MZ@ !L!This program cannot be run in DOS mode. $;=߉ZSZSZSӬZSQZSRichZSPEd.}" ,@` %8.rdata@@.rsrc  @@.} lPP.}$8.rdata8.rdata$voltmdP.rdata$zzzdbg .rsrc$01(.rsrc$02 ՠ(ȇx'/uHkP^.}0H %(?@EXFpGHLRS~0H`x9x 8Ph34r(@X"p""""""""""" "0"@"P"`"p""""""""""" "0"@"P"`"p"""""""'(P*+ .p|/R01D248:>:ADUDfXk,q:x~`td< 0 ܟ @"dR< NXNt!&-0$MUI}J`_Neֶn MUI uk-UABCB@>1;5< =5 28O2;5=>.5<0T 4>:;04=8E 2V4><>AB59.>?><V6=V 40=V: V25=L 2?;82C 57C;LB0B 5:><5=40FVO >A8;0==OV43C: 0B53>@VO=0;V7><8;:0 >?5@5465==O =D>@<0FV9=5 #2V<:=CB8 01> 28<:=CB8 =02V30FVN)V03=>AB8G=89 72VB ?@> 0=0;VB8:C Defender3;O45@5652V :><C=V:0FVW >73>@B0==O @8T4=0==O !?@02=VABLUpToDate@>1;5<8 7 ?@>4C:B82=VABN@>1;5<8 7 :>=DV3C@0FVTNCFA>2V4:05<0T5 =0;0HB>20=>%13>4.)>4=O54V;O >=54V;>:V2B>@>:!5@540'5B25@ OB=8FO!C1>B0V:>;8"5AB8 <5@56528E :><C=V:0FV9"5AB8 @>73>@B0==O MDE"5AB8 ?@8T4=0==O MDE"5AB8 A?@02=>ABV DC=:FV9 MDE"5AB8 0:BC0;L=>ABV MDE"5AB8 ?@>4C:B82=>ABV"5AB8 :>=DV3C@0FVW%5@52V@:8 :5@>20=>3> 4>ABC?C 4> ?0?>:'5@52V@:8  (72C65==O 25:B>@V2 0B0:8)8<:=CB> 01;>:C20B8 >=VB>@8=3 54>ABC?=>"!;C610 %1 2V4ACB=O 54>ABC?=>52V4><89 AB0=@>F5A$09;i?;F#`ea BOc 8 ZgO@ ?) ;B # i_ 7?VK?HK*\C[.!<"m1?0BVa2<S<! ]]M \^ [U QX <7 .! 4]aW /c Q Qe SqDD!PA 57C;LB0B8 57C;LB0B8O;0F=VBL ?>A8;0==O "=0;V7", I>1 ?5@53;O=CB8 4>:;04=V 2V4><>ABV ?@> @57C;LB0B8.PA=D>@<0FVO ?@> :><? NB5@=D>@<0FVO ?@> :><? NB5@VMNameVMSize VMLocationSubscriptionId ResourceGroupVmId OSVersionV;L:VABL O45@V;L:VABL ;>3VG=8E ?@>F5A>@V20=FN6:8 =0 O4@>$V78G=0 ?0< OBL >7B0HC20==O D09;C 4>20=B065==O'>B>G=5 28:>@8AB0==O D09;C 4>20=B065==O,07>289 @>7<V@ 284V;5=>3> D09;C 4>20=B065==O&V:>25 28:>@8AB0==O D09;C 4>20=B065==O@8T4=0=> 4> 4><5=C@8T4=0=> 4> Azure AD@8T4=0=> 4> @>1>G>3> <VAFO45=B8DV:0B>@ ?@8AB@>N Azure AD!B0= @5TAB@0FVW@EVB5:BC@0 !'0A 7020=B065==O A8AB5<8!8AB5<=89 ?@>:AV-A5@25@ WinHTTP"@8AB@V9 70@5TAB@>20=> 2 AAD V MEM>@8AB@V9 =5 70@5TAB@>20=>, V 2V= =V:>;8 =5 1C2 70@5TAB@>20=89.@8AB@>T< :5@CT 035=B MDM@8AB@>T< :5@CT 035=B SCCM0@>1;5<0 :>=DV3C@0FVW Microsoft Endpoint Manager030;L=0 ?><8;:0@>1;5<0 7 ?V4:;NG5==O<4@8AB@V9 70@5TAB@>20=>, 0 B5?5@ A:0A>20=> @5TAB@0FVN(@8AB@V9 >GV:CT =0 A:0AC20==O @5TAB@0FVW><8;:0 ?@87=0G5==O ?>;VB8:PA><8;:0 72VBC ?@> ?>;VB8:8&030;L=0 ?><8;:0 3V1@84=>3> ?@8T4=0==O52V4?>2V4=VABL >A5@54:C)V1@84=0 ?><8;:0 B>G:0 7 T4=0==O A;C618><8;:0 A5@B8DV:0B0$5?@028;L=0 :>=DV3C@0FVO AAD Connect><8;:0 A;C618 DNS @>1;5<0 A8=E@>=V70FVW 3>48==8:0MDE V ConfigMgrPA#@>B84VO 703@>70< C :V=F528E B>G:0E=D>@<0FVO ?@> Sense 5@AVO Sense!B0= A;C618 Sense45=B8DV:0B>@ >@30=V70FVW45=B8DV:0B>@ ?@8AB@>N>;>10;L=89 C=V:0;L=89 V45=B8DV:0B>@ AB0=C 70E8ABC 2V4 V<VB0FV9!B0= A;C618 DiagTrack (UTC) >73>@=CB> 70E8AB 2V4 V<VB0FV95@AVO :>=DV3C@0FVW SenseMachineAuth IDStartType A;C618 Sense* >7B0HC20==O F5=B@C >1@>1:8 40=8E ?@8AB@>N1@8AB@V9 ?@8T4=0=> G5@57 >?B8<V7>20=5 ?V4:;NG5==O="8? 70?CA:C ?><VG=8:0 7V 2E>4C 4> >1;V:>2>3> 70?8AC MicrosoftPA=B82V@CA Defender!=D>@<0FVO ?@> =B82V@CA Defender!B0= A;C618 =B82V@CAC Defender$5@AVO ?;0BD>@<8 =B82V@CAC Defender55@AVO <5E0=V7<C 28O2;5==O 703@>7 =B82V@CAC Defender5@AVO O4@0 =B82V@CAC Defender 568< =B82V@CAC Defender/>=DV3C@0FVO ?0@0<5B@V2 SSL =B82V@CAC Defender/>=DV3C@0FVO ?@>:AV-A5@25@0 =B82V@CAC Defender$!B0= A;C618 F5=B@C 57?5:0 C Windows(!B0= A;C618 A?@02=>ABV 57?5:8 C WindowsPA(!B0= A;C618 <5@5652>W ?5@52V@:8 Defender!B0= >A=>2=>W A;C618 DefenderDefender 70E8I5=> 2V4 ?V4@>1>:%65@5;> 70E8ABC 2V4 ?V4@>1>: Defender'8=OB:8 70E8ABC 2V4 ?V4@>1>: C Defender 568< SmartLocker =B8H?83C=AL:0 ?@>3@0<0 Defender 568< 70E8ABC <5@56V DefenderPAx5@52V@B5 :>=DV3C@0FVN <5@56V B0 ?5@5:>=09B5AO, I> =5>1EV4=V URL-04@5A8 =5 701;>:>20=>. >:;04=V 2V4><>ABV 482. BCB: %1 ServiceURLs5@52V@:C ?V4:;NG5==O 4> URL-04@5A E<0@=>W A;C618 Microsoft Defender 4;O :V=F528E B>G>: (CNC) CA?VH=> 7025@H5=>. %1 7 @57C;LB0B>< %25 240;>AO ?5@52V@8B8 ?V4:;NG5==O 4> URL-04@5A E<0@=>W A;C618 Microsoft Defender 4;O :V=F528E B>G>: (CNC). 5 240;>AO 28:>=0B8 ?5@52V@:C 4;O URL-04@5A8: %1 7 @57C;LB0B>< %2#AV B5AB>2V ?V4:;NG5==O 4> URL-04@5A E<0@=8E A;C61 Microsoft Defender 4;O :V=F528E B>G>: (CNC) =5 ?@>945=>. 5 240;>AO 28:>=0B8 ?5@52V@:C 4;O URL-04@5A8: %1 7 @57C;LB0B>< %25@52V@:C ?V4:;NG5==O 4> URL-04@5A E<0@=>W A;C618 Microsoft Defender 4;O :V=F528E B>G>: (Cyber) CA?VH=> 7025@H5=>. %1 7 @57C;LB0B>< %25 240;>AO ?5@52V@8B8 ?V4:;NG5==O 4> URL-04@5A E<0@=>W A;C618 Microsoft Defender 4;O :V=F528E B>G>: (Cyber). 5 240;>AO 28:>=0B8 ?5@52V@:C 4;O URL-04@5A8: %1 7 @57C;LB0B>< %2#AV B5AB>2V ?V4:;NG5==O 4> URL-04@5A E<0@=8E A;C61 Microsoft Defender 4;O :V=F528E B>G>: (Cyber) =5 ?@>945=>. 