From 74a0841b09615e40388d57e24d0b503118f4ceda Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 11 Aug 2020 13:21:26 -0700 Subject: [PATCH 01/20] add liveanalyzer troubleshoot topic --- windows/security/threat-protection/TOC.md | 2 + .../images/analyzer-commands.png | Bin 0 -> 45792 bytes .../images/analyzer-file.png | Bin 0 -> 7725 bytes .../images/choose-file.png | Bin 0 -> 8558 bytes .../images/upload-file.png | Bin 0 -> 1229 bytes .../troubleshoot-collect-support-log.md | 66 ++++++++++++++++++ 6 files changed, 68 insertions(+) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/analyzer-commands.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/analyzer-file.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/choose-file.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/upload-file.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 6a30c6da4d..bb71e600b5 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -652,6 +652,8 @@ ##### [Check service health](microsoft-defender-atp/service-status.md) #### [Troubleshoot live response issues](microsoft-defender-atp/troubleshoot-live-response.md) + +#### [Collect support logs using LiveAnalyzer ](microsoft-defender-atp/troubleshoot-collect-support-log.md) #### [Troubleshoot attack surface reduction issues]() ##### [Network protection](microsoft-defender-atp/troubleshoot-np.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/analyzer-commands.png b/windows/security/threat-protection/microsoft-defender-atp/images/analyzer-commands.png new file mode 100644 index 0000000000000000000000000000000000000000..5e66e9efc4c7e0f3b824984dffe825facd6b4979 GIT binary patch literal 45792 zcmdpdXH-*NyR8jHgNk&i(!o#!q&Go&6@<`<^bR6~UM!$=6ok-`-U66}UV#CQ&s^XQ30mfBg;)a8Qw!)Pw@OZ$v6$vqY`?Z>h*Oe>x z+W-1oO#I9b<+>6SFzBHt>X#R!Exano*NMRzZ*stayCbyWUbCH~J8osoz2} zwzhCX+Ii#yp86n{Z;*2}yV@z5R--ypx^!$-=&nJ4^ZsT<`!$yiT2m1{Hw~QUwf|(e zgXRzfjf+#V*(!lx=O5EdG2OOCrW=zza_pzD;@KFUQt9ox!6$pHR|-p~ z)|&*6=u`jM4+s4h?L8XSt%BhX@C^o)3=_E&e&kSKhOe1OGXm-=zQd^z*C#TbqBpxB{p6Po`I%P(6d)_(z(IVk|VB}D`RN2PjHi-^Vsr#m#c#WPf+gE8|r*kcROyzW(?11a`m*qR`>sy)DPuOzK!r zBOn%-lg`uGX2-YZ&CY8|Vt_W{;?+u8d!GKGMlwzX7IRilrr?#Cx&67lXQO%4CWx>t zZQ;<~<9-am2~CPhbFKYj-ThYnrU)}9jbEk+FHWHG>mkrhiL>t5V(~@ddKL0|MXt!l zAGbKdc`d-CCA&il=K-KvNjwE`X4ht-cAyi{JKq~N?@iVmk+d5`nW0yw3rD=s4Tu(O z+`cgOk-237fFt}Q4P`2{?8v%30j2fYUiD(8NVjJDxzyx;H;{<9tYg-84%~sTi3kmZ z@jLZsdGnahKXYRRGO6i1uf;UiaCVjUPI+%WJZD51Kj=QAU=iQ8uifB=Dh45_Yi|3iM zMc9qEsRK*NuD(Y}kgj-#!uYC{6ooGaA}Q5fP|8 zVP)7Pt%l$j?8*cMHPeCPTB$_D%pEMGeD3CXqRlCoS@6;l)IuA#SUMF>C0*-eWu^lu z{~oa4%7ywcSapH19Xf>wGkUnb2y<7PCqfR+PA_B3Uhs1-G2NsD+J>sO|JWa@ro5AP z(gu06`Q^JNB>agJi8Qz~_zmF{{|Md1td4$tWfUV=XxwcrhP(bJ_%AB;uM7WQ8zZ!D zj&fAH##|CxsiBoGCR;2I7ovHWv9c)4tesxHi8!wMYm;A+E6i6OC1pB$KS(~NIGSL5 zpMRlSD5rQiNE6^C`A3N6<|4!r_H@_lHa1#I`z81Q>0)<0@D=ekBPItMa8qpLB6+;s zt`vX9I{mZF!^k?+{EN^|K)uxIRCSTnQ0k_5d&ZyU&7k?V^%pc;tpC`T$#g7Xu--lt z8Hi8gaO4^|>4{_K5eGBHJJR-RP;%+#?|7(=swNkeTf%3Bh09;KY$V9i@E7=LqCSOS zobtvAT?!brjXjDv$0qcJJeU|8T^5g!_7xh_`fKskwwGJEJvu?Pu zA{&mu$Mt)y0eISF#`-%7AE?#-H9R=yYHoI4+TCrDtV+JOAA|qhg;%aTli$#V!8m9V z^^HA?Z(SX_ty|chYmj7|>d`wFrbsjGDAs(hIVwrPOyg1S>5n-mA41o+rI+oS3G&&r zmzbNm=Wd8mJFyb*nJ|fzy~Jf89?`Ev!-2gQHY6ZKP5^u=saHOKx?Gd_NptP&>OWTT ztJizP{YT+8yoAM=51=f28}R&t9jL>n>_(M_C;u(I+bSV*D5$u|sz7ABC5@md&NW*22e8UdT#v~9E>Q)By&13|{Z zBd%J(64Zyjf6x&|e|SQ1b#JHF2UlU5P&uMb_d zQ~vV8qz@M?2n_$Z(A+DQC&kj3xt+3Mmeuk`=Re*4LcPGagoKBGb&>)Quina?PrgUz zBFOm)WVQTfZh4q3nVRp=!3+a5eLW``<*8z@_wa+o(y@kcT35k}d zqguCD5(ejY(Z=p7A4hgf>C>Dom|F$w^_hY?X6`%8;JRaRR_}*r>!Yx%Rip@IZsODZKbyn-1B5z>`M4uSLK&~H}b6@*Z*K?|Btw;KwL^5m}9n2i>E=F zdsWWfVut)vHw%+}936a#C^mC}{;*B!)v`{}l#_v}p**Gt1|NAZe?Sci@82cEj>N4E zmkJhxCd9w%mZ8U^(xj4|D382X7x4FZDQm}SrewfUnzWtXL`4?95{o0dC_LFNE+sNOJUcJd_-S==0L7*> zbYL%VZF<jyO`nr^zl&g029PL=7?u1G{s-lq6G)?nlBo4L^QK>jbq$QKfPRp zq_~xKHkJg3f@9;GX^v#cyP#ucYv#fN&Sx7Xh)^r-9D;P{^kLGbwDajWcd6th5#`F= zuD%EA3)0uLOoBa2g*S7^qLqi!a_;K}z6KhG7MH_T`yEvAzqQJ|XoRvb@;>0tciL&a?2T--~(&LXA8^OL`kZUK*nzr?KpE1TRqn+ihkmGQ3U3%y3&o%+rERRY_eEA6vO{WJ*+VELj;&>w~2 zB^bUavlBfla9)q!>$RQ+TNqtZoSa@3SB7+N0QYCIFLVfc421iTvrTy;@SUw_8Fbxc zPDRM(;3&{Dy9KXC=w+!L!rT$2?_{wa> zhgeixbY}y=Z`=^G$(i61U*3COgMGzdw;{RJoAk#JQ(CM27DA=<#!_{QQF%4V;TVv= z+K%zS&SCM=Fmx};1LL{eE>Uwz+qNV=dOxJPoVohaGML~Jy0-o?R)ct&OjKOihv?yG zDWV#ia|;vPJ_t976(x&h=NL=ct|Q{ln#Sdbc7#_Y)yD>9TS{c6>@@UPzzjMQ|IvB4 z&YO66cl~mgoB0LK&9sG`Ht6VQM(iM71}nTiDtnWA;fVLM^1lDTG^l@*N$A+ns~kP@ z;X!sBS(In=xd7m+zn*Zd0J7Y|G*L~-_MHbd0{S5$k(Y~s!FedUO|{S5to&t+PFT8| ze&4?Aov^2%%EPO-zX~NryO~0NQULiy<1W*jhj0mBzBIk^;y^K8p%gb;aPWoiS*(*ae+m=tYlpD!$DRImj!9oZbx%_B{MTQ>*W`D0wfvc1)G8i|a;n^f7Y@WP7=( zK~w$$Ixqxj667pZYEyXlYpFmKQkz9d!CM#zSUd3qKGwtOGHjPocIuYi-wLi67YrSV z%L@q&Dm69ggBY6m$NgM#JB)6u65yU)vG`Uf5vuEn3JNkMC<213il893nSCzMy*A>S zl}8l}yqx|JftSBHd0FizK*1zfQHmRHStUWUgr47OP>uQFho{Xh9Xs_XsiiMl>zMMm zIe*Oz*IaTzxQN2f0&#rj4Sw+(A;sZc&~C8&R&98&;8XYWOgu$&5}!te1u(ScDCFg3 zasc{{syu!(G$GStM0Dz86CtJR#o#H78rWYN+}1Z=h;F`Igp_PL%%!1!j=8M$g7Nkz zQy9XK$3<mj6hnA!8c1Ly~0(<}Q(FCfTq;30r0X#O-8=5m~d0yTi&^hUOsWp#U>L7RtZ56N( zR0yRP%WGwozm{9h)d(V|d)1Yu-~>0mn^{JeJMo%p<&~xk7nq2o(Ea$!Qg@Uc$xzFA zI3C;r*4w^_bUJI5cP|?QUMdG4YRU}U`OFYniPG_D*}vbS$C7#Jbx3^{e9|g^0hl@! zT*80qfL88G)TpD*)gNgkl!N(8w*6bHXs1);Yug}|880tez@m6&C@oNSBod}nF@h;~ z*6JFpk?rcCvVq7FcHF(VvU$rJ+(!6{lgq^k`EQq&gbJ#w6eWa`T!v98Fa-fCvV%so z3DKa&$2UqNsW}UU!;$Fr6PZ-HhN-@C6T_h3DXO!dUGS%cK98&mVwxwhPrODB;XlhM=79O_X?hG#Dn4uhzWm+~UJzMR*~qfZAoFpLYp^hL-$l5Zqq z(}kj1cW!(!Uahnk=j`O$w%``fliv-6Uh{lmFI{8QXN-AnlgQ9Dz=8G7F7L0uyBlie zGy{87*!hco^(?>n_wm%A2}O4WhR(7dV+-dS=(1%o2^$gf%kaP%c)gS8WV2QLZUcYg z)JnQJDyIBSd=n>igtj#)+z@hi)A9^u|0&w|js5}|4GnrQWl`>L(BNkQ$}3BppH4e`RH1BLkd=M$(-QDm>Yhu2 zYY(3)jVM5{euw@u%eeg;^9e{j=lEir1ua$woHchjpb3tG7^evzr(R5JZnSG5%bgc| z`!7bK)fal7)805kxCS}7)?eD_?#7`C3%$oV!TaajW2ESlQQSmfe2s~V9wE;8P9~0PNuaCAIApAPONq#U3aq&X_OZN!MHC*Sq|j-~e4Pe-UiQC_=8mT~7nGbbg4 zZ-GwFr!_13V;e)w9G(_Vd=A#OeUmVwst{zGIM*0*3CCbhl&YN&&9V0lo14qF{jyE6e`CWmaCxqdb}Rky0v!_$YS zwj2x$lUeHjSRvigr0oS~;WI}>bO)YCrpYVpzsXMM2PgDTjBUscyod@uMM){3=q?Mi zQM7>c>_S&OpV~w=0B2N{?T}fl;g&rMS`G%^u2zTZn}@#MMw!Z-X+vb-sw~rId{}z~ zJ8>Co;{*>cm>jHLOnAlMjACzXA>m&5yul3|ZB#1yxy$y4#_VWO5f%Ubs^XIw<-;?c zJl#soK{m$Iwf3HG19%_H6aTDpTZPTx(yks`aCwUIVW=Mlj&m9zl0$xsnL}-b+{N=I z)$t`wT%P1bzUg`eRV&(^a?QSBO;LZ?E2nD8e)cv?HSaG3I_9VE+D8XR)IE1R}%R@!kH zgtk`;IWEL+_8)iGoVeeaJwMeJWj{aL^*~Rm!4}8{aOX8$T?awSh4{PuyBhZQB565X ze7ldb?_e!3AwJLhKZA8vPKP|UN-3%2yUK)IgEw#T~RW7~*7tSZL zhDLdUT7OXF9C9LbU$@1ux-w#;hlKzl*boLC`xXD}O3UA_Y+V-X$A8ixAP#g=XE?5COIXf)2lvZYY z6kncZmw3*E_g+P7e4u<8!&CiCK4`;pm}vX;YP$_kol7ZUp09L@A^+00AxHCVr8B$P z-ZO_>EOv(#i9?`_d)N}Fb(LC%8L!(e8KPe}A+7sUf`TN||6u6B)AU_~Vbos$^0(ei zh(sBhe_C&Idn5lw=yl6E^Id!7El1f>VPF}8yVuQ!!V9G|do z=C6kp4=V#z!&UpDT?U?#q17j7j-orAvK_U{gn?dD#T(q);Z$|TF{9R;FCDq&%M zrbAbd0+c`r>>k{dUdu@TuuMCb<6czlK8QR~-CSp6KRtb=91&x185Xpkn{Pt9NgMsX zYD@WMem^Ycd_{)?lrS^aLE_;%xAc6zh=yGd!0KftS~%%j(|XO-JG1Y7{_gz~zv?mv z)-Q8Nw&{Xu?y69M^dVAcQ)q{H!&ZWczf*aMvrR{Gi48-CAbSMH1^C(d3lgFoo2b31 z$)Te&?e}ebdBi#!P92>DFIJmiWC3`bpFS8QG)UE+Jd?HE_1Gw-rV(5*_QkT$Uybkh zXz~U3!T~0@*w?8B3-VH*G4nRbk}0Bc#*xqOyIGAdVokqITh`36RcF^S)*eq?H zhktwR39%UK0KkW*CTD)1Xvq(xkS+a6O?ty0nF@haGIyHWitAW_jl`RO_jq;9FDtkF zDBM{Lqb7wMaiQCC$5JPkifj|nJsRmU?y((uG69SLC|2Pn4 z&DF%^CyI}%kJC+7)gzN`9wml9W0x4O&gOO$w8Xnx1V6Fb2GD3uRDJ=g)D78~vS3{3 z_s_6$fx8E)Wow1B+$MF?`kJ6Cgx^~%yv*FLd+@DJXH5WtYj%X?q2BP>9{doE$G2Lr zGt&ssF*Mm%8pA)6Xl4DhW7`r$B52{mx8u=_7U-Vn{ntag5u1-jr0Y@OP%@w3%W< z#^b^ou$RiB_)jt|_p`F~HE=r)dO}x6!z=Atdu;PtKBm2U`(iZWlRd0E<$TttrM%Gk zkI=y9e1Efvi}&OGHI%$?#8db5P6Dm8JBScf(f`HGl(uvt^=klMZT&N~cOwqw&!~W+;VUK-^d{dIVqVa& zhMu?_%6D&9hK`-S$xluC_=1n3J=IOowUjC)*E9T8)e8z18zRyUTifyNbot+;YD5S< zp%w#<$8>i>;SaG$WkB$u_P*{=%Xr*GuC60We>|(WZ2EYk;omrWk7$<1+?uL?irCvzU1?hygDRgr6ein+AS5u?`osaKj|%&Aoh@k zq(IQSk`6u)>6KBw(m?|;v|fb6`oDvJ-+Cz-mvcJ5p#cQ#(eD`Zi{TG>I+B$oA4FFI zhT8HdbuF6Hb>k8tQv1K~y6EWanU3AVx7G!5Xh2lq0BPLBDCx{kfswB)PQTKPdEHhsxWD z5{R=ZHMvtV6Y}K2&YC*p9VWe zaWH#^ zrMuU$`smW___w#*KkX5yRB<%hQ zJ`B@*dB@(?#Wye#eK5X#_o)V0IrsFfJvNZV3XGHHXg zAkuPCN0J`oyVtxVYFOQf&mW?aT&T`g9NCUAuOpK>29?NM=ihZ9_|T2_;rjL<6~-!K z6Z&OI4tT;cgE1`s1UZ%D1V?l^e+^DmyrC7Hv^#A#^d!?_%EJ7B1Km>B9~p6rAEd$h zWmN%IrHZ=#r{9iwPwE~YNMBy?neeSgpqo2&$sy|6LbuAXswEpeTXVTZYg16v=J)m< z;}=07>w@)dCD;o`7!~lkE!HZMnEx$y&>oV9MW7eDY<%QNc77ljQpxPGtLM#XKp|sv za&Z0ZTGol=*9T{EH)lH^yyglKup4xv?)+f_J9k~JjCR!stZKvpd=9(>K8R|z)P4G5 zl0clWolku|sm?yhH&zTZQ!rI-&67&Z$N2}Q%X6kvv0%^tR9@z76op>ZRrAY`aR(}O z)@kcQ$jqa@6xv$;czzH-CZpn@_=W}3(gIg4Zx)n4Rm;qS%*mEI6US5a$LYhgP`?u# zAZPe!Y%pzfu$d1pWewMNczH4Z9{>38vb8db{m=B#htQL7DP0$uv%Qv!Um&Ag==Q>@ z0O(?{T6-*~<(AaX;o7^g#`WY(o5`K1d7)t+MOTUmcnZj^R?8Ij^q~_YsU(io0~ye-Wg&pd==XD1mtcuD&Rn6Zlk}O5fBO*Ms+K*KWhQUa2!;Hi+Y5Y} z($6fR1|Qyh<f;lOR@3PGi|C=j2>|Z!?nIi)Z{1Hle~qq|3p%5CObJ4(whwUI60j zB{xze<g`(n7D7adF~Q zQq@f}@A%pk>HhgbiIId$Irw*;j#bF+1$~V1Dt>6%QbwzfHSV1k$R=gR>4t!pQpR}1 zC29y#UR_=zdELBO)D$uj(j0r+eNS}*V;_WS{{-h|wk=`n_`2yBdWgn-m`9R2@ z%sl>!YGe8u*Qrz7J6~EL*!qEJszvHrHnNpiTECu)p!YzbW$AN*=2Vg-JYkJxsF~wN zn}~P}d8Y}iUW{gSZrNnb23I~udi=`T&hM)Xl}?F8(<@b!!6$i-Q_qa>y3Kf_v%Im< zK^c!