MFETCONT0¸þ{pfžqþRÝãÏ•ý-ËKT1ÕÕ(Œ¾$¡Â`pðˆ‡3 J”òÄ80¬)ZÍTŒ÷²I¿?hÙdÒ|’TD’ò®§’ï]ŽØý ÷3!W{Ø%ã()h ÷ž±;é«L %·œÇýèÁ)“Bj™…÷]>7©§K/›®ÀP”ÙÞ €Ž¥ÅåÍ}”ýOrAË3y< d,p’dB„yÃc”ÖâfÚ)Õkl·ö%,2¸½¤DöÇ"DÏô¿ô!ûq7K㬻6Ú6#g‹„Õm…tÖÈz‚Ȋ #‹©¹«qþw‹‡~ TD¥9DLuaQ=A@@  ÁJ @€‚J @ƒJ @€ƒ€$$@@$€€$ÀÀ$$@@$€€$ÀÀ€d @ˆ€d@ @€ˆ$€€€dÀ @€‰€d @Š$@@€d€ @‹ÀdÀ @Œ$@$@€$€À$À$@€requirepackage/windows/WinUtils sanitizationgPatternTableInitgPatternTablegSysPropTablegDomainPatternmyloggetValFromNestedTable replaceKeysQueryDispatcher WhereParsergetRuleLastExecutedTimevalidateFrequencyhasRuleExpired initializeSanitizeDataCollectedcase_insensitive_patterngetMaskpopulategPatternTableescapeMagicCharspopulategDomainPatterntablecopyCheckTelemetryActivationCheckDestPresentGetTelemetryVersionprocessMeteringDatagetMeteringData &…À€œ€@@À€…€†À@À@AAAœ@€…€À€œÀ€ÅÁ€@ÜA€¡€@þÀ€…€†À@À@AA…À€œœ@€€typetableloggerlog_dbg tostring : pairsmylog …À€œ€@@€€…€À€œÀ€ÅÁ@ÜA€¡€@þ€€”ŒA @€typetablepairsgetValFromNestedTableð?26ÅÜ€@À€ €ÃJ…Àœ€Å€Ü‚ÀÀ€ÅÂÆÁ€@€Ü‚€Ú@€ËBÁ@€€Ü‚À€€À€ÅÜ‚@À€€Å‚@€€Ü‚€€I¡÷^€ÅÀÆÂAAÜ@€€ typetablepairsstringfindgsub replaceKeysloggerlog_dbg$input in replaceKeys() is not table5[ zÅ€J…A†@ÀÂE†BÁ\‚‚Å܂œA€ÀAÀ€…‹ABFBÁœÁ@€À €W€BÀ€WÀB@€CÀ€…A‹AB@€œÁ@€@€€C€…A†@ÀœA€…‹AB@€œÁ@€€€@D€…A†@À‚œA€…Á‹AB@€œÁ@€Àÿ…†AEÅ‚ÅÜœÀE@€…A†@ÀœA€@€…A†FÀF€…A‰G…A‹AGœA…A‹G€@€œA…A†@ÀœA€ÁA‚@€€À€‚KÂÈÀ€\BC€EBF‚ÀƒÁ \B€€%g_dataCollectorloggerlog_dbg'Entering QueryDispatcher with rule id  tostringid Teletype :: syspropsysPropMapperQueryExecutorpplog featureusagecustomppLogGrepEngineppropteletype = pprop ppropManagersysevtteletype = sysevtsysEventEnginestringlower sanitizenoSanitization set to no sanitizationgPatternTableInitpopulategPatternTableSanitizeDataCollectedReplacing separator%.:: replaceKeysstoreExiting QueryDispatcher]q<…†@@Àœ@€ƒ€ EÁFÁ€ÁA\@ €…†‚AÀÃAœ‚…†‚AÀCAœ‚€…†AÀƒœ€€À€€ÅËCÃ@€܃€€ÅÃÆƒÁ@€†„C܃€@€¡‚€ûaÀõEFAÀƒÁÁ\A€€loggerlog_dbgEntering WhereParserstringgmatch %[(.