5 240;>AO 28:>=0B8 ?5@52V@:C 4;O URL-04@5A8: %1 7 @57C;LB0B>< %25@52V@:C ?V4:;NG5==O 4> URL-04@5A E<0@=>W A;C618 Microsoft Defender 4;O :V=F528E B>G>: (AutoIR) CA?VH=> 7025@H5=>. %1 7 @57C;LB0B>< %25 240;>AO ?5@52V@8B8 ?V4:;NG5==O 4> URL-04@5A E<0@=>W A;C618 Microsoft Defender 4;O :V=F528E B>G>: (AutoIR). 5 240;>AO 28:>=0B8 ?5@52V@:C 4;O URL-04@5A8: %1 7 @57C;LB0B>< %25 240;>AO 28:>=0B8 2AV ?5@52V@:8 ?V4:;NG5=L 4> URL-04@5A E<0@=8E A;C61 Microsoft Defender 4;O :V=F528E B>G>: (AutoIR). 5 240;>AO 28:>=0B8 ?5@52V@:C 4;O URL-04@5A8: %1 7 @57C;LB0B>< %25@52V@:C ?V4:;NG5==O 4> URL-04@5A E<0@=>W A;C618 Microsoft Defender 4;O :V=F528E B>G>: (SampleUpload) CA?VH=> 7025@H5=>. %1 7 @57C;LB0B>< %25 240;>AO ?5@52V@8B8 ?V4:;NG5==O 4> URL-04@5A E<0@=>W A;C618 Microsoft Defender 4;O :V=F528E B>G>: (SampleUpload). 5 240;>AO 28:>=0B8 ?5@52V@:C 4;O URL-04@5A8: %1 7 @57C;LB0B>< %25 240;>AO 28:>=0B8 2AV B5AB>2V ?V4:;NG5==O 4> URL-04@5A E<0@=8E A;C61 Microsoft Defender 4;O :V=F528E B>G>: (SampleUpload). 5 240;>AO 28:>=0B8 ?5@52V@:C 4;O URL-04@5A8: %1 7 @57C;LB0B>< %25@52V@:C ?V4:;NG5==O 4> URL-04@5A E<0@=>W A;C618 Microsoft Defender 4;O :V=F528E B>G>: (MdeConfigMgr) CA?VH=> 7025@H5=>. %1 7 @57C;LB0B>< %2PA5 240;>AO ?5@52V@8B8 ?V4:;NG5==O 4> URL-04@5A E<0@=>W A;C618 Microsoft Defender 4;O :V=F528E B>G>: (MdeConfigMgr). 5 240;>AO 28:>=0B8 ?5@52V@:C 4;O URL-04@5A8: %1 7 @57C;LB0B>< %2#AV ?5@52V@:8 ?V4:;NG5=L 4> URL-04@5A E<0@=8E A;C61 Microsoft Defender 4;O :V=F528E B>G>: (MdeConfigMgr) =5 ?@>945=>. 5 240;>AO 28:>=0B8 ?5@52V@:C 4;O URL-04@5A8: %1 7 @57C;LB0B>< %25@52V@:C ?V4:;NG5==O 4> URL-04@5A E<0@=8E A;C61 Microsoft Defender 4;O :V=F528E B>G>: (OneD) CA?VH=> 7025@H5=>. %1 7 @57C;LB0B>< %25 240;>AO ?5@52V@8B8 ?V4:;NG5==O 4> URL-04@5A E<0@=>W A;C618 Microsoft Defender 4;O :V=F528E B>G>: (OneD). 5 240;>AO 28:>=0B8 ?5@52V@:C 4;O URL-04@5A8: %1 7 @57C;LB0B>< %25 240;>AO 28:>=0B8 2AV ?5@52V@:8 ?V4:;NG5=L 4> URL-04@5A E<0@=8E A;C61 Microsoft Defender 4;O :V=F528E B>G>: (OneD). 5 240;>AO 28:>=0B8 ?5@52V@:C 4;O URL-04@5A8: %1 7 @57C;LB0B>< %2W5@52V@:C A5@B8DV:0B0 4;O E<0@=>W A;C618 Defender 4;O :V=F528E B>G>: CA?VH=> 7025@H5=>.&V4:;8:0==O A5@B8DV:0B0 =5 ?5@52V@5=>.L%<0@=5 ?V4:;NG5==O <>65 1CB8 ?>@CH5=5 G5@57 ?><8;:8 2V4:;8:0==O A5@B8DV:0B0.5@5:>=09B5AO, I> =0ABC?=V URL-04@5A8 =5 701;>:>20=>: %1 V %2. )>1 >B@8<0B8 4>40B:>2V 2V4><>ABV, 725@=VBLAO 4> %3. )>1 >B@8<0B8 4>:;04=V 2V4><>ABV ?@> ?><8;:C, ?5@53;O=LB5 %4.[5@52V@:C ?V4:;NG5==O 4> E<0@=>W A;C618 =B82V@CA 4;O Microsoft Defender CA?VH=> 7025@H5=>.V5 240;>AO ?5@52V@8B8 ?V4:;NG5==O 4> E<0@=>W A;C618 =B82V@CA0 4;O Microsoft Defender.s/:I> =B82V@CA 4;O Microsoft Defender T 20H8< >A=>2=8< 0=B82V@CA=8< @VH5==O< 01> 28 28@VH8;8 22V<:=CB8 @568< 1;>:C20==O @>B84VW 703@>70< C :V=F528E B>G:0E (EDR), ?5@5:>=09B5AO, I> ?V4:;NG5==O 4> URL-04@5A E<0@8 AV =5 701;>:>20=>. >:;04=V 2V4><>ABV 482. =0 AB>@V=FV https://learn.microsoft.com/defender-endpoint/configure-network-connections-microsoft-defender-antivirus)>B>G=5 ?V4:;NG5==O 4> <5@56V =5 ;V<VB=5.)>B>G=5 ?V4:;NG5==O 4> <5@56V ;V<VB=5. %1V<VB=V <5@56V <>6CBL >1<56C20B8 DC=:FV>=0;L=VABL C :><C=V:0FVOE V7 Defender MAPS, =0?@8:;04 70?8B8 =0 5:AB@5=V ?V4?8A8 =5 =04A8;0NBLAO (?>B@V1=V 4;O :>@8ABC20FL:8E V=48:0B>@V2 =0 4>40GC 4> 5:AB@5=8E ?V4?8AV2).ApproachingDataLimit: %1OverDataLimit: %1 >C<V=3: %1NetworkCostType: %15@52V@:C ?V4:;NG5==O 4> URL-04@5A E<0@=>W A;C618 Microsoft Defender 4;O :V=F528E B>G>: (:>=DV3C@0FVO ECS) CA?VH=> 7025@H5=>. %1 7 @57C;LB0B>< %2!5@52V@:0 ?V4:;NG5==O 4> E<0@=>W A;C618 Microsoft Defender 4;O :V=F528E B>G>: (:>=DV3C@0FVO ECS) ?>25@=C;0 HTTP 502 "5?@028;L=89 H;N7". &5 2V4><0 B8<G0A>20 ?@>1;5<0 7V H;N7>< ?@>3@0<8 Azure, O:0 <>65 28@VH8B8AO A0<>ABV9=>. >2B>@VBL ?5@52V@:C, O:I> ?@>1;5<0 =5 7=8:=5. %1 7 @57C;LB0B>< %2#AV B5AB>2V ?V4:;NG5==O 4> URL-04@5A E<0@=8E A;C61 Microsoft Defender 4;O :V=F528E B>G>: (:>=DV3C@0FVO ECS) =5 ?@>945=>. 5 240;>AO 28:>=0B8 ?5@52V@:C 4;O URL-04@5A8: %1 7 @57C;LB0B>< %2/:I> 28 ?;0=CTB5 C2V<:=CB8 :5@C20==O :>=DV3C@0FVTN 157?5:8 MDE 4;O :>=B@>;5@V2 4><5=C, 725@=VBLAO 4> =02545=>W =86G5 4>:C<5=B0FVW, I>1 ?5@53;O=CB8 A?8A>: 28<>3.V4B@8<C20=V ?;0BD>@<8h@8AB@V9 =5 <0T <V=V<0;L=>3> @V2=O 28?@02;5==O 4;O ?@8T4=0==O 4> :5@C20==O :>=DV3C@0FVTN 157?5:8 MDE: %10 ?@8AB@>W 2AB0=>2;5=> @>;L A;C61 V<5= Active Directory. V4B@8<:0 :>=B@>;5@V2 4><5=C =0@07V ?5@51C20T 2 @568<V ?V43>B>2G>W 25@AVW V 28<030T 4>40B:>2>W :>=DV3C@0FVW./:I> 28 ?;0=CTB5 C2V<:=CB8 :5@C20==O :>=DV3C@0FVTN 157?5:8 MDE 4;O :>=B@>;5@V2 4><5=C, 725@=VBLAO 4> =02545=>W =86G5 4>:C<5=B0FVW.