MZ@ !L!This program cannot be run in DOS mode. $<թRթRթRԩRPԩRRichթRPEd["  T` .rdatap@@.rsrc @@[ T.rdataT.rdata$zzzdbg .rsrc$01!p.rsrc$02(@Xp   8%Z!( WEVT_TEMPLATEMUI 4VS_VERSION_INFO  98  98?StringFileInfo\040904B0LCompanyNameMicrosoft Corporation|*FileDescriptionMicrosoft-Windows-System-Events Resourcest*FileVersion10.0.14393.2312 (rs1_release.180607-1919)h$InternalNamemicrosoft-windows-system-events.dll.LegalCopyright Microsoft Corporation. All rights reserved.p$OriginalFilenamemicrosoft-windows-system-events.dllj%ProductNameMicrosoft Windows Operating SystemDProductVersion10.0.14393.2312DVarFileInfo$Translation CRIMX'/G!D?84Oצ]P!,"{+B/[OpsOQ3=Txc#w[HV]s]J+:WcL.?w;L?YFKB7vPY0J~W4"SKDiU?FMEOCEld `{MKf/e@ڊR_O](a.BJ;?&(/ '2 RCR۫AYH2^񿿁E|چd|56wuC$E7ܴP.KINo ́^aph*uOȮ ϛ#h *~_HOt(qP{_0*&^җ`"0ʜP-GDB'4)G WEVT4tCHAN0\PMicrosoft-Windows-Kernel-WDI/AnalyticLMicrosoft-Windows-Kernel-WDI/DebugXMicrosoft-Windows-Kernel-WDI/OperationalTTBL TEMP piS^(c`lgߜD EventDataA?oData'KName ProviderID A9oData!KNameEventID AMoData5KNameDroppedEventCount AAoData)KName ActionCount AMZ ComplexData'KName SemActions `|  4HlProviderIDEventID(DroppedEventCountActionCountSemActionsProviderIDLevelReservedKeyword$EnablePropertyNTStatusTEMP,X ڈ6MhYF㐍D EventDataA?oData'KName ProviderID A9oData!KNameEventID   ProviderIDEventIDTEMP  mx [GH kAD EventDataA?oData'KName ProviderID A9oData!KNameEventID A;oData#KNameNTStatus   4 ProviderIDEventIDNTStatusTEMP kgT,ptVD EventDataA?oData'KName ProviderID A9oData!KNameEventID AEoData-KName ScenarioCount AcZ ComplexData=KNameScenarioInflightItems x     (@ProviderIDEventID ScenarioCount0ScenarioInflightItemsProviderIDEventIDReserved InflightCountTEMP,4ڈ6MhYF㐍D EventDataA?oData'KName ProviderID A9oData!KNameEventID \xProviderIDEventIDTEMP {][9HNh`D EventDataA?oData'KName ProviderID 4ProviderIDTEMPh mx [GH kAD EventDataA?oData'KName ProviderID A9oData!KNameEventID A;oData#KNameNTStatus ProviderIDEventIDNTStatusTEMP^=yT[LgD EventDataA9oData!KNameSqmType A7oDataKNameSqmSid SqmTypeSqmSidTEMPD4H5Sp- #;BD EventDataAGoData/KNameSqmSessionGuid A5oDataKNameSqmID A9oData!KNameSqmType AWoData?KNameSqmDWORDDatapointValue $SqmSessionGuidSqmIDSqmType4SqmDWORDDatapointValueTEMP`/Z>]$zq!D EventDataAGoData/KNameSqmSessionGuid A5oDataKNameSqmID A9oData!KNameSqmType AOoData7KNameSqmStreamRowLength AQZ ComplexData+KName SqmStreamRow (Hh$SqmSessionGuidSqmIDSqmType,SqmStreamRowLength SqmStreamRow SqmTypeEntry SqmDWORDEntry$SqmStringEntryOPCO< 0< 0 0 0 0x00$0p0040LWDI_SEM_TASK_SCENARIO_OPCODE_STARTHWDI_SEM_TASK_SCENARIO_OPCODE_ENDPWDI_SEM_TASK_SCENARIO_OPCODE_TIMEOUTXWDI_SEM_TASK_SCENARIO_OPCODE_START_FAILEDTWDI_SEM_TASK_SCENARIO_OPCODE_END_FAILEDXWDI_SEM_TASK_SCENARIO_OPCODE_INFLIGHT_MAXLWDI_SEM_TASK_INIT_OPCODE_MISCONFIGPWDI_SEM_TASK_INIT_OPCODE_SCENARIO_MAXtWDI_SEM_TASK_INIT_OPCODE_SCENARIO_CONTEXT_PROVIDER_MAXdWDI_SEM_TASK_INIT_OPCODE_SCENARIO_END_EVENT_MAXPWDI_SEM_TASK_INIT_OPCODE_PROVIDER_MAXLEVLPP0PLwin:Errorwin:Warning(win:InformationalTASK p p0WDI_SEM_TASK_SCENARIO(WDI_SEM_TASK_INITKEYWt!L"`4pcontextdiagwin:SQMEVNT    8!! ! >8U ؋ D EventDataA3oDataKNameMode A?oData'KName ObjectType A?oData'KName ObjectName AAoData)KName ProcessName A[oDataCKNameObjectCreatorProcessName A?oData'KName AccessMask A=oData%KName TokenType AOoData7KNameImpersonationLevel A=oData%KName SessionId ACoData+KName LowBoxNumber AKoData3KNameTokenGroupsCount AOZ ComplexData)KName TokenGroups AMoData5KNameTokenPackageCount AQZ ComplexData+KName TokenPackage ASoData;KNameTokenCapabilityCount A[Z ComplexData5KNameTokenCapabilities ASoData;KNameTokenTrustLevelCount AWZ ComplexData1KNameTokenTrustLevel A_oDataGKNameSecurityDescriptorRevision A]oDataEKNameSecurityDescriptorControl AYoDataAKNameSecurityDescriptorOwner AYoDataAKNameSecurityDescriptorGroup ACoData+KName DaclRevision ACoData+KName DaclAceCount AGZ ComplexData!KNameDaclAce ACoData+KName SaclRevision ACoData+KName SaclAceCount AGZ ComplexData!KNameSaclAce HAXAtAAAABBDB\B|B BB BC8C`C!CCC(D\DDD"DDE&$E8E\EtEEEEFF,FHFTFhFFFModeObjectTypeObjectNameProcessName8ObjectCreatorProcessNameAccessMaskTokenType,ImpersonationLevelSessionId LowBoxNumber(TokenGroupsCountTokenGroups(TokenPackageCount TokenPackage0TokenCapabilityCount(TokenCapabilities0TokenTrustLevelCount$TokenTrustLevel<SecurityDescriptorRevision8SecurityDescriptorControl4SecurityDescriptorOwner4SecurityDescriptorGroup DaclRevision DaclAceCountDaclAce SaclRevision SaclAceCountSaclAce$GroupAttributesGroupSidPackageSid0CapabilityAttributes CapabilitySid TrustLevelSidAceTypeAceFlagsAccessMask SidAceTypeAceFlagsAccessMask SidTEMPK(JS1OlD EventDataA?oData'KName ActionName AAoData)KName ProcessName AAoData)KName AccountName AEoData-KName AuthorityName A9oData!KNameTokenId AKoData3KNameAuthenticationId A=oData%KName TokenType AOoData7KNameImpersonationLevel A?oData'KName TokenFlags AYoDataAKNameSidValuesReferenceCount AGoData/KNameSidValuesCount AKZ ComplexData%KName SidValues AeoDataMKNameSharedSidValuesReferenceCount ASoData;KNameSharedSidValuesCount AWZ ComplexData1KNameSharedSidValues M Mʬ]qX?o PD EventDataAEoData-KName MmPhase0Start ACoData+KName MmPhase0Stop  AAoData)KName Phase1Start  AMoData5KNameKsrExtensionStart  AKoData3KNameKsrExtensionStop  ASoData;KNameStartProcessorsStart  AQoData9KNameStartProcessorsStop   ,T LT lT T T T U MmPhase0Start MmPhase0StopPhase1Start(KsrExtensionStart(KsrExtensionStop0StartProcessorsStart,StartProcessorsStopOPCO01LUwin:InfoLEVLdPUPUwin:Error(win:InformationalTASKD`V|VVVVSystemStartSystemStop SoftBootInfo,BootPerformanceData(SystemTimeChangeKEYWDXW W@W,X<KERNEL_GENERAL_KEYWORD_TIMELKERNEL_GENERAL_SECURITY_ACCESSCHECKLKERNEL_GENERAL_TOKEN_SID_MANAGEMENT$BootPerformanceEVNT0x"@U|U`[!#@U|UDVd[!%@U|U!%@U|U!%@U|U!l%pU!<'pU!   )@U|U!  \0@U|UUh[!  4@U|UUl[! 4pUp[,@U|U!,.@U|U!@F|Ut[0O@U|U Vx[!Q@U|U(V|[WWHWHW(W8WHWHWWEVTZ[\\\ȧ@CHANt\XMicrosoft-Windows-Kernel-Process/AnalyticMAPSLl\BMAP\ ProcessFlagsTTBL KTEMPd^ q=[uT|D EventDataA=oData%KName ProcessID A?oData'KName CreateTime AIoData1KNameParentProcessID A=oData%KName SessionID A=oData%KName ImageName ^^^ _8_ProcessIDCreateTime$ParentProcessIDSessionIDImageNameTEMP!xX6fPjD EventDataAIoData1KNameFrozenProcessID $FrozenProcessIDTEMPLEnvz_%D EventDataAIoData1KNameFrozenProcessID A?oData'KName CreateTime ؍$FrozenProcessIDCreateTimeTEMP47ά Y`D EventDataACoData+KName Container ID A7oDataKNameJob ID A?oData'KName StatusCode p Container IDJob IDStatusCodeTEMP.n]y]bA"hD EventDataA7oDataKNameJob ID AMoData5KNameDiskIoAttribution A?oData'KName StatusCode $8`Job ID(DiskIoAttributionStatusCodeTEMPlw묌 U o &D EventDataA7oDataKNameJob ID AEoData-KName IoRateControl AAoData)KName ControlType A;oData#KNameRateType A?oData'KName RateAmount A?oData'KName StatusCode 4LhJob ID IoRateControlControlTypeRateTypeRateAmountStatusCodeTEMPLZePSG(/7'D EventDataA7oDataKNameJob ID AEoData-KName IoRateControl A9oData!KNameMaxIops  ACoData+KName MaxBandwidth  AGoData/KNameMaxTimePercent  AIoData1KNameReservationIops  ASoData;KNameReservationBandwidth  AWoData?KNameReservationTimePercent  AYoDataAKNameCriticalReservationIops  AcoDataKKNameCriticalReservationBandwidth AgoDataOKNameCriticalReservationTimePercent ACoData+KName ControlFlags A?oData'KName VolumeName A?oData'KName StatusCode dx ̚  D x 0PlJob ID IoRateControlMaxIops MaxBandwidth$MaxTimePercent$ReservationIops0ReservationBandwidth4ReservationTimePercent4CriticalReservationIops@CriticalReservationBandwidthDCriticalReservationTimePercent ControlFlagsVolumeNameStatusCodeTEMP @̶:SS[D EventDataA7oDataKNameJob ID AEoData-KName IoRateControl A9oData!KNameMaxIops  ACoData+KName MaxBandwidth  AGoData/KNameMaxTimePercent  AIoData1KNameReservationIops  ASoData;KNameReservationBandwidth  AWoData?KNameReservationTimePercent  AYoDataAKNameCriticalReservationIops  AcoDataKKNameCriticalReservationBandwidth AgoDataOKNameCriticalReservationTimePercent AAoData)KName SoftMaxIops AKoData3KNameSoftMaxBandwidth AOoData7KNameSoftMaxTimePercent