MZ@ !L!This program cannot be run in DOS mode. $;=߉ZSZSZSӬZSQZSRichZSPEd.}" ,4` %8.rdata@@.rsrc @@.} lPP.}$8.rdata8.rdata$voltmdP.rdata$zzzdbg .rsrc$01(.rsrc$02 ՠ(ȇx'/uHkP^.}0H %(?@EXFpGHLRS~0H`x9x 8Ph34r(@Xp 0@P`p 0@P`p'(|)\*p+t,@.l.@.zh0T2 357f8p hCh Lp@PTS4W [`\ l`bh nZ|v4  |: 8 tdZ n0.,MUI}J`_Neֶn MUI ja-JPS0a00OULo0d0K00~0[00g0W0_00 s0}`1Xo0B00~0[000 0000 000:q_000iQNchYNSgq00000000000Rg000fJT`1XcO 0000000n0R0fH0Defender :e00000 0000i000000OU\00000000ck8^'`UpToDate 0000000n0OULibn0OULCFA000ASRrS_j0W0 ibU00f0D0~0[00%1 Bfkeefegfekpfe4lfe(gfeёfeWfeW0j0D0 000000O000 MDE U\000MDE 00000000 000 MDE _jn0ck8^'`000 MDE ge000 0000000 000ib000CFA (00000 0000n06R_) 000PAASR (;edbn0n\) 000!qR0000vg)R(u NSo0D0D0D0H0%1 0000L0X[(WW0~0[00O(u NS Nfj0rKa00000000 u0SUBVRunning PzPz0Stopped 000Pausedtz0Start PendingPA00SSUStop Pending00PzContinue Pending>o0ABVPause Pending 00MSUUnknown0YfMBoot qeSystemYfqMAAuto 0Pz:kYfManual Yf:kPzMDisabled SU0BVSUNormalM00Passive ModeSUAMASxS Passive ModeM:k0uEDR Block Mode0u0Passive Audit ModePzSUSU0Not runningPAiQNiQN[Rg] 00000000Y00h00P}gn0s0}L0h:yU00~0Y00000`1X000`1XVMNameVMSize VMLocationSubscriptionId ResourceGroupVmId OSVersion00n0pe ֊t00000n0pe 00T0h0n00000peirt000 PageFile n04X@bPageFile n0s(Wn0O(urlPageFile n0rR0S_f0000 000PageFile n0000Bfn0O(us0000SRn0 Azure AD SRn0PA 0000000SRn0Azure AD 0000 ID{v2n0rKa OS n000000000000wRBf0000hQSOn0 WinHTTP 00000000o0 AAD J00s0 MEM k0{v2U00f0D0~0Y00000o0{v2U00f0J00Z00S00~0g0{v2U00_0S0h0L0B00~0[000000o0 MDM 000000k00c0f0{tU00f0D0~0Y00000o0 SCCM 000000k00c0f0{tU00f0D0~0Y0Microsoft 0000000 000000n0ibn0OULN,000c}n0OUL0000o0{v2U00f0D0~0W0_0L00s(Wo0{v2dU00f0D0~0Y00000n0{v2dL0OYu-Ng0Y0 0000n0rR0S_f0000 0000 0000 000N,vj0000000SR0000000n0 NN000000 000 - 0000c}0000<ffn0000AAD Connect n0ibn00DNS 000 0000 Tgn0OULMDE J00s0 ConfigMgrPAEDR0000`1X 0000 00000 0000 0000n0rKaD}T~ ID0000 ID0000000[V{n0rKa GUIDDiagTrack (UTC) 0000n0rKa0000000[V{_jL0U\U00f0D0~0Y0 0000ib00000MachineAuth ID0000 0000n0 StartType0000n00000000n04X@bRsvj0c}K0000000U00_00000!Microsoft 00000 00000 000000Yn0.z^ Defender AVDefender AV `1XDefender AV 0000n0rKaDefender AV 00000000n000000!Defender AV 000000 00000000n000000Defender AV 0000n000000Defender AV 000Defender AV SSLOptions ibDefender AV 0000ibWindows 000000 0000 0000n0rKaWindows 000000 000 0000n0rKaDefender 000000ig0000n0rKaDefender Core Service n0rKaDefender o09eV002bkU00f0D0~0Y0Defender 9eV002bk000Defender o09eV002bkdYk0j0c0f0D0~0Y0SmartLocker 