-)%]gsub%[%][^%s]+syspropsysPropMapper findProp propertyExiting from WhereParsert… "J@I€Š@‰€À€ÅÀÚ@€KAÁÁ€\Á€€WÀA€€EFAƒÁÂ@‚Õ‚\A€€‰Ã€EFAÂ\AFA@^€ keyresultg_objTelemetryUtilsð?invokegetLastSuccessfulRunTimeloggerlog_dbg(getLastSuccessfulRunTime failed with .. tostring,Failed to create instance of telemetryutils‡Ÿ ?‚€ÅÜ€ZÀ€Ú@€@À€žÚ€ €W@À €ÅÆÁÀÜ€€ÅÆAÁA‚…ÂÀ€œ‚U‚‚ÜA€ÅÆAÁA…ÂÀ€œ‚U‚‚ÜA€ÅA€ÜÚ€ÅÆÁÂB@€‚CÜMÁÅÆÁÂBÃÜ€€@€€‚€‚ž€getRuleLastExecutedTimeostimeloggerlog_dbglastExecTime:  tostring lfrequency:  tonumbermathfloor@@õ@¡µ A€š@@€@À€Z@@€Â€ €@@€@E€€\@@€Â€€Z@@€@E€\@€Â€€@E€\@€@E€€\@@€Â€Â€A@C€ÁŀܕÁA€Þ€ tonumberloggerlog_dbgRule expired ::  tostring¾×^EF@ÀƒÁ€\@€EÀFÁ†@AÊ€ÉÀAƒÉ@B„\@€EÀFÁ†@AʀɀBƒÉÀB„\@€EÀFÁ†@AÊ€ÉCƒÉ@C„\@€EÀFÁ†@AʀɀCƒÉÀC„\@€EÀFÁ†@AÊ€ÉDƒÉÀC„\@€EÀFÁ†@AÊ€É@DƒÉÀC„\@€J@Š€ÊÉ€ÅŠÉÆ‹É€ÆŒÉÀF„‰ÀЉ@GŽI€€‰Š€ÊÀÉÈÉ€ÇÉÀF„‰ÀЉÀGŽI€Š€ÊɀŊÉÀȋɀƌÉÀF„‰ÀЉ@GŽI€‘Š€ÊɀŊÉ@ɋɀƌÉÀF„‰ÀЉ@GŽI€’Š€ÊɀŊÉÀÉ‹ÉÊŒÉ@B„‰ÀЉ@GŽI€“ @‰€)loggerlog_dbgEntering initializetableinsertgPatternTablepattern-(%d%d%d)%.(%d%d?%d?)%.(%d%d?%d?)%.(%d%d?%d?)mask###.###.###.###ç[%a%d][%a%d]?[%a%d]?[%a%d]?%:[%a%d][%a%d]?[%a%d]?[%a%d]?%:[%a%d][%a%d]?[%a%d]?[%a%d]?%:[%a%d][%a%d]?[%a%d]?[%a%d]?%:[%a%d][%a%d]?[%a%d]?[%a%d]?%:[%a%d][%a%d]?[%a%d]?[%a%d]?%:[%a%d][%a%d]?[%a%d]?[%a%d]?%:[%a%d][%a%d]?[%a%d]?[%a%d]?(####:####:####:####:####:####:####:####2%w%w[:%-]%w%w[:%-]%w%w[:%-]%w%w[:%-]%w%w[:%-]%w%w##:##:##:##:##:##ˆ[A-Za-z0-9]+@%[IPv6%:[%a%d][%a%d][%a%d][%a%d]%:[%a%d][%a%d][%a%d]%:[%a%d][%a%d][%a%d]%:%:[%a%d][%a%d][%a%d]%:[%a%d][%a%d][%a%d][%a%d]%] ###@yyy.zzz,"+(.-)%"+@[A-Za-z0-9%.%%%+%-_]+%.%w%w%w?%w?G[A-Za-z0-9%.%%%+%-_!#%$&%'%*%/=%?%^`{}|~]+[^%.]?@[A-Za-z0-9%.