@8:>@8AB0==O :5@C20==O ?0@0<5B@0<8 157?5:8 =0 :>=B@>;5@0E 4><5=C@8AB@V9 ?@0FNT =0 32-@>7@O4=V9 >?5@0FV9=V9 A8AB5<V, O:0 =5 ?V4B@8<CTBLAO 4;O ?@8T4=0==O 4> :5@C20==O :>=DV3C@0FVTN 157?5:8 MDE.W25@=VBL C203C, I> 71V@:0 ! ?@8AB@>N =5 ?V4B@8<CTBLAO MDE V =5 <>65 1CB8 ?@8T4=0=0: %1:!?8A>: ?V4B@8<C20=8E 25@AV9 Windows =02545=> 2 FV9 AB0BBV.<%1 =0 FL><C ?@8AB@>W =5 ?@0FNT =0 >GV:C20=><C @V2=V 70E8ABC.>:;04=V 2V4><>ABV ?@> 70E8AB PPL V ?@> B5, G><C F5 4C65 206;82>, 482. 2 FV9 4>:C<5=B0FVW. /:I> ?@>1;5<0 =5 7=8:=5, 725@=VBLAO 4> A;C618 ?V4B@8<:8 Microsoft.PPL|25@=VBL C203C, I> 2AB0=>2;5=0 =0 FL><C ?@8AB@>W A5@25@=0 @540:FVO Hyper-V =5 ?V4B@8<CTBLAO MDE V =5 <>65 1CB8 ?@8T4=0=0: %1_82. 4>:C<5=B0FVN "7 ?V4B@8<:>N MDE", I>1 ?5@53;O=CB8 A?8A>: ?V4B@8<C20=8E A5@25@=8E 28?CA:V2.V4B@8<C20=V 25@AVW Windows!;C610 MDE Sense!;C610 MDE 0=B82V@CAC Windefend!;C610 57?5:8 C Windows WscSvc!;C610 Windows SecurityHealth"!;C610 MDE 70E8ABC <5@56V WdnisSvc!B0= >A=>2=>W A;C618 DefenderPA!>:;04=V 2V4><>ABV 482. 2 AB0BBV.25@=VBL C203C, I> =0 FL><C :><? NB5@V ?@0FNT 70AB0@V;0 25@AVO ?;0BD>@<8 Defender. 5@AVW ?;0BD>@<8, AB0@VHV 70 N-2, 1V;LH5 =5 ?V4B@8<C20B8<CBLAO.9;0BD>@<0 ?@>3@0<8 70E8ABC 2V4 2V@CAV2 Microsoft Defender25@=VBL C203C, I> =0 FL><C :><? NB5@V ?@0FNT 70AB0@V;0 25@AVO =B82V@CA0 Defender. VA;O 28?CA:C =>2>W 25@AVW ?0:5B0 ?V4B@8<:0 42>E ?>?5@54=VE 25@AV9 72>48BLAO ;8H5 4> B5E=VG=8E ?8B0=L. 5@AVW, AB0@VHV 70 2:070=V 2 FL><C @>74V;V, =040NBLAO ;8H5 4;O B5E=VG=>W ?V4B@8<:8 7 >=>2;5==O."/4@> =B82V@CAC Microsoft Defender25@=VBL C203C, I> =0 FL><C :><? NB5@V 28:>@8AB>2CTBLAO 70AB0@V;0 25@AVO <5E0=V7<C 28O2;5==O 703@>7. )>1 70157?5G8B8 >?B8<0;L=89 70E8AB V AC<VA=VABL, @5:><5=4CT<> 70AB>AC20B8 =09=>2VHC 25@AVN <5E0=V7<C 28O2;5==O 703@>7.2=>2;5==O 0=B82V@CA=>W ?@>3@0<8 Microsoft DefenderPAC8A>:5 28:>@8AB0==O & Sense A?>AB5@V30TBLAO G5@57 B@0DV: Sense NDR]!?@>1C9B5 70AB>AC20B8 28=OB:8 @>B84VW 703@>70< C :V=F528E B>G:0E Sense 4> B0:8E ?@>F5AV2: %18A>:5 28:>@8AB0==O &L;0BD>@<0 MDE 707=0;0 28A>:>3> 28:>@8AB0==O ?0< OBV 7 ?>B>G=8<8 25@AVO<8 MDE8A>:5 28:>@8AB0==O ?0< OBV><8;:8 >=>2;5==O ?;0BD>@<8 MDE><8;:8 >=>2;5==O O4@0 MDE><8;:8 >=>2;5==O ?V4?8AC MDEC=>2;5==O ?V4?8AC MDE =5 240TBLAO, >A:V;L:8 265 70?CI5=> 5:75<?;O@.[0G5:09B5, 4>:8 2AV ?@>F5A8 MpSigStub.exe 7025@H0BLAO, ?5@H =V6 ?>2B>@=> >=>2;N20B8 ?V4?8A.L5 240;>AO V=VFV0;V7C20B8 A;C61C MDE Windefend, V 2>=0 70AB@O3;0 =0 5B0?V %15@57020=B06B5 :><? NB5@ V >=>2VBL ?;0BD>@<C Defender 4> =09=>2VH>W 25@AVW, 0 O:I> ?@>1;5<0 =5 7=8:=5, ?>2V4><B5 ?@> F5 :>@?>@0FVN 09:@>A>DB.N5 240;>AO 7025@H8B8 @>1>BC A;C618 MDE Windefend, V 2>=0 70AB@O3;0 =0 5B0?V %1e=>2VBL ?;0BD>@<C Defender 4> =09=>2VH>W 25@AVW. /:I> ?@>1;5<0 =5 7=8:=5, ?>2V4><B5 ?@> F5 Microsoft.J8:;NG5==O MDE ?>A8;0TBLAO =0 7<V==V A5@54>28I0 (%1), O:V =5 T A8AB5<=8<8.b5@53;O=LB5 A2>W 28=OB:8: %1 I>1 ?5@5:>=0B8AO, I> 2>=8 ?>A8;0NBLAO =0 ?@028;L=V 7<V==V A5@54>28I0.25 240;>AO >B@8<0B8 =0;0HBC20==O Defender Windows./:I> 28 ?;0=C20;8 2?@>2048B8 :5@C20==O :>=DV3C@0FVTN ?@8AB@>W2 MDE, 725@=VBLAO 4> =02545=>W =86G5 AB0BBV, I>1 >B@8<0B8 4>40B:>2V 2V4><>ABV.<5@5:>=09B5AO, I> A;C610 Defender Windows ?@0FNT V 4>ABC?=0.I0;0HBC20==O =B82V@CAC Microsoft Defender 70 4>?><>3>N 3@C?>2>W ?>;VB8:88<>38 4> ?V4:;NG5==OM0;0HBC20==O 3V1@84=8E ?@8T4=0=L Azure Active Directory 4;O :5@>20=8E 4><5=V2>@B0; 157?5:8 M365PAl#AC=5==O ?@>1;5< V7 ?@8T4=0==O<, ?>2 O70=8E V7 :5@C20==O< 157?5:>N 4;O Microsoft Defender 4;O :V=F528E B>G>:;NG AB0=40@B=8E ?>;VB8: MDE"!B0=40@B=89 :;NG A;C618 MDE Sensor%!B0=40@B=89 H;OE 4> :0B0;>3C :5H0 MDE&!B0=40@B=89 H;OE 4> :0B0;>3C MDE Cyber !B0=40@B=89 H;OE 4> :0B0;>3C MDE,!B0=40@B=89 H;OE 4> :0B0;>3C ProgramData MDE,!B0=40@B=89 H;OE 4> B8<G0A>2>3> :0B0;>3C MDE+!B0=40@B=89 H;OE 4> :0B0;>3C B@0AC20==O MDE840;VBL @>74V;8 @5TAB@C, ?>2 O70=V V7 70E8AB>< 2V4 V<VB0FV9, I>1 ?@8AB@V9 AB2>@82 =>289 ?@820B=89 :;NG V ?>2B>@=> 70@5TAB@C202AO. 8:>=09B5 :><0=4C "%1"5<0T 4V9 4;O 28:>=0==O. V4 G0A ?5@V>4C, I> ?>G8=0TBLAO 7 ?>4VW 70?CA:C Cyberthrottling, :V15@40=V =5 =04E>48;8 2 ?>@B0; MDATP.&59 ?@8AB@V9 =0<0302AO 22V9B8 G5@57 035=B <>=VB>@8=3C Microsoft (MMA), 0;5 =5 7<V3 28:>=0B8 FN A?@>1C, >A:V;L:8 2V= =5 ?V4B@8<CT ?@8T4=0==O 70 4>?><>3>N FL>3> <5B>4C.7=09><B5AO 7 =0H>N >=;09=>2>N 4>:C<5=B0FVTN, I>1 4V7=0B8AO, O:89 A?>AV1 ?@8T4=0==O ?V4E>48BL 4;O >?5@0FV9=>W A8AB5<8 FL>3> ?@8AB@>N.(V4B@8<C20=0 :>=DV3C@0FVO ?@8T4=0==O MDE:><? NB5@ ?>2 O70=> 7 ?52=8< V45=B8DV:0B>@>< >A5@54:C AAD.5@5:>=09B5AO, I> V45=B8DV:0B>@ :;VT=B0 AAD C 20H><C >A5@54:C MDE 2V4?