000Defender 000000[V{Defender 000000Ow000PAA000000ib0xW00_j0 URL L00000U00f0D0j0D0S0h00xW0f0O0`0U0D00 s0}k0d0D0f0o00%1 0SgqW0f0O0`0U0D0 ServiceURLsPMicrosoft Defender for Endpoint (CnC) 0000 0000 URL x0n0c}000L0ck8^k0[NW0~0W0_00P}g %2 n0 %1bMicrosoft Defender for Endpoint (CnC) 0000 0000n0 URL x0n0c}000k01YWeW0~0W0_00 !kn0 URL n0000L01YWeW0~0W0_0: %1 n0P}g %2eMicrosoft Defender for Endpoint (CnC) 0000 0000 URL x0n0Y0y0f0n0000c}L01YWeW0~0W0_00 !kn0 URL n0000L01YWeW0~0W0_0: %1 n0P}g %2RMicrosoft Defender for Endpoint (0000) 0000 0000n0 URL x0n0c}000L0ck8^k0[NW0~0W0_00P}g %2 n0 %1dMicrosoft Defender for Endpoint (Cyber) 0000 0000n0 URL x0n0c}000k01YWeW0~0W0_00 !kn0 URL n0000L01YWeW0~0W0_0: %1 n0P}g %2gMicrosoft Defender for Endpoint (Cyber) 0000 0000 URL x0n0Y0y0f0n0000c}k01YWeW0~0W0_00 !kn0 URL n0000L01YWeW0~0W0_0: %1 n0P}g %2SMicrosoft Defender for Endpoint (AutoIR) 0000 0000 URL x0n0c}000L0ck8^k0[NW0~0W0_00P}g %2 n0 %1dMicrosoft Defender for Endpoint (AutoIR) 0000 0000 URL x0n0c}000k01YWeW0~0W0_00 !kn0 URL n0000L01YWeW0~0W0_0: %1 n0P}g %2hMicrosoft Defender for Endpoint (AutoIR) 0000 0000 URL x0n0Y0y0f0n0000c}L01YWeW0~0W0_00 !kn0 URL n0000L01YWeW0~0W0_0: %1 n0P}g %2WMicrosoft Defender for Endpoint (SampleUpload) 0000 0000 URL x0n0c}000L0ck8^k0[NW0~0W0_00P}g %2 %1kMicrosoft Defender for Endpoint (SampleUpload) 0000 0000n0 URL x0n0c}000k01YWeW0~0W0_00 !kn0 URL n0000L01YWeW0~0W0_0: %1 n0P}g %2nMicrosoft Defender for Endpoint (SampleUpload) 0000 0000 URL x0n0Y0y0f0n0000c}L01YWeW0~0W0_00 !kn0 URL n0000L01YWeW0~0W0_0: %1 n0P}g %2YMicrosoft Defender for Endpoint (MdeConfigMgr) 0000 0000 URL x0n0c}000L0ck8^k0[NW0~0W0_00P}g %2 n0 %1jMicrosoft Defender for Endpoint (MdeConfigMgr) 0000 0000 URL x0n0c}000k01YWeW0~0W0_00 !kn0 URL n0000L01YWeW0~0W0_0: %1 n0P}g %2nMicrosoft Defender for Endpoint (MdeConfigMgr) 0000 0000 URL x0n0Y0y0f0n0000c}L01YWeW0~0W0_00 !kn0 URL n0000L01YWeW0~0W0_0: %1 n0P}g %2QMicrosoft Defender for Endpoint (OneD) 0000 0000 URL x0n0c}000L0ck8^k0[NW0~0W0_00P}g %2 n0 %1cMicrosoft Defender for Endpoint (OneDs) 0000 0000 URL x0n0c}000k01YWeW0~0W0_00 !kn0 URL n0000L01YWeW0~0W0_0: %1 n0P}g %2gMicrosoft Defender for Endpoint (OneDs) 0000 0000 URL x0n0Y0y0f0n0000c}L01YWeW0~0W0_00 !kn0 URL n0000L01YWeW0~0W0_0: %1 n0P}g %21Defender for Endpoint 0000 0000n0<ffn0io000Please update the sensor to ensure you have optimal protection and stability.9qSA0Microsoft Defender for Endpoint update for EDR Sensor0YfABVThis