ACoData+KName ControlFlags A?oData'KName VolumeName A?oData'KName StatusCode  ȣ ܣ D t ܤ  ` | Х Job ID IoRateControlMaxIops MaxBandwidth$MaxTimePercent$ReservationIops0ReservationBandwidth4ReservationTimePercent4CriticalReservationIops@CriticalReservationBandwidthDCriticalReservationTimePercentSoftMaxIops(SoftMaxBandwidth,SoftMaxTimePercent ControlFlagsVolumeNameStatusCodeTEMP8_P‹5ZƄ dD EventDataA=oData%KName KeyObject A7oDataKNameStatus A?oData'KName EntryCount A;oData#KNameDataSize A9oData!KNameKeyName  KeyObjectStatusEntryCountDataSizeKeyNameTEMPxTC^ζUGrD EventDataA=oData%KName KeyObject A7oDataKNameStatus A=oData%KName InfoClass A;oData#KNameDataSize A9oData!KNameKeyName AKoData3KNameCapturedDataSize ACoData+KName CapturedData  $<PxKeyObjectStatusInfoClassDataSizeKeyName(CapturedDataSize CapturedDataTEMP<tZvNɋP};ɖD EventDataACoData+KName HiveFilePath A;oData#KNameFileSize  HiveFilePathFileSizeTEMP\%{1Uϫ+FD EventDataAGoData/KNameTotalEntrySize AGoData/KNameBytesRecovered  $TotalEntrySize$BytesRecoveredTEMP9̡^`U@w `D EventDataA?oData'KName StatusCode StatusCodeTEMPT/mT6#W|4D EventDataACoData+KName HiveFilePath AGoData/KNameHiveMountPoint $ HiveFilePath$HiveMountPointTEMP9̡^`U@w `D EventDataA?oData'KName StatusCode StatusCodeTEMP8ݯI^voXD EventDataACoData+KName HiveFilePath AGoData/KNameHiveMountPoint A?oData'KName FlushFlags t HiveFilePath$HiveMountPointFlushFlagsTEMPpiT;qWwfD EventDataAEoData-KName BytesGathered  BytesGatheredTEMP@iT;qWwfD EventDataAEoData-KName BytesGathered T BytesGatheredTEMPLX˦i=I_Nm;D EventDataACoData+KName WritesIssued ACoData+KName BytesWritten  WritesIssued BytesWrittenTEMPL˦i=I_Nm;D EventDataACoData+KName WritesIssued ACoData+KName BytesWritten  WritesIssued BytesWrittenTEMP9̡^`U@w `D EventDataA?oData'KName StatusCode StatusCodeTEMP$VUV6QDY7{D EventDataA?oData'KName SourceFile A5oDataKNameFlags SourceFileFlagsTEMP9̡^`U@w `D EventDataA?oData'KName StatusCode StatusCodeTEMP$VUV6QDY7{D EventDataA?oData'KName SourceFile A5oDataKNameFlags SourceFileFlagsTEMPp9̡^`U@w `D EventDataA?oData'KName StatusCode StatusCodeTEMP<*KtS fg<fD EventDataAEoData-KName SourceKeyPath P SourceKeyPathTEMP9̡^`U@w `D EventDataA?oData'KName StatusCode StatusCodeOPCO!22  D    X    `  d X!p"#$%&'(4)\*+,-. win:Startwin:StopHRegPerfOpHiveMountBaseFileMountedPRegPerfOpHiveFlushBecameActiveFlusherHRegPerfOpShutdownRundownComplete4RegPerfOpSaveFileCopiedHRegPerfOpHiveMountLogEntryAppliedHRegPerfOpHiveFlushGatheredLogData<RegPerfOpShutdownFlushStart4RegPerfOpSaveTreeCopiedPRegPerfOpHiveFlushGatheredPrimaryData<RegPerfOpShutdownFlushStop8RegPerfOpSaveFileWrittenDRegPerfOpHiveFlushWroteLogFileLRegPerfOpHiveFlushWrotePrimaryFileTRegPerfOpHiveFlushBoostedActiveFlusherPRegPerfOpHiveFlushStartWaitForActivePRegPerfOpHiveFlushFinishWaitForActiveCreateKeyOpenKeyDeleteKeyQueryKeySetValueKey$DeleteValueKey QueryValueKey EnumerateKey(EnumerateValueKey0QueryMultipleValueKey(SetInformationKeyFlushKeyCloseKey(QuerySecurityKey$SetSecurityKeyLEVL@PH(win:InformationalTASKs@spssss(s\0RegPerfTaskHiveMount0RegPerfTaskHiveUnload0RegPerfTaskHiveFlush,RegPerfTaskShutdown,RegPerfTaskHiveLoad4RegPerfTaskHiveRestore,RegPerfTaskHiveSaveKEYW @@h @,DCloseKey(QuerySecurityKey$SetSecurityKey(EnumerateValueKey0QueryMultipleValueKey(SetInformationKeyFlushKeySetValueKey$DeleteValueKey QueryValueKey EnumerateKeyCreateKeyOpenKeyDeleteKeyQueryKeyEVNT- Է<! Է$<"@Ժ0<#`<<$ؿH<%T<&`<'l< (x< ) < *@ < +Ժ< ,Ժ<-Ժ<.Ժ<@@<| @X<| @<|@0L<|@@<@HL<@ @< @d< @< @< @t<@t<@<@<@ <@ L< @@<!@@<" @<# @<$@L<%@@<&@L<'@@<(@L<)@@<$* @|<$+ @<$, @<$-@pL<$DTdt$4WEVT0 || CHANtXMicrosoft-Windows-Kernel-Acpi/DiagnosticMAPS8\VMAP$VMAP$XVMAP$VMAPd       ,MapAcpiOverrideTypeHMapActiveCoolingDevicePowerState<MapAmlMethodInvocationState MapResetTypeTTBLXTEMPLh}9/`XuNytD EventDataACoData+KName ResourceFlag AAoData)KName GeneralFlag AKoData3KNameTypeSpecificFlag AAoData)KName Granularity  A?oData'KName AddressMin  A?oData'KName AddressMax  AOoData7KNameAddressTranslation  AEoData-KName AddressLength  (D l     ResourceFlagGeneralFlag(TypeSpecificFlagGranularityAddressMinAddressMax,AddressTranslation AddressLengthTEMP\K;T]cAl쪙D EventDataAAoData)KName GpeRegister AOoData7KNameUnexpectedEventMap  <GpeRegister,UnexpectedEventMapTEMP Èm_:RtD EventDataAioDataQKNameThermalZoneDeviceInstanceLength A]oDataEKNameThermalZoneDeviceInstance A3oDataKName_TMP A3oDataKName_PSV A3oDataKName_AC0 A3oDataKName_AC1 A3oDataKName_AC2 A3oDataKName_AC3 A3oDataKName_AC4 A3oDataKName_AC5 A3oDataKName_AC6 A3oDataKName_AC7 A3oDataKName_AC8 A3oDataKName_AC9 A3oDataKName_HOT A3oDataKName_CRT  < t           $ 4 D DThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance_TMP_PSV_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRTTEMPH|~\K+ISD EventDataAioDataQKNameThermalZoneDeviceInstanceLength A]oDataEKNameThermalZoneDeviceInstance AOoData7KNameActiveCoolingLevel A[oDataCKNameActiveCoolingDeviceIndex AYoDataAKNameFanDeviceInstanceLength AMoData5KNameFanDeviceInstance AKoData3KNamePowerStateLength A?oData'KName PowerState `0XDThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance,ActiveCoolingLevel8ActiveCoolingDeviceIndex4FanDeviceInstanceLength(FanDeviceInstance(PowerStateLengthPowerStateTEMPpnV^_V?{LvD EventDataAioDataQKNameThermalZoneDeviceInstanceLength A]oDataEKNameThermalZoneDeviceInstance AOoData7KNameActiveCoolingLevel A[oDataCKNameActiveCoolingDeviceIndex AYoDataAKNameFanDeviceInstanceLength AMoData5KNameFanDeviceInstance A?oData'KName PowerState @x8DThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance,ActiveCoolingLevel8ActiveCoolingDeviceIndex4FanDeviceInstanceLength(FanDeviceInstancePowerStateTEMP]}[qMD EventDataASoData;KNameDeviceInstanceLength AGoData/KNameDeviceInstance A?oData'KName PowerState  0DeviceInstanceLength$DeviceInstancePowerStateTEMPt۸̫Sm`D EventDataASoData;KNameDeviceInstanceLength AGoData/KNameDeviceInstance A;oData#KNameThrottle 0DeviceInstanceLength$DeviceInstanceThrottleTEMPXA*7U G9PJD EventDataASoData;KNameDeviceInstanceLength AGoData/KNameDeviceInstance A?oData'KName PowerState A;oData#KNameThrottle @\0DeviceInstanceLength$DeviceInstancePowerStateThrottleTEMP@j焴YE3rZ6D EventDataAioDataQKNameThermalZoneDeviceInstanceLength A]oDataEKNameThermalZoneDeviceInstance AAoData)KName Temperature `DThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstanceTemperatureTEMPe`g~\G D EventDataAQoData9KNameAmlMethodNameLength AEoData-KName AmlMethodName AGoData/KNameAmlMethodState 0 \ 8| ,AmlMethodNameLength AmlMethodName$AmlMethodStateTEMP,,P,q"^8Iy,z D EventDataA]oDataEKNameThermalZoneBiosNameLength AQoData9KNameThermalZoneBiosName A3oDataKName_TMP A3oDataKName_PSV A3oDataKName_TC1 A3oDataKName_TC2 A3oDataKName_TSP A3oDataKName_AC0 A3oDataKName_AC1 A3oDataKName_AC2 A3oDataKName_AC3 A3oDataKName_AC4 A3oDataKName_AC5 A3oDataKName_AC6 A3oDataKName_AC7 A3oDataKName_AC8 A3oDataKName_AC9 A3oDataKName_HOT A3oDataKName_CRT A3oDataKName_NTT A=oData%KName _PSLCount AAoData)KName _PSLEntries A=oData%KName _TZDCount AAoData)KName _TZDEntries A=oData%KName _AL0Count AAoData)KName _AL0Entries A=oData%KName _AL1Count AAoData)KName _AL1Entries A=oData%KName _AL2Count AAoData)KName _AL2Entries A=oData%KName _AL3Count AAoData)KName _AL3Entries A=oData%KName _AL4Count AAoData)KName _AL4Entries !A=oData%KName _AL5Count "AAoData)KName _AL5Entries #A=oData%KName _AL6Count $AAoData)KName _AL6Entries %A=oData%KName _AL7Count &AAoData)KName _AL7Entries 'A=oData%KName _AL8Count (AAoData)KName _AL8Entries )A=oData%KName _AL9Count *AAoData)KName _AL9Entries +//$040D0T0d0t00000000011$141D1\1x1111112,2H2`2|2 22"22$23&03L3(d33*38ThermalZoneBiosNameLength,ThermalZoneBiosName_TMP_PSV_TC1_TC2_TSP_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRT_NTT_PSLCount_PSLEntries_TZDCount_TZDEntries_AL0Count_AL0Entries_AL1Count_AL1Entries_AL2Count_AL2Entries_AL3Count_AL3Entries_AL4Count_AL4Entries_AL5Count_AL5Entries_AL6Count_AL6Entries_AL7Count_AL7Entries_AL8Count_AL8Entries_AL9Count_AL9EntriesTEMP--?