>2V40T V45=B8DV:0B>@C :;VT=B0 SCP, =02545=><C 28I5. )>1 ?5@53;O=CB8 V45=B8DV:0FVN 20H>3> >A5@54:C MDE, 725@=VBLAO 4> ?>@B0;C 157?5:8 M365.H@8AB@V9 ?V4B@8<CT 70E8AB 2V4 V<VB0FVW B0 ?5@51C20T 2 AB01V;L=><C AB0=V.ISharedSignatureRoot =0;0HB>20=> B0 4>ABC?=> 4;O >1;V:>2>3> 70?8AC SYSTEM.4>=DV3C@0FVO SharedSignatureRoot 283;O40T =>@<0;L=>.H=0G5==O @5TAB@C SharedSignatureRoot =5 =0;0HB>20=> 01> 2>=> =54>ABC?=5.o&5 V=D>@<0FV9=5 ?>2V4><;5==O ?5@52V@B5, G8 >GV:CTBLAO :>=DV3C@0FVO SharedSignatureRoot 4;O 20H>3> A5@54>28I0.+>=DV3C@0FVO @>7:;04C >=>2;5==O ?V4?8AC: %15SignatureScheduleDay: %1, SignatureUpdateInterval: %2[5@53;O=LB5 =0;0HBC20==O @>7:;04C >=>2;5==O ?V4?8AC 2V4?>2V4=> 4> ?>B@51 20H>3> A5@54>28I0.E0;0HBC20==O 70?;0=>20=8E ?5@52V@>: 4;O =B82V@CAC Microsoft Defender.SignatureDefinitionUpdateFileSharesSources: %1k5@53;O=LB5 =0;0HBC20==O 465@5; A?V;L=>3> 4>ABC?C 4> D09;V2 ?V4?8AC 2V4?>2V4=> 4> ?>B@51 20H>3> A5@54>28I0.SignatureFallbackOrder: %1T5@53;O=LB5 =0;0HBC20==O @575@2=>3> ?>@O4:C ?V4?8AC 2V4?>2V4=> 4> ?>B@51 A5@54>28I0.25@=VBL C203C, I> =0 FL><C :><? NB5@V 4VT ?>;VB8:0, O:0 4>72>;OT 4>4020B8 ;8H5 =04V9=8E 28402FV2 =0 >A=>2V 4><5=C. &5 <>65 ?5@5H:>460B8 @>1>BV 40BG8:0 MDE, O:89 <0T V=AB0;N20B8 A5@B8DV:0B8 2 AE>28I5 =04V9=8E 28402FV2.;O >B@8<0==O 4>40B:>2>W V=D>@<0FVW 725@=VBLAO 4> AB0BBV. )>1 C=8:=CB8 =5>GV:C20=8E ?@>1;5<, 2840;VBL ?>2'O70=C :>=DV3C@0FVN 3@C?>2>W ?>;VB8:8: ;>:0;L=V ?>7=0G:8 02B5=B8DV:0FVW = %1, ?>7=0G:8 02B5=B8DV:0FVW GP = %2.TrustedPublishers_5 240;>AO ?@>G8B0B8 B>G:C ?V4:;NG5==O 4> A;C618 (SCP) 7 @>74V;C :>=DV3C@0FVW Active Directory.F">G:0 ?V4:;NG5==O A;C618 (SCP) <VAB8BL =5?V4B@8<C20=C :>=DV3C@0FVN: %1F">G:0 ?V4:;NG5==O 4> A;C618 (SCP) <VAB8BL =5?V4B@8<C20=C :>=DV3C@0FVN.x@8AB@V9 =5 <>6=0 ?@8T4=0B8 4> Azure AD, >A:V;L:8 70?8A SCP =0;0HB>20=> =0 ?@8T4=0==O ?@8AB@>N 4> A;C618 Enterprise DRS.V">G:C ?V4:;NG5==O A;C618 (SCP) =5 =0;0HB>20=> 2 @>74V;V :>=DV3C@0FVW Active Directory.h5 240;>AO ?V4:;NG8B8AO 4> :>=B@>;5@0 4><5=C, I>1 >B@8<0B8 2V4><>ABV ?@> B>G:C ?V4:;NG5==O A;C618 (SCP).A=CT @>71V6=VABL <V6 V45=B8DV:0B>@>< >A5@54:C AAD V7 20H>3> >A5@54:C MDE 9 V45=B8DV:0B>@>< :;VT=B0 2 70?8AV SCP 20H>3> 4><5=C.5@5:>=09B5AO, I> V45=B8DV:0B>@ :;VT=B0 AAD C 20H><C >A5@54:C MDE 2V4?>2V40T V45=B8DV:0B>@C :;VT=B0 SCP, =02545=><C 28I5. )>1 ?5@53;O=CB8 V45=B8DV:0FVN >A5@54:C MDE, 482. 4>:C<5=B0FVN.O@8AB@>T< :5@CT 035=B SCCM, V =8< =5 :5@C20B8<5 @VH5==O :5@C20==O 157?5:>N MDE.aConfiguration Manager 22060TBLAO T48=8< 70A>1>< :5@C20==O 157?5:>N. Defender 4;O :V=F528E B>G>: =5 :5@C20B8<5 ?0@0<5B@0<8 157?5:8 =0 ?@8AB@>OE, O:8<8 265 :5@CT Configuration Manager. /:I> E>G5B5 7<V=8B8 F5, 28<:=VBL ?0@0<5B@ "5@C20B8 ?0@0<5B@0<8 157?5:8 70 4>?><>3>N Configuration Manager". >40B:>2V 2V4><>ABV 482VBLAO 2 =02545=V9 =86G5 4>:C<5=B0FVW.M@8AB@V9 ?V4B@8<CT 70E8AB 2V4 V<VB0FVW, 0;5 =5 ?5@51C20T 2 AB01V;L=><C AB0=V.~C4L ;0A:0, 725@=VBLAO 4> @5:><5=40FV9 C =0ABC?=V9 AB0BBV. /:I> ?@>1;5<0 =5 7=8:=5, 725@=VBLAO 4> A;C618 ?V4B@8<:8 Microsoft.6Microsoft Defender 4;O :V=F528E B>G>: CVE-2022-232788Microsoft Defender 4;O :V=F528E B>G>: 0=0;VB8:0 703@>7!B0=40@B=V H;OE8 2V4ACB=V: %1.5@5:>=09B5AO, I> 73040=V 2V4ACB=V H;OE8 VA=CNBL V =5 1C;8 ?5@59<5=>20=V. >6;82>, ?>B@V1=> AB2>@8B8 2V4ACB=V ?0?:8 2 :>=B5:ABV ;>:0;L=>3> :><? NB5@0.PAQ5 240;>AO ?@8T4=0B8 F59 ?@8AB@V9 G5@57 Microsoft Endpoint Configuration Manager.&O ?@>1;5<0 <>65 28=8:=CB8, O:I> @>74V; @5TAB@C %1 2V4ACB=V9 C: %2. )>1 AB2>@8B8 2V4ACB=V9 @>74V; @5TAB@C, <>6=0 A:>@8AB0B8AO: %3B@8AB@V9 ?>2V4><;OT ?@> ?@>AB@>G5=C >@30=V70FVN 45=B8DV:0B>@: %1.k0< A;V4 2V4'T4=0B8 ?@8AB@V9 2V4 FVTW >@30=V70FVW, 0 ?>BV< ?@8T4=0B8 9>3> 4> ?>B>G=>W >@30=V70FVW. 25@=VBLAO 4> A;C618 ?V4B@8<:8 Microsoft, O:I> C 20A =5<0T 4>ABC?C 4> AF5=0@VN 2V4'T4=0==O 7V 73040=8< V45=B8DV:0B>@>< OrgID. @8<VB:0: )>1 ?5@53;O=CB8 ?>B>G=89 OrgID, 1C4L ;0A:0, ?5@594VBL =0 ?>@B0; MDEMDE V =0B8A=VBL =0 V<'O :>@8ABC20G0 C 25@E=L><C ?@02><C :CBV. &5=B@ 157?5:825@=VBL C203C, I> ?@8AB@V9 <0T ?><8;:C "020=B065==O ?@820B=>3> :;NG0 4;O A5@B8DV:0B0 02B5=B8DV:0FVW :;VT=B0" 2 6C@=0;V OpsMgr.w840;VBL V ?>2B>@=> V=AB0;N9B5 MMA (035=B <>=VB>@8=3C Microsoft) =0 FL><C ?@8AB@>W B0 ?5@52V@B5, G8 ?@>1;5<0 =5 7=8:=5.<VAF5289 G0A =0 ?@8AB@>W =5 71V30TBLAO 7 G0A>< C AzureAzure.l5@5:>=09B5AO, I> G0A C ;>:0;L=V9 A8AB5<V ?@028;L=89 V 2AB0=>2;5=> ?@028;L=89 G0A>289 ?>OA. /:I> F59 ?@8AB@V9 ?@8T4=0=> 4> 4><5=C, ?5@5:>=09B5AO, I> A;C610 Windows Time ?@0FNT, 0 ?@8AB@V9 A8=E@>=V7>20=> 7 G0A>< 20H>3> 4><5=C. >:;04=V 2V4><>ABV ?@> =0;0HBC20==O B0 :5@C20==O A8=E@>=V70FVTN G0AC 482. 2 AB0BBV, I>1 ?5@5:>=0B8AO, I> ;>:0;L=89 G0A C BIOS ?