403Webshell
Server IP : 209.209.40.120  /  Your IP : 216.73.217.112
Web Server : Microsoft-IIS/10.0
System : Windows NT NEWWWW 10.0 build 17763 (Windows Server 2019) i586
User : NEWWWW$ ( 0)
PHP Version : 8.3.30
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : OFF  |  Perl : OFF  |  Python : OFF  |  Sudo : OFF  |  Pkexec : OFF
Directory :  /ProgramData/Microsoft/Windows Defender/Platform/4.18.26050.15-0/ru-RU/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /ProgramData/Microsoft/Windows Defender/Platform/4.18.26050.15-0/ru-RU/ProtectionManagement.dll.mui
MZ����@���	�!�L�!This program cannot be run in DOS mode.

$=;=�yZS�yZS�yZS��Ӭ�xZS���Q�xZS�RichyZS�PEd���f{�" ,���` ����%8.rdata�@@.rsrc� �@@��f{
lPP��f{$����8.rdata8.rdata$voltmdP�.rdata$zzzdbg �.rsrc$01�&P�.rsrc$02 ��Rb��"b��oͩ+Z,���(?����f{��0�H�H�`�x������������ �8�	P�
h�����
���������(�@�X�p������������� 0�!H�`�x�������� 0@P`p�������� 0@P`p���&��`'�h*�l-�	�@7��=���D���Jf�DM���N��P��\R��V���X��<[���_���fl�,m���{:�4��
��x
�h���T�B���x
��l
�|���,�f�����0�N���(����������T�MUI���|n����]�š�V�Y���v��NmuB�}���MUIru-RU9-B> 01AB@0:B=K9 :;0AA, :>B>@K9 ?>:07K205B 107>2K9 AB0BCA. :><?LNB5@0, A>740==K9 MAPS"5:CI55 A>AB>O=85 :><?LNB5@0
CleanStatePendingFullScan
PendingRebootPendingManualStepsPendingOfflineScanCriticalFailure/#:07K205B, B@51C5BAO ;8 ?5@5703@C7:0 CAB@>9AB20#"5:CI55 A>AB>O=85 ?@>4C:B0 DefenderNoStatusServiceNotRunning,ServiceStartedWithoutMalwareProtectionEngineEndingManualStepsPAAVSignaturesOutOfDateASSignaturesOutOfDateNoRecentQuickScanNoRecentFullScanSystemInitiatedScanInProgressSystemInitiatedCleanInProgressSamplesPendingSubmissionRunningInEvaluationModeRunningInNonGenuineWindowsModeProductExpiredOfflineScanRequired$ServiceShuttingDownForSystemShutdownRemediationFailedCriticallyRemediationFailedNonCriticallyNoStatusFlagsSetPlatformOutOfDatePlatformUpdateInProgressPlatformAlmostOutdated+SignatureOrPlatformEndOfLifePastOrImpending-WindowsSModeSignaturesInUseOnNonWin10SInstall: 568< @01>BK 0I8B=8:0 (>1KG=K9, ?0AA82=K9, ?0AA82=K9 SxS)H5@A8O ?@>4C:B0 (>A=>2=>9 =><5@, 4>?>;=8B5;L=K9 =><5@, A1>@:0, @540:F8O)F5@A8O A;C61K (>A=>2=>9 =><5@, 4>?>;=8B5;L=K9 =><5@, A1>@:0, @540:F8O)NA;8 ?>4?8A8 02B>=><=>3> Defender 8 0=B828@CA=>9 ?@>3@0<<K 2 Defender CAB0@5;8V5@A8O 0=B8H?8>=A:8E A83=0BC@ (>A=>2=>9 =><5@, 4>?>;=8B5;L=K9 =><5@, A1>@:0, @540:F8O)h>7@0AB 0=B8H?8>=A:8E A83=0BC@ (2 4=OE): 5A;8 A83=0BC@K =8:>340 =5 >1=>2;O;8AL, 2K2>48BAO 7=0G5=85 65535�>A;54=55 >1=>2;5=85 0=B8H?8>=A:8E A83=0BC@ (<5AB=>5 2@5<O): 5A;8 A83=0BC@K =8:>340 =5 >1=>2;O;8AL, 4;O MB>3> A2>9AB20 C:07K205BAO 7=0G5=85 0U5@A8O 0=B828@CA=KE A83=0BC@ (>A=>2=>9 =><5@, 4>?>;=8B5;L=K9 =><5@, A1>@:0, @540:F8O)g>7@0AB 0=B828@CA=KE A83=0BC@ (2 4=OE): 5A;8 A83=0BC@K =8:>340 =5 >1=>2;O;8AL, 2K2>48BAO 7=0G5=85 65535�>A;54=55 >1=>2;5=85 0=B828@CA=KE A83=0BC@ (<5AB=>5 2@5<O): 5A;8 A83=0BC@K =8:>340 =5 >1=>2;O;8AL, 4;O MB>3> A2>9AB20 C:07K205BAO 7=0G5=85 0L5@A8O A83=0BC@ NRI (>A=>2=>9 =><5@, 4>?>;=8B5;L=K9 =><5@, A1>@:0, @540:F8O)^>7@0AB A83=0BC@ NRI (2 4=OE): 5A;8 A83=0BC@K =8:>340 =5 >1=>2;O;8AL, 2K2>48BAO 7=0G5=85 65535PA�>A;54=55 >1=>2;5=85 A83=0BC@ NRI (<5AB=>5 2@5<O): 5A;8 A83=0BC@K =8:>340 =5 >1=>2;O;8AL, 4;O MB>3> A2>9AB20 C:07K205BAO 7=0G5=85 NULLp@5<O 70?CA:0 ?>A;54=59 ?>;=>9 ?@>25@:8: 5A;8 MB> A2>9AB2> =8:>340 =5 >1=>2;O;>AL, 4;O =53> 2K2>48BAO 7=0G5=85 0s@5<O 7025@H5=8O ?>A;54=59 ?>;=>9 ?@>25@:8: 5A;8 MB> A2>9AB2> =8:>340 =5 >1=>2;O;>AL, 4;O =53> 2K2>48BAO 7=0G5=85 0cLast full scan age in days- if signatures have never been updated you will see an age of 65535 daysLast scan sourceUnknownUser!8AB5<0	Real-timeIOAV;Signature version used for the last full scan of the device>If no full scan has successfully completed in the last 14 days-Indicates if a Defender full scan is required$Real-time scan direction enumerationBothIncomingPA	OutcomingdTime of last Quick Scan start - If this has never updated you will see a null value in this propertybTime of last Quick Scan end - If this has never updated you will see a null value in this propertyeLast quick scan age in days- if signatures have never been updated you will see an age of 65535 days.<Signature version used for the last quick scan of the device?If no quick scan has successfully completed in the last 14 days5The AM Engine version (major, minor, build, revision)If the AM Engine is enabledWSpecifies whether the computer is monitoring file and program activity on your computer)Scan all downloaded files and attachments0Specifies whether behavior monitoring is enabled1Specifies whether Antivirus protection is enabled3Specifies whether Antispyware protection is enabled2Specifies whether the machine is a virtual machine6Specifies whether the machine has tamper protection onkSpecifies the last entity that changed the TamperProtection state e.g., UI, Signatures, Intune, ATP, etc...1Specifies whether real-time protection is enabled2NRI Engine version (major, minor, build, revision)If the NRI Engine is enabled+Indicates the current Device Control state.@Indicates the current Device Control DefaultEnforcement policy. \Timestamp indicating when the last configuration update occured for device control policies.Troubleshooting (TS) mode state-Troubleshooting (TS) current state start time+Troubleshooting (TS) current state end time.Troubleshooting (TS) remaining time in minutes/Troubleshooting (TS) remaining quota in minutes%Troubleshooting (TS) quota reset time-Troubleshooting (TS) maximum quota in minutes Troubleshooting (TS) mode source)Smart App Control (SAC) mode: On/Eval/Off1Smart App Control (SAC) eval mode expiration time Defender initialization progress>Indicates the state of Controlled Configuration on this device5@A8O AE5<K#=8:0;L=K9  >1=0@C65=8O
