MZ@ !L!This program cannot be run in DOS mode. $vb?2Q2Q2Q0Q2PZQ/Q=Q3Q>Q3Q3QRich2QPELFPT!  f0e@A uuP, X&\Lq.textef `.datap j@.idata l@@.didatlx@.rsrc z@@.relocX@Bp'cp',p90;;?@BPaPbceh@lpll`nnnnnoo oPo`opooooopp p0p@pPpppFPT%$'$8api-ms-win-service-management-l1-1-0.dllapi-ms-win-service-management-l2-1-0.dllADVAPI32.dllole32.dllKH ݪ&Y&D9?]Jc#Kb 6o F!k /([s?UFQv-sBY.H{P,rF~ă%t\ aKGԋGpGNҎ*ͫnk7E77+q9>bOnyZ'F?wMW'S 2Q^_KtIl*M_; ݙ FK#EWN8y"w8Ow"[0}}J\f@D֠NG<=RPCRT4.dllCRYPT32.dll1.3.6.1.4.1.311.47.1.1SYSTEM\CurrentControlSet\Services\NapAgent\LocalConfigSoftware\Policies\Microsoft\NetworkAccessProtection\ClientConfigPlumbIpsecPolicy<NULL>NULLNULLMYCertOpenStorenet\quarantine\ipsec\rp\certstore.cppCertControlStoreFindValidHealthCertsInitializeTimerQueueSetTimerSetEventHealthCertInfo::CopyFindDeletedHealthCertsFindNewHealthCertsHealthCertInfo::CopyFromHealth cert has been deleted. Its properties were -- Found unexpired health cert - FindHealthCertInfoFound valid health cert. Its properties are - GetPropertyFindRootIssuerCertGetCertificateContextPropertyCertGetCertificateChainCreateTimerQueueCreateTimerQueueTimerNAP_MEM_ALLOC|Bg0w.|POpenKeynet\quarantine\ipsec\rp\qecconfig.cppRegisterForChangesEnterCriticalPolicySectionQueryValue(PlumbPolicy)RegisterGPNotificationnet\quarantine\ipsec\rp\napipsecdefs.cpp2^g BFEIpsecRpnet\quarantine\ipsec\rp\napipsecrp.cppNapIPSecEnfCEventLog::InitializeNapFwpInitInitializeEventsAndThreadSvcChangeNotifier::InitializeQecConfig::InitializeCertStore::InitializeCreateAndSubscribeNapAgentCreateEventCreateThreadCoCreateInstanceINapCertRelyingParty::SubscribeWaitForMultipleObjectsPlumbPolicyCertStore::ProcessChangeNotificationCertStore::ReallyProcessChangeNotificationQecConfig::ReadPlumbPolicy/bwLXATx-[Nnxdk6EY+}W@(вqFwpmEngineOpen0net\quarantine\ipsec\rp\nap_fwp.cppNapFwpAddDefaultProviderContextsNapFwpAddDefaultFiltersIkeextSaCreateEnumHandleIkeextSaEnumFwpmProviderContextGetByKeyUuidCreateIpSec NAP Precanned MM PolicyFwpmProviderContextAddIpSec NAP Precanned QM PolicyNapFwpAddDefaultMMProviderContextNapFwpAddDefaultQMProviderContextIpSec NAP Precanned FilterFwpmFilterAdd0FwpmFilterAddMM filter: For all traffic, use IPSec NAP pre-canned MM