObjectAttribute TypeOfChangeNewValue USNStatusCodeTEMPdháëšŢÎ;XűďE•Lp|á˙˙źD‚ EventDataA˙˙KŠoData3K•NameReplicationEvent A˙˙IŠoData1K•NameAuditStatusCode á¸á(ReplicationEvent$AuditStatusCodeTEMP(ăŸl깎§ŮPIK- `’_“˙˙D‚ EventDataA˙˙KŠoData3K•NameReplicationEvent A˙˙IŠoData1K•NameAuditStatusCode A˙˙UŠoData=K•NameReplicationStatusCode dăŒă°ă(ReplicationEvent$AuditStatusCode0ReplicationStatusCodeTEMPˆ„ĺ™^2‡ÝQ_Ťœuä;€’˙˙pD‚ EventDataA˙˙GŠoData/K•NameDestinationDRA A˙˙=ŠoData%K•Name SourceDRA A˙˙7ŠoDataK•NameObject A˙˙9ŠoData!K•NameOptions A˙˙?ŠoData'K•Name StatusCode čĺ ć$ć8ćLć$DestinationDRASourceDRAObjectOptionsStatusCodeTEMPˆ číĚÓ ćľW¸ŚâfOő€˙˙pD‚ EventDataA˙˙GŠoData/K•NameDestinationDRA A˙˙=ŠoData%K•Name SourceDRA A˙˙7ŠoDataK•NameObject A˙˙9ŠoData!K•NameOptions  A˙˙?ŠoData'K•Name StatusCode pč”čŹč ŔčÔč$DestinationDRASourceDRAObjectOptionsStatusCodeTEMPx¤ë´"gŐ šSQŔź~˛ĐÎ<˙˙€D‚ EventDataA˙˙OŠoData7K•NameGroupPolicyApplied A˙˙9ŠoData!K•NameProfile A˙˙EŠoData-K•Name OperationMode A˙˙OŠoData7K•NameRemoteAdminEnabled A˙˙UŠoData=K•NameMulticastFlowsEnabled A˙˙[ŠoDataCK•NameLogDroppedPacketsEnabled A˙˙iŠoDataQK•NameLogSuccessfulConnectionsEnabled 0ě\ěpěěźěěě$í,GroupPolicyAppliedProfile OperationMode,RemoteAdminEnabled0MulticastFlowsEnabled8LogDroppedPacketsEnabledDLogSuccessfulConnectionsEnabledTEMPœ€îňNǖŰü\ÔüMŐkžÓś˙˙âD‚ EventDataA˙˙AŠoData)K•Name ProfileUsed A˙˙7ŠoDataK•NameRuleId A˙˙;ŠoData#K•NameRuleName źîŘîěîProfileUsedRuleIdRuleNameTEMP¨ đtźMeEĽŢZí˘ÇĹW $˙˙čD‚ EventDataA˙˙GŠoData/K•NameProfileChanged A˙˙7ŠoDataK•NameRuleId A˙˙;ŠoData#K•NameRuleName \đ€đ”đ$ProfileChangedRuleIdRuleNameTEMP¨ČńtźMeEĽŢZí˘ÇĹW $˙˙čD‚ EventDataA˙˙GŠoData/K•NameProfileChanged A˙˙7ŠoDataK•NameRuleId A˙˙;ŠoData#K•NameRuleName ň(ň<ň$ProfileChangedRuleIdRuleNameTEMP¨pótźMeEĽŢZí˘ÇĹW $˙˙čD‚ EventDataA˙˙GŠoData/K•NameProfileChanged A˙˙7ŠoDataK•NameRuleId A˙˙;ŠoData#K•NameRuleName ŹóĐóäó$ProfileChangedRuleIdRuleNameTEMPĚ,ő´`I5­Q\}ŃҘĄ˛˘3˙˙úD‚ EventDataA˙˙GŠoData/K•NameProfileChanged A˙˙AŠoData)K•Name SettingType A˙˙CŠoData+K•Name SettingValue hőŒő¨ő$ProfileChangedSettingType SettingValueTEMPŒŘöřXž† [ZëL|ĐőZăp˙˙ÚD‚ EventDataA˙˙9ŠoData!K•NameProfile A˙˙7ŠoDataK•NameRuleId A˙˙;ŠoData#K•NameRuleName ÷(÷<÷ProfileRuleIdRuleNameTEMPŒdřřXž† [ZëL|ĐőZăp˙˙ÚD‚ EventDataA˙˙9ŠoData!K•NameProfile A˙˙7ŠoDataK•NameRuleId A˙˙;ŠoData#K•NameRuleName  ř´řČřProfileRuleIdRuleNameTEMP Dú!’˙ˆCS˝ýsKďNtŠ˙˙0D‚ EventDataA˙˙9ŠoData!K•NameProfile A˙˙OŠoData7K•NameReasonForRejection A˙˙7ŠoDataK•NameRuleId A˙˙;ŠoData#K•NameRuleName ”ú¨úÔúčúProfile,ReasonForRejectionRuleIdRuleNameTEMPĐœűÓ:ća7 ŁSşš˝đՑ0J˙˙fD‚ EventDataA˙˙EŠoData-K•Name ActiveProfile °ű ActiveProfileTEMPŕü,ˆ8ń#˜JTC¤Ř,íŰ´\˙˙ÜD‚ EventDataA˙˙7ŠoDataK•NameRuleId A˙˙;ŠoData#K•NameRuleName A˙˙;ŠoData#K•NameRuleAttr ý0ýHýRuleIdRuleNameRuleAttrTEMPč¨ţŘ:b#źć$_%eůZŔ†0˙˙D‚ EventDataA˙˙7ŠoDataK•NameRuleId A˙˙;ŠoData#K•NameRuleName A˙˙5ŠoDataK•NameError A˙˙7ŠoDataK•NameReason řţ ˙$˙4˙RuleIdRuleNameErrorReasonTEMPŔtŕ¤OŐViCŸo0—”.˙˙öD‚ EventDataA˙˙MŠoData5K•NameCallerProcessName A˙˙=ŠoData%K•Name ProcessId A˙˙=ŠoData%K•Name Publisher °Řđ(CallerProcessNameProcessIdPublisherTEMP(ÜN5í/PoX`HŽ*<8˙˙žD‚ EventDataA˙˙EŠoData-K•Name RemoteAddress A˙˙1ŠoDataK•NameSPI $ RemoteAddress SPITEMP(N5í/PoX`HŽ*<8˙˙žD‚ EventDataA˙˙EŠoData-K•Name RemoteAddress A˙˙1ŠoDataK•NameSPI ,L RemoteAddress SPITEMP(,N5í/PoX`HŽ*<8˙˙žD‚ EventDataA˙˙EŠoData-K•Name RemoteAddress A˙˙1ŠoDataK•NameSPI Tt RemoteAddress SPITEMP(TN5í/PoX`HŽ*<8˙˙žD‚ EventDataA˙˙EŠoData-K•Name RemoteAddress A˙˙1ŠoDataK•NameSPI |œ RemoteAddress SPITEMP(|N5í/PoX`HŽ*<8˙˙žD‚ EventDataA˙˙EŠoData-K•Name RemoteAddress A˙˙1ŠoDataK•NameSPI ¤Ä RemoteAddress SPITEMPč l ĎŘoŠ[ĂUTaV+űeƒ=˙˙fD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙=ŠoData%K•Name LogonGuid A˙˙EŠoData-K•Name TargetUserSid A˙˙GŠoData/K•NameTargetUserName A˙˙KŠoData3K•NameTargetDomainName A˙˙EŠoData-K•Name TargetLogonId A˙˙IŠoData1K•NameTargetLogonGuid A˙˙9ŠoData!K•NameSidList H l  ¸ Ü ô  8 ` € ¤ $SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdLogonGuid TargetUserSid$TargetUserName(TargetDomainName TargetLogonId$TargetLogonGuidSidListTEMPÄä ŔA|ďoT<'˛D˙˙öD‚ EventDataA˙˙CŠoData+K•Name LocalAddress A˙˙EŠoData-K•Name RemoteAddress A˙˙?ŠoData'K•Name KeyModName  @` LocalAddress RemoteAddressKeyModNameTEMPĨŔA|ďoT<'˛D˙˙öD‚ EventDataA˙˙CŠoData+K•Name LocalAddress A˙˙EŠoData-K•Name RemoteAddress A˙˙?ŠoData'K•Name KeyModName ä$ LocalAddress RemoteAddressKeyModNameTEMPÄlŔA|ďoT<'˛D˙˙öD‚ EventDataA˙˙CŠoData+K•Name LocalAddress A˙˙EŠoData-K•Name RemoteAddress A˙˙?ŠoData'K•Name KeyModName ¨Čč LocalAddress RemoteAddressKeyModNameTEMP  %ÓžMĆëV?¸ńäŃĄ,—˙˙fD‚ EventDataA˙˙SŠoData;K•NameLocalMMPrincipalName A˙˙UŠoData=K•NameRemoteMMPrincipalName A˙˙CŠoData+K•Name LocalAddress A˙˙IŠoData1K•NameLocalKeyModPort A˙˙EŠoData-K•Name RemoteAddress A˙˙KŠoData3K•NameRemoteKeyModPort A˙˙CŠoData+K•Name MMAuthMethod A˙˙AŠoData)K•Name MMCipherAlg A˙˙GŠoData/K•NameMMIntegrityAlg A˙˙9ŠoData!K•NameDHGroup A˙˙?ŠoData'K•Name MMLifetime A˙˙9ŠoData!K•NameQMLimit A˙˙3ŠoDataK•NameRole A˙˙SŠoData;K•NameMMImpersonationState A˙˙?