@028;L=89. WindowsTimeU@8AB@V9 ?@0FNT ?V4 :5@C20==O< AB0@VH>W 25@AVW System Center Endpoint Protection: %1.=>2VBL A8AB5<C 4> >AB0==L>W 4>ABC?=>W 25@AVW, I>1 70157?5G8B8 AC<VA=VABL V 4>72>;8B8 @5TAB@C20B8 28O2;5==O H:V4;82>3>  =0 ?>@B0;V 157?5:8 Defender 4;O :V=F528E B>G>:.9!B0;0AO ?><8;:0 2 ?>B>FV :5@C20==O :>=DV3C@0FVTN 157?5:8.@8AB@V9 ?@8T4=0=> 4> Microsoft Defender 4;O :V=F528E B>G>:. 4=0: AB0;0AO ?><8;:0 2 ?>B>FV :5@C20==O :>=DV3C@0FVTN 157?5:8. &5 <>65 1CB8 G5@57 B5, I> ?@8AB@V9 =5 2V4?>2V40T 28<>30< 4;O :0=0;C :5@C20==O Microsoft Defender 4;O :V=F528E B>G>:.9>?5@54=V C<>28 4;O Microsoft Defender 4;O :V=F528E B>G>:9!B0;0AO ?><8;:0 2 ?>B>FV :5@C20==O :>=DV3C@0FVTN 157?5:8.PA@8AB@V9 ?@8T4=0=> 4> Microsoft Defender 4;O :V=F528E B>G>:. 4=0: Microsoft Endpoint Manager =5 =0;0HB>20=> G5@57 &5=B@ 04<V=VAB@C20==O 4;O 4>72>;C :>=DV3C@0FVW 157?5:8 Microsoft Defender 4;O :V=F528E B>G>:.0>=DV3C@0FVO >A5@54:C Microsoft Endpoint Manager !B0;0AO ?@>1;5<0 7 ?V4:;NG5==O<.@8AB@V9 ?@8T4=0=> 4> Microsoft Defender 4;O :V=F528E B>G>:. 4=0: C ?>B>FV :5@C20==O :>=DV3C@0FVTN 157?5:8 AB0;0AO ?><8;:0, O:0 <>3;0 28=8:=CB8 G5@57 ?@>1;5<C 7 ?V4:;NG5==O<. 5@5:>=09B5AO, I> ?@8AB@V9 <>65 >1<V=N20B8AO 40=8<8 7 :V=F528<8 B>G:0<8 MDE.BV=F52V B>G:8 Azure Active Directory B0 Microsoft Endpoint Manager'030;L=0 ?><8;:0 3V1@84=>3> ?@8T4=0==O.@8AB@V9 ?@8T4=0=> 4> Microsoft Defender 4;O :V=F528E B>G>:. 4=0: AB0;0AO ?><8;:0 2 ?>B>FV :5@C20==O :>=DV3C@0FVTN 157?5:8, V ! =5 240;>AO 28:>=0B8 3V1@84=5 ?@8T4=0==O. 5@53;O=LB5 ?>A8;0==O 4;O CAC=5==O =5?>;04>: 3V1@84=>3> ?@8T4=0==O =0 @V2=V !.V8?@02;5==O =5?>;04>: V7 3V1@84=8<8 ?@8AB@>O<8, ?V4:;NG5=8<8 4> Azure Active Directory52V4?>2V4=VABL >A5@54:C.@8AB@V9 ?@8T4=0=> 4> Microsoft Defender 4;O :V=F528E B>G>:. 4=0: C ?>B>FV :5@C20==O :>=DV3C@0FVTN 157?5:8 AB0;0AO ?><8;:0, 1> V45=B8DV:0B>@ >A5@54:C Microsoft Defender 4;O :V=F528E B>G>: =5 71V30TBLAO 7 V45=B8DV:0B>@>< >A5@54:C Azure Active Directory. 5@5:>=09B5AO, I> V45=B8DV:0B>@ >A5@54:C Azure Active Directory 7 20H>3> >A5@54:C Defender 4;O :V=F528E B>G>: 71V30TBLAO 7 V45=B8DV:0B>@>< >A5@54:C 2 70?8AV SCP 20H>3> 4><5=C.)V1@84=0 ?><8;:0 B>G:0 7 T4=0==O A;C618@8AB@V9 ?@8T4=0=> 4> Microsoft Defender 4;O :V=F528E B>G>:. 4=0: 70?8A B>G:8 ?V4:;NG5==O A;C618 (SCP) =0;0HB>20=> =5?@028;L=>, V ?@8AB@V9 =5 240;>AO ?@8T4=0B8 4> Azure AD. &5 <>65 1CB8 G5@57 B5, I> SCP =0;0HB>20=> =0 ?@8T4=0==O 4> Enterprise DRS. 5@5:>=09B5AO, I> 70?8A SCP 2:07CT =0 Azure AD, 0 SCP =0;0HB>20=> 2V4?>2V4=> 4> =09:@0I8E ?@0:B8:. )>1 4V7=0B8AO 1V;LH5, ?5@594VBL 70 ?>A8;0==O<8.#0;0HBC20==O B>G:C 7 T4=0==O A;C618><8;:0 A5@B8DV:0B0.@8AB@V9 ?@8T4=0=> 4> Microsoft Defender 4;O :V=F528E B>G>:. 4=0: C ?>B>FV :5@C20==O :>=DV3C@0FVTN 157?5:8 AB0;0AO ?><8;:0 G5@57 ?><8;:C A5@B8DV:0B0 ?@8AB@>N. !5@B8DV:0B ?@8AB@>N =0;568BL V=H><C >A5@54:C. 5@5:>=09B5AO, I> ?V4 G0A AB2>@5==O ?@>DV;V2 28:>=CNBLAO @5:><5=40FVW.04V9=V ?@>DV;V A5@B8DV:0BV2%5?@028;L=0 :>=DV3C@0FVO AAD Connect. @8AB@V9 ?@8T4=0=> 4> Microsoft Defender 4;O :V=F528E B>G>:. 4=0: C ?>B>FV :5@C20==O :>=DV3C@0FVTN 157?5:8 AB0;0AO ?><8;:0 G5@57 =5?@028;L=C :>=DV3C@0FVN 2 AAD Connect. )>1 287=0G8B8, I> 702060T ?@8AB@>N 70@5TAB@C20B8AO 2 AAD, 70?CABVBL 70A>18 CAC=5==O =5?>;04>:.1=AB@C<5=B CAC=5==O =5?>;04>: @5TAB@0FVW ?@8AB@>NE;O Windows Server 2012 R2 A?5FV0;L=V V=AB@C:FVW 7 CAC=5==O =5?>;04>:><8;:0 A;C618 DNS.@8AB@V9 ?@8T4=0=> 4> Microsoft Defender 4;O :V=F528E B>G>:. 4=0: C ?>B>FV :5@C20==O :>=DV3C@0FVTN 157?5:8 AB0;0AO ?><8;:0 G5@57 ?><8;:C DNS. 5@52V@B5 ?V4:;NG5==O 4> =B5@=5BC B0/01> ?0@0<5B@8 DNS =0 ?@8AB@>W. 5?@028;L=V ?0@0<5B@8 DNS <>6CBL 1CB8 =0 AB>@>=V @>1>G>W AB0=FVW. ;O =0;56=>W @>1>B8 A;C618 Active Directory ?>B@V1=> 28:>@8AB>2C20B8 DNS 4><5=C, 0 =5 04@5AC <0@H@CB870B>@0. )>1 4V7=0B8AO 1V;LH5, ?5@594VBL 70 ?>A8;0==O<8.!@>1;5<0 A8=E@>=V70FVW 3>48==8:0.@8AB@V9 ?@8T4=0=> 4> Microsoft Defender 4;O :V=F528E B>G>:. 4=0: AB0;0AO ?><8;:0 2 ?>B>FV :5@C20==O :>=DV3C@0FVTN 157?5:8. 5@52V@B5, G8 3>48==8: 2AB0=>2;5=> ?@028;L=> 9 A8=E@>=V7>20=> =0 ?@8AB@>W, 45 AB0;0AO ?><8;:0.><8;:0 7020=B065==O ?>;VB8:.@8AB@V9 ?@8T4=0=> 4> Microsoft Defender 4;O :V=F528E B>G>:. 4=0: ?@8AB@V9 =5 7<V3 7020=B068B8 ?>;VB8:8 157?5:8 :V=F528E B>G>: V7 MEM. 5@5:>=09B5AO, I> ?@8AB@V9 <>65 >1<V=N20B8AO 40=8<8 7 :V=F528<8 B>G:0<8 MDE.><8;:0 A:0AC20==O @5TAB@0FVW.@8AB@V9 =0@07V 70@5TAB@>20=>, 0;5 9>3> ?>B@V1=> A:0AC20B8. 4=0: ?@>F5A A:0AC20==O @5TAB@0FVW =5 240;>AO 28:>=0B8 G5@57 B8<G0A>2C ?><8;:C. 5@5:>=09B5AO, I> ?@8AB@V9 <>65 >1<V=N20B8AO 40=8<8 7 MDE :V=F528<8 B>G:0<8.><8;:0 ?