>Iq+~lZ&=Ly>R#QJpB3tiAgLqi_L50KMkeIx!#!>s;n8 z8+$cDXriNS%As|iZ*T|h5&RUh1s1RwN|3(k9;b{IZLBJkt7x%`*ZxE-T&anHh&+Na zQfos)?s7+&y|Axs_I&0aCjyB6=X|*%Z6ELhpTGw|fK?<~Lr&vjB4p;dkPsD6o-{7P zw+Py&ajeheG!l^{j2*d?ut_xAvVr>!WfA>txn22H!FGj<@u6pdrXsA@^sz0XD393< zLT37!gXo?z;K>)dhmlF=<2z%gPv(UTjg-|tpZ~7FGo9`&LcxQz@ZZOo3=2j3b~*&S zIDpM7R)h!ZJbNdWD36($&3uB~<0pW&xg1_$Tsy#*s?i$^?{*rAkYR7hDt|b6AOdVT zLx#RQ7Pw56=&|Vc4b>29F_=7$47ImoOB{AE-HUdYlDrMPasP5$SE9Z3dn~gf6iJ4t= z-;O(@V-VI?D;c~D_vA(_sn z@)fHU+@quAZJR!!8Fhzx5at~=m6W02sI{sXXc?h8WNvQTNW-e!UA-&&jRc&v?_8kG ze+T1yDl05FCzO4fnxt}`zfEJ<$UdPkB$n9)MRa%O^k*Psjk4*Ne}@P(4!5j)JVHmj z36Hhu6!>Kt7>%lfo1T1Kb&|VT8Xq4Xb>dh4!5-Jq#?Zo1z|-36OEDkw#DuvM$9_7O zJ{K-wuif*$aCIIDtp4nn)mn14R-f5F8ngk7U7Vk4Xgw&ehYs!F_a-GL2GHkB(_TIw z#2yEcWv)$$6ZF%6+>E!fia|H|^}CYk1ziS)%V4Z+EjE#x22s5xaxgX$oK z*kK&UX)fco<|DG<=GI`exv8!9&y%yxW8GJSlf~s&m`=z$fCY<d&&xa1iB@|5wZ)JaK`$<<<8LF8*iD6DEC@x<(*u{$D{U2$~Ni2p2t?d z0iCprNrflpnt_f3zx^C+M_SZ6C!e-41H$&`%6b1pdn=V8SJ(SB{heLn3Cx*AF7?~Q zfr|F}(*N5|q9E@#BW}HP_ZMUQJZc$QGdeP(Z73h2ExOv-ezJR9-8JPp68z_*sr((i zUUDL{-Z(#3mJYMow|*3zlk6!-dpz zvDzZvCD!`q@(FR+-0WMaWC!ua0~tFbJ>6ZBCi!RWlpWdfoDRRul zO`u=`>a0ne_xej5DHYn1aKeQThnbH?>@vGaT%SZK* zOQ&B)Ouu`_>yu?eR=^DmkZnl?+=w5jm!I;}wn%!=5oKH&}Kpj(1DF%HRvtg>V{q+jn(E(MM z+hjP^0l=!j=okTE#ymrvFAUnzkiC*Q5xdkl`)yR6zZ2Bygn zEcYX9?K!Xf2B?G^OL7ERp*6C{)C+21je_JE@UDlxB{l3f0uPkA`g-^fxBk){KdP@X zwRIpdNfRVJ_wj_PQ`u`X%LXw983*}W{uhkE8Q`-$J7e4?l6I zuk8WJ`L3Q=w<&TGGN(=g4-YE~vOh_Z1-%pbTQp9_z;d}8e{o`M-o`%pV;3twnKuzR zjM^(Iop3O{cIC&D|4YI6|CAzqrUjnH{yKWsRKbX6NL^3&DbzO9tlmy6DPTf0=h0Il zLWuJ6Pa@g*IkX}fou@CG#{s2w>vdIY=o9PaHtUWz<~40ezwhF#0?Tyvt7zF8>mib9 zqGd6`@{D`IKHrtj)B?TvraVqkhU4~+H^-Jc9DW)S{gK-}aHBKVM6ELPrYs>-S~K_) z@Ph55jTeKnU_d~y!|HpfaZ%Jy2L!zQ=;R_bX!A6H^4uJYO7eZ#ANzT`MDE{WD};dq zF-GC~yW(-VXRXEWP0x0e@=FT()nGDgTp)uoB>T8WtGTou0&BYN!^(qcP)wZ# zBu$+4vtf0TzmJfCkh;)QWwJ!~_>Du?vON04=Ju1VoX(=)^`B5A`=@2imOe3T>CL}o zfA~T{xG+`AiU@c7AAb%7#wb*ZRo%2H^T#3cH*G0fbQ2>63DrgIHd#t#9p?%KmH?Cm{ojejF2Ftpr` zOX~ee79w1ew><9~loy$68s%1NbhF=VW&3azKC$h~S!1Js`R^WI|)cyXfV%P3f07XTsw0$OKW9x+Gs&99QMBJT?LP9TlDnHcT6#HkuTaW7>)mPsCN3OL&#kYp*Nc+TmtE??G{B$>`K`kTXfJT#y1b!A7$~Z zgk(Pm8k~eHfZV@-^l=xwH#r$@{A!DmX5BTgEt`Wn&~VcBkDY?3ne9Fu`a4sw(Lwd< z2u8$B1_bbd3qn|z>KlT;#lK&#hRfZw1`{J`3Ib@HyO$Nsu_G=&Cak!)qkXx2SOC#s z0;sT*5ns?^yP@cMm>i8sHF)vFIOFS7j9_L7J@jXX$m!!vu&UeoJjNd9@5&=Z6I{^Z z2`VT{q&M*-nG^H(0emS5j}s6%ZW;u@=qnlx z+(O<`h6i_9>Rd@Y-~@F9zKY&&48SSFgs9<0m>2?Yxe1qCTIEWwSnqLk4HIeJ7+fT$ zGWZ4DNIiWo>+u-%x>1bwjP5N}9%jTZHJ2@tLIt$OEG4goBs^M9)g)EL&x_Dt)m~pE zpIRdU_&P3319ahgJVKx#bxN9l^ZCA%4zCssgfA`01}YX!7geok2ii)7d*g1%Vf1a^ zfFhH`qJL4-5UK>Jg?=?N14@wPZmb}Lw$&(h0cB`i@PHK1sMx1DRmFz0{TcB|ZoE8J zF$hMttj2uZ!873qbD$joCBr7OdCEZfg-1llr81fR)qj3Et1n?yZ7NBR6fZ{=<7iBZ zrVsIyKpO_dAl}o#nryhSdUnxT6_=icPx&fRy29-1UpnQ7tWitacJv(w zKv43L+Kc9G@5~3lGV4KX%x2L9D-%n6^)cyY z1(NNa?rcehPHWHM!-FFAxoJUyc7&eDBp-L~8j@YZ_GiZdmN0K?tDeG45g@3?GlmlA z#KM*?%q}Dd>KR=0j3b^s!=IUWl+8TyO8V7i>kT{ap(G zs$Lc}&^x<7NtMqtq)_&r-`No(d)Hnnm?)K|d9X@cl*M-h>~gw_D2~XXdnUO6rkuM^ z6f}M%K&Gm7BGmP8(^6cWrW(2YQ!&bLRC^EX{>Qc8`^U9@r@D}h<}E!xU8;pSFTzhK z`2+k#ju42PXQ|f9h?ImluU;K(&-(An%pJIXQOcH~NHiUM{2o8o(0X2i~m$EE1CkD~aT$;EE zPv$eegP2wQ4 zMw8yeNqME<*;GI6^DPo-e3#ha@-l>;#m$VvfaV$pAVZ&#|N6f-%pJBbw7}{ol+<{I zP3$_~a3mYXTP%Yz+FKs~fGI|3Le3=)zZdU<*EV}>$yb`98?9MUC4M;MAlO7QFSZ#i zDOR>zwu6l5PQKS~#5yc_?&<3C9B*DdZaD89Gt_WWH-EA)>qOJWJ||Gq6TE^@Es%gc z!nnys>YE!F)!SRRE^S8&2sv(GNH0_N03Kn#HR0>Nv&6O;7b6TSz8 z(P6F0$HwqXygBPfW9P-h+rH|H5#2cXc!P1P+M3_~@fUJ7?}qS-s7$*D1I+WHZie$P zx1+>QMDHrP1L6SnYr?k3u6gB19hs9EfSc;jG@Bxai$46{rUERCW%xF_B=Rd8WTXW|PGmZ3A-Oh*gQRc?g!y~zJX#;lEaA*D z#y>|zJTpBs8WXCh^oS6Dth?Tj76=qS4fyS`K(pWdzBY85$WrExK9({e&+zY`sEcnh z<2n;7nWhPzM4lAo-ZrooE;l<%sAy2X*%Wy_X#aSD4c%Cqm&`N!<@u?cx#7BQ^l!6$ z>#X`33T;$Mb?QBvrQ!O#fw*DR*QJ%~cxcCnY)wPSQrEaz>7ZPS`LupxQ`SrF`%bdQ zz0zwP*YUG)38CFb%PCWZ0ZqMuXOX4xnFe_!a-Z6Xnlo?k5Gq@?phIOi*ivRzZ(>{C zuo2&@Za4oN5_E2xoBhh(LiSCd_c=s#+=Up{edWpzxe_X%iyN!$_aE%xyeOaCsB2cy-mo+iGKOhTbd=O7$u%KKo+bAhW3OU5NNF%28ps^3Qwc zNCF^e#o>~#`sgaaqw3i14^kX|$Z2``+jREBjcCM{6eDd#(Z({m%~AV)Q2&kLTGPPz zAkX(b@12M5*LQ@~XPIJlvPJoL60$$BF%P&EyYXugj{t5_nP^ckbOk43TdC}F`92at z@{eon4eLM3?Si8R$lHpQz7{EG8q%x~#LwV2CY-*G755&)G-oVRg z?rX!UR!&y84P9~~K3u#?tus!Ueo_5kuXVyRyUe*cb*<$RlHycDlu6YP-f*nnMwpwr zl$e687l|E?af2jxY%GVQ)D7haUtWt$LTW==cC(~(){|W;f6uKol*Sg3beD?#)the> zRufEkZ-;*`DM)(utQ+w7LmZ%lo;FH>aK~r&WENZ66^G0PA&8p&h4$JCloqTQBvaF4 zpCp*|!W{TS(LpefTYa;ZMiml?soExnkO?3pZ4{pHy^%R}bE)t0M4u3Y2-a;U_#Fku zhR#9WF%uJm>6pqJPV(I-HLEu!pRH;*0CCeA^E2_U(?+;;hf(7h9_E8{c^N;)hK#vE zc*&EjmBUZX{a-iaMf4+*5FtADmTy!tU44bT{sexS&pV35I-9|u0#Y9>m8g#L=%#a9 zl$$)blFO{+8t~Ms4=7$YgK7_DYuP@PMtvpa=?62(b4)3|oJ+?v`9WQLQ7iBsU ztYp8GYPObR_SACF4xaUnK<5zM8|Un?Ba!~a#AS-?#Yl%2QjifF`zc8G^-N$Xd{Hht ze^9raf6r|rUn($>AkdNRR=2L}9Y`nbU`}&vimjO9L3g2KcE!UF3K*!xB#*drH}`l& z#qf96E|oT`<@Ma6f<5M+8+vRzXV(W;9ESaurqlP_7l}M)jtyi9W37D&<$h> z3uRb>?#~@qVt($s2UE;9(W%>PHxi}DI%l)##{MSdaz60%U~rmL!GM4q`BZAfAa|*p z4rhpJ7FR`9y->nI!tQ{-a}V8U>vgrD&%U86Mz|a z)rF?N(fMpL=D7z+zC;MZ_xd>xA6ANN1Nw#V!$IQ$e@*9SakJ>2fRt7m0FOzl%P-Fd zWAhDwmxczXzsf>|Rz1Uapso{hjD+J%V?lLsFdjLDrfn(IIl1FGmE{>MKHO%8Du3Mj zl5z%olSaP)w_Bal1EmTtPOIzeivM0g-v8k+)0kH{HW3BoJyWl#%{w`$KDA=m;;tR? zBd}+TdkhA1RYf>%em!?^gbj>(iGex6E4S2I9wwP)h#bEH&pTcqjO)LpVK)-XY&;Pw zBIw*CYQtDkhjFwyZR)4R`n|pyt&Wo2nTT*Eyq=S=ymU@5s%EZ)hV;;MH)tVxM;d1@ zNBc06@%aPr3V>zZ2lbsP(cc)RojL^yBFk_y&Tj6X!<CzDrP!y#GY0{f?NPtiRgr-OcHAwFuy@RxbBKQpMz3+XO zXRWi&I_K4KE#E+#iIbVh{6D{Mk;~nOTT;dxVvAR&5Xi51KjTU3rmAJ~b+7k}b?v(= zZURE(Ae#@1J=of+bm63U6RJV%^%=>X1<^1o1?Yl?YjKo3Alr^Qt{ooC9(w4NIvZpC zC!WB4j|YHN@kGVjUW2n)xutH}ER^BYy7!k-Ai59Pi36+J=Zdf^PmiXan9>%ymAg>Y z4O(Ay6PRS}s{>tm^YNkt=q^b${!yX>B_f+)&Pf|bP!D1|H0pq84j3NBG#@K^ka)p# z9I%fIi92$S+k1qzA;r(!mU$4ZXU?wK$OEnCXi?{NkoHe-Hg%(^VlOm(D;&4d7|8M4U6F%l=m5+z+1-sO@L807??eM32Nx&Wx-4K)V3Vr)BVtv4J3v1KF zvVHJ39e+a`&+3gws4fEee0Y3hflw%Bv=s2+qD!!VM*1T{Vnok>>ARQEC9xOIa!3{yz;xnAGu+64R~>s2L1sch7oymH3rxyK_65t z)sV9(_~{~EEDK~lj?_cNjmCSdt@aLu$=wz@KD+;)n+F~at1`J;;vR`5L7rU)5owwu zRwPDh)bF1@!COQhRjpN5-E1ts{dg?+UTy zuFo>!AW1cs^#Z_$F`sRo5S@d+e0IfX8?G_eM}(=h=#%^GwQe6`&-)DN1#q(tp zoe7vng@B5IZRFQ`*Yt4;d3ZhUg(xZQsX>V2n6|`?y`=a;oSEsY3B`+<=vCPYG%|FO zl(M5*^Ta<7O+}tx8cBdNQwG%@pg^;2o`Cv=hC+XvJL-+9@Y6TtT<6OnQXGV(2i|FA zlH($vd?{}M)Ka4?;WK1f)*F>JJ!N~k- z+9aF5bXoW1zm3N2O%5RHj{BM*NmMM8Cce+|6D0(}B#ug&F3Igd^!_Y%%-K>uyIFgO z;oxZFhx42WIKaiWKP+aE@sm*JuDY*{DNNbhPx6xXu9RE3XLnC-oU`o?G`F*)KAWvS zTDn9oR`yb3Zd9g>zth`cC#SfJ&F_B>0roKiWN>>6wn+amk_>Kr_4NTGK5dEE{VG` zOz-soq7BmPq1dqrznxunQ???vo#Q@-Jm+7EZ0B?8h2)ugA8cxLrB=9V_~TL3;|pxFUu(1mDOxn8c#nDci}ndDxqo>3PQwtvX<{8#)IGdA)>st$ z9HDmnGGZ%KGlg!O$ThpG$a2iVlnYYY=D35@k?j<5!%mc5KV(W}q7_c`BNkaJIAhax z`%870PFU0&6A;@;A-RVow9e*FM+H_<8AALYPi(C8!~NYAEqaF6{p{{VX3b{sCOPsPCbYB20fbc z^43K`UV|cNsS~-6`37ETSVp|I$3^3)_;;WVVQb?F=;H^(ogDvRx#^hGT;2MC_gAAl zJ}1g1Pc~+MlD28`P))OT6ZK^z<{|#NhR&yc5F3YxCe&L>-(kBb(eu@2#$`jzQ|Dub z+b52whlCDuIZE$^k?^^R=*jC=vFpLAU(-O|jRHmkMZTfh&pp76l^?EFM>eR)%lDp) zl07s4)0<1t(a6I=E*WdBs-0Nf6vQa(72THbf60}$r+whpoc!FLyUY8wZv3fJml=z|J z{jK|v<^goJd1z0XRO{zf{RhydEZo7|%utVB3LQnKGl0ZQo_m5?W}wz1xeQ3QKppen z0;~jYW8e9%b~EOl_7Qs00sTge-#?KgPB+Q;%9qFeuHti6BASh7=Q)T@=*f;vFaw2! z*;Fr-w@H#Bi0kaol6q#|IXxn9x&uwKKQU!rtiBK`%sH$-o={l$0uSW(%fCv< zzx$I=_PX)Se@iO+Pr*OH_THcW-w!$ihK81l34R_s1AW?g&fnbz=LuTH?_V{D#s@gz z++>P`dv#1{Y6*jl#K~d$cWO9$@_~FheB;Yz z6drBv-;XY+;4CdN@fZ%IUs@hRP1mh1(xI0qx|t)lg4>mM{9RQAqo+Al5tbRXxmZ%O zt1;{_h$(9%=0xM=x<8&=i9knT27lt#cW|0_hHz%j9CawCP0tpEPm8AS))%|T=J-SR za+uVxOAMY9w?xMEboTgD6`t)2n^YKNARf5wX89G7PX_+lBs|_h;sTn`i>>WVHpd=a zn)(1t@&6Uaq_Ho>MKlY{OyArrSg0s1-tP6xppOFl(HV5E-ydBZz2syn z<|~3f`n>Mi{Tze*6*Js7ouMrdF|_ezSotm)H8jO(nfjwFGkNbDM%b!EgG^5u#xiUb zas?O!n^MO1JGiAl6;$L8a7w?^+5H8NZqz@Anty$OCvUPJK%LUHMpB)e3R<}a*}k7h zj!)!nDRO;Et3_k6k-o2Vg|&pRgR>P>{7JP~6MA9yuI@utL>9(W<0K^I#EolBF%Uky zI&4r}1uRD_HOPG1CAiuE)3n^vC;azWMG}TgO$_9&eRY|&3n!i2#an;BNpF-=Bt8`d zIYi4PO{3nkQ0C>!m=sW`UemSrpOLoc^7n0gW7lWwzi)f?J)NFeudg{tDsM3}c&QiM7~G9}-#8V0n8>x7kUJ zj-}SHOUL7AzWoNmb>h?=p=jXcwIl!C|D{3M$(zn3=*ZzIWt-_qst~(mn$$fu;5Ld<@a5Yt8!-)sn^i z2hK;eD3yeGKEkMfBYhU=Hvj%FE$WQWZ^?VRi2EmUWPP&B7-&}KA%9LWGIUcuYd=h9WbOGuD_zDhN zYC7`=Mheje!$4o<<&f7X3l=df4GC& z&tHcq>bTfLo5#oWV@WHt$FdKq25YY2N%jG0yXjkrG3BK8L+|4DML9>;E9@g}8 zVROkP>Z+xtf8)k%L(fLT{8iYK#uB2%P3s49S}7Azzzj`-c~$?2SV#m7n%ckyj`801 ztip6>mmLt_fI@v>bi&l=aTBkL34Qi6^RX%lyU*sg58{zS{<7KT8n)mTxIGD9>9Gq2 ziM_vg+s9pMA*z!Uu~rvNx3J?Zejb6v&KhUTSJ+N35YMnXoi*pNKC71U!( zj{ND`m`4S}VM}$ZCw3_&vYM55Dl-1I(rKYTY9`>)Ku-Do;&V>?