MZ@ !L!This program cannot be run in DOS mode. $Rؕ3}3}3}H̴3}H̱3}Rich3}PEdR"  iE`.rsrc@@(@Xp   00  WEVT_TEMPLATEMUI 4VS_VERSION_INFO@%@%?~StringFileInfoZ040904B0LCompanyNameMicrosoft Corporation|*FileDescriptionMicrosoft-Windows-System-Events Resourcesr)FileVersion6.3.9600.16384 (winblue_rtm.130821-1623)h$InternalNamemicrosoft-windows-system-events.dll.LegalCopyright Microsoft Corporation. All rights reserved.p$OriginalFilenamemicrosoft-windows-system-events.dllj%ProductNameMicrosoft Windows Operating SystemBProductVersion6.3.9600.16384DVarFileInfo$Translation CRIM"/G!D?84Oצ] ,"{+B/$JOpsOQ3=T~c#w[HV]s]J+:WcL.?w; &?YFKBQ7vPY0J~W4c"SKD4eiU?FMEOCEl `{MKf/e@ڊR_O](a$BJ;?&0  '2 RCR۫AYP#^񿿁E|چ]56wuC$E7ĺ^apxWEVT0 PH CHAN0\PMicrosoft-Windows-Kernel-WDI/AnalyticLMicrosoft-Windows-Kernel-WDI/DebugXMicrosoft-Windows-Kernel-WDI/OperationalTTBL TEMP -Wxgz_vD EventDataA?oData'KName ProviderID A9oData!KNameEventID AMoData5KNameDroppedEventCount AAoData)KName ActionCount AMZ ComplexData'KName SemActions ,Tp ProviderIDEventID(DroppedEventCountActionCountSemActionsProviderIDLevelReservedKeyword$EnablePropertyNTStatusTEMP,f*Ƥ&gAD EventDataA?oData'KName ProviderID A9oData!KNameEventID  8 ProviderIDEventIDTEMPd C>ҞSD EventDataA?oData'KName ProviderID A9oData!KNameEventID A;oData#KNameNTStatus    ProviderIDEventIDNTStatusTEMPt QoJoJ]:VD EventDataA?oData'KName ProviderID A9oData!KNameEventID AEoData-KName ScenarioCount AcZ ComplexData=KNameScenarioInflightItems  0 D d     ProviderIDEventID ScenarioCount0ScenarioInflightItemsProviderIDEventIDReserved InflightCountTEMP,f*Ƥ&gAD EventDataA?oData'KName ProviderID A9oData!KNameEventID ProviderIDEventIDTEMPL׋Q&è@e*`D EventDataA?oData'KName ProviderID ProviderIDTEMPC>ҞSD EventDataA?oData'KName ProviderID A9oData!KNameEventID A;oData#KNameNTStatus @\pProviderIDEventIDNTStatusTEMPT*B3TMD EventDataA9oData!KNameSqmType A7oDataKNameSqmSid |SqmTypeSqmSidTEMPD:LsTBD EventDataAGoData/KNameSqmSessionGuid A5oDataKNameSqmID A9oData!KNameSqmType AWoData?KNameSqmDWORDDatapointValue l$SqmSessionGuidSqmIDSqmType4SqmDWORDDatapointValueTEMP`3f!LF+VfNHD EventDataAGoData/KNameSqmSessionGuid A5oDataKNameSqmID A9oData!KNameSqmType AOoData7KNameSqmStreamRowLength AQZ ComplexData+KName SqmStreamRow Pt$$SqmSessionGuidSqmIDSqmType,SqmStreamRowLength SqmStreamRow SqmTypeEntry SqmDWORDEntry$SqmStringEntryOPCO< 0 0$ 0l 000h00 0\004LWDI_SEM_TASK_SCENARIO_OPCODE_STARTHWDI_SEM_TASK_SCENARIO_OPCODE_ENDPWDI_SEM_TASK_SCENARIO_OPCODE_TIMEOUTXWDI_SEM_TASK_SCENARIO_OPCODE_START_FAILEDTWDI_SEM_TASK_SCENARIO_OPCODE_END_FAILEDXWDI_SEM_TASK_SCENARIO_OPCODE_INFLIGHT_MAXLWDI_SEM_TASK_INIT_OPCODE_MISCONFIGPWDI_SEM_TASK_INIT_OPCODE_SCENARIO_MAXtWDI_SEM_TASK_INIT_OPCODE_SCENARIO_CONTEXT_PROVIDER_MAXdWDI_SEM_TASK_INIT_OPCODE_SCENARIO_END_EVENT_MAXPWDI_SEM_TASK_INIT_OPCODE_PROVIDER_MAXLEVLPPPwin:Errorwin:Warning(win:InformationalTASK pT p0WDI_SEM_TASK_SCENARIO(WDI_SEM_TASK_INITKEYWt!"4 contextdiagwin:SQMEVNT   \T ,! !\` ," " l ,# @# <$ @$L x<% @%L <& & 8L' ' 8L( ( 8L) )(8L* *8L+ , - WEVT<)P!!"@FpFFFGCHAN0l!SystemMAPS!VMAP4!@Ex:SystemTimeChange.ReasonMapTTBL<$ TEMP "z <!{AD EventDataA9oData!KNameNewTime A9oData!KNameOldTime ##NewTimeOldTimeTEMP<$wӓMuWD EventDataA9oData!KNameNewTime A9oData!KNameOldTime A7oDataKNameReason x$$!$NewTimeOldTimeReasonTEMPP%ygػ$<[7J.D EventDataTEMP8&"{_ui69:D EventDataAAoData)KName FinalStatus AMoData5KNameExtraStringLength AAoData)KName ExtraString t&&&FinalStatus(ExtraStringLengthExtraStringTEMP("{_ui69:D EventDataAAoData)KName FinalStatus AMoData5KNameExtraStringLength AAoData)KName ExtraString D(`((FinalStatus(ExtraStringLengthExtraStringTEMP*y73D EventDataAMoData5KNameExtraStringLength AAoData)KName ExtraString A3oDataKNameTmId A3oDataKNameRmId A7oDataKNameStatus ACoData+KName InternalCode +,+H+X+h+|+(ExtraStringLengthExtraStringTmIdRmIdStatus InternalCodeTEMP(-gkSM4# ܔc4D EventDataAGoData/KNameHiveNameLength A;oData#KNameHiveName ACoData+KName OriginalSize A9oData!KNameNewSize T-x---$HiveNameLengthHiveName OriginalSizeNewSizeTEMP00/ܡ^KN8D EventDataAGoData/KNameHiveNameLength A;oData#KNameHiveName AAoData)KName KeysUpdated A?oData'KName DirtyPages ////$HiveNameLengthHiveNameKeysUpdatedDirtyPagesTEMP<2/wmUWFD EventDataACoData+KName MajorVersion ACoData+KName MinorVersion ACoData+KName BuildVersion A?oData'KName QfeVersion AGoData/KNameServiceVersion A;oData#KNameBootMode A=oData%KName StartTime 223(3D3h33 MajorVersion MinorVersion BuildVersionQfeVersion$ServiceVersionBootModeStartTimeTEMP(4 %C+Wi4\D EventDataA;oData#KNameStopTime <4StopTimeTEMP*=.