~kURQow D EventDataA]oDataEKNameThermalZoneBiosNameLength AQoData9KNameThermalZoneBiosName A3oDataKName_TMP A3oDataKName_PSV A3oDataKName_TC1 A3oDataKName_TC2 A3oDataKName_TSP A3oDataKName_AC0 A3oDataKName_AC1 A3oDataKName_AC2 A3oDataKName_AC3 A3oDataKName_AC4 A3oDataKName_AC5 A3oDataKName_AC6 A3oDataKName_AC7 A3oDataKName_AC8 A3oDataKName_AC9 A3oDataKName_HOT A3oDataKName_CRT A3oDataKName_NTT A=oData%KName _PSLCount AAoData)KName _PSLEntries A=oData%KName _TZDCount AAoData)KName _TZDEntries A=oData%KName _AL0Count AAoData)KName _AL0Entries A=oData%KName _AL1Count AAoData)KName _AL1Entries A=oData%KName _AL2Count AAoData)KName _AL2Entries A=oData%KName _AL3Count AAoData)KName _AL3Entries A=oData%KName _AL4Count AAoData)KName _AL4Entries !A=oData%KName _AL5Count "AAoData)KName _AL5Entries #A=oData%KName _AL6Count $AAoData)KName _AL6Entries %A=oData%KName _AL7Count &AAoData)KName _AL7Entries 'A=oData%KName _AL8Count (AAoData)KName _AL8Entries )A=oData%KName _AL9Count *AAoData)KName _AL9Entries +AIoData1KNameMinimumThrottle ,8CpCCCCCCCC DD,DD EventDataAMoData5KNameFanBiosNameLength AAoData)KName FanBiosName A?oData'KName PowerState hvvv(FanBiosNameLengthFanBiosNamePowerStateTEMPw (ZӖzD EventDataAMoData5KNameFanBiosNameLength AAoData)KName FanBiosName A9oData!KNameControl 0xXxtx(FanBiosNameLengthFanBiosNameControlTEMP`z-F)徤^Y(KPCD EventDataAioDataQKNameThermalZoneDeviceInstanceLength A]oDataEKNameThermalZoneDeviceInstance ASoData;KNameDeviceInstanceLength AGoData/KNameDeviceInstance A?oData'KName PowerState z@{x{{{DThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance0DeviceInstanceLength$DeviceInstancePowerStateTEMPl~7iup]^H)D EventDataAioDataQKNameThermalZoneDeviceInstanceLength A]oDataEKNameThermalZoneDeviceInstance ASoData;KNameDeviceInstanceLength AGoData/KNameDeviceInstance AEoData-KName ThrottleLimit d~~~4DThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance0DeviceInstanceLength$DeviceInstance ThrottleLimitTEMP`؀ro窯QZٍPD EventDataASoData;KNameDeviceBiosNameLength AGoData/KNameDeviceBiosName AIoData1KNameDeviceResetType A7oDataKNameStatus (X\|0DeviceBiosNameLength$DeviceBiosName$DeviceResetTypeStatusTEMPT] VDWgguFlD EventDataAKoData3KNameAcpiOverrideType h(AcpiOverrideTypeTEMP|!6;xv0RF*D EventDataA5oDataKNameScope A7oDataKNameObject A7oDataKNameStatus ԃScopeObjectStatusOPCOLEVLdP<PTwin:Error(win:InformationalTASKdԆef(g\hićjklDmtnoȈpqr4shtuv(wDxd,ResourceTranslation(GpeEventHandling4TemperatureNotification0TripPointNotification8ActiveCoolingDevicePower$AmlMethodTrace,DeviceActiveCooling0DevicePassiveCooling0DeviceCoolingRundown(TemperatureChange,ThermalZoneRundownFanRundown,FanPowerStateChange$FanStatusChange4ActiveCoolingConstraintDActiveCoolingConstraintRundown8PassiveCoolingConstraintDPassiveCoolingConstraintRundownDeviceReset AcpiOverrideAMLIErrorKEYW܊ $acpi:Diagnostic acpi:Thermal ms:TelemetryEVNT,d0e 0fh0gh0܄hT 0h0i0jT00 k <0L l 0h mt0 n 0  n30 nPG0 nH\0 oHr0pt0؅ qv0$rx0(sx0,,t{0H0u{0d4v T08w 0@x$HWEVTt+,|P0T`CHANxА\Microsoft-Windows-International/OperationalTTBLPTEMPT!ӊVj̊c%D EventDataAAoData)KName RegistryKey A=oData%KName ErrorCode A9oData!KNameMessage ĒRegistryKeyErrorCodeMessageTEMP<(JP=L mD EventDataAAoData)KName RegistryKey A?oData'KName StatusCode ܓRegistryKeyStatusCodeTEMPX=A+ SAEQbD EventDataAAoData)KName RegistryKey RegistryKeyTEMP,Ӭ"S^LnD EventDataA;oData#KNameCodePage A;oData#KNameFileName ؕCodePageFileNameTEMP,ܖ^٤T/miD EventDataA?oData'KName LocaleName A7oDataKNameWinDir  LocaleNameWinDirTEMPp̘aM.|P#2*3odD EventDataA=oData%KName ProcessId AAoData)KName ProdessName A7oDataKNameLocale A7oDataKNameLCType A;oData#KNamelpLCData 0HdxProcessIdProdessNameLocaleLCTypelpLCDataTEMP 5RN!=D EventDataA=oData%KName ProcessId AAoData)KName ProdessName A7oDataKNameLocale A;oData#KNameCalendar A9oData!KNameCalType A?oData'KName lpLCalData 0D\pProcessIdProdessNameLocaleCalendarCalTypelpLCalDataTEMP]BP=C#D EventDataA=oData%KName ProcessId AAoData)KName ProdessName A5oDataKNameGeoId ProcessIdProdessNameGeoIdTEMPȟ G}P4munD EventDataA?oData'KName LocaleName A5oDataKNameFlags A=oData%KName ProcessId AAoData)KName ProdessName A?oData'KName ReturnCode ,HXpLocaleNameFlagsProcessIdProdessNameReturnCodeTEMP8ٰU:Rw?ZZD EventDataA=oData%KName ProcessId AAoData)KName ProdessName ġProcessIdProdessNameTEMPUhMMP%BD EventDataA;oData#KNameFileName A?oData'KName LineNumber A7oDataKNameReason 0HdFileNameLineNumberReasonTEMPA]EventXML+xmlns User-Loader&. FailureReason & ImportDllName ,1ProcessImagePath Tt FailureReason ImportDllName(ProcessImagePathTEMPL԰R7nU]= A]EventXML+xmlns User-Loader,1ProcessImagePath & CurDirDllPath (ProcessImagePath CurDirDllPathTEMPR ֿypTZ4,XA]EventXML+xmlns User-Loader,1ProcessImagePath & CurDirDllPath $ FoundDllPath Lt(ProcessImagePath CurDirDllPath FoundDllPathTEMP(/ETRO^]LD EventDataAEoData-KName FailureReason AEoData-KName ImportDllName AKoData3KNameProcessImagePath (Hh FailureReason ImportDllName(ProcessImagePathTEMP D EventDataA=oData%KName ProcessId AUoData=KNameSuspendProcessRequest A9oData!KNameDLLName ProcessId0SuspendProcessRequestDLLNameOPCO01,win:InfoLEVLUPPP win:Criticalwin:Errorwin:Warning(win:InformationalTASKKEYW4t @X  LUSER_LOADER_KEYWORD_DEPRECATED_DLLPUSER_LOADER_FATAL_CALLBACK_EXCEPTIONHUSER_LOADER_KEYWORD_LOAD_FAILURE@USER_LOADER_LAUNCH_16BIT_APPTUSER_LOADER_KEYWORD_COMPONENT_ON_DEMANDPUSER_LOADER_KEYWORD_LOAD_FATAL_ERROREVNTp  8 tT  tT@  tT  tT L tT 8 hT 8 hT D tT  8 PT   t4   h4   \4$4DTdddWEVT,TCHAN4lMicrosoft-Windows-Kernel-BootDiagnostics/DiagnosticOPCO02win:StartLEVL@P(win:InformationalTASKD8SystemBootKEYWD1p(win:ResponseTimeEVNTD$`WEVT|5D`XCHAN|``Microsoft-Windows-Kernel-Prefetch/DiagnosticTTBL(. TEMPhT {]̝SV..ϪRD EventDataAOoData7KNameScenarioNameLength ACoData+KName ScenarioName AGoData/KNameScenarioHashId ACoData+KName ScenarioType ,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeTEMP0nd^ᥦ\-y6D EventDataAOoData7KNameScenarioNameLength ACoData+KName ScenarioName AGoData/KNameScenarioHashId ACoData+KName ScenarioType AEoData-KName PrefetchPhase ACoData+KName PrefetchType AGoData/KNameIsTricklePhase ,Xx,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType PrefetchPhase PrefetchType$IsTricklePhaseTEMP; /T'6zf>D EventDataAOoData7KNameScenarioNameLength ACoData+KName ScenarioName AGoData/KNameScenarioHashId ACoData+KName ScenarioType AMoData5KNamePrefetchPhaseMask ACoData+KName PrefetchType AGoData/KNameIsTricklePhase  Ll,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType(PrefetchPhaseMask PrefetchType$IsTricklePhaseTEMP ( QNoYAD EventDataAOoData7KNameScenarioNameLength ACoData+KName ScenarioName AGoData/KNameScenarioHashId ACoData+KName ScenarioType AEoData-KName PrefetchPhase ACoData+KName PrefetchType AGoData/KNameIsTricklePhase AOoData7KNameNumPagesPrefetched  ACoData+KName NumReadLists (Ll ,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType PrefetchPhase PrefetchType$IsTricklePhase,NumPagesPrefetched NumReadListsTEMP 0|Xo^{k1lD EventDataAOoData7KNameScenarioNameLength ACoData+KName ScenarioName AGoData/KNameScenarioHashId ACoData+KName ScenarioType AMoData5KNamePrefetchPhaseMask ACoData+KName PrefetchType AGoData/KNameIsTricklePhase AOoData7KNameNumPagesPrefetched  ACoData+KName NumReadLists 0Tt  ,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType(PrefetchPhaseMask PrefetchType$IsTricklePhase,NumPagesPrefetched NumReadListsTEMP<޲5UKvD EventDataAOoData7KNameScenarioNameLength ACoData+KName ScenarioName AGoData/KNameScenarioHashId ACoData+KName ScenarioType AEoData-KName PrefetchPhase d,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType PrefetchPhaseTEMP*Beh9[ D EventDataAOoData7KNameScenarioNameLength ACoData+KName ScenarioName AGoData/KNameScenarioHashId ACoData+KName ScenarioType AMoData5KNamePrefetchPhaseMask T,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType(PrefetchPhaseMaskTEMPh {]̝SV..