@|TF>sGcc1x3nG6 z_)!SYk_NO<@RhkTk>|J;O{(`*3vkJm_proG@=SrHHXXD6wOKK%Vwxk+6QFvY-m5W4e4nb3s9`qDcsk88ieOah;tpzgMP zhI}6$v(0)Fj&W1GY)O;=t*P)CZ+Im149jtZaVu}%Q$`;mHPG5eEN;MAr zoV*L(t7u*z?f5%rmIklr)A83%d$ZH2409{6RaO;9s|TRvv%K7z7o0TYrWO!B-aDET zPBB`;QNbF>sM3|)x8tj+^v<=Bi&W?5-qCVIW~y&EQaU&}v5!WPpI!y1TXJQqGMhd* zaj5I6FAZCG#JCAXeGzyo7Gxv3q=BsOwm;Hz>@0m?j*4#aunEiWS_c*|C($rjc zZjQb(a+35xDP)M9B4Au+#8va@=P^2Q}2=R&ej9l5}=Ue}< zy2JyRBP}jm8;88kIqo950cj{E8G+wg9a_{ZbS%Qd$?ncZgXUo~vZD`#%f44HMnSP}?##E0_7?`jDYBvZLKc=6sa9QWixY-ORt1|*FoLMB&*gO}r6ZWiv~ZKUZG zjbEZNl9qoTRA;N-)vO9`#Jr~8R||bJZ^@S;{LE-UBj(XMb#t!sE?GLz+nMk8?Kt?# z?I-r;sSw747e9{^Uc{0kJ6~?R*Yua+=g<)o;v6>&t9y*_g0TG$0CAJ2~}T| zEXX^g>?~#^TE;dM+-!e~(sE7nkxRd|@_3TcrF*p0mcgLp`otvw9*Jda8;#I-Wn~D6 zwL)RY2$1>Wu9sR7uz(h&dep8%N73%h#~G{saU<~yC2|kY1C18bFV~e1XG82;zI~_1 z35C9u4H%~g_nbyaaBN4xhrPTKdTTR9?^SK>V|#WYG89I4D|kJixpXf&!|71Q>L^Xw z%dz2|nb!a_AA{qNZI0au)%n2)%LFBHPFhaQ+OBgVpoSZ=zI=<{ z*erIIEBphqdRRiOo1N3q3(t5+p(q_5=f&|=SgYoSlsc5VyGn&@{{XoPE<`SMg~eA0 zR+%W+UzGX=SRNcOmoXx3Z8@`Z;j89uN$IlQv+r+7&s`(vrfO1#+hY1c(?aL!^AiS6 zazLe*g%b*~uUva=A+288iL!-6-3ST$J5{e&@ap^yN44gr!a8awxG3A(TVxRc5w69k zAMY?b)HjxF4o>=h!w+6=umzW!M}Hl!wY{L~(itAVD^84)RCOj72y#y}j8dGTv4!hi zsfehtT#!&U=EZS9Z!1d@MD4UOGw42Ct}}i^D$wefQf#*;Muf= zvP_=(1(ZWE2Vg?qYVI>#N2*)u&4Mo)HvXKtc;57`JNJce@&#jC2BvCp{_ml-?%ltl zV5CUp$EUoMI@t8Z4doHR!#?i!eK;j(?yu+#ygE~96ugt|*Bh;9K@IP{T~70+C!B&{ zY2gR!DI7Eu`}>c>;w@~by#PDa;++2*e20ob0vDTQJY>}7YiaQYh5SxK!)K;nlgzc5 zOj@U1)04V1GPg1Aee(Ps=}kU+X*pXfqq*7~<1u_nUrPK9c9x2yF3H#Gk+^w)%(zHq zgMa$Qx{mY%yT)ncKWm8>Y&>XD&oGzr)=Sf}FN21 zu@J@|PJNQXt~gf<6kLts-;m9Se#7l&4f?jVeppC4A~e2IC7D9g9>RvE4u!j3KeK4c%e z$~L=pH5Fp7%q*`xIk09t(iUdQhtcawV@jamSFPQmtq|H9MNz`^an?TuKva~Sdmu26 zlGM>n>I8fH^)!KB1G_R=Q6+dvZ^)jLiYs+bI8s1wsyAvjq~dCqpRRiju52!U6~;uKIZ5g7&)Xgk|19Zxqql{5+~MECKiA! zzsDQpw1#R!&cc*hG4Ck=xOalYu~x>n1B0Aaj@-#?$ZO6%!k6x3DgUFyS8K^kY#LYI zHMq5h`2=@gw%L8cDP5ABy+Gt4WCyqRD#8Jm;^w{D$9juAWGZdY0#LT%6Tk^)_if4%Qn9*e0B^{Tgt z4pF?T+I;!R>-n`$4OnLjn>c50I2cu5I&|+6aY6t}fhSnBbQ~DR!Q@4RyQ?#b_B*Ey z2n6LiM64t%FkNyg`~f9!`d+(C3+1K+yJfLq8qK0h-&CkEY@y=Ri#9e(O0puOhagJot~2TkBhvVeC(@LBDp44shfM zZqQcHIVA+bFN5+&4X$tSXsR`dactKgm1CM ziwCf9{$A*W)wDp<=$M>MpI5{bf7S5ZGhwT6TTA#p;wMz{UpOCGs6Q{bMl|%Go{G>I zqOwBytp4eTIqIHr%~V0M<2U1X<;E?~S49Jk_SIrZ!DH&X=K2kG@~d;B-U8$EZpwEQ zjG}*ef?iuG7&8of&P@F{y!(*aA9^G5&fMa2H>5HhwotFKy+U)xSwosPDam3K;h zKpO-7$Ak{4E1%7HVW4-Lei9U7`;VJvEk+YuR3{!5a*jhA-Rt03JC?d#Jd!e~Y_1LF zaX;<|xq}-44&@!r?|p1PX9t$^OiZwA&7U*rK%6O?uRe)A#lF0jZBt59`h24hu^o(% zBGM>i_c1Z1O>-$6G#{;qJaD!|x+zk=#ns6NIHiAW|7_>B-cP%mswP9Wr~be?S8-p8 zQ$zw86`nA++sq#BPmCtrsT#;?1nB$7MQ+QOZ@C*8Pe!k&>qkt!+{N65kYb~ZqRQJu z0mPCDGV@KP#^+=(&-0!LLKUi>GDghNe@R4;K|j>=NXo3c;-B-Ka*vfMGgGA)@nzdt zO!>9-&P<(z^jA?~s7G|`>vEjxZmBZm{LbmfsAm-*v63|lGceg*9JWB|TJUoGKy7Cm zGix;TGu(p+axToTt3(n?3m3D^9|rtF2uh2OSCU-rZG3$tD3W}zzUBhoR&CHw#W`Qo zp0H*&tgl?EF_n*V3;q*DP#rM_P_C z1Qcqg`htX!8v(KFc}`>EAa(Z$&zr|*q;a+{`G|9R_fM9oEX=?TeE#M4y@YPxnrpEj z;G#Qs?yZ$57eU7`y`5Nb?T~WxA^nTAq~T zlX{XEc!}G$_u$9WlJd||>vULz9~QR_3I53?8OW5OL^Y|!hm_2eRojoa`Jr9eq^aRfmC~AoyY6(AX!XEQ zdQC>5=O@tKEoOA*x0mKBsumi1YZ>i$LEO^4slwRH^sZlMt4NhU8{`6G;MLARk}MON z@+?W#!PC=Z(znL6r7IVhH8684Xn5@X)qSWG*e?If!}_=~{y7lOQfV4^O zqbqhpgG+nl*W?$c7tn^K&Sxk3a?)A92OX4_QdTc<*70b@{OJEz`j$kq;C?23BLvY` z?ORE>#ySBZ;|!KYkJbk6UwQw2)$5km$$Cca5UbKh)N4|s0Gy=K)L8btV+~q@el!gG zW!vZ9>aTm7+rFXN__0uX3Gj$uY3`8=@#vh__`l!ux`~&g`1(HL#HhxYK?(BlL6rE z66DExbZE4BqGK^SH$bWW{K zv76P&3xNchoU>_OBnj1FyJSwY-!l_lln(msoK2$tSI7IUL2RcMiD{$%ceQrX)x9q>h zTL08aaUe#@#gg@_FV8tSnGboobzXlk8twOcuj-Da&uFY!A7dQwKnv4cbqf`y`H=DH zSH@h^W1>+QyHp0t+*N|hIRBFWN|6aDqKGcs#jgZQyia*bs=+>oCym<0Dd#VFDMIb! zGeX;wKGN^Wy^!}w5{+JAXd%wtL1(SqZppM3+po`;g8?eMTx4PG^LNG${a2K6FToa8 z9(jkA^+MSLF3xmGp|V6f)m6WWo66S|WwQ_1aCZS3JRvd-@+JZXpUHOr7O%=7)6ELU z($>(oRXI=3auzS`M?;Kp#K$C78nV9s;f)i)=g}1m33UAJr_{om-n+;I5f(Fcf z%a}+~Fw9lHk{oZZF#dA5u$R0`wVJ8WPJ3H3W&p6HbUi`9-_V% z7Znb79jXJ_30J4n7+@lzg=s@wHcE7i;kI?}oi17B>a4g~dEaBBoz8w(^BgYaVc1=M z(CI9o>&NCiZDW@kI!T!jI?}J(WWLIK0dPxI`|sd&X)h(@p%fgc4XDq{M&6hz9OJ0Y*8=t#uw?9V)3TSfaaRWWnX2qviL9%^?-4+aO9uZKhyh3e-okG@uT6_nbvcZ zU(+K|CK(47C0nFEoSphZOAn;*%XXLbu$Resx zT*a!I!8QS2`X%h;k}cJ`!Qv;tCIP#(MT7S;MwbW{U@#Y}juMY)74MM8O|DuuRSp?c zEi)XPh1uCTg_lOQ6%0GA7i|YGiZ_ z?&13E-?**m?9=(T$gLnOX882us;2mKuA!(Zdt+`(M<<}zOOk4bvg2P)nD_rGuD+cV zf9PiY73N_5_+@o}zwpb1H}-Hl833QkdYEG|=SK6SBJTS9gP^{J`Z(LkNmU3>dmBz3 zuVbZk#5J!8XqQj7+5rJDvGd`yqI1}~&sv0-b`&b?>;4L;BE|`h%Vp}F$dD-YQt&>j zmV*DaqJ=`a-X{)y3{tQ1eX-)mLMgj2+mhUI$U|q)-6Mwv5bAvZp&Ep{A7bz8&Dl)e z^)4pNE0z$KT!IDJi2% zSu^=A0inx%Ee~kiqWOFmZ49@W^oWDz(x`oFWTLxh%i^bFHXQ+BjKV0lrgKv9j!N+H ze1g~Vv^;rY31m3NHzvH(sSrHEY~j_3nKaawcCX(B$29D>dM;NKq&OvV;#=A1L|)ZX zH{m|s=C9gV#eGEz8->RAv4&@hzc*0fiBB(A^?)wSt54;vr2yQtShWNV2f9$ zPoaJmqOo>!5DMx+#W5xs92lpW7(}d^3peL5rpP$3hQ-=jVFbX^7*V&>1UR29tDalZ z$K2EO`zaa@UjG3=d0fQyr5*n250BR#@FZ!bvN4cK4x=l#sv~~1IlszswU{(rkkp?wQ)cerE)O=hx5PHv4G1A- zB3hl8J#3)d!WDV)t~eOfWP1li1v-OnKUVI8SFfR;z7*RZB-CEMlaTFT=9I01IKH(} z^e)Zivkr1V^2nJsehTVia1?WU`RJ~#jGU$7gY~yXC)!oP^0H4bF&EoYAB}$-TOyYz zq6W6h@3s9Fn~f={-Zc#6i6>u;j+EmCI@Dkn)romxgxbP%Nt=QXOA3Jd!rTz_ zGcMCP@LSIDsx6^2^!(Gga+!$TlQ}@w*VmFxR?uPB-Lar+=04^?=o}+n0#uCBV>fB! zn4TY004jnQ@8lY(b7Xa&OEX(>5k2FbYdm1}XbphvrWXIS{aCfANzjd2$X?g;T;FH# z1+ictQjRU^e7fCx_raISv;wxTcR$`O>8lrE7UAIqH*#H2m%qdcGZZ-qiyuo^F7WcX zp@GVIcvVT+p7=DMdBB&xPbhX#2Fs6%*FXxbLoVRO z?5%{yy@9iu`kqvsI}q>K=tW??lJKYdFcm)|X>AZ&xzYmi>1Hgj-M;_OQdXyFO`n@8Z%pxc-DiN8 z`(LCp=bmlGQ7zh%R>5y~jpnFhI_)LGcyC%5RJcR3kDx`HH8F@}&arQEb& zYJFtl0c2zmX1*hxC~OECvHIHIm9oqKyrjqaM~hQ2b?XMcdDFw+Qo{p)TT$1e?3r=l z@hc7Lk^RCUF!j|X(>@%VjEW;a(u01V=nd%W0$Q7)fr;xKw7U|}meCpqIA)lb@aTXO z=-nF4lXXD67v)>A=nKk{!LBdHs#d;2(egVVJ2@IXG}evv&%vwniT5SuB}VnCIoTMocgXFf?1yPKyz$=?Pk z*TtOuKzj1#XYH#&shAr1z%aOQh7VbMUzA^UlyI3JAHC6^O547shTtE58WNkkR)db% z7L@zYekM-zh>M-s!WpxOUiKM?XKDziW}1|GMS=t zLPVEqTnr*oD57R~09m35#Z~qHLM&9=noO^=HdtJvM>mt$b<_FlUkIdl7vW4Nwf$F81k-3Eb& zFD^)YF3Zd%^d@r?qf#Qe4Vck7cjb-8-@J5K7dpbMf4F0fR}s>FDb^D#h6wW2yLK1s z@KvL=6j5~=hYXTY_$+L8{?<=sm52(h#lvW`9yh|@=#Rzt-kNR{FQxLKo6x0RA$WAa zJzU_SD>^XUwoixoTawbcT)mBIw(_?&)@X7tbQlzVg_7;EIAct$c)5nZMJm&z!Sy4T zb&RfXb5hzS5WLd@*S;%gk;A#RyKBGA@7sQjmiP6M-!2Ow+28)gq>kQ%z_%cC*$hk; zVSX`NE&(*v%S~ln>;^nPf40tdQ#QYUX(!*42A*F{f5i1`Z#J9mn!dQPtR^a)np%JE zU_rLhVv$=a&o$Dr?^{Be%qojHTXrBH4XAh2K%Oxl=X4UHD@WxUaJt`(JkOElLqrW~}BSe*`%3|dcr`^vbTzJIy= zne4Y`$bCY`27Fi_b1cPK*T*wT8TBLLEhH zOP?ysl%&^O_+$8e`A@b8qGDzJHs87X=9ZX7Gaqn)ob$_R^Xv-$@}K$Q>-%@XL7aG7 z)lZ@nQB)bBKvkg8K|wW0x*s(8r&RCNfiJeRp0b?nD`gMfKZ8Hx2X4lqGIsN9Pyp}! zzbtM1e;F(O_x{?p@c4Z#Lm@z{d24@--qlBcP;cWyGf+o`beGq~5A@yG2!w;K<5WjX z&px_8e_qoEcXV|Cfh>=7!%E3d(1?%c`zsy()bL%u#@R5f@tfISk744?w0D-_E0wJ7a;6uFbKEUxs3oXK>RH6ad{WTX(o@^Bw<3@jDjzRi z2b<1a%08&S6V^^?Wd*mp(=n(2PPpt2`<$a$HPnt8p8yl+M9{s1Twsh{lZNbUn?AonRgVb9IRBcD}{KZZ; zI9?cbsd~^Ry?bUV!J$C;m&DFAU3JMxi;(mCfKO|Rbq%`gFT9gL%ui-d3#)EEL$M6# z{Ohv-@{lxvwTWh>+8YrXpe&A8Fkqh->|G)CI#bzZi9ghQ`&WaWt!R$VU+D1e0>GH8 z|6h#NJ@0`Y-=jP#?%Fivj`#<~G5C@n6cw`WrXT5U`Y7eGvsrp0aHH2QqJJ_}6l-)R zP@|gFy8K6y`pD5UqZzHzFsVz%Ih79J!mjDRqR43_(Dw~zJb-f0}* zajlSrJ+lvAPAFtW3IxW`W~pI22v~VreeC|1js5Jmk}v=7-W!61fbbay&-Jyk!haP;`=`$^NB~uE zq*VRsN*SNMZ7so#@Abg-$-ZX!qw3#Pu;-5dv{D*pdJcnY;4>{9^cf~H+*Ex5SfCHH z@bpI_P{rKRkv;!&?(cv9zb_N~e;c;0X6bDZz6cuIb>=ya(%@QLsjYFHfw7O>t`wJ_ zsceA4H$16ZZ^$=3@bBH{qm1Ro=pAjT{|FrP1K-_RDAP)Gf-r3bfz z;2rd^{_*xwiGRO8hKPEI@idJh^ctmE^%6pXNg~px~9?H(H*h_0lo?gzqTjVUAKY;XIcqsrlj2It`3VKl;&~;HGIy^ z-tv-Zg2AHe-2mRXxq!aX1L-A=+6-jxH0Qtf|GeoM4_KS4TnLdy?US=?$bJxVI>Yez zzCJRHzUVXQ%T|%Nh6$=Gu7 zs4eY(cX+8;GVp7&_7B$&EgbxNKVNVc=iuP(Lg5A2;J)2QI}%i;?v1mwS!SIX^zJlMX-gaFxyJiF}t@3ZLO{8_{HU+SIruyIP# z&rnZoEYzXz5)@@cy;Bbc9M**Ld{cm&$@-s4FSa%4cnvUGrnVaF9Q(tq%GJjs5xT9- zaY95RMj1kXaU$%)LHX9fXSa=6TZQ=TQH))nCf~bqprw zUbVXQ9|!Em4=Fvs5`9naRU5MmBp*e`T$OF)UixNV>N1Nk>cA{opb&G&1*ym7?DPqwMIp zKBzZ7E8b+Bwkg*uo+}aYn^^CF_`E%y*E4hIOI4OJlQJ8{4HfboF4bU3sD45oGIl7f zBE=O(uRWTpmbhe*pk}fpXR)Nl6euvc^j*@!)HyVFw$B)ssd9fK zdbn%U@IuuSlZ0XiL^Va@!{1Cmr=x140F&jXwgj^bt4x@}ise(CY{XKZabqS?$ZJ4o zJdtS=ayV6Y__Df&T;sV};E_G=Q~vwGE)ut$iFUB&z4^tbyvo}&O>0#84A%RnYrqcW z9;!If?a4f~OIgLF?@}AGDdei?BS>FcA}@P_`cM2waZJo=Wa0Ykl73t&vy7oh!Wx;a zA3<}pw2sVZ$lg@7{6yS2c7R6=uLCH(pyu*;f~C=1_K*<%_G8Tb|Y4Ve{`^l{M`m2DUoKFQlL2bTkj@YcoiB~w^)_=n|19z z`1Zb*un^B}*+Nh_!YYHEH!KQY25z9od>DGbDGL^<&Pujv;wsVt#zjPA`go;a!J@c% zg|GBLkn;I3H`C)grCRJmpJsj5ZsVnadsBe|@Y%XDZ@W{uiQsLlzlAjSK+)MFK)Mf& zN7Q-t$jMcWiS?Tn3HWbxZcAehlczng(a~@gph0lQcI09`>q(A6+s#+gDtUw5ADD|; z&u5^Sb010`L8c8QhX2(QICd1o&8drl5Ya9Ic`ika`*MD`KXb8Ienjdu{D z4hbC-Ld!ktKGa`nyxf*sl~)vb2he6|PP{0>7rFpoZ9Hd$8k26JSA0{ZXaV2a>9Bu_ zbr5WVDXB5}M72s~t@f>2n^fo~)*Cf}DZ zegj!03jRgj<7`E9B_OvyjV4iwUH+zsO2F>Xd8J!)jf14WK>DlJH)>YK^J`VI=iZo+?+Nldb;Lr!_50` z3XeBC3o;Ql^fhFT#`e4r9Z+MnM=6kJ9BRZk)?j^6-h{Y&2_(_=*t;POWu`VeNjRtr zvxgmv{zg7KpMagS2}Z9n|6SFl_*?_}?ve)R7)D?XIZ)ljEXO-}*eqrHbNIV5zR7}X zIimIHUZGJBm{2M8JvkxjZB_QAi5RiKsl1bCny2)?Z>A58owm8Yv}4^UOpk(#GGb+6 zfauR!