^Jk D EventDataA3oDataKNameMode A?oData'KName ObjectType A?oData'KName ObjectName AAoData)KName ProcessName A[oDataCKNameObjectCreatorProcessName A?oData'KName AccessMask A=oData%KName TokenType AOoData7KNameImpersonationLevel A=oData%KName SessionId ACoData+KName LowBoxNumber AKoData3KNameTokenGroupsCount AOZ ComplexData)KName TokenGroups AMoData5KNameTokenPackageCount AQZ ComplexData+KName TokenPackage ASoData;KNameTokenCapabilityCount A[Z ComplexData5KNameTokenCapabilities ASoData;KNameTokenTrustLevelCount AWZ ComplexData1KNameTokenTrustLevel A_oDataGKNameSecurityDescriptorRevision A]oDataEKNameSecurityDescriptorControl AYoDataAKNameSecurityDescriptorOwner AYoDataAKNameSecurityDescriptorGroup ACoData+KName DaclRevision ACoData+KName DaclAceCount AGZ ComplexData!KNameDaclAce ACoData+KName SaclRevision ACoData+KName SaclAceCount AGZ ComplexData!KNameSaclAce @@ A(ADA|AAAAAB 8  D EventDataA=oData%KName ImageBase A=oData%KName ImageSize A=oData%KName ProcessID AEoData-KName ImageCheckSum AEoData-KName TimeDateStamp AAoData)KName DefaultBase A=oData%KName ImageName o,oDo\o|oooImageBaseImageSizeProcessID ImageCheckSum TimeDateStampDefaultBaseImageNameTEMPrqogE> 8  D EventDataA=oData%KName ImageBase A=oData%KName ImageSize A=oData%KName ProcessID AEoData-KName ImageCheckSum AEoData-KName TimeDateStamp AAoData)KName DefaultBase A=oData%KName ImageName rrrrs$s@sImageBaseImageSizeProcessID ImageCheckSum TimeDateStampDefaultBaseImageNameTEMPt0oy:Sa_60D EventDataA=oData%KName ProcessID A;oData#KNameThreadID AAoData)KName OldPriority AAoData)KName NewPriority  u$uʴjD EventDataAIoData1KNameFrozenProcessID (v$FrozenProcessIDOPCOx1|v2v2vwin:Infowin:Startwin:StopLEVL@Pv(win:InformationalTASK Dxdxxxxxxy Dy py y ProcessStartProcessStopThreadStartThreadStopImageLoadImageUnload0CpuBasePriorityChange(CpuPriorityChange,PagePriorityChange(IoPriorityChange ProcessFreezeKEYW$z \z@zz{H{8WINEVENT_KEYWORD_PROCESS4WINEVENT_KEYWORD_THREAD4WINEVENT_KEYWORD_IMAGE@WINEVENT_KEYWORD_CPU_PRIORITYDWINEVENT_KEYWORD_OTHER_PRIORITYDWINEVENT_KEYWORD_PROCESS_FREEZEEVNTPXKdvvw~JMdvvw~JPpvv,w~JtUpvv,w~J p]dvvHw~J advvHw~J p]pvvdw~J fpvvdw~J@HlXvvw~J@oXvvw~JXsXvvw~JXsXvvw~J   XsXvvw~J   XsXvv x~J   tudvv(x~J   tupvv(x~JyyyyyyyyyyyyzzzzWEVTFH0طȼCHANt\Microsoft-Windows-Kernel-Registry/Analytic`Microsoft-Windows-Kernel-Registry/PerformanceTTBLl/TEMP(E!5Ġ8D EventDataA?oData'KName BaseObject A=oData%KName KeyObject A7oDataKNameStatus AAoData)KName Disposition A;oData#KNameBaseName ACoData+KName RelativeName ԂBaseObjectKeyObjectStatusDispositionBaseName RelativeNameTEMPLodkl)n$sD EventDataA=oData%KName KeyObject A7oDataKNameStatus A9oData!KNameKeyName KeyObjectStatusKeyNameTEMPxFt MQAD EventDataA=oData%KName KeyObject A7oDataKNameStatus A=oData%KName InfoClass A;oData#KNameDataSize A9oData!KNameKeyName AKoData3KNameCapturedDataSize ACoData+KName CapturedData ̇ KeyObjectStatusInfoClassDataSizeKeyName(CapturedDataSize CapturedDataTEMP ,4qnڦD EventDataA=oData%KName KeyObject A7oDataKNameStatus A3oDataKNameType A;oData#KNameDataSize A9oData!KNameKeyName A=oData%KName ValueName AKoData3KNameCapturedDataSize ACoData+KName CapturedData AKoData3KNamePreviousDataType AKoData3KNamePreviousDataSize A[oDataCKNamePreviousDataCapturedSize ACoData+KName PreviousData (@Tl܍ <KeyObjectStatusTypeDataSizeKeyNameValueName(CapturedDataSize CapturedData(PreviousDataType(PreviousDataSize8PreviousDataCapturedSize PreviousDataTEMPgӼhy3\ D EventDataA=oData%KName KeyObject A7oDataKNameStatus A9oData!KNameKeyName A=oData%KName ValueName ,@KeyObjectStatusKeyNameValueNameTEMPВW[M MBD EventDataA=oData%KName KeyObject A7oDataKNameStatus A=oData%KName InfoClass A;oData#KNameDataSize A9oData!KNameKeyName A=oData%KName ValueName AKoData3KNameCapturedDataSize ACoData+KName CapturedData p̓ KeyObjectStatusInfoClassDataSizeKeyNameValueName(CapturedDataSize CapturedDataTEMP ԐC54`:D EventDataA=oData%KName KeyObject A7oDataKNameStatus A5oDataKNameIndex A=oData%KName InfoClass A;oData#KNameDataSize A9oData!KNameKeyName AKoData3KNameCapturedDataSize ACoData+KName CapturedData Ph|ЗKeyObjectStatusIndexInfoClassDataSizeKeyName(CapturedDataSize CapturedDataTEMPp_z28tѳtc)dD EventDataA=oData%KName KeyObject A7oDataKNameStatus A?oData'KName EntryCount A;oData#KNameDataSize A9oData!KNameKeyName ,@\tKeyObjectStatusEntryCountDataSizeKeyNameTEMPxFt MQAD EventDataA=oData%KName KeyObject A7oDataKNameStatus A=oData%KName InfoClass A;oData#KNameDataSize A9oData!KNameKeyName AKoData3KNameCapturedDataSize ACoData+KName CapturedData H`tKeyObjectStatusInfoClassDataSizeKeyName(CapturedDataSize CapturedDataTEMP<ܞFD:'fCPD EventDataACoData+KName HiveFilePath A;oData#KNameFileSize $ HiveFilePathFileSizeTEMP\(~iV'abiRkD EventDataAGoData/KNameTotalEntrySize AGoData/KNameBytesRecovered Pt$TotalEntrySize$BytesRecoveredTEMP,`CL羫6a`D EventDataA?oData'KName StatusCode @StatusCodeTEMPTD sӨg5HD EventDataACoData+KName HiveFilePath AGoData/KNameHiveMountPoint l HiveFilePath$HiveMountPointTEMPD`CL羫6a`D EventDataA?oData'KName StatusCode XStatusCodeTEMPKz<̽֕tn&D EventDataACoData+KName HiveFilePath AGoData/KNameHiveMountPoint A?oData'KName FlushFlags ܤ HiveFilePath$HiveMountPointFlushFlagsTEMPإz01Vt`UgfD EventDataAEoData-KName BytesGathered  BytesGatheredTEMPz01Vt`UgfD EventDataAEoData-KName BytesGathered  BytesGatheredTEMPL.]6(2xK%G~Г]|D EventDataACoData+KName WritesIssued ACoData+KName BytesWritten  WritesIssued BytesWrittenTEMPL .]6(2xK%G~Г]|D EventDataACoData+KName WritesIssued ACoData+KName BytesWritten 4T WritesIssued BytesWrittenTEMP`CL羫6a`D EventDataA?oData'KName StatusCode StatusCodeTEMP$Ѱbk,~`L;D EventDataA?oData'KName SourceFile A5oDataKNameFlags 0LSourceFileFlagsTEMP`CL羫6a`D EventDataA?oData'KName StatusCode StatusCodeTEMP$Ѱbk,~`L;D EventDataA?oData'KName SourceFile A5oDataKNameFlags 4SourceFileFlagsTEMPح`CL羫6a`D EventDataA?oData'KName StatusCode StatusCodeTEMPz IJ_wB fD EventDataAEoData-KName SourceKeyPath  SourceKeyPathTEMPl`CL羫6a`D EventDataA?oData'KName StatusCode StatusCodeOPCO!242L d   D x   D x ȳ  <̴ p !