policyNapFwpAddDefaultMMorQMFilterQM filter: For all traffic, use IPSec NAP pre-canned QM policyFor all outbound unicast traffic, use Ipsec and do negotiation discoveryNapFwpAddDefaultTransportOrAleFilterFor all inbound unicast traffic, use Ipsec and do negotiation discoveryAllow all outbound ICMP trafficNapFwpAddDefaultIcmpFilterAllow all inbound ICMP trafficBlock traffic when NAP Context is NULLAllow only secure inbound traffic at the ALE layerNapFwpAddDefaultTransportOrAleFiltersForProtectedZoneAllow all inbound ICMP traffic at the ALE layer5~pRsmUIn&QVq_G$net\quarantine\ipsec\common\src\registryhelper.cppRegQueryValueExWRegQueryValueExW - wrong typeQueryValueEnginenet\quarantine\ipsec\common\src\eventlogger.cppC׊ﬗ p>oOpenSCManagernet\quarantine\ipsec\common\src\svcchange.cppOpenServiceCoInitializeExNotifyServiceStatusChangeWaitForSingleObjectExServiceStatusChangeNotifyCallback\`'L&5RSDSx!Iccnapipsec.pdb@lhpBY̋UjQRj+u u@]̋UjjEPQRj+u u@ ] ̋UjjEPjEPjhj+u u@(]̋UQQM3ESVWj^t*f9u$3ۍzff;u+3Uj [t f9u Ut'f9t%FEff;Eu+u4uj ^3t f9t PSQVWjhjhj+u u@0_^[]̋UQSVWh$h3ۋSSj 0Љu'4~ Vh,j&M_^3[l9]̋UQQSVډMW}SCPWy fMCPC PyVhn?u'$=$@ppjMCPWy|>?u$=$ti@tcppjNMCPWyVh|HM,*?u1$=$t@tppjY?u_^[]̋UQQE3S]VW} WRjQM$E4= t$9uu54~ 9uu4= u33@M7jTPPuVh|HO+?WPju$uJ4~ VhH+y;t3jTPL#'_^[] ̋UQSVW}EPu 3ERQ$4= t0uA4؅~ ہShH*u4= u3@_^[]̋UES3VE W}u3]EPSSEEPSSQju/4؅~ ہShH)M9Yt2$=$@qqpp9Y tpAP td@DpF pjTPPȋE u0Sh|gF ppQ==F M@E*$=$t@tppjYMtQ_^[]̋V3VVhQh,P u*4~ VhPH(^̋V񋆼tjP^̋USVWWj)yVhj+OE3jPG(u'4~ Vhp'y$Vhj1Z')w$g_^[]̋U eeS] VWjM u4~ VhjReEXPh(xEPQM(W,;uEPQM _(+#yVh@jtZ& }EM(_^[]̋UMSV3Wt&f9ujэrff;u+~sjTPPuPh|j,&s jTPPFu#Ph|j/ZQ%1 s3689 s sv'9 _^[]̋SV3W9vC;r&_^[̋U3ʼnES]VWjdF $F(,Pj$Ph =$$t1Gt+vVvDPPjR,PSwwM_^3[~0]̋UjjEPjEPjEPj hHj+u u@0]̋UjjEPQhHj+u u@ ] ̋UjjEPjhHj+u u@ ] ̋UjjEPjEPQhHj+u u@(]̋UjjEPjEPjhHj+u u@(]̋UQES3Vu EWtHtjWXHÊ#u<WS8WSE4UFt Nt^~VF3_^[]̋UQQV5$W,FePjjEMPjQVhp9N 06u_^]̋UQ} SVWugu\3pX$p]$=$t@typHpj Yd} u^5$$;tOFtvHvj Y5$;t,t"3ۋF F tv vD^^ 6u=$_3^@[] ̋UVW$$;t@tpHpj Y4$;t@tVppj Y!