>zc_0Kni8ereaJp$xCh}qS6XBzEO7gxZOXCfcLYm#_~+2D{e+9HWsggZ*(GDT z-<@kGN%lXWl3#j(cokJZv{7~+HSlm3Adgx%O-|q1@o4<1Pnk|++p*UE?d-F`VmX6i zHbUjD!OEG!rJ0sQU#%zabL_>xGbw+fAnVmN0Oq>9EgKvnH6Bqu=6hYG4Ox}MA~8H< z>_3B}c%}*S8++qoZg$NNWe-hJCjF>e%_DBk<0y~hMKk=V&0s0chRmfUHNahnPTaFIuFwvc=P>&p;6EQ?rvS;Wd!D{@|)^~EqMdhgvX6x%q=DbHP6FfpkgvJatPn8cB&u{Bns4a zb!U+5FKVK$d|q&8tt_L>|`Bqs)3yb_tRedo_e6T z0t`7taleBU*AS<^x59U`c}~w&7>O%V`+#FgNA35ex}S6IPU&IXbD*#fKq#ABz{ zjD~=WM(Uv)p=Or{8C@UYfbe34x~h0>%IG?-=g_s%@g`oK)E*Mjn%7kyQ6V%cks#Gc z{=w_8vd+9Z!EwBNq?e)Kp5aahY&>T~fj026=Zx3#V@bJ_Uf8TFT>`Z6v*6wgPzTo! zwAu{pppj!$)-u(Nr55rQAq!`hcH*88xV)hGe6UOS#XEG?%c{5rApfARNp{j}q?JQc zm>5kYWj7wT0cm`wor;*VTCo#f^ZM7cC4Yb8$f0j3pS#+JF{-q6HhH75PEBd#HuQYd zZhs1_$7q>wBJ&g&M0i!{3$tw*OV`B=DYhyJt3MmKLbOAzbspc{;(v9g1kK1+;^h>p zd}oply)WKv8}K4l>nO?+yS3S1-M1A3;UjU|_ES;~=)kVv9N*l@UjjvPDnLSP+&cD$ zPavpN9=1c77l^VoJ^~TjK}h?y{)AI^RdPd;*E3mOn_@1YUWf>&GZhyNKH9gGeKmzgUS7{-t~Y>YSU>bt)ueg(!{+m%=p;76exEjwp&YZA<0b7KvAHF< zGkWDCRH$}np-X+$NEm4P%JUL7jxZX;ZFLgLgAx3jj9L05QE{zl#qT17)>l!Gf^3qV zS6*f1#u(T20S>MLwY0KYJs!w#aU>p)-hga*KEqp_vlZvF2Ew zZ7t#r`Q?0c2rSK=gf5(zt=k10{qlVBYDR}Lh^RAX`cMkvZo08^QgrbfP*I(AEHJij zlEL*m;*q3?dcdWV7pZ$2XB}czC(t)BL%CFp?Kgq8sm0~Ur@*AhF_NRgeRlB^*<;{H zO4{!+AT>fWS-gPr;=GgMXOfp|CFMcq%0E8c9$icFip{!*uXhe?!TH-Qboqso9%C!6 zlQhNzfN`-Jxi68f3X(d{NyPiQSnAkneri!Kuk$vIME2rr7G=hLpHA-{)JTR0(fpRI z>NnFd9UiEmlP#3r3FZSTWoH?WRh~wa=vaaic&^?$4A38`-gPiF8OZUUV*UGOg+MK6 zRQ4Fxut>UGDdZ_QtQ;OsKLD6naqY9-u_OlvWwgGz35v_oD6&jyRY`^J4s136>k5J{ zq-dz*q`HQ$Ym6%7+^;B~Q1L*hoccvam$3CRnF#BKrwS4$=DXSs3tSEDxc3Kzzt=Dl z%REOjopu}j6vcHu-huUpr@9i0!>LJAHn-eQlBG+IrRuI=Vona6!bvf~@}>k1u1R{? z54Y$j|00Q+Jc$iuf+>}MtjStcygS&~#}-D4cP*N;9td!Kd`uk@FTfxV!FcP5kK6Q9 zB*98bSKJ6y853Car_^&t(e|Rk_2__Y`$GzETf1C32V2C${0+Fty+)v8!MR>%&2~$w z^Rkb9M=8Uv^m7~CDq_9~-*{=4(Hf&-o&J3V+-PjS0S z9$G!qcYlkaWVboD#|TqO0*hZXa8XQSjY5-9If}QmqwA5LyM|D7y=%G*@}nS zHs{gbEwBWmP)r1_a(*qmgnE zb8CMA%g8sgK#7QCpZr7T))#1VA{LNy>%Fw??IrO6HkYZZ;qr7C37C^P;>kt~h*N;0 z?p_KdK!9;?8%z(IzM}ux{klVj(m+j^$O_ z0Z*fyv9-=E>L&CVa`(czG*g`tvpe0*>uyuVsm=8LfcFYNb?XcJU@-zrY|Vh!l)3qB z2Rbe(Z&uz#?CvX@#hiQ6B;0=gRpG9PpQ2^4T)beF02M?Gp+%oD#vnpB@kPFu6cuKt zuq$sdLW^&ts!fMi(M0=0kX@}1Cy?SIR9IQ{h%q#e`w|tuz5HBk8Q*I22n6EfI8#X_ zB63#n;SQY3F&mFQ<{WxX!cFCdpz}dQ6DPMtn+E$e?HG{OPVn&8vHr$)vtTupCpPyU z@7l7*PgL9g*WP(XHSx9W-iCspB4`2%L^?=`v;ZPOy7VF)LLl@eAVoSBKp+$W=}oF2 z%>)QiRUmYT^r}cN3B421Gx)sES^xEZIqO;PIp5BF$x2(9mDw}1_kG>h?~1;*XU5Oe zrd$gxljgtBHK_LW)9g`vc`#f3KxCrTs?IWQBig9!{Mp35hu)AQj)AQ~_Z zJT24BOSW@L60t+Nn)hG>Bc}L6( zxv^^AN{{pD{CIferkMFG*ZeMDTx8EKO`w1qTOn^ou|wtEO4#S(n93AzwTD42J!Py( z>8=qbu~O)j80P?LL4H`GeYUKmq$GAju!!E^)OoXs&tK|M1(gj(wT6KkuQg`Zt#7VIFNrJz?FpM3;iiBR%3x5z}_7EQaN}ZWWe=ZWRgE)An<8Y z6BzL3DfNJdxOtAO4m<}UhA}Q@qctKDdzJLKi$HwxXVoJUi8o=XvaMaaI^I~|?DRZW zAa&84GFkU|)kz4YWD%eYYgG?-p=_4z#IFL_6q%#c#P<4aJ%*K8Adn(VNAzYkz)0ezmIcq&@13=pp#-|`m~BZ+NmXgE&~}dn!sg}%NAO~`{R-+&}~Mo6Q2!bbR1Li$ofrTu=g^)p=Ke^e?)D;Dkt=V%V(Lyjr*eky_a$OFouO1(Ihp5^9Gc-51 zyhUdH)mUAu)!&iu^g&ev>gto&(Nc2Vu4>I;9SM1ICiVq=wf9?n)&296h$ZT|Ew2b^ z59?6;qx>rh3Rx{DXGYInTmeqSeSmI9HqUZ|An{SWBXK%^;Jm=zLz2E#!l< zaOh^+=sNyEK&zRp2DZ^HgPqha=VE+;e{`5GHv=>g!cZI=NR%wQ_QHONhx&DB5pS!? z=qPXxs>Cflg^md^zIx)ky&%aygt@a!%AQGH`Npy(E$_AXs9p+-h$0FabTQC*bXfh= z2?%9oe+VN5>g9QDY<@mJB?01Ao|5oqK6=YR$7lReY}C4iDq@R4S+#V&mamNwaLh%P zSKK7c>$sXE3k1`cUG~puY?6iRdP-f3XL%$iMTKr{L2eX7A<6=Pr`y&R(Zun1B!4fuCe}M1@wH;M#}+I z__BGSO&>VCxoqtdNqG?VS1-qhqoycpL}J1%<0PqP@>{4I=@3z2>K)Hyhp zNA*>xqssa+L~cfa-GB~k2r0tzMz%-Tts7NtRzNYj=zw{7m0y4;ZGe4P3;%NwZzsZA z(7_`tumf8fMg($9g+G~bcXxW-(P+`WmklroWdatF0QPqWjIzAztrQu5e^k4!5VZrmmwqy-AbK`SV1o5;!U`_Qc+p- z4p0T&kfxHa)UKX1#eRZyy^-=B+lmkM0&Ww)S7{U!Sq#&l(tV}RSkqRlzT@x^ff|>X zJN3HM5#`X{oF#9VF>TaRWz)7=jAz11HwxR7zcP^iG zz0$W{*%Y2!=|*L~oFI>O^M209|7QHCYc14=fzbY&3^+yHvBNPt&}^YVC&9`%t69wP z_#3mY_)_YM8eDp1aW*S2v6%A3z4qgBX^_K`p!r*?egBZyG48;)=6Ajv&ok7}QBN}d z{8sUAQ(};sjGBET1O(!+T~Im6P&L)SB`1|-%SEZtMX`$~X&7*jH%>TiS1&%M*IJ6X zwXmc+aAzd~-ly@~DSh6~M=y<{EMY=RK)a619BeKn#T}ctmbq{c5Xb^jR4Y|#bzSkvX3TASS!th1decm*U(N50(YoLOg}n?N^f;?`$|5J5cJKhjsxo0AL`&+Kk{&1DrwCUhlFXuB&{6h}|rYN~fx zBL<}}7KjH$`BKH~+60hZ)&)&B+UN7&(J!}m99|5Fxdh}+R3U%SXmhi4C2#NpjlEuV zOYQB`e7#^`2ec_;rnL`Pfb`|V1)&?~KU=i-N(b$0`Y>fulO=<6zx%&sSo&SMsk42A z^C^xl8+^%5ouZW}lcKTT%-^^iE-^Veo+cVIP4lD#A=F+wZ2+;E?66(oIgIh`?91@q zit**u>a|fjmdq?Fyj0v*c2He$z#@GY^*-ovE@7)Xdn}porkCD&$J}zKtf*qz)aBVk z>$@vpP9MqGpo<)3(ZT&O#h;fKHx(Opm8iY9{khDa&LKmrsMkV4ns{o@sxuwryfx3B z9d7QYFyoA>>9eN4w%qphkFi^7)u%Qj-lSx$hW7v?jD#N(nYEGR)DdPkNK0N=X2pHX zwodrf)B6lHWo-ZxU*1S{TG|VegdPGR3x}w`Oe1i5sDk%`r7)taIRF!m<$Hm*hIf&a z0HOoDHX~r>3h>fbkC)eNYLcVv)7H=LE3Yz0oR;1(bkFV7Q)I`Ty#M7+l3;pCQb|6W zx_oK>bx+&8x<>E~;PUVV%<>=7i~jG*c>gIo>Hq)w>9IZC{$uRa|M0H^6r#Zo{W?wm zR$CLkrR+zhsp8fytpKdvAwxYUhx`2%hRtJ<*kVUnh_6erE7$Qly;G%rO_108t+1x` zU9l3WL=i$iKvCV4`c_*M&(yo+Mi2dNB|=W4EP21$yJX~ndI>Ig9r zpSplh98j5BE@5^*3-k401Y@XQW>c|e(&$L;_b~?te}_D-I`sF;MC!NGt-bC_o$Lx- zR<&D^OWuojBQ-xaCw?7awH+wy<|tDm{N6oH+YtzG?Oj?*&A+|s7AVP3mF-VjavBcm zt4^f+4!EBvyu2euGM)M3qT^U&_6m~!`mF4c3M*4OcFKSg>yKp^%J)-_V_wx_=YG%~ zQ)11qF;?H?HQ=~vv7eLb-YD+xe|6NyRa`wpFTKR=_=GfnwiPVwzQg*x+w-#~zy)Vt zfrmXCiWW0T4!H)@9dpRb^!o2{I;MdBqVZkl8l4kNiAWw$1L~7=h~R5DXm+lj(=)(4 z!QEtSORB2-{f^;1_4oRvM%RrZ;z9Q1ddLR@C)sEnf6L@w%rXln0zWY>V#&@@j|5Bn zWl0ra%*N}~LcjT0sh}|-y?d2UPTXvi1+oJX(GZ0wN&7xRcG}pI);GVxV_j+7w*XSBkKt5)%UK3Rfo1CVOEL6fKBoj1u&)0e9azvZnoCBnq9I=FEjv6H21x3WD-nCmwDGh*jx7emxtb?=*?WvOE^0#{*W@1$j};vsm{&-dfTw6=pWkfm#(m(_geQISEg<|J~{E&t2(J!y-=ox-N@O& z9pj}d1(n&?Pg8tOfK&iHj&OL@X z!*Ds4OC(0k{0*?Qltk7w6H%nCsUVGO9*}ciAD4&j04%?gPhCk58xn}$&4sKSewV{u ziSdo-9ps6P?8Ld6v=+=R<-6zj@SwWJNPb%LZ4Sc3;sg7y)bARC%L-7_A2v8^SPE~< z6`9*fv^gz?T-a9R5DdwE=gf|@zw+v&JBm*jf?y3cevW$4KXTYi{E1JY7@kTR4V7-< zK0oumNmhnQ16SA?IgeU$4_qvY-JdK=-y0ma49+N-S9Xb*^KgFybq^5jv%Z(MCvswD zkXI(vesww`EG;e^>;dIOsXphK zrFvL;oCvhnB%Oeh?ih>0ioAlEgQb>IO+){bYctt>uhXXk(oOv8CbZTM^h(9r+vUJy zI_t+eapP&bm&~}~D{}jV3IPqUYoWahQdPm=p^o`AT^Rf113M82H@JpW_bp8u!9$7A zae9$$@TR1?BbIr%(7#gvAw|pNFePsyFZC~lWawF-Y_#K9fegZU!`7S1UlQix>&zeK zO6!=#fI>^wN9b)yB#np)P@wi_Tawa`+5rk!>LYm&f4|xe@BHdgsOx1+yh~k_%s#s5 z+7DL{tKpEOL-&NK%jV}l>Wd3Qy{{buJ4r~@(g0pMKr7L4-mL|+l1P;*1I@qm_*1Qf z3u*sD=*P8j84gYZ%_$%I4T8c*0ik1F&fj<6ORUW)mza0rVH|(Ta+wVi4;6VB>bCN$ zNX0$Q8Lm3EYaCJceO$v%I|%?|l|j9K>-3QVTK{S!TMwnZg44Wa{P-*=jN`fF2S^L2 zdUe(Z1md8{@mt^%_-&*-X8ZQ)?CSlaw-{edTSTAfw7RMP9DU=DCD6v8bZ_AFyQZNf zkGVeq994;b$y*|I?_V{KM@dsA+m-KRct;5;jubjrL0i=O05@5G;BJIT)38oGtgWwX zqlA8L-8|FqnT%`6{b)%w7z=+RbmHQCeCLR0=t+)P?y(3Y)XDoG_E$~#1hUXcAg#^| z$Jw#%33LG=j|%U@S$agc=jaeS*Mftk z5t+utjX&e*;)P%47fg-xCZCn43cNF&Z^Rgpt7#!(g+PLOm)o1bP4iw1C5(`^ESyR< zH(<>fw-)Lr<6+T(EKalZb3E(!V3<+kbe+#BUGAxSRZijs6pT(%CR$ux&_t|lO-o?Z zXjJIOacJn` z*r##!@6%M}IO*tRaOwHsjrfyC_Pb3Tu$MqSiE#up^Hd3ee|+<3->Y%Grp!uw)Y=Y> z!g|}9*3Xljyo1=yw&Q+XpLp%nAKP9=K3cHbPoR+99~@s%0t#F*jTVnQF6=xevq8k) zSC6n2(o<$;_a$wW(Q?ug~kmL25K_K#g8E5b670n#>r{xRNU z5FQmLAqmjG)|asM0N}fG{n$lJ*zX0&mD+Lx;niZE?c!Wq#t9b`q!0yB@ctHZd|x{T zP7nfW9~56x0iyw1RtB^V9;n!>{>^Wh(7k$gEwcs)YQxzY5AlZ#-Rq7gZ>MEqM;Cn# z>Uturf$#>|Ow-w@*#o^-2Y>=Ht>%EyW#Rp-8y-`Kw5~VA3>@EsP46=%DNYOPrzS4I z(uhqxG5N&ysxSkZAvQZ=T5nVod7?)Z%Y867iSWXBgxOptUqHVuyEgm@gaPI&1B)x& zs{RQR;hR>qYNc0<3-eK^jfH+FF+W%KgSM^iHI8+RqYT;O9=K?Vu@n;wXdQc zfh2joSubW`=8Q`N;GO(BfT3!@_d#}~Cu+?mjhrzf;qtz6jKHdoOLO&2|IBK}J#;ZsJIBc5(zCI{4R}G!GZ7+_Fsq!9LGE!l( z&WQ}t_Lz>C6xHJRU3-7~Yj^rX=`?YRWMJI z3D3Mc>WNe~H_i?X`f2}Xw3EPAAN$MsiPKD3jaN}eDNSp`N5VX6Hs#ZPC8>ze6*cLL z$mr@_XA#%{cARZVk^4iHA! z)e1&MlajN1jY0QLWy+`cu_Qvp1DB;daumK4(@&8}RV?y=D6pq6+6bZw;eU#SB3io! zyS?EUTWk!4YHiJJ0~!G!(yeAF7cAN0j^E)#{88{Opuf!RO2qil1dez;z^RtfoI=Zv zkM6drZuKZ2r&R&CQ1ijV)a08$lmt(7xWbk; zX`M%6a%k4F%Qgd3yJe~JP>tn0cs3uy7?G@g=k5g2n#8Z3CZx0+MRGgwVn?O135!+t z@(jjB)^x71%~g0110mBo=tP#jz9FJ+UmGA=HQ+SwST7EL_orU{bd#3+x>5+uuWT5A zv&!JC)nO8V0IIA1Gw?KfFg`Hx!)ZI>)zk(f6&c)IDK<#OHpkbfXBN^^j0=C;F{{v^ zXZkSo-ta4f0W(whb{%zFQgSLIO9O3x{ggZVx+XcYN92OUx4D4871a09Ps12;whISTof4NrrjR-LOqGGNwfHo0Ss=?f8@&)8hyZa zb$Qf>3f2pJT<0YD4rIeA6=fVN&n0aTTf4g4K_-LS{nl;PG>s~NVz_;Ud84Fioq4!F_8!l_ z=wWP@F;=3Z(qo%|71u4~)Ilewqtj{PP$mO?c&^A4iIN6UI(FJlvy>Q()t~lW&#V zz8`v9r?)A%?j;4K5v*H|GH5BQJHU2^N~r04uqd#YBn9*-vC7>#i^Zr1`!CmxOyqt> z*XE5Dy8c=OdQXl9q`aGQ%RkBop-IXh#4D>sVUcZ7J6-RNq*5v&vjjqb*|tRh`^4gi^X3PhC{dPc>A`+{r)(W&*G4w4QO zt$iP!24cM8ZtCNrKoGB*UQCUf*ja9E4>7a3R;=%AlL+6)Wr#3?AkQFu1zVHWN z966o{A5`z5Tr!s z_T}6zp}1pu8TmeOMAIw+U;6ExAXm%>SS}j+%KaNz`=-Ar7(D)DX`6GjjV%%Uq{OA` z#2q>`W0Vp5Ykb$zzs~t1$`3cSrBn|c2s0-ROggZAHM2E5WXSas z99j$(^%%)58^PBkE?MdHkC9w6%w1WP7%}}f%;`7KcRI?4DVGNocl z5Z~hSZl?gnRDmvsjwm8^)lKr}Q+|E2M_`-G^n33$a!0Ys1C!;sN{^i;DZXP$=_8XA zu_n^mc#j$`CscOO&{owhvxCnVo&U8$!yl&VNPB^xEwAR>w&1Q*m2p?y>0q_&R-dk92DPp zFG2V|o8~^@F*zJ`LZ|EiAT~e1u*QDIS3g_7p3U}v{tz;b6H6B8^e}m$OC9NLZ+8@! zS>Us=Wd)HsNT&;Ig9f9Ja4VPcFqjweS)?DZ0<4*wSg(p|P;af+Y{e2rrmts?!6qpx$Q?I0}AzMY)- zP%9fuF!SG>O?%be@TgsLah)ot_?n$;6K_no>#u=w;~7F~EPTgm5B=P1alSxoPnq#o z+qB==8^9SSard;>|EpX|=*2AHo^oxlfWHS!4WI`%)o_7vyfXDb^L~~V-FV{jpCncI z59i8%$qUh+92C9XzA#|05=o~R_vf;b=P+~u?nd7jWy)`izXDzY=Do(W)>>TVUFWZc zp%36tVF%YnBooCY;GKul|3eqRfB*W;zxJP=+iT7LC^xe(0S&~~{>oxp18bL>(X=fh z^NO*5U66lw?