ϪRD EventDataAOoData7KNameScenarioNameLength ACoData+KName ScenarioName AGoData/KNameScenarioHashId ACoData+KName ScenarioType 0T,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeTEMP@.d2ˮVO`D EventDataAOoData7KNameScenarioNameLength ACoData+KName ScenarioName AGoData/KNameScenarioHashId ACoData+KName ScenarioType A=oData%KName EndReason 4,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeEndReasonTEMP\Icܑ(0D EventDataAOoData7KNameScenarioNameLength ACoData+KName ScenarioName AGoData/KNameScenarioHashId ACoData+KName ScenarioType AAoData)KName ActionFlags AAoData)KName TraceReason AGoData/KNamePrefetchReason <h,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeActionFlagsTraceReason$PrefetchReasonTEMP 4Y UZD EventDataAOoData7KNameScenarioNameLength ACoData+KName ScenarioName AGoData/KNameScenarioHashId ACoData+KName ScenarioType AAoData)KName ActionFlags AAoData)KName TraceReason AGoData/KNamePrefetchReason AAoData)KName NumLaunches AWoData?KNameTimeSinceLastLaunchInS 4Xx,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeActionFlagsTraceReason$PrefetchReasonNumLaunches4TimeSinceLastLaunchInSTEMPZ G,GQW93D EventDataAOoData7KNameScenarioNameLength ACoData+KName ScenarioName AGoData/KNameScenarioHashId ACoData+KName ScenarioType AGoData/KNameWorkItemsCount \,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioType$WorkItemsCountTEMPޞoد=QID EventDataAOoData7KNameScenarioNameLength ACoData+KName ScenarioName AGoData/KNameScenarioHashId ACoData+KName ScenarioType A=oData%KName NumPhases @l,ScenarioNameLength ScenarioName$ScenarioHashId ScenarioTypeNumPhasesOPCOx1202Hwin:Infowin:Startwin:StopLEVL@Px(win:InformationalTASKp  <(PrefetchSections(PrefetchMetadataOpenVolumesEndTrace(ScenarioDecision GetReadListsAsyncWorkerKEYWD t(BasicInformationEVNT 4lP lP  lP  lP ,l P l$P , l(P  l,P l0P  l4P tl8P Ll<P (l@P  $l8DP   l8HP  lTLP   lTPP  lTTPddddddddddddddddddWEVT$      CHANdHMicrosoft-Windows-UAC/OperationalTTBL\TEMPP )5H7^AdD EventDataOPCOLEVL0P win:ErrorTASKH  CreateProcessKEYWEVNT@0   WEVT    D P  CHAN` DMicrosoft-Windows-COM/AnalyticTTBLTEMP wNm\"l):NVD EventDataA5oDataKNameCLSID  CLSIDOPCO01 win:InfoLEVL@P (win:InformationalTASKKEYWLl 0COM_CLASSNOTREG_ERROREVNTD$     \ WEVTdL   CHAN8h  ApplicationTTBLTEMPḨVv@gA8PathxmlnsDhttp://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0&Q AttemptedPath  AttemptedPathTEMP$Ew\C__3A PathAndGuidxmlnsDhttp://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0&Q AttemptedPath " SrpRuleGuid Ll AttemptedPathSrpRuleGuidTEMP7z7--WjMi(JRA@%PathGuidAndRulexmlnsDhttp://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0&Q AttemptedPath " SrpRuleGuid RulePath 8Xt AttemptedPathSrpRuleGuidRulePathOPCOLEVLhPPwin:Warning(win:InformationalTASKKEYWEVNT02 2 X a a X b b X c c X d d X r r X WEVTH$&&4'@'CHANPDHMicrosoft-Windows-MUI/Operational<Microsoft-Windows-MUI/AdminDMicrosoft-Windows-MUI/Analytic<Microsoft-Windows-MUI/DebugTTBLTEMP$*QqXD EventDataA7oDataKNameStatus StatusTEMPPxa8pRX1z`D EventDataAioDataQKNamecchParentImagePathIncludingNull AAoData)KName FeatureGuid AcoDataKKNameParentProcessImageHeaderHash AIoData1KNameParentImagePath D????DcchParentImagePathIncludingNullFeatureGuid@ParentProcessImageHeaderHash$ParentImagePathTEMP CU[W_yxD EventDataA5oDataKNameFlags A[oDataCKNamecchIdStringIncludingNull AYoDataAKNamecchDllPathIncludingNull A;oData#KNameCategory AIoData1KNameManifestVersion AEoData-KName DllHeaderHash A_oDataGKNameApplicationImageHeaderHash A;oData#KNameIdString A9oData!KNameDllPath CCDLDdDDDDDFlags8cchIdStringIncludingNull4cchDllPathIncludingNullCategory$ManifestVersion DllHeaderHash<ApplicationImageHeaderHashIdStringDllPathTEMPx8G]ngP\\堟D EventDataA5oDataKNameFlags A[oDataCKNamecchIdStringIncludingNull A;oData#KNameCategory AIoData1KNameManifestVersion A_oDataGKNameApplicationImageHeaderHash A;oData#KNameIdString GGGH4HpHFlags8cchIdStringIncludingNullCategory$ManifestVersion<ApplicationImageHeaderHashIdStringOPCOLEVL@PH(win:InformationalTASKIIIJ4J`JJAitFeature,AitParentAitFeatureAitAppInfo,AitSystemUsageByDll,AitSystemUsageByExe AitProcessEndKitFeatureKEYWEVNT`9HH4=HHp7HI@H4IEHPIHlI;HIWEVT0pLlMxMMMMTTBLTEMP(M{U+0"vD EventDataAUoData=KNameAeLookupServieTrigger $D EventDataASoData;KNameSwitchBranchImplGuid A_oDataGKNameSwitchBranchImplNameLength ASoData;KNameSwitchBranchImplName AmoDataUKName!SwitchBranchImplDescriptionLength AaoDataIKNameSwitchBranchImplDescription ,d\ddde0SwitchBranchImplGuid<SwitchBranchImplNameLength0SwitchBranchImplNameHSwitchBranchImplDescriptionLength<SwitchBranchImplDescriptionTEMPtf=t\UZD EventDataAMoData5KNameTargetContextGuid AMoData5KNameTargetContextType AKoData3KNameModuleNameLength A?oData'KName ModuleName ,gTg|gg(TargetContextGuid(TargetContextType(ModuleNameLengthModuleNameTEMPhhmUlSG41tD EventDataASoData;KNameContextUpdateCounter  |h0ContextUpdateCounterOPCOLEVL@Ph(win:InformationalTASKtiiiiAeSbCallAeSbImpl(AeSbContextUpdate0AeSbContextReadRetryKEYWEVNT ^hiah iLeh;QD EventDataAAoData)KName SessionGuid A?oData'KName LoggerMode AAoData)KName SessionName AAoData)KName LogFileName AGoData/KNameMinimumBuffers AGoData/KNameMaximumBuffers A?oData'KName BufferSize AKoData3KNamePeakBuffersCount AQoData9KNameCurrentBuffersCount AGoData/KNameFlushThreshold ԭ 0TpĮSessionGuidLoggerModeSessionNameLogFileName$MinimumBuffers$MaximumBuffersBufferSize(PeakBuffersCount,CurrentBuffersCount$FlushThresholdTEMP  .tXWG D EventDataAAoData)KName SessionName AIoData1KNameSecurityDescOld AIoData1KNameSecurityDescNew \xSessionName$SecurityDescOld$SecurityDescNewTEMP$˥YP_y.D EventDataA?oData'KName ProviderId A?oData'KName StatusCode A9oData!KNameEventId AAoData)KName SessionName tProviderIdStatusCodeEventIdSessionNameTEMP<9'H*bRJD EventDataACoData+KName ProviderName AAoData)KName SessionName AIoData1KNameMatchAnyKeyword  AIoData1KNameMatchAllKeyword  AGoData/KNameEnableProperty A5oDataKNameLevel `   ProviderNameSessionName$MatchAnyKeyword$MatchAllKeyword$EnablePropertyLevelTEMP̷茴 \iD EventDataA;oData#KNameFileName A?oData'KName BufferSize AKoData3KNameBuffersPersisted AGoData/KNameBuffersWritten A7oDataKNameStatus 0HdFileNameBufferSize(BuffersPersisted$BuffersWrittenStatusOPCO1x22   (PtȺ L|win:Infowin:Startwin:Stop4ETW_OPCODE_WRITE_BUFFER4ETW_OPCODE_FILE_SWITCH(ETW_OPCODE_START$ETW_OPCODE_STOP(ETW_OPCODE_FLUSH,ETW_OPCODE_REGISTER0ETW_OPCODE_UNREGISTER(ETW_OPCODE_ENABLE,ETW_OPCODE_DISABLE0ETW_OPCODE_CONFIGUREHETW_OPCODE_USER_MODE_STACK_TRACELEVLPPP4U\win:Errorwin:Warning(win:Informationalwin:VerboseTASK,T|Խ(ETW_TASK_LOGGING(ETW_TASK_SESSION(ETW_TASK_PROVIDER0ETW_TASK_STACK_TRACE,ETW_TASK_LOST_EVENT,SavePersistedLoggerKEYWx @Ծ,ETW_KEYWORD_SESSION0ETW_KEYWORD_PROVIDER4ETW_KEYWORD_LOST_EVENT8ETW_KEYWORD_SOFT_RESTARTEVNT  TлԚ ܻԚ T лԚTл ԚpлԚ  ܻԚ TлԚ @0  @<   @` $  @ ( @`, @0 @``4 @`$8 @PH< @ܲH@ @PTD@``Hlؼ@илLиPܸTXил\Ԛ8888888HH888888HHH8X8hhhWEVTX;D<<HJCHANlSystemTMicrosoft-Windows-Kernel-Boot/AnalyticXMicrosoft-Windows-Kernel-Boot/OperationalMAPS0,VMAPTdefBMAPt  @    4EnableDisableReasonMap VsmPolicyMapTTBLtTTEMP`ǍY<D EventDataA9oData!KNameSqmType AGoData/KNameSqmSessionGuid A5oDataKNameSqmID AOoData7KNameSqmStreamRowLength AQZ ComplexData+KName SqmStreamRow h|<SqmType$SqmSessionGuidSqmID,SqmStreamRowLength SqmStreamRow SqmTypeEntry SqmDWORDEntry$SqmStringEntryTEMPt*dŸ[|5NRD EventDataA5oDataKNameWidth A7oDataKNameHeight ACoData+KName BitsPerPixel WidthHeight BitsPerPixelTEMPAg[k#l't`D EventDataA?oData'KName BytesPerMs BytesPerMsTEMP 1ĒBW[nTs,D EventDataA;oData#KNameDeviceID A;oData#KNameFileName A=oData%KName BytesRead  ACoData+KName BytesWritten  h  DeviceIDFileNameBytesRead BytesWrittenTEMPj_D EventDataAIoData1KNameApplicationGuid A=oData%KName BytesRead  ACoData+KName BytesWritten  8 \ t$ApplicationGuidBytesRead BytesWrittenTEMPf RۓF,D EventDataA=oData%KName ImageName A?oData'KName ImageFlags A7oDataKNameReason ACoData+KName ErrorIgnored D\xImageNameImageFlagsReason ErrorIgnoredTEMPD4~MQ9TsK,^.bD EventDataAAoData)KName BootmgrTime  XBootmgrTimeTEMPHQb^D EventDataA=oData%KName ImageName