MZ@ !L!This program cannot be run in DOS mode. $|!f8O58O58O5159O58N5SO515O5159O5153O515(O5159O5159O5Rich8O5PELn[J!  x&o@@@u{hx (,@xh x.textvx `.data~@.rsrcx @@.reloc @Bo[J[J[J[J[J[J[J([JO[Jx[J[J[J[J[J[J[J/[JR[Jx1[J[Jmsvcrt.dllntdll.dllAPI-MS-Win-Core-ErrorHandling-L1-1-0.dllAPI-MS-Win-Core-Handle-L1-1-0.dllAPI-MS-Win-Core-Heap-L1-1-0.dllAPI-MS-Win-Core-Interlocked-L1-1-0.dllAPI-MS-Win-Core-LibraryLoader-L1-1-0.dllAPI-MS-Win-Core-LocalRegistry-L1-1-0.dllAPI-MS-Win-Core-Misc-L1-1-0.dllAPI-MS-Win-Core-ProcessThreads-L1-1-0.dllAPI-MS-Win-Core-Profile-L1-1-0.dllAPI-MS-Win-Core-Synch-L1-1-0.dllAPI-MS-Win-Core-SysInfo-L1-1-0.dllAPI-MS-Win-Core-ThreadPool-L1-1-0.dllfwpuclnt.dllUSERENV.dllKERNEL32.dll oouooo'>o-oIoo-ooQoʤww+w'www+w@k@[J%,"HTTP_USER_AGENTHEADER_HCEP-Correlation-IdHEADER_HCEP-VersionLOCAL_ADDRREMOTE_ADDRUNICODE_LOGOB1w5+wvww1w wBh i i i kk [l  )www  w'wPw w# wA$ww[{wnwwww@g k _ 0 ww+'j@{%j@c%j@J'j@6l@l)NlҨllZll,lwl߂lll oouooo'>o-oIoo-ooQoʤww+w'www+w@k@[J%,"HTTP_USER_AGENTHEADER_HCEP-Correlation-IdHEADER_HCEP-VersionLOCAL_ADDRREMOTE_ADDRUNICODE_LOGON_USERCache-Control: no-cache, must-revalidate Content-Type: application/healthcertificate-response HCEP-Version: 1.0 Pragma: no-cache Content-Type: application/healthcertificate-request HCEP-Version: 1.0 Content-LengthHCEP-AFW-ZoneHCEP-AFW-Protection-LevelHCEP-SoHRHCEP-Correlation-IdHCEP-Version1.3.6.1.4.1.311.47.1.131.3.6.1.4.1.311.47.1.121.3.6.1.4.1.311.47.1.111.3.6.1.4.1.311.47.1.101.3.6.1.4.1.311.47.1.31.3.6.1.4.1.311.47.1.31.3.6.1.4.1.311.47.1.11.3.6.1.4.1.311.47.1.1PlumbIpsecPolicySoftware\Policies\Microsoft\NetworkAccessProtection\ClientConfigSYSTEM\CurrentControlSet\Services\NapAgent\LocalConfigOHÆNULLNULL<NULL>d:\w7rtm\net\quarantine\ipsec\rp\certstore.cppSetEventCertGetCertificateContextPropertyCreateTimerQueueCreateTimerQueueTimerSetTimerCertControlStoreHealthCertInfo::CopyFromHealth cert has been deleted. Its properties were -- NAP_MEM_ALLOCCertGetCertificateChainFindRootIssuerGetPropertyFindHealthCertInfoFound valid health cert. Its properties are - Found unexpired health cert - InitializeTimerQueueFindValidHealthCertsCertOpenStoreMYFindNewHealthCertsFindDeletedHealthCertsHealthCertInfo::Copyd:\w7rtm\net\quarantine\ipsec\rp\qecconfig.cppQueryValue(PlumbPolicy)EnterCriticalPolicySectionRegisterGPNotificationRegisterForChangesOpenKeyU(KpJ #5J7d:\w7rtm\net\quarantine\ipsec\rp\napipsecdefs.cppIpsecRpALLBFEY+}W@(вq"AoZE"ޘd?7Microsoft\NAPIPSecd:\w7rtm\net\quarantine\ipsec\rp\napipsecrp.cppINapCertRelyingParty::SubscribeCoCreateInstance/bwLXATx-[NnQecConfig::ReadPlumbPolicyNapFwpSetIkeConfigQecConfig::ProcessChangeNotificationCertStore::ReallyProcessChangeNotificationWaitForMultipleObjectsCertStore::ProcessChangeNotificationPlumbPolicyCreateEventCreateThreadCreateAndSubscribeNapAgentCertStore::InitializeQecConfig::InitializeSvcChangeNotifier::InitializeInitializeEventsAndThreadNapFwpInitCEventLog::InitializeNapIPSecEnfNapMemInitialize|F"g%t@z3nFwpmProviderContextGetByKeyd:\w7rtm\net\quarantine\ipsec\rp\nap_fwp.cppIkeextSaEnumIkeextSaCreateEnumHandleFwpmEngineOpen0FwpmProviderContextAddIpSec NAP Precanned MM PolicyUuidCreateIpSec NAP Precanned QM PolicyNapFwpAddDefaultQMProviderContextNapFwpAddDefaultMMProviderContextFwpmFilterAdd0IpSec NAP Precanned FilterFwpmFilterAddAllow all inbound ICMP traffic at the ALE layerNapFwpAddDefaultTransportOrAleFiltersForProtectedZoneAllow only secure inbound traffic at the ALE layerBlock traffic when NAP Context is NULLAllow all inbound ICMP trafficNapFwpAddDefaultIcmpFilterAllow all outbound ICMP trafficFor all inbound unicast traffic, use Ipsec and do negotiation discoveryNapFwpAddDefaultTransportOrAleFilterFor all outbound unicast traffic, use Ipsec and do negotiation discoveryQM filter: For all traffic, use IPSec NAP pre-canned QM policyNapFwpAddDefaultMMorQMFilterMM filter: For all traffic, use IPSec NAP pre-canned MM policyNapFwpAddDefaultFiltersNapFwpAddDefaultProviderContexts)(c#<#rd:\w7rtm\net\quarantine\ipsec\common\src\registryhelper.cppRegQueryValueExW - wrong typeRegQueryValueExWQueryValueEngined:\w7rtm\net\quarantine\ipsec\common\src\svcchange.cppServiceStatusChangeNotifyCallbackWaitForSingleObjectExNotifyServiceStatusChangeCoInitializeExOpenServiceOpenSCManager–<XfTd:\w7rtm\net\quarantine\ipsec\common\src\eventlogger.cpp@@API-MS-WIN-Service-Management-L1-1-0.dllAPI-MS-WIN-Service-Management-L2-1-0.dllADVAPI32.dllole32.dllKH ݪ&Y&D9?]Jc#Kb 6o F!k /([s?UFQv-sBY.H{P,rF~ă%t\ aKGԋGpGNҎ*ͫnk7E77+q9>bOnyZ'F?wMW'S 2Q^_KtIl*M_; ݙ FK#EWN8y"w8Ow"[0}}J\f@D֠NG<=RPCRT4.dllCRYPT32.dllHD@-@RSDSՄ8/A讶#napipsec.pdbRrUjuuj+u uF]̋UjjEPuuj+u uF ]̋UQU S3VW;t*f9u E #pf@@f;u+DE E ;tf9u E@ UE@};t"f9ujǍpf@@f;u+\j [t f?u @@Utp@u+@jXʅu@ju uSWPQuuj+u uE0_^[̋S3VWWF SP^^5AWSP'AWSPA$_^[q@u)@~ % PhD@hh@4̋UM]̋U싁UE ]̋U싁UE ]̋UQQeSVWEPuEu u@5@ֿ ;t.u8օ~ % PhX@hh@E/4u ;u33@ME_^[̋UD@3ʼnEESVu W=@hjdlPF j0PSjd4PF jPSסh@_^[=h@t,@t&4QlQhh@jppM3S?