ص"#$%8&\'|()Ķ*+,4-L.twin:Startwin:StopHRegPerfOpHiveMountBaseFileMountedPRegPerfOpHiveFlushBecameActiveFlusherHRegPerfOpShutdownRundownComplete4RegPerfOpSaveFileCopiedHRegPerfOpHiveMountLogEntryAppliedHRegPerfOpHiveFlushGatheredLogData<RegPerfOpShutdownFlushStart4RegPerfOpSaveTreeCopiedPRegPerfOpHiveFlushGatheredPrimaryData<RegPerfOpShutdownFlushStop8RegPerfOpSaveFileWrittenDRegPerfOpHiveFlushWroteLogFileLRegPerfOpHiveFlushWrotePrimaryFileTRegPerfOpHiveFlushBoostedActiveFlusherPRegPerfOpHiveFlushStartWaitForActivePRegPerfOpHiveFlushFinishWaitForActiveCreateKeyOpenKeyDeleteKeyQueryKeySetValueKey$DeleteValueKey QueryValueKey EnumerateKey(EnumerateValueKey0QueryMultipleValueKey(SetInformationKeyFlushKeyCloseKey(QuerySecurityKey$SetSecurityKeyLEVL@P(win:InformationalTASKssظss8sdssĹ0RegPerfTaskHiveMount0RegPerfTaskHiveUnload0RegPerfTaskHiveFlush,RegPerfTaskShutdown,RegPerfTaskHiveLoad4RegPerfTaskHiveRestore,RegPerfTaskHiveSaveKEYW,P x@л(Hh @CloseKey(QuerySecurityKey$SetSecurityKey(EnumerateValueKey0QueryMultipleValueKey(SetInformationKeyFlushKeySetValueKey$DeleteValueKey QueryValueKey EnumerateKeyCreateKeyOpenKeyDeleteKeyQueryKeyEVNT- <HT! <LT"@<PT#ȄTT$@XT%\\T&XȰ`T'@԰dT (@hT ) lT *@pT +<tT ,<xT-<|T.<(T@d @d @<d@d@\d@d@td @̯d @<d @ d @ܦDd@ܦPd@\d@hd@td@td @8d!@8d" @8d# @,8d$@8d%@8Td&@\Td'@ pd(@Dpd)@d* @d+ @d, @8d-@خd̺ܺl|,<L\ WEVT``@4!"CHANtXMicrosoft-Windows-Kernel-Acpi/DiagnosticMAPStVMAP$VMAP$HMapActiveCoolingDevicePowerState<MapAmlMethodInvocationStateTTBLTTEMPL{$JG5[#%tD EventDataACoData+KName ResourceFlag AAoData)KName GeneralFlag AKoData3KNameTypeSpecificFlag AAoData)KName Granularity  A?oData'KName AddressMin  A?oData'KName AddressMax  AOoData7KNameAddressTranslation  AEoData-KName AddressLength     0 L x ResourceFlagGeneralFlag(TypeSpecificFlagGranularityAddressMinAddressMax,AddressTranslation AddressLengthTEMP\1D%z\vϫ|D EventDataAAoData)KName GpeRegister AOoData7KNameUnexpectedEventMap GpeRegister,UnexpectedEventMapTEMPD3O v]a?]́D EventDataAioDataQKNameThermalZoneDeviceInstanceLength A]oDataEKNameThermalZoneDeviceInstance A3oDataKName_TMP A3oDataKName_PSV A3oDataKName_AC0 A3oDataKName_AC1 A3oDataKName_AC2 A3oDataKName_AC3 A3oDataKName_AC4 A3oDataKName_AC5 A3oDataKName_AC6 A3oDataKName_AC7 A3oDataKName_AC8 A3oDataKName_AC9 A3oDataKName_HOT A3oDataKName_CRT  0@P`pDThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance_TMP_PSV_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRTTEMPH6})Y5D EventDataAioDataQKNameThermalZoneDeviceInstanceLength A]oDataEKNameThermalZoneDeviceInstance AOoData7KNameActiveCoolingLevel A[oDataCKNameActiveCoolingDeviceIndex AYoDataAKNameFanDeviceInstanceLength AMoData5KNameFanDeviceInstance AKoData3KNamePowerStateLength A?oData'KName PowerState $P DThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance,ActiveCoolingLevel8ActiveCoolingDeviceIndex4FanDeviceInstanceLength(FanDeviceInstance(PowerStateLengthPowerStateTEMP/~#n];HnD EventDataAioDataQKNameThermalZoneDeviceInstanceLength A]oDataEKNameThermalZoneDeviceInstance AOoData7KNameActiveCoolingLevel A[oDataCKNameActiveCoolingDeviceIndex AYoDataAKNameFanDeviceInstanceLength AMoData5KNameFanDeviceInstance A?oData'KName PowerState 0htDThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance,ActiveCoolingLevel8ActiveCoolingDeviceIndex4FanDeviceInstanceLength(FanDeviceInstancePowerStateTEMPxnwX.eנD EventDataASoData;KNameDeviceInstanceLength AGoData/KNameDeviceInstance A?oData'KName PowerState Xt0DeviceInstanceLength$DeviceInstancePowerStateTEMP@ݳҊ`xD EventDataASoData;KNameDeviceInstanceLength AGoData/KNameDeviceInstance A;oData#KNameThrottle <l0DeviceInstanceLength$DeviceInstanceThrottleTEMPX(t[P&HU`xJD EventDataASoData;KNameDeviceInstanceLength AGoData/KNameDeviceInstance A?oData'KName PowerState A;oData#KNameThrottle xt0DeviceInstanceLength$DeviceInstancePowerStateThrottleTEMP@lf5JT8lB6D EventDataAioDataQKNameThermalZoneDeviceInstanceLength A]oDataEKNameThermalZoneDeviceInstance AAoData)KName Temperature $DThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstanceTemperatureTEMP S\Uj0k[n D EventDataAQoData9KNameAmlMethodNameLength AEoData-KName AmlMethodName AGoData/KNameAmlMethodState ,AmlMethodNameLength AmlMethodName$AmlMethodStateTEMP,,S8ZW+z D EventDataA]oDataEKNameThermalZoneBiosNameLength AQoData9KNameThermalZoneBiosName A3oDataKName_TMP A3oDataKName_PSV A3oDataKName_TC1 A3oDataKName_TC2 A3oDataKName_TSP A3oDataKName_AC0 A3oDataKName_AC1 A3oDataKName_AC2 A3oDataKName_AC3 A3oDataKName_AC4 A3oDataKName_AC5 A3oDataKName_AC6 A3oDataKName_AC7 