ImageNameTEMPR6AmZbD EventDataAAoData)KName DriveNumber DriveNumberTEMPX@a]0gډzD EventDataAAoData)KName FwStartPage AAoData)KName FwPageCount  ACoData+KName FwMemoryType AOoData7KNameFwMemoryAttributes AAoData)KName BlStartPage  AAoData)KName BlPageCount  ACoData+KName BlMemoryType AOoData7KNameBlMemoryAttributes  L h  (FwStartPageFwPageCount FwMemoryType,FwMemoryAttributesBlStartPageBlPageCount BlMemoryType,BlMemoryAttributesTEMP"jfg$\LhD EventDataAGoData/KNamePreBootMgrTime  $PreBootMgrTimeTEMP@&6ؕ]nZHD EventDataAKoData3KNameUefiVariableName A3oDataKNameSize A7oDataKNameStatus |(UefiVariableNameSizeStatusTEMP@7":Q:bMD EventDataAIoData1KNameApplicationGuid A9oData!KNameElement $ApplicationGuidElementTEMP$*QqXD EventDataA7oDataKNameStatus StatusTEMPH$*QqXD EventDataA7oDataKNameStatus \StatusTEMPLTIQH\pԦD EventDataAEoData-KName FailureStatus ACoData+KName FailureMsgId   |  FailureStatus FailureMsgIdTEMPP )5H7^AdD EventDataTEMPHtjIQBna`D EventDataA?oData'KName EntryCount EntryCountTEMPdX4``D EventDataA?oData'KName ToolsCount xToolsCountTEMP\;WQ[\4D EventDataAKoData3KNameLastShutdownGood ACoData+KName LastBootGood    (LastShutdownGood LastBootGoodTEMP ryWyþThD EventDataAGoData/KNameOptionSelected $OptionSelectedTEMPP)5H7^AdD EventDataTEMPPd)5H7^AdD EventDataTEMPP)5H7^AdD EventDataTEMPPS/y^q0hD EventDataAGoData/KNameBootMenuPolicy d$BootMenuPolicyTEMPP)5H7^AdD EventDataTEMPhw-g0^ " \D EventDataA;oData#KNameBootType |BootTypeTEMP4l ;H^FߟUD EventDataA;oData#KNameBootType AAoData)KName LoadOptions BootTypeLoadOptionsTEMP,v5Y0EX5f0qD EventDataAEoData-KName ResetEndStart AKoData3KNameLoadOSImageStart  AMoData5KNameStartOSImageStart  AUoData=KNameExitBootServicesEntry  ASoData;KNameExitBootServicesExit   $ D l   ResetEndStart(LoadOSImageStart(StartOSImageStart0ExitBootServicesEntry0ExitBootServicesExitTEMP$*QqXD EventDataA7oDataKNameStatus StatusTEMPT{b(]O]9xD EventDataAWoData?KNameBitlockerUserInputTime  h4BitlockerUserInputTimeTEMPHm[ MkV,BctD EventDataA=oData%KName ImageName AIoData1KNameImageLoadStatus ImageName$ImageLoadStatusTEMPXbIU2Z"MD EventDataAAoData)KName PeImageName AMoData5KNamePeImageLoadStatus PeImageName(PeImageLoadStatusTEMPQI-Rd(PrD EventDataAQoData9KNameUpdateCapsuleStatus ,UpdateCapsuleStatusTEMP\JM9T2`0cXD EventDataAAoData)KName DeviceFlags A=oData%KName PcrBitmap AUoData=KNameUpdateSupportedStatus DeviceFlagsPcrBitmap0UpdateSupportedStatusTEMPHm[ MkV,BctD EventDataA=oData%KName ImageName AIoData1KNameImageLoadStatus  ImageName$ImageLoadStatusTEMPH(m[ MkV,BctD EventDataA=oData%KName ImageName AIoData1KNameImageLoadStatus PhImageName$ImageLoadStatusTEMPDl#|'$\-]HD EventDataA=oData%KName ImageName AGoData/KNameSiPolicyStatus ImageName$SiPolicyStatusTEMPDT&{ZputD EventDataA;oData#KNameHiveName AGoData/KNameHiveLoadStatus HiveName$HiveLoadStatusTEMP$*QqXD EventDataA7oDataKNameStatus StatusTEMPT$*QqXD EventDataA7oDataKNameStatus hStatusTEMPXS#…H9D EventDataA3oDataKNamePath A?oData'KName FailedPath A7oDataKNameStatus PathFailedPathStatusTEMPxdC6lZ'H_?ZD EventDataA3oDataKNamePath A7oDataKNameImport A7oDataKNameStatus DThPathImportStatusTEMP$NjzpPN?tD EventDataAKoData3KNameCachedCopyStatus AQoData9KNameIdkGenerationStatus AIoData1KNameMeasuringStatus AYoDataAKNameSealingAndCachingStatus t(CachedCopyStatus,IdkGenerationStatus$MeasuringStatus4SealingAndCachingStatusTEMPhXy49QZݐ|N! D EventDataAKoData3KNameCachedCopyStatus A]oDataEKNameUnsealingCachedCopyStatus A_oDataGKNameKeyGenerationAndSaveStatus AEoData-KName SealingStatus A?oData'KName TpmPcrMask AeoDataMKNameProtectorAssistedUnsealStatus AeoDataMKNameProtectorAssistedResealStatus A]oDataEKNameProtectorSealUpdateStatus  XP(CachedCopyStatus8UnsealingCachedCopyStatus<KeyGenerationAndSaveStatus SealingStatusTpmPcrMask@ProtectorAssistedUnsealStatus@ProtectorAssistedResealStatus8ProtectorSealUpdateStatusTEMP4*TXYY\xD EventDataAWoData?KNameRetrieveDriverListTime  H4RetrieveDriverListTimeTEMPEa3[>B:jD EventDataAIoData1KNameLoadDriversTime  0$LoadDriversTimeTEMP,(.=W$ V^ϻпD EventDataA3oDataKNamePath ACoData+KName LoadHiveTime  P `Path LoadHiveTimeTEMPZ\JZd$D EventDataAUoData=KNameApplicationIdentifier AQoData9KNameApplicationLoadTime   0ApplicationIdentifier,ApplicationLoadTimeTEMP L/!~U1&ݟ)D EventDataAUoData=KNameApplicationIdentifier A[oDataCKNameApplicationExecutionTime  <  l 0ApplicationIdentifier8ApplicationExecutionTimeTEMP$t ,L&SYD EventDataA7oDataKNameStatus A;oData#KNameFileName   StatusFileNameTEMP4 x_TU]xD EventDataA7oDataKNameStatus ACoData+KName FailurePoint   Status FailurePointTEMP $*QqXD EventDataA7oDataKNameStatus  StatusTEMPT 5 0&UHv%pD EventDataAOoData7KNameReserveDescriptors h ,ReserveDescriptorsTEMP~]ͽ'1D EventDataAEoData-KName ApplicationId A;oData#KNameRunCount A=oData%KName PageCount   ( ApplicationIdRunCountPageCountTEMP sZj_jz(V(D EventDataA7oDataKNameStatus A9oData!KNameBlockId  4 HStatusBlockIdTEMP'v~rPxzx^X VrD EventDataAQoData9KNameFreePersistentPages  ,FreePersistentPagesTEMPD$ *P 7`:oD EventDataA7oDataKNameStatus AKoData3KNameOutstandingCount  L `Status(OutstandingCountTEMPh| NYBB D EventDataAEoData-KName ApplicationId AQoData9KNameFreePersistentPages    ApplicationId,FreePersistentPagesTEMP$*?SYz\D EventDataAEoData-KName ApplicationId A9oData!KNameBlockId  AQoData9KNameFreePersistentPages  `   ApplicationIdBlockId,FreePersistentPagesTEMP/yTQlC\VD EventDataAEoData-KName ApplicationId A9oData!KNameBlockId  A5oDataKNameFlags  4H ApplicationIdBlockIdFlagsTEMPp݆@:[%ʼnDYD EventDataA7oDataKNameStatus AAoData)KName RunsClaimed A=oData%KName PageCount   StatusRunsClaimedPageCountTEMP'v~rPxzx^X VrD EventDataAQoData9KNameFreePersistentPages  ,FreePersistentPagesTEMP87!~Z]I)D EventDataAEoData-KName ApplicationId A9oData!KNameBlockId    ApplicationIdBlockIdTEMP re ~SVC.`JD EventDataA3oDataKNameType A5oDataKNameFlags A?oData'KName BufferSize \l|TypeFlagsBufferSizeTEMPE{wHX}u;GD EventDataA7oDataKNameStatus A;oData#KNameDataSize A?oData'KName BufferSize StatusDataSizeBufferSizeTEMPBRuuT;CBwD EventDataA5oDataKNamePhase A7oDataKNameStatus  0PhaseStatusTEMPl 7C{S5o/Q9D EventDataA7oDataKNameStatus AQoData9KNameEnableDisableReason A=oData%KName VsmPolicy   , Status,EnableDisableReasonVsmPolicyTEMP"ݺB[C~7D EventDataA?oData'KName LowAddress AAoData)KName HighAddress  A=oData%KName SkipBytes  A?oData'KName TotalBytes  A=oData%KName CacheType A5oDataKNameFlags  `# |# # ###LowAddressHighAddressSkipBytesTotalBytesCacheTypeFlagsTEMP|$s /T1XD>RD EventDataA1oDataKNameMdl $ MdlTEMP(%LX+I%nvXD EventDataA7oDataKNameSecure  <%SecureTEMP% +t]K~plD EventDataAKoData3KNameSoftRestartCount &(SoftRestartCountTEMPD 'i%O댘\@2 \D EventDataAKoData3KNameSoftRestartCount A7oDataKNameSecure  4' \'(SoftRestartCountSecureTEMP( c U@MƑD EventDataAGoData/KNameSequenceNumber AIoData1KNameDescriptorCount AYZ ComplexData3KNameMemoryDescriptor H)l)) ) ))*$SequenceNumber$DescriptorCount(MemoryDescriptorBasePagePageCountMemoryTypeReservedTEMP*Uߔ镢jD EventDataAIoData1KNameDescriptorCount *$DescriptorCountTEMP,w0bYGN}VD EventDataA7oDataKNameStatus A=oData%KName PageCount  A?oData'KName MemoryType A?oData'KName Attributes A?oData'KName LowAddress  AAoData)KName HighAddress  X- l--- - -StatusPageCountMemoryTypeAttributesLowAddressHighAddressTEMP./TRw^D EventDataA=oData%KName StartTime .StartTimeTEMP</w)ϻ6^lVAwD EventDataA?oData'KName Identifier AAoData)KName PartitionId //IdentifierPartitionIdTEMP2hlNY&hQO D EventDataA?oData'KName Identifier AOoData7KNamePartitionPageCount  AQoData9KNameAllocatedBlockCount  AMoData5KNameAllocatedRunCount  AOoData7KNameAllocatedPageCount  A7oDataKNameStatus 2 2 2 3 03\3Identifier,PartitionPageCount,AllocatedBlockCount(AllocatedRunCount,AllocatedPageCountStatusTEMP,D4didlYUYOSD EventDataA?oData'KName Identifier A7oDataKNameStatus l44IdentifierStatusTEMP05*)R#.