<O C3@>7K(45=B8D8:0B>@ A5@L57=>AB8   ?5@5G8A;5=8587:89#<5@5==>KA>:89@8B8G5A:89 :0B53>@88   ?5@5G8A;5=85INVALIDADWARESPYWAREPASSWORDSTEALERTROJANDOWNLOADERPAWORMBACKDOORREMOTEACCESSTROJANTROJANEMAILFLOODER	KEYLOGGERDIALERMONITORINGSOFTWAREBROWSERMODIFIERCOOKIE
BROWSERPLUGIN
AOLEXPLOITNUKERSECURITYDISABLERJOKEPROGRAMHOSTILEACTIVEXCONTROLSOFTWAREBUNDLERSTEALTHNOTIFIERSETTINGSMODIFIERTOOLBARREMOTECONTROLSOFTWARE	TROJANFTPPOTENTIALUNWANTEDSOFTWARE
ICQEXPLOITTROJANTELNETFILESHARINGPROGRAMMALWARE_CREATION_TOOLREMOTE_CONTROL_SOFTWARETOOLTROJAN_DENIALOFSERVICETROJAN_DROPPERTROJAN_MASSMAILERPATROJAN_MONITORINGSOFTWARETROJAN_PROXYSERVERVIRUSKNOWNUNKNOWNSPPBEHAVIOR
VULNERABILTIYPOLICYType ID - Enumeration	Known BadBehavior
Known GoodNRI!2>4=>5 A>AB>O=85 C3@>7KThreatCleanRebootRequiredManualStepsRequiredFullScanRequiredReinfectionLoopExecuted(List of resources affected by the threat Specifies if threat has executed!Specifies if the threat is activeVThis is a singleton that represents the Microsoft Antimalware service infection status7This class represents the catalog of recognized threatsUnique Threat ID<O A2O70==>3> ?@>F5AA0%>;L7>20B5;L, 70?@>A82H89 8A?@02;5=85, B8?0 8AB>G=8:0 >1=0@C65=8O   ?5@5G8A;5=85ELAMLocalAttestationRemoteAttestation/!?8A>: @5AC@A>2, 2E>4OI8E 2 >1;0ABL >1=0@C65=8O(@5<O ?5@2>=0G0;L=>3> >1=0@C65=8O C3@>7K+@5<O ?>A;54=53> 87<5=5=8O A>AB>O=8O C3@>7K@5<O 8A?@02;5=8O.& A>AB>O=8O 2K?>;=5=8O   ?5@5G8A;5=85
01;>:8@>20=>	 07@5H5=>
K?>;=5=85NotExecuting" A>AB>O=8O C3@>7K   ?5@5G8A;5=85
1=0@C65=>G8I5=>0@0=B8=#40;5=>CleanFailedQuarantineFailedRemoveFailedAllowFailedB:070=>
BlockedFailed>4 >H81:8 A>AB>O=8O C3@>7K"59AB285 ?> >G8AB:5   ?5@5G8A;5=85G8AB8BL><5I5=> 2 :0@0=B8=#40;8BL	 07@5H8BLUserDefinedNoAction;>:8@>20BL.#:07K205B, CA?5H=> ;8 1K;0 ?@>872545=0 >G8AB:0B5>1E>48<K5 4;O 8A?@02;5=8O 4>?>;=8B5;L=K5 459AB28O   ?5@5G8A;5=855BFullScanAndRebootRequiredFullScanAndManualStepsRequiredRebootAndManualStepsRequired'FullScanAndRebootAndManualStepsRequiredFullScanAndOfflineScanRequiredRebootAndOfflineScanRequired'FullScanAndRebootAndOfflineScanRequired!ManualStepsAndOfflineScanRequired,FullScanAndManualStepsAndOfflineScanRequired*RebootAndManualStepsAndOfflineScanRequired5FullScanAndRebootAndManualStepsAndOfflineScanRequired4-B> :;0AA, ?@54AB02;ONI89 ?>4@>1=>5 A>AB>O=85 C3@>7K1.0O;0AA A:0=8@>20=8O A 8A?>;L7>20=85< 0=B828@CA=>9 ?@>3@0<<K 2 Microsoft Defender:;0AA A83=0BC@ 0=B828@CA=>9 ?@>3@0<<K 2 Microsoft DefenderB;0AA A:0=8@>20=8O WDO 0=B828@CA=>9 ?@>3@0<<K 2 Microsoft Defender@;0AA ?0:5B>2 ?C;LA0 0=B828@CA=>9 ?@>3@0<<K 2 Microsoft DefenderZ>72>;O5B 04<8=8AB@0B>@C >?@545;8BL, =C6=> ;8 >B:;NG8BL DC=:F8N 02B><0B8G5A:8E 8A:;NG5=89.J>72>;O5B 04<8=8AB@0B>@C O2=K< >1@07>< >B:;NG8BL ?@>25@:C C:070==KE ?CB59.O>72>;O5B 04<8=8AB@0B>@C O2=K< >1@07>< >B:;NG8BL ?@>25@:C C:070==KE @0AH8@5=89.N>72>;O5B 04<8=8AB@0B>@C O2=K< >1@07>< >B:;NG8BL ?@>25@:C C:070==KE ?@>F5AA>2.u>72>;O5B 04<8=8AB@0B>@C O2=K< >1@07>< >B:;NG8BL ?@>25@:C wdnisdrv A5B52KE ?0:5B>2 =0 >?@545;5==>< =01>@5 IP-04@5A>2.P#:07K205B, A:>;L:> 4=59 M;5<5=BK 4>;6=K E@0=8BLAO 2 ?0?:5 :0@0=B8=0 4> C40;5=8O.60?@02;5=85 ?@>25@:8 2 @50;L=>< 2@5<5=8   ?5@5G8A;5=85h#:07K205B, 2 :0:>9 45=L =545;8 4>;6=0 ?@>2>48BLAO 70?;0=8@>20==0O ?>;=0O ?@>25@:0 4;O F5;59 8A?@02;5=8O.	654=52=>>A:@5A5=L5>=545;L=8:B>@=8:!@540'5B25@3OB=8F0!C11>B08:>340OIndicates what time to perform the scheduled full scan to complete remediation.9Configure the state of Remote Encryption Protection(REP).5 =0AB@>5=>C48BB:;.rTime in minutes for which Remote Encryption Protection(REP) will block threats. 0 results in no limit enforcement.XIndicates how aggressively Remote Encryption Protection(REP) will block detected threat.MediumTSpecify the IP address and subnet exclusions from Remote Encryption Protection(REP).>0AB@>9B5 A>AB>O=85 ?@54>B2@0I5=8O 0B0: <5B>4>< ?>41>@0 (BFP).lTime in minutes for which Brute Force Prevention(BFP) will block threats. 0 results in no limit enforcement.RIndicates how aggressively Brute Force Prevention(BFP) will block detected threat.S#:068B5 IP-04@5A 8 8A:;NG5=8O ?>4A5B8 87 ?@54>B2@0I5=8O 0B0: <5B>4>< ?>41>@0 (BFP).`Brute Force Prevention(BFP) Plugin - extend Brute Force coverage to block IPs on local networks.�Brute Force Prevention(BFP) Plugin - disables Brute Force Protection's initial 2 week learning period and starts blocking threats immediately.=Configure timeout for detections requiring additional action.zTime in minutes for a detection in the 'critically failed' state to move to either 'additional action' or 'cleared' state.UTime in minutes for a detection in the 'failed' state to move to the 'cleared' state.OSpecifies the interval that will be used for service health report, in minutes.fSpecify whether to report a Dynamic Signature dropped event. By default, such events are not reported.OSpecify the maximum percentage of CPU utilization during a scan. This policy setting allows you to configure the maximum percentage CPU utilization permitted during a scan. Valid values for this setting are a percentage represented by the integers 5 to 100. A value of 0 indicates that there should be no throttling of CPU utilization.