A3oDataKName_AC8 A3oDataKName_AC9 A3oDataKName_HOT A3oDataKName_CRT A3oDataKName_NTT A=oData%KName _PSLCount AAoData)KName _PSLEntries A=oData%KName _TZDCount AAoData)KName _TZDEntries A=oData%KName _AL0Count AAoData)KName _AL0Entries A=oData%KName _AL1Count AAoData)KName _AL1Entries A=oData%KName _AL2Count AAoData)KName _AL2Entries A=oData%KName _AL3Count AAoData)KName _AL3Entries A=oData%KName _AL4Count AAoData)KName _AL4Entries !A=oData%KName _AL5Count "AAoData)KName _AL5Entries #A=oData%KName _AL6Count $AAoData)KName _AL6Entries %A=oData%KName _AL7Count &AAoData)KName _AL7Entries 'A=oData%KName _AL8Count (AAoData)KName _AL8Entries )A=oData%KName _AL9Count *AAoData)KName _AL9Entries +L 0@P`p8Pl <"Tp$&( *$8ThermalZoneBiosNameLength,ThermalZoneBiosName_TMP_PSV_TC1_TC2_TSP_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRT_NTT_PSLCount_PSLEntries_TZDCount_TZDEntries_AL0Count_AL0Entries_AL1Count_AL1Entries_AL2Count_AL2Entries_AL3Count_AL3Entries_AL4Count_AL4Entries_AL5Count_AL5Entries_AL6Count_AL6Entries_AL7Count_AL7Entries_AL8Count_AL8Entries_AL9Count_AL9EntriesTEMP--@,PG퀦:~F˵ D EventDataA]oDataEKNameThermalZoneBiosNameLength AQoData9KNameThermalZoneBiosName A3oDataKName_TMP A3oDataKName_PSV A3oDataKName_TC1 A3oDataKName_TC2 A3oDataKName_TSP A3oDataKName_AC0 A3oDataKName_AC1 A3oDataKName_AC2 A3oDataKName_AC3 A3oDataKName_AC4 A3oDataKName_AC5 A3oDataKName_AC6 A3oDataKName_AC7 A3oDataKName_AC8 A3oDataKName_AC9 A3oDataKName_HOT A3oDataKName_CRT A3oDataKName_NTT A=oData%KName _PSLCount AAoData)KName _PSLEntries A=oData%KName _TZDCount AAoData)KName _TZDEntries A=oData%KName _AL0Count AAoData)KName _AL0Entries A=oData%KName _AL1Count AAoData)KName _AL1Entries A=oData%KName _AL2Count AAoData)KName _AL2Entries A=oData%KName _AL3Count AAoData)KName _AL3Entries A=oData%KName _AL4Count AAoData)KName _AL4Entries !A=oData%KName _AL5Count "AAoData)KName _AL5Entries #A=oData%KName _AL6Count $AAoData)KName _AL6Entries %A=oData%KName _AL7Count &AAoData)KName _AL7Entries 'A=oData%KName _AL8Count (AAoData)KName _AL8Entries )A=oData%KName _AL9Count *AAoData)KName _AL9Entries +AIoData1KNameMinimumThrottle ,  ( 8 H X h x           ( 8 H ` |       0 L d    "  $&4P(h*8ThermalZoneBiosNameLength,ThermalZoneBiosName_TMP_PSV_TC1_TC2_TSP_AC0_AC1_AC2_AC3_AC4_AC5_AC6_AC7_AC8_AC9_HOT_CRT_NTT_PSLCount_PSLEntries_TZDCount_TZDEntries_AL0Count_AL0Entries_AL1Count_AL1Entries_AL2Count_AL2Entries_AL3Count_AL3Entries_AL4Count_AL4Entries_AL5Count_AL5Entries_AL6Count_AL6Entries_AL7Count_AL7Entries_AL8Count_AL8Entries_AL9Count_AL9Entries$MinimumThrottleTEMP !ԝlD EventDataAMoData5KNameFanBiosNameLength AAoData)KName FanBiosName ACoData+KName FstSupported  A?oData'KName PowerState A9oData!KNameControl $ @t`|(FanBiosNameLengthFanBiosName FstSupportedPowerStateControlTEMPůtj/D^D EventDataAMoData5KNameFanBiosNameLength AAoData)KName FanBiosName A?oData'KName PowerState $t@(FanBiosNameLengthFanBiosNamePowerStateTEMP52<t6P2D EventDataAMoData5KNameFanBiosNameLength AAoData)KName FanBiosName A9oData!KNameControl (FanBiosNameLengthFanBiosNameControlTEMP`,ԝmwYE`D EventDataAioDataQKNameThermalZoneDeviceInstanceLength A]oDataEKNameThermalZoneDeviceInstance ASoData;KNameDeviceInstanceLength AGoData/KNameDeviceInstance A?oData'KName PowerState  <t`DThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance0DeviceInstanceLength$DeviceInstancePowerStateTEMPlƗG=稡 D EventDataAioDataQKNameThermalZoneDeviceInstanceLength A]oDataEKNameThermalZoneDeviceInstance ASoData;KNameDeviceInstanceLength AGoData/KNameDeviceInstance AEoData-KName ThrottleLimit <tDThermalZoneDeviceInstanceLength8ThermalZoneDeviceInstance0DeviceInstanceLength$DeviceInstance ThrottleLimitOPCOLEVL@P (win:InformationalTASKXd8edfghi(jLkxlmn o, pH qt r s t!uH!,ResourceTranslation(GpeEventHandling4TemperatureNotification0TripPointNotification8ActiveCoolingDevicePower$AmlMethodTrace,DeviceActiveCooling0DevicePassiveCooling0DeviceCoolingRundown(TemperatureChange,ThermalZoneRundownFanRundown,FanPowerStateChange$FanStatusChange4ActiveCoolingConstraintDActiveCoolingConstraintRundown8PassiveCoolingConstraintDPassiveCoolingConstraintRundownKEYWp!!$acpi:Diagnostic acpi:ThermalEVNT dL@%e\%fx%g%h%h(%i@%j% k % l  % m<% n,X% n@X& ot&p&q\ &r&s&t|&u|&!!!!!!!!!!!!!!!!!!!!WEVTx+&'PD$EF(G8GCHANx&\Microsoft-Windows-International/OperationalTTBLPTEMP((>/C;WyP8D EventDataAAoData)KName RegistryKey A=oData%KName ErrorCode A9oData!KNameMessage d(((RegistryKeyErrorCodeMessageTEMP<)u^C/ 7 D EventDataAAoData)KName RegistryKey A?oData'KName StatusCode ))RegistryKeyStatusCodeTEMP*ܼa"g II89rY`bD EventDataAAoData)KName RegistryKey *RegistryKeyTEMP,+ ^Q撌D EventDataA;oData#KNameCodePage A;oData#KNameFileName ++CodePageFileNameTEMP,,P#IonD EventDataA?oData'KName LocaleName A7oDataKNameWinDir ,,LocaleNameWinDirTEMPp..