`D EventDataA?oData'KName Identifier D5IdentifierTEMP \7oL)^*vwD EventDataA?oData'KName Identifier A;oData#KNameRunCount A=oData%KName PageCount  A7oDataKNameStatus AQoData9KNamePartitionNameLength AEoData-KName PartitionName 77 8 848`8IdentifierRunCountPageCountStatus,PartitionNameLength PartitionNameTEMP909QSK&D EventDataA7oDataKNameStatus A?oData'KName ActualSize ACoData+KName ExpectedSize 99:StatusActualSize ExpectedSizeTEMPD;D RUW8SҍƵD EventDataAAoData)KName PartitionId A;oData#KNameRunCount A=oData%KName PageCount  ;; ;PartitionIdRunCountPageCountOPCOx1;2<2,<win:Infowin:Startwin:StopLEVLPt<P<P<win:Errorwin:Warning(win:InformationalTASK ,AAA(BDBdBBB B C HC tC CCD(DXDDDDDE4ELEEEE$FHFlFF F!F"F#$G$HG%tG&G'G(H)0H*hH+H,H(InitializeLibrary PrepareTarget4RebuildKernelMemoryMapFatalError PersistMemory0ClaimPersistedMemory,FreePersistedMemory,CleanupPageDatabaseCancelBoot@AttachPersistentPageDatabase,MemoryBlockRundown0BuildKernelMemoryMap GetMemoryMap<AllocatePhysicalPagesForMdl(ExecuteTransition0DisconnectHypervisor(MemoryMapRundown@PhysicalPageAllocationFailureBootManagerPreBoot(FirmwareBootDataLoadDriversLoadHive8BootApplicationExecution8WaitForPartitionsRestored4MemoryPartitionRestore4PersistMemoryPartition$RegisterLoader$SiPolicyFailureBootTotalIo(DirtyBootShutdown$BootMenuPolicyBootType8MemoryPartitionsRestored$QueryStatistics,ConnectSecureLoader$BootFileAccess4RetrieveDriverListTime8FreePersistedMemoryBlock,PrepareNotification8PartitionInitialAddMemory$ImageHashCheck,ImageIntegrityCheck,BootPolicyMigrationKEYW IIIIJ @J hJ@J4JSoftRestart,MemoryPreservation,MemoryBlockRundown$PhysicalMemory(MemoryMapRundown(MemoryPartitions ms:Telemetryms:Measureswin:SQMEVNTs@`h<@`h<@h<%@h<@ @h<@X`+ @;P<tA\` @h<>``* @t;\<XAd`  @4\<h`  P<l` @ Th<> @(h<  @\<p`@h<@h< pP< h< h< h< h<$@ h< h< h< dh<  h<@@ h<! h<\@! h<\@h<t` pP< h< ?@h<  h<! @!P<x`" @"P<|`# #<P<`$@$$h<% @%P<`& &DP<`' 'P<`( (P<`) )P<`* *|P<`+ +P<`, ,|P<- -|h<.&@h<@/@|h<(?0@Th<D?1 1P<?2 2 P<3 3 h<4@h<5@h<`?6@ P<7@ P<8@ P<d;h<<`d$;h<<`e ;h<<`f;h<<`fP%;h<<`f,&;h<<`g ;h<<`h ;h<=`i ;h<=`j ;h<L=`k@;h<L=`l ;P<0=`m\;h<=`n ;h<=`o;h<=`p ;h<=`q;h<h=`rX;h<h=`s ;\<=`t  ;\<=`u ;h<=`v  ;h<=aw ;h<= ax ;h<>ay  ;h<>az ;h<,>a{ ;h<,>a|@| 0P< a~ !;h<H>$a #;h<H>,a-;h<d>4a;h<>8ap';h<>@a*;h<>Da *;P<>Ha;h<|?Pa;h<|?Ta D;P<=Xa.;h<?`a/;h<?ha p3;P<?pa4;h<?xa`5;h<?a 8;P<?a" ;h<x@a#;h<@a# ;h<@a$ ;P<@a';h<Aa' ;h<Aa(;h< Aa( ;h< Aa) (:;h<_Ql%xt%D EventDataA?oData'KName ByteOffset A1oDataKNameIrp A;oData#KNameThreadId A?oData'KName FileObject A9oData!KNameFileKey A7oDataKNameIOSize A9oData!KNameIOFlags  hhhhi,i@iByteOffset IrpThreadIdFileObjectFileKeyIOSizeIOFlagsTEMP8kaRR!Y -%D EventDataA1oDataKNameIrp A;oData#KNameThreadId A?oData'KName FileObject A9oData!KNameFileKey AKoData3KNameExtraInformation A=oData%KName InfoClass kkkkl,l IrpThreadIdFileObjectFileKey(ExtraInformationInfoClassTEMP`lnRXZtKŁD EventDataA1oDataKNameIrp A;oData#KNameThreadId A?oData'KName FileObject A9oData!KNameFileKey AKoData3KNameExtraInformation A=oData%KName InfoClass A;oData#KNameFilePath noo8oLotoo IrpThreadIdFileObjectFileKey(ExtraInformationInfoClassFilePathTEMPq9kRBCK&"D EventDataA1oDataKNameIrp A;oData#KNameThreadId A?oData'KName FileObject A9oData!KNameFileKey A7oDataKNameLength A=oData%KName InfoClass A=oData%KName FileIndex A;oData#KNameFileName rrrrrss4s IrpThreadIdFileObjectFileKeyLengthInfoClassFileIndexFileNameTEMPt[ҟhQouD EventDataA1oDataKNameIrp A;oData#KNameThreadId A?oData'KName FileObject A9oData!KNameFileKey ttu,u IrpThreadIdFileObjectFileKeyTEMPwԋRW!ssxD EventDataA1oDataKNameIrp A?oData'KName FileObject AIoData1KNameIssuingThreadId AEoData-KName CreateOptions AKoData3KNameCreateAttributes AAoData)KName ShareAccess A;oData#KNameFileName xx8x\x|xxx IrpFileObject$IssuingThreadId CreateOptions(CreateAttributesShareAccessFileNameTEMP@{ުN[^kљ9و2D EventDataA?oData'KName ByteOffset A1oDataKNameIrp A?oData'KName FileObject A9oData!KNameFileKey AIoData1KNameIssuingThreadId A7oDataKNameIOSize A9oData!KNameIOFlags A?oData'KName ExtraFlags  {{|$|8|\|p||ByteOffset IrpFileObjectFileKey$IssuingThreadIdIOSizeIOFlagsExtraFlagsTEMP ~ty:[PW<D EventDataA1oDataKNameIrp A?oData'KName FileObject A9oData!KNameFileKey AKoData3KNameExtraInformation AIoData1KNameIssuingThreadId A=oData%KName InfoClass  4Hp IrpFileObjectFileKey(ExtraInformation$IssuingThreadIdInfoClassTEMPxZQ UKn?,D EventDataA1oDataKNameIrp A?oData'KName FileObject A9oData!KNameFileKey AKoData3KNameExtraInformation AIoData1KNameIssuingThreadId A=oData%KName InfoClass A;oData#KNameFilePath lxЂ  IrpFileObjectFileKey(ExtraInformation$IssuingThreadIdInfoClassFilePathTEMPt욷X_0D EventDataA1oDataKNameIrp A?oData'KName FileObject A9oData!KNameFileKey AIoData1KNameIssuingThreadId A7oDataKNameLength A=oData%KName InfoClass A=oData%KName FileIndex A;oData#KNameFileName (4Pd̆ IrpFileObjectFileKey$IssuingThreadIdLengthInfoClassFileIndexFileNameTEMP @]@L,Xӑ2\(D EventDataA1oDataKNameIrp A?oData'KName FileObject A9oData!KNameFileKey AIoData1KNameIssuingThreadId ̈ IrpFileObjectFileKey$IssuingThreadIdTEMP-ITSBDD EventDataA1oDataKNameIrp AKoData3KNameExtraInformation A7oDataKNameStatus DPx Irp(ExtraInformationStatusTEMP$\`Ӓ],ӚD EventDataA9oData!KNameFileKey A;oData#KNameFileName FileKeyFileNameOPCO01ȋwin:InfoLEVL@P(win:InformationalTASKT x   Ď؎,DXl|ԏ$@TNameCreateNameDeleteCreateCleanupCloseReadWrite$SetInformationSetDeleteRenameDirEnumFlush(QueryInformationFSCTL OperationEndDirNotifyDeletePathRenamePathSetLinkPathSetLink CreateNewFileKEYW  P@ȑ<t @KERNEL_FILE_KEYWORD_FILENAME<KERNEL_FILE_KEYWORD_FILEIO<KERNEL_FILE_KEYWORD_OP_END<KERNEL_FILE_KEYWORD_CREATE8KERNEL_FILE_KEYWORD_READ8KERNEL_FILE_KEYWORD_WRITEDKERNEL_FILE_KEYWORD_DELETE_PATHTKERNEL_FILE_KEYWORD_RENAME_SETLINK_PATHLKERNEL_FILE_KEYWORD_CREATE_NEW_FILEEVNT'  ,,b  H,b  bd,b  @udȚ,b  LsК,b  Ԛ,b Lsؚ,b ܚ,b f,b x,b fԌ,b xԌ,b Ti,b |,b Ti ,b |  ,b Ti(,b |(,b oD,b $D,b Ls` ,b `$,b Ti|(,b ||,,b Ti0,b |4,b`8,b oЍ@,b $ЍD,bDlH,bL,bDlP,bT,bDl$X,b$\,b Ti(`,b |(d,bb\h,b@u\l,bААWEVT؛<l(CHANdHMicrosoft-Windows-PCI/DiagnosticOPCO01Twin:InfoLEVL@P(win:InformationalTASKP Ԝ(AspmErrataRundownKEYW,DiagEVNTD  HxhWEVTt,ԝl$$CHAN\\Microsoft-Windows-Kernel-StoreMgr/Analytic`Microsoft-Windows-Kernel-StoreMgr/OperationalMAPSОVMAP$LVMAP$4CacheTerminationMsgMap8StoreMgrCorruptPageMsgMapTTBL TEMP|0w49-TO[T!lD EventDataA9oData!KNameDataKey A9oData!KNameDataMgr AAoData)KName StoreOffset AGoData/KNameCompressedSize A5oDataKNameFlags ءDataKeyDataMgrStoreOffset$CompressedSizeFlagsTEMP$` UE3CD EventDataA9oData!KNameDataKey A9oData!KNameDataMgr AAoData)KName StoreOffset `tDataKeyDataMgrStoreOffsetTEMPt `U81P{G]\-D EventDataA;oData#KNameStoreKey ACoData+KName StoreFileKey AAoData)KName UserDataMgr AAoData)KName MetadataMgr A?oData'KName RegionSize AAoData)KName RegionCount A=oData%KName BlockSize A?oData'KName SectorSize AOoData7KNameEncryptionStrength A=oData%KName StoreType A9oData!KNameStoreId ACoData+KName BlocksStored ACoData+KName RegionsInUse AGoData/KNameTotalSpaceUsed A5oDataKNameFlags AIoData1KNameMetaRegionCount AKoData3KNameMetaRegionsInUse ASoData;KNameMetaRegionsSpaceUsed A=oData%KName StoreTime ܪ0Lh0PtЬStoreKey StoreFileKeyUserDataMgrMetadataMgrRegionSizeRegionCountBlockSizeSectorSize,EncryptionStrengthStoreTypeStoreId BlocksStored RegionsInUse$TotalSpaceUsedFlags$MetaRegionCount(MetaRegionsInUse0MetaRegionsSpaceUsedStoreTimeTEMP4d*cSՍ&w)t\D EventDataA;oData#KNameStoreKey StoreKeyTEMP _Ql6a D EventDataA9oData!KNameDataMgr AGoData/KNameVirtualAddress AIoData1KNamePhysicalAddress  A3oDataKNameSize A?oData'KName FileBacked AGoData/KNameCorruptionType A5oDataKNameFlags  аО DDataMgr$VirtualAddress$PhysicalAddressSizeFileBacked$CorruptionTypeFlagsTEMPvz] 8XIGrD EventDataA9oData!KNameDataMgr AAoData)KName RegionIndex A7oDataKNameStatus A=oData%KName SpaceUsed AGoData/KNameLastAccessTime `tDataMgrRegionIndexStatusSpaceUsed$LastAccessTimeTEMP@TBZ R- ))>D EventDataA?oData'KName FailReason A?oData'KName FailStatus AKoData3KNameObjectPathLength A?oData'KName ObjectPath ܵFailReasonFailStatus(ObjectPathLengthObjectPathTEMP Kz?pYޔaB@dD EventDataA3oDataKNameSize A3oDataKNameData  SizeDataTEMPx0(߀09S 