ŠoData'K•Name MMFilterID  A˙˙7ŠoDataK•NameMMSAID  A˙˙SŠoData;K•NameLocalEMPrincipalName A˙˙UŠoData=K•NameRemoteEMPrincipalName A˙˙CŠoData+K•Name EMAuthMethod A˙˙SŠoData;K•NameEMImpersonationState A˙˙?ŠoData'K•Name QMFilterID  Dt¤Äč0Pl¤ŔÔä  0Dt¤Ä ô0LocalMMPrincipalName0RemoteMMPrincipalName LocalAddress$LocalKeyModPort RemoteAddress(RemoteKeyModPort MMAuthMethodMMCipherAlg$MMIntegrityAlgDHGroupMMLifetimeQMLimitRole0MMImpersonationStateMMFilterIDMMSAID0LocalEMPrincipalName0RemoteEMPrincipalName EMAuthMethod0EMImpersonationStateQMFilterIDTEMPČ D%şœĽÇF‡wRj\Ľ*ké˙˙ţD‚ EventDataA˙˙SŠoData;K•NameLocalMMPrincipalName A˙˙UŠoData=K•NameRemoteMMPrincipalName A˙˙CŠoData+K•Name LocalAddress A˙˙IŠoData1K•NameLocalKeyModPort A˙˙EŠoData-K•Name RemoteAddress A˙˙KŠoData3K•NameRemoteKeyModPort A˙˙CŠoData+K•Name MMAuthMethod A˙˙AŠoData)K•Name MMCipherAlg A˙˙GŠoData/K•NameMMIntegrityAlg A˙˙9ŠoData!K•NameDHGroup A˙˙?ŠoData'K•Name MMLifetime A˙˙9ŠoData!K•NameQMLimit A˙˙3ŠoDataK•NameRole A˙˙SŠoData;K•NameMMImpersonationState A˙˙?ŠoData'K•Name MMFilterID  A˙˙7ŠoDataK•NameMMSAID  A˙˙SŠoData;K•NameLocalEMPrincipalName A˙˙IŠoData1K•NameLocalEMCertHash A˙˙KŠoData3K•NameLocalEMIssuingCA A˙˙EŠoData-K•Name LocalEMRootCA A˙˙UŠoData=K•NameRemoteEMPrincipalName A˙˙KŠoData3K•NameRemoteEMCertHash A˙˙MŠoData5K•NameRemoteEMIssuingCA A˙˙GŠoData/K•NameRemoteEMRootCA A˙˙SŠoData;K•NameEMImpersonationState A˙˙?ŠoData'K•Name QMFilterID  L'|'Ź'Ě'đ'(8(X(t(˜(Ź(Č(Ü(ě( ) 8)L)|) )Č)č)*@*h*Œ* ź*0LocalMMPrincipalName0RemoteMMPrincipalName LocalAddress$LocalKeyModPort RemoteAddress(RemoteKeyModPort MMAuthMethodMMCipherAlg$MMIntegrityAlgDHGroupMMLifetimeQMLimitRole0MMImpersonationStateMMFilterIDMMSAID0LocalEMPrincipalName$LocalEMCertHash(LocalEMIssuingCA LocalEMRootCA0RemoteEMPrincipalName(RemoteEMCertHash(RemoteEMIssuingCA$RemoteEMRootCA0EMImpersonationStateQMFilterIDTEMPČ  3$36$çĆÖ\V_#•ŕjë˙˙ţD‚ EventDataA˙˙SŠoData;K•NameLocalMMPrincipalName A˙˙IŠoData1K•NameLocalMMCertHash A˙˙KŠoData3K•NameLocalMMIssuingCA A˙˙EŠoData-K•Name LocalMMRootCA A˙˙UŠoData=K•NameRemoteMMPrincipalName A˙˙KŠoData3K•NameRemoteMMCertHash A˙˙MŠoData5K•NameRemoteMMIssuingCA A˙˙GŠoData/K•NameRemoteMMRootCA A˙˙CŠoData+K•Name LocalAddress A˙˙IŠoData1K•NameLocalKeyModPort A˙˙EŠoData-K•Name RemoteAddress A˙˙KŠoData3K•NameRemoteKeyModPort A˙˙AŠoData)K•Name MMCipherAlg A˙˙GŠoData/K•NameMMIntegrityAlg A˙˙9ŠoData!K•NameDHGroup A˙˙?ŠoData'K•Name MMLifetime A˙˙9ŠoData!K•NameQMLimit A˙˙3ŠoDataK•NameRole A˙˙SŠoData;K•NameMMImpersonationState A˙˙?ŠoData'K•Name MMFilterID  A˙˙7ŠoDataK•NameMMSAID  A˙˙SŠoData;K•NameLocalEMPrincipalName A˙˙UŠoData=K•NameRemoteEMPrincipalName A˙˙CŠoData+K•Name EMAuthMethod A˙˙SŠoData;K•NameEMImpersonationState A˙˙?ŠoData'K•Name QMFilterID  5D5h55°5ŕ5606T6t6˜6¸6ŕ6ü6 747P7d7t7 ¤7 Ŕ7Ô7848T8 „80LocalMMPrincipalName$LocalMMCertHash(LocalMMIssuingCA LocalMMRootCA0RemoteMMPrincipalName(RemoteMMCertHash(RemoteMMIssuingCA$RemoteMMRootCA LocalAddress$LocalKeyModPort RemoteAddress(RemoteKeyModPortMMCipherAlg$MMIntegrityAlgDHGroupMMLifetimeQMLimitRole0MMImpersonationStateMMFilterIDMMSAID0LocalEMPrincipalName0RemoteEMPrincipalName EMAuthMethod0EMImpersonationStateQMFilterIDTEMP BT­@š3¤PťŢŞçđ0Ýć˙˙L D‚ EventDataA˙˙SŠoData;K•NameLocalMMPrincipalName A˙˙IŠoData1K•NameLocalMMCertHash A˙˙KŠoData3K•NameLocalMMIssuingCA A˙˙EŠoData-K•Name LocalMMRootCA A˙˙UŠoData=K•NameRemoteMMPrincipalName A˙˙KŠoData3K•NameRemoteMMCertHash A˙˙MŠoData5K•NameRemoteMMIssuingCA A˙˙GŠoData/K•NameRemoteMMRootCA A˙˙IŠoData1K•NameLocalKeyModPort A˙˙EŠoData-K•Name RemoteAddress A˙˙KŠoData3K•NameRemoteKeyModPort A˙˙AŠoData)K•Name MMCipherAlg A˙˙GŠoData/K•NameMMIntegrityAlg A˙˙9ŠoData!K•NameDHGroup A˙˙?ŠoData'K•Name MMLifetime A˙˙9ŠoData!K•NameQMLimit A˙˙3ŠoDataK•NameRole A˙˙SŠoData;K•NameMMImpersonationState A˙˙?ŠoData'K•Name MMFilterID  A˙˙7ŠoDataK•NameMMSAID  A˙˙SŠoData;K•NameLocalEMPrincipalName A˙˙IŠoData1K•NameLocalEMCertHash A˙˙KŠoData3K•NameLocalEMIssuingCA A˙˙EŠoData-K•Name LocalEMRootCA A˙˙UŠoData=K•NameRemoteEMPrincipalName A˙˙KŠoData3K•NameRemoteEMCertHash A˙˙MŠoData5K•NameRemoteEMIssuingCA A˙˙GŠoData/K•NameRemoteEMRootCA A˙˙SŠoData;K•NameEMImpersonationState A˙˙?ŠoData'K•Name QMFilterID  xD¨DĚDôDEDElE”E¸EÜEüE$F@FdFxF”F¨F¸F čF GGHGlG”G´GäG H4HXH ˆH0LocalMMPrincipalName$LocalMMCertHash(LocalMMIssuingCA LocalMMRootCA0RemoteMMPrincipalName(RemoteMMCertHash(RemoteMMIssuingCA$RemoteMMRootCA$LocalKeyModPort RemoteAddress(RemoteKeyModPortMMCipherAlg$MMIntegrityAlgDHGroupMMLifetimeQMLimitRole0MMImpersonationStateMMFilterIDMMSAID0LocalEMPrincipalName$LocalEMCertHash(LocalEMIssuingCA LocalEMRootCA0RemoteEMPrincipalName(RemoteEMCertHash(RemoteEMIssuingCA$RemoteEMRootCA0EMImpersonationStateQMFilterIDTEMPŹ pN =źHŽ4QœŰ‰N-˙˙–D‚ EventDataA˙˙SŠoData;K•NameLocalEMPrincipalName A˙˙IŠoData1K•NameLocalEMCertHash A˙˙KŠoData3K•NameLocalEMIssuingCA A˙˙EŠoData-K•Name LocalEMRootCA A˙˙UŠoData=K•NameRemoteEMPrincipalName A˙˙KŠoData3K•NameRemoteEMCertHash A˙˙MŠoData5K•NameRemoteEMIssuingCA A˙˙GŠoData/K•NameRemoteEMRootCA A˙˙CŠoData+K•Name LocalAddress A˙˙IŠoData1K•NameLocalKeyModPort A˙˙EŠoData-K•Name RemoteAddress A˙˙KŠoData3K•NameRemoteKeyModPort A˙˙CŠoData+K•Name FailurePoint A˙˙EŠoData-K•Name FailureReason A˙˙5ŠoDataK•NameState A˙˙3ŠoDataK•NameRole A˙˙SŠoData;K•NameEMImpersonationState A˙˙?