Ŀ[9TdD EventDataA=oData%KName ProcessId AAoData)KName ProdessName A7oDataKNameLocale A7oDataKNameLCType A;oData#KNamelpLCData //8/L/`/ProcessIdProdessNameLocaleLCTypelpLCDataTEMPX17j&T`3-lD EventDataA=oData%KName ProcessId AAoData)KName ProdessName A7oDataKNameLocale A;oData#KNameCalendar A9oData!KNameCalType A?oData'KName lpLCalData 112202D2ProcessIdProdessNameLocaleCalendarCalTypelpLCalDataTEMPx3BSl봃lֆD EventDataA=oData%KName ProcessId AAoData)KName ProdessName A5oDataKNameGeoId 333ProcessIdProdessNameGeoIdTEMP56Ƣ2EìJE킿WnD EventDataA?oData'KName LocaleName A5oDataKNameFlags A=oData%KName ProcessId AAoData)KName ProdessName A?oData'KName ReturnCode 66,6D6`6LocaleNameFlagsProcessIdProdessNameReturnCodeTEMP8X7Oۓǃg|1pD EventDataA=oData%KName ProcessId AAoData)KName ProdessName 77ProcessIdProdessNameTEMP8V*ZK_vi|D EventDataA;oData#KNameFileName A?oData'KName LineNumber A7oDataKNameReason 9989FileNameLineNumberReasonTEMP9CE,ja-jTq\D EventDataA;oData#KNameFileName 9FileNameTEMP:E R^`l`D EventDataA?oData'KName StatusCode :StatusCodeTEMP`; 7`]x`D EventDataA?oData'KName LocaleName t;LocaleNameTEMP<l<?QwbUoFID EventDataA?oData'KName LocaleName A?oData'KName StatusCode <<LocaleNameStatusCodeTEMPX=wwVvP#VD EventDataA5oDataKNameValue l=ValueTEMP>^'@fsU"wD EventDataA5oDataKNameValue AGoData/KNameWin32ErrorCode AMoData5KNameWin32ErrorMessage >>?Value$Win32ErrorCode(Win32ErrorMessageTEMP?$йRqjXD EventDataA7oDataKNameString ?StringTEMP@j\K/uE5vD EventDataA9oData!KNameAltSort A7oDataKNameLocale @@AltSortLocaleTEMP,|B(7/{^4qq6D EventDataA7oDataKNameLCType A5oDataKNameValue AGoData/KNameWin32ErrorCode AMoData5KNameWin32ErrorMessage BBBCLCTypeValue$Win32ErrorCode(Win32ErrorMessageTEMPDl <€?zD EventDataA7oDataKNameLCType A5oDataKNameValue ,D@DLCTypeValueOPCO5D5D 5D!!5D""5EDataTableInitialize,ConfigurationChangeOperationCleanupLEVLUlEPEPEPEUE win:Criticalwin:Errorwin:Warning(win:Informationalwin:VerboseTASK$uF uF!!uF""uF##uG(CharacterEncoding(DateTimeCalendar CMEGroupPolicyLocaleKEYWEVNT` 7# 'hD0EF&#(hD0EF&*\D0EF&*\D0EF&#+\D0EF&#+\D0EF&!"|6DHEdF&!"DHEdF&!":DHEdF&!":DHEdF&#)hDHEF& # hD`EF& !# -DTEF& ! x/DTE,F& !# `2DTEF& !# 3DTEF&'!!'7DI<:D EventDataAAoData)KName FeatureGuid ACoData+KName CallerIdType ACoData+KName cchImagePath A=oData%KName ImagePath ܸFeatureGuid CallerIdType cchImagePathImagePathTEMPԺ#kLҥ]lk`D EventDataAioDataQKNamecchParentImagePathIncludingNull AAoData)KName FeatureGuid AcoDataKKNameParentProcessImageHeaderHash AIoData1KNameParentImagePath $hĻDcchParentImagePathIncludingNullFeatureGuid@ParentProcessImageHeaderHash$ParentImagePathTEMP jjWD EventDataA5oDataKNameFlags A[oDataCKNamecchIdStringIncludingNull AYoDataAKNamecchDllPathIncludingNull A;oData#KNameCategory AIoData1KNameManifestVersion AEoData-KName DllHeaderHash A_oDataGKNameApplicationImageHeaderHash A;oData#KNameIdString A9oData!KNameDllPath ,DhFlags8cchIdStringIncludingNull4cchDllPathIncludingNullCategory$ManifestVersion DllHeaderHash<ApplicationImageHeaderHashIdStringDllPathTEMPxш-G LRR6=D EventDataA5oDataKNameFlags A[oDataCKNamecchIdStringIncludingNull A;oData#KNameCategory AIoData1KNameManifestVersion A_oDataGKNameApplicationImageHeaderHash A;oData#KNameIdString PFlags8cchIdStringIncludingNullCategory$ManifestVersion<ApplicationImageHeaderHashIdStringOPCOLEVL@P(win:InformationalTASK@`AitFeature,AitParentAitFeatureAitAppInfo,AitSystemUsageByDll,AitSystemUsageByExe AitProcessEndKitFeatureKEYWEVNT`dP0LhWEVT0PLXTTBLTEMPuuUU`SKEvD EventDataAUoData=KNameAeLookupServieTrigger 0AeLookupServieTriggerOPCOLEVL@Pp(win:InformationalTASKKEYWEVNT@\dWEVTx.X@LCHANdXhMicrosoft-Windows-Kernel-ApphelpCache/Operational\Microsoft-Windows-Kernel-ApphelpCache/DebugdMicrosoft-Windows-Kernel-ApphelpCache/AnalyticTTBLTEMPlqyPёJOZ'pD EventDataAOoData7KNameOperationalMessage ,OperationalMessageTEMPD!W+ 1 N bD EventDataAAoData)KName InfoMessage XInfoMessageTEMP N^`zDuPGdD EventDataACoData+KName DebugMessage   DebugMessageOPCOLEVLdPpPwin:Error(win:InformationalTASKKEYWEVNT3dd 4d@5tXtWEVT@ /|TTBL TEMPxXdj ;󏺒D EventDataAKoData3KNameSwitchBranchGuid AWoData?KNameSwitchBranchNameLength AKoData3KNameSwitchBranchName AeoDataMKNameSwitchBranchDescriptionLength AYoDataAKNameSwitchBranchDescription \ (SwitchBranchGuid4SwitchBranchNameLength(SwitchBranchName@SwitchBranchDescriptionLength4SwitchBranchDescriptionTEMPq ʥ4 ,D EventDataASoData;KNameSwitchBranchImplGuid A_oDataGKNameSwitchBranchImplNameLength ASoData;KNameSwitchBranchImplName AmoDataUKName!SwitchBranchImplDescriptionLength AaoDataIKNameSwitchBranchImplDescription ,h0SwitchBranchImplGuid<SwitchBranchImplNameLength0SwitchBranchImplNameHSwitchBranchImplDescriptionLength<SwitchBranchImplDescriptionTEMPt?F/3)ZD EventDataAMoData5KNameTargetContextGuid AMoData5KNameTargetContextType AKoData3KNameModuleNameLength A?oData'KName ModuleName $Lt(TargetContextGuid(TargetContextType(ModuleNameLengthModuleNameTEMP8 Q|#S ,tD EventDataASoData;KNameContextUpdateCounter  L0ContextUpdateCounterOPCOLEVL@P(win:InformationalTASKD\tAeSbCallAeSbImpl(AeSbContextUpdate0AeSbContextReadRetryKEYWEVNTT (WEVT '8CHANt,XMicrosoft-Windows-Kernel-Network/AnalyticTTBLtTEMP( @=BnɅ6* {@zD EventDataA1oDataKNamePID A3oDataKNamesize A5oDataKNamedaddr A5oDataKNamesaddr A5oDataKNamedport A5oDataKNamesport A;oData#KNamestartime