6D EventDataA;oData#KNameStoreKey A3oDataKNameSize A3oDataKNameData lStoreKeySizeDataTEMPpR0qTBV) D EventDataA;oData#KNameStoreKey A5oDataKNameParam StoreKeyParamTEMPLлYqUD EventDataA7oDataKNameReason A?oData'KName FailStatus AKoData3KNameDeviceDescLength AMoData5KNameDeviceDescription AKoData3KNameObjectPathLength A?oData'KName ObjectPath H\xȼReasonFailStatus(DeviceDescLength(DeviceDescription(ObjectPathLengthObjectPathTEMP`ԾǍY<D EventDataA9oData!KNameSqmType AGoData/KNameSqmSessionGuid A5oDataKNameSqmID AOoData7KNameSqmStreamRowLength AQZ ComplexData+KName SqmStreamRow t(HSqmType$SqmSessionGuidSqmID,SqmStreamRowLength SqmStreamRow SqmTypeEntry SqmDWORDEntry$SqmStringEntryOPCOx122win:Infowin:Startwin:StopLEVL@P(win:InformationalTASK $@\x   D d StoreAddStoreRemoveStoreCreateStoreDelete StoreRundown$StoreCorruption(StorePageRundownRegionEvictRegionWrite(UnpersistFailure StoreIoStatsGlobalStatsStoreEmpty RegionRelease RegionCompact RegionRundown(CacheTerminationKEYWp@4StoreOpsStoreDiag0StoreContentsRundownwin:SQMEVNTx0 xLxhxxP@ԭxxTx  Tx  P@x,  ,xH   xd  xTxTTTxP@x 000000@P000@000000P0@`WEVTH TTBLPTEMPD͟,Vo9{BD EventDataA9oData!KNameSqmType AGoData/KNameSqmSessionGuid A5oDataKNameSqmID AWoData?KNameSqmDWORDDatapointValue 0TdSqmType$SqmSessionGuidSqmID4SqmDWORDDatapointValueOPCOLEVL@P(win:InformationalTASKKEYW04 win:SQMEVNTDT`WEVT|*@8TCHANtXMicrosoft-Windows-Kernel-Memory/AnalyticTTBL" TEMP !5 .)]Z^D EventDataAGoData/KNamePriorityLevels AEoData-KName ZeroPageCount AEoData-KName FreePageCount AMoData5KNameModifiedPageCount A[oDataCKNameModifiedNoWritePageCount ACoData+KName BadPageCount AMoData5KNameStandbyPageCounts ASoData;KNameRepurposedPageCounts A]oDataEKNameModifiedPageCountPageFile AOoData7KNamePagedPoolPageCount AUoData=KNameNonPagedPoolPageCount ACoData+KName MdlPageCount AIoData1KNameCommitPageCount (Hp X$PriorityLevels ZeroPageCount FreePageCount(ModifiedPageCount8ModifiedNoWritePageCount BadPageCount(StandbyPageCounts0RepurposedPageCounts8ModifiedPageCountPageFile,PagedPoolPageCount0NonPagedPoolPageCount MdlPageCount$CommitPageCountTEMPpRn.RHD EventDataA5oDataKNameCount AQZ ComplexData+KName WSCommitInfo hx,Count WSCommitInfoProcessID,WorkingSetPageCount$CommitPageCount,VirtualSizeInPages<PrivateWorkingSetPageCountTEMP$ LRn.RHD EventDataA5oDataKNameCount AQZ ComplexData+KName WSCommitInfo $D\@dCount WSCommitInfoProcessID,WorkingSetPageCount$CommitPageCount,VirtualSizeInPages<PrivateWorkingSetPageCount,StoreSizePageCount$StoredPageCount(CommitDebtInPagesTEMPd pRn.RHD EventDataA5oDataKNameCount AQZ ComplexData+KName WSCommitInfo L \|LxCount WSCommitInfoProcessID,WorkingSetPageCount$CommitPageCount,VirtualSizeInPages<PrivateWorkingSetPageCount,StoreSizePageCount$StoredPageCount(CommitDebtInPages,SharedCommitInPagesTEMP?"~[& S%\D EventDataA5oDataKNameCount A_Z ComplexData9KNameSessionWSCommitInfo l|<Count,SessionWSCommitInfoSessionId,WorkingSetPageCount$CommitPageCount,PagedPoolPageCount<PrivateWorkingSetPageCountTEMP< h?"~[& S%\D EventDataA5oDataKNameCount A_Z ComplexData9KNameSessionWSCommitInfo 0@l<hCount,SessionWSCommitInfoSessionId,WorkingSetPageCount$CommitPageCount,PagedPoolPageCount<PrivateWorkingSetPageCount,StoreSizePageCount$StoredPageCount(CommitDebtInPagesTEMP| ?"~[& S%\D EventDataA5oDataKNameCount A_Z ComplexData9KNameSessionWSCommitInfo  $PCount,SessionWSCommitInfoSessionId,WorkingSetPageCount$CommitPageCount,PagedPoolPageCount<PrivateWorkingSetPageCount,StoreSizePageCount$StoredPageCount(CommitDebtInPages,SharedCommitInPagesTEMP)mN_}݉T3n^D EventDataA=oData%KName ProcessId ProcessIdTEMP  de^<3D EventDataA=oData%KName ProcessId A5oDataKNameFlags ProcessIdFlagsTEMP0tMO %XRVw*D EventDataA=oData%KName ProcessId A7oDataKNameStatus AGoData/KNamePagesProcessed lProcessIdStatus$PagesProcessedTEMPUSg\zY4.D EventDataA=oData%KName ProcessId A7oDataKNameStatus AGoData/KNamePagesProcessed A_oDataGKNameWriteCombinePagesProcessed AWoData?KNameUncachedPagesProcessed AQoData9KNameCleanPagesProcessed p0ProcessIdStatus$PagesProcessed<WriteCombinePagesProcessed4UncachedPagesProcessed,CleanPagesProcessedTEMP$,V]])&lQ|{D EventDataA=oData%KName ProcessId A7oDataKNameStatus TlProcessIdStatusTEMPbP PJ& ZD EventDataA9oData!KNameAcgFlag $AcgFlagOPCOx1h22win:Infowin:Startwin:StopLEVL@P(win:InformationalTASKd HMemInfoMemInfoWS(MemInfoSessionWS(WorkingSetOutSwap(WorkingSetInSwap AcgKEYW8 @X<KERNEL_MEM_KEYWORD_MEMINFO@KERNEL_MEM_KEYWORD_MEMINFO_EX<KERNEL_MEM_KEYWORD_WS_SWAP4KERNEL_MEM_KEYWORD_ACGEVNTP LD@D@hD@D@D4@xD4@D40PPPP\P\P0PlPl\\lD \Dl`ppppppWEVT<6H<'l''()CHAN\@XMicrosoft-Windows-Kernel-ShimEngine/DebugdMicrosoft-Windows-Kernel-ShimEngine/OperationaldMicrosoft-Windows-Kernel-ShimEngine/DiagnosticMAPSVMAP$LVMAP$LKSE:DeviceFlagApplied.FlagSourceMapLKSE:DriverShimApplied.ShimSourceMapTTBL,TEMP4|Z~B ;\Yqh:D EventDataA9oData!KNameEventId ACoData+KName DebugMessage EventId DebugMessageTEMP(@%oM]@/Hxɫ4D EventDataA?oData'KName DriverName A?oData'KName ShimSource A=oData%KName ShimCount ACoData+KName AppliedGuids DriverNameShimSourceShimCount AppliedGuidsTEMP`- U&OSA4*D EventDataA?oData'KName DeviceName AAoData)KName DeviceClass A?oData'KName FlagSource A5oDataKNameFlags   DeviceNameDeviceClassFlagSourceFlagsTEMPN_քD EventDataA?oData'KName DriverName A?oData'KName DriverBase A?oData'KName DriverSize AIoData1KNameDriverTimeStamp AGoData/KNameDriverCheckSum 8TpDriverNameDriverBaseDriverSize$DriverTimeStamp$DriverCheckSumTEMPDef2_Ǎ;vBD EventDataACoData+KName DriverObject A?oData'KName DriverBase  DriverObjectDriverBaseTEMPd@O]SRxD EventDataA?oData'KName DriverBase A?oData'KName DriverSize ACoData+KName DriverObject A1oDataKNamePdo A7oDataKNameStatus AAoData)KName ServiceName A?oData'KName HardwareId $0D`DriverBaseDriverSize DriverObject PdoStatusServiceNameHardwareIdTEMP0.D EventDataACoData+KName DriverObject A1oDataKNameFdo A1oDataKNameIrp A7oDataKNameStatus  $ DriverObject Fdo IrpStatusTEMPb6wm+^ >.D EventDataACoData+KName DriverObject A1oDataKNameFdo A1oDataKNameIrp A7oDataKNameStatus  DriverObject Fdo IrpStatusTEMP80gcQ胉 o8D EventDataACoData+KName DriverObject A1oDataKNameFdo A1oDataKNameIrp A=oData%KName MinorCode A=oData%KName PowerType A?oData'KName PowerState A7oDataKNameStatus  $@ DriverObject Fdo IrpMinorCodePowerTypePowerStateStatusTEMP8hgcQ胉 o8D EventDataACoData+KName DriverObject A1oDataKNameFdo A1oDataKNameIrp A=oData%KName MinorCode A=oData%KName PowerType A?oData'KName PowerState A7oDataKNameStatus  ,D\x DriverObject Fdo IrpMinorCodePowerTypePowerStateStatusTEMP\ b}}_G&SvD EventDataACoData+KName DriverObject A1oDataKNameFdo A1oDataKNameIrp A=oData%KName MinorCode A?oData'KName PowerState A7oDataKNameStatus   ! !$!@! DriverObject Fdo IrpMinorCodePowerStateStatusTEMP"b6wm+^ >.D EventDataACoData+KName DriverObject A1oDataKNameFdo A1oDataKNameIrp A7oDataKNameStatus " ##$# DriverObject Fdo IrpStatusTEMP$N_քD EventDataA?oData'KName DriverName A?oData'KName DriverBase A?oData'KName DriverSize AIoData1KNameDriverTimeStamp AGoData/KNameDriverCheckSum \%x%%%%DriverNameDriverBaseDriverSize$DriverTimeStamp$DriverCheckSumTEMPD&ef2_Ǎ;vBD EventDataACoData+KName DriverObject A?oData'KName DriverBase ' ' DriverObjectDriverBaseOPCO01T'win:InfoLEVLP'P'U'win:Error(win:Informationalwin:VerboseTASKKEYW((()4)\)) )(ShimEngineEvents,ShimEngineMessages,DriverScopeGeneral$DriverScopePnp(DriverScopePower$DriverScopeIrps$DriverScopePool4SkipDriverUnloadGeneralEVNTDx'T'T@H''d@H''d @8#'-d @%'-d  '-t  '-t  '-t  |'-t '-t '-t '-t '-t '.t T'.t 8'.t ' .t T'.t '.t T!'.t((0(0(0(p(p(`(0(`(@(@(@(P(P(P(P(WEVT .....OPCOLEVL@P.