@87=0G5==O ?>;VB8:.@8AB@V9 CA?VH=> ?@8T4=0=> 4> Microsoft Defender 4;O :V=F528E B>G>:. ><C 240;>AO 7020=B068B8 ?>;VB8:8 157?5:8 :V=F528E B>G>: V7 MEM. 4=0: ?V4 G0A ?@87=0G5==O ?>;VB8: AB0;0AO ?><8;:0.><8;:0 72VBC ?@> ?>;VB8:8.@8AB@V9 CA?VH=> ?@8T4=0=> 4> Microsoft Defender 4;O :V=F528E B>G>:. ><C 240;>AO 7020=B068B8 ?>;VB8:8 157?5:8 :V=F528E B>G>: V7 MEM. 4=0: ?V4 G0A 72VBC20==O ?@> ?>;VB8:8 4> MEM AB0;0AO ?><8;:0.PA_&59 ?@8AB@V9 =5 <>6=0 ?@8T4=0B8 2 ?>B>G=><C AB0=V, >A:V;L:8 9>3> AB0= ImageState C %1 =5?>2=89.&O ?@>1;5<0 <>65 28=8:=CB8, O:I> >1@07 ! 28:>=02 :V;L:0 ?>A;V4>2=8E A?@>1 sysprep, 0 4;O @5TAB@C 2AB0=>2;5=> 7=0G5==O '%1'. /:I> ?@>1;5<0 =5 7=8:=5, 725@=VBLAO 4> A;C618 ?V4B@8<:8 Microsoft..V4><>ABV ?@> AB0= ?@>3@0<8 V=AB0;OFVW Windows@>6;82>, 7=0G5==O ImagePath C @5TAB@V 7<V=5=> ?5@54 ?@8T4=0==O<.s5@53;O=LB5 FN ?><8;:C B0 ?5@52V@B5 ImagePath (C <560E %1), I>1 ?5@5:>=0B8AO, I> 2V= 2:07CT =0 ?@8?CAB8<89 H;OE %2.(8O2;5=> >1<565=V ?>4VW :V15@40=8E SenseMDE V ConfigMgr!5@C20==O ?@8AB@>T< 74V9A=NTBLAO 70 4>?><>3>N Configuration Manager V Microsoft Defender 4;O :V=F528E B>G>:. 5@C20==O ?>;VB8:0<8 G5@57 >18420 :0=0;8 <>65 A?@8G8=8B8 :>=D;V:B8 9 =51060=V =0A;V4:8. )>1 C=8:=CB8 FL>3>, ?>;VB8:8 157?5:8 :V=F528E B>G>: A;V4 V7>;N20B8 2 >4=V9 A8AB5<V 157?5:8.8!?V2VA=C20==O 7 Microsoft Endpoint Configuration Manager!B0= @5TAB@0FVW 7<V=5=>5@C20==O ?@8AB@>T< 74V9A=NTBLAO 70 4>?><>3>N Configuration Manager V Microsoft Defender 4;O :V=F528E B>G>:. @8AB@V9 1C;> 28;CG5=> 7 @VH5==O :5@C20==O :>=DV3C@0FVTN 157?5:8, 1> 7<V=8;0AO >1;0ABL 70AB>AC20==O 01> 7 ?@8AB@>N 2840;8;8 ?>7=0G:C MDE-Management.!8AB5<=V 7<V==V >B>G5==O %%TEMP%% (B0 %%TMP%%) =5 287=0G5=>. &5 <>65 A?@8G8=8B8 71>W 2 @>1>BV Windows Defender V V=H8E A8AB5<=8E :><?>=5=BV2, O:V 70;560BL 2V4 B8<G0A>2>3> :0B0;>3C.87=0GB5 7<V==V A8AB5<=>3> A5@54>28I0 TEMP V TMP. !B0=40@B=5 7=0G5==O %%SystemRoot%%\TEMP 4;O A8AB5<=8E >1;V:>28E 70?8AV2. 5@5:>=09B5AO, I> H;OE VA=CT B0 <0T 2V4?>2V4=V 4>72>;8.0B0;>3 %%TEMP%% =54>ABC?=89. &5 <>65 ?@8725AB8 4> 71>W2 C :><?>=5=B0E 0E8A=8:0 Windows, O:8< ?>B@V1=> 70?8AC20B8 B8<G0A>2V D09;8.j5@5:>=09B5AO, I> :0B0;>3 %%TEMP%% VA=CT, 0 ?>B>G=89 >1;V:>289 70?8A <0T 4>72>;8 =0 G8B0==O 9 70?8AC20==O.0B0;>3 %%TEMP%% =0;0HB>20=> =0 =5AB0=40@B=89 H;OE. 5AB0=40@B=89 H;OE TEMP <>65 A?@8G8=8B8 ?@>1;5<8 7 :><?>=5=B0<8, O:V ?@8?CA:0NBL AB0=40@B=5 @>7B0HC20==O.PA5@52V@B5, G8 A?5FV0;L=89 H;OE %%TEMP%% T =02<8A=8<. /:I> F5 =5>GV:C20=>, A:8=LB5 7<V==V A8AB5<=>3> A5@54>28I0 TEMP V TMP 4> AB0=40@B=>3> 7=0G5==O (%%SystemRoot%%\TEMP 4;O A8AB5<=8E >1;V:>28E 70?8AV2).P >]Q eQ e% T 'U mF@e)@<  (WUU>g F-c+# ;c) >U_@Aa. B%5   [ 82U7 > 8Y Y I@MDB W ` (7 z_S M;Y O [MW7U) FB7#3B/Q, %5?  U O<< g Y<1 '  IU:UA e  ^LU @ []a. S mU VFYmg8 F  B3B Ig% ?7W S Dc @:TUM UM5W g % We)B.  +F ~U|=a <0 '+ 'a < e HLQS Q cQ <[] # Y<_a_  S/_cYC \5 $6A_]eMm_ YYIB ;g3>>`.!_Y/ [_Z;]T.dR)_ ? '9 i gO -HcWUKM m 33 Og __3-c @3mAU O  ^\f A>8B o<< DcU< 3mU[M;[ U <_]K! W & =_Zw]em_Y58Ic3B^c_/5[_^Ka. "[ @OmUaa QiH  \"- AB S: %1N :a g =g c'W] ]W3 _ Mc =4 B=Q <QYD _;V.! 79g ?]e4!>.)7 B 3 BB UUW] )[  > -K]B<! I g=+[ .!A. .B a 3.!1m<9 g ]g:> R 8H 7 B W B/<< UMYm F @1ge1 L+!e_. U mU )U<BH YY e c= > s<cgHFLOO )Hu[ _S] g % )ASOa D5Y O > ]W)YQ>) +] 0aa!H<H W<k OqO3 LU  c=.! !B>HF# 9Y1<Tc U+2:(U): %1&b[ .!/ U aMUU@>^ M2W c W 3Q_c QHY MY  MF  H] L@.! e O ! e[ MH)9g ]T _Uc 1B _ Ym . &HQY, g%O7 H0_ : FS? B[7 []+!mg  c'T Q@ -Q_. :0]7 Sm> D D-7E[BD! '([) 3< e' 21 aagMm 9/Wm g SV2@(a).5g D)SD<;g 3WJ<a WD g'Q ]eMm DY@ H>i !7a __!9m8B :FY AYU ]W8A7 m VO `RO \ '<H ( \^) ] T92! D g%  .=b=5 QV  [ aq U_<! MFJS BO Y]e  W D  I4[ L: c I;! g= ;@-Fe U5AY)B^ @W+U Y1m . &HMY, g'U HU  4)BU U g' aU-<9c  eRT @O< TU 5 e   B)<)geO B= F Y [;  Z [ 2>5. <[T  c VOQ[ _mYc U 4[[V[gK.M) -[ 8e @-e-B7 0 Q[  R5 0IgV-[# @L)Be @.BMa H[ w @@ gR O.!1m<.! U7O e ' e W  [ A5 Sm ]-?#, W <U W O<gI Y c BR @I].PA0 Y_B .!TDO 1W "HHc - V-2022-232782UU>B M;O S H;c - [3 KBeaW- ] Si;V9# Ig[  OB Y[  B% /S_ 9TS W D@B V aMH[QOM>.!a.!  [ ]7FaY B M[qW C R >@g<@ 3cA;   [B0J):)eC.5 W_1c .!9MU 3 Ic g M X Z79UMW"[a m'+H '4] +B5  ?2U U UZ;aM.6 ]' S-! +IWB-:|cK '0_  d! /2.@:. d= 5YWO m B=Q O_' u4a: %1"[-_ K R@Q8  B%T `\f 0He [  '4T W<[]-M[ e HO5 e BRT TEc g% ( YWm4\ 3_B\)[ DS "8 5 "=O.!c U eV9\ 23). >7a @g RT ?a VK g[ @c[  W[ %Q @mVU_)F_ < O5 e BY  7.EW  a 0H-]I! @L@ Jg _ I1 g WT[c3 )B= >Os.l@7] I[FY.! F e-Vg  >O ! nU ] > 2< 8M. OB g YMU>e U  aU TO]]e[.M ;VsY4gVF Y @.!5K  [ @O.!FB+ 7eu>Y7 B gOD OM< _gSg9#.T B0UQ 3VT cRW] .!YY>S mQa[ eM H_eH R L@ :I! a]iM D Y_! g: %1aZk@@Oc f;\ -'5Sa Y5 e  J<Q 1 g'W[ m[D. f'a  Ac  I.! Bw g  >1m.:[Q -U  B% K A[3U (-c=? 