A9oData!KNameendtime A7oDataKNameseqnum A7oDataKNameconnid $4DTd| PIDsizedaddrsaddrdportsportstartimeendtimeseqnumconnidTEMPP7 [jID EventDataA1oDataKNamePID A3oDataKNamesize A5oDataKNamedaddr A5oDataKNamesaddr A5oDataKNamedport A5oDataKNamesport A7oDataKNameseqnum A7oDataKNameconnid  PIDsizedaddrsaddrdportsportseqnumconnidTEMP(XMSܬm/D EventDataA1oDataKNamePID A3oDataKNamesize A5oDataKNamedaddr A5oDataKNamesaddr A5oDataKNamedport A5oDataKNamesport A1oDataKNamemss A9oData!KNamesackopt A5oDataKNametsopt A5oDataKNamewsopt A7oDataKNamercvwin AAoData)KName rcvwinscale AAoData)KName sndwinscale A7oDataKNameseqnum A7oDataKNameconnid  ,<L\l| PIDsizedaddrsaddrdportsport msssackopttsoptwsoptrcvwinrcvwinscalesndwinscaleseqnumconnidTEMP(֫t=tn4mqD EventDataA5oDataKNameProto AAoData)KName FailureCode ,<ProtoFailureCodeTEMP( ,b/ @ dBDb$/ @8CDb$/ @DDb$/@FDb$/@FDb$/ G,b/ HDb/ IDb/ IDb/ JDb/ LDb/ LDb/ $MDb/ tMDb/ MDb/ NDb/ NDb/0Dbk G,b/ ODb/@RDb$/  SDb/!@!xT,b$/"@"U,b$/#@#W,b$/$@$XDb$/%@%Y,b$/& & [,b4/' 'h\,b4/( (],b4/) )`^,b4/* *_,b4/+ +`,b4/bWEVT9 tkk4tșCHANpkTMicrosoft-Windows-Kernel-File/AnalyticTTBL )TEMP(ng?Fϓd*ϰD EventDataA1oDataKNameIrp A;oData#KNameThreadId A?oData'KName FileObject AEoData-KName CreateOptions AKoData3KNameCreateAttributes AAoData)KName ShareAccess A;oData#KNameFileName nnnno0GVse6t"D EventDataA1oDataKNameIrp A;oData#KNameThreadId A?oData'KName FileObject A9oData!KNameFileKey A7oDataKNameLength A=oData%KName InfoClass A=oData%KName FileIndex A;oData#KNameFileName {{|0|D|X|p|| IrpThreadIdFileObjectFileKeyLengthInfoClassFileIndexFileNameTEMP}ѬQ/qS%D EventDataA1oDataKNameIrp A;oData#KNameThreadId A?oData'KName FileObject A9oData!KNameFileKey @~L~d~~ IrpThreadIdFileObjectFileKeyTEMP؀4׋:=ڜvzD EventDataA1oDataKNameIrp A?oData'KName FileObject AIoData1KNameIssuingThreadId AEoData-KName CreateOptions AKoData3KNameCreateAttributes AAoData)KName ShareAccess A;oData#KNameFileName dpЁ IrpFileObject$IssuingThreadId CreateOptions(CreateAttributesShareAccessFileNameTEMP02D EventDataA?oData'KName ByteOffset A1oDataKNameIrp A?oData'KName FileObject A9oData!KNameFileKey AIoData1KNameIssuingThreadId A7oDataKNameIOSize A9oData!KNameIOFlags A?oData'KName ExtraFlags  4P\xą؅ByteOffset IrpFileObjectFileKey$IssuingThreadIdIOSizeIOFlagsExtraFlagsTEMP qPU?ƘD EventDataA1oDataKNameIrp A?oData'KName FileObject A9oData!KNameFileKey AKoData3KNameExtraInformation AIoData1KNameIssuingThreadId A=oData%KName InfoClass `lĈ IrpFileObjectFileKey(ExtraInformation$IssuingThreadIdInfoClassTEMPx49ͽ`#F/RD EventDataA1oDataKNameIrp A?oData'KName FileObject A9oData!KNameFileKey AKoData3KNameExtraInformation AIoData1KNameIssuingThreadId A=oData%KName InfoClass A;oData#KNameFilePath ̋$H` IrpFileObjectFileKey(ExtraInformation$IssuingThreadIdInfoClassFilePathTEMP܎]ON0D EventDataA1oDataKNameIrp A?oData'KName FileObject A9oData!KNameFileKey AIoData1KNameIssuingThreadId A7oDataKNameLength A=oData%KName InfoClass A=oData%KName FileIndex A;oData#KNameFileName |܏  IrpFileObjectFileKey$IssuingThreadIdLengthInfoClassFileIndexFileNameTEMP 0f߉ %eg(D EventDataA1oDataKNameIrp A?oData'KName FileObject A9oData!KNameFileKey AIoData1KNameIssuingThreadId    IrpFileObjectFileKey$IssuingThreadIdTEMP\E't!k/ciHD EventDataA1oDataKNameIrp AKoData3KNameExtraInformation A7oDataKNameStatus ̓ Irp(ExtraInformationStatusTEMP$KT%Œu5'D EventDataA9oData!KNameFileKey A;oData#KNameFileName ؔFileKeyFileNameOPCO01win:InfoLEVL@PL(win:InformationalTASKT ̗   ,<L\И(@\xNameCreateNameDeleteCreateCleanupCloseReadWrite$SetInformationSetDeleteRenameDirEnumFlush(QueryInformationFSCTL OperationEndDirNotifyDeletePathRenamePathSetLinkPathSetLink CreateNewFileKEYW d @Xț `@KERNEL_FILE_KEYWORD_FILENAME<KERNEL_FILE_KEYWORD_FILEIO<KERNEL_FILE_KEYWORD_OP_END<KERNEL_FILE_KEYWORD_CREATE8KERNEL_FILE_KEYWORD_READ8KERNEL_FILE_KEYWORD_WRITEDKERNEL_FILE_KEYWORD_DELETE_PATHTKERNEL_FILE_KEYWORD_RENAME_SETLINK_PATHLKERNEL_FILE_KEYWORD_CREATE_NEW_FILEEVNT'  @k  @k  k@k  ~@ k  |@ԕ(k  8@ԕ,k |@0k 8@4k po@ 8k ,@ @k po@(Hk ,@(Pk r@DXk @D\k r@``k @`dk r@|hk @|lk x@pk x@tk |@xk 8@|k r@Жk @Жk r@k @k`D@k x@$k x@$ku@@k@@ku@\k@\ku@xk@xk r@|k @|kk@k~@Ĥkԙԙ$$44DDDDTTWEVT0ĥTCHANdLHMicrosoft-Windows-PCI/DiagnosticOPCO01win:InfoLEVL@Pܥ(win:InformationalTASKP ,(AspmErrataRundownKEYW,pDiagEVNTD  Х<`WEVTt,,ܨ<||@CHANX\Microsoft-Windows-Kernel-StoreMgr/Analytic`Microsoft-Windows-Kernel-StoreMgr/OperationalMAPSL(VMAP$VMAP$p4CacheTerminationMsgMap8StoreMgrCorruptPageMsgMapTTBL TEMP|dLBD EventDataA?oData'KName FailReason A?oData'KName FailStatus AKoData3KNameObjectPathLength A?oData'KName ObjectPath 4\FailReasonFailStatus(ObjectPathLengthObjectPathTEMP <i.G&o2BPD EventDataA3oDataKNameSize A3oDataKNameData dtSizeDataTEMPx 7$X8ZŐD EventDataA;oData#KNameStoreKey A3oDataKNameSize A3oDataKNameData StoreKeySizeDataTEMP9KQ0VJg0D EventDataA;oData#KNameStoreKey A5oDataKNameParam StoreKeyParamTEMPL(#eʻ D EventDataA7oDataKNameReason A?oData'KName FailStatus AKoData3KNameDeviceDescLength AMoData5KNameDeviceDescription AKoData3KNameObjectPathLength A?oData'KName