When set, Microsoft Defender Antivirus will check for new signatures before running a scan.  If new signatures are found they will be downloaded and installed before the scan begins.  If no new signatures are found, the scan will start based on the existing signatures.CTurn on removal of items from scan history folder. This setting defines the number of days items should be kept in the scan history folder before being permanently removed. The value represents the number of days to keep items in the folder. If set to zero, items will be kept forever and will not be automatically removed.?K?>;=5=85 70?;0=8@>20==KE ?@>25@>: B>;L:> ?@8 ?@>AB>5 A8AB5<K.'#:070=85 B8?0 70?;0=8@>20==>9 ?@>25@:8.KAB@0O ?@>25@:0>;=0O ?@>25@:0<#:070=85 4=O =545;8 4;O 2K?>;=5=8O 70?;0=8@>20==>9 ?@>25@:8.G#:070=85 2@5<5=8 ACB>: 4;O 2K?>;=5=8O 70?;0=8@>20==>9 1KAB@>9 ?@>25@:8.?#:070=85 2@5<5=8 ACB>: 4;O 2K?>;=5=8O 70?;0=8@>20==>9 ?@>25@:8.�3@0=8G5=85 =0 8A?>;L7>20=85 & <>65B 1KBL ?@8<5=5=> B>;L:> : 70?;0=8@>20==K< ?@>25@:0< 8;8 70?;0=8@>20==K< 8 ?>;L7>20B5;LA:8< ?@>25@:0<. =0G5=85 ?> C<>;G0=8N >3@0=8G8205B 8A?>;L7>20=85 & B>;L:> 4;O 70?;0=8@>20==KE ?@>25@>:.s@5@K205B >1=>2;5=8O, 70?CI5==K5 A;C61>9, =5<54;5==> ?>A;5 ?5@2>9 CAB0=>2:8 2 B5G5=85 7040==>3> ?@><56CB:0 2@5<5=8.�5@5>?@545;O5B ?0@0<5B@ CheckForSignatureBeforeRunningScan. @5@K205B >1=>2;5=8O, 70?CI5==K5 A;C61>9, 5A;8 A83=0BC@0 1K;0 CA?5H=> >1=>2;5=0 2 B5G5=85 7040==>3> ?@><56CB:0 2@5<5=8. @5<O C:07K205BAO 2 <8=CB0E.�0405B D09;>2K5 @5AC@AK >1I53> 4>ABC?0 4;O A:0G820=8O >1=>2;5=89 A;C61K 0=0;870 157>?0A=>AB8. -B>B ?0@0<5B@ ?>72>;O5B =0AB@>8BL UNC-8AB>G=8:8 D09;>2KE @5AC@A>2 >1I53> 4>ABC?0 4;O A:0G820=8O >1=>2;5=89 A;C61K 0=0;870 157>?0A=>AB8. 1@0I5=85 : 8AB>G=8:0< 1C45B ?@>872>48BLAO 2 C:070==>< ?>@O4:5. =0G5=85 MB>3> ?0@0<5B@0 4>;6=> 1KBL C:070=> 2 D>@<0B5 AB@>:8, A>AB>OI59 87 @0745;5==KE 25@B8:0;L=>9 G5@B>9 8AB>G=8:>2 >1=>2;5=89 A;C61K 0=0;870 157>?0A=>AB8. @8<5@: {\unc1 | \unc2 }. > C<>;G0=8N MB>B A?8A>: ?CAB.�A;8 7040=> 7=0G5=85 "8AB8=0", A;C610 AM =5 1C45B 70?CA:0BL >1=>2;5=85 A;C61K 0=0;870 157>?0A=>AB8 ?@8 703@C7:5 =57028A8<> >B =0;8G8O <>4C;O.�0405B ?>@O4>: 8AB>G=8:>2 4;O A:0G820=8O >1=>2;5=89 0=0;870 157>?0A=>AB8. -B>B ?0@0<5B@ ?>72>;O5B C:070BL ?>@O4>: >1@0I5=8O : @07;8G=K< 8AB>G=8:0< >1=>2;5=89 0=0;870 157>?0A=>AB8. =0G5=85 MB>3> ?0@0<5B@0 4>;6=> 1KBL C:070=> 2 D>@<0B5 AB@>:8, A>AB>OI59 87 @0745;5==KE 25@B8:0;L=>9 G5@B>9 8AB>G=8:>2 >1=>2;5=89 0=0;870 157>?0A=>AB8 2 ?>@O4:5 >1@0I5=8O : =8<. >7<>6=K5 7=0G5=8O: "InternalDefinitionUpdateServer", "MicrosoftUpdateServer", "MMPC", "FileShares" �#:07K205B 45=L =545;8, 2 :>B>@K9 ?@>8AE>48B >1=>2;5=85 A;C61K 0=0;870 157>?0A=>AB8. @8 CAB0=>2:5 =C;52>3> 7=0G5=8O (0x0) A;C610 0=0;870 157>?0A=>AB8 1C45B >1=>2;OBLAO 5654=52=>.�#:07K205B, 2 :0:>5 2@5<O ?@>25@O5BAO =0;8G85 >1=>2;5=89 A;C61K 0=0;870 157>?0A=>AB8. > C<>;G0=8N A83=0BC@K ?@>25@ONBAO ?5@54 70?;0=8@>20==>9 ?@>25@:>9.�?@545;O5B G8A;> 4=59, ?>A;5 :>B>@>3> <>6=> ?>;CG8BL 4>?>;=8B5;L=CN A83=0BC@C.  01>B05B A ?0@0<5B@>< SignatureUpdateLastChecked. 0 = 157 ?>;CG5=8O 4>?>;=8B5;L=>9 A83=0BC@K; 1 = 1 45=L; 2 = 2 4=O 8 B. 4.�=0G5=85 2@5<5=8 ?@54AB02;5=> :0: G8A;> G0A>2 <564C ?@>25@:0<8 >1=>2;5=89. 80?07>= 4>?CAB8<KE 7=0G5=89: >B 1 (565G0A=>) 4> 24 (5654=52=>).6 0A?>;>65=85 A5B52>9 ?0?:8 BLOB->1J5:B0 A83=0BC@K UNC.Q#:07K205B 8=B5@20; 2 <8=CB0E, :>B>@K9 1C45B 8A?>;L7>20BLAO 4;O ?@>25@:8 A83=0BC@.@8A>548=5=85 : Microsoft MAPS.	B:;NG5=>07>2K9PA