%=u_^]̋UVW$$H;t@tppjYuk$;t@tppjY_^]̋S33VWfVShLă08<@DH,4VSh04VSh3$ 3ȃjY_^[̋UQ3EVT@@E}u hQ!yVh4 yVh`_yVhx5ЃQz"yVh5ԃ8y Vhp5܃@5؃y VhG$=$t@tpHpjY5ȃyVh@QQj !yj ^]̋UVu>t P tjQ 3tPD 5t QD5t PL585054}5<$@5<$=$t@tpHpjYb$95tJQQjăt P5ă}^]̋UEttw w]̋QVWj3_VVVVtG rVVhh@BVVtuZ4~ Vh 4~ Vhxuy 8 _^Y̋Vj^D r^̡̃tPtjP5D%̋UQQ3ʼnEeVWh h8jjhl\y Wh=8 MQhh0h7PN LV yWhEt $=$t@tuppny! tQpLփ% M_3^G']̋UQQ3ʼnE Vt]}u@jh7QpL֋ $$tAtPqqjY QpLփ% M3^&]̋UVW$$;t@tpHpjY$M@$;t@tVppjY%=u_^]̋UQSVWE3jjGPj؃;$=$t@tSSppjY$˃IIItaIt=IDVh@y`VhXyCVh@(u2y Vh@zEx:$=$t@tSSppjY}tIVh-Vh@ 4~ Vhn_^[]̋UQSVWEEEPEPOx؅ySh25$$t!FtEPEPvvj5$PptbltIH;u>Q0+ u#$t8Ft2vHvjYkp}tP__^[]̃=Vt5'$=$t@tpHpjYQQj^̋USVWu$$tBtWvvrr3QH%?QPO_^[]̋UjjEPjEPQhh$j+u u@(]hDjht*%8 3ҹpB jX$, <@T3̋UQeESVWPjjj jĐt~ VhhzuW wOw y VhS]Ӌjy7jӋy0;VhxyVh_ }t uȐey_^[]̋UQQVW3EPWWj W}Đt!~ Phh6u4\ֹċPM hDWh( 9}t uȐ_^]̋USV3ۍEWPSSj S]]]]]Đt VhhbEPSu̐t Vh$4EPEPjuuАt) VhXN$=$t@tuh$ppj Y9]EPEPuԐMEA(t HMI,U}E A|t|8t8t8t8t 8 t8 u^@tW@uQq1uؐ $$t AtEWp0qqj Y5t }tEPܐeC;] $ Vht%3ۃ}t EPܐ]}t EPܐ}tuu]}t uȐ_^[]̋USV3ۍEWPSSj S]]]]]Đt VhhbEPSu̐t Vh$4EPEPjuuАt) VhX~N$=$t@tuh$ppj YQ9]EPEPuԐMEA(t HMI,Ur}E A|t|8t8t8t8t 8 t8 u^@tW@tQq1uؐ $$t AtEWp0qqj Yt }tEPܐeC;] $ Vht-3ۃ}t EPܐ]}t EPܐ}tuu]}t uȐ_^[]̋ $$$SV5$3Wj_=TC=hj=x=_ HL  x$|$==؊_5\` 5Ċ ̊6iЊ^|XHl\pt6iT6ih܊  ؊[̋U3ʼnEESVWjىEYd33`j4REUPUU-" ]3u}E3Džpj YE]E3ɉEAEMhEPM]MdDžt<t ؁Sh DS`EEESPuEt& ؁ShS uM_^3[^]̋Uh3ʼnEESVW3ۉEj4EUSP]! ]3}jYNt NuEEpEMuMEEPE,E<<t ؁Sh[ASEE0EESPuEt& ؁Shh: $uM_^3[E]̋UVuy VhpuU MyVh ^] ̋U3ʼnESVW3}u3ٺΫ};uAuRSU$;uFuQSM_^3[q]̋U3ʼnEESVP3ۋE WXEhT`SP\ \P<t ؁Shjp\DžlDžt}SSPXP}Et& ؁Sh4K T\M_^3[R] ̋U3ʼnEESV03ۋEW@Eht 6&^̋UjjEPj h%j+u u@ ] ̋UjjEPjEPjEPj h%j+u u@0]̋Vh3Vfău(4~ Vh4jZX%x^̋UQESV3+tHt Ht3A jjY#fu/fux& $$tPAtJuSRqq 8BtVVVVVuVQP$=$t@t Rpp^[Y] ̋UQE SVW3jVVGLGPD؅u-4~ Vh%j4Z%pjhSHu4~ Vh%j;n3PPPPGu4~ VhxjD<3ɍEPQWhPaQQMtG u(4~ VhjYZ%SLy6?t 7L't wDg t w Dg _^[]̋U}VujWX7jj`yVh%%2Md^]̋QVW~jjvtw=uQjtt~~  O;:u C(;]r_^[]hd`Yu@à 3̋U3ʼnE} SVW0HX03d}p;t/h3 u=\tjY`3FudEti`E];r:9;t3Ή;L֋d `9UuE9Mt΋‰UEىMPuXY=`=d=\33} d3Xp;t-h3 u9=\j_tj:3Fhh \[YYuhhY=\Yu3=lt&hlYtu5lWuL03@M_^3[?] ̋U} uh]*̋Ucsm9Eu u PYY]3]j0hpE3uE w} u=0uu9E t =htNE} u 4uu uL׉EMEQPDYYËe3uu}Euu uEMEQPYYËe3uu}Euu uCEMEQPYYËe3uu} }EVVuMEQPxYYËe3uEVVuHMEQPIYYËe3u=ht4EVVuLMEQP YYËe3uE t Euu uEMEQPYYËe3uu=htG=4t>Euu uL׉EMEQPtYYËe3uuE E } w ̋UQ3ʼnEVu3;u sWu>t L׃;u r_M3^ ]; ujhXqedEuu5LYTjYedE`E܍EPEPu u؋M dM܉ `E ËujFY̋UuUYH]%$%̋UE3SVWH<AYt} p ;r H;r B(;r3_^[]̋Ujhxqh@ldPSVW1E3PEdeEhtTE-PhPt:@$ЃEMd Y_^[]ËE3Ɂ8ËeE3Md Y_^[]̋UEMZf9t3]ËH<39PEu