ObjectPath L HReasonFailStatus(DeviceDescLength(DeviceDescription(ObjectPathLengthObjectPathTEMP`,eCj{FD EventDataA9oData!KNameSqmType AGoData/KNameSqmSessionGuid A5oDataKNameSqmID AOoData7KNameSqmStreamRowLength AQZ ComplexData+KName SqmStreamRow @`SqmType$SqmSessionGuidSqmID,SqmStreamRowLength SqmStreamRow SqmTypeEntry SqmDWORDEntry$SqmStringEntryOPCOx12 2$win:Infowin:Startwin:StopLEVL@PT(win:InformationalTASKd|< X t   4TStoreAddStoreRemoveStoreCreateStoreDelete StoreRundown$StoreCorruption(StorePageRundownRegionEvictRegionWrite(UnpersistFailure StoreIoStatsGlobalStatsStoreEmpty RegionRelease RegionCompact RegionRundown(CacheTerminationKEYW@4(StoreOpsStoreDiag0StoreContentsRundownwin:SQMEVNTH8dH8H8pH8H8P@,HHH08HL8  Hh8  P@8HH  H8  xH8  H8H8H 8H$8H,(8P@HH,HdH4WEVT<HxTTBLPTEMPD$9vDf>BD EventDataA9oData!KNameSqmType AGoData/KNameSqmSessionGuid A5oDataKNameSqmID AWoData?KNameSqmDWORDDatapointValue tSqmType$SqmSessionGuidSqmID4SqmDWORDDatapointValueOPCOLEVL@P(win:InformationalTASKKEYW04dwin:SQMEVNTDTWEVT$HCHANt@XMicrosoft-Windows-Kernel-Memory/AnalyticTTBLTEMP 8 rH*Պ1^D EventDataAGoData/KNamePriorityLevels AEoData-KName ZeroPageCount AEoData-KName FreePageCount AMoData5KNameModifiedPageCount A[oDataCKNameModifiedNoWritePageCount ACoData+KName BadPageCount AMoData5KNameStandbyPageCounts ASoData;KNameRepurposedPageCounts A]oDataEKNameModifiedPageCountPageFile AOoData7KNamePagedPoolPageCount AUoData=KNameNonPagedPoolPageCount ACoData+KName MdlPageCount AIoData1KNameCommitPageCount <` Hx ,$PriorityLevels ZeroPageCount FreePageCount(ModifiedPageCount8ModifiedNoWritePageCount BadPageCount(StandbyPageCounts0RepurposedPageCounts8ModifiedPageCountPageFile,PagedPoolPageCount0NonPagedPoolPageCount MdlPageCount$CommitPageCountTEMPp4yDnK'+dD EventDataA5oDataKNameCount AQZ ComplexData+KName WSCommitInfo 4XCount WSCommitInfoProcessID,WorkingSetPageCount$CommitPageCount,VirtualSizeInPages<PrivateWorkingSetPageCountTEMPIC޾?D EventDataA5oDataKNameCount A_Z ComplexData9KNameSessionWSCommitInfo <Lx Count,SessionWSCommitInfoSessionId,WorkingSetPageCount$CommitPageCount,PagedPoolPageCount<PrivateWorkingSetPageCountTEMPLL_/6p}d^D EventDataA=oData%KName ProcessId ProcessIdTEMP(2w ?'iD EventDataA=oData%KName ProcessId A7oDataKNameStatus AGoData/KNamePagesProcessed d|ProcessIdStatus$PagesProcessedTEMP$i.tҺ7nD EventDataA=oData%KName ProcessId A7oDataKNameStatus ProcessIdStatusTEMPh%JPSR.9mlJZD EventDataA9oData!KNameAcgFlag |AcgFlagOPCOx122win:Infowin:Startwin:StopLEVL@P (win:InformationalTASKd(PxMemInfoMemInfoWS(MemInfoSessionWS(WorkingSetOutSwap(WorkingSetInSwap AcgKEYW8 @4t<KERNEL_MEM_KEYWORD_MEMINFO@KERNEL_MEM_KEYWORD_MEMINFO_EX<KERNEL_MEM_KEYWORD_WS_SWAP4KERNEL_MEM_KEYWORD_ACGEVNT Tx0@Pp|0@0H00H000WEVT1\P HCHAN\<XMicrosoft-Windows-Kernel-ShimEngine/DebugdMicrosoft-Windows-Kernel-ShimEngine/OperationaldMicrosoft-Windows-Kernel-ShimEngine/DiagnosticMAPSpVMAP$VMAP$LKSE:DeviceFlagApplied.FlagSourceMapLKSE:DriverShimApplied.ShimSourceMapTTBL(TEMP44as 7!#δD EventDataA9oData!KNameEventId ACoData+KName DebugMessage \pEventId DebugMessageTEMP(bo>ǧw,ܞV(4D EventDataA?oData'KName DriverName A?oData'KName ShimSource A=oData%KName ShimCount ACoData+KName AppliedGuids HpdDriverNameShimSourceShimCount AppliedGuidsTEMPl= ofC*D EventDataA?oData'KName DeviceName AAoData)KName DeviceClass A?oData'KName FlagSource A5oDataKNameFlags  h DeviceNameDeviceClassFlagSourceFlagsTEMPj%D EventDataA9oData!KNameAddress A7oDataKNameCaller A1oDataKNameTag AddressCaller TagTEMP|y@Q@ ߱D EventDataACoData+KName DriverObject A1oDataKNameFdo A1oDataKNameIrp <H DriverObject Fdo IrpTEMPHCV$>jD EventDataACoData+KName DriverObject A1oDataKNameFdo A?oData'KName DeviceType AUoData=KNameDeviceCharacteristics A=oData%KName Exclusive A7oDataKNameStatus 8P DriverObject FdoDeviceType0DeviceCharacteristicsExclusiveStatusTEMPT_}:+eac?VD EventDataACoData+KName DriverObject A1oDataKNameFdo A1oDataKNameIrp A=oData%KName MajorCode A7oDataKNameStatus Tt DriverObject Fdo IrpMajorCodeStatusTEMPTD  o.gl )H)VD EventDataACoData+KName DriverObject A1oDataKNameFdo A1oDataKNameIrp A=oData%KName MinorCode A7oDataKNameStatus       DriverObject Fdo IrpMinorCodeStatusTEMPT 2 {osegcQD EventDataACoData+KName DriverObject A1oDataKNameFdo A1oDataKNameIrp A7oDataKNameStatus      DriverObject Fdo IrpStatusTEMP8 2 {osegcQD EventDataACoData+KName DriverObject A1oDataKNameFdo A1oDataKNameIrp A7oDataKNameStatus      DriverObject Fdo IrpStatusTEMP8]1D EventDataACoData+KName DriverObject A1oDataKNameFdo A1oDataKNameIrp A=oData%KName MinorCode A=oData%KName PowerType A?oData'KName PowerState A7oDataKNameStatus t DriverObject Fdo IrpMinorCodePowerTypePowerStateStatusTEMP8 ]1D EventDataACoData+KName DriverObject A1oDataKNameFdo A1oDataKNameIrp A=oData%KName MinorCode A=oData%KName PowerType A?oData'KName PowerState A7oDataKNameStatus 0 DriverObject Fdo IrpMinorCodePowerTypePowerStateStatusTEMP2ԵR D EventDataACoData+KName DriverObject A1oDataKNameFdo A1oDataKNameIrp A=oData%KName MinorCode A?oData'KName PowerState A7oDataKNameStatus  DriverObject Fdo IrpMinorCodePowerStateStatusTEMPT2 {osegcQD EventDataACoData+KName DriverObject A1oDataKNameFdo A1oDataKNameIrp A7oDataKNameStatus  DriverObject Fdo IrpStatusOPCO01win:InfoLEVLPPPhUwin:Error(win:Informationalwin:VerboseTASKKEYW4\$(ShimEngineEvents,ShimEngineMessages,DriverScopeGeneral$DriverScopePnp(DriverScopePower$DriverScopeIrps$DriverScopePoolEVNT\, \8 @8@8  D,  D,  D,  4D, dD, D, TD, dD, D, D , D, D, D, DD, D ,$$WEVT OPCOLEVL@P(win:InformationalTASKKEYWEVNT@WEVT  !