%%%+%-_]+gSysPropTabledomainWinProp namespace root\CIMV2 classnameWin32_NTDomain  propertynameName###pSourcewmi localusersapi getuserinfo property nodenameWin32_ComputerSystem  groupnameWin32_Group ipv6"Win32_NetworkAdapterConfiguration IPAddressÙ*ÅÆ@ÀAÜ@€ÁÀÁE€\W@Á€€E€\@:€…À€œ‚@A€‹ÂA€@€œBÀ7€…Æœ‚Å‚CBÜ@€„€€ÄÂÀ€„ÂWÀ@€ÄÂWÀ@@€F„E†„Â\„À€E†ÄÂ\„€EFDÀÀ€\„‰@á‚À÷Å‚ÃCÜ@$€„€#€ÄÂÀ"€„ÂWÀ@"€ÄÂWÀ@@!€F„„ÀAÅÜ„€ …†ED À€ €œÅ€@€  €€Z€D €€‹…Ä œ…€… €€ÁÂ…†EC Æ€@œ…€‰€À€€øÀ€D @€‹ÅD€ @€U†† †ÆÂœ…€ …†EC Æ€AF @€œ…€‰€ D…†EE À€ Ä œ…€À ñZ€‹…Ä œ…€… €‹ÅDA€€U†† †ÆÂœ…€ …†EC Æ@€F @€€œ…€‰€LÄ€ €@ê@€ZÀ€‹ÅDA€€ÁUƆ †ÆÂœ…€ …†EC Æ@€† @€ œ…€‰€ŒD …†EE À€ Ä œ…€À @âEÀáZE@á€Ààá‚ÀÚÆ‚ÅÚ@€ÅÆBÀAÃÜB€Å‚ƒÅÜ€€„ÂÀ€Ä€„ÂWÀ@@€ÄÂWÀ@€€DCF†„ÂÆÄ„‰á‚€úaÀÄEFAÀƒÁ\A€€loggerlog_dbg,Entering sanitization:SanitizeDataCollectedtypetablepairsSanitizeDataCollected tostringgDomainPatternpatternmaskstringgsubipairsgPatternTableð?findlengetMask[%W]sub customTableInside custom table+Exiting sanitization:SanitizeDataCollected,:K@Á@$\€^€gsub (%%?)(.)/8@€‹@Àœ€€š@€€À€•Àž€…À†AÁ@ ÁKÁÁ\ž€match%astringformat[%s%s]lowerupper;M BAAÁA‚Â@@€€€@€€€‚Â@E‚FÁ€€À\‚B‚€€€‚A@€€À‚€Z€€‚Â@E‚FÁ€€À€€\‚B‚€€€‚A@€€€À€‚À@€€€Õ€‚‚A@€ÂÁ‚ÀÞ€ stringfindsub[%W]gsub%%%%%%N¤ÑEF@ÀƒÁ€\@€KÀ@\@CAÊBF‚A.€Â€FÃAZ@€FBZ€€FÁA†B@€EFCÀƒÁC\C€Â€Â@€FBZ€€EÃFÃZC€EÃ…CÁƒœƒIƒ†EÃÃÀ€JŠƒÆƒB‰Ã…ÆD‰Ãˆ‡ÃÀ €Â@ €@ÄÀ€FBZ€EÃFƒÄZC€EÃ…CÁ܃Iƒ‰EÃÄ@€JŠÃÆE‰ÃŠÆCE‰ÃƒŠÆƒE‰Ãˆ‡Ã@€ÂÀ€EFCÀƒÁÃ\C€ÂJGÚ€KCFÅÃ\À‡À€EFCÀƒÁƒ\C€ÀÆÀ€EC…\€…À€œ„@G €…„À€€œD€€€”€ŒÄG ÉA aƒüEC€€\@ €…À€œ„W@H  €…„†ÄH ŀ܄ œÄ€€€ @ Z€€š€…„†DI ŀ܄œ„€@ ‹„ÉÅ A œ„@ …D ‹„J €œD€…Ä À€œ„@ … À€œ„@ …D†DK Æ„K …E€€\… E…—FL E˜œD€aƒÀñ€€EFCÀƒÁC \C€JGEIÙ!‚ÑB@C€ B€Þ€4loggerlog_dbgEntering populategPatternTable initializepairsgSysPropTablepSourceWinProp5gSysPropTable not populated with pSource and WinPropapisysPropMapperg_objStockSysPropscriptableserviceobjectstocksystemprop QueryString propertywmi g_objSysProp systemprop namespace classname propertynameIFailed to get WinProp parameters in sanitization:populategPatternTable() outTable getpropval<Executing the query in sanitization:populategPatternTable()typetablegetValFromNestedTableð? tostringNULLstringfind Domain: subgsub ^%s*(.