>?>;=8B5;L=>!>3;0A85 =0 >B?@02:C >1@07F0.AlwaysPromptSendSafeSamples	NeverSendSendAllSamples#B:;NG8BL @568< :>=D845=F80;L=>AB8.�-B>B ?0@0<5B@ ?>72>;O5B 2:;NG8BL 8 >B:;NG8BL A;CG09=K9 2K1>@ 2@5<5=8 4;O 70?CA:0 70?;0=8@>20==KE ?@>25@>: 8 >1=>2;5=89 A;C61K 0=0;870 157>?0A=>AB8. = 8A?>;L7C5BAO 4;O @0A?@545;5=8O 2;8O=8O ?@>25@>: =0 @5AC@AK. 0?@8<5@, 53> <>6=> ?@8<5=OBL =0 3>AB52KE 28@BC0;L=KE <0H8=0E, @07<5I5==KE =0 >1I5< E>AB5, GB>1K >=8 >4=>2@5<5==> =5 2K?>;=O;8 459AB28O, B@51CNI85 8=B5=A82=>3> 8A?>;L7>20=8O 48A:>2.�-B>B ?0@0<5B@ ?>72>;O5B =0AB@>8BL A;CG09=>5 @0=4><870F8N ?;0=8@>2I8:0 2 G0A0E. =B5@20; A;CG09=>3> 2K1>@0 - [1 23] G. ;O ?>;CG5=8O 4>?>;=8B5;L=KE A2545=89 >1 MDD5:B5 A;CG09=>3> 2K1>@0 ?@>25@:0 ?0@0<5B@ RandomizeScheduleTaskTimes.B:;NG8BL <>=8B>@8=3 ?>2545=8O.B:;NG8BL 70I8BC IOAV.(B:;NG8BL <>=8B>@8=3 2 @50;L=>< 2@5<5=8.B:;NG8BL ?@>25@:C AF5=0@852.B:;NG8BL ?@>25@:C 0@E82>2.�B:;NG8BL 4>?>;=8B5;L=CN ?>;=CN ?@>25@:C. >?>;=8B5;L=0O ?@>25@:0 2K?>;=O5BAO ?> ?@8G8=5 ?@>?CA:0 70?;0=8@>20==>9 ?@>25@:8. 1KG=> ?@>?CA: 70?;0=8@>20==KE ?@>25@>: A2O70= A B5<, GB> 2 70?;0=8@>20==>5 2@5<O :><?LNB5@ 1K; 2K:;NG5=.�B:;NG8BL 4>?>;=8B5;L=CN 1KAB@CN ?@>25@:C. >?>;=8B5;L=0O ?@>25@:0 2K?>;=O5BAO ?> ?@8G8=5 ?@>?CA:0 70?;0=8@>20==>9 ?@>25@:8. 1KG=> ?@>?CA: 70?;0=8@>20==KE ?@>25@>: A2O70= A B5<, GB> 2 70?;0=8@>20==>5 2@5<O :><?LNB5@ 1K; 2K:;NG5=.PA%B:;NG8BL ?@>25@:C M;5:B@>==>9 ?>GBK.%B:;NG8BL ?@>25@:C AJ5<=KE =>A8B5;59. B:;NG5=85 B>G:8 2>AAB0=>2;5=8O.;B:;NG5=85 ?>;=>9 ?@>25@:8 4;O ?>4:;NG5==KE A5B52KE 48A:>2.�B:;NG05B ?@>25@:C A5B52KE D09;>2. :;NG5=85 ?0@0<5B@0 "ApplyDisableNetworkScanningToIOAV" =5>1E>48<> ?@8 ?@>25@:5 IOAV, GB>1K 30@0=B8@>20BL, GB> ?@>25@:0 A5B52KE D09;>2 B0:65 >B:;NG5=0._#1548B5AL, GB> ?0@0<5B@ "B:;NG8BL ?@>25@:C A5B52KE D09;>2" B0:65 ?@8<5=O5BAO : ?@>25@:0< IOAV.7:;NG8BL @568< 1;>:8@>2:8 ?>;L7>20B5;LA:>3> 8=B5@D59A0.�45=B8D8:0B>@K C3@>7, ?@8 >1=0@C65=88 :>B>@KE =5 4>;6=> 2K?>;=OBLAO 459AB285 ?> C<>;G0=8N. 59AB28O 2 ?0@0<5B@5 ThreatIDDefaultAction_Actions 4>;6=K 1KBL ?5@5G8A;5=K 2 B>< 65 ?>@O4:5, GB> 8 845=B8D8:0B>@K 2 ?0@0<5B@5 ThreatIDDefaultAction_Ids�59AB28O ?> C<>;G0=8N 4;O C3@>7, ?@8 >1=0@C65=88 :>B>@KE =5 4>;6=> 2K?>;=OBLAO 459AB285 ?> C<>;G0=8N. 59AB28O 4>;6=K 1KBL C:070=K 2 B>< 65 ?>@O4:5, GB> 8 A>>B25BAB2CNI85 845=B8D8:0B>@K, ?5@5G8A;5==K5 2 ?0@0<5B@5 ThreatIDDefaultAction_Ids.,59AB285 ?> C<>;G0=8N 4;O =58725AB=KE C3@>7.659AB285 ?> C<>;G0=8N 4;O C3@>7 A =87:>9 A5@L57=>ABLN.959AB285 ?> C<>;G0=8N 4;O C3@>7 A C<5@5==>9 A5@L57=>ABLN.759AB285 ?> C<>;G0=8N 4;O C3@>7 A 2KA>:>9 A5@L57=>ABLN.=59AB285 ?> C<>;G0=8N 4;O C3@>7 A >G5=L 2KA>:>9 A5@L57=>ABLN.?#:068B5 @568< 70I8BK >B ?>B5=F80;L=> =565;0B5;L=>3> ?@8;>65=8O.:;NG5=>	AuditMode*B:;NG8BL 1;>:8@>2:C ?@8 ?5@2>< ?>O2;5=88."0AB@>8BL C@>25=L 70I8BK 2 >1;0:5.> C<>;G0=8NKA>:>5+C;52>9 4>?CA:J0AB@>9:0 @0AH8@5==>9 ?@>25@:8 2 >1;0:5. >?CAB8<K5 7=0G5=8O: 0 50 A5:C=4.A0AB@>9:0 DC=:F88 70I8BK A5B8 Exploit Guard 2 Microsoft Defender. 568< 0C48B060AB@>9:0 :><?>=5=B0 ">=B@>;8@C5<K9 4>ABC? : D09;0<".BlockDiskModificationOnlyAuditDiskModificationOnly@#:070BL 8A:;NG5=8O 4;O ?@028; A>:@0I5=8O =0?@02;5=89 0B0: (ASR).�#:068B5 845=B8D8:0B>@K ?@028;0 A>:@0I5=8O =0?@02;5=89 0B0:. 45=B8D8:0B>@K ?@028;0 4>;6=K 1KBL C:070=K 2 B>< 65 ?>@O4:5, GB> 8 A>>B25BAB2CNI85 459AB28O, C:070==K5 2 A2>9AB25 AttackSurfaceReductionRules_Actions.�59AB28O ?> C<>;G0=8N 4;O ?@028;0 A>:@0I5=8O =0?@02;5=89 0B0:. 59AB28O 4>;6=K 1KBL C:070=K 2 B>< 65 ?>@O4:5, GB> 8 A>>B25BAB2CNI85 845=B8D8:0B>@K ?@028;0, C:070==K5 2 A2>9AB25 AttackSurfaceReductionRules_Ids.5 =0AB@>5=>PA
@54C?@5640BLM>1028BL @07@5H5==K5 ?@8;>65=8O 2 :><?>=5=B ">=B@>;8@C5<K9 4>ABC? : D09;0<".G>1028BL 70I8I5==K5 ?0?:8 2 :><?>=5=B ">=B@>;8@C5<K9 4>ABC? : D09;0<".D!?8A>: ?0?>:, 70I8I5==KE C?@02;O5<K< 4>ABC?>< : ?0?:0< ?> C<>;G0=8N._?@545;O5B D09;>2K9 @5AC@A >1I53> 4>ABC?0 4;O <5E0=87<0 >1=0@C65=8O C3@>7 2 28@BC0;L=KE A@540E.rA;8 =0AB@>5=> 2<5AB5 A SharedSignaturesPath, 2K <>65B5 2:;NG0BL >1=>2;5=8O B>;L:> 2 A>>B25BAB288 A ?;0=8@>2I8:><.W#:068B5, A;54C5B ;8 8A?>;L7>20BL =87:89 ?@8>@8B5B & 2> 2@5<O 70?;0=8@>20==>9 ?@>25@:8.5:;NG05B 8;8 >B:;NG05B DC=:F8N 2KG8A;5=8O EMH0 D09;0.q>72>;O5B 0=B828@CA=>9 ?@>3@0<<5 2 Microsoft Defender >1=>2;OBLAO 8 2708<>459AB2>20BL G5@57 ;8<8B=>5 ?>4:;NG5=85.�-B>B ?0@0<5B@ >?