ŠoData'K•Name QMFilterID  ŘOP,PTPtP¤PĚPôPQ8Q\Q|Q¤QÄQäQôQR 4R0LocalEMPrincipalName$LocalEMCertHash(LocalEMIssuingCA LocalEMRootCA0RemoteEMPrincipalName(RemoteEMCertHash(RemoteEMIssuingCA$RemoteEMRootCA LocalAddress$LocalKeyModPort RemoteAddress(RemoteKeyModPort FailurePoint FailureReasonStateRole0EMImpersonationStateQMFilterIDTEMPđ „VĘ8"Ojq^ÄOţž'˙˙˙ţD‚ EventDataA˙˙SŠoData;K•NameLocalEMPrincipalName A˙˙UŠoData=K•NameRemoteEMPrincipalName A˙˙CŠoData+K•Name LocalAddress A˙˙IŠoData1K•NameLocalKeyModPort A˙˙EŠoData-K•Name RemoteAddress A˙˙KŠoData3K•NameRemoteKeyModPort A˙˙CŠoData+K•Name FailurePoint A˙˙EŠoData-K•Name FailureReason A˙˙CŠoData+K•Name EMAuthMethod A˙˙5ŠoDataK•NameState A˙˙3ŠoDataK•NameRole A˙˙SŠoData;K•NameEMImpersonationState A˙˙?ŠoData'K•Name QMFilterID ˆW¸WčWX,XLXtX”X´XÔXäXôX $Y0LocalEMPrincipalName0RemoteEMPrincipalName LocalAddress$LocalKeyModPort RemoteAddress(RemoteKeyModPort FailurePoint FailureReason EMAuthMethodStateRole0EMImpersonationStateQMFilterIDTEMP´ĚYxŐs醖ŔXŕľů Čyô˙˙XD‚ EventDataA˙˙7ŠoDataK•NamePolicy ŕYPolicyTEMPźZ_˜ëÂTSƒťí<”Ŕł§˙˙”D‚ EventDataA˙˙7ŠoDataK•NamePolicy A˙˙5ŠoDataK•NameError äZřZPolicyErrorTEMP´”[xŐs醖ŔXŕľů Čyô˙˙XD‚ EventDataA˙˙7ŠoDataK•NamePolicy ¨[PolicyTEMP„\_˜ëÂTSƒťí<”Ŕł§˙˙”D‚ EventDataA˙˙7ŠoDataK•NamePolicy A˙˙5ŠoDataK•NameError Ź\Ŕ\PolicyErrorTEMP´\]xŐs醖ŔXŕľů Čyô˙˙XD‚ EventDataA˙˙7ŠoDataK•NamePolicy p]PolicyTEMPL^_˜ëÂTSƒťí<”Ŕł§˙˙”D‚ EventDataA˙˙7ŠoDataK•NamePolicy A˙˙5ŠoDataK•NameError t^ˆ^PolicyErrorTEMP`__˜ëÂTSƒťí<”Ŕł§˙˙”D‚ EventDataA˙˙7ŠoDataK•NamePolicy A˙˙5ŠoDataK•NameError ˆ_œ_PolicyErrorTEMP´8`xŐs醖ŔXŕľů Čyô˙˙XD‚ EventDataA˙˙7ŠoDataK•NamePolicy L`PolicyTEMP(a_˜ëÂTSƒťí<”Ŕł§˙˙”D‚ EventDataA˙˙7ŠoDataK•NamePolicy A˙˙5ŠoDataK•NameError PadaPolicyErrorTEMP´bxŐs醖ŔXŕľů Čyô˙˙XD‚ EventDataA˙˙7ŠoDataK•NamePolicy bPolicyTEMPđb_˜ëÂTSƒťí<”Ŕł§˙˙”D‚ EventDataA˙˙7ŠoDataK•NamePolicy A˙˙5ŠoDataK•NameError c,cPolicyErrorTEMP8dRZyz,7ŠZôŸIŤBŢN˙˙ŚD‚ EventDataA˙˙IŠoData1K•NameQuickModeFilter A˙˙5ŠoDataK•NameError @ddd$QuickModeFilterErrorTEMP°eŠŠŽ@iŻ^-ŒŠlś§­a˙˙VD‚ EventDataA˙˙5ŠoDataK•NameError eErrorTEMP°°eŠŠŽ@iŻ^-ŒŠlś§­a˙˙VD‚ EventDataA˙˙5ŠoDataK•NameError ÄeErrorTEMP4ŹfěË-óüSˇ_ ŞÝnj˙˙¤D‚ EventDataA˙˙;ŠoData#K•NameProfiles A˙˙AŠoData)K•Name Application ÔfěfProfilesApplicationTEMPŔœg?~Źv|âUjšř]•4˘˙˙^D‚ EventDataA˙˙=ŠoData%K•Name ErrorCode °gErrorCodeTEMPŔ\h?~Źv|âUjšř]•4˘˙˙^D‚ EventDataA˙˙=ŠoData%K•Name ErrorCode phErrorCodeTEMPŔi?~Źv|âUjšř]•4˘˙˙^D‚ EventDataA˙˙=ŠoData%K•Name ErrorCode 0iErrorCodeTEMPŔÜi?~Źv|âUjšř]•4˘˙˙^D‚ EventDataA˙˙=ŠoData%K•Name ErrorCode điErrorCodeTEMPŔœj?~Źv|âUjšř]•4˘˙˙^D‚ EventDataA˙˙=ŠoData%K•Name ErrorCode °jErrorCodeTEMPŔ\k?~Źv|âUjšř]•4˘˙˙^D‚ EventDataA˙˙=ŠoData%K•Name ErrorCode pkErrorCodeTEMPŔl?~Źv|âUjšř]•4˘˙˙^D‚ EventDataA˙˙=ŠoData%K•Name ErrorCode 0lErrorCodeTEMP´Ôloî(éôĺ9P𗆤ΫŰá˙˙XD‚ EventDataA˙˙7ŠoDataK•Nameparam1 člparam1TEMPĚÄnăŽĎ~,BTi4ţńi˙˙’D‚ EventDataA˙˙EŠoData-K•Name CallerUserSid A˙˙GŠoData/K•NameCallerUserName A˙˙KŠoData3K•NameCallerDomainName A˙˙EŠoData-K•Name CallerLogonId A˙˙9ŠoData!K•NameOrdinal (oHolo”o´o CallerUserSid$CallerUserName(CallerDomainName CallerLogonIdOrdinalTEMP|Äpö>6ţWIéeČXŞ÷˛˙˙ĆD‚ EventDataA˙˙OŠoData7K•NameOldBlockedOrdinals A˙˙OŠoData7K•NameNewBlockedOrdinals ěpq,OldBlockedOrdinals,NewBlockedOrdinalsTEMP$ŔsŁ8ä:]÷Z>-ŚQ˙˙FD‚ EventDataA˙˙[ŠoDataCK•NameOldIgnoreDefaultSettings A˙˙[ŠoDataCK•NameNewIgnoreDefaultSettings A˙˙WŠoData?K•NameOldIgnoreLocalSettings A˙˙WŠoData?K•NameNewIgnoreLocalSettings A˙˙OŠoData7K•NameOldBlockedOrdinals A˙˙OŠoData7K•NameNewBlockedOrdinals 8tpt¨tÜtuů×\˙˙TD‚ EventDataA˙˙3ŠoDataK•NameType PTypeTEMP<<8IˇI[K˛Ţ0Ö^žt˙˙ŚD‚ EventDataA˙˙3ŠoDataK•NameType A˙˙KŠoData3K•NamePacketsDiscarded  d tType(PacketsDiscardedTEMPÔ ¤Ph‚,ď]Ž˘24ĽÓďY˙˙ÔD‚ EventDataA˙˙=ŠoData%K•Name Direction A˙˙EŠoData-K•Name SourceAddress A˙˙AŠoData)K•Name DestAddress A˙˙=ŠoData%K•Name EtherType A˙˙=ŠoData%K•Name MediaType A˙˙EŠoData-K•Name InterfaceType A˙˙9ŠoData!K•NameVlanTag A˙˙?ŠoData'K•Name FilterRTID  A˙˙=ŠoData%K•Name LayerName A˙˙=ŠoData%K•Name LayerRTID l„¤ŔŘđ $@ XDirection SourceAddressDestAddressEtherTypeMediaType InterfaceTypeVlanTagFilterRTIDLayerNameLayerRTIDTEMP ŕ oůUĐ{3\ÂË sş|˙˙<D‚ EventDataA˙˙=ŠoData%K•Name Direction A˙˙EŠoData-K•Name SourceAddress A˙˙AŠoData)K•Name DestAddress A˙˙=ŠoData%K•Name EtherType A˙˙9ŠoData!K•NameVlanTag A˙˙?ŠoData'K•Name vSwitch ID A˙˙MŠoData5K•NameSourcevSwitchPort A˙˙WŠoData?K•NameDestinationvSwitchPort A˙˙?ŠoData'K•Name FilterRTID  A˙˙=ŠoData%K•Name LayerName A˙˙=ŠoData%K•Name LayerRTID ź Ô ô  ( < X €  ´ Đ  č Direction SourceAddressDestAddressEtherTypeVlanTagvSwitch ID(SourcevSwitchPort4DestinationvSwitchPortFilterRTIDLayerNameLayerRTIDTEMPÔ Ph‚,ď]Ž˘24ĽÓďY˙˙ÔD‚ EventDataA˙˙=ŠoData%K•Name Direction A˙˙EŠoData-K•Name SourceAddress A˙˙AŠoData)K•Name DestAddress A˙˙=ŠoData%K•Name EtherType A˙˙=ŠoData%K•Name MediaType A˙˙EŠoData-K•Name InterfaceType A˙˙9ŠoData!K•NameVlanTag A˙˙?