+nuegfJgq4QQkt8lGrGKRel7O9tF{?AM#aWWpSV?JJ6ktta0xMfK)Q z{KML^iTajjWZd^oG}Xgw8)dG$yu*k#JML%z`jg@Pm6f@UFKCs5Cb$I4>WalvbDmyJ z7O1m28Ou2|W5P?Qn3Sp$-c!w@+YH*YLo;FnadY|7h8^W##>%D}#BV8YvdPtqYtvu0 zP6-JAwS7YyIaI&T;4x10HG0DCuM5OA?aWc<1{v6k$}yl_Fn1ivjkVYKH75O(E!C*Y z;U1#st*_>SGUWRXN)U+lAj(Zb1J1M*xpuf~krBczVW7^uG`5zjVR>{So>9lQ-u7?bly` j`Tj91&-@(67XALi!1G{yzU8jf=}xLBYATe=S-kvT0lOjp literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/analyzer-file.png b/windows/security/threat-protection/microsoft-defender-atp/images/analyzer-file.png new file mode 100644 index 0000000000000000000000000000000000000000..0673d134b336ea4bce75b124b648613b9d4e4664 GIT binary patch literal 7725 zcmd6MXIN8Pw{8Fd1*0g{AOuk92tp{*k)lYIjtHS_AW}EdYovp;t#m<3Ktc&1N>NIp zbOQpROEDXe7MdVQAc1hRzw_(UWGVMI9k>G_3Ebd{IR|K*P^cWe!e=@`-a2TJL`YYM6O!voyn{UX4 zG@D(&kkaDXNVC8W3TbE5v%YJ${`Ufsu&N=4B+pgw_+Z-9Ytp8fbdg=OkJdM=$SW@kJtUKauYci7_ z(?z|CxZHieYEI)w{258Fkx^ zoIN}GoAn3uNRc?Amc|-Ye-69TwrDf?+k=Mex8Si;y{rl*KsBKen{7R>6}`K^W{dIP z8n2{iQ71eTGx(L29u|8=&NbI8DV&9eylm8L=-5TN%(vEOT%EFVoSB^c5kuX1_vcb~ zY+!A259XNIn6|atbP&N3v{m26HM5D-`qcVyy8U*9-?P=;)I^Ne{T&&H)}XPw`{>Q3 z-@GGgjj;8%`A(ACX;2kepT*aL>phrL8IgR$dPKS5?|7+(^IOwh7C94@C2~vDC4MMI zWqaY%hexW5qhI1#)4m4n&!BD2XB|Lrw3BtQ?z^Q_pQci+n3J%Ip!4uzHD%+HsBhZP zuC6Y9?U>)Mj9x?}5f*}Hnty#iqZs4z4yWjuud9ftFP$%F@m-_u>Ji*8cp$s!Zlw;o-$Y|8=*XB%r>K z$)_bsx0xCkv|?XMv6>(y5^@}8!hATzXmTe9`E8d7W?$;OL%(Igt)3Y5VDaJW0)1hM ze#dp5kk{aq0Vq#N)WKH~N77&^Eoe^h4qh;#TI@;Sx2&{?`Bq=4wVaV}348Fy4YB@% zn|@=eEvZSn#WSWQ>agzfi!X0pKa1S!%E$@QYQNFD?7HFG7k+kn{Oe#yR@vg7O33!? z(@+@mD?PV;g;9vby(@C@Mp3a9P8rBbxHf?-oi0t-iEAtd=iPRkdvMpuaz zGe!vhMj>mDwP9!?^yI{oX{X2^luSvHa4>l=c-ZPakSUPC1xuXMTd4q_uK&u%bn;IM znp~Ga=RkW;XLbAEtHp_CiQ<}TEcqp#E`J_hG&Tw{=??3D(e@)kD(ct>dL5D{Z?VF& zZXj2PL$*9f-pLE;`!y%Sc3`XzA zJlkpMd(ksSxHsce2OPX%1mSANQ`T8Vr)bwhG@(*#+DUXoS_b8#T*Q=3OY`@!;n$Ir_tnC%R*f_0SsVbC{u~$@m zx{T;ZqhzBe|6B;cez1#76ICZK1onO4(`efde*DR_J^aYGr1e2W-nh>^D>7RK^!QFM z6`qBKy)9>THt>2D9)!#%%%fFrmr8*iCwbki^%M|Xtx0Eo@Zsw;_74aaTh(8}c0IL_ zv?7@=@B6kkWx%61x-Vxc?d9eDqsP}A(qm4lxZ`(e2vny=8crcUjLI=%c+69gn<(gm zY4==wt^O@tZ}IE>**FUEvYdv}h26rtA5?A^rI3Us z8TE`{GH-Y2SIBVaQRO8Ma_3YQOiMYnyr$7B<$!35o3kj|w>vb}J?%n<7?0nR?Ys*hz(tDZ*);I+tyLshOl6&3D)z*g>=7 zdF-@yj>$rpw8$l{RC|R-K1qxgp}&qiw@D$jgdIaEe@}}QDgL67rq%>6e1$h^Cy6&s z9yj*Tdd5nMDa*#~;V3t-e4Tgh)rLt1#!yGl9wBVZci6$wr7$CCN!qAjPh;oBB=fcx zL_B|sw_kWR^i4n95oRK?XtI3a&Fge8OW*uc(;hR6MV*^^n0D%JH?&anMa<1gwRT=0 z^LD5#M*T_5@lh;32-ZzdW>J0ukCyQ_OX#nhDmcl(NHzw*h?RKD<~S#Zt+_$C%)pLI z(P8qv9 z-qKEM-%7d(YEOLt(IkF7<2#(=Js9KxmVZ6^%tYpmtx;>*m45t+F!Q?AmN@%!+`>+$ z9L!Zy5_9qGjxp+}=BxN*E9D*Z8o?GG!Bgg(wdd8?dGPQ~_-auMYZ)H6J=aoK;Nt{I z=&#_;!G>cXOAdwU2%qIDI>L!JqA6Z?1T&0cHclR%U;b^L6laNvm?|J{KOM@G$tVtm zU-5FAL}so)SMpwhpi{F!4a8||%wp}%^Egeksr&l9?JeFQY9h+f`}Co5gJsCBB`gvl zQ>&pBA4S*bQ>7@c_Tt7`(9k#K%j(p)@>tmC0-bq{Z@OnUWCvMs&+o*x>PHkbv?%0%1nKN( zkP!!XF8x1RK=>kX^Yi>wrf)!^ro}11?9CH`I#c>hUrwOOhFD3M$o66fFTd!-@l-eq zpW&P+sGYM)RCU^E;-4-@#v_jumUKu;zqo=PlL1K2E$147;fBc$q8xd~>lpM%WhGsK zWqY?{PjC?b&P7+{_pm}wcOpCM)Rta0KIZz5pJ%^EwZNLR{Vd*6T4Zg#O}#P153|$y z=hDXj{X#A&8`OF5$!BVsSyRAD|DPn}sN{I3eT*>_3N3(a5)j~?Ipe|ui|FA(g^ov5 ztLT=RRt->mzr~u-Z3+B*Z2$PK($>9oyY)&RwAG_Jn7H!~GMao#-*vpwFh28s8ms{S z4Rs0kaa%3_65GR`xc)eM@v?y|3<@^!PRNWojydeRo)NS8LbB#9mNmCRSaXpF`f@H# z5_I4YSWXbN)b~ZWNL`fW^Uy5oOqq3b7mrRVApUd(`XP zmL0QgT?PC%aAC`pEXUA4hJF+48;;9JKqKnnp5SfGdURoK#ymNCi<%>$%tdTrgb25_ z?!4~zWy>Wx=$4ArHoz6UI5Sj)hKA!7@JrlJ*yNcVY6ZZ5p;4<20yW;(Q64;lXsCUz zocL(t!(mkPUjA8wrYl&nByd!tZLqC5$2v7h)c!i3(%s4Yao+G5RQAt-Q5S$PI*BnJVlpU+<;_ISp9l=(VLxx(np|n%7Tjl^bYw_3WGRgJK zYMSags}fzJIgrs&c9cFEKetFvBlZ`~Kjpyd6BClMT#m{sR=^ z7k`^uAnQ6NSuR>+;p|3u)`6vOp&}uVz9@id zuw7ApAis2K+Jf7jvwBnn6W8VvXDd({W%W_OnYSOfF;ue+TD?(e^xCrUkW}NsRUaS= zTSP#T$P0m^!-Y(oq9ri*Y*AA)lZDAjlU#45JJ!&hY7MgmbS8H~yMZPj@u}-81UG&~ zUQ_F~l-2Y|;FFntx0nb_l!orA+nKt=nLbwbB|%qQ!w>nrr3Rsd`%A(Z>-6bynKCDk z6U;t+G)r&*(`K<0n)N85)(oTnAeUTqSe|0A{Q+ey{8S&3ka=37Tmq{xtWaMpL>Yho z$+e$gYVym2({iUa8vI0Ls&UR%h~nJ*tVa9k6nWMkY8EpDS4&o%mh7V#P36KPS~;jC zAY@Da!J{M6s_w~fcUz5;5A&_9%}t4M{cR*H#J9HE8uABEZ;b3-{QE-K#%$aOVIY>D zyfkk+HrJ}RHlJIATI~yVv;1MMryJgsRewGSWsMuFe85~_V!k?HL=JPMrt+YTgX(&!L~ZG9|gfT9`BrH+w%vYc_Z*> z^7p98dHK4nEqioJ%^t0tEmuGh5!X!CBu?5~26#u0_j55|?~P}IbL zU;x+)fdGFo|Njg0lMcbX&V19S(>C-y>1p!6fpMZF{)@_B6IW3E9uqqYOjJX+eZJ;>SU_oSs6 zcQ^$dxIUu8Q1R?>-qr+RPF};$k~rmI+!_418HRhRvpGLwXAJQ5$wNLfc;oh7HEEIj7DL0k}=6ufg2*;uH-7?!U{9#+!BN}0!tE^hPguGLMGmvR-L#BG#?|lMIaaMf7fq3m0SGreUAwnQr%2AmDE<{ zc6v2zwvs#)39h`CJ-xp5aSAXYV6}>!n{FB(iW4E3G4itJGL9d((;EDqdg=OJ3(hng zSj$eKl87s`1Z@5rFkcaUi;H3b?}C^XRYdusg+LYO^_Wx{^xU{&VcKG2Ep$unVfsIt zv%Z5qQ_s8Iw$@Y@KsxZhg^TgI`OLQ}o-FffT~=NUbNjfGIp5QgEtc$=FT*ZoS`5np zR9DF$nnL$}{K{yAUcY^WJ$706$o^P9*IHmIF~Y8e&?gtT*4SOHn+%c=E>;hhM?Lu@ zzW_grUOL)e$*_97no`0j$otN|W1&wrm z1gq=}4f2C{M0+jJ%VUnk3Pi=26L*)D{)~)Q^-XX*`WKy~C*QcA$u*!BvVGor8YO{F zb05k};w^!r1J2PalP{7Om$%JI6(8KRa*B2PGVyf~&K%<9Q!lhH!M|>eZFcu}tMiWbzaX>n4GuFZs*aGuVqGcVJQ|RL z3qUL}-Ar7iYAa5bFvna!RBhF^7GQtSLzbEdO^stl5{9Hl+kBr+J4rj``J?+*-8vh) zsZ~l{uxb?fR)e?CV!PsSsa9jyFNs#4?^k)WejD#QqM#Vf;WuhX`YnxAa|2hYfc-C( zohstFjgaUn%CBSjmb%;&Y;7?*zeNDqhqwY}&oyCggIPl?(Bk<1rI&Wnc5+(MP;}?Z zgWFWn4*Nuv39ut{&#w}YGZBDz$tGte&BY_6c|Q0$Cj8}h>=)MZB_{K#7?jD>OIUTf ztY`1jeZCw)sz_S2++*$xkCk+su4%nel^Lea&i;@@O8O2z(*3wZ*}8HOR+verUjU67 z^_FrsDwm|ER6LjFc?}*EdARs4M~)=23p1{dO;(ZN0SXjtG~XL}Sm9Odew|+QL^*b} z!a_$&G?*NCp4)7w;5gVA7iBDCH{%WMw7*6$!b|%ke=C_hWA0BSq8aOJz6o=|Jxkfs7l$zCD;kH~PogiGox!;~ns){1>Dw zZ-Kfgt(ulA`>Ps+2|}tQj>CQB9N#5X8wj9GL5E&OPNVzinKRJYXN>0`u=>9^^?w1r z{x|f~chIX?gp>8)4-DZ+W3*xC?@%58Btms#`6Tmmh%aYG$Z4XYz?Odr1ru0XHUqs2 z_L~en3AN}*^b_QtG#a4O)|Ruht>8Eq0ODzdg1AEVTily=(rDQBxrw|g&uNqhJ^GVL zm)N+d-rJPsc2%B$B9iT##`M6ezBE?f(#}ST-=;j#edAx$I@ot;3e|a%Eip=q=py6u zc{N9|wizW0(qCLVD2@{DN;Hb+$7~A13NSSXF(;}v0_F1iv$fbdUwoT+39()^ z*ymdL?~MmIIiKY@J)W55h{+Ph&t?ZI=27N+lK!#TY|>`6mmjTJN}Wc&&b7rj-HbYZ zzb|D{8ZiG2Oa1LSm@j$e;xmS$^Verm&n-9?AFTGpzG8d4`t(8rCE&Q=J#DJNxViz) zc9g4ce^#Go+kPzBiJ{!qX$n~;EjKAjm0kr3!>w-TveK2~1un(kFXbr{Y*FUI{rYkx zKg*CPJS;Y48O?9`ftGB6rbojn^*VmewnbD_A&l<;xWrc!R1AY%m5tbL>c@4&)*4De z3Qrg9h^Gn}9*8S5Q;XAt-c>i$Ww3Ouw?mT3m@Cxn%Aic+p*)VmI<^?(V0}ER98D1Z zATV$&7eaS~v4BpW>7OK6Hzi7-PQ%1CTG>M9ZJFh#_pQOGLo01NFe%AkHR>-1bW8nS zz?svzXG2n54tpSKX`8r=j_ z40uvlwE6Wb-p~ympqk&BLPsZo{}y!mH`v&}U!I@?ljoBb7Jgx-YEHch_KRhv92vLe zo~!CW+CKvb=WrX0|JjLaiirKMQ2$G#G@`jm*r6T{|213KXC4kI4m`{I+$Z$Ob}DB8SPL3BuwXB3>n?3g5(*ozW zLatw0*J@U@7n>2KJ&jbEl;!i^*5ZkoJv+Uhh2|z*R~2-M_#k_-W3rVUtl9@4RIcc+ z?D>V)bG$&iiS>+@{wS25xJ2FLRO^1ZBG$9gh{+z_`-7=En{JluYo1C1#%o0;1$cg? zox7mSQWbmDgJ$_p!CxCh{1^P&5}A_C5^SlqqH})L>2oJ5QmilP2Znh`5Q6}=+&8p^ zlI6f1hvYP+;VkP@sjMGN11!0ZI)-Qw?_jpeN^Zv`-OW=kWglO8LoE6hf8vW|m^2(n zOJZ);v^VXQL->A8 z-d*6R(&*^mNW4{aIZ2l21H`|XDdGZRmiKo?_VBkCKly~t&g>1~XwMwT0zk`>g=;os z5_k8Vt+&zfQGWlNYn#$vv4y|QNc1%8>WKanu|yL2oKH%7&P-nGy5DoZ%2)hg&+${J zdB;Afm(Yu7I>nry>cez28h$Rvo@4v8ZuqCo5l$gyb05t;NdGcU&=}QNyIe_1DvwXl| zY9cp vUO?cO|FaYSW@>dYg(b;HjPNlABuW3p3oz6-)oZxt9QVHf_s7Kq literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/choose-file.png b/windows/security/threat-protection/microsoft-defender-atp/images/choose-file.png new file mode 100644 index 0000000000000000000000000000000000000000..c82cab2cb8b1179a51fb6f14403471ca1dd07fa6 GIT binary patch literal 8558 zcmds-^yN+u_9==%ef!{A%FcQZC*V#QRPp}uFG}Xf4PID87adqAH>-fc#wI7863*~UcBBDbK-aRQ^vgEMG>n) z$n#B-{iQbE>x+Z5y~Qs>6iPSmXKhS&=j(ZUWfemH>OW&u5<1x!%cwA|`807boWYOs zT$GgY`yC%12vJo7FMkcQ4A`G5B4GkjjD0xx*QKR*l-Mp zDA>7=j@YKOu22s}M81!BWDv`==kI@SBteN?$fe8Q^xgjV{{0q&5&3~4Vta8h6A$Vs`lEIhBv-O({r6DX|6Jehi-~O=7jt>! z{Mut5aOvR#OQbgEaXP-aoGj6zv86oT7-N~NwzkwnXW`6ipmV=?4W$pIeSBH^%x{I# z^ZI;m^1TZFPUg>Ve73kM3es0%GtpOR1gULgOtG&h4 z4YVinm3rIeh2-m4M80u;pNy@IhRwsbm?!c)lDz{)5vj>i&eSg^h_U zQ$hLpl}e}ZXyE1T#mdM`mF350dkahh9zYrQ8G#HAq}BRxW@_HS20~Biu|ToTsMhEX z;YrRD`*u=RX=R#Z)j0ChcBqixJE^p(QayLJ_Q=bV&8?97h~3wF781^z<7|3;6H}$S zX)qXpjQ@6thq&mSdYK{eqL;#XFqy4YPnTH=*`L4=lP*{-XjQ9BWAy#e)d!U(Dr5{O zxcjVxNlaX|CHz)aLGeu#phgJ5~i<+l6 z>qsUlFBbJzr)Vm=cg)ijL)bg=ue6FjjHBR?#52@3sj^}UdMFPv*G7T`6RB0u5LD5V zkc)lKbPZ#=caS$erJYy9yDPF~rln1%2P?Kiscr*~Vw-@icheOgH5%O}M@}cgW}p}Q z)*;W0S`2w|r0u~!3iSBEq8r0>{7_0O!2B2Q5Bn27_4|FzZ2@%~uf?axBQZ&}h0?zA zhXnI~NLrtnUBhX38J*?SFMz?V&NKNUetkdYgG4LF@(hhGM$SDKoo<@z44ZUZt2Pw~ z?QGDrCar-7HmI@Dd@hy&t;(gxUyG4eYG=VEJzQ~L}N4#%~;Vel0VizGmAW)scg0G0vwmC}PPa6I_!%J=VW3;NZJQ}W{HYk|5+uW0FO!n{J zPCR#IMx}VBlU*$=?u{YS4k6jxEmOnIqU zzstelcylbjc!eW737`)7NxNOt4PLD?M~n|3NtxvNjIyXtcNR@Gl3DGyKLG)mpG<2C zG_)`JRYUQ$^5D{1_jJeDi*5+o-^ zKlZ%@(5Wg0`Pd3RoqCis?MV`|Gwc0l0W+@Q$WzS2?SeYnnU)x?vp37~K71dk0SwII z8mPcQNQ%^@gxY+7QOok1HF=cv^*0*xct)bi%!;BcTJ+z{RarJp)(%$uFmS7PnLwWJ zVV=(`=&5mYr&YTG;BAaRS9(;_=-B`Q`kqVYr*S>hW3FE7<_-q)5*=+O#2I7Mfe5hS zsgN?b9yh;Ytvn#}Q^zG~b2WM^v=&d*I~`{4Cy$5y_V^teq+>(3W zzIGJo#r6_oF5d%;3@2$@8xd#QGef8C*X{F`ekASb${g}j4X$aYW;8kl;#$l-vceR8l#e$X)c6OdJ7xnvuo=1{s2$xR!YHu79L(P|0dkgAsL(j|ZJgeA97SW0K zeegr3@Adep5qm zh#+Ej0axKAF?Cjel~(_q$)Qph ztDMk7kZYk13o`)5>%`)38I9o(o}^gAHz5}VJN;}eGn$HuASfj4mvDBhnz5|4ixd|> zvM)&jvHzRT*U%hVVH=&NnF7`34$Ik3`RPt+a4TG_6noy5HX`InKn8iKZx%=AI1Qjd z1+YF*FyuG!oc}{yOp?D~GP{hML%)~dtXZ!?u}0atoXeG(7n+KbB1oH_h7^QZXiTfO zw}LAFd2`IwP3X1qm1j!l=4pI%yP`KX47;C%E7lbSaz#h-tcU3el!dX8B9ocKH0sS( z1y~aBL3MW6X9ZWstgW3k_dd8NQcmpJ*jsATEL>gExB8&p^VYwQP$5FmlMAw-T+pjI z>5!q%=thtvu#@occeydY1hoIHI#`^U8QkQVb?)