̋UQQEEE jEEPhjh1@tp j@u@3̋VW3@u+@~ % Wh@hxh@2_^̋Vt jP@&^̋V3VVhQh%/@Q@u+@;~ % Vh@hh@P2^̋VtjP@&^̋UVutPj @P@&^]̋SVW~39t;t WjSP@^;t jP@PF P PP PVx _^[̋UQeVFPjj6@u1@~ % Ph@hh@E"1SWh@h@@;t@tQSj pph@uM;t@tSj ppuE}Ph@hh@0!Ɔ;t@tSj pp_[E^̋UQSV3ۋ]9W7wu=kW0i E|.khX@0x C;rPh$@hh@/}}WV '_E^[̋UQQEUS@VW3PQu uM Ӌ5@Eֿ ;t6}u@օ~ % PhX@hh@EC/}}u ;u33@M}7j @P@MuPh@hh@E.vS]G;>r[&_^]̋UQS3VW]9] v'u}+7P؅|/EE;E ruE } Vu&_^[Sh$@j{h@a$űUUH;JuV0W:3_^u@3]̋UjjEPjEPuuj+u u4(]̋UE33҉H@HfPH]̋UQQE3SEVu WtHtjWXt33E#u3RSU3uES3UNt ~tNQMVJ NAt vtM_WOG3_^[̋UQQV5h@W@(eNQjjMQjPVhG@@E136u_^̋V5h@Wh@;t)FN tQP3ff 6u߉=h@_^̋UEȁu%]̋U} uVVu<@Ȓ@V[h@@@5h@h@^=h@tI@tCh@j pp"/} u)h@=h@t@th@j pp3@] ̋VW'f N$$NxLjY3~_^̋V񍎀#Nx#N$#^#̋UEtt ~ X ]̋VWjq_6@&Ou_^̋VF tP@F tjP@v @f ^̋UQeVWLVh@jjh<+@@} Wh@h:.URhԐ@5А@5@PQ }Whh@hBh8@g 'h@=h@t@tuh@jpps}t PQ&_^̋UVLtN}u5j5@PQ h@h@tAtPh@jqqLPQL^]̋Vt2h@=h@t@th@jppj&^̋USVWuVYh@=h@t@tWvvh@j pp$3H%?PT&_^[]̋UVuN$o!Nxh@=h@t@th@jpptjj%$^]̋USVEP3ٍEPKxEEuuuuh;ƉE}Ph@h/h8@.h@Wh@;t"@tMQMQh@jppEPE􍳀P)EPEP}t8}t;uMft,h@;t3@t-h@jpp}t u_E^[̋UVWh@h@@;t@tWjppQu@1h@;t@tWjpp'_^]̋UQSVW3EjjGPj@؃Zh@=h@t@tSSh@jpph@˃IIIteIt=IVhd@h(Vh@hOx8}]Vhd@hO$ytAjf}#Vhd@hEC||h@=h@t@tSSh@jppj}_@~ % Vh@h2Vh@h%Vh@@hVh@h Vhd@hh8@(k_^[̋USVWh@h@@;t@tWjppMءh@;t@tSWjppS _^[]̋UQQSVW3ى}}sWWWW@;tjE}rWWShI@WWl@C ;u?@;~ % Ph@Ehh8@69}}E_^[@;~ % Ph|@Eh̋VW}Wh @hh@ }Wh@hj}Wh@h}Wh|@hvN$5@}Wh@@hvNx} Wh@hivvW} Wh@hEh@=h@t@th@jppv@}Wh@hh8@ j} j_^̋SVWh@h@@;t@tWj ppy@nءh@;t@tSWj ppuS_^[̋UjjE PjEPuuj+u u((]339@@̋U S3ۍEPSSj S]]]]]]]);t~ % Ph!@Eh`EPSu);t~ % Ph @Eh3EPEPjuu`);t)~ % Ph @Eh h @,>h@VWh@H @;t@tuVj pp0]9]MEPEPu(;M]A(tHEPq,Z)8]twMEH|;tgtttt t uGI;t@Au:p0uR( h@;t#AtUPEp0Vj qq9]t EP (]EE;E"$~ % PhX @h"h @E_^9]t EP']9]t EP'9]tuu']9][tuy'E̋U S3ۍEPSSj S]]]]]]]';t~ % Ph!@Eh`EPSu[';t~ % Ph @Eh3EPEPjuu';t)~ % Ph @Ehh @>h@VWh@H @;t@tuVj pp]9]MEPEPu&;M]A(tHEPq,'8]twMEH|;tgtttt t uGI;t@At:p0u & h@;t#AtUPEp0Vj qq9]t EP%]EE;E"$~ % PhX @hh @E_^9]t EP}%]9]t EPl%9]tuuP%]9][tu3%Ẽ%h@3@jpY@@L@P@ T@\@l@ p@̡8 @ < @0 @SV54 @Wj_=@=@3Gx@ |@Й@@ @ ԙ@ D @=@=ę@=@=4@_5@ܙ@ @5@@ @6i^@@@0@@x@@@@@@6i@@@@6iș@@@@Й@@@ @@ @@ @@ (@,@8@@[̋UME EAEA`3B`PH PH]̋UD@3ʼnES]VW3jY3}uu}j4EVPuu j Y3h󫍅hPEPu uWhEEPEEE@@@;t~ % Ph!@Eh>VEEVEPSE`!@E";t&~ % Ph0!@Ehh @| uĿD@ME_^3[G ̋U\D@3ʼnES]VW3j4EVPuu j3Y}uEHt HuE@E@EE HuMEPEE,E<@;t~ % Ph!@EhK>VEEVEPSEԴ!@E!;t&~ % Ph0!@EhXh @h uĿT@ME_^3[3 ̋UVuu u} Vh8"@hruuu}Vh!