@545;O5B, @07@5H5=0 ;8 =0AB@>9:0 70I8BK A5B8 2 @568<5 1;>:8@>2:8 8;8 0C48B0 2 Windows Server. A;8 CAB0=>2;5=> 7=0G5=85 false, 7=0G5=85 EnableNetworkProtection 1C45B 83=>@8@>20BLAO.>-B>B ?0@0<5B@ C?@02;O5B >1@01>B:>9 40B03@0<<K 4;O 70I8BK A5B8.�0I8B0 A5B8 ?@>25@O5B A5B52>9 B@0D8: 8 >?@545;O5B =C6=>5 459AB285: @07@5H8BL 8;8 1;>:8@>20BL B@0D8: ;81> 2K25AB8 ?@54C?@5645=85. -B>B ?0@0<5B@ >?@545;O5B, 1;>:8@C5B ;8 70I8B0 A5B8 A5B52>9 B@0D8: 2<5AB> >B>1@065=8O ?@54C?@5645=8O.�A;8 MB>B ?0@0<5B@ 2:;NG5=, 70?;0=8@>20==K5 ?@>25@:8, 2K?>;=O5<K5 ?@8 ?@>AB>5 A8AB5<K, =5 1C4CB >3@0=8G820BL @01>BC &. =0G5=85 ?> C<>;G0=8N   1, A;54>20B5;L=>, @53C;8@>20=85 ?>-?@56=5<C 1C45B >B:;NG5=> 4;O ?@>25@>: 2 @568<5 ?@>AB>O.�A;8 CAB0=>2;5=> 7=0G5=85 TRUE, 70?;0=8@>20==0O ?>;=0O ?@>25@:0 2K?>;=O5BAO, 5A;8 A8AB5<0 @01>B05B >B 10B0@58. =0G5=85 ?> C<>;G0=8N   FALSE, B. 5. ?> C<>;G0=8N ?>;=0O ?@>25@:0 >B<5=O5BAO, 5A;8 A8AB5<0 @01>B05B >B 10B0@58.�A?>;L7C5BAO 4;O C:070=8O D09;0 02B><0B8G5A:>9 =0AB@>9:8 ?@>:A8-A5@25@0 (PAC), :>B>@K9 =C6=> 8A?>;L7>20BL. ProxyServer 8<55B ?@8>@8B5B.�A?>;L7C5BAO 4;O C:070=8O 8<5=>20==>3> ?@>:A8-A5@25@0, :>B>@K9 A;54C5B 8A?>;L7>20BL ?@8 ?>?KB:5 :;85=B0 ?>4:;NG8BLAO : A5B8 (4;O >1=>2;5=8O A83=0BC@ 8 >BG5B>2 SpyNet).PA)!?8A>: 04@5A>2 4;O >1E>40 ?@>:A8-A5@25@0.�A;8 04<8=8AB@0B>@K E>BOB ?@8=C48B5;L=> CAB0=>28BL 2A5 A>548=5=8O G5@57 ?@>:A8-A5@25@ 8 =5 @07@5H0BL ?@O<>5 ?>4:;NG5=85. :;NG05B B>;L:> ProxyServer 8 ProxyPacUrl. 5 2:;NG05B IESettings 8 >1=0@C65=85 AutoProxy.3-B>B ?0@0<5B@ >B:;NG05B 0=0;87 TLS 4;O 0I8BK A5B8.4-B>B ?0@0<5B@ >B:;NG05B 0=0;87 HTTP 4;O 0I8BK A5B8.3-B>B ?0@0<5B@ >B:;NG05B 0=0;87 DNS 4;O 0I8BK A5B8.7-B>B ?0@0<5B@ >B:;NG05B 0=0;87 DNS TCP 4;O 0I8BK A5B8.3-B>B ?0@0<5B@ >B:;NG05B 0=0;87 SSH 4;O 0I8BK A5B8.� 07@5H8BL 04<8=8AB@0B>@0< =0AB@0820BL CAB@>9AB2> 4;O ?>;CG5=8O >1=>2;5=89 ?;0BD>@<K Microsoft Defender ?> >?@545;5==><C :0=0;C (:>;LFC)   ?>72>;O5B :;85=B0< :>=B@>;8@>20BL ?@>F5AA ?>AB5?5==>3> 2K?CA:0.5B0-25@A8O@5420@8B5;L=0O 25@A8O
@><56CB>G=K9(8@>:89B;>65=>� 07@5H8BL 04<8=8AB@0B>@0< =0AB@0820BL CAB@>9AB2> 4;O ?>;CG5=8O >1=>2;5=89 <>4C;O Microsoft Defender ?> >?@545;5==><C :0=0;C (:>;LFC)   ?>72>;O5B :;85=B0< :>=B@>;8@>20BL ?@>F5AA ?>AB5?5==>3> 2K?CA:0.� 07@5H8BL 04<8=8AB@0B>@0< =0AB@0820BL CAB@>9AB2> 4;O ?>;CG5=8O >1=>2;5=89 <5E0=87<0 >1=0@C65=8O C3@>7 Microsoft Defender ?> >?@545;5==><C :0=0;C (:>;LFC)   ?>72>;O5B :;85=B0< :>=B@>;8@>20BL ?@>F5AA ?>AB5?5==>3> 2K?CA:0.� 07@5H8BL 04<8=8AB@0B>@0< >B:070BLAO >B ?@>F5AA0 ?>AB5?5==>3> 2K?CA:0 >1=>2;5=89 ?>4A8AB5<K, ?;0BD>@<K 8 <5E0=87<0 >1=0@C65=8O C3@>7.�-B>B ?0@0<5B@ >?@545;O5B, @07@5H5=0 ;8 =0AB@>9:0 70I8BK A5B8 2 @568<5 1;>:8@>2:8 8;8 0C48B0 2 ?@56=59 25@A88 Windows RS3. A;8 CAB0=>2;5=> 7=0G5=85 false, 7=0G5=85 EnableNetworkProtection 1C45B 83=>@8@>20BLAO.�-B>B ?0@0<5B@ >?@545;O5B, @07@5H5=> ;8 70I8B5 A5B8 2:;NG0BL >1@01>B:C 40B03@0<< 2 Windows Server. A;8 CAB0=>2;5=> 7=0G5=85 false, 7=0G5=85 DisableDatagramProcessing 1C45B 83=>@8@>20BLAO, 8 ?@>25@:0 40B03@0<< ?> C<>;G0=8N 1C45B >B:;NG5=0.�-B>B ?0@0<5B@ 2:;NG05B DC=:F8N DNS Sinkhole 4;O 0I8BK A5B8, CG8BK20O 7=0G5=85 EnableNetworkProtection 4;O 1;>:8@>2:8 8 0C48B0, => =5 2K?>;=O5B =8:0:8E 459AB289 2 @568<5 ?@>25@:8.H-B>B ?0@0<5B@ >B:;NG05B D8;LB@0F8N 2E>4OI8E ?>4:;NG5=89 4;O 0I8BK A5B8.3-B>B ?0@0<5B@ >B:;NG05B 0=0;87 RDP 4;O 0I8BK A5B8.\-B>B ?0@0<5B@ >B:;NG05B A1>@ 8 >B?@02:C B5;5<5B@88 ?@>872>48B5;L=>AB8 87 A;C61K 70I8BK A5B8.B-B>B ?0@0<5B@ =0AB@08205B CA8;5=85 70I8BK A ?><>ILN <5B>: 4>25@8O.�#?@02;O9B5 >B>1@065=85< 8A:;NG5=89 4;O >1KG=KE ;>:0;L=KE ?>;L7>20B5;59 =0 CAB@>9AB25. A?>;L7C9B5 ?0@0<5B@ ?>;8B8:8 HideExclusionsFromLocalAdmins, GB>1K A:@KBL 8A:;NG5=8O 4;O >1KG=KE 8 04<8=8AB@0B82=KE ;>:0;L=KE ?>;L7>20B5;59.3-B>B ?0@0<5B@ >B:;NG05B 0=0;87 FTP 4;O 0I8BK A5B8.�-B>B ?0@0<5B@ 2:;NG05B >?B8<870F8N ?@>872>48B5;L=>AB8, GB> ?>72>;O5B A8=E@>==> ?@>25@O5<K< A5B52K< ?>B>:0< ?5@5:;NG8BLAO =0 0A8=E@>==CN ?@>25@:C.M#:068B5 :>;8G5AB2> <8=CB ?>A;5 ?>;C=>G8 4;O 70?CA:0 70?;0=8@>20==>9 ?