#cki%Eyy3CK6y_uTXjCw$0jZ4fa z1_1LZ@_+}8K4PQ9An0a_7D74T4p1M}S=N`YF zzDSfB;H=Z*XnA#nR9xxqOLqEHk52`J`}|@@CZQ2oG{HrmEH9T?Z6yAcJ2g%P39!fY&YQH%Qrx}TT)oZL%ov?8!bVKV zDvBxssEY@gfIsY+8--IHRUTSEyba?>B{suYdFpJ7a3Wv7I;hslxBMciXQzfuF5DJP z9ztQHkzn(8ni|!$I?+UANU_M~6il2C%qe+qj2)HST|m3Xl^|%@gr@wLk9s(r5VjzZ ztVg=c?h*5m@i2ls8b2@kPy{I@J3Z4EpPOc1CP@jw5m{xw&ijH^`5$L)F9Ea5&DnjB zWZWAJR<90IxU6k7E-J?p_&3GjtcaQA+S)E;I^YRb)gIyArkdn*jjznW9>)1O9 zgW1%8=*?uDfZe(8ee)#vrVqI+z#rNj9UV)+F~`i$g1Q+YCdM@;x+y6hXc{BUoz`BpQ7Ja&)(E!1;wRo3CEhS+5`!^Fo3-OU!rd0rNV?3WrWV*sV@l8VF z26Pq9rX6AMlyKqeeB_$lYI&%+`N}8Glab4*_Li5^%#?^?k&Ya(a45Y|aV&HqnM3Il zOX&KrF_WhQ6%y|!7uU@PD--3!L30N0MW6ltJSGNV2D|xzcZe=aC04T(-+}cMiKhuA zL_2-&IRElB=V)meqSSo-N0>;$Y9pM+;HL1E19gCTJ2uxinO{oijLn(lbAaOZvef9j z$0!4WG7PxEQS(q1^Oj+D7A5WEQb%P{qY;Z>jmi?X zJO@^E4WKA*mdV}w`R&?Yb!AI>nAPNN5fbEyIL3ZW?%y%$e@kzWphem>0%+#6@r2ts zy29xcA6r2Nhj33{(2P3zYRRus=gVb@C<2LQ2-l9p1cW)62I=}V=>fvT6$$XHDB!?J z^V&y6Vb_g3)!B|`dlqhcwKLuHg0!DiIXn|ltNx-hQ3BPC@_b9y8X}WQH5=>08AcN+ z!P@clwm)xPbjz;ZSss5UssVn;?y#ruR{72$8igtn-Z)n&_-R2d6=FXowaw`CuXy$Ro1rCQqo1k`9FH zq=LgqMbyapDUJ5%5wKk!%v`0DNk^76(1WrEnbC^dKY>%R3h>o*#5{Gc2YMizXc+OC z73MOU-dBmaJlk=1N01>Wi3%GW2`8goTg}QmNJ_hW&mC0=B(gf!cXVU}#m)LVRZDqU zNxj`0rXj${g^AJU*Hb0F)Tnh;YWCuOLex$^lXyv}G$DN5l7eTq9|SbdsUh6alnc23 zgU{5>a?}*#4E>rI-I^sF;W-fSyn{D>2b;q0+McaOJkhg7Q|vuqSWx#0x+cCnOOEUy z`$|uKeZFt3mnzkcqA{Qmt*C{0OrxALrKY>Py}K~0@!Zk`!OK3dS3YQhAaQ&mQvJZZ zUGIP%s>yB;frqsJefRCD?G5a8)>ZIBOW;tXQfDQA0V5;*myR1KbBtk4KXJLUr9FxW z;93M|S>(S|NhSmHykKR$A*EKlnJfwK2tmF0{(%9kf$+rI@IlM6g4kF?2{f^EfTJ60 zq+9c!?L(^n&xQ-&h?UTjB#)J^)|tY#LL-@iFV{8s{_%}}NxRDO3trpWp(v&d7<_*h zX5Q$Q(cm`ybbF?X-+%ju@4DuH*o>Km?SzK0I0L^8bBJ2QUb)&s$g{TApRm5r=jtS!*P#Ly1$&5{Gd)E^Xd-*i3r)5sYFNHG zB^IBY>lA2kgFjF{(#_+;iq_1Ro8$jL5M^^(ELMzf%5+nusE^uTQPass$x38HKX%eLz>Po`+%Eej_R46XjS64xzHLGQYJxpn{aV&#yO`*bs0JIK`rfEqYph_sxFR7WQ&IZ@3yd z7g_+cZhJZ}`q6p&N7*r!QW5T#*pKJUPnH?+HvX8vOCSB!9qqI+n&bByZ7=isywYQ( zNw*_fGlf0p`ejLAjg9QgW)dBLru$-Cl3&DpY86Z^`+R?i9~+6L$DTi%4G3BA^q~_4 zg4pme8G%3QAO1a(r5Dp|)#7JZ{`|4R=Fe7tciG1vdb~vcNF3+kbP?w8sO5TpN});* zthoQE2B$WxvXE#bm@zz&`EHiPEa3*JbLcP8N_&I~*t6g%W0Qixlai(tKZ`l^0q9Wr z1Vt;@b6aKxihzz;&ls~xn&mD8NY!cTlkS2dCb~;Ane}^c-KX2Dvnh!p+YPi>qEz!g zS3ov?%<^>>D1<<&-bwiHwP!0ueC6imR#Q*6+u2sX*axB<*57u0NeudXSj5dck#z_4 zO56-~Jli&&tns#$aiz5h;GAqPltLvT0E+Z3%k9DceKS+i2JA0xB9Ta^(QFaFo4>wc z7$Op&!HZlZR(jJh3XrN{D#wUDv3+7jgPE;Wrcvp$GP^1AsBwjDI$;|tYkOKeM=$_O z-D)oW;IDcwx3_qRG3OtB*Th1=NuX`BkNsoYukAWHqC8<<0R`z07%cH;sck$uRG*Wt zTqB8jOWM~wgL`F0nQi&0I87BQGNa>m!7|ZU@D}DUY>OKse(={ zGa>5L7P1!RoQx%ES~17#iIzVhRfj`qy#DQclUTr29z&`Q*+`UAa6;SVKnvP}wmLDy zgafs9-FQs0ui_KgC7!CXqRByVEHwmD!9^`8JMt@N>%;8S7Az%Tq=0@V6|rH?%s8@? z4?0xFa?KHRD%Y#!#U@W<;o;>)k8=v)H(!rlWitfb{H<#p+ogH^#O(*fe=#+t^5G(2 z$lpqwfH-owGvc1cpOTcGtU@d7(PcLg2gJ%M51FF=XR0*idHHiK_}C-ttSzdRNxAI$ z1e=4FTK$dI4mT+2aT18iE_UaOSz^1U9uRbis*IDf$?`?wCd~JmQQG)*8DiXy$8}BQz*H)0Hw8D?r^jxj7=qVV#TWMCD8{J+H7(A4p=U@QWw?SmKfX_b>TIi<@Da ziEdcH#s1Qjz(s25v;4JbLn)6rWh`iZkshv)(NW2{2!Oj2$<#uziOkq9wp_C=N@LgT zy)tg2j~OjNVRlK#*|r-lm4hS`YA!sO9vOB%@3I|BJ#zGbO3m)1MNc%k2_$Dxkucxz z4(iCs#0~xa4F=%i7BWYbv?iP?xQw$-506H>aI)-$3{F5Dx3C3L_YzwZ`0np6Iwguu zzI5K|`fZGsRm+@VBe;*A=!%bBK;~`S744PAjiZ;S5|%`T-L}E%AY0<0m6^f-?Y7J&NN$$l1NN& zFCBh7r~X^6&TDf#|3?~X&Jhravg)+&pyjtvt3nb!t$b_nADZgc{s=y6E=)pe)E3~m z9-nGN`#Q>CH*qTJ463U?*Aa5|TzJ9(TlXf5Uk8$PaE4`#=j&ddId4|yhZKfq-{TZ# z*GGBqaOXyTV|Z++CgJcogfg}@^dTun*lDVppf)5P00I#)lj08KpPr9AqACUx1Moqm zy1AK=h`w}6G8L72Isr5N@bmh@$HAPJ)z)ndZ2K6=`)$)sr0xCH>~ZeOjmC&@_z}ra zp;D)pxW$wl5e%5s*!X=iF;%z07d7ilrVgRDHd9|4GPMcj=};ne4BBg)eePp^;N#9F z2%^&Y))pv?vDY#6tDT`lcGgJ(mQl{yQ#*K-ztE`zWGqrbK0I8tZe~O^bYz+kRAtbk zQyJ&s-(7j*?qFzM9iq8&rreyet=P_2O4WY4JY)N5h$94yC%{MGVpC<&_(MSIwPPd^ z%y=N5*H>zIlnO6jR7mQzhe+6!_}O~|)y(zoyx8`UgzKc)c%Dr0Q{0%C>xmT{!j!1D zDF@l%g3L}Vpq6o1okd~jG29|j|Ln7>CBOrUMUj+t4ifRu#jX%a&9#At?UdBo@b`u( zWX`^|%8AkL08X_%4{?^h>#4%K5|dQ*xF9p$jW^0u%mmQlI2gb~xs!CJnf-ZCzLpVCorU0|Ukh~*M$;u$QX-qMU6#Am z@bK}~efy(-;C@8TyOZbgIQ;XG`4fkRNCcoHm)O~IqBI zCk}<2GSy;O4m9`=*UJugHty+)i$p}G9FJJuUqG*d%1(lZsJHV~pfi-to~n`9o~z8k zk@PDkH=zo6E`CKLC+2)PnwHjZpE5by5v%d+fxvm6NDKzks1Wa=1;_Dy0C>zv4PNl%w4?Za;tiL@OVw@MZ(m+Z#^O{*&J^$%(aI-7cy>1SG_q*IUWom`nf9#lu z*_pCLJ%zj>iIdQIa%Ah^z)}3(YfD7${_a-X2dU>@|Q+kh#AyY4+jD8|1 zUL9C40fr!z0fNHhPipob2}P<^Qk~@x?F_W{q@K89i%&B69}h9Fk@Oomjf?s9xAaBo zgeXAjh=m>pL=jU-IY}(>I`TD|9r}QPgMa#4rIN|G!)>d--~D1kA#UtL?qPPGXZQc0 ztQ$0`U4-vCu@XTCC4)Z}{5)IdNJQrSuNH+-zs|jy!V45z`v@u#)X7c+IdN?rU9a5R zgx{SMy6b3C_gcuo6ilnFwi7VVzz}g7O>$N`Wr9k!xNiVS-#0R%d$W-C50le>@m(DeLXYe2w5!HeqMRN!nEG`-_a5!V#AVt@V8=+@Ba3_Pw8o zaB?5fm1vY<-P)&#E5d-(bkg^&VPZIOw!wY^MJU~@QXDU?+?mjTo8Jalb$c#Q!x2BD zgRqrvR2lN-!`q~)qJ1VUwl~Ux64f5|^RY0%|04_GTR>j>n zd%wBux@|N!0dz|_~Zb(D#L(cdn4#l!)?-c4T=AxFMg6oFJ!zn2(&Vfin zWt!u>FSerj0hOnkolVJK^b61Hi2LeSX9zxEdW;x&VCto{59C#^oy2o!ZjsZfMse;F znGl$oU5@bJgYGEu)MvShdfAHYPBG7$_w(95di?xMJe^Ald;oJ)DcfZMS70o9+Z z*NMH06r$ZXTP`D+W7`sD;5a-R{A-v4MrNVdGnb;)35PQ3u45J}d8#tgHf7SFHUaI4 z30Hi`v0N!vL$rllS2IG}DOJ{T%)+Q}lL&dq8A^D3gKv_YU%0pq{ebujk-IvYIP01I*+sBD)L}!(Thl<_@Mp1)wR-Y$g z)yf@b-?ZN7hP`Ezn?S*vZ10kP6bPmQwhsMPW2h!GcKMSLN^J5pAb9V$!y;H;27_ts zr+uXdH{ypsV0|tdyD4TQhHH4O#~50NqU>x&T_@@GpFwV5YLc_edzYz`6gW3csrSqRj<>#46>}hH0thkjVaj9o-*bTcz0!K^znOZg2F6w^)b4n@9 literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/upload-file.png b/windows/security/threat-protection/microsoft-defender-atp/images/upload-file.png new file mode 100644 index 0000000000000000000000000000000000000000..6d348e59333ae1734b044f5a258297e82285ec8d GIT binary patch literal 1229 zcmeAS@N?(olHy`uVBq!ia0vp^8-dt_gBeJE>e8G8q!^2X+?^QKos)S9hD8WCilK1o(uwx)dGx|NsA2Ab4;wDsP_v5H(-C58{9R`tkGgLnoapPwsm1`RmuC z4f4s0?g7OgE=rSYIQI4Hv0jC=l@EauJ#ulY9xBMoDaiL8y|*$>KKbjtl@C`XEA$+7 zF4(6AM3q28P93^>F{=6Eg;S^EfXcppeSYlJp%+11;4Nf~)Qu~tcf9*~RU1O&v&(09K#&X-byv5IwU%xiXvfH+=&slVK z|JwDp1CIWRON_ni_VjT=QBK$4(;x30w|1$pTlcEa_ISIzomQ3mwacu_UNUNl6E)nL(?3@Al}xyO zs43F!{nRD=c_}$E^{LlVa&BgS{P^~$uGul72Sb@uqBRYmeQIwzS_om^-EZ_`=k<6F>hP zJ7Ik6n7u`H#e>MnKYkpGQ9K;v)o{{(wP=;lvK#sn!*Ya_EerOZ%Uyfiq4|+SzgeaK zp9vY!Rw`>6?DpR|8mtq;rXL-<^6l53HB4f8RqHc?Vw!ZXv-xYg)bn~x|0lieO7gL^ zqrREiAJ4rH;JmZNqIcT&$M=(-+PtoaKj_dKAo_m)^S1)hHFpAYRvec-+E#TZbj72+ z{pB6@YmfgISXJ@b!l&0qBpT{2TJ(dp-RJnZ_3!q00ka;1 Mr>mdKI;Vst0QzcpQUCw| literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md new file mode 100644 index 0000000000..1168c4ff48 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md @@ -0,0 +1,66 @@ +--- +title: Collect support logs in Microsoft Defender ATP using LiveAnalyzer +description: Learn how to collect logs using LiveAnalyzer to troubleshoot Microsoft Defender ATP issues +keywords: support, log, collect, troubleshoot, liveanalyzer, analyzer, live, response +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: troubleshooting +--- + +# Collect support logs in Microsoft Defender ATP using LiveAnalyzer + + +**Applies to:** +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +When approaching support you will often be requested to provide Microsoft Defender ATP Client Analyzer tool output. + +This topic provides instructions on how to run the tool via Live Response, or locally if the machine isn’t communicating with Microsoft Defender ATP cloud services. + +1. Download the [LiveAnalyzer.ps1 script](https://aka.ms/MDATPLiveAnalyzer ). + +2. Initiate a [Live Response session](live-response.md#initiate-a-live-response-session-on-a-device) oo the machine you need to investigate. + +3. Select **Upload file to library**. + + ![Image of upload file](images/upload-file.png) + +4. Select **Choose file**. + + ![Image of choose file button](images/choose-file.png) + +5. Select the downloaded file named MDATPLiveAnalyzer.ps1 and then select on **Confirm** + + + ![Image of choose file button](images/analyzer-file.png) + + +6. While still in the LiveResponse session, use the commands below to run the analyzer and collect the result file: + + ``` + Run MDATPLiveAnalyzer.ps1 + GetFile "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Downloads\MDATPClientAnalyzerResult.zip" -auto + ``` + + ![Image of commands](images/analyzer-commands.png) + + +>[!NOTES] +>- The latest preview version of MDATPClientAnalyzer can be downloaded [here](https://aka.ms/Betamdatpanalyzer).
+>- The LiveAnalyzer script downloads the troubleshooting package on the destination machine from: https://mdatpclientanalyzer.blob.core.windows.net.