ŠoData'K•Name FilterRTID  A˙˙=ŠoData%K•Name LayerName A˙˙=ŠoData%K•Name LayerRTID Đč$<Tt ˆ¤ źDirection SourceAddressDestAddressEtherTypeMediaType InterfaceTypeVlanTagFilterRTIDLayerNameLayerRTIDTEMP DoůUĐ{3\ÂË sş|˙˙<D‚ EventDataA˙˙=ŠoData%K•Name Direction A˙˙EŠoData-K•Name SourceAddress A˙˙AŠoData)K•Name DestAddress A˙˙=ŠoData%K•Name EtherType A˙˙9ŠoData!K•NameVlanTag A˙˙?ŠoData'K•Name vSwitch ID A˙˙MŠoData5K•NameSourcevSwitchPort A˙˙WŠoData?K•NameDestinationvSwitchPort A˙˙?ŠoData'K•Name FilterRTID  A˙˙=ŠoData%K•Name LayerName A˙˙=ŠoData%K•Name LayerRTID  8XtŒ źä 4 LDirection SourceAddressDestAddressEtherTypeVlanTagvSwitch ID(SourcevSwitchPort4DestinationvSwitchPortFilterRTIDLayerNameLayerRTIDTEMPH °Ż*ZÄXAS0%Ľ#o’đ˙˙D‚ EventDataA˙˙=ŠoData%K•Name ProcessId A˙˙AŠoData)K•Name Application A˙˙=ŠoData%K•Name Direction A˙˙EŠoData-K•Name SourceAddress A˙˙?ŠoData'K•Name SourcePort A˙˙AŠoData)K•Name DestAddress A˙˙;ŠoData#K•NameDestPort A˙˙;ŠoData#K•NameProtocol A˙˙?ŠoData'K•Name FilterRTID  A˙˙=ŠoData%K•Name LayerName A˙˙=ŠoData%K•Name LayerRTID  Œ¤ŔŘř0H `| ”ProcessIdApplicationDirection SourceAddressSourcePortDestAddressDestPortProtocolFilterRTIDLayerNameLayerRTIDTEMPÄ @!QU`„nv] Ş5kŽtţ˙˙`D‚ EventDataA˙˙=ŠoData%K•Name ProcessId A˙˙AŠoData)K•Name Application A˙˙=ŠoData%K•Name Direction A˙˙EŠoData-K•Name SourceAddress A˙˙?ŠoData'K•Name SourcePort A˙˙AŠoData)K•Name DestAddress A˙˙;ŠoData#K•NameDestPort A˙˙;ŠoData#K•NameProtocol A˙˙CŠoData+K•Name FilterOrigin A˙˙?ŠoData'K•Name FilterRTID A˙˙=ŠoData%K•Name LayerName A˙˙=ŠoData%K•Name LayerRTID  0"H"d"|"œ"¸"Ô"ě"# $#@# X#ProcessIdApplicationDirection SourceAddressSourcePortDestAddressDestPortProtocol FilterOriginFilterRTIDLayerNameLayerRTIDTEMPH ź&Ż*ZÄXAS0%Ľ#o’đ˙˙D‚ EventDataA˙˙=ŠoData%K•Name ProcessId A˙˙AŠoData)K•Name Application A˙˙=ŠoData%K•Name Direction A˙˙EŠoData-K•Name SourceAddress A˙˙?ŠoData'K•Name SourcePort A˙˙AŠoData)K•Name DestAddress A˙˙;ŠoData#K•NameDestPort A˙˙;ŠoData#K•NameProtocol A˙˙?ŠoData'K•Name FilterRTID  A˙˙=ŠoData%K•Name LayerName A˙˙=ŠoData%K•Name LayerRTID  ˜'°'Ě'ä'( (<(T( l(ˆ(  (ProcessIdApplicationDirection SourceAddressSourcePortDestAddressDestPortProtocolFilterRTIDLayerNameLayerRTIDTEMPÄ L,QU`„nv] Ş5kŽtţ˙˙`D‚ EventDataA˙˙=ŠoData%K•Name ProcessId A˙˙AŠoData)K•Name Application A˙˙=ŠoData%K•Name Direction A˙˙EŠoData-K•Name SourceAddress A˙˙?ŠoData'K•Name SourcePort A˙˙AŠoData)K•Name DestAddress A˙˙;ŠoData#K•NameDestPort A˙˙;ŠoData#K•NameProtocol A˙˙CŠoData+K•Name FilterOrigin A˙˙?ŠoData'K•Name FilterRTID A˙˙=ŠoData%K•Name LayerName A˙˙=ŠoData%K•Name LayerRTID  <-T-p-ˆ-¨-Ä-ŕ-ř-. 0.L. d.ProcessIdApplicationDirection SourceAddressSourcePortDestAddressDestPortProtocol FilterOriginFilterRTIDLayerNameLayerRTIDTEMPđř0áq˜ÎĘčHV• ăŞ˙Bzí˙˙HD‚ EventDataA˙˙=ŠoData%K•Name ProcessId A˙˙AŠoData)K•Name Application A˙˙EŠoData-K•Name SourceAddress A˙˙?ŠoData'K•Name SourcePort A˙˙;ŠoData#K•NameProtocol A˙˙?ŠoData'K•Name FilterRTID  A˙˙=ŠoData%K•Name LayerName A˙˙=ŠoData%K•Name LayerRTID   ˜1°1Ě1ě12 2<2 T2ProcessIdApplication SourceAddressSourcePortProtocolFilterRTIDLayerNameLayerRTIDTEMPđč4áq˜ÎĘčHV• ăŞ˙Bzí˙˙HD‚ EventDataA˙˙=ŠoData%K•Name ProcessId A˙˙AŠoData)K•Name Application A˙˙EŠoData-K•Name SourceAddress A˙˙?ŠoData'K•Name SourcePort A˙˙;ŠoData#K•NameProtocol A˙˙?ŠoData'K•Name FilterRTID  A˙˙=ŠoData%K•Name LayerName A˙˙=ŠoData%K•Name LayerRTID   ˆ5 5ź5Ü5ř5 6,6 D6ProcessIdApplication SourceAddressSourcePortProtocolFilterRTIDLayerNameLayerRTIDTEMPH ¨9˝˛@ü ŤU PB3–@÷š˙˙D‚ EventDataA˙˙=ŠoData%K•Name ProcessID A˙˙AŠoData)K•Name Application A˙˙=ŠoData%K•Name Direction A˙˙EŠoData-K•Name SourceAddress A˙˙?ŠoData'K•Name SourcePort A˙˙AŠoData)K•Name DestAddress A˙˙;ŠoData#K•NameDestPort A˙˙;ŠoData#K•NameProtocol A˙˙?ŠoData'K•Name FilterRTID  A˙˙=ŠoData%K•Name LayerName A˙˙=ŠoData%K•Name LayerRTID  „:œ:¸:Đ:đ: ;(;@; X;t; Œ;ProcessIDApplicationDirection SourceAddressSourcePortDestAddressDestPortProtocolFilterRTIDLayerNameLayerRTIDTEMPP @î¨K‚iĆA[Ăń.že°Šy˙˙HD‚ EventDataA˙˙=ŠoData%K•Name ProcessID A˙˙AŠoData)K•Name Application A˙˙=ŠoData%K•Name Direction A˙˙EŠoData-K•Name SourceAddress A˙˙?ŠoData'K•Name SourcePort A˙˙AŠoData)K•Name DestAddress A˙˙;ŠoData#K•NameDestPort A˙˙;ŠoData#K•NameProtocol A˙˙GŠoData/K•NameInterfaceIndex A˙˙CŠoData+K•Name FilterOrigin A˙˙?ŠoData'K•Name FilterRTID A˙˙=ŠoData%K•Name LayerName A˙˙=ŠoData%K•Name LayerRTID A˙˙CŠoData+K•Name RemoteUserID A˙˙IŠoData1K•NameRemoteMachineID  LAdA€A˜A¸AÔAđAB BDB dB€B ˜B°BĐBProcessIDApplicationDirection SourceAddressSourcePortDestAddressDestPortProtocol$InterfaceIndex FilterOriginFilterRTIDLayerNameLayerRTID RemoteUserID$RemoteMachineIDTEMPH @F˝˛@ü ŤU PB3–@÷š˙˙D‚ EventDataA˙˙=ŠoData%K•Name ProcessID A˙˙AŠoData)K•Name Application A˙˙=ŠoData%K•Name Direction A˙˙EŠoData-K•Name SourceAddress A˙˙?ŠoData'K•Name SourcePort A˙˙AŠoData)K•Name DestAddress A˙˙;ŠoData#K•NameDestPort A˙˙;ŠoData#K•NameProtocol A˙˙?