@hyh @^]̋UD@3ʼnEeS]VW3}𫫫jD@Yu3tPS jT@Yu3tPS M_^3[i̋UD@3ʼnEES]Vu \EW}X3hP`dhP dP@t~ % Ph!@`hhxDžt"@Dž|}E}ԥjjdP\t)~ % Ph|"@`hh @ XdM`_^3[C̋UD@3ʼnEE 4ES]d Y=(@E P@;th`@jSVׅuE @j_t jl9h|@ht@@YYzhp@hh@,Y=@3Y9] uSV4@9@th@Yt uWu@@wh`@jjVׅu@t jYM@t0=@ tЃ;sS(@%@%@YjV@4@3@_^[] j,hPw@qM 3BU3u L@;u95@uu;t @;t6U@uQuЉEE MPQYYËe3uu9uEuu uEE MPQKYYËe3uu9uoM EuQuLEE MPQYYËe3uu} 9uEVVuE MPQYYËe3uEVVuE MPQYYËe3u@;t,EVVuE MPQ_YYËe3u9u t } Euu uEE MPQYYËe3uu@;t>95@t6Euu uЉEE MPQYYËe3uuE Et L@̋U} u]%8@; D@u%@jhw@@Eu u0@YQjYe@E@EEPEPu E܋E@E@E EjXY̋UuiYH]% @̋UMMZf9t3]ËA<8PEu3ҹ f9H‹]̋UEH<ASVq3WDv} H ;r X;r B(;r3_^[]jhw@e@V\Yt=E+PVYYt+@$ЃE E3=ËeE3e%D@%@@hRr@d5D$l$l$+SVWD@1E3PeuEEEEdËMd Y__^[]Q̋Uuuu uho@hD@]̋UD@eeSWN@;t t УH@[VEP@u3ux@3h@3@3EP@E3E3;tD@uO@5D@։5H@^_[̋U(@ @@@5@=@fМ@f Ĝ@f@f@f%@f-@Ȝ@E@E@E̜@@@ě@@ @D@H@j@h*@@h t@Pp@%<@%@%4@%,@%`@%L@%P@%T@%X@%\@%@%(@%@@%H@%D@h@QRPh x@!ZYd@l@t@QRPh,x@ZYQRPhLx@ZY\@X@T@@QRPhlx@ZYุ@@@QRPhx@yZYด@QRPhx@^ZYธ@@@@@@@|@@%@%@%@% @%@%@%@%@%@%@%@%@H tItIu7@t0@$ < ËHV3v@ u F ;r^^̋UU SVuW339~v6FNjtt~~ p:u C(;^r_^[]%@̹@ hFw@jY̹@5o@m@m@n@.n@]n@qn@n@n@n@n@o@o@Ko@_o@o@o@p@q@q@*Ԟdx,{*؞t y<{ +ܞTxD{0+HyT{,@yd{,|yl{yyynyXy~yyzzz{zz4zXzjzz&zyzzCloseServiceHandlePOpenServiceWOpenSCManagerWNotifyServiceStatusChangeWNRegisterEventSourceWADeregisterEventSourceReportEventWCoCreateInstanceCoUninitializeCoInitializeExUuidCreateCertGetCertificateContextPropertyCertNameToStrWCertVerifyTimeValidity3CertFindCertificateInStorelCertCloseStoreCertControlStoreCertFreeCertificateChain.CertGetCertificateChainCertFreeCertificateContextlCertOpenStore~~L~L}}&}r(}(<}l<P}ȁP`}`h}~h}‚}d}}.}t}}2fHTȀ:ZL*Vj@L4ԃڅZH& ބ΄Th~r~|~~~~~~h~~~~2Lfmemsetmemcpyj_XcptFiltermallocfree_initterm_amsg_exitmsvcrt.dll_unlock__dllonexitB_lock_onexitY_except_handler4_commonOEtwTraceMessageAEtwGetTraceEnableFlagsBEtwGetTraceEnableLevelCEtwGetTraceLoggerHandleJEtwRegisterTraceGuidsWQEtwUnregisterTraceGuidsntdll.dllGetLastErrorUnhandledExceptionFilterSetUnhandledExceptionFilterAPI-MS-Win-Core-ErrorHandling-L1-1-0.dllCloseHandleAPI-MS-Win-Core-Handle-L1-1-0.dllHeapAllocGetProcessHeapHeapFreeAPI-MS-Win-Core-Heap-L1-1-0.dllInterlockedCompareExchangeInterlockedIncrementInterlockedDecrementInterlockedExchangeAPI-MS-Win-Core-Interlocked-L1-1-0.dllDisableThreadLibraryCalls GetProcAddressFreeLibrary LoadLibraryExAAPI-MS-Win-Core-LibraryLoader-L1-1-0.dllRegOpenKeyExWRegCloseKeyRegQueryValueExWAPI-MS-Win-Core-LocalRegistry-L1-1-0.dllSleepAPI-MS-Win-Core-Misc-L1-1-0.dllCreateThread