f9Q]̋UeeVWN@;t t УjEPE3EEp1Eh1E3EM3EEP|E3EM3;t5uO@ щ _^]%h@ld5D$l$l$+SVW1E3ʼnEPeuEEEEdËM3̋Uuuu uhhh]̋Uj8u<h dPl]̋U$8 40,5(=$fPf Df ff%f-HE<E@EL@D8 <HjXkǀLjX LjX LjXk LjX Lh]% %%h@ld5D$l$l$+SVW1E3PeuEEEEdËMd Y__^[]Q%̸LQRPhqZY̸D̸H̸TQRPhqZYQRPhq}ZY̸̸̸̸\QRPhq#ZY̸d̸`̸<QRPhrZY̸0QRPh4rZY̸̸̸4̸,̸(̸$̸u̸e̸ ŰUju hp5uh]%%% %%(|hvfffffgBgVgqggggg hFhZhijjTDrt XTrtP\trt``\rtd<rthrtfs6sNsssltttHt*ttsssrsrsvsssCloseServiceHandleOpenSCManagerWOpenServiceWNotifyServiceStatusChangeWRegisterEventSourceWDeregisterEventSourceReportEventWCoCreateInstanceCoUninitializeCoInitializeExUuidCreateCertOpenStoreCertControlStoreCertCloseStoreCertFindCertificateInStoreCertVerifyTimeValidityCertFreeCertificateContextCertGetCertificateContextPropertyCertGetCertificateChainCertFreeCertificateChainCertNameToStrW.PT\uHuPuXu0;;iu~uNapIpsec.dllInitializeNapIpsecRpUninitializeNapIpsecRpN@D?$\D,ܙdޕʖz8H$FėRbxJ<Nb~Ę֘(\8" ֓ȓȚ~dR̔plt,0:4rDȒLؒ\Vޖd"|̗0<v |v\D,ܙdޕʖz8H$FėRbxJ<Nb~Ę֘(\8" ֓ȓȚ~dR̔q_XcptFilter_amsg_exitfreemalloc_inittermb_lock_unlock__dllonexit _onexitmsvcrt.dlll_except_handler4_commonQEtwTraceMessageEEtwGetTraceLoggerHandleDEtwGetTraceEnableLevelCEtwGetTraceEnableFlagsLEtwRegisterTraceGuidsWSEtwUnregisterTraceGuidsntdll.dllGetLastError UnhandledExceptionFilter SetUnhandledExceptionFilterapi-ms-win-core-errorhandling-l1-1-1.dllCloseHandleapi-ms-win-core-handle-l1-1-0.dllHeapAllocGetProcessHeapHeapFreeapi-ms-win-core-heap-l1-2-0.dllDisableThreadLibraryCallsapi-ms-win-core-libraryloader-l1-2-0.dll!RegQueryValueExWRegOpenKeyExWRegCloseKeyapi-ms-win-core-registry-l1-1-0.dllCreateThread GetCurrentProcessIdGetCurrentThreadId GetCurrentProcessATerminateProcessapi-ms-win-core-processthreads-l1-1-2.dllQueryPerformanceCounterapi-ms-win-core-profile-l1-1-0.dll'SetEventCreateEventW3WaitForSingleObjectInitializeCriticalSection DeleteCriticalSection4WaitForSingleObjectEx+Sleepapi-ms-win-core-synch-l1-2-0.dllGetSystemTimeAsFileTimeGetTickCountapi-ms-win-core-sysinfo-l1-2-1.dll&FwpmEngineOpen0#FwpmEngineClose0IkeextSaCreateEnumHandle0IkeextSaEnum2fFwpmProviderContextGetByKey2IkeextSaDeleteById0:FwpmFreeMemory0IkeextSaDestroyEnumHandle0XFwpmProviderContextAdd1YFwpmProviderContextAdd2\FwpmProviderContextDeleteByKey0-FwpmFilterAdd00FwpmFilterDeleteByKey0fwpuclnt.dll6UnregisterGPNotificationEnterCriticalPolicySection(LeaveCriticalPolicySection/RegisterGPNotificationUSERENV.dllCreateTimerQueue