ŠoData'K•Name FilterRTID  A˙˙=ŠoData%K•Name LayerName A˙˙=ŠoData%K•Name LayerRTID  G4GPGhGˆG¤GŔGŘG đG H $HProcessIDApplicationDirection SourceAddressSourcePortDestAddressDestPortProtocolFilterRTIDLayerNameLayerRTIDTEMPL Lşűß7/6PâŒV+ôÍ˙˙°D‚ EventDataA˙˙=ŠoData%K•Name ProcessID A˙˙AŠoData)K•Name Application A˙˙=ŠoData%K•Name Direction A˙˙EŠoData-K•Name SourceAddress A˙˙?ŠoData'K•Name SourcePort A˙˙AŠoData)K•Name DestAddress A˙˙;ŠoData#K•NameDestPort A˙˙;ŠoData#K•NameProtocol A˙˙?ŠoData'K•Name FilterRTID  A˙˙=ŠoData%K•Name LayerName A˙˙=ŠoData%K•Name LayerRTID A˙˙CŠoData+K•Name RemoteUserID A˙˙IŠoData1K•NameRemoteMachineID  $Mä =QZIŇ(Ämš˙˙čD‚ EventDataA˙˙IŠoData1K•NameOpCorrelationID A˙˙KŠoData3K•NameAppCorrelationID A˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙7ŠoDataK•NameDSName A˙˙7ŠoDataK•NameDSType A˙˙;ŠoData#K•NameObjectDN A˙˙?ŠoData'K•Name ObjectGUID A˙˙AŠoData)K•Name ObjectClass A˙˙[ŠoDataCK•NameAttributeLDAPDisplayName A˙˙OŠoData7K•NameAttributeSyntaxOID A˙˙GŠoData/K•NameAttributeValue A˙˙GŠoData/K•NameExpirationTime A˙˙EŠoData-K•Name OperationType |ą ąČąěą˛8˛\˛p˛„˛œ˛¸˛Ô˛ ł8ł\ł€ł$OpCorrelationID(AppCorrelationID$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdDSNameDSTypeObjectDNObjectGUIDObjectClass8AttributeLDAPDisplayName,AttributeSyntaxOID$AttributeValue$ExpirationTime OperationTypeTEMPt0ľOʜ3vóVCŽME`ac˙˙ZD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId €ľ¤ľČľđľ$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMP˜¸F_`͆—Č]—KČřcŚ˙˙PD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙GŠoData/K•NameBackupFileName A˙˙QŠoData9K•NameProcessCreationTime A˙˙IŠoData1K•NameClientProcessId $šHšlš”š¸šÜšş$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId$BackupFileName,ProcessCreationTime$ClientProcessIdTEMPtźťOʜ3vóVCŽME`ac˙˙ZD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId  ź0źTź|ź$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTEMP$żF_`͆—Č]—KČřcŚ˙˙PD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙GŠoData/K•NameBackupFileName A˙˙QŠoData9K•NameProcessCreationTime A˙˙IŠoData1K•NameClientProcessId °żÔżřż ŔDŔhŔ”Ŕ$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId$BackupFileName,ProcessCreationTime$ClientProcessIdTEMP hÄŮw"BźžU°öPőUó:“˙˙zD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙?ŠoData'K•Name TargetName A˙˙3ŠoDataK•NameType A˙˙_ŠoDataGK•NameCountOfCredentialsReturned A˙˙EŠoData-K•Name ReadOperation A˙˙?ŠoData'K•Name ReturnCode A˙˙QŠoData9K•NameProcessCreationTime A˙˙IŠoData1K•NameClientProcessId DĹhĹŒĹ´ĹŘĹôĹĆ@Ć`Ć|ƨĆ$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdTargetNameType<CountOfCredentialsReturned ReadOperationReturnCode,ProcessCreationTime$ClientProcessIdTEMPÄ HĘ’Ř‹Ş ĂP‚LÔ2oţS~˙˙FD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙CŠoData+K•Name SearchString A˙˙OŠoData7K•NameSchemaFriendlyName A˙˙7ŠoDataK•NameSchema A˙˙_ŠoDataGK•NameCountOfCredentialsReturned A˙˙QŠoData9K•NameProcessCreationTime A˙˙IŠoData1K•NameClientProcessId Ë4ËXˀˤËÄËđËĚ@ĚlĚ$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId SearchString,SchemaFriendlyNameSchema<CountOfCredentialsReturned,ProcessCreationTime$ClientProcessIdTEMP¨hϸÝÄŰň ZĎmłČŤƒĘ­˙˙¤D‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙5ŠoDataK•NameFlags A˙˙_ŠoDataGK•NameCountOfCredentialsReturned A˙˙QŠoData9K•NameProcessCreationTime A˙˙IŠoData1K•NameClientProcessId Đ,ĐPĐxĐœĐŹĐčĐŃ$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdFlags<CountOfCredentialsReturned,ProcessCreationTime$ClientProcessIdTEMP¸ PŐ (ŔšNw_Œ{SĚťK [˙˙âD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙OŠoData7K•NameSchemaFriendlyName A˙˙7ŠoDataK•NameSchema A˙˙;ŠoData#K•NameResource A˙˙;ŠoData#K•NameIdentity A˙˙?ŠoData'K•Name PackageSid A˙˙5ŠoDataK•NameFlags A˙˙?ŠoData'K•Name ReturnCode A˙˙QŠoData9K•NameProcessCreationTime A˙˙IŠoData1K•NameClientProcessId TÖxÖœÖÄÖčÖ×(×@×X×tׄנ×Ě×$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId,SchemaFriendlyNameSchemaResourceIdentityPackageSidFlagsReturnCode,ProcessCreationTime$ClientProcessIdTEMP0ŒÚPr¤îžŘ.]ŮżĐř ¸ŕ˙˙fD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙9ŠoData!K•NamePackage A˙˙9ŠoData!K•NameUserUPN A˙˙CŠoData+K•Name TargetServer A˙˙;ŠoData#K•NameCredType ,ŰPŰtŰœŰŔŰÔŰčŰÜ$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdPackageUserUPN TargetServerCredTypeTEMPĐ ßý)ôfKR#Ů ą ˙˙ÄD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙EŠoData-K•Name TransactionId A˙˙;ŠoData#K•NameNewState A˙˙IŠoData1K•NameResourceManager A˙˙=ŠoData%K•Name ProcessId A˙˙AŠoData)K•Name ProcessName Ěßđßŕ<ŕ`ŕ€ŕ˜ŕźŕÔŕ$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonId TransactionIdNewState$ResourceManagerProcessIdProcessNameTEMP  ôäӞ6Šs×@Tȇۂ0yôÄ˙˙ÎD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId  A˙˙=ŠoData%K•Name ProcessId A˙˙AŠoData)K•Name ProcessName A˙˙IŠoData1K•NameRemoteIpAddress A˙˙?ŠoData'K•Name RemotePort A˙˙EŠoData-K•Name InterfaceUuid A˙˙KŠoData3K•NameProtocolSequence A˙˙UŠoData=K•NameAuthenticationService A˙˙QŠoData9K•NameAuthenticationLevel äĺć,ć TćxććŹćĐćěć ç4çdç$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdProcessIdProcessName$RemoteIpAddressRemotePort InterfaceUuid(ProtocolSequence0AuthenticationService,AuthenticationLevelTEMPäXěď§AřcQQľńEńĆ˙˙’D‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId  A˙˙=ŠoData%K•Name ProcessId A˙˙AŠoData)K•Name ProcessName A˙˙IŠoData1K•NameRemoteIpAddress A˙˙?