6=\` "(\ B W5_\WAOaB\Y@g1R^\!;Y>D\`Z;\00010002) B M8UY  BIU <)HW<q< U7qW %3a  Q HeVe^   :."=O ]_WB5[ ? b? Oq-WmIBUbbA^ 1.2 A!Fc @3B @ a 9c IL! F '+U m=H. fRU D .!Ag Q;cVcC   BMs.<M]7 K3< g[c "?^ 1.2 B-TDe _ L! (cR ;\`Zb\ YUHc 1Ic3@\Te\KcY>\`ocwYS[\\ &"\UM:U\b9 1.2\ !TI).PAX- @RQY] U   M?J< ? gR+] m%?. d%a  Q e 1; ceC g - >F. <Qa 1;-Um cRc  5C[9!OWB[m /_ LB ('/?  \\^b\ Y3;g ?cUOB\ ;BUMB\^Q_SBwSVU\Z &G9\= 7>#MYBR<]\ ).[  /? B_B 0->5gS\ SeT cVH m@5Fg ] _J! Y ! T %\ cUB. "[-U <w K B aQ  M 97gHMW UY BO (E: !a 1 mJW>!).PA5@>20=89 4>ABC? 4> ?0?>:M5 240;>AO 7020=B068B8 <>4C;L mde_cfa_evaluation 4V03=>AB8:0 CFA =54>ABC?=005@52V@B5 V=AB0;OFVN MdeDiag V @5TAB@0FVN <>4C;OA# 6C@=0;0E =5 7=0945=> 28O2;5=L CFA (:5@>20=>3> 4>ABC?C 4> ?0?>:)05 ?>B@V1=> =VG>3> @>18B8 CFA ?@0FNT =>@<0;L=>?@>0=0;V7>20=> ?V4>7@V;V D09;8 (%1) 4;O 287=0G5==O AB0=C 4>2V@8q5@53;O=LB5 CfaTrustChecks.txt C 28EV4=V9 V=D>@<0FVW 4V03=>AB8:8, I>1 >B@8<0B8 4>:;04=V @57C;LB0B8 0=0;V7C 4>2V@8C%1 =5 4>2V@OT CFA, >A:V;L:8 7>1@065==O ?@>F5AC =5 287=0=> =04V9=8<.q>409B5 9>3> 4> A?8A:C 4>72>;5=8E ?@>3@0< 01> 4>409B5 28:;NG5==O 0=B82V@CA0 4;O FL>3> D09;C, O:I> 4>2V@OTB5 9><C.J%1 =5 4>2V@OT CFA, >A:V;L:8 9>3> 10BL:V2AL:89 5;5<5=B =5 287=0=> =04V9=8<.E%1 =5 4>2V@OT CFA, >A:V;L:8 9>3> 10BL:V2AL:89 5;5<5=B =5 T AF5=0@VT<.<%1 =5 4>2V@OT CFA, >A:V;L:8 7020=B065=> =5=04V9=89 D09;: %2.DCFA =5 4>2V@OT %1, >A:V;L:8 WW 1C;> 22545=> =5=04V9=8< ?@>F5A><: %2.C>409B5 28:;NG5==O 0=B82V@CA0 4;O FL>3> D09;C, O:I> 4>2V@OTB5 9><C.Z>409B5 28:;NG5==O 0=B82V@CA0 4;O FL>3> ?@>F5AC, O:I> 4>2V@OTB5 9><C (28:;NG5==O ?@>F5AC).PA @>F5A: %1 >4VW CFA:  VO: %1, ?@8G8=0: %2>4VW 701@C4=5==O:" - TaintType: %1, TaintReason: %2 >2V4=8:: %1(5:75<?;O@V2: %1)PAt'%2' ASR %1 GUID (465@5;>: %3) <VAB8BL ?@>1V;8 =0 ?>G0B:C 01> 2 :V=FV, O:V <>6CBL ?5@5H:>460B8 70AB>AC20==N ?@028;0.f840;VBL ?>G0B:>2V B0 :V=F52V ?@>1V;8 7 GUID ?@028;0 ASR C :>=DV3C@0FVW 3@C?>2>W ?>;VB8:8 01> @5TAB@C.ASR %1 GUID %2 (465@5;>: %3) <VAB8BL DV3C@=V 4C6:8. 45=B8DV:0B>@8 GUID A;V4 2:07C20B8 157 4C6>: (=0?@8:;04, 56a863a9-875e-4185-98a7-b882c64b5ce5).W8;CGVBL DV3C@=V 4C6:8 7 GUID ?@028;0 ASR C 3@C?>2V9 ?>;VB8FV 01> :>=DV3C@0FVW @5TAB@C.8:;NG5==O ASR '%1' (465@5;>: %2) <VAB8BL ?>G0B:>2V 01> :V=F52V ?@>1V;8 G8 B01C;OFVW, O:V <>6CBL ?5@5H:>460B8 ?>HC:C 28:;NG5==O.k840;VBL ?>G0B:>2V B0 :V=F52V ?@>1V;8 7V H;OEC 28:;NG5==O ASR C 3@C?>2V9 ?>;VB8FV 01> :>=DV3C@0FVW @5TAB@C.ASR %1 GUID %2 (465@5;>: %3) =5 T 4V9A=8< GUID. GV:C20=89 D>@<0B: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx (=0?@8:;04, 56a863a9-875e-4185-98a7-b882c64b5ce5)8?@02B5 GUID ?@028;0 ASR C :>=DV3C@0FVW 3@C?>2>W ?>;VB8:8 01> @5TAB@C, I>1 28:>@8AB>2C20B8 ?@8?CAB8<89 D>@<0B GUID 157 4>40B:>28E A8<2>;V2.^V "EBm[W '%1' (]WA: %2) K0;_ Oc-WUW ('..') Um5De. "cW OU@? '..' '.! A/ .! ! g= <4^ L <R JYQ3 BRD [ <cU> QFBY^ [!MUU, a>;cB E@;) c[ <_[H L58 _ -8B M ] .:0A % \T 5A:[QD 5DeY +%  _BB^-YQ_M! 02U1BBQ @0e= R4 ] c ?c? '..' U<He]. M;c 3[_  ]c IY X c 88- IB 6 Bk_+D M9BY-] c H @0 cm.PA')> B0:5 0=0;VB8:0 4V03=>AB8:8 Defender?=0;VB8:0 4V03=>AB8:8 Defender F5 V=AB@C<5=B A0<>4V03=>AB8:8, O:89 718@0T 9 0=0;V7CT 4V03=>AB8G=V 40=V, 0 B0:>6 =040T 72VB 4;O 4>?><>38 2 CAC=5==V ?@>1;5< V7 ?@>4C:B82=VABN 2V@BC0;L=8E <0H8= Windows 2 Azure. >:C<5=B0FVO 0=0;VB8:8 4V03=>AB8:8 Defender 4;O Windows: %1.$ G>3> ?>G0B8 ?5@52V@:C FL>3> 72VBC?>G=VBL V7 2:;04:8 "3;O4". 5@53;O=LB5 @5:><5=40FVW B0 ?>A8;0==O =0 @57C;LB0B8. V7=09B5AO, O: 2>=8 <>6CBL 2?;8=CB8 =0 ?@>4C:B82=VABL, 0 B0:>6 ?@> @5:><5=40FVW I>4> :>=DV3C@0FV9, >?B8<V7>20=8E 4;O ?V428I5==O ?@>4C:B82=>ABV. >:;04=VH5 ?@> ?5@53;O4 72VBC %1.//:V 40=V 718@0T 0=0;VB8:0 4V03=>AB8:8 Defender?&=0;VB8:0 4V03=>AB8:8 Defender 718@0T 2V4><>ABV ?@> 2V@BC0;L=C <0H8=C Windows, :>=DV3C@0FVN 48A:V2 01> ?C;V2 AE>28I, ;VG8;L=8:8 ?@>4C:B82=>ABV, A?>6820GV2 28A>:8E @5AC@AV2, 6C@=0;8 B0 @V7=V B@0AC20==O. >:;04=V 2V4><>ABV ?@> B8? 2V4><>AB59, O:V 718@0T 0=0;VB8:0 4V03=>AB8:8 Defender, 482. 2 %1.PPPPld!B0;0AO ?><8;:0 ?V4 G0A 28:>=0==O <>4C;O LUA. x!B0;0AO ?><8;:0 ?V4 G0A 7020=B065==O <>4C;O LUA-D09;C. L!8=B0:A8G=0 ?><8;:0 2 <>4C;V LUA. D!B0;0AO ?><8;:0 ?0<OBV LUA. D!B0;0AO 7030;L=0 ?><8;:0 LUA. D8=8:;0 ?><8;:0 B@82>38 LUA. \8:>=0==O LUA ?5@5@20=> A83=0;>< 7C?8=:8. 5 240;>AO 48=0<VG=> =0;0HBC20B8 7=V<:8 48=0<VG=>W ?0<OBV 4;O ?@>F5AC. $4VS_VERSION_INFO e e?StringFileInfo`042204B0LCompanyNameMicrosoft Corporation7FileDescription/4@> 4V03=>AB8:8 Microsoft Defender 4;O :V=F528E B>G>:BInternalNamedefenderdiag.dll~-LegalCopyright >@?