machine has failed to onboard as MsSense.exe crashed during initialization phase for TelLib.dll. A00:k The error from the crash was: %10tzS:kThis can happen if the SYSTEM account does not have permissions to write to the expected path (ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Cyber). e00tz Please validate the ACLs in the path and reset the permissions from parent folder if needed.IqPze0Device is anti-spoofing capable but is not yet registered with cloud.p0tzPzPlease ensure connectivity to EDRCloud CnC URLs is not blocked. Contact Microsoft support if issue persists.QS0nA configuration or dependency is preventing Network Protection from starting.XSUn>oPlease review this error message to understand the blocking issue and resolve it: %1e0uqSupported TLS ciphers are not enabled on this machine. This can affect connectivity to MDE cloud.000Please inspect the configured ciphers (within HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002) to ensure it contains minimum required ciphers for connectivity to MDE cloud.&0SU00Cipher suites and TLS requirementsfSU>o00TLS 1.2 client protocol is not enabled on this machine. This can affect connectivity to MDE cloud.000BVPlease confirm that TLS 1.2 client is enabled (within HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client).PA\0tzSSECDH ciphers are not enabled on this machine. This can affect connectivity to MDE cloud.0u:kMPlease confirm that ECDH KeyExchangeAlgorithm is enabled (within HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\ECDH).Yf0SSUBasic URL test failedBVtzBVBVNetworkProtection component is disabled or failed URL check test. This may indicate a presence of a network redirector (Ex: Cisco Umbrella).PA 00000 0000n06R_5mde_cfa_evaluation 00000n000k01YWeW0~0W0_0 - CFA :eo0)R(ug0M0~0[00MdeDiag n0000000h000000{v20xY00%00k0 CFA (00000 0000n06R_) iQo0d0K00~0[00g0W0_0[Qo0 Ng0Y0 - CFA o0ck8^k0_jW0f0D0~0Y0 O<00000n0_00k0 %1 Nn0u0W0D000000RgW0~0W0_01s0}j0O<RgP}gk0d0D0f0o00:eQRn0 CfaTrustChecks.txt 0xW0f0O0`0U0D0/%1 o00000 0000L0iRg0B00h0XU00j0D0_000CFA k00c0f0O\k00000/00L0B00_000000L0i(uU00j0D0S'`L0B00~0Y0030000 0000~0_0o000000ibn0 ASR 000 GUID K00HQ-h0+g>\n0zz}v0JRdW0~0Y00lASR %1 GUID '%2' (000: %3) k0lK0c0S0L0+T~00f0D0~0Y00GUID o0lK0c0S0j0W0g0c[Y00_L0B00~0Y0 (O: 56a863a9-875e-4185-98a7-b882c64b5ce5)040000 00000~0_0o000000ibn0 ASR 000n0 GUID K00lK0c0S00JRdW0f0O0`0U0D00?ASR dY '%1' (000: %2) n0HQ-~0_0o0+g>\k00000/00L0B00_000dYL0NW0j0O0j00S'`L0B00~0Y00.0000 