ŠoData'K•Name RemotePort A˙˙EŠoData-K•Name InterfaceUuid A˙˙KŠoData3K•NameProtocolSequence A˙˙UŠoData=K•NameAuthenticationService A˙˙QŠoData9K•NameAuthenticationLevel A˙˙5ŠoDataK•NameOpNum A˙˙;ŠoData#K•NameEndpoint A˙˙?ŠoData'K•Name RemoteHost „í¨íĚí ôíî0îLîpîŒîŹîÔîď0ď@ďXď$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdProcessIdProcessName$RemoteIpAddressRemotePort InterfaceUuid(ProtocolSequence0AuthenticationService,AuthenticationLevelOpNumEndpointRemoteHostTEMPX Äňzď˝ÛĐ\fh™•¤˙˙D‚ EventDataA˙˙3ŠoDataK•NameSSID A˙˙;ŠoData#K•NameIdentity A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙9ŠoData!K•NamePeerMac A˙˙;ŠoData#K•NameLocalMac A˙˙;ŠoData#K•NameIntfGuid A˙˙?ŠoData'K•Name ReasonCode A˙˙?ŠoData'K•Name ReasonText A˙˙=ŠoData%K•Name ErrorCode  ó°óČóěóô8ôLôdô|ô˜ô´ôSSIDIdentity$SubjectUserName(SubjectDomainName$SubjectLogonIdPeerMacLocalMacIntfGuidReasonCodeReasonTextErrorCodeTEMPěůČ)Ţ ŠvR  ‚źľ!˙˙D‚ EventDataA˙˙3ŠoDataK•NameSSID A˙˙;ŠoData#K•NameIdentity A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙9ŠoData!K•NamePeerMac A˙˙;ŠoData#K•NameLocalMac A˙˙;ŠoData#K•NameIntfGuid A˙˙?ŠoData'K•Name ReasonCode A˙˙?ŠoData'K•Name ReasonText A˙˙=ŠoData%K•Name ErrorCode A˙˙EŠoData-K•Name EAPReasonCode A˙˙OŠoData7K•NameEapRootCauseString A˙˙CŠoData+K•Name EAPErrorCode  ú0úHúlú”ú¸úĚúäúüúű4űLűlű˜űSSIDIdentity$SubjectUserName(SubjectDomainName$SubjectLogonIdPeerMacLocalMacIntfGuidReasonCodeReasonTextErrorCode EAPReasonCode,EapRootCauseString EAPErrorCodeTEMP8XţD۰[ÁARéݸĆi˛Ť˙˙jD‚ EventDataA˙˙EŠoData-K•Name InterfaceName A˙˙;ŠoData#K•NameIdentity A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙?ŠoData'K•Name ReasonCode A˙˙?ŠoData'K•Name ReasonText A˙˙=ŠoData%K•Name ErrorCode řţ˙0˙T˙|˙ ˙ź˙Ř˙ InterfaceNameIdentity$SubjectUserName(SubjectDomainName$SubjectLogonIdReasonCodeReasonTextErrorCodeTEMP` °Ü!r=˜ŕT%‘ůž“šus˙˙ŒD‚ EventDataA˙˙AŠoData)K•Name ProviderKey A˙˙CŠoData+K•Name ProviderName A˙˙?ŠoData'K•Name CalloutKey A˙˙AŠoData)K•Name CalloutName A˙˙AŠoData)K•Name CalloutType A˙˙=ŠoData%K•Name CalloutId A˙˙;ŠoData#K•NameLayerKey A˙˙=ŠoData%K•Name LayerName A˙˙9ŠoData!K•NameLayerId d€ źŘô $<ProviderKey ProviderNameCalloutKeyCalloutNameCalloutTypeCalloutIdLayerKeyLayerNameLayerIdTEMP„X"i¨ŔϜVęW221ťń˜˙˙ÔD‚ EventDataA˙˙AŠoData)K•Name ProviderKey A˙˙CŠoData+K•Name ProviderName A˙˙=ŠoData%K•Name FilterKey A˙˙?ŠoData'K•Name FilterName A˙˙?ŠoData'K•Name FilterType A˙˙;ŠoData#K•NameFilterId  A˙˙;ŠoData#K•NameLayerKey A˙˙=ŠoData%K•Name LayerName A˙˙9ŠoData!K•NameLayerId A˙˙7ŠoDataK•NameWeight A˙˙?ŠoData'K•Name Conditions A˙˙7ŠoDataK•NameAction A˙˙?ŠoData'K•Name CalloutKey A˙˙AŠoData)K•Name CalloutName p Œ Ź Ä ŕ  ü  , D  X l ˆ œ ¸ ProviderKey ProviderNameFilterKeyFilterNameFilterTypeFilterIdLayerKeyLayerNameLayerIdWeightConditionsActionCalloutKeyCalloutNameTEMPÄ ‡âoól^ťjÎ&<ňQ˙˙öD‚ EventDataA˙˙AŠoData)K•Name ProviderKey A˙˙CŠoData+K•Name ProviderName A˙˙CŠoData+K•Name ProviderType < X x ProviderKey ProviderName ProviderTypeTEMP €Y™‹řEĹ]đ;Př‹7˙˙˛D‚ EventDataA˙˙AŠoData)K•Name ProviderKey A˙˙CŠoData+K•Name ProviderName A˙˙OŠoData7K•NameProviderContextKey A˙˙QŠoData9K•NameProviderContextName A˙˙QŠoData9K•NameProviderContextType ä LxProviderKey ProviderName,ProviderContextKey,ProviderContextName,ProviderContextTypeTEMP  GeBčw&ź_“ú 4\ňr˙˙ĆD‚ EventDataA˙˙AŠoData)K•Name ProviderKey A˙˙CŠoData+K•Name ProviderName A˙˙AŠoData)K•Name SubLayerKey A˙˙CŠoData+K•Name SubLayerName A˙˙CŠoData+K•Name SubLayerType A˙˙7ŠoDataK•NameWeight 4Tp°ProviderKey ProviderNameSubLayerKey SubLayerName SubLayerTypeWeightTEMP Zé°aŁt7VÖu/d°ýĐ%˙˙˜D‚ EventDataA˙˙=ŠoData%K•Name ProcessId A˙˙9ŠoData!K•NameUserSid A˙˙;ŠoData#K•NameUserName A˙˙AŠoData)K•Name ProviderKey A˙˙CŠoData+K•Name ProviderName A˙˙?ŠoData'K•Name ChangeType A˙˙?ŠoData'K•Name CalloutKey A˙˙AŠoData)K•Name CalloutName A˙˙AŠoData)K•Name CalloutType A˙˙=ŠoData%K•Name CalloutId A˙˙;ŠoData#K•NameLayerKey A˙˙=ŠoData%K•Name LayerName A˙˙9ŠoData!K•NameLayerId ”ŹŔŘô0Lh„œ´ĚProcessIdUserSidUserNameProviderKey ProviderNameChangeTypeCalloutKeyCalloutNameCalloutTypeCalloutIdLayerKeyLayerNameLayerIdTEMP@ôąr%kŘU}u˝Č áźg˙˙ŕD‚ EventDataA˙˙=ŠoData%K•Name ProcessId A˙˙9ŠoData!K•NameUserSid A˙˙;ŠoData#K•NameUserName A˙˙AŠoData)K•Name ProviderKey A˙˙CŠoData+K•Name ProviderName A˙˙?ŠoData'K•Name ChangeType A˙˙=ŠoData%K•Name FilterKey A˙˙?ŠoData'K•Name FilterName A˙˙?ŠoData'K•Name FilterType A˙˙;ŠoData#K•NameFilterId A˙˙;ŠoData#K•NameLayerKey A˙˙=ŠoData%K•Name LayerName A˙˙9ŠoData!K•NameLayerId A˙˙7ŠoDataK•NameWeight A˙˙?ŠoData'K•Name Conditions A˙˙7ŠoDataK•NameAction A˙˙?ŠoData'K•Name CalloutKey A˙˙AŠoData)K•Name CalloutName \tˆ źÜř ,  H ` x   ¤ ¸ Ô č !ProcessIdUserSidUserNameProviderKey ProviderNameChangeTypeFilterKeyFilterNameFilterTypeFilterIdLayerKeyLayerNameLayerIdWeightConditionsActionCalloutKeyCalloutNameTEMP€X#e^Ä?ëďôQĎ\˘7m_o5˙˙D‚ EventDataA˙˙=ŠoData%K•Name ProcessId A˙˙9ŠoData!K•NameUserSid A˙˙;ŠoData#K•NameUserName A˙˙?