>@0FVO 09:@>A>DB. #AV ?@020 70E8I5=V.ROriginalFilenamedefenderdiag.dll.muin'ProductName?5@0FV9=0 A8AB5<0 Microsoft Windows;FileVersion4.18.26060.3008 (df1b0eba8e0e68e7272235d6dea4de3285c715b9)DProductVersion4.18.26060.3008DVarFileInfo$Translation"PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD%0%w *H %h0%d10  `He0\ +7N0L0 +70 010  `He SDsrq>>%<FF`ŷ2 003zkճz0  *H  01 0 UUS10U Washington10URedmond10U Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20110 260219193722Z 261017193722Z0p1 0 UUS10U Washington10URedmond10U Microsoft Corporation10UMicrosoft Windows0"0  *H 0  xT 8+;H'h<&s7\A};_=)ؔ6- 9 5p^WO$:dBAFO 5frvYRU_t% 0b4 ^=݌vOr5HT d)#r'ҳ'ϙ;V%=(R64.ou+j A`p5]N0>ivWo[3Tz+:4aCCl@U>r#uN^7v0r0U%0 +7 +0U:a8B~J$(0EU>0<:0810U Microsoft Corporation10U 501107+5068660U#0)9ėx͐O|US0WUP0N0LJHFhttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl%200a+U0S0Q+0Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0 U00  *H  T?it:]?T]h dzBs=oY^Sxg +OUJ%⩺v/VA'aQ=5\[ݻF,` 4r̅/Ag?oԗEHBNN,g? QDpt uWtu gM.uV& h{Mp9jÂ,N&&-ƶ: FF2󨺇0P0t\&؞p >ys00 avV0  *H  01 0 UUS10U Washington10URedmond10U Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100 111019184142Z 261019185142Z01 0 UUS10U Washington10URedmond10U Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20110"0  *H 0  . i!i33T ҋ8-|byJ?5 pk6u1ݍp7tF([`#,GgQ'rɹ;S5|'# oFnhttp://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0  *H  |qQyn9>\` QfG=*hwLb{Ǻz4KbzJ7-W|=ܸZij:ni!7ށugӓW^)9-Es[zFX^gl5?$5 uVx,Јߺ~,c#!xlX6+̤-@EΊ\k>p* j_Gc 26*pZBYqKW~!<ŹE ŕ]b֠c uw}=EWo3wbY~10 001 0 UUS10U Washington10URedmond10U Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20113zkճz0  `He0 *H  1  +70 +7 10  +70/ *H  1" !6C! ˣ q<ʨ݇ё0B +7 1402Microsofthttp://www.microsoft.com0  *H z9A7b?3$8 ,u.e_~+3z(Sx ˄c'.Qbګ+NHN#;V =% }9;|q9 Yo`\l%Vg 8+NaY0”ɐڠ2V+uT~.eLlu^~WLDE(S%Fd I[zOJ(:0 +710| *H m0i10  `He0R *H  A=09 +Y 010  `He PXspA6&P'9{Rg#pj15Q 620260622202734.459Z0Ѥ01 0 UUS10U Washington10URedmond10U Microsoft Corporation1%0#U Microsoft America Operations1'0%U nShield TSS ESN:A400-05E0-D9471%0#UMicrosoft Time-Stamp Service0 03(@(0  *H  0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100 260219194006Z 270517194006Z01 0 UUS10U Washington10URedmond10U Microsoft Corporation1%0#U Microsoft America Operations1'0%U nShield TSS ESN:A400-05E0-D9471%0#UMicrosoft Time-Stamp Service0"0  *H 0 ʜ $^e_ 7\s:B~CclD -pXV4or2R\4rlM*?`.UE=>Ё2q[m@ntg f @epy{Mo!j?Qfy{›"mfT#L*^.,(W8T ,}^G5~jև}Zt+p?&^.Yw YBo+%}{3Nah?sB(xKtf:Oiܸ8G ߠH?25r\V`QbeMFdh8'Bx"?”2<[0RG9FxLÈrv0O~ $p y M.Aar~i.jތw? -Q_URU?rDBGLQӐn=]MPKfL͟jUٻg8I0E0Uɥd[a!iC0U#0]^b]eS5r0_UX0V0TRPNhttp://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l+`0^0\+0Phttp://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0 U00U% 0 +0U0  *H  ˚Zmh7qKN*\Pm׭Z6QxqԬTF/]+w.dfXncb^M05 ҄A!8@p6!MXCj~T(3yTbjbez 9#y(툴-7 h;9I=0z1\-G~P:(!E:"Ћ>z+2 RXNiZhoW8)ȁ;FTvȇ8GHS$ƸIAs1??@ .1-bGP"gxꆥCIH*rQ$01Sg? .nv%BߏhPk7r"'NQB߶s22WO{jLi8%ONA`슢/ߴ۾mfU9`? i3F鱢1+o5fI7H=5w,2^Z,U>0q0Y3kI0  *H  01 0 UUS10U Washington10URedmond10U Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100 210930182225Z 300930183225Z0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100"0  *H 0 Lr! y$yՂҩlNu5WlJ⽹>`3\OfSqZ~JZ6gF# w2`}jRDFkvPDq\Q17 8n&S|9azĪri65&dژ;{3[~Rb%j]SVMݼ㑏9,Qpi 6-p15(㴇$ɏ~TUmh;Fz)7EFn20\O,b͹⍈䖬Jq[g`= s}AFu_4 }~ٞE߶r/}_۪~66L+nQsM7t4G|?Lۯ^s=CN39LBh.QFѽjZasg^(v3rק  co 6d[!]_0tعP a65Gk\RQ]%PzlrRą<7?xE^ڏriƮ{>j.00 +70# +7*RdĚhttp://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0  *H  U}*,g1$[rKo\>NGdx=139q6?dl|u9m1lѡ"fg:SMݘx6.Vi {jo)n?Hum m#TxSu$Wݟ=heV(U'$@]='@8)üTB  jBRu6as.,k{n?, x鑲[It 쑀=J>f;O2ٖtLrou04zP X@1Q{p( 6ںL 4$5g+ 挙"'B=%tt[jў>~13}{8pDѐȫ::bpcSMmqjU3XpfM050Ѥ01 0 UUS10U Washington10URedmond10U Microsoft Corporation1%0#U Microsoft America Operations1'0%U nShield TSS ESN:A400-05E0-D9471%0#UMicrosoft Time-Stamp Service# 0+u49'HR0~0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100  *H  0"20260622113323Z20260623113323Z0t0: +Y 1,0*0 0 0M0 06 +Y 1(0&0  +Y  0 00  *H  "aҥBh'D$g]7e^tabB$af^#&f[j Aky?Q>0 X%\ g'Ak%ЄAs1A=,%oXYq+"r piDiDG"H*,PSgAXLrbKD,|ΧB6' %[$3$$Հ޵ mցoq: .g%Q1 0 00|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103(@(0  `HeJ0 *H  1  *H  0/ *H  1" \-^3#Lя烗R9Dӱ̵0 *H  /1000 UFQ`c_d^OGqWUm"00~0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103(@(0" AwKe+ P̐ |ޕv0  *H  /Lh߄%h[IK4Z:;e5U$=rk:~j'Ƒ! |1{ _!2SOCx65rʳŏxJCG68mnl|0rxjq'ĝ۸-jL" ߨ/Vdx'a^b+ TٯjBk]]~2=hjK#Zm{p|#* \罻bGT$V_éⲎt?+I9Oldp ʔYNrZ{RKj]l^lF0%x>(S@=^+^4e ]p9S X**1}|Bq_5Mld^?aMXqވB"g!)>VHUb$YL OTPN<Fx P.ЌwYM_\U;s C]tJ7[hQ9̕$ QO#sI#?̅N8NZET"