@!!p""CHANx \Microsoft-Windows-Kernel-IoTrace/DiagnosticOPCO01(!win:InfoLEVLhPd!U!(win:Informationalwin:VerboseTASK","D"$UserInitiatedIoKernelIo,ActivityIdTransferKEYWEVNT!L!! !X!! !X!! !L!! WEVT@:#8%C0DDJ8KCHAN$  $|$$Application\Microsoft-Windows-AppModel-Runtime/AnalyticXMicrosoft-Windows-AppModel-Runtime/AdmindMicrosoft-Windows-AppModel-Runtime/DiagnosticsTTBLTEMPtl'YKU1/dAD EventDataA=oData%KName ProcessID A?oData'KName CreateTime AIoData1KNameParentProcessID AIoData1KNamePackageFullName A=oData%KName ImageName AcoDataKKNamePackageRelativeApplicationId ''(<(`(x(ProcessIDCreateTime$ParentProcessID$PackageFullNameImageName@PackageRelativeApplicationIdTEMP)xzV/ңaD EventDataAIoData1KNamePackageFullName A=oData%KName ErrorCode ACoData+KName ErrorMessage  *D*\*$PackageFullNameErrorCode ErrorMessageTEMP+zn7/6rD EventDataAIoData1KNamePackageFullName A=oData%KName ErrorCode ACoData+KName FailedBinary +, ,$PackageFullNameErrorCode FailedBinaryTEMP,pgT;OIt^D EventDataA=oData%KName ErrorCode ,ErrorCodeTEMP@/WKLg:4B=D EventDataA;oData#KNameFileName A=oData%KName ErrorCode A3oDataKNameSize  A7oDataKNameOffset A?oData'KName HeaderAddr A9oData!KNameSection A=oData%KName ProcessId // ///0(0FileNameErrorCodeSizeOffsetHeaderAddrSectionProcessIdTEMP2v'>gD EventDataA;oData#KNameFileName A=oData%KName ErrorCode A3oDataKNameSize  A?oData'KName HeaderAddr A9oData!KNameSection A=oData%KName ProcessId 22 2223FileNameErrorCodeSizeHeaderAddrSectionProcessIdTEMP5⓼vy$D EventDataA;oData#KNameFileName A=oData%KName ErrorCode A3oDataKNameSize  A?oData'KName HeaderAddr AWoData?KNameApplicationUserModelId A=oData%KName ProcessId 55 5556FileNameErrorCodeSizeHeaderAddr4ApplicationUserModelIdProcessIdTEMPp7>q@dD EventDataA;oData#KNameFileName A=oData%KName ErrorCode A3oDataKNameSize  A?oData'KName HeaderAddr A=oData%KName ProcessId ,8D8 \8l88FileNameErrorCodeSizeHeaderAddrProcessIdTEMP9nJ],5ED EventDataA;oData#KNameFileName A=oData%KName ErrorCode A=oData%KName ProcessId 9 :$:FileNameErrorCodeProcessIdTEMP<;8qB &D EventDataA;oData#KNameFileName AEoData-KName ExceptionCode @;X;FileName ExceptionCodeTEMP(L<fG%+8D EventDataA=oData%KName ErrorCode A9oData!KNameContext t<<ErrorCodeContextTEMP(t=fG%+8D EventDataA=oData%KName ErrorCode A9oData!KNameContext ==ErrorCodeContextTEMP\>pgT;OIt^D EventDataA=oData%KName ErrorCode p>ErrorCodeTEMP(?]eIw,OzlD EventDataAKoData3KNameAppContainerName TD\#( (>TD\#) )>TD\#* *>TD\#+ +3 ><@CTDF ]#ffx;CTDF$]#gg>CTD4F(]#hhx;CTD4F,]#ii>CTDPF0]#jjx;CTDPF4]#kk>CTDlF8]#ll<CTDlF<]#mm>CTDF@]#nn<CTDFD]#odo>CTDpEH]#pdp<CTDpEL]#qeq>CTDEP]#rer<CTDET]#sfs>CTDEX]#tft<CTDE\]#ugu>CTDE`]#vgv<CTDEd]#whw>CTDEh]#xhx<CTDEl]#yiy>CTDEp]#ziz<CTDEt]#{{d?CTDDx]#||<@CTDD|]#}}d?CTDE]#~~<@CTDE]#d?CTDE]#<@CTDE]#JJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJWEVT3]_a4bb{|CHAN4^ P^^ApplicationTMicrosoft-Windows-AppModel-State/Debug\Microsoft-Windows-AppModel-State/DiagnosticTTBLTEMP(_txL;>D EventDataAAoData)KName ErrorString A5oDataKNameError `$`ErrorStringErrorTEMPTaZ?!)= KD EventDataACoData+KName FolderString AEoData-KName PackageString A5oDataKNameError aaa FolderString PackageStringErrorOPCOT2b2bwin:Startwin:StopLEVLdPXbPpbwin:Error(win:InformationalTASK*F.FΏfUzD EventDataAqoDataYKName#NtEstimatedRequiredPrimaryDataBytes AaoDataIKNameNtEstimatedPrimaryDataBytes  AaoDataIKNameHvEstimatedPrimaryDataBytes  AeoDataMKNameHvEstimatedSecondaryDataBytes   t   8LNtEstimatedRequiredPrimaryDataBytes<NtEstimatedPrimaryDataBytes<HvEstimatedPrimaryDataBytes@HvEstimatedSecondaryDataBytesTEMP̘62cb<Wphn. D EventDataAOoData7KNameNtPrimaryDataBytes AOoData7KNameHvPrimaryDataBytes  ASoData;KNameHvSecondaryDataBytes    4 `,NtPrimaryDataBytes,HvPrimaryDataBytes0HvSecondaryDataBytesTEMPXhփA}8D EventDataA;oData#KNameNTStatus A?oData'KName TotalBytes  AAoData)KName HeaderBytes  AKoData3KNamePrimaryDataBytes  AOoData7KNameSecondaryDataBytes   ԛ   4NTStatusTotalBytesHeaderBytes(PrimaryDataBytes,SecondaryDataBytesOPCO c d  e4 flghĝijkHlpmvĞwAPIStartAPIEnd8WriteDumpDataToFileStart4WriteDumpDataToFileEnd$MirroringStart,MirroringPhase0End,MirroringPhase1End,SystemQuiesceStart(SystemQuiesceEnd,PageBufferingStart(PageBufferingEnd(BufferEstimation(BufferAllocationLEVL@P,(win:InformationalTASKNO$PdQR8LIVEDUMP_TASK_CAPTURE_API@LIVEDUMP_TASK_SIZING_WORKFLOWPLIVEDUMP_TASK_CAPTURE_PAGES_WORKFLOWPLIVEDUMP_TASK_WRITE_DEFERRED_DATA_APITLIVEDUMP_TASK_DISCARD_DEFERRED_DATA_APIKEYWEVNT _l ` `dx ` a ` b `eS |fT |gU |hV |iW̜ |jt  |kux |X Y Z [ \̜ ]؜ ^  nl  odx  p  q  rl П sdx ПHnڭYlO/^:r%u * WEVT_TEMPLATEMUIMUI en-US