0000~0_0o000000ibn0 ASR dY00K00HQ-h0+g>\n0zz}v0JRdW0~0Y00ASR %1 GUID '%2' (000: %3) o0 gRj0 GUID g0o0B00~0[000_j0b__: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx (O: 56a863a9-875e-4185-98a7-b882c64b5ce5)0PAG0000 0000~0_0o000000ibn0 ASR 000 GUID 0OckW0f00YORj0eW[0+T~0j0D0 gRj0 GUID b__0O(uW0f0O0`0U0D00n00AASR Exclusion '%1' (source: %2) contains a parent-directory ('..') segment. After resolving '..' the effective excluded path may be much broader than the literal entry suggests, silently expanding the exclusion beyond its intended scope.>o00tzReplace the ASR exclusion entry with a fully-resolved absolute path that does not contain '..' segments. Recent versions of Microsoft Defender reject non-canonical exclusion entries at config load time.Defender :e00000h0o0UOg0Y0K0?Defender :e00000o00:e0000SƖ0RgW00Azure Nn0 Windows N`000n00000000OULn000000000000k0y_zd000000cOY00000000:e000g0Y00Defender :e00000n0 Windows 000000o0 %1 g0Y00S0n00000o0i0S0K00xY00p00D0g0Y0K0?e[i] 00K00YW0~0Y00chYNh0P}gn00000xW0~0Y000000000k0S|0Y0q_h000000000giSibn0000 000000k0d0D0f0fW0~0Y000000 %1 n0xk0Y00s0}`1X0%Defender :e00000k00c0f0SƖU000000n0.z^o0UOg0Y0K0?Defender :e00000o00Windows VM00000~0_0o0aW000n0ib00000000 000000ؚ0000mn0000J00s0T.z0000k0Y00`1X0SƖW0~0Y00Defender :e00000g0SƖU000`1Xn0s0}o0 %1 g0Y00PPPP<LUA 00000n0[Lg0000L0zvuW0~0W0_00 HLUA 0000 00000n000g0000L0zvuW0~0W0_00 8LUA 00000g0ie000L0zvuW0~0W0_00 4LUA n0000 000L0zvuW0~0W0_00 0LUA n0N,000L0zvuW0~0W0_00 4LUA n00000 000L0zvuW0~0W0_00 @LUA n0[LL0\Pbk0000k00c0f0-NeU00~0W0_00 L0000n0000 000000000Rvk0ibg0M0~0[00g0W0_00 4VS_VERSION_INFO e e?`StringFileInfo<041104B0LCompanyNameMicrosoft Corporationv'FileDescriptionMicrosoft Defender for Endpoint :e0000BInternalNamedefenderdiag.dll.LegalCopyright Microsoft Corporation. All rights reserved.ROriginalFilenamedefenderdiag.dll.muij%ProductNameMicrosoft Windows Operating System;FileVersion4.18.26060.3008 (df1b0eba8e0e68e7272235d6dea4de3285c715b9)DProductVersion4.18.26060.3008DVarFileInfo$TranslationPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING%0% *H %0%10  `He0\ +7N0L0 +70 010  `He ?yl9쫊Վ9OmLXwa]M 0 03y*#X:y0  *H  01 0 UUS10U Washington10URedmond10U Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20110 260219193721Z 261017193721Z0p1 0 UUS10U Washington10URedmond10U Microsoft Corporation10UMicrosoft Windows0"0  *H 0 H܏irO~HrgkFZ{}-Lt9sS%I2BDyw-0_0N m AvUNw.yTÇ*V{Ɲ( u<<ƍuš5~$ R 92w/ a \RǂS;x_ŠUS,i }` yw7z#iFV)b\6Dä00U%0 +7 +0Uz 63V)0TUM0KI0G1-0+U $Microsoft Ireland Operations Limited10U 501107+5068760U#0)9ėx͐O|US0WUP0N0LJHFhttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl%200a+U0S0Q+0Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0 U00  *H  YEywSvLmK "TU`M,Z|׸Dîh)s4åѨsc BoJf!Jmwf~$)нC{wS`p I8/i W}[Sm yg]pzıO𑧩ؑK F#$"_J,. n.Cs=i~}8@4=\OSUT+ 5A%pIC>Mo0RJe%C_00 avV0  *H  01 0 UUS10U Washington10URedmond10U Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100 111019184142Z 261019185142Z01 0 UUS10U Washington10URedmond10U Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20110"0  *H 0  . i!i33T ҋ8-|byJ?5 pk6u1ݍp7tF([`#,GgQ'rɹ;S5|'# oFnhttp://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0  *H  |qQyn9>\` QfG=*hwLb{Ǻz4KbzJ7-W|=ܸZij:ni!7ށugӓW^)9-Es[zFX^gl5?$5 uVx,Јߺ~,c#!xlX6+̤-@EΊ\k>p* j_Gc 26*pZBYqKW~!<ŹE ŕ]b֠c uw}=EWo3wbY~1-0)001 0 UUS10U Washington10URedmond10U Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20113y*#X:y0  `He0 *H  1  +70 +7 10  +70/ *H  1" yRQ, (0:dm{m(0B +7 1402Microsofthttp://www.microsoft.com0  *H t(9쨓iX<}lBR[Daִ' в"=B)}Cʦ{(dQ X Ɍd|!y\o)|e(Q牍r כ}*)hF˄xP 2 ڊ>sق jޟ&y9j^ܧoL{$Z 9e'.CJMM T| 'ViC\KG4%b@bF$JKpTہ-۶f*ϩa z_haDٛQR0Gn-t (ŠC<:=3d&; 8olɱOMFNzВqPiN A9 >JXֻO̺ qOm{ll-TrY[(eG%H@F=wIs{!䈬̔~ÿGzI`ܜd-}Etï x /)I0E0U_ĩ6'b2BD$}!jZM?į&P烗9_I YԽܖSjG"F#J0r[U-~saJt'Ԕ콟/Qz_)\7*7dpJ`|8($֭;218ж>T/yKhcuj,]aDHٙ%` Z7Z3`;*bQP ,h12e3:.<>3xk!m8r2tܮ`ߨ hK/#.J&S kYjqj 힤 PKG{G`= m[egve8gw-!~vTैoGl%mZ^:?Ab,9jk/`B&F /]lWj/@`3\OfSqZ~JZ6gF# w2`}jRDFkvPDq\Q17 8n&S|9azĪri65&dژ;{3[~Rb%j]SVMݼ㑏9,Qpi 6-p15(㴇$ɏ~TUmh;Fz)7EFn20\O,b͹⍈䖬Jq[g`= s}AFu_4 }~ٞE߶r/}_۪~66L+nQsM7t4G|?Lۯ^s=CN39LBh.QFѽjZasg^(v3rק  co 6d[!]_0tعP a65Gk\RQ]%PzlrRą<7?xE^ڏriƮ{>j.00 +70# +7*RdĚhttp://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0  *H  U}*,g1$[rKo\>NGdx=139q6?dl|u9m1lѡ"fg:SMݘx6.Vi {jo)n?Hum m#TxSu$Wݟ=heV(U'$@]='@8)üTB  jBRu6as.,k{n?, x鑲[It 쑀=J>f;O2ٖtLrou04zP X@1Q{p( 6ںL 4$5g+ 挙"'B=%tt[jў>~13}{8pDѐȫ::bpcSMmqjU3XpfY0A0٤01 0 UUS10U Washington10URedmond10U Microsoft Corporation1-0+U $Microsoft Ireland Operations Limited1'0%U nShield TSS ESN:591A-05E0-D9471%0#UMicrosoft Time-Stamp Service# 0+__zErVuDRƠ0~0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100  *H  qA0"20260622083057Z20260623083057Z0w0= +Y 1/0-0 qA0  00 06 +Y 1(0&0  +Y  0 00  *H  zC5Ε1 (xzQF\ˆ" ԒEvU᱆fVQwBk w> -}Qcè d4Cڪ6~8kbApaeZqqVˎ> +m{ebe%F1lz,Ema/%ZyPBnR>]$46B{lb$Y20  *H  sIܬfg*;ɋ<[0)#'O&5v`d!,w 7cMn^VRzLk~C(5;aZ-4ErXJYajy YZՔ nAr{|mDe9?{OǮ,)5`#9CL