GetCurrentThreadId GetCurrentProcessId*TerminateProcess GetCurrentProcessAPI-MS-Win-Core-ProcessThreads-L1-1-0.dllQueryPerformanceCounterAPI-MS-Win-Core-Profile-L1-1-0.dll SetEvent(WaitForSingleObjectCreateEventWInitializeCriticalSection DeleteCriticalSection)WaitForSingleObjectExAPI-MS-Win-Core-Synch-L1-1-0.dllGetTickCount GetSystemTimeAsFileTimeAPI-MS-Win-Core-SysInfo-L1-1-0.dllCreateTimerQueueDeleteTimerQueueExCreateTimerQueueTimerDeleteTimerQueueTimerAPI-MS-Win-Core-ThreadPool-L1-1-0.dllFwpmEngineClose0IkeextSaDestroyEnumHandle0%FwpmFreeMemory0IkeextSaDeleteById0IFwpmProviderContextGetByKey1IkeextSaEnum1IkeextSaCreateEnumHandle0FwpmEngineOpen0?FwpmProviderContextAdd1BFwpmProviderContextDeleteByKey0FwpmFilterAdd0FwpmFilterDeleteByKey0fwpuclnt.dll-UnregisterGPNotificationLeaveCriticalPolicySection EnterCriticalPolicySection&RegisterGPNotificationUSERENV.dllWaitForMultipleObjectsDelayLoadFailureHookKERNEL32.dll[J|hpxKFNapIpsec.dllInitializeNapIpsecRpUninitializeNapIpsecRp@x@H@0@@@@p@T@,@@@@@@@@@@@@@p@@@x@h@p@@@p@@@p@@@@77777777777777@@B@p@@@@x@H@0@@@@p@T@,@@@@@@@@@@@@@@x@H@0@@@@p@T@,@@@@@@@@@@@@@@x@H@0@@@@p@T@,@@@@@@@@@@@@@@x@H@0@@@@p@T@,@@@@@@@@@@@@@N@Du@ u@u@t@t@t@t@u@u@u@u@u@u@ku@u@u@u@Pu@!u@Fu@><>>> ??????00.0h0p0000 1131=1d1111111 22@2b222223 33.3j3t34,464x44445 55)5W5a555556 6;6|6666666 7C7j7~77777778 88"8/8x8888899(9[9n9z9999999:7:=:K:::::%;T;a;w;;;;;;;5>>>>>??@001?1E1r1111111111 22223%3.3Q3Z3`3l33333333344$424t4y44444E5J5W55555 6^6m666666&767;7J7\7778<8^8c8r88888888 999;99999999:7:F:Y:{:::::;;;";8;K;U;;;;;;%>>>?'?6?=?B?Pt0[0e00000000001 111!1)1/191>1D1J1P1V1\1b1i1n1t1z1111111111111111111122222(2,22272=2A2G2L2R2V22(3.3D3b33333 44B4X4v4444455:5X5r555616~66627T7j7778F888D9\999:&:I::::M;o;;;;>>>$>->2>H>M>^>j>u>|>>>>>>?!?`F0S0m00001G1Q1|1111222`2733334!4:4c4k4444444555(5Q5~555566W6^66666"7,7J7m7|7777777"8.888M88888888889"9-9:9N9X9f9x99 ::0:7:\:::: ;;;%;;;;;< <<6k?u???p00"0,0=0Q0Y0z000l1z11112d2i222222222233$3*30363<3C3J3Q3X3_3f3m3u3}33333333333333344 4,484D4P4\4h4t444444444444555"5/5=5G5Q5^5l5y5555555555556 66$606<6H6T6`6l6"7,767G7h7p7t7|777777777777777888000 00000 0$0(0,0004080<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0000000000000000000111 11111 1$1(1,1014181<1@1D1H1L1P1T1X1\1`1d1h1l1p1t1x1|111111111111111111111111111111111222 22222 2$2(2,2024282<2@2T2X2\2d2h2l2t2|22222222222222