@>25@:8.T-B>B ?0@0<5B@ >B:;NG05B 70I8BC >B ?>445;:8, 5A;8 2:;NG5= @568< CAB@0=5=8O =5?>;04>:.4-B>B ?0@0<5B@ >B:;NG05B 0=0;87 SMTP 4;O 0I8BK A5B8.4-B>B ?0@0<5B@ >B:;NG05B 0=0;87 QUIC 4;O 0I8BK A5B8.2-B> CAB0=02;8205B @568< @5?CB0F88 4;O 0I8BK A5B8.: #: MB>B ?0@0<5B@ >B:;NG05B TDT 2 ?>4A8AB5<5.�#:068B5 845=B8D8:0B>@ 8A:;NG5=89 ?@028;0 A>:@0I5=8O =0?@02;5=89 0B0: (ASR). 5>1E>48<> 7040BL 8;8 4>1028BL 845=B8D8:0B>@ ?@028;0 A A>>B25BAB2CNI8<8 8A:;NG5=8O<8, C:070==K<8 2 A2>9AB25 AttackSurfaceReductionRules_RuleSpecificExclusions.�#:068B5 8A:;NG5=8O, >B=>AOI85AO : ?@028;C A>:@0I5=8O =0?@02;5=89 0B0: (ASR). 5>1E>48<> 7040BL 8;8 4>1028BL 8A:;NG5=8O, >B=>AOI85AO : ?@028;C, A A>>B25BAB2CNI8< 845=B8D8:0B>@><, C:070==K< 2 A2>9AB25 AttackSurfaceReductionRules_RuleSpecificExclusions_Id.Y:;NG8BL 70I8BC 2 @50;L=>< 2@5<5=8 8 >1=>2;5=8O A83=0BC@ ?@8 ?5@2>< 2:;NG5=88 :><?LNB5@0.�-B>B ?0@0<5B@ ?>72>;O5B "-04<8=8AB@0B>@0< =0AB@0820BL 2:;NG5=85 8;8 >B:;NG5=85 @568<0 ?@>872>48B5;L=>AB8 4;O C?@02;O5<KE CAB@>9AB2.rB:;NG0BL 7040GC >1A;C6820=8O :MH0 >B D0:B8G5A:>3> >1=>2;5=8O :MH0. <5AB> MB>3> >= 1C45B 2>72@0I0BLAO =5<54;5==>.A@>25@OBL 8A:;NG5==K5 D09;K 8 :0B0;>38 2> 2@5<O 1KAB@KE ?@>25@>:.ScanRtpExclusions6#40;8BL 25@E=89 ?@545; :>;8G5AB20 ?>B>:>2 A:0=8@>20=8OuA;8 MB>B ?0@0<5B@ 2:;NG5=, >A=>2=0O A;C610 ?5@5AB0=5B 8A?>;L7>20BL !;C61C @0AH8@5==>9 :>=D83C@0F88 (ECS) 4;O 1KAB@>3> ?@54>AB02;5=8O :@8B8G5A:8 206=KE, 7028AOI8E >B >@30=870F88 8A?@02;5=89 4;O 0=B828@CA=>9 ?@>3@0<<K 2 Microsoft Defender 8 4@C3>3> ?@>3@0<<=>3> >15A?5G5=8O Defender. A?@02;5=8O 1C4CB ?>-?@56=5<C ?@54>AB02;OBLAO A ?><>ILN >1=>2;5=89 0=0;8B8:8 157>?0A=>AB8.{A;8 MB0 DC=:F8O 2:;NG5=0, >A=>2=0O A;C610 ?5@5AB0=5B 8A?>;L7>20BL ?;0BD>@<C OneDsCollector 4;O A1>@0 40==KE B5;5<5B@88 87 0=B828@CA=>9 ?@>3@0<<K 2 Microsoft Defender 8 4@C3>3> ?@>3@0<<=>3> >15A?5G5=8O Defender. :;NG5=85 MB>3> ?0@0<5B@0 <>65B ?>2;8OBL =0 A?>A>1=>ABL 09:@>A>DB 1KAB@> @0A?>7=020BL 8 CAB@0=OBL ?@>1;5<K, B0:85 :0: =87:0O ?@>872>48B5;L=>ABL 8 ;>6=K5 A@010BK20=8O.2:;NG8BL @073@C7:C A53<5=B0F88 UDP 4;O 70I8BK A5B8-:;NG8BL @073@C7:C ?@85<0 UDP 4;O 70I8BK A5B8bMHc3O:U * �.!8c  O��7�g/��. 0=�]4J:�, 1=���2@� (U9 48� 2@�7), 2=��VB (a
0� 0H <�! ��!�).����.! gR �Y.!� �� [�sW7U ��3 ����BO+� _��mY�c� �KB�>@�#T��T k��gQ[ b=�_ ]�Bg�D# �B@O�a �>� B� T�-H� e'� �W��U �? I=/�R ����YH� a��mY+B� ��eQ@!�!�
� o����� aQiS�TU ]%��@� L A>���Ac�. �=T ��@_ �� g'/] acc��# a'��B L� �B37 4_ � ���7-_���S�e� [eSV9! �D�mW��WF e=� [�AoY�cC -IBQ>B�9 m���c5 [�iS�a /� QO�.!W.  �[_-L!� ��>�5[ ��: '?eT3D4@.!��;�e�MD���gT^�O�M3'  '+AUOUQ��l�����\.!U�MY'  '�'  '� V>�%�S�[' �,?��	�cTU cR� ��� �� B% �� �K u%�	' ]�U�B� � �<B-T�Q ����c.!U O
F�. �� U5c c� |W> e'�? _A�WV�w ��g�<:-���� i��0�Q >�
�3U ��:�.�5�-��] g=� ��m2TY �� C_ ��g�3 IR�
R � 	���=-F� _)F�e�S� �U I��3� BM�. t�S:] I��% Z�!9�cqOQr���g5��]�
':M�. 0 = I� 	��	%-o@,  1 = 1 ��w,  2 = 2 w_, c
.PAV[0L< �WV���� m��M.$�a0J@� �FBU�a��� �WQ�T8g+�F ]�[e�m.� o[M3 �����Sm�B��D �[ [M�=� L� ��0kBg Jw B'�[ m:B. *� -� �S� �[ _��+���, �'5 ��i!B A�����m�g/>I �U ��c ]��=B �Y�m B[� �]�Y.^\@���� Y�@�Yc�� w?�<�� �#��emS 3�@@Q ���e QY 8�B. *^ ���@g, �C�� 3�@�Y� ]�A[ .!��IB.�IcY�Ba � ���c �YMg��B�>�.:�TA��C e= 6�B�a��F[ ��Y ��g��8 `mY��A T�oB/�� V�BU.O����_ � ��!T [[�YT ��� a������� ��e�B@�#M 
 _@���a V  �+YB��B �;�+3��< c_..��S�U��e ��QI5U IBV�)3�] �Y�Y��[ � <�[_
�g�!�WC Q� J��-���c+�8.Z�?ee�>e�����g�MF_"'��B^B��5��e+�)��e���]�# �iO^e���������BW>�[�m@��3ZB�eJ�c��W
�e/Q�]T���>� Z4K E�e���	�c���].
3�1Y�A�FYS�
`A�K�m@Bg7PA����>� b[O�� C�e)������?_.s�[]��@��m��W��+�;���� �We��B� 0WB�U�!7B��@5 ^)#��B�YQ J����W��g��;U.ZWD0ekS�a��e���� �e�+@� !�<�qeTW ��e������+OIa.`� a�sB���cOm@��.!�g[!'��#��Zg�B/�
>�S��)�g� 4? ��mM c% )0 �T�c �[ �97YeM����+c)� �< �e�. �B �=Q <�mQIe, B% �K@^ �]� VU �R� �RT ��#��C�U�Y+m�;��e �] q�< eM �'W�BZ�����g��/�0e���Ue[�? g[�U ��<k� �W!< 	1�e�9 e= f=Y�4B0�3VAU�U1�B 5� ��3 "Ke���U�] ��79e .��+��e�>? 