ŠoData'K•Name ChangeType A˙˙AŠoData)K•Name ProviderKey A˙˙CŠoData+K•Name ProviderName A˙˙CŠoData+K•Name ProviderType ä#ü#$($D$`$€$ProcessIdUserSidUserNameChangeTypeProviderKey ProviderName ProviderTypeTEMPČ ”'œŻcŕgćú\wĎÄ˙˙žD‚ EventDataA˙˙=ŠoData%K•Name ProcessId A˙˙9ŠoData!K•NameUserSid A˙˙;ŠoData#K•NameUserName A˙˙AŠoData)K•Name ProviderKey A˙˙CŠoData+K•Name ProviderName A˙˙?ŠoData'K•Name ChangeType A˙˙OŠoData7K•NameProviderContextKey A˙˙QŠoData9K•NameProviderContextName A˙˙QŠoData9K•NameProviderContextType H(`(t(Œ(¨(Č(ä()<)ProcessIdUserSidUserNameProviderKey ProviderNameChangeType,ProviderContextKey,ProviderContextName,ProviderContextTypeTEMPÜ p,+ľńą_ąP\Š‚MçS(˙˙ŇD‚ EventDataA˙˙=ŠoData%K•Name ProcessId A˙˙9ŠoData!K•NameUserSid A˙˙;ŠoData#K•NameUserName A˙˙AŠoData)K•Name ProviderKey A˙˙CŠoData+K•Name ProviderName A˙˙?ŠoData'K•Name ChangeType A˙˙AŠoData)K•Name SubLayerKey A˙˙CŠoData+K•Name SubLayerName A˙˙CŠoData+K•Name SubLayerType A˙˙7ŠoDataK•NameWeight 8-P-d-|-˜-¸-Ô-đ-.0.ProcessIdUserSidUserNameProviderKey ProviderNameChangeTypeSubLayerKey SubLayerName SubLayerTypeWeightTEMP\ Ź5+f˘$ŽK^Oɲüś ˙˙4D‚ EventDataA˙˙CŠoData+K•Name LocalAddress A˙˙KŠoData3K•NameLocalAddressMask A˙˙=ŠoData%K•Name LocalPort A˙˙QŠoData9K•NameLocalTunnelEndpoint A˙˙EŠoData-K•Name RemoteAddress A˙˙MŠoData5K•NameRemoteAddressMask A˙˙?ŠoData'K•Name RemotePort A˙˙OŠoData7K•NamePeerPrivateAddress A˙˙SŠoData;K•NameRemoteTunnelEndpoint A˙˙?ŠoData'K•Name IpProtocol A˙˙KŠoData3K•NameKeyingModuleName A˙˙?ŠoData'K•Name AhAuthType A˙˙AŠoData)K•Name EspAuthType A˙˙?ŠoData'K•Name CipherType A˙˙IŠoData1K•NameLifetimeSeconds A˙˙MŠoData5K•NameLifetimeKilobytes A˙˙IŠoData1K•NameLifetimePackets A˙˙3ŠoDataK•NameMode A˙˙3ŠoDataK•NameRole A˙˙MŠoData5K•NameTransportFilterId  A˙˙CŠoData+K•Name MainModeSaId  A˙˙EŠoData-K•Name QuickModeSaId  A˙˙?ŠoData'K•Name InboundSpi  A˙˙AŠoData)K•Name OutboundSpi  Œ7Ź7Ô7ě7888`8|8¨8Ř8ô8989T9p9”9ź9ŕ9đ9 : (: H: h: „: LocalAddress(LocalAddressMaskLocalPort,LocalTunnelEndpoint RemoteAddress(RemoteAddressMaskRemotePort,PeerPrivateAddress0RemoteTunnelEndpointIpProtocol(KeyingModuleNameAhAuthTypeEspAuthTypeCipherType$LifetimeSeconds(LifetimeKilobytes$LifetimePacketsModeRole(TransportFilterId MainModeSaId QuickModeSaIdInboundSpiOutboundSpiTEMP\  BzŇ飒ÔŮ^=œĐô+:˙˙ĘD‚ EventDataA˙˙CŠoData+K•Name LocalAddress A˙˙KŠoData3K•NameLocalAddressMask A˙˙=ŠoData%K•Name LocalPort A˙˙QŠoData9K•NameLocalTunnelEndpoint A˙˙EŠoData-K•Name RemoteAddress A˙˙MŠoData5K•NameRemoteAddressMask A˙˙?ŠoData'K•Name RemotePort A˙˙OŠoData7K•NamePeerPrivateAddress A˙˙SŠoData;K•NameRemoteTunnelEndpoint A˙˙?ŠoData'K•Name IpProtocol A˙˙KŠoData3K•NameKeyingModuleName A˙˙?ŠoData'K•Name AhAuthType A˙˙AŠoData)K•Name EspAuthType A˙˙?ŠoData'K•Name CipherType A˙˙IŠoData1K•NameLifetimeSeconds A˙˙MŠoData5K•NameLifetimeKilobytes A˙˙IŠoData1K•NameLifetimePackets A˙˙3ŠoDataK•NameMode A˙˙3ŠoDataK•NameRole A˙˙MŠoData5K•NameTransportFilterId  A˙˙CŠoData+K•Name MainModeSaId  A˙˙EŠoData-K•Name QuickModeSaId  A˙˙?ŠoData'K•Name InboundSpi  A˙˙AŠoData)K•Name OutboundSpi  A˙˙;ŠoData#K•NameTunnelId  A˙˙MŠoData5K•NameTrafficSelectorId  ¨DČDđDE4ETE|E˜EÄEôEF8FTFpFŒF°FŘFüF G G DG dG „G  G źG ÔG LocalAddress(LocalAddressMaskLocalPort,LocalTunnelEndpoint RemoteAddress(RemoteAddressMaskRemotePort,PeerPrivateAddress0RemoteTunnelEndpointIpProtocol(KeyingModuleNameAhAuthTypeEspAuthTypeCipherType$LifetimeSeconds(LifetimeKilobytes$LifetimePacketsModeRole(TransportFilterId MainModeSaId QuickModeSaIdInboundSpiOutboundSpiTunnelId(TrafficSelectorIdTEMP`°Jó:ęUZ´ďR2P -\’˙˙~D‚ EventDataA˙˙CŠoData+K•Name LocalAddress A˙˙=ŠoData%K•Name LocalPort A˙˙QŠoData9K•NameLocalTunnelEndpoint A˙˙EŠoData-K•Name RemoteAddress A˙˙?ŠoData'K•Name RemotePort A˙˙SŠoData;K•NameRemoteTunnelEndpoint A˙˙?ŠoData'K•Name IpProtocol A˙˙EŠoData-K•Name QuickModeSaId  PKpKˆK´KÔKđK L PpHgĹ卲˙˙xD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙eŠoDataMK•NameFullyQualifiedSubjectUserName <)`)„)Ź)$SubjectUserSid$SubjectUserName(SubjectDomainName@FullyQualifiedSubjectUserNameTEMPŹ˜+Őx,~OO>PpHgĹ卲˙˙xD‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙eŠoDataMK•NameFullyQualifiedSubjectUserName č+ ,0,X,$SubjectUserSid$SubjectUserName(SubjectDomainName@FullyQualifiedSubjectUserNameTEMP´$-oî(éôĺ9P𗆤ΫŰá˙˙XD‚ EventDataA˙˙7ŠoDataK•Nameparam1 8-param1TEMPŘě-ŐŁ§`u×>X 6[L}Ÿv˙˙jD‚ EventDataA˙˙IŠoData1K•NameClientIPAddress .$ClientIPAddressTEMPŘÄ.ŐŁ§`u×>X 6[L}Ÿv˙˙jD‚ EventDataA˙˙IŠoData1K•NameClientIPAddress Ř.$ClientIPAddressTEMPŘœ/ŐŁ§`u×>X 6[L}Ÿv˙˙jD‚ EventDataA˙˙IŠoData1K•NameClientIPAddress °/$ClientIPAddressTEMPŘt0P6˙ƒcσWď ^B˙˙jD‚ EventDataA˙˙IŠoData1K•NameHostedCacheName ˆ0$HostedCacheNameTEMPH1!‹îO‰Ć‘W#&lÔ:˙˙ŽD‚ EventDataA˙˙IŠoData1K•NameHostedCacheName A˙˙=ŠoData%K•Name ErrorCode ¸1Ü1$HostedCacheNameErrorCodeTEMPŔ2ˇ´2™Wę#ęcІQ˙˙–D‚ EventDataA˙˙9ŠoData!K•NameEventId A˙˙5ŠoDataK•NameCount č2ü2EventIdCountTEMP<č3ź )źoYNŁŘYňv-˙˙¨D‚ EventDataA˙˙AŠoData)K•Name ProductName A˙˙?ŠoData'K•Name Categories 4,4ProductNameCategoriesTEMP¸Ř4ë8p1ž,W… ľ Œf˙˙ZD‚ EventDataA˙˙9ŠoData!K•NameMessage ě4MessageTEMP<Ü5ź )źoYNŁŘYňv-˙˙¨D‚ EventDataA˙˙AŠoData)K•Name ProductName A˙˙?