(win:InformationalTASKKEYWEVNT@.WEVT /0800h1x1CHANx/\Microsoft-Windows-Kernel-IoTrace/DiagnosticOPCO01 0win:InfoLEVLhP\0U0(win:Informationalwin:VerboseTASK1$1<1$UserInitiatedIoKernelIo,ActivityIdTransferKEYWEVNT0D00/0P00/0P00/0D00/WEVTJ24H``(aDggCHAN 3 (33344Application\Microsoft-Windows-AppModel-Runtime/AnalyticXMicrosoft-Windows-AppModel-Runtime/AdminXMicrosoft-Windows-AppModel-Runtime/DebugdMicrosoft-Windows-AppModel-Runtime/DiagnosticsTTBL+TEMPt6'$vS^a[.D EventDataA=oData%KName ProcessID A?oData'KName CreateTime AIoData1KNameParentProcessID AIoData1KNamePackageFullName A=oData%KName ImageName AcoDataKKNamePackageRelativeApplicationId D7\7x7777ProcessIDCreateTime$ParentProcessID$PackageFullNameImageName@PackageRelativeApplicationIdTEMPD9zsS&]% ǙD EventDataAIoData1KNamePackageFullName A=oData%KName ErrorCode ACoData+KName ErrorMessage 999$PackageFullNameErrorCode ErrorMessageTEMP;}s!t ^pvWD EventDataAIoData1KNamePackageFullName A=oData%KName ErrorCode ACoData+KName FailedBinary D;h;;$PackageFullNameErrorCode FailedBinaryTEMP4<?~v|Uj]4^D EventDataA=oData%KName ErrorCode H<ErrorCodeTEMP@x> wZۉML-eD EventDataA;oData#KNameFileName A=oData%KName ErrorCode A3oDataKNameSize  A7oDataKNameOffset A?oData'KName HeaderAddr A9oData!KNameSection A=oData%KName ProcessId ?? 4?D?X?t??FileNameErrorCodeSizeOffsetHeaderAddrSectionProcessIdTEMPxA2OlT>6D EventDataA;oData#KNameFileName A=oData%KName ErrorCode A3oDataKNameSize  A?oData'KName HeaderAddr A9oData!KNameSection A=oData%KName ProcessId AB B0BLB`BFileNameErrorCodeSizeHeaderAddrSectionProcessIdTEMPpD/Q}QBD EventDataA;oData#KNameFileName A=oData%KName ErrorCode A3oDataKNameSize  A?oData'KName HeaderAddr AWoData?KNameApplicationUserModelId A=oData%KName ProcessId DE E(EDExEFileNameErrorCodeSizeHeaderAddr4ApplicationUserModelIdProcessIdTEMPp(G&8#}NX[VPpKdD EventDataA;oData#KNameFileName A=oData%KName ErrorCode A3oDataKNameSize  A?oData'KName HeaderAddr A=oData%KName ProcessId GG GGGFileNameErrorCodeSizeHeaderAddrProcessIdTEMPIR n#V!qTD EventDataA;oData#KNameFileName A=oData%KName ErrorCode A=oData%KName ProcessId TIlIIFileNameErrorCodeProcessIdTEMP<xJDI]jzXKD EventDataA;oData#KNameFileName AEoData-KName ExceptionCode JJFileName ExceptionCodeTEMP(Kc+Uw6pD EventDataA=oData%KName ErrorCode A9oData!KNameContext KKErrorCodeContextTEMP(Lc+Uw6pD EventDataA=oData%KName ErrorCode A9oData!KNameContext LMErrorCodeContextTEMPM?~v|Uj]4^D EventDataA=oData%KName ErrorCode MErrorCodeTEMPN&؍1 U);߸ClD EventDataAKoData3KNameAppContainerName N(AppContainerNameTEMPdOt+=D{Q mjD EventDataAIoData1KNamePackageFullName xO$PackageFullNameTEMPHP 2B[&Ŧ]$D EventDataA=oData%KName ErrorCode AIoData1KNamePackageFullName PPErrorCode$PackageFullNameTEMP,QˀfS t:sVD EventDataA=oData%KName ErrorCode A;oData#KNameResource QQErrorCodeResourceTEMP,RˀfS t:sVD EventDataA=oData%KName ErrorCode A;oData#KNameResource  S$SErrorCodeResourceTEMPH T 2B[&Ŧ]$D EventDataA=oData%KName ErrorCode AIoData1KNamePackageFullName HT`TErrorCode$PackageFullNameTEMPUر`n[m,l.D EventDataA=oData%KName ErrorCode AIoData1KNamePackageFullName A3oDataKNameUser UUVErrorCode$PackageFullNameUserTEMPHWuBԘ|Xl%{ZFD EventDataA=oData%KName ErrorCode AIoData1KNamePackageFullName AEoData-KName DesiredStatus AEoData-KName CurrentStatus W X0XPXErrorCode$PackageFullName DesiredStatus CurrentStatusTEMPY~uBYĴz ED EventDataAIoData1KNamePackageFullName AEoData-KName DesiredStatus AEoData-KName CurrentStatus YZ(Z$PackageFullName DesiredStatus CurrentStatusTEMP[^mQw D EventDataA=oData%KName ErrorCode AIoData1KNamePackageFullName A3oDataKNameUser AEoData-KName DesiredStatus AEoData-KName CurrentStatus `\x\\\\ErrorCode$PackageFullNameUser DesiredStatus CurrentStatusTEMP4\^9%'S`Zdv{<D EventDataAIoData1KNamePackageFullName A3oDataKNameUser AEoData-KName DesiredStatus AEoData-KName CurrentStatus ^^^_$PackageFullNameUser DesiredStatus CurrentStatusTEMP(_c+Uw6pD EventDataA=oData%KName ErrorCode A9oData!KNameContext `4`ErrorCodeContextOPCOT2l`2`win:Startwin:StopLEVLP`P`Pawin:Errorwin:Warning(win:InformationalTASKc@ccc dXdddedf(egdeheie8fhfffg0AppModelProcessStartHAppIntegrityDependencyGraphCheck<AppIntegrityProcessCreationHAppIntegrityInAppValidatePackageLAppModelDynamicPropertiesReadFailedHAppModelDynamicPropertiesInvalidDRestrictedAppContainerCreationDRestrictedAppContainerDeletion<RestrictedAppContainerOpenHRestrictedAppContainerEnumeration@RestrictedAppContainerLaunchLRestrictedAppContainerTerminateAll0AppContainerCreation0AppContainerDeletion,AppContainerUpdate@FirewallAppContainerCreation@FirewallAppContainerDeletionKEYWgg@gProcess AppContainerms:MeasuresEVNTd@4`z2@ 8`z2@ 8`z2@ 8`z2@ 8`z2@ 8`z2 8`z2 9`z2  9`z2  9`z2  ;`z2 `<`z2 ?`z2 `<`z2 `<`z2 H`z2 I`z2@ 8`z2@ J`{2 J`{2 J` {2 J`{2 J`{2 J`{2 J`{2 J` {2 J`${2 J`({2 (M`,{2  J`0{2! !(M`4{2" "(M`8{2# #(M`<{2$ $(M`@{2% %(M`D{2& &(M`H{2' 'M`L{2( (M`P{2) )M`T{2* *M`X{2+ +xB`\{2, ,E``{2- -J`d{2. .(M`h{2/ /(M`l{20 0J`p{21 1J`t{22 2J`x{23 3J`|{24 4J`{25 5N`{26 6N`{27 7N`{28 8N`{29 9O`{2: :O`{2; ;O`{2< <N`{2=@ =8`{2> >O`{2? ?P`{2@ @R`{2A Ac'޽XS떂7r\D EventDataA;oData#KNameNTStatus NTStatusTEMPXE*S\=PuD EventDataAqoDataYKName#NtEstimatedRequiredPrimaryDataBytes AaoDataIKNameNtEstimatedPrimaryDataBytes  AaoDataIKNameHvEstimatedPrimaryDataBytes  AeoDataMKNameHvEstimatedSecondaryDataBytes   d   (LNtEstimatedRequiredPrimaryDataBytes<NtEstimatedPrimaryDataBytes<HvEstimatedPrimaryDataBytes@HvEstimatedSecondaryDataBytesTEMPe[$` D EventDataAOoData7KNameNtPrimaryDataBytes AOoData7KNameHvPrimaryDataBytes  ASoData;KNameHvSecondaryDataBytes    $ P,NtPrimaryDataBytes,HvPrimaryDataBytes0HvSecondaryDataBytesTEMPHi:9pUsnVgD EventDataA;oData#KNameNTStatus A?oData'KName TotalBytes  AAoData)KName HeaderBytes  AKoData3KNamePrimaryDataBytes  AOoData7KNameSecondaryDataBytes      $NTStatusTotalBytesHeaderBytes(PrimaryDataBytes,SecondaryDataBytesTEMP 8 QCY]pD EventDataAOoData7KNameCallbackIdentifier ,CallbackIdentifierTEMPTB|SUY҂K$+D EventDataAOoData7KNameCallbackIdentifier A;oData#KNameNTStatus Dp,CallbackIdentifierNTStatusOPCO c< dT eh fghi$jPk|lmvw }HAPIStartAPIEnd8WriteDumpDataToFileStart4WriteDumpDataToFileEnd$MirroringStart,MirroringPhase0End,MirroringPhase1End,SystemQuiesceStart(SystemQuiesceEnd,PageBufferingStart(PageBufferingEnd(BufferEstimation(BufferAllocationRemovePagesLEVL@P|(win:InformationalTASKN<OtPQRT8LIVEDUMP_TASK_CAPTURE_API@LIVEDUMP_TASK_SIZING_WORKFLOWPLIVEDUMP_TASK_CAPTURE_PAGES_WORKFLOWPLIVEDUMP_TASK_WRITE_DEFERRED_DATA_APITLIVEDUMP_TASK_DISCARD_DEFERRED_DATA_APIKEYWEVNT _p `Tp ap bp~$peSpfTpgUphVpiWpjtpkuh$plx0pmy0pnzP0po{P0pp|40pXpYpZp[p\p]p^ p np oTp pp qp rp  sTp WEVT8hTTBLh TEMPpI,c_vN`D EventDataA?oData'KName ReturnCode ReturnCodeTEMPdyi ,UTujD EventDataASoData;KNameNotifyRoutineAddress A?oData'KName ReturnCode 0NotifyRoutineAddressReturnCodeTEMPL=RӛT9FD EventDataAIoData1KNameTargetProcessId A?oData'KName ReturnCode 4$TargetProcessIdReturnCodeTEMP2ll9Q+Y%6D EventDataAIoData1KNameTargetProcessId AEoData-KName DesiredAccess A?oData'KName ReturnCode $TargetProcessId DesiredAccessReturnCodeTEMPTv"\[R=JD EventDataAIoData1KNameTargetProcessId AGoData/KNameTargetThreatId AEoData-KName DesiredAccess A?oData'KName ReturnCode 4T$TargetProcessId$TargetThreatId DesiredAccessReturnCodeTEMP<L(FG \\9ID EventDataA?oData'KName DriverName A?oData'KName ReturnCode tDriverNameReturnCodeTEMP<(FG \\9ID EventDataA?oData'KName DriverName A?oData'KName ReturnCode DriverNameReturnCodeTEMPPdNV]ۏWD{HD EventDataAGoData/KNameLinkSourceName AGoData/KNameLinkTargetName AEoData-KName DesiredAccess A?oData'KName ReturnCode $LinkSourceName$LinkTargetName DesiredAccessReturnCodeOPCO01Pwin:InfoLEVL@P(win:InformationalTASKKEYWEVNTDtDtDtDtPDtDtpDtDtWEVTx`CHAN\ ApplicationSystemTTBLLTEMP@-v6R^l/{/!ID EventDataA5oDataKNameCVEID AMoData5KNameAdditionalDetails (8CVEID(AdditionalDetailsOPCO01xwin:InfoLEVL4Pwin:WarningTASKKEYWEVNTp  l@ lWEVTTTBLTEMPX?~v|Uj]4^D EventDataA=oData%KName ErrorCode lErrorCodeOPCOLEVL4Pwin:WarningTASKKEYWEVNT@WEVT8@TTBL0TEMPl mYḐpSd`}XD EventDataAIoData1KNameStackDBInstance AIoData1KNameStackDBSequence AKoData3KNameStackDBBufferLen AEoData-KName StackDBBuffer p$StackDBInstance$StackDBSequence(StackDBBufferLen StackDBBufferTEMP(?Yi\C'Y`D EventDataAIoData1KNameStackDBInstance A=oData%KName TotalData A=oData%KName ProcessId d$StackDBInstanceTotalDataProcessIdOPCOLEVLTASKKEYWEVNTpd^TS{(G