<�UU%�;-q� ����B���MU ( ���) �� gR.! �o:�.�� �O]U c� 2@��.d^�5 �� g=� L<�:�� 0�e-M?.+��7�c��; �� g%� Ok>.!. ($�B��;, �K
�m��)PA% Y1�M	�! 1� B%M 3�@5. (d , h��, �HC)X��� �� !O	�B �MWc].��87 �� O7m�B @�Ye[.1\B�W� ��m �� B%� W_<�, �R8 V� �4] ��S[B �YT�g5)� B�<7 �� �=Q ��>�, �%�� �g �)B: �6@VY�3j;+q�7 ���H���/QY ( l�) �� e[.! 3�:M g� LT 37mQ��.:����1a��c ����Y �%5�W���B ��g�>U7 �:O:WK T�:5] 
:�a[PA%1!s! ?@>25@O5B 20H5 CAB@>9AB2>K-B> <>65B 70=OBL =5:>B>@>5 2@5<O 2 7028A8<>AB8 >B 2K1@0==>3> B8?0 ?@>25@:8.@>25@:0 CA?5H=> 7025@H5=0.)@8 ?@>25@:5 CAB@>9AB20 ?@>87>H;8 >H81:8.0AB@08205<0O ?@>25@:0>;=0O ?@>25@:0KAB@0O ?@>25@:0%1!s! %2!s!11=>2;5=85 >?@545;5=89 28@CA>2 8 ?@>3@0<<-H?8>=>2e%1!s! 02B><0B8G5A:8 >1=>2;O5B >?@545;5=8O 28@CA>2 8 ?@>3@0<<-H?8>=>2, GB>1K 70I8B8BL 20H5 CAB@>9AB2>.9?@545;5=8O 28@CA>2 8 ?@>3@0<<-H?8>=>2 CA?5H=> >1=>2;5=K.G1=>2;5=85 >?@545;5=89 28@CA>2 8 ?@>3@0<<-H?8>=>2 7025@H5=> A >H81:0<8.&?@545;5=8O 28@CA>2 8 ?@>3@0<<-H?8>=>2.5 C40;>AL 2K?>;=8BL >?5@0F8N. H81:0: 0x%1!x!G@8 2K?>;=5=88 =0AB@08205<>3> A:0=8@>20=8O B@51C5BAO ?0@0<5B@ ScanPath.,0 MB>< CAB@>9AB25 C65 2K?>;=O5BAO ?@>25@:0.U0 MB>< CAB@>9AB25 C65 2K?>;=O5BAO >1=>2;5=85 >?@545;5=89 28@CA>2 8 ?@>3@0<<-H?8>=>2.*>B5=F80;L=> >?0A=K5 M;5<5=BK C65 >G8I5=K.G0 CAB@>9AB25 =5 >1=0@C65=> 0:B82=KE M;5<5=B>2, :>B>@K5 <>6=> >G8AB8BL.D@8 ?>?KB:5 >G8AB8BL ?>B5=F80;L=> >?0A=K5 M;5<5=BK ?@>87>H;8 >H81:8.i;O :064>3> ?0@0<5B@0 ThreatIDDefaultAction_Ids =5>1E>48<> 7040BL 7=0G5=85 ThreatIDDefaultAction_Actions.H5 C40;>AL ?>;CG8BL 459AB285 ?> C<>;G0=8N 4;O  C3@>7K. H81:0: 0x%1!x!M5 C40;>AL 2K?>;=8BL >?5@0F8N. H81:0: 0x%1!x!. ?5@0F8O: %2!s!. &5;L: %3!s!.B# 20A =54>AB0B>G=> @07@5H5=89 4;O 2K?>;=5=8O 70?@>H5==>9 >?5@0F88.0@8 ?@>25@:5 WDO =0 CAB@>9AB25 ?@>87>H;8 >H81:8.,0 MB>< CAB@>9AB25 C65 2K?>;=O5BAO ?@>25@:0.PA������@>87>H;0 >H81:0 %1 2 <5B>40E ?>;CG5=8O M:75<?;O@>2 ?>AB02I8:0 WMI %2.%0

�@>87>H;0 >H81:0 %1 2 AB0B8G5A:>< <5B>45 ?>AB02I8:0 WMI %2.%0

�@>87>H;0 >H81:0 %1 2 <5B>45 FireEvent ?>AB02I8:0 WMI %2.%0

x@>87>H;0 >H81:0 %1 ?@8 ?>?KB:5 @538AB@0F88 4;O ?>;CG5=8O C254><;5=89 ?>AB02I8:0 WMI %2 87 2A5E 0:B82=KE :><?LNB5@=KE A50=A>2. C4CB ?>;CG5=K B>;L:> C254><;5=8O 87 B5:CI53> A50=A0.%0

�@>87>H;0 >H81:0 %1 ?@8 ?>?KB:5 A>740BL ?>B>: >BA;56820=8O A>1KB89 4;O ?>AB02I8:0 WMI %2.%0

�@>87>H;0 >H81:0 %1 ?@8 ?>?KB:5 @538AB@0F88 ?>AB02I8:0 WMI %2 4;O >BA;56820=8O C254><;5=89 >B 0=B82@54>=>A=KE ?@>3@0<<.%0

T4VS_VERSION_INFO���e�e?�StringFileInfo�041904B0LCompanyNameMicrosoft Corporation�.FileDescription>AB02I8: WMI 25@A88 2 4;O C?@02;5=8O 70I8B>9JInternalNameProtectionManagement�ELegalCopyright� >@?>@0F8O 09:@>A>DB (Microsoft Corporation). A5 ?@020 70I8I5=K.bOriginalFilenameProtectionManagement.dll.muir)ProductName?5@0F8>==0O A8AB5<0 Microsoft� Windows��9FileVersion4.18.26050.15 (b7ae6fb185fe12f8ad81cb6d4ade5982e03d0a61)@ProductVersion4.18.26050.15DVarFileInfo$Translation�PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX�%0�%�	*�H��
��%�0�%�10
	`�He0\
+�7�N0L0
+�70	���010
	`�He :�3��oе�j�Sjp�.<#�-�ٮN�I��
�0�	0��3�W���2-.�0
	*�H��
0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20110
260416190915Z
261017190915Z0p10	UUS10U
Washington10URedmond10U
Microsoft Corporation10UMicrosoft Windows0�"0
	*�H��
�0�
�֥�mlF��O%���F�k���Q�.�H�B���0��
|Ḣ�|�9b4�wۤ��cc��]Q����@~�$	���B��hn�K����u���D�@+c�,�iA�,a����晞�B���
K2؟��&���?
̡�M��~;ax�|xT�nJ2L��+����8���ܞ�-��A�G�T*���S3�<�:Cݨ�#�6J�8�ou�,bO�l��K&�*&n��`���|5M`x�O �^�U)��s�ۿ��	���0��0U%0
+�7
+0U�`\�6�ϧ4��h�N$�o*0TUM0K�I0G1-0+U$Microsoft Ireland Operations Limited10U
229879+5075120U#0��)9�ėx͐��O��|U�S0WUP0N0L�J�H�Fhttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl%200a+U0S0Q+0�Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0U�00
	*�H��
��R��>���q;/
W�M95s�
�q9����V�ޏ�%���y��{��0L%�3e_�12E�8;Mx���;HB/��y�����9��-�yU�}lT���W����t,\��r'D�i���Y�Ѡۆ8
�p<:��NbC��8�<i���g���N?=N}�i;�s�6wjql`��4�$�����(t��U�vMb��}�EwTC����V�X+ls\����yφ,��5r*���0��0���
avV0
	*�H��
0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100
111019184142Z
261019185142Z0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20110�"0
	*�H��
�0�
�����.	����i�!�i33��T����� ��ҋ�8����-|by��J?5 p���k�6u�1ݍp��7�tF�([�`#,��G�g�Q'�r��ɹ;S5|���'�����#	o�F��n�<A�ˣ?]jM�i%(\6��C
��������['�'x0�[*	k"�S`,�hS��I�a��h	sD]}�T+�y��5]l+\μ�#�on�&�6�O�'��2;A�,���w�TN�\�e�C���mw�Z$�H��C0�?0	+�70U�)9�ėx͐��O��|U�S0	+�7
SubCA0U�0U�0�0U#0��Vˏ�\bh�=��[�Κ�0VUO0M0K�I�G�Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0�>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
	*�H��
��|qQ�y�n��9>�<Rn+?s��h�H�4M��&�1F�ay�8.Ek��(�����	��L
6fj���������@26v�Zƿ���Ӭ�h�b��TlP0X��|���N���|�sW�R!s4Z�V��	����~�����?�rS��c��=1e�������=����BА�_T���G�o�sNA�@�_�*��s�!(���s9_>�\`����	���Q�fG���=�*hw��Lb{��Ǻz�4Kbz����J7�-�W|�=ܸZ��ij�:��n�i!7ށ�ugӓW^)9��-���Es[���z��FX�^���g�l5��?$�5�
u�V��x,��Ј���ߺ~,c��#!�xl�X6+�̤��-����@�E�Ί\k>��p*