+> If you cannot allow the machine to reach the above URL, then upload MDATPClientAnalyzerPreview.zip file to the library before running the LiveAnalyzer script: +>```PutFile MDATPClientAnalyzerPreview.zip -overwrite +>Run MDATPLiveAnalyzer.ps1 +>GetFile "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Downloads\MDATPClientAnalyzerResult.zip" -auto +>``` +> - For more information on gathering data locally on a machine in case the machine isn’t communicating with Microsoft Defender ATP cloud services, or does not appear in MDATP portal as expected, see [Verify client connectivity to Microsoft Defender ATP service URLs](configure-proxy-internet.md#verify-client-connectivity-to-microsoft-defender-atp-service-urls). \ No newline at end of file From 55763d9645a4004cca8de4ce4b78c6577d9eccb1 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 11 Aug 2020 13:25:57 -0700 Subject: [PATCH 02/20] Update troubleshoot-collect-support-log.md --- .../troubleshoot-collect-support-log.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md index 1168c4ff48..7700f85f67 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md @@ -25,7 +25,7 @@ ms.topic: troubleshooting When approaching support you will often be requested to provide Microsoft Defender ATP Client Analyzer tool output. -This topic provides instructions on how to run the tool via Live Response, or locally if the machine isn’t communicating with Microsoft Defender ATP cloud services. +This topic provides instructions on how to run the tool via Live Response, or locally if the machine isn't communicating with Microsoft Defender ATP cloud services. 1. Download the [LiveAnalyzer.ps1 script](https://aka.ms/MDATPLiveAnalyzer ). @@ -55,7 +55,7 @@ This topic provides instructions on how to run the tool via Live Response, or lo ![Image of commands](images/analyzer-commands.png) ->[!NOTES] +>[!NOTE] >- The latest preview version of MDATPClientAnalyzer can be downloaded [here](https://aka.ms/Betamdatpanalyzer).
>- The LiveAnalyzer script downloads the troubleshooting package on the destination machine from: https://mdatpclientanalyzer.blob.core.windows.net.
> If you cannot allow the machine to reach the above URL, then upload MDATPClientAnalyzerPreview.zip file to the library before running the LiveAnalyzer script: From 9f0cf54c6dcd209c9be1da32ff400f9cf4849459 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 11 Aug 2020 13:26:43 -0700 Subject: [PATCH 03/20] Update troubleshoot-collect-support-log.md --- .../microsoft-defender-atp/troubleshoot-collect-support-log.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md index 7700f85f67..9dd7c8c2a0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md @@ -63,4 +63,4 @@ This topic provides instructions on how to run the tool via Live Response, or lo >Run MDATPLiveAnalyzer.ps1 >GetFile "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Downloads\MDATPClientAnalyzerResult.zip" -auto >``` -> - For more information on gathering data locally on a machine in case the machine isn’t communicating with Microsoft Defender ATP cloud services, or does not appear in MDATP portal as expected, see [Verify client connectivity to Microsoft Defender ATP service URLs](configure-proxy-internet.md#verify-client-connectivity-to-microsoft-defender-atp-service-urls). \ No newline at end of file +> - For more information on gathering data locally on a machine in case the machine isn't communicating with Microsoft Defender ATP cloud services, or does not appear in MDATP portal as expected, see [Verify client connectivity to Microsoft Defender ATP service URLs](configure-proxy-internet.md#verify-client-connectivity-to-microsoft-defender-atp-service-urls). \ No newline at end of file From 3e1a432d39154dc0c7799f2f2041571e5015902c Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 11 Aug 2020 16:19:18 -0700 Subject: [PATCH 04/20] update content --- .../troubleshoot-collect-support-log.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md index 9dd7c8c2a0..90d1d6ef27 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md @@ -1,7 +1,7 @@ --- -title: Collect support logs in Microsoft Defender ATP using LiveAnalyzer -description: Learn how to collect logs using LiveAnalyzer to troubleshoot Microsoft Defender ATP issues -keywords: support, log, collect, troubleshoot, liveanalyzer, analyzer, live, response +title: Collect support logs in Microsoft Defender ATP using live response +description: Learn how to collect logs using live response to troubleshoot Microsoft Defender ATP issues +keywords: support, log, collect, troubleshoot, live response, liveanalyzer, analyzer, live, response search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -17,19 +17,19 @@ ms.collection: M365-security-compliance ms.topic: troubleshooting --- -# Collect support logs in Microsoft Defender ATP using LiveAnalyzer +# Collect support logs in Microsoft Defender ATP using live response **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -When approaching support you will often be requested to provide Microsoft Defender ATP Client Analyzer tool output. +When contacting support you will often be asked to provide the output package of the Microsoft Defender ATP Client Analyzer tool. -This topic provides instructions on how to run the tool via Live Response, or locally if the machine isn't communicating with Microsoft Defender ATP cloud services. +This topic provides instructions on how to run the tool via Live Response. 1. Download the [LiveAnalyzer.ps1 script](https://aka.ms/MDATPLiveAnalyzer ). -2. Initiate a [Live Response session](live-response.md#initiate-a-live-response-session-on-a-device) oo the machine you need to investigate. +2. Initiate a [Live Response session](live-response.md#initiate-a-live-response-session-on-a-device) on the machine you need to investigate. 3. Select **Upload file to library**. From 2e8530d435c64454dc60c2457a249b518572b696 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 11 Aug 2020 16:23:43 -0700 Subject: [PATCH 05/20] Update troubleshoot-collect-support-log.md --- .../microsoft-defender-atp/troubleshoot-collect-support-log.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md index 90d1d6ef27..3966d17196 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md @@ -23,7 +23,7 @@ ms.topic: troubleshooting **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -When contacting support you will often be asked to provide the output package of the Microsoft Defender ATP Client Analyzer tool. +When contacting support, you will often be asked to provide the output package of the Microsoft Defender ATP Client Analyzer tool. This topic provides instructions on how to run the tool via Live Response. From 005a3ae267b3e73824e41fed010e71df4b8f27cb Mon Sep 17 00:00:00 2001 From: amirsc3 <42802974+amirsc3@users.noreply.github.com> Date: Wed, 12 Aug 2020 09:59:29 +0300 Subject: [PATCH 06/20] Update troubleshoot-collect-support-log.md A few minor text edits --- .../troubleshoot-collect-support-log.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md index 3966d17196..d538c8896c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md @@ -23,7 +23,7 @@ ms.topic: troubleshooting **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -When contacting support, you will often be asked to provide the output package of the Microsoft Defender ATP Client Analyzer tool. +When contacting support, you may be asked to provide the output package of the Microsoft Defender ATP Client Analyzer tool. This topic provides instructions on how to run the tool via Live Response. @@ -39,7 +39,7 @@ This topic provides instructions on how to run the tool via Live Response. ![Image of choose file button](images/choose-file.png) -5. Select the downloaded file named MDATPLiveAnalyzer.ps1 and then select on **Confirm** +5. Select the downloaded file named MDATPLiveAnalyzer.ps1 and then click on **Confirm** ![Image of choose file button](images/analyzer-file.png) @@ -63,4 +63,4 @@ This topic provides instructions on how to run the tool via Live Response. >Run MDATPLiveAnalyzer.ps1 >GetFile "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Downloads\MDATPClientAnalyzerResult.zip" -auto >``` -> - For more information on gathering data locally on a machine in case the machine isn't communicating with Microsoft Defender ATP cloud services, or does not appear in MDATP portal as expected, see [Verify client connectivity to Microsoft Defender ATP service URLs](configure-proxy-internet.md#verify-client-connectivity-to-microsoft-defender-atp-service-urls). \ No newline at end of file +> - For more information on gathering data locally on a machine in case the machine isn't communicating with Microsoft Defender ATP cloud services, or does not appear in MDATP portal as expected, see [Verify client connectivity to Microsoft Defender ATP service URLs](configure-proxy-internet.md#verify-client-connectivity-to-microsoft-defender-atp-service-urls). From c785872988fd1ae06e1e79f42ab5249203a628e9 Mon Sep 17 00:00:00 2001 From: amirsc3 <42802974+amirsc3@users.noreply.github.com> Date: Wed, 12 Aug 2020 10:05:33 +0300 Subject: [PATCH 07/20] Update troubleshoot-collect-support-log.md Also added missing command to the instructions --- .../microsoft-defender-atp/troubleshoot-collect-support-log.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md index d538c8896c..39b935ed42 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md @@ -45,9 +45,10 @@ This topic provides instructions on how to run the tool via Live Response. ![Image of choose file button](images/analyzer-file.png) -6. While still in the LiveResponse session, use the commands below to run the analyzer and collect the result file: +6. While still in the LiveResponse session, use the commands below to upload, run the analyzer and collect the result file: ``` + PutFile MDATPClientAnalyzerPreview.zip -overwrite Run MDATPLiveAnalyzer.ps1 GetFile "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Downloads\MDATPClientAnalyzerResult.zip" -auto ``` From d73986ffd43c7276b15bec1ea581725cc1e88013 Mon Sep 17 00:00:00 2001 From: amirsc3 <42802974+amirsc3@users.noreply.github.com> Date: Wed, 12 Aug 2020 10:07:48 +0300 Subject: [PATCH 08/20] Update troubleshoot-collect-support-log.md --- .../microsoft-defender-atp/troubleshoot-collect-support-log.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md index 39b935ed42..aead6da6fc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md @@ -45,10 +45,9 @@ This topic provides instructions on how to run the tool via Live Response. ![Image of choose file button](images/analyzer-file.png) -6. While still in the LiveResponse session, use the commands below to upload, run the analyzer and collect the result file: +6. While still in the LiveResponse session, use the commands below run the analyzer and collect the result file: ``` - PutFile MDATPClientAnalyzerPreview.zip -overwrite Run MDATPLiveAnalyzer.ps1 GetFile "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Downloads\MDATPClientAnalyzerResult.zip" -auto ``` From 0fcbe6141bd3d83803c1e5252f7ede488925d3e1 Mon Sep 17 00:00:00 2001 From: amirsc3 <42802974+amirsc3@users.noreply.github.com> Date: Wed, 12 Aug 2020 10:08:13 +0300 Subject: [PATCH 09/20] Update troubleshoot-collect-support-log.md --- .../microsoft-defender-atp/troubleshoot-collect-support-log.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md index aead6da6fc..d538c8896c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md @@ -45,7 +45,7 @@ This topic provides instructions on how to run the tool via Live Response. ![Image of choose file button](images/analyzer-file.png) -6. While still in the LiveResponse session, use the commands below run the analyzer and collect the result file: +6. While still in the LiveResponse session, use the commands below to run the analyzer and collect the result file: ``` Run MDATPLiveAnalyzer.ps1 From 3c96ac8ad0afd068053e511326f0939796da6828 Mon Sep 17 00:00:00 2001 From: amirsc3 <42802974+amirsc3@users.noreply.github.com> Date: Wed, 12 Aug 2020 11:41:26 +0300 Subject: [PATCH 10/20] Update troubleshoot-collect-support-log.md minor fix --- .../troubleshoot-collect-support-log.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md index 3966d17196..053a67f212 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md @@ -59,8 +59,9 @@ This topic provides instructions on how to run the tool via Live Response. >- The latest preview version of MDATPClientAnalyzer can be downloaded [here](https://aka.ms/Betamdatpanalyzer).
>- The LiveAnalyzer script downloads the troubleshooting package on the destination machine from: https://mdatpclientanalyzer.blob.core.windows.net.
> If you cannot allow the machine to reach the above URL, then upload MDATPClientAnalyzerPreview.zip file to the library before running the LiveAnalyzer script: ->```PutFile MDATPClientAnalyzerPreview.zip -overwrite +>``` +>PutFile MDATPClientAnalyzerPreview.zip -overwrite >Run MDATPLiveAnalyzer.ps1 >GetFile "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Downloads\MDATPClientAnalyzerResult.zip" -auto >``` -> - For more information on gathering data locally on a machine in case the machine isn't communicating with Microsoft Defender ATP cloud services, or does not appear in MDATP portal as expected, see [Verify client connectivity to Microsoft Defender ATP service URLs](configure-proxy-internet.md#verify-client-connectivity-to-microsoft-defender-atp-service-urls). \ No newline at end of file +> - For more information on gathering data locally on a machine in case the machine isn't communicating with Microsoft Defender ATP cloud services, or does not appear in MDATP portal as expected, see [Verify client connectivity to Microsoft Defender ATP service URLs](configure-proxy-internet.md#verify-client-connectivity-to-microsoft-defender-atp-service-urls). From a555d33cc2654a2180789100c244c32b4e292c81 Mon Sep 17 00:00:00 2001 From: Kurt Sarens <56369685+kurtsarens@users.noreply.github.com> Date: Wed, 19 Aug 2020 17:41:08 -0700 Subject: [PATCH 11/20] Update troubleshoot-collect-support-log.md MDATP is a solution that consist of multiple components. Live response session can be used to collect MDAV support data too --- .../troubleshoot-collect-support-log.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md index 49b05d09ea..ad09527b75 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md @@ -27,7 +27,9 @@ When contacting support, you may be asked to provide the output package of the M This topic provides instructions on how to run the tool via Live Response. -1. Download the [LiveAnalyzer.ps1 script](https://aka.ms/MDATPLiveAnalyzer ). +1. Download the appropriate script + * Sense: [LiveAnalyzer.ps1 script](https://aka.ms/MDATPLiveAnalyzer ). + * Microsoft Defender AV: [LiveAnalyzer+MDAV.ps1 script](https://aka.ms/MDATPLiveAnalyzer ). 2. Initiate a [Live Response session](live-response.md#initiate-a-live-response-session-on-a-device) on the machine you need to investigate. From f3f7bc1ae9d8a5392977601d308c08dbcec283b7 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Fri, 21 Aug 2020 14:21:29 -0700 Subject: [PATCH 12/20] Update troubleshoot-collect-support-log.md --- .../troubleshoot-collect-support-log.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md index ad09527b75..3efb0b9bde 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md @@ -28,8 +28,10 @@ When contacting support, you may be asked to provide the output package of the M This topic provides instructions on how to run the tool via Live Response. 1. Download the appropriate script - * Sense: [LiveAnalyzer.ps1 script](https://aka.ms/MDATPLiveAnalyzer ). - * Microsoft Defender AV: [LiveAnalyzer+MDAV.ps1 script](https://aka.ms/MDATPLiveAnalyzer ). + * Microsoft Defender ATP client sensor logs only: [LiveAnalyzer.ps1 script](https://aka.ms/MDATPLiveAnalyzer). + - Result package approximate size: ~100Kb + * Microsoft Defender ATP client sensor and Antivirus logs: [LiveAnalyzer+MDAV.ps1 script](https://aka.ms/MDATPLiveAnalyzerAV). + - Result package approximate size: ~10Mb 2. Initiate a [Live Response session](live-response.md#initiate-a-live-response-session-on-a-device) on the machine you need to investigate. From 0ab59995cd837d709edc191b218d90821c9050ae Mon Sep 17 00:00:00 2001 From: jcaparas Date: Fri, 21 Aug 2020 14:24:19 -0700 Subject: [PATCH 13/20] Update troubleshoot-collect-support-log.md --- .../microsoft-defender-atp/troubleshoot-collect-support-log.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md index 3efb0b9bde..b00bda81b5 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md @@ -31,7 +31,7 @@ This topic provides instructions on how to run the tool via Live Response. * Microsoft Defender ATP client sensor logs only: [LiveAnalyzer.ps1 script](https://aka.ms/MDATPLiveAnalyzer). - Result package approximate size: ~100Kb * Microsoft Defender ATP client sensor and Antivirus logs: [LiveAnalyzer+MDAV.ps1 script](https://aka.ms/MDATPLiveAnalyzerAV). - - Result package approximate size: ~10Mb + - Result package approximate size: ~10Mb 2. Initiate a [Live Response session](live-response.md#initiate-a-live-response-session-on-a-device) on the machine you need to investigate. From 599f955b7f139d7a7962960285159ad66304b420 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 23 Sep 2020 13:48:07 -0700 Subject: [PATCH 14/20] Formatting fixes in the large note block --- .../troubleshoot-collect-support-log.md | 22 +++++++++++-------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md index b00bda81b5..5bba7c5ab6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md @@ -51,7 +51,7 @@ This topic provides instructions on how to run the tool via Live Response. 6. While still in the LiveResponse session, use the commands below to run the analyzer and collect the result file: - ``` + ```console Run MDATPLiveAnalyzer.ps1 GetFile "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Downloads\MDATPClientAnalyzerResult.zip" -auto ``` @@ -60,12 +60,16 @@ This topic provides instructions on how to run the tool via Live Response. >[!NOTE] ->- The latest preview version of MDATPClientAnalyzer can be downloaded [here](https://aka.ms/Betamdatpanalyzer).
->- The LiveAnalyzer script downloads the troubleshooting package on the destination machine from: https://mdatpclientanalyzer.blob.core.windows.net.
-> If you cannot allow the machine to reach the above URL, then upload MDATPClientAnalyzerPreview.zip file to the library before running the LiveAnalyzer script: ->``` ->PutFile MDATPClientAnalyzerPreview.zip -overwrite ->Run MDATPLiveAnalyzer.ps1 ->GetFile "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Downloads\MDATPClientAnalyzerResult.zip" -auto ->``` +>- The latest preview version of MDATPClientAnalyzer can be downloaded here: [https://aka.ms/Betamdatpanalyzer](https://aka.ms/Betamdatpanalyzer). +> +>- The LiveAnalyzer script downloads the troubleshooting package on the destination machine from: https://mdatpclientanalyzer.blob.core.windows.net. +> +> If you cannot allow the machine to reach the above URL, then upload MDATPClientAnalyzerPreview.zip file to the library before running the LiveAnalyzer script: +> +> ```console +> PutFile MDATPClientAnalyzerPreview.zip -overwrite +> Run MDATPLiveAnalyzer.ps1 +> GetFile "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Downloads\MDATPClientAnalyzerResult.zip" -auto +> ``` +> > - For more information on gathering data locally on a machine in case the machine isn't communicating with Microsoft Defender ATP cloud services, or does not appear in MDATP portal as expected, see [Verify client connectivity to Microsoft Defender ATP service URLs](configure-proxy-internet.md#verify-client-connectivity-to-microsoft-defender-atp-service-urls). From 2073a13218f055eeb8cf434e8c0be846148e0474 Mon Sep 17 00:00:00 2001 From: Louie Mayor Date: Wed, 23 Sep 2020 14:21:29 -0700 Subject: [PATCH 15/20] Limits, errors, toc --- windows/security/threat-protection/TOC.md | 20 ++++---- .../advanced-hunting-errors.md | 38 +++++++++++++++ .../advanced-hunting-limits.md | 48 +++++++++++++++++++ .../advanced-hunting-overview.md | 14 ++++-- 4 files changed, 107 insertions(+), 13 deletions(-) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-errors.md create mode 100644 windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-limits.md diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 53f7819631..0c329e0e19 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -367,12 +367,6 @@ ##### [Threat protection reports](microsoft-defender-atp/threat-protection-reports.md) #### [Device health and compliance reports](microsoft-defender-atp/machine-reports.md) - -#### [Custom detections]() -##### [Custom detections overview](microsoft-defender-atp/overview-custom-detections.md) -##### [Create detection rules](microsoft-defender-atp/custom-detection-rules.md) -##### [View & manage detection rules](microsoft-defender-atp/custom-detections-manage.md) - ### [Behavioral blocking and containment]() #### [Behavioral blocking and containment](microsoft-defender-atp/behavioral-blocking-containment.md) #### [Client behavioral blocking](microsoft-defender-atp/client-behavioral-blocking.md) @@ -385,9 +379,14 @@ ### [Advanced hunting]() #### [Advanced hunting overview](microsoft-defender-atp/advanced-hunting-overview.md) -#### [Learn the query language](microsoft-defender-atp/advanced-hunting-query-language.md) +#### [Learn, train, & get examples]() +##### [Learn the query language](microsoft-defender-atp/advanced-hunting-query-language.md) +##### [Use shared queries](microsoft-defender-atp/advanced-hunting-shared-queries.md) #### [Work with query results](microsoft-defender-atp/advanced-hunting-query-results.md) -#### [Use shared queries](microsoft-defender-atp/advanced-hunting-shared-queries.md) +#### [Optimize & handle errors]() +##### [Apply query best practices](microsoft-defender-atp/advanced-hunting-best-practices.md) +##### [Handle errors](microsoft-defender-atp/advanced-hunting-errors.md) +##### [Service limits](microsoft-defender-atp/advanced-hunting-limits.md) #### [Advanced hunting schema reference]() ##### [Understand the schema](microsoft-defender-atp/advanced-hunting-schema-reference.md) ##### [DeviceAlertEvents](microsoft-defender-atp/advanced-hunting-devicealertevents-table.md) @@ -405,7 +404,10 @@ ##### [DeviceTvmSoftwareVulnerabilitiesKB](microsoft-defender-atp/advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md) ##### [DeviceTvmSecureConfigurationAssessment](microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessment-table.md) ##### [DeviceTvmSecureConfigurationAssessmentKB](microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessmentkb-table.md) -#### [Apply query best practices](microsoft-defender-atp/advanced-hunting-best-practices.md) +#### [Custom detections]() +##### [Custom detections overview](microsoft-defender-atp/overview-custom-detections.md) +##### [Create detection rules](microsoft-defender-atp/custom-detection-rules.md) +##### [View & manage detection rules](microsoft-defender-atp/custom-detections-manage.md) ### [Microsoft Threat Experts](microsoft-defender-atp/microsoft-threat-experts.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-errors.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-errors.md new file mode 100644 index 0000000000..04da6314b5 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-errors.md @@ -0,0 +1,38 @@ +--- +title: Handle errors in advanced hunting for Microsoft Threat Protection +description: Understand errors displayed when using advanced hunting +keywords: advanced hunting, threat hunting, cyber threat hunting, microsoft threat protection, microsoft 365, mtp, m365, search, query, telemetry, schema, kusto, timeout, resources, errors, unknown error +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: lomayor +author: lomayor +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +--- + +# Handle advanced hunting errors + +Advanced hunting displays errors to notify for syntax mistakes and whenever queries hit [predefined limits](advanced-hunting-limits.md). Refer to the table below for tips on how to resolve or avoid errors. + +| Error type | Cause | Resolution | Error message examples | +|--|--|--|--| +| Syntax errors | The query contains unrecognized names, including references to nonexistent operators, columns, functions, or tables. | Ensure references to [Kusto operators and functions](https://docs.microsoft.com/azure/data-explorer/kusto/query/) are correct. Check [the schema](advanced-hunting-schema-reference.md) for the correct advanced hunting columns, functions, and tables. Enclose variable strings in quotes so they are recognized. While writing your queries, use the autocomplete suggestions from IntelliSense. | `A recognition error occurred.` | +| Semantic errors | While the query uses valid operator, column, function, or table names, there are errors in its structure and resulting logic. In some cases, advanced hunting identifies the specific operator that caused the error. | Check for errors in the structure of query. Refer to [Kusto documentation](https://docs.microsoft.com/azure/data-explorer/kusto/query/) for guidance. While writing your queries, use the autocomplete suggestions from IntelliSense. | `'project' operator: Failed to resolve scalar expression named 'x'`| +| Timeouts | A query can only run within a [limited period before timing out](advanced-hunting-limits.md). This error can happen more frequently when running complex queries. | [Optimize the query](advanced-hunting-best-practices.md) | `Query exceeded the timeout period.` | +| CPU throttling | Queries in the same tenant have exceeded the [CPU resources](advanced-hunting-limits.md) that have been allocated based on tenant size. | The service checks CPU resource usage every 15 minutes and daily and displays warnings after usage exceeds 10% of the allocated limit. If you reach 100% utilization, the service blocks queries until after the next daily or 15-minute cycle. [Optimize your queries to avoid hitting CPU limits](advanced-hunting-best-practices.md) | - `This query used X% of your organization's allocated resources for the current 15 minutes.`
- `You have exceeded processing resources allocated to this tenant. You can run queries again in .` | +| Result size limit exceeded | The aggregate size of the result set for the query has exceeded the maximum limit. This error can occur if the result set is so large that truncation at the 10,000-record limit can't reduce it to an acceptable size. Results that have multiple columns with sizable content are more likely to be impacted by this error. | [Optimize the query](advanced-hunting-best-practices.md) | `Result size limit exceeded. Use "summarize" to aggregate results, "project" to drop uninteresting columns, or "take" to truncate results.` | +| Excessive resource consumption | The query has consumed excessive amounts of resources and has been stopped from completing. In some cases, advanced hunting identifies the specific operator that wasn't optimized. | [Optimize the query](advanced-hunting-best-practices.md) | -`Query stopped due to excessive resource consumption.`
-`Query stopped. Adjust use of the operator to avoid excessive resource consumption.` | +| Unknown errors | The query failed because of an unknown reason. | Try running the query again. Contact Microsoft through the portal if queries continue to return unknown errors. | `An unexpected error occurred during query execution. Please try again in a few minutes.` + +## Related topics +- [Advanced hunting best practices](advanced-hunting-best-practices.md) +- [Service limits](advanced-hunting-limits.md) +- [Understand the schema](advanced-hunting-schema-reference.md) +- [Kusto Query Language overview](https://docs.microsoft.com/azure/data-explorer/kusto/query/) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-limits.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-limits.md new file mode 100644 index 0000000000..417da3181b --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-limits.md @@ -0,0 +1,48 @@ +--- +title: Advanced hunting limits in Microsoft Defender ATP +description: Understand various service limits that keep the advanced hunting service responsive +keywords: advanced hunting, threat hunting, cyber threat hunting, microsoft threat protection, microsoft 365, mtp, m365, search, query, telemetry, schema, kusto, CPU limit, query limit, resources, maximum results +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: lomayor +author: lomayor +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +--- + +# Advanced hunting service limits + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink) + +To keep the service performant and responsive, advanced hunting sets various limits for queries run manually and by [custom detection rules](custom-detection-rules.md). Refer to the following table to understand these limits. + +| Limit | Size | Refresh cycle | Description | +|--|--|--|--| +| Data range | 30 days | Every query | Each query can look up data from up to the past 30 days. | +| Result set | 10,000 rows | Every query | Each query can return up to 10,000 records. | +| Timeout | 10 minutes | Every query | Each query can run for up to 10 minutes. If it does not complete within 10 minutes, the service displays an error. +| CPU resources | Based on tenant size | - On the hour and then every 15 minutes
- Daily at 12 midnight | The service enforces the daily and the 15-minute limit separately. For each limit, the [portal displays an error](advanced-hunting-errors.md) whenever a query runs and the tenant has consumed over 10% of allocated resources. Queries are blocked if the tenant has reached 100% until after the next daily or 15-minute cycle. | + +>[!NOTE] +>A separate set of limits apply to advanced hunting queries performed through the API. [Read about advanced hunting APIs](run-advanced-query-api.md) + +Customers who run multiple queries regularly should track consumption and [apply optimization best practices](advanced-hunting-best-practices.md) to minimize disruption resulting from exceeding these limits. + +## Related topics + +- [Advanced hunting best practices](advanced-hunting-best-practices.md) +- [Handle advanced hunting errors](advanced-hunting-errors.md) +- [Advanced hunting overview](advanced-hunting-overview.md) +- [Custom detections rules](custom-detection-rules.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md index a34a79ae55..de1e7d598a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md @@ -30,6 +30,9 @@ Advanced hunting is a query-based threat-hunting tool that lets you explore raw You can use the same threat-hunting queries to build custom detection rules. These rules run automatically to check for and respond to various events and system states, including suspected breach activity and misconfigured devices. +>[!TIP] +>Use [advanced hunting in Microsoft Threat Protection](https://docs.microsoft.com/microsoft-365/security/mtp/advanced-hunting-overview) to hunt for threats using data from Microsoft Defender ATP, Office 365 ATP, Microsoft Cloud App Security, and Azure ATP. [Turn on Microsoft Threat Protection](https://docs.microsoft.com/microsoft-365/security/mtp/mtp-enable) + ## Get started with advanced hunting Watch this video for a quick overview of advanced hunting and a short tutorial that will get you started fast.

@@ -38,13 +41,16 @@ Watch this video for a quick overview of advanced hunting and a short tutorial t You can also go through each of the following steps to ramp up your advanced hunting knowledge. +We recommend going through several steps to quickly get up and running with advanced hunting. + | Learning goal | Description | Resource | |--|--|--| -| **Get a feel for the language** | Advanced hunting is based on the [Kusto query language](https://docs.microsoft.com/azure/kusto/query/), supporting the same syntax and operators. Start learning the query language by running your first query. | [Query language overview](advanced-hunting-query-language.md) | +| **Learn the language** | Advanced hunting is based on [Kusto query language](https://docs.microsoft.com/azure/kusto/query/), supporting the same syntax and operators. Start learning the query language by running your first query. | [Query language overview](advanced-hunting-query-language.md) | | **Learn how to use the query results** | Learn about charts and various ways you can view or export your results. Explore how you can quickly tweak queries and drill down to get richer information. | [Work with query results](advanced-hunting-query-results.md) | -| **Understand the schema** | Get a good, high-level understanding of the tables in the schema and their columns. This will help you determine where to look for data and how to construct your queries. | [Schema reference](advanced-hunting-schema-reference.md) | +| **Understand the schema** | Get a good, high-level understanding of the tables in the schema and their columns. Learn where to look for data when constructing your queries. | [Schema reference](advanced-hunting-schema-reference.md) | | **Use predefined queries** | Explore collections of predefined queries covering different threat hunting scenarios. | [Shared queries](advanced-hunting-shared-queries.md) | -| **Learn about custom detections** | Understand how you can use advanced hunting queries to trigger alerts and apply response actions automatically. | - [Custom detections overview](overview-custom-detections.md)
- [Custom detection rules](custom-detection-rules.md) | +| **Optimize queries and handle errors** | Understand how to create efficient and error-free queries. | - [Query best practices](advanced-hunting-best-practices.md)
- [Handle errors](advanced-hunting-errors.md) | +| **Create custom detection rules** | Understand how you can use advanced hunting queries to trigger alerts and take response actions automatically. | - [Custom detections overview](overview-custom-detections.md)
- [Custom detection rules](custom-detection-rules.md) | ## Data freshness and update frequency Advanced hunting data can be categorized into two distinct types, each consolidated differently: @@ -61,4 +67,4 @@ All time information in advanced hunting is currently in the UTC time zone. - [Use shared queries](advanced-hunting-shared-queries.md) - [Understand the schema](advanced-hunting-schema-reference.md) - [Apply query best practices](advanced-hunting-best-practices.md) -- [Custom detections overview](overview-custom-detections.md) +- [Custom detections overview](overview-custom-detections.md) \ No newline at end of file From 2c29fd0f8713339b2b8b1891eb0880a1723c7cf2 Mon Sep 17 00:00:00 2001 From: Louie Mayor Date: Wed, 23 Sep 2020 14:22:10 -0700 Subject: [PATCH 16/20] Update TOC.md --- windows/security/threat-protection/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 0c329e0e19..5f2416539d 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -387,7 +387,7 @@ ##### [Apply query best practices](microsoft-defender-atp/advanced-hunting-best-practices.md) ##### [Handle errors](microsoft-defender-atp/advanced-hunting-errors.md) ##### [Service limits](microsoft-defender-atp/advanced-hunting-limits.md) -#### [Advanced hunting schema reference]() +#### [Data schema]() ##### [Understand the schema](microsoft-defender-atp/advanced-hunting-schema-reference.md) ##### [DeviceAlertEvents](microsoft-defender-atp/advanced-hunting-devicealertevents-table.md) ##### [DeviceFileEvents](microsoft-defender-atp/advanced-hunting-devicefileevents-table.md) From 65d749f97aa4586b6428fbae846f84328756ba2e Mon Sep 17 00:00:00 2001 From: Louie Mayor Date: Wed, 23 Sep 2020 14:30:38 -0700 Subject: [PATCH 17/20] Update advanced-hunting-overview.md --- .../advanced-hunting-overview.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md index de1e7d598a..576f8e6c89 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md @@ -26,9 +26,9 @@ ms.topic: article >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink) -Advanced hunting is a query-based threat-hunting tool that lets you explore raw data for the last 30 days. You can proactively inspect events in your network to locate interesting indicators and entities. The flexible access to data facilitates unconstrained hunting for both known and potential threats. +Advanced hunting is a query-based threat-hunting tool that lets you explore up to 30 days of raw data. You can proactively inspect events in your network to locate threat indicators and entities. The flexible access to data enables unconstrained hunting for both known and potential threats. -You can use the same threat-hunting queries to build custom detection rules. These rules run automatically to check for and respond to various events and system states, including suspected breach activity and misconfigured devices. +You can use the same threat-hunting queries to build custom detection rules. These rules run automatically to check for and then respond to suspected breach activity, misconfigured machines, and other findings. >[!TIP] >Use [advanced hunting in Microsoft Threat Protection](https://docs.microsoft.com/microsoft-365/security/mtp/advanced-hunting-overview) to hunt for threats using data from Microsoft Defender ATP, Office 365 ATP, Microsoft Cloud App Security, and Azure ATP. [Turn on Microsoft Threat Protection](https://docs.microsoft.com/microsoft-365/security/mtp/mtp-enable) @@ -53,13 +53,13 @@ We recommend going through several steps to quickly get up and running with adva | **Create custom detection rules** | Understand how you can use advanced hunting queries to trigger alerts and take response actions automatically. | - [Custom detections overview](overview-custom-detections.md)
- [Custom detection rules](custom-detection-rules.md) | ## Data freshness and update frequency -Advanced hunting data can be categorized into two distinct types, each consolidated differently: +Advanced hunting data can be categorized into two distinct types, each consolidated differently. - **Event or activity data**—populates tables about alerts, security events, system events, and routine assessments. Advanced hunting receives this data almost immediately after the sensors that collect them successfully transmit them to Microsoft Defender ATP. -- **Entity data**—populates tables with consolidated information about users and devices. To provide fresh data, tables are updated every 15 minutes with any new information, adding rows that might not be fully populated. Every 24 hours, data is consolidated to insert a record that contains the latest, most comprehensive data set about each entity. +- **Entity data**—populates tables with consolidated information about users and devices. This data comes from both relatively static data sources and dynamic sources, such as Active Directory entries and event logs. To provide fresh data, tables are updated with any new information every 15 minutes, adding rows that might not be fully populated. Every 24 hours, data is consolidated to insert a record that contains the latest, most comprehensive data set about each entity. ## Time zone -All time information in advanced hunting is currently in the UTC time zone. +Time information in advanced hunting is currently in the UTC time zone. ## Related topics - [Learn the query language](advanced-hunting-query-language.md) From 8a928a7da9b89d1b3255b76be3e55c6c470d5383 Mon Sep 17 00:00:00 2001 From: Louie Mayor Date: Wed, 23 Sep 2020 14:35:18 -0700 Subject: [PATCH 18/20] Update advanced-hunting-errors.md --- .../microsoft-defender-atp/advanced-hunting-errors.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-errors.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-errors.md index 04da6314b5..a1c467b53d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-errors.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-errors.md @@ -19,6 +19,14 @@ ms.topic: article # Handle advanced hunting errors +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink) + + Advanced hunting displays errors to notify for syntax mistakes and whenever queries hit [predefined limits](advanced-hunting-limits.md). Refer to the table below for tips on how to resolve or avoid errors. | Error type | Cause | Resolution | Error message examples | @@ -35,4 +43,4 @@ Advanced hunting displays errors to notify for syntax mistakes and whenever quer - [Advanced hunting best practices](advanced-hunting-best-practices.md) - [Service limits](advanced-hunting-limits.md) - [Understand the schema](advanced-hunting-schema-reference.md) -- [Kusto Query Language overview](https://docs.microsoft.com/azure/data-explorer/kusto/query/) +- [Kusto Query Language overview](https://docs.microsoft.com/azure/data-explorer/kusto/query/) \ No newline at end of file From de055e12d695ca58fa2947af7a1beb2677032d0d Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 23 Sep 2020 14:36:33 -0700 Subject: [PATCH 19/20] Second attempt to fix indentation --- .../troubleshoot-collect-support-log.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md index 5bba7c5ab6..eecaf63643 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md @@ -60,16 +60,16 @@ This topic provides instructions on how to run the tool via Live Response. >[!NOTE] ->- The latest preview version of MDATPClientAnalyzer can be downloaded here: [https://aka.ms/Betamdatpanalyzer](https://aka.ms/Betamdatpanalyzer). +> - The latest preview version of MDATPClientAnalyzer can be downloaded here: [https://aka.ms/Betamdatpanalyzer](https://aka.ms/Betamdatpanalyzer). > ->- The LiveAnalyzer script downloads the troubleshooting package on the destination machine from: https://mdatpclientanalyzer.blob.core.windows.net. +> - The LiveAnalyzer script downloads the troubleshooting package on the destination machine from: https://mdatpclientanalyzer.blob.core.windows.net. > -> If you cannot allow the machine to reach the above URL, then upload MDATPClientAnalyzerPreview.zip file to the library before running the LiveAnalyzer script: +> If you cannot allow the machine to reach the above URL, then upload MDATPClientAnalyzerPreview.zip file to the library before running the LiveAnalyzer script: > -> ```console -> PutFile MDATPClientAnalyzerPreview.zip -overwrite -> Run MDATPLiveAnalyzer.ps1 -> GetFile "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Downloads\MDATPClientAnalyzerResult.zip" -auto -> ``` +> ```console +> PutFile MDATPClientAnalyzerPreview.zip -overwrite +> Run MDATPLiveAnalyzer.ps1 +> GetFile "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Downloads\MDATPClientAnalyzerResult.zip" -auto +> ``` > > - For more information on gathering data locally on a machine in case the machine isn't communicating with Microsoft Defender ATP cloud services, or does not appear in MDATP portal as expected, see [Verify client connectivity to Microsoft Defender ATP service URLs](configure-proxy-internet.md#verify-client-connectivity-to-microsoft-defender-atp-service-urls). From 77687c2d209b3b55d35c59ac278cd194f22883be Mon Sep 17 00:00:00 2001 From: Louie Mayor Date: Wed, 23 Sep 2020 14:43:01 -0700 Subject: [PATCH 20/20] Meta fixes --- .../microsoft-defender-atp/advanced-hunting-errors.md | 4 ++-- .../microsoft-defender-atp/advanced-hunting-limits.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-errors.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-errors.md index a1c467b53d..092f10cf8f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-errors.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-errors.md @@ -1,7 +1,7 @@ --- -title: Handle errors in advanced hunting for Microsoft Threat Protection +title: Handle errors in advanced hunting for Microsoft Defender ATP description: Understand errors displayed when using advanced hunting -keywords: advanced hunting, threat hunting, cyber threat hunting, microsoft threat protection, microsoft 365, mtp, m365, search, query, telemetry, schema, kusto, timeout, resources, errors, unknown error +keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, microsoft defender atp, wdatp, m365, search, query, telemetry, schema, kusto, timeout, resources, errors, unknown error search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-limits.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-limits.md index 417da3181b..66e8db56e7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-limits.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-limits.md @@ -1,7 +1,7 @@ --- title: Advanced hunting limits in Microsoft Defender ATP description: Understand various service limits that keep the advanced hunting service responsive -keywords: advanced hunting, threat hunting, cyber threat hunting, microsoft threat protection, microsoft 365, mtp, m365, search, query, telemetry, schema, kusto, CPU limit, query limit, resources, maximum results +keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, microsoft defender atp, wdatp, search, query, telemetry, schema, kusto, CPU limit, query limit, resources, maximum results search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10