DeleteTimerQueueExCreateTimerQueueTimerDeleteTimerQueueTimerWaitForMultipleObjectsKERNEL32.dllDelayLoadFailureHookResolveDelayLoadedAPI memcmp memcpymemsetonooo0p@pPp pppooponn`nn o`oPo(@Xp    WEVT_TEMPLATEMUI4VS_VERSION_INFOD%D%? StringFileInfo040904B0LCompanyNameMicrosoft CorporationbFileDescriptionNAP IPSec Enforcement Clientp(FileVersion6.3.9600.17415 (winblue_r4.141028-1500): InternalNameNAPIPSec.DLL.LegalCopyright Microsoft Corporation. All rights reserved.B OriginalFilenameNAPIPSec.DLLj%ProductNameMicrosoft Windows Operating SystemBProductVersion6.3.9600.17415DVarFileInfo$Translation CRIMW+LɊ$WEVT(4TTBLTEMP(b<AYD EventData;KNameNAP_IPSEC_RP_STARTEDTEMPe"!q-AYD EventData;KNameNAP_IPSEC_RP_STOPPEDTEMPLE}kJ!^-&A]D EventData?KNameNAP_IPSEC_POLICY_ADDEDTEMP[\7'4`nAaD EventDataCKNameNAP_IPSEC_POLICY_DELETEDTEMPG'hmw(AgD EventDataIKNameNAP_IPSEC_POLICY_ADD_FAILEDTEMPMH3A[D EventData=KNameNAP_IPSEC_SAS_DELETEDOPCOLEVLTASKKEYWH8P,win:EventlogClassicEVNTH(L@@@@@@g+e\k_ &y|q* WEVT_TEMPLATEMUIMUI en-US0000 7777v77778\8n88888899)909N9X9m9999999:0:G::::::::;>;H;;;;9,>J>_>>>>> ?1?;?G????0#0(0]0b0s0x000001>1E1[1`1t1~11111122&202A2222222=3D3_3333333444K4h444444444%515F5R5~555(6/6U6~66666677,7;7B7T7\778888888889%9K9Y999999:%:Q:Y:c:i:o:u:y::::::::::;;;;@;R;i;;;;;'<.<4<:<@ >>&>6>j>u>z>>>>>>>>>>>>>>>>>>>???$?:?J?T?_?e????????@0000:0d0j0p000000000000001 11"111;1G1L1l1~1111111222K2P2b2|22223Z3{3333344"474A444444 55Y5i5n5~5556+6C6N6`6f6o6t6z6666662777F7P7]7p77777778I8b8w88888888"99999:!:8:K:]:o:::::;';1;@;E;U;;<<> >>>>!>'>->2>8><>S>>> ?!?9?R?\?h????PL0(0:0R0k0u0000011>1F1^1111 2A2Z2d222"3;3g333344455?5L555556;6Y6^666#7<7h77777 8888+8:8A8J8O8V8[8l8{888888888888888 99 9)9.959O9V9_9d9k99999999999999::#:E::::: ;.;Q;t;;;;;R(>V>}>>>>>>? ???/?7??????`h00"070?0P0W0c0x0000000000 1121g1s1}111112 22+2:2l2v223333333 44:4G4d4l4r4444444455$5*5>5C5O5^5f5y555566?6V6k6778 8;88888899959=9a9j999(:-:?:]:q:w:9;T;`;o;x;;;;;;;;;RL>a>s>>>>>>>??!?3?Q?a?q???????pL00!010A0Q0j0p0x00000000011111 1(1,14181@1D1L1P1p1110 0$0 L140000000 0$0(0,00040<0D0H0L0T0\0`0d0