j�_G��c
2��6*pZ�BYqKW�~���!<��Ź���E��� ����ŕ�]b֠c �uw}=�E�����W�o3��w�bY~1�*0�&0��0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20113�W���2-.�0
	`�He���0	*�H��
	1
+�70
+�710
+�70/	*�H��
	1" _y�M��D#>a�d�bD�S�#�Cv�C�Fl>Ė0B
+�71402��Microsoft��http://www.microsoft.com0
	*�H��
�9�x!����@w6���R��-��.D���ѷ�I)x�ꥴ�^Ӿ�ȷL��6(��R����v	nk���67��(�BtvE�@ѐk��|vJ����E�b}���N�����%���ɔ\n��g��)�)Х,�^�����<?�
*�7�?�*è�o�s7�6�f�1���P��$�ik7���"ed���^0UFf͵�O��ث>���RR}���{+c�]ކ��yvY�BQ˅��U�K��±w���0��
+�71��0��	*�H��
���0��10
	`�He0�Z*�H��
	��I�E0�A
+�Y
010
	`�He ��֔�� ���^�iǶYkz&*Y��<`��|j��vI20260531193421.884Z0��٤��0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1-0+U$Microsoft Ireland Operations Limited1'0%UnShield TSS ESN:6F1A-05E0-D9471%0#UMicrosoft Time-Stamp Service���0�(0��3	U��Y�0
	*�H��
0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100
250814184831Z
261113184831Z0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1-0+U$Microsoft Ireland Operations Limited1'0%UnShield TSS ESN:6F1A-05E0-D9471%0#UMicrosoft Time-Stamp Service0�"0
	*�H��
�0�
��
1��,��7���v�@��b�}��]�Żd�X��Z�)_�Q�9�����gZPUN�1P�Y�m�{�0A�Kz�z�\/�F;���)�	߲�~A�^��������v������.��D�IG��9q	Ze7�u�io��!�8�hQ��s.�R��V�
�PC�c71��L� ��G�V�ZZ���Z.@�
��d��IpFf[�z��톅�}�D�a�3�F���iv�Z��P��y5S2��H�T�?q �x�k�B��q[jN�
��N������ WM���	7���D� �z�v*�<b1�����-Šh}��.OiO��'=os�OGY�iP�B�2��"gE���-�o�>�w%�n~���1"7p�����V���&5�3pȭ��j�����%}H�&Ȧjq�œ�M#����4��3�	ɁPz��z41���'�7�l�%�ˑm�c%_m�:�<t�T3&���Ѱ��[8 M.�d܅���WQ����I0�E0UZ�c��.�:o�X,);d0U#0���]^b]����e�S5�r0_UX0V0T�R�P�Nhttp://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l+`0^0\+0�Phttp://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0U�00U%�0
+0U��0
	*�H��
��V��^j'w��
Յ�'��2G/��a �H�‚y�G�;�z�su���3��̨Ԯ򴽵����������ycj~\��gC� Dɉ�4,����v;���߯��pR�/�2�|�<�׾�n?Ku�B���N9ԫ�{�@�'�d��Jx�V�I�ó�'�
��i��?k�ˈ�h�G=j���#1�7�Q�#	nU��@M*�`)|�SL�1GX��Ӻr�F�I�����6܌��=1�W%��?Ȯ$
"9���]�1���P0O-�r����4?��.���_Aڷ�rΟ�~��'7?����Z�I�� Ltȩ�
�_צ#�m���z�=��ݫ���Px�t���h�A��n�Rl�d���.��ll�rpX~���?�j�na�ލj�:�O�r=��G��4"�B<J_"��3��d_a)L��ʛ�>ay�}S=��M��%Ҝ�o�'�f~w��v��X�ݥ����i�›�-e��J�~�/�-�=��Q�r����HX�b��C�#�r���6��r0�q0�Y�3��k��I�0
	*�H��
0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100
210930182225Z
300930183225Z0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100�"0
	*�H��
�0�
���L�r!y���$y�Ղ��ҩlNu��5W�lJ�⽹>`3�\O�f��SqZ�~JZ��6g�F#���w2��`}jR�D���Fk��v��P�D�q\Q17�
8n����&S|9azĪ�ri����6�5&dژ;�{3��[~��R���b%�j�]�S���VM�ݼ��㑏�9,Q��pi
�6-p�1�5(�㴇$��ɏ~�T��U�mh;�F��z)7���E�Fn�2��0\O,�b�͹⍈䖬J��q�[g`���=� �s}A�Fu��_4���� }~�ٞE߶r/�}_��۪~6�6L�+n�Q���s�M7t�4���G��|?Lۯ^����s=CN�39L��Bh.�QF�ѽjZas�g�^�(v�3rק ��
�co�6d�[���!]_0t���عP��a�65�G������k�\RQ]�%��Pzl�r�Rą��<�7�?x�E���^ڏ�riƮ{��>j�.����0��0	+�70#	+�7*�R�dĚ���<F5)��/�0U��]^b]����e�S5�r0\U U0S0Q+�7L�}0A0?+3http://www.microsoft.com/pkiops/Docs/Repository.htm0U%0
+0	+�7
SubCA0U�0U�0�0U#0��Vˏ�\bh�=��[�Κ�0VUO0M0K�I�G�Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0�>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
	*�H��
��U}�*��,g1$[�rK��o�\�>NGdx���=13�9��q6?�dl|�u9m�1��lѡ�"��fg:SMݘ��x�6.���V����i�	�{�jo�)�n�?Hu��m��m#T�xSu$W�ݟ�=��h�e��V����(U'�$�@���]='�@�8���)�ü�T�B�������j�BRu�6��as.,k{n?,	x鑲�[�I�t�쑀�=�J>f;O���2ٖ����t��Lro�u0�4�z�P�
X�@<�Tm�ctH,�NG-�q�d�$�smʎ	��WITd�s�[D�Z�k
��(�g($�8K�n�!TkjEG����^O���Lv�WT	�iD~|�als�
��Af=i��AI~~���;����>�1Q������{��p���(��6ںL���
�4�$5g+�
�挙��"��'B=%��tt[jў>�~�13}���{�8pDѐ�ȫ:�:b�pcSM��m��qj�U3X��pf�V0�>0���٤��0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1-0+U$Microsoft Ireland Operations Limited1'0%UnShield TSS ESN:6F1A-05E0-D9471%0#UMicrosoft Time-Stamp Service�#
0+Zd�Mn�lj�uq�K0�$Tg���0���~0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100
	*�H��
�ƴ�0"20260531132227Z20260601132227Z0t0:
+�Y
1,0*0
�ƴ�0#�00
��06
+�Y
1(0&0
+�Y
�
0� �
0��0
	*�H��
��j�M�#llE����]8��
	�-���TO1�v��ňÝ�à9�u�j�s�c��Ɠ �e�E3ۚk-��B�c���~���9��>��,1�lv��L���M�"����,}`05v�0m������BT�m�F	w�[y8II��c,T�h�d�$F6PZ��:�Ci_!�gVb]wt�k�w,�	�9Ż�KOn?FM���3{Z�p�Ā�k��Z$�u���a�ʣ%")tP���'&�v�7w��q^��1�
0�	0��0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103	U��Y�0
	`�He��J0	*�H��
	1
*�H��
	0/	*�H��
	1" U�g�S�f����O)�͗����f��g�A����0��*�H��
	/1��0��0��0�� � i&6h���ա#�6
�vD��b�ɡЈr!�h0��0���~0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103	U��Y�0" A�v��69��=.Ќ�p�^�������p�;�0
	*�H��
�{n��@,�h��jj;�
�\`o=�H���_9��n�(onA���pb<�5��I����=���K�Hq��%*����m�K4E��O��ˌMF^p���W�}�v�OUTr��� �
0�"ș�U�oq��_m��x5�Ԙ��|ح|��8�h���g�S1��7}E��_WH�\��@��?�0�W �ŗ�u(��o`F?�K
���h�|;�ۜ�]<��{��
�{�.M`�����`���A��U>_��xu�f�+�{�Q3�Ot޾�@���v���m��=�g樧��?��n�r�䋳7�(��?d3��k���x�Qkw�;�u�Q �mv��>�yI�����Opw�̈́"\>��L���k<�ǑK%��u�In����>0�7�m�on<�$�:��<+�]8���aa�����^�i֑R(���ؚ�TI�v�\�=zT8A%���E.W������U�(�߉�����6v��ڇlx|q�'D��֌��z��&

Youez - 2016 - github.com/yon3zu
LinuXploit