-)%s*$%1 sanitizationpopulategDomainPatterncase_insensitive_patternescapeMagicCharsinsertgPatternTablepatternmaskAFailed to get properties in sanitization:populategPatternTable()resultExiting populategPatternTable¦¨ K@Á@\€KÀÁÀ\€^€gsub[%-%.%+%(%)%$%^%%%?%*]%%%1%z%%zª¯…À€œ€@@Å€€Ü€ÁAU@…@†€AÆÀA E€€\ A„ „œ@€€ case_insensitive_pattern( tostring) \[^;,%s]*tableinsertgDomainPatternpatternmask##\##±¹ J€€…Àœ€I€¡€ÿ^€pairs»ìGA@@€AÀ€…@Àœ€@Z@€AÀ@€‚€ž…€†À@†Aœ€€Å€ÆÀÁÜ€À€‚@€Â€ÞÅ€ÆÂEFÁÁ€\MAÂ…†ÁAÀœÜ€B@€ÀAEA€€ÁÁ\€€A€†€EAFÃŽA€‡@\@€€‚€ž@€‚ž€Y@ tonumber POINTPRODUCTMA agentguidstringlensubð?lower0@ào@mathfloorp@ïøB@€…@†€@†À@œ€€@WA@€@A€B€^€MET POINTPRODUCT METERING installedTMû@@C€€@€ÀEF@Á…†€AÁÀ\€€€ loggerlog_dbgEntering GetTelemetryVersion() RegistrygetHKLMRSOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\TELEMTRY1000VersionDT€€Á €€€À€FFÀWÀÀ@€C€^J AEFAÁ††AÁÁ\€Z€FÁ††ABI„À€EFAÁ††AÁ\€ZÀ€M@FAWÀÀÀ€EFAÁ@††AÁÁ\€Z€€FÁ@††ABI„FÁ††ABI…@À€FÁ††ABI…@ÌÀ@ð€ ð?resultstringmatchsysevt.descriptionrunning StartTimesysevt.timeoccuredstoppedEndTime!Pn…†@@Àœ@€…À€ J†AAI‚†AIƒGJGÁE†AB\€€…Å‚œ€@€€ÅÃɃƒ@€¡‚þa€üE…ÁI…EKAÃÅ€\ÁÀ€EFÁÃ…Àœ\…AÀ€œ€DÀ€ŠI‰†ÁĉAEŠ…†ÁEÅBÆÜœ€F@€…†A@ÀœA€@€…†AG€G€…‰ÁÇŽ…‹HœA…‹AH€@€œA…†A@À‚œA€ÁÁ B @€€À€‚K‚IÀ€\BEFBÀƒÁ \B€Þ€(loggerlog_dbgInside getMeteringDatag_dataCollectort maxoccurquery sysevtproppairsselectSYSTEMEVENTSPROPS mappingssysEventEngineQueryExecutortablecopyprocessMeteringDatanextresult No eventsstringlower tostring sanitizenoSanitization set to no sanitizationgPatternTableInitpopulategPatternTableSanitizeDataCollectedReplacing separator%.:: replaceKeysstoreExiting getMeteringData