ŠoData'K•Name Categories 6 6ProductNameCategoriesTEMPŹÄ6N0x}šRĎŚ°¸“5(˙˙TD‚ EventDataA˙˙3ŠoDataK•NameGUID Ř6GUIDTEMP´t7oî(éôĺ9P𗆤ΫŰá˙˙XD‚ EventDataA˙˙7ŠoDataK•Nameparam1 ˆ7param1TEMPdT:˙đřwӆÓZŽ…%Ü ŕľŃ˙˙‚D‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙9ŠoData!K•NameClassId A˙˙=ŠoData%K•Name VendorIds A˙˙EŠoData-K•Name CompatibleIds A˙˙QŠoData9K•NameLocationInformation ô:;<;d;ˆ;œ;´;Ô;$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdClassIdVendorIds CompatibleIds,LocationInformationTEMPĐ ?H•ƒ­ŒuVQu}A;˙˙\D‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙;ŠoData#K•NameDeviceId A˙˙MŠoData5K•NameDeviceDescription A˙˙9ŠoData!K•NameClassId A˙˙=ŠoData%K•Name ClassName A˙˙=ŠoData%K•Name VendorIds A˙˙EŠoData-K•Name CompatibleIds A˙˙QŠoData9K•NameLocationInformation l@@´@Ü@AA@ATAlA„A¤A$SubjectUserSid$SubjectUserName(SubjectDomainName$SubjectLogonIdDeviceId(DeviceDescriptionClassIdClassNameVendorIds CompatibleIds,LocationInformationTEMP8ŹBeŸ0#ľ§¨U“%F<źÂŞA˙˙ŚD‚ EventDataA˙˙=ŠoData%K•Name ProcessId A˙˙AŠoData)K•Name ProcessName ÔBěBProcessIdProcessNameTEMP¨(DȊÝdvӂXΨĄ°Âvn˙˙ęD‚ EventDataA˙˙=ŠoData%K•Name ProcessId A˙˙AŠoData)K•Name ProcessName A˙˙=ŠoData%K•Name FatalCode dD|D˜DProcessIdProcessNameFatalCodeTEMPŘ DHdx÷}× ­SĽŐS0ЊÂj˙˙`D‚ EventDataA˙˙GŠoData/K•NameSubjectUserSid A˙˙IŠoData1K•NameSubjectUserName A˙˙MŠoData5K•NameSubjectDomainName A˙˙GŠoData/K•NameSubjectLogonId A˙˙;ŠoData#K•NameDeviceId A˙˙MŠoData5K•NameDeviceDescription A˙˙9ŠoData!K•NameClassId A˙˙=ŠoData%K•Name ClassName A˙˙AŠoData)K•Name HardwareIds A˙˙EŠoData-K•Name CompatibleIds A˙˙QŠoData9K•NameLocationInformation  IDIhII´IĚIôIJ JŒDŒ€ €@IŒDŒ€ € PŒDŒ€ €”VŒDŒ€& €&hYŒDŒ€' €'4ZŒDŒ€( €(˜\ŒDŒ€) €)ŘcŒDŒ€* €* kŒDŒ€+ €+źsŒDŒ€, €,¨ŒDŒ€- €-X‹ŒDŒ€. €.°Ě“ŒDŒ€. €.<ŒDŒ€/ €/¨§ŒDŒ€0 €0°ĐŠŒDŒ€0 €0„ąŒDŒ€1 €1LşŒDŒ€2 €2lÁŒDŒ€3 €3´ĹŒDŒ€4 €4\ĚŒDŒ€5 €5°$ŃŒDŒ€5 €5PŮŒDŒ€6 €6řáŒDŒ€7 €7°4éŒDŒ€7 €7TďŒDŒ€8 €8öŒDŒ€9 €9ŘůŒDŒ€: €:ŕüŒDŒ€; €; ŒDŒ€< €<ÄŒDŒ€> €>ÔŒDŒ€? €?ülŒDŒ€@ €@Č ŒDŒ€A €AźŒDŒ€B €B|ŒDŒ€C €C¤ŒDŒ€P €P°źŒDŒ€P €P°8$ŒDŒ€P €P,)ŒDŒ€Q €QL1ŒDŒ€R €R 5ŒDŒ€S €Sœ9ŒDŒ€T €TX>ŒDŒ€U €UČBŒDŒ€V €V°GŒDŒ€W €WČLŒDŒ€X €XŕQŒDŒ€Y €YhXŒDŒ€Y €Yh]ŒDŒ€Z €Z°dŒDŒ€Z €ZpgŒDŒ€[ €[°xmŒDŒ€[ €[ĐpŒDŒ€\ €\°ŘvŒDŒ€\ €\0zŒDŒ€] €]°8€ŒDŒ€] €]ƒŒDŒ€^ €^°˜‰ŒDŒ€^ €^ŒDŒ€_ €_“ŒDŒ€` €`Ŕ™ŒDŒ€a €a$ŒDŒ€b €bˆ ŒDŒ€c €cŕĽŒDŒ€e €e8ŠŒDŒ€f €f¸ŞŒDŒ€g €gÔŤŒDŒ€h €hˆŹŒDŒ€i €i<­ŒDŒ€j €jL°ŒDŒ€k €kHłŒDŒ€l €l|śŒDŒ€m €mÔťŒDŒ€n €n8żŒDŒ€o €oœÂŒDŒ€o €o$ÇŒDŒ€p €pÔĚŒDŒ€r €rxߌDŒ€s €spăŒDŒ€t €tčçŒDŒ€u €uŕëŒDŒ€v €vŘďŒDŒ€w €wPôŒDŒ€x €x°ÄůŒDŒ€x €x ˙ŒDŒ€y €y,ŒDŒ€z €zˆ ŒDŒ€{ €{ŒDŒ€| €|°tŒDŒ€| €|ĐŒDŒ€} €}ÜŒDŒ€~ €~8%ŒDŒ€ €°)ŒDŒ€ €44ŒDŒ€‚ €‚¨9ŒDŒ€ƒ €ƒœGŒDŒ€„ €„`SŒDŒ€… €…XWŒDŒ€† €†fŒDŒ€‡ €‡PuŒDŒ€ˆ €ˆČyŒDŒ€‰ €‰<ŒDŒ€Š €Š°°„ŒDŒ€Š €Š ŠŒDŒ€‹ €‹ŒDŒ€Œ €Œt•ŒDŒ€ €ě™ŒDŒ€Ž €Ž`ŸŒDŒ€ €°Ô¤ŒDŒ€ €0ŞŒDŒ€ €<°ŒDŒ€‘ €‘˜ľŒDŒ€’ €’şŒDŒ€“ €“„żŒDŒ€” €”°řÄŒDŒ€” €”TĘŒDŒ€• €•`ĐŒDŒ€– €–źŐŒDŒ€— €—4ÚŒDŒ€˜ €˜¨ßŒDŒ€™ €™°ĺŒDŒ€™ €™xęŒDŒ€š €š„đŒDŒ€› €›ŕőŒDŒ€œ €œXúŒDŒ€ €X˙ŒDŒ€ž €ž ŒDŒ€Ÿ €ŸxŒDŒ€  € °pŒDŒ€  € °œŒDŒ€  € P"ŒDŒ€Ą €Ą°(9ŒDŒ€Ą €Ą°Ü>ŒDŒ€Ą €Ą´EŒDŒ€˘ €˘°YŒDŒ€˘ €˘T]ŒDŒ€Ł €ŁŔbŒDŒ€¤ €¤ŘmŒDŒ€Ľ €Ľ€qŒDŒ€Ś €Ś(uŒDŒ€§ €§ävŒDŒ€¨ €¨(xŒDŒ€Š €Š€~ŒDŒ€Ş €Ş¸€ŒDŒ€Ť €ŤԃŒDŒ€Ź €Ź ‰ŒDŒ€­ €­˜ŒDŒ€Ž €Ž¨’ŒDŒ€Ż €Ż0–ŒDŒ€° €°¤›ŒDŒ€ą €ą°ĄŒDŒ€ą €ątŚŒDŒ€˛ €˛€ŹŒDŒ€ł €łÜąŒDŒ€´ €´8ˇŒDŒ€ľ €ľ”źŒDŒ€ś €ś ÁŒDŒ€ˇ €ˇ€ĆŒDŒ€¸ €¸ôËŒDŒ€š €šlĐŒDŒ€ş €şDÔŒDŒ€˝ €˝”׌DŒ€ž €žhÚŒDŒ€ż €ż$/ŒDŒ€Ŕ €Ŕ”ŰŒDŒ€Á €ÁhŢŒDŒ€Â €Â<áŒDŒ€Ă €ĂäŒDŒ€Đ €Đ°äćŒDŒ€Đ €ĐdčŒDŒ€Ń €Ń0ęŒDŒ€Ň €ŇĚîŒDŒ€Ó €ÓüôŒDŒ€Ô €Ô$0ŒDŒ€Ő €Ő RŒDŒ€Ö €ÖTzŒDŒ€× €×ř{ŒDŒ€Ř €ŘLhŒDŒ€Ů €Ůđ†ŒDŒ€Ú €Ú8úŒDŒ€Ţ €Ţ,ŒDŒ€ €4ŒDŒ€ €XŒDŒ€ €Ř ŒDŒ€ €XŒDŒ€ €ŘŒDŒ€ €źŒDŒ€ €  ŒDŒ€ €H$ŒDŒ€ €x(ŒDŒ€  € +ŒDŒ€  € $0ŒDŒ€  € 0>ŒDŒ€  € |3ŒDŒ€  € d6ŒDŒ€ €ŒDŒ€ €ŒDŒ€ €Ř8ŒDŒ€ €„;ŒDŒ€ €¤@ŒDŒ€ €¤CŒDŒ€ €ˆFŒDŒ€ €äIŒDŒ€ €°ĐLŒDŒ€ €tNŒDŒ€ €°UŒDŒ€ €@XŒDŒ€ €°Č^ŒDŒ€ €ěaŒDŒ€ €°¸fŒDŒ€ €ÜiŒDŒ€ €¨nŒDŒ€ €trŒDŒ€ €vŒDŒ€ €tzŒDŒ€ €|ŒDŒ€ €ř~ŒDŒ€  € ¨€ŒDŒ€! €!`„ŒDŒ€" €"P…ŒDŒ€# €#ŠŒDŒ€$ €$ЎŒDŒ€& €&ؔŒDŒ€( €( –ŒDŒ€) €)pšŒDŒ€* €*ԞŒDŒ€+ €+ğŒDŒ€, €,¸ĽŒDŒ€- €-ČoŒDŒ€. €.DqŒDŒ€/ €/pŚŒDŒ€0 €0dŹŒDŒ€1 €1ląŒDŒ€@ €@`ˇŒDŒ€@ €@xşŒDŒ€A €A˝ŒDŒ€A €A¨ŔŒDŒ€B €BŔĂŒDŒ€B €BŘĆŒDŒ€C €CđÉŒDŒ€C €CÍŒDŒ€D €D ĐŒDŒ€D €D,ÓŒDŒ€E €E8ÖŒDŒ€E €E°ŮŒDŒ€F €F(ÝŒDŒ€G €GxŕŒDŒ€H €HÜáŒDŒ€I €IŕăŒDŒ€I €IhćŒDŒ€P €PđčŒDŒ€Q €QhíŒDŒ€R €RďŒDŒ€S €SŹđŒDŒ€T €TTňŒDŒ€U €UŒDŒ€V €VüóŒDŒ€W €WČőŒDŒ€X €XT÷ŒDŒ€Y €YŕřŒDŒ€Z €ZŒDŒ€\ €\űŒDŒ€] €]ĐűŒDŒ€^ €^`ýŒDŒ€` €`ŒDŒ€a €a0ŒDŒ€b €bXŒDŒ€c €c€ŒDŒ€d €dĐŒDŒ€e €e¨ŒDŒ€p €p¸ ŒDŒ€q €q|ŒDŒ€r €r@ŒDŒ€s €sŒDŒ€t €tŒDŒ€u €uŘ*ŒDŒ€v €v 8ŒDŒ€w €w¤HŒDŒ€x €xPRŒDŒ€y €y ÜŒDŒ€  € ŒDŒ€Ą €ĄŒDŒ€Ł €ŁČgŒDŒ€¤ €¤ˆhŒDŒ€Ľ €ĽHiŒDŒ€Ś €ŚjŒDŒ€§ €§ÔeŒDŒ€¨ €¨gŒDŒ€Š €ŠŒDŒ€Ş €ŞŒDŒ€Ť €ŤČjŒDŒ€­ €­ˆkŒDŒ€Ž €ŽHlŒDŒ€Ż €ŻhuŒDŒ€° €°ČyŒDŒ€ą €ąÔ{ŒDŒ€˛ €˛ŕ}ŒDŒ€ł €łěŒDŒ€´ €´$‚ŒDŒ€ľ €ľ\„ŒDŒ€ś €ś”†ŒDŒ€ˇ €ˇœˆŒDŒ€¸ €¸¤ŠŒDŒ€š €šʌŒDŒ€ş €şH˙ŒDŒ€ť €ťôŽŒDŒ€Ŕ €ŔD“ŒDŒ€Á €Á”–ŒDŒ€Â €Â°ŕšŒDŒ€Â €Â€ ŒDŒ€Ă €Ă°<§ŒDŒ€Ă €ĂdŹŒDŒ€Ä €Ä¨˛ŒDŒ€Ĺ €ĹġŒDŒ€Ć €ĆěźŒDŒ€Ç €ÇžŒDŒ€Č €ČdÂŒDŒ€É €É”ĆŒDŒ€Ę €Ę0ËŒDŒ€Ë €ËÄĐŒDŒ€Ě €ĚXÖŒDŒ€Í €ÍlÜŒDŒ€Î €ÎpâŒDŒ€Ď €Ď€čŒDŒ€ €ŒDŒ€ €ŒDŒ€ €ˆëŒDŒ€ €řîŒDŒ€ €XňŒDŒ€ €°dőŒDŒ€ €Ř÷ŒDŒ€ €”űŒDŒ€ €$ýŒDŒ€ €ÔgŒDŒ€ €ĐoŒDŒ€ €€uŒDŒ€ €´{ŒDŒ€ €°čŒDŒ€ € …ŒDŒ€ €@‹ŒDŒ€ €h‘ŒDŒ€ €ДŒDŒ€ €@œŒDŒ€ €¨ŸŒDŒ€ €pŒDŒ€ €ÔŒDŒ€ €´ŒDŒ€ €`ŒDŒ€ €œŒDŒ€ €ŒDŒ€  € °dŒDŒ€  € ŹŒDŒ€! €!°p#ŒDŒ€! €!¸(ŒDŒ€" €"|.ŒDŒ€# €#l2ŒDŒ